import of openssl-0.9.7g; tested on platforms from alpha to zaurus, ok deraadt@

1 files changed, 16 insertions, 0 deletions

diff --git a/src/lib/libcrypto/hmac/hmac.c b/src/lib/libcrypto/hmac/hmac.c
index 4c91f919d5..06ee80761f 100644
--- a/src/lib/libcrypto/hmac/hmac.c
+++ b/src/lib/libcrypto/hmac/hmac.c
@@ -77,6 +77,15 @@ void HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
 
         if (key != NULL)
                 {
+#ifdef OPENSSL_FIPS
+                if (FIPS_mode() && !(md->flags & EVP_MD_FLAG_FIPS)
+                && (!(ctx->md_ctx.flags & EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)
+                 || !(ctx->i_ctx.flags & EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)
+                 || !(ctx->o_ctx.flags & EVP_MD_CTX_FLAG_NON_FIPS_ALLOW)))
+                OpenSSLDie(__FILE__,__LINE__,
+                        "HMAC: digest not allowed in FIPS mode");
+#endif
+                
                 reset=1;
                 j=EVP_MD_block_size(md);
                 OPENSSL_assert(j <= sizeof ctx->key);
@@ -171,3 +180,10 @@ unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
         return(md);
         }
 
+void HMAC_CTX_set_flags(HMAC_CTX *ctx, unsigned long flags)
+        {
+        EVP_MD_CTX_set_flags(&ctx->i_ctx, flags);
+        EVP_MD_CTX_set_flags(&ctx->o_ctx, flags);
+        EVP_MD_CTX_set_flags(&ctx->md_ctx, flags);
+        }
+