]>
git.ipfire.org Git - thirdparty/openssl.git/blob - test/recipes/20-test_cli_fips.t
2 # Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
13 use File
::Spec
::Functions qw
/curdir abs2rel/;
16 use OpenSSL
::Test qw
/:DEFAULT srctop_dir bldtop_dir bldtop_file srctop_file data_file/;
17 use OpenSSL
::Test
::Utils
;
20 setup
("test_cli_fips");
22 use lib srctop_dir
('Configurations');
23 use lib bldtop_dir
('.');
26 my $no_check = disabled
("fips") || disabled
('fips-securitychecks');
27 plan skip_all
=> "Test only supported in a fips build with security checks"
31 my $fipsmodule = bldtop_file
('providers', platform
->dso('fips'));
32 my $fipsconf = srctop_file
("test", "fips-and-base.cnf");
33 my $defaultconf = srctop_file
("test", "default.cnf");
34 my $tbs_data = $fipsmodule;
35 my $bogus_data = $fipsconf;
37 $ENV{OPENSSL_CONF
} = $fipsconf;
39 ok
(run
(app
(['openssl', 'list', '-public-key-methods', '-verbose'])),
40 "provider listing of public key methods");
41 ok
(run
(app
(['openssl', 'list', '-public-key-algorithms', '-verbose'])),
42 "provider listing of public key algorithms");
43 ok
(run
(app
(['openssl', 'list', '-key-managers', '-verbose'])),
44 "provider listing of keymanagers");
45 ok
(run
(app
(['openssl', 'list', '-key-exchange-algorithms', '-verbose'])),
46 "provider listing of key exchange algorithms");
47 ok
(run
(app
(['openssl', 'list', '-kem-algorithms', '-verbose'])),
48 "provider listing of key encapsulation algorithms");
49 ok
(run
(app
(['openssl', 'list', '-signature-algorithms', '-verbose'])),
50 "provider listing of signature algorithms");
51 ok
(run
(app
(['openssl', 'list', '-asymcipher-algorithms', '-verbose'])),
52 "provider listing of encryption algorithms");
53 ok
(run
(app
(['openssl', 'list', '-key-managers', '-verbose', '-select', 'DSA' ])),
54 "provider listing of one item in the keymanager");
62 ok
(run
(app
(['openssl', 'pkey',
66 $prefix.': '."Create the public key with $type parameters");
70 my $tsignverify_count = 9;
74 my $fips_pub_key = shift;
75 my $nonfips_key = shift;
76 my $nonfips_pub_key = shift;
77 my $fips_sigfile = $prefix.'.fips.sig';
78 my $nonfips_sigfile = $prefix.'.nonfips.sig';
82 $ENV{OPENSSL_CONF
} = $fipsconf;
84 $sigfile = $fips_sigfile;
85 $testtext = $prefix.': '.
86 'Sign something with a FIPS key';
87 ok
(run
(app
(['openssl', 'dgst', '-sha256',
93 $testtext = $prefix.': '.
94 'Verify something with a FIPS key';
95 ok
(run
(app
(['openssl', 'dgst', '-sha256',
96 '-verify', $fips_pub_key,
97 '-signature', $sigfile,
101 $testtext = $prefix.': '.
102 'Verify a valid signature against the wrong data with a FIPS key'.
104 ok
(!run
(app
(['openssl', 'dgst', '-sha256',
105 '-verify', $fips_pub_key,
106 '-signature', $sigfile,
110 $ENV{OPENSSL_CONF
} = $defaultconf;
113 skip
"FIPS failure testing", 6
114 if ($nonfips_key eq '');
116 $sigfile = $nonfips_sigfile;
117 $testtext = $prefix.': '.
118 'Sign something with a non-FIPS key'.
119 ' with the default provider';
120 ok
(run
(app
(['openssl', 'dgst', '-sha256',
121 '-sign', $nonfips_key,
126 $testtext = $prefix.': '.
127 'Verify something with a non-FIPS key'.
128 ' with the default provider';
129 ok
(run
(app
(['openssl', 'dgst', '-sha256',
130 '-verify', $nonfips_pub_key,
131 '-signature', $sigfile,
135 $ENV{OPENSSL_CONF
} = $fipsconf;
137 $testtext = $prefix.': '.
138 'Sign something with a non-FIPS key'.
140 ok
(!run
(app
(['openssl', 'dgst', '-sha256',
141 '-sign', $nonfips_key,
142 '-out', $prefix.'.nonfips.fail.sig',
146 $testtext = $prefix.': '.
147 'Verify something with a non-FIPS key'.
149 ok
(!run
(app
(['openssl', 'dgst', '-sha256',
150 '-verify', $nonfips_pub_key,
151 '-signature', $sigfile,
155 $testtext = $prefix.': '.
156 'Verify something with a non-FIPS key'.
157 ' in FIPS mode but with a non-FIPS property query';
158 ok
(run
(app
(['openssl', 'dgst',
159 '-provider', 'default',
160 '-propquery', '?fips!=yes',
162 '-verify', $nonfips_pub_key,
163 '-signature', $sigfile,
167 $testtext = $prefix.': '.
168 'Verify a valid signature against the wrong data with a non-FIPS key'.
170 ok
(!run
(app
(['openssl', 'dgst', '-sha256',
171 '-verify', $nonfips_pub_key,
172 '-signature', $sigfile,
179 skip
"FIPS EC tests because of no ec in this build", 1
183 my $testtext_prefix = 'EC';
184 my $a_fips_curve = 'prime256v1';
185 my $fips_key = $testtext_prefix.'.fips.priv.pem';
186 my $fips_pub_key = $testtext_prefix.'.fips.pub.pem';
187 my $a_nonfips_curve = 'brainpoolP256r1';
188 my $nonfips_key = $testtext_prefix.'.nonfips.priv.pem';
189 my $nonfips_pub_key = $testtext_prefix.'.nonfips.pub.pem';
193 plan tests
=> 5 + $tsignverify_count;
195 $ENV{OPENSSL_CONF
} = $defaultconf;
196 $curvename = $a_nonfips_curve;
197 $testtext = $testtext_prefix.': '.
