Commit e38d2c0d authored by Yann Ylavic's avatar Yann Ylavic
Browse files

mod_ssl: unset FIPS mode only if we set it. 

If FIPS mode is set by default per openssl lib/module, we should not
unset it on restart or it might never be set again.

PR 63136


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1853133 13f79535-47bb-0310-9956-ffa450edef68
parent a7173211

modules/ssl/mod_ssl.c

+0 −3
Original line number Diff line number Diff line
@@ -348,9 +348,6 @@ static apr_status_t ssl_cleanup_pre_config(void *data) 
    /*

     * Try to kill the internals of the SSL library.

     */

#ifdef HAVE_FIPS

    FIPS_mode_set(0);

#endif

    /* Corresponds to OBJ_create()s */

    OBJ_cleanup();

    /* Corresponds to OPENSSL_load_builtin_modules() */

modules/ssl/ssl_engine_init.c

+11 −1
Original line number Diff line number Diff line
@@ -190,6 +190,14 @@ int ssl_is_challenge(conn_rec *c, const char *servername, 
    return 0;

}



#ifdef HAVE_FIPS

static apr_status_t modssl_fips_cleanup(void *data)

{

    FIPS_mode_set(0);

    return APR_SUCCESS;

}

#endif



/*

 *  Per-module initialization

 */
@@ -319,6 +327,8 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog, 
            if (FIPS_mode_set(1)) {

                ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s, APLOGNO(01884)

                             "Operating in SSL FIPS mode");

                apr_pool_cleanup_register(p, NULL, modssl_fips_cleanup,

                                          apr_pool_cleanup_null);

            }

            else {

                ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01885) "FIPS mode failed");