|
 |
489963 |
Added to address RHBZ#1449689
|
|
|
489963 |
|
|
|
489963 |
Original patch notes from <hhorak@redhat.com> follows:
|
|
|
489963 |
|
|
|
489963 |
...
|
|
|
489963 |
|
|
|
489963 |
In FIPS mode there is no md5 by default, unless declared it is specifically
|
|
|
489963 |
allowed. MD5 is used for non-crypto related things in MySQL (digests related
|
|
|
489963 |
to performance schema and table list), so it is ok to use MD5 there.
|
|
|
489963 |
|
|
|
489963 |
However, there is also MD5() SQL function, that should still keep working,
|
|
|
489963 |
but users should know they should avoid using it in FIPS mode.
|
|
|
489963 |
|
|
|
489963 |
RHBZ: #1351791
|
|
|
489963 |
|
|
|
489963 |
Upstream bug reports:
|
|
|
489963 |
http://bugs.mysql.com/bug.php?id=83696
|
|
|
489963 |
https://jira.mariadb.org/browse/MDEV-7788
|
|
|
489963 |
|
|
|
489963 |
|
|
|
489963 |
diff -Naurp mysql-5.7.18_original/mysys_ssl/my_md5.cc mysql-5.7.18_patched/mysys_ssl/my_md5.cc
|
|
|
489963 |
--- mysql-5.7.18_original/mysys_ssl/my_md5.cc 2017-03-18 08:45:14.000000000 +0100
|
|
|
489963 |
+++ mysql-5.7.18_patched/mysys_ssl/my_md5.cc 2017-05-12 12:19:38.584814619 +0200
|
|
|
489963 |
@@ -38,13 +38,22 @@ static void my_md5_hash(char *digest, co
|
|
|
489963 |
|
|
|
489963 |
#elif defined(HAVE_OPENSSL)
|
|
|
489963 |
#include <openssl/md5.h>
|
|
|
489963 |
+#include <openssl/evp.h>
|
|
|
489963 |
|
|
|
489963 |
static void my_md5_hash(unsigned char* digest, unsigned const char *buf, int len)
|
|
|
489963 |
{
|
|
|
489963 |
- MD5_CTX ctx;
|
|
|
489963 |
- MD5_Init (&ctx;;
|
|
|
489963 |
- MD5_Update (&ctx, buf, len);
|
|
|
489963 |
- MD5_Final (digest, &ctx;;
|
|
|
489963 |
+ EVP_MD_CTX *ctx;
|
|
|
489963 |
+ ctx = EVP_MD_CTX_create();
|
|
|
489963 |
+
|
|
|
489963 |
+ #ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
|
|
|
489963 |
+ /* we will be using MD5, which is not allowed under FIPS */
|
|
|
489963 |
+ EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
|
|
|
489963 |
+ #endif
|
|
|
489963 |
+
|
|
|
489963 |
+ EVP_DigestInit_ex(ctx, EVP_md5(), NULL);
|
|
|
489963 |
+ EVP_DigestUpdate(ctx, buf, len);
|
|
|
489963 |
+ EVP_DigestFinal_ex(ctx, digest, NULL);
|
|
|
489963 |
+ EVP_MD_CTX_destroy(ctx);
|
|
|
489963 |
}
|
|
|
489963 |
|
|
|
489963 |
#endif /* HAVE_YASSL */
|