Merge branch 'maint'

* maint:
  crypto: Fix FIPS flags for MACs
  crypto: Fix FIPS flags for digests
  crypto: Fix FIPS flags for digests in HMAC
  crypto: Rename cipher fips macro

6 files changed, 75 insertions, 28 deletions

diff --git a/lib/crypto/c_src/api_ng.c b/lib/crypto/c_src/api_ng.c
index 3408ba1b88..a109f444cf 100644
--- a/lib/crypto/c_src/api_ng.c
+++ b/lib/crypto/c_src/api_ng.c
@@ -100,7 +100,7 @@ static int get_init_args(ErlNifEnv* env,
         }
 
 
-    if (FORBIDDEN_IN_FIPS(*cipherp))
+    if (CIPHER_FORBIDDEN_IN_FIPS(*cipherp))
         {
             *return_term = EXCP_NOTSUP(env, "Forbidden in FIPS");
             goto err;
diff --git a/lib/crypto/c_src/cipher.c b/lib/crypto/c_src/cipher.c
index 0532fb7566..e144a891a6 100644
--- a/lib/crypto/c_src/cipher.c
+++ b/lib/crypto/c_src/cipher.c
@@ -214,7 +214,7 @@ ERL_NIF_TERM cipher_info_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]
     if ((cipherp = get_cipher_type_no_key(argv[0])) == NULL)
         return enif_make_badarg(env);
 
-    if (FORBIDDEN_IN_FIPS(cipherp))
+    if (CIPHER_FORBIDDEN_IN_FIPS(cipherp))
         return enif_raise_exception(env, atom_notsup);
     if ((cipher = cipherp->cipher.p) == NULL)
         return enif_raise_exception(env, atom_notsup);
@@ -330,7 +330,7 @@ ERL_NIF_TERM cipher_types_as_list(ErlNifEnv* env)
 
     for (p = cipher_types; (p->type.atom & (p->type.atom != atom_false)); p++) {
         if ((prev == p->type.atom) ||
-            FORBIDDEN_IN_FIPS(p) )
+            CIPHER_FORBIDDEN_IN_FIPS(p) )
             continue;
 
         if ((p->cipher.p != NULL) ||
diff --git a/lib/crypto/c_src/cipher.h b/lib/crypto/c_src/cipher.h
index 0e51c410eb..c23e128824 100644
--- a/lib/crypto/c_src/cipher.h
+++ b/lib/crypto/c_src/cipher.h
@@ -52,10 +52,10 @@ struct cipher_type_t {
 
 #ifdef FIPS_SUPPORT
 /* May have FIPS support, must check dynamically if it is enabled */
-# define FORBIDDEN_IN_FIPS(P) (((P)->flags & NO_FIPS_CIPHER) && FIPS_mode())
+# define CIPHER_FORBIDDEN_IN_FIPS(P) (((P)->flags & NO_FIPS_CIPHER) && FIPS_mode())
 #else
 /* No FIPS support since the symbol FIPS_SUPPORT is undefined */
-# define FORBIDDEN_IN_FIPS(P) 0
+# define CIPHER_FORBIDDEN_IN_FIPS(P) 0
 #endif
 
 extern ErlNifResourceType* evp_cipher_ctx_rtype;
diff --git a/lib/crypto/c_src/digest.c b/lib/crypto/c_src/digest.c
index c987a664d5..0f887ab765 100644
--- a/lib/crypto/c_src/digest.c
+++ b/lib/crypto/c_src/digest.c
@@ -22,7 +22,7 @@
 
 static struct digest_type_t digest_types[] =
 {
-    {{"md4"},
+    {{"md4"}, NO_FIPS_DIGEST,
 #ifdef HAVE_MD4
      {&EVP_md4}
 #else
@@ -30,7 +30,7 @@ static struct digest_type_t digest_types[] =
 #endif
     },
 
-    {{"md5"},
+    {{"md5"}, NO_FIPS_DIGEST,
 #ifdef HAVE_MD5
      {&EVP_md5}
 #else
@@ -38,7 +38,7 @@ static struct digest_type_t digest_types[] =
 #endif
     },
 
-    {{"ripemd160"},
+    {{"ripemd160"}, NO_FIPS_DIGEST,
 #ifdef HAVE_RIPEMD160
      {&EVP_ripemd160}
 #else
@@ -46,9 +46,9 @@ static struct digest_type_t digest_types[] =
 #endif
     },
 
-    {{"sha"}, {&EVP_sha1}},
+    {{"sha"}, 0, {&EVP_sha1}},
 
-    {{"sha224"},
+    {{"sha224"}, 0,
 #ifdef HAVE_SHA224
      {&EVP_sha224}
 #else
@@ -56,7 +56,7 @@ static struct digest_type_t digest_types[] =
 #endif
     },
 
