From a92db2ebfca5b6aff6ee5e6f643665bf73afc19f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Wed, 28 Nov 2012 17:50:01 +0100
Subject: [PATCH 1/8] Store encrypted private key as PKCS#8

Legacy format uses MD5 that is not awailable in FIPS mode.
---
 t/data/key.pem.e | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/t/data/key.pem.e b/t/data/key.pem.e
index 5656b60..04d8745 100644
--- a/t/data/key.pem.e
+++ b/t/data/key.pem.e
@@ -1,18 +1,17 @@
------BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: DES-CBC,FF5FA63A87ABD584
-
-fl5y1luQTaEXw4Jx1DVk7tUKOwdqcknon/RRdcr14KE86HxxdOjpcqWs1nVBMXMR
-v/gjpfkXIPA+XT5nFXt//YZfwMmAhFWFaojlQv0AOjpXQvhRJJ5EkWYUYq6Y/0uX
-NG0xLpOla4uqGWVZrVmXXqfnfgobBE1/Ffp297M8Z1mgsBNeLlt4P32Cgg8+zyNX
-Ewmcdi5teBc4xsSjNbP2xafzjjP1GlhxCpjsDC2ahxvcoOnOUSkR/lm8Kmzju/tP
-7NzyzgxZGbgDs199GdYAu9kgkMDg74sWxNsJYvl6YKZWuvd4gl31zlG+J0BrY70/
-dloPgF0b9diufTqHrjlVLBvsVtvtc9KRKkRjbtoEszordTWHT0G9LOJbnvxz4iKs
-oPwYyhXltjSb79JuQ3Imk41RRJb7FborNmfsgGbsBSawiSMpHZstmfpfFvHwXM3m
-3QPdpV98LuOtOlQQiAyXkPv4AOtULqBF9AuxugMxM6OEi/xVnIcgQVknJ9DURB7Y
-nk5rqG0UVLurQCWkRogVywVVc2fBYzQrDk3Ra2q4OndSVLBd8RSCsHBpWTNplr6n
-T8NjiF74wpX00I33wqV90FqyVMLNjLb3guRWpXx8ibxXn7wSRwYpxl9hZHBTqezQ
-77PAZ00GJt03zWc0ia7vs6VRUUUPs1LuNjgavmYVeNMHOPd5/B27IsxuvX9yODQ/
-1S5Lmjw8FGLxNX1EUH+rwFpCAkv0c0jVvAOgWeautXkBsVJriZI96CPuayQx1RdA
-om7ykGfpLjGzeNtdEqB4mFYB9tWOiRRNssox7/Wxf5fvq2GImpCFqQ==
------END RSA PRIVATE KEY-----
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIFe4I0QEObHsCAggA
+MBQGCCqGSIb3DQMHBAgHBvJrPU9U8wSCAoCkU4ujuUqqzCPpTCWMjdvohENVjF5p
+bEt31lo+IP/eVCdJLd3sbQhmv0JjTAE2CGnYlapF28WS2ZCCZfSEkNyY4yI/1Cqa
+VdHEJ+7QzVkDQJkYmgvXOFJbEXW7uY5TFsI4MFm1bXwAiU7ZXq1kQt3amMGKdUEG
+uGNf1D3OH2RTRfdPZSZYI0WQjLbj4q2v1winMU4Kf0Y0LNNYEsiReFzyKAxwCZ0q
+01aoNxga7cSWTnwzwXvzgev2rjx2t/0cxK/IrUyVAk97po7jYZ09ug8MRS7mXi0x
+t9zsTK9GRKSazlUdJlHOn0QmC5deDBUmOdYWFSSsKGTTOZeBr29UtcdNzMPNVpOs
+pHVUVZRBfLWUDeXSksTVhOAcf06NzkhTJ9mcKUqao++pTQgeKJke4/9QL+mqMDNL
+4KKn0VQbAbaWupTYVLLG8V4WdSQOoCZQbD86Ss8mFX2oRoB9PBe4hbTrHkCdMuHm
+XjfPAU8Z5ys+IQAcRbVAbOGPoFjGMEwFxl8bn1JTSWhbBDATdbyvstpmlTIsGuBH
+7tRU68UFK8pIPCX9MNQkpdAq6Yzl3H05mKyoJqYrYnX9xlqOVhgkHv35RWkxfnyz
+efnOMzAHn22h2hqCuxqLydyMSKlE0x9jDAgEChTKzwZCg0D461G3aj3b9MG7QvKz
++sOI5+28g+wpVuv+6DNFgizOlndyY6Y8+lU4k87UeL1Mc/lcZMB60hj4ZkEYoGyK
+s0UHtqaq82XlZf3OL3aouQojGBw9DGo/1KWISuM1I3ZCxlqh1uEG3rMnaSTjI6Ao
+yClYz274wOXPOhvfcoczs9++IXzltKzuFZeLJ0K+gsKTlk+eGhN0lzav
+-----END ENCRYPTED PRIVATE KEY-----
-- 
1.8.0


