jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Do not export TLS keys in FIPS mode

Browse source 
Only allow the TLS library keying material exporter functionality to be
used for MSK derivation with TLS-based EAP methods to avoid exporting
internal TLS keys from the library.

Signed-hostap: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2012-08-16 19:38:15 +03:00
parent 411f567050
commit c9e08af24f
3 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/crypto/tls_openssl.c
View file

@ -2299,6 +2299,11 @@ static int tls_global_dh(SSL_CTX *ssl_ctx, const char *dh_file)
int tls_connection_get_keys(void *ssl_ctx, struct tls_connection *conn, int tls_connection_get_keys(void *ssl_ctx, struct tls_connection *conn,
struct tls_keys *keys) struct tls_keys *keys)
{ {
#ifdef CONFIG_FIPS
wpa_printf(MSG_ERROR, "OpenSSL: TLS keys cannot be exported in FIPS "
"mode");
return -1;
#else /* CONFIG_FIPS */
SSL *ssl; SSL *ssl;
if (conn == NULL || keys == NULL) if (conn == NULL || keys == NULL)
@ -2316,6 +2321,7 @@ int tls_connection_get_keys(void *ssl_ctx, struct tls_connection *conn,
keys->server_random_len = SSL3_RANDOM_SIZE; keys->server_random_len = SSL3_RANDOM_SIZE;
return 0; return 0;
#endif /* CONFIG_FIPS */
} }

4
src/eap_peer/eap_tls_common.c
View file

@ -259,7 +259,9 @@ void eap_peer_tls_ssl_deinit(struct eap_sm *sm, struct eap_ssl_data *data)
u8 * eap_peer_tls_derive_key(struct eap_sm *sm, struct eap_ssl_data *data, u8 * eap_peer_tls_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,
const char *label, size_t len) const char *label, size_t len)
{ {
#ifndef CONFIG_FIPS
struct tls_keys keys; struct tls_keys keys;
#endif /* CONFIG_FIPS */
u8 *rnd = NULL, *out; u8 *rnd = NULL, *out;
out = os_malloc(len); out = os_malloc(len);
@ -271,6 +273,7 @@ u8 * eap_peer_tls_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,
== 0) == 0)
return out; return out;
#ifndef CONFIG_FIPS
/* /*
* TLS library did not support key generation, so get the needed TLS * TLS library did not support key generation, so get the needed TLS
* session parameters and use an internal implementation of TLS PRF to * session parameters and use an internal implementation of TLS PRF to
@ -299,6 +302,7 @@ u8 * eap_peer_tls_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,
return out; return out;
fail: fail:
#endif /* CONFIG_FIPS */
os_free(out); os_free(out);
os_free(rnd); os_free(rnd);
return NULL; return NULL;

2
wpa_supplicant/Makefile
View file

@ -847,8 +847,10 @@ NEED_DES=y
# Shared TLS functions (needed for EAP_TLS, EAP_PEAP, EAP_TTLS, and EAP_FAST) # Shared TLS functions (needed for EAP_TLS, EAP_PEAP, EAP_TTLS, and EAP_FAST)
OBJS += ../src/eap_peer/eap_tls_common.o OBJS += ../src/eap_peer/eap_tls_common.o
OBJS_h += ../src/eap_server/eap_server_tls_common.o OBJS_h += ../src/eap_server/eap_server_tls_common.o
ifndef CONFIG_FIPS
NEED_TLS_PRF=y NEED_TLS_PRF=y
endif endif
endif
ifndef CONFIG_TLS ifndef CONFIG_TLS
CONFIG_TLS=openssl CONFIG_TLS=openssl