Merge ~tobhe/ubuntu/+source/openssl:noble-fips-patches into ubuntu/+source/openssl:ubuntu/devel

[Tobias Heider]

Here are a few patches we are currently shipping in our FIPS archive that we would like to instead add to the regular package. This would allow us to stop maintaining a separate OpenSSL version for FIPS and deduplicate our CVE fixing work.

The actual FIPS magic happens in a separate provider package.
The changes proposed in this PR shouldn't change any default behaviour. Instead they make OpenSSL aware of FIPS mode and change some default settings to comply with FIPS to prevent crashes if the only enabled provider is the FIPS provider.

[Tobias Heider (tobhe)]

Built deb is available at https://launchpad.net/~tobhe/+archive/ubuntu/openssl-test/+packages

[Adrien Nader (adrien)]

I'm only halfway through the diff but wanted to submit this now since it will be faster for everyone but also for the question related to #ifndef !FIPS_MODULE.

review: Needs Information

[Adrien Nader (adrien)]

No further comment actually (DEP-3 headers should be for all patches however).

[Tobias Heider (tobhe)]

Replies inline. I will push an update with better headers and commit messages

[Adrien Nader (adrien)]

review: Needs Fixing

7f75686... by Tobias Heider on 2024-02-27

  * Add fips-mode detection and adjust defaults when run in fips mode.
    - d/p/fips/crypto-Add-kernel-FIPS-mode-detection.patch:
      Detect if kernel fips mode is enabled
    - d/p/fips/crypto-Automatically-use-the-FIPS-provider-when-the-kerne.patch:
      Load FIPS provider if running in FIPS mode
    - d/p/fips/apps-speed-Omit-unavailable-algorithms-in-FIPS-mode.patch:
      Limit openssl-speed to FIPS compliant algorithms when running in FIPS mode
    - d/p/fips/apps-pass-propquery-arg-to-the-libctx-DRBG-fetches.patch
      Make sure DRBG respects query properties
    - d/p/fips/test-Ensure-encoding-runs-with-the-correct-context-during.patch:
      Make sure encoding runs with correct library context and provider

7c9b1a6... by Tobias Heider on 2024-02-27

Changelog for 3.0.13-1ubuntu2

[Tobias Heider (tobhe)]

Now rebased onto 3.0.13-1ubuntu1 and with Adrien's ifndef comment addressed.

[Simon Chopin (schopin)]

I'd like Adrien's ACK on the changes before uploading. Also, please add the (LP: #XXXXXXX) stanza to the changelog, so that the FFe bug gets closed and we get an easy reference later on when manipulating those patches (which should probably also include a Bug-Ubuntu: DEP-3 field ;) )

review: Needs Fixing

f990ecf... by Tobias Heider on 2024-03-13

Add launchpad bug ID to changelog and patches

[Tobias Heider (tobhe)]

> I'd like Adrien's ACK on the changes before uploading. Also, please add the
> (LP: #XXXXXXX) stanza to the changelog, so that the FFe bug gets closed and we
> get an easy reference later on when manipulating those patches (which should
> probably also include a Bug-Ubuntu: DEP-3 field ;) )

Added LP bug reference to the changelog and Bug-Ubuntu to each of the patch headers with the last update

50071b5... by Tobias Heider on 2024-03-14

Fix version number 3.0.13-1ubuntu2 > 3.0.13-0ubuntu2

[Tobias Heider (tobhe)]

Should be fixed with the latest upload

[Adrien Nader (adrien)]

I am now including this MR in https://code.launchpad.net/~adrien-n/ubuntu/+source/openssl/+git/openssl/+merge/462486 .

[Chris Coulson (chrisccoulson)]

I've added a couple of comments to this

[Chris Coulson (chrisccoulson)]

Oh, huh, apparently you can only submit comments on a single commit at a time, so here's the other one.

[Adrien Nader (adrien)]

Chris, thanks for your comments, they're very informative. Just to be clear also: this change is actually now uploaded but that was done as part of another MR (version is currently in noble-proposed: https://launchpad.net/ubuntu/+source/openssl/3.0.13-0ubuntu2 ) which is why the status of this one has not been affected. But again, I appreciated reading your comments.

Tobias, can you update the status of this MR to make this visible?

[Tobias Heider (tobhe)]

Thanks for the feedback Chris, as far as I can tell OpenSSL speed worked fine last I tried it but I can check.

Updated the status to merged.

diff --git a/debian/changelog b/debian/changelog
index 06dd500..136ef9c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,20 @@
+openssl (3.0.13-0ubuntu2) noble; urgency=medium
+
+  * Add fips-mode detection and adjust defaults when running in fips mode
+    (LP: #2056593):
+    - d/p/fips/crypto-Add-kernel-FIPS-mode-detection.patch:
+      Detect if kernel fips mode is enabled
+    - d/p/fips/crypto-Automatically-use-the-FIPS-provider-when-the-kerne.patch:
+      Load FIPS provider if running in FIPS mode
+    - d/p/fips/apps-speed-Omit-unavailable-algorithms-in-FIPS-mode.patch:
+      Limit openssl-speed to FIPS compliant algorithms when running in FIPS mode
+    - d/p/fips/apps-pass-propquery-arg-to-the-libctx-DRBG-fetches.patch
+      Make sure DRBG respects query properties
+    - d/p/fips/test-Ensure-encoding-runs-with-the-correct-context-during.patch:
+      Make sure encoding runs with correct library context and provider
+
+ -- Tobias Heider <[e-mail]>  Wed, 13 Mar 2024 11:40:11 +0100
+
 openssl (3.0.13-0ubuntu1) noble; urgency=medium
 
