]> git.ipfire.org Git - thirdparty/openssl.git/commit
Switch FIPS self tests to deferred execution
authorSimo Sorce <simo@redhat.com>
Tue, 25 Nov 2025 22:16:50 +0000 (17:16 -0500)
committerDmitry Belyavskiy <beldmit@gmail.com>
Fri, 13 Feb 2026 09:53:41 +0000 (10:53 +0100)
commit40240719507cfc09870f0faa28cc6e70084d3ee7
treeff5cdee33878d5d4ebbff929c691da8be670f87c
parent380aafd8651cf478744a5cfbe8ebf42e51396227
Switch FIPS self tests to deferred execution

Update the FIPS module to run self-tests on demand (deferred) rather
than on module load. Change the test definitions in self_test_data.c
from SELF_TEST_ONLOAD to SELF_TEST_DEFERRED.

Add calls to ossl_deferred_self_test() in the newctx functions for
ciphers, digests, signatures, KDFs, KEMs and DRBGs to trigger execution
upon first instantiation. Introduce CIPHER_PROV_CHECK and
DIGEST_PROV_CHECK macros in common headers to facilitate these checks.
Define dependencies for composite tests to ensure prerequisite tests
run when needed.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/29222)
39 files changed:
include/internal/fips.h
providers/fips/self_test.h
providers/fips/self_test_data.c
providers/implementations/asymciphers/rsa_enc.c
providers/implementations/ciphers/cipher_aes_cbc_hmac_sha.c
providers/implementations/ciphers/cipher_aes_ccm.c
providers/implementations/ciphers/cipher_aes_gcm.c
providers/implementations/ciphers/cipher_aes_ocb.c
providers/implementations/ciphers/cipher_aes_wrp.c
providers/implementations/ciphers/cipher_aes_xts.c
providers/implementations/ciphers/cipher_tdes_common.c
providers/implementations/digests/sha3_prov.c
providers/implementations/exchange/dh_exch.c
providers/implementations/exchange/ecdh_exch.c
providers/implementations/include/prov/ciphercommon.h
providers/implementations/include/prov/digestcommon.h
providers/implementations/kdfs/hkdf.c
providers/implementations/kdfs/hmacdrbg_kdf.c
providers/implementations/kdfs/kbkdf.c
providers/implementations/kdfs/pbkdf2.c
providers/implementations/kdfs/snmpkdf.c
providers/implementations/kdfs/srtpkdf.c
providers/implementations/kdfs/sshkdf.c
providers/implementations/kdfs/sskdf.c
providers/implementations/kdfs/tls1_prf.c
providers/implementations/kdfs/x942kdf.c
providers/implementations/kem/ml_kem_kem.c
providers/implementations/kem/rsa_kem.c
providers/implementations/keymgmt/ml_dsa_kmgmt.c
providers/implementations/keymgmt/ml_kem_kmgmt.c
providers/implementations/rands/drbg_ctr.c
providers/implementations/rands/drbg_hash.c
providers/implementations/rands/drbg_hmac.c
providers/implementations/signature/dsa_sig.c
providers/implementations/signature/ecdsa_sig.c
providers/implementations/signature/eddsa_sig.c
providers/implementations/signature/lms_signature.c
providers/implementations/signature/ml_dsa_sig.c
providers/implementations/signature/rsa_sig.c