|
 |
c4366c |
diff -up openssl-fips-0.9.8e/crypto/o_init.c.fipsmode openssl-fips-0.9.8e/crypto/o_init.c
|
|
|
c4366c |
--- openssl-fips-0.9.8e/crypto/o_init.c.fipsmode 2007-07-01 02:07:22.000000000 +0200
|
|
|
c4366c |
+++ openssl-fips-0.9.8e/crypto/o_init.c 2009-04-15 13:48:51.000000000 +0200
|
|
|
c4366c |
@@ -59,6 +59,45 @@
|
|
|
c4366c |
#include <e_os.h>
|
|
|
c4366c |
#include <openssl/err.h>
|
|
|
c4366c |
|
|
|
c4366c |
+#ifdef OPENSSL_FIPS
|
|
|
c4366c |
+#include <sys/types.h>
|
|
|
c4366c |
+#include <sys/stat.h>
|
|
|
c4366c |
+#include <fcntl.h>
|
|
|
c4366c |
+#include <unistd.h>
|
|
|
c4366c |
+#include <errno.h>
|
|
|
c4366c |
+#include <stdlib.h>
|
|
|
c4366c |
+#include <openssl/fips.h>
|
|
|
c4366c |
+#include <openssl/evp.h>
|
|
|
c4366c |
+#include <openssl/rand.h>
|
|
|
c4366c |
+
|
|
|
c4366c |
+#define FIPS_MODE_SWITCH_FILE "/proc/sys/crypto/fips_enabled"
|
|
|
c4366c |
+
|
|
|
c4366c |
+static void init_fips_mode(void)
|
|
|
c4366c |
+ {
|
|
|
c4366c |
+ char buf[2] = "0";
|
|
|
c4366c |
+ int fd;
|
|
|
c4366c |
+
|
|
|
c4366c |
+ if (getenv("OPENSSL_FORCE_FIPS_MODE") != NULL)
|
|
|
c4366c |
+ {
|
|
|
c4366c |
+ buf[0] = '1';
|
|
|
c4366c |
+ }
|
|
|
c4366c |
+ else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0)
|
|
|
c4366c |
+ {
|
|
|
c4366c |
+ while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR);
|
|
|
c4366c |
+ close(fd);
|
|
|
c4366c |
+ }
|
|
|
c4366c |
+ /* Failure reading the fips mode switch file means just not
|
|
|
c4366c |
+ * switching into FIPS mode. We would break too many things
|
|
|
c4366c |
+ * otherwise.
|
|
|
c4366c |
+ */
|
|
|
c4366c |
+
|
|
|
c4366c |
+ if (buf[0] == '1')
|
|
|
c4366c |
+ {
|
|
|
c4366c |
+ FIPS_mode_set(1);
|
|
|
c4366c |
+ }
|
|
|
c4366c |
+ }
|
|
|
c4366c |
+#endif
|
|
|
c4366c |
+
|
|
|
c4366c |
/* Perform any essential OpenSSL initialization operations.
|
|
|
c4366c |
* Currently only sets FIPS callbacks
|
|
|
c4366c |
*/
|
|
|
c4366c |
@@ -73,11 +112,10 @@ void OPENSSL_init(void)
|
|
|
c4366c |
#ifdef CRYPTO_MDEBUG
|
|
|
c4366c |
CRYPTO_malloc_debug_init();
|
|
|
c4366c |
#endif
|
|
|
c4366c |
-#ifdef OPENSSL_ENGINE
|
|
|
c4366c |
+ init_fips_mode();
|
|
|
c4366c |
int_EVP_MD_init_engine_callbacks();
|
|
|
c4366c |
int_EVP_CIPHER_init_engine_callbacks();
|
|
|
c4366c |
int_RAND_init_engine_callbacks();
|
|
|
c4366c |
-#endif
|
|
|
c4366c |
done = 1;
|
|
|
c4366c |
}
|
|
|
c4366c |
#endif
|
|
|
c4366c |
diff -up openssl-fips-0.9.8e/ssl/ssl_algs.c.fipsmode openssl-fips-0.9.8e/ssl/ssl_algs.c
|
|
|
c4366c |
--- openssl-fips-0.9.8e/ssl/ssl_algs.c.fipsmode 2007-04-24 13:30:48.000000000 +0200
|
|
|
c4366c |
+++ openssl-fips-0.9.8e/ssl/ssl_algs.c 2009-04-15 14:09:42.000000000 +0200
|
|
|
c4366c |
@@ -64,6 +64,8 @@
|
|
|
c4366c |
int SSL_library_init(void)
|
|
|
c4366c |
{
|
|
|
c4366c |
|
|
|
c4366c |
+ OPENSSL_init();
|
|
|
c4366c |
+
|
|
|
c4366c |
#ifndef OPENSSL_NO_DES
|
|
|
c4366c |
EVP_add_cipher(EVP_des_cbc());
|
|
|
c4366c |
EVP_add_cipher(EVP_des_ede3_cbc());
|