   * Import 3.0.13
diff --git a/debian/patches/fips/apps-pass-propquery-arg-to-the-libctx-DRBG-fetches.patch b/debian/patches/fips/apps-pass-propquery-arg-to-the-libctx-DRBG-fetches.patch
new file mode 100644
index 0000000..fce1415
--- /dev/null
+++ b/debian/patches/fips/apps-pass-propquery-arg-to-the-libctx-DRBG-fetches.patch
@@ -0,0 +1,38 @@
+From: Chris Coulson <[e-mail]>
+Date: Thu, 13 Oct 2022 00:02:26 +0100
+Subject: apps: pass -propquery arg to the libctx DRBG fetches
+
+Forwarded: no
+Applied-Upstream: no
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2056593
+
+The -propquery argument might be used to define a preference for which provider
+an algorithm is fetched from. Set the query properties for the library context
+DRBG fetches as well so that they are fetched with the same properties.
+---
+ apps/lib/app_libctx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/apps/lib/app_libctx.c b/apps/lib/app_libctx.c
+index 4b9ec40e8527..d1c9909165b4 100644
+--- a/apps/lib/app_libctx.c
++++ b/apps/lib/app_libctx.c
+@@ -6,6 +6,7 @@
+  * in the file LICENSE in the source distribution or at
+  * https://www.openssl.org/source/license.html
+  */
++#include <openssl/rand.h>
+ #include "app_libctx.h"
+ #include "apps.h"
+ 
+@@ -15,6 +16,10 @@ static const char *app_propq = NULL;
+ int app_set_propq(const char *arg)
+ {
+     app_propq = arg;
++    if (!RAND_set_DRBG_type(app_libctx, NULL, arg, NULL, NULL))
++        return 0;
++    if (!RAND_set_seed_source_type(app_libctx, NULL, arg))
++        return 0;
+     return 1;
+ }
+ 
diff --git a/debian/patches/fips/apps-speed-Omit-unavailable-algorithms-in-FIPS-mode.patch b/debian/patches/fips/apps-speed-Omit-unavailable-algorithms-in-FIPS-mode.patch
new file mode 100644
index 0000000..2aa9810
--- /dev/null
+++ b/debian/patches/fips/apps-speed-Omit-unavailable-algorithms-in-FIPS-mode.patch
@@ -0,0 +1,130 @@
+From: Chris Coulson <[e-mail]>
+Date: Thu, 21 Apr 2022 13:11:18 +0100
+Subject: apps/speed: Omit unavailable algorithms in FIPS mode
+
+Forwarded: no
+Applied-Upstream: no
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2056593
+---
+ apps/speed.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 66 insertions(+)
+
+diff --git a/apps/speed.c b/apps/speed.c
+index 1113d775b8ab..9bdab90186b3 100644
+--- a/apps/speed.c
++++ b/apps/speed.c
+@@ -1496,6 +1496,9 @@ int speed_main(int argc, char **argv)
+     OPENSSL_assert(strcmp(sm2_choices[SM2_NUM - 1].name, "curveSM2") == 0);
+ #endif
+ 
++    if (EVP_default_properties_is_fips_enabled(app_get0_libctx()))
++        evp_mac_mdname = "sha1";
++
+     prog = opt_init(argc, argv, speed_options);
+     while ((o = opt_next()) != OPT_EOF) {
+         switch (o) {
+@@ -1647,6 +1650,8 @@ int speed_main(int argc, char **argv)
+         }
+         if (strcmp(algo, "des") == 0) {
+             doit[D_CBC_DES] = doit[D_EDE3_DES] = 1;
++            if (EVP_default_properties_is_fips_enabled(app_get0_libctx()))
++                doit[D_CBC_DES] = 0;
+             continue;
+         }
+         if (strcmp(algo, "sha") == 0) {
+@@ -1660,6 +1665,8 @@ int speed_main(int argc, char **argv)
+         if (strncmp(algo, "rsa", 3) == 0) {
+             if (algo[3] == '\0') {
+                 memset(rsa_doit, 1, sizeof(rsa_doit));
++                if (EVP_default_properties_is_fips_enabled(app_get0_libctx()))
++                    rsa_doit[R_RSA_512] = rsa_doit[R_RSA_1024] = 0;
+                 continue;
+             }
+             if (opt_found(algo, rsa_choices, &i)) {
+@@ -1682,6 +1689,10 @@ int speed_main(int argc, char **argv)
+         if (strncmp(algo, "dsa", 3) == 0) {
+             if (algo[3] == '\0') {
+                 memset(dsa_doit, 1, sizeof(dsa_doit));
++                /* R_DSA_512 and R_DSA_1024 should be disabled in FIPS mode,
++                 * but actually, none of the DSA benchmarks work because the
++                 * compiled-in keys fail the necessary checks. Just return an
++                 * error if the DSA benchmarks are invoked explicitly. */
+                 continue;
+             }
+             if (opt_found(algo, dsa_choices, &i)) {
+@@ -1700,6 +1711,18 @@ int speed_main(int argc, char **argv)
+         if (strncmp(algo, "ecdsa", 5) == 0) {
+             if (algo[5] == '\0') {
+                 memset(ecdsa_doit, 1, sizeof(ecdsa_doit));
++                if (EVP_default_properties_is_fips_enabled(app_get0_libctx())) {
++                    ecdsa_doit[R_EC_P160] = ecdsa_doit[R_EC_P192] = 0;
++#ifndef OPENSSL_NO_EC2M
++                    ecdsa_doit[R_EC_K163] = ecdsa_doit[R_EC_B163] = 0;
++#endif
++                    ecdsa_doit[R_EC_BRP256R1] =
++                        ecdsa_doit[R_EC_BRP256T1] =
++                        ecdsa_doit[R_EC_BRP384R1] =
++                        ecdsa_doit[R_EC_BRP384T1] =
++                        ecdsa_doit[R_EC_BRP512R1] =
++                        ecdsa_doit[R_EC_BRP512T1] = 0;
++                }
+                 continue;
+             }
+             if (opt_found(algo, ecdsa_choices, &i)) {
