|
| 1 | +# FIPS support |
| 2 | + |
| 3 | +**NOTE: FIPS Support is in-progress** |
| 4 | + |
| 5 | +The fleet-server can be built in a FIPS capable mode. |
| 6 | +This forces the use of a FIPS provider to handle any cryptographic calls. |
| 7 | + |
| 8 | +Currently FIPS is provided by compiling with the [microsoft/go](https://github.com/microsoft/go) distribution. |
| 9 | +This toolchain must be present for local compilation. |
| 10 | + |
| 11 | +## Build changes |
| 12 | + |
| 13 | +As we are using micrsoft/go as a base we follow their conventions. |
| 14 | + |
| 15 | +Our FIPS changes require the `requirefips` build tag. |
| 16 | +When compiling `GOEXPERIMENT=systemcrypto` and `CGO_ENABLED=1` must be set. |
| 17 | +Additionally the `MS_GOTOOLCHAIN_TELEMETRY_ENABLED=0` env var is set to disable telemetry for [microsoft/go](https://github.com/microsoft/go). |
| 18 | + |
| 19 | +The `FIPS=true` env var is used by our magefile as the FIPS toggle. |
| 20 | +This env var applies to all targets, at a minimum the `requirefips` tag will be set. |
| 21 | +For targets that compile binaries, the `GOEXPERIMENT=systemcrypto` and `CGO_ENABLED=1` env vars are set. |
| 22 | + |
| 23 | +For developer conveniance, running `FIPS=true mage multipass` will provision a multipass VM with the Microsoft/go toolchain. |
| 24 | +See [Multipass VM Usage](#multipass-vm-usage) for additional details. |
| 25 | + |
| 26 | +### Multipass VM Usage |
| 27 | + |
| 28 | +A Multipass VM created with `FIPS=true mage multipass` is able to compile FIPS enabled golang programs, but is not able to run them. |
| 29 | +When you try to run one the following error occurs: |
| 30 | +``` |
| 31 | +GODEBUG=fips140=on ./bin/fleet-server -c fleet-server.yml |
| 32 | +panic: opensslcrypto: can't enable FIPS mode for OpenSSL 3.0.13 30 Jan 2024: openssl: FIPS mode not supported by any provider |
| 33 | +
|
| 34 | +goroutine 1 [running]: |
| 35 | +crypto/internal/backend.init.1() |
| 36 | + /usr/local/go/src/crypto/internal/backend/openssl_linux.go:85 +0x210 |
| 37 | +``` |
| 38 | + |
| 39 | +In order to be able to run a FIPS enabled binary, openssl must have a fips provider. |
| 40 | +Openssl [provides instructions on how to do this](https://github.com/openssl/openssl/blob/master/README-FIPS.md). |
| 41 | + |
| 42 | +A TLDR for our multipass container is: |
| 43 | + |
| 44 | +1. Download and compile the FIPS provider for openssl in the VM by running: |
| 45 | +``` |
| 46 | +wget https://github.com/openssl/openssl/releases/download/openssl-3.0.13/openssl-3.0.13.tar.gz |
| 47 | +tar -xzf openssl-3.0.13.tar.gz |
| 48 | +cd openssl-3.0.13 |
| 49 | +./Configure enable-fips |
| 50 | +make test |
| 51 | +sudo make install_fips |
| 52 | +sudo openssl fipsinstall -out /usr/local/ssl/fipsmodule.cnf -module /usr/local/lib/ossl-modules/fips.so |
| 53 | +``` |
| 54 | + |
| 55 | +2. Copy the `fips.so` module to the system library, in order to find the location run: |
| 56 | +``` |
| 57 | +openssl version -m |
| 58 | +``` |
| 59 | + |
| 60 | +On my VM I would copy the `fips.so` module with: |
| 61 | +``` |
| 62 | +sudo cp /usr/local/lib/ossl-modules/fips.so /usr/lib/aarch64-linux-gnu/ossl-modules/fips.so |
| 63 | +``` |
| 64 | + |
| 65 | +3. Create an openssl.cnf for the program to use with the contents: |
| 66 | +``` |
| 67 | +config_diagnostics = 1 |
| 68 | +openssl_conf = openssl_init |
| 69 | +
|
| 70 | +.include /usr/local/ssl/fipsmodule.cnf |
| 71 | +
|
| 72 | +[openssl_init] |
| 73 | +providers = provider_sect |
| 74 | +alg_section = algorithm_sect |
| 75 | +
|
| 76 | +[provider_sect] |
| 77 | +fips = fips_sect |
| 78 | +base = base_sect |
| 79 | +
|
| 80 | +[base_sect] |
| 81 | +activate = 1 |
| 82 | +
|
| 83 | +[algorithm_sect] |
| 84 | +default_properties = fips=yes |
| 85 | +``` |
| 86 | + |
| 87 | +4. Run the program with the `OPENSSL_CONF=openssl.cnf` and `GODEBUG=fips140=on` env vars, i.e., |
| 88 | +``` |
| 89 | +OPENSSL_CONF=./openssl.cnf GODEBUG=fips140=on ./bin/fleet-server -c fleet-server.yml |
| 90 | +23:48:47.871 INF Boot fleet-server args=["-c","fleet-server.yml"] commit=55104f6f ecs.version=1.6.0 exe=./bin/fleet-server pid=65037 ppid=5642 service.name=fleet-server service.type=fleet-server version=9.0.0 |
| 91 | +i... |
| 92 | +``` |
| 93 | + |
| 94 | +## Usage |
| 95 | + |
| 96 | +Binaries produced with the `FIPS=true` env var will panic on startup if they cannot find a FIPS provider. |
| 97 | +The system/image is required to have a FIPS provider available. |
0 commit comments