WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

configure.ac: add --enable-fips=dev-no-post (WOLFSSL_FIPS_DEV_NO_POST, MAJOR=8) 

and AM_CONDITIONAL BUILD_FIPS_NO_POST. Refactor FIPS dev/ready version setup:
hoist ENABLED_FIPS_DEV / ENABLED_FIPS_READY to set -DWOLFSSL_FIPS_DEV /
-DWOLFSSL_FIPS_READY centrally, and switch the FIPS AS_CASE arms from
`test "$FIPS_VERSION" != "dev"` to `test "$ENABLED_FIPS_DEV" != "yes"` so the
dev semantics extend to v5-dev/v6-dev/lean-aesgcm-dev.

src/include.am: under !BUILD_FIPS_NO_POST, drop fips.c / fips_test.c /
wolfcrypt_first.c / wolfcrypt_last.c from the build (dev-no-post uses no fips
repo content).

wolfssl/wolfcrypt/settings.h, wolfssl/wolfcrypt/wc_compat.h: under
WOLFSSL_FIPS_DEV_NO_POST, squat WOLF_CRYPT_FIPS_H to inhibit fips.h, and change
the FIPS_READY/DEV version block guard to `!defined(HAVE_FIPS_VERSION)`
(required so an externally supplied version is not clobbered).

wolfssl/wolfcrypt/fips_test.h: add WOLFSSL_FIPS_DEV_NO_POST stub block
(fipsCastStatus_get, the PRIVATE_KEY macros) so master builds without the fips
repo.

linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c: accommodate
WOLFSSL_FIPS_DEV_NO_POST (guard verifyCore / CAST / fencepost paths that the
fips repo would otherwise provide; force WC_USE_PIE_FENCEPOSTS_FOR_FIPS).

wolfcrypt/test/test.c: in hmac_sha256_test(), don't expect HMAC_KAT_FIPS_E in
WOLFSSL_FIPS_DEV_NO_POST builds.

wolfssl/wolfcrypt/types.h: add stub macro for
wolfCrypt_SetPrivateKeyReadEnable_fips() when WOLFSSL_FIPS_DEV_NO_POST.
pull/11031/head
Daniel Pouzzner 2026-08-03 23:16:05 -05:00
parent 46fb6b804d
commit c7a2c6c46d
9 changed files with 273 additions and 175 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

