Skip to content

Commit 35c05a5

Browse files
ColtonWilleyColtonWilley
committed
Optimize FIPS CAST startup tests witj per algo mutex handling for thread safe lazy CAST
1 parent 44d52b7 commit 35c05a5

16 files changed

Lines changed: 399 additions & 33 deletions

‎include/wolfprovider/internal.h‎

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,51 @@ int wp_provctx_lock_rng(WOLFPROV_CTX* provCtx);
162162
void wp_provctx_unlock_rng(WOLFPROV_CTX* provCtx);
163163

164164
#ifdef HAVE_FIPS
165-
wolfSSL_Mutex *wp_get_cast_mutex(void);
165+
/* CAST self-test algorithm categories */
166+
#define WP_CAST_ALGO_AES 0
167+
#define WP_CAST_ALGO_HMAC 1
168+
#define WP_CAST_ALGO_DRBG 2
169+
#define WP_CAST_ALGO_RSA 3
170+
#define WP_CAST_ALGO_ECDSA 4
171+
#define WP_CAST_ALGO_ECDH 5
172+
#define WP_CAST_ALGO_DH 6
173+
#define WP_CAST_ALGO_COUNT 7
174+
175+
wolfSSL_Mutex *wp_get_cast_mutex(int algo);
176+
int wp_get_cast_init(int algo);
177+
void wp_set_cast_init(int algo, int init);
178+
int wp_init_cast(int algo);
179+
180+
/**
181+
* Check FIPS CAST for algorithm. Returns 0 on failure.
182+
* Use at function entry points that return int (1=success, 0=failure).
183+
*/
184+
#define WP_CHECK_FIPS_ALGO(algo) \
185+
do { \
186+
if (wp_init_cast(algo) != 1) { \
187+
WOLFPROV_ERROR_MSG(WP_LOG_COMP_PROVIDER, \
188+
"FIPS CAST initialization failed"); \
189+
return 0; \
190+
} \
191+
} while (0)
192+
193+
/**
194+
* Check FIPS CAST for algorithm. Returns NULL on failure.
195+
* Use at function entry points that return pointers (NULL=failure).
196+
*/
197+
#define WP_CHECK_FIPS_ALGO_PTR(algo) \
198+
do { \
199+
if (wp_init_cast(algo) != 1) { \
200+
WOLFPROV_ERROR_MSG(WP_LOG_COMP_PROVIDER, \
201+
"FIPS CAST initialization failed"); \
202+
return NULL; \
203+
} \
204+
} while (0)
205+
206+
#else
207+
/* Non-FIPS: no-op */
208+
#define WP_CHECK_FIPS_ALGO(algo) do { } while (0)
209+
#define WP_CHECK_FIPS_ALGO_PTR(algo) do { } while (0)
166210
#endif
167211
#endif
168212

‎src/wp_aes_aead.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1022,6 +1022,9 @@ static int wp_aesgcm_einit(wp_AeadCtx* ctx, const unsigned char *key,
10221022
if (!wolfssl_prov_is_running()) {
10231023
ok = 0;
10241024
}
1025+
if (ok) {
1026+
WP_CHECK_FIPS_ALGO(WP_CAST_ALGO_AES);
1027+
}
10251028
#ifdef WOLFSSL_AESGCM_STREAM
10261029
if (ok) {
10271030
int rc;
@@ -1108,6 +1111,9 @@ static int wp_aesgcm_dinit(wp_AeadCtx *ctx, const unsigned char *key,
11081111
if (!wolfssl_prov_is_running()) {
11091112
ok = 0;
11101113
}
1114+
if (ok) {
1115+
WP_CHECK_FIPS_ALGO(WP_CAST_ALGO_AES);
1116+
}
11111117
#ifdef WOLFSSL_AESGCM_STREAM
11121118
if (ok && key != NULL) {
11131119
int rc = wc_AesGcmDecryptInit(aes, key, (word32)keyLen, iv, (word32)ivLen);
@@ -1754,6 +1760,9 @@ static int wp_aesccm_init(wp_AeadCtx* ctx, const unsigned char *key,
17541760
if (!wolfssl_prov_is_running()) {
17551761
ok = 0;
17561762
}
1763+
if (ok) {
1764+
WP_CHECK_FIPS_ALGO(WP_CAST_ALGO_AES);
1765+
}
17571766
if (ok && (key != NULL)) {
17581767
rc = wc_AesCcmSetKey(&ctx->aes, key, (word32)keyLen);
17591768
if (rc != 0) {

