TEST: Check property query support of apps/pkey

Property query support works correctly for apps/pkey, but there does not
seem to be a test for it yet, so add one.

See also 30b2c3592e8511b60d44f93eb657a1ecb3662c08, which previously
fixed a similar problem in dsaparam and gendsa. See also the initial
report in https://bugzilla.redhat.com/show_bug.cgi?id=2094956.

Signed-off-by: Clemens Lang <cllang@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/18717)

diff --git a/test/recipes/15-test_ec.t b/test/recipes/15-test_ec.t
index acd1b3960d8d013e72b957789169f202d0d7acac..354c360362677921c37b73e0ef060432883bb554 100644 (file)
--- a/test/recipes/15-test_ec.t
+++ b/test/recipes/15-test_ec.t
@@ -18,7 +18,9 @@ setup("test_ec");
 
 plan skip_all => 'EC is not supported in this build' if disabled('ec');
 
-plan tests => 14;
+plan tests => 15;
+
+my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
 
 require_ok(srctop_file('test','recipes','tconversion.pl'));
 
@@ -85,3 +87,25 @@ subtest 'Ed448 conversions -- public key' => sub {
                  -in => srctop_file("test", "tested448pub.pem"),
                  -args => ["pkey", "-pubin", "-pubout"] );
 };
+
+subtest 'Check loading of fips and non-fips keys' => sub {
+    plan skip_all => "FIPS is disabled"
+        if $no_fips;
+
+    plan tests => 2;
+
+    my $fipsconf = srctop_file("test", "fips-and-base.cnf");
+    $ENV{OPENSSL_CONF} = $fipsconf;
+
+    ok(!run(app(['openssl', 'pkey',
+                 '-check', '-in', srctop_file("test", "testec-p112r1.pem")])),
+        "Checking non-fips curve key fails in FIPS provider");
+
+    ok(run(app(['openssl', 'pkey',
+                '-provider', 'default',
+                '-propquery', '?fips!=yes',
+                '-check', '-in', srctop_file("test", "testec-p112r1.pem")])),
+        "Checking non-fips curve key succeeds with non-fips property query");
+
+    delete $ENV{OPENSSL_CONF};
+}

diff --git a/test/testec-p112r1.pem b/test/testec-p112r1.pem
new file mode 100644 (file)
index 0000000..c81398e
--- /dev/null
+++ b/test/testec-p112r1.pem
@@ -0,0 +1,7 @@
+-----BEGIN EC PARAMETERS-----
+BgUrgQQABg==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MD4CAQEEDqpz3/ZgfdnaauL3MgNsoAcGBSuBBAAGoSADHgAErmlghD+XSf6spLhs
+7CqP1x1K6h2kfELB84SYKg==
+-----END EC PRIVATE KEY-----