|
 |
42d0ad |
From 42693cba452efa00a4848beb1514229149520cc1 Mon Sep 17 00:00:00 2001
|
|
|
42d0ad |
From: Alexander Scheel <ascheel@redhat.com>
|
|
|
42d0ad |
Date: Wed, 5 Aug 2020 11:39:45 -0400
|
|
|
42d0ad |
Subject: [PATCH] Ignore user-provided dhparams in FIPS mode (#3554)
|
|
|
42d0ad |
|
|
|
42d0ad |
OpenSSL in RHEL 8.3 introduces a breaking change in FIPS mode:
|
|
|
42d0ad |
user-provided dhparams will be ignored (and dhparam generation
|
|
|
42d0ad |
may fail as well), unless they are on the FIPS approved list of
|
|
|
42d0ad |
parameters. However, OpenSSL since v1.1.1 will automatically select
|
|
|
42d0ad |
an appropriate DH parameter set anyways, if the user did not provide
|
|
|
42d0ad |
any. These will be FIPS approved.
|
|
|
42d0ad |
|
|
|
42d0ad |
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
|
|
|
42d0ad |
---
|
|
|
42d0ad |
src/main/tls.c | 17 +++++++++++++++++
|
|
|
42d0ad |
1 file changed, 17 insertions(+)
|
|
|
42d0ad |
|
|
|
42d0ad |
diff --git a/src/main/tls.c b/src/main/tls.c
|
|
|
42d0ad |
index 5809a1bd7d..5e6493333c 100644
|
|
|
42d0ad |
--- a/src/main/tls.c
|
|
|
42d0ad |
+++ b/src/main/tls.c
|
|
|
42d0ad |
@@ -1352,6 +1352,23 @@ static int load_dh_params(SSL_CTX *ctx, char *file)
|
|
|
42d0ad |
|
|
|
42d0ad |
if (!file) return 0;
|
|
|
42d0ad |
|
|
|
42d0ad |
+ /*
|
|
|
42d0ad |
+ * Prior to trying to load the file, check what OpenSSL will do with it.
|
|
|
42d0ad |
+ *
|
|
|
42d0ad |
+ * Certain downstreams (such as RHEL) will ignore user-provided dhparams
|
|
|
42d0ad |
+ * in FIPS mode, unless the specified parameters are FIPS-approved.
|
|
|
42d0ad |
+ * However, since OpenSSL >= 1.1.1 will automatically select parameters
|
|
|
42d0ad |
+ * anyways, there's no point in attempting to load them.
|
|
|
42d0ad |
+ *
|
|
|
42d0ad |
+ * Change suggested by @t8m
|
|
|
42d0ad |
+ */
|
|
|
42d0ad |
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
|
|
|
42d0ad |
+ if (FIPS_mode() > 0) {
|
|
|
42d0ad |
+ WARN(LOG_PREFIX ": Ignoring user-selected DH parameters in FIPS mode. Using defaults.");
|
|
|
42d0ad |
+ return 0;
|
|
|
42d0ad |
+ }
|
|
|
42d0ad |
+#endif
|
|
|
42d0ad |
+
|
|
|
42d0ad |
if ((bio = BIO_new_file(file, "r")) == NULL) {
|
|
|
42d0ad |
ERROR(LOG_PREFIX ": Unable to open DH file - %s", file);
|
|
|
42d0ad |
return -1;
|