HAProxy in FIPS Mode

ArunViswanath · March 6, 2024, 6:29pm

Hi.
I need to enable FIPS mode on the Community Edition HA Proxy. On reading certain documents on the HA Proxy site, they mention that HA Proxy depends on the OpenSSL installed on the system. If the OpenSSL version(OpenSSL 1.1.1f 31 Mar 2020) deployed is FIPS Compliant then the HA Proxy installed on the system will also be in FIPS mode. Can anyone confirm, that OpenSSL FIPS enabled is the only dependency or do we need to do some extra configuration on HA to run it on FIPS mode?

Do we need an Enterprise version HA Proxy to enable FIPS (say FIPS mode can be enabled only with the Enterprise version), or is only a community edition with OpenSSL FIPS mode sufficient?

I really appreciate any help you can provide.
Arun V

lukastribus · March 6, 2024, 8:47pm

Also see:

github.com/haproxy/haproxy

Need an Openssl initialization call for Openssl 1.1.x and above.

opened 09:10PM - 09 Feb 24 UTC

madhanrajrm

type: feature

### Your Feature Request As part of Haproxy __ssl_sock_init startup operation…, we are avoiding the initialization call if linked OpenSSL library is ssl6 or below :- ``` #if HA_OPENSSL_VERSION_NUMBER < 0x10100000L SSL_library_init(); #endif ``` https://github.com/haproxy/haproxy/blob/613e959c7bf65cf43a9c3cd4abdb1c0593b0beb8/src/ssl_sock.c#L7498 We know that starting OpenSSL 1.1.X it does dynamic initialization, but if any one needs explicit initialization when they want to do something like setting FIPS or something to do with engine as part of initialization . https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_init_ssl.html “ there may be situations when explicit initialization is desirable or needed, for example when some nondefault initialization is required.” Note:- We use custom OpenSSL 1.1.1 which we have got FIPS approved , so in order to enable FIPS mode we rely on OPENSSL_init_ssl initialization. I did below code on haproxy which has helped us with our problems. ``` #if HA_OPENSSL_VERSION_NUMBER < 0x10100000L SSL_library_init(); #elif OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL); #endif ``` So we would like to understand the possibility of allowing this implementation and if there are any implications. ### What are you trying to do? we need an explicity initialization call irrespective of openssl doing dynamic allocations so that we can do like setting/enabling/disabling FIPS mode or so. ### Output of `haproxy -vv` ```plain [root@cucm-8 HAPROXY]# ./haproxy -ddd -f ./haproxy_new.conf -vvv HA-Proxy version 2.2.32-4081d5a 2023/12/19 - https://haproxy.org/ Status: long-term supported branch - will stop receiving fixes around Q2 2025. Known bugs: http://www.haproxy.org/bugs/bugs-2.2.32.html Running on: Linux 4.18.0-372.16.1.el8_6.x86_64 #1 SMP Wed Jul 13 03:56:16 EDT 2022 x86_64 Build options : TARGET = custom CPU = generic CC = gcc CFLAGS = -m64 -march=x86-64 -O2 -g -Wall -Wextra -Wdeclaration-after-statement -fwrapv -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-clobbered -Wno-missing-field-initializers -Wno-stringop-overflow -Wno-cast-function-type -Wtype-limits -Wshift-negative-value -Wshift-overflow=2 -Wduplicated-cond -Wnull-dereference OPTIONS = USE_EPOLL=1 USE_THREAD=1 USE_LINUX_SPLICE=1 USE_OPENSSL=1 USE_CPU_AFFINITY=1 DEBUG = Feature list : -51DEGREES -ACCEPT4 -BACKTRACE -CLOSEFROM +CPU_AFFINITY -CRYPT_H -DEVICEATLAS -DL +EPOLL -EVPORTS -FUTEX -GETADDRINFO -KQUEUE -LIBCRYPT +LINUX_SPLICE -LINUX_TPROXY -LUA -NETFILTER -NS -OBSOLETE_LINKER +OPENSSL -PCRE -PCRE2 -PCRE2_JIT -PCRE_JIT +POLL -PRCTL -PRIVATE_CACHE -PTHREAD_PSHARED -RT -SLZ -STATIC_PCRE -STATIC_PCRE2 -SYSTEMD -TFO +THREAD -THREAD_DUMP -TPROXY -WURFL -ZLIB Default settings : bufsize = 16384, maxrewrite = 1024, maxpollevents = 200 Built with multi-threading support (MAX_THREADS=64, default=2). Built with OpenSSL version : OpenSSL 1.1.1t.7.2.500 Running on OpenSSL version : OpenSSL 1.1.1t.7.2.500 OpenSSL library supports TLS extensions : yes OpenSSL library supports SNI : yes OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3 Built without compression support (neither USE_ZLIB nor USE_SLZ are set). Compression algorithms supported : identity("identity") Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND Built without PCRE or PCRE2 support (using libc's regex instead) Encrypted password support via crypt(3): no Built with gcc compiler version 8.5.0 20210514 (Red Hat 8.5.0-10) Available polling systems : epoll : pref=300, test result OK poll : pref=200, test result OK select : pref=150, test result OK Total: 3 (3 usable), will use epoll. Available multiplexer protocols : (protocols marked as <default> cannot be specified using 'proto' keyword) fcgi : mode=HTTP side=BE mux=FCGI <default> : mode=HTTP side=FE|BE mux=H1 h2 : mode=HTTP side=FE|BE mux=H2 <default> : mode=TCP side=FE|BE mux=PASS Available services : none Available filters : [SPOE] spoe [COMP] compression [TRACE] trace [CACHE] cache [FCGI] fcgi-app ```

Topic		Replies	Views
How to run HAProxy in FIPs Mode? Help!	1	963	February 7, 2019
HAProxy as a FIPs compliance Help!	3	2185	January 22, 2019
Haproxy with FIPS failing Help!	6	818	March 7, 2024
Query regarding HAProxy and OpenSSL Help!	4	901	November 25, 2018
HAProxy configure OpenSSL version Help!	8	110	September 1, 2024

HAProxy in FIPS Mode

Related topics