New cipher "strength" FIPS which specifies that a

cipher suite is FIPS compatible.

New cipherstring "FIPS" is all FIPS compatible ciphersuites except eNULL.

Only allow FIPS ciphersuites in FIPS mode.

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index d04096016ce31a1ac7d17f8e92df039b2994ba8c..e7b15431b1aaa84ca875f1c6651488367a2a911e 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -142,7 +142,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_RSA_NULL_SHA,
        SSL3_CK_RSA_NULL_SHA,
        SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_STRONG_NONE,
+       SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
        0,
        0,
        0,
@@ -183,7 +183,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_ADH_DES_40_CBC_SHA,
        SSL3_CK_ADH_DES_40_CBC_SHA,
        SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_EXPORT|SSL_EXP40|SSL_FIPS,
        0,
        40,
        128,
@@ -196,7 +196,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_ADH_DES_64_CBC_SHA,
        SSL3_CK_ADH_DES_64_CBC_SHA,
        SSL_kEDH |SSL_aNULL|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
        0,
        56,
        56,
@@ -209,7 +209,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_ADH_DES_192_CBC_SHA,
        SSL3_CK_ADH_DES_192_CBC_SHA,
        SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        0,
        168,
        168,
@@ -291,7 +291,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_RSA_DES_40_CBC_SHA,
        SSL3_CK_RSA_DES_40_CBC_SHA,
        SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_EXPORT|SSL_EXP40|SSL_FIPS,
        0,
        40,
        56,
@@ -304,7 +304,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_RSA_DES_64_CBC_SHA,
        SSL3_CK_RSA_DES_64_CBC_SHA,
        SSL_kRSA|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
        0,
        56,
        56,
@@ -317,7 +317,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_RSA_DES_192_CBC3_SHA,
        SSL3_CK_RSA_DES_192_CBC3_SHA,
        SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        0,
        168,
        168,
@@ -332,7 +332,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
        SSL3_CK_DH_DSS_DES_40_CBC_SHA,
        SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_EXPORT|SSL_EXP40|SSL_FIPS,
        0,
        40,
        56,
@@ -345,7 +345,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
        SSL3_CK_DH_DSS_DES_64_CBC_SHA,
        SSL_kDHd |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
        0,
        56,
        56,
@@ -358,7 +358,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
        SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
        SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        0,
        168,
        168,
@@ -371,7 +371,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
        SSL3_CK_DH_RSA_DES_40_CBC_SHA,
        SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_EXPORT|SSL_EXP40|SSL_FIPS,
        0,
        40,
        56,
@@ -384,7 +384,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
        SSL3_CK_DH_RSA_DES_64_CBC_SHA,
        SSL_kDHr |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
        0,
        56,
        56,
@@ -397,7 +397,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
        SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
        SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        0,
        168,
        168,
@@ -412,7 +412,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
        SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
        SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_EXPORT|SSL_EXP40|SSL_FIPS,
        0,
        40,
        56,
@@ -425,7 +425,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
        SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
        SSL_kEDH|SSL_aDSS|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
        0,
        56,
        56,
@@ -438,7 +438,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
        SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
        SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        0,
        168,
        168,
@@ -451,7 +451,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
        SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
        SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
-       SSL_EXPORT|SSL_EXP40,
+       SSL_EXPORT|SSL_EXP40|SSL_FIPS,
        0,
        40,
        56,
@@ -464,7 +464,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
        SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
        SSL_kEDH|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_LOW,
+       SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
        0,
        56,
        56,
@@ -477,7 +477,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
        SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
        SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-       SSL_NOT_EXP|SSL_HIGH,
+       SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
        0,
        168,
        168,
@@ -767,7 +767,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
            TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
            SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_TLSV1,
-           SSL_EXPORT|SSL_EXP56,
+           SSL_EXPORT|SSL_EXP56|SSL_FIPS,
            0,
            56,
            56,
@@ -780,7 +780,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
            TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
            SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_TLSV1,
-           SSL_EXPORT|SSL_EXP56,
+           SSL_EXPORT|SSL_EXP56|SSL_FIPS,
            0,
            56,
            56,
@@ -835,7 +835,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_RSA_WITH_AES_128_SHA,
            TLS1_CK_RSA_WITH_AES_128_SHA,
            SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
-           SSL_NOT_EXP|SSL_MEDIUM,
+           SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
            0,
            128,
            128,
@@ -848,7 +848,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
            TLS1_CK_DH_DSS_WITH_AES_128_SHA,
            SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_MEDIUM,
+           SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
            0,
            128,
            128,
@@ -861,7 +861,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
            TLS1_CK_DH_RSA_WITH_AES_128_SHA,
            SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_MEDIUM,
+           SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
            0,
            128,
            128,
@@ -874,7 +874,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
            TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
            SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_MEDIUM,
+           SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
            0,
            128,
            128,
@@ -887,7 +887,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
            TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
            SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_MEDIUM,
+           SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
            0,
            128,
            128,
@@ -900,7 +900,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_ADH_WITH_AES_128_SHA,
            TLS1_CK_ADH_WITH_AES_128_SHA,
            SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_MEDIUM,
+           SSL_NOT_EXP|SSL_MEDIUM|SSL_FIPS,
            0,
            128,
            128,
@@ -914,7 +914,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_RSA_WITH_AES_256_SHA,
            TLS1_CK_RSA_WITH_AES_256_SHA,
            SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
-           SSL_NOT_EXP|SSL_HIGH,
+           SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
            0,
            256,
            256,
@@ -927,7 +927,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
            TLS1_CK_DH_DSS_WITH_AES_256_SHA,
            SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_HIGH,
+           SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
            0,
            256,
            256,
@@ -940,7 +940,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
            TLS1_CK_DH_RSA_WITH_AES_256_SHA,
            SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_HIGH,
+           SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
            0,
            256,
            256,
@@ -953,7 +953,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
            TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
            SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_HIGH,
+           SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
            0,
            256,
            256,
@@ -966,7 +966,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
            TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
            SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_HIGH,
+           SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
            0,
            256,
            256,
@@ -979,7 +979,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
            TLS1_TXT_ADH_WITH_AES_256_SHA,
            TLS1_CK_ADH_WITH_AES_256_SHA,
            SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
-           SSL_NOT_EXP|SSL_HIGH,
+           SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
            0,
            256,
            256,

