aboutsummaryrefslogtreecommitdiffstats
path: root/lib/crypto/c_src/Makefile.in
diff options
context:
space:
mode:
authorDániel Szoboszlay <[email protected]>2014-04-28 17:20:24 +0200
committerMagnus Henoch <[email protected]>2016-09-28 15:08:31 +0100
commit0a1feff48388c8430f5eebd1531f769605601fab (patch)
treee21885594ce82dac0a7327a6222b959efbc4f4be /lib/crypto/c_src/Makefile.in
parent867ef8aab0a32d76e6e66b317ef39c75e84e177e (diff)
downloadotp-0a1feff48388c8430f5eebd1531f769605601fab.tar.gz
otp-0a1feff48388c8430f5eebd1531f769605601fab.tar.bz2
otp-0a1feff48388c8430f5eebd1531f769605601fab.zip
Support using OpenSSL in FIPS mode
FIPS mode support needs to be enabled at compile time, by configuring Erlang/OTP with --enable-fips option. In FIPS mode the non-FIPS algorithms are disabled and raise error notsup. The supported protocols list is properly updated in FIPS mode to advertise only the enabled protocols. FIPS mode is off by default even if Erlang/OTP was built with FIPS support. It needs to be turned on at runtime. The official approach is to set the fips_mode application environment parameter of the crypto application to true. This would turn FIPS mode on when the NIF is loaded and would prevent loading the module on error. Another method is provided via the crypto:enable_fips_mode/1 function, but it is not recommended to be used in production, as it won't prevent the use of the crypto module in case of an error, and would risk OpenSSL crashing the emulator. It is very useful for test suites however that need to check both validated and non-validated functionality. This commit is based on commit 00b3a04d17a653b4abddeebd6dd8a2c38df532d0.
Diffstat (limited to 'lib/crypto/c_src/Makefile.in')
-rw-r--r--lib/crypto/c_src/Makefile.in2
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/crypto/c_src/Makefile.in b/lib/crypto/c_src/Makefile.in
index c62f25b3ee..1d1abca08e 100644
--- a/lib/crypto/c_src/Makefile.in
+++ b/lib/crypto/c_src/Makefile.in
@@ -43,9 +43,11 @@ SSL_LIBDIR = @SSL_LIBDIR@
SSL_INCLUDE = @SSL_INCLUDE@
SSL_CRYPTO_LIBNAME = @SSL_CRYPTO_LIBNAME@
SSL_SSL_LIBNAME = @SSL_SSL_LIBNAME@
+SSL_DEFINE = @SSL_DEFINE@
INCLUDES = $(SSL_INCLUDE) $(DED_INCLUDES)
+CFLAGS += $(SSL_DEFINE)
ifeq ($(TYPE),debug)
TYPEMARKER = .debug