+@@ -1710,6 +1733,18 @@ int speed_main(int argc, char **argv)
+         if (strncmp(algo, "ecdh", 4) == 0) {
+             if (algo[4] == '\0') {
+                 memset(ecdh_doit, 1, sizeof(ecdh_doit));
++                if (EVP_default_properties_is_fips_enabled(app_get0_libctx())) {
++                    ecdh_doit[R_EC_P160] = ecdh_doit[R_EC_P192] = 0;
++#ifndef OPENSSL_NO_EC2M
++                    ecdh_doit[R_EC_K163] = ecdh_doit[R_EC_B163] = 0;
++#endif
++                    ecdh_doit[R_EC_BRP256R1] =
++                        ecdh_doit[R_EC_BRP256T1] =
++                        ecdh_doit[R_EC_BRP384R1] =
++                        ecdh_doit[R_EC_BRP384T1] =
++                        ecdh_doit[R_EC_BRP512R1] =
++                        ecdh_doit[R_EC_BRP512T1] = 0;
++                }
+                 continue;
+             }
+             if (opt_found(algo, ecdh_choices, &i)) {
+@@ -1863,6 +1898,37 @@ int speed_main(int argc, char **argv)
+ #ifndef OPENSSL_NO_SM2
+         memset(sm2_doit, 1, sizeof(sm2_doit));
+ #endif
++        if (EVP_default_properties_is_fips_enabled(app_get0_libctx())) {
++            rsa_doit[R_RSA_512] = rsa_doit[R_RSA_1024] = 0;
++
++            memset(dsa_doit, 0, sizeof(dsa_doit));
++
++            ecdsa_doit[R_EC_P160] = ecdsa_doit[R_EC_P192] = 0;
++#ifndef OPENSSL_NO_EC2M
++            ecdsa_doit[R_EC_K163] = ecdsa_doit[R_EC_B163] = 0;
++#endif
++            ecdsa_doit[R_EC_BRP256R1] =
++                ecdsa_doit[R_EC_BRP256T1] =
++                ecdsa_doit[R_EC_BRP384R1] =
++                ecdsa_doit[R_EC_BRP384T1] =
++                ecdsa_doit[R_EC_BRP512R1] =
++                ecdsa_doit[R_EC_BRP512T1] = 0;
++
++            ecdh_doit[R_EC_P160] = ecdh_doit[R_EC_P192] = 0;
++#ifndef OPENSSL_NO_EC2M
++            ecdh_doit[R_EC_K163] = ecdh_doit[R_EC_B163] = 0;
++#endif
++            ecdh_doit[R_EC_BRP256R1] =
++                ecdh_doit[R_EC_BRP256T1] =
++                ecdh_doit[R_EC_BRP384R1] =
++                ecdh_doit[R_EC_BRP384T1] =
++                ecdh_doit[R_EC_BRP512R1] =
++                ecdh_doit[R_EC_BRP512T1] = 0;
++
++#ifndef OPENSSL_NO_SM2
++            memset(sm2_doit, 0, sizeof(sm2_doit));
++#endif
++        }
+     }
+     for (i = 0; i < ALGOR_NUM; i++)
+         if (doit[i])
diff --git a/debian/patches/fips/crypto-Add-kernel-FIPS-mode-detection.patch b/debian/patches/fips/crypto-Add-kernel-FIPS-mode-detection.patch
new file mode 100644
index 0000000..25c5184
--- /dev/null
+++ b/debian/patches/fips/crypto-Add-kernel-FIPS-mode-detection.patch
@@ -0,0 +1,154 @@
+From: Chris Coulson <[e-mail]>
+Date: Thu, 14 Apr 2022 14:57:44 +0100
+Subject: crypto: Add kernel FIPS mode detection
+
+Forwarded: no
+Applied-Upstream: no
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2056593
+
+This adds a new internal API to determine whether the kernel has been booted
+in FIPS mode. This can be overridden with the OPENSSL_FORCE_FIPS_MODE
+environment variable. OPENSSL_FIPS_MODE_SWITCH_PATH can be used to specify an
+alternative path for the fips_enabled file and is used in tests.
+The FIPS_MODULE switch can be used to enable build of the the FIPS provider
+module specific parts which are not needed in the OpenSSL library itself.
+---
+ crypto/build.info  |  2 +-
+ crypto/context.c   | 20 ++++++++++++++++++++
+ crypto/fips_mode.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
+ crypto/fips_mode.h | 17 +++++++++++++++++
+ 4 files changed, 84 insertions(+), 1 deletion(-)
+ create mode 100644 crypto/fips_mode.c
+ create mode 100644 crypto/fips_mode.h
+
+diff --git a/crypto/build.info b/crypto/build.info
+index a45bf8deefd5..a128c645667e 100644
+--- a/crypto/build.info
++++ b/crypto/build.info
+@@ -101,7 +101,7 @@ SOURCE[../libcrypto]=$UTIL_COMMON \
+         mem.c mem_sec.c \
+         cversion.c info.c cpt_err.c ebcdic.c uid.c o_time.c o_dir.c \
+         o_fopen.c getenv.c o_init.c init.c trace.c provider.c provider_child.c \
+-        punycode.c passphrase.c
++        punycode.c passphrase.c fips_mode.c
+ SOURCE[../providers/libfips.a]=$UTIL_COMMON
+ 
+ SOURCE[../libcrypto]=$UPLINKSRC
+diff --git a/crypto/context.c b/crypto/context.c
+index 548665fba265..83e255cb2563 100644
+--- a/crypto/context.c
++++ b/crypto/context.c
+@@ -17,6 +17,11 @@
+ #include "crypto/ctype.h"
+ #include "crypto/rand.h"
+ 
++#ifndef FIPS_MODULE
++# include "crypto/evp.h"
++# include "fips_mode.h"
++#endif
++
+ struct ossl_lib_ctx_onfree_list_st {
+     ossl_lib_ctx_onfree_fn *fn;
+     struct ossl_lib_ctx_onfree_list_st *next;
+@@ -69,11 +74,26 @@ int ossl_lib_ctx_is_child(OSSL_LIB_CTX *ctx)
+     return ctx->ischild;
+ }
+ 
++#if !defined(FIPS_MODULE)
++static CRYPTO_ONCE init_fips = CRYPTO_ONCE_STATIC_INIT;
++
++DEFINE_RUN_ONCE_STATIC(do_init_fips)
++{
++    ossl_init_fips();
++    return 1;
++}
++#endif
++
+ static int context_init(OSSL_LIB_CTX *ctx)
+ {
+     size_t i;
+     int exdata_done = 0;
+ 
++#if !defined(FIPS_MODULE)
++    if (!RUN_ONCE(&init_fips, do_init_fips))
++        return 0;
++#endif
