Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Inconsistent behavior building on Linux/MacOS against OpenSSL 3.x #8271

Closed
udkyo opened this issue Mar 15, 2024 · 3 comments
Closed

Inconsistent behavior building on Linux/MacOS against OpenSSL 3.x #8271

udkyo opened this issue Mar 15, 2024 · 3 comments
Assignees
Labels
bug Issue is reported as a bug team:VM Assigned to OTP team VM

Comments

@udkyo
Copy link

udkyo commented Mar 15, 2024

Describe the bug
Building from source with fips enabled using --with-ssl=[OpenSSL 3.x dir] on macos fails at Checking for FIPS_mode_set()... no

An identical build on Linux completes successfully (Checking for FIPS_mode_set()... yes) which is confusing, as it seems FIPS_mode_set doesn't actually exist in OpenSSL 3.x.

To Reproduce

mkdir /tmp/erlang-test
cd /tmp/erlang-test

git clone https://github.com/openssl/openssl
pushd openssl
./Configure enable-fips --prefix=/tmp/erlang-test/openssl-3.x
make && make install
popd

git clone https://github.com/erlang/otp
pushd otp
./configure --enable-fips --with-ssl=/tmp/erlang-test/openssl-3.x

Expected behavior
I would expect to see an OpenSSL 3.x friendly check, rather than a FIPS_mode_set() check which seems to only be valid when using OpenSSL 1.x.

As the FIPS_mode_set check is there however, I also expect current Linux builds --with-ssling OpenSSL 3.x to fail, which does not match my experience.

Affected versions
I encountered this while attempting to build 26.2 with FIPS enabled, but it looks like anything newer is the same. I'm not sure which older versions this behaviour is present in.

@udkyo udkyo added the bug Issue is reported as a bug label Mar 15, 2024
@IngelaAndin IngelaAndin added the team:VM Assigned to OTP team VM label Mar 18, 2024
@jhogberg jhogberg added the help wanted Issue not worked on by OTP; help wanted from the community label Mar 18, 2024
@sverker
Copy link
Contributor

sverker commented Mar 18, 2024

@udkyo Could you try #8277 where I have removed the check for FIPS_mode_set which was incorrect in multiple ways. It's currently based on OTP-26.2.3.

@sverker sverker removed the help wanted Issue not worked on by OTP; help wanted from the community label Mar 18, 2024
@udkyo
Copy link
Author

udkyo commented Mar 21, 2024

Looks good @sverker. Using that PR on OTP-26.2.3 I'm able to build on MacOS + Linux and enable FIPS on each. Thank you very much!

@sverker
Copy link
Contributor

sverker commented Apr 2, 2024

#8277 merged. Scheduled for next 25, 26 and 27.0 release.

@sverker sverker closed this as completed Apr 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Issue is reported as a bug team:VM Assigned to OTP team VM
Projects
None yet
Development

No branches or pull requests

4 participants