Attachment 584570 Details for Bug 811753 – Disable MD5 and DES when FIPS is enabled

[patch] Disable MD5 and DES when FIPS is enabled

crypt-fipsalgo-bz811753.patch (text/plain), 2.72 KB, created by Alexandre Oliva on 2012-05-15 07:51:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Alexandre Oliva

Created: 2012-05-15 07:51:53 UTC

Size: 2.72 KB

patch

obsolete

>for  ChangeLog
>2012-05-15  Alexandre Oliva  <aoliva@redhat.com>
>
>	* crypt/crypt-entry.c: Include unistd.h.
>	(fips_enabled): New.
>	(__crypt_r, __crypt): Disable MD5 and DES if FIPS is enabled.
>	* crypt/md5c-test.c (main): Tolerate disabled MD5.
>
>Index: crypt/crypt-entry.c
>===================================================================
>--- crypt/crypt-entry.c.orig	2012-05-15 04:32:05.402061050 -0300
>+++ crypt/crypt-entry.c	2012-05-15 04:32:29.493712394 -0300
>@@ -27,6 +27,7 @@
> #include <stdio.h>
> #endif
> #include <string.h>
>+#include <unistd.h>
> 
> #ifndef STATIC
> #define STATIC static
>@@ -74,6 +75,27 @@ static const char sha512_salt_prefix[] =
> /* For use by the old, non-reentrant routines (crypt/encrypt/setkey)  */
> extern struct crypt_data _ufc_foobar;
> 
>+/* Return nonzero if FIPS mode is enabled, i.e., whether MD5 and DES
>+   algorithms should be rejected.  */
>+static inline int
>+fips_enabled (void)
>+{
>+  static int checked;
>+
>+  if (!checked)
>+    {
>+      int res = -1;
>+
>+#ifdef _SC_CRYPTO_FIPS_ENABLED
>+      res = __sysconf (_SC_CRYPTO_FIPS_ENABLED);
>+#endif
>+
>+      checked = (res > 0) ? 1 : -1;
>+    }
>+
>+  return checked > 0;
>+}
>+
> /*
>  * UNIX crypt function
>  */
>@@ -90,7 +112,8 @@ __crypt_r (key, salt, data)
> 
> #ifdef _LIBC
>   /* Try to find out whether we have to use MD5 encryption replacement.  */
>-  if (strncmp (md5_salt_prefix, salt, sizeof (md5_salt_prefix) - 1) == 0)
>+  if (strncmp (md5_salt_prefix, salt, sizeof (md5_salt_prefix) - 1) == 0
>+      && !fips_enabled ())
>     return __md5_crypt_r (key, salt, (char *) data,
> 			  sizeof (struct crypt_data));
> 
>@@ -108,7 +131,7 @@ __crypt_r (key, salt, data)
>   /*
>    * Hack DES tables according to salt
>    */
>-  if (_ufc_setup_salt_r (salt, data) != 0)
>+  if (fips_enabled () || _ufc_setup_salt_r (salt, data) != 0)
>     return NULL;
> 
>   /*
>@@ -144,7 +167,8 @@ crypt (key, salt)
> {
> #ifdef _LIBC
>   /* Try to find out whether we have to use MD5 encryption replacement.  */
>-  if (strncmp (md5_salt_prefix, salt, sizeof (md5_salt_prefix) - 1) == 0)
>+  if (strncmp (md5_salt_prefix, salt, sizeof (md5_salt_prefix) - 1) == 0
>+      && !fips_enabled ())
>     return __md5_crypt (key, salt);
> 
>   /* Try to find out whether we have to use SHA256 encryption replacement.  */
>Index: crypt/md5c-test.c
>===================================================================
>--- crypt/md5c-test.c.orig	2012-05-15 04:30:55.907066709 -0300
>+++ crypt/md5c-test.c	2012-05-15 04:32:29.533711814 -0300
>@@ -9,7 +9,10 @@ main (int argc, char *argv[])
>   int result = 0;
> 
>   cp = crypt ("Hello world!", salt);
>-  result |= strcmp ("$1$saltstri$YMyguxXMBpd2TEZ.vS/3q1", cp);
>+
>+  /* MD5 is disabled in FIPS mode.  */
>+  if (cp)
>+    result |= strcmp ("$1$saltstri$YMyguxXMBpd2TEZ.vS/3q1", cp);
> 
>   return result;
> }

Actions: View | Diff

Attachments on bug 811753: 576902 | 584543 | 584565 | 584570 | 589580