From ba6930bb13e661a91fb555b06e9e8af9c82c2f03 Mon Sep 17 00:00:00 2001
From: Andreas Auernhammer <aead@mail.de>
Date: Mon, 8 Mar 2021 19:58:02 +0100
Subject: [PATCH] fips: always enable AES in FIPS mode when using madmin
 (#11732)

This commit adds FIPS-specifc build tags to the madmin
package. When madmin is compiled with `--tags "fips"`
it will always use AES-GCM for encryption - not just
when an optimized AES implementation is available.
---
 pkg/madmin/encrypt.go        |  2 +-
 pkg/madmin/encrypt_fips.go   | 22 ++++++++++++++++++++++
 pkg/madmin/encrypt_nofips.go | 24 ++++++++++++++++++++++++
 3 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 pkg/madmin/encrypt_fips.go
 create mode 100644 pkg/madmin/encrypt_nofips.go

diff --git a/pkg/madmin/encrypt.go b/pkg/madmin/encrypt.go
index debc42150..ef2937ab9 100644
--- a/pkg/madmin/encrypt.go
+++ b/pkg/madmin/encrypt.go
@@ -51,7 +51,7 @@ func EncryptData(password string, data []byte) ([]byte, error) {
 		err    error
 		stream *sio.Stream
 	)
-	if sioutil.NativeAES() { // Only use AES-GCM if we can use an optimized implementation
+	if useAES() { // Only use AES-GCM if we can use an optimized implementation
 		id = aesGcm
 		stream, err = sio.AES_256_GCM.Stream(key)
 	} else {
diff --git a/pkg/madmin/encrypt_fips.go b/pkg/madmin/encrypt_fips.go
new file mode 100644
index 000000000..0971c223e
--- /dev/null
+++ b/pkg/madmin/encrypt_fips.go
@@ -0,0 +1,22 @@
+// MinIO Cloud Storage, (C) 2021 MinIO, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// +build fips
+
+package madmin
+
+// useAES always returns true since AES is the only
+// option out of AES-GCM and ChaCha20-Poly1305 that
+// is approved by the NIST.
+func useAES() bool { return true }
diff --git a/pkg/madmin/encrypt_nofips.go b/pkg/madmin/encrypt_nofips.go
new file mode 100644
index 000000000..4d618b0b4
--- /dev/null
+++ b/pkg/madmin/encrypt_nofips.go
@@ -0,0 +1,24 @@
+// MinIO Cloud Storage, (C) 2021 MinIO, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// +build !fips
+
+package madmin
+
+import "github.com/secure-io/sio-go/sioutil"
+
+// useAES returns true if the executing CPU provides
+// AES-GCM hardware instructions and an optimized
+// assembler implementation is available.
+func useAES() bool { return sioutil.NativeAES() }