openssl/openssl-0.9.8j-kernel-fipsmode.patch

   1 diff -up openssl-0.9.8j/crypto/o_init.c.fipsmode openssl-0.9.8j/crypto/o_init.c
   2 --- openssl-0.9.8j/crypto/o_init.c.fipsmode     2008-11-05 19:36:36.000000000 +0100
   3 +++ openssl-0.9.8j/crypto/o_init.c      2009-01-14 17:57:39.000000000 +0100
   4 @@ -59,6 +59,45 @@
   5  #include <e_os.h>
   6  #include <openssl/err.h>
   7
   8 +#ifdef OPENSSL_FIPS
   9 +#include <sys/types.h>
  10 +#include <sys/stat.h>
  11 +#include <fcntl.h>
  12 +#include <unistd.h>
  13 +#include <errno.h>
  14 +#include <stdlib.h>
  15 +#include <openssl/fips.h>
  16 +#include <openssl/evp.h>
  17 +#include <openssl/rand.h>
  18 +
  19 +#define FIPS_MODE_SWITCH_FILE "/proc/sys/crypto/fips_enabled"
  20 +
  21 +static void init_fips_mode(void)
  22 +       {
  23 +       char buf[2] = "0";
  24 +       int fd;
  25 +
  26 +       if (getenv("OPENSSL_FORCE_FIPS_MODE") != NULL)
  27 +               {
  28 +               buf[0] = '1';
  29 +               }
  30 +       else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0)
  31 +               {
  32 +               while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR);
  33 +               close(fd);
  34 +               }
  35 +       /* Failure reading the fips mode switch file means just not
  36 +        * switching into FIPS mode. We would break too many things
  37 +        * otherwise.
  38 +        */
  39 +
  40 +       if (buf[0] == '1')
  41 +               {
  42 +               FIPS_mode_set(1);
  43 +               }
  44 +       }
  45 +#endif
  46 +
  47  /* Perform any essential OpenSSL initialization operations.
  48   * Currently only sets FIPS callbacks
  49   */
  50 @@ -73,11 +112,10 @@ void OPENSSL_init(void)
  51  #ifdef CRYPTO_MDEBUG
  52                 CRYPTO_malloc_debug_init();
  53  #endif
  54 -#ifdef OPENSSL_ENGINE
  55 +               init_fips_mode();
  56                 int_EVP_MD_init_engine_callbacks();
  57                 int_EVP_CIPHER_init_engine_callbacks();
  58                 int_RAND_init_engine_callbacks();
  59 -#endif
  60                 done = 1;
  61                 }
  62  #endif