Redirect FIPS memory allocation to FIPS_malloc() routine, remove

OpenSSL malloc dependencies.

diff --git a/Makefile.org b/Makefile.org
index 4160f590a85e11d0fee330f99bc5f31bc817309c..8e7a77d57857784cc548b408fbb892b6a47d2c8e 100644 (file)
--- a/Makefile.org
+++ b/Makefile.org
@@ -313,7 +313,6 @@ FIPS_EX_OBJ= ../crypto/aes/aes_cfb.o \
        ../crypto/evp/e_des3.o \
        ../crypto/evp/m_sha1.o \
        ../crypto/hmac/hmac.o \
-       ../crypto/mem.o \
        ../crypto/modes/cfb128.o \
        ../crypto/modes/ctr128.o \
        ../crypto/modes/ofb128.o \

diff --git a/crypto/bn/bn_blind.c b/crypto/bn/bn_blind.c
index 6e00f43c669069c4bf8e71f8b4598050b59d68d0..d2bba48b0d14c423a177640a04d90f741f1584fc 100644 (file)
--- a/crypto/bn/bn_blind.c
+++ b/crypto/bn/bn_blind.c
@@ -113,6 +113,12 @@
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
+#define OPENSSL_FIPSAPI
+
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 #define BN_BLINDING_COUNTER    32
 
 struct bn_blinding_st

diff --git a/crypto/bn/bn_ctx.c b/crypto/bn/bn_ctx.c
index 3f2256f67575aeca46c110ba8416bfba1daa60af..f16fb35f5a306cba39c38f8130b4034fd4b10aec 100644 (file)
--- a/crypto/bn/bn_ctx.c
+++ b/crypto/bn/bn_ctx.c
@@ -60,12 +60,18 @@
 #endif
 #endif
 
+#define OPENSSL_FIPSAPI
+
 #include <stdio.h>
 #include <assert.h>
 
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 /* TODO list
  *
  * 1. Check a bunch of "(words+1)" type hacks in various bignum functions and

diff --git a/crypto/bn/bn_exp.c b/crypto/bn/bn_exp.c
index d9b6c737fc82f5f5f8c4bc9a5d7ba23ee8627c73..22673677931a1aa2e37a19d25b2b3bf73ec62b44 100644 (file)
--- a/crypto/bn/bn_exp.c
+++ b/crypto/bn/bn_exp.c
@@ -113,6 +113,11 @@
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
+#define OPENSSL_FIPSAPI
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 /* maximum precomputation table size for *variable* sliding windows */
 #define TABLE_SIZE     32
 

diff --git a/crypto/bn/bn_lib.c b/crypto/bn/bn_lib.c
index 7a5676de69275897f4c197fad784a46a585d0f75..503762b31eb77e0b31d8ff9cead8f46d80eeaf9f 100644 (file)
--- a/crypto/bn/bn_lib.c
+++ b/crypto/bn/bn_lib.c
@@ -67,6 +67,11 @@
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
+#define OPENSSL_FIPSAPI
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 const char BN_version[]="Big Number" OPENSSL_VERSION_PTEXT;
 
 /* This stuff appears to be completely unused, so is deprecated */

diff --git a/crypto/bn/bn_rand.c b/crypto/bn/bn_rand.c
index b376c28ff3ff25b027922964af6ca26b4995250a..070b1e4ed2868a9d11ea84222e84a64a470134cf 100644 (file)
--- a/crypto/bn/bn_rand.c
+++ b/crypto/bn/bn_rand.c
@@ -115,6 +115,11 @@
 #include "bn_lcl.h"
 #include <openssl/rand.h>
 
