1 files changed, 105 insertions, 124 deletions

diff --git a/src/lib/libssl/src/fips/rsa/fips_rsa_eay.c b/src/lib/libcrypto/rsa/rsa_eay.c
index 937a14e684..2e1ddd48d3 100644
--- a/src/lib/libssl/src/fips/rsa/fips_rsa_eay.c
+++ b/src/lib/libcrypto/rsa/rsa_eay.c
@@ -110,13 +110,12 @@
  */
 
 #include <stdio.h>
+#include "cryptlib.h"
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
 #include <openssl/rand.h>
-#include <openssl/err.h>
-#include <openssl/fips.h>
 
-#if !defined(RSA_NULL) && defined(OPENSSL_FIPS)
+#ifndef RSA_NULL
 
 static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
                 unsigned char *to, RSA *rsa,int padding);
@@ -139,7 +138,7 @@ static RSA_METHOD rsa_pkcs1_eay_meth={
         BN_mod_exp_mont, /* XXX probably we should not use Montgomery if  e == 3 */
         RSA_eay_init,
         RSA_eay_finish,
-        RSA_FLAG_FIPS_METHOD, /* flags */
+        0, /* flags */
         NULL,
         0, /* rsa_sign */
         0, /* rsa_verify */
@@ -151,16 +150,6 @@ const RSA_METHOD *RSA_PKCS1_SSLeay(void)
         return(&rsa_pkcs1_eay_meth);
         }
 
-/* Usage example;
- *    MONT_HELPER(rsa, bn_ctx, p, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err);
- */
-#define MONT_HELPER(rsa, ctx, m, pre_cond, err_instr) \
-        if((pre_cond) && ((rsa)->_method_mod_##m == NULL) && \
-                        !BN_MONT_CTX_set_locked(&((rsa)->_method_mod_##m), \
-                                CRYPTO_LOCK_RSA, \
-                                (rsa)->m, (ctx))) \
-                err_instr
-
 static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
@@ -169,18 +158,6 @@ static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
         unsigned char *buf=NULL;
         BN_CTX *ctx=NULL;
 
-        if(FIPS_selftest_failed())
-                {
-                FIPSerr(FIPS_F_RSA_EAY_PUBLIC_ENCRYPT,FIPS_R_FIPS_SELFTEST_FAILED);
-                goto err;
-                }
-
-        if (FIPS_mode() && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
-                {
-                RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
-                return -1;
-                }
-
         if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
                 {
                 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE);
@@ -240,13 +217,15 @@ static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
         if (BN_bin2bn(buf,num,f) == NULL) goto err;
         
         if (BN_ucmp(f, rsa->n) >= 0)
-                {       
+                {
                 /* usually the padding functions would catch this */
                 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
                 goto err;
                 }
 
-        MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
+        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
+                if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))
+                        goto err;
 
         if (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx,
                 rsa->_method_mod_n)) goto err;
@@ -277,6 +256,7 @@ static BN_BLINDING *rsa_get_blinding(RSA *rsa, int *local, BN_CTX *ctx)
 {
         BN_BLINDING *ret;
         int got_write_lock = 0;
+        CRYPTO_THREADID cur;
 
         CRYPTO_r_lock(CRYPTO_LOCK_RSA);
 
@@ -294,7 +274,8 @@ static BN_BLINDING *rsa_get_blinding(RSA *rsa, int *local, BN_CTX *ctx)
         if (ret == NULL)
                 goto err;
 
-        if (BN_BLINDING_get_thread_id(ret) == CRYPTO_thread_id())
+        CRYPTO_THREADID_current(&cur);
+        if (!CRYPTO_THREADID_cmp(&cur, BN_BLINDING_thread_id(ret)))
                 {
                 /* rsa->blinding is ours! */
 
@@ -333,63 +314,56 @@ static BN_BLINDING *rsa_get_blinding(RSA *rsa, int *local, BN_CTX *ctx)
         return ret;
 }
 
