mirror of
https://github.com/haproxy/haproxy.git
synced 2026-07-11 10:07:10 -04:00
1739b648cf
When AWS-LC is built in FIPS mode, unconditionally override the
compile-time cipher defaults with FIPS-approved sets before config
parsing. Explicit ssl-default-{bind,server}-ciphers{suites} keywords
in the global section still take precedence over these defaults.
The approved sets are defined as macros in include/haproxy/defaults.h
alongside the existing CONNECT/LISTEN_DEFAULT_CIPHERS family:
CONNECT/LISTEN_DEFAULT_FIPS_CIPHERS - AES-128-GCM-SHA256 and
AES-256-GCM-SHA384 (TLS 1.2)
CONNECT/LISTEN_DEFAULT_FIPS_CIPHERSUITES - TLS_AES_128_GCM_SHA256 and
TLS_AES_256_GCM_SHA384 (TLS 1.3)
This ensures internal servers (httpclient, Lua SSL sockets) that
inherit global defaults also operate with FIPS-compliant cipher lists
without requiring explicit configuration.
|
||
|---|---|---|
| .. | ||
| haproxy | ||
| import | ||
| make | ||