FIPS: Remove MD5 from the CONFIG_FIPS=y build

When CONFIG_FIPS=y is used, do not include MD5 in the build and disable
EAPOL-Key frames that use MD5 (WPA/TKIP and dynamic WEP with IEEE
802.1X).

Signed-hostap: Jouni Malinen <j@w1.fi>

diff --git a/src/common/wpa_common.c b/src/common/wpa_common.c
index 7a013a805e3ee756522ef1256b2ccfea2a2a9df9..61d586930a772af8666979725ef4e96bbe58c1f2 100644 (file)
--- a/src/common/wpa_common.c
+++ b/src/common/wpa_common.c
@@ -43,8 +43,10 @@ int wpa_eapol_key_mic(const u8 *key, int ver, const u8 *buf, size_t len,
        u8 hash[SHA1_MAC_LEN];
 
        switch (ver) {
+#ifndef CONFIG_FIPS
        case WPA_KEY_INFO_TYPE_HMAC_MD5_RC4:
                return hmac_md5(key, 16, buf, len, mic);
+#endif /* CONFIG_FIPS */
        case WPA_KEY_INFO_TYPE_HMAC_SHA1_AES:
                if (hmac_sha1(key, 16, buf, len, hash))
                        return -1;

diff --git a/src/eapol_supp/eapol_supp_sm.c b/src/eapol_supp/eapol_supp_sm.c
index 280d1b0b315821bad61fbc3fddc3397a003a76fe..07ef83bcd1d4353229c9e2909cff2687149bb5b0 100644 (file)
--- a/src/eapol_supp/eapol_supp_sm.c
+++ b/src/eapol_supp/eapol_supp_sm.c
@@ -624,6 +624,7 @@ struct eap_key_data {
 
 static void eapol_sm_processKey(struct eapol_sm *sm)
 {
+#ifndef CONFIG_FIPS
        struct ieee802_1x_hdr *hdr;
        struct ieee802_1x_eapol_key *key;
        struct eap_key_data keydata;
@@ -786,6 +787,7 @@ static void eapol_sm_processKey(struct eapol_sm *sm)
                                sm->ctx->eapol_done_cb(sm->ctx->ctx);
                }
        }
+#endif /* CONFIG_FIPS */
 }
 
 

diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
index 388267e9b2f0530bbade6bb2e086ca088fd10cfb..cf525acf89dd31b62272a95a8928c1d668496b70 100644 (file)
--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
@@ -1101,7 +1101,9 @@ SHA1OBJS += ../src/crypto/sha1-tlsprf.o
 endif
 endif
 
-MD5OBJS = ../src/crypto/md5.o
+ifndef CONFIG_FIPS
+MD5OBJS += ../src/crypto/md5.o
+endif
 ifdef NEED_MD5
 ifdef CONFIG_INTERNAL_MD5
 MD5OBJS += ../src/crypto/md5-internal.o