feat(openssl): add config-driven FIPS provider selection engine#18103
Draft
tobiasb-ms wants to merge 1 commit into
Draft
feat(openssl): add config-driven FIPS provider selection engine#18103tobiasb-ms wants to merge 1 commit into
tobiasb-ms wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds config-driven FIPS provider selection and activation to OpenSSL.
Changes:
- Adds provider designation, validation, activation, and tests.
- Removes the legacy
fips_local.cnfsymlink. - Updates rendered OpenSSL packaging output.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
base/comps/openssl/openssl.comp.toml |
Adds the patch and symlink-removal overlays. |
base/comps/openssl/0080-azl-fips-provider-drop-in-activation.patch |
Implements and tests FIPS provider selection. |
specs/o/openssl/openssl.spec |
Renders packaging and release changes. |
specs/o/openssl/0080-azl-fips-provider-drop-in-activation.patch |
Rendered copy of the source patch. |
Comment on lines
+234
to
+237
| + if (provider_conf_load(libctx, fips_name, fips_sect, cnf) != 1) | ||
| + return 0; | ||
| + | ||
| + if (OSSL_PROVIDER_load(libctx, fips_name) == NULL) { |
Comment on lines
+237
to
+240
| + if (OSSL_PROVIDER_load(libctx, fips_name) == NULL) { | ||
| + ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INIT_FAIL, | ||
| + "Failed to activate FIPS provider '%s'.", fips_name); | ||
| + return 0; |
Comment on lines
+293
to
+297
| + if (!provider_conf_activate_fips(libctx, cnf)) { | ||
| + /* | ||
| + * The kernel is in FIPS mode but the designated FIPS provider could | ||
| + * not be activated. This must be fatal regardless of the config's | ||
| + * config_diagnostics setting: otherwise CONF_modules_load_file_ex() |
| [[components.openssl.overlays]] | ||
| type = "patch-add" | ||
| source = "0080-azl-fips-provider-drop-in-activation.patch" | ||
| description = "AZL config-driven FIPS provider drop-in activation. patch-add auto-assigns the next number (Patch0080); the spec's `%autosetup -S git` applies it last -- i.e. on top of Fedora's pristine patch 0019." |
Add the AZL provider-agnostic FIPS activation engine to base openssl. This is the first of a series: providers (openssl-fips-provider and SymCrypt-OpenSSL) that use this engine will follow. - Add 0080-azl-fips-provider-drop-in-activation.patch: rework provider_conf.c so that, in kernel FIPS mode, OpenSSL reads an [azl_fips_provider] designation from its openssl.d drop-in config, activates exactly the designated provider, and applies the per-provider property-query strictness (mandatory fips=yes vs. soft ?fips=yes). A missing, empty, or ambiguous designation fails closed. Includes unit tests (test/prov_conf_fips_test.c, 03-test_prov_conf_fips.t). - Drop the legacy /etc/pki/tls/fips_local.cnf symlink (both its %install creation and %files entry); nothing reads it after the 0080 rework. Base openssl still ships no fips.so and openssl-libs requires no FIPS provider, so non-FIPS systems are unchanged and the repo still closes. Because no [azl_fips_provider] designation exists yet, kernel FIPS mode hard-fails -- which matches current behavior (kernel FIPS mode does not work today). Provider packages and the packaging mutual-exclusion wiring follow in subsequent changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5f315f8d-6603-4659-8d14-4476bc265450
tobiasb-ms
force-pushed
the
tobiasb-ms/openssl-fips-providers-load-logic
branch
from
July 23, 2026 20:12
e433ed9 to
3a710cf
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
base/comps/openssl/0080-azl-fips-provider-drop-in-activation.patch:304
- This does not make the failure propagate with the shipped
config_diagnostics = 0.CONF_modules_load()capturedCONF_MFLAGS_IGNORE_ERRORSbefore invoking this callback; after this returns 0 it therefore continues and ultimately returns 1. AlthoughCONF_modules_load_file_ex()rereads the diagnostics bit, by then the module failure has already been converted to success. Consequently, on a kernel-FIPS system with no designation (the state introduced by this PR),OPENSSL_init_crypto()can still succeed without FIPS enforcement. Make the module loader re-check diagnostics on a failed callback (or enable strict handling before module iteration), and add an end-to-end test using the default ignore flags and a missing designation.
+ OSSL_LIB_CTX_set_conf_diagnostics(libctx, 1);
return 0;
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the Azure Linux config-driven FIPS provider selection engine to base
openssl, without shipping any FIPS provider yet. This is the first of a series: the engine lands first so that provider packages (openssl-fips-provider,SymCrypt-OpenSSL) can plug into it in follow-up PRs.Work item: AB#18197
What this PR does
0080-azl-fips-provider-drop-in-activation.patchto theopensslcomponent. Comments in that file provide context and a configuration example./etc/pki/tls/fips_local.cnfsymlink; nothing reads it after the 0080 rework, which reads theopenssl.ddrop-in instead.Behavior / Compatibility
[azl_fips_provider]designation exists yet. This is a slight deviation from kernel FIPS mode today, where due to a bug in Fedora/RHEL, if no FIPS provider is present, OpenSSL partially works.Testing
openssl%check(including the new unit tests) passes.SymCrypt-OpenSSLdesignation on top: on a kernel-FIPS system the designated provider loads and activates instead of hard-failing. (That provider wire-up is a separate follow-up PR.)