TLS configuration: library has no ciphers:ssl/ssl_lib.c

[gg2code]

Working on TLS as per https://vector.dev/docs/reference/configuration/tls/, vector is to connect with kafka, Loki and cloudwatch. But get the following error when creating a new image. Building sinks is failing.

Configuration error. error=Sink "kafka_sink": creating kafka producer failed: Client creation error: SSL_CTX_new() failed: ssl/ssl_lib.c:3955:(unknown function) error:0A0000A1:SSL routines::library has no ciphers

ERROR vector::topology::builder: Configuration error. error=Sink "loki_sink": Failed to build TLS connector: Could not build TLS connector: error:0A0000A1:SSL routines:(unknown function):library has no ciphers:ssl/ssl_lib.c:3955:

So in the openssl.cnf file, are we also supposed to pass cipher to be used.

config_diagnostics = 1
openssl_conf = openssl_init

.include /path/to/fipsmodule.cnf

[openssl_init]
providers = provider_sect
alg_section = algorithm_sect

[provider_sect]
fips = fips_sect
base = base_sect

[base_sect]
activate = 1

[algorithm_sect]
default_properties = fips=yes

[jszwedko]

Do I take this to mean you are building Vector? Can you share more about that process? Maybe the Dockerfile?

[gg2code]

Yes, building vector. Trying to create a hardened vector image.

[gg2code]

FROM timberio/vector:0.40.0-debian

# Install dependencies
RUN apt-get update && apt-get install -y \
    build-essential \
    wget \
    curl

# Set OpenSSL and FIPS versions
ENV OPENSSL_VERSION=3.0.9

# Download, build, and install OpenSSL with FIPS support
RUN wget https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz && \
    tar -xzvf openssl-$OPENSSL_VERSION.tar.gz && \
    cd openssl-$OPENSSL_VERSION && \
    ./Configure enable-fips && \
    make && \
    make install

# Create OpenSSL configuration file with FIPS settings
COPY openssl-fips.cnf /usr/local/ssl/openssl.cnf

# Set environment variables for OpenSSL and FIPS
ENV OPENSSL_CONF=/usr/local/ssl/openssl.cnf

ENTRYPOINT ["/usr/bin/vector"]

[jszwedko]

Thanks @gg2code .

I'm not sure if that Dockerfile will do what you want. The Vector binary distributed in the Docker images as OpenSSL statically compiled in:

root@4cb94a4e1212:/# ldd /usr/bin/vector
        linux-vdso.so.1 (0x0000ffffbad32000)
        libgcc_s.so.1 => /lib/aarch64-linux-gnu/libgcc_s.so.1 (0x0000ffffb52f0000)
        libpthread.so.0 => /lib/aarch64-linux-gnu/libpthread.so.0 (0x0000ffffb52c0000)
        libm.so.6 => /lib/aarch64-linux-gnu/libm.so.6 (0x0000ffffb5220000)
        libdl.so.2 => /lib/aarch64-linux-gnu/libdl.so.2 (0x0000ffffb51f0000)
        libc.so.6 => /lib/aarch64-linux-gnu/libc.so.6 (0x0000ffffb5040000)
        /lib/ld-linux-aarch64.so.1 (0x0000ffffbacf5000)

It looks like you want to dynamically link OpenSSL in which case you'll need to rebuild Vector and disable the static compilation of OpenSSL by removing the vendored flag here:

vector/Cargo.toml

Line 318 in dc0b408

openssl = { version = "0.10.66", default-features = false, features = ["vendored"] }

The statically compiled OpenSSL in Vector will still read openssl.cnf. It seems like maybe you are configuring ciphers that won't exist because the version of OpenSSL being used is not what you expect (i.e. not FIPS)?

[gg2code]

Thanks @jszwedko , Is there a version of vector that is truly fips compliant ?

So I'm trying to build a vector image that is fips compliant and getting library has no ciphers error. To build it, are you suggesting removing the above mentioned line 318 and re-building vector ?

[jszwedko]

Thanks @jszwedko , Is there a version of vector that is truly fips compliant ?

Not at the moment, but that is being tracked by #16535. Some Vector users have created their own custom builds to achieve sufficient compliance for their needs (dynamically linking OpenSSL with FIPs module, disabling sources and sinks they don't need that wouldn't be compliant, etc.).

So I'm trying to build a vector image that is fips compliant and getting library has no ciphers error. To build it, are you suggesting removing the above mentioned line 318 and re-building vector ?

I'm suggesting removing the vendored feature there and, yes, rebuilding Vector after that. That will create a build of Vector that dynamically links OpenSSL.