Commit b53338cb authored by Emilia Kasper's avatar Emilia Kasper
Browse files

Clean up references to FIPS 



This removes the fips configure option. This option is broken as the
required FIPS code is not available.

FIPS_mode() and FIPS_mode_set() are retained for compatibility, but
FIPS_mode() always returns 0, and FIPS_mode_set() can only be used to
turn FIPS mode off.

Reviewed-by: default avatarStephen Henson <steve@openssl.org>
parent 223a90cc

Configure

+3 −34
Original line number Diff line number Diff line
@@ -302,12 +302,9 @@ $config{openssldir}=""; 
$config{processor}="";

$config{libdir}="";

$config{cross_compile_prefix}="";

$config{fipslibdir}="/usr/local/ssl/fips-2.0/lib/";

my $nofipscanistercheck=0;

$config{baseaddr}="0xFB00000";

my $auto_threads=1;    # enable threads automatically? true by default

my $default_ranlib;

$config{fips}=0;



# Top level directories to build

$config{dirs} = [ "crypto", "ssl", "engines", "apps", "test", "util", "tools", "fuzz" ];
@@ -685,7 +682,7 @@ while (@argvcopy) 
		{ $config{processor}=386; }

	elsif (/^fips$/)

		{

		$config{fips}=1;

		die "FIPS mode not supported\n";

		}

	elsif (/^rsaref$/)

		{
@@ -695,8 +692,7 @@ while (@argvcopy) 
		}

	elsif (/^nofipscanistercheck$/)

		{

		$config{fips} = 1;

		$nofipscanistercheck = 1;

		die "FIPS mode not supported\n";

		}

	elsif (/^[-+]/)

		{
@@ -734,10 +730,6 @@ while (@argvcopy) 
			{

			$withargs{fuzzer_include}=$1;

			}

		elsif (/^--with-fipslibdir=(.*)$/)

			{

			$config{fipslibdir}="$1/";

			}

		elsif (/^--with-baseaddr=(.*)$/)

			{

			$config{baseaddr}="$1";
@@ -821,15 +813,6 @@ if ($libs =~ /(^|\s)-Wl,-rpath,/ 
	"***** any of asan, msan or ubsan\n";

}



if ($config{fips})

	{

	delete $disabled{"shared"} if ($disabled{"shared"} =~ /^default/);

	}

else

	{

	@{$config{dirs}} = grep !/^fips$/, @{$config{dirs}};

	}



my @tocheckfor = (keys %disabled);

while (@tocheckfor) {

    my %new_tocheckfor = ();
@@ -1058,15 +1041,6 @@ if (!$disabled{dso} && $target{dso_scheme} ne "") 


$config{ex_libs}="$libs$config{ex_libs}" if ($libs ne "");



if ($disabled{asm})

	{

	if ($config{fips})

		{

		@{$config{defines}} = grep !/^[BL]_ENDIAN$/, @{$config{defines}};

		@{$target{defines}} = grep !/^[BL]_ENDIAN$/, @{$target{defines}};

		}

	}



# If threads aren't disabled, check how possible they are

unless ($disabled{threads}) {

    if ($auto_threads) {
@@ -1107,8 +1081,7 @@ if (defined($disabled{"deprecated"})) { 
if ($target{shared_target} eq "")

	{

	$no_shared_warn = 1

	    if ((!$disabled{shared} || !$disabled{"dynamic-engine"})

		&& !$config{fips});

	    if (!$disabled{shared} || !$disabled{"dynamic-engine"});

	$disabled{shared} = "no-shared-target";

	$disabled{pic} = $disabled{shared} = $disabled{"dynamic-engine"} =

	    "no-shared-target";
@@ -1172,10 +1145,6 @@ unless ($disabled{asm}) { 
    push @{$config{defines}}, "OPENSSL_BN_ASM_MONT5" if ($target{bn_asm_src} =~ /-mont5/);

    push @{$config{defines}}, "OPENSSL_BN_ASM_GF2m" if ($target{bn_asm_src} =~ /-gf2m/);



    if ($config{fips}) {

	push @{$config{openssl_other_defines}}, "OPENSSL_FIPS";

    }



    if ($target{sha1_asm_src}) {

	push @{$config{defines}}, "SHA1_ASM"   if ($target{sha1_asm_src} =~ /sx86/ || $target{sha1_asm_src} =~ /sha1/);

	push @{$config{defines}}, "SHA256_ASM" if ($target{sha1_asm_src} =~ /sha256/);

apps/openssl.c

+0 −10
Original line number Diff line number Diff line
@@ -21,9 +21,6 @@ 
# include <openssl/engine.h>

#endif

#include <openssl/err.h>

#ifdef OPENSSL_FIPS

# include <openssl/fips.h>

#endif

#define USE_SOCKETS /* needed for the _O_BINARY defs in the MS world */

#include "s_apps.h"

/* Needed to get the other O_xxx flags. */
@@ -143,15 +140,8 @@ int main(int argc, char *argv[]) 
    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);



    if (getenv("OPENSSL_FIPS")) {

#ifdef OPENSSL_FIPS

        if (!FIPS_mode_set(1)) {

            ERR_print_errors(bio_err);

            return 1;

        }

#else

        BIO_printf(bio_err, "FIPS mode not supported.\n");

        return 1;

#endif

    }



    if (!apps_startup())

crypto/aes/asm/aes-mips.pl

+0 −4
Original line number Diff line number Diff line
@@ -105,10 +105,6 @@ $code.=<<___; 
#include "mips_arch.h"



.text

#ifdef OPENSSL_FIPSCANISTER

# include <openssl/fipssyms.h>

#endif



#if !defined(__mips_eabi) && (!defined(__vxworks) || defined(__pic__))

.option	pic2

#endif

crypto/bn/asm/sparcv8plus.S

+0 −4
Original line number Diff line number Diff line
@@ -144,10 +144,6 @@ 
 *	    }

 */



#ifdef OPENSSL_FIPSCANISTER

#include <openssl/fipssyms.h>

#endif



#if defined(__SUNPRO_C) && defined(__sparcv9)

  /* They've said -xarch=v9 at command line */

  .register	%g2,#scratch

crypto/des/asm/des_enc.m4

+0 −4
Original line number Diff line number Diff line
@@ -31,10 +31,6 @@ 


#include <openssl/opensslconf.h>



#ifdef OPENSSL_FIPSCANISTER

#include <openssl/fipssyms.h>

#endif



#if defined(__SUNPRO_C) && defined(__sparcv9)

# define ABI64  /* They've said -xarch=v9 at command line */

#elif defined(__GNUC__) && defined(__arch64__)