Allow MD5 hash in zombie mode

diff --git a/lib/crypto-api.c b/lib/crypto-api.c
index b2d11a414f02ef0e47b4e23dc1d2f105cd13044e..aa7189ed83dec0ce507833de1ed8121cc7e597c3 100644 (file)
--- a/lib/crypto-api.c
+++ b/lib/crypto-api.c
@@ -463,8 +463,11 @@ gnutls_hash_init(gnutls_hash_hd_t * dig,
 {
 #ifdef ENABLE_FIPS140
        /* MD5 is only allowed internally for TLS */
-       if (algorithm == GNUTLS_DIG_MD5)
-               return gnutls_assert_val(GNUTLS_E_UNWANTED_ALGORITHM);
+       if (_gnutls_get_fips_state() != FIPS_STATE_SELFTEST && 
+               _gnutls_get_fips_state() != FIPS_STATE_ZOMBIE) {
+               if (algorithm == GNUTLS_MAC_MD5)
+                       return gnutls_assert_val(GNUTLS_E_UNWANTED_ALGORITHM);
+       }
 #endif
 
        *dig = gnutls_malloc(sizeof(digest_hd_st));