+#define OPENSSL_FIPSAPI
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
        {
        unsigned char *buf=NULL;

diff --git a/crypto/bn/bn_recp.c b/crypto/bn/bn_recp.c
index 2e8efb8dae29ac2f5473299ae2bcb9e4752c1f5c..dde27ae71a5add527e139aa614e5a9190ec7c1bd 100644 (file)
--- a/crypto/bn/bn_recp.c
+++ b/crypto/bn/bn_recp.c
@@ -60,6 +60,11 @@
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
+#define OPENSSL_FIPSAPI
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 void BN_RECP_CTX_init(BN_RECP_CTX *recp)
        {
        BN_init(&(recp->N));

diff --git a/crypto/buffer/buf_str.c b/crypto/buffer/buf_str.c
index 151f5ea971aaa30a55f7ca755c46bac7825907c4..6d94942df807b41a8e61b46fe634f2d27464361f 100644 (file)
--- a/crypto/buffer/buf_str.c
+++ b/crypto/buffer/buf_str.c
@@ -60,6 +60,11 @@
 #include "cryptlib.h"
 #include <openssl/buffer.h>
 
+#define OPENSSL_FIPSAPI
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 char *BUF_strdup(const char *str)
        {
        if (str == NULL) return(NULL);

diff --git a/crypto/dsa/dsa_sign.c b/crypto/dsa/dsa_sign.c
index e02365a8b133248f0e9a2cb7c0c555841bc7bb3e..3684960203de42c3443a0b31752b2be894025362 100644 (file)
--- a/crypto/dsa/dsa_sign.c
+++ b/crypto/dsa/dsa_sign.c
@@ -63,6 +63,11 @@
 #include <openssl/rand.h>
 #include <openssl/bn.h>
 
+#define OPENSSL_FIPSAPI
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 DSA_SIG * DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
        {
        return dsa->meth->dsa_do_sign(dgst, dlen, dsa);

diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c
index b8676ad020dc6303dca33ae52aef5d8382c56daf..e82a81b03ae62be387a9cdb794209735cf2a314f 100644 (file)
--- a/crypto/rsa/rsa_gen.c
+++ b/crypto/rsa/rsa_gen.c
@@ -70,6 +70,8 @@
 
 #ifdef OPENSSL_FIPS
 
+#define OPENSSL_FIPSAPI
+
 #include <openssl/fips.h>
 #include <openssl/evp.h>
 

diff --git a/crypto/rsa/rsa_oaep.c b/crypto/rsa/rsa_oaep.c
index eaae71223682099f737e5c8377894662de1a15da..48cd89dd48cc30aeca24078828f50574790b02aa 100644 (file)
--- a/crypto/rsa/rsa_oaep.c
+++ b/crypto/rsa/rsa_oaep.c
@@ -30,6 +30,10 @@
 #include <openssl/rand.h>
 #include <openssl/sha.h>
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 static int MGF1(unsigned char *mask, long len,
        const unsigned char *seed, long seedlen);
 

diff --git a/crypto/rsa/rsa_pss.c b/crypto/rsa/rsa_pss.c
index e8f6798bbd6a5de9aa01476ec6bc57cb37719537..0d008c33f327630da6908128f30c40927a70a47a 100644 (file)
--- a/crypto/rsa/rsa_pss.c
+++ b/crypto/rsa/rsa_pss.c
@@ -67,6 +67,10 @@
 #include <openssl/sha.h>
 #include "rsa_locl.h"
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 static const unsigned char zeroes[] = {0,0,0,0,0,0,0,0};
 
 #if defined(_MSC_VER) && defined(_ARM_)

diff --git a/fips/dh/fips_dh_lib.c b/fips/dh/fips_dh_lib.c
index 4a822cf192506ee90ecfba3441482a38cb27c9d1..747d949389c22b536a0dcaa22ef0d0cd3d7d73f1 100644 (file)
--- a/fips/dh/fips_dh_lib.c
+++ b/fips/dh/fips_dh_lib.c
@@ -56,9 +56,12 @@
  *
  */
 
+#define OPENSSL_FIPSAPI
+
 #include <string.h>
 #include <openssl/bn.h>
 #include <openssl/dh.h>
+#include <openssl/fips.h>
 
 /* Minimal FIPS versions of FIPS_dh_new() and FIPS_dh_free(): to
  * reduce external dependencies. 

diff --git a/fips/dsa/fips_dsa_lib.c b/fips/dsa/fips_dsa_lib.c
index 2545966d2a381005bee342da4afce354297ea457..06f8cabfee31286f4cafd2b51dc5e67d37792c89 100644 (file)
--- a/fips/dsa/fips_dsa_lib.c
+++ b/fips/dsa/fips_dsa_lib.c
@@ -56,9 +56,12 @@
  *
  */
 
+#define OPENSSL_FIPSAPI
+
 #include <string.h>
 #include <openssl/dsa.h>
 #include <openssl/bn.h>
+#include <openssl/fips.h>
 
 /* Minimal FIPS versions of FIPS_dsa_new() and FIPS_dsa_free: to
  * reduce external dependencies. 

diff --git a/fips/fips.h b/fips/fips.h
index 2ef955ab13f3d0b8bdaeed85fb6a7d3f659372e6..5452db9311f522ec110e257ba18be66b7ba722ea 100644 (file)
--- a/fips/fips.h
+++ b/fips/fips.h
@@ -113,8 +113,13 @@ void FIPS_lock(int mode, int type,const char *file,int line);
 void FIPS_set_locking_callback (void (*func)(int mode, int type,
                                const char *file,int line));
 
+void *FIPS_malloc(int num, const char *file, int line);
+void FIPS_free(void *);
+
 #if defined(OPENSSL_FIPSCANISTER) && defined(OPENSSL_FIPSAPI)
 #define CRYPTO_lock FIPS_lock
+#define CRYPTO_malloc FIPS_malloc
+#define CRYPTO_free FIPS_free
 #endif
 
 /* BEGIN ERROR CODES */

diff --git a/fips/fips_utl.h b/fips/fips_utl.h
index b3162d68632ae4286fa85c858e5aa4c3f724da2d..76ae4f8e38d25ce8de5b5fcab14786bdfe07bda4 100644 (file)
--- a/fips/fips_utl.h
+++ b/fips/fips_utl.h
@@ -47,6 +47,9 @@
  *
  */
 
+#define OPENSSL_FIPSAPI
+#include <openssl/fips.h>
+
 int hex2bin(const char *in, unsigned char *out);
 unsigned char *hex2bin_m(const char *in, long *plen);
 int do_hex2bn(BIGNUM **pr, const char *in);

diff --git a/fips/hmac/fips_hmactest.c b/fips/hmac/fips_hmactest.c
index 575f6524b7de99018bfd4bf3a9920678dde0828f..8c51fe523be1ce5e6e61165a267ec2e443bd9fcb 100644 (file)
--- a/fips/hmac/fips_hmactest.c
+++ b/fips/hmac/fips_hmactest.c
@@ -77,7 +77,6 @@ int main(int argc, char *argv[])
 
 #else
 
-#include <openssl/fips.h>
 #include "fips_utl.h"
 
 static int hmac_test(const EVP_MD *md, FILE *out, FILE *in);

diff --git a/fips/rand/fips_randtest.c b/fips/rand/fips_randtest.c
index 88fb86060d04efc514fb27433bfa5b1d65432347..31c51d3392886ca4ae8aa016f7087210258570a4 100644 (file)
--- a/fips/rand/fips_randtest.c
+++ b/fips/rand/fips_randtest.c
@@ -123,6 +123,8 @@ int main(int argc, char *argv[])
 
 #else
 
+#define OPENSSL_FIPSAPI
+
 #include <openssl/fips.h>
 #include "fips_utl.h"
 

diff --git a/fips/rsa/fips_rsa_lib.c b/fips/rsa/fips_rsa_lib.c
index a37ad3e540746f40e952e275ab72df99e769ae09..77c0cb84666f4f3172c8f530ae13aeac7bd04cb6 100644 (file)
--- a/fips/rsa/fips_rsa_lib.c
+++ b/fips/rsa/fips_rsa_lib.c
@@ -56,11 +56,14 @@
  *
  */
 
