Open rokek opened 6 years ago
Did you make a commit?
Yes, in this branch: https://github.com/rokek/couchdb/tree/md5-hash-fips
Did you review the Erlang Crypto documentation on FIPS?
It seems the correct answer is to use the FIPS enabled Crypto library. Need to determine if Couch will build with Crypto library configured.
It's interesting that Erlang has that, but I'm not sure how it would help because FIPS mode disallows OpenSSL md5 calls. The doc you linked points that out:
The crypto application supports using OpenSSL in FIPS mode. In this scenario only the validated algorithms provided by the Object Module are accessible, other algorithms usually available in OpenSSL (like md5) or implemented in the Erlang code (like SRP) are disabled.
The doc also describes the approach I took to work around the problem for these non-crypto (verification-only) use cases:
For exceptional, non-cryptographic use cases one may consider switching to erlang:md5/1 as well.
Added a module named couch_hash, but it is not found when tests run with
make check
. Maybe I missed a place where it is required to define modules?Expected Behavior
Code compiles and CouchDB tests succeed.
Current Behavior
Code compiles but CouchDB tests fail with:
Failed to start all the nodes. Check the dev/logs/*.log for errors.
{error,on_load_failure} = load_app_module(couch_hash) {"init terminating in do_boot",{{error,{{shutdown,{failed_to_start_child,"couch_epi|chttpd_auth|keeper",{undef,[{couch_hash,hash,[<<2 bytes>>],[]},{couch_epi_util,hash,1,[{file,"src/couch_epi_util.erl"},{line,25}]},{couch_epi_functions,data,1,[{file,"src/couch_epi_functions.erl"},{line,33}]},{couch_epi_module_keeper,do_reload_if_updated,1,[{file,"src/couch_epi_module_keeper.erl"},{line,116}]},{gen_server,init_it,6,[{file,"gen_server.erl"},{line,304}]},{proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,239}]}]}}},{couch_epi_app,start,[normal,[]]}}},[{boot_node,start_app,3,[{file,"dev/boot_node.erl"},{line,134}]},{lists,foldl,3,[{file,"lists.erl"},{line,1248}]},{boot_node,start_app,3,[{file,"dev/boot_node.erl"},{line,124}]},{lists,foldl,3,[{file,"lists.erl"},{line,1248}]},{init,start_it,1,[]},{init,start_em,1,[]}]}}
Possible Solution
Determine where to define couch_hash module so that couch_hash:hash is available to existing CouchDB code and tests.
Steps to Reproduce (for bugs)
Context
Before attempting to run CouchDB, I expect the added couch_hash module to work within CouchDB's existing tests.
Your Environment