377
configure.ac
View File

@ -562,6 +562,13 @@ AS_CASE([$ENABLED_WOLFENGINE],
# v5-RC11 - historical FIPS 140-3, wolfCrypt/fips WCv5.0-RC11
# HAVE_FIPS_VERSION = 5, HAVE_FIPS_VERSION_MINOR = 2.
# v5-RC12 - historical FIPS 140-3, wolfCrypt/fips WCv5.0-RC12
# FIPS dev/ready is always one major increment ahead of the latest tagged
# version:
FIPS_DEVREADY_MAJOR=7
FIPS_DEVREADY_MINOR=0
FIPS_DEVREADY_PATCH=0
AS_CASE([$ENABLED_FIPS],
[no],[
FIPS_VERSION="none"
@ -634,6 +641,7 @@ AS_CASE([$ENABLED_FIPS],
HAVE_FIPS_VERSION_MAJOR=5
HAVE_FIPS_VERSION_MINOR=3
ENABLED_FIPS="yes"
ENABLED_FIPS_READY=yes
DEF_SP_MATH_ALL="no"
DEF_FAST_MATH="yes"
],
@ -643,6 +651,7 @@ AS_CASE([$ENABLED_FIPS],
HAVE_FIPS_VERSION_MINOR=2
HAVE_FIPS_VERSION_PATCH=1
ENABLED_FIPS="yes"
ENABLED_FIPS_DEV=yes
# for dev, DEF_SP_MATH_ALL and DEF_FAST_MATH follow non-FIPS defaults (currently sp-math-all)
],
[v5-kcapi],[
@ -653,7 +662,7 @@ AS_CASE([$ENABLED_FIPS],
ENABLED_FIPS="yes"
# for dev, DEF_SP_MATH_ALL and DEF_FAST_MATH follow non-FIPS defaults (currently sp-math-all)
],
[v6|v6-dev],[
[v6],[
FIPS_VERSION="v6"
HAVE_FIPS_VERSION=6
HAVE_FIPS_VERSION_MAJOR=6
@ -663,6 +672,16 @@ AS_CASE([$ENABLED_FIPS],
DEF_SP_MATH_ALL="yes"
DEF_FAST_MATH="no"
],
[v6-dev],[
FIPS_VERSION="v6"
HAVE_FIPS_VERSION=6
HAVE_FIPS_VERSION_MAJOR=6
HAVE_FIPS_VERSION_MINOR=0
HAVE_FIPS_VERSION_PATCH=0
ENABLED_FIPS="yes"
ENABLED_FIPS_DEV=yes
# for dev, DEF_SP_MATH_ALL and DEF_FAST_MATH follow non-FIPS defaults (currently sp-math-all)
],
[v7],[
FIPS_VERSION="v7"
HAVE_FIPS_VERSION=7
@ -673,32 +692,60 @@ AS_CASE([$ENABLED_FIPS],
DEF_SP_MATH_ALL="yes"
DEF_FAST_MATH="no"
],
# Should always remain one ahead of the latest so as not to be confused with
# the latest
[ready|v7-ready],[
FIPS_VERSION="ready"
HAVE_FIPS_VERSION=8
HAVE_FIPS_VERSION_MAJOR=8
HAVE_FIPS_VERSION_MINOR=0
HAVE_FIPS_VERSION_PATCH=0
HAVE_FIPS_VERSION_MAJOR=$FIPS_DEVREADY_MAJOR
HAVE_FIPS_VERSION_MINOR=$FIPS_DEVREADY_MINOR
HAVE_FIPS_VERSION_PATCH=$FIPS_DEVREADY_PATCH
ENABLED_FIPS="yes"
ENABLED_FIPS_READY=yes
DEF_SP_MATH_ALL="yes"
DEF_FAST_MATH="no"
],
[dev|v7-dev],[
FIPS_VERSION="dev"
HAVE_FIPS_VERSION_MAJOR=8
HAVE_FIPS_VERSION_MINOR=0
HAVE_FIPS_VERSION_PATCH=0
HAVE_FIPS_VERSION_MAJOR=$FIPS_DEVREADY_MAJOR
HAVE_FIPS_VERSION_MINOR=$FIPS_DEVREADY_MINOR
HAVE_FIPS_VERSION_PATCH=$FIPS_DEVREADY_PATCH
ENABLED_FIPS="yes"
ENABLED_FIPS_DEV=yes
# for dev, DEF_SP_MATH_ALL and DEF_FAST_MATH follow non-FIPS defaults (currently sp-math-all)
],
[lean-aesgcm|lean-aesgcm-ready|lean-aesgcm-dev],[
FIPS_VERSION="$ENABLED_FIPS"
HAVE_FIPS_VERSION_MAJOR=8
HAVE_FIPS_VERSION_MINOR=0
HAVE_FIPS_VERSION_PATCH=0
[dev-no-post],[
FIPS_VERSION="dev-no-post"
HAVE_FIPS_VERSION_MAJOR=$FIPS_DEVREADY_MAJOR
HAVE_FIPS_VERSION_MINOR=$FIPS_DEVREADY_MINOR
HAVE_FIPS_VERSION_PATCH=$FIPS_DEVREADY_PATCH
ENABLED_FIPS="yes"
ENABLED_FIPS_DEV=yes
# for dev, DEF_SP_MATH_ALL and DEF_FAST_MATH follow non-FIPS defaults (currently sp-math-all)
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FIPS_DEV_NO_POST"
],
[lean-aesgcm],[
FIPS_VERSION="$ENABLED_FIPS"
HAVE_FIPS_VERSION_MAJOR=$FIPS_DEVREADY_MAJOR
HAVE_FIPS_VERSION_MINOR=$FIPS_DEVREADY_MINOR
HAVE_FIPS_VERSION_PATCH=$FIPS_DEVREADY_PATCH
ENABLED_FIPS="yes"
# No PK in lean-aesgcm
],
[lean-aesgcm-ready],[
FIPS_VERSION="$ENABLED_FIPS"
HAVE_FIPS_VERSION_MAJOR=$FIPS_DEVREADY_MAJOR
HAVE_FIPS_VERSION_MINOR=$FIPS_DEVREADY_MINOR
HAVE_FIPS_VERSION_PATCH=$FIPS_DEVREADY_PATCH
ENABLED_FIPS="yes"
ENABLED_FIPS_READY=yes
# No PK in lean-aesgcm
],
[lean-aesgcm-dev],[
FIPS_VERSION="$ENABLED_FIPS"
HAVE_FIPS_VERSION_MAJOR=$FIPS_DEVREADY_MAJOR
HAVE_FIPS_VERSION_MINOR=$FIPS_DEVREADY_MINOR
HAVE_FIPS_VERSION_PATCH=$FIPS_DEVREADY_PATCH
ENABLED_FIPS="yes"
ENABLED_FIPS_DEV=yes
],
[
AS_IF([test "$ENABLED_FIPS" = "yes"],[ENABLED_FIPS="(unset)"],[ENABLED_FIPS=\"$ENABLED_FIPS\"])
@ -717,6 +764,11 @@ if test -z "$HAVE_FIPS_VERSION_PATCH"
then
HAVE_FIPS_VERSION_PATCH=0
fi
AC_SUBST([HAVE_FIPS_VERSION_MAJOR])
AC_SUBST([HAVE_FIPS_VERSION_MINOR])
AC_SUBST([HAVE_FIPS_VERSION_PATCH])
if test -z "$HAVE_FIPS_VERSION"
then
HAVE_FIPS_VERSION="$HAVE_FIPS_VERSION_MAJOR"
@ -733,7 +785,7 @@ AS_CASE([$FIPS_VERSION],
AS_IF([ test -s $srcdir/wolfcrypt/src/fips.c ],
[AC_MSG_ERROR([FIPS source tree is incompatible with non-FIPS build (requires --enable-fips)])])
],
[disabled],
[disabled|dev-no-post],
[],
[
AS_IF([ ! test -s $srcdir/wolfcrypt/src/fips.c],
@ -741,6 +793,30 @@ AS_CASE([$FIPS_VERSION],
]
)
if test "$ENABLED_FIPS_DEV" = "yes"
then
# Only signal WOLFSSL_FIPS_DEV if there is no wolfCrypt overlay, assuring
# that v5-dev and v6-dev are excluded.
if test $HAVE_FIPS_VERSION_MAJOR -ge $FIPS_DEVREADY_MAJOR
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FIPS_DEV"
fi
else
ENABLED_FIPS_DEV=no
fi
if test "$ENABLED_FIPS_READY" = "yes"
then
# Only signal WOLFSSL_FIPS_DEV if there is no wolfCrypt overlay, assuring
# that v5-ready is excluded.
if test $HAVE_FIPS_VERSION_MAJOR -ge $FIPS_DEVREADY_MAJOR
then
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FIPS_READY"
fi
else
ENABLED_FIPS_READY=no
fi
# For reproducible build, gate out from the build anything that might
# introduce semantically frivolous jitter, maximizing chance of
# identical object files.
@ -6849,14 +6925,7 @@ AC_ARG_ENABLE([aeskeywrap],
# FIPS feature and macro setup
AS_CASE([$FIPS_VERSION],
[v7|ready|dev],[ # FIPS 140-3 PQ-FS
AS_IF([test "$FIPS_VERSION" = "dev"],
ENABLED_FIPS_DEV=yes
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FIPS_DEV"])
AS_IF([test "$FIPS_VERSION" = "ready" || test "$FIPS_VERSION" = "v7"],
ENABLED_FIPS_READY=yes
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FIPS_READY"])
[v7|ready|dev|dev-no-post],[ # FIPS 140-3 PQ-FS
AM_CFLAGS="$AM_CFLAGS \
-DHAVE_FIPS \
@ -6887,35 +6956,35 @@ AS_CASE([$FIPS_VERSION],
# protocol section
AS_IF([test "$ENABLED_WOLFSSH" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_ssh" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ssh" != "no")],
[enable_ssh="yes"])
AS_IF([test "$ENABLED_HKDF" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_hkdf" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_hkdf" != "no")],
[ENABLED_HKDF="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_HKDF"])
AS_IF([test "x$ENABLED_PWDBASED" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_pwdbased" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_pwdbased" != "no")],
[ENABLED_PWDBASED="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_PBKDF2 -DHAVE_AESGCM"])
AS_IF([test "x$ENABLED_SRTP" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_srtp" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_srtp" != "no")],
[ENABLED_SRTP="yes"])
AS_IF([test "x$ENABLED_SRTP_KDF" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_srtp_kdf" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_srtp_kdf" != "no")],
[ENABLED_SRTP_KDF="yes"])
# public key section
AS_IF([test "$ENABLED_KEYGEN" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_keygen" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_keygen" != "no")],
[ENABLED_KEYGEN="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KEY_GEN"])
# AS_IF([test "$ENABLED_COMPKEY" != "yes" &&
# (test "$FIPS_VERSION" != "dev" || test "$enable_compkey" != "yes")],
# (test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_compkey" != "yes")],
# [ENABLED_COMPKEY="yes"])
AS_IF([test "$ENABLED_RSAPSS" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_rsapss" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_rsapss" != "no")],
[ENABLED_RSAPSS="yes"; AM_CFLAGS="$AM_CFLAGS -DWC_RSA_PSS"])
AS_IF([test "$ENABLED_DH" != "no" &&
@ -6923,50 +6992,50 @@ AS_CASE([$FIPS_VERSION],
[enable_dh="no"; ENABLED_DH="no"; AM_CFLAGS="$AM_CFLAGS -DNO_DH"])
AS_IF([test "$ENABLED_ECC" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_ecc" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ecc" != "no")],
[ENABLED_ECC="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC -DTFM_ECC256"
AS_IF([test "$ENABLED_ECC_SHAMIR" = "yes"],
[AM_CFLAGS="$AM_CFLAGS -DECC_SHAMIR"])])
AS_IF([test "$ENABLED_ED25519" = "no" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_ed25519" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ed25519" != "no")],
[ENABLED_ED25519="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_ED25519 -DHAVE_ED25519_KEY_IMPORT"])
