Rename FIPS_mode_set and FIPS_mode. Theses symbols will be defined in

the FIPS capable OpenSSL.

diff --git a/CHANGES b/CHANGES
index 1ee3a478d3effda5bc67eefc006da305aef23624..872ab107f7cf1e31d621a124bad1facdf0558021 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,11 @@
 
  Changes between 1.0.1 and 1.1.0  [xx XXX xxxx]
 
 
  Changes between 1.0.1 and 1.1.0  [xx XXX xxxx]
 

+  *) Rename FIPS_mode_set and FIPS_mode to FIPS_module_mode_set and
+     FIPS_module_mode. FIPS_mode and FIPS_mode_set will be implmeneted
+     outside the validated module in the FIPS capable OpenSSL.
+     [Steve Henson]
+

   *) Initial TLS v1.2 client support. Add a default signature algorithms
      extension including all the algorithms we support. Parse new signature
      format in client key exchange. Relax some ECC signing restrictions for
   *) Initial TLS v1.2 client support. Add a default signature algorithms
      extension including all the algorithms we support. Parse new signature
      format in client key exchange. Relax some ECC signing restrictions for

diff --git a/crypto/bn/bn_rand.c b/crypto/bn/bn_rand.c
index 30cc929ff6978135fa60d627a013820eccef8fad..8d74895dedde6eebda62be5d9abb1164019e6409 100644 (file)
--- a/crypto/bn/bn_rand.c
+++ b/crypto/bn/bn_rand.c
@@ -252,7 +252,7 @@ static int bn_rand_range(int pseudo, BIGNUM *r, const BIGNUM *range)
         * generated. So we just use the second case which is equivalent to
         * "Generation by Testing Candidates" mentioned in B.1.2 et al.
         */
         * generated. So we just use the second case which is equivalent to
         * "Generation by Testing Candidates" mentioned in B.1.2 et al.
         */

-       else if (!FIPS_mode() && !BN_is_bit_set(range, n - 2) && !BN_is_bit_set(range, n - 3))
+       else if (!FIPS_module_mode() && !BN_is_bit_set(range, n - 2) && !BN_is_bit_set(range, n - 3))

 #else
        else if (!BN_is_bit_set(range, n - 2) && !BN_is_bit_set(range, n - 3))
 #endif
 #else
        else if (!BN_is_bit_set(range, n - 2) && !BN_is_bit_set(range, n - 3))
 #endif

diff --git a/crypto/dh/dh_gen.c b/crypto/dh/dh_gen.c
index 9749b7215715f502d73339fa9697c3817c35aead..d0cecda8d7aa53d3a3045321c8f7bd8b6a38231e 100644 (file)
--- a/crypto/dh/dh_gen.c
+++ b/crypto/dh/dh_gen.c
@@ -118,7 +118,7 @@ static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB
                return 0;
                }
 
                return 0;
                }
 

-       if (FIPS_mode() && (prime_len < OPENSSL_DH_FIPS_MIN_MODULUS_BITS))
+       if (FIPS_module_mode() && (prime_len < OPENSSL_DH_FIPS_MIN_MODULUS_BITS))

                {
                DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_KEY_SIZE_TOO_SMALL);
                goto err;
                {
                DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_KEY_SIZE_TOO_SMALL);
                goto err;

diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c
index 6c0c745c8d380eddefd499878c658d69adc64ee3..ca2435e75fea28d465827df38a061820c53914e0 100644 (file)
--- a/crypto/dh/dh_key.c
+++ b/crypto/dh/dh_key.c
@@ -128,7 +128,7 @@ static int generate_key(DH *dh)
        BIGNUM *pub_key=NULL,*priv_key=NULL;
 
 #ifdef OPENSSL_FIPS
        BIGNUM *pub_key=NULL,*priv_key=NULL;
 
 #ifdef OPENSSL_FIPS

-       if (FIPS_mode() && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS))
+       if (FIPS_module_mode() && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS))

