24588300 OpenSSL FIPS work based on 1.0.2 for Oracle Solaris: Phase I
20800792 openssl-1.0.1-fips-140: using obsolete -xarch option
--- a/components/openssl/openssl-fips-140/Makefile Thu Oct 13 08:59:50 2016 -0700
+++ b/components/openssl/openssl-fips-140/Makefile Thu Oct 13 14:47:30 2016 -0700
@@ -36,7 +36,7 @@
# OpenSSL version, but the IPS_COMPONENT_VERSION is purposely only to change if
# the FIPS module version changes.
COMPONENT_VERSION = 1.0.2j
-IPS_COMPONENT_VERSION = 2.0.12
+IPS_COMPONENT_VERSION = 2.0.13
COMPONENT_PROJECT_URL= http://www.openssl.org/
COMPONENT_SRC_NAME = openssl
COMPONENT_SRC = $(COMPONENT_SRC_NAME)-$(COMPONENT_VERSION)
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/components/openssl/openssl-fips-140/patches/204-fips-by-default.patch Thu Oct 13 14:47:30 2016 -0700
@@ -0,0 +1,28 @@
+# Developed in house: Solaris specific
+# This patch enables FIPS mode in the _init routine.
+--- a/crypto/cryptlib.c 2016-09-02 14:10:14.157867400 -0700
++++ b/crypto/cryptlib.c 2016-09-02 14:08:38.308229315 -0700
+@@ -117,6 +117,8 @@
+ #include <openssl/safestack.h>
+ #include <pthread.h>
+
++extern unsigned char FIPS_signature[];
++
+ #if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WIN16)
+ static double SSLeay_MSVC5_hack = 0.0; /* and for VC1.5 */
+ #endif
+@@ -531,6 +582,14 @@
+ (void) pthread_mutex_init(&solaris_openssl_locks[i], NULL);
+ }
+
++ if ((FIPS_signature[0] != 0x00) || (FIPS_signature[1] != 0xFF)) {
++ /* Set FIPS mode by default if FIPS_signature is already set */
++ if (FIPS_mode_set(1) != 1) {
++ fprintf(stderr, "Failed to set FIPS mode.\n");
++ abort();
++ }
++ }
++
+ (void) pthread_atfork(solaris_fork_prep, solaris_fork_post, solaris_fork_post);
+ }
+
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/components/openssl/openssl-fips-140/patches/205-allow-md5.patch Thu Oct 13 14:47:30 2016 -0700
@@ -0,0 +1,20 @@
+# Allow MD5 in FIPS mode
+# Developed in house: not applicable to upstream
+--- a/crypto/evp/digest.c 2016-09-15 15:26:57.097982570 -0700
++++ b/crypto/evp/digest.c 2016-09-15 15:29:22.781095415 -0700
+@@ -240,8 +240,13 @@
+ return 1;
+ #ifdef OPENSSL_FIPS
+ if (FIPS_mode()) {
+- if (FIPS_digestinit(ctx, type))
+- return 1;
++ if (type == EVP_md5()) {
++ if (ctx->digest->init(ctx))
++ return 1;
++ } else {
++ if (FIPS_digestinit(ctx, type))
++ return 1;
++ }
+ OPENSSL_free(ctx->md_data);
+ ctx->md_data = NULL;
+ return 0;
--- a/components/openssl/openssl-fips/Makefile Thu Oct 13 08:59:50 2016 -0700
+++ b/components/openssl/openssl-fips/Makefile Thu Oct 13 14:47:30 2016 -0700
@@ -31,11 +31,11 @@
include ../../../make-rules/shared-macros.mk
COMPONENT_NAME = openssl-fips
-COMPONENT_VERSION = 2.0.12
+COMPONENT_VERSION = 2.0.13
COMPONENT_SRC = $(COMPONENT_NAME)-$(COMPONENT_VERSION)
COMPONENT_ARCHIVE = $(COMPONENT_SRC).tar.gz
COMPONENT_ARCHIVE_HASH= \
- sha256:ab5af8f4c542ce3fae31fbd99b029fdc37da5e655191f3c4bfdaa8b0d6dc10b7
+ sha256:3ff723f93901f750779a2e67ff15985c357f1a15c892c9504446fbc85c6f77da
COMPONENT_ARCHIVE_URL = http://www.openssl.org/source/$(COMPONENT_ARCHIVE)
COMPONENT_BUGDB= library/openssl
@@ -71,7 +71,7 @@
# Note: COMPONENT_ARCHIVE_HASH is a SHA256 digest used by the Userland
# Consolidation to check the file integrity.
OPENSSL_FIPS_HMAC_KEY = etaonrishdlcupfm
-OPENSSL_FIPS_HMAC = 86ec30179f1bfb2edde4ababf0fb519ba7380b69
+OPENSSL_FIPS_HMAC = 26f923491458df77a1f4c6ce39fef2f5bea88cd5
# There is a broken link in the tarball which causes cp(1) to fail which would
# fail the whole configure process. It's safer to get rid of the link than
@@ -132,7 +132,7 @@
@echo Basic FIPS-140 mode verification passed.