‎src/wp_aes_block.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,9 @@ static int wp_aes_block_init(wp_AesBlockCtx *ctx, const unsigned char *key,
328328
ok = 0;
329329
}
330330
if (ok) {
331-
int rc = wc_AesSetKey(&ctx->aes, key, (word32)ctx->keyLen, ctx->iv,
331+
int rc;
332+
WP_CHECK_FIPS_ALGO(WP_CAST_ALGO_AES);
333+
rc = wc_AesSetKey(&ctx->aes, key, (word32)ctx->keyLen, ctx->iv,
332334
enc ? AES_ENCRYPTION : AES_DECRYPTION);
333335
if (rc != 0) {
334336
WOLFPROV_MSG_DEBUG_RETCODE(WP_LOG_LEVEL_DEBUG, "wc_AesSetKey", rc);

‎src/wp_aes_stream.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -314,12 +314,14 @@ static int wp_aes_stream_init(wp_AesStreamCtx *ctx, const unsigned char *key,
314314
ok = 0;
315315
}
316316
if (ok) {
317+
int rc;
317318
#if defined(WP_HAVE_AESCTS)
318319
if (ctx->mode == EVP_CIPH_CBC_MODE && !enc) {
319320
dir = AES_DECRYPTION;
320321
}
321322
#endif
322-
int rc = wc_AesSetKey(&ctx->aes, key, (word32)ctx->keyLen, iv,
323+
WP_CHECK_FIPS_ALGO(WP_CAST_ALGO_AES);
324+
rc = wc_AesSetKey(&ctx->aes, key, (word32)ctx->keyLen, iv,
323325
dir);
324326
if (rc != 0) {
325327
WOLFPROV_MSG_DEBUG_RETCODE(WP_LOG_LEVEL_DEBUG, "wc_AesSetKey", rc);

‎src/wp_aes_wrap.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -266,7 +266,9 @@ static int wp_aes_wrap_init(wp_AesWrapCtx *ctx, const unsigned char *key,
266266
}
267267
if (ok) {
268268
#if LIBWOLFSSL_VERSION_HEX >= 0x05000000
269-
int rc = wc_AesSetKey(&ctx->aes, key, (word32)ctx->keyLen, iv,
269+
int rc;
270+
WP_CHECK_FIPS_ALGO(WP_CAST_ALGO_AES);
271+
rc = wc_AesSetKey(&ctx->aes, key, (word32)ctx->keyLen, iv,
270272
wrap ? AES_ENCRYPTION : AES_DECRYPTION);
271273
if (rc != 0) {
272274
WOLFPROV_MSG_DEBUG_RETCODE(WP_LOG_LEVEL_DEBUG, "wc_AesSetKey", rc);

‎src/wp_dh_kmgmt.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1156,6 +1156,9 @@ static int wp_dh_import(wp_Dh* dh, int selection, const OSSL_PARAM params[])
11561156
if (!wolfssl_prov_is_running()) {
11571157
ok = 0;
11581158
}
1159+
if (ok) {
1160+
WP_CHECK_FIPS_ALGO(WP_CAST_ALGO_DH);
1161+
}
11591162
if (ok && (dh == NULL)) {
11601163
ok = 0;
11611164
}
@@ -1832,6 +1835,8 @@ static wp_Dh* wp_dh_gen(wp_DhGenCtx *ctx, OSSL_CALLBACK *cb, void *cbArg)
18321835
(void)cb;
18331836
(void)cbArg;
18341837