                {
                DHerr(DH_F_GENERATE_KEY, DH_R_KEY_SIZE_TOO_SMALL);
                return 0;
                {
                DHerr(DH_F_GENERATE_KEY, DH_R_KEY_SIZE_TOO_SMALL);
                return 0;


@@ -227,7 +227,7 @@ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
                }
 
 #ifdef OPENSSL_FIPS
                }
 
 #ifdef OPENSSL_FIPS

-       if (FIPS_mode() && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS))
+       if (FIPS_module_mode() && (BN_num_bits(dh->p) < OPENSSL_DH_FIPS_MIN_MODULUS_BITS))

                {
                DHerr(DH_F_COMPUTE_KEY, DH_R_KEY_SIZE_TOO_SMALL);
                goto err;
                {
                DHerr(DH_F_COMPUTE_KEY, DH_R_KEY_SIZE_TOO_SMALL);
                goto err;

diff --git a/crypto/dsa/dsa_gen.c b/crypto/dsa/dsa_gen.c
index 4ff8a472cdc95f6a7a51462d9bb28004b6ea67b3..a4a0421beff4aba1175ff4d1ce31d7121c30d137 100644 (file)
--- a/crypto/dsa/dsa_gen.c
+++ b/crypto/dsa/dsa_gen.c
@@ -141,7 +141,7 @@ int dsa_builtin_paramgen(DSA *ret, size_t bits, size_t qbits,
            goto err;
            }
 
            goto err;
            }
 

-       if (FIPS_mode() && !(ret->flags & DSA_FLAG_NON_FIPS_ALLOW) 
+       if (FIPS_module_mode() && !(ret->flags & DSA_FLAG_NON_FIPS_ALLOW) 

                        && (bits < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS))
                {
                DSAerr(DSA_F_DSA_BUILTIN_PARAMGEN, DSA_R_KEY_SIZE_TOO_SMALL);
                        && (bits < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS))
                {
                DSAerr(DSA_F_DSA_BUILTIN_PARAMGEN, DSA_R_KEY_SIZE_TOO_SMALL);


@@ -412,7 +412,7 @@ static int dsa2_valid_parameters(size_t L, size_t N)
 int fips_check_dsa_prng(DSA *dsa, size_t L, size_t N)
        {
        int strength;
 int fips_check_dsa_prng(DSA *dsa, size_t L, size_t N)
        {
        int strength;

-       if (!FIPS_mode())
+       if (!FIPS_module_mode())

                return 1;
 
        if (dsa->flags & (DSA_FLAG_NON_FIPS_ALLOW|DSA_FLAG_FIPS_CHECKED))
                return 1;
 
        if (dsa->flags & (DSA_FLAG_NON_FIPS_ALLOW|DSA_FLAG_FIPS_CHECKED))

diff --git a/crypto/dsa/dsa_key.c b/crypto/dsa/dsa_key.c
index 3df9a6c6a99a608497e0b8d982efbd98121a6de1..0c47ac45b9db03692f9e80d2ac281667bc2ec04b 100644 (file)
--- a/crypto/dsa/dsa_key.c
+++ b/crypto/dsa/dsa_key.c
@@ -106,7 +106,7 @@ static int dsa_builtin_keygen(DSA *dsa)
        BIGNUM *pub_key=NULL,*priv_key=NULL;
 
 #ifdef OPENSSL_FIPS
        BIGNUM *pub_key=NULL,*priv_key=NULL;
 
 #ifdef OPENSSL_FIPS

-       if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)
+       if (FIPS_module_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)

                && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS))
                {
                DSAerr(DSA_F_DSA_BUILTIN_KEYGEN, DSA_R_KEY_SIZE_TOO_SMALL);
                && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS))
                {
                DSAerr(DSA_F_DSA_BUILTIN_KEYGEN, DSA_R_KEY_SIZE_TOO_SMALL);

diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c
index 38f667f4e7cc6a2d4c56358379d8c6e225923992..38b4f06012c8dacb91d72cc0ac6a43e539492e87 100644 (file)
--- a/crypto/dsa/dsa_ossl.c
+++ b/crypto/dsa/dsa_ossl.c
@@ -150,7 +150,7 @@ static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
            return NULL;
            }
 
            return NULL;
            }
 

-       if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW) 
+       if (FIPS_module_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW) 

                && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS))
                {
                DSAerr(DSA_F_DSA_DO_SIGN, DSA_R_KEY_SIZE_TOO_SMALL);
                && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS))
                {
                DSAerr(DSA_F_DSA_DO_SIGN, DSA_R_KEY_SIZE_TOO_SMALL);


@@ -353,7 +353,7 @@ static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
            return -1;
            }
 
            return -1;
            }
 

-       if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW) 
+       if (FIPS_module_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW) 

                && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS))
                {
                DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_KEY_SIZE_TOO_SMALL);
                && (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS))
                {
                DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_KEY_SIZE_TOO_SMALL);

diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c
index 87ef77f070f2f240a32c50a70b43b26de059d7e5..ef22737b0ed0ef67aac817bd8f281f0a9f4ca9ef 100644 (file)
--- a/crypto/ec/ec_key.c
+++ b/crypto/ec/ec_key.c
@@ -260,7 +260,7 @@ static int fips_check_ec(EC_KEY *key)
 int fips_check_ec_prng(EC_KEY *ec)
        {
        int bits, strength;
 int fips_check_ec_prng(EC_KEY *ec)
        {
        int bits, strength;

-       if (!FIPS_mode())
+       if (!FIPS_module_mode())

                return 1;
 
        if (ec->flags & (EC_FLAG_NON_FIPS_ALLOW|EC_FLAG_FIPS_CHECKED))
                return 1;
 
        if (ec->flags & (EC_FLAG_NON_FIPS_ALLOW|EC_FLAG_FIPS_CHECKED))

diff --git a/crypto/evp/e_aes.c b/crypto/evp/e_aes.c
index b0cb33e7359ce964bc4a7a43cda80f527596acbf..361abf2fd2d9940111b6f8d3ed68caf8fc1cfa7f 100644 (file)
--- a/crypto/evp/e_aes.c
+++ b/crypto/evp/e_aes.c
@@ -247,7 +247,7 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
                if (arg <= 0)
                        return 0;
 #ifdef OPENSSL_FIPS
                if (arg <= 0)
                        return 0;
 #ifdef OPENSSL_FIPS

-               if (FIPS_mode() && !(c->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW)
+               if (FIPS_module_mode() && !(c->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW)

                                                 && arg < 12)
                        return 0;
 #endif
                                                 && arg < 12)
                        return 0;
 #endif


@@ -519,7 +519,7 @@ static int aes_xts(EVP_CIPHER_CTX *ctx, unsigned char *out,
                return -1;
 #ifdef OPENSSL_FIPS
        /* Requirement of SP800-38E */
                return -1;
 #ifdef OPENSSL_FIPS
        /* Requirement of SP800-38E */

-       if (FIPS_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) &&
+       if (FIPS_module_mode() && !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW) &&

                        (len > (1L<<20)*16))
                {
                EVPerr(EVP_F_AES_XTS, EVP_R_TOO_LARGE);
                        (len > (1L<<20)*16))
                {
                EVPerr(EVP_F_AES_XTS, EVP_R_TOO_LARGE);

diff --git a/crypto/rsa/rsa_eay.c b/crypto/rsa/rsa_eay.c
index bb434d7328199c9136ec9111972aebe837e562b8..325efb95c7799d9e87797792e42373f2aed2440b 100644 (file)
--- a/crypto/rsa/rsa_eay.c
+++ b/crypto/rsa/rsa_eay.c
@@ -170,7 +170,7 @@ static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
                goto err;
                }
 
                goto err;
                }
 

-       if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
+       if (FIPS_module_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)

                && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
                {
                RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
                && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
                {
                RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);


@@ -382,7 +382,7 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                goto err;
                }
 
                goto err;
                }
 

-       if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
+       if (FIPS_module_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)

                && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
                {
                RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
                && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
                {
                RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, RSA_R_KEY_SIZE_TOO_SMALL);


@@ -530,7 +530,7 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                goto err;
                }
 
                goto err;
                }
 

-       if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
+       if (FIPS_module_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)

                && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
                {
                RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
                && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
                {
                RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);


@@ -674,7 +674,7 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
                goto err;
                }
 
                goto err;
                }
 

-       if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)
+       if (FIPS_module_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW)

                && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
                {
                RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);
                && (BN_num_bits(rsa->n) < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
                {
                RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_KEY_SIZE_TOO_SMALL);

diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c
index 24f9eaf4d6dd24f330e0ff4d2120d0fc544769e5..d28f8725cd06fb637cbf568d631f747de19866d9 100644 (file)
--- a/crypto/rsa/rsa_gen.c
+++ b/crypto/rsa/rsa_gen.c
@@ -82,7 +82,7 @@
 int fips_check_rsa_prng(RSA *rsa, int bits)
        {
        int strength;
 int fips_check_rsa_prng(RSA *rsa, int bits)
        {
        int strength;

-       if (!FIPS_mode())
+       if (!FIPS_module_mode())

                return 1;
 
        if (rsa->flags & (RSA_FLAG_NON_FIPS_ALLOW|RSA_FLAG_CHECKED))
                return 1;
 
        if (rsa->flags & (RSA_FLAG_NON_FIPS_ALLOW|RSA_FLAG_CHECKED))


@@ -205,7 +205,7 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
            return 0;
            }
 
            return 0;
            }
 

-       if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW) 
+       if (FIPS_module_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW) 

                && (bits < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
            {
            FIPSerr(FIPS_F_RSA_BUILTIN_KEYGEN,FIPS_R_KEY_TOO_SHORT);
                && (bits < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
            {
            FIPSerr(FIPS_F_RSA_BUILTIN_KEYGEN,FIPS_R_KEY_TOO_SHORT);

diff --git a/crypto/rsa/rsa_x931g.c b/crypto/rsa/rsa_x931g.c
index 819a7289540884b42f1b97a190a897971cf9bf00..e6e62c4ad33da6c870a307d0693c698de74d06ba 100644 (file)
--- a/crypto/rsa/rsa_x931g.c
+++ b/crypto/rsa/rsa_x931g.c
@@ -210,7 +210,7 @@ int RSA_X931_generate_key_ex(RSA *rsa, int bits, const BIGNUM *e, BN_GENCB *cb)
        BN_CTX *ctx = NULL;
 
 #ifdef OPENSSL_FIPS
        BN_CTX *ctx = NULL;
 
 #ifdef OPENSSL_FIPS

-       if (FIPS_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW) && 
+       if (FIPS_module_mode() && !(rsa->flags & RSA_FLAG_NON_FIPS_ALLOW) && 

                (bits < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
            {
            FIPSerr(FIPS_F_RSA_X931_GENERATE_KEY_EX,FIPS_R_KEY_TOO_SHORT);
                (bits < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS))
            {
            FIPSerr(FIPS_F_RSA_X931_GENERATE_KEY_EX,FIPS_R_KEY_TOO_SHORT);

diff --git a/fips/fips.c b/fips/fips.c
index a18fd58f28f1fe777079797dcba37af98259ca2f..6498595ec5232d7f2b6a29dba432524b53bddc42 100644 (file)
--- a/fips/fips.c
+++ b/fips/fips.c
@@ -96,7 +96,7 @@ static void fips_set_mode(int onoff)
                }
        }
 
                }
        }
 

-int FIPS_mode(void)
+int FIPS_module_mode(void)

        {
        int ret = 0;
        int owning_thread = fips_is_owning_thread();
        {
        int ret = 0;
        int owning_thread = fips_is_owning_thread();


@@ -237,7 +237,7 @@ int FIPS_check_incore_fingerprint(void)
     return rv;
     }
 
     return rv;
     }
 

-int FIPS_mode_set(int onoff)
+int FIPS_module_mode_set(int onoff)

