From: William Lallemand <wlallemand@haproxy.com>
Date: Thu, 13 Aug 2026 13:51:11 +0000 (+0000)
Subject: MINOR: ssl: report FIPS mode in -vv for OpenSSL >= 3.0 too
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3914af44e0bbc529d431f65bf9e4809f2944d4bf;p=thirdparty%2Fhaproxy.git

MINOR: ssl: report FIPS mode in -vv for OpenSSL >= 3.0 too

The "SSL library FIPS mode" line in "haproxy -vv" was only computed
for SSL libraries implementing the legacy FIPS_mode() API (OpenSSL
1.0.x/1.1.x and compatible libraries such as AWS-LC), and silently
omitted for OpenSSL 3.0 and above.

Use the openssl_fips_mode() helper introduced for the fips_mode()
config condition predicate instead of calling FIPS_mode() directly:
it also covers OpenSSL >= 3.0 via
EVP_default_properties_is_fips_enabled(), and reports "no" rather
than omitting the line entirely for any SSL library supporting
neither API. The line is now unconditionally printed.
---

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 802d08597..eb6ca6cb9 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -8844,9 +8844,7 @@ static void ssl_register_build_options()
 #endif
 #endif
 	       "", ptr);
-#if defined(USE_OPENSSL) && (HA_OPENSSL_VERSION_NUMBER < 0x3000000fL)
-	memprintf(&ptr, "%s\nSSL library FIPS mode : %s", ptr, FIPS_mode() ? "yes" : "no");
-#endif
+	memprintf(&ptr, "%s\nSSL library FIPS mode : %s", ptr, openssl_fips_mode() > 0 ? "yes" : "no");
 	memprintf(&ptr, "%s\nSSL library default verify directory : %s", ptr, ha_default_cert_dir());
 	memprintf(&ptr, "%s\nSSL library supports :", ptr);
 	for (i = CONF_TLSV_MIN; i <= CONF_TLSV_MAX; i++)