From: Dr. Stephen Henson <steve@openssl.org>
Date: Sat, 23 Apr 2011 21:59:12 +0000 (+0000)
Subject: More fixes for DSA FIPS overrides.
X-Git-Tag: OpenSSL-fips-2_0-rc1~506
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=69a80f7d5e1363276a9588546df28782a18a8c36;p=oweals%2Fopenssl.git

More fixes for DSA FIPS overrides.
---

diff --git a/apps/dsaparam.c b/apps/dsaparam.c
index deb4aa9444..03e33f9f7e 100644
--- a/apps/dsaparam.c
+++ b/apps/dsaparam.c
@@ -435,13 +435,21 @@ bad:
 
 		assert(need_rand);
 		if ((dsakey=DSAparams_dup(dsa)) == NULL) goto end;
-		if (!DSA_generate_key(dsakey)) goto end;
+		if (non_fips_allow)
+			dsakey->flags |= DSA_FLAG_NON_FIPS_ALLOW;
+		if (!DSA_generate_key(dsakey))
+			{
+			ERR_print_errors(bio_err);
+			DSA_free(dsakey);
+			goto end;
+			}
 		if 	(outformat == FORMAT_ASN1)
 			i=i2d_DSAPrivateKey_bio(out,dsakey);
 		else if (outformat == FORMAT_PEM)
 			i=PEM_write_bio_DSAPrivateKey(out,dsakey,NULL,NULL,0,NULL,NULL);
 		else	{
 			BIO_printf(bio_err,"bad output format specified for outfile\n");
+			DSA_free(dsakey);
 			goto end;
 			}
 		DSA_free(dsakey);
diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c
index acf7af95c4..38f667f4e7 100644
--- a/crypto/dsa/dsa_ossl.c
+++ b/crypto/dsa/dsa_ossl.c
@@ -353,7 +353,8 @@ static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
 	    return -1;
 	    }
 
-	if (FIPS_mode() && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS))
+	if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW) 
+		&& (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS))
 		{
 		DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_KEY_SIZE_TOO_SMALL);
 		return -1;