-    {{"sha256"},
+    {{"sha256"}, 0,
 #ifdef HAVE_SHA256
      {&EVP_sha256}
 #else
@@ -64,7 +64,7 @@ static struct digest_type_t digest_types[] =
 #endif
     },
 
-    {{"sha384"},
+    {{"sha384"}, 0,
 #ifdef HAVE_SHA384
      {&EVP_sha384}
 #else
@@ -72,7 +72,7 @@ static struct digest_type_t digest_types[] =
 #endif
     },
 
-    {{"sha512"},
+    {{"sha512"}, 0,
 #ifdef HAVE_SHA512
      {&EVP_sha512}
 #else
@@ -80,7 +80,7 @@ static struct digest_type_t digest_types[] =
 #endif
     },
 
-    {{"sha3_224"},
+    {{"sha3_224"}, 0,
 #ifdef HAVE_SHA3_224
      {&EVP_sha3_224}
 #else
@@ -88,7 +88,7 @@ static struct digest_type_t digest_types[] =
 #endif
     },
 
-    {{"sha3_256"},
+    {{"sha3_256"}, 0,
 #ifdef HAVE_SHA3_256
      {&EVP_sha3_256}
 #else
@@ -96,7 +96,7 @@ static struct digest_type_t digest_types[] =
 #endif
     },
 
-    {{"sha3_384"},
+    {{"sha3_384"}, 0,
 #ifdef HAVE_SHA3_384
      {&EVP_sha3_384}
 #else
@@ -104,7 +104,7 @@ static struct digest_type_t digest_types[] =
 #endif
     },
 
-    {{"sha3_512"},
+    {{"sha3_512"}, 0,
 #ifdef HAVE_SHA3_512
      {&EVP_sha3_512}
 #else
@@ -112,7 +112,7 @@ static struct digest_type_t digest_types[] =
 #endif
     },
 
-    {{"blake2b"},
+    {{"blake2b"}, 0,
 #ifdef HAVE_BLAKE2
      {&EVP_blake2b512}
 #else
@@ -120,7 +120,7 @@ static struct digest_type_t digest_types[] =
 #endif
     },
 
-    {{"blake2s"},
+    {{"blake2s"}, 0,
 #ifdef HAVE_BLAKE2
      {&EVP_blake2s256}
 #else
@@ -128,7 +128,8 @@ static struct digest_type_t digest_types[] =
 #endif
     },
 
-    {{NULL}, {NULL}}
+    /*==== End of list ==== */
+    {{NULL}, 0, {NULL}}
 };
 
 void init_digest_types(ErlNifEnv* env)
diff --git a/lib/crypto/c_src/digest.h b/lib/crypto/c_src/digest.h
index 06852416cf..b1f8128a1f 100644
--- a/lib/crypto/c_src/digest.h
+++ b/lib/crypto/c_src/digest.h
@@ -28,12 +28,25 @@ struct digest_type_t {
 	const char*  str;        /* before init, NULL for end-of-table */
 	ERL_NIF_TERM atom;       /* after init, 'false' for end-of-table */
     }type;
+    unsigned flags;
     union {
 	const EVP_MD* (*funcp)(void);  /* before init, NULL if notsup */
 	const EVP_MD* p;               /* after init, NULL if notsup */
     }md;
 };
 
+/* masks in the flags field if digest_type_t */
+#define NO_FIPS_DIGEST 1
+
+#ifdef FIPS_SUPPORT
+/* May have FIPS support, must check dynamically if it is enabled */
+# define DIGEST_FORBIDDEN_IN_FIPS(P) (((P)->flags & NO_FIPS_DIGEST) && FIPS_mode())
+#else
+/* No FIPS support since the symbol FIPS_SUPPORT is undefined */
+# define DIGEST_FORBIDDEN_IN_FIPS(P) 0
+#endif
+
+
 void init_digest_types(ErlNifEnv* env);
 struct digest_type_t* get_digest_type(ERL_NIF_TERM type);
 
diff --git a/lib/crypto/c_src/mac.c b/lib/crypto/c_src/mac.c
index 8b2710b91a..149975ba9d 100644
--- a/lib/crypto/c_src/mac.c
+++ b/lib/crypto/c_src/mac.c
@@ -34,6 +34,7 @@ struct mac_type_t {
 	const char*  str;        /* before init, NULL for end-of-table */
 	ERL_NIF_TERM atom;       /* after init, 'false' for end-of-table */
     }name;
+    unsigned flags;
     union {
         const int pkey_type;
     }alg;
@@ -41,6 +42,9 @@ struct mac_type_t {
     size_t key_len;      /* != 0 to also match on key_len */
 };
 
