lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-07-30 22:43:12 +03:00
Code Activity

* crypt/crypt-entry.c: Include fips-private.h.

Browse Source 
(__crypt_r, __crypt): Disable MD5 and DES if FIPS is enabled.
* crypt/md5c-test.c (main): Tolerate disabled MD5.
* sysdeps/unix/sysv/linux/fips-private.h: New file.
* sysdeps/generic/fips-private.h: New file, dummy fallback.
This commit is contained in:
Alexandre Oliva
2012-10-10 07:05:46 -03:00
parent 4ba74a3573
commit e745142509
5 changed files with 143 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
crypt/crypt-entry.c
View File

@ -28,6 +28,7 @@
#endif
#include <string.h>
#include <errno.h>
#include <fips-private.h>
#ifndef STATIC
#define STATIC static
@ -92,8 +93,16 @@ __crypt_r (key, salt, data)
#ifdef _LIBC
/* Try to find out whether we have to use MD5 encryption replacement. */
if (strncmp (md5_salt_prefix, salt, sizeof (md5_salt_prefix) - 1) == 0)
return __md5_crypt_r (key, salt, (char *) data,
sizeof (struct crypt_data));
{
/* FIPS rules out MD5 password encryption. */
if (fips_enabled_p ())
{
__set_errno (EPERM);
return NULL;
}
return __md5_crypt_r (key, salt, (char *) data,
sizeof (struct crypt_data));
}
/* Try to find out whether we have to use SHA256 encryption replacement. */
if (strncmp (sha256_salt_prefix, salt, sizeof (sha256_salt_prefix) - 1) == 0)
@ -115,6 +124,13 @@ __crypt_r (key, salt, data)
return NULL;
}
/* FIPS rules out DES password encryption. */
if (fips_enabled_p ())
{
__set_errno (EPERM);
return NULL;
}
/*
* Setup key schedule
*/
@ -148,7 +164,9 @@ crypt (key, salt)
{
#ifdef _LIBC
/* Try to find out whether we have to use MD5 encryption replacement. */
if (strncmp (md5_salt_prefix, salt, sizeof (md5_salt_prefix) - 1) == 0)
if (strncmp (md5_salt_prefix, salt, sizeof (md5_salt_prefix) - 1) == 0
/* Let __crypt_r deal with the error code if FIPS is enabled. */
&& !fips_enabled_p ())
return __md5_crypt (key, salt);
/* Try to find out whether we have to use SHA256 encryption replacement. */