++
+     ctx->lock = CRYPTO_THREAD_lock_new();
+     if (ctx->lock == NULL)
+         return 0;
+diff --git a/crypto/fips_mode.c b/crypto/fips_mode.c
+new file mode 100644
+index 000000000000..0131075ed764
+--- /dev/null
++++ b/crypto/fips_mode.c
+@@ -0,0 +1,46 @@
++#define _GNU_SOURCE
++#include <errno.h>
++#include <fcntl.h>
++#include <stdlib.h>
++#include <string.h>
++#include <sys/types.h>
++#include <sys/stat.h>
++#include <unistd.h>
++#include "fips_mode.h"
++
++#define FIPS_MODE_SWITCH_FILE "/proc/sys/crypto/fips_enabled"
++
++static int fips_mode;
++
++int ossl_fips_mode(void)
++{
++    return fips_mode;
++}
++
++void ossl_init_fips(void)
++{
++    const char *switch_path = FIPS_MODE_SWITCH_FILE;
++    char *v;
++    char c;
++    int fd;
++
++    if ((v = secure_getenv("OPENSSL_FORCE_FIPS_MODE")) != NULL) {
++        fips_mode = strcmp(v, "0") == 0 ? 0 : 1;
++        return;
++    }
++
++    if ((v = secure_getenv("OPENSSL_FIPS_MODE_SWITCH_PATH")) != NULL) {
++        switch_path = v;
++    }
++
++    fd = open(switch_path, O_RDONLY);
++    if (fd < 0) {
++        fips_mode = 0;
++        return;
++    }
++
++    while (read(fd, &c, sizeof(c)) < 0 && errno == EINTR);
++    close(fd);
++
++    fips_mode = c == '1' ? 1 : 0;
++}
+diff --git a/crypto/fips_mode.h b/crypto/fips_mode.h
+new file mode 100644
+index 000000000000..5f0607ba9d70
+--- /dev/null
++++ b/crypto/fips_mode.h
+@@ -0,0 +1,17 @@
++/*
++ * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
++ *
++ * Licensed under the Apache License 2.0 (the "License").  You may not use
++ * this file except in compliance with the License.  You can obtain a copy
++ * in the file LICENSE in the source distribution or at
++ * https://www.openssl.org/source/license.html
++ */
++
++#ifndef OSSL_FIPS_MODE_H
++# define OSSL_FIPS_MODE_H
++# pragma once
++
++int ossl_fips_mode(void);
++void ossl_init_fips(void);
++
++#endif
diff --git a/debian/patches/fips/crypto-Automatically-use-the-FIPS-provider-when-the-kerne.patch b/debian/patches/fips/crypto-Automatically-use-the-FIPS-provider-when-the-kerne.patch
new file mode 100644
index 0000000..4d2eb9d
--- /dev/null
+++ b/debian/patches/fips/crypto-Automatically-use-the-FIPS-provider-when-the-kerne.patch
@@ -0,0 +1,495 @@
+From: Chris Coulson <[e-mail]>
+Date: Thu, 14 Apr 2022 15:40:56 +0100
+Subject: crypto: Automatically use the FIPS provider when the kernel is
+ booted in FIPS mode
+
+Forwarded: no
+Applied-Upstream: no
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2056593
+
+This automatically configures all library contexts to use the FIPS provider when
+the kernel is booted in FIPS mode by:
+- Setting "fips=yes" as the default property for algorithm fetches
+- Loading and activating the FIPS provider as the fallback provider.
+
+If applications load providers via a configuration either because the default
+configuration is modified or they override the default configuration, this
+disables loading of the fallback providers. In this case, the configuration
+must load the FIPS provider when FIPS mode is enabled, else algorithm fetches
+will fail
+
+Applications can choose to use non-FIPS approved algorithms by specifying the
+"-fips" or "fips=no" property for algorithm fetches and loading the default
+provider.
+---
+ crypto/context.c                        |   5 ++
+ crypto/provider_core.c                  |   4 +-
+ crypto/provider_local.h                 |   2 +-
+ crypto/provider_predefined.c            |  25 +++++++-
+ doc/man3/EVP_set_default_properties.pod |   3 +-
+ doc/man5/config.pod                     |   8 ++-
+ doc/man7/OSSL_PROVIDER-default.pod      |   7 ++-
+ doc/man7/crypto.pod                     |  30 +++++++--
+ doc/man7/fips_module.pod                |  15 +++++
+ test/build.info                         |   6 +-
+ test/fips_auto_enable_test.c            | 106 ++++++++++++++++++++++++++++++++
+ test/recipes/04-test_auto_fips_mode.t   |  50 +++++++++++++++
+ test/recipes/04-test_auto_fips_mode/off |   1 +
+ test/recipes/04-test_auto_fips_mode/on  |   1 +
+ test/run_tests.pl                       |   1 +
+ 15 files changed, 247 insertions(+), 17 deletions(-)
+ create mode 100644 test/fips_auto_enable_test.c
+ create mode 100644 test/recipes/04-test_auto_fips_mode.t
+ create mode 100644 test/recipes/04-test_auto_fips_mode/off
+ create mode 100644 test/recipes/04-test_auto_fips_mode/on
+
+diff --git a/crypto/context.c b/crypto/context.c
+index 83e255cb2563..457ebb0880b4 100644
+--- a/crypto/context.c
++++ b/crypto/context.c
+@@ -122,6 +122,11 @@ static int context_init(OSSL_LIB_CTX *ctx)
+     if (!ossl_property_parse_init(ctx))
+         goto err;
+ 
++#if !defined(FIPS_MODULE)
++    if (ossl_fips_mode() == 1 && !evp_default_properties_enable_fips_int(ctx, 1, 0))
++        goto err;
++#endif
++
+     return 1;
+  err:
+     if (exdata_done)
+diff --git a/crypto/provider_core.c b/crypto/provider_core.c
+index 4cadb6a9f02e..ecfa1e1dd902 100644
+--- a/crypto/provider_core.c
++++ b/crypto/provider_core.c
