diff --git a/ext/openssl/ossl.c b/ext/openssl/ossl.c index 6c532aca9..c1e1ba80e 100644 --- a/ext/openssl/ossl.c +++ b/ext/openssl/ossl.c @@ -418,7 +418,11 @@ static VALUE ossl_fips_mode_get(VALUE self) { -#ifdef OPENSSL_FIPS +#if OSSL_OPENSSL_PREREQ(3, 0, 0) + VALUE enabled; + enabled = EVP_default_properties_is_fips_enabled(NULL) ? Qtrue : Qfalse; + return enabled; +#elif OPENSSL_FIPS VALUE enabled; enabled = FIPS_mode() ? Qtrue : Qfalse; return enabled; diff --git a/test/openssl/test_fips.rb b/test/openssl/test_fips.rb index 03f7761a0..803480a4e 100644 --- a/test/openssl/test_fips.rb +++ b/test/openssl/test_fips.rb @@ -4,12 +4,37 @@ if defined?(OpenSSL) class OpenSSL::TestFIPS < OpenSSL::TestCase + def test_fips_mode_get_is_true_on_fips_mode_enabled + unless ENV["CI"] && ENV["TEST_RUBY_OPENSSL_FIPS_ENABLED"] + omit "Only for on FIPS mode environment on CI" + end + + assert_separately([{ "OSSL_MDEBUG" => nil }, "-ropenssl"], <<~"end;") + assert OpenSSL.fips_mode == true, ".fips_mode returns true on FIPS mode enabled" + end; + end + + def test_fips_mode_get_is_false_on_fips_mode_disabled + unless ENV["CI"] && !ENV["TEST_RUBY_OPENSSL_FIPS_ENABLED"] + omit "Only for non-FIPS mode environment on CI" + end + + assert_separately([{ "OSSL_MDEBUG" => nil }, "-ropenssl"], <<~"end;") + assert OpenSSL.fips_mode == false, ".fips_mode returns false on FIPS mode disabled" + end; + end + def test_fips_mode_is_reentrant OpenSSL.fips_mode = false OpenSSL.fips_mode = false end - def test_fips_mode_get + def test_fips_mode_get_with_fips_mode_set + if openssl?(3, 0, 0) + pend('OpenSSL::OPENSSL_FIPS and fips_mode_set are not properly ' \ + 'implemented in OpenSSL 3') + end + return unless OpenSSL::OPENSSL_FIPS assert_separately([{ "OSSL_MDEBUG" => nil }, "-ropenssl"], <<~"end;") begin