From 2c2c6a460ae8cc655df83c8964595581389676c1 Mon Sep 17 00:00:00 2001
From: "Alan T. DeKok" <aland@freeradius.org>
Date: Tue, 9 Sep 2025 07:03:21 -0400
Subject: [PATCH] don't load legacy provider on --enable-fips-workaround. 
 Fixes #5644

Upstream-Status: Backport
[https://github.com/FreeRADIUS/freeradius-server/commit/2c2c6a460ae8cc655df83c8964595581389676c1]

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 src/main/tls.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/main/tls.c b/src/main/tls.c
index ba267983b1..c04f3228e4 100644
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -64,8 +64,11 @@ USES_APPLE_DEPRECATED_API	/* OpenSSL API has been deprecated by Apple */
 #  include <openssl/provider.h>
 
 static OSSL_PROVIDER *openssl_default_provider = NULL;
+
+#ifndef WITH_FIPS
 static OSSL_PROVIDER *openssl_legacy_provider = NULL;
 #endif
+#endif
 
 #define LOG_PREFIX "tls"
 
@@ -3693,6 +3696,7 @@ int tls_global_init(TLS_UNUSED bool spawn_flag, TLS_UNUSED bool check)
 		return -1;
 	}
 
+#ifndef WITH_FIPS
 	/*
 	 *	Needed for MD4
 	 *
@@ -3703,6 +3707,7 @@ int tls_global_init(TLS_UNUSED bool spawn_flag, TLS_UNUSED bool check)
 		ERROR("(TLS) Failed loading legacy provider");
 		return -1;
 	}
+#endif
 #endif
 
 	return 0;
@@ -3777,10 +3782,12 @@ void tls_global_cleanup(void)
 	}
 	openssl_default_provider = NULL;
 
+#ifndef WITH_FIPS
 	if (openssl_legacy_provider && !OSSL_PROVIDER_unload(openssl_legacy_provider)) {
 		ERROR("Failed unloading legacy provider");
 	}
 	openssl_legacy_provider = NULL;
+#endif
 #endif
 
 	CONF_modules_unload(1);
-- 
2.43.0