+@@ -544,7 +544,7 @@ OSSL_PROVIDER *ossl_provider_new(OSSL_LIB_CTX *libctx, const char *name,
+         size_t i;
+ 
+         /* Check if this is a predefined builtin provider */
+-        for (p = ossl_predefined_providers; p->name != NULL; p++) {
++        for (p = ossl_predefined_providers(); p->name != NULL; p++) {
+             if (strcmp(p->name, name) == 0) {
+                 template = *p;
+                 break;
+@@ -1305,7 +1305,7 @@ static int provider_activate_fallbacks(struct provider_store_st *store)
+         return 1;
+     }
+ 
+-    for (p = ossl_predefined_providers; p->name != NULL; p++) {
++    for (p = ossl_predefined_providers(); p->name != NULL; p++) {
+         OSSL_PROVIDER *prov = NULL;
+ 
+         if (!p->is_fallback)
+diff --git a/crypto/provider_local.h b/crypto/provider_local.h
+index e0bcbcb9f94e..bfde4dd7cc25 100644
+--- a/crypto/provider_local.h
++++ b/crypto/provider_local.h
+@@ -23,7 +23,7 @@ typedef struct {
+     unsigned int is_fallback:1;
+ } OSSL_PROVIDER_INFO;
+ 
+-extern const OSSL_PROVIDER_INFO ossl_predefined_providers[];
++const OSSL_PROVIDER_INFO *ossl_predefined_providers(void);
+ 
+ void ossl_provider_info_clear(OSSL_PROVIDER_INFO *info);
+ int ossl_provider_info_add_to_store(OSSL_LIB_CTX *libctx,
+diff --git a/crypto/provider_predefined.c b/crypto/provider_predefined.c
+index 068e0b7cd96a..0ee2158a7c47 100644
+--- a/crypto/provider_predefined.c
++++ b/crypto/provider_predefined.c
+@@ -9,6 +9,9 @@
+ 
+ #include <openssl/core.h>
+ #include "provider_local.h"
++#if !defined(FIPS_MODULE)
++# include "fips_mode.h"
++#endif
+ 
+ OSSL_provider_init_fn ossl_default_provider_init;
+ OSSL_provider_init_fn ossl_base_provider_init;
+@@ -17,7 +20,7 @@ OSSL_provider_init_fn ossl_fips_intern_provider_init;
+ #ifdef STATIC_LEGACY
+ OSSL_provider_init_fn ossl_legacy_provider_init;
+ #endif
+-const OSSL_PROVIDER_INFO ossl_predefined_providers[] = {
++const OSSL_PROVIDER_INFO providers[] = {
+ #ifdef FIPS_MODULE
+     { "fips", NULL, ossl_fips_intern_provider_init, NULL, 1 },
+ #else
+@@ -30,3 +33,23 @@ const OSSL_PROVIDER_INFO ossl_predefined_providers[] = {
+ #endif
+     { NULL, NULL, NULL, NULL, 0 }
+ };
++
++#if !defined(FIPS_MODULE)
++const OSSL_PROVIDER_INFO fips_providers[] = {
++    { "fips", NULL, NULL, NULL, 1 },
++    { "base", NULL, ossl_base_provider_init, NULL, 1 },
++    { "default", NULL, ossl_default_provider_init, NULL, 0 },
++    { "null", NULL, ossl_null_provider_init, NULL, 0 },
++    { NULL, NULL, NULL, NULL, 0 }
++};
++#endif
++
++const OSSL_PROVIDER_INFO *ossl_predefined_providers(void)
++{
++#if !defined(FIPS_MODULE)
++    if (ossl_fips_mode() == 1)
++        return fips_providers;
++#endif
++
++    return providers;
++}
+diff --git a/doc/man3/EVP_set_default_properties.pod b/doc/man3/EVP_set_default_properties.pod
+index 2d862772c251..3ee3f10566dd 100644
+--- a/doc/man3/EVP_set_default_properties.pod
++++ b/doc/man3/EVP_set_default_properties.pod
+@@ -34,7 +34,8 @@ query for the given I<libctx>. It merges the fips default property query with an
+ existing query strings that have been set via EVP_set_default_properties().
+ 
+ EVP_default_properties_is_fips_enabled() indicates if 'fips=yes' is a default
+-property for the given I<libctx>.
++property for the given I<libctx>. This is the default for every I<libctx> on
++systems that are operaring in FIPS-approved mode.
+ 
+ =head1 NOTES
+ 
+diff --git a/doc/man5/config.pod b/doc/man5/config.pod
+index 8d312c661fa0..e35368c13da1 100644
+--- a/doc/man5/config.pod
++++ b/doc/man5/config.pod
+@@ -275,11 +275,13 @@ available to the provider.
+ 
+ =head3 Default provider and its activation
+ 
+-If no providers are activated explicitly, the default one is activated implicitly.
+-See L<OSSL_PROVIDER-default(7)> for more details.
++If no providers are activated explicitly, either the default provider or
++FIPS provider are activated implicitly depending on the environment.
++See L<crypto(7)>, L<OSSL_PROVIDER-default(7)> and L<OSSL_PROVIDER-FIPS(7)> for
++more details.
+ 
+ If you add a section explicitly activating any other provider(s),
+-you most probably need to explicitly activate the default provider,
++you most probably need to explicitly activate the default or FIPS provider,
+ otherwise it becomes unavailable in openssl. It may make the system remotely unavailable.
+ 
+ =head2 EVP Configuration
+diff --git a/doc/man7/OSSL_PROVIDER-default.pod b/doc/man7/OSSL_PROVIDER-default.pod
+index e39d76abdbb8..e6ff52241632 100644
+--- a/doc/man7/OSSL_PROVIDER-default.pod
++++ b/doc/man7/OSSL_PROVIDER-default.pod
+@@ -9,9 +9,10 @@ OSSL_PROVIDER-default - OpenSSL default provider
+ The OpenSSL default provider supplies the majority of OpenSSL's diverse
+ algorithm implementations. If an application doesn't specify anything else
+ explicitly (e.g. in the application or via config), then this is the
+-provider that will be used as fallback: It is loaded automatically the
+-first time that an algorithm is fetched from a provider or a function
+-acting on providers is called and no other provider has been loaded yet.