$(TOUCH) $@
-test: $(NO_TESTS)
+test: $(NO_TESTS)
system-test: $(NO_TESTS)
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/components/openssl/openssl-fips/patches/301-fips-validation.patch Thu Oct 13 14:47:30 2016 -0700
@@ -0,0 +1,92 @@
+# Developed in house: Solaris specific
+# This patch is necessary to get a new FIPS validation:
+# - Use modern compile options
+# - Conform to FIPS 186-4: RSA key generation
+# - Enable FIPS by default: ignore a call to FIPS_mode_set(1)
+--- a/Configure.orig 2016-07-15 01:47:46.399055235 -0700
++++ b/Configure 2016-07-15 01:59:36.376433305 -0700
+@@ -221,8 +221,8 @@
+ "solaris64-x86_64-gcc","gcc:-m64 -O3 -Wall -DL_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:solaris-shared:-fPIC:-m64 -shared -static-libgcc:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::/64",
+
+ #### Solaris x86 with Sun C setups
+-"solaris-x86-cc","cc:-fast -O -Xa::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"solaris64-x86_64-cc","cc:-fast -xarch=amd64 -xstrconst -Xa -DL_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:solaris-shared:-KPIC:-xarch=amd64 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::/64",
++"solaris-x86-cc","cc:-fast -m32 -O -xstrconst -Xa::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"solaris64-x86_64-cc","cc:-fast -m64 -xstrconst -Xa -DL_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:solaris-shared:-KPIC:-m64 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::/64",
+
+ #### SPARC Solaris with GNU C setups
+ "solaris-sparcv7-gcc","gcc:-O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+@@ -239,12 +239,12 @@
+ # SC4.2 is ok, better than gcc even on bn as long as you tell it -xarch=v8
+ # SC5.0 note: Compiler common patch 107357-01 or later is required!
+ "solaris-sparcv7-cc","cc:-xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"solaris-sparcv8-cc","cc:-xarch=v8 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"solaris-sparcv9-cc","cc:-xtarget=ultra -xarch=v8plus -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"solaris64-sparcv9-cc","cc:-xtarget=ultra -xarch=v9 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:solaris-shared:-KPIC:-xarch=v9 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):/usr/ccs/bin/ar rs::/64",
++"solaris-sparcv8-cc","cc:-m32 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"solaris-sparcv9-cc","cc:-m32 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"solaris64-sparcv9-cc","cc:-m64 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:solaris-shared:-KPIC:-m64 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):/usr/ccs/bin/ar rs::/64",
+ ####
+-"debug-solaris-sparcv8-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -xarch=v8 -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"debug-solaris-sparcv9-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -xtarget=ultra -xarch=v8plus -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"debug-solaris-sparcv8-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -m32 -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"debug-solaris-sparcv9-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -m64 -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+
+ #### SunOS configs, assuming sparc for the gcc one.
+ #"sunos-cc", "cc:-O4 -DNOPROTO -DNOCONST::(unknown):SUNOS::DES_UNROLL:${no_asm}::",
+--- a/crypto/bn/bn_x931p.c.new 2016-07-15 02:15:47.056871670 -0700
++++ b/crypto/bn/bn_x931p.c 2015-11-16 13:45:17.000000000 -0800
+@@ -78,8 +78,8 @@
+ {
+ i++;
+ BN_GENCB_call(cb, 0, i);
+- /* NB 27 MR is specificed in X9.31 */
+- if (BN_is_prime_fasttest_ex(pi, 27, ctx, 1, cb))
++ /* NB 32 MR is specificed in X9.31 */
++ if (BN_is_prime_fasttest_ex(pi, 32, ctx, 1, cb))
+ break;
+ if (!BN_add_word(pi, 2))
+ return 0;
+@@ -254,9 +254,9 @@
+ if (!Xp2)
+ Xp2 = BN_CTX_get(ctx);
+
+- if (!BN_rand(Xp1, 101, 0, 0))
++ if (!BN_rand(Xp1, 171, 0, 0))
+ goto error;
+- if (!BN_rand(Xp2, 101, 0, 0))
++ if (!BN_rand(Xp2, 171, 0, 0))
+ goto error;
+ if (!BN_X931_derive_prime_ex(p, p1, p2, Xp, Xp1, Xp2, e, ctx, cb))
+ goto error;
+--- a/fips/fips.c 2016-06-20 12:49:46.000000000 -0700
++++ b/fips/fips.c 2016-09-08 07:53:52.169922810 -0700
+@@ -288,6 +291,12 @@
+ {
+ int ret = 0;
+
++ /* FIPS mode is enabled by default : this is noop */
++ if (onoff && FIPS_module_mode())
++ {
++ return 1;
++ }
++
+ fips_w_lock();
+ fips_started = 1;
+ fips_set_owning_thread();
+@@ -301,15 +310,6 @@
+ fips_auth_fail = 1;
+ fips_selftest_fail = 1;
+ FIPSerr(FIPS_F_FIPS_MODULE_MODE_SET,FIPS_R_AUTHENTICATION_FAILURE);
+- return 0;
+- }
+-
+- /* Don't go into FIPS mode twice, just so we can do automagic
+- seeding */
+- if(FIPS_module_mode())
+- {
+- FIPSerr(FIPS_F_FIPS_MODULE_MODE_SET,FIPS_R_FIPS_MODE_ALREADY_SET);
+- fips_selftest_fail = 1;
+ ret = 0;
+ goto end;
+ }