diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2013-09-27 09:11:55 +0200 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2013-09-27 09:24:03 +0200 |
| commit | c8f34ba7b604e063750e72e894d3b203988caea0 (patch) | |
| tree | dc804516c9c0b226a27007042f23daefebf94f44 /src/libstrongswan/plugins/openssl/openssl_plugin.c | |
| parent | e4d63cfae795ee9584e0292eece31340ad0ea926 (diff) | |
| download | strongswan-c8f34ba7b604e063750e72e894d3b203988caea0.tar.bz2 strongswan-c8f34ba7b604e063750e72e894d3b203988caea0.tar.xz | |
openssl: Properly log FIPS mode when enabled via openssl.conf
Enabling FIPS mode twice will fail, so if it is enabled in openssl.conf
it should be disabled in strongswan.conf (or the other way around).
Either way, we should log whether FIPS mode is enabled or not.
References #412.
Diffstat (limited to 'src/libstrongswan/plugins/openssl/openssl_plugin.c')
| -rw-r--r-- | src/libstrongswan/plugins/openssl/openssl_plugin.c | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/src/libstrongswan/plugins/openssl/openssl_plugin.c b/src/libstrongswan/plugins/openssl/openssl_plugin.c index fb34a6858..b6d699de2 100644 --- a/src/libstrongswan/plugins/openssl/openssl_plugin.c +++ b/src/libstrongswan/plugins/openssl/openssl_plugin.c @@ -520,13 +520,14 @@ plugin_t *openssl_plugin_create() fips_mode = lib->settings->get_int(lib->settings, "libstrongswan.plugins.openssl.fips_mode", FIPS_MODE); #ifdef OPENSSL_FIPS - if (!FIPS_mode_set(fips_mode)) + if (fips_mode) { - DBG1(DBG_LIB, "unable to set openssl FIPS mode(%d)", fips_mode); - return NULL; + if (!FIPS_mode_set(fips_mode)) + { + DBG1(DBG_LIB, "unable to set openssl FIPS mode(%d)", fips_mode); + return NULL; + } } - DBG1(DBG_LIB, "openssl FIPS mode(%d) - %sabled ",fips_mode, - fips_mode ? "en" : "dis"); #else if (fips_mode) { @@ -550,6 +551,13 @@ plugin_t *openssl_plugin_create() OPENSSL_config(NULL); OpenSSL_add_all_algorithms(); +#ifdef OPENSSL_FIPS + /* we do this here as it may have been enabled via openssl.conf */ + fips_mode = FIPS_mode(); + DBG1(DBG_LIB, "openssl FIPS mode(%d) - %sabled ", fips_mode, + fips_mode ? "en" : "dis"); +#endif /* OPENSSL_FIPS */ + #ifndef OPENSSL_NO_ENGINE /* activate support for hardware accelerators */ ENGINE_load_builtin_engines(); |