From ce8a8c0012b0e4c83ffb5817c11a92c10c1f4de5 Mon Sep 17 00:00:00 2001 From: Mike Beaumont Date: Mon, 29 Apr 2024 12:14:32 +0200 Subject: [PATCH] crypto/tls: don't call tlsrsakex.IncNonDefault with FIPS We haven't called tlsrsakex.Value() yet at this point if we're using FIPS, like if CipherSuites != nil. This adds needFIPS as a gate next to CipherSuites != nil. FIPS specifies suites that would be skipped if tlsarsakex were set. Fixes #65991 Change-Id: I8070d8f43f27c04067490af8cc7ec5e787f2b9bd Reviewed-on: https://go-review.googlesource.com/c/go/+/582315 Reviewed-by: Filippo Valsorda Reviewed-by: Cherry Mui TryBot-Bypass: Filippo Valsorda Auto-Submit: Filippo Valsorda Reviewed-by: Dmitri Shuralyov --- handshake_client.go | 2 +- handshake_server.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/handshake_client.go b/handshake_client.go index 0b35dee..d046c86 100644 --- a/handshake_client.go +++ b/handshake_client.go @@ -526,7 +526,7 @@ func (hs *clientHandshakeState) pickCipherSuite() error { return errors.New("tls: server chose an unconfigured cipher suite") } - if hs.c.config.CipherSuites == nil && rsaKexCiphers[hs.suite.id] { + if hs.c.config.CipherSuites == nil && !needFIPS() && rsaKexCiphers[hs.suite.id] { tlsrsakex.IncNonDefault() } diff --git a/handshake_server.go b/handshake_server.go index eb87ee0..d5f8cc8 100644 --- a/handshake_server.go +++ b/handshake_server.go @@ -370,7 +370,7 @@ func (hs *serverHandshakeState) pickCipherSuite() error { } c.cipherSuite = hs.suite.id - if c.config.CipherSuites == nil && rsaKexCiphers[hs.suite.id] { + if c.config.CipherSuites == nil && !needFIPS() && rsaKexCiphers[hs.suite.id] { tlsrsakex.IncNonDefault() }