Codestin Search App

ColtonWilley · 2026-02-04T18:22:35Z

Add OpenSSL FIPS baseline testing infrastructure

OpenSSL patches to enforce FIPS restrictions
Standalone test suite verifying wolfProvider matches baseline behavior
Scripts for patching OpenSSL
Documentation overhaul new integration guides

padelsbach · 2026-02-05T22:47:08Z

docs/FIPS_INTEGRATION_GUIDE.md

+| Restriction | Requirement |
+|-------------|-------------|
+| RSA Key Size | 2048 bits minimum |
+| SHA1 Signing | Blocked (verification allowed) |


SHA1 hashing is still enabled right? May want to clarify that

padelsbach · 2026-02-05T22:47:59Z

docs/FIPS_INTEGRATION_GUIDE.md

+## Replace Default Mode (Recommended for FIPS)
+
+FIPS certification applies system-wide, meaning all cryptographic operations should use the FIPS-validated module. wolfProvider's replace-default mode ensures this by making wolfProvider the primary cryptographic provider for all OpenSSL operations. In this model it is impossible for an application
+to use the default provider, any attempts to do so will yield wolfProvider instead.


Nit: unexpected line break here

padelsbach · 2026-02-05T22:50:45Z

docs/FIPS_INTEGRATION_GUIDE.md

+>
+> A thorough code review is recommended to ensure all cryptographic operations route through OpenSSL's provider interface.
+
+### Common Failures


Consider moving Common Failures section right below Run Your Tests

padelsbach · 2026-02-05T22:52:19Z

docs/FIPS_INTEGRATION_GUIDE.md

+
+### Run Your Tests
+
+Run your application's test suite against the baseline build. Fix any failures before proceeding.


Any more guidance on how to fix? Alternatively, maybe suggest they reach out to support@wolfssl for consulting?

padelsbach · 2026-02-06T16:32:34Z

docs/FIPS_INTEGRATION_GUIDE.md

+
+---
+
+### Option B: Manual Build (Autotools)


Is there a corresponding Option A?

padelsbach · 2026-02-06T16:32:49Z

docs/FIPS_INTEGRATION_GUIDE.md

+
+Choose the approach that fits your workflow.
+
+### Build Script


We should point out that the build script is the recommended path

padelsbach · 2026-02-06T16:35:40Z

docs/FIPS_INTEGRATION_GUIDE.md

+
+### Patch OpenSSL
+
+Apply FIPS baseline restrictions to your OpenSSL source tree. See [FIPS Baseline Patches](../patches/openssl-fips-baseline/README.md) for detailed options and common errors.


Could clarify this a bit, Eg. "This mode disables non-FIPS approved algorithms so one can evaluate their application before integrating wolfProvider".

padelsbach · 2026-02-06T16:38:58Z

docs/INTEGRATION_GUIDE.md

+```
+
+---
+


Consider adding notes about confirming the install, or running the unit and cmd line tests.

padelsbach · 2026-02-06T16:43:48Z

test/standalone/tests/fips_baseline/run.sh

+FIPS_VERSION="unknown"
+
+# Check if provider output indicates FIPS mode
+if ${OPENSSL_BIN} list -providers 2>/dev/null | grep -qi "fips"; then


Should we specifically check for "Baseline" here?

padelsbach · 2026-02-06T16:54:28Z

test/standalone/tests/fips_baseline/test_fips_baseline_main.c

+    /* Step 3: Create library contexts for each provider */
+    TEST_INFO("Step 3: Creating library contexts for each provider...");
+
+    g_default_libctx = OSSL_LIB_CTX_new();


Consider following naming convention from test/unit.c, eg: wpLibCtx and osslLibCtx

padelsbach · 2026-02-06T17:01:38Z

test/standalone/tests/fips_baseline/test_fips_baseline_main.c

+    }
+    TEST_INFO("  ✓ Default provider library context created");
+
+    g_wolfprov_libctx = OSSL_LIB_CTX_new();


I'm confused. Why load wolfprovider in this test? Isn't the whole point to prove OSSL behavior without wolfprov?

If we want to confirm that ossl fips baseline behaves same as wolfprov fips, recommend adding an option to the test executable to select which one to test.

Its tricky. For the user I do want them to baseline with this modified openssl with no wolfprovider at all. These tests are not really designed for the external user, they assume that the baseline behavior is functional. These are internal tests for us to use to validate the baseline behavior. I think if we start mixing and matching customers will get confused.

Understood, but the point remains. Why test something different than what the customer will use?

No, this is testing to validate that the patches themselves function properly. We have the inverse requirement we normally have, normally openssl is correct and we match their behavior, now wolfprovider is the source of truth and we are testing that our patches are correct and yield equivalent behavior.

Its would also make for a very long and confusing flow, as the baseline testing cant be run with replace default. So they would need to build without replace default to verify patches, and then clean everything and build a differently patched openssl and wolfprovider with replace default this time.

libwolfprov is already built or available with this flow iiuc. I'm not suggesting we test against replace default

I'm only suggesting running this test twice, with only one provider loaded at a time. Having both loaded seems like a risk of winding up at the wrong one (albeit a small risk)

Oh I see what you are saying. We could do the baseline with a single provider and then do it with replace default as the ground truth?

Exactly, just for extra peace of mind

padelsbach · 2026-02-06T17:10:24Z

test/standalone/tests/fips_baseline/test_fips_baseline_main.c

+    return TEST_SUCCESS;
+#endif
+
+    /* Test 1: MD5 should be unavailable in FIPS mode */


IIUC, the test mostly checks that functionality is disabled/removed. Consider adding a sanity check that a basic FIPS operation does work.

Initial implementation of opensl FIPS baseline process

0115b55

ColtonWilley requested review from SparkiDev, aidangarske and padelsbach February 4, 2026 18:22

padelsbach reviewed Feb 6, 2026

View reviewed changes

docs/INTEGRATION_GUIDE.md

```

---

Copy link

Contributor

padelsbach Feb 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding notes about confirming the install, or running the unit and cmd line tests.

padelsbach reviewed Feb 6, 2026

View reviewed changes

Update naming to be consistent, doc updates per comments

26fb139


		### Run Your Tests

		Run your application's test suite against the baseline build. Fix any failures before proceeding.


		Choose the approach that fits your workflow.

		### Build Script


		### Patch OpenSSL

		Apply FIPS baseline restrictions to your OpenSSL source tree. See [FIPS Baseline Patches](../patches/openssl-fips-baseline/README.md) for detailed options and common errors.

Conversation

ColtonWilley commented Feb 4, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

padelsbach Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

padelsbach Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

padelsbach Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

padelsbach Feb 6, 2026 •

edited

Loading

padelsbach Feb 6, 2026 •

edited

Loading

padelsbach Feb 6, 2026 •

edited

Loading