Skip to content
  • Jun Aruga's avatar
    244363b2
    [ruby/openssl] Use ENV["TEST_RUBY_OPENSSL_FIPS_ENABLED"] instead of OpenSSL::OPENSSL_FIPS. · 244363b2
    Jun Aruga authored
    As OpenSSL::OPENSSL_FIPS always returns true on OpenSSL >= 3.0.0, we cannot use
    this constant as a flag to check whether the OpenSSL is FIPS or not.
    See <https://github.com/ruby/openssl/blob/d725783c5c180337f3d00efcba5b8744e0aea813/ext/openssl/ossl.c#L994-L1004>.
    
    Skip the test_fips_mode_get_with_fips_mode_set test in AWS-LC case.
    
    Because we don't test `OpenSSL.fips_mode=` on AWS-LC for now. We cannot change
    the value of the `OpenSSL.fips_mode` on AWS-LC.
    The `OpenSSL.fips_mode` in AWS-LC behaves as follows.
    
    On AWS-LC non-FIPS:
    ```
    $ bundle exec ruby -I ./lib -ropenssl.so -e 'p OpenSSL.fips_mode'
    false
    
    $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = true; p OpenSSL.fips_mode'
    -e:1:in 'OpenSSL.fips_mode=': Turning on FIPS mode failed (OpenSSL::OpenSSLError)
    	from -e:1:in '<main>'
    
    $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = false; p OpenSSL.fips_mode'
    false
    ```
    
    On AWS-LC FIPS:
    ```
    $ bundle exec ruby -I ./lib -ropenssl.so -e 'p OpenSSL.fips_mode'
    true
    
    $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = false; p OpenSSL.fips_mode'
    -e:1:in 'OpenSSL.fips_mode=': Turning off FIPS mode failed (OpenSSL::OpenSSLError)
    	from -e:1:in '<main>'
    
    $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = true; p OpenSSL.fips_mode'
    true
    ```
    
    https://github.com/ruby/openssl/commit/fd3e3e722f
    244363b2
    [ruby/openssl] Use ENV["TEST_RUBY_OPENSSL_FIPS_ENABLED"] instead of OpenSSL::OPENSSL_FIPS.
    Jun Aruga authored
    As OpenSSL::OPENSSL_FIPS always returns true on OpenSSL >= 3.0.0, we cannot use
    this constant as a flag to check whether the OpenSSL is FIPS or not.
    See <https://github.com/ruby/openssl/blob/d725783c5c180337f3d00efcba5b8744e0aea813/ext/openssl/ossl.c#L994-L1004>.
    
    Skip the test_fips_mode_get_with_fips_mode_set test in AWS-LC case.
    
    Because we don't test `OpenSSL.fips_mode=` on AWS-LC for now. We cannot change
    the value of the `OpenSSL.fips_mode` on AWS-LC.
    The `OpenSSL.fips_mode` in AWS-LC behaves as follows.
    
    On AWS-LC non-FIPS:
    ```
    $ bundle exec ruby -I ./lib -ropenssl.so -e 'p OpenSSL.fips_mode'
    false
    
    $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = true; p OpenSSL.fips_mode'
    -e:1:in 'OpenSSL.fips_mode=': Turning on FIPS mode failed (OpenSSL::OpenSSLError)
    	from -e:1:in '<main>'
    
    $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = false; p OpenSSL.fips_mode'
    false
    ```
    
    On AWS-LC FIPS:
    ```
    $ bundle exec ruby -I ./lib -ropenssl.so -e 'p OpenSSL.fips_mode'
    true
    
    $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = false; p OpenSSL.fips_mode'
    -e:1:in 'OpenSSL.fips_mode=': Turning off FIPS mode failed (OpenSSL::OpenSSLError)
    	from -e:1:in '<main>'
    
    $ bundle exec ruby -I ./lib -ropenssl.so -e 'OpenSSL.fips_mode = true; p OpenSSL.fips_mode'
    true
    ```
    
    https://github.com/ruby/openssl/commit/fd3e3e722f
Loading