OSSForks/mariadb-server
1
0
Fork 0
mirror of https://github.com/zebrajr/server.git synced 2025-12-06 12:20:40 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

MDEV-27778 md5 in FIPS crashes with OpenSSL 3.0.0

Browse Source 
OpenSSL 3.0.0+ does not support EVP_MD_CTX_FLAG_NON_FIPS_ALLOW any longer.
In OpenSSL 1.1.1 the non FIPS allowed flag is context specific, while
in 3.0.0+ it is a different EVP_MD provider.

Fixes #2010

part of MDEV-29000
This commit is contained in:
Honza Horak 2022-02-08 16:39:10 +01:00 committed by Vladislav Vaintroub
parent 1dc09ce0fd
commit ef65566981
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
mysys_ssl/my_md5.cc
View File

@ -52,12 +52,23 @@ static void md5_result(EVP_MD_CTX *context, uchar digest[MD5_HASH_SIZE])
static void md5_init(EVP_MD_CTX *context) static void md5_init(EVP_MD_CTX *context)
{ {
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
EVP_MD *md5;
EVP_MD_CTX_init(context);
/* Ok to ignore FIPS: MD5 is not used for crypto here */
/* In OpenSSL 3.0.0+ it is a different EVP_MD provider */
md5 = EVP_MD_fetch(NULL, "MD5", "fips=no");
EVP_DigestInit_ex(context, md5, NULL);
EVP_MD_free(md5);
#else
EVP_MD_CTX_init(context); EVP_MD_CTX_init(context);
#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW #ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
/* Ok to ignore FIPS: MD5 is not used for crypto here */ /* Ok to ignore FIPS: MD5 is not used for crypto here */
/* In OpenSSL 1.1.1 the non FIPS allowed flag is context specific */
EVP_MD_CTX_set_flags(context, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); EVP_MD_CTX_set_flags(context, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
#endif #endif
EVP_DigestInit_ex(context, EVP_md5(), NULL); EVP_DigestInit_ex(context, EVP_md5(), NULL);
#endif
} }
static void md5_input(EVP_MD_CTX *context, const uchar *buf, unsigned len) static void md5_input(EVP_MD_CTX *context, const uchar *buf, unsigned len)