Vector FIPS Config

[ankycampy]

Hi All, we are following this link https://vector.dev/docs/reference/configuration/tls/ and working on FIPS provider example section, we have created a fips.so and fipsmodule.cnf file and defined in /etc/default/vector file as an environment variable.....Post restarting vector services we don't see any reference in vector internal logs that says Vector is running with FIPS config or FIPS config is active or vector is using FIPS modules etc etc.....are we missing something ? Is there a way to validate this ?

We have installed vector in Amazon Linux using yum install instructions.

[PaulSteinTR]

Update: we used these instructions to build FIPS.
https://github.com/openssl/openssl/blob/master/README-FIPS.md

Follow-up question, other than from Vector docs stating openSSL v4.0 is used internally, where is it defined or shown the source/libraries for openSSL?

[pront]

Hi @PaulSteinTR, I suppose you were following this example: https://vector.dev/docs/reference/configuration/tls/#fips-provider-example

Vector is using the https://crates.io/crates/openssl crate.
See version here: https://github.com/vectordotdev/vector/blob/master/Cargo.toml#L350

A few things to check:

• Did you verify with openssl version that fips is shown in the version?
• Do you restart with sudo systemctl restart vector?
• Do you see different logs on start vs restart? If so please share.

Related:

• FIPS enabled system unable to use TLS #21232
• FIPS compliance #8435

[PaulSteinTR]

Thanks, Pront.
Yes. I used that FIPS example in my openssl.cnf.

Pront: Vector is using the https://crates.io/crates/openssl crate.
openssl = { version = "0.10.68", default-features = false, features = ["vendored"] }
Paul: From this page: https://vector.dev/docs/reference/configuration/tls/
it states, "the official Vector binaries are statically linked against OpenSSL version 3.4.0".
Q - how can this be?
Q - What am I missing?
Q - Is there another set of documentation listing Vector as FIPs compliant and steps to install? Because following what's in place today doesn't seem to get the customer across the finish line.

All thoughts and ideas would be helpful and appreciated.

[pront]

Hello, I added references to some issues. I recommending going through them to understand where we are today with FIPS compliance (which is something we want in Vector).

Q - how can this be?
Q - What am I missing?

This questions are not clear but I guess there's confusion around the openssl crate. The crate provides bindings i.e. a layer that connects Rust code to the underlying OpenSSL library, allowing Rust programs to utilize OpenSSL's functionalities.

FIPS compliant TLS connections should work based on the docs example unless there's a bug like this one.

[PaulSteinTR]

Thanks, Pront. That helps.

Circling back to Ankur's original post, can you help answer this:

Ankurcampy: Post restarting vector services we don't see any reference in vector internal logs that says Vector is running with FIPS config or FIPS config is active or vector is using FIPS modules etc etc.....are we missing something?

[pront]

You copy/pasted the same text as before so it's hard for me to further assist you.

I asked some questions before:

Did you verify with openssl version that fips is shown in the version?
Do you think you hit this bug? #21232

If I am reading the tea leaves correctly, this is not about a restart, it seems like you never managed to get it working with FIPS.

[PaulSteinTR]

Correct. It's not about a restart.
I copied the same text because I'm still searching for the answer to Ankurcampy's question about how we confirm Vector is running in FIPS with modules loaded.

I'll look back in our logs for anything resembling the #21232 bug you listed.

[PaulSteinTR]

Another question:
The official Vector binaries are statically linked against OpenSSL version 3.4.0. Is this through Vector's use of a Rust openssl crate?
Ref: openssl = { version = "0.10.68", default-features = false, features = ["vendored"] }
If openssl is NOT installed at a system level, can you point me to where openssl is located within Vector so Rust can define a crate against it and use the cryptographic capabilities? (if that makes sense).

[pront]

OpenSSL is statically linked. This is because we use https://crates.io/crates/openssl crate with the vendored feature ON. Take a look at the docs here: https://docs.rs/openssl/0.10.68/openssl/index.html#vendored

So, we need to look at what https://github.com/alexcrichton/openssl-src-rs/tree/300.4.1%2B3.4.0 points to.

Note: Need to look at what version Vector uses -> https://github.com/vectordotdev/vector/blob/master/Cargo.toml#L410C1-L410C12

In this case, 3.4.0.

MAJOR=3
MINOR=4
PATCH=0
PRE_RELEASE_TAG=
BUILD_METADATA=
RELEASE_DATE="22 Oct 2024"
SHLIB_VERSION=3

[PaulSteinTR]

Excellent & Interesting. Thank you for stringing this together.

Knowing this, I need to ask how Vector can be FIPS compliant by using v3.4.0 through the use of 'crate'd openssl with 'vendored = on' when openssl FIPS compliance stops at v3.0.9?
(List of compliant openssl here:) https://openssl-library.org/source/

If the answer is found further down the TLS page using the installation steps from the doc: https://vector.dev/docs/reference/configuration/tls/
..... this is mentioned:
"Not all versions of the OpenSSL FIPS module have been validated. However, it is possible to use previous validated versions of the FIPS module with newer versions of OpenSSL, such as the version used in Vector."

With this in mind, I was able to create the fips.so, fipsmodule.cnf and setup openssl.cnf in all the right directories following the insturctions. When I ran systemctl stop/start vector I believe Vector now has the capability to use cryptography when sending logs.
I just can't confirm this from the Vector logs.

Question: is there a CLI method within Vector to output if the VIPS Provider is being used for confirmation?

[PaulSteinTR]

If it's not possible to confirm whether Vector, through the CLI or from logs, can this be added to a 'feature request'?
If it's already in place please point me to how this can be confirmed. Thanks.

[pront]

There is a workaround:

# use this
ldd $(which vector) | grep ssl

# or this
strings $(which vector) | grep -i "OpenSSL"
# ...
# OpenSSL 3.4.0 22 Oct 2024
# ...

But it would be a nice enhancement. You can use this form to request this: https://github.com/vectordotdev/vector/issues/new?template=feature.yml