30
30
class FipsTests (TestSuite ):
31
31
@TestCaseMetadata (
32
32
description = """
33
- Ensures that an AZL machine is in the correct FIPS mode.
33
+ Ensures that an AZL machine is in the correct FIPS mode.
34
34
""" ,
35
35
priority = 3 ,
36
36
requirement = simple_requirement (
@@ -114,15 +114,15 @@ def _get_expected_fips_mode(
114
114
log (Logger): The logger instance for logging messages.
115
115
node (Node): The node object representing the target machine.
116
116
variables (Dict[str, Any]): A dictionary of variables containing the
117
- 'testing_fips_image' key.
117
+ 'testing_fips_image' key.
118
118
119
119
Returns:
120
120
bool: The expected FIPS mode (True for enabled,
121
- False for disabled or None if we can't determine.).
121
+ False for disabled or None if we can't determine.).
122
122
"""
123
123
log .debug (f"get_expected_fips_mode: variables is '{ variables } '" )
124
124
125
- # First, see if the test runner specified the FIPS image type in the variables.
125
+ # First, check FIPS image type in variables
126
126
testing_fips_image = variables .get ("testing_fips_image" , None )
127
127
if testing_fips_image is not None :
128
128
log .debug (
@@ -131,10 +131,10 @@ def _get_expected_fips_mode(
131
131
)
132
132
return to_bool (testing_fips_image )
133
133
134
- # Fall back to checking the image SKU from the azure metadata endpoint.
134
+ # Fall back to checking image SKU from azure metadata endpoint
135
135
log .debug (
136
- "get_expected_fips_mode: testing_fips_image is not set; falling back to "
137
- "marketplace image sku."
136
+ "get_expected_fips_mode: testing_fips_image is not set; "
137
+ "falling back to marketplace image sku."
138
138
)
139
139
response = node .tools [Curl ].fetch (
140
140
arg = "--max-time 2 --header Metadata:true --silent" ,
@@ -143,17 +143,39 @@ def _get_expected_fips_mode(
143
143
url = METADATA_ENDPOINT ,
144
144
)
145
145
146
- # If we successfully fetched the metadata , check the image SKU.
146
+ # If metadata fetch successful , check image SKU
147
147
if response .exit_code == 0 :
148
148
log .debug (
149
149
"get_expected_fips_mode: successfully fetched metadata; "
150
150
"checking image SKU."
151
151
)
152
152
json_response = json .loads (response .stdout )
153
- return "fips" in json_response ["compute" ]["sku" ]
154
153
155
- # If we couldn't determine the FIPS mode, return False as a default.
154
+ # Safely get compute and sku with default empty values
155
+ compute = json_response .get ("compute" , {})
156
+ sku = compute .get ("sku" , "" )
157
+
158
+ # Ensure SKU is a string type before processing
159
+ if not isinstance (sku , str ):
160
+ log .debug (
161
+ f"get_expected_fips_mode: Expected string for SKU, "
162
+ f"got { type (sku )} "
163
+ )
164
+ return None
165
+
166
+ # Skip empty or whitespace-only SKUs
167
+ if not sku .strip ():
168
+ log .debug (
169
+ "get_expected_fips_mode: SKU is empty or contains only whitespace"
170
+ )
171
+ return None
172
+
173
+ # Check if SKU contains 'fips' (case-insensitive)
174
+ return "fips" in sku .lower ()
175
+
176
+ # If we couldn't determine the FIPS mode, return None as a default.
156
177
log .debug (
157
- "get_expected_fips_mode: could not determine the FIPS mode; returning None."
178
+ "get_expected_fips_mode: could not determine the FIPS mode; "
179
+ "returning None."
158
180
)
159
181
return None
0 commit comments