Include FIPS mode in OpenSSL_version return value

[WillChilds-Klein]

Issues:

Resolves t/P138681213

Description of changes:

This backports PR 1419 to the 2022 FIPS branch. Confirmed that modifying crypto.c does not affect the FIPS module.

Call-outs:

• n/a

Testing:

• CI
• verified FIPS module hash is unchanged

Setup

$ git diff
diff --git a/util/fipstools/inject_hash/inject_hash.go b/util/fipstools/inject_hash/inject_hash.go
index e4905be6b..0ba118fb3 100644
--- a/util/fipstools/inject_hash/inject_hash.go
+++ b/util/fipstools/inject_hash/inject_hash.go
@@ -24,6 +24,7 @@ import (
        "debug/elf"
        "debug/macho"
        "encoding/binary"
+       "encoding/hex"
        "errors"
        "flag"
        "fmt"
@@ -390,7 +391,10 @@ func do(outPath, oInput string, arInput string, appleOS bool) error {
        } else {
                mac.Write(moduleText)
        }
+
        calculated := mac.Sum(nil)
+       fmt.Fprintf(os.Stdout, "CALCULATED MODULE HASH: %s\n", hex.EncodeToString(calculated[:]))
+       return nil

        // Replace the default hash value in the object with the calculated
        // value and write it out.

Before this PR

$ git show -q
commit d0c62be0b9083ffc20056649b0719c3990f553d0 (HEAD -> pr-1419-fips-backport)
Author: Will Childs-Klein <[email protected]>
Date:   Wed Jul 3 14:54:50 2024 +0000

    Revert "Include FIPS mode in OpenSSL_version return value (#1419)"

    This reverts commit 3f78067363523cc2aaaeeb31b75c450571cfcd56.

$ rm -rf build && cmake-build.sh && go run util/fipstools/inject_hash/inject_hash.go -in-object ./build/crypto/libcrypto.so
...
CALCULATED MODULE HASH: 02af10f6b9bbfe07a126c8c883e1be339f52a94ba3c69e6dad78605ad5ffcb5a

After this PR

$ git show -q
commit 3f78067363523cc2aaaeeb31b75c450571cfcd56 (HEAD -> pr-1419-fips-backport, origin/pr-1419-fips-backport)
Author: Will Childs-Klein <[email protected]>
Date:   Thu Feb 15 18:54:44 2024 -0500

    Include FIPS mode in OpenSSL_version return value (#1419)

    This change includes FIPS mode information in the return value of
    `OpenSSL_version(OPENSSL_VERSION)`. This will allow consumers of CPython (and
    likely other tools or language runtimes) to detect FIPS mode without calling to
    an AWS-LC-specific API, which would require either patching or forking the
    language or tool in question.

$ rm -rf build && cmake-build.sh && go run util/fipstools/inject_hash/inject_hash.go -in-object ./build/crypto/libcrypto.so
...
CALCULATED MODULE HASH: 02af10f6b9bbfe07a126c8c883e1be339f52a94ba3c69e6dad78605ad5ffcb5a

Ensure that Modifying Module Source Affects Hash

$ git diff
diff --git a/crypto/fipsmodule/sha/sha256.c b/crypto/fipsmodule/sha/sha256.c
index 38164535c..8f5a9b534 100644
--- a/crypto/fipsmodule/sha/sha256.c
+++ b/crypto/fipsmodule/sha/sha256.c
@@ -87,7 +87,7 @@ int SHA256_Init(SHA256_CTX *sha) {
   sha->h[3] = 0xa54ff53aUL;
   sha->h[4] = 0x510e527fUL;
   sha->h[5] = 0x9b05688cUL;
-  sha->h[6] = 0x1f83d9abUL;
+  sha->h[6] = 0x1f83d9acUL;
   sha->h[7] = 0x5be0cd19UL;
   sha->md_len = SHA256_DIGEST_LENGTH;
   return 1;
diff --git a/util/fipstools/inject_hash/inject_hash.go b/util/fipstools/inject_hash/inject_hash.go
index e4905be6b..0ba118fb3 100644
--- a/util/fipstools/inject_hash/inject_hash.go
+++ b/util/fipstools/inject_hash/inject_hash.go
@@ -24,6 +24,7 @@ import (
        "debug/elf"
        "debug/macho"
        "encoding/binary"
+       "encoding/hex"
        "errors"
        "flag"
        "fmt"
@@ -390,7 +391,10 @@ func do(outPath, oInput string, arInput string, appleOS bool) error {
        } else {
                mac.Write(moduleText)
        }
+
        calculated := mac.Sum(nil)
+       fmt.Fprintf(os.Stdout, "CALCULATED MODULE HASH: %s\n", hex.EncodeToString(calculated[:]))
+       return nil

        // Replace the default hash value in the object with the calculated
        // value and write it out.

$ rm -rf build && cmake-build.sh && go run util/fipstools/inject_hash/inject_hash.go -in-object ./build/crypto/libcrypto.so
...
CALCULATED MODULE HASH: 3fe78abfc13f00d09fd2b2483e4dbe61c99b4119d369b2d40044d2965b8ea944

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.