Add support to define a callback for FIPS test failures before aborting the process #2162
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2162 +/- ##
=======================================
Coverage 79.04% 79.04%
=======================================
Files 612 612
Lines 106065 106071 +6
Branches 14994 14995 +1
=======================================
+ Hits 83837 83842 +5
+ Misses 21576 21575 -1
- Partials 652 654 +2 ☔ View full report in Codecov by Sentry. |
| void BORINGSSL_FIPS_abort(void) { | ||
| WEAK_SYMBOL_FUNC(void, AWS_LC_fips_failure_callback, (const char* message)) | ||
| #include <unistd.h> | ||
| void AWS_LC_FIPS_failure(const char* message) { |
There was a problem hiding this comment.
Please correct me if I'm wrong, but this will break our next FIPS validation. If we allow someone outside the boundary to register a callback our lab will not be able to prove that we stop processing events when a PCT or self-tests fails. When we detect a failure we need to abort immediately as defined in ISO 19790 section 7.3.3, b), 7.3.3 c), and 7.5. This needs to be wrapped in a #ifdef so we don't expose it when we are building as a 140-3 level 1 module.
There was a problem hiding this comment.
This is no different than the current behavior: an application using AWS-LC can install a custom signal handler to perform any logging/cleanup before the abort terminates the process. However, with this callback the application gets a clearer signal if the abort is a FIPS anomaly or a different SIGABRT.
…age (#2182) ### Description of changes: In preparation for the callback change in #2162 this change updates all the places that could abort to pass a message to a new abort function that explains why it's about to abort. ### Testing: The existing test-break-kat.go will ensure all the KATs still fail as expected and the messages they print match. By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.
andrewhop
force-pushed
the
fips_callback
branch
2 times, most recently
from
62d5a7b to
035dd7d
Compare
andrewhop
force-pushed
the
fips_callback
branch
from
035dd7d to
0f09484
Compare
Description of changes:
This change adds an optional callback that applications linking with AWS-LC can define to get alerted to FIPS failures during their use of AWS-LC. This does not change how AWS-LC shuts down in the event of a CAST/PCT failure. This callback only provides access to a better log message. Previously applications using AWS-LC could register a signal handler using sigaction, but there was no way to distinguish between a FIPS specific abort and a general error. The same is true for atexit hooks.
This PR also undoes the optional change in 5553a20 and instead defines a new AWS_LC_FIPS_Failure in non-FIPS builds which just logs the error to
stderr.Testing
This change adds a new gtest application that checks the callback function is called with the expected message and is used with break-kat.go and the runtime PCT environment variables to ensure the callback is passed the expected message.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.