upstream/haproxy
1
0
Fork 0
mirror of https://github.com/haproxy/haproxy.git synced 2026-07-15 03:56:56 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

MEDIUM: ssl: set FIPS-approved curve defaults for AWS-LC FIPS builds

Browse source 
When AWS-LC is built in FIPS mode, unconditionally override the
compile-time curve defaults with the FIPS-approved NIST P-curves
before config parsing. Explicit ssl-default-{bind,server}-curves
keywords in the global section still take precedence over these
defaults.

The approved set is defined as macros in include/haproxy/defaults.h
alongside the existing CONNECT/LISTEN_DEFAULT_FIPS_CIPHERS family:
  CONNECT/LISTEN_DEFAULT_FIPS_CURVES - P-256, P-384, P-521

This ensures that internal servers (httpclient, Lua SSL sockets) that
inherit global defaults also operate with FIPS-compliant curve lists
without requiring explicit configuration.
This commit is contained in:
William Lallemand 2026-06-30 13:26:19 +00:00
parent 29f5126317
commit 3b2cd5f9fb
2 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
include/haproxy/defaults.h
View file

@ -460,6 +460,15 @@
#define LISTEN_DEFAULT_FIPS_CIPHERSUITES "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384"
#endif
/* FIPS-approved elliptic curves for AWS-LC FIPS builds (NIST P-curves only) */
#ifndef CONNECT_DEFAULT_FIPS_CURVES
#define CONNECT_DEFAULT_FIPS_CURVES "P-256:P-384:P-521"
#endif
#ifndef LISTEN_DEFAULT_FIPS_CURVES
#define LISTEN_DEFAULT_FIPS_CURVES "P-256:P-384:P-521"
#endif
/* named curve used as defaults for ECDHE ciphers */
#ifndef ECDHE_DEFAULT_CURVE
#define ECDHE_DEFAULT_CURVE "prime256v1"

4
src/ssl_sock.c
View file

@ -8545,6 +8545,10 @@ static void __ssl_sock_init(void)
global_ssl.listen_default_ciphersuites = strdup(LISTEN_DEFAULT_FIPS_CIPHERSUITES);
free(global_ssl.connect_default_ciphersuites);
global_ssl.connect_default_ciphersuites = strdup(CONNECT_DEFAULT_FIPS_CIPHERSUITES);
free(global_ssl.listen_default_curves);
global_ssl.listen_default_curves = strdup(LISTEN_DEFAULT_FIPS_CURVES);
free(global_ssl.connect_default_curves);
global_ssl.connect_default_curves = strdup(CONNECT_DEFAULT_FIPS_CURVES);
}
#endif /* OPENSSL_IS_AWSLC */