You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
79 lines
2.9 KiB
79 lines
2.9 KiB
diff -up nss/lib/pk11wrap/pk11pars.c.852023_enable_fips_when_in_fips_mode nss/lib/pk11wrap/pk11pars.c |
|
--- nss/lib/pk11wrap/pk11pars.c.852023_enable_fips_when_in_fips_mode 2018-03-05 16:58:32.000000000 +0100 |
|
+++ nss/lib/pk11wrap/pk11pars.c 2018-03-09 17:24:39.815838810 +0100 |
|
@@ -671,6 +671,10 @@ SECMOD_CreateModuleEx(const char *librar |
|
|
|
mod->internal = NSSUTIL_ArgHasFlag("flags", "internal", nssc); |
|
mod->isFIPS = NSSUTIL_ArgHasFlag("flags", "FIPS", nssc); |
|
+ /* if the system FIPS mode is enabled, force FIPS to be on */ |
|
+ if (SECMOD_GetSystemFIPSEnabled()) { |
|
+ mod->isFIPS = PR_TRUE; |
|
+ } |
|
mod->isCritical = NSSUTIL_ArgHasFlag("flags", "critical", nssc); |
|
slotParams = NSSUTIL_ArgGetParamValue("slotParams", nssc); |
|
mod->slotInfo = NSSUTIL_ArgParseSlotInfo(mod->arena, slotParams, |
|
diff -up nss/lib/pk11wrap/pk11util.c.852023_enable_fips_when_in_fips_mode nss/lib/pk11wrap/pk11util.c |
|
--- nss/lib/pk11wrap/pk11util.c.852023_enable_fips_when_in_fips_mode 2018-03-05 16:58:32.000000000 +0100 |
|
+++ nss/lib/pk11wrap/pk11util.c 2018-03-09 17:25:46.804347730 +0100 |
|
@@ -95,6 +95,26 @@ SECMOD_Shutdown() |
|
return SECSuccess; |
|
} |
|
|
|
+int SECMOD_GetSystemFIPSEnabled(void) { |
|
+#ifdef LINUX |
|
+ FILE *f; |
|
+ char d; |
|
+ size_t size; |
|
+ |
|
+ f = fopen("/proc/sys/crypto/fips_enabled", "r"); |
|
+ if (!f) |
|
+ return 0; |
|
+ |
|
+ size = fread(&d, 1, 1, f); |
|
+ fclose(f); |
|
+ if (size != 1) |
|
+ return 0; |
|
+ if (d == '1') |
|
+ return 1; |
|
+#endif |
|
+ return 0; |
|
+} |
|
+ |
|
/* |
|
* retrieve the internal module |
|
*/ |
|
@@ -428,7 +448,7 @@ SECMOD_DeleteInternalModule(const char * |
|
SECMODModuleList **mlpp; |
|
SECStatus rv = SECFailure; |
|
|
|
- if (pendingModule) { |
|
+ if (SECMOD_GetSystemFIPSEnabled() || pendingModule) { |
|
PORT_SetError(SEC_ERROR_MODULE_STUCK); |
|
return rv; |
|
} |
|
@@ -963,7 +983,7 @@ SECMOD_CanDeleteInternalModule(void) |
|
#ifdef NSS_FIPS_DISABLED |
|
return PR_FALSE; |
|
#else |
|
- return (PRBool)(pendingModule == NULL); |
|
+ return (PRBool) ((pendingModule == NULL) && !SECMOD_GetSystemFIPSEnabled()); |
|
#endif |
|
} |
|
|
|
diff -up nss/lib/pk11wrap/secmodi.h.852023_enable_fips_when_in_fips_mode nss/lib/pk11wrap/secmodi.h |
|
--- nss/lib/pk11wrap/secmodi.h.852023_enable_fips_when_in_fips_mode 2018-03-05 16:58:32.000000000 +0100 |
|
+++ nss/lib/pk11wrap/secmodi.h 2018-03-09 17:24:39.816838788 +0100 |
|
@@ -115,6 +115,13 @@ PK11SymKey *pk11_TokenKeyGenWithFlagsAnd |
|
CK_MECHANISM_TYPE pk11_GetPBECryptoMechanism(SECAlgorithmID *algid, |
|
SECItem **param, SECItem *pwd, PRBool faulty3DES); |
|
|
|
+/* Get the state of the system FIPS mode */ |
|
+/* NSS uses this to force FIPS mode if the system bit is on. Applications which |
|
+ * use the SECMOD_CanDeleteInteral() to check to see if they can switch to or |
|
+ * from FIPS mode will automatically be told that they can't swith out of FIPS |
|
+ * mode */ |
|
+int SECMOD_GetSystemFIPSEnabled(); |
|
+ |
|
extern void pk11sdr_Init(void); |
|
extern void pk11sdr_Shutdown(void); |
|
|
|
|