     {
     int fips_set_owning_thread();
     int fips_clear_owning_thread();
     {
     int fips_set_owning_thread();
     int fips_clear_owning_thread();


@@ -254,7 +254,7 @@ int FIPS_mode_set(int onoff)
 
        /* Don't go into FIPS mode twice, just so we can do automagic
           seeding */
 
        /* Don't go into FIPS mode twice, just so we can do automagic
           seeding */

-       if(FIPS_mode())
+       if(FIPS_module_mode())

            {
            FIPSerr(FIPS_F_FIPS_MODE_SET,FIPS_R_FIPS_MODE_ALREADY_SET);
            fips_selftest_fail = 1;
            {
            FIPSerr(FIPS_F_FIPS_MODE_SET,FIPS_R_FIPS_MODE_ALREADY_SET);
            fips_selftest_fail = 1;

diff --git a/fips/fips.h b/fips/fips.h
index c37c32b2fd9d738b8232fda5f174ff04be7c28bd..d07d1904029c83e0e142ef2a4c5c56c521fa4530 100644 (file)
--- a/fips/fips.h
+++ b/fips/fips.h
@@ -67,8 +67,8 @@ struct env_md_st;
 struct evp_cipher_st;
 struct evp_cipher_ctx_st;
 
 struct evp_cipher_st;
 struct evp_cipher_ctx_st;
 

-int FIPS_mode_set(int onoff);
-int FIPS_mode(void);
+int FIPS_module_mode_set(int onoff);
+int FIPS_module_mode(void);

 const void *FIPS_rand_check(void);
 int FIPS_selftest(void);
 int FIPS_selftest_failed(void);
 const void *FIPS_rand_check(void);
 int FIPS_selftest(void);
 int FIPS_selftest_failed(void);

diff --git a/fips/fips_test_suite.c b/fips/fips_test_suite.c
index 2f9333c35c37b9e7a0d3e863667968b5614835f7..5290cb258747306203c1f45b8757191f49a2b0ef 100644 (file)
--- a/fips/fips_test_suite.c
+++ b/fips/fips_test_suite.c
@@ -945,7 +945,7 @@ int main(int argc,char **argv)
         }
        if (!no_exit) {
                fips_algtest_init_nofips();
         }
        if (!no_exit) {
                fips_algtest_init_nofips();

-               if (!FIPS_mode_set(1)) {
+               if (!FIPS_module_mode_set(1)) {

                    printf("Power-up self test failed\n");
                    exit(1);
                }
                    printf("Power-up self test failed\n");
                    exit(1);
                }


@@ -964,8 +964,8 @@ int main(int argc,char **argv)
     /* Power-up self test
     */
     ERR_clear_error();
     /* Power-up self test
     */
     ERR_clear_error();

-    test_msg("2. Automatic power-up self test", FIPS_mode_set(1));
-    if (!FIPS_mode())
+    test_msg("2. Automatic power-up self test", FIPS_module_mode_set(1));
+    if (!FIPS_module_mode())

        exit(1);
     if (do_drbg_stick)
             FIPS_drbg_stick();
        exit(1);
     if (do_drbg_stick)
             FIPS_drbg_stick();

diff --git a/fips/fips_utl.h b/fips/fips_utl.h
index dc29c20ce37d5731b24bced7d14b91605f5f4827..6cb58094b8321d40335afe9cf1992c93bc8dc545 100644 (file)
--- a/fips/fips_utl.h
+++ b/fips/fips_utl.h
@@ -136,7 +136,7 @@ void do_entropy_stick(void)
 void fips_algtest_init(void)
        {
        fips_algtest_init_nofips();
 void fips_algtest_init(void)
        {
        fips_algtest_init_nofips();

-       if (!FIPS_mode_set(1))
+       if (!FIPS_module_mode_set(1))