From e602628aa470e375de6d94f24878cf875f915a4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Wed, 28 Nov 2012 17:57:27 +0100
Subject: [PATCH 2/8] Compare SHA-1 fingerprint in t/local/07_sslecho.t

MD5 is not available in FIPS mode.
---
 t/local/07_sslecho.t | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/t/local/07_sslecho.t b/t/local/07_sslecho.t
index fb70315..7eb9934 100644
--- a/t/local/07_sslecho.t
+++ b/t/local/07_sslecho.t
@@ -261,12 +261,12 @@ my @results;
 
         my $cn = Net::SSLeay::X509_NAME_get_text_by_NID($subject_name, &Net::SSLeay::NID_commonName);
 
-	my $fingerprint =  Net::SSLeay::X509_get_fingerprint($cert, 'md5');
+	my $fingerprint =  Net::SSLeay::X509_get_fingerprint($cert, 'SHA-1');
 
         push @results, [ $issuer  eq $cert_name, 'cert issuer'  ];
         push @results, [ $subject eq $cert_name, 'cert subject' ];
         push @results, [ substr($cn, length($cn) - 1, 1) ne "\0", 'tailing 0 character is not returned from get_text_by_NID' ];
-        push @results, [ $fingerprint  eq 'AB:56:FB:BD:4E:02:B2:68:AD:F2:C9:6A:2A:7D:DC:BD', 'md5 fingerprint'  ];
+        push @results, [ $fingerprint  eq '96:9F:25:FD:42:A7:FC:4D:8B:FF:14:76:7F:2E:07:AF:F6:A4:10:96', 'SHA-1 fingerprint'  ];
 
         return 1;
     }
-- 
1.8.0


From 6166c27753708f76c18c445ead8e7a4ff9488650 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Wed, 28 Nov 2012 18:06:52 +0100
Subject: [PATCH 3/8] Use 2048-bit RSA keys in t/local/31_rsa_generate_key.t

RSA keys shorter than 1024 bits are forbidden in FIPS mode.
---
 t/local/31_rsa_generate_key.t | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/t/local/31_rsa_generate_key.t b/t/local/31_rsa_generate_key.t
index 26591a6..c0f3619 100644
--- a/t/local/31_rsa_generate_key.t
+++ b/t/local/31_rsa_generate_key.t
@@ -16,18 +16,18 @@ Net::SSLeay::ERR_load_crypto_strings();
 Net::SSLeay::SSLeay_add_ssl_algorithms();
 
 lives_ok(sub {
-        Net::SSLeay::RSA_generate_key(512, 0x10001);
+        Net::SSLeay::RSA_generate_key(2048, 0x10001);
 }, 'RSA_generate_key with valid callback');
 
 dies_ok(sub {
-        Net::SSLeay::RSA_generate_key(512, 0x10001, 1);
+        Net::SSLeay::RSA_generate_key(2048, 0x10001, 1);
 }, 'RSA_generate_key with invalid callback');
 
