From 331ade0e56df08d9f2eb1b71cf22f30038015e93 Mon Sep 17 00:00:00 2001
From: Ingela Anderton Andin <ingela@erlang.org>
Date: Sat, 6 Jun 2015 23:38:07 +0200
Subject: ssl: Filter suites for openssl FIPS if necessary

---
 lib/ssl/test/ssl_test_lib.erl | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

(limited to 'lib/ssl/test')

diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index a3bfdf8893..f35c0502ae 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -778,7 +778,12 @@ send_selected_port(_,_,_) ->
 
 rsa_suites(CounterPart) ->
     ECC = is_sane_ecc(CounterPart),
-    lists:filter(fun({rsa, _, _}) ->
+    FIPS = is_fips(CounterPart),
+    lists:filter(fun({rsa, des_cbc, sha}) when FIPS == true ->
+			 false;
+		    ({dhe_rsa, des_cbc, sha}) when FIPS == true ->
+			 false;
+		    ({rsa, _, _}) ->
 			 true;
 		    ({dhe_rsa, _, _}) ->
 			 true;
@@ -1090,6 +1095,25 @@ is_sane_ecc(crypto) ->
 is_sane_ecc(_) ->
     true.
 
+is_fips(openssl) ->
+    VersionStr = os:cmd("openssl version"),
+    case re:split(VersionStr, "fips") of
+	[_] ->
+	    false;
+	_ ->
+	    true
+    end;
+is_fips(crypto) ->
+    [{_,_, Bin}]  = crypto:info_lib(),
+    case re:split(Bin, <<"fips">>) of
+	[_] ->
+	    false;
+	_ ->
+	    true
+    end;
+is_fips(_) ->
+    false.
+
 cipher_restriction(Config0) ->
     case is_sane_ecc(openssl) of
 	false ->
-- 
cgit v1.2.3