elastic / elastic/apm-agent-python

apm agent fails in a FIPS enabled host

Open
#2,115 1 comment 0 reactions 0 assignees View on GitHub
agent-python community triage
Dominant language
Python
Stars
431
Forks
239
Avg merge
5d 10h
Merged PRs (30d)
7

Description

``We are running a webapp on Azure, which uses Elastic APM (elastic-apm==6.23.0). Since 08/29/2024, without changing anything our app is failing to run, with:

```
crypto/fips/fips.c:154: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE
Aborted (core dumped)
```

We noticed the Azure webapp environment (linux) now has the following kernel parameter:

```
# sysctl crypto.fips_enabled
crypto.fips_enabled = 1
```

**To Reproduce**

```
# python
Python 3.12.2 (main, Feb 22 2024, 11:15:41) [GCC 10.2.1 20210110] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import elasticapm
>>> apm=elasticapm.Client()
>>> elasticapm.instrument()
crypto/fips/fips.c:154: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE
Aborted (core dumped)
#
```

**Environment (please complete the following information)**
- OS: Linux hostname 5.15.164.1-1.cm2 #1 SMP Sun Aug 18 19:16:21 UTC 2024 x86_64 GNU/Linux
- Python version: 3.12
- APM Server version: unrelevant, it fail before even connecting (no need to have an APM server to test it)
- Agent version: 6.23.0

**Additional context**

```
(antenv) root@aiops-dev_0ac897ce81:/tmp/8dccb366a943910# python
Python 3.12.2 (main, Feb 22 2024, 11:15:41) [GCC 10.2.1 20210110] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import elasticapm
>>> apm=elasticapm.Client()
>>> elasticapm.instrument()
crypto/fips/fips.c:154: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE
Aborted (core dumped)
(antenv) root@aiops-dev_0ac897ce81:/tmp/8dccb366a943910#

Linux aiops-dev_0ac897ce81 5.15.164.1-1.cm2 #1 SMP Sun Aug 18 19:16:21 UTC 2024 x86_64 GNU/Linux

(antenv) root@aiops-dev_0ac897ce81:/tmp/8dccb366a943910# sysctl crypto.fips_enabled
crypto.fips_enabled = 1

elastic-apm==6.23.0

(antenv) root@aiops-dev_0ac897ce81:/tmp/8dccb366a943910# python -V
Python 3.12.2
```

See attached file for detail about installed packages in the OS and version, as well as a detailled dump of the system calls.

[issue.txt](https://github.com/user-attachments/files/16836808/issue.txt)

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure on Python 3.12/Linux with crypto.fips_enabled=1 using the reported import elasticapm, Client(), and instrument() entry points. The payload names no source files or tests, so first locate the initialization path reached by those calls and establish a regression test for the FIPS-enabled case. Done means instrumentation no longer aborts with the reported OpenSSL self-test failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, linux, python
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.