|
 |
80a797 |
Author: Antonio Torres <antorres@redhat.com>
|
|
|
80a797 |
Date: Fri Jul 2 07:12:48 2021 -0400
|
|
|
80a797 |
Subject: [PATCH] exit if host in FIPS mode and MD5 not explicitly allowed
|
|
|
80a797 |
|
|
|
80a797 |
FIPS does not allow MD5, which FreeRADIUS needs to work. The user should
|
|
|
80a797 |
explicitly allow MD5 usage by setting the RADIUS_MD5_FIPS_OVERRIDE environment
|
|
|
80a797 |
variable to 1 or else FR should exit at start.
|
|
|
80a797 |
|
|
|
80a797 |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1958979
|
|
|
80a797 |
Signed-off-by: Antonio Torres antorres@redhat.com
|
|
|
80a797 |
---
|
|
|
80a797 |
src/main/radiusd.c | 14 ++++++++++++++
|
|
|
80a797 |
1 file changed, 14 insertions(+)
|
|
|
80a797 |
|
|
|
80a797 |
diff --git a/src/main/radiusd.c b/src/main/radiusd.c
|
|
|
80a797 |
index 9739514509..58a48895e6 100644
|
|
|
80a797 |
--- a/src/main/radiusd.c
|
|
|
80a797 |
+++ b/src/main/radiusd.c
|
|
|
80a797 |
@@ -298,6 +298,20 @@ int main(int argc, char *argv[])
|
|
|
80a797 |
exit(EXIT_FAILURE);
|
|
|
80a797 |
}
|
|
|
80a797 |
|
|
|
80a797 |
+ /*
|
|
|
80a797 |
+ * If host is in FIPS mode, we need the user to explicitly allow MD5 usage.
|
|
|
80a797 |
+ */
|
|
|
80a797 |
+ char *fips_md5_override = getenv("RADIUS_MD5_FIPS_OVERRIDE");
|
|
|
80a797 |
+ FILE *fips_file = fopen("/proc/sys/crypto/fips_enabled", "r");
|
|
|
80a797 |
+ if (fips_file != NULL) {
|
|
|
80a797 |
+ int fips_enabled = fgetc(fips_file) - '0';
|
|
|
80a797 |
+ fclose(fips_file);
|
|
|
80a797 |
+ if (fips_enabled == 1 && (fips_md5_override == NULL || atoi(fips_md5_override) != 1)) {
|
|
|
80a797 |
+ fprintf(stderr, "Cannot run FreeRADIUS in FIPS mode because it uses MD5. To allow MD5 usage, set RADIUS_MD5_FIPS_OVERRIDE=1 before starting FreeRADIUS.\n");
|
|
|
80a797 |
+ exit(EXIT_FAILURE);
|
|
|
80a797 |
+ }
|
|
|
80a797 |
+ }
|
|
|
80a797 |
+
|
|
|
80a797 |
/*
|
|
|
80a797 |
* According to the talloc peeps, no two threads may modify any part of
|
|
|
80a797 |
* a ctx tree with a common root without synchronisation.
|