From 26b21aa0d52047d93df79b25bff27093971d1b96 Mon Sep 17 00:00:00 2001 From: Griffin Gao Date: Wed, 8 Jul 2026 18:34:43 +0800 Subject: [PATCH] [rest]: Disable TLS session tickets to avoid AES-CTR panic under FIPS Under sonic_fips=1 the symcrypt OpenSSL provider has no AES-CTR, which crypto/tls uses only for session tickets; the golang- fips backend panics on every TLS handshake, so rest_server resets all connections. Disabling session tickets removes the only AES- CTR call path and restores RESTCONF. Signed-off-by: Griffin Gao --- rest/main/main.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/rest/main/main.go b/rest/main/main.go index b07ce7496..99af59032 100644 --- a/rest/main/main.go +++ b/rest/main/main.go @@ -106,6 +106,12 @@ func main() { ClientCAs: prepareCACertificates(), MinVersion: tls.VersionTLS12, PreferServerCipherSuites: true, + // In FIPS mode (sonic_fips=1) the symcrypt OpenSSL provider does not + // implement AES-CTR, and the golang-fips backend panics instead of + // returning an error. crypto/tls uses AES-CTR only to encrypt session + // tickets, so disabling ticket based resumption keeps the whole TLS + // path within the algorithms symcrypt provides. + SessionTicketsDisabled: true, } // Prepare HTTPS server