Commit 4aa5e580 authored by Bob Van Landuyt's avatar Bob Van Landuyt 💬
Browse files

Merge branch 'fix-fips-mode-check' into 'master' 

Add support to disable FIPS mode via env var

See merge request !101
parents bf3cb1ef 9397d39a

lib/labkit/fips.rb

+5 −2
Original line number Diff line number Diff line
@@ -18,12 +18,15 @@ module Labkit 
      #

      # @return [Boolean]

      def enabled?

        # Attempt to auto-detect FIPS mode from OpenSSL

        return true if OpenSSL.fips_mode

        # Check if it set manually to false

        return false if %w[0 false no].include?(ENV["FIPS_MODE"])



        # Otherwise allow it to be set manually via the env vars

        return true if %w[1 true yes].include?(ENV["FIPS_MODE"])



        # Otherwise, attempt to auto-detect FIPS mode from OpenSSL

        return true if OpenSSL.fips_mode



        false

      end

spec/labkit/fips_spec.rb

+16 −40
Original line number Diff line number Diff line
@@ -6,54 +6,30 @@ RSpec.describe Labkit::FIPS do 
  include StubENV



  describe ".enabled?" do

    using RSpec::Parameterized::TableSyntax



    subject { described_class.enabled? }



    let(:openssl_fips_mode) { false }

    let(:fips_mode_env_var) { nil }

    where(:openssl_fips_mode, :fips_mode_env_var, :expect_enabled) do

      false | nil | false

      true | nil | true

      true | "true" | true

      true | "1" | true

      true | "yes" | true

      true | "false" | false

      true | "0" | false

      true | "no" | false

      false | "true" | true

      false | "false" | false

    end



    before do

      allow(OpenSSL).to receive(:fips_mode).and_return(openssl_fips_mode)

      stub_env("FIPS_MODE", fips_mode_env_var)

    end



    describe "OpenSSL auto-detection" do

      context "with OpenSSL in FIPS mode" do

        let(:openssl_fips_mode) { true }



        it { is_expected.to be_truthy }

      end



      context "with OpenSSL not in FIPS mode" do

        let(:openssl_fips_mode) { false }



        it { is_expected.to be_falsey }

      end

    end



    describe "manual configuration via env var" do

      context "when env var is not set" do

        let(:fips_mode_env_var) { nil }



        it { is_expected.to be_falsey }

      end



      context "when env var is set to true" do

        let(:fips_mode_env_var) { "true" }



        it { is_expected.to be_truthy }

      end



      context "when env var is set to 1" do

        let(:fips_mode_env_var) { "1" }



        it { is_expected.to be_truthy }

      end



      context "when env var is set to false" do

        let(:fips_mode_env_var) { "false" }



        it { is_expected.to be_falsey }

      end

    with_them do

      it { is_expected.to be(expect_enabled) }

    end

  end