You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kudu.apache.org by al...@apache.org on 2025/08/12 05:21:37 UTC
(kudu) branch master updated: [util] introduce security::IsFIPSEnabled()
This is an automated email from the ASF dual-hosted git repository.
alexey pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/kudu.git
The following commit(s) were added to refs/heads/master by this push:
new 3a2f29a92 [util] introduce security::IsFIPSEnabled()
3a2f29a92 is described below
commit 3a2f29a92790ee949f8efdb6f299dc52fb672fe6
Author: Alexey Serbin <al...@apache.org>
AuthorDate: Sat Aug 9 18:29:54 2025 -0700
[util] introduce security::IsFIPSEnabled()
This is a micro-refactoring regarding the FIPS provider status in
the OpenSSL: the duplicate code is replaced with newly introduced
security::IsFIPSEnabled() utility function. For details on the
evolution of the FIPS-related terminology in the OpenSSL, see [1].
This is a follow-up to acac73ecda83ec2390b5990cc132ca6968bfefdf.
[1] https://github.com/openssl/openssl/discussions/21797
Change-Id: I672cb90af37d66468c1e2144da224e7795e75084
Reviewed-on: http://gerrit.cloudera.org:8080/23276
Tested-by: Alexey Serbin <al...@apache.org>
Reviewed-by: Abhishek Chennaka <ac...@cloudera.com>
---
src/kudu/server/webserver-test.cc | 22 +++++++---------------
src/kudu/server/webserver.cc | 15 +++------------
src/kudu/util/openssl_util.cc | 8 ++++++++
src/kudu/util/openssl_util.h | 6 ++++++
4 files changed, 24 insertions(+), 27 deletions(-)
diff --git a/src/kudu/server/webserver-test.cc b/src/kudu/server/webserver-test.cc
index 95a8e7d9d..76f8b7b08 100644
--- a/src/kudu/server/webserver-test.cc
+++ b/src/kudu/server/webserver-test.cc
@@ -17,11 +17,6 @@
#include "kudu/server/webserver.h"
-#include <openssl/crypto.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#include <openssl/ssl.h>
-#endif
-
#include <cstdlib>
#include <functional>
#include <initializer_list>
@@ -55,6 +50,7 @@
#include "kudu/util/flag_tags.h"
#include "kudu/util/logging.h"
#include "kudu/util/net/sockaddr.h"
+#include "kudu/util/openssl_util.h"
#include "kudu/util/slice.h"
#include "kudu/util/status.h"
#include "kudu/util/test_macros.h"
@@ -82,14 +78,10 @@ DECLARE_bool(webserver_enable_csp);
DECLARE_string(spnego_keytab_file);
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
-int fips_mode = FIPS_mode();
-#else
-int fips_mode = EVP_default_properties_is_fips_enabled(NULL);
-#endif
-
namespace kudu {
+const bool g_is_fips = security::IsFIPSEnabled();
+
namespace {
void SetSslOptions(WebserverOptions* opts) {
string password;
@@ -134,7 +126,7 @@ class WebserverTest : public KuduTest {
AddPreInitializedDefaultPathHandlers(server_.get());
AddPostInitializedDefaultPathHandlers(server_.get());
- if (!use_htpasswd() || !fips_mode) {
+ if (!use_htpasswd() || !g_is_fips) {
ASSERT_OK(server_->Start());
vector<Sockaddr> addrs;
@@ -193,7 +185,7 @@ class PasswdWebserverTest : public WebserverTest {
// Send a HTTP request with no username and password. It should reject
// the request as the .htpasswd is presented to webserver.
TEST_F(PasswdWebserverTest, TestPasswdMissing) {
- if (fips_mode) {
+ if (g_is_fips) {
GTEST_SKIP();
}
Status status = curl_.FetchURL(url_, &buf_);
@@ -201,7 +193,7 @@ TEST_F(PasswdWebserverTest, TestPasswdMissing) {
}
TEST_F(PasswdWebserverTest, TestPasswdPresent) {
- if (fips_mode) {
+ if (g_is_fips) {
GTEST_SKIP();
}
curl_.set_auth(CurlAuthType::DIGEST,
@@ -211,7 +203,7 @@ TEST_F(PasswdWebserverTest, TestPasswdPresent) {
}
TEST_F(PasswdWebserverTest, TestCrashInFIPSMode) {
- if (!fips_mode) {
+ if (!g_is_fips) {
GTEST_SKIP();
}
diff --git a/src/kudu/server/webserver.cc b/src/kudu/server/webserver.cc
index 49bef8cf1..85eff8fc7 100644
--- a/src/kudu/server/webserver.cc
+++ b/src/kudu/server/webserver.cc
@@ -17,12 +17,8 @@
#include "kudu/server/webserver.h"
-#include <netinet/in.h>
-#include <openssl/crypto.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#include <openssl/ssl.h>
-#endif
#include <gssapi/gssapi_krb5.h>
+#include <netinet/in.h>
#include <sys/socket.h>
#include <algorithm>
@@ -57,8 +53,8 @@
#include "kudu/gutil/strings/stringpiece.h"
#include "kudu/gutil/strings/strip.h"
#include "kudu/gutil/strings/substitute.h"
-#include "kudu/security/init.h"
#include "kudu/security/gssapi.h"
+#include "kudu/security/init.h"
#include "kudu/util/easy_json.h"
#include "kudu/util/env.h"
#include "kudu/util/flag_tags.h"
@@ -365,12 +361,7 @@ Status Webserver::Start() {
}
if (!opts_.password_file.empty()) {
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
- int fips_mode = FIPS_mode();
-#else
- int fips_mode = EVP_default_properties_is_fips_enabled(NULL);
-#endif
- if (fips_mode) {
+ if (security::IsFIPSEnabled()) {
return Status::IllegalState(
"Webserver cannot be started with Digest authentication in FIPS approved mode");
}
diff --git a/src/kudu/util/openssl_util.cc b/src/kudu/util/openssl_util.cc
index 2321c9813..3f7c45f35 100644
--- a/src/kudu/util/openssl_util.cc
+++ b/src/kudu/util/openssl_util.cc
@@ -410,6 +410,14 @@ bool IsOpenSSLInitialized() {
return g_ssl_is_initialized;
}
+bool IsFIPSEnabled() {
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+ return FIPS_mode() != 0;
+#else
+ return EVP_default_properties_is_fips_enabled(nullptr) != 0;
+#endif
+}
+
string GetOpenSSLErrors() {
ostringstream serr;
uint32_t l;
diff --git a/src/kudu/util/openssl_util.h b/src/kudu/util/openssl_util.h
index eba953f49..fcedea2d8 100644
--- a/src/kudu/util/openssl_util.h
+++ b/src/kudu/util/openssl_util.h
@@ -122,6 +122,12 @@ void FinalizeOpenSSL();
// ** calls from global's initializers before main()
bool IsOpenSSLInitialized();
+// Whether the FIPS provider is enabled.
+//
+// See https://github.com/openssl/openssl/discussions/21797 for details on the
+// evolution of the FIPS-related terminology in the OpenSSL project.
+bool IsFIPSEnabled();
+
// Fetches errors from the OpenSSL error error queue, and stringifies them.
//
// The error queue will be empty after this method returns.