-static int rsa_blinding_convert(BN_BLINDING *b, int local, BIGNUM *f,
-        BIGNUM *r, BN_CTX *ctx)
-{
-        if (local)
+static int rsa_blinding_convert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,
+        BN_CTX *ctx)
+        {
+        if (unblind == NULL)
+                /* Local blinding: store the unblinding factor
+                 * in BN_BLINDING. */
                 return BN_BLINDING_convert_ex(f, NULL, b, ctx);
         else
                 {
-                int ret;
-                CRYPTO_r_lock(CRYPTO_LOCK_RSA_BLINDING);
-                ret = BN_BLINDING_convert_ex(f, r, b, ctx);
-                CRYPTO_r_unlock(CRYPTO_LOCK_RSA_BLINDING);
-                return ret;
-                }
-}
-
-static int rsa_blinding_invert(BN_BLINDING *b, int local, BIGNUM *f,
-        BIGNUM *r, BN_CTX *ctx)
-{
-        if (local)
-                return BN_BLINDING_invert_ex(f, NULL, b, ctx);
-        else
-                {
+                /* Shared blinding: store the unblinding factor
+                 * outside BN_BLINDING. */
                 int ret;
                 CRYPTO_w_lock(CRYPTO_LOCK_RSA_BLINDING);
-                ret = BN_BLINDING_invert_ex(f, r, b, ctx);
+                ret = BN_BLINDING_convert_ex(f, unblind, b, ctx);
                 CRYPTO_w_unlock(CRYPTO_LOCK_RSA_BLINDING);
                 return ret;
                 }
-}
+        }
+
+static int rsa_blinding_invert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,
+        BN_CTX *ctx)
+        {
+        /* For local blinding, unblind is set to NULL, and BN_BLINDING_invert_ex
+         * will use the unblinding factor stored in BN_BLINDING.
+         * If BN_BLINDING is shared between threads, unblind must be non-null:
+         * BN_BLINDING_invert_ex will then use the local unblinding factor,
+         * and will only read the modulus from BN_BLINDING.
+         * In both cases it's safe to access the blinding without a lock.
+         */
+        return BN_BLINDING_invert_ex(f, unblind, b, ctx);
+        }
 
 /* signing */
 static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        BIGNUM *f, *ret, *br, *res;
+        BIGNUM *f, *ret, *res;
         int i,j,k,num=0,r= -1;
         unsigned char *buf=NULL;
         BN_CTX *ctx=NULL;
         int local_blinding = 0;
+        /* Used only if the blinding structure is shared. A non-NULL unblind
+         * instructs rsa_blinding_convert() and rsa_blinding_invert() to store
+         * the unblinding factor outside the blinding structure. */
+        BIGNUM *unblind = NULL;
         BN_BLINDING *blinding = NULL;
 
-        if(FIPS_selftest_failed())
-                {
-                FIPSerr(FIPS_F_RSA_EAY_PRIVATE_ENCRYPT,FIPS_R_FIPS_SELFTEST_FAILED);
-                goto err;
-                }
-
-        if (FIPS_mode() && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
-                {
-                RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
-                return -1;
-                }
-
         if ((ctx=BN_CTX_new()) == NULL) goto err;
         BN_CTX_start(ctx);
         f   = BN_CTX_get(ctx);
-        br  = BN_CTX_get(ctx);
         ret = BN_CTX_get(ctx);
         num = BN_num_bytes(rsa->n);
         buf = OPENSSL_malloc(num);
@@ -437,8 +411,15 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                 }
         
         if (blinding != NULL)
-                if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))
+                {
+                if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL))
+                        {
+                        RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                if (!rsa_blinding_convert(blinding, f, unblind, ctx))
                         goto err;
+                }
 
         if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
                 ((rsa->p != NULL) &&
@@ -461,16 +442,18 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                         BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
                         }
                 else
-                        d = rsa->d;
+                        d= rsa->d;
 
-                MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
+                if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
+                        if(!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))
+                                goto err;
 
                 if (!rsa->meth->bn_mod_exp(ret,f,d,rsa->n,ctx,
                                 rsa->_method_mod_n)) goto err;
                 }
 
         if (blinding)
-                if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))
+                if (!rsa_blinding_invert(blinding, ret, unblind, ctx))
                         goto err;
 
         if (padding == RSA_X931_PADDING)
@@ -509,30 +492,21 @@ err:
 static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        BIGNUM *f, *ret, *br;
+        BIGNUM *f, *ret;
         int j,num=0,r= -1;
         unsigned char *p;
         unsigned char *buf=NULL;
         BN_CTX *ctx=NULL;
         int local_blinding = 0;
+        /* Used only if the blinding structure is shared. A non-NULL unblind
+         * instructs rsa_blinding_convert() and rsa_blinding_invert() to store
+         * the unblinding factor outside the blinding structure. */
+        BIGNUM *unblind = NULL;
         BN_BLINDING *blinding = NULL;
 
-        if(FIPS_selftest_failed())
-                {
-                FIPSerr(FIPS_F_RSA_EAY_PRIVATE_DECRYPT,FIPS_R_FIPS_SELFTEST_FAILED);
-                goto err;
-                }
-
-        if (FIPS_mode() && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
-                {
-                RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
-                return -1;
-                }
-
         if((ctx = BN_CTX_new()) == NULL) goto err;
         BN_CTX_start(ctx);
         f   = BN_CTX_get(ctx);
-        br  = BN_CTX_get(ctx);
         ret = BN_CTX_get(ctx);
         num = BN_num_bytes(rsa->n);
         buf = OPENSSL_malloc(num);
@@ -570,8 +544,15 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                 }
         
         if (blinding != NULL)
-                if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))
+                {
+                if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL))
+                        {
+                        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                if (!rsa_blinding_convert(blinding, f, unblind, ctx))
                         goto err;
+                }
 
