Skip to content

Commit 1c3df16

Browse files
dgarskedgarske
authored
Merge pull request #104 from LinuxJedi/fix-jenkins
Fix issues found by Jenkins FIPS test
2 parents 0a9aaf0 + c7885a2 commit 1c3df16

4 files changed

Lines changed: 64 additions & 33 deletions

File tree

‎examples/add_cert_file.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ static CK_RV load_cert(char* filename, unsigned char **certData,
148148
CK_ULONG *certDataLen)
149149
{
150150
int ret = 0;
151-
unsigned char *buffer;
151+
unsigned char *buffer = NULL;
152152
int len;
153153
XFILE file;
154154

‎src/internal.c‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9269,19 +9269,43 @@ int WP11_EC_Derive(unsigned char* point, word32 pointLen, unsigned char* key,
92699269
{
92709270
int ret;
92719271
ecc_key pubKey;
9272+
unsigned char* x963Data = point;
9273+
word32 x963Len = pointLen;
9274+
int dataLen;
9275+
int i = 0;
92729276
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
92739277
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION > 2)))
92749278
WC_RNG rng;
92759279
#endif
92769280

9281+
/* Check if the point data is DER-encoded (starts with OCTET STRING tag) */
9282+
if (pointLen >= 3 && point[0] == ASN_OCTET_STRING) {
9283+
/* Strip DER encoding - similar to EcSetPoint function */
9284+
i = 1;
9285+
if (point[i] >= ASN_LONG_LENGTH) {
9286+
if (point[i] == (ASN_LONG_LENGTH | 1)) {
9287+
i++;
9288+
}
9289+
else {
9290+
ret = ASN_PARSE_E;
9291+
goto cleanup;
9292+
}
9293+
}
9294+
dataLen = point[i++];
9295+
if (dataLen == (int)(pointLen - i)) {
9296+
x963Data = point + i;
9297+
x963Len = dataLen;
9298+
}
9299+
}
9300+
92779301
ret = wc_ecc_init_ex(&pubKey, NULL, priv->slot->devId);
92789302
if (ret == 0) {
92799303
if (priv->data.ecKey.dp) {
9280-
ret = wc_ecc_import_x963_ex(point, pointLen, &pubKey,
9304+
ret = wc_ecc_import_x963_ex(x963Data, x963Len, &pubKey,
92819305
priv->data.ecKey.dp->id);
92829306
}
92839307
else {
9284-
ret = wc_ecc_import_x963(point, pointLen, &pubKey);
9308+
ret = wc_ecc_import_x963(x963Data, x963Len, &pubKey);
92859309
}
92869310
}
92879311
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
@@ -9305,6 +9329,7 @@ int WP11_EC_Derive(unsigned char* point, word32 pointLen, unsigned char* key,
93059329
#endif
93069330
}
93079331

9332+
cleanup:
93089333
wc_ecc_free(&pubKey);
93099334

93109335
return ret;

‎tests/pkcs11test.c‎

Lines changed: 32 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -10146,12 +10146,14 @@ static CK_RV test_tls_mac_tls_prf(void* args)
1014610146
CK_RV ret;
1014710147
CK_OBJECT_HANDLE key;
1014810148
static unsigned char keyData[] = {
10149-
0x74, 0x9A, 0xBD, 0xAA, 0x2A, 0x52, 0x07, 0x47,
10150-
0xD6, 0xA6, 0x36, 0xB2, 0x07, 0x32, 0x8E, 0xD0,
10149+
0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
10150+
0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00,
10151+
0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
10152+
0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00
1015110153
};
1015210154
static unsigned char exp[] = {
10153-
0x17, 0x74, 0x60, 0x8b, 0x2c, 0x7d, 0x75, 0x60,
10154-
0xe7, 0x2d, 0xef, 0x6c
10155+
0xda, 0x00, 0x2c, 0x57, 0xfc, 0x41, 0xdb, 0xb5,
10156+
0x34, 0x04, 0x07, 0xdc
1015510157
};
1015610158

1015710159
ret = get_generic_key(session, keyData, sizeof(keyData), CK_FALSE, &key);
@@ -11693,26 +11695,26 @@ static CK_RV test_hkdf_derive_extract_then_expand_salt_data(void* args)
1169311695

1169411696
CK_BYTE salt_bytes[] = {
1169511697
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
11696-
0x08, 0x09, 0x0a, 0x0b, 0x0c
11698+
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
1169711699
};
1169811700
CK_BYTE expected_prk[] = {
11699-
0x07, 0x77, 0x09, 0x36, 0x2c, 0x2e, 0x32, 0xdf,
11700-
0x0d, 0xdc, 0x3f, 0x0d, 0xc4, 0x7b, 0xba, 0x63,
11701-
0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31,
11702-
0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5
11701+
0x77, 0x9e, 0x31, 0x7a, 0x04, 0x47, 0xae, 0x12,
11702+
0x06, 0x79, 0xa6, 0x78, 0x6d, 0x66, 0x6d, 0x95,
11703+
0x75, 0x14, 0x0e, 0x73, 0xbc, 0xa2, 0xcc, 0xde,
11704+
0xb0, 0xc1, 0xe5, 0x50, 0xdc, 0xd7, 0x62, 0x31
1170311705
};
1170411706
CK_BYTE ikm_tc1_hex[] = {
1170511707
0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
1170611708
0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
1170711709
0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b
1170811710
};
1170911711
CK_BYTE expected_okm[] = {
11710-
0x3c, 0xb2, 0x5f, 0x25, 0xfa, 0xac, 0xd5, 0x7a,
11711-
0x90, 0x43, 0x4f, 0x64, 0xd0, 0x36, 0x2f, 0x2a,
11712-
0x2d, 0x2d, 0x0a, 0x90, 0xcf, 0x1a, 0x5a, 0x4c,
11713-
0x5d, 0xb0, 0x2d, 0x56, 0xec, 0xc4, 0xc5, 0xbf,
11714-
0x34, 0x00, 0x72, 0x08, 0xd5, 0xb8, 0x87, 0x18,
11715-
0x58, 0x65
11712+
0xdb, 0x32, 0x19, 0x87, 0x36, 0xee, 0x02, 0x1e,
11713+
0x65, 0x8c, 0xcc, 0xa7, 0xd6, 0x21, 0xc5, 0xe7,
11714+
0x9e, 0x81, 0xda, 0x48, 0xc6, 0xa3, 0x6c, 0x8b,
11715+
0x41, 0x2b, 0xce, 0xbe, 0x5e, 0x86, 0xf1, 0xc1,
11716+
0x83, 0x7b, 0xf5, 0xa4, 0xf5, 0x94, 0xe3, 0x37,
11717+
0x33, 0xb8
1171611718
};
1171711719
CK_BYTE info_bytes[] = {
1171811720
0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
@@ -11873,7 +11875,7 @@ static CK_RV test_hkdf_derive_extract_then_expand_salt_data(void* args)
1187311875
}
1187411876