+/* masks in the flags field if mac_type_t */
+#define NO_FIPS_MAC 1
+
 #define NO_mac 0
 #define HMAC_mac 1
 #define CMAC_mac 2
@@ -48,7 +52,7 @@ struct mac_type_t {
 
 static struct mac_type_t mac_types[] =
 {
-    {{"poly1305"},
+    {{"poly1305"}, NO_FIPS_MAC,
 #ifdef HAVE_POLY1305
      /* If we have POLY then we have EVP_PKEY */
      {EVP_PKEY_POLY1305}, POLY1305_mac, 32
@@ -57,7 +61,7 @@ static struct mac_type_t mac_types[] =
 #endif
     },
 
-    {{"hmac"},
+    {{"hmac"}, 0,
 #ifdef HAS_EVP_PKEY_CTX
      {EVP_PKEY_HMAC}, HMAC_mac, 0
 #else
@@ -66,7 +70,7 @@ static struct mac_type_t mac_types[] =
 #endif
     },
 
-    {{"cmac"},
+    {{"cmac"}, 0,
 #ifdef HAVE_CMAC
      /* If we have CMAC then we have EVP_PKEY */
      {EVP_PKEY_CMAC}, CMAC_mac, 0
@@ -76,12 +80,21 @@ static struct mac_type_t mac_types[] =
     },
 
     /*==== End of list ==== */
-    {{NULL},
+    {{NULL}, 0,
      {0}, NO_mac, 0
     }
 };
 
 
+#ifdef FIPS_SUPPORT
+/* May have FIPS support, must check dynamically if it is enabled */
+# define MAC_FORBIDDEN_IN_FIPS(P) (((P)->flags & NO_FIPS_MAC) && FIPS_mode())
+#else
+/* No FIPS support since the symbol FIPS_SUPPORT is undefined */
+# define MAC_FORBIDDEN_IN_FIPS(P) 0
+#endif
+
+
 /***************************
  Mandatory prototypes
 ***************************/
@@ -219,6 +232,12 @@ ERL_NIF_TERM mac_one_time(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
             goto err;
         }
 
+    if (MAC_FORBIDDEN_IN_FIPS(macp))
+        {
+            return_term = EXCP_NOTSUP(env, "MAC algorithm forbidden in FIPS");
+            goto err;
+        }
+
     /*--------------------------------------------------
       Algorithm dependent indata checking and computation.
       If EVP_PKEY is available, only set the pkey variable
@@ -245,7 +264,11 @@ ERL_NIF_TERM mac_one_time(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
                     return_term = EXCP_NOTSUP(env, "Unsupported digest algorithm");
                     goto err;
                 }
-
+            if (DIGEST_FORBIDDEN_IN_FIPS(digp))
+                {
+                    return_term = EXCP_NOTSUP(env, "Digest algorithm for HMAC forbidden in FIPS");
+                    goto err;
+                }
             md = digp->md.p;
 
 #ifdef HAS_EVP_PKEY_CTX
@@ -284,7 +307,7 @@ ERL_NIF_TERM mac_one_time(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
                     goto err;
                 }
             
-            if (FORBIDDEN_IN_FIPS(cipherp))
+            if (CIPHER_FORBIDDEN_IN_FIPS(cipherp))
                 {
                     return_term = EXCP_NOTSUP(env, "Cipher algorithm not supported in FIPS");
                     goto err;
@@ -496,6 +519,12 @@ ERL_NIF_TERM mac_init_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
             goto err;
         }
 
+    if (MAC_FORBIDDEN_IN_FIPS(macp))
+        {
+            return_term = EXCP_NOTSUP(env, "MAC algorithm forbidden in FIPS");
+            goto err;
+        }
+
     /*--------------------------------------------------
       Algorithm dependent indata checking and computation.
       If EVP_PKEY is available, only set the pkey variable
@@ -522,7 +551,11 @@ ERL_NIF_TERM mac_init_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
                     return_term = EXCP_NOTSUP(env, "Unsupported digest algorithm");
                     goto err;
                 }
-
+            if (DIGEST_FORBIDDEN_IN_FIPS(digp))
+                {
+                    return_term = EXCP_NOTSUP(env, "Digest algorithm for HMAC forbidden in FIPS");
+                    goto err;
+                }
             md = digp->md.p;
 
 # ifdef HAVE_PKEY_new_raw_private_key
@@ -553,7 +586,7 @@ ERL_NIF_TERM mac_init_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
                     goto err;
                 }
             
-            if (FORBIDDEN_IN_FIPS(cipherp))
+            if (CIPHER_FORBIDDEN_IN_FIPS(cipherp))
                 {
                     return_term = EXCP_NOTSUP(env, "Cipher algorithm not supported in FIPS");
                     goto err;