Redirect DSA operations to FIPS module in FIPS mode.

[oweals/openssl.git] / crypto / dsa / dsa_sign.c

diff --git a/crypto/dsa/dsa_sign.c b/crypto/dsa/dsa_sign.c
index 17555e589275eabbabab7c604d507f608b8b6d7f..c3cc3642cea83199249a1253624dd6b2a9343938 100644 (file)
--- a/crypto/dsa/dsa_sign.c
+++ b/crypto/dsa/dsa_sign.c
@@ -61,30 +61,54 @@
 #include "cryptlib.h"
 #include <openssl/dsa.h>
 #include <openssl/rand.h>
+#include <openssl/bn.h>
 
 DSA_SIG * DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
        {
+#ifdef OPENSSL_FIPS
+       if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
+                       && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
+               {
+               DSAerr(DSA_F_DSA_DO_SIGN, DSA_R_NON_FIPS_DSA_METHOD);
+               return NULL;
+               }
+#endif
        return dsa->meth->dsa_do_sign(dgst, dlen, dsa);
        }
 
-int DSA_sign(int type, const unsigned char *dgst, int dlen, unsigned char *sig,
-            unsigned int *siglen, DSA *dsa)
+int DSA_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
        {
-       DSA_SIG *s;
-       RAND_seed(dgst, dlen);
-       s=DSA_do_sign(dgst,dlen,dsa);
-       if (s == NULL)
+#ifdef OPENSSL_FIPS
+       if (FIPS_mode() && !(dsa->meth->flags & DSA_FLAG_FIPS_METHOD)
+                       && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW))
                {
-               *siglen=0;
-               return(0);
+               DSAerr(DSA_F_DSA_SIGN_SETUP, DSA_R_NON_FIPS_DSA_METHOD);
+               return 0;
                }
-       *siglen=i2d_DSA_SIG(s,&sig);
-       DSA_SIG_free(s);
-       return(1);
+#endif
+       return dsa->meth->dsa_sign_setup(dsa, ctx_in, kinvp, rp);
        }
 
-int DSA_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
+DSA_SIG *DSA_SIG_new(void)
        {
-       return dsa->meth->dsa_sign_setup(dsa, ctx_in, kinvp, rp);
+       DSA_SIG *sig;
+       sig = OPENSSL_malloc(sizeof(DSA_SIG));
+       if (!sig)
+               return NULL;
+       sig->r = NULL;
+       sig->s = NULL;
+       return sig;
+       }
+
+void DSA_SIG_free(DSA_SIG *sig)
+       {
+       if (sig)
+               {
+               if (sig->r)
+                       BN_free(sig->r);
+               if (sig->s)
+                       BN_free(sig->s);
+               OPENSSL_free(sig);
+               }
        }