AS_IF([test "$ENABLED_CURVE25519" != "no" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_curve25519" = "")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_curve25519" = "")],
[ENABLED_CURVE25519="no"; AM_CFLAGS="$AM_CFLAGS"])
AS_IF([test "x$ENABLED_ED448" != "xyes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_ed448" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ed448" != "no")],
[ENABLED_ED448="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_ED448 -DHAVE_ED448_KEY_IMPORT"])
AS_IF([test "$ENABLED_CURVE448" != "no" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_curve448" = "")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_curve448" = "")],
[ENABLED_CURVE448="no"; AM_CFLAGS="$AM_CFLAGS"])
AS_IF([test "x$ENABLED_ED25519_STREAM" != "xyes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_ed25519_stream" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ed25519_stream" != "no")],
[ENABLED_ED25519_STREAM="yes"])
AS_IF([test "x$ENABLED_ED448_STREAM" != "xyes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_ed448_stream" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ed448_stream" != "no")],
[ENABLED_ED448_STREAM="yes"])
AS_IF([test "x$ENABLED_ECCCUSTCURVES" != "xno" &&
test "$FIPS_VERSION" != "dev"],
test "$ENABLED_FIPS_DEV" != "yes"],
[AC_MSG_WARN([Forcing off ecccustcurves for FIPS ${FIPS_VERSION}.])
ENABLED_ECCCUSTCURVES="no"])
# Hashing section
AS_IF([test "x$ENABLED_SHA3" != "xyes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_sha3" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha3" != "no")],
[ENABLED_SHA3="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA3"])
AS_IF([test "$ENABLED_SHA224" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_sha224" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha224" != "no")],
[ENABLED_SHA224="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA224"])
AS_IF([test "$ENABLED_SHA512" = "no" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_sha512" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha512" != "no")],
[ENABLED_SHA512="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512 -DWOLFSSL_SHA384"])
# SHA512-224 and SHA512-256 enabled for FIPS v7+ (needed for ML-DSA
@ -6974,51 +7043,51 @@ AS_CASE([$FIPS_VERSION],
# Shake128 because we're testing SHAKE256
AS_IF([test "x$ENABLED_SHAKE128" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_shake128" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_shake128" != "no")],
[ENABLED_SHAKE128="yes"])
# Shake256 mandated for ED448
AS_IF([test "x$ENABLED_SHAKE256" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_shake256" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_shake256" != "no")],
[ENABLED_SHAKE256="yes"])
# Aes section
AS_IF([test "$ENABLED_AESCCM" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesccm" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesccm" != "no")],
[ENABLED_AESCCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESCCM"])
AS_IF([test "$ENABLED_AESCTR" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesctr" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesctr" != "no")],
[ENABLED_AESCTR="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_COUNTER"])
AS_IF([test "$ENABLED_CMAC" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_cmac" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_cmac" != "no")],
[ENABLED_CMAC="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CMAC"])
AS_IF([test "$ENABLED_AESGCM" = "no" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesgcm" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesgcm" != "no")],
[ENABLED_AESGCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESGCM"; AM_CCASFLAGS="$AM_CCASFLAGS -DHAVE_AESGCM"])
AS_IF([test "$ENABLED_AESGCM_STREAM" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesgcm_stream" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesgcm_stream" != "no")],
[ENABLED_AESGCM_STREAM="yes"])
AS_IF([test "x$ENABLED_AESOFB" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesofb" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesofb" != "no")],
[ENABLED_AESOFB="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_OFB"])
AS_IF([test "x$ENABLED_AESCFB" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aescfb" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aescfb" != "no")],
[ENABLED_AESCFB="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_CFB"])
AS_IF([test "x$ENABLED_AESXTS" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesxts" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesxts" != "no")],
[ENABLED_AESXTS="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_XTS"])
AS_IF([test "x$ENABLED_AESXTS" = "xyes" && test "x$ENABLED_AESNI" = "xyes"],
[AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_AES_XTS"])
AS_IF([test "x$ENABLED_AESXTS_STREAM" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesxts_stream" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesxts_stream" != "no")],
[ENABLED_AESXTS_STREAM="yes"])
AS_IF([(test "$ENABLED_AESCCM" != "no" && test "$HAVE_AESCCM_PORT" != "yes") ||
@ -7028,12 +7097,12 @@ AS_CASE([$FIPS_VERSION],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB"])
AS_IF([test "x$ENABLED_AESKEYWRAP" != "xyes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aeskeywrap" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aeskeywrap" != "no")],
[ENABLED_AESKEYWRAP="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AES_KEYWRAP"])
# Post-Quantum section
AS_IF([test "$ENABLED_MLKEM" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_mlkem" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_mlkem" != "no")],
[ENABLED_MLKEM="yes"
ENABLED_MLKEM512="yes"
ENABLED_MLKEM768="yes"
@ -7043,7 +7112,7 @@ AS_CASE([$FIPS_VERSION],
ENABLED_MLKEM_DECAPSULATE="yes"])
AS_IF([test "$ENABLED_MLDSA" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_dilithium" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_dilithium" != "no")],
[ENABLED_MLDSA="yes"
ENABLED_MLDSA44="yes"
ENABLED_MLDSA65="yes"
@ -7053,17 +7122,17 @@ AS_CASE([$FIPS_VERSION],
ENABLED_MLDSA_VERIFY="yes"])
AS_IF([test "$ENABLED_XMSS" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_xmss" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_xmss" != "no")],
[ENABLED_XMSS="yes"])
AS_IF([test "$ENABLED_LMS" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_lms" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_lms" != "no")],
[ENABLED_LMS="yes"])
# LMS: enable SHA-256/192 and SHAKE256 parameter sets for FIPS v7
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_LMS_SHA256_192 -DWOLFSSL_LMS_SHAKE256"
AS_IF([test "$ENABLED_SLHDSA" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_slhdsa" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_slhdsa" != "no")],
[ENABLED_SLHDSA="yes"
SLHDSA_PARAM_128S="yes"
SLHDSA_PARAM_128F="yes"
@ -7081,12 +7150,12 @@ AS_CASE([$FIPS_VERSION],
# SHA-256 DRBG -- cannot be disabled at build time in FIPS mode
AS_IF([test "$ENABLED_SHA256_DRBG" != "yes" &&
test "$FIPS_VERSION" != "dev"],
test "$ENABLED_FIPS_DEV" != "yes"],
[AC_MSG_ERROR([Can not disable SHA256-DRBG at build time in FIPS mode. Disable at run-time with wc_Sha256Drbg_Disable() or wc_Sha256Drbg_Disable_fips()])])
# SHA-512 DRBG -- cannot be disabled at build time in FIPS mode
AS_IF([test "$ENABLED_SHA512_DRBG" != "yes" &&
test "$FIPS_VERSION" != "dev"],
test "$ENABLED_FIPS_DEV" != "yes"],
[AC_MSG_ERROR([Can not disable SHA512-DRBG at build time in FIPS mode. Disable it at run-time with wc_Sha512Drbg_Disable() or wc_Sha512Drbg_Disable_fips()])])
# Old TLS requires MD5 + HMAC, which is not allowed under FIPS 140-3
@ -7132,82 +7201,82 @@ AS_CASE([$FIPS_VERSION],
# protocol section
AS_IF([test "$ENABLED_WOLFSSH" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_ssh" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ssh" != "no")],
[enable_ssh="yes"])
AS_IF([test "$ENABLED_HKDF" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_hkdf" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_hkdf" != "no")],
[ENABLED_HKDF="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_HKDF"])
AS_IF([test "x$ENABLED_PWDBASED" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_pwdbased" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_pwdbased" != "no")],
