diff options
| author | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2013-11-22 14:33:23 +0100 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2013-11-27 11:41:44 +0100 |
| commit | e63f26e13cafef026d349841c4f17d02bb497414 (patch) | |
| tree | 3bdf6c7df2034971ac9576002346fa3a8ac1bf51 /lib/crypto-api.c | |
| parent | 56d4c98724a73ccbf53ee8699a89f078b4465e98 (diff) | |
| download | gnutls-e63f26e13cafef026d349841c4f17d02bb497414.tar.gz | |
Better handling of FIPS140-2 initialization
Diffstat (limited to 'lib/crypto-api.c')
| -rw-r--r-- | lib/crypto-api.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/lib/crypto-api.c b/lib/crypto-api.c index 0f421fae22..b2d11a414f 100644 --- a/lib/crypto-api.c +++ b/lib/crypto-api.c @@ -317,8 +317,11 @@ gnutls_hmac_init(gnutls_hmac_hd_t * dig, { #ifdef ENABLE_FIPS140 /* MD5 is only allowed internally for TLS */ - if (algorithm == GNUTLS_MAC_MD5) - return gnutls_assert_val(GNUTLS_E_UNWANTED_ALGORITHM); + if (_gnutls_get_fips_state() != FIPS_STATE_SELFTEST && + _gnutls_get_fips_state() != FIPS_STATE_ZOMBIE) { + if (algorithm == GNUTLS_MAC_MD5) + return gnutls_assert_val(GNUTLS_E_UNWANTED_ALGORITHM); + } #endif *dig = gnutls_malloc(sizeof(mac_hd_st)); |