Feature/opensslv3 compat

example/client-brski/estclient-brski.c

@@ -388,7 +388,7 @@ int main (int argc, char **argv)
                 break;
             case 'f':
                 /* Turn FIPS on if requested and exit if failure */
-                set_fips_return = FIPS_mode_set(1);
+                set_fips_return = est_enable_fips(1);
                 if (!set_fips_return) {
                     printf("\nERROR setting FIPS MODE ON ...\n");
                     ERR_load_crypto_strings();

example/client/estclient.c

@@ -1280,7 +1280,7 @@ int main (int argc, char **argv)
                 break;
             case 'f':
                 /* Turn FIPS on if requested and exit if failure */
-                set_fips_return = FIPS_mode_set(1);
+                set_fips_return = est_enable_fips(1);
                 if (!set_fips_return) {
                     printf("\nERROR setting FIPS MODE ON ...\n");
                     ERR_load_crypto_strings();

example/proxy/estproxy.c

@@ -593,7 +593,7 @@ int main (int argc, char **argv)
             /*
              * Turn FIPS on if user requested it and exit if failure
              */
-            set_fips_return = FIPS_mode_set(1);
+            set_fips_return = est_enable_fips(1);
             if (set_fips_return != 1) {
                 set_fips_error = ERR_get_error();
                 printf("\nERROR WHILE SETTING FIPS MODE ON exiting ....\n");

example/server/estserver.c

@@ -2285,7 +2285,7 @@ int main (int argc, char **argv)
             /* turn FIPS on if user requested it
              * and exit if failure.
              */
-            set_fips_return = FIPS_mode_set(1);
+            set_fips_return = est_enable_fips(1);
             if (set_fips_return != 1) {
                 set_fips_error = ERR_get_error();
                 printf("\nERROR WHILE SETTING FIPS MODE ON exiting ....\n");

java/jni/client.c

@@ -179,7 +179,7 @@ static int jni_est_client_X509_REQ_sign (X509_REQ *x, EVP_PKEY *pkey, const EVP_
  */
 JNIEXPORT jint JNICALL Java_com_cisco_c3m_est_ESTClient_enable_1fips(
 		JNIEnv *env, jclass obj) {
-	if (!FIPS_mode() && !FIPS_mode_set(1)) {
+	if (!est_is_fips_enabled() && !est_enable_fips(1)) {
 		ERR_print_errors_fp(stderr);
 		return -1;
 	} else {

src/est/est.c

@@ -42,7 +42,9 @@
 #include <DbgHelp.h>
 #endif  /* DISABLE_BACKTRACE*/
 #endif /* WIN32*/
-
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+#include <openssl/rand.h>
 #ifndef ENABLE_CLIENT_ONLY
 static char hex_chpw[] = {0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 
 			  0xF7, 0x0D, 0x01, 0x09, 0x07};

