T8529: Add configuration CLI to enable OpenSSL FIPS#5139
T8529: Add configuration CLI to enable OpenSSL FIPS#5139sever-sever wants to merge 1 commit intovyos:currentfrom
Conversation
|
👍 |
|
❌ Typos detected in PR (1 found)
|
There was a problem hiding this comment.
Pull request overview
Adds a new system option fips configuration knob intended to enable OpenSSL FIPS provider usage on VyOS systems, and validates it via a new smoketest.
Changes:
- Add
system option fipsCLI node to the interface definition. - Generate
/etc/ssl/openssl.cnffrom a new Jinja template and runopenssl fipsinstallwhen FIPS is enabled. - Add a smoketest that enables/disables FIPS and checks provider activation.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
src/conf_mode/system_option.py |
Adds OpenSSL config rendering + runs openssl fipsinstall when fips is configured, plus a runtime warning. |
data/templates/openssl/openssl.cnf.j2 |
New OpenSSL configuration template with conditional FIPS provider include/activation. |
interface-definitions/system_option.xml.in |
Adds the fips leaf under system option. |
smoketest/scripts/cli/test_system_option.py |
Adds a smoketest validating config changes and provider activation/deactivation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
sever-sever
requested review from
alexandr-san4ez,
c-po,
Copilot,
dmbaturin,
jestabro,
natali-rs1985,
sarthurdev and
zdc
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Converted to the |
Add the new configuration CLI to enable OpenSSL FIPS-140 (Federal Information Processing Standard) cryptographic modules
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # ensure directory exists | ||
| os.makedirs(os.path.dirname(openssl_fipsmodule_config), exist_ok=True) | ||
| cmd( | ||
| f'openssl fipsinstall -module /usr/lib/{arch}/ossl-modules/fips.so -out {openssl_fipsmodule_config}' |
There was a problem hiding this comment.
The openssl fipsinstall ... invocation uses cmd(...) without raising=ConfigError / a helpful message=.... If fipsinstall fails (e.g., provider integrity check fails, permissions, unsupported OpenSSL build), this will raise an OSError and may surface as an unhandled exception during commit instead of a clean config error. Use cmd(..., raising=ConfigError, message='...') so the user gets an actionable CLI error and the commit fails gracefully.
| f'openssl fipsinstall -module /usr/lib/{arch}/ossl-modules/fips.so -out {openssl_fipsmodule_config}' | |
| f'openssl fipsinstall -module /usr/lib/{arch}/ossl-modules/fips.so -out {openssl_fipsmodule_config}', | |
| raising=ConfigError, | |
| message='Failed to generate OpenSSL FIPS module configuration' |
|
CI integration ❌ failed! Details
|
There was a problem hiding this comment.
Basic functionality test looks good. I don't see any problems with this new feature.
vyos@vyos1:~$ conf
vyos@vyos1# set system option fips
vyos@vyos1# commit
[ system option ]
WARNING: FIPS 140-3 support is incomplete and may behave unexpectedly!
vyos@vyos1:~$ openssl list -providers
Providers:
base
name: OpenSSL Base Provider
version: 3.1.2
status: active
fips
name: OpenSSL FIPS Provider
version: 3.1.2
status: active
vyos@vyos1:~$ python3
>>> import ssl
>>> import hashlib
>>> print(ssl.OPENSSL_VERSION)
OpenSSL 3.1.2 1 Aug 2023
>>> h = hashlib.sha256(b"test")
>>> print("SHA-256 OK:", h.hexdigest())
SHA-256 OK: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
>>> hashlib.algorithms_available
{'blake2s', 'shake_256', 'blake2b', 'sha224', 'sha3_384', 'sha512_256', 'sha256', 'sha512', 'md5', 'sha3_224', 'sha512_224', 'shake_128', 'sha3_256', 'sha1', 'sha3_512', 'sha384'}
>>> hashlib.algorithms_guaranteed
{'blake2s', 'sha3_224', 'shake_256', 'blake2b', 'sha224', 'sha3_384', 'shake_128', 'sha3_256', 'sha256', 'sha512', 'md5', 'sha1', 'sha3_512', 'sha384'}
>>> exit()
[edit]
vyos@vyos1# del system option fips
[edit]
vyos@vyos1# commit
[edit]
vyos@vyos1# python3
>>> import hashlib
>>> hashlib.algorithms_available
{'blake2b', 'sha1', 'sha224', 'sha256', 'sha3_224', 'sha512', 'md5', 'sha3_384', 'shake_256', 'sha3_512', 'md5-sha1', 'sha512_224', 'shake_128', 'ripemd160', 'sha3_256', 'sha512_256', 'sm3', 'sha384', 'blake2s'}
>>> hashlib.algorithms_guaranteed
{'blake2b', 'shake_128', 'sha1', 'sha3_224', 'sha3_256', 'sha224', 'sha512', 'sha3_384', 'sha384', 'sha3_512', 'shake_256', 'blake2s', 'sha256', 'md5'}
Change summary
Add the new configuration CLI to enable OpenSSL FIPS-140 (Federal Information Processing Standard) cryptographic modules
https://docs.openssl.org/master/man7/fips_module/#making-all-applications-use-the-fips-module-by-default
Types of changes
Related Task(s)
Related PR(s)
This PR relies on a specific OpenSSL version (with built FIPS) vyos/vyos-build#1161
How to test / Smoketest result
Check (expected OpenSSL FIPS):
Remove FIPS
Expected the Default provider
Smoketest will pass after the required OpenSSL version:
Checklist: