root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity
openssl/test/fips-and-base.cnf

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

23 lines
469 B
Plaintext
Raw Normal View History

Add CLI tests in FIPS configuration Add positive and negative tests of CLI apps using configuration files via environment variables to force FIPS mode. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12291)
2020-06-27 06:40:30 +08:00
openssl_conf = openssl_init
Add config_diagnostics to our configuration files. The change to a more configuration based approach to enable FIPS mode operation highlights a shortcoming in the default should do something approach we've taken for bad configuration files. Currently, a bad configuration file will be automatically loaded and once the badness is detected, it will silently stop processing the configuration and continue normal operations. This is good for remote servers, allowing changes to be made without bricking things. It's bad when a user thinks they've configured what they want but got something wrong and it still appears to work. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16171)
2021-07-29 07:55:09 +08:00
# Comment out the next line to ignore configuration errors
config_diagnostics = 1
Add CLI tests in FIPS configuration Add positive and negative tests of CLI apps using configuration files via environment variables to force FIPS mode. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12291)
2020-06-27 06:40:30 +08:00
.include fipsmodule.cnf
[openssl_init]
providers = provider_sect
test: note that a default property query must be included for FIPS validity Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20079)
2023-01-23 06:52:17 +08:00
# You MUST uncomment the following line to operate in a FIPS approved manner,
# It is commented out here purely for testing purposes.
#alg_section = evp_properties
[evp_properties]
default_properties = "fips=yes"
Add CLI tests in FIPS configuration Add positive and negative tests of CLI apps using configuration files via environment variables to force FIPS mode. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12291)
2020-06-27 06:40:30 +08:00
[provider_sect]
fips = fips_sect
base = base_sect
[base_sect]
activate = 1