Update from HEAD

[oweals/openssl.git] / crypto / rsa / rsa_sign.c

diff --git a/crypto/rsa/rsa_sign.c b/crypto/rsa/rsa_sign.c
index 9e7dfd1927bf55dd9a9191dd53cf2b80647fb11a..5488c06f6d8d9df23c756eaf5f4417aab60693b1 100644 (file)
--- a/crypto/rsa/rsa_sign.c
+++ b/crypto/rsa/rsa_sign.c
@@ -76,7 +76,7 @@ int RSA_sign(int type, const unsigned char *m, unsigned int m_len,
        const unsigned char *s = NULL;
        X509_ALGOR algor;
        ASN1_OCTET_STRING digest;
-       if(rsa->flags & RSA_FLAG_SIGN_VER)
+       if((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_sign)
                {
                return rsa->meth->rsa_sign(type, m, m_len,
                        sigret, siglen, rsa);
@@ -90,6 +90,14 @@ int RSA_sign(int type, const unsigned char *m, unsigned int m_len,
                i = SSL_SIG_LENGTH;
                s = m;
        } else {
+       /* NB: in FIPS mode block anything that isn't a TLS signature */
+#ifdef OPENSSL_FIPS
+               if(FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
+                       {
+                       RSAerr(RSA_F_RSA_SIGN, RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE);
+                       return 0;
+                       }
+#endif
                sig.algor= &algor;
                sig.algor->algorithm=OBJ_nid2obj(type);
                if (sig.algor->algorithm == NULL)
@@ -155,7 +163,7 @@ int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
                return(0);
                }
 
-       if(rsa->flags & RSA_FLAG_SIGN_VER)
+       if((rsa->flags & RSA_FLAG_SIGN_VER) && rsa->meth->rsa_verify)
                {
                return rsa->meth->rsa_verify(dtype, m, m_len,
                        sigbuf, siglen, rsa);
@@ -167,10 +175,22 @@ int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
                RSAerr(RSA_F_RSA_VERIFY,ERR_R_MALLOC_FAILURE);
                goto err;
                }
-       if((dtype == NID_md5_sha1) && (m_len != SSL_SIG_LENGTH) ) {
+       if(dtype == NID_md5_sha1)
+               {
+               if (m_len != SSL_SIG_LENGTH)
+                       {
                        RSAerr(RSA_F_RSA_VERIFY,RSA_R_INVALID_MESSAGE_LENGTH);
                        goto err;
-       }
+                       }
+               }
+       /* NB: in FIPS mode block anything that isn't a TLS signature */
+#ifdef OPENSSL_FIPS
+       else if(FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW))
+               {
+               RSAerr(RSA_F_RSA_VERIFY, RSA_R_OPERATION_NOT_ALLOWED_IN_FIPS_MODE);
+               return 0;
+               }
+#endif
        i=RSA_public_decrypt((int)siglen,sigbuf,s,rsa,RSA_PKCS1_PADDING);
 
        if (i <= 0) goto err;
@@ -185,6 +205,23 @@ int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
                sig=d2i_X509_SIG(NULL,&p,(long)i);
 
                if (sig == NULL) goto err;
+
+               /* Excess data can be used to create forgeries */
+               if(p != s+i)
+                       {
+                       RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
+                       goto err;
+                       }
+
+               /* Parameters to the signature algorithm can also be used to
+                  create forgeries */
+               if(sig->algor->parameter
+                  && ASN1_TYPE_get(sig->algor->parameter) != V_ASN1_NULL)
+                       {
+                       RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
+                       goto err;
+                       }
+
                sigtype=OBJ_obj2nid(sig->algor->algorithm);