Why enabling OpenSSL FIPS ?

[stac47]

Hello,
I tried to build this library against OpenSSL v3. Now, FIPS certified algorithms were moved to dedicated 'provider' and the function FIPS_mode_set has been removed.
The following lines in librabbitmq/amqp_openssl.c in fact do not seem good:

#ifndef LIBRESSL_VERSION_NUMBER
  FIPS_mode_set(0);
#endif

In fact, the effects of such a call has changed across the OpenSSL revision:

• 1.0.2 series was the only on that were FIPS-capable. But with some constraints amongst them it could not be dynamically loaded (no shared libraries are available when you build openssl with fips). See here
• 1.1.x series is not FIPS-capable. They let the API which does nothing as you can see in openssl branch 1.1.1 (crypto/o_fips.c):

int FIPS_mode_set(int r)
{
    if (r == 0)
        return 1;
    CRYPTOerr(CRYPTO_F_FIPS_MODE_SET, CRYPTO_R_FIPS_MODE_NOT_SUPPORTED);
    return 0;
}

• 3.x series have finally removed this deprecated API.

To me, those lines should be removed, but as I have no background on this library, there is perhaps a reason why this was added. But reading the commit 6726405, it is just to deinit openssl, but probably useless as FIPS mode has never been enabled.
Regards,

[alanxz]

You are correct in that FIPS mode has never been used in rabbitmq-c, this was cargo-culted from somewhere else when figuring out how to do this (I think it came from the OpenSSL wiki).

I believe this can be safely removed.