OpenSSL 3.0 hangs at exit with FIPS provider

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

OpenSSL 3.0 hangs at exit with FIPS provider

Thomas Dwyer III
Platform: Linux x86_64

I understand this is still alpha but how complete is the FIPS provider right now? I'm following the documentation at https://wiki.openssl.org/index.php/OpenSSL_3.0 but I'm having a problem where my application hangs during exit() when I use the "fips" provider. I reduced my code down to this minimal snippet that reproduces the problem:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <openssl/evp.h>
#include <openssl/crypto.h>
#include <openssl/err.h>
#include <openssl/provider.h>

int
main(int argc, char **argv)
{
        OSSL_PROVIDER *pvdr = NULL;
        EVP_MD_CTX *ctx;
        const EVP_MD *md;
        char *alg = "sha1";
        int rc = 0;

        pvdr = OSSL_PROVIDER_load(NULL, "fips");
        if (pvdr == NULL) {
                fprintf(stderr, "Error loading FIPS provider\n");
                exit(1);
        }

        md = EVP_get_digestbyname(alg);
        if (!digest) {
                fprintf(stderr, "unknown digest '%s'\n", alg);
                exit(1);
        }

        ctx = EVP_MD_CTX_create();

        if (EVP_DigestInit_ex(ctx, md, NULL) != 1) {
                long err = ERR_get_error();
                char *msg = ERR_error_string(err, NULL);
                fprintf(stderr, "EVP_DigestInit_ex() failed: %s\n", msg);
                exit(1);
        }

        EVP_MD_CTX_destroy(ctx);

        rc = OSSL_PROVIDER_unload(pvdr);
        if (rc != 1) {
                fprintf(stderr, "Error unloading FIPS provider\n");
                exit(1);
        }

        printf("finished!\n");
        exit(0);
}

When I run this it prints "finished!" and then hangs in some kind of spin loop consuming 100% CPU. Skipping the call to EVP_DigestInit_ex() allows it to exit successfully, as does inserting a call to OPENSSL_init_crypto() at the very top with the OPENSSL_INIT_NO_ATEXIT flag. Passing "default" instead of "fips" to OSSL_PROVIDER_load() also seems to work fine. What am I missing?

Also, per section 7.8 of the wiki referenced above, I'm unable to confirm that the digest algorithm I want to use is being provided by the FIPS module. EVP_MD_provider(md) returns NULL even though the actual digest is computed correctly.


Thanks,
Tom.III


Reply | Threaded
Open this post in threaded view
|

Re: OpenSSL 3.0 hangs at exit with FIPS provider

Matt Caswell-2


On 15/07/2020 18:20, Thomas Dwyer III wrote:
> Platform: Linux x86_64
>
> I understand this is still alpha but how complete is the FIPS provider
> right now?

Fairly complete.

Please could you raise this as a github issue so that it can be properly
investigated and tracked?

> When I run this it prints "finished!" and then hangs in some kind of
> spin loop consuming 100% CPU. Skipping the call to EVP_DigestInit_ex()
> allows it to exit successfully, as does inserting a call to
> OPENSSL_init_crypto() at the very top with the OPENSSL_INIT_NO_ATEXIT
> flag. Passing "default" instead of "fips" to OSSL_PROVIDER_load() also
> seems to work fine. What am I missing?
>
> Also, per section 7.8 of the wiki referenced above, I'm unable to
> confirm that the digest algorithm I want to use is being provided by the
> FIPS module. EVP_MD_provider(md) returns NULL even though the actual
> digest is computed correctly.

You need to explicitly fetch your md using EVP_MD_fetch(). The md you
are using at the moment has no associated provider - one is implicitly
fetched and used during the EVP_DigestInit_ex() call - but that doesn't
affect the md object. By using "EVP_MD_fetch()" you can make the fetch
explicit and EVP_MD_provider() should return the expected results.

Matt


>
>
> Thanks,
> Tom.III
>
>