(PUP-3114) Added an enforcement for FIPS

FIPS mode requires that the keylength be restricted to 2048 bits instead
of the new standard 4096.

This patch provides that proper enforcement.
No, there is not. Unfortunately, all OpenSSL does is return a key
generation error. However, you don't know *why* it returned the error (bad
installation, FIPS, something else....).

The fact needs to be in facter since a LOT of services will need to adjust
their algorithm usage based on FIPS being enabled on the system.

If you don't want to be tied to a particular version of Facter, the easiest
thing to do would be to repeat the entire fact in the Puppet core. That
seemed a bit silly to me since there are already other facts being used
throughout the core.

Thanks,

Trevor

On Fri, Sep 26, 2014 at 6:56 PM, Josh Cooper <notifications@github.com>
wrote:

> In lib/puppet/ssl/key.rb:
>
> > @@ -22,7 +22,14 @@ def self.supported_formats
> >    # Knows how to create keys with our system defaults.
> >    def generate
> >      Puppet.info "Creating a new SSL key for #{name}"
> > -    @content = OpenSSL::PKey::RSA.new(Puppet[:keylength].to_i)
> > +    keylength = Puppet[:keylength].to_i
> > +    if Facter.value('fips_enabled') == 'true'
> > +      if keylength > 2048
> > +        Puppet.info "Forcing keylength to 2048 due to FIPS being enabled."
> > +        keylength = 2048
> > +      end
> > +    end
> > +    @content = OpenSSL::PKey::RSA.new(keylength)
>
> Is there a way to query OpenSSL programmatically to determine if it is in
> FIPS enabled mode? That way we're not dependent on a particular facter
> version?
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/puppetlabs/puppet/pull/3044/files#r18118450>.
>



-- 
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan@onyxpoint.com

-- This account not approved for unencrypted proprietary information --