OpenSSL 3.0.1: FIPS provider not available

[biao-billy]

In migrating my OpenSSL 1.0.2 FIPS app to OpenSSL 3.0.1, I am having difficulty in loading the FIPS module. I am following closely the "Programmatically loading the FIPS module (default library context)" section of the fips module guide doc.

With the following changes, FIPS module failed to load. In fact, OSSL_PROVIDER_available(NULL, "fips") returns 0.

Can someone please review my changes and see what might still be missing?

Config/Installation changes:

1. enable-fips, --api=1.1.1, and --libdir=lib were added to config (latter 2 for app compat)
2. After build & install, openssl-3.0.1/providers/fips.so, openssl-3.0.1/providers/fipsmodule.cnf and openssl-3.0.1/apps/openssl.cnf were copied from the build VM to the app VM.

App changes:

1. Edited the openssl.cnf to have the settings described in the fips module guide.
2. Pointed app to the openssl config location: OPENSSL_config("/opt/uno/etc/openssl.cnf")
3. Added the following loading code:

            const char* default_search_path = "/opt/uno/lib/crypto";
            OSSL_PROVIDER_set_default_search_path(NULL, default_search_path);

            if (!OSSL_PROVIDER_available(NULL, "fips")) {
               SvcLog(LEVEL_ERROR, "FIPS provider not available");
               return false;
            }

            fips = OSSL_PROVIDER_load(NULL, "fips");
            if (fips == NULL) {
                SvcLog(LEVEL_ERROR,"Failed to load FIPS provider\n");
                return false;
            }

Key file locations in app:

[root@ven-rhel lib]# ls /opt/uno/lib/crypto/fips.so
/opt/uno/lib/crypto/fips.so

[root@ven-rhel etc]# ls /opt/uno/etc/openssl.cnf /opt/uno/etc/fipsmodule.cnf
/opt/uno/etc/fipsmodule.cnf  /opt/uno/etc/openssl.cnf

Selected content from openssl.cnf

openssl_conf = openssl_init

.include fipsmodule.cnf

[openssl_init]
providers = provider_sect

[provider_sect]
fips = fips_sect
base = base_sect

[base_sect]
activate = 1

fipsmodule.cnf content

[root@ven-rhel etc]# cat fipsmodule.cnf
[fips_sect]
# activate = 1
conditional-errors = 1
security-checks = 1
module-mac = 67:48:52:5C:46:50:3C:D9:FD:73:DD:77:C0:51:DB:1C:32:48:8D:73:DA:CF:55:B6:38:C9:40:C1:54:7B:B6:D1

[paulidale]

You need to load the FIPS provider either via configuration or explicitly. Please read the migration guide.

[biao-billy]

@paulidale Is this wrong? It's referenced from the migration guild. How should I interpret it?

Applications may choose to load the FIPS provider explicitly rather than relying on config to do this. The config file is still necessary in order to hold the FIPS module config data (such as its self test status and integrity data)

[paulidale]

The FIPS provider needs the bits openssl fipsinstall creates. This is unconditional.

Your fipsmodule.cnf looks reasonable apart from the commented out activate line.

[mattcaswell]

Are you seeing any error message on the OpenSSL error stack, e.g. via ERR_print_errors_fp(stderr) or similar call?

[mattcaswell]

The code to load the FIPS provider looks ok to me at first glance.

[t8m]

Most probably the problem is with the relative path used in the .include fipsmodule.cnf directive. You need to use an absolute path or set OPENSSL_CONF_INCLUDE environment variable to the path where the fipsmodule.cnf is placed.

[t8m]

Otherwise the fipsmodule.cnf will be looked from the CWD of the application.

[biao-billy]

@paulidale @mattcaswell @t8m, thanks for your assistance.

First of all, I've read the migration guide many times, it's not prescriptive to what I want to accomplish, with many ambiguities. Please kindly point out anything I am clearly missing from the guide, or doing something that's clearly not confirming to the migration guide.

I have a couple fundamental questions:

1. Is FIPS module load by config file and by explicit API calls mutually exclusive or not. As I quoted from fips module guide above, the guide is pretty clear you need config file even if you load fips.so explicitly. Now what's not clear is for manual load, you need just fipsmodule.cnf? or you still need openssl.cnf where fipsmodule.cnf is referenced. @paulidale it would be great if you can clarify on that.

2. Is openssl fipsinstall build target required? I don't know why that's the case based on fips module guide. @paulidale can you please elaborate on why including this special purpose build target is unconditional?

... using the enable-fips option. If it is enabled, the FIPS provider gets built and installed in addition to the other standard providers. No separate installation procedure is necessary. There is however a dedicated install_fips make target, which serves the special purpose of installing only the FIPS provider into an existing OpenSSL installation.

3. Must fipsmodule.cnf be placed in the same directory as fips.so in the app?

@mattcaswell, no output from the error callback

int error_callback(const char *str, size_t len, void *u) {
    SvcLog(LEVEL_INFO, "OpenSSL: %s\n", str);

    return 1;
}
<snip>
ERR_print_errors_cb(error_callback, nullptr);

@t8m, the sample openssl.cnf uses non- absolute path. I tried .include ./fipsmodule.cnf to no avail.

# For FIPS
# Optionally include a file that is generated by the OpenSSL fipsinstall
# application. This file contains configuration data required by the OpenSSL
# fips provider. It contains a named section e.g. [fips_sect] which is
# referenced from the [provider_sect] below.
# Refer to the OpenSSL security policy for more information.
# .include fipsmodule.cnf

[paulidale]

Without running openssl fipsinstall you won't have the module checksum and the module won't load. So yes, it must be run.
This lives in the configuration file fipsmodule.cnf so you need that too -- regardless of how the FIPS provider is loaded. It's easiest via config.