1 /* 2 * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <string.h> 11 #include <openssl/evp.h> 12 #include <openssl/provider.h> 13 #include "testutil.h" 14 15 static int is_fips; 16 static int bad_fips; 17 18 static int test_is_fips_enabled(void) 19 { 20 int is_fips_enabled, is_fips_loaded; 21 EVP_MD *sha256 = NULL; 22 23 /* 24 * Check we're in FIPS mode when we're supposed to be. We do this early to 25 * confirm that EVP_default_properties_is_fips_enabled() works even before 26 * other function calls have auto-loaded the config file. 27 */ 28 is_fips_enabled = EVP_default_properties_is_fips_enabled(NULL); 29 is_fips_loaded = OSSL_PROVIDER_available(NULL, "fips"); 30 31 /* 32 * Check we're in an expected state. EVP_default_properties_is_fips_enabled 33 * can return true even if the FIPS provider isn't loaded - it is only based 34 * on the default properties. However we only set those properties if also 35 * loading the FIPS provider. 36 */ 37 if (!TEST_int_eq(is_fips || bad_fips, is_fips_enabled) 38 || !TEST_int_eq(is_fips && !bad_fips, is_fips_loaded)) 39 return 0; 40 41 /* 42 * Fetching an algorithm shouldn't change the state and should come from 43 * expected provider. 44 */ 45 sha256 = EVP_MD_fetch(NULL, "SHA2-256", NULL); 46 if (bad_fips) { 47 if (!TEST_ptr_null(sha256)) { 48 EVP_MD_free(sha256); 49 return 0; 50 } 51 } else { 52 if (!TEST_ptr(sha256)) 53 return 0; 54 if (is_fips 55 && !TEST_str_eq(OSSL_PROVIDER_get0_name(EVP_MD_get0_provider(sha256)), 56 "fips")) { 57 EVP_MD_free(sha256); 58 return 0; 59 } 60 EVP_MD_free(sha256); 61 } 62 63 /* State should still be consistent */ 64 is_fips_enabled = EVP_default_properties_is_fips_enabled(NULL); 65 if (!TEST_int_eq(is_fips || bad_fips, is_fips_enabled)) 66 return 0; 67 68 return 1; 69 } 70 71 int setup_tests(void) 72 { 73 size_t argc; 74 char *arg1; 75 76 if (!test_skip_common_options()) { 77 TEST_error("Error parsing test options\n"); 78 return 0; 79 } 80 81 argc = test_get_argument_count(); 82 switch(argc) { 83 case 0: 84 is_fips = 0; 85 bad_fips = 0; 86 break; 87 case 1: 88 arg1 = test_get_argument(0); 89 if (strcmp(arg1, "fips") == 0) { 90 is_fips = 1; 91 bad_fips = 0; 92 break; 93 } else if (strcmp(arg1, "badfips") == 0) { 94 /* Configured for FIPS, but the module fails to load */ 95 is_fips = 0; 96 bad_fips = 1; 97 break; 98 } 99 /* fall through */ 100 default: 101 TEST_error("Invalid argument\n"); 102 return 0; 103 } 104 105 /* Must be the first test before any other libcrypto calls are made */ 106 ADD_TEST(test_is_fips_enabled); 107 return 1; 108 } 109