 {
     my $called = 0;
 
     lives_ok(sub {
-            Net::SSLeay::RSA_generate_key(512, 0x10001, \&cb);
+            Net::SSLeay::RSA_generate_key(2048, 0x10001, \&cb);
     }, 'RSA_generate_key with valid callback');
 
     cmp_ok( $called, '>', 0, 'callback has been called' );
@@ -52,7 +52,7 @@ dies_ok(sub {
     my $userdata = 'foo';
 
     lives_ok(sub {
-            Net::SSLeay::RSA_generate_key(512, 0x10001, \&cb_data, $userdata);
+            Net::SSLeay::RSA_generate_key(2048, 0x10001, \&cb_data, $userdata);
     }, 'RSA_generate_key with valid callback and userdata');
 
     cmp_ok( $called, '>', 0, 'callback has been called' );
-- 
1.8.0


From 99b12c69676ad81a55dfe9fa2750267806f9bcce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Thu, 29 Nov 2012 13:15:58 +0100
Subject: [PATCH 4/8] Use 2048-bit keys in t/local/35_ephemeral.t

FIPS requires at least 1024b RSA keys.
---
 t/local/35_ephemeral.t | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/t/local/35_ephemeral.t b/t/local/35_ephemeral.t
index 5ab3724..5ebc309 100644
--- a/t/local/35_ephemeral.t
+++ b/t/local/35_ephemeral.t
@@ -11,5 +11,5 @@ Net::SSLeay::ERR_load_crypto_strings();
 Net::SSLeay::SSLeay_add_ssl_algorithms();
 
 ok( my $ctx = Net::SSLeay::CTX_new(), 'CTX_new' );
-ok( my $rsa = Net::SSLeay::RSA_generate_key(512, Net::SSLeay::RSA_F4()), 'RSA_generate_key' );
+ok( my $rsa = Net::SSLeay::RSA_generate_key(2048, Net::SSLeay::RSA_F4()), 'RSA_generate_key' );
 ok( Net::SSLeay::CTX_set_tmp_rsa($ctx, $rsa), 'CTX_set_tmp_rsa' );
-- 
1.8.0


From 08b1e288e7947b0c9aad0d31773c19fc619c7cf7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Thu, 29 Nov 2012 13:23:49 +0100
Subject: [PATCH 5/8] Store private for t/local/38_priv-key.t as PKCS#8

