openssl_test.go

package openssl_test

import (
	"fmt"
	"go/version"
	"os"
	"runtime"
	"strings"
	"testing"
	"time"

	"github.com/golang-fips/openssl/v2"
)

// sink is used to prevent the compiler from optimizing out the allocations.
var sink uint8

// getVersion returns the OpenSSL version to use for testing.
func getVersion() string {
	v := os.Getenv("GO_OPENSSL_VERSION_OVERRIDE")
	if v != "" {
		if runtime.GOOS == "linux" {
			return "libcrypto.so." + v
		}
		return v
	}
	// Try to find a supported version of OpenSSL on the system.
	// This is useful for local testing, where the user may not
	// have GO_OPENSSL_VERSION_OVERRIDE set.
	versions := []string{"3", "1.1.1", "1.1", "11", "111", "1.0.2", "1.0.0", "10"}
	if runtime.GOOS == "windows" {
		if runtime.GOARCH == "amd64" {
			versions = []string{"libcrypto-3-x64", "libcrypto-3", "libcrypto-1_1-x64", "libcrypto-1_1", "libeay64", "libeay32"}
		} else {
			versions = []string{"libcrypto-3", "libcrypto-1_1", "libeay32"}
		}
	}
	for _, v = range versions {
		if runtime.GOOS == "windows" {
			v += ".dll"
		} else if runtime.GOOS == "darwin" {
			v = "libcrypto." + v + ".dylib"
		} else {
			v = "libcrypto.so." + v
		}
		if ok, _ := openssl.CheckVersion(v); ok {
			return v
		}
	}
	return "libcrypto.so"
}

func TestMain(m *testing.M) {
	v := getVersion()
	fmt.Printf("Using %s\n", v)
	err := openssl.Init(v)
	if err != nil {
		// An error here could mean that this Linux distro does not have a supported OpenSSL version
		// or that there is a bug in the Init code.
		panic(err)
	}
	_ = openssl.SetFIPS(true) // Skip the error as we still want to run the tests on machines without FIPS support.
	fmt.Println("OpenSSL version:", openssl.VersionText())
	fmt.Println("FIPS enabled:", openssl.FIPS())
	status := m.Run()
	for range 5 {
		// Run GC a few times to avoid false positives in leak detection.
		runtime.GC()
		// Sleep a bit to let the finalizers run.
		time.Sleep(10 * time.Millisecond)
	}
	openssl.CheckLeaks()
	os.Exit(status)
}

func TestCheckVersion(t *testing.T) {
	v := getVersion()
	exists, fips := openssl.CheckVersion(v)
	if !exists {
		t.Fatalf("OpenSSL version %q not found", v)
	}
	if want := openssl.FIPS(); want != fips {
		t.Fatalf("FIPS mismatch: want %v, got %v", want, fips)
	}
}

// compareCurrentVersion compares v with [runtime.Version].
// See [go/versions.Compare] for information about
// v format and comparison rules.
func compareCurrentVersion(v string) int {
	ver := strings.TrimPrefix(runtime.Version(), "devel ")
	return version.Compare(ver, v)
}

func TestSetFIPS(t *testing.T) {
	fipsEnabled := openssl.FIPS()
	t.Cleanup(func() {
		// Restore the previous FIPS mode.
		err := openssl.SetFIPS(fipsEnabled)
		if err != nil {
			t.Fatal(err)
		}
	})

	if err := openssl.SetFIPS(fipsEnabled); err != nil {
		// Test that we can set FIPS mode to the current state
		// without error.
		t.Fatalf("SetFIPS(%v) failed: %v", fipsEnabled, err)
	}
	if got := openssl.FIPS(); got != fipsEnabled {
		// Test that the FIPS mode hasn't been changed by the
		// previous SetFIPS call.
		t.Fatalf("FIPS mode mismatch: want %v, got %v", fipsEnabled, got)
	}

	if fipsEnabled &&
		openssl.DefaultProviderAvailable() {
		// Test that we can disable FIPS mode if it was enabled
		// when the built-in provider is available.
		err := openssl.SetFIPS(false)
		if err != nil {
			t.Fatalf("SetFIPS(false) failed: %v", err)
		}
	} else if !fipsEnabled &&
		(openssl.SymCryptProviderAvailable() || openssl.FIPSProviderAvailable()) {
		// Test that we can enable FIPS mode if it was disabled
		// when the provider is known to support FIPS mode.
		err := openssl.SetFIPS(true)
		if err != nil {
			t.Fatalf("SetFIPS(true) failed: %v", err)
		}
	} else {
		t.Skip("FIPS mode is not supported")
	}
}