1*b0d17251Schristos /*
2*b0d17251Schristos * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
3*b0d17251Schristos *
4*b0d17251Schristos * Licensed under the Apache License 2.0 (the "License"). You may not use
5*b0d17251Schristos * this file except in compliance with the License. You can obtain a copy
6*b0d17251Schristos * in the file LICENSE in the source distribution or at
7*b0d17251Schristos * https://www.openssl.org/source/license.html
8*b0d17251Schristos */
9*b0d17251Schristos
10*b0d17251Schristos #include <string.h>
11*b0d17251Schristos #include <openssl/evp.h>
12*b0d17251Schristos #include <openssl/provider.h>
13*b0d17251Schristos #include "testutil.h"
14*b0d17251Schristos
15*b0d17251Schristos static int is_fips;
16*b0d17251Schristos static int bad_fips;
17*b0d17251Schristos
test_is_fips_enabled(void)18*b0d17251Schristos static int test_is_fips_enabled(void)
19*b0d17251Schristos {
20*b0d17251Schristos int is_fips_enabled, is_fips_loaded;
21*b0d17251Schristos EVP_MD *sha256 = NULL;
22*b0d17251Schristos
23*b0d17251Schristos /*
24*b0d17251Schristos * Check we're in FIPS mode when we're supposed to be. We do this early to
25*b0d17251Schristos * confirm that EVP_default_properties_is_fips_enabled() works even before
26*b0d17251Schristos * other function calls have auto-loaded the config file.
27*b0d17251Schristos */
28*b0d17251Schristos is_fips_enabled = EVP_default_properties_is_fips_enabled(NULL);
29*b0d17251Schristos is_fips_loaded = OSSL_PROVIDER_available(NULL, "fips");
30*b0d17251Schristos
31*b0d17251Schristos /*
32*b0d17251Schristos * Check we're in an expected state. EVP_default_properties_is_fips_enabled
33*b0d17251Schristos * can return true even if the FIPS provider isn't loaded - it is only based
34*b0d17251Schristos * on the default properties. However we only set those properties if also
35*b0d17251Schristos * loading the FIPS provider.
36*b0d17251Schristos */
37*b0d17251Schristos if (!TEST_int_eq(is_fips || bad_fips, is_fips_enabled)
38*b0d17251Schristos || !TEST_int_eq(is_fips && !bad_fips, is_fips_loaded))
39*b0d17251Schristos return 0;
40*b0d17251Schristos
41*b0d17251Schristos /*
42*b0d17251Schristos * Fetching an algorithm shouldn't change the state and should come from
43*b0d17251Schristos * expected provider.
44*b0d17251Schristos */
45*b0d17251Schristos sha256 = EVP_MD_fetch(NULL, "SHA2-256", NULL);
46*b0d17251Schristos if (bad_fips) {
47*b0d17251Schristos if (!TEST_ptr_null(sha256)) {
48*b0d17251Schristos EVP_MD_free(sha256);
49*b0d17251Schristos return 0;
50*b0d17251Schristos }
51*b0d17251Schristos } else {
52*b0d17251Schristos if (!TEST_ptr(sha256))
53*b0d17251Schristos return 0;
54*b0d17251Schristos if (is_fips
55*b0d17251Schristos && !TEST_str_eq(OSSL_PROVIDER_get0_name(EVP_MD_get0_provider(sha256)),
56*b0d17251Schristos "fips")) {
57*b0d17251Schristos EVP_MD_free(sha256);
58*b0d17251Schristos return 0;
59*b0d17251Schristos }
60*b0d17251Schristos EVP_MD_free(sha256);
61*b0d17251Schristos }
62*b0d17251Schristos
63*b0d17251Schristos /* State should still be consistent */
64*b0d17251Schristos is_fips_enabled = EVP_default_properties_is_fips_enabled(NULL);
65*b0d17251Schristos if (!TEST_int_eq(is_fips || bad_fips, is_fips_enabled))
66*b0d17251Schristos return 0;
67*b0d17251Schristos
68*b0d17251Schristos return 1;
69*b0d17251Schristos }
70*b0d17251Schristos
setup_tests(void)71*b0d17251Schristos int setup_tests(void)
72*b0d17251Schristos {
73*b0d17251Schristos size_t argc;
74*b0d17251Schristos char *arg1;
75*b0d17251Schristos
76*b0d17251Schristos if (!test_skip_common_options()) {
77*b0d17251Schristos TEST_error("Error parsing test options\n");
78*b0d17251Schristos return 0;
79*b0d17251Schristos }
80*b0d17251Schristos
81*b0d17251Schristos argc = test_get_argument_count();
82*b0d17251Schristos switch(argc) {
83*b0d17251Schristos case 0:
84*b0d17251Schristos is_fips = 0;
85*b0d17251Schristos bad_fips = 0;
86*b0d17251Schristos break;
87*b0d17251Schristos case 1:
88*b0d17251Schristos arg1 = test_get_argument(0);
89*b0d17251Schristos if (strcmp(arg1, "fips") == 0) {
90*b0d17251Schristos is_fips = 1;
91*b0d17251Schristos bad_fips = 0;
92*b0d17251Schristos break;
93*b0d17251Schristos } else if (strcmp(arg1, "badfips") == 0) {
94*b0d17251Schristos /* Configured for FIPS, but the module fails to load */
95*b0d17251Schristos is_fips = 0;
96*b0d17251Schristos bad_fips = 1;
97*b0d17251Schristos break;
98*b0d17251Schristos }
99*b0d17251Schristos /* fall through */
100*b0d17251Schristos default:
101*b0d17251Schristos TEST_error("Invalid argument\n");
102*b0d17251Schristos return 0;
103*b0d17251Schristos }
104*b0d17251Schristos
105*b0d17251Schristos /* Must be the first test before any other libcrypto calls are made */
106*b0d17251Schristos ADD_TEST(test_is_fips_enabled);
107*b0d17251Schristos return 1;
108*b0d17251Schristos }
109