Add --enable-fips, FIPSify everything. (b68a0834) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

README-FIPS

+7 −1

Original line number	Diff line number	Diff line
		@@ -21,7 +21,11 @@ build of the OpenSSL library.

		Note this branch includes apr and apr-util, while the authors figure out what
		to do about apr MD5 and other fips issues are resolved. That work will be
		submitted to the apr project, once the least distruptive change is ascertained.
		submitted to the apr project, once the least distruptive change is
		ascertained.

		Note also that even with FIPS mode is off, operations using MD5 are
		not possible.

		Stuff FIPS requires
		-------------------
		@@ -32,3 +36,5 @@ a single chunk (note that this could be relaxed at the cost of more
		code).

		Certificates: must be signed using SHA-1.

		Passwords: must be SHA-1 hashed.

+8 −0

Original line number	Diff line number	Diff line
		@@ -16,7 +16,15 @@
		# The build environment was provided by Sascha Schumann.

		PROGRAM_OBJECTS = $(PROGRAM_SOURCES:.c=.lo)
		TOP=/home/ben/work/openssl-0.9.7

		# XXX: I don't know how to work out the correct path for the real executable
		TO_FINGERPRINT = $(PROGRAM_NAME:httpd=.libs/lt-httpd)
		FINGERPRINT = $(TO_FINGERPRINT).sha1

		$(PROGRAM_NAME): $(PROGRAM_DEPENDENCIES) $(PROGRAM_OBJECTS)
		$(PROGRAM_PRELINK)
		$(LINK) $(PROGRAM_LDFLAGS) $(PROGRAM_OBJECTS) $(PROGRAM_LDADD)
		# blearg - force libtool to do its stupid magic
		-./$(PROGRAM_NAME) --help
		TOP=$(TOP) $(TOP)/fips/openssl_fips_fingerprint $(TOP)/libcrypto.a $(TO_FINGERPRINT) > $(FINGERPRINT)

+8 −1

Original line number	Diff line number	Diff line
		@@ -18,6 +18,10 @@ sinclude(build/find_apr.m4)
		sinclude(build/find_apu.m4)
		sinclude(acinclude.m4)

		dnl Allow FIPS mode
		AC_ARG_ENABLE(fips,[Enable FIPS mode (i.e. disable or replace all crypto)],
		[AC_DEFINE([AP_FIPS],1,[Set to 1 if FIPS mode is enabled])])

		dnl XXX we can't just use AC_PREFIX_DEFAULT because that isn't subbed in
		dnl by configure until it is too late. Is that how it should be or not?
		dnl Something seems broken here.
		@@ -106,8 +110,11 @@ yes.reconfig)
		esac

		if test "$apu_found" = "reconfig"; then
		if test "${enable_fips+set}" = set; then
		fips_option="--enable-fips"
		fi
		APR_SUBDIR_CONFIG(srclib/apr-util,
		[--with-apr=../apr --prefix=$prefix --exec-prefix=$exec_prefix --libdir=$libdir --includedir=$includedir --bindir=$bindir],
		[--with-apr=../apr --prefix=$prefix --exec-prefix=$exec_prefix --libdir=$libdir --includedir=$includedir --bindir=$bindir $fips_option],
		[--enable-layout=\|\'--enable-layout=])
		dnl We must be the last to build and the first to be cleaned
		AP_BUILD_SRCLIB_DIRS="$AP_BUILD_SRCLIB_DIRS apr-util"

+1 −0

Original line number	Diff line number	Diff line
		@@ -35,6 +35,7 @@ extern "C" {

		/** The name of the Apache executable */
		AP_DECLARE_DATA extern const char *ap_server_argv0;
		AP_DECLARE_DATA extern const char *ap_server_full_argv0;
		/** The global server's ServerRoot */
		AP_DECLARE_DATA extern const char *ap_server_root;

+15 −0

Original line number	Diff line number	Diff line
		@@ -26,7 +26,20 @@ extern "C" {
		*/

		#include "apr_md5.h"
		#include "ap_config_auto.h"

		#ifdef AP_FIPS
		/**
		* Create a SHA-1 checksum of a string of binary data
		* @param a Pool to allocate out of
		* @param buf Buffer to generate checksum for
		* @param len The length of the buffer
		* @return The checksum in hex
		* @deffunc char ap_md5_binary(apr_pool_t a, const unsigned char *buf, int len)
		*/
		AP_DECLARE(char ) ap_sha1_binary(apr_pool_t a, const unsigned char *buf, int len);

		#else
		/**
		* Create an MD5 checksum of a given string
		* @param a Pool to allocate out of
		@@ -63,6 +76,8 @@ AP_DECLARE(char ) ap_md5contextTo64(apr_pool_t p, apr_md5_ctx_t *context);
		*/
		AP_DECLARE(char ) ap_md5digest(apr_pool_t p, apr_file_t *infile);

		#endif /ndef AP_FIPS /

		#ifdef __cplusplus
		}
		#endif