++provider that will be used as fallback on systems that are not operating in
++FIPS-approved mode: It is loaded automatically the first time that an algorithm
++is fetched from a provider or a function acting on providers is called and no
++other provider has been loaded yet.
+ 
+ If an attempt to load a provider has already been made (whether successful
+ or not) then the default provider won't be loaded automatically. Therefore
+diff --git a/doc/man7/crypto.pod b/doc/man7/crypto.pod
+index c31e10ac29a5..40e421583675 100644
+--- a/doc/man7/crypto.pod
++++ b/doc/man7/crypto.pod
+@@ -48,8 +48,22 @@ A provider in OpenSSL is a component that collects together algorithm
+ implementations. In order to use an algorithm you must have at least one
+ provider loaded that contains an implementation of it. OpenSSL comes with a
+ number of providers and they may also be obtained from third parties. If you
+-don't load a provider explicitly (either in program code or via config) then the
+-OpenSSL built-in "default" provider will be automatically loaded.
++don't load a provider explicitly (either in program code or via config) then one
++of the following OpenSSL providers will be loaded automatically:
++
++=over 4
++
++=item *
++
++The built-in "default" provider when running on a system that is not operating
++in FIPS-approved mode.
++
++=item *
++
++The "fips" provider when running on a system that is operating in FIPS-approved
++mode.
++
++=back
+ 
+ =head2 Library contexts
+ 
+@@ -364,9 +378,10 @@ algorithms), the property query string "provider=default" can be used as a
+ search criterion for these implementations.  The default provider includes all
+ of the functionality in the base provider below.
+ 
+-If you don't load any providers at all then the "default" provider will be
+-automatically loaded. If you explicitly load any provider then the "default"
+-provider would also need to be explicitly loaded if it is required.
++If you don't load any providers at all and the system is not running in
++FIPS-approved mode, then the "default" provider will be automatically loaded.
++If you explicitly load any provider then the "default" provider would also need
++to be explicitly loaded if it is required.
+ 
+ See L<OSSL_PROVIDER-default(7)>.
+ 
+@@ -397,6 +412,11 @@ provider can also be selected with the property "fips=yes". The FIPS provider
+ may also contain non-approved algorithm implementations and these can be
+ selected with the property "fips=no".
+ 
++If you don't load any providers at all and the system is running in
++FIPS-approved mode, then the FIPS provider will be automatically loaded.
++If you explicitly load any provider then the FIPS provider would also need
++to be explicitly loaded if it is required.
++
+ See L<OSSL_PROVIDER-FIPS(7)> and L<fips_module(7)>.
+ 
+ =head2 Legacy provider
+diff --git a/doc/man7/fips_module.pod b/doc/man7/fips_module.pod
+index d0861a9dcecc..801075d9d05e 100644
+--- a/doc/man7/fips_module.pod
++++ b/doc/man7/fips_module.pod
+@@ -45,6 +45,21 @@ All of the above APIs are deprecated in OpenSSL 3.0 - so a simple rule is to
+ avoid using all deprecated functions. See L<migration_guide(7)> for a list of
+ deprecated functions.
+ 
++=head2 Applications running on systems operating in FIPS-approved mode
++
++When running on systems that are operating in FIPS-approved mode and no
++providers are loaded explicitly via the application or config, the FIPS module
++is loaded implicitly as a fallback provider whenever an algorithm is fetched
++for the first time. The "default" provider is not loaded implicitly in this
++case, and must be loaded explicitly if it is required by an application.
++
++Every L<OSSL_LIB_CTX(3)> is created with "fips=yes" as a default property in
++this mode so that algorithm fetches will only fetch algorithms that define
++this property and are FIPS-approved. To use algorithms that are not FIPS
++approved, either specify "-fips" or "fips=no" as a property query string with
++fetching functions, or use the L<EVP_default_properties_enable_fips(3)> function
++to remove the default property for a specific B<OSSL_LIB_CTX>.
++
+ =head2 Making all applications use the FIPS module by default
+ 
+ One simple approach is to cause all applications that are using OpenSSL to only
+diff --git a/test/build.info b/test/build.info
+index 416c2270771a..02d9f082d072 100644
+--- a/test/build.info
++++ b/test/build.info
+@@ -61,7 +61,7 @@ IF[{- !$disabled{tests} -}]
+           keymgmt_internal_test hexstr_test provider_status_test defltfips_test \
+           bio_readbuffer_test user_property_test pkcs7_test upcallstest \
+           provfetchtest prov_config_test rand_test fips_version_test \
+-          nodefltctxtest
++          nodefltctxtest fips_auto_enable_test
+ 
+   IF[{- !$disabled{'deprecated-3.0'} -}]
+     PROGRAMS{noinst}=enginetest
+@@ -599,6 +599,10 @@ IF[{- !$disabled{tests} -}]
+   INCLUDE[cmp_client_test]=.. ../include ../apps/include
+   DEPEND[cmp_client_test]=../libcrypto.a libtestutil.a
