Description of problem:

The FIPS_selftest() routine fails if the system is in FIPS mode.


Version-Release number of selected component (if applicable):

openssl-1.1.1g-12.el8_3.x86_64

How reproducible:

Always.

Steps to Reproduce:

#include <stdio.h>
#include <openssl/ssl.h>
#include <openssl/fips.h>
#include <openssl/err.h>
int main(int argc, char *argv[])
{
   fprintf(stderr,"Startup\n");
   fprintf(stderr,"all algos added\n");
   if(FIPS_mode())
      fprintf(stderr,"FIPS mode already set.\n");
   else {
      fprintf(stderr,"Not to set FIPS mode...\n");
   }
   fprintf(stderr,"Attempt FIPS self tests...\n");
   if (FIPS_selftest()) {
      fprintf(stderr,"FIPS self tests succeeded.\n");
   }
   else {
      fprintf(stderr,"ERROR: FIPS self tests failed.\n");
      ERR_print_errors_fp(stderr);
   }
   return 0;
}


Actual results:

Startup
all algos added
FIPS mode already set.
Attempt FIPS self tests...
ERROR: FIPS self tests failed.
139731764220864:error:0607B0C8:digital envelope routines:EVP_CipherInit_ex:disabled for FIPS:crypto/evp/evp_enc.c:226:
139731764220864:error:2D06F065:FIPS routines:func(111):reason(101):crypto/fips/fips_des_selftest.c:129:


Expected results:

self tests should succeed.

Additional info:

The failure seems to stem from the presence of the the 2-Key 3DES test in FIPS_selftest_des().

From the flags in crypto/evp/e_des3.c that particular cipher is not marked as FIPS.