+#define OPENSSL_FIPSAPI
+
 #include <string.h>
 #include <openssl/evp.h>
 #include <openssl/rsa.h>
 #include <openssl/bn.h>
 #include <openssl/err.h>
+#include <openssl/fips.h>
 
 /* Minimal FIPS versions of FIPS_rsa_new() and FIPS_rsa_free: to
  * reduce external dependencies. 
@@ -95,7 +98,6 @@ void FIPS_rsa_free(RSA *r)
        if (r->iqmp != NULL) BN_clear_free(r->iqmp);
        if (r->blinding != NULL) BN_BLINDING_free(r->blinding);
        if (r->mt_blinding != NULL) BN_BLINDING_free(r->mt_blinding);
-       if (r->bignum_data != NULL) OPENSSL_free_locked(r->bignum_data);
        OPENSSL_free(r);
        }
 

diff --git a/fips/rsa/fips_rsa_sign.c b/fips/rsa/fips_rsa_sign.c
index d07111b4be61c135ed9401665d47a28c073733b4..4e5b4bf1db31fea152958559d744029f70a5f2be 100644 (file)
--- a/fips/rsa/fips_rsa_sign.c
+++ b/fips/rsa/fips_rsa_sign.c
@@ -63,6 +63,7 @@
 #include <openssl/rsa.h>
 #include <openssl/err.h>
 #include <openssl/sha.h>
+#include <openssl/fips.h>
 
 #ifdef OPENSSL_FIPS
 

diff --git a/fips/utl/Makefile b/fips/utl/Makefile
index 577578ee70fe6705cff17c75d91dee9ba0675eea..8542b3215631f42004410c46e1eb70e5efa51ecf 100644 (file)
--- a/fips/utl/Makefile
+++ b/fips/utl/Makefile
@@ -22,8 +22,8 @@ TEST=
 APPS=
 
 LIB=$(TOP)/libcrypto.a
-LIBSRC= fips_err.c fips_md.c fips_enc.c fips_lck.c
-LIBOBJ= fips_err.o fips_md.o fips_enc.o fips_lck.o
+LIBSRC= fips_err.c fips_md.c fips_enc.c fips_lck.c fips_mem.c
+LIBOBJ= fips_err.o fips_md.o fips_enc.o fips_lck.o fips_mem.o
 
 SRC= $(LIBSRC)
 

diff --git a/fips/utl/fips_enc.c b/fips/utl/fips_enc.c
index 23ba5ddb746c756f7a49fb27ac7999fa66cf6322..93647a023b0368cf60764ccfe0b5e33f458ad479 100644 (file)
--- a/fips/utl/fips_enc.c
+++ b/fips/utl/fips_enc.c
@@ -56,11 +56,13 @@
  * [including the GNU Public Licence.]
  */
 
+#define OPENSSL_FIPSAPI
+
 #include <stdio.h>
 #include <string.h>
 #include <openssl/evp.h>
 #include <openssl/err.h>
-#include <openssl/rand.h>
+#include <openssl/fips.h>
 
 void FIPS_cipher_ctx_init(EVP_CIPHER_CTX *ctx)
        {

diff --git a/fips/utl/fips_md.c b/fips/utl/fips_md.c
index 6e33e841a561fceb50951372c88a8b7931cf982b..0038646f58f9d70492f413be7bb9490afd557037 100644 (file)
--- a/fips/utl/fips_md.c
+++ b/fips/utl/fips_md.c
@@ -111,11 +111,14 @@
 
 /* Minimal standalone FIPS versions of Digest operations */
 
+#define OPENSSL_FIPSAPI
+
 #include <stdio.h>
 #include <string.h>
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include <openssl/err.h>
+#include <openssl/fips.h>
 
 void FIPS_md_ctx_init(EVP_MD_CTX *ctx)
        {