MINOR: stats: report the SSL library FIPS mode in "show info"

The "SSL library FIPS mode" indicator printed by "haproxy -vv" had no
equivalent in the CLI. Add a "FipsMode" field to "show info" so that the
FIPS state of the running process can be queried at runtime, using the
same openssl_fips_mode() helper as the -vv line and the fips_mode()
configuration condition.

The field is only emitted by builds with SSL support, and reports 0 when
the SSL library is not in FIPS mode or does not support FIPS mode at all.

diff --git a/include/haproxy/stats-t.h b/include/haproxy/stats-t.h
index 2e76750e098dba1c00398a91d4bd472b9923320b..f381d503001abfeca8e1a051d10e892065bc9577 100644 (file)
--- a/include/haproxy/stats-t.h
+++ b/include/haproxy/stats-t.h
@@ -343,6 +343,7 @@ enum stat_idx_info {
        ST_I_INF_NBTGROUPS,
        ST_I_INF_MASTER_ID,
        ST_I_INF_WORKER_ID,
+       ST_I_INF_FIPS_MODE,
 
        /* must always be the last one */
        ST_I_INF_MAX

diff --git a/src/stats.c b/src/stats.c
index f55cf578a6c4f1ef899404385c8af0919ae4daaa..6ad82371c33602e81355a75f4cf191a9739e2db3 100644 (file)
--- a/src/stats.c
+++ b/src/stats.c
@@ -177,6 +177,7 @@ const struct stat_col stat_cols_info[ST_I_INF_MAX] = {
        [ST_I_INF_NBTGROUPS]                      = { .name = "NbThreadGroups",              .alt_name = "nb_thread_groups",              .desc = "Number of started thread groups (global.thread-groups)" },
        [ST_I_INF_MASTER_ID]                      = { .name = "Master_id",                   .alt_name = "master_id",                     .desc = "Unique identifier of the master process, preserved across reloads (master-worker mode only)" },
        [ST_I_INF_WORKER_ID]                      = { .name = "Worker_id",                   .alt_name = "worker_id",                     .desc = "Unique identifier of this worker process, renewed on each reload unless set with global 'worker-id'" },
+       [ST_I_INF_FIPS_MODE]                      = { .name = "FipsMode",                    .alt_name = "fips_mode",                     .desc = "1 if the loaded SSL library is currently running in FIPS mode, otherwise zero" },
 };
 
 /* one line of info */
@@ -850,6 +851,9 @@ int stats_fill_info(struct field *line, int len, uint flags)
                line[ST_I_INF_MASTER_ID]              = mkf_str(FO_CONFIG|FN_OUTPUT|FS_SERVICE, global.master_id);
        if (global.worker_id)
                line[ST_I_INF_WORKER_ID]              = mkf_str(FO_CONFIG|FN_OUTPUT|FS_SERVICE, global.worker_id);
+#ifdef USE_OPENSSL
+       line[ST_I_INF_FIPS_MODE]                      = mkf_u32(FO_STATUS, openssl_fips_mode() > 0);
+#endif
        return 1;
 }