fix: return errors for refused requests (FIPS HMAC forgery)

wolfssl-gnutls-wrapper/src/kdf.c

@@ -47,11 +47,7 @@ static int wolfssl_hkdf_extract(gnutls_mac_algorithm_t mac, const void *key,
 
     if (ret != 0) {
         WGW_WOLFSSL_ERROR("wc_HKDF_Extract", ret);
-#if defined(HAVE_FIPS)
-        return GNUTLS_FIPS140_OP_NOT_APPROVED;
-#else
         return GNUTLS_E_INTERNAL_ERROR;
-#endif
     }
 
     return 0;
@@ -147,11 +143,6 @@ static int wolfssl_pbkdf2(gnutls_mac_algorithm_t mac, const void *key,
 
     if (ret != 0) {
         WGW_WOLFSSL_ERROR("wc_PBKDF2_ex", ret);
-#if defined(HAVE_FIPS)
-        if (ret == HMAC_MIN_KEYLEN_E) {
-            return GNUTLS_FIPS140_OP_NOT_APPROVED;
-        }
-#endif
         return GNUTLS_E_INTERNAL_ERROR;
     }
 

wolfssl-gnutls-wrapper/src/mac.c

@@ -197,11 +197,7 @@ static int wolfssl_hmac_setkey(void *_ctx, const void *key, size_t keysize)
         (word32)keysize);
     if (ret != 0) {
         WGW_WOLFSSL_ERROR("wc_HmacSetKey", ret);
-#if defined(HAVE_FIPS)
-        return GNUTLS_FIPS140_OP_NOT_APPROVED;
-#else
         return GNUTLS_E_HASH_FAILED;
-#endif
     }
 
     WGW_LOG("hmac key set successfully");
@@ -362,6 +358,7 @@ static int wolfssl_hmac_fast(gnutls_mac_algorithm_t algorithm,
     /* Set key into HMAC context. */
     ret = wolfssl_hmac_setkey(ctx, key, keysize);
     if (ret != 0) {
+        wolfssl_hmac_deinit(ctx);
         return ret;
     }
 
@@ -507,7 +504,6 @@ static int wolfssl_cmac_setkey(void *_ctx, const void *key, size_t keysize)
         WC_CMAC_AES, NULL);
     if (ret != 0) {
         WGW_WOLFSSL_ERROR("wc_InitCmac", ret);
-        gnutls_free(ctx);
         return GNUTLS_E_HASH_FAILED;
     }
 
@@ -548,7 +544,6 @@ static int wolfssl_cmac_hash(void *_ctx, const void *text, size_t textsize)
             (word32)ctx->key_size, WC_CMAC_AES, NULL);
         if (ret != 0) {
             WGW_WOLFSSL_ERROR("wc_InitCmac", ret);
-            gnutls_free(ctx);
             return GNUTLS_E_HASH_FAILED;
         }
         ctx->set_key = 0;
@@ -617,7 +612,6 @@ static int wolfssl_cmac_output(void *_ctx, void *digest, size_t digestsize)
             (word32)ctx->key_size, WC_CMAC_AES, NULL);
         if (ret != 0) {
             WGW_WOLFSSL_ERROR("wc_InitCmac", ret);
-            gnutls_free(ctx);
             return GNUTLS_E_HASH_FAILED;
         }
         ctx->set_key = 0;
@@ -690,6 +684,7 @@ static int wolfssl_cmac_fast(gnutls_mac_algorithm_t algorithm,
     /* Set key into CMAC context. */
     ret = wolfssl_cmac_setkey(ctx, key, keysize);
     if (ret != 0) {
+        wolfssl_cmac_deinit(ctx);
         return ret;
     }
 
@@ -865,7 +860,6 @@ static int wolfssl_gmac_setkey(void *_ctx, const void *key, size_t keysize)
     ret = wc_GmacSetKey(&ctx->gmac_ctx, (const byte*)key, (word32)keysize);
     if (ret != 0) {
         WGW_WOLFSSL_ERROR("wc_GmacSetKey", ret);
-        gnutls_free(ctx);
         return GNUTLS_E_HASH_FAILED;
     }
 
