Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

When running in FIPS mode, OpenSSL 3 default properties should contain fips=1. #10433

Open
qmuntal opened this issue Sep 12, 2024 · 1 comment
Labels
3.0 PRs Destined for 3.0 bug Something isn't working

Comments

@qmuntal
Copy link

qmuntal commented Sep 12, 2024

Describe the bug
When the kernel is running in FIPS mode, the OpenSSL 3 default properties doesn't contain fips=1, which makes EVP_default_properties_is_fips_enabled return false. The Go Microsoft toolchain needs to know if the FIPS mode is enabled or not to apply some additional logic on top of what's provided by OpenSSL.

To Reproduce
Steps to reproduce the behavior:

  1. Set OPENSSL_FORCE_FIPS_MODE=1 to simulate kernel FIPS mode.
  2. Compile and run a C program that calls EVP_default_properties_is_fips_enabled and check if it returns true:
#include <stdio.h>
#include "openssl/evp.h"

int main(int ac, char **av)
{
    int ret = EVP_default_properties_is_fips_enabled(NULL);
    if (ret == 1)
        printf("FIPS enabled\n");
    else
        printf("FIPS not enabled\n");
    return 0;
}

Expected behavior
FIPS enabled

Real behavior
FIPS not enabled

Notes

There is a patch file that defines FIPS_mope as EVP_default_properties_is_fips_enabled: https://github.com/microsoft/azurelinux/blob/ba13b467104263b5740cdca3054ea5121d8160ab/SPECS/openssl/0008-Add-FIPS_mode-compatibility-macro.patch#L43C11-L43C20. I would expect fips=yes to be set when the kernel is running in FIPS mode.

@microsoft/golang-compiler

@qmuntal qmuntal added bug Something isn't working 3.0 PRs Destined for 3.0 labels Sep 12, 2024
@mfrw
Copy link
Member

mfrw commented Sep 16, 2024

/cc @tobiasb-ms @christopherco

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3.0 PRs Destined for 3.0 bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants