e_os.h: refine inline override logic (to address warnings in debug build).

[openssl.git] / crypto / dh / dh_gen.c

diff --git a/crypto/dh/dh_gen.c b/crypto/dh/dh_gen.c
index a929a0f0648000ab0e80d7ad444b9842ce113260..23d6ead3ca81467e2431e3e313125d4592fd8c43 100644 (file)
--- a/crypto/dh/dh_gen.c
+++ b/crypto/dh/dh_gen.c
@@ -61,11 +61,26 @@
  *  - Geoff
  */
 
+#define OPENSSL_FIPSAPI
+
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/bn.h>
 #include <openssl/dh.h>
 
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
+
+static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb);
+
+int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *cb)
+       {
+       if(ret->meth->generate_params)
+               return ret->meth->generate_params(ret, prime_len, generator, cb);
+       return dh_builtin_genparams(ret, prime_len, generator, cb);
+       }
+
 /* We generate DH parameters as follows
  * find a prime q which is prime_len/2 bits long.
  * p=(2*q)+1 or (p-1)/2 = q
@@ -91,12 +106,26 @@
  * It's just as OK (and in some sense better) to use a generator of the
  * order-q subgroup.
  */
-int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *cb)
+static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb)
        {
        BIGNUM *t1,*t2;
        int g,ok= -1;
        BN_CTX *ctx=NULL;
 
+#ifdef OPENSSL_FIPS
+       if(FIPS_selftest_failed())
+               {
+               FIPSerr(FIPS_F_DH_BUILTIN_GENPARAMS,FIPS_R_FIPS_SELFTEST_FAILED);
+               return 0;
+               }
+
+       if (FIPS_module_mode() && (prime_len < OPENSSL_DH_FIPS_MIN_MODULUS_BITS))
+               {
+               DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_KEY_SIZE_TOO_SMALL);
+               goto err;
+               }
+#endif
+
        ctx=BN_CTX_new();
        if (ctx == NULL) goto err;
        BN_CTX_start(ctx);
@@ -110,7 +139,7 @@ int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *c
        
        if (generator <= 1)
                {
-               DHerr(DH_F_DH_GENERATE_PARAMETERS, DH_R_BAD_GENERATOR);
+               DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_BAD_GENERATOR);
                goto err;
                }
        if (generator == DH_GENERATOR_2)
@@ -153,7 +182,7 @@ int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *c
 err:
        if (ok == -1)
                {
-               DHerr(DH_F_DH_GENERATE_PARAMETERS,ERR_R_BN_LIB);
+               DHerr(DH_F_DH_BUILTIN_GENPARAMS,ERR_R_BN_LIB);
                ok=0;
                }