@@ -1051,6 +1045,7 @@ static int wolfssl_gmac_fast(gnutls_mac_algorithm_t algorithm,
     /* Set key into GMAC context. */
     ret = wolfssl_gmac_setkey(ctx, key, keysize);
     if (ret != 0) {
+        wolfssl_gmac_deinit(ctx);
         return ret;
     }
 

wolfssl-gnutls-wrapper/src/pk.c

@@ -2461,7 +2461,7 @@ static int wolfssl_pk_generate_params(gnutls_pk_algorithm_t algo,
  * @param [in]      bits    Number of bits in key.
  * @param [in, out] params  GnuTLS PK parameters.
  * @return  0 on success.
- * @return  GNUTLS_FIPS140_OP_NOT_APPROVED when FIPS140 build
+ * @return  GNUTLS_E_INVALID_REQUEST when FIPS140 build and 1024 bits.
  * @return  GNUTLS_E_RANDOM_FAILED when random initialization fails.
  * @return  GNUTLS_E_CRYPTO_INIT_FAILED when initializing RSA key fails.
  * @return  GnuTLS error on other failure.
@@ -2483,7 +2483,7 @@ static int wolfssl_pk_generate_keys_rsa(unsigned int bits,
     /* missing check for 1024, 1024 is not allowed */
     if (bits == 1024) {
         WGW_ERROR("Bits size not valid");
-        return GNUTLS_FIPS140_OP_NOT_APPROVED;
+        return GNUTLS_E_INVALID_REQUEST;
     }
 #endif
 
@@ -2509,11 +2509,7 @@ static int wolfssl_pk_generate_keys_rsa(unsigned int bits,
     if (ret != 0) {
         WGW_ERROR("RSA key generation failed with code %d", ret);
         wc_FreeRsaKey(&rsa);
-#if defined(HAVE_FIPS)
-        return GNUTLS_FIPS140_OP_NOT_APPROVED;
-#else
         return GNUTLS_E_PK_GENERATION_ERROR;
-#endif
     }
 
     /* Store RSA fields in the GnuTLS parameters. */
@@ -2715,7 +2711,7 @@ static int wolfssl_pk_generate_keys_ecc(unsigned int curve,
  * @param [in]      curve   GnuTLS curve.
  * @param [in, out] params  GnuTLS PK parameters.
  * @return  0 on success.
- * @return  GNUTLS_ECC_CURVE_INVALID when curve does not match algorithm.
+ * @return  GNUTLS_E_ECC_UNSUPPORTED_CURVE when curve does not match algorithm.
  * @return  GNUTLS_E_RANDOM_FAILED when random initialization fails.
  * @return  GNUTLS_E_CRYPTO_INIT_FAILED when initializing key fails.
  * @return  GnuTLS error on other failure.
@@ -2732,7 +2728,7 @@ static int wolfssl_pk_generate_keys_ed25519(unsigned int curve,
 
     /* Check curve matches algorithm. */
     if (curve != GNUTLS_ECC_CURVE_ED25519) {
-        return GNUTLS_ECC_CURVE_INVALID;
+        return GNUTLS_E_ECC_UNSUPPORTED_CURVE;
     }
 
     /* Initialize a new random for blinding. */
@@ -2817,7 +2813,7 @@ static int wolfssl_pk_generate_keys_ed25519(unsigned int curve,
  * @param [in]      curve   GnuTLS curve.
  * @param [in, out] params  GnuTLS PK parameters.
  * @return  0 on success.
- * @return  GNUTLS_ECC_CURVE_INVALID when curve does not match algorithm.
+ * @return  GNUTLS_E_ECC_UNSUPPORTED_CURVE when curve does not match algorithm.
  * @return  GNUTLS_E_RANDOM_FAILED when random initialization fails.
  * @return  GNUTLS_E_CRYPTO_INIT_FAILED when initializing key fails.
  * @return  GnuTLS error on other failure.
@@ -2834,7 +2830,7 @@ static int wolfssl_pk_generate_keys_ed448(unsigned int curve,
 
     /* Check curve matches algorithm. */
     if (curve != GNUTLS_ECC_CURVE_ED448) {
-        return GNUTLS_ECC_CURVE_INVALID;
+        return GNUTLS_E_ECC_UNSUPPORTED_CURVE;
     }
 
