]> git.kaiwu.me - haproxy.git/commit
MEDIUM: ssl: introduce src/fips.c with TLS version check
authorWilliam Lallemand <wlallemand@haproxy.com>
Tue, 30 Jun 2026 12:38:31 +0000 (12:38 +0000)
committerWilliam Lallemand <wlallemand@haproxy.com>
Fri, 10 Jul 2026 17:42:03 +0000 (19:42 +0200)
commit9ac590b55e8087a113389da4a503315bab494ca3
tree2e027c0c08ff2f5d396ac8511b48446119fa8720
parent475a69d2241e863e5e66b4669a4b84097c8782b3
MEDIUM: ssl: introduce src/fips.c with TLS version check

Add src/fips.c and include/haproxy/fips.h to centralise FIPS compliance
checks for AWS-LC builds.

ssl_fips_check_version() verifies that ssl-min-ver is not set below
TLS 1.2, which AWS-LC in FIPS mode would refuse to negotiate.

The check accepts an enum obj_type * so it can resolve the owning
bind/server and produce a precise error message including the proxy
and object name in the standard HAProxy 'type proxy/name' form.
Makefile
include/haproxy/fips.h [new file with mode: 0644]
src/fips.c [new file with mode: 0644]
src/ssl_sock.c