Make sure the FIPS stuff is only really compiled when in FIPS mode.

diff --git a/fips/dh/fips_dh_check.c b/fips/dh/fips_dh_check.c
index 5b9d8da58b477ff9f1fa329e7215da913282134b..874920b466faa06fe6b8f499be6d653916b966cc 100644 (file)
--- a/fips/dh/fips_dh_check.c
+++ b/fips/dh/fips_dh_check.c
@@ -58,8 +58,11 @@
 
 #include <stdio.h>
 #include <openssl/bn.h>
+#ifndef OPENSSL_NO_DH
 #include <openssl/dh.h>
 
+#ifdef OPENSSL_FIPS
+
 /* Check that p is a safe prime and
  * if g is 2, 3 or 5, check that is is a suitable generator
  * where
@@ -117,3 +120,6 @@ err:
        if (q != NULL) BN_free(q);
        return(ok);
        }
+
+#endif
+#endif

diff --git a/fips/dh/fips_dh_gen.c b/fips/dh/fips_dh_gen.c
index db5b2910f4d6bd13dd8d250416a7e3b772e83991..09fbc4d53f28a45a9a8076e3ee38fdde75dfb921 100644 (file)
--- a/fips/dh/fips_dh_gen.c
+++ b/fips/dh/fips_dh_gen.c
@@ -60,9 +60,14 @@
 #include <string.h>
 #include <openssl/err.h>
 #include <openssl/bn.h>
+#ifndef OPENSSL_NO_DH
 #include <openssl/dh.h>
+#endif
 #include <openssl/fips.h>
 
+#ifndef OPENSSL_NO_DH
+#ifdef OPENSSL_FIPS
+
 /* We generate DH parameters as follows
  * find a prime q which is prime_len/2 bits long.
  * p=(2*q)+1 or (p-1)/2 = q
@@ -89,8 +94,6 @@
  * order-q subgroup.
  */
 
-#ifdef OPENSSL_FIPS
-
 DH *DH_generate_parameters(int prime_len, int generator,
             void (*callback)(int,int,void *), void *cb_arg)
        {
@@ -180,3 +183,4 @@ err:
        }
 
 #endif
+#endif

diff --git a/fips/dh/fips_dh_key.c b/fips/dh/fips_dh_key.c
index 447d5b384173f23fd0a7083857833e6956f215db..41e3a661c0c59346245abf3d34fdb458ccaa058a 100644 (file)
--- a/fips/dh/fips_dh_key.c
+++ b/fips/dh/fips_dh_key.c
@@ -59,9 +59,14 @@
 #include <stdio.h>
 #include <openssl/err.h>
 #include <openssl/bn.h>
+#ifndef OPENSSL_NO_RAND
 #include <openssl/rand.h>
+#endif
+#ifndef OPENSSL_NO_DH
 #include <openssl/dh.h>
 
+#ifdef OPENSSL_FIPS
+
 static int generate_key(DH *dh);
 static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh);
 static int dh_bn_mod_exp(const DH *dh, BIGNUM *r,
@@ -220,3 +225,6 @@ static int dh_finish(DH *dh)
                BN_MONT_CTX_free((BN_MONT_CTX *)dh->method_mont_p);
        return(1);
        }
+
+#endif
+#endif