     /* Initialize a new random for blinding. */
@@ -2919,7 +2915,7 @@ static int wolfssl_pk_generate_keys_ed448(unsigned int curve,
  * @param [in]      curve   GnuTLS curve.
  * @param [in, out] params  GnuTLS PK parameters.
  * @return  0 on success.
- * @return  GNUTLS_ECC_CURVE_INVALID when curve does not match algorithm.
+ * @return  GNUTLS_E_ECC_UNSUPPORTED_CURVE when curve does not match algorithm.
  * @return  GNUTLS_E_RANDOM_FAILED when random initialization fails.
  * @return  GNUTLS_E_CRYPTO_INIT_FAILED when initializing key fails.
  * @return  GnuTLS error on other failure.
@@ -2936,7 +2932,7 @@ static int wolfssl_pk_generate_keys_x25519(unsigned int curve,
 
     /* Check curve matches algorithm. */
     if (curve != GNUTLS_ECC_CURVE_X25519) {
-        return GNUTLS_ECC_CURVE_INVALID;
+        return GNUTLS_E_ECC_UNSUPPORTED_CURVE;
     }
 
     /* Initialize a new random for generation. */
@@ -3021,7 +3017,7 @@ static int wolfssl_pk_generate_keys_x25519(unsigned int curve,
  * @param [in]      curve   GnuTLS curve.
  * @param [in, out] params  GnuTLS PK parameters.
  * @return  0 on success.
- * @return  GNUTLS_ECC_CURVE_INVALID when curve does not match algorithm.
+ * @return  GNUTLS_E_ECC_UNSUPPORTED_CURVE when curve does not match algorithm.
  * @return  GNUTLS_E_RANDOM_FAILED when random initialization fails.
  * @return  GNUTLS_E_CRYPTO_INIT_FAILED when initializing key fails.
  * @return  GnuTLS error on other failure.
@@ -3038,7 +3034,7 @@ static int wolfssl_pk_generate_keys_x448(unsigned int curve,
 
     /* Check curve matches algorithm. */
     if (curve != GNUTLS_ECC_CURVE_X448) {
-        return GNUTLS_ECC_CURVE_INVALID;
+        return GNUTLS_E_ECC_UNSUPPORTED_CURVE;
     }
 
     /* Initialize a new random for blinding. */
@@ -3125,8 +3121,8 @@ static int wolfssl_pk_generate_keys_x448(unsigned int curve,
  * @param [in]      ephemeral  Key pair is ephemenral - random can be weaker.
  *                             Ignored.
  * @return  0 on success.
- * @return  GNUTLS_FIPS140_OP_NOT_APPROVED when FIPS140 build
- * @return  GNUTLS_ECC_CURVE_INVALID when curve does not match algorithm.
+ * @return  GNUTLS_E_INVALID_REQUEST when FIPS140 build and 1024 bits.
+ * @return  GNUTLS_E_ECC_UNSUPPORTED_CURVE when curve does not match algorithm.
  * @return  GNUTLS_E_RANDOM_FAILED when random initialization fails.
  * @return  GNUTLS_E_CRYPTO_INIT_FAILED when initializing key fails.
  * @return  GnuTLS error on other failure.

wolfssl-gnutls-wrapper/tests/Makefile

@@ -1,4 +1,4 @@
-TESTS = test_hash test_shake test_aescbc test_aescfb8 test_aesgcm test_aesccm test_aesxts test_hmac test_cmac test_gmac test_rnd test_rnd_fork test_tls_prf test_hkdf test_pbkdf2 test_ecdsa_sign_and_verify test_ecdh_encrypt_and_decrypt test_eddsa_sign_and_verify test_rsa_sign_and_verify test_rsa_encrypt_and_decrypt test_dh_encrypt_and_decrypt test_pk_import_export test_long_hash test_fips test_aessiv
+TESTS = test_hash test_shake test_aescbc test_aescfb8 test_aesgcm test_aesccm test_aesxts test_hmac test_cmac test_gmac test_rnd test_rnd_fork test_tls_prf test_hkdf test_pbkdf2 test_ecdsa_sign_and_verify test_ecdh_encrypt_and_decrypt test_eddsa_sign_and_verify test_rsa_sign_and_verify test_rsa_encrypt_and_decrypt test_dh_encrypt_and_decrypt test_pk_import_export test_long_hash test_fips test_aessiv test_fips_refusal_errors
 