[ENABLED_PWDBASED="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_PBKDF2 -DHAVE_AESGCM"])
AS_IF([test "x$ENABLED_SRTP" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_srtp" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_srtp" != "no")],
[ENABLED_SRTP="yes"])
AS_IF([test "x$ENABLED_SRTP_KDF" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_srtp_kdf" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_srtp_kdf" != "no")],
[ENABLED_SRTP_KDF="yes"])
# public key section
AS_IF([test "$ENABLED_KEYGEN" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_keygen" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_keygen" != "no")],
[ENABLED_KEYGEN="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KEY_GEN"])
# AS_IF([test "$ENABLED_COMPKEY" != "yes" &&
# (test "$FIPS_VERSION" != "dev" || test "$enable_compkey" != "yes")],
# (test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_compkey" != "yes")],
# [ENABLED_COMPKEY="yes"])
AS_IF([test "$ENABLED_RSAPSS" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_rsapss" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_rsapss" != "no")],
[ENABLED_RSAPSS="yes"; AM_CFLAGS="$AM_CFLAGS -DWC_RSA_PSS"])
AS_IF([test "$ENABLED_ECC" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_ecc" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ecc" != "no")],
[ENABLED_ECC="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC -DTFM_ECC256"
AS_IF([test "$ENABLED_ECC_SHAMIR" = "yes"],
[AM_CFLAGS="$AM_CFLAGS -DECC_SHAMIR"])])
AS_IF([test "$ENABLED_ED25519" = "no" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_ed25519" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ed25519" != "no")],
[ENABLED_ED25519="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_ED25519 -DHAVE_ED25519_KEY_IMPORT"])
AS_IF([test "$ENABLED_CURVE25519" != "no" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_curve25519" = "")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_curve25519" = "")],
[ENABLED_CURVE25519="no"; AM_CFLAGS="$AM_CFLAGS"])
AS_IF([test "x$ENABLED_ED448" != "xyes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_ed448" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ed448" != "no")],
[ENABLED_ED448="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_ED448 -DHAVE_ED448_KEY_IMPORT"])
AS_IF([test "$ENABLED_CURVE448" != "no" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_curve448" = "")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_curve448" = "")],
[ENABLED_CURVE448="no"; AM_CFLAGS="$AM_CFLAGS"])
AS_IF([test "x$ENABLED_ED25519_STREAM" != "xyes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_ed25519_stream" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ed25519_stream" != "no")],
[ENABLED_ED25519_STREAM="yes"])
AS_IF([test "x$ENABLED_ED448_STREAM" != "xyes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_ed448_stream" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ed448_stream" != "no")],
[ENABLED_ED448_STREAM="yes"])
AS_IF([test "x$ENABLED_ECCCUSTCURVES" != "xno" &&
test "$FIPS_VERSION" != "dev"],
test "$ENABLED_FIPS_DEV" != "yes"],
[AC_MSG_WARN([Forcing off ecccustcurves for FIPS ${FIPS_VERSION}.])
ENABLED_ECCCUSTCURVES="no"])
# Hashing section
AS_IF([test "x$ENABLED_SHA3" != "xyes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_sha3" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha3" != "no")],
[ENABLED_SHA3="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA3"])
AS_IF([test "$ENABLED_SHA224" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_sha224" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha224" != "no")],
[ENABLED_SHA224="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA224"])
AS_IF([test "$ENABLED_SHA512" = "no" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_sha512" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha512" != "no")],
[ENABLED_SHA512="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512 -DWOLFSSL_SHA384"])
# SHA512-224 and SHA512-256 are not in-boundary in FIPS v6.
@ -7215,51 +7284,51 @@ AS_CASE([$FIPS_VERSION],
# Shake128 because we're testing SHAKE256
AS_IF([test "x$ENABLED_SHAKE128" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_shake128" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_shake128" != "no")],
[ENABLED_SHAKE128="yes"])
# Shake256 mandated for ED448
AS_IF([test "x$ENABLED_SHAKE256" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_shake256" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_shake256" != "no")],
[ENABLED_SHAKE256="yes"])
# Aes section
AS_IF([test "$ENABLED_AESCCM" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesccm" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesccm" != "no")],
[ENABLED_AESCCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESCCM"])
AS_IF([test "$ENABLED_AESCTR" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesctr" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesctr" != "no")],
[ENABLED_AESCTR="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_COUNTER"])
AS_IF([test "$ENABLED_CMAC" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_cmac" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_cmac" != "no")],
[ENABLED_CMAC="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CMAC"])
AS_IF([test "$ENABLED_AESGCM" = "no" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesgcm" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesgcm" != "no")],
[ENABLED_AESGCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESGCM"; AM_CCASFLAGS="$AM_CCASFLAGS -DHAVE_AESGCM"])
AS_IF([test "$ENABLED_AESGCM_STREAM" != "yes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesgcm_stream" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesgcm_stream" != "no")],
[ENABLED_AESGCM_STREAM="yes"])
AS_IF([test "x$ENABLED_AESOFB" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesofb" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesofb" != "no")],
[ENABLED_AESOFB="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_OFB"])
AS_IF([test "x$ENABLED_AESCFB" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aescfb" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aescfb" != "no")],
[ENABLED_AESCFB="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_CFB"])
AS_IF([test "x$ENABLED_AESXTS" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesxts" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesxts" != "no")],
[ENABLED_AESXTS="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_XTS"])
AS_IF([test "x$ENABLED_AESXTS" = "xyes" && test "x$ENABLED_AESNI" = "xyes"],
[AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_AES_XTS"])
AS_IF([test "x$ENABLED_AESXTS_STREAM" = "xno" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aesxts_stream" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesxts_stream" != "no")],
[ENABLED_AESXTS_STREAM="yes"])
AS_IF([(test "$ENABLED_AESCCM" != "no" && test "$HAVE_AESCCM_PORT" != "yes") ||
@ -7269,7 +7338,7 @@ AS_CASE([$FIPS_VERSION],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB"])
AS_IF([test "x$ENABLED_AESKEYWRAP" != "xyes" &&
(test "$FIPS_VERSION" != "dev" || test "$enable_aeskeywrap" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aeskeywrap" != "no")],
[ENABLED_AESKEYWRAP="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AES_KEYWRAP"])
# Old TLS requires MD5 + HMAC, which is not allowed under FIPS 140-3
@ -7281,11 +7350,6 @@ AS_CASE([$FIPS_VERSION],
[lean-aesgcm|lean-aesgcm-ready|lean-aesgcm-dev],[
AS_IF([test "$FIPS_VERSION" = "lean-aesgcm-dev"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FIPS_DEV"])
AS_IF([test "$FIPS_VERSION" = "lean-aesgcm-ready"],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FIPS_READY"])
AM_CFLAGS="$AM_CFLAGS \
-DHAVE_FIPS \
-DHAVE_FIPS_VERSION=$HAVE_FIPS_VERSION \
@ -7318,19 +7382,19 @@ AS_CASE([$FIPS_VERSION],
[ENABLED_WOLFSSH="no"; enable_ssh="no"])
AS_IF([test "$ENABLED_HKDF" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_hkdf" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_hkdf" != "yes")],
[enable_hkdf="no"; ENABLED_HKDF="no"; AM_CFLAGS="$AM_CFLAGS -UHAVE_HKDF"])
AS_IF([test "$ENABLED_PWDBASED" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_pwdbased" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_pwdbased" != "yes")],
