New ctrl to set current certificate.

[oweals/openssl.git] / crypto / evp / evp_enc.c

diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c
index a816eb76b1808edea94a16a8e1504c35d4d08ff7..177fe43ac6da6b3dc164fd892f2b6b7489f4ea00 100644 (file)
--- a/crypto/evp/evp_enc.c
+++ b/crypto/evp/evp_enc.c
@@ -125,10 +125,14 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
                /* Ensure a context left lying around from last time is cleared
                 * (the previous check attempted to avoid this if the same
                 * ENGINE and EVP_CIPHER could be used). */
-               EVP_CIPHER_CTX_cleanup(ctx);
-
-               /* Restore encrypt field: it is zeroed by cleanup */
-               ctx->encrypt = enc;
+               if (ctx->cipher)
+                       {
+                       unsigned long flags = ctx->flags;
+                       EVP_CIPHER_CTX_cleanup(ctx);
+                       /* Restore encrypt and flags */
+                       ctx->encrypt = enc;
+                       ctx->flags = flags;
+                       }
 #ifndef OPENSSL_NO_ENGINE
                if(impl)
                        {
@@ -166,8 +170,16 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
 #endif
 
 #ifdef OPENSSL_FIPS
-               return FIPS_cipherinit(ctx, cipher, key, iv, enc);
-#else
+               if (FIPS_mode())
+                       {
+                       const EVP_CIPHER *fcipher;
+                       if (cipher)
+                               fcipher = FIPS_get_cipherbynid(EVP_CIPHER_type(cipher));
+                       if (fcipher)
+                               cipher = fcipher;
+                       return FIPS_cipherinit(ctx, cipher, key, iv, enc);
+                       }
+#endif
                ctx->cipher=cipher;
                if (ctx->cipher->ctx_size)
                        {
@@ -183,7 +195,8 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
                        ctx->cipher_data = NULL;
                        }
                ctx->key_len = cipher->key_len;
-               ctx->flags = 0;
+               /* Preserve wrap enable flag, zero everything else */
+               ctx->flags &= EVP_CIPHER_CTX_FLAG_WRAP_ALLOW;
                if(ctx->cipher->flags & EVP_CIPH_CTRL_INIT)
                        {
                        if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, NULL))
@@ -192,7 +205,6 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
                                return 0;
                                }
                        }
-#endif
                }
        else if(!ctx->cipher)
                {
@@ -203,13 +215,21 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
 skip_to_init:
 #endif
 #ifdef OPENSSL_FIPS
-       return FIPS_cipherinit(ctx, cipher, key, iv, enc);
-#else
+       if (FIPS_mode())
+               return FIPS_cipherinit(ctx, cipher, key, iv, enc);
+#endif
        /* we assume block size is a power of 2 in *cryptUpdate */
        OPENSSL_assert(ctx->cipher->block_size == 1
            || ctx->cipher->block_size == 8
            || ctx->cipher->block_size == 16);
 
+       if(!(ctx->flags & EVP_CIPHER_CTX_FLAG_WRAP_ALLOW)
+               && EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_WRAP_MODE)
+               {
+               EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_WRAP_MODE_NOT_ALLOWED);
+               return 0;
+               }
+
        if(!(EVP_CIPHER_CTX_flags(ctx) & EVP_CIPH_CUSTOM_IV)) {
                switch(EVP_CIPHER_CTX_mode(ctx)) {
 
@@ -232,6 +252,7 @@ skip_to_init:
                        break;
 
                        case EVP_CIPH_CTR_MODE:
+                       ctx->num = 0;
                        /* Don't reuse IV for CTR mode */
                        if(iv)
                                memcpy(ctx->iv, iv, EVP_CIPHER_CTX_iv_length(ctx));
@@ -242,6 +263,7 @@ skip_to_init:
                        break;
                }
        }
+               
 
        if(key || (ctx->cipher->flags & EVP_CIPH_ALWAYS_CALL_INIT)) {
                if(!ctx->cipher->init(ctx,key,iv,enc)) return 0;
@@ -250,7 +272,6 @@ skip_to_init:
        ctx->final_used=0;
        ctx->block_mask=ctx->cipher->block_size-1;
        return 1;
-#endif
        }
 
 int EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,