root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity

Add OSSL_SELF_TEST_TYPE_PCT_IMPORT transient error state 

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28376)
This commit is contained in:
Pauli 2025-08-29 12:41:22 +10:00 committed by Neil Horman
parent 9013cca925
commit 1dc1de7861
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/openssl/self_test.h
View File

@ -31,6 +31,7 @@ extern "C" {
# define OSSL_SELF_TEST_TYPE_CRNG "Continuous_RNG_Test" # define OSSL_SELF_TEST_TYPE_CRNG "Continuous_RNG_Test"
# define OSSL_SELF_TEST_TYPE_PCT "Conditional_PCT" # define OSSL_SELF_TEST_TYPE_PCT "Conditional_PCT"
# define OSSL_SELF_TEST_TYPE_PCT_KAT "Conditional_KAT" # define OSSL_SELF_TEST_TYPE_PCT_KAT "Conditional_KAT"
# define OSSL_SELF_TEST_TYPE_PCT_IMPORT "Import_PCT"
# define OSSL_SELF_TEST_TYPE_KAT_INTEGRITY "KAT_Integrity" # define OSSL_SELF_TEST_TYPE_KAT_INTEGRITY "KAT_Integrity"
# define OSSL_SELF_TEST_TYPE_KAT_CIPHER "KAT_Cipher" # define OSSL_SELF_TEST_TYPE_KAT_CIPHER "KAT_Cipher"
# define OSSL_SELF_TEST_TYPE_KAT_ASYM_CIPHER "KAT_AsymmetricCipher" # define OSSL_SELF_TEST_TYPE_KAT_ASYM_CIPHER "KAT_AsymmetricCipher"

13
providers/fips/self_test.c
View File

@ -426,9 +426,18 @@ void SELF_TEST_disable_conditional_error_state(void)
void ossl_set_error_state(const char *type) void ossl_set_error_state(const char *type)
{ {
int cond_test = (type != NULL && strcmp(type, OSSL_SELF_TEST_TYPE_PCT) == 0); int cond_test = 0;
int import_pct = 0;
if (!cond_test || (FIPS_conditional_error_check == 1)) { if (type != NULL) {
cond_test = strcmp(type, OSSL_SELF_TEST_TYPE_PCT) == 0;
import_pct = strcmp(type, OSSL_SELF_TEST_TYPE_PCT_IMPORT) == 0;
}
if (import_pct) {
/* Failure to import is transient to avoid a DoS attack */
ERR_raise(ERR_LIB_PROV, PROV_R_FIPS_MODULE_IMPORT_PCT_ERROR);
} else if (!cond_test || (FIPS_conditional_error_check == 1)) {
set_fips_state(FIPS_STATE_ERROR); set_fips_state(FIPS_STATE_ERROR);
ERR_raise(ERR_LIB_PROV, PROV_R_FIPS_MODULE_ENTERING_ERROR_STATE); ERR_raise(ERR_LIB_PROV, PROV_R_FIPS_MODULE_ENTERING_ERROR_STATE);
} else { } else {