+ 
++  SOURCE[fips_auto_enable_test]=fips_auto_enable_test.c
++  INCLUDE[fips_auto_enable_test]=../include  ../apps/include
++  DEPEND[fips_auto_enable_test]=../libcrypto libtestutil.a
++
+   # Internal test programs.  These are essentially a collection of internal
+   # test routines.  Some of them need to reach internal symbols that aren't
+   # available through the shared library (at least on Linux, Solaris, Windows
+diff --git a/test/fips_auto_enable_test.c b/test/fips_auto_enable_test.c
+new file mode 100644
+index 000000000000..5135ab1b5772
+--- /dev/null
++++ b/test/fips_auto_enable_test.c
+@@ -0,0 +1,106 @@
++/*
++ * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
++ *
++ * Licensed under the Apache License 2.0 (the "License").  You may not use
++ * this file except in compliance with the License.  You can obtain a copy
++ * in the file LICENSE in the source distribution or at
++ * https://www.openssl.org/source/license.html
++ */
++
++#include <openssl/evp.h>
++#include <openssl/provider.h>
++#include "testutil.h"
++
++static int badfips;
++static int context;
++static int fips;
++
++static int test_fips_auto(void)
++{
++    OSSL_LIB_CTX *libctx = NULL;
++    EVP_MD *sha256 = NULL;
++    int is_fips_enabled, fips_loaded, default_loaded;
++    const char *prov_name, *expected_prov_name = fips ? "fips" : "default";
++    int testresult = 0;
++
++    if (context) {
++        if (!TEST_ptr(libctx = OSSL_LIB_CTX_new()))
++            goto err;
++    }
++
++    is_fips_enabled = EVP_default_properties_is_fips_enabled(libctx);
++
++    if (!TEST_int_eq(is_fips_enabled, fips))
++        goto err;
++
++    sha256 = EVP_MD_fetch(libctx, "SHA-256", NULL);
++    if (!fips || !badfips) {
++        if (!TEST_ptr(sha256))
++            goto err;
++
++        prov_name = OSSL_PROVIDER_get0_name(EVP_MD_get0_provider(sha256));
++        if (!TEST_str_eq(prov_name, expected_prov_name))
++            goto err;
++    } else if (!TEST_ptr_null(sha256))
++        goto err;
++
++    fips_loaded = OSSL_PROVIDER_available(libctx, "fips");
++    default_loaded = OSSL_PROVIDER_available(libctx, "default");
++
++    if (!TEST_int_eq(fips_loaded, fips && !badfips) ||
++        !TEST_int_eq(default_loaded, !fips && !badfips))
++        goto err;
++
++    testresult = 1;
++ err:
++    EVP_MD_free(sha256);
++    OSSL_LIB_CTX_free(libctx);
++    return testresult;
++}
++
++typedef enum OPTION_choice {
++    OPT_ERR = -1,
++    OPT_EOF = 0,
++    OPT_FIPS,
++    OPT_BAD_FIPS,
++    OPT_CONTEXT,
++    OPT_TEST_ENUM
++} OPTION_CHOICE;
++
++const OPTIONS *test_get_options(void)
++{
++    static const OPTIONS options[] = {
++        OPT_TEST_OPTIONS_DEFAULT_USAGE,
++        { "fips", OPT_FIPS, '-', "Test library context in FIPS mode" },
++        { "badfips", OPT_BAD_FIPS, '-', "Expect FIPS mode not to work correctly" },
++        { "context", OPT_CONTEXT, '-', "Explicitly use a non-default library context" },
++        { NULL }
++    };
++    return options;
++}
++
++int setup_tests(void)
++{
++    OPTION_CHOICE o;
++
++    while ((o = opt_next()) != OPT_EOF) {
++        switch (o) {
++        case OPT_FIPS:
++            fips = 1;
++            break;
++        case OPT_BAD_FIPS:
++            badfips = 1;
++            break;
++        case OPT_CONTEXT:
++            context = 1;
++            break;
++        case OPT_TEST_CASES:
++            break;
++        default:
++            return 0;
++        }
++    }
++
++    ADD_TEST(test_fips_auto);
++    return 1;
++}
+diff --git a/test/recipes/04-test_auto_fips_mode.t b/test/recipes/04-test_auto_fips_mode.t
+new file mode 100644
+index 000000000000..fcd4b3d4e8a3
+--- /dev/null
++++ b/test/recipes/04-test_auto_fips_mode.t
+@@ -0,0 +1,50 @@
++#! /usr/bin/env perl
++# Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
++#
++# Licensed under the Apache License 2.0 (the "License").  You may not use
++# this file except in compliance with the License.  You can obtain a copy
++# in the file LICENSE in the source distribution or at
++# https://www.openssl.org/source/license.html
++
++use strict;
++use warnings;
++
++use File::Spec::Functions qw/curdir/;
++use OpenSSL::Test qw/:DEFAULT srctop_dir/;
++use OpenSSL::Test::Utils;
++use Cwd qw(abs_path);
++
++BEGIN {
++    setup("test_auto_fips_mode");
++}
++
++my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
++
++plan tests => ($no_fips ? 5 : 7);
++
++$ENV{OPENSSL_FIPS_MODE_SWITCH_PATH} = abs_path(srctop_dir("test", "recipes",
++        "04-test_auto_fips_mode", "notexist"));
++ok(run(test(["fips_auto_enable_test"])), "running fips_auto_enable_test");
++ok(run(test(["fips_auto_enable_test", "-context"])),
++    "running fips_auto_enable_test -context");
++
++$ENV{OPENSSL_FIPS_MODE_SWITCH_PATH} = abs_path(srctop_dir("test", "recipes",
++        "04-test_auto_fips_mode", "off"));
++ok(run(test(["fips_auto_enable_test"])),
++    "running fips_auto_enable_test with FIPS mode off");
++ok(run(test(["fips_auto_enable_test", "-context"])),
