TS-3576: Remove the need for FIPS locking for OpenSSL
Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/d41e96fa Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/d41e96fa Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/d41e96fa Branch: refs/heads/master Commit: d41e96fafb097c0918c7c57728adf1afd08f3e91 Parents: ba1d6f7 Author: Bryan Call <bc...@apache.org> Authored: Thu Apr 30 18:42:30 2015 -0700 Committer: Bryan Call <bc...@apache.org> Committed: Thu Apr 30 18:44:45 2015 -0700 ---------------------------------------------------------------------- iocore/net/SSLUtils.cc | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/trafficserver/blob/d41e96fa/iocore/net/SSLUtils.cc ---------------------------------------------------------------------- diff --git a/iocore/net/SSLUtils.cc b/iocore/net/SSLUtils.cc index 2fae482..0b73244 100644 --- a/iocore/net/SSLUtils.cc +++ b/iocore/net/SSLUtils.cc @@ -137,10 +137,17 @@ SSL_pthreads_thread_id() } static void -SSL_locking_callback(int mode, int type, const char * /* file ATS_UNUSED */, int /* line ATS_UNUSED */) +SSL_locking_callback(int mode, int type, const char *file, int line) { + Debug("ssl_lock", "file: %s line: %d type: %d", file, line, type); ink_assert(type < CRYPTO_num_locks()); +#ifdef OPENSSL_FIPS + if (type == CRYPTO_LOCK_FIPS || type == CRYPTO_LOCK_FIPS2) { + return; + } +#endif + if (mode & CRYPTO_LOCK) { pthread_mutex_lock(&mutex_buf[type]); } else if (mode & CRYPTO_UNLOCK) { @@ -151,6 +158,7 @@ SSL_locking_callback(int mode, int type, const char * /* file ATS_UNUSED */, int } } + static bool SSL_CTX_add_extra_chain_cert_file(SSL_CTX *ctx, const char *chainfile) { @@ -757,6 +765,12 @@ SSLInitializeLibrary() SSL_load_error_strings(); SSL_library_init(); +#ifdef OPENSSL_FIPS + int mode = FIPS_mode(); + FIPS_mode_set(mode); + Debug("ssl", "FIPS_mode: %d", mode); +#endif + mutex_buf = (pthread_mutex_t *)OPENSSL_malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t)); for (int i = 0; i < CRYPTO_num_locks(); i++) {