diff --git a/ssl/ssl.h b/ssl/ssl.h
index 913bd40eea4a3dd7afa36265054d3830bce77f8d..ad201f2574375c8130992b1c5ea1140654db8cc5 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -239,6 +239,7 @@ extern "C" {
 #define SSL_TXT_LOW            "LOW"
 #define SSL_TXT_MEDIUM         "MEDIUM"
 #define SSL_TXT_HIGH           "HIGH"
+#define SSL_TXT_FIPS           "FIPS"
 #define SSL_TXT_kFZA           "kFZA"
 #define        SSL_TXT_aFZA            "aFZA"
 #define SSL_TXT_eFZA           "eFZA"

diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index 44c503eb048ea65744165ea301114af40cf563be..78251d9f9ebf81eae6d7c20a2b2f40bb54603a00 100644 (file)
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -59,6 +59,7 @@
 #include <stdio.h>
 #include <openssl/objects.h>
 #include <openssl/comp.h>
+#include <openssl/fips.h>
 #include "ssl_locl.h"
 
 #define SSL_ENC_DES_IDX                0
@@ -153,6 +154,7 @@ static const SSL_CIPHER cipher_aliases[]={
        {0,SSL_TXT_LOW,   0, 0,   SSL_LOW, 0,0,0,0,SSL_STRONG_MASK},
        {0,SSL_TXT_MEDIUM,0, 0,SSL_MEDIUM, 0,0,0,0,SSL_STRONG_MASK},
        {0,SSL_TXT_HIGH,  0, 0,  SSL_HIGH, 0,0,0,0,SSL_STRONG_MASK},
+       {0,SSL_TXT_FIPS,  0, 0,  SSL_FIPS, 0,0,0,0,SSL_FIPS|SSL_STRONG_NONE},
        };
 
 static int init_ciphers=1;
@@ -359,7 +361,12 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
                {
                c = ssl_method->get_cipher(i);
                /* drop those that use any of that is not available */
+#ifdef OPENSSL_FIPS
+               if ((c != NULL) && c->valid && !(c->algorithms & mask)
+                       && (!FIPS_mode || (c->algo_strength & SSL_FIPS)))
+#else
                if ((c != NULL) && c->valid && !(c->algorithms & mask))
+#endif
                        {
                        co_list[co_list_num].cipher = c;
                        co_list[co_list_num].next = NULL;
@@ -854,7 +861,11 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         */
        for (curr = head; curr != NULL; curr = curr->next)
                {
+#ifdef OPENSSL_FIPS
+               if (curr->active && (!FIPS_mode || curr->cipher->algo_strength & SSL_FIPS))
+#else
                if (curr->active)
+#endif
                        {
                        sk_SSL_CIPHER_push(cipherstack, curr->cipher);
 #ifdef CIPHER_DEBUG

diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index dd6c7a7323f0f04310014e30be1f650501c68ad9..ca34c8b8f07cdcbbc13e3290608ac59bf4224ff9 100644 (file)
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -302,8 +302,9 @@
 #define SSL_LOW                        0x00000020L
 #define SSL_MEDIUM             0x00000040L
 #define SSL_HIGH               0x00000080L
+#define SSL_FIPS               0x00000100L
 
-/* we have used 000000ff - 24 bits left to go */
+/* we have used 000001ff - 23 bits left to go */
 
 /*
  * Macros to check the export status and cipher strength for export ciphers.