                {
                fprintf(stderr, "Error entering FIPS mode\n");
                exit(1);
                {
                fprintf(stderr, "Error entering FIPS mode\n");
                exit(1);

diff --git a/fips/rand/fips_rand_lib.c b/fips/rand/fips_rand_lib.c
index 9ea6655edf3e6f3fc87e4de9ce435a2288b64e15..cc8d7179b6cebae060433704c3c3326951e61f32 100644 (file)
--- a/fips/rand/fips_rand_lib.c
+++ b/fips/rand/fips_rand_lib.c
@@ -72,7 +72,7 @@ int FIPS_rand_set_method(const RAND_METHOD *meth)
        else
                fips_approved_rand_meth = 0;
 
        else
                fips_approved_rand_meth = 0;
 

-       if (!fips_approved_rand_meth && FIPS_mode())
+       if (!fips_approved_rand_meth && FIPS_module_mode())

                {
                FIPSerr(FIPS_F_FIPS_RAND_SET_METHOD, FIPS_R_NON_FIPS_METHOD);
                return 0;
                {
                FIPSerr(FIPS_F_FIPS_RAND_SET_METHOD, FIPS_R_NON_FIPS_METHOD);
                return 0;


@@ -83,7 +83,7 @@ int FIPS_rand_set_method(const RAND_METHOD *meth)
 
 void FIPS_rand_seed(const void *buf, int num)
        {
 
 void FIPS_rand_seed(const void *buf, int num)
        {

-       if (!fips_approved_rand_meth && FIPS_mode())
+       if (!fips_approved_rand_meth && FIPS_module_mode())

                {
                FIPSerr(FIPS_F_FIPS_RAND_SEED, FIPS_R_NON_FIPS_METHOD);
                return;
                {
                FIPSerr(FIPS_F_FIPS_RAND_SEED, FIPS_R_NON_FIPS_METHOD);
                return;


@@ -94,7 +94,7 @@ void FIPS_rand_seed(const void *buf, int num)
 
 void FIPS_rand_add(const void *buf, int num, double entropy)
        {
 
 void FIPS_rand_add(const void *buf, int num, double entropy)
        {

-       if (!fips_approved_rand_meth && FIPS_mode())
+       if (!fips_approved_rand_meth && FIPS_module_mode())

                {
                FIPSerr(FIPS_F_FIPS_RAND_ADD, FIPS_R_NON_FIPS_METHOD);
                return;
                {
                FIPSerr(FIPS_F_FIPS_RAND_ADD, FIPS_R_NON_FIPS_METHOD);
                return;


@@ -105,7 +105,7 @@ void FIPS_rand_add(const void *buf, int num, double entropy)
 
 int FIPS_rand_bytes(unsigned char *buf, int num)
        {
 
 int FIPS_rand_bytes(unsigned char *buf, int num)
        {

-       if (!fips_approved_rand_meth && FIPS_mode())
+       if (!fips_approved_rand_meth && FIPS_module_mode())

                {
                FIPSerr(FIPS_F_FIPS_RAND_BYTES, FIPS_R_NON_FIPS_METHOD);
                return 0;
                {
                FIPSerr(FIPS_F_FIPS_RAND_BYTES, FIPS_R_NON_FIPS_METHOD);
                return 0;


@@ -117,7 +117,7 @@ int FIPS_rand_bytes(unsigned char *buf, int num)
 
 int FIPS_rand_pseudo_bytes(unsigned char *buf, int num)
        {
 
 int FIPS_rand_pseudo_bytes(unsigned char *buf, int num)
        {

-       if (!fips_approved_rand_meth && FIPS_mode())
+       if (!fips_approved_rand_meth && FIPS_module_mode())

                {
                FIPSerr(FIPS_F_FIPS_RAND_PSEUDO_BYTES, FIPS_R_NON_FIPS_METHOD);
                return 0;
                {
                FIPSerr(FIPS_F_FIPS_RAND_PSEUDO_BYTES, FIPS_R_NON_FIPS_METHOD);
                return 0;