src/est/est_client.c

@@ -40,6 +40,7 @@
 #include <openssl/ssl.h>
 #include <openssl/cms.h>
 #include <openssl/rand.h>
+#include <openssl/crypto.h>
 #include "est.h"
 #include "est_locl.h"
 #include "est_ossl_util.h"
@@ -3182,7 +3183,7 @@ EST_ERROR est_client_enroll_internal (EST_CTX *ctx, char *cn, int *pkcs7_len, in
          * HTTPS digest mode requires the use of MD5.  Make sure we're not
          * in FIPS mode and can use MD5
          */
-        if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+        if (ctx->auth_mode == AUTH_DIGEST && (est_is_fips_enabled())){
             EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
             rv = EST_ERR_BAD_MODE;
             goto err;
@@ -3593,7 +3594,7 @@ EST_ERROR est_client_reenroll (EST_CTX *ctx, X509 *cert, int *pkcs7_len, EVP_PKE
          * HTTPS digest mode requires the use of MD5.  Make sure we're not
          * in FIPS mode and can use MD5
          */
-        if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+        if (ctx->auth_mode == AUTH_DIGEST && (est_is_fips_enabled())){
 	    EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
 	    rv = EST_ERR_BAD_MODE;
             goto err;
@@ -3679,7 +3680,7 @@ static EST_ERROR est_client_enroll_csr_internal (EST_CTX *ctx, X509_REQ *csr, in
          * HTTPS digest mode requires the use of MD5.  Make sure we're not
          * in FIPS mode and can use MD5
          */
-        if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+        if (ctx->auth_mode == AUTH_DIGEST && (est_is_fips_enabled())){
             EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
             rv = EST_ERR_BAD_MODE;
             goto err;
@@ -5871,7 +5872,7 @@ static EST_ERROR est_client_brski_send_get_voucher (EST_CTX *ctx, int *cacert_le
          * HTTPS digest mode requires the use of MD5.  Make sure we're not
          * in FIPS mode and can use MD5
          */
-        if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+        if (ctx->auth_mode == AUTH_DIGEST && (est_is_fips_enabled())){
             EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
             rv = EST_ERR_BAD_MODE;
             goto err;
@@ -6365,7 +6366,7 @@ EST_ERROR est_client_brski_send_voucher_status (EST_CTX *ctx, EST_BRSKI_STATUS_V
          * HTTPS digest mode requires the use of MD5.  Make sure we're not
          * in FIPS mode and can use MD5
          */
-        if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+        if (ctx->auth_mode == AUTH_DIGEST && (est_is_fips_enabled())){
             EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
             rv = EST_ERR_BAD_MODE;
             goto err;
@@ -6534,7 +6535,7 @@ EST_ERROR est_client_brski_send_enroll_status (EST_CTX *ctx, EST_BRSKI_STATUS_VA
          * HTTPS digest mode requires the use of MD5.  Make sure we're not
          * in FIPS mode and can use MD5
          */
-        if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+        if (ctx->auth_mode == AUTH_DIGEST && (est_is_fips_enabled())){
             EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
             rv = EST_ERR_BAD_MODE;
             goto err;

src/est/est_ossl_util.c

@@ -500,3 +500,21 @@ char *est_find_ser_num_in_subj(X509 *cert)
     return(ser_num_str);
 }
 #endif
+
+int est_is_fips_enabled()
+{
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+    return EVP_default_properties_is_fips_enabled(NULL);
+#else
+    return FIPS_mode();
+#endif
+}
+
+int est_enable_fips(int enable)
+{
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	return EVP_default_properties_enable_fips(NULL, enable);
+#else
+	return FIPS_mode_set(enable);
+#endif
+}

src/est/est_ossl_util.h

@@ -44,4 +44,6 @@ LIBEST_TEST_API void ossl_dump_ssl_errors(void);
 EST_ERROR ossl_init_cert_store(X509_STORE *store,
                                unsigned char *raw1, int size1);
 
+int est_is_fips_enabled();
+int est_enable_fips(int);
 #endif

src/est/est_server.c

@@ -3355,7 +3355,7 @@ EST_ERROR est_server_set_auth_mode (EST_CTX *ctx, EST_HTTP_AUTH_MODE amode)
         /*
          * Since HTTP digest auth uses MD5, make sure we're not in FIPS mode.
          */
-	if (FIPS_mode()) {
+	if (est_is_fips_enabled()) {
 	    EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
 	    return (EST_ERR_BAD_MODE);
 	}

src/est/est_server_http.c

@@ -42,6 +42,8 @@
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 #include <openssl/x509v3.h>
+#include <openssl/crypto.h>
+#include <openssl/rand.h>
 #if defined(_WIN32)
 #define _CRT_SECURE_NO_WARNINGS // Disable deprecation warning in VS2005
 #else

test/UT/US1864/us1864.c

@@ -218,12 +218,12 @@ static void us1864_test1 (void)
     /*
      * Make sure we don't allow DIGEST mode when in FIPS mode
      */
-    if (!FIPS_mode_set(1)) {
+    if (!est_enable_fips(1)) {
         printf("FIPS mode not supported, skipping test to prevent digest auth when in FIPS mode");
     } else {
         est_rv = est_server_set_auth_mode(ctx, AUTH_DIGEST);
         CU_ASSERT(est_rv == EST_ERR_BAD_MODE);
-        FIPS_mode_set(0);
+        est_enable_fips(0);
     }
 
     X509_free(x);