Commit 7951c269 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

add fips blocking overrides to command line utilities

parent 5997efca

apps/dgst.c

+10 −0
Original line number Original line Diff line number Diff line
@@ -128,6 +128,7 @@ int MAIN(int argc, char **argv) 
#endif

#endif

	char *hmac_key=NULL;

	char *hmac_key=NULL;

	char *mac_name=NULL;

	char *mac_name=NULL;

	int non_fips_allow = 0;

	STACK_OF(OPENSSL_STRING) *sigopts = NULL, *macopts = NULL;

	STACK_OF(OPENSSL_STRING) *sigopts = NULL, *macopts = NULL;





	apps_startup();

	apps_startup();
@@ -220,6 +221,8 @@ int MAIN(int argc, char **argv) 
			debug=1;

			debug=1;

		else if (!strcmp(*argv,"-fips-fingerprint"))

		else if (!strcmp(*argv,"-fips-fingerprint"))

			hmac_key = "etaonrishdlcupfm";

			hmac_key = "etaonrishdlcupfm";

		else if (strcmp(*argv,"-non-fips-allow") == 0)

			non_fips_allow=1;

		else if (!strcmp(*argv,"-hmac"))

		else if (!strcmp(*argv,"-hmac"))

			{

			{

			if (--argc < 1)

			if (--argc < 1)
@@ -405,6 +408,13 @@ int MAIN(int argc, char **argv) 
			goto end;

			goto end;

		}

		}





	if (non_fips_allow)

		{

		EVP_MD_CTX *md_ctx;

		BIO_get_md_ctx(bmd,&md_ctx);

		EVP_MD_CTX_set_flags(md_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);

		}



	if (hmac_key)

	if (hmac_key)

		{

		{

		sigkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, impl,

		sigkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, impl,

apps/enc.c

+8 −0
Original line number Original line Diff line number Diff line
@@ -129,6 +129,7 @@ int MAIN(int argc, char **argv) 
	char *engine = NULL;

	char *engine = NULL;

#endif

#endif

	const EVP_MD *dgst=NULL;

	const EVP_MD *dgst=NULL;

	int non_fips_allow = 0;





	apps_startup();

	apps_startup();
@@ -281,6 +282,8 @@ int MAIN(int argc, char **argv) 
			if (--argc < 1) goto bad;

			if (--argc < 1) goto bad;

			md= *(++argv);

			md= *(++argv);

			}

			}

		else if (strcmp(*argv,"-non-fips-allow") == 0)

			non_fips_allow = 1;

		else if	((argv[0][0] == '-') &&

		else if	((argv[0][0] == '-') &&

			((c=EVP_get_cipherbyname(&(argv[0][1]))) != NULL))

			((c=EVP_get_cipherbyname(&(argv[0][1]))) != NULL))

			{

			{
@@ -593,6 +596,11 @@ bad: 
		 */

		 */





		BIO_get_cipher_ctx(benc, &ctx);

		BIO_get_cipher_ctx(benc, &ctx);



		if (non_fips_allow)

			EVP_CIPHER_CTX_set_flags(ctx,

				EVP_CIPH_FLAG_NON_FIPS_ALLOW);



		if (!EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, enc))

		if (!EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, enc))

			{

			{

			BIO_printf(bio_err, "Error setting cipher %s\n",

			BIO_printf(bio_err, "Error setting cipher %s\n",