@@ -129,7 +129,7 @@ int FIPS_rand_pseudo_bytes(unsigned char *buf, int num)
 
 int FIPS_rand_status(void)
        {
 
 int FIPS_rand_status(void)
        {

-       if (!fips_approved_rand_meth && FIPS_mode())
+       if (!fips_approved_rand_meth && FIPS_module_mode())

                {
                FIPSerr(FIPS_F_FIPS_RAND_STATUS, FIPS_R_NON_FIPS_METHOD);
                return 0;
                {
                FIPSerr(FIPS_F_FIPS_RAND_STATUS, FIPS_R_NON_FIPS_METHOD);
                return 0;


@@ -153,7 +153,7 @@ int FIPS_rand_strength(void)
                return 80;
        else if (fips_approved_rand_meth == 0)
                {
                return 80;
        else if (fips_approved_rand_meth == 0)
                {

-               if (FIPS_mode())
+               if (FIPS_module_mode())

                        return 0;
                else
                        return 256;
                        return 0;
                else
                        return 256;

diff --git a/fips/utl/fips_enc.c b/fips/utl/fips_enc.c
index 55a880d06e6ec79fa870b8a28d3e2e486e53959c..fcff5ece879a64dbdb50c4dff252998709410090 100644 (file)
--- a/fips/utl/fips_enc.c
+++ b/fips/utl/fips_enc.c
@@ -136,7 +136,7 @@ int FIPS_cipherinit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
        if (cipher)
                {
                /* Only FIPS ciphers allowed */
        if (cipher)
                {
                /* Only FIPS ciphers allowed */

-               if (FIPS_mode() && !(cipher->flags & EVP_CIPH_FLAG_FIPS) &&
+               if (FIPS_module_mode() && !(cipher->flags & EVP_CIPH_FLAG_FIPS) &&

                        !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW))
                        {
                        EVPerr(EVP_F_FIPS_CIPHERINIT, EVP_R_DISABLED_FOR_FIPS);
                        !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW))
                        {
                        EVPerr(EVP_F_FIPS_CIPHERINIT, EVP_R_DISABLED_FOR_FIPS);


@@ -288,7 +288,7 @@ int FIPS_cipher_ctx_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in)
                }
 
        /* Only FIPS ciphers allowed */
                }
 
        /* Only FIPS ciphers allowed */

-       if (FIPS_mode() && !(in->cipher->flags & EVP_CIPH_FLAG_FIPS) &&
+       if (FIPS_module_mode() && !(in->cipher->flags & EVP_CIPH_FLAG_FIPS) &&

                !(out->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW))
                {
                EVPerr(EVP_F_FIPS_CIPHER_CTX_COPY, EVP_R_DISABLED_FOR_FIPS);
                !(out->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW))
                {
                EVPerr(EVP_F_FIPS_CIPHER_CTX_COPY, EVP_R_DISABLED_FOR_FIPS);

diff --git a/fips/utl/fips_md.c b/fips/utl/fips_md.c
index 556267994c1f3be591b9be517c3b62152f53cd4f..8bc028ab3f731b4a14944baf4bb0439f9aadf1e7 100644 (file)
--- a/fips/utl/fips_md.c
+++ b/fips/utl/fips_md.c
@@ -173,7 +173,7 @@ int FIPS_digestinit(EVP_MD_CTX *ctx, const EVP_MD *type)
                ctx->digest = &bad_md;
                return 0;
                }
                ctx->digest = &bad_md;
                return 0;
                }

-       if(FIPS_mode() && !(type->flags & EVP_MD_FLAG_FIPS) &&
+       if(FIPS_module_mode() && !(type->flags & EVP_MD_FLAG_FIPS) &&

                !(ctx->flags & EVP_MD_CTX_FLAG_NON_FIPS_ALLOW))
                {
                EVPerr(EVP_F_FIPS_DIGESTINIT, EVP_R_DISABLED_FOR_FIPS);
                !(ctx->flags & EVP_MD_CTX_FLAG_NON_FIPS_ALLOW))
                {
                EVPerr(EVP_F_FIPS_DIGESTINIT, EVP_R_DISABLED_FOR_FIPS);