From 70604635a44eecb3cb73303ed421e3006e4153b5 Mon Sep 17 00:00:00 2001
From: rcritten <>
Date: Fri, 16 May 2008 15:16:02 +0000
Subject: Make FIPS mode work. This fixes 2 problems:

1. In nss_init_SSLLibrary() the server config wasn't being set properly
   for each virtual server so FIPS wasn't getting turned on.
2. There seem to be a problem in NSS_Shutdown() that makes subsequent
   logins appear to succeed but they actually are skipped causing keys
   and certs to not be available.

Also switch an error message to a warning related to FIPS ciphers.
---
 nss_engine_init.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'nss_engine_init.c')

diff --git a/nss_engine_init.c b/nss_engine_init.c
index c83a4aa..c4e2d90 100644
--- a/nss_engine_init.c
+++ b/nss_engine_init.c
@@ -148,9 +148,10 @@ static void nss_init_SSLLibrary(server_rec *base_server)
     const char * ocspurl = NULL;
     const char * ocspname = NULL;
 
-    sc = mySrvConfig(base_server);
 
     for (s = base_server; s; s = s->next) {
+        sc = mySrvConfig(s);
+
         if (sc->fips == TRUE) {
             fipsenabled = TRUE;
         }
@@ -802,7 +803,7 @@ static void nss_init_ctx_cipher_suite(server_rec *s,
     if (mctx->sc->fips) {
         for (i=0; i<ciphernum; i++) {
             if (cipher_state[i] == PR_TRUE && fips_state[i] == PR_FALSE) {
-                ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+                ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
                     "Cipher %s is enabled but this is not a FIPS cipher, disabling.", ciphers_def[i].name);
                 cipher_state[i] = PR_FALSE;
             }
-- 
cgit