 PKGCONF ?= pkg-config
 UNAME_S := $(shell uname -s)

wolfssl-gnutls-wrapper/tests/test_fips_refusal_errors.c

@@ -0,0 +1,96 @@
+/* A request the provider refuses must fail with a negative error.
+ *
+ * GnuTLS treats any provider return >= 0 as success. A FIPS wolfCrypt refuses
+ * an HMAC key shorter than 14 bytes; if that refusal is not returned as a
+ * negative error, gnutls_hmac_fast() reports success without writing the MAC,
+ * and gnutls_hmac_init() succeeds with an HMAC that does not depend on the
+ * key, so a forged tag verifies.
+ *
+ * HMAC-SHA256 with the 4-byte key "Jefe" (RFC 4231 test case 2), one-shot and
+ * streaming: each must either fail with a negative error (FIPS) or give the
+ * RFC value. Two different short keys must not give the same MAC.
+ */
+#include <stdio.h>
+#include <string.h>
+#include <gnutls/gnutls.h>
+#include <gnutls/crypto.h>
+#include "test_util.h"
+
+static const char *msg = "what do ya want for nothing?";
+
+/* RFC 4231, section 4.3. */
+static const unsigned char tc2_mac[32] = {
+    0x5b, 0xdc, 0xc1, 0x46, 0xbf, 0x60, 0x75, 0x4e, 0x6a, 0x04, 0x24, 0x26,
+    0x08, 0x95, 0x75, 0xc7, 0x5a, 0x00, 0x3f, 0x08, 0x9d, 0x27, 0x39, 0x83,
+    0x9d, 0xec, 0x58, 0xb9, 0x64, 0xec, 0x38, 0x43
+};
+
+static int hmac_stream(const char *key, unsigned char *mac)
+{
+    gnutls_hmac_hd_t hd;
+    int ret;
+
+    ret = gnutls_hmac_init(&hd, GNUTLS_MAC_SHA256, key, strlen(key));
+    if (ret < 0) {
+        return ret;
+    }
+    ret = gnutls_hmac(hd, msg, strlen(msg));
+    gnutls_hmac_deinit(hd, mac);
+    return ret;
+}
+
+/* 0 when ret is a negative error, or success with the RFC 4231 value. */
+static int check(const char *op, int ret, const unsigned char *mac)
+{
+    if (ret < 0) {
+        printf("%s refused: %s\n", op, gnutls_strerror(ret));
+        return 0;
+    }
+    if (ret > 0) {
+        printf("FAILURE - %s returned %d, not an error code\n", op, ret);
+        return 1;
+    }
+    return compare(op, mac, tc2_mac, sizeof(tc2_mac));
+}
+
+int main(void)
+{
+    unsigned char mac[32], mac2[32];
+    int ret, ret2;
+
+    printf("Testing that refused HMAC keys fail with an error...\n");
+
+    ret = gnutls_global_init();
+    if (ret != 0) {
+        print_gnutls_error("initializing GnuTLS", ret);
+        return 1;
+    }
+
+    memset(mac, 0, sizeof(mac));
+    ret = gnutls_hmac_fast(GNUTLS_MAC_SHA256, "Jefe", 4, msg, strlen(msg), mac);
+    if (check("HMAC-SHA256 one-shot, 4-byte key", ret, mac) != 0) {
+        gnutls_global_deinit();
+        return 1;
+    }
+
+    memset(mac, 0, sizeof(mac));
+    ret = hmac_stream("Jefe", mac);
+    if (check("HMAC-SHA256 streaming, 4-byte key", ret, mac) != 0) {
+        gnutls_global_deinit();
+        return 1;
+    }
+
+    memset(mac, 0, sizeof(mac));
+    memset(mac2, 0, sizeof(mac2));
+    ret = hmac_stream("Jefe", mac);
+    ret2 = hmac_stream("Jeff", mac2);
+    if (ret == 0 && ret2 == 0 && memcmp(mac, mac2, sizeof(mac)) == 0) {
+        printf("FAILURE - two different keys gave the same MAC\n");
+        gnutls_global_deinit();
+        return 1;
+    }
+
+    gnutls_global_deinit();
+    printf("\nAll refusal tests completed successfully!\n");
+    return 0;
+}