MyFavMirrors
/
minio
mirror of https://github.com/minio/minio.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fips: enforce FIPS-compliant TLS ciphers in FIPS mode (#20131) 

This commit enforces FIPS-compliant TLS ciphers in FIPS mode
by importing the `fipsonly` module.

Otherwise, MinIO still accepts non-FIPS compliant TLS connections.
This commit is contained in:
Andreas Auernhammer 2024-07-23 12:11:25 +02:00 committed by GitHub
parent b3a94c4e85
commit 4f5dded4d4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 3 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
internal/fips/api.go
View File

@ -138,10 +138,6 @@ func TLSCurveIDs() []tls.CurveID {
if !Enabled {
curves = append(curves, tls.X25519) // Only enable X25519 in non-FIPS mode
}
curves = append(curves, tls.CurveP256)
if go19 {
// With go1.19 enable P384, P521 newer constant time implementations.
curves = append(curves, tls.CurveP384, tls.CurveP521)
}
curves = append(curves, tls.CurveP256, tls.CurveP384, tls.CurveP521)
return curves
}

2
internal/fips/fips.go
View File

@ -20,4 +20,6 @@
package fips
import _ "crypto/tls/fipsonly"
const enabled = true

23
internal/fips/go19.go
View File

@ -1,23 +0,0 @@
// Copyright (c) 2015-2022 MinIO, Inc.
//
// This file is part of MinIO Object Storage stack
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see <http://www.gnu.org/licenses/>.
//go:build go1.19
// +build go1.19
package fips
const go19 = true

23
internal/fips/no_go19.go
View File

@ -1,23 +0,0 @@
// Copyright (c) 2015-2022 MinIO, Inc.
//
// This file is part of MinIO Object Storage stack
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see <http://www.gnu.org/licenses/>.
//go:build !go1.19
// +build !go1.19
package fips
const go19 = false