File openssl-1.0.1h-fips-engine.patch of Package openssl
Index: openssl-1.0.1h/crypto/evp/digest.c
===================================================================
--- openssl-1.0.1h.orig/crypto/evp/digest.c
+++ openssl-1.0.1h/crypto/evp/digest.c
@@ -223,6 +223,22 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, c
ENGINE_finish(impl);
return 0;
}
+#ifdef OPENSSL_FIPS
+ /* If we have an engine, only use it if its FIPS certified, or
+ * non-FIPS stuff is allowed. */
+ if (FIPS_mode()) {
+ if ((d->flags & EVP_MD_FLAG_FIPS)
+ || (ctx->flags & EVP_MD_CTX_FLAG_NON_FIPS_ALLOW))
+ {
+ type = d;
+ }
+ else
+ {
+ ENGINE_finish(impl);
+ }
+ } else
+#endif
+ {
/* We'll use the ENGINE's private digest definition */
type = d;
/* Store the ENGINE functional reference so we know
@@ -230,6 +246,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, c
* it when done. */
ctx->engine = impl;
}
+ }
else
ctx->engine = NULL;
}
Index: openssl-1.0.1h/crypto/rsa/rsa_lib.c
===================================================================
--- openssl-1.0.1h.orig/crypto/rsa/rsa_lib.c
+++ openssl-1.0.1h/crypto/rsa/rsa_lib.c
@@ -142,6 +142,7 @@ int RSA_set_method(RSA *rsa, const RSA_M
RSA *RSA_new_method(ENGINE *engine)
{
RSA *ret;
+ RSA_METHOD *meth;
ret=(RSA *)OPENSSL_malloc(sizeof(RSA));
if (ret == NULL)
@@ -166,8 +167,8 @@ RSA *RSA_new_method(ENGINE *engine)
ret->engine = ENGINE_get_default_RSA();
if(ret->engine)
{
- ret->meth = ENGINE_get_RSA(ret->engine);
- if(!ret->meth)
+ meth = ENGINE_get_RSA(ret->engine);
+ if(!meth)
{
RSAerr(RSA_F_RSA_NEW_METHOD,
ERR_R_ENGINE_LIB);
@@ -175,6 +176,17 @@ RSA *RSA_new_method(ENGINE *engine)
OPENSSL_free(ret);
return NULL;
}
+#ifdef OPENSSL_FIPS
+ if (!FIPS_mode() || (meth->flags & RSA_FLAG_FIPS_METHOD))
+ {
+ ret->meth = meth;
+ }
+ else
+ {
+ ENGINE_finish(ret->engine);
+ ret->engine = NULL;
+ }
+#endif
}
#endif
#ifdef OPENSSL_FIPS