         /* do the decrypt */
         if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
@@ -596,14 +577,16 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                 else
                         d = rsa->d;
 
-                MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
+                if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
+                        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))
+                                goto err;
                 if (!rsa->meth->bn_mod_exp(ret,f,d,rsa->n,ctx,
                                 rsa->_method_mod_n))
                   goto err;
                 }
 
         if (blinding)
-                if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))
+                if (!rsa_blinding_invert(blinding, ret, unblind, ctx))
                         goto err;
 
         p=buf;
@@ -656,18 +639,6 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
         unsigned char *buf=NULL;
         BN_CTX *ctx=NULL;
 
-        if(FIPS_selftest_failed())
-                {
-                FIPSerr(FIPS_F_RSA_EAY_PUBLIC_DECRYPT,FIPS_R_FIPS_SELFTEST_FAILED);
-                goto err;
-                }
-
-        if (FIPS_mode() && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
-                {
-                RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
-                return -1;
-                }
-
         if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
                 {
                 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);
@@ -718,13 +689,15 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
                 goto err;
                 }
 
-        MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
+        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
+                if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))
+                        goto err;
 
         if (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx,
                 rsa->_method_mod_n)) goto err;
 
         if ((padding == RSA_X931_PADDING) && ((ret->d[0] & 0xf) != 12))
-                BN_sub(ret, rsa->n, ret);
+                if (!BN_sub(ret, rsa->n, ret)) goto err;
 
         p=buf;
         i=BN_bn2bin(ret,p);
@@ -766,7 +739,6 @@ static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
         BIGNUM *r1,*m1,*vrfy;
         BIGNUM local_dmp1,local_dmq1,local_c,local_r1;
         BIGNUM *dmp1,*dmq1,*c,*pr1;
-        int bn_flags;
         int ret=0;
 
         BN_CTX_start(ctx);
@@ -774,31 +746,41 @@ static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
         m1 = BN_CTX_get(ctx);
         vrfy = BN_CTX_get(ctx);
 
-        /* Make sure mod_inverse in montgomerey intialization use correct 
-         * BN_FLG_CONSTTIME flag.
-         */
-        bn_flags = rsa->p->flags;
-        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
-                {
-                rsa->p->flags |= BN_FLG_CONSTTIME;
-                }
-        MONT_HELPER(rsa, ctx, p, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err);
-        /* We restore bn_flags back */
-        rsa->p->flags = bn_flags;
+        {
+                BIGNUM local_p, local_q;
+                BIGNUM *p = NULL, *q = NULL;
 
-        /* Make sure mod_inverse in montgomerey intialization use correct
-         * BN_FLG_CONSTTIME flag.
-         */
-        bn_flags = rsa->q->flags;
-        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
-                {
-                rsa->q->flags |= BN_FLG_CONSTTIME;
-                }
-        MONT_HELPER(rsa, ctx, q, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err);
-        /* We restore bn_flags back */
-        rsa->q->flags = bn_flags;       
+                /* Make sure BN_mod_inverse in Montgomery intialization uses the
+                 * BN_FLG_CONSTTIME flag (unless RSA_FLAG_NO_CONSTTIME is set)
+                 */
+                if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                        {
+                        BN_init(&local_p);
+                        p = &local_p;
+                        BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);
 
-        MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
+                        BN_init(&local_q);
+                        q = &local_q;
+                        BN_with_flags(q, rsa->q, BN_FLG_CONSTTIME);
+                        }
+                else
+                        {
+                        p = rsa->p;
+                        q = rsa->q;
+                        }
+
+                if (rsa->flags & RSA_FLAG_CACHE_PRIVATE)
+                        {
+                        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_p, CRYPTO_LOCK_RSA, p, ctx))
+                                goto err;
+                        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_q, CRYPTO_LOCK_RSA, q, ctx))
+                                goto err;
+                        }
+        }
+
+        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
+                if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))
+                        goto err;
 
         /* compute I mod q */
         if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
@@ -915,7 +897,6 @@ err:
 
 static int RSA_eay_init(RSA *rsa)
         {
-        FIPS_selftest_check();
         rsa->flags|=RSA_FLAG_CACHE_PUBLIC|RSA_FLAG_CACHE_PRIVATE;
         return(1);
         }