Bug 829088
| Summary: | nss-softokn sha224 self-test fails in fips mode | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Alexandre Oliva <aoliva> | ||||||||||
| Component: | nss-softokn | Assignee: | Elio Maldonado Batiz <emaldona> | ||||||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||||
| Severity: | unspecified | Docs Contact: | |||||||||||
| Priority: | unspecified | ||||||||||||
| Version: | 17 | CC: | aoliva, emaldona, fche, jakub, kengert, law, mtoman, omoris, pwouters, rrelyea, schwab, sgrubb, tmraz | ||||||||||
| Target Milestone: | --- | ||||||||||||
| Target Release: | --- | ||||||||||||
| Hardware: | Unspecified | ||||||||||||
| OS: | Unspecified | ||||||||||||
| Whiteboard: | |||||||||||||
| Fixed In Version: | nss-softokn-3.13.4-3.fc18, nss-softokn-3.13.4-3.fc17 | Doc Type: | Bug Fix | ||||||||||
| Doc Text: | Story Points: | --- | |||||||||||
| Clone Of: | 811753 | Environment: | |||||||||||
| Last Closed: | 2012-07-19 09:13:49 UTC | Type: | Bug | ||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||
| Documentation: | --- | CRM: | |||||||||||
| Verified Versions: | Category: | --- | |||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||
| Embargoed: | |||||||||||||
| Bug Depends On: | |||||||||||||
| Bug Blocks: | 717789, 811753, 867144 | ||||||||||||
| Attachments: |
|
||||||||||||
|
Description
Alexandre Oliva
2012-06-05 22:34:08 UTC
Though we can't currently enable system wide fips mode by doing a buildwith tis change
- if (!post && nsslow_GetFIPSEnabled()) {
+ if (!post && (1 || nsslow_GetFIPSEnabled())) { /* force the test to be run always */
crv = freebl_fipsPowerUpSelfTest();
if (crv != CKR_OK) {
post_failed = 1;
that forces execution of the powerup slef-tests regradless I can reproduce the problem. I booted in single user mode okay and when to run level 3 where authetication of root failed, likewise on run level 5 I could gogin as regular user. I checkd the expected anwser and it matches a value from
http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/SHA224.pdf
so the computed value is indeed wrong. I'll work on this and log the corresponding bug.
Created attachment 590229 [details]
nss test sample C file
I'm confused then. The attached nss-example.c runs fine in fips mode. If the fips self test is supposed to fail over the bad sha2 selftest, why does this example run fine in fips mode?
The problem isn't in softoken. Softoken in Fips mode works fine. The problem is in the direct to freebl interface in FIPS mode (think libgcrypt). bob It also only affects softoken 3.13.x, so there is no issue with RHEL5 or RHEL6. bob Created attachment 591327 [details]
minimalist bug reproducer
See the comments at the top of the file wit the steps to reproduce it. Since fedora isn't quite ready for fips mode I turn it on and off by devious means.
Proceed with care. I followed the steps and traced execition with gdb and saw the sha224 power-up self-test fail the compare. I have submitted a patch to the upstream bug and along with it a full test suite for the nss low hash api.
Created attachment 591352 [details]
nss-softokn sha224 fips self test fix
This patch does fix my issue, and nss works properly in fips mode
It also properly handles the crypt() calls now via freebl for $5$ and $6$ salts. Thank you Paul for verifiying the fix and attaching a downstream version of the upstream patch - they are effectively the same. The fix consists of using for the nss lowhash self-tests the same expected value as used in softoken . Created attachment 591641 [details]
patch as it was checked in - same as applied upstream
nspr-4.9.1-1.fc17,nss-util-3.13.5-1.fc17,nss-softokn-3.13.5-1.fc17,nss-3.13.5-1.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/nspr-4.9.1-1.fc17,nss-util-3.13.5-1.fc17,nss-softokn-3.13.5-1.fc17,nss-3.13.5-1.fc17 Package nspr-4.9.1-1.fc17, nss-util-3.13.5-1.fc17, nss-softokn-3.13.5-1.fc17, nss-3.13.5-1.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing nspr-4.9.1-1.fc17 nss-util-3.13.5-1.fc17 nss-softokn-3.13.5-1.fc17 nss-3.13.5-1.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-10451/nspr-4.9.1-1.fc17,nss-util-3.13.5-1.fc17,nss-softokn-3.13.5-1.fc17,nss-3.13.5-1.fc17 then log in and leave karma (feedback). Package nspr-4.9.1-2.fc17, nss-util-3.13.5-1.fc17, nss-softokn-3.13.5-1.fc17, nss-3.13.5-1.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing nspr-4.9.1-2.fc17 nss-util-3.13.5-1.fc17 nss-softokn-3.13.5-1.fc17 nss-3.13.5-1.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-10451/nspr-4.9.1-2.fc17,nss-util-3.13.5-1.fc17,nss-softokn-3.13.5-1.fc17,nss-3.13.5-1.fc17 then log in and leave karma (feedback). nspr-4.9.1-2.fc16,nss-util-3.13.5-1.fc16,nss-softokn-3.13.5-1.fc16,nss-3.13.5-1.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/nspr-4.9.1-2.fc16,nss-util-3.13.5-1.fc16,nss-softokn-3.13.5-1.fc16,nss-3.13.5-1.fc16 confirmed working on f16 and f17. Thanks! nspr-4.9.1-2.fc17, nss-util-3.13.5-1.fc17, nss-softokn-3.13.5-1.fc17, nss-3.13.5-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. nspr-4.9.1-2.fc16, nss-util-3.13.5-1.fc16, nss-softokn-3.13.5-1.fc16, nss-3.13.5-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report. *** Bug 903144 has been marked as a duplicate of this bug. *** |