From 741719ca53f9da8629d3a2acf3a4570cfa6c2d11 Mon Sep 17 00:00:00 2001
From: Konstantin Pavlov <thresh@nginx.com>
Date: Fri, 20 May 2022 11:26:35 +0400
Subject: [PATCH] Added support for OpenSSL 3.0.

FIPS_mode() was removed from OpenSSL 3.0 so use
EVP_default_properties_is_fips_enabled instead.  However, at least
Fedora and RHEL 9 patched their openssl packages to provide FIPS_mode()
so check if it's not defined.

This was tested on:
- Ubuntu 22.04 openssl 3.0.2-0ubuntu1.1 FIPS disabled
- RHEL 8.6 openssl 1.1.1k-6.el8_5.x86_64 FIPS disabled and enabled.
- RHEL 9.0 openssl 3.0.1-23.el9_0.x86_64 FIPS disabled and enabled.
---
 ngx_core_fips_check_module.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ngx_core_fips_check_module.c b/ngx_core_fips_check_module.c
index 149f595..706725a 100644
--- a/ngx_core_fips_check_module.c
+++ b/ngx_core_fips_check_module.c
@@ -10,6 +10,10 @@
 
 #include <openssl/crypto.h>
 
+#if (OPENSSL_VERSION_NUMBER >= 0x30000000L && !defined FIPS_mode)
+# define FIPS_mode() EVP_default_properties_is_fips_enabled(NULL)
+#endif
+
 typedef enum {
     UNKNOWN,
     DISABLED,
-- 
2.30.1 (Apple Git-130)