mirror of
https://github.com/libp2p/go-openssl.git
synced 2024-12-27 23:40:18 +08:00
46d44e1dfd
* Fix build with OpenSSL 3.0 - FIPS_mode_set() does not exist in OpenSSL 3.0 [1] - X509_check_* functions declarated in openssl/x509v3.h instead of openssl/x509.h [2] - X509_chack_* functions have const char arg inserad of const unsigned char [2] - skip MD4 tests if it is unsupported by OpenSSL - the patch does not change behavior under OpenSSL version != 3 - the patch just fixes build under OpenSSL 3.0 and doesn't update deprecated code or behavior 1. https://wiki.openssl.org/index.php/OpenSSL_3.0#Upgrading_from_the_OpenSSL_2.0_FIPS_Object_Module 2. https://www.openssl.org/docs/man3.0/man3/X509_check_host.html * Add Ubuntu 22.04 runner to GitHub Actions go test workflow * Fix flaky tests on Ubuntu 22.04 It is necessary to handle OpenSSL errors very carefully. Otherwise, errors may appear in unexpected places. For example, we didn't catch an error from EVP_DigestInit_ex() and it appears sometimes in conn.go: func (c *Conn) getErrorHandler(rv C.int, errno error) func() error { errcode := C.SSL_get_error(c.ssl, rv) // <- here
53 lines
1.3 KiB
Go
53 lines
1.3 KiB
Go
// Copyright (C) 2017. See AUTHORS.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package openssl
|
|
|
|
/*
|
|
#include <openssl/ssl.h>
|
|
|
|
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
|
|
int FIPS_mode_set(int ONOFF) {
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
*/
|
|
import "C"
|
|
import "errors"
|
|
import "runtime"
|
|
|
|
// FIPSModeSet enables a FIPS 140-2 validated mode of operation.
|
|
// https://wiki.openssl.org/index.php/FIPS_mode_set()
|
|
// This call has been deleted from OpenSSL 3.0.
|
|
func FIPSModeSet(mode bool) error {
|
|
runtime.LockOSThread()
|
|
defer runtime.UnlockOSThread()
|
|
|
|
if C.OPENSSL_VERSION_NUMBER >= 0x30000000 {
|
|
return errors.New("FIPS_mode_set() has been deleted from OpenSSL 3.0")
|
|
}
|
|
|
|
var r C.int
|
|
if mode {
|
|
r = C.FIPS_mode_set(1)
|
|
} else {
|
|
r = C.FIPS_mode_set(0)
|
|
}
|
|
if r != 1 {
|
|
return errorFromErrorQueue()
|
|
}
|
|
return nil
|
|
}
|