Bug 2083879

Summary:	-Wimplicit-function-declaration when compiling FIPS_mode() function with clang
Product:	Red Hat Enterprise Linux 9	Reporter:	Tom Stellard <tstellar>
Component:	openssl	Assignee:	Dmitry Belyavskiy <dbelyavs>
Status:	CLOSED ERRATA	QA Contact:	Alicja Kario <hkario>
Severity:	low	Docs Contact:
Priority:	low
Version:	9.1	CC:	cllang, crypto-team, dbelyavs, extras-qa, hkario, mspacek, mturk, sahana, sam, sgallagh, tm
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openssl-3.0.7-2.el9	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:	2083876	Environment:
Last Closed:	2023-05-09 08:20:36 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2083876
Bug Blocks:

Description Tom Stellard 2022-05-10 21:54:34 UTC

+++ This bug was initially created as a clone of Bug #2083876 +++

Description of problem:
The new FIPS_mode() macros expands to EVP_default_properties_is_fips_enabled() which has a declaration in a different header file.  This causes clang to emit the -Wimplicit-function-declaration warning when compiling applications that use the macro.

Version-Release number of selected component (if applicable):
openssl-3.0.2-5.fc36

How reproducible:
Always

Steps to Reproduce:

$ dnf install clang openssl-devel
$ cat fips-clang.c
#include <stdio.h>
#include <openssl/fips.h>

int main(int argc, char **argv) {
  if (FIPS_mode())
    printf("FIPS mode enabled\n");
  return 0;
}

$ clang -Werror clang-fips.c 
clang-fips.c:5:7: error: implicit declaration of function 'EVP_default_properties_is_fips_enabled' is invalid in C99 [-Werror,-Wimplicit-function-declaration]
  if (FIPS_mode())
      ^
/usr/include/openssl/fips.h:20:22: note: expanded from macro 'FIPS_mode'
# define FIPS_mode() EVP_default_properties_is_fips_enabled(NULL)
                     ^
1 error generated.


Expected results:
Program compiles successfully.

Comment 7 Stephen Gallagher 2022-12-02 15:53:17 UTC

There's one other place that should be fixed for compatibility: previously, the <openssl/crypto.h> header included <openssl/fips.h>. Packages that were (perhaps unknowingly) relying on this implicit behavior are now broken. (For example, my sscg package compiled fine on 3.0.5 and fails with `../src/dhparams.c:234:8: error: implicit declaration of function ‘FIPS_mode’ [-Werror=implicit-function-declaration]` on 3.0.7.

Comment 8 Dmitry Belyavskiy 2022-12-02 15:59:29 UTC

Unfortunately, including <openssl/fips.h> into the <openssl/crypto.h> seems to be a mistake. It causes a circular dependency: we need to include <openssl/evp.h> before <openssl/fips.h>, but evp.h requires some definitions from crypto.h

Comment 9 Tomáš Mráz 2022-12-05 11:20:13 UTC

Yeah, IMO, given the <openssl/fips.h> is Red Hat specific thing, it is better to bite the bullet and explicitly include it in applications code instead of depending on it being implicitly included from some other upstream header file.

Comment 11 Stephen Gallagher 2022-12-07 20:06:31 UTC

(In reply to Stephen Gallagher from comment #7)
> There's one other place that should be fixed for compatibility: previously,
> the <openssl/crypto.h> header included <openssl/fips.h>. Packages that were
> (perhaps unknowingly) relying on this implicit behavior are now broken. (For
> example, my sscg package compiled fine on 3.0.5 and fails with
> `../src/dhparams.c:234:8: error: implicit declaration of function
> ‘FIPS_mode’ [-Werror=implicit-function-declaration]` on 3.0.7.

For the record, I've patched my sscg package to call EVP_default_properties_is_fips_enabled(NULL) instead of FIPS_mode() on OpenSSL 3.

Comment 14 errata-xmlrpc 2023-05-09 08:20:36 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Low: openssl security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:2523