make inability to dup/clone ciphers an error

There should be no reason that a cipher can't be duplicated Fixes #21887 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #21933)
openssl · Sep 12, 2023 · 39d857b · 39d857b
1 parent 9912dfb
commit 39d857b
Showing 1 changed file with 22 additions and 6 deletions.
diff --git a/test/evp_test.c b/test/evp_test.c
@@ -735,6 +735,9 @@ static int cipher_test_enc(EVP_TEST *t, int enc, size_t out_misalign,
     int ok = 0, tmplen, chunklen, tmpflen, i;
     EVP_CIPHER_CTX *ctx_base = NULL;
     EVP_CIPHER_CTX *ctx = NULL, *duped;
+    int fips_dupctx_supported = (fips_provider_version_ge(libctx, 3, 0, 11)
+                                && fips_provider_version_lt(libctx, 3, 1, 0))
+                                || fips_provider_version_ge(libctx, 3, 1, 3);
 
     t->err = "TEST_FAILURE";
     if (!TEST_ptr(ctx_base = EVP_CIPHER_CTX_new()))
@@ -865,18 +868,30 @@ static int cipher_test_enc(EVP_TEST *t, int enc, size_t out_misalign,
 
     /* Test that the cipher dup functions correctly if it is supported */
     ERR_set_mark();
-    if (EVP_CIPHER_CTX_copy(ctx, ctx_base)) {
-        EVP_CIPHER_CTX_free(ctx_base);
-        ctx_base = NULL;
-    } else {
-        EVP_CIPHER_CTX_free(ctx);
-        ctx = ctx_base;
+    if (!EVP_CIPHER_CTX_copy(ctx, ctx_base)) {
+        if (fips_dupctx_supported) {
+            TEST_info("Doing a copy of Cipher %s Fails!\n",
+                      EVP_CIPHER_get0_name(expected->cipher));
+            ERR_print_errors_fp(stderr);
+            goto err;
+        } else {
+            TEST_info("Allowing copy fail as an old fips provider is in use.");
+        }
     }
     /* Likewise for dup */
     duped = EVP_CIPHER_CTX_dup(ctx);
     if (duped != NULL) {
         EVP_CIPHER_CTX_free(ctx);
         ctx = duped;
+    } else {
+        if (fips_dupctx_supported) {
+            TEST_info("Doing a dup of Cipher %s Fails!\n",
+                      EVP_CIPHER_get0_name(expected->cipher));
+            ERR_print_errors_fp(stderr);
+            goto err;
+        } else {
+            TEST_info("Allowing dup fail as an old fips provider is in use.");
+        }
     }
     ERR_pop_to_mark();
 
@@ -1089,6 +1104,7 @@ static int cipher_test_run(EVP_TEST *t)
     int rv, frag, fragmax, in_place;
     size_t out_misalign, inp_misalign;
 
+    TEST_info("RUNNING TEST FOR CIPHER %s\n", EVP_CIPHER_get0_name(cdat->cipher));
     if (!cdat->key) {
         t->err = "NO_KEY";
         return 0;