Respect no-asm with fips option and disable FIPS DES assembler in

shared context [because it's not PIC].

diff --git a/Configure b/Configure
index a1bf5c9db50a04dfba1d16b1947ed67ef8f319d7..a7fdc3dfdacd7aa27d522753365ab13458e14d8e 100755 (executable)
--- a/Configure
+++ b/Configure
@@ -1161,14 +1161,21 @@ if ($ranlib eq "")
 
 $bn_obj = $bn_asm unless $bn_obj ne "";
 
-my $fips_des_obj='asm/fips-dx86-elf.o' if ($des_obj =~ /\-elf\.o$/);
-my $fips_sha1_obj='asm/sx86-elf.o'     if ($sha1_obj =~ /\-elf\.o$/);
+my $fips_des_obj;
+my $fips_sha1_obj;
 if ($fips)
        {
+       if ($des_obj =~ /\-elf\.o$/ && $no_shared) # FIPS DES module is not PIC
+               {
+               $fips_des_obj='asm/fips-dx86-elf.o';
+               $openssl_other_defines.="#define OPENSSL_FIPS_DES_ASM\n";
+               }
+       else {  $fips_des_obj=$fips_des_enc;  }
+       $fips_sha1_obj='asm/sx86-elf.o' if ($sha1_obj =~ /\-elf\.o$/);
        $des_obj=$sha1_obj="";
        $openssl_other_defines.="#define OPENSSL_FIPS\n";
        }
-$des_obj=$des_enc      unless (!$fips && $des_obj =~ /\.o$/);
+$des_obj=$des_enc      unless ($des_obj =~ /\.o$/);
 $bf_obj=$bf_enc                unless ($bf_obj =~ /\.o$/);
 $cast_obj=$cast_enc    unless ($cast_obj =~ /\.o$/);
 $rc4_obj=$rc4_enc      unless ($rc4_obj =~ /\.o$/);

diff --git a/crypto/des/des_enc.c b/crypto/des/des_enc.c
index 2bf840274097d6b785a530dfd76e300fb2d517c2..72be2d98d7476fc502c10f5566a83771b2e1a103 100644 (file)
--- a/crypto/des/des_enc.c
+++ b/crypto/des/des_enc.c
@@ -293,7 +293,7 @@ void DES_decrypt3(DES_LONG *data, DES_key_schedule *ks1,
 
 #ifndef DES_DEFAULT_OPTIONS
 
-#if !defined(OPENSSL_FIPS)
+#if !defined(OPENSSL_FIPS_DES_ASM)
 
 #undef CBC_ENC_C__DONT_UPDATE_IV
 #include "ncbc_enc.c" /* DES_ncbc_encrypt */
@@ -410,6 +410,6 @@ void DES_ede3_cbc_encrypt(const unsigned char *input, unsigned char *output,
        tin[0]=tin[1]=0;
        }
 
-#endif /* !defined(OPENSSL_FIPS) */
+#endif /* !defined(OPENSSL_FIPS_DES_ASM) */
 
 #endif /* DES_DEFAULT_OPTIONS */