Legacy format uses MD5 which is unavailable in FIPS.
---
 t/data/test_CA1.encrypted_key.pem | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/t/data/test_CA1.encrypted_key.pem b/t/data/test_CA1.encrypted_key.pem
index 5a73b3c..28b188d 100644
--- a/t/data/test_CA1.encrypted_key.pem
+++ b/t/data/test_CA1.encrypted_key.pem
@@ -1,18 +1,17 @@
------BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: DES-EDE3-CBC,3BACE3D69BE83336
-
-ar+ndQli7XxsaLYYV6wj6budOowuGLLyBhCgN640ufP2MHDwd5rGkK+UcR/PkP3L
-5WBs3tNdhO9x9U6aQBmIMr5IU5uifiBtydK7cAqtPoVZdT+FNdaH5n0onTsvMkoQ
-eDCGrWUI7dPBceBfWq/L+cap+R7KDAwzeHZjg7fXOcLrSU16Ne+lDYCNX/OFIPWQ
-vv5b018XTiJWYkq4rRuw8sHiPovzuY7tadvegbzJx2TC5Jb0gaXbcu9NQX2gRr53
-nxtkzIHekpU3SIsPH2Sv67MkqHY0L1LGZGLI35oLqaJnCuzWyH2MaELDR43Oh7GY
-F7kWDbHpIwoqEJescck1P2jW7KgC/WeJo7/EzYSRKZ2n3RjvdsrewVfGiOLTOYk7
-lowC6XFtwwAx+QO/+FGipekztw/Zpdu5qrM97LxwciTOTcovxEDpwZMQ5L0FW7DB
-5GyNSdjP4JD+fd7j8FQb9joZzecE65HfLqLj/10tN4VMOlC6i0oNPc+3LquP4w8p
-o5NhzjPEKi0ilWlkJDdwUqt81Q+IoR0b3Fx1FalB8qAW3GiZIVjukov5X6eufBGu
-HaqIBun82IiOuPuv5EFRKB4sC9RCfvv+UgmnkLEyJb8Ev6Hb0Y+ZPJi8E17Un8cQ
-ZE31vbitFYsa4UHKEpsM7zzZrnDkkKhEWAXNONT8sN50Rk4zGw2E+Mg0+scs9wmX
-LvP4ojSa7KTwz0Hyvf1QXRG25XpNTh1MIWMpCQV/dqe1f6R9mxbyxHB1oHy8wl1S
-rUZEfdwWdB0ZxWT3LXSsS07wtxF+Nftt/olpAKcftoF73VuMEnHW3Q==
------END RSA PRIVATE KEY-----
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQITsuxC3a/3nMCAggA
+MBQGCCqGSIb3DQMHBAhA/86UKBTLSgSCAoCF4ohLfVgalUA/BBo6vxHdVug5jJb7
+VcS8ruRoi4auq+Szdi9pX/4K0r6fvOmxPe5Gr2+c8Qr7NgNM8Ji1g6QAlomWBsV0
+S0cK0RRPAz54J7/OV+7f5mucU2IcpsG79bcWIZAuBXZkfSqb4EUxmtFiMlp2ffwu
+v7IsSIKUqB4zy35pFg5i33lLfEAuen0fCMdfBXMv/Y9N+0BwbD3hYEkAzEOjPvND
+Kc8coLZoTMPe8UqcTU5brA85CSRMJw2Q+7vE7y3QiSVzyd+wv/vJwg6thbSZ/J6K
+5sFH+wrPDqOZ/u0kRq20dvkP31EncBt2/ZYbYfd7yrZkO6o0haJZcOFOaWmDzyJU
+ql0XROVp9JLCliFTX5Vi9/dTcgxf50XZiz7CSSpryTpp+dVvGdn0YpT4R2YM6U3K
+zm88/GDxUYICbtAgNWwbzgDFGboHs8fRh78h9TmBDVEWGA2ArdNwHao5jDHCxbfz
+lhidH8D6LmXBmkBKYZ17GHkE7lwi3xxnu4TwLcMdtlSo0FKm8cisQI2ZYnU13qbY
+0tTl2gdeBgN3bpgmFi8sfk2RJhhMpBcBj3QpZKmmed1A+w4DG0yuQM+Y45fGyVu7
+nkZDr/ZcdqxxXILy5nzD9Q4YnLhPfj9qhJELL4o+zi52Q89zkpYMyIHz0VOk0geL
+lU/N+ASfnlNIZMevIh9lo2EachOJZ4K6EQMf2cauueWNLhIvX5ZMCH2QarDK1Qk6
+nymASwq3tkEHhxIf4lbekDTOdELQcGq1hiVReaxKmJRwJ52LBEA+7fA+iegeTL54
+8dt2qaEC+2y4Y8o3kbJGVFFZ/0FBZEfUEQ8UxkHHnEemYeJSH3R2jBC1
+-----END ENCRYPTED PRIVATE KEY-----
-- 
1.8.0


From ad5632c2507da0bae3b7227fbfbaeb8708194cd7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Thu, 29 Nov 2012 14:42:17 +0100
Subject: [PATCH 6/8] Encrypt PKCS#12 with 3DES for t/local/39_pkcs12.t

