--enable-fips-mode option breaks build of hmacmd5.c and md5.c

Summary

When specifying the "--enable-fips-mode=yes" option with./configure command, the build fails on lib/isc/hmacmd5.c and lib/isc/md5.c.

Building on CentOS7.

BIND version used

9.12.4

Steps to reproduce

-unpack 9.12.4 tarball -run "./configure --enable-fips-mode=yes" -run "make" command

What is the current bug behavior?

./make command produces the following output (the build breaks similarly when the build process reaches lib/isc/md5.c): ... gcc -std=gnu99 -I/tmp/bind-test/bind-9.12.4 -I../.. -I./unix/include -I./pthreads/include -I./x86_32/include -I./include -I./include -I/tmp/bind-test/bind-9.12.4/lib/dns/include -I../../lib/dns/include -D_REENTRANT -DOPENSSL -DPK11_LIB_LOCATION="undefined" -D_GNU_SOURCE -g -O2 -I/usr/include/libxml2 -fPIC -W -Wall -Wmissing-prototypes -Wcast-qual -Wwrite-strings -Wformat -Wpointer-arith -fno-strict-aliasing -fno-delete-null-pointer-checks -c hmacmd5.c hmacmd5.c:409:1: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘attribute’ at end of input EMPTY_TRANSLATION_UNIT ^ make[2]: *** [hmacmd5.o] Error 1 make[2]: Leaving directory /tmp/bind-test/bind-9.12.4/lib/isc' make[1]: *** [subdirs] Error 1 make[1]: Leaving directory /tmp/bind-test/bind-9.12.4/lib' make: *** [subdirs] Error 1

What is the expected correct behavior?

The build completes successfully.

Relevant configuration files

When the "--enable-fips-mode=yes" option is specified, the following value is set in config.h: /* Disable MD5 functions (for FIPSmode) */ #define PK11_MD5_DISABLE 1

Thus, the PK11_MD5_DISABLE C preprocessor value has been defined. The following C preprocessor logic is found in both hmacmd5.c and md5.c:

#include "config.h" #include <pk11/site.h>

#ifndef PK11_MD5_DISABLE

#include <isc/util.h>

//body of code here #else /* !PK11_MD5_DISABLE / EMPTY_TRANSLATION_UNIT #endif / PK11_MD5_DISABLE */

The problem (I think), is that the "EMPTY_TRANSLATION_UNIT" macro is defined in the lib/isc/util.h file. So, when PK11_MD5_DISABLE is defined, isc/util.h is never included and thus EMPTY_TRANSLATION_UNIT is never set. This causes the pre-processor failure as seen in the compile snippet.

Relevant logs and/or screenshots

(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code, as it's very hard to read otherwise.)

Possible fixes

If you move the "#include <isc/util.h>" directive such that it preceeds the "#ifndef PK11_MD5_DISABLE" directive, then the build completes successfully. For example: