fips

Documentation

Overview

Package fips reports FIPS 140-3 mode and provides helpers to gate operations that rely on cryptography not approved by the Go FIPS 140-3 module.

Index

• func CheckWebSocketURL(urls ...string) error
• func DisabledError(op, algo string) error
• func Enabled() bool
• func Enforced() bool

Functions

func CheckWebSocketURL

func CheckWebSocketURL(urls ...string) error

CheckWebSocketURL returns an error when running under FIPS and any of the provided URLs use ws:// or wss://.

Background: the nats.go client computes SHA-1 unguarded in its WebSocket handshake (Sec-WebSocket-Accept), which panics under GODEBUG=fips140=only. nats-server ships an fips140.WithoutEnforcement bypass for the same path (https://github.com/nats-io/nats-server/pull/8141, merge 7224db1) but nats.go does not yet have an equivalent. Until that lands upstream we refuse WebSocket URLs up front so users get a clear error instead of a runtime panic. Each argument may contain a comma-separated list of URLs.

func DisabledError

func DisabledError(op, algo string) error

DisabledError returns an error indicating an operation is unavailable in the FIPS build. op is the user-facing operation name and algo the algorithm or primitive that is not part of the FIPS 140-3 module.

func Enabled

func Enabled() bool

Enabled reports whether the Go FIPS 140-3 module is active (GODEBUG=fips140=on or fips140=only, or built with //go:debug fips140=...).

func Enforced

func Enforced() bool

Enforced reports whether strict FIPS 140-3 enforcement is active.

crypto/fips140.Enforced was added in Go 1.26. On older toolchains we fall back to Enabled, treating any FIPS signal as strict so the gates fail closed.