New ctrl to set current certificate.

[oweals/openssl.git] / crypto / dh / dh_gen.c

diff --git a/crypto/dh/dh_gen.c b/crypto/dh/dh_gen.c
index 1f805073cf301a6d86c815452944d1b3695d3bb9..7b1fe9c9cbbaf9eebf74b7785569e0bf41f4e599 100644 (file)
--- a/crypto/dh/dh_gen.c
+++ b/crypto/dh/dh_gen.c
@@ -66,12 +66,29 @@
 #include <openssl/bn.h>
 #include <openssl/dh.h>
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
 static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb);
 
 int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *cb)
        {
+#ifdef OPENSSL_FIPS
+       if (FIPS_mode() && !(ret->meth->flags & DH_FLAG_FIPS_METHOD)
+                       && !(ret->flags & DH_FLAG_NON_FIPS_ALLOW))
+               {
+               DHerr(DH_F_DH_GENERATE_PARAMETERS_EX, DH_R_NON_FIPS_METHOD);
+               return 0;
+               }
+#endif
        if(ret->meth->generate_params)
                return ret->meth->generate_params(ret, prime_len, generator, cb);
+#ifdef OPENSSL_FIPS
+       if (FIPS_mode())
+               return FIPS_dh_generate_parameters_ex(ret, prime_len,
+                                                       generator, cb);
+#endif
        return dh_builtin_genparams(ret, prime_len, generator, cb);
        }
 
@@ -119,7 +136,7 @@ static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB
        
        if (generator <= 1)
                {
-               DHerr(DH_F_DH_GENERATE_PARAMETERS, DH_R_BAD_GENERATOR);
+               DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_BAD_GENERATOR);
                goto err;
                }
        if (generator == DH_GENERATOR_2)
@@ -162,7 +179,7 @@ static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB
 err:
        if (ok == -1)
                {
-               DHerr(DH_F_DH_GENERATE_PARAMETERS,ERR_R_BN_LIB);
+               DHerr(DH_F_DH_BUILTIN_GENPARAMS,ERR_R_BN_LIB);
                ok=0;
                }