[Swan-commit] Changes to ref refs/heads/master

[Paul Wouters]

New commits:
commit dc6172dc5a06b966d5675371e375af2ebd775c9e
Author: Paul Wouters <pwouters at redhat.com>
Date:   Fri Apr 24 13:18:23 2020 -0400

    FIPS: split fips mode checks from pluto binary check
    
    Compiling with USE_FIPSCHECK used to compile support for two things:
    - pluto self test using fipscheck library
    - activate fips when detecting system is in fips mode
    
    USE_FIPSCHECK now only refers to the first item. Being able to run
    in fips mode is now always possible, even without USE_FIPSCHECK
    support.
    
    Note that as of version 3.30, the KDF's implemented in libreswan
    have been moved to NSS. Since all crypto was already outsourced
    to NSS, this means that libreswan itself provides no algorithms
    that require FIPS testing, and therefor cannot be FIPS certified.
    Only NSS and the kernel requires FIPS certification for libreswan
    to run in fips mode. As a result, there is no more need to support
    the FIPS requirement for binary selftest.
    
    Additionally, the concept of a "FIPS Product" that is independent of the
    kernel fips mode was abandoned. This is now only needed for compiling for
    older distributions such as RHEL6 to RHEL-8.1.  It is not required for
    RHEL-8.2 and onwards. Compiling without USE_FIPSCHECK now still allows
    (and causes) libreswan to run in fips mode, if it detects the kernel
    was booted in fips mode.
    
    The option USE_FIPSCHECK=true therefor means to use both the old
    FIPS Product test, as well as performing the pluto binary check
    using the fipscheck library. This is irrespective of whether USE_NSS_PRF
    is enabled or disabled. If USE_NSS_PRF is disabled, then libreswan
    in theory must use USE_FIPSCHECK to selftest for FIPS compliance.
    (although since the KDF in libreswan only uses RFC methods with
    NSS provided secure hash functions, your FIPS testlab might be able
    to argue that this is not needed)
    
    There are some tests in libreswan that were only run when compiled
    with the old style USE_FIPSCHECK which was the only way to run in
    FIPS mode until now. Some of these checks, such as minimum RSA key
    size, are sensisble to run even when not running in FIPS mode. These
    checks have been moved outside of checking for fips mode.
    
    This commit also disables USE_FIPSCHECK for fedora. It is still
    enabled for RHEL8 (and older releases) per default to allow compiling
    with FIPS support using older NSS versions that do not have IKE KDF
    support yet.