FIPS does not allow RC2.
---
 t/data/pkcs12-full.p12      | Bin 2773 -> 2773 bytes
 t/data/pkcs12-no-chain.p12  | Bin 1589 -> 1589 bytes
 t/data/pkcs12-no-passwd.p12 | Bin 1589 -> 1589 bytes
 3 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/t/data/pkcs12-full.p12 b/t/data/pkcs12-full.p12
index 2296dbf055d67034caab4d5a625c849587203c80..4b08fe15f4913111d295da287504bd9511c58df4 100644
GIT binary patch
diff --git a/t/data/pkcs12-no-chain.p12 b/t/data/pkcs12-no-chain.p12
index cf1a4614ce85e7c6e33e8895ec9bd894c6ad28cd..9979364f9e6bbac792e9c7094b5b0dc77faa5384 100644
GIT binary patch
diff --git a/t/data/pkcs12-no-passwd.p12 b/t/data/pkcs12-no-passwd.p12
index c4d19ee11458371670c606c53594fe6f1a9acbed..b6122d0449cd1336483b7114088b5dd79f277c2d 100644
GIT binary patch
-- 
1.8.0


From e974099e9bf97eb27840c310c9ab6c66107319e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Fri, 30 Nov 2012 10:58:04 +0100
Subject: [PATCH 7/8] Skip disabled digests in t/local/50_digest.t

P_EVP_MD_list_all() does not remove digests disabled in FIPS.
MD2() and similar functions abort or crash depending on OpenSSL version if
the digest is disabled due to FIPS.
---
 t/local/50_digest.t | 47 ++++++++++++++++++++++++++++++++++-------------
 1 file changed, 34 insertions(+), 13 deletions(-)

diff --git a/t/local/50_digest.t b/t/local/50_digest.t
index ebd111b..c181837 100644
--- a/t/local/50_digest.t
+++ b/t/local/50_digest.t
@@ -65,19 +65,24 @@ sub digest_file {
   is(length($data), -s $file, 'got the whole file');
 
   SKIP: {
-    skip "Net::SSLeay::MD2 not available", 1 unless exists &Net::SSLeay::MD2;
+    skip "Net::SSLeay::MD2 not available", 1
+      unless exists &Net::SSLeay::MD2 and exists $available_digests->{md2};
     is( unpack("H*", Net::SSLeay::MD2($data)), $expected_results->{md2}, "MD2 all-in-one-go [$file]");
   }
   SKIP: {
-    skip "Net::SSLeay::MD4 not available", 1 unless exists &Net::SSLeay::MD4;
+    skip "Net::SSLeay::MD4 not available", 1
+      unless exists &Net::SSLeay::MD4 and exists $available_digests->{md4};
     is( unpack("H*", Net::SSLeay::MD4($data)), $expected_results->{md4}, "MD4 all-in-one-go [$file]");
   }
   SKIP: {
-    skip "Net::SSLeay::MD5 not available", 1 unless exists &Net::SSLeay::MD5;
+    skip "Net::SSLeay::MD5 not available", 1
+      unless exists &Net::SSLeay::MD5 and exists $available_digests->{md5};
     is( unpack("H*", Net::SSLeay::MD5($data)), $expected_results->{md5}, "MD5 all-in-one-go [$file]");
   }
   SKIP: {
-    skip "Net::SSLeay::RIPEMD160 not available", 1 unless exists &Net::SSLeay::RIPEMD160;
+    skip "Net::SSLeay::RIPEMD160 not available", 1
+      unless exists &Net::SSLeay::RIPEMD160 and
+        exists $available_digests->{ripemd160};
     is( unpack("H*", Net::SSLeay::RIPEMD160($data)), $expected_results->{ripemd160}, "RIPEMD160 all-in-one-go [$file]");
   }  
 }
@@ -106,32 +111,42 @@ sub digest_strings {
       