[enable_pwdbased="no"; ENABLED_PWDBASED="no"])
AS_IF([test "$ENABLED_SRTP" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_srtp" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_srtp" != "yes")],
[enable_srtp="no"; ENABLED_SRTP="no"])
AS_IF([test "$ENABLED_SRTP_KDF" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_srtp_kdf" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_srtp_kdf" != "yes")],
[enable_srtp_kdf="no"; ENABLED_SRTP_KDF="no"])
AS_IF([test "$ENABLED_PKCS8" != "no" && test "$enable_pkcs8" != "yes"],
@ -7339,151 +7403,151 @@ AS_CASE([$FIPS_VERSION],
# public key section
AS_IF([test "$ENABLED_SP_MATH_ALL" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_sp_math_all" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sp_math_all" != "yes")],
[enable_sp_math_all="no"; ENABLED_SP_MATH_ALL="no"])
AS_IF([test "$ENABLED_KEYGEN" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_keygen" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_keygen" != "yes")],
[enable_keygen="no"; ENABLED_KEYGEN="no"; AM_CFLAGS="$AM_CFLAGS -UWOLFSSL_KEY_GEN"])
AS_IF([test "$ENABLED_COMPKEY" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_compkey" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_compkey" != "yes")],
[enable_compkey="no"; ENABLED_COMPKEY="no"])
AS_IF([test "$ENABLED_RSA" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_rsa" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_rsa" != "yes")],
[enable_rsa="no"; ENABLED_RSA="no"; AM_CFLAGS="$AM_CFLAGS -DNO_RSA"])
AS_IF([test "$ENABLED_RSAPSS" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_rsapss" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_rsapss" != "yes")],
[enable_rsapss="no"; ENABLED_RSAPSS="no"; AM_CFLAGS="$AM_CFLAGS -UWC_RSA_PSS"])
AS_IF([test "$ENABLED_DH" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_dh" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_dh" != "yes")],
[enable_dh="no"; ENABLED_DH="no"; AM_CFLAGS="$AM_CFLAGS -DNO_DH"])
AS_IF([test "$ENABLED_ECC" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_ecc" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ecc" != "yes")],
[enable_ecc="no"; ENABLED_ECC="no"; ENABLED_ECCMINSZ="n/a"; ENABLED_ECC_SHAMIR="no"; AM_CFLAGS="$AM_CFLAGS -UHAVE_ECC -UTFM_ECC256 -UECC_MIN_KEY_SZ -UECC_SHAMIR"])
AS_IF([test "$ENABLED_ED25519" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_ed25519" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ed25519" != "yes")],
[enable_ed25519="no"; ENABLED_ED25519="no"; AM_CFLAGS="$AM_CFLAGS -UHAVE_ED25519 -UHAVE_ED25519_KEY_IMPORT"])
AS_IF([test "$ENABLED_CURVE25519" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_curve25519" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_curve25519" != "yes")],
[enable_curve25519="no"; ENABLED_CURVE25519="no"; AM_CFLAGS="$AM_CFLAGS -UHAVE_CURVE25519"])
AS_IF([test "$ENABLED_ED448" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_ed448" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ed448" != "yes")],
[enable_ed448="no"; ENABLED_ED448="no"; AM_CFLAGS="$AM_CFLAGS -UHAVE_ED448 -UHAVE_ED448_KEY_IMPORT"])
AS_IF([test "$ENABLED_CURVE448" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_curve448" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_curve448" != "yes")],
[enable_curve448="no"; ENABLED_CURVE448="no"; AM_CFLAGS="$AM_CFLAGS -UHAVE_CURVE448"])
AS_IF([test "$ENABLED_ED25519_STREAM" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_ed25519_stream" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ed25519_stream" != "yes")],
[enable_ed25519_stream="no"; ENABLED_ED25519_STREAM="no"])
AS_IF([test "$ENABLED_ED448_STREAM" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_ed448_stream" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ed448_stream" != "yes")],
[enable_ed448_stream="no"; ENABLED_ED448_STREAM="no"])
AS_IF([test "$ENABLED_ECCCUSTCURVES" != "no" &&
test "$FIPS_VERSION" != "lean-aesgcm-dev"],
test "$ENABLED_FIPS_DEV" != "yes"],
[ENABLED_ECCCUSTCURVES="no"])
# Hashing section
AS_IF([test "$ENABLED_SHA" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_sha" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha" != "yes")],
[enable_sha="no"; ENABLED_SHA="no"; AM_CFLAGS="$AM_CFLAGS -DNO_SHA"])
AS_IF([test "$ENABLED_SHA256" = "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_sha256" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha256" != "no")],
[enable_sha256="yes"; ENABLED_SHA256="yes"; AM_CFLAGS="$AM_CFLAGS -UNO_SHA256"])
AS_IF([test "$ENABLED_SHA3" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_sha3" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha3" != "yes")],
[enable_sha3="no"; ENABLED_SHA3="no"; AM_CFLAGS="$AM_CFLAGS -UWOLFSSL_SHA3"])
AS_IF([test "$ENABLED_SHAKE128" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_shake128" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_shake128" != "yes")],
[enable_shake128="no"; ENABLED_SHAKE128="no"])
AS_IF([test "$ENABLED_SHAKE256" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_shake256" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_shake256" != "yes")],
[enable_shake256="no"; ENABLED_SHAKE256="no"])
AS_IF([test "$ENABLED_SHA224" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_sha224" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha224" != "yes")],
[enable_sha224="no"; ENABLED_SHA224="no"; AM_CFLAGS="$AM_CFLAGS -UWOLFSSL_SHA224"])
AS_IF([test "$ENABLED_SHA384" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_sha384" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha384" != "yes")],
[enable_sha384="no"; ENABLED_SHA384="no"; AM_CFLAGS="$AM_CFLAGS -UWOLFSSL_SHA384 -UWOLFSSL_SHA384"])
AS_IF([test "$ENABLED_SHA512" = "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_sha512" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha512" != "no")],
[enable_sha512="yes"; ENABLED_SHA512="yes"; ENABLED_SHA512_DRBG="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512 -DWOLFSSL_SHA384"])
# SHA512-224 and SHA512-256 are SHA-2 algorithms not in our FIPS algorithm list
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NOSHA512_224 -DWOLFSSL_NOSHA512_256"
AS_IF([test "$ENABLED_SHAKE128" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_shake128" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_shake128" != "yes")],
[enable_shake128="no"; ENABLED_SHAKE128="no"])
AS_IF([test "$ENABLED_SHAKE256" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_shake256" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_shake256" != "yes")],
[enable_shake256="no"; ENABLED_SHAKE256="no"])
AS_IF([test "$ENABLED_MLKEM" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_mlkem" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_mlkem" != "yes")],
[enable_mlkem="no"; ENABLED_MLKEM="no"])
AS_IF([test "$ENABLED_MD5" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_md5" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_md5" != "yes")],
[enable_md5="no"; ENABLED_MD5="no"; AM_CFLAGS="$AM_CFLAGS -DNO_MD5"])
# Aes section
AS_IF([test "$ENABLED_AESCBC" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_aescbc" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aescbc" != "yes")],
[enable_aescbc="no"; ENABLED_AESCBC="no"; AM_CFLAGS="$AM_CFLAGS -DNO_AES_CBC"])
AS_IF([test "$ENABLED_AESCCM" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_aesccm" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesccm" != "yes")],
[enable_aesccm="no"; ENABLED_AESCCM="no"; AM_CFLAGS="$AM_CFLAGS -UHAVE_AESCCM"])
AS_IF([test "$ENABLED_AESCTR" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_aesctr" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesctr" != "yes")],
[enable_aesctr="no"; ENABLED_AESCTR="no"; AM_CFLAGS="$AM_CFLAGS -UWOLFSSL_AES_COUNTER"])
AS_IF([test "$ENABLED_CMAC" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_cmac" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_cmac" != "yes")],
[enable_cmac="no"; ENABLED_CMAC="no"; AM_CFLAGS="$AM_CFLAGS -UWOLFSSL_CMAC"])
AS_IF([test "$ENABLED_AESGCM" = "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_aesgcm" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesgcm" != "no")],
[ENABLED_AESGCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESGCM"; AM_CCASFLAGS="$AM_CCASFLAGS -DHAVE_AESGCM"])
