Skip to content

Commit fd3e3e7

Browse files
committed
Use ENV["TEST_RUBY_OPENSSL_FIPS_ENABLED"] instead of OpenSSL::OPENSSL_FIPS.
As OpenSSL::OPENSSL_FIPS always returns true on OpenSSL >= 3.0.0, we cannot use this constant as a flag to check whether the OpenSSL is FIPS or not. See <https://github.com/ruby/openssl/blob/d725783c5c180337f3d00efcba5b8744e0aea813/ext/openssl/ossl.c#L994-L1004>. Skip the test_fips_mode_get_with_fips_mode_set test in AWS-LC case. Because we don't test `OpenSSL.fips_mode=` on AWS-LC for now. We cannot change the value of the `OpenSSL.fips_mode` on AWS-LC. The `OpenSSL.fips_mode` in AWS-LC behaves as follows. On AWS-LC non-FIPS: ``` $ bundle exec ruby -I ./lib -ropenssl.so -e 'p OpenSSL.fips_mode' false $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = true; p OpenSSL.fips_mode' -e:1:in 'OpenSSL.fips_mode=': Turning on FIPS mode failed (OpenSSL::OpenSSLError) from -e:1:in '<main>' $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = false; p OpenSSL.fips_mode' false ``` On AWS-LC FIPS: ``` $ bundle exec ruby -I ./lib -ropenssl.so -e 'p OpenSSL.fips_mode' true $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = false; p OpenSSL.fips_mode' -e:1:in 'OpenSSL.fips_mode=': Turning off FIPS mode failed (OpenSSL::OpenSSLError) from -e:1:in '<main>' $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = true; p OpenSSL.fips_mode' true ```
1 parent d725783 commit fd3e3e7

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

test/openssl/test_fips.rb

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,10 @@ def test_fips_mode_is_reentrant
3737
end
3838

3939
def test_fips_mode_get_with_fips_mode_set
40-
omit('OpenSSL is not FIPS-capable') unless OpenSSL::OPENSSL_FIPS and !aws_lc? # AWS-LC's FIPS mode is decided at compile time.
40+
return if aws_lc? # AWS-LC's FIPS mode is decided at compile time.
41+
unless ENV["TEST_RUBY_OPENSSL_FIPS_ENABLED"]
42+
omit "Only for FIPS mode environment"
43+
end
4144

4245
assert_separately(["-ropenssl"], <<~"end;")
4346
begin

0 commit comments

Comments
 (0)