   
     SKIP: {
-      skip "Net::SSLeay::MD2 not available", 1 unless exists &Net::SSLeay::MD2;
+      skip "Net::SSLeay::MD2 not available", 1
+        unless exists &Net::SSLeay::MD2 and exists $available_digests->{md2};
       is(unpack('H*', Net::SSLeay::MD2($data)), $fps->{$data}->{md2}, "MD2 hash for '$data'");
     }
     SKIP: {
-      skip "Net::SSLeay::MD4 not available", 1 unless exists &Net::SSLeay::MD4;
+      skip "Net::SSLeay::MD4 not available", 1
+        unless exists &Net::SSLeay::MD4 and exists $available_digests->{md4};
       is(unpack('H*', Net::SSLeay::MD4($data)), $fps->{$data}->{md4}, "MD4 hash for '$data'");
     }
     SKIP: {
-      skip "Net::SSLeay::MD5 not available", 1 unless exists &Net::SSLeay::MD5;
+      skip "Net::SSLeay::MD5 not available", 1
+        unless exists &Net::SSLeay::MD5 and exists $available_digests->{md5};
       is(unpack('H*', Net::SSLeay::MD5($data)), $fps->{$data}->{md5}, "MD5 hash for '$data'");
     }
     SKIP: {
-      skip "Net::SSLeay::RIPEMD160 not available", 1 unless exists &Net::SSLeay::RIPEMD160;
+      skip "Net::SSLeay::RIPEMD160 not available", 1
+        unless exists &Net::SSLeay::RIPEMD160 and
+          exists $available_digests->{ripemd160};
       is(unpack('H*', Net::SSLeay::RIPEMD160($data)), $fps->{$data}->{ripemd160}, "RIPEMD160 hash for '$data'");
     }
 
     SKIP: {
-      skip "Net::SSLeay::SHA1 not available", 1 unless exists &Net::SSLeay::SHA1;
+      skip "Net::SSLeay::SHA1 not available", 1
+        unless exists &Net::SSLeay::SHA1 and exists $available_digests->{sha1};
       is(unpack('H*', Net::SSLeay::SHA1($data)), $fps->{$data}->{sha1}, "SHA1 hash for '$data'");
     }
     SKIP: {
-      skip "Net::SSLeay::SHA256 not available", 1 unless exists &Net::SSLeay::SHA256;
+      skip "Net::SSLeay::SHA256 not available", 1
+        unless exists &Net::SSLeay::SHA256 and
+          exists $available_digests->{sha256};
       is(unpack('H*', Net::SSLeay::SHA256($data)), $fps->{$data}->{sha256}, "SHA256 hash for '$data'");
     }
     SKIP: {
-      skip "Net::SSLeay::SHA512 not available", 1 unless exists &Net::SSLeay::SHA512;
+      skip "Net::SSLeay::SHA512 not available", 1
+        unless exists &Net::SSLeay::SHA512 and
+          exists $available_digests->{sha512};
       is(unpack('H*', Net::SSLeay::SHA512($data)), $fps->{$data}->{sha512}, "SHA512 hash for '$data'");
     }
   }
@@ -143,7 +158,13 @@ eval {
   Net::SSLeay::initialize();
   Net::SSLeay::OpenSSL_add_all_digests();
   if (Net::SSLeay::SSLeay >= 0x1000000f) {
-    %all_digests = map { $_=>1 } @{Net::SSLeay::P_EVP_MD_list_all()};
+	my $ctx = Net::SSLeay::EVP_MD_CTX_create();
+    %all_digests = map { $_=>1 } grep {
+      # P_EVP_MD_list_all() does not remove digests disabled in FIPS 
+      my $md;
+      $md = Net::SSLeay::EVP_get_digestbyname($_) and
+        Net::SSLeay::EVP_DigestInit($ctx, $md)
+    } @{Net::SSLeay::P_EVP_MD_list_all()};
   }
   else {
     %all_digests = ();
@@ -270,7 +291,7 @@ SKIP: {
     skip "pre-0.9.7", 1 unless Net::SSLeay::SSLeay >= 0x0090700f;
     my $md = Net::SSLeay::EVP_get_digestbyname("md5");
     my $ctx = Net::SSLeay::EVP_MD_CTX_create();
-    Net::SSLeay::EVP_DigestInit($ctx, $md);
+    skip "MD5 not available", 1 unless Net::SSLeay::EVP_DigestInit($ctx, $md);
     my $md2 = Net::SSLeay::EVP_MD_CTX_md($ctx);
     is(Net::SSLeay::EVP_MD_size($md2), 16, 'EVP_MD_size via EVP_MD_CTX_md md5');
   }
-- 
1.8.0