1838+
WP_CHECK_FIPS_ALGO_PTR(WP_CAST_ALGO_DH);
1839+
18351840
/* Create a new DH key object to hold generated data. */
18361841
dh = wp_dh_new(ctx->provCtx);
18371842
if (dh != NULL) {
@@ -2064,6 +2069,8 @@ static int wp_dh_decode_spki(wp_Dh* dh, unsigned char* data, word32 len)
20642069

20652070
WOLFPROV_ENTER_SILENT(WP_LOG_COMP_DH, WOLFPROV_FUNC_NAME);
20662071

2072+
WP_CHECK_FIPS_ALGO(WP_CAST_ALGO_DH);
2073+
20672074
rc = wc_DhPublicKeyDecode(data, &idx, &dh->key, len);
20682075
if (rc != 0) {
20692076
ok = 0;
@@ -2127,6 +2134,8 @@ static int wp_dh_decode_pki(wp_Dh* dh, unsigned char* data, word32 len)
21272134

21282135
WOLFPROV_ENTER_SILENT(WP_LOG_COMP_DH, WOLFPROV_FUNC_NAME);
21292136

2137+
WP_CHECK_FIPS_ALGO(WP_CAST_ALGO_DH);
2138+
21302139
rc = wc_DhKeyDecode(data, &idx, &dh->key, len);
21312140
if (rc != 0) {
21322141
ok = 0;

‎src/wp_ecc_kmgmt.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1767,6 +1767,9 @@ static wp_Ecc* wp_ecc_gen(wp_EccGenCtx *ctx, OSSL_CALLBACK *cb, void *cbArg)
17671767
(void)cb;
17681768
(void)cbArg;
17691769

1770+
WP_CHECK_FIPS_ALGO_PTR(WP_CAST_ALGO_ECDSA);
1771+
WP_CHECK_FIPS_ALGO_PTR(WP_CAST_ALGO_ECDH);
1772+
17701773
if (ctx->curveName[0] != '\0') {
17711774
ecc = wp_ecc_new(ctx->provCtx);
17721775
}

‎src/wp_ecdh_exch.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,9 @@ static int wp_ecdh_init(wp_EcdhCtx* ctx, wp_Ecc* ecc, const OSSL_PARAM params[])
184184
if (!wolfssl_prov_is_running()) {
185185
ok = 0;
186186
}
187+
if (ok) {
188+
WP_CHECK_FIPS_ALGO(WP_CAST_ALGO_ECDH);
189+
}
187190
if (ok && (ctx->key != ecc)) {
188191
/* Free old key and up reference new key. */
189192
wp_ecc_free(ctx->key);

‎src/wp_ecdsa_sig.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,10 @@ static int wp_ecdsa_signverify_init(wp_EcdsaSigCtx *ctx, wp_Ecc* ecc,
190190
if (ctx == NULL || (ecc == NULL && ctx->ecc == NULL)) {
191191
ok = 0;
192192
}
193-
else if (ecc != NULL) {
193+
if (ok) {
194+
WP_CHECK_FIPS_ALGO(WP_CAST_ALGO_ECDSA);
195+
}
196+
if (ok && (ecc != NULL)) {
194197
if (!wp_ecc_up_ref(ecc)) {
195198
ok = 0;
196199
}

‎src/wp_hmac.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,8 @@ static int wp_hmac_set_key(wp_HmacCtx* macCtx, const unsigned char* key,
126126

127127
WOLFPROV_ENTER(WP_LOG_COMP_MAC, "wp_hmac_set_key");
128128

129+
WP_CHECK_FIPS_ALGO(WP_CAST_ALGO_HMAC);
130+
129131
if (macCtx->keyLen > 0) {
130132
OPENSSL_secure_clear_free(macCtx->key, macCtx->keyLen);
131133
}

0 commit comments

Comments
 (0)