Latest update.

test/sslprovidertest.c

@@ -7,6 +7,7 @@
  * https://www.openssl.org/source/license.html
  */
 
+#include <string.h>
 #include <openssl/provider.h>
 
 #include "ssltestlib.h"
@@ -14,11 +15,10 @@
 
 static char *cert = NULL;
 static char *privkey = NULL;
+static char *modulename = NULL;
+static char *configfile = NULL;
 
-/* TODO(3.0): Re-enable this code. See comment in setup_tests() */
-#if 0
-OSSL_PROVIDER *defctxlegacy = NULL;
-#endif
+static OSSL_PROVIDER *defctxlegacy = NULL;
 
 static int test_different_libctx(void)
 {
@@ -26,13 +26,29 @@ static int test_different_libctx(void)
     SSL *clientssl = NULL, *serverssl = NULL;
     int testresult = 0;
     OPENSSL_CTX *libctx = OPENSSL_CTX_new();
+    OSSL_PROVIDER *prov = NULL;
 
-/* TODO(3.0): Re-enable this code. See comment in setup_tests() */
-#if 0
-    /* Verify that the default provider in the default libctx is not available */
-    if (!TEST_false(OSSL_PROVIDER_available(NULL, "default")))
+    /*
+     * Verify that the default and fips providers in the default libctx are not
+     * available
+     */
+    if (!TEST_false(OSSL_PROVIDER_available(NULL, "default"))
+            || !TEST_false(OSSL_PROVIDER_available(NULL, "fips")))
         goto end;
-#endif
+
+    if (!TEST_true(OPENSSL_CTX_load_config(libctx, configfile)))
+        goto end;
+
+    prov = OSSL_PROVIDER_load(libctx, modulename);
+    if (!TEST_ptr(prov)
+               /* Check we have the provider available */
+            || !TEST_true(OSSL_PROVIDER_available(libctx, modulename)))
+        goto end;
+    /* Check the default provider is not available */
+    if (strcmp(modulename, "default") != 0
+            && !TEST_false(OSSL_PROVIDER_available(libctx, "default")))
+        goto end;
+    TEST_note("%s provider loaded", modulename);
 
     cctx = SSL_CTX_new_with_libctx(libctx, NULL, TLS_client_method());
     if (!TEST_ptr(cctx))
@@ -41,11 +57,21 @@ static int test_different_libctx(void)
     if (!TEST_ptr(sctx))
         goto end;
 
+    /*
+     * TODO(3.0): Make this work in TLSv1.3. Currently we can only do RSA key
+     * exchange, because we don't have key gen/param gen for EC yet - which
+     * implies TLSv1.2 only
+     */
     if (!TEST_true(create_ssl_ctx_pair(NULL,
                                        NULL,
                                        TLS1_VERSION,
-                                       0,
-                                       &sctx, NULL, cert, privkey)))
+                                       TLS1_2_VERSION,
+                                       &sctx, &cctx, cert, privkey)))
+        goto end;
+
+    /* Ensure we use a FIPS compatible ciphersuite and sigalg */
+    if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "AES128-SHA256"))
+            || !TEST_true(SSL_CTX_set1_sigalgs_list(cctx, "RSA+SHA256")))
         goto end;
 
     if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
@@ -56,15 +82,13 @@ static int test_different_libctx(void)
     if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
         goto end;
 
-/* TODO(3.0): Re-enable this code. See comment in setup_tests() */
-#if 0
     /*
-     * Verify that the default provider in the default libctx is still not
-     * available
+     * Verify that the default and fips providers in the default libctx are
+     * still not available
      */
-    if (!TEST_false(OSSL_PROVIDER_available(NULL, "default")))
+    if (!TEST_false(OSSL_PROVIDER_available(NULL, "default"))
+            || !TEST_false(OSSL_PROVIDER_available(NULL, "fips")))
         goto end;
-#endif
 
     testresult = 1;
 
@@ -74,6 +98,7 @@ static int test_different_libctx(void)
     SSL_CTX_free(sctx);
     SSL_CTX_free(cctx);
 
+    OSSL_PROVIDER_unload(prov);
     OPENSSL_CTX_free(libctx);
 
     return testresult;
@@ -82,26 +107,15 @@ static int test_different_libctx(void)
 int setup_tests(void)
 {
     char *certsdir = NULL;
-    /*
-     * TODO(3.0): Re-enable this code when key generation is provider aware. At
-     * the moment the below causes the tests to fail because libssl attempts to
-     * generate a key for the key_share, which ultimately invokes RAND_bytes().
-     * However, because key generation is not yet provider aware it just uses
-     * the default library context - and hence fails.
-     */
-#if 0
-    /*
-     * For tests in this file we want to ensure the default ctx does not have
-     * the default provider loaded into the default ctx. So we load "legacy" to
-     * prevent default from being auto-loaded. This tests that there is no
-     * "leakage", i.e. when using SSL_CTX_new_with_libctx() we expect only the
-     * specific libctx to be used - nothing should fall back to the default
-     * libctx
-     */
-    defctxlegacy = OSSL_PROVIDER_load(NULL, "legacy");
-#endif
 
-    if (!TEST_ptr(certsdir = test_get_argument(0)))
+    if (!test_skip_common_options()) {
+        TEST_error("Error parsing test options\n");
+        return 0;
+    }
+
+    if (!TEST_ptr(certsdir = test_get_argument(0))
+            || !TEST_ptr(modulename = test_get_argument(1))
+            || !TEST_ptr(configfile = test_get_argument(2)))
         return 0;
 
     cert = test_mk_file_path(certsdir, "servercert.pem");
@@ -114,6 +128,16 @@ int setup_tests(void)
         return 0;
     }
 
+    /*
+     * For tests in this file we want to ensure the default ctx does not have
+     * the default provider loaded into the default ctx. So we load "legacy" to
+     * prevent default from being auto-loaded. This tests that there is no
+     * "leakage", i.e. when using SSL_CTX_new_with_libctx() we expect only the
+     * specific libctx to be used - nothing should fall back to the default
+     * libctx
+     */
+    defctxlegacy = OSSL_PROVIDER_load(NULL, "legacy");
+
     ADD_TEST(test_different_libctx);
 
     return 1;
@@ -121,8 +145,5 @@ int setup_tests(void)
 
 void cleanup_tests(void)
 {
-    /* TODO(3.0): Re-enable this code. See comment in setup_tests() */
-#if 0
     OSSL_PROVIDER_unload(defctxlegacy);
-#endif
 }