<div>Hello,</div><div><br></div><div>I am having difficulting when running stunnel in FIPS mode and using a SIGHUP to get stunnel to re-read it's configuration file (for instance if I've changed a port # or IP address for one of the connections). This causes stunnel to call the SSL routine FIPS_mode_set() a second time after receiving the SIGHUP, which in turn attempts to reinitialize SSL. Unfortunately, OpenSSL does not support calling FIPS_mode_set(1) more than once. The initialization of SSL becomes incomplete as a result of the 2nd call and subsequent attempts to use stunnel to establish encrypted connections fail.</div>
<div><br></div><div>Does anyone have any suggestions on how I can make this work (besides killing and restarting stunnel)?</div><div><br></div><div>If not, I have a proposed fix (and there are multiple ways that this could be addressed). Anyway, my suggestion is to add the following two lines to the ssl_configure() function (found in the file "ssl.c"), right before the current FIPS_mode_set() routine is called:</div>
<div><br></div><div> FIPS_mode_set(0);</div><div> RAND_set_rand_method(NULL);</div><div><br></div><div>The function currently looks like:</div><div><br></div><div> int ssl_configure(void) { /* configure global SSL settings */</div>
<div> #ifdef USE_FIPS</div><div> if(!FIPS_mode_set(global_options.option.fips)) {</div><div> ERR_load_crypto_strings();</div><div> sslerror("FIPS_mode_set");</div><div> return 0;</div>
<div> }</div><div> s_log(LOG_NOTICE, "FIPS mode %s",</div><div> global_options.option.fips ? "enabled" : "disabled");</div><div> #endif /* USE_FIPS */</div><div> :</div>
<div> :</div><div> }<span class="Apple-tab-span" style="white-space:pre"> </span></div><div><br></div><div>With the suggested fix, it would look as follows:</div><div><br></div><div> int ssl_configure(void) { /* configure global SSL settings */</div>
<div> #ifdef USE_FIPS</div><div> FIPS_mode_set(0);</div><div> RAND_set_rand_method(NULL);</div><div> if(!FIPS_mode_set(global_options.option.fips)) {</div><div> ERR_load_crypto_strings();</div>
<div> sslerror("FIPS_mode_set");</div><div> return 0;</div><div> }</div><div> s_log(LOG_NOTICE, "FIPS mode %s",</div><div> global_options.option.fips ? "enabled" : "disabled");</div>
<div> #endif /* USE_FIPS */</div><div> :</div><div> :</div><div> }</div><div><br></div><div>Does the above seem reasonable. Could this change, or some other modification which would support using SIGHUP with FIPS, be considered for a future stunnel update?</div>
<div><br></div><div>Thanks for your help.</div>