mirror of
https://github.com/BerriAI/litellm.git
synced 2026-11-14 09:03:16 +00:00
eba880e108
* fix(tls): exclude RSA key exchange from outbound cipher list in FIPS mode * fix(tls): apply the FIPS cipher filter to SSL contexts clients already hold enforce_fips_mode runs after load_config, so guardrail and logger clients built during config load held an SSL context without the RSA key exchange exclusion. enforce_fips_mode now updates every cached context in place, and the SDK no longer imports the proxy's FIPS module. * fix(tls): refuse to start in FIPS mode when SSL_SECURITY_LEVEL has only RSA key exchange Excluding RSA key exchange from an SSL_SECURITY_LEVEL that lists only RSA key-exchange suites leaves no TLS 1.2 suite, so set_ciphers raised on every client build. enforce_fips_mode now checks the configured list first and refuses to start with a FipsModeError that names the setting. The cipher list test no longer assumes the host has RSA key-exchange suites. * fix(tls): offer only TLS 1.3 instead of refusing to start when no TLS 1.2 suite without RSA key exchange is left * chore(tls): warn when fips_mode leaves a cipher list with only TLS 1.3 * style(tls): split the TLS 1.3 fallback warning to fit the line limit * fix(proxy): exclude RSA key exchange before config-load secret reads in FIPS mode get_config reads secrets (AWS, GCP, HashiCorp, CyberArk secret managers) over the shared outbound SSL context before enforce_fips_mode runs, so with general_settings.fips_mode true those first TLS handshakes still offered RSA key exchange. Turn the exclusion on in get_config from the raw general_settings, right before the secret manager starts, reusing the existing fips_mode_setting (now public) and exclude_rsa_key_exchange. enforce_fips_mode still owns the refusal and the final state; fips_mode given as an os.environ/ reference is still handled there. * test(proxy): skip the config-load RSA key exchange test on an OpenSSL without RSA suites On an OpenSSL whose default cipher list offers no RSA key exchange suite, fips and standard mode read secrets the same way, so the test has nothing to tell apart and skips, as the http_handler fallback test already does. * fix(tls): exclude TLS 1.2 ChaCha20 suites from the outbound cipher list in FIPS mode ChaCha20-Poly1305 is not a FIPS approved algorithm. FIPS providers already refuse it, so on the Chainguard image this changes nothing, but fips_mode now drops it from TLS 1.2 explicitly next to RSA key exchange. Python's set_ciphers cannot touch TLS 1.3 suites, which still come from OpenSSL's config. exclude_rsa_key_exchange is renamed to exclude_rsa_key_exchange_and_chacha20 to match. |
||
|---|---|---|
| .. | ||
| .coverage_baseline | ||
| __init__.py | ||
| _coverage_check.py | ||
| _pin_check.py | ||
| conftest.py | ||
| test_background_health.py | ||
| test_exception_handlers.py | ||
| test_harness_smoke.py | ||
| test_lifecycle.py | ||
| test_openapi_customization.py | ||
| test_proxy_config.py | ||
| test_routes_anthropic_beta.py | ||
| test_routes_assistants.py | ||
| test_routes_audio.py | ||
| test_routes_chat_completions.py | ||
| test_routes_completions.py | ||
| test_routes_config.py | ||
| test_routes_embeddings.py | ||
| test_routes_invitation.py | ||
| test_routes_login_sso.py | ||
| test_routes_misc.py | ||
| test_routes_model_cost_map.py | ||
| test_routes_model_info.py | ||
| test_routes_model_metrics.py | ||
| test_routes_models.py | ||
| test_routes_moderations.py | ||
| test_routes_onboarding.py | ||
| test_routes_queue.py | ||
| test_routes_threads.py | ||
| test_routes_utils.py | ||
| test_spend_counters.py | ||
| test_streaming_helpers.py | ||
| test_team_model_name_translation.py | ||