1187511877
if (ret == CKR_OK) {
11876-
if (XMEMCMP(expected_okm, derived_value2, sizeof(expected_prk))) {
11878+
if (XMEMCMP(expected_okm, derived_value2, sizeof(expected_okm))) {
1187711879
ret = CKR_DATA_INVALID;
1187811880
CHECK_CKR(ret, "Derived PRK doesn't match");
1187911881
}
@@ -11891,15 +11893,15 @@ static CK_RV test_hkdf_derive_extract_with_expand_salt_data(void* args)
1189111893

1189211894
CK_BYTE salt_bytes[] = {
1189311895
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
11894-
0x08, 0x09, 0x0a, 0x0b, 0x0c
11896+
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
1189511897
};
1189611898
CK_BYTE expected_okm[] = {
11897-
0x3c, 0xb2, 0x5f, 0x25, 0xfa, 0xac, 0xd5, 0x7a,
11898-
0x90, 0x43, 0x4f, 0x64, 0xd0, 0x36, 0x2f, 0x2a,
11899-
0x2d, 0x2d, 0x0a, 0x90, 0xcf, 0x1a, 0x5a, 0x4c,
11900-
0x5d, 0xb0, 0x2d, 0x56, 0xec, 0xc4, 0xc5, 0xbf,
11901-
0x34, 0x00, 0x72, 0x08, 0xd5, 0xb8, 0x87, 0x18,
11902-
0x58, 0x65
11899+
0xdb, 0x32, 0x19, 0x87, 0x36, 0xee, 0x02, 0x1e,
11900+
0x65, 0x8c, 0xcc, 0xa7, 0xd6, 0x21, 0xc5, 0xe7,
11901+
0x9e, 0x81, 0xda, 0x48, 0xc6, 0xa3, 0x6c, 0x8b,
11902+
0x41, 0x2b, 0xce, 0xbe, 0x5e, 0x86, 0xf1, 0xc1,
11903+
0x83, 0x7b, 0xf5, 0xa4, 0xf5, 0x94, 0xe3, 0x37,
11904+
0x33, 0xb8
1190311905
};
1190411906
CK_BYTE info_bytes[] = {
1190511907
0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
@@ -12130,16 +12132,16 @@ static CK_RV test_hkdf_derive_extract_with_expand_salt_key(void* args)
1213012132

1213112133
CK_BYTE salt_bytes[] = {
1213212134
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
12133-
0x08, 0x09, 0x0a, 0x0b, 0x0c
12135+
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
1213412136
};
1213512137
CK_ULONG salt_bytes_len = sizeof(salt_bytes);
1213612138
CK_BYTE expected_okm[] = {
12137-
0x3c, 0xb2, 0x5f, 0x25, 0xfa, 0xac, 0xd5, 0x7a,
12138-
0x90, 0x43, 0x4f, 0x64, 0xd0, 0x36, 0x2f, 0x2a,
12139-
0x2d, 0x2d, 0x0a, 0x90, 0xcf, 0x1a, 0x5a, 0x4c,
12140-
0x5d, 0xb0, 0x2d, 0x56, 0xec, 0xc4, 0xc5, 0xbf,
12141-
0x34, 0x00, 0x72, 0x08, 0xd5, 0xb8, 0x87, 0x18,
12142-
0x58, 0x65
12139+
0xdb, 0x32, 0x19, 0x87, 0x36, 0xee, 0x02, 0x1e,
12140+
0x65, 0x8c, 0xcc, 0xa7, 0xd6, 0x21, 0xc5, 0xe7,
12141+
0x9e, 0x81, 0xda, 0x48, 0xc6, 0xa3, 0x6c, 0x8b,
12142+
0x41, 0x2b, 0xce, 0xbe, 0x5e, 0x86, 0xf1, 0xc1,
12143+
0x83, 0x7b, 0xf5, 0xa4, 0xf5, 0x94, 0xe3, 0x37,
12144+
0x33, 0xb8
1214312145
};
1214412146
CK_BYTE info_bytes[] = {
1214512147
0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,

‎wolfpkcs11/internal.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,10 @@
3535
#include <wolfpkcs11/pkcs11.h>
3636
#include <wolfpkcs11/version.h>
3737

38+
#ifdef HAVE_FIPS
39+
#define NO_MD5
40+
#endif
41+
3842
/* store requires AES */
3943
#ifdef NO_AES
4044
#undef WOLFPKCS11_NO_STORE

0 commit comments

Comments
 (0)