Horton

Re: Allow tests to pass in OpenSSL FIPS mode

Tom Lane <tgl@sss.pgh.pa.us>

View thread View on postgr.es
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Peter Eisentraut <peter@eisentraut.org>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>, markwkm@gmail.com
Date: 2025-09-14T19:02:15Z
Lists: pgsql-hackers 
[ blast-from-the-past department ]

I wrote:
> Peter Eisentraut <peter@eisentraut.org> writes:
>> I suggest that if there are no other concerns, we proceed with the patch 
>> set as is for now.

> After thinking about it for awhile, I guess I'm okay with only
> bothering to provide expected-files for FIPS failures under OpenSSL
> 3.x (which is how your patch is set up, I believe).  While there are
> certainly still LTS platforms with 1.x, we don't have to consider FIPS
> mode on them to be a supported case.

I see that Mark W. has just spun up a couple of BF animals running
FIPS mode under SLES 15 (goshawk and shoebill).  Not too surprisingly,
they are failing the MD5 test:

 select md5('') = 'd41d8cd98f00b204e9800998ecf8427e' AS "TRUE";
-ERROR:  could not compute MD5 hash: unsupported
+ERROR:  could not compute MD5 hash: disabled for FIPS
 select md5('a') = '0cc175b9c0f1b6a831c399e269772661' AS "TRUE";
-ERROR:  could not compute MD5 hash: unsupported
+ERROR:  could not compute MD5 hash: disabled for FIPS
(etc etc)

Should we revisit the decision to not support this spelling
of the error message?  SLES 15 has got another decade or so
of support according to wikipedia [1], so it's hard to call it
a dead platform.

It looks like it'd be easy enough to generate the required
alternate expected-file, just s/unsupported/disabled for FIPS/g.
Happy to take care of this if there are not objections.

			regards, tom lane

[1] https://en.wikipedia.org/wiki/SUSE_Linux_Enterprise#End-of-support_schedule

Commits

  1. Add regression expected-files for older OpenSSL in FIPS mode.

  2. Allow tests to pass in OpenSSL FIPS mode (rest)

  3. Allow tests to pass in OpenSSL FIPS mode (TAP tests)

  4. pgcrypto: Allow tests to pass in OpenSSL FIPS mode

  5. pgcrypto: Split off pgp-encrypt-md5 test

  6. citext: Allow tests to pass in OpenSSL FIPS mode

  7. Remove incidental md5() function uses from main regression tests

  8. Improve/correct comments

  9. Put tests of md5() function into separate test file