From 62dbca93fcbdd192828a3a366cb6cb7f74158510 Mon Sep 17 00:00:00 2001 From: Viacheslav Hletenko Date: Mon, 20 Apr 2026 15:19:52 +0000 Subject: T8529: Add configuration CLI to enable OpenSSL FIPS Add the new configuration CLI to enable OpenSSL FIPS-140 (Federal Information Processing Standard) cryptographic modules --- smoketest/scripts/cli/test_system_option.py | 32 +++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) (limited to 'smoketest/scripts/cli') diff --git a/smoketest/scripts/cli/test_system_option.py b/smoketest/scripts/cli/test_system_option.py index e025c01ab..f0b3bfb53 100755 --- a/smoketest/scripts/cli/test_system_option.py +++ b/smoketest/scripts/cli/test_system_option.py @@ -15,6 +15,7 @@ # along with this program. If not, see . import os +import subprocess import unittest from base_vyostest_shim import VyOSUnitTestSHIM @@ -143,5 +144,36 @@ class TestSystemOption(VyOSUnitTestSHIM.TestCase): if cpu_vendor == 'AuthenticAMD': self.assertIn(f' initcall_blacklist=acpi_cpufreq_init amd_pstate={amd_pstate_mode}', tmp) + def test_fips(self): + # Enable FIPS + self.cli_set(['system', 'option', 'fips']) + self.cli_commit() + + # Verify OpenSSL config is updated + tmp = read_file('/etc/ssl/openssl.cnf') + self.assertIn('.include /run/ssl/fipsmodule.cnf', tmp) + self.assertIn('fips = fips_sect', tmp) + + # Verify OpenSSL provider is active + out = subprocess.check_output(['openssl', 'list', '-providers'], text=True) + + self.assertIn('fips', out) + self.assertIn('OpenSSL FIPS Provider', out) + self.assertIn('status: active', out) + + # Remove FIPS + self.cli_delete(['system', 'option']) + self.cli_commit() + + # Verify config cleanup + tmp = read_file('/etc/ssl/openssl.cnf') + self.assertNotIn('.include /run/ssl/fipsmodule.cnf', tmp) + self.assertNotIn('fips = fips_sect', tmp) + + # Verify FIPS provider is no longer active + out = subprocess.check_output(['openssl', 'list', '-providers'], text=True) + self.assertNotIn('OpenSSL FIPS Provider', out) + + if __name__ == '__main__': unittest.main(verbosity=2, failfast=VyOSUnitTestSHIM.TestCase.debug_on()) -- cgit v1.2.3