wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Don't advertise or use MD5 for TLS v1.2 in FIPS mode

Browse source
This commit is contained in:
Dr. Stephen Henson 2011-05-25 15:31:32 +00:00
parent 3d52f1d52b
commit ebc5e72fe5
1 changed files with 12 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
ssl/t1_lib.c
View file

@ -317,9 +317,15 @@ static unsigned char tls12_sigalgs[] = {
int tls12_get_req_sig_algs(SSL *s, unsigned char *p) int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
{ {
size_t slen = sizeof(tls12_sigalgs);
#ifdef OPENSSL_FIPS
/* If FIPS mode don't include MD5 which is last */
if (FIPS_mode())
slen -= 2;
#endif
if (p) if (p)
memcpy(p, tls12_sigalgs, sizeof(tls12_sigalgs)); memcpy(p, tls12_sigalgs, slen);
return (int)sizeof(tls12_sigalgs); return (int)slen;
} }
unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit) unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
@ -2066,6 +2072,10 @@ const EVP_MD *tls12_get_hash(unsigned char hash_alg)
{ {
#ifndef OPENSSL_NO_MD5 #ifndef OPENSSL_NO_MD5
case TLSEXT_hash_md5: case TLSEXT_hash_md5:
#ifdef OPENSSL_FIPS
if (FIPS_mode())
return NULL;
#endif
return EVP_md5(); return EVP_md5();
#endif #endif
#ifndef OPENSSL_NO_SHA #ifndef OPENSSL_NO_SHA