69 lines
2.2 KiB
Diff
69 lines
2.2 KiB
Diff
|
From d9f2c7df12a2e51ed78056e2bdc5714abf32390c Mon Sep 17 00:00:00 2001
|
||
|
|
From: Stefan Eissing <icing@apache.org>
|
||
|
|
Date: Fri, 8 Feb 2019 09:01:42 +0000
|
||
|
|
Subject: [PATCH 370/504] Merge of r1853133,r1853166 from trunk:
|
||
|
|
|
||
|
|
mod_ssl: Don't unset FIPS mode on restart unless it's forced by
|
||
|
|
configuration (SSLFIPS on) and not active by default in OpenSSL. PR 63136.
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1853197 13f79535-47bb-0310-9956-ffa450edef68
|
||
|
|
---
|
||
|
|
CHANGES | 4 +++-
|
||
|
|
modules/ssl/mod_ssl.c | 3 ---
|
||
|
|
modules/ssl/ssl_engine_init.c | 12 +++++++++++-
|
||
|
|
3 files changed, 14 insertions(+), 5 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
|
||
|
|
index 9fdf9e042e..4797c78bb9 100644
|
||
|
|
--- a/modules/ssl/mod_ssl.c
|
||
|
|
+++ b/modules/ssl/mod_ssl.c
|
||
|
|
@@ -331,9 +331,6 @@ static apr_status_t ssl_cleanup_pre_config(void *data)
|
||
|
|
/*
|
||
|
|
* Try to kill the internals of the SSL library.
|
||
|
|
*/
|
||
|
|
-#ifdef HAVE_FIPS
|
||
|
|
- FIPS_mode_set(0);
|
||
|
|
-#endif
|
||
|
|
/* Corresponds to OBJ_create()s */
|
||
|
|
OBJ_cleanup();
|
||
|
|
/* Corresponds to OPENSSL_load_builtin_modules() */
|
||
|
|
diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
|
||
|
|
index 18d18c691f..48d7b96cd8 100644
|
||
|
|
--- a/modules/ssl/ssl_engine_init.c
|
||
|
|
+++ b/modules/ssl/ssl_engine_init.c
|
||
|
|
@@ -183,6 +183,14 @@ int ssl_is_challenge(conn_rec *c, const char *servername,
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
+#ifdef HAVE_FIPS
|
||
|
|
+static apr_status_t modssl_fips_cleanup(void *data)
|
||
|
|
+{
|
||
|
|
+ FIPS_mode_set(0);
|
||
|
|
+ return APR_SUCCESS;
|
||
|
|
+}
|
||
|
|
+#endif
|
||
|
|
+
|
||
|
|
/*
|
||
|
|
* Per-module initialization
|
||
|
|
*/
|
||
|
|
@@ -311,11 +319,13 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
|
||
|
|
ssl_rand_seed(base_server, ptemp, SSL_RSCTX_STARTUP, "Init: ");
|
||
|
|
|
||
|
|
#ifdef HAVE_FIPS
|
||
|
|
- if(sc->fips) {
|
||
|
|
+ if (sc->fips) {
|
||
|
|
if (!FIPS_mode()) {
|
||
|
|
if (FIPS_mode_set(1)) {
|
||
|
|
ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s, APLOGNO(01884)
|
||
|
|
"Operating in SSL FIPS mode");
|
||
|
|
+ apr_pool_cleanup_register(p, NULL, modssl_fips_cleanup,
|
||
|
|
+ apr_pool_cleanup_null);
|
||
|
|
}
|
||
|
|
else {
|
||
|
|
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01885) "FIPS mode failed");
|
||
|
|
--
|
||
|
|
2.19.1
|
||
|
|
|