Sorry, I meant to include the config information in my previous email. I should
probably go back to the beginning, I've been trying a lot of different
combinations without success, so unwinding to the beginning and taking one step
at a time is probably appropriate. Since I want the FIPS changes limited to my
application only, this is based on the response from Dr. Paul Dale earlier in
the thread, the first approach he recommended, so the application code looks
like this:
fipsp = OSSL_PROVIDER_load(fips_libctx, "fips");
if (fipsp == NULL)
{
// error handling
}
basep = OSSL_PROVIDER_load(fips_libctx, "base"); /* can't load keys without
this */
if (basep == NULL)
{
/* error handling */
}
defp = OSSL_PROVIDER_load(non_fips_libctx, "default");
if (defp == NULL)
{
/* error handling */
}
Since I'm back to not using my own config file, this is the relevant content in
/usr/local/ssl/openssl.cnf. Again, from Dr. Paul Dale's advice of needing a
FIPS section, and not needing base or default sections:
openssl_conf = openssl_init
.include /usr/local/ssl/fipsmodule.cnf
[openssl_init]
providers = provider_sect
# List of providers to load
[provider_sect]
default = default_sect
# The fips section name should match the section name inside the
# included fipsmodule.cnf.
fips = fips_sect
[default_sect]
# activate = 1
Here is the /usr/local/ssl/fipsmodule.cnf file:
[fips_sect]
activate = 1
conditional-errors = 1
security-checks = 1
module-mac =
E4:0D:C8:C3:1E:DB:2B:30:E6:F2:49:7B:F5:BD:10:5C:9A:2B:CC:C1:33:49:31:B5:C5:AF:50:AB:82:1E:AE:C9
With these config files and the code above, the OSSL_PROVIDER_load(fips_libctx,
"fips") call fails. Here are the messages from the ERR_print_errors_fp() call:
2097C692B57F0000:error:1C8000D5:Provider routines:(unknown function):missing
config data:providers/fips/self_test.c:289:
2097C692B57F0000:error:1C8000E0:Provider routines:(unknown function):fips
module entering error state:providers/fips/self_test.c:387:
2097C692B57F0000:error:1C8000D8:Provider routines:(unknown function):self test
post failure:providers/fips/fipsprov.c:706:
2097C692B57F0000:error:078C0105:common libcrypto routines:(unknown
function):init fail:crypto/provider_core.c:903:name=fips
So this does seem like I have something wrong as far as setup/install or
configuration. I'm not sure if it's something in the config files above, or
something with my application being able to find the fips.so, which was also
mentioned. The code above in self_test.c that's throwing the error looks like
the st parameter to SELF_TESET_post() is NULL, but I'm not sure what the actual
problem is. The self test isn't set up to run correctly, the self test failed,
maybe both, or maybe something else?
One of the links from Matt included a function
OSSL_PROVIDER_set_default_search_path(). I'm wondering if that's needed since I
don't have any environment variables set up? I'm not sure what the default
search path is.
Jason
________________________________
From: Matt Caswell <m...@openssl.org>
Sent: Wednesday, October 27, 2021 10:34 AM
To: Jason Schultz <jetso...@hotmail.com>; Dr Paul Dale <pa...@openssl.org>;
openssl-users@openssl.org <openssl-users@openssl.org>
Subject: Re: OpenSSL 3.0 FIPS questions
On 26/10/2021 20:17, Jason Schultz wrote:
> Thanks for all of the help so far. Unfortunately, I'm still struggling
> with this. There could be a number of issues, starting with the
> installation of OpenSSL. I basically followed the documentation and did
> the following:
>
> ./Configure enable-fips
>
> make
>
> make test
>
> make install
>
>
> The "make test" actually fails, but I did not troubleshoot as it seems
> like a lot of systems have issues here. But I know the .so produced when
> I build my application is linking to the correct OpenSSL libraries
> (libssl.so.3 and libcrypto.so.3). Checking the OpenSSL version shows 3.0.
>
> I've tried a number of combinations trying to make this work, starting
> with the code from Dr. Paul Dale in a previous message:
>
> fips_libctx = OSSL_LIB_CTX_new();
> if (!fips_libctx)
> // error handling
>
> non_fips_libctx = OSSL_LIB_CTX_new();
> if (!non_fips_libctx)
> // error handling
>
> fipsp = OSSL_PROVIDER_load(fips_libctx, "fips");
> if (fipsp == NULL)
> {
> /* error handling */
> }
>
> basep = OSSL_PROVIDER_load(fips_libctx, "base");
> if (basep == NULL)
> {
> /* error handling */
> }
>
> defp = OSSL_PROVIDER_load(non_fips_libctx, "default");
> if (defp == NULL)
> {
> /* error handling */
> }
>
> /* Disallow falling back to the default library context */
> nullp = OSSL_PROVIDER_load(NULL, "null");
> if (nullp == NULL)
> {
> /*error handling */
> }
>
> With the code like the above, the OSSL_PROVIDER_load() calls fails for
> fips. If I try to use the fips_libctx in SSL_CTX_new_ex(), it fails and
> returns NULL, which is probably expected given the fips provider didn't
> load.
>
> At that point, I wasn't sure if my application was using the (correct)
> config file in /usr/local/ssl/. I don't have any environment variables
> set up, and would prefer not to have to set any to get this to work. So
> I changed the provider load for FIPS to use OSSL_LIB_CTX_load_config():
>
> if (!OSSL_LIB_CTX_load_config(fips_libctx,
> "/usr/local/ssl/openssl-fips.cnf"))
What is in the /usr/local/ssl/openssl-fips.cnf config file?
Does the config file attempt to activate the FIPS provider itself? Does
it supply the necessary FIPS provider config parameters?
Typically the config file has a ".include" directive in it which
includes the necessary FIPS config params. That included file will look
something like this:
$ cat fipsmodule.cnf
[fips_sect]
activate = 1
conditional-errors = 1
security-checks = 1
module-mac =
95:06:06:D1:85:17:92:F6:7B:7D:C2:43:36:A4:59:5D:75:6F:39:E6:13:0B:4B:26:5A:1B:48:78:33:5B:BE:F0
Most likely what is happening is that the FIPS provider is failing to
load. Either because it cannot find the fips.so file, or because the
necessary FIPS config parameters above are not found or not correct.
You can test whether a provider is actually available for use or not
using the OSSL_PROVIDER_available() function call. E.g.:
if (!OSSL_PROVIDER_available(fips_libctx, "fips")) {
/* error handling */
}
https://www.openssl.org/docs/man3.0/man3/OSSL_PROVIDER_available.html
If things are failing then you might find it helpful to dump the OpenSSL
error stack to try and get some clues as to what the problem might be, e.g.
ERR_print_errors_fp(stdout);
https://www.openssl.org/docs/man3.0/man3/ERR_print_errors_fp.html
Matt
