OCPBUGS-65684: Fix invalid random source in FIPS 140-only mode in FIPS mode#2159
OCPBUGS-65684: Fix invalid random source in FIPS 140-only mode in FIPS mode#2159tlbueno merged 1 commit intocoreos:mainfrom
Conversation
There was a problem hiding this comment.
Code Review
This pull request correctly addresses an issue with using an invalid random source in FIPS 140-only mode. By removing the custom random source from the TLS configuration, the code now relies on the FIPS-compliant default (crypto/rand.Reader), which resolves the reported error. The change is clear and the added comment provides good context. I've added one suggestion for a follow-up refactoring to improve code clarity now that a potential source of errors has been removed.
|
This passes a local fips test for me, but I don't understand the implications of not setting the rand value in non-fips mode. |
|
@dustymabe, yeah I do not either, we could build a patch file, and simply apply it in packaging for fips-only targets? We did something like this for adding rdcore for the longest time. |
|
looks like we need to run |
d23815e to
8b8889a
Compare
1700022 to
e1a9fa8
Compare
860a137 to
18d5da5
Compare
…S mode When igntion is compiled with GOEXPERIMENT=strictfipsruntime and running in a computer with FIPS enabled, the random source is invalid. When FIPS is enabled, instead of use a custom random on TLS config, do not set a random source at all as it will use crypto/rand.Reader by default Co-authored-by: Steven Presti <47181335+prestist@users.noreply.github.com> Co-authored-by: Dusty Mabe <dusty@dustymabe.com> Signed-off-by: Tiago Bueno <tiago.bueno@gmail.com>
Not reading directly from urandom means that Ignition might block on reading random bytes until the random pool is initialized. But on FIPS mode, the random algorithm are slightly different, so I'm not even sure it will block at all. |
When igntion is compiled with GOEXPERIMENT=strictfipsruntime and running in a computer with FIPS enabled, the random source is invalid.
Instead of use a custom random on TLS config, we must do not set a random source at all as it will use crypto/rand.Reader by default