VirtualBox

source: vbox/trunk/src/libs/openssl-3.1.5/test/recipes/03-test_fipsinstall.t@ 105770

Last change on this file since 105770 was 104078, checked in by vboxsync, 8 months ago

openssl-3.1.5: Applied and adjusted our OpenSSL changes to 3.1.4. bugref:10638
File size: 16.6 KB
Line 
1#! /usr/bin/env perl
2# Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
3#
4# Licensed under the Apache License 2.0 (the "License"). You may not use
5# this file except in compliance with the License. You can obtain a copy
6# in the file LICENSE in the source distribution or at
7# https://www.openssl.org/source/license.html
8
9use strict;
10use warnings;
11
12use File::Spec::Functions qw(:DEFAULT abs2rel);
13use File::Copy;
14use OpenSSL::Glob;
15use OpenSSL::Test qw/:DEFAULT srctop_dir srctop_file bldtop_dir bldtop_file/;
16use OpenSSL::Test::Utils;
17
18BEGIN {
19 setup("test_fipsinstall");
20}
21use lib srctop_dir('Configurations');
22use lib bldtop_dir('.');
23use platform;
24
25plan skip_all => "Test only supported in a fips build" if disabled("fips");
26
27# Compatible options for pedantic FIPS compliance
28my @pedantic_okay =
29 ( 'ems_check', 'no_drbg_truncated_digests', 'self_test_onload' );
30
31# Incompatible options for pedantic FIPS compliance
32my @pedantic_fail =
33 ( 'no_conditional_errors', 'no_security_checks', 'self_test_oninstall' );
34
35plan tests => 35 + (scalar @pedantic_okay) + (scalar @pedantic_fail);
36
37my $infile = bldtop_file('providers', platform->dso('fips'));
38my $fipskey = $ENV{FIPSKEY} // config('FIPSKEY') // '00';
39my $provconf = srctop_file("test", "fips-and-base.cnf");
40
41# Read in a text $infile and replace the regular expression in $srch with the
42# value in $repl and output to a new file $outfile.
43sub replace_line_file_internal {
44
45 my ($infile, $srch, $repl, $outfile) = @_;
46 my $msg;
47
48 open(my $in, "<", $infile) or return 0;
49 read($in, $msg, 1024);
50 close $in;
51
52 $msg =~ s/$srch/$repl/;
53
54 open(my $fh, ">", $outfile) or return 0;
55 print $fh $msg;
56 close $fh;
57 return 1;
58}
59
60# Read in the text input file 'fips.cnf'
61# and replace a single Key = Value line with a new value in $value.
62# OR remove the Key = Value line if the passed in $value is empty.
63# and then output a new file $outfile.
64# $key is the Key to find
65sub replace_line_file {
66 my ($key, $value, $outfile) = @_;
67
68 my $srch = qr/$key\s*=\s*\S*\n/;
69 my $rep;
70 if ($value eq "") {
71 $rep = "";
72 } else {
73 $rep = "$key = $value\n";
74 }
75 return replace_line_file_internal('fips.cnf', $srch, $rep, $outfile);
76}
77
78# Read in the text input file 'test/fips.cnf'
79# and replace the .cnf file used in
80# .include fipsmodule.cnf with a new value in $value.
81# and then output a new file $outfile.
