Skip to content
Snippets Groups Projects
  • Stan Hu's avatar
    7f6ff530c9f7
    ruby: Enable OPENSSL_FIPS macro for system SSL builds · 7f6ff530c9f7
    Stan Hu authored
    In the Ubuntu 18.04 FIPS builds, currently `OpenSSL.fips_mode` is
    `false`, which prevents GitLab from entering FIPS mode.
    
    Even though these builds properly link against the FIPS-enabled system
    OpenSSL, this flag is `false` because Ruby compiles out the dynamic
    `FIPS_mode()` checks (https://wiki.openssl.org/index.php/FIPS_mode())
    unless the `OPENSSL_FIPS` macro is defined. In RedHat, `OPENSSL_FIPS`
    is always defined in `/usr/include/openssl/opensslconf-x86_64.h`, but
    this is not the case for Ubuntu. On non FIPS-systems, `FIPS_mode()`
    should return 0 (not available), so this compile-time guard should not
    be necessary. For now, we only enable it for builds that link
    against the system SSL.
    
    Relates to https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6775
    
    Changelog: fixed
    7f6ff530c9f7
    History
    ruby: Enable OPENSSL_FIPS macro for system SSL builds
    Stan Hu authored
    In the Ubuntu 18.04 FIPS builds, currently `OpenSSL.fips_mode` is
    `false`, which prevents GitLab from entering FIPS mode.
    
    Even though these builds properly link against the FIPS-enabled system
    OpenSSL, this flag is `false` because Ruby compiles out the dynamic
    `FIPS_mode()` checks (https://wiki.openssl.org/index.php/FIPS_mode())
    unless the `OPENSSL_FIPS` macro is defined. In RedHat, `OPENSSL_FIPS`
    is always defined in `/usr/include/openssl/opensslconf-x86_64.h`, but
    this is not the case for Ubuntu. On non FIPS-systems, `FIPS_mode()`
    should return 0 (not available), so this compile-time guard should not
    be necessary. For now, we only enable it for builds that link
    against the system SSL.
    
    Relates to https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6775
    
    Changelog: fixed