From d9f2c7df12a2e51ed78056e2bdc5714abf32390c Mon Sep 17 00:00:00 2001 From: Stefan Eissing Date: Fri, 8 Feb 2019 09:01:42 +0000 Subject: [PATCH 370/504] Merge of r1853133,r1853166 from trunk: mod_ssl: Don't unset FIPS mode on restart unless it's forced by configuration (SSLFIPS on) and not active by default in OpenSSL. PR 63136. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1853197 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 4 +++- modules/ssl/mod_ssl.c | 3 --- modules/ssl/ssl_engine_init.c | 12 +++++++++++- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c index 9fdf9e042e..4797c78bb9 100644 --- a/modules/ssl/mod_ssl.c +++ b/modules/ssl/mod_ssl.c @@ -331,9 +331,6 @@ static apr_status_t ssl_cleanup_pre_config(void *data) /* * Try to kill the internals of the SSL library. */ -#ifdef HAVE_FIPS - FIPS_mode_set(0); -#endif /* Corresponds to OBJ_create()s */ OBJ_cleanup(); /* Corresponds to OPENSSL_load_builtin_modules() */ diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c index 18d18c691f..48d7b96cd8 100644 --- a/modules/ssl/ssl_engine_init.c +++ b/modules/ssl/ssl_engine_init.c @@ -183,6 +183,14 @@ int ssl_is_challenge(conn_rec *c, const char *servername, return 0; } +#ifdef HAVE_FIPS +static apr_status_t modssl_fips_cleanup(void *data) +{ + FIPS_mode_set(0); + return APR_SUCCESS; +} +#endif + /* * Per-module initialization */ @@ -311,11 +319,13 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog, ssl_rand_seed(base_server, ptemp, SSL_RSCTX_STARTUP, "Init: "); #ifdef HAVE_FIPS - if(sc->fips) { + if (sc->fips) { if (!FIPS_mode()) { if (FIPS_mode_set(1)) { ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s, APLOGNO(01884) "Operating in SSL FIPS mode"); + apr_pool_cleanup_register(p, NULL, modssl_fips_cleanup, + apr_pool_cleanup_null); } else { ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01885) "FIPS mode failed"); -- 2.19.1