Fix tests under FIPS+snapsafe

Author: torben-hansen

crypto/crypto_test.cc

@@ -26,6 +26,7 @@
 
 #include <gtest/gtest.h>
 #include "test/test_util.h"
+#include "ube/snapsafe_detect.h"
 
 static int AWS_LC_ERROR_return(void) {
   GUARD_PTR(NULL);
@@ -74,7 +75,7 @@ TEST(CryptoTest, Strndup) {
 }
 
 TEST(CryptoTest, aws_lc_assert_entropy_cpu_jitter) {
-  if (FIPS_mode() == 1) {
+  if (FIPS_mode() == 1 && CRYPTO_get_snapsafe_supported() != 1) {
     ASSERT_EQ(1, FIPS_is_entropy_cpu_jitter());
   }
 }

crypto/fipsmodule/rand/entropy/entropy_source_test.cc

@@ -79,19 +79,22 @@ TEST(EntropySources, Configuration) {
 #if defined(AWSLC_SNAPSAFE_TESTING) && defined(OPENSSL_LINUX)
   EXPECT_EQ(OPT_OUT_CPU_JITTER_ENTROPY_SOURCE, get_entropy_source_method_id_FOR_TESTING());
 
-// If entropy build configuration choose to opt-out of CPU Jitter Entropy
+// If entropy build configuration choose to explicitly opt-out of CPU Jitter
+// Entropy
 #elif defined(DO_NOT_USE_CPU_JITTER_ENTROPY)
   EXPECT_EQ(OPT_OUT_CPU_JITTER_ENTROPY_SOURCE, get_entropy_source_method_id_FOR_TESTING());
+
 #else
   int expected_entropy_source_id = TREE_DRBG_JITTER_ENTROPY_SOURCE;
   if (CRYPTO_get_snapsafe_supported()) {
     expected_entropy_source_id = OPT_OUT_CPU_JITTER_ENTROPY_SOURCE;
   }
 
   EXPECT_EQ(expected_entropy_source_id, get_entropy_source_method_id_FOR_TESTING());
-#endif
 
-  if (FIPS_mode() == 1) {
+  // For FIPS build we can strongly assert.
+  if (FIPS_mode() == 1 && CRYPTO_get_snapsafe_supported() != 1) {
     EXPECT_NE(OPT_OUT_CPU_JITTER_ENTROPY_SOURCE, get_entropy_source_method_id_FOR_TESTING());
   }
+#endif
 }