diff options
| -rw-r--r-- | .gitlab-ci.yml | 36 | ||||
| -rw-r--r-- | configure.ac | 17 | ||||
| -rw-r--r-- | doc/cha-internals.texi | 22 | ||||
| -rw-r--r-- | lib/crypto-selftests.c | 11 | ||||
| -rw-r--r-- | lib/fips.c | 5 | ||||
| -rw-r--r-- | lib/gnutls.pc.in | 2 | ||||
| -rw-r--r-- | lib/random.c | 4 | ||||
| -rw-r--r-- | lib/system/keys-win.c | 8 | ||||
| -rw-r--r-- | tests/Makefile.am | 1 |
9 files changed, 84 insertions, 22 deletions
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index ccc4eddfa1..5ce88f2662 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -390,6 +390,42 @@ MinGW64.DLLs: - win64-build/ retry: 1 +MinGW64.Vista+: + stage: stage1-testing + image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$MINGW_BUILD + script: + - ./bootstrap + - export CC="ccache x86_64-w64-mingw32-gcc" + # Target Vista instead of XP, currently the default in mingw + - export CPPFLAGS="-D_WIN32_WINT=0x600" + - export WINEPATH=/usr/x86_64-w64-mingw32/sys-root/mingw/bin + - mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc + - echo ':DOSWin:M::MZ::/usr/bin/wine64:' > /proc/sys/fs/binfmt_misc/register + - mkdir -p build + - cd build + - dash ../configure --disable-gcc-warnings --host=x86_64-w64-mingw32 --target=x86_64-w64-mingw32 --cache-file ../cache/config.cache --with-included-libtasn1 --disable-guile --disable-nls --with-included-unistring --enable-local-libopts --disable-full-test-suite --disable-non-suiteb-curves --disable-doc + # generate the certtool autogen file to check whether later compilation will modify it + - mingw64-make -j$BUILDJOBS -C src certtool-args.c.bak + - mingw64-make -j$BUILDJOBS + - mingw64-make -j$CHECKJOBS -C tests check + - cd .. + # since we use --enable-local-libopts the generated files must equal the .bak + - cmp build/src/certtool-args.c build/src/certtool-args.c.bak || false + tags: + - shared + - docker + - linux + except: + - tags + artifacts: + expire_in: 1 week + when: on_failure + paths: + - build/*.log + - build/tests/*.log + - build/tests/*/*.log + retry: 1 + MinGW64: stage: stage1-testing image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$MINGW_BUILD diff --git a/configure.ac b/configure.ac index 3413a3dc99..9ea53b7344 100644 --- a/configure.ac +++ b/configure.ac @@ -111,6 +111,7 @@ AM_CONDITIONAL(ENABLE_CXX, test "$use_cxx" != "no") dnl Detect windows build use_accel=yes +have_vista_dynamic=yes case "$host" in *android*) have_android=yes @@ -121,6 +122,22 @@ case "$host" in AC_DEFINE([_UNICODE], [1], [Defined to 1 for Unicode (wide chars) APIs]) LIB_CRYPT32="-lcrypt32" AC_SUBST([LIB_CRYPT32]) + AC_PREPROC_IFELSE([AC_LANG_PROGRAM( + [[#include <windows.h> + #if defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x0600 + # error Vista APIs allowed statically + #endif + ]],[[;]])],[have_vista_dynamic=yes],[have_vista_dynamic=no]) + AC_ARG_ENABLE(dyn_ncrypt, + AS_HELP_STRING([--enable-dyn-ncrypt], [use ncrypt dynamically]), + enable_dyn_ncrypt=$enableval, enable_dyn_ncrypt=$have_vista_dynamic + ) + if test "x$enable_dyn_ncrypt" = "xyes"; then + AC_DEFINE([DYN_NCRYPT], 1, [Dynamic use of ncrypt API (win32)]) + else + LIBNCRYPT="-lncrypt" + fi + AC_SUBST([LIBNCRYPT]) ;; *darwin*) have_macosx=yes diff --git a/doc/cha-internals.texi b/doc/cha-internals.texi index 2a9bc1a45b..f188caecc9 100644 --- a/doc/cha-internals.texi +++ b/doc/cha-internals.texi @@ -667,15 +667,29 @@ is for the conformance to NIST's FIPS140-2 publication, which consists of polici for cryptographic modules (such as software libraries). Its implementation in GnuTLS is designed for Red Hat Enterprise Linux, and can only be enabled when the library is explicitly compiled with the '--enable-fips140-mode' -configure option. The operation of the library is then modified, as follows. +configure option. + +There are two distinct library states with regard to FIPS140-2: the FIPS140-2 +mode is @emph{installed} if @code{/etc/system-fips} is present, and the +FIPS140-2 mode is @emph{enabled} if @code{/proc/sys/crypto/fips_enabled} +contains '1', which is typically set with the ``fips=1'' kernel command line +option. + +When the FIPS140-2 mode is installed, the operation of the library is modified +as follows. @itemize -@item FIPS140-2 mode is enabled when @code{/proc/sys/crypto/fips_enabled} contains '1' and @code{/etc/system-fips} is present. -@item Only approved by FIPS140-2 algorithms are enabled -@item Only approved by FIPS140-2 key lengths are allowed for key generation @item The random generator used switches to DRBG-AES @item The integrity of the GnuTLS and dependent libraries is checked on startup @item Algorithm self-tests are run on library load +@end itemize + +When the FIPS140-2 mode is enabled, The operation of the library is in addition +modified as follows. + +@itemize +@item Only approved by FIPS140-2 algorithms are enabled +@item Only approved by FIPS140-2 key lengths are allowed for key generation @item Any cryptographic operation will be refused if any of the self-tests failed @end itemize diff --git a/lib/crypto-selftests.c b/lib/crypto-selftests.c index f904b029b2..f915b6d744 100644 --- a/lib/crypto-selftests.c +++ b/lib/crypto-selftests.c @@ -1939,13 +1939,6 @@ static int test_mac(gnutls_mac_algorithm_t mac, return ret; \ } -#define FIPS_STARTUP_ONLY_TEST_CASE(x, func, vectors) case x: \ - if (_gnutls_fips_mode_enabled() != 1) { \ - ret = func(x, V(vectors), flags); \ - if (!(flags & GNUTLS_SELF_TEST_FLAG_ALL) || ret < 0) \ - return ret; \ - } - /*- * gnutls_cipher_self_test: * @flags: GNUTLS_SELF_TEST_FLAG flags @@ -2075,7 +2068,7 @@ int gnutls_mac_self_test(unsigned flags, gnutls_mac_algorithm_t mac) switch (mac) { case GNUTLS_MAC_UNKNOWN: - FIPS_STARTUP_ONLY_TEST_CASE(GNUTLS_MAC_MD5, test_mac, hmac_md5_vectors); + NON_FIPS_CASE(GNUTLS_MAC_MD5, test_mac, hmac_md5_vectors); FALLTHROUGH; CASE(GNUTLS_MAC_SHA1, test_mac, hmac_sha1_vectors); FALLTHROUGH; @@ -2135,7 +2128,7 @@ int gnutls_digest_self_test(unsigned flags, gnutls_digest_algorithm_t