Commit ba27e72
crypto: fix Argon2 bypassing FIPS mode
The private OSSL_LIB_CTX used for OSSL_set_max_threads() inherits no
configuration, so Argon2 escaped FIPS mode and --openssl-config.
Check availability against the default context, and create the private
one only when lanes > 1.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #64776
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>1 parent 5460c46 commit ba27e72
1 file changed
Lines changed: 17 additions & 8 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1996,15 +1996,24 @@ DataPointer argon2(const Buffer<const char>& pass, | |||
| 1996 | 1996 | return {}; | |
| 1997 | 1997 | } | |
| 1998 | 1998 | ||
| 1999 | - // creates a new library context to avoid locking when running concurrently | ||
| 2000 | - auto ctx = DeleteFnPtr<OSSL_LIB_CTX, OSSL_LIB_CTX_free>{OSSL_LIB_CTX_new()}; | ||
| 2001 | - if (!ctx) { | ||
| 2002 | - return {}; | ||
| 2003 | - } | ||
| 1999 | + // A new library context is only needed for OSSL_set_max_threads(), which is | ||
| 2000 | + // per-context. It inherits no configuration, so availability is checked | ||
| 2001 | + // against the default context, otherwise Argon2 works in FIPS mode. | ||
| 2002 | + DeleteFnPtr<OSSL_LIB_CTX, OSSL_LIB_CTX_free> ctx; | ||
| 2003 | + if (lanes > 1) { | ||
| 2004 | + if (!DeleteFnPtr<EVP_KDF, EVP_KDF_free>{ | ||
| 2005 | + EVP_KDF_fetch(nullptr, algorithm.data(), nullptr)}) { | ||
| 2006 | + return {}; | ||
| 2007 | + } | ||
| 2004 | 2008 | ||
| 2005 | - // required if threads > 1 | ||
| 2006 | - if (lanes > 1 && OSSL_set_max_threads(ctx.get(), lanes) != 1) { | ||
| 2007 | - return {}; | ||
| 2009 | + ctx.reset(OSSL_LIB_CTX_new()); | ||
| 2010 | + if (!ctx) { | ||
| 2011 | + return {}; | ||
| 2012 | + } | ||
| 2013 | + | ||
| 2014 | + if (OSSL_set_max_threads(ctx.get(), lanes) != 1) { | ||
| 2015 | + return {}; | ||
| 2016 | + } | ||
| 2008 | 2017 | } | |
| 2009 | 2018 | ||
| 2010 | 2019 | auto kdf = DeleteFnPtr<EVP_KDF, EVP_KDF_free>{ | |
0 commit comments