Blame SOURCES/0004-fips-mode.patch

800a7b
diff --git a/ospfd/ospf_vty.c b/ospfd/ospf_vty.c
800a7b
index 631465f..e084ff3 100644
800a7b
--- a/ospfd/ospf_vty.c
800a7b
+++ b/ospfd/ospf_vty.c
800a7b
@@ -1136,6 +1136,11 @@ DEFUN (ospf_area_vlink,
800a7b
 
800a7b
 	if (argv_find(argv, argc, "message-digest", &idx)) {
800a7b
 		/* authentication message-digest */
800a7b
+		if(FIPS_mode())
800a7b
+		{
800a7b
+			vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
800a7b
+			return CMD_WARNING_CONFIG_FAILED;
800a7b
+		}
800a7b
 		vl_config.auth_type = OSPF_AUTH_CRYPTOGRAPHIC;
800a7b
 	} else if (argv_find(argv, argc, "null", &idx)) {
800a7b
 		/* "authentication null" */
800a7b
@@ -1993,6 +1998,15 @@ DEFUN (ospf_area_authentication_message_digest,
800a7b
 				  ? OSPF_AUTH_NULL
800a7b
 				  : OSPF_AUTH_CRYPTOGRAPHIC;
800a7b
 
800a7b
+	if(area->auth_type == OSPF_AUTH_CRYPTOGRAPHIC)
800a7b
+	{
800a7b
+		if(FIPS_mode())
800a7b
+		{
800a7b
+			vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
800a7b
+			return CMD_WARNING_CONFIG_FAILED;
800a7b
+		}
800a7b
+	}
800a7b
+
800a7b
 	return CMD_SUCCESS;
800a7b
 }
800a7b
 
800a7b
@@ -6665,6 +6679,11 @@ DEFUN (ip_ospf_authentication_args,
800a7b
 
800a7b
 	/* Handle message-digest authentication */
800a7b
 	if (argv[idx_encryption]->arg[0] == 'm') {
800a7b
+		if(FIPS_mode())
800a7b
+		{
800a7b
+			vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
800a7b
+			return CMD_WARNING_CONFIG_FAILED;
800a7b
+		}
800a7b
 		SET_IF_PARAM(params, auth_type);
800a7b
 		params->auth_type = OSPF_AUTH_CRYPTOGRAPHIC;
800a7b
 		return CMD_SUCCESS;
800a7b
@@ -6971,6 +6990,11 @@ DEFUN (ip_ospf_message_digest_key,
800a7b
        "The OSPF password (key)\n"
800a7b
        "Address of interface\n")
800a7b
 {
800a7b
+	if(FIPS_mode())
800a7b
+	{
800a7b
+		vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
800a7b
+		return CMD_WARNING_CONFIG_FAILED;
800a7b
+	}
800a7b
 	VTY_DECLVAR_CONTEXT(interface, ifp);
800a7b
 	struct crypt_key *ck;
800a7b
 	uint8_t key_id;
800a7b
diff --git a/isisd/isis_circuit.c b/isisd/isis_circuit.c
800a7b
index 81b4b39..cce33d9 100644
800a7b
--- a/isisd/isis_circuit.c
800a7b
+++ b/isisd/isis_circuit.c
800a7b
@@ -1318,6 +1318,10 @@ static int isis_circuit_passwd_set(struct isis_circuit *circuit,
800a7b
 		return ferr_code_bug(
800a7b
 			"circuit password too long (max 254 chars)");
800a7b
 
800a7b
+	//When in FIPS mode, the password never gets set in MD5
800a7b
+	if((passwd_type == ISIS_PASSWD_TYPE_HMAC_MD5) && FIPS_mode())
800a7b
+		return ferr_cfg_invalid("FIPS mode is enabled, md5 authentication is disabled");
800a7b
+
800a7b
 	circuit->passwd.len = len;
80b0bb
 	strlcpy((char *)circuit->passwd.passwd, passwd,
80b0bb
 		sizeof(circuit->passwd.passwd));
800a7b
diff --git a/isisd/isisd.c b/isisd/isisd.c
800a7b
index 419127c..a6c36af 100644
800a7b
--- a/isisd/isisd.c
800a7b
+++ b/isisd/isisd.c
800a7b
@@ -1638,6 +1638,10 @@ static int isis_area_passwd_set(struct isis_area *area, int level,
800a7b
 		if (len > 254)
800a7b
 			return -1;
800a7b
 
800a7b
+		//When in FIPS mode, the password never get set in MD5
800a7b
+		if ((passwd_type == ISIS_PASSWD_TYPE_HMAC_MD5) && (FIPS_mode()))
800a7b
+			return ferr_cfg_invalid("FIPS mode is enabled, md5 authentication is disabled");
800a7b
+
800a7b
 		modified.len = len;
80b0bb
 		strlcpy((char *)modified.passwd, passwd,
80b0bb
 			sizeof(modified.passwd));
800a7b
diff --git a/ripd/rip_cli.c b/ripd/rip_cli.c
800a7b
index 5bb81ef..02a09ef 100644
800a7b
--- a/ripd/rip_cli.c
800a7b
+++ b/ripd/rip_cli.c
800a7b
@@ -796,6 +796,12 @@ DEFPY (ip_rip_authentication_mode,
800a7b
 			value = "20";
800a7b
 	}
800a7b
 
800a7b
+	if(strmatch(mode, "md5") && FIPS_mode())
800a7b
+	{
800a7b
+		vty_out(vty, "FIPS mode is enabled, md5 authentication id disabled\n");
800a7b
+		return CMD_WARNING_CONFIG_FAILED;
800a7b
+	}
800a7b
+
800a7b
 	nb_cli_enqueue_change(vty, "./authentication-scheme/mode", NB_OP_MODIFY,
800a7b
 			      strmatch(mode, "md5") ? "md5" : "plain-text");
80b0bb
 	if (strmatch(mode, "md5"))