Replace hardcoded use of MD5 in sync-diff-inspector with configurable option to support FIPS-compliant environments.#886
Conversation
… option to support FIPS-compliant environments. (pingcap#6) Context: TiDB FIPS build mode introduced in 7.6.0: pingcap/tidb#47949. TiDB binaries built with FIPS 140-3 compliance mode disable MD5 hashing in OpenSSL library used by TiKV. Problem: sync-diff-inspector relies on hardcoded MD5() for chunk checksumming. For performance reasons, TiDB may push expression evaluation down to TiKV coprocessor (tidb_query_expr), which uses OpenSSL for cryptographic functions. In FIPS mode, TiKV's OpenSSL inner_evp_generic_fetch() tries to load MD5 algorithm and fails with error code 50856204 (EVP_R_UNSUPPORTED). As a result, sync-diff-inspector fails because TiDB rejected all MD5-based checksum queries due to OpenSSL security policy restrictions. Changes: - Added a new `checksum-algorithm` configuration flag: - Supported options: md5" and "sha256" hash functions for checksumming - Default: md5 for backwards compatibility.
|
Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @maxz-db. Thanks for your PR. I'm waiting for a pingcap member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Welcome @maxz-db! |
|
|
1 participant
Context:
Changes:
What problem does this PR solve?
Issue Number: close #885
What is changed and how it works?
checksum-algorithmconfiguration flag to sync-diff-inspector:Tests