Remove openssl.SetFIPS(true) call
#1513
Conversation
|
Looks like Mariner 2 hasn't ported forward-ported the code to enable FIPS mode from the config file. OpenSSL only officially supports FIPS mode in v1.0.2, so the relevant code was removed in OpenSSL 1.1. Will have to find another way. |
qmuntal
requested review from
a team and
microsoft-golang-review-bot
as code owners
| "HGRCPATH=", | ||
| "GOTOOLCHAIN=auto", | ||
| "newline=\n", | ||
| + "OPENSSL_FORCE_FIPS_MODE=" + os.Getenv("OPENSSL_FORCE_FIPS_MODE"), // useful for testing on Mariner 2. |
There was a problem hiding this comment.
I feel like this would fit better in extraEnvKeys. (Unless there's a reason that it must be set to empty string even if the env var is unassigned?)
| "os" | ||
| ) | ||
|
|
||
| // enableSystemWideFIPS enables Mariner and Azure Linux 3 process-wide FIPS mode. |
There was a problem hiding this comment.
I think in context what's here is plenty, but I figure a bit more explicit detail doesn't hurt:
| // enableSystemWideFIPS enables Mariner and Azure Linux 3 process-wide FIPS mode. | |
| // enableSystemWideFIPS enables Mariner and Azure Linux 3 process-wide FIPS mode | |
| // for any process that inherits the current process' environment variables. |
| // FIPS mode is enabled if OPENSSL_FORCE_FIPS_MODE is set, regardless of the value. | ||
| _, ok := os.LookupEnv("OPENSSL_FORCE_FIPS_MODE") | ||
| if ok { | ||
| log.Println("FIPS mode already enabled.") |
There was a problem hiding this comment.
Might be confusing if you only see the log because there are a few things "FIPS mode" could mean.
| log.Println("FIPS mode already enabled.") | |
| log.Println("Mariner and Azure Linux 3 forced FIPS mode (OPENSSL_FORCE_FIPS_MODE) already enabled.") |
| } | ||
|
|
||
| env("OPENSSL_FORCE_FIPS_MODE", "1") | ||
| log.Println("Enabled Mariner and Azure Linux 3 FIPS mode.") |
There was a problem hiding this comment.
env will have just logged a message, but it doesn't hurt to make this a bit more explicit too.
| log.Println("Enabled Mariner and Azure Linux 3 FIPS mode.") | |
| log.Println("Enabled Mariner and Azure Linux 3 FIPS mode (OPENSSL_FORCE_FIPS_MODE).") |
To make sure I have this right: for a user to run a test with forced FIPS mode, this will work: For the user to have an issue with passthrough, they'd have to be using yet another custom test runner that passes through |
As agreed in https://github.com/microsoft/go-lab/blob/main/docs/adr/0012-remove-gofips.md, we shouldn't try to modify the OpenSSL FIPS mode.
This PR removes the
openssl.SetFIPS(true)call and update our build scripts to enable FIPS mode system-wide.Our CI Mariner 2 image is not FIPS-enabled by default, so we need to force FIPS mode by setting
OPENSSL_FORCE_FIPS_MODE. That flag should be passes to theTestScriptchild processes as they only inherit a filtered set of environment variables, which includesGODEBUG.Note that since we switched from
GOFIPStoGODEBUG=fips140, our test FIPS test coverage has increased, asGOFIPSwas not being passed toTestScriptchild processes, making them not aware of the required FIPS mode.Also, this is unlikely that users need to update their code to also pass
OPENSSL_FORCE_FIPS_MODEto child processes that don't inherit all environment variables. Mainly because they should be running a FIPS-enabled Mariner image on production. If they don't, possible for testing purposes, then child processes won't inherit theGODEBUGenv var neither.For #1445.