From d1f1988d50ffb9635f9c01f15a0866453fe5a64b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Fri, 30 Nov 2012 13:10:18 +0100
Subject: [PATCH 8/8] Expect undef in t/local/32_x509_get_cert_info.t when
 algorithm is not available

MD5 is not available in FIPS mode.
---
 t/local/32_x509_get_cert_info.t | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/t/local/32_x509_get_cert_info.t b/t/local/32_x509_get_cert_info.t
index e1fc186..b04bb0f 100755
--- a/t/local/32_x509_get_cert_info.t
+++ b/t/local/32_x509_get_cert_info.t
@@ -22,6 +22,17 @@ my $dump = {
   "testcert_strange.crt.pem"  => do(File::Spec->catfile('t', 'data', 'testcert_strange.crt.pem_dump')),
 };
 
+my %available_digests = map {$_=>1} qw( md5 sha1 );
+if (Net::SSLeay::SSLeay >= 0x1000000f) {
+  my $ctx = Net::SSLeay::EVP_MD_CTX_create();
+  %available_digests = map { $_=>1 } grep {
+    # P_EVP_MD_list_all() does not remove digests disabled in FIPS 
+    my $md;
+    $md = Net::SSLeay::EVP_get_digestbyname($_) and
+      Net::SSLeay::EVP_DigestInit($ctx, $md)
+  } @{Net::SSLeay::P_EVP_MD_list_all()};
+}
+
 for my $f (keys (%$dump)) {
   my $filename = File::Spec->catfile('t', 'data', $f);
   ok(my $bio = Net::SSLeay::BIO_new_file($filename, 'rb'), "BIO_new_file\t$f");
@@ -80,15 +91,21 @@ for my $f (keys (%$dump)) {
     }
   }
   
-  #BEWARE: values are not the same across different openssl versions, therefore testing just >0
+  #BEWARE: values are not the same across different openssl versions or FIPS mode, therefore testing just >0
   #is(Net::SSLeay::X509_subject_name_hash($x509), $dump->{$f}->{hash}->{subject}->{dec}, 'X509_subject_name_hash dec');
   #is(Net::SSLeay::X509_issuer_name_hash($x509), $dump->{$f}->{hash}->{issuer}->{dec}, 'X509_issuer_name_hash dec');
+  #is(Net::SSLeay::X509_issuer_and_serial_hash($x509), $dump->{$f}->{hash}->{issuer_and_serial}->{dec}, "X509_issuer_and_serial_hash dec\t$f");
   cmp_ok(Net::SSLeay::X509_subject_name_hash($x509), '>', 0, "X509_subject_name_hash dec\t$f");
   cmp_ok(Net::SSLeay::X509_issuer_name_hash($x509), '>', 0, "X509_issuer_name_hash dec\t$f");
-  
-  is(Net::SSLeay::X509_issuer_and_serial_hash($x509), $dump->{$f}->{hash}->{issuer_and_serial}->{dec}, "X509_issuer_and_serial_hash dec\t$f");
-  is(Net::SSLeay::X509_get_fingerprint($x509, "md5"), $dump->{$f}->{fingerprint}->{md5}, "X509_get_fingerprint md5\t$f");
-  is(Net::SSLeay::X509_get_fingerprint($x509, "sha1"), $dump->{$f}->{fingerprint}->{sha1}, "X509_get_fingerprint sha1\t$f");
+  cmp_ok(Net::SSLeay::X509_issuer_and_serial_hash($x509), '>', 0, "X509_issuer_and_serial_hash dec\t$f");
+
+  for my $digest (qw( md5 sha1 )) { 
+    is(Net::SSLeay::X509_get_fingerprint($x509, $digest),
+      (exists $available_digests{$digest} ?
+        $dump->{$f}->{fingerprint}->{$digest} :
+        undef),
+      "X509_get_fingerprint $digest\t$f");
+  }
   
   my $sha1_digest = Net::SSLeay::EVP_get_digestbyname("sha1");
   SKIP: {
-- 
1.8.0

