From: Tobias Brunner <tobias@strongswan.org>
Date: Fri, 27 Sep 2013 07:11:55 +0000 (+0200)
Subject: openssl: Properly log FIPS mode when enabled via openssl.conf
X-Git-Tag: 5.1.1dr4~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c8f34ba7b604e063750e72e894d3b203988caea0;p=thirdparty%2Fstrongswan.git

openssl: Properly log FIPS mode when enabled via openssl.conf

Enabling FIPS mode twice will fail, so if it is enabled in openssl.conf
it should be disabled in strongswan.conf (or the other way around).

Either way, we should log whether FIPS mode is enabled or not.

References #412.
---

diff --git a/src/libstrongswan/plugins/openssl/openssl_plugin.c b/src/libstrongswan/plugins/openssl/openssl_plugin.c
index fb34a6858d..b6d699de2b 100644
--- a/src/libstrongswan/plugins/openssl/openssl_plugin.c
+++ b/src/libstrongswan/plugins/openssl/openssl_plugin.c
@@ -520,13 +520,14 @@ plugin_t *openssl_plugin_create()
 	fips_mode = lib->settings->get_int(lib->settings,
 						"libstrongswan.plugins.openssl.fips_mode", FIPS_MODE);
 #ifdef OPENSSL_FIPS
-	if (!FIPS_mode_set(fips_mode))
+	if (fips_mode)
 	{
-		DBG1(DBG_LIB, "unable to set openssl FIPS mode(%d)", fips_mode);
-		return NULL;
+		if (!FIPS_mode_set(fips_mode))
+		{
+			DBG1(DBG_LIB, "unable to set openssl FIPS mode(%d)", fips_mode);
+			return NULL;
+		}
 	}
-	DBG1(DBG_LIB, "openssl FIPS mode(%d) - %sabled ",fips_mode,
-				   fips_mode ? "en" : "dis");
 #else
 	if (fips_mode)
 	{
@@ -550,6 +551,13 @@ plugin_t *openssl_plugin_create()
 	OPENSSL_config(NULL);
 	OpenSSL_add_all_algorithms();
 
+#ifdef OPENSSL_FIPS
+	/* we do this here as it may have been enabled via openssl.conf */
+	fips_mode = FIPS_mode();
+	DBG1(DBG_LIB, "openssl FIPS mode(%d) - %sabled ", fips_mode,
+		 fips_mode ? "en" : "dis");
+#endif /* OPENSSL_FIPS */
+
 #ifndef OPENSSL_NO_ENGINE
 	/* activate support for hardware accelerators */
 	ENGINE_load_builtin_engines();