82# $key is the Key to find
83sub replace_parent_line_file {
84 my ($value, $outfile) = @_;
85 my $srch = qr/fipsmodule.cnf/;
86 my $rep = "$value";
87 return replace_line_file_internal(srctop_file("test", 'fips.cnf'),
88 $srch, $rep, $outfile);
89}
90
91# Check if the specified pattern occurs in the given file
92# Returns 1 if the pattern is found and 0 if not
93sub find_line_file {
94 my ($key, $file) = @_;
95
96 open(my $in, $file) or return -1;
97 while (my $line = <$in>) {
98 if ($line =~ /$key/) {
99 close($in);
100 return 1;
101 }
102 }
103 close($in);
104 return 0;
105}
106
107# fail if no module name
108ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module',
109 '-provider_name', 'fips',
110 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
111 '-section_name', 'fips_sect'])),
112 "fipsinstall fail");
113
114# fail to verify if the configuration file is missing
115ok(!run(app(['openssl', 'fipsinstall', '-in', 'dummy.tmp', '-module', $infile,
116 '-provider_name', 'fips', '-mac_name', 'HMAC',
117 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
118 '-section_name', 'fips_sect', '-verify'])),
119 "fipsinstall verify fail");
120
121
122# output a fips.cnf file containing mac data
123ok(run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
124 '-provider_name', 'fips', '-mac_name', 'HMAC',
125 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
126 '-section_name', 'fips_sect'])),
127 "fipsinstall");
128
129# verify the fips.cnf file
130ok(run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
131 '-provider_name', 'fips', '-mac_name', 'HMAC',
132 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
133 '-section_name', 'fips_sect', '-verify'])),
134 "fipsinstall verify");
135
136ok(replace_line_file('module-mac', '', 'fips_no_module_mac.cnf')
137 && !run(app(['openssl', 'fipsinstall',
138 '-in', 'fips_no_module_mac.cnf',
139 '-module', $infile,
140 '-provider_name', 'fips', '-mac_name', 'HMAC',
141 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
142 '-section_name', 'fips_sect', '-verify'])),
143 "fipsinstall verify fail no module mac");
144
145ok(replace_line_file('install-mac', '', 'fips_no_install_mac.cnf')
146 && !run(app(['openssl', 'fipsinstall',
147 '-in', 'fips_no_install_mac.cnf',
148 '-module', $infile,
149 '-provider_name', 'fips', '-mac_name', 'HMAC',
150 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
151 '-section_name', 'fips_sect', '-verify'])),
152 "fipsinstall verify fail no install indicator mac");
153
154ok(replace_line_file('module-mac', '00:00:00:00:00:00',
155 'fips_bad_module_mac.cnf')
156 && !run(app(['openssl', 'fipsinstall',
157 '-in', 'fips_bad_module_mac.cnf',
158 '-module', $infile,
159 '-provider_name', 'fips', '-mac_name', 'HMAC',
160 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
161 '-section_name', 'fips_sect', '-verify'])),
162 "fipsinstall verify fail if invalid module integrity value");
163
164ok(replace_line_file('install-mac', '00:00:00:00:00:00',
165 'fips_bad_install_mac.cnf')
166 && !run(app(['openssl', 'fipsinstall',
167 '-in', 'fips_bad_install_mac.cnf',
168 '-module', $infile,
169 '-provider_name', 'fips', '-mac_name', 'HMAC',
170 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
171 '-section_name', 'fips_sect', '-verify'])),
172 "fipsinstall verify fail if invalid install indicator integrity value");
173
174ok(replace_line_file('install-status', 'INCORRECT_STATUS_STRING',
175 'fips_bad_indicator.cnf')
176 && !run(app(['openssl', 'fipsinstall',
177 '-in', 'fips_bad_indicator.cnf',
178 '-module', $infile,
179 '-provider_name', 'fips', '-mac_name', 'HMAC',
180 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
181 '-section_name', 'fips_sect', '-verify'])),
182 "fipsinstall verify fail if invalid install indicator status");
183
184# fail to verify the fips.cnf file if a different key is used
185ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
186 '-provider_name', 'fips', '-mac_name', 'HMAC',
187 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
188 '-section_name', 'fips_sect', '-verify'])),
189 "fipsinstall verify fail bad key");
190
191# fail to verify the fips.cnf file if a different mac digest is used
192ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
193 '-provider_name', 'fips', '-mac_name', 'HMAC',
194 '-macopt', 'digest:SHA512', '-macopt', "hexkey:$fipskey",
195 '-section_name', 'fips_sect', '-verify'])),