AS_IF([test "$ENABLED_AESGCM_STREAM" != "yes" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_aesgcm_stream" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesgcm_stream" != "no")],
[ENABLED_AESGCM_STREAM="yes"])
AS_IF([test "$ENABLED_AESOFB" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_aesofb" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesofb" != "yes")],
[enable_aesofb="no"; ENABLED_AESOFB="no"; AM_CFLAGS="$AM_CFLAGS -UWOLFSSL_AES_OFB"])
AS_IF([test "$ENABLED_AESCFB" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_aescfb" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aescfb" != "yes")],
[enable_aescfb="no"; ENABLED_AESCFB="no"; AM_CFLAGS="$AM_CFLAGS -UWOLFSSL_AES_CFB"])
AS_IF([test "$ENABLED_AESXTS" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_aesxts" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesxts" != "yes")],
[enable_aesxts="no"; ENABLED_AESXTS="no"; AM_CFLAGS="$AM_CFLAGS -UWOLFSSL_AES_XTS"])
AS_IF([test "$ENABLED_AESXTS" = "yes" && test "$ENABLED_AESNI" = "yes"],
[AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_AES_XTS"])
AS_IF([test "$ENABLED_AESXTS_STREAM" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_aesxts_stream" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesxts_stream" != "yes")],
[enable_aesxts_stream="no"; ENABLED_AESXTS_STREAM="no"])
AS_IF([(test "$ENABLED_AESCCM" != "no" && test "$HAVE_AESCCM_PORT" != "yes") ||
@ -7493,7 +7557,7 @@ AS_CASE([$FIPS_VERSION],
[AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB"])
AS_IF([test "$ENABLED_AESKEYWRAP" != "no" &&
(test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_aeskeywrap" != "yes")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aeskeywrap" != "yes")],
[enable_aeskeywrap="no"; ENABLED_AESKEYWRAP="no"; AM_CFLAGS="$AM_CFLAGS -UHAVE_AES_KEYWRAP"])
# Old TLS requires MD5 + HMAC, which is not allowed under FIPS 140-3
@ -7539,19 +7603,19 @@ AS_CASE([$FIPS_VERSION],
# force various features to FIPS 140-3 defaults, unless overridden with dev:
AS_IF([test "$ENABLED_KEYGEN" != "yes" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_keygen" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_keygen" != "no")],
[ENABLED_KEYGEN="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_KEY_GEN"])
AS_IF([test "$ENABLED_SHA224" != "yes" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_sha224" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha224" != "no")],
[ENABLED_SHA224="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA224"])
AS_IF([test "$ENABLED_SHA3" != "yes" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_sha3" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha3" != "no")],
[ENABLED_SHA3="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA3"])
AS_IF([test "$ENABLED_WOLFSSH" != "yes" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_ssh" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ssh" != "no")],
[enable_ssh="yes"])
# Shake128 is a SHA-3 algorithm outside the v5 FIPS algorithm list
@ -7570,7 +7634,7 @@ AS_CASE([$FIPS_VERSION],
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NOSHA512_224 -DWOLFSSL_NOSHA512_256"
AS_IF([test "$ENABLED_AESCCM" != "yes" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_aesccm" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesccm" != "no")],
[ENABLED_AESCCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESCCM"])
AS_IF([test "$ENABLED_AESXTS" = "yes" &&
@ -7579,37 +7643,37 @@ AS_CASE([$FIPS_VERSION],
ENABLED_AESXTS="no"])
AS_IF([test "$ENABLED_RSAPSS" != "yes" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_rsapss" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_rsapss" != "no")],
[ENABLED_RSAPSS="yes"; AM_CFLAGS="$AM_CFLAGS -DWC_RSA_PSS"])
AS_IF([test "$ENABLED_ECC" != "yes" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_ecc" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_ecc" != "no")],
[ENABLED_ECC="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC -DTFM_ECC256"
AS_IF([test "$ENABLED_ECC_SHAMIR" = "yes" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_eccshamir" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_eccshamir" != "no")],
[AM_CFLAGS="$AM_CFLAGS -DECC_SHAMIR"])])
AS_IF([test "$ENABLED_AESCTR" != "yes" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_aesctr" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesctr" != "no")],
[ENABLED_AESCTR="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_COUNTER"])
AS_IF([test "$ENABLED_CMAC" != "yes" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_cmac" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_cmac" != "no")],
[ENABLED_CMAC="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CMAC"])
AS_IF([test "$ENABLED_HKDF" != "yes" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_hkdf" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_hkdf" != "no")],
[ENABLED_HKDF="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_HKDF"])
AS_IF([test "$ENABLED_INTELRDSEED" = "yes" || test "$ENABLED_AMDRDSEED" = "yes" ],
[AM_CFLAGS="$AM_CFLAGS -DFORCE_FAILURE_RDSEED"])
AS_IF([test "$ENABLED_SHA512" = "no" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_sha512" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_sha512" != "no")],
[ENABLED_SHA512="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512 -DWOLFSSL_SHA384"])
AS_IF([test "$ENABLED_AESGCM" = "no" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_aesgcm" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesgcm" != "no")],
[ENABLED_AESGCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESGCM"; AM_CCASFLAGS="$AM_CCASFLAGS -DHAVE_AESGCM"])
# AES-GCM streaming isn't part of the v5 FIPS suite.
@ -7625,7 +7689,7 @@ AS_CASE([$FIPS_VERSION],
AS_IF([test $HAVE_FIPS_VERSION_MINOR -ge 2],
[AS_IF([test "x$ENABLED_AESOFB" = "xno" &&
(test "$FIPS_VERSION" != "v5-dev" || test "$enable_aesofb" != "no")],
(test "$ENABLED_FIPS_DEV" != "yes" || test "$enable_aesofb" != "no")],
[ENABLED_AESOFB="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_OFB"])])
AS_IF([test "$ENABLED_SRTP" != "no" &&
@ -7726,10 +7790,10 @@ AS_CASE([$FIPS_VERSION],
AS_IF([test "x$ENABLED_DES3" = "xno"],[ENABLED_DES3="yes"])
])
AS_IF([test "x$ENABLED_FIPS" = "xyes" && test "x$thread_ls_on" = "xno" && test "$ENABLE_LINUXKM" = "no"],
AS_IF([test "x$ENABLED_FIPS" = "xyes" && test "x$thread_ls_on" = "xno" && test "$ENABLE_LINUXKM" = "no" && test "$FIPS_VERSION" != "dev-no-post"],
[AC_MSG_ERROR([FIPS requires Thread Local Storage])])
AS_IF([(test "$ENABLED_NULL_CIPHER" = "yes" || test "$ENABLED_LEANPSK" = "yes") && test "$ENABLED_FIPS" != "no" && test "$FIPS_VERSION" != "dev" && test "$FIPS_VERSION" != "v5-dev"],
AS_IF([(test "$ENABLED_NULL_CIPHER" = "yes" || test "$ENABLED_LEANPSK" = "yes") && test "$ENABLED_FIPS" != "no" && test "$ENABLED_FIPS_DEV" != "yes"],
[AC_MSG_ERROR([FIPS is incompatible with nullcipher])])
# SELFTEST
@ -8509,7 +8573,7 @@ fi
# FIPS override: Hash DRBG is mandatory
if test "$ENABLED_HASHDRBG" != "yes" && test "$ENABLED_FIPS" = "yes" &&
test "$FIPS_VERSION" != "dev" && test "$ENABLED_KCAPI" = "no"
test "$ENABLED_FIPS_DEV" != "yes" && test "$ENABLED_KCAPI" = "no"
then
if test "$enable_hashdrbg" = "no"
then
@ -12845,7 +12909,7 @@ AX_HARDEN_CC_COMPILER_FLAGS
if test "$ENABLED_SELFTEST" = yes || test "$ENABLED_FIPS" = yes
then
if ! test "$ENABLED_FIPS_DEV" = yes && ! test "$ENABLED_FIPS_READY" = yes
if test $HAVE_FIPS_VERSION_MAJOR -lt 7
then
# rsa.c wc_hash2mgf() switches on enum wc_HashType, which is defined
# outside the FIPS boundary. Unsupported hashes are correctly handled
@ -13082,6 +13146,7 @@ AM_CONDITIONAL([BUILD_FIPS_V6],[test $HAVE_FIPS_VERSION = 6])
AM_CONDITIONAL([BUILD_FIPS_V6_PLUS],[test $HAVE_FIPS_VERSION -ge 6])
AM_CONDITIONAL([BUILD_FIPS_V7],[test $HAVE_FIPS_VERSION = 7])
AM_CONDITIONAL([BUILD_FIPS_V7_PLUS],[test $HAVE_FIPS_VERSION -ge 7])
AM_CONDITIONAL([BUILD_FIPS_NO_POST],[test "$FIPS_VERSION" = "dev-no-post"])
AM_CONDITIONAL([BUILD_SIPHASH],[test "x$ENABLED_SIPHASH" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_CMAC],[test "x$ENABLED_CMAC" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
AM_CONDITIONAL([BUILD_SHE],[test "x$ENABLED_SHE" = "xstandard" || test "x$ENABLED_SHE" = "xextended" || test "x$ENABLED_USERSETTINGS" = "xyes"])

4
linuxkm/linuxkm_wc_port.h
View File

@ -930,10 +930,12 @@
extern int wolfCrypt_FIPS_SHA3_sanity(void);
extern const unsigned int wolfCrypt_FIPS_sha3_ro_sanity[2];
#endif
#ifndef WOLFSSL_FIPS_DEV_NO_POST
extern int wolfCrypt_FIPS_FT_sanity(void);
extern const unsigned int wolfCrypt_FIPS_ft_ro_sanity[2];
extern const unsigned int wolfCrypt_FIPS_f_ro_sanity[2];
extern int wc_RunAllCast_fips(void);
#endif
#endif
#endif
@ -1266,10 +1268,12 @@
typeof(wolfCrypt_FIPS_SHA3_sanity) *wolfCrypt_FIPS_SHA3_sanity;
typeof(wolfCrypt_FIPS_sha3_ro_sanity) *wolfCrypt_FIPS_sha3_ro_sanity;
#endif
#ifndef WOLFSSL_FIPS_DEV_NO_POST
typeof(wolfCrypt_FIPS_FT_sanity) *wolfCrypt_FIPS_FT_sanity;
typeof(wolfCrypt_FIPS_ft_ro_sanity) *wolfCrypt_FIPS_ft_ro_sanity;
typeof(wolfCrypt_FIPS_f_ro_sanity) *wolfCrypt_FIPS_f_ro_sanity;
typeof(wc_RunAllCast_fips) *wc_RunAllCast_fips;
#endif
#endif /* FIPS_VERSION3_GE(6,0,0) */
#endif /* HAVE_FIPS */

17
linuxkm/module_hooks.c
View File

@ -40,6 +40,9 @@
#include <wolfssl/wolfcrypt/hmac.h>
#endif
#include <wolfssl/wolfcrypt/fips_test.h>
#if defined(WOLFSSL_FIPS_DEV_NO_POST) && !defined(WC_USE_PIE_FENCEPOSTS_FOR_FIPS)
#define WC_USE_PIE_FENCEPOSTS_FOR_FIPS
#endif
#endif
#if !defined(NO_CRYPT_TEST) || defined(LINUXKM_LKCAPI_REGISTER)
#include <wolfcrypt/test/test.h>
@ -91,7 +94,7 @@ static int libwolfssl_cleanup(void) {
return ret;
}
#ifdef HAVE_FIPS
#if defined(HAVE_FIPS) && !defined(WOLFSSL_FIPS_DEV_NO_POST)
/* failsafe definitions for FIPS <5.3 */
#ifndef FIPS_IN_CORE_DIGEST_SIZE
#ifndef NO_SHA256
@ -630,7 +633,7 @@ static int wolfssl_init(void)
}
#endif /* WC_LINUXKM_TEST_INET_PTON */
#ifdef HAVE_FIPS
#if defined(HAVE_FIPS) && !defined(WOLFSSL_FIPS_DEV_NO_POST)
/* The compiled-in verifycore must be the right length, else the module
* geometry will change when the correct value is passed in, destabilizing
* wc_linuxkm_pie_text_reloc_tab. It also must be the right length for the
@ -1217,7 +1220,7 @@ static const struct wc_reloc_table_segments seg_map = {
.fips_rodata_start = (size_t)(uintptr_t)wolfCrypt_FIPS_ro_start,
.fips_rodata_end = (size_t)(uintptr_t)wolfCrypt_FIPS_ro_end,
#endif
#if FIPS_VERSION3_GE(6,0,0) || defined(WOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE)
#if (FIPS_VERSION3_GE(6,0,0) || defined(WOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE)) && !defined(WOLFSSL_FIPS_DEV_NO_POST)
.verifyCore_start = (uintptr_t)verifyCore,
.verifyCore_end = (uintptr_t)verifyCore + FIPS_IN_CORE_DIGEST_SIZE*2 + 1,
#endif
@ -1284,7 +1287,7 @@ static const struct wc_reloc_table_segments seg_map = {
.fips_rodata_start = (size_t)(uintptr_t)wolfCrypt_FIPS_ro_start,
.fips_rodata_end = (size_t)(uintptr_t)wolfCrypt_FIPS_ro_end,
#endif
#if FIPS_VERSION3_GE(6,0,0) || defined(WOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE)
#if (FIPS_VERSION3_GE(6,0,0) || defined(WOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE)) && !defined(WOLFSSL_FIPS_DEV_NO_POST)
.verifyCore_start = (uintptr_t)verifyCore,
.verifyCore_end = (uintptr_t)verifyCore + FIPS_IN_CORE_DIGEST_SIZE*2 + 1
#endif
@ -1664,6 +1667,8 @@ static int set_up_wolfssl_linuxkm_pie_redirect_table(void) {
wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_sha3_ro_sanity =
&wolfCrypt_FIPS_sha3_ro_sanity;
#endif
#ifndef WOLFSSL_FIPS_DEV_NO_POST
wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_FT_sanity =
wolfCrypt_FIPS_FT_sanity;
wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_ft_ro_sanity =
@ -1672,7 +1677,9 @@ static int set_up_wolfssl_linuxkm_pie_redirect_table(void) {
&wolfCrypt_FIPS_f_ro_sanity;
wolfssl_linuxkm_pie_redirect_table.wc_RunAllCast_fips =
wc_RunAllCast_fips;
#endif
#endif /* !WOLFSSL_FIPS_DEV_NO_POST */
#endif /* FIPS_VERSION3_GE(6,0,0) */
#endif
#if !defined(WOLFCRYPT_ONLY) && !defined(NO_CERTS)

8
src/include.am
View File

@ -933,9 +933,11 @@ src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wolfcrypt_last.c
endif BUILD_FIPS_V6
if BUILD_FIPS_V7_PLUS
if !BUILD_FIPS_NO_POST
# FIPS 140-3 v7.0.0+ first file
src_libwolfssl@LIBSUFFIX@_la_SOURCES += \
wolfcrypt/src/wolfcrypt_first.c
endif !BUILD_FIPS_NO_POST
src_libwolfssl@LIBSUFFIX@_la_SOURCES += \
wolfcrypt/src/hmac.c \
@ -1359,13 +1361,17 @@ if BUILD_WC_SLHDSA
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_slhdsa.c
endif
if !BUILD_FIPS_NO_POST
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/fips.c \
wolfcrypt/src/fips_test.c
# fips last file
src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wolfcrypt_last.c
endif BUILD_FIPS_V7_PLUS
endif !BUILD_FIPS_NO_POST
endif BUILD_FIPS_V7_PLUS
endif BUILD_FIPS

2
wolfcrypt/test/test.c
View File

@ -10144,7 +10144,7 @@ out:
#if !defined(HAVE_FIPS) || FIPS_VERSION3_GE(6,0,0)
if ((ret = wc_HmacSizeByType(WC_SHA256)) != WC_SHA256_DIGEST_SIZE)
return WC_TEST_RET_ENC_EC(ret);
#if FIPS_VERSION3_GE(6,0,0)
#if FIPS_VERSION3_GE(6,0,0) && !defined(WOLFSSL_FIPS_DEV_NO_POST)
if ((ret = wc_HmacSizeByType(21)) != WC_NO_ERR_TRACE(HMAC_KAT_FIPS_E))
#else
if ((ret = wc_HmacSizeByType(21)) != WC_NO_ERR_TRACE(BAD_FUNC_ARG))

15
wolfssl/wolfcrypt/fips_test.h
View File

@ -119,6 +119,19 @@ enum FipsModeId {
/* FIPS failure callback */
typedef void(*wolfCrypt_fips_cb)(int ok, int err, const char* hash);
#ifdef WOLFSSL_FIPS_DEV_NO_POST
#define wc_RunAllCast_fips() 0
static WC_INLINE int wolfCrypt_SetCb_fips(wolfCrypt_fips_cb cbf) {
(void)cbf;
return 0;
}
#define wolfCrypt_GetVersion_fips() "wolfCrypt DEV_NO_POST"
#define wolfCrypt_GetStatus_fips() 0
#define wolfCrypt_GetCoreHash_fips() ""
#define wolfCrypt_IntegrityTest_fips() 0
#define fipsEntry() WC_DO_NOTHING
#else /* !WOLFSSL_FIPS_DEV_NO_POST */
/* Public set function */
WOLFSSL_API int wolfCrypt_SetCb_fips(wolfCrypt_fips_cb cbf);
@ -148,6 +161,8 @@ WOLFSSL_API int wc_RunAllCast_fips(void);
void fipsEntry(void);
#endif
#endif /* !WOLFSSL_FIPS_DEV_NO_POST */
#ifdef __cplusplus
} /* extern "C" */
#endif

14
wolfssl/wolfcrypt/settings.h
View File

@ -402,6 +402,11 @@
#define FIPS_NO_WRAPPERS
#endif
#ifdef WOLFSSL_FIPS_DEV_NO_POST
/* Inhibit inclusion of fips.h for no-POST fips-dev. */
#define WOLF_CRYPT_FIPS_H
#endif
/* Microsoft's ARM64 compiler defines _M_ARM64 but not __aarch64__. The wolfSSL
* ARMv8 assembly (WOLFSSL_ARMASM) and all of its C callers are gated on
* __aarch64__, so map _M_ARM64 across when building that assembly with MSVC and
@ -486,15 +491,12 @@
#include <wolfssl/wolfcrypt/visibility.h>
/*------------------------------------------------------------*/
#if defined(WOLFSSL_FIPS_READY) || defined(WOLFSSL_FIPS_DEV)
#undef HAVE_FIPS_VERSION_MAJOR
#if (defined(WOLFSSL_FIPS_READY) || defined(WOLFSSL_FIPS_DEV)) && \
!defined(HAVE_FIPS_VERSION)
#define HAVE_FIPS_VERSION_MAJOR 7 /* always one more than major version */
/* of most recent FIPS certificate */
#undef HAVE_FIPS_VERSION
/* of most recent FIPS submission */
#define HAVE_FIPS_VERSION HAVE_FIPS_VERSION_MAJOR
#undef HAVE_FIPS_VERSION_MINOR
#define HAVE_FIPS_VERSION_MINOR 0 /* always 0 */
#undef HAVE_FIPS_VERSION_PATCH
#define HAVE_FIPS_VERSION_PATCH 0 /* always 0 */
#endif

6
wolfssl/wolfcrypt/types.h
View File

@ -2431,16 +2431,16 @@ WOLFSSL_API word32 CheckRunTimeSettings(void);
#define WC_SANITIZE_ENABLE() WC_DO_NOTHING
#endif
#if FIPS_VERSION_GE(5,1)
#define WC_SPKRE_F(x,y) wolfCrypt_SetPrivateKeyReadEnable_fips((x),(y))
#if FIPS_VERSION_GE(5,1) && !defined(WOLFSSL_FIPS_DEV_NO_POST)
#define WC_SPKRE_F(x,y) wolfCrypt_SetPrivateKeyReadEnable_fips(x, y)
#define PRIVATE_KEY_LOCK() WC_SPKRE_F(0,WC_KEYTYPE_ALL)
#define PRIVATE_KEY_UNLOCK() WC_SPKRE_F(1,WC_KEYTYPE_ALL)
#else
#define wolfCrypt_SetPrivateKeyReadEnable_fips(x, y) 0
#define PRIVATE_KEY_LOCK() WC_DO_NOTHING
#define PRIVATE_KEY_UNLOCK() WC_DO_NOTHING
#endif
#ifdef _MSC_VER
/* disable buggy MSC warning (incompatible with clang-tidy
* readability-avoid-const-params-in-decls)

5
wolfssl/wolfcrypt/wc_compat.h
View File

@ -32,7 +32,7 @@
(defined(WOLF_CRYPT_AES_H) && !defined(NO_AES) && \
!defined(WC_AES_TYPE_DEFINED) && !defined(CTAO_CRYPT_AES_H)) || \
(defined(WOLF_CRYPT_RANDOM_H) && !defined(WC_RNG_TYPE_DEFINED)) || \
(defined(WOLF_CRYPT_FIPS_H) && \
(defined(WOLF_CRYPT_FIPS_H) && !defined(WOLFSSL_FIPS_DEV_NO_POST) && \
!defined(fipsCastStatus_get) && !defined(wc_Des3_SetKey) && \
!defined(WC_DES3_TYPE_DEFINED)) || \
(defined(WOLF_CRYPT_FIPS_TEST_H) && \
@ -55,8 +55,7 @@
#endif
#if defined(HAVE_FIPS) && defined(HAVE_AESGCM) && \
!defined(WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED) && \
!defined(FIPS_NO_WRAPPERS)
!defined(WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED)
/* Unless WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED, wc_AesGcmEncrypt() is a
* non-FIPS API hardwired to FIPS_WRONG_API_E in fips.c. But we can emulate