Bug ID 831717: Error messages from mcpd appear in system log during config sync between FIPS-capable devices

Last Modified: Oct 10, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP TMOS(all modules)

Known Affected Versions:
12.1.0, 12.1.0 HF1, 12.1.0 HF2, 12.1.1, 12.1.1 HF1, 12.1.1 HF2, 12.1.2, 12.1.2 HF1, 12.1.2 HF2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 12.1.4.1, 12.1.5

Opened: Sep 26, 2019
Severity: 4-Minor

Symptoms

Messages similar to the following appear in the /var/log/ltm logfile: Sep 15 21:40:31 B10350F-R40-S44 err mcpd[27806]: fips_get_key_attr(): mod_err = 0xa9 Sep 15 21:40:31 B10350F-R40-S44 err mcpd[27806]: fips_find_key_from_modulus(): mod_err = 0xffffffff Sep 15 21:40:31 B10350F-R40-S44 err mcpd[27806]: fips_find_key_from_modulus(): mod_err = 0xffffffff Despite this, the sync is successful and the keys are available on the other device.

Impact

None; the message is benign, caused by the software trying to determine whether the key exists already.

Conditions

Two BIG-IP devices with FIPS HSM installed configured with failover and config sync. A FIPS-resident SSL key is created on one device (e.g. active) and config sync attempted with the other (e.g. standby).

Workaround

Ignore the 0xa9/0xffffffff errors if the config sync is successful and keys properly exchanged.

Fix Information

None

Behavior Change