mirror of
https://github.com/ruby/ruby.git
synced 2025-08-15 13:39:04 +02:00
244363b23e
As OpenSSL::OPENSSL_FIPS always returns true on OpenSSL >= 3.0.0, we cannot use this constant as a flag to check whether the OpenSSL is FIPS or not. See <d725783c5c/ext/openssl/ossl.c (L994-L1004)>. Skip the test_fips_mode_get_with_fips_mode_set test in AWS-LC case. Because we don't test `OpenSSL.fips_mode=` on AWS-LC for now. We cannot change the value of the `OpenSSL.fips_mode` on AWS-LC. The `OpenSSL.fips_mode` in AWS-LC behaves as follows. On AWS-LC non-FIPS: ``` $ bundle exec ruby -I ./lib -ropenssl.so -e 'p OpenSSL.fips_mode' false $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = true; p OpenSSL.fips_mode' -e:1:in 'OpenSSL.fips_mode=': Turning on FIPS mode failed (OpenSSL::OpenSSLError) from -e:1:in '<main>' $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = false; p OpenSSL.fips_mode' false ``` On AWS-LC FIPS: ``` $ bundle exec ruby -I ./lib -ropenssl.so -e 'p OpenSSL.fips_mode' true $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = false; p OpenSSL.fips_mode' -e:1:in 'OpenSSL.fips_mode=': Turning off FIPS mode failed (OpenSSL::OpenSSLError) from -e:1:in '<main>' $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = true; p OpenSSL.fips_mode' true ```fd3e3e722f
59 lines
1.8 KiB
Ruby
59 lines
1.8 KiB
Ruby
# frozen_string_literal: true
|
|
require_relative 'utils'
|
|
|
|
if defined?(OpenSSL)
|
|
|
|
class OpenSSL::TestFIPS < OpenSSL::TestCase
|
|
def test_fips_mode_get_is_true_on_fips_mode_enabled
|
|
unless ENV["TEST_RUBY_OPENSSL_FIPS_ENABLED"]
|
|
omit "Only for FIPS mode environment"
|
|
end
|
|
|
|
assert_separately(["-ropenssl"], <<~"end;")
|
|
assert OpenSSL.fips_mode == true, ".fips_mode should return true on FIPS mode enabled"
|
|
end;
|
|
end
|
|
|
|
def test_fips_mode_get_is_false_on_fips_mode_disabled
|
|
if ENV["TEST_RUBY_OPENSSL_FIPS_ENABLED"]
|
|
omit "Only for non-FIPS mode environment"
|
|
end
|
|
|
|
assert_separately(["-ropenssl"], <<~"end;")
|
|
message = ".fips_mode should return false on FIPS mode disabled. " \
|
|
"If you run the test on FIPS mode, please set " \
|
|
"TEST_RUBY_OPENSSL_FIPS_ENABLED=true"
|
|
assert OpenSSL.fips_mode == false, message
|
|
end;
|
|
end
|
|
|
|
def test_fips_mode_is_reentrant
|
|
return if aws_lc? # AWS-LC's FIPS mode is decided at compile time.
|
|
|
|
assert_separately(["-ropenssl"], <<~"end;")
|
|
OpenSSL.fips_mode = false
|
|
OpenSSL.fips_mode = false
|
|
end;
|
|
end
|
|
|
|
def test_fips_mode_get_with_fips_mode_set
|
|
return if aws_lc? # AWS-LC's FIPS mode is decided at compile time.
|
|
unless ENV["TEST_RUBY_OPENSSL_FIPS_ENABLED"]
|
|
omit "Only for FIPS mode environment"
|
|
end
|
|
|
|
assert_separately(["-ropenssl"], <<~"end;")
|
|
begin
|
|
OpenSSL.fips_mode = true
|
|
assert OpenSSL.fips_mode == true, ".fips_mode should return true when .fips_mode=true"
|
|
|
|
OpenSSL.fips_mode = false
|
|
assert OpenSSL.fips_mode == false, ".fips_mode should return false when .fips_mode=false"
|
|
rescue OpenSSL::OpenSSLError
|
|
pend "Could not set FIPS mode (OpenSSL::OpenSSLError: \#$!); skipping"
|
|
end
|
|
end;
|
|
end
|
|
end
|
|
|
|
end
|