Blame SOURCES/0004-fips-mode.patch

4d1074
diff --git a/ospfd/ospf_vty.c b/ospfd/ospf_vty.c
4d1074
index 631465f..e084ff3 100644
4d1074
--- a/ospfd/ospf_vty.c
4d1074
+++ b/ospfd/ospf_vty.c
4d1074
@@ -1136,6 +1136,11 @@ DEFUN (ospf_area_vlink,
4d1074
 
4d1074
 	if (argv_find(argv, argc, "message-digest", &idx)) {
4d1074
 		/* authentication message-digest */
4d1074
+		if(FIPS_mode())
4d1074
+		{
4d1074
+			vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
4d1074
+			return CMD_WARNING_CONFIG_FAILED;
4d1074
+		}
4d1074
 		vl_config.auth_type = OSPF_AUTH_CRYPTOGRAPHIC;
4d1074
 	} else if (argv_find(argv, argc, "null", &idx)) {
4d1074
 		/* "authentication null" */
4d1074
@@ -1993,6 +1998,15 @@ DEFUN (ospf_area_authentication_message_digest,
4d1074
 				  ? OSPF_AUTH_NULL
4d1074
 				  : OSPF_AUTH_CRYPTOGRAPHIC;
4d1074
 
4d1074
+	if(area->auth_type == OSPF_AUTH_CRYPTOGRAPHIC)
4d1074
+	{
4d1074
+		if(FIPS_mode())
4d1074
+		{
4d1074
+			vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
4d1074
+			return CMD_WARNING_CONFIG_FAILED;
4d1074
+		}
4d1074
+	}
4d1074
+
4d1074
 	return CMD_SUCCESS;
4d1074
 }
4d1074
 
4d1074
@@ -6665,6 +6679,11 @@ DEFUN (ip_ospf_authentication_args,
4d1074
 
4d1074
 	/* Handle message-digest authentication */
4d1074
 	if (argv[idx_encryption]->arg[0] == 'm') {
4d1074
+		if(FIPS_mode())
4d1074
+		{
4d1074
+			vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
4d1074
+			return CMD_WARNING_CONFIG_FAILED;
4d1074
+		}
4d1074
 		SET_IF_PARAM(params, auth_type);
4d1074
 		params->auth_type = OSPF_AUTH_CRYPTOGRAPHIC;
4d1074
 		return CMD_SUCCESS;
4d1074
@@ -6971,6 +6990,11 @@ DEFUN (ip_ospf_message_digest_key,
4d1074
        "The OSPF password (key)\n"
4d1074
        "Address of interface\n")
4d1074
 {
4d1074
+	if(FIPS_mode())
4d1074
+	{
4d1074
+		vty_out(vty, "FIPS mode is enabled, md5 authentication is disabled\n");
4d1074
+		return CMD_WARNING_CONFIG_FAILED;
4d1074
+	}
4d1074
 	VTY_DECLVAR_CONTEXT(interface, ifp);
4d1074
 	struct crypt_key *ck;
4d1074
 	uint8_t key_id;
4d1074
diff --git a/isisd/isis_circuit.c b/isisd/isis_circuit.c
4d1074
index 81b4b39..cce33d9 100644
4d1074
--- a/isisd/isis_circuit.c
4d1074
+++ b/isisd/isis_circuit.c
4d1074
@@ -1318,6 +1318,10 @@ static int isis_circuit_passwd_set(struct isis_circuit *circuit,
4d1074
 		return ferr_code_bug(
4d1074
 			"circuit password too long (max 254 chars)");
4d1074
 
4d1074
+	//When in FIPS mode, the password never gets set in MD5
4d1074
+	if((passwd_type == ISIS_PASSWD_TYPE_HMAC_MD5) && FIPS_mode())
4d1074
+		return ferr_cfg_invalid("FIPS mode is enabled, md5 authentication is disabled");
4d1074
+
4d1074
 	circuit->passwd.len = len;
ce3795
 	strlcpy((char *)circuit->passwd.passwd, passwd,
ce3795
 		sizeof(circuit->passwd.passwd));
4d1074
diff --git a/isisd/isisd.c b/isisd/isisd.c
4d1074
index 419127c..a6c36af 100644
4d1074
--- a/isisd/isisd.c
4d1074
+++ b/isisd/isisd.c
4d1074
@@ -1638,6 +1638,10 @@ static int isis_area_passwd_set(struct isis_area *area, int level,
4d1074
 		if (len > 254)
4d1074
 			return -1;
4d1074
 
4d1074
+		//When in FIPS mode, the password never get set in MD5
4d1074
+		if ((passwd_type == ISIS_PASSWD_TYPE_HMAC_MD5) && (FIPS_mode()))
4d1074
+			return ferr_cfg_invalid("FIPS mode is enabled, md5 authentication is disabled");
4d1074
+
4d1074
 		modified.len = len;
ce3795
 		strlcpy((char *)modified.passwd, passwd,
ce3795
 			sizeof(modified.passwd));
4d1074
diff --git a/ripd/rip_cli.c b/ripd/rip_cli.c
4d1074
index 5bb81ef..02a09ef 100644
4d1074
--- a/ripd/rip_cli.c
4d1074
+++ b/ripd/rip_cli.c
4d1074
@@ -796,6 +796,12 @@ DEFPY (ip_rip_authentication_mode,
4d1074
 			value = "20";
4d1074
 	}
4d1074
 
4d1074
+	if(strmatch(mode, "md5") && FIPS_mode())
4d1074
+	{
4d1074
+		vty_out(vty, "FIPS mode is enabled, md5 authentication id disabled\n");
4d1074
+		return CMD_WARNING_CONFIG_FAILED;
4d1074
+	}
4d1074
+
4d1074
 	nb_cli_enqueue_change(vty, "./authentication-scheme/mode", NB_OP_MODIFY,
4d1074
 			      strmatch(mode, "md5") ? "md5" : "plain-text");
ce3795
 	if (strmatch(mode, "md5"))