MINOR: ssl: report FIPS mode in -vv for OpenSSL >= 3.0 too

The "SSL library FIPS mode" line in "haproxy -vv" was only computed
for SSL libraries implementing the legacy FIPS_mode() API (OpenSSL
1.0.x/1.1.x and compatible libraries such as AWS-LC), and silently
omitted for OpenSSL 3.0 and above.

Use the openssl_fips_mode() helper introduced for the fips_mode()
config condition predicate instead of calling FIPS_mode() directly:
it also covers OpenSSL >= 3.0 via
EVP_default_properties_is_fips_enabled(), and reports "no" rather
than omitting the line entirely for any SSL library supporting
neither API. The line is now unconditionally printed.

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 802d08597e8eebe82d977f12277aa2bfe613f8be..eb6ca6cb9bf925ea425751317e70137db90d8c43 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -8844,9 +8844,7 @@ static void ssl_register_build_options()
 #endif
 #endif
               "", ptr);
-#if defined(USE_OPENSSL) && (HA_OPENSSL_VERSION_NUMBER < 0x3000000fL)
-       memprintf(&ptr, "%s\nSSL library FIPS mode : %s", ptr, FIPS_mode() ? "yes" : "no");
-#endif
+       memprintf(&ptr, "%s\nSSL library FIPS mode : %s", ptr, openssl_fips_mode() > 0 ? "yes" : "no");
        memprintf(&ptr, "%s\nSSL library default verify directory : %s", ptr, ha_default_cert_dir());
        memprintf(&ptr, "%s\nSSL library supports :", ptr);
        for (i = CONF_TLSV_MIN; i <= CONF_TLSV_MAX; i++)