From: William Lallemand <wlallemand@haproxy.com>
Date: Mon, 12 Oct 2026 14:04:28 +0000 (+0000)
Subject: MINOR: stats: report the SSL library FIPS mode in "show info"
X-Git-Tag: v3.5-dev9~28
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=4e6160c786a025f9050a260a39a1ef99045a2cc2;p=haproxy.git

MINOR: stats: report the SSL library FIPS mode in "show info"

The "SSL library FIPS mode" indicator printed by "haproxy -vv" had no
equivalent in the CLI. Add a "FipsMode" field to "show info" so that the
FIPS state of the running process can be queried at runtime, using the
same openssl_fips_mode() helper as the -vv line and the fips_mode()
configuration condition.

The field is only emitted by builds with SSL support, and reports 0 when
the SSL library is not in FIPS mode or does not support FIPS mode at all.
---

diff --git a/include/haproxy/stats-t.h b/include/haproxy/stats-t.h
index 2e76750e0..f381d5030 100644
--- a/include/haproxy/stats-t.h
+++ b/include/haproxy/stats-t.h
@@ -343,6 +343,7 @@ enum stat_idx_info {
 	ST_I_INF_NBTGROUPS,
 	ST_I_INF_MASTER_ID,
 	ST_I_INF_WORKER_ID,
+	ST_I_INF_FIPS_MODE,
 
 	/* must always be the last one */
 	ST_I_INF_MAX
diff --git a/src/stats.c b/src/stats.c
index f55cf578a..6ad82371c 100644
--- a/src/stats.c
+++ b/src/stats.c
@@ -177,6 +177,7 @@ const struct stat_col stat_cols_info[ST_I_INF_MAX] = {
 	[ST_I_INF_NBTGROUPS]                      = { .name = "NbThreadGroups",              .alt_name = "nb_thread_groups",              .desc = "Number of started thread groups (global.thread-groups)" },
 	[ST_I_INF_MASTER_ID]                      = { .name = "Master_id",                   .alt_name = "master_id",                     .desc = "Unique identifier of the master process, preserved across reloads (master-worker mode only)" },
 	[ST_I_INF_WORKER_ID]                      = { .name = "Worker_id",                   .alt_name = "worker_id",                     .desc = "Unique identifier of this worker process, renewed on each reload unless set with global 'worker-id'" },
+	[ST_I_INF_FIPS_MODE]                      = { .name = "FipsMode",                    .alt_name = "fips_mode",                     .desc = "1 if the loaded SSL library is currently running in FIPS mode, otherwise zero" },
 };
 
 /* one line of info */
@@ -850,6 +851,9 @@ int stats_fill_info(struct field *line, int len, uint flags)
 		line[ST_I_INF_MASTER_ID]              = mkf_str(FO_CONFIG|FN_OUTPUT|FS_SERVICE, global.master_id);
 	if (global.worker_id)
 		line[ST_I_INF_WORKER_ID]              = mkf_str(FO_CONFIG|FN_OUTPUT|FS_SERVICE, global.worker_id);
+#ifdef USE_OPENSSL
+	line[ST_I_INF_FIPS_MODE]                      = mkf_u32(FO_STATUS, openssl_fips_mode() > 0);
+#endif
 	return 1;
 }