From: Chris Staite <christopher.staite@menlosecurity.com>
Date: Sun, 1 Nov 2026 19:57:37 +0000 (+0000)
Subject: BUG/MEDIUM: ssl: skip TLS 1.3 suites in the FIPS TLS 1.2 cipher check
X-Git-Tag: v3.5-dev11~86
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=15c8469518a0d1f2e35266d5951c006b8492029e;p=haproxy.git

BUG/MEDIUM: ssl: skip TLS 1.3 suites in the FIPS TLS 1.2 cipher check

With AWS-LC in FIPS mode, ssl_fips_check_ciphers() walks the list returned
by SSL_CTX_get_ciphers() and rejects any entry whose key exchange is not
ECDHE (or DHE). But AWS-LC documents that this list includes the TLS 1.3
cipher suites as well, and for these SSL_CIPHER_get_kx_nid() returns
NID_kx_any since TLS 1.3 suites do not specify the key exchange. Every
TLS 1.3 suite is thus reported as a non-FIPS cipher, including the
FIPS-approved ones that are set by default:

  FIPS mode active but non-FIPS cipher(s) configured:
  'TLS_AES_128_GCM_SHA256', 'TLS_AES_256_GCM_SHA384'.

Since the internal httpclient server is checked as well, HAProxy refuses
to start in FIPS mode with any configuration, even one without a single
SSL setting. This was observed with AWS-LC FIPS 4.0.0.

TLS 1.3 suites are already validated against their own list by
ssl_fips_check_ciphersuites(), so ssl_fips_check_ciphers() must only
consider TLS 1.2 ciphers. Skip the ciphers whose minimum protocol version
is TLS 1.3 or above. SSL_CIPHER_get_min_version() was preferred over
testing for NID_kx_any because it expresses the intent directly rather
than relying on a side effect of how TLS 1.3 suites are described. Non-FIPS
TLS 1.2 ciphers (e.g. AES128-SHA or ECDHE-RSA-CHACHA20-POLY1305) and
non-FIPS TLS 1.3 suites (e.g. TLS_CHACHA20_POLY1305_SHA256) are still
rejected.

This bug was introduced in 3.5-dev3 by commit 9e2809508 ("MEDIUM: ssl: add
FIPS TLS 1.2 cipher check for AWS-LC"), no backport is needed.
---

diff --git a/src/fips.c b/src/fips.c
index 3b4a31418..04e14cfc3 100644
--- a/src/fips.c
+++ b/src/fips.c
@@ -241,6 +241,10 @@ int ssl_fips_check_ciphers(SSL_CTX *ctx, const enum obj_type *obj, char **err)
 		cipher     = sk_SSL_CIPHER_value(cipher_list, i);
 		cipher_nid = SSL_CIPHER_get_cipher_nid(cipher);
 
+		/* TLS 1.3 ciphersuites are checked by ssl_fips_check_ciphersuites() */
+		if (SSL_CIPHER_get_min_version(cipher) >= TLS1_3_VERSION)
+			continue;
+
 		kx_nid = SSL_CIPHER_get_kx_nid(cipher);
 		if (kx_nid == NID_kx_ecdhe
 #ifdef NID_kx_dhe