Make sure overrides work for RSA/DSA.

diff --git a/apps/dsaparam.c b/apps/dsaparam.c
index fe72c1d3dfa8fb5205143f589168c6199987f2b4..deb4aa9444b29f23a424de12b4de31478a9fb6b8 100644 (file)
--- a/apps/dsaparam.c
+++ b/apps/dsaparam.c
@@ -118,6 +118,7 @@ int MAIN(int argc, char **argv)
        char *infile,*outfile,*prog,*inrand=NULL;
        int numbits= -1,num,genkey=0;
        int need_rand=0;
+       int non_fips_allow = 0;
 #ifndef OPENSSL_NO_ENGINE
        char *engine=NULL;
 #endif
@@ -195,6 +196,8 @@ int MAIN(int argc, char **argv)
                        }
                else if (strcmp(*argv,"-noout") == 0)
                        noout=1;
+               else if (strcmp(*argv,"-non-fips-allow") == 0)
+                       non_fips_allow = 1;
                else if (sscanf(*argv,"%d",&num) == 1)
                        {
                        /* generate a key */
@@ -297,6 +300,8 @@ bad:
                        BIO_printf(bio_err,"Error allocating DSA object\n");
                        goto end;
                        }
+               if (non_fips_allow)
+                       dsa->flags |= DSA_FLAG_NON_FIPS_ALLOW;
                BIO_printf(bio_err,"Generating DSA parameters, %d bit long prime\n",num);
                BIO_printf(bio_err,"This could take some time\n");
 #ifdef GENCB_TEST
@@ -326,6 +331,7 @@ bad:
                                goto end;
                                }
 #endif
+                       ERR_print_errors(bio_err);
                        BIO_printf(bio_err,"Error, DSA key generation failed\n");
                        goto end;
                        }

diff --git a/apps/genrsa.c b/apps/genrsa.c
index 37e9310910b2968c0b148531c371d5e06993b9e1..2331024248c43191dfefa51c1de096e89a1ab647 100644 (file)
--- a/apps/genrsa.c
+++ b/apps/genrsa.c
@@ -93,6 +93,7 @@ int MAIN(int argc, char **argv)
        ENGINE *e = NULL;
 #endif
        int ret=1;
+       int non_fips_allow = 0;
        int i,num=DEFBITS;
        long l;
        const EVP_CIPHER *enc=NULL;
@@ -185,6 +186,8 @@ int MAIN(int argc, char **argv)
                        if (--argc < 1) goto bad;
                        passargout= *(++argv);
                        }
+               else if (strcmp(*argv,"-non-fips-allow") == 0)
+                       non_fips_allow = 1;
                else
                        break;
                argv++;
@@ -273,6 +276,9 @@ bad:
        if (!rsa)
                goto err;
 
+       if (non_fips_allow)
+               rsa->flags |= RSA_FLAG_NON_FIPS_ALLOW;
+
        if(!BN_set_word(bn, f4) || !RSA_generate_key_ex(rsa, num, bn, &cb))
                goto err;
                

diff --git a/crypto/dsa/dsa_lib.c b/crypto/dsa/dsa_lib.c
index 12f83ed8482ec0f732d17c97f7f3a4ff3daa3769..c9b25a05612bd331d6296e19ddf9aeccac66684e 100644 (file)
--- a/crypto/dsa/dsa_lib.c
+++ b/crypto/dsa/dsa_lib.c
@@ -163,7 +163,7 @@ DSA *DSA_new_method(ENGINE *engine)
        ret->method_mont_p=NULL;
 
        ret->references=1;
-       ret->flags=ret->meth->flags;
+       ret->flags=ret->meth->flags & ~DSA_FLAG_NON_FIPS_ALLOW;
        CRYPTO_new_ex_data(CRYPTO_EX_INDEX_DSA, ret, &ret->ex_data);
        if ((ret->meth->init != NULL) && !ret->meth->init(ret))
                {

diff --git a/crypto/rsa/rsa.h b/crypto/rsa/rsa.h
index 7174f9cee8a040c3b4e25b1bd688a12e858fd752..136cffd93a08bf132adb041d0dd67d1cf3795578 100644 (file)
--- a/crypto/rsa/rsa.h
+++ b/crypto/rsa/rsa.h
@@ -458,7 +458,7 @@ RSA *RSAPrivateKey_dup(RSA *rsa);
 
 /* If this flag is set the RSA method is FIPS compliant and can be used
  * in FIPS mode. This is set in the validated module method. If an
- * application sets this flag in its own methods it is its reposibility
+ * application sets this flag in its own methods it is its responsibility
  * to ensure the result is compliant.
  */
 

diff --git a/crypto/rsa/rsa_eay.c b/crypto/rsa/rsa_eay.c
index d47f64e75d0f733116b6436f881e10ae22335134..bb434d7328199c9136ec9111972aebe837e562b8 100644 (file)
--- a/crypto/rsa/rsa_eay.c
+++ b/crypto/rsa/rsa_eay.c
@@ -170,7 +170,8 @@ static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
                goto err;
                }
 
-       if (FIPS_mode() && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
+       if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
+               && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
                {
                RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
                return -1;
@@ -381,7 +382,8 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                goto err;
                }
 
-       if (FIPS_mode() && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
+       if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
+               && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
                {
                RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
                return -1;
@@ -528,7 +530,8 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                goto err;
                }
 
-       if (FIPS_mode() && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
+       if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
+               && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
                {
                RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
                return -1;
@@ -671,7 +674,8 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
                goto err;
                }
 
-       if (FIPS_mode() && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
+       if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
+               && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
                {
                RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
                return -1;

diff --git a/crypto/rsa/rsa_lib.c b/crypto/rsa/rsa_lib.c
index 3225570671f339c4ddd3b50f494d0da39aadf6c2..6e4334231c6590ea68b00c8d20029aa4e923880d 100644 (file)
--- a/crypto/rsa/rsa_lib.c
+++ b/crypto/rsa/rsa_lib.c
@@ -181,7 +181,7 @@ RSA *RSA_new_method(ENGINE *engine)
        ret->blinding=NULL;
        ret->mt_blinding=NULL;
        ret->bignum_data=NULL;
-       ret->flags=ret->meth->flags;
+       ret->flags=ret->meth->flags & ~RSA_FLAG_NON_FIPS_ALLOW;
        if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_RSA, ret, &ret->ex_data))
                {
 #ifndef OPENSSL_NO_ENGINE