* ext/openssl/ossl.c: do not use FIPS_mode_set if not available.

* test/openssl/utils.rb: revise comment about setting FIPS mode to
  false.
* test/openssl/test_fips.rb: remove tests that cause errors on
  ruby-ci.
  [Feature #6946] [ruby-core:47345]



git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@38491 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

2 files changed, 6 insertions, 46 deletions

diff --git a/test/openssl/test_fips.rb b/test/openssl/test_fips.rb
index 7d290feb7c..882647f7e1 100644
--- a/test/openssl/test_fips.rb
+++ b/test/openssl/test_fips.rb
@@ -1,53 +1,12 @@
 require_relative 'utils'
 
-if defined?(OpenSSL) && OpenSSL::OPENSSL_FIPS
+if defined?(OpenSSL)
 
 class OpenSSL::TestFIPS < Test::Unit::TestCase
 
-  def test_reject_md5
-    data = "test"
-    assert_not_nil(OpenSSL::Digest.new("MD5").digest(data))
-    in_fips_mode do
-      assert_raise(OpenSSL::Digest::DigestError) do
-        OpenSSL::Digest.new("MD5").digest(data)
-      end
-    end
-  end
-
-  def test_reject_short_key_rsa
-    assert_key_too_short(OpenSSL::PKey::RSAError) { dh = OpenSSL::PKey::RSA.new(256) }
-  end
-
-  def test_reject_short_key_dsa
-    assert_key_too_short(OpenSSL::PKey::DSAError) { dh = OpenSSL::PKey::DSA.new(256) }
-  end
-
-  def test_reject_short_key_dh
-    assert_key_too_short(OpenSSL::PKey::DHError) { dh = OpenSSL::PKey::DH.new(256) }
-  end
-
-  def test_reject_short_key_ec
-    assert_key_too_short(OpenSSL::PKey::ECError) do
-      group = OpenSSL::PKey::EC::Group.new('secp112r1')
-      key = OpenSSL::PKey::EC.new
-      key.group = group
-      key.generate_key
-    end
-  end
-
-  private
-
-  def in_fips_mode
-    OpenSSL.fips_mode = true
-    yield
-  ensure
+  def test_fips_mode_is_reentrant
+    OpenSSL.fips_mode = false
     OpenSSL.fips_mode = false
-  end
-
-  def assert_key_too_short(expected_error)
-    in_fips_mode do
-      assert_raise(expected_error) { yield }
-    end
   end
 
 end
diff --git a/test/openssl/utils.rb b/test/openssl/utils.rb
index 646ed88366..ba9714b3fc 100644
--- a/test/openssl/utils.rb
+++ b/test/openssl/utils.rb
@@ -1,8 +1,9 @@
 begin
   require "openssl"
 
-  # disable FIPS mode for tests for installations
-  # where FIPS mode would be enabled by default
+  # Disable FIPS mode for tests for installations
+  # where FIPS mode would be enabled by default.
+  # Has no effect on all other installations.
   OpenSSL.fips_mode=false
 rescue LoadError
 end