Hello,
I have a question regarding the logic around SSLFIPS on/off. After
https://svn.apache.org/viewvc?view=revision&revision=1853197
I think SSLFIPS off will not work as expected.
#ifdef HAVE_FIPS
if (sc->fips) {
if (!FIPS_mode()) {
if (FIPS_mode_set(1)) {
ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s, APLOGNO(01884)
"Operating in SSL FIPS mode");
apr_pool_cleanup_register(p, NULL, modssl_fips_cleanup,
apr_pool_cleanup_null);
}
else {
ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01885)
"FIPS mode failed");
ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s);
return ssl_die(s);
}
}
}
else {
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01886)
"SSL FIPS mode disabled");
}
#endif
In case sc->fips is FALSE (SSLFIPS off or not set), the
FIPS_mode_set() is not called at all and the fips mode is untouched.
If I understand correctly, it can be ON as it is on my system when a
binary starts up.
Question also is, whether the FIPS mode should not stand untouched
when SSLFIPS is not specified at all (not intend to turning it off).
Perhaps even more basic concern, what is actually the purpose
(usecase) or SSLFIPS directive? In other words, in case you have a
FIPS system, why you would like to disable it in httpd?
Unfortunately I do not know much about FIPS, so perhaps I missed
something basic but important, apologize in advance :).
Bye,
Petr
--
Have a lot of fun!
