|
 |
f57b16 |
diff -up openssl-3.0.1/crypto/pkcs12/p12_key.c.pkc12_fips openssl-3.0.1/crypto/pkcs12/p12_key.c
|
|
|
f57b16 |
--- openssl-3.0.1/crypto/pkcs12/p12_key.c.pkc12_fips 2022-02-21 12:35:24.829893907 +0100
|
|
|
f57b16 |
+++ openssl-3.0.1/crypto/pkcs12/p12_key.c 2022-02-21 13:01:22.711622967 +0100
|
|
|
f57b16 |
@@ -85,17 +85,41 @@ int PKCS12_key_gen_uni_ex(unsigned char
|
|
|
f57b16 |
EVP_KDF *kdf;
|
|
|
f57b16 |
EVP_KDF_CTX *ctx;
|
|
|
f57b16 |
OSSL_PARAM params[6], *p = params;
|
|
|
f57b16 |
+ char *adjusted_propq = NULL;
|
|
|
f57b16 |
|
|
|
f57b16 |
if (n <= 0)
|
|
|
f57b16 |
return 0;
|
|
|
f57b16 |
|
|
|
f57b16 |
- kdf = EVP_KDF_fetch(libctx, "PKCS12KDF", propq);
|
|
|
f57b16 |
- if (kdf == NULL)
|
|
|
f57b16 |
+ if (ossl_get_kernel_fips_flag()) {
|
|
|
f57b16 |
+ const char *nofips = "-fips";
|
|
|
f57b16 |
+ size_t len = propq ? strlen(propq) + 1 + strlen(nofips) + 1 :
|
|
|
f57b16 |
+ strlen(nofips) + 1;
|
|
|
f57b16 |
+ char *ptr = NULL;
|
|
|
f57b16 |
+
|
|
|
f57b16 |
+ adjusted_propq = OPENSSL_zalloc(len);
|
|
|
f57b16 |
+ if (adjusted_propq != NULL) {
|
|
|
f57b16 |
+ ptr = adjusted_propq;
|
|
|
f57b16 |
+ if (propq) {
|
|
|
f57b16 |
+ memcpy(ptr, propq, strlen(propq));
|
|
|
f57b16 |
+ ptr += strlen(propq);
|
|
|
f57b16 |
+ *ptr = ',';
|
|
|
f57b16 |
+ ptr++;
|
|
|
f57b16 |
+ }
|
|
|
f57b16 |
+ memcpy(ptr, nofips, strlen(nofips));
|
|
|
f57b16 |
+ }
|
|
|
f57b16 |
+ }
|
|
|
f57b16 |
+
|
|
|
f57b16 |
+ kdf = adjusted_propq ? EVP_KDF_fetch(libctx, "PKCS12KDF", adjusted_propq) : EVP_KDF_fetch(libctx, "PKCS12KDF", propq);
|
|
|
f57b16 |
+ if (kdf == NULL) {
|
|
|
f57b16 |
+ OPENSSL_free(adjusted_propq);
|
|
|
f57b16 |
return 0;
|
|
|
f57b16 |
+ }
|
|
|
f57b16 |
ctx = EVP_KDF_CTX_new(kdf);
|
|
|
f57b16 |
EVP_KDF_free(kdf);
|
|
|
f57b16 |
- if (ctx == NULL)
|
|
|
f57b16 |
+ if (ctx == NULL) {
|
|
|
f57b16 |
+ OPENSSL_free(adjusted_propq);
|
|
|
f57b16 |
return 0;
|
|
|
f57b16 |
+ }
|
|
|
f57b16 |
|
|
|
f57b16 |
*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
|
|
|
f57b16 |
(char *)EVP_MD_get0_name(md_type),
|
|
|
f57b16 |
@@ -127,6 +149,7 @@ int PKCS12_key_gen_uni_ex(unsigned char
|
|
|
f57b16 |
} OSSL_TRACE_END(PKCS12_KEYGEN);
|
|
|
f57b16 |
}
|
|
|
f57b16 |
EVP_KDF_CTX_free(ctx);
|
|
|
f57b16 |
+ OPENSSL_free(adjusted_propq);
|
|
|
f57b16 |
return res;
|
|
|
f57b16 |
}
|
|
|
f57b16 |
|
|
|
f57b16 |
diff -up openssl-3.0.1/apps/pkcs12.c.pkc12_fips_apps openssl-3.0.1/apps/pkcs12.c
|
|
|
f57b16 |
--- openssl-3.0.1/apps/pkcs12.c.pkc12_fips_apps 2022-02-21 16:37:07.908923682 +0100
|
|
|
f57b16 |
+++ openssl-3.0.1/apps/pkcs12.c 2022-02-21 17:38:44.555345633 +0100
|
|
|
f57b16 |
@@ -765,15 +765,34 @@ int pkcs12_main(int argc, char **argv)
|
|
|
f57b16 |
}
|
|
|
f57b16 |
if (macver) {
|
|
|
f57b16 |
EVP_KDF *pkcs12kdf;
|
|
|
f57b16 |
+ char *adjusted_propq = NULL;
|
|
|
f57b16 |
+ const char *nofips = "-fips";
|
|
|
f57b16 |
+ size_t len = app_get0_propq() ? strlen(app_get0_propq()) + 1 + strlen(nofips) + 1 :
|
|
|
f57b16 |
+ strlen(nofips) + 1;
|
|
|
f57b16 |
+ char *ptr = NULL;
|
|
|
f57b16 |
+
|
|
|
f57b16 |
+ adjusted_propq = OPENSSL_zalloc(len);
|
|
|
f57b16 |
+ if (adjusted_propq != NULL) {
|
|
|
f57b16 |
+ ptr = adjusted_propq;
|
|
|
f57b16 |
+ if (app_get0_propq()) {
|
|
|
f57b16 |
+ memcpy(ptr, app_get0_propq(), strlen(app_get0_propq()));
|
|
|
f57b16 |
+ ptr += strlen(app_get0_propq());
|
|
|
f57b16 |
+ *ptr = ',';
|
|
|
f57b16 |
+ ptr++;
|
|
|
f57b16 |
+ }
|
|
|
f57b16 |
+ memcpy(ptr, nofips, strlen(nofips));
|
|
|
f57b16 |
+ }
|
|
|
f57b16 |
|
|
|
f57b16 |
pkcs12kdf = EVP_KDF_fetch(app_get0_libctx(), "PKCS12KDF",
|
|
|
f57b16 |
- app_get0_propq());
|
|
|
f57b16 |
+ adjusted_propq ? adjusted_propq : app_get0_propq());
|
|
|
f57b16 |
if (pkcs12kdf == NULL) {
|
|
|
f57b16 |
BIO_printf(bio_err, "Error verifying PKCS12 MAC; no PKCS12KDF support.\n");
|
|
|
f57b16 |
BIO_printf(bio_err, "Use -nomacver if MAC verification is not required.\n");
|
|
|
f57b16 |
+ OPENSSL_free(adjusted_propq);
|
|
|
f57b16 |
goto end;
|
|
|
f57b16 |
}
|
|
|
f57b16 |
EVP_KDF_free(pkcs12kdf);
|
|
|
f57b16 |
+ OPENSSL_free(adjusted_propq);
|
|
|
f57b16 |
/* If we enter empty password try no password first */
|
|
|
f57b16 |
if (!mpass[0] && PKCS12_verify_mac(p12, NULL, 0)) {
|
|
|
f57b16 |
/* If mac and crypto pass the same set it to NULL too */
|