www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-07 04:02:58 +03:00
Code Activity

Introduce SSLFIPS directive to support OpenSSL FIPS_mode; permits all

Browse Source 
builds of mod_ssl to use 'SSLFIPS off' for portability, but the proper
build of openssl is required for 'SSLFIPS on'.  

PR: 46270  
Submitted by: Dr Stephen Henson <steve openssl.org>, wrowe



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@925980 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
William A. Rowe Jr
2010-03-22 06:53:41 +00:00
parent 3e862e7f90
commit 7eb4e714ae
7 changed files with 113 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
modules/ssl/ssl_engine_init.c
View File

@@ -79,12 +79,25 @@ static int ssl_tmp_key_init_rsa(server_rec *s,
{
SSLModConfigRec *mc = myModConfig(s);
#ifdef HAVE_FIPS
if (FIPS_mode() && bits < 1024) {
mc->pTmpKeys[idx] = NULL;
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
"Init: Skipping generating temporary "
"%d bit RSA private key in FIPS mode", bits);
return OK;
}
#endif
if (!(mc->pTmpKeys[idx] =
RSA_generate_key(bits, RSA_F4, NULL, NULL)))
{
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
"Init: Failed to generate temporary "
"%d bit RSA private key", bits);
ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, s);
return !OK;
}
@@ -96,6 +109,18 @@ static int ssl_tmp_key_init_dh(server_rec *s,
{
SSLModConfigRec *mc = myModConfig(s);
#ifdef HAVE_FIPS
if (FIPS_mode() && bits < 1024) {
mc->pTmpKeys[idx] = NULL;
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
"Init: Skipping generating temporary "
"%d bit DH parameters in FIPS mode", bits);
return OK;
}
#endif
if (!(mc->pTmpKeys[idx] =
ssl_dh_GetTmpParam(bits)))
{
@@ -231,6 +256,26 @@ int ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
*/
ssl_rand_seed(base_server, ptemp, SSL_RSCTX_STARTUP, "Init: ");
#ifdef HAVE_FIPS
if(sc->fips) {
if (!FIPS_mode())
if (FIPS_mode_set(1)) {
ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s,
"Operating in SSL FIPS mode");
}
else {
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, "FIPS mode failed");
ssl_log_ssl_error(APLOG_MARK, APLOG_EMERG, s);
ssl_die();
}
}
}
else {
ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s,
"SSL FIPS mode disabled");
}
#endif
/*
* read server private keys/public certs into memory.
* decrypting any encrypted keys via configured SSLPassPhraseDialogs