|
 |
4ac9e2 |
From ccf8343aedd49b1250bee761f5c1ba8465b7dadb Mon Sep 17 00:00:00 2001
|
|
|
4ac9e2 |
From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
|
|
|
4ac9e2 |
Date: Thu, 10 Jan 2019 14:04:02 +0100
|
|
|
4ac9e2 |
Subject: [PATCH 1/2] fips140: Fix the names of files used in integrity checks
|
|
|
4ac9e2 |
|
|
|
4ac9e2 |
The names of the libraries haven't been updated when the soname version
|
|
|
4ac9e2 |
were bumped.
|
|
|
4ac9e2 |
|
|
|
4ac9e2 |
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
|
|
|
4ac9e2 |
---
|
|
|
4ac9e2 |
lib/fips.c | 6 +++---
|
|
|
4ac9e2 |
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
4ac9e2 |
|
|
|
4ac9e2 |
diff --git a/lib/fips.c b/lib/fips.c
|
|
|
4ac9e2 |
index 2715af599..fb2d596c2 100644
|
|
|
4ac9e2 |
--- a/lib/fips.c
|
|
|
4ac9e2 |
+++ b/lib/fips.c
|
|
|
4ac9e2 |
@@ -135,9 +135,9 @@ void _gnutls_fips_mode_reset_zombie(void)
|
|
|
4ac9e2 |
}
|
|
|
4ac9e2 |
}
|
|
|
4ac9e2 |
|
|
|
4ac9e2 |
-#define GNUTLS_LIBRARY_NAME "libgnutls.so.28"
|
|
|
4ac9e2 |
-#define NETTLE_LIBRARY_NAME "libnettle.so.4"
|
|
|
4ac9e2 |
-#define HOGWEED_LIBRARY_NAME "libhogweed.so.2"
|
|
|
4ac9e2 |
+#define GNUTLS_LIBRARY_NAME "libgnutls.so.30"
|
|
|
4ac9e2 |
+#define NETTLE_LIBRARY_NAME "libnettle.so.6"
|
|
|
4ac9e2 |
+#define HOGWEED_LIBRARY_NAME "libhogweed.so.4"
|
|
|
4ac9e2 |
#define GMP_LIBRARY_NAME "libgmp.so.10"
|
|
|
4ac9e2 |
|
|
|
4ac9e2 |
#define HMAC_SUFFIX ".hmac"
|
|
|
4ac9e2 |
--
|
|
|
4ac9e2 |
2.20.1
|
|
|
4ac9e2 |
|
|
|
4ac9e2 |
|
|
|
4ac9e2 |
From 8bac499469af3fb39a5ad59f1defe9f3824d5119 Mon Sep 17 00:00:00 2001
|
|
|
4ac9e2 |
From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
|
|
|
4ac9e2 |
Date: Fri, 11 Jan 2019 11:23:21 +0100
|
|
|
4ac9e2 |
Subject: [PATCH 2/2] fips140: Ignore newlines read at the end of HMAC file
|
|
|
4ac9e2 |
|
|
|
4ac9e2 |
This makes the integrity check to ignore newlines appended after the
|
|
|
4ac9e2 |
HMAC value.
|
|
|
4ac9e2 |
|
|
|
4ac9e2 |
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
|
|
|
4ac9e2 |
---
|
|
|
4ac9e2 |
lib/fips.c | 7 +++++++
|
|
|
4ac9e2 |
1 file changed, 7 insertions(+)
|
|
|
4ac9e2 |
|
|
|
4ac9e2 |
diff --git a/lib/fips.c b/lib/fips.c
|
|
|
4ac9e2 |
index fb2d596c2..0169ab171 100644
|
|
|
4ac9e2 |
--- a/lib/fips.c
|
|
|
4ac9e2 |
+++ b/lib/fips.c
|
|
|
4ac9e2 |
@@ -250,6 +250,13 @@ static unsigned check_binary_integrity(const char* libname, const char* symbol)
|
|
|
4ac9e2 |
}
|
|
|
4ac9e2 |
|
|
|
4ac9e2 |
hmac_size = hex_data_size(data.size);
|
|
|
4ac9e2 |
+
|
|
|
4ac9e2 |
+ /* trim eventual newlines from the end of the data read from file */
|
|
|
4ac9e2 |
+ while ((data.size > 0) && (data.data[data.size - 1] == '\n')) {
|
|
|
4ac9e2 |
+ data.data[data.size - 1] = 0;
|
|
|
4ac9e2 |
+ data.size--;
|
|
|
4ac9e2 |
+ }
|
|
|
4ac9e2 |
+
|
|
|
4ac9e2 |
ret = gnutls_hex_decode(&data, hmac, &hmac_size);
|
|
|
4ac9e2 |
gnutls_free(data.data);
|
|
|
4ac9e2 |
|
|
|
4ac9e2 |
--
|
|
|
4ac9e2 |
2.20.1
|
|
|
4ac9e2 |
|