summaryrefslogtreecommitdiff
path: root/ext/openssl/ossl.c
diff options
context:
space:
mode:
authoremboss <emboss@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2012-12-20 00:29:07 +0000
committeremboss <emboss@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2012-12-20 00:29:07 +0000
commita3b753b28214ad321e7335afada7f1b06d036836 (patch)
treec405de7ac3b8a087774472e6d31ee7de7642863c /ext/openssl/ossl.c
parente3e4e9dfe77c103ac8a46e5ad15ef6b36e6f0653 (diff)
* ext/openssl/ossl.c: add OpenSSL.fips_mode= to allow enabling FIPS
mode manually. * test/openssl/utils.rb: turn off FIPS mode for tests. This prevents OpenSSL installations with FIPS mode enabled by default from raising FIPS-related errors during the tests. * test/openssl/test_fips.rb: add tests for FIPS-capable OpenSSL installations. [Feature #6946] [ruby-core:47345] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@38480 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'ext/openssl/ossl.c')
-rw-r--r--ext/openssl/ossl.c30
1 files changed, 29 insertions, 1 deletions
diff --git a/ext/openssl/ossl.c b/ext/openssl/ossl.c
index ac8f638..9d14ca6 100644
--- a/ext/openssl/ossl.c
+++ b/ext/openssl/ossl.c
@@ -425,6 +425,33 @@ ossl_debug_set(VALUE self, VALUE val)
}
/*
+ * call-seq:
+ * OpenSSL.fips_mode = boolean -> boolean
+ *
+ * Turns FIPS mode on or off. Turning on FIPS mode will obviously only have an
+ * effect for FIPS-capable installations of the OpenSSL library. Trying to do
+ * so otherwise will result in an error.
+ *
+ * === Examples
+ *
+ * OpenSSL.fips_mode = true # turn FIPS mode on
+ * OpenSSL.fips_mode = false # and off again
+ */
+static VALUE
+ossl_fips_mode_set(VALUE self, VALUE enabled)
+{
+ if RTEST(enabled) {
+ int mode = FIPS_mode();
+ if(!mode && !FIPS_mode_set(1)) /* turning on twice leads to an error */
+ ossl_raise(eOSSLError, "Turning on FIPS mode failed");
+ } else {
+ if(!FIPS_mode_set(0)) /* turning off twice is OK */
+ ossl_raise(eOSSLError, "Turning off FIPS mode failed");
+ }
+ return enabled;
+}
+
+/*
* OpenSSL provides SSL, TLS and general purpose cryptography. It wraps the
* OpenSSL[http://www.openssl.org/] library.
*
@@ -944,13 +971,14 @@ Init_openssl()
rb_define_const(mOSSL, "OPENSSL_VERSION_NUMBER", INT2NUM(OPENSSL_VERSION_NUMBER));
/*
- * Boolean indicating whether OpenSSL runs in FIPS mode or not
+ * Boolean indicating whether OpenSSL is FIPS-enabled or not
*/
#ifdef HAVE_OPENSSL_FIPS
rb_define_const(mOSSL, "OPENSSL_FIPS", Qtrue);
#else
rb_define_const(mOSSL, "OPENSSL_FIPS", Qfalse);
#endif
+ rb_define_module_function(mOSSL, "fips_mode=", ossl_fips_mode_set, 1);
/*
* Generic error,