openssl.c: Avoid OpenSSL latent error in FIPS mode
File:
openssl.c
Notes:
Avoid initing MD5 digest, which is not permitted in OpenSSL FIPS certified cryptography mode.
Credit:
Marc
@@ -2221,6 +2221,13 @@ _libssh2_sha512(const unsigned char *message, unsigned long len,
int
_libssh2_md5_init(libssh2_md5_ctx *ctx)
{
+ /* MD5 digest is not supported in OpenSSL FIPS mode
+ * Trying to init it will result in a latent OpenSSL error:
+ * "digital envelope routines:FIPS_DIGESTINIT:disabled for fips"
+ * So, just return 0 in FIPS mode
+ */
+ if(FIPS_mode() != 0)
+ return 0;
#ifdef HAVE_OPAQUE_STRUCTS
*ctx = EVP_MD_CTX_new();