++    "running fips_auto_enable_test -context with FIPS mode off");
++
++$ENV{OPENSSL_FIPS_MODE_SWITCH_PATH} = abs_path(srctop_dir("test", "recipes",
++        "04-test_auto_fips_mode", "on"));
++
++unless($no_fips) {
++    ok(run(test(["fips_auto_enable_test", "-fips"])),
++        "running fips_auto_enable_test -fips");
++    ok(run(test(["fips_auto_enable_test", "-context", "-fips"])),
++        "running fips_auto_enable_test -context -fips");
++}
++
++$ENV{OPENSSL_MODULES} = curdir();
++ok(run(test(["fips_auto_enable_test", "-fips", "-badfips"])),
++    "running fips_auto_enable_test -fips -badfips");
+diff --git a/test/recipes/04-test_auto_fips_mode/off b/test/recipes/04-test_auto_fips_mode/off
+new file mode 100644
+index 000000000000..573541ac9702
+--- /dev/null
++++ b/test/recipes/04-test_auto_fips_mode/off
+@@ -0,0 +1 @@
++0
+diff --git a/test/recipes/04-test_auto_fips_mode/on b/test/recipes/04-test_auto_fips_mode/on
+new file mode 100644
+index 000000000000..d00491fd7e5b
+--- /dev/null
++++ b/test/recipes/04-test_auto_fips_mode/on
+@@ -0,0 +1 @@
++1
+diff --git a/test/run_tests.pl b/test/run_tests.pl
+index 4384ebe28e0d..b52d5b7ee05e 100644
+--- a/test/run_tests.pl
++++ b/test/run_tests.pl
+@@ -37,6 +37,7 @@ $ENV{OPENSSL_CONF} = rel2abs(catfile($srctop, "apps", "openssl.cnf"));
+ $ENV{OPENSSL_CONF_INCLUDE} = rel2abs(catdir($bldtop, "test"));
+ $ENV{OPENSSL_MODULES} = rel2abs(catdir($bldtop, "providers"));
+ $ENV{OPENSSL_ENGINES} = rel2abs(catdir($bldtop, "engines"));
++$ENV{OPENSSL_FIPS_MODE_SWITCH_PATH} = "/nonexistant";
+ $ENV{CTLOG_FILE} = rel2abs(catfile($srctop, "test", "ct", "log_list.cnf"));
+ 
+ my %tapargs =
diff --git a/debian/patches/fips/test-Ensure-encoding-runs-with-the-correct-context-during.patch b/debian/patches/fips/test-Ensure-encoding-runs-with-the-correct-context-during.patch
new file mode 100644
index 0000000..3b2b15f
--- /dev/null
+++ b/debian/patches/fips/test-Ensure-encoding-runs-with-the-correct-context-during.patch
@@ -0,0 +1,57 @@
+From: Chris Coulson <[e-mail]>
+Date: Thu, 30 Mar 2023 16:10:16 +0100
+Subject: test: Ensure encoding runs with the correct context during
+ test_encoder_decoder
+
+Forwarded: no
+Applied-Upstream: no
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2056593
+
+This test uses 2 library contexts - one context for creating initial test keys,
+and then another context (or the default context) for running tests. There is an
+issue that during the encoding tests, the OSSL_ENCODER_CTX is created from the
+created EVP_PKEYs, which are associated with the library context used to create
+the keys. This means that encoding tests run with the wrong library context,
+which always uses the default provider.
+---
+ test/endecode_test.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/test/endecode_test.c b/test/endecode_test.c
+index 5158b39ee41f..ce6febe619a8 100644
+--- a/test/endecode_test.c
++++ b/test/endecode_test.c
+@@ -105,11 +105,12 @@ static EVP_PKEY *make_template(const char *type, OSSL_PARAM *genparams)
+ static EVP_PKEY *make_key(const char *type, EVP_PKEY *template,
+                           OSSL_PARAM *genparams)
+ {
+-    EVP_PKEY *pkey = NULL;
++    EVP_PKEY *tmp_pkey = NULL, *pkey = NULL;
+     EVP_PKEY_CTX *ctx =
+         template != NULL
+         ? EVP_PKEY_CTX_new_from_pkey(keyctx, template, testpropq)
+         : EVP_PKEY_CTX_new_from_name(keyctx, type, testpropq);
++    OSSL_PARAM *params = NULL;
+ 
+     /*
+      * No real need to check the errors other than for the cascade
+@@ -119,8 +120,18 @@ static EVP_PKEY *make_key(const char *type, EVP_PKEY *template,
+            && EVP_PKEY_keygen_init(ctx) > 0
+            && (genparams == NULL
+                || EVP_PKEY_CTX_set_params(ctx, genparams) > 0)
+-           && EVP_PKEY_keygen(ctx, &pkey) > 0);
++           && EVP_PKEY_keygen(ctx, &tmp_pkey) > 0);
++    EVP_PKEY_CTX_free(ctx);
++
++    (void)(tmp_pkey != NULL
++           && ((ctx = EVP_PKEY_CTX_new_from_name(testctx, type, testpropq)) != NULL)
++           && EVP_PKEY_todata(pkey, EVP_PKEY_KEYPAIR, &params) > 0
++           && EVP_PKEY_fromdata_init(ctx) > 0
++           && EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEYPAIR, params) > 0);
++    OSSL_PARAM_free(params);
+     EVP_PKEY_CTX_free(ctx);
++    EVP_PKEY_free(tmp_pkey);
++
+     return pkey;
+ }
+ #endif
diff --git a/debian/patches/series b/debian/patches/series
index 7c3b688..c8b1797 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -18,3 +18,10 @@ intel/0001-Dual-1536-2048-bit-exponentiation-optimization-for-I.patch
 # Skipped due to issues appearing in the testsuite on 3.0.13 following dupctx
 # changes in 3.0.13
 # intel/0002-AES-GCM-enabled-with-AVX512-vAES-and-vPCLMULQDQ.patch
+
+# FIPS patches
+fips/crypto-Add-kernel-FIPS-mode-detection.patch
+fips/crypto-Automatically-use-the-FIPS-provider-when-the-kerne.patch
+fips/apps-speed-Omit-unavailable-algorithms-in-FIPS-mode.patch
+fips/apps-pass-propquery-arg-to-the-libctx-DRBG-fetches.patch
+fips/test-Ensure-encoding-runs-with-the-correct-context-during.patch