Merge pull request #400 from dgarske/fips

Fixes for building with FIPS

Author: ejohnstown

src/internal.c

@@ -3248,10 +3248,16 @@ static int DoKexDhReply(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
             ssh->kSz = MAX_KEX_KEY_SZ;
             if (!ssh->handshake->useEcc) {
 #ifndef WOLFSSH_NO_DH
+            #ifdef PRIVATE_KEY_UNLOCK
+                PRIVATE_KEY_UNLOCK();
+            #endif
                 ret = wc_DhAgree(&ssh->handshake->privKey.dh,
                                  ssh->k, &ssh->kSz,
                                  ssh->handshake->x, ssh->handshake->xSz,
                                  f, fSz);
+            #ifdef PRIVATE_KEY_LOCK
+                PRIVATE_KEY_LOCK();
+            #endif
                 ForceZero(ssh->handshake->x, ssh->handshake->xSz);
                 wc_FreeDhKey(&ssh->handshake->privKey.dh);
                 if (ret != 0) {
@@ -3272,10 +3278,14 @@ static int DoKexDhReply(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
                 if (ret == 0)
                     ret = wc_ecc_import_x963(f, fSz, key_ptr);
                 if (ret == 0) {
+                #ifdef PRIVATE_KEY_UNLOCK
                     PRIVATE_KEY_UNLOCK();
+                #endif
                     ret = wc_ecc_shared_secret(&ssh->handshake->privKey.ecc,
                                                key_ptr, ssh->k, &ssh->kSz);
+                #ifdef PRIVATE_KEY_LOCK
                     PRIVATE_KEY_LOCK();
+                #endif
                 }
                 wc_ecc_free(key_ptr);
                 wc_ecc_free(&ssh->handshake->privKey.ecc);
@@ -7074,11 +7084,15 @@ int SendKexDhReply(WOLFSSH* ssh)
                                              ssh->ctx->privateKeySz);
             /* Flatten the public key into x963 value for the exchange hash. */
             if (ret == 0) {
+            #ifdef PRIVATE_KEY_UNLOCK
                 PRIVATE_KEY_UNLOCK();
+            #endif
                 ret = wc_ecc_export_x963(&sigKeyBlock_ptr->sk.ecc.key,
                                          sigKeyBlock_ptr->sk.ecc.q,
                                          &sigKeyBlock_ptr->sk.ecc.qSz);
+            #ifdef PRIVATE_KEY_LOCK
                 PRIVATE_KEY_LOCK();
+            #endif
             }
             /* Hash in the length of the public key block. */
             if (ret == 0) {
@@ -7254,9 +7268,16 @@ int SendKexDhReply(WOLFSSH* ssh)
                     if (ret == 0)
                         ret = wc_DhGenerateKeyPair(privKey, ssh->rng,
                                 y_ptr, &ySz, f_ptr, &fSz);
-                    if (ret == 0)
+                    if (ret == 0) {
+                    #ifdef PRIVATE_KEY_UNLOCK
+                        PRIVATE_KEY_UNLOCK();
+                    #endif
                         ret = wc_DhAgree(privKey, ssh->k, &ssh->kSz, y_ptr, ySz,
                                 ssh->handshake->e, ssh->handshake->eSz);
+                    #ifdef PRIVATE_KEY_LOCK
+                        PRIVATE_KEY_LOCK();
+                    #endif
+                    }
                     ForceZero(y_ptr, ySz);
                     wc_FreeDhKey(privKey);
                 }
@@ -7307,15 +7328,23 @@ int SendKexDhReply(WOLFSSH* ssh)
                                          wc_ecc_get_curve_size_from_id(primeId),
                                          privKey, primeId);
                 if (ret == 0) {
+                #ifdef PRIVATE_KEY_UNLOCK
                     PRIVATE_KEY_UNLOCK();
+                #endif
                     ret = wc_ecc_export_x963(privKey, f_ptr, &fSz);
+                #ifdef PRIVATE_KEY_LOCK
                     PRIVATE_KEY_LOCK();
+                #endif
                 }
                 if (ret == 0) {
+                #ifdef PRIVATE_KEY_UNLOCK
                     PRIVATE_KEY_UNLOCK();
+                #endif
                     ret = wc_ecc_shared_secret(privKey, pubKey,
                                                ssh->k, &ssh->kSz);
+                #ifdef PRIVATE_KEY_LOCK
                     PRIVATE_KEY_LOCK();
+                #endif
                 }
                 wc_ecc_free(privKey);
                 wc_ecc_free(pubKey);
@@ -7936,8 +7965,15 @@ int SendKexDhInit(WOLFSSH* ssh)
                 ret = wc_ecc_make_key_ex(ssh->rng,
                                      wc_ecc_get_curve_size_from_id(primeId),
                                      privKey, primeId);
-            if (ret == 0)
+            if (ret == 0) {
+            #ifdef PRIVATE_KEY_UNLOCK
+                PRIVATE_KEY_UNLOCK();
+            #endif
                 ret = wc_ecc_export_x963(privKey, e, &eSz);
+            #ifdef PRIVATE_KEY_LOCK
+                PRIVATE_KEY_LOCK();
+            #endif
+            }
 #else
             ret = WS_INVALID_ALGO_ID;
 #endif /* !defined(WOLFSSH_NO_ECDH) */

src/ssh.c

@@ -32,6 +32,8 @@
 #include <wolfssh/internal.h>
 #include <wolfssh/log.h>
 #include <wolfssl/wolfcrypt/wc_port.h>
+#include <wolfssl/wolfcrypt/error-crypt.h>
+#include <wolfssl/wolfcrypt/random.h>
 
 #ifdef NO_INLINE
     #include <wolfssh/misc.h>
@@ -40,6 +42,19 @@
     #include "src/misc.c"
 #endif
 
+#ifdef HAVE_FIPS
+static void myFipsCb(int ok, int err, const char* hash)
+{
+    printf("in my Fips callback, ok = %d, err = %d\n", ok, err);
+    printf("message = %s\n", wc_GetErrorString(err));
+    printf("hash = %s\n", hash);
+
+    if (err == IN_CORE_FIPS_E) {
+        printf("In core integrity hash check failure, copy above hash\n");
+        printf("into verifyCore[] in fips_test.c and rebuild\n");
+    }
+}
+#endif /* HAVE_FIPS */
 
 int wolfSSH_Init(void)
 {
@@ -49,6 +64,13 @@ int wolfSSH_Init(void)
     if (wolfCrypt_Init() != 0)
         ret = WS_CRYPTO_FAILED;
 
+#ifdef HAVE_FIPS
+    wolfCrypt_SetCb_fips(myFipsCb);
+#endif
+#ifdef WC_RNG_SEED_CB
+    wc_SetSeed_Cb(wc_GenerateSeed);
+#endif
+
     WLOG(WS_LOG_DEBUG, "Leaving wolfSSH_Init(), returning %d", ret);
     return ret;
 }

tests/testsuite.c

@@ -103,10 +103,11 @@ int TestsuiteTest(int argc, char** argv)
 
     WSTARTTCP();
 
-    wolfSSH_Init();
     #if defined(DEBUG_WOLFSSH)
         wolfSSH_Debugging_ON();
     #endif
+
+    wolfSSH_Init();
     #if !defined(WOLFSSL_TIRTOS)
         ChangeToWolfSshRoot();
     #endif