| From: | Daniel Gustafsson <daniel(at)yesql(dot)se> |
|---|---|
| To: | Peter Eisentraut <peter(dot)eisentraut(at)enterprisedb(dot)com> |
| Cc: | Michael Paquier <michael(at)paquier(dot)xyz>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: Allow tests to pass in OpenSSL FIPS mode |
| Date: | 2023-03-08 09:21:26 |
| Message-ID: | 7085A535-23CA-47C9-9D13-36D4A1933A1D@yesql.se |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
> On 8 Mar 2023, at 09:49, Peter Eisentraut <peter(dot)eisentraut(at)enterprisedb(dot)com> wrote:
> It occurred to me that it would be easier to maintain this in the long run if we could enable a "fake FIPS" mode that would have the same effect but didn't require fiddling with the OpenSSL configuration or installation.
>
> The attached patch shows how this could work. Thoughts?
- * Initialize a hash context. Note that this implementation is designed
- * to never fail, so this always returns 0.
+ * Initialize a hash context.
Regardless of which, we wan't this hunk since the code clearly can return -1.
+#ifdef FAKE_FIPS_MODE
I'm not enthusiastic about this. If we use this rather than OpenSSL with FIPS
enabled we might end up missing bugs or weird behavior due to changes in
OpenSSL that we didn't test.
--
Daniel Gustafsson
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Peter Eisentraut | 2023-03-08 09:26:54 | Re: Allow tests to pass in OpenSSL FIPS mode |
| Previous Message | Peter Eisentraut | 2023-03-08 08:49:15 | Re: Allow tests to pass in OpenSSL FIPS mode |