196 "fipsinstall verify fail incorrect digest");
197
198# corrupt the module hmac
199ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
200 '-provider_name', 'fips', '-mac_name', 'HMAC',
201 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
202 '-section_name', 'fips_sect', '-corrupt_desc', 'HMAC'])),
203 "fipsinstall fails when the module integrity is corrupted");
204
205# corrupt the first digest
206ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
207 '-provider_name', 'fips', '-mac_name', 'HMAC',
208 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
209 '-section_name', 'fips_sect', '-corrupt_desc', 'SHA1'])),
210 "fipsinstall fails when the digest result is corrupted");
211
212# corrupt another digest
213ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
214 '-provider_name', 'fips', '-mac_name', 'HMAC',
215 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
216 '-section_name', 'fips_sect', '-corrupt_desc', 'SHA3'])),
217 "fipsinstall fails when the digest result is corrupted");
218
219# corrupt cipher encrypt test
220ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
221 '-provider_name', 'fips', '-mac_name', 'HMAC',
222 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
223 '-section_name', 'fips_sect', '-corrupt_desc', 'AES_GCM'])),
224 "fipsinstall fails when the AES_GCM result is corrupted");
225
226# corrupt cipher decrypt test
227ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
228 '-provider_name', 'fips', '-mac_name', 'HMAC',
229 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
230 '-section_name', 'fips_sect', '-corrupt_desc', 'AES_ECB_Decrypt'])),
231 "fipsinstall fails when the AES_ECB result is corrupted");
232
233# corrupt DRBG
234ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
235 '-provider_name', 'fips', '-mac_name', 'HMAC',
236 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
237 '-section_name', 'fips_sect', '-corrupt_desc', 'CTR'])),
238 "fipsinstall fails when the DRBG CTR result is corrupted");
239
240# corrupt a KAS test
241SKIP: {
242 skip "Skipping KAS DH corruption test because of no dh in this build", 1
243 if disabled("dh");
244
245 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
246 '-provider_name', 'fips', '-mac_name', 'HMAC',
247 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
248 '-section_name', 'fips_sect',
249 '-corrupt_desc', 'DH',
250 '-corrupt_type', 'KAT_KA'])),
251 "fipsinstall fails when the kas result is corrupted");
252}
253
254# corrupt a Signature test - 140-3 requires a known answer test
255SKIP: {
256 skip "Skipping Signature DSA corruption test because of no dsa in this build", 1
257 if disabled("dsa");
258
259 run(test(["fips_version_test", "-config", $provconf, ">=3.1.0"]),
260 capture => 1, statusvar => \my $exit);
261 skip "FIPS provider version is too old for KAT DSA signature test", 1
262 if !$exit;
263 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
264 '-provider_name', 'fips', '-mac_name', 'HMAC',
265 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
266 '-section_name', 'fips_sect', '-self_test_oninstall',
267 '-corrupt_desc', 'DSA',
268 '-corrupt_type', 'KAT_Signature'])),
269 "fipsinstall fails when the signature result is corrupted");
270}
271
272# corrupt a Signature test - 140-2 allows a pairwise consistency test
273SKIP: {
274 skip "Skipping Signature DSA corruption test because of no dsa in this build", 1
275 if disabled("dsa");
276
277 run(test(["fips_version_test", "-config", $provconf, "<3.1.0"]),
278 capture => 1, statusvar => \my $exit);
279 skip "FIPS provider version is too new for PCT DSA signature test", 1
280 if !$exit;
281 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
282 '-provider_name', 'fips', '-mac_name', 'HMAC',
283 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
284 '-section_name', 'fips_sect',
285 '-corrupt_desc', 'DSA',
286 '-corrupt_type', 'PCT_Signature'])),
287 "fipsinstall fails when the signature result is corrupted");
288}
289
290# corrupt an Asymmetric cipher test
291SKIP: {
292 skip "Skipping Asymmetric RSA corruption test because of no rsa in this build", 1
293 if disabled("rsa");
294 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
295 '-corrupt_desc', 'RSA_Encrypt',
296 '-corrupt_type', 'KAT_AsymmetricCipher'])),
297 "fipsinstall fails when the asymmetric cipher result is corrupted");
298}
299
300# 'local' ensures that this change is only done in this file.