digest) switch (digest) { case GNUTLS_DIG_UNKNOWN: - FIPS_STARTUP_ONLY_TEST_CASE(GNUTLS_DIG_MD5, test_digest, md5_vectors); + NON_FIPS_CASE(GNUTLS_DIG_MD5, test_digest, md5_vectors); FALLTHROUGH; CASE(GNUTLS_DIG_SHA1, test_digest, sha1_vectors); FALLTHROUGH; diff --git a/lib/fips.c b/lib/fips.c index 3c43250aaf..75f26f629e 100644 --- a/lib/fips.c +++ b/lib/fips.c @@ -102,14 +102,13 @@ unsigned _gnutls_fips_mode_enabled(void) else f1p = 0; } - f2p = !access(FIPS_SYSTEM_FILE, F_OK); - - if (f1p != 0 && f2p != 0) { + if (f1p != 0) { _gnutls_debug_log("FIPS140-2 mode enabled\n"); ret = GNUTLS_FIPS140_STRICT; goto exit; } + f2p = !access(FIPS_SYSTEM_FILE, F_OK); if (f2p != 0) { /* a funny state where self tests are performed * and ignored */ diff --git a/lib/gnutls.pc.in b/lib/gnutls.pc.in index 46a1eb5d85..15d3ab057c 100644 --- a/lib/gnutls.pc.in +++ b/lib/gnutls.pc.in @@ -19,6 +19,6 @@ Description: Transport Security Layer implementation for the GNU system URL: https://www.gnutls.org/ Version: @VERSION@ Libs: -L${libdir} -lgnutls -Libs.private: @LIBINTL@ @LIBSOCKET@ @INET_PTON_LIB@ @LIBPTHREAD@ @LIB_SELECT@ @TSS_LIBS@ @GMP_LIBS@ @LIBUNISTRING@ @LIBATOMIC_LIBS@ @LIB_CRYPT32@ +Libs.private: @LIBINTL@ @LIBSOCKET@ @INET_PTON_LIB@ @LIBPTHREAD@ @LIB_SELECT@ @TSS_LIBS@ @GMP_LIBS@ @LIBUNISTRING@ @LIBATOMIC_LIBS@ @LIB_CRYPT32@ @LIBNCRYPT@ @GNUTLS_REQUIRES_PRIVATE@ Cflags: -I${includedir} diff --git a/lib/random.c b/lib/random.c index 6462738416..605fc8d51a 100644 --- a/lib/random.c +++ b/lib/random.c @@ -105,9 +105,9 @@ int _gnutls_rnd_preinit(void) #elif defined(ENABLE_FIPS140) /* The FIPS140 random generator is only enabled when we are compiled - * with FIPS support, _and_ the system requires FIPS140. + * with FIPS support, _and_ the system is in FIPS installed state. */ - if (_gnutls_fips_mode_enabled() == 1) { + if (_gnutls_fips_mode_enabled() != 0) { ret = gnutls_crypto_rnd_register(100, &_gnutls_fips_rnd_ops); if (ret < 0) return ret; diff --git a/lib/system/keys-win.c b/lib/system/keys-win.c index 9b7b53e77d..f9a4b1ca9e 100644 --- a/lib/system/keys-win.c +++ b/lib/system/keys-win.c @@ -26,6 +26,7 @@ #define _WIN32_WINNT 0x600 #endif +#include <config.h> #include "gnutls_int.h" #include "errors.h" #include <gnutls/gnutls.h> @@ -45,8 +46,6 @@ #include <winbase.h> #include <winapifamily.h> -#define DYN_NCRYPT - #ifdef __MINGW32__ # include <_mingw.h> # ifdef __MINGW64_VERSION_MAJOR @@ -1521,13 +1520,16 @@ int _gnutls_system_key_init(void) ret = GNUTLS_E_CRYPTO_INIT_FAILED; goto fail; } -#endif ncrypt_init = 1; return 0; fail: FreeLibrary(ncrypt_lib); return ret; +#else + ncrypt_init = 1; + return 0; +#endif } void _gnutls_system_key_deinit(void) diff --git a/tests/Makefile.am b/tests/Makefile.am index a41067f5af..11a083c637 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -567,6 +567,7 @@ endif if !WINDOWS indirect_tests += datefudge-check +noinst_PROGRAMS = datefudge-check endif check_PROGRAMS = $(cpptests) $(ctests) $(indirect_tests) |