From 9695829e5b39b779a53edb8032cbfef42fed161a Mon Sep 17 00:00:00 2001 From: Luis Neto Date: Thu, 30 Jan 2025 05:47:07 -0800 Subject: [PATCH] TUN-8857: remove restriction for using FIPS and PQ ## Summary When the FIPS compliance was achieved with HTTP/2 Transport the technology at the time wasn't available or certified to be used in tandem with Post-Quantum encryption. Nowadays, that is possible, thus, we can also remove this restriction from Cloudflared. Closes TUN-8857 --- cmd/cloudflared/tunnel/cmd.go | 2 -- cmd/cloudflared/tunnel/configuration.go | 5 ----- component-tests/test_pq.py | 14 +++++++++----- 3 files changed, 9 insertions(+), 12 deletions(-) diff --git a/cmd/cloudflared/tunnel/cmd.go b/cmd/cloudflared/tunnel/cmd.go index 9c80ffe8..a7287fb0 100644 --- a/cmd/cloudflared/tunnel/cmd.go +++ b/cmd/cloudflared/tunnel/cmd.go @@ -31,7 +31,6 @@ import ( "github.com/cloudflare/cloudflared/credentials" "github.com/cloudflare/cloudflared/diagnostic" "github.com/cloudflare/cloudflared/edgediscovery" - "github.com/cloudflare/cloudflared/fips" "github.com/cloudflare/cloudflared/ingress" "github.com/cloudflare/cloudflared/logger" "github.com/cloudflare/cloudflared/management" @@ -926,7 +925,6 @@ func tunnelFlags(shouldHide bool) []cli.Flag { Usage: "When given creates an experimental post-quantum secure tunnel", Aliases: []string{"pq"}, EnvVars: []string{"TUNNEL_POST_QUANTUM"}, - Hidden: fips.IsFipsEnabled(), }), altsrc.NewBoolFlag(&cli.BoolFlag{ Name: "management-diagnostics", diff --git a/cmd/cloudflared/tunnel/configuration.go b/cmd/cloudflared/tunnel/configuration.go index 46a2bc6f..15c54954 100644 --- a/cmd/cloudflared/tunnel/configuration.go +++ b/cmd/cloudflared/tunnel/configuration.go @@ -23,7 +23,6 @@ import ( "github.com/cloudflare/cloudflared/edgediscovery" "github.com/cloudflare/cloudflared/edgediscovery/allregions" "github.com/cloudflare/cloudflared/features" - "github.com/cloudflare/cloudflared/fips" "github.com/cloudflare/cloudflared/ingress" "github.com/cloudflare/cloudflared/orchestration" "github.com/cloudflare/cloudflared/supervisor" @@ -125,10 +124,6 @@ func prepareTunnelConfig( transportProtocol := c.String("protocol") - if c.Bool("post-quantum") && fips.IsFipsEnabled() { - return nil, nil, fmt.Errorf("post-quantum not supported in FIPS mode") - } - featureSelector, err := features.NewFeatureSelector(ctx, namedTunnel.Credentials.AccountTag, c.StringSlice("features"), c.Bool("post-quantum"), log) if err != nil { return nil, nil, errors.Wrap(err, "Failed to create feature selector") diff --git a/component-tests/test_pq.py b/component-tests/test_pq.py index a7b2ed50..2681e935 100644 --- a/component-tests/test_pq.py +++ b/component-tests/test_pq.py @@ -1,7 +1,6 @@ -from util import LOGGER, nofips, start_cloudflared, wait_tunnel_ready +from util import LOGGER, start_cloudflared, wait_tunnel_ready -@nofips class TestPostQuantum: def _extra_config(self): config = { @@ -12,6 +11,11 @@ class TestPostQuantum: def test_post_quantum(self, tmp_path, component_tests_config): config = component_tests_config(self._extra_config()) LOGGER.debug(config) - with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], cfd_args=["run", "--post-quantum"], new_process=True): - wait_tunnel_ready(tunnel_url=config.get_url(), - require_min_connections=1) + with start_cloudflared( + tmp_path, + config, + cfd_pre_args=["tunnel", "--ha-connections", "1"], + cfd_args=["run", "--post-quantum"], + new_process=True, + ): + wait_tunnel_ready(tunnel_url=config.get_url(), require_min_connections=1)