301local $ENV{OPENSSL_CONF_INCLUDE} = abs2rel(curdir());
302
303ok(replace_parent_line_file('fips.cnf', 'fips_parent.cnf')
304 && run(app(['openssl', 'fipsinstall', '-config', 'fips_parent.cnf'])),
305 "verify fips provider loads from a configuration file");
306
307ok(replace_parent_line_file('fips_no_module_mac.cnf',
308 'fips_parent_no_module_mac.cnf')
309 && !run(app(['openssl', 'fipsinstall',
310 '-config', 'fips_parent_no_module_mac.cnf'])),
311 "verify load config fail no module mac");
312
313SKIP: {
314 run(test(["fips_version_test", "-config", $provconf, "<3.1.0"]),
315 capture => 1, statusvar => \my $exit);
316 skip "FIPS provider version doesn't support self test indicator", 3
317 if !$exit;
318
319 ok(replace_parent_line_file('fips_no_install_mac.cnf',
320 'fips_parent_no_install_mac.cnf')
321 && !run(app(['openssl', 'fipsinstall',
322 '-config', 'fips_parent_no_install_mac.cnf'])),
323 "verify load config fail no install mac");
324
325 ok(replace_parent_line_file('fips_bad_indicator.cnf',
326 'fips_parent_bad_indicator.cnf')
327 && !run(app(['openssl', 'fipsinstall',
328 '-config', 'fips_parent_bad_indicator.cnf'])),
329 "verify load config fail bad indicator");
330
331
332 ok(replace_parent_line_file('fips_bad_install_mac.cnf',
333 'fips_parent_bad_install_mac.cnf')
334 && !run(app(['openssl', 'fipsinstall',
335 '-config', 'fips_parent_bad_install_mac.cnf'])),
336 "verify load config fail bad install mac");
337}
338
339ok(replace_parent_line_file('fips_bad_module_mac.cnf',
340 'fips_parent_bad_module_mac.cnf')
341 && !run(app(['openssl', 'fipsinstall',
342 '-config', 'fips_parent_bad_module_mac.cnf'])),
343 "verify load config fail bad module mac");
344
345SKIP: {
346 run(test(["fips_version_test", "-config", $provconf, "<3.1.0"]),
347 capture => 1, statusvar => \my $exit);
348 skip "FIPS provider version doesn't support self test indicator", 3
349 if !$exit;
350
351 my $stconf = "fipsmodule_selftest.cnf";
352
353 ok(run(app(['openssl', 'fipsinstall', '-out', $stconf,
354 '-module', $infile, '-self_test_onload'])),
355 "fipsinstall config saved without self test indicator");
356
357 ok(!run(app(['openssl', 'fipsinstall', '-in', $stconf,
358 '-module', $infile, '-verify'])),
359 "fipsinstall config verify fails without self test indicator");
360
361 ok(run(app(['openssl', 'fipsinstall', '-in', $stconf,
362 '-module', $infile, '-self_test_onload', '-verify'])),
363 "fipsinstall config verify passes when self test indicator is not present");
364}
365
366SKIP: {
367 run(test(["fips_version_test", "-config", $provconf, ">=3.1.0"]),
368 capture => 1, statusvar => \my $exit);
369 skip "FIPS provider version can run self tests on install", 1
370 if !$exit;
371 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
372 '-provider_name', 'fips', '-mac_name', 'HMAC',
373 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
374 '-section_name', 'fips_sect', '-self_test_oninstall',
375 '-ems_check'])),
376 "fipsinstall fails when attempting to run self tests on install");
377}
378
379ok(find_line_file('drbg-no-trunc-md = 0', 'fips.cnf') == 1,
380 'fipsinstall defaults to not banning truncated digests with DRBGs');
381
382ok(run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
383 '-provider_name', 'fips', '-mac_name', 'HMAC',
384 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
385 '-section_name', 'fips_sect', '-no_drbg_truncated_digests'])),
386 "fipsinstall knows about allowing truncated digests in DRBGs");
387
388ok(find_line_file('drbg-no-trunc-md = 1', 'fips.cnf') == 1,
389 'fipsinstall will allow option for truncated digests with DRBGs');
390
391
392ok(run(app(['openssl', 'fipsinstall', '-out', 'fips-pedantic.cnf',
393 '-module', $infile, '-pedantic'])),
394 "fipsinstall accepts -pedantic option");
395
396foreach my $o (@pedantic_okay) {
397 ok(run(app(['openssl', 'fipsinstall', '-out', "fips-${o}.cnf",
398 '-module', $infile, '-pedantic', "-${o}"])),
399 "fipsinstall accepts -${o} after -pedantic option");
400}
401
402foreach my $o (@pedantic_fail) {
403 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf',
404 '-module', $infile, '-pedantic', "-${o}"])),
405 "fipsinstall disallows -${o} after -pedantic option");
406}
407
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette