Maintenance Ruby 3.4 gets fixes, but no new features. Switch to Ruby 4.0 →
class method
OpenSSL.fips_mode=
[U] (::boolish) -> U
OpenSSL.fips_mode = boolean → boolean
ext/openssl/ossl.c
View on GitHub ↗
static VALUE
ossl_fips_mode_set(VALUE self, VALUE enabled)
{
#if OSSL_OPENSSL_PREREQ(3, 0, 0)
if (RTEST(enabled)) {
if (!EVP_default_properties_enable_fips(NULL, 1)) {
ossl_raise(eOSSLError, "Turning on FIPS mode failed");
}
} else {
if (!EVP_default_properties_enable_fips(NULL, 0)) {
ossl_raise(eOSSLError, "Turning off FIPS mode failed");
}
}
return enabled;
#elif defined(OPENSSL_FIPS)
if (RTEST(enabled)) {
int mode = FIPS_mode();
if(!mode && !FIPS_mode_set(1)) /* turning on twice leads to an error */
ossl_raise(eOSSLError, "Turning on FIPS mode failed");
} else {
if(!FIPS_mode_set(0)) /* turning off twice is OK */
ossl_raise(eOSSLError, "Turning off FIPS mode failed");
}
return enabled;
#else
if (RTEST(enabled))
ossl_raise(eOSSLError, "This version of OpenSSL does not support FIPS mode");
return enabled;
#endif
}
Turns FIPS mode on or off. Turning on FIPS mode will obviously only have an effect for FIPS-capable installations of the OpenSSL library. Trying to do so otherwise will result in an error.
Examples
Example
OpenSSL.fips_mode = true # turn FIPS mode on OpenSSL.fips_mode = false # and off again
See also
.fips_mode
.fixed_length_secure_compare
.errors
.secure_compare
also in
4.1 · 4.0 · 3.3 · 3.2 · 3.1 · 3.0