198 'Generate a key with a non-FIPS algorithm with the default provider';
199 ok
(run
(app
(['openssl', 'genpkey', '-algorithm', 'EC',
200 '-pkeyopt', 'ec_paramgen_curve:'.$curvename,
201 '-out', $nonfips_key])),
204 pubfrompriv
($testtext_prefix, $nonfips_key, $nonfips_pub_key, "non-FIPS");
206 $ENV{OPENSSL_CONF
} = $fipsconf;
208 $curvename = $a_fips_curve;
209 $testtext = $testtext_prefix.': '.
210 'Generate a key with a FIPS algorithm';
211 ok
(run
(app
(['openssl', 'genpkey', '-algorithm', 'EC',
212 '-pkeyopt', 'ec_paramgen_curve:'.$curvename,
213 '-out', $fips_key])),
216 pubfrompriv
($testtext_prefix, $fips_key, $fips_pub_key, "FIPS");
218 $curvename = $a_nonfips_curve;
219 $testtext = $testtext_prefix.': '.
220 'Generate a key with a non-FIPS algorithm'.
222 ok
(!run
(app
(['openssl', 'genpkey', '-algorithm', 'EC',
223 '-pkeyopt', 'ec_paramgen_curve:'.$curvename,
224 '-out', $testtext_prefix.'.'.$curvename.'.priv.pem'])),
227 tsignverify
($testtext_prefix, $fips_key, $fips_pub_key, $nonfips_key,
233 skip
"FIPS RSA tests because of no rsa in this build", 1
237 my $testtext_prefix = 'RSA';
238 my $fips_key = $testtext_prefix.'.fips.priv.pem';
239 my $fips_pub_key = $testtext_prefix.'.fips.pub.pem';
240 my $nonfips_key = $testtext_prefix.'.nonfips.priv.pem';
241 my $nonfips_pub_key = $testtext_prefix.'.nonfips.pub.pem';
244 plan tests
=> 5 + $tsignverify_count;
246 $ENV{OPENSSL_CONF
} = $defaultconf;
247 $testtext = $testtext_prefix.': '.
248 'Generate a key with a non-FIPS algorithm with the default provider';
249 ok
(run
(app
(['openssl', 'genpkey', '-algorithm', 'RSA',
250 '-pkeyopt', 'rsa_keygen_bits:512',
251 '-out', $nonfips_key])),
254 pubfrompriv
($testtext_prefix, $nonfips_key, $nonfips_pub_key, "non-FIPS");
256 $ENV{OPENSSL_CONF
} = $fipsconf;
258 $testtext = $testtext_prefix.': '.
259 'Generate a key with a FIPS algorithm';
260 ok
(run
(app
(['openssl', 'genpkey', '-algorithm', 'RSA',
261 '-pkeyopt', 'rsa_keygen_bits:2048',
262 '-out', $fips_key])),
265 pubfrompriv
($testtext_prefix, $fips_key, $fips_pub_key, "FIPS");
267 $testtext = $testtext_prefix.': '.
268 'Generate a key with a non-FIPS algorithm'.
270 ok
(!run
(app
(['openssl', 'genpkey', '-algorithm', 'RSA',
271 '-pkeyopt', 'rsa_keygen_bits:512',
272 '-out', $testtext_prefix.'.fail.priv.pem'])),
275 tsignverify
($testtext_prefix, $fips_key, $fips_pub_key, $nonfips_key,
281 skip
"FIPS DSA tests because of no dsa in this build", 1
285 my $testtext_prefix = 'DSA';
286 my $fips_key = $testtext_prefix.'.fips.priv.pem';
287 my $fips_pub_key = $testtext_prefix.'.fips.pub.pem';
288 my $nonfips_key = $testtext_prefix.'.nonfips.priv.pem';
289 my $nonfips_pub_key = $testtext_prefix.'.nonfips.pub.pem';
291 my $fips_param = $testtext_prefix.'.fips.param.pem';
292 my $nonfips_param = $testtext_prefix.'.nonfips.param.pem';
293 my $shortnonfips_param = $testtext_prefix.'.shortnonfips.param.pem';
295 plan tests
=> 13 + $tsignverify_count;
297 $ENV{OPENSSL_CONF
} = $defaultconf;
299 $testtext = $testtext_prefix.': '.
300 'Generate non-FIPS params with the default provider';
301 ok
(run
(app
(['openssl', 'genpkey', '-genparam',
303 '-pkeyopt', 'type:fips186_2',
304 '-pkeyopt', 'dsa_paramgen_bits:512',
305 '-out', $nonfips_param])),
308 $ENV{OPENSSL_CONF
} = $fipsconf;
310 $testtext = $testtext_prefix.': '.
311 'Generate FIPS params';
312 ok
(run
(app
(['openssl', 'genpkey', '-genparam',
314 '-pkeyopt', 'dsa_paramgen_bits:2048',
315 '-out', $fips_param])),
318 $testtext = $testtext_prefix.': '.
319 'Generate non-FIPS params'.
321 ok
(!run
(app
(['openssl', 'genpkey', '-genparam',
323 '-pkeyopt', 'dsa_paramgen_bits:512',
324 '-out', $testtext_prefix.'.fail.param.pem'])),
327 $testtext = $testtext_prefix.': '.
328 'Generate non-FIPS params using non-FIPS property query'.
330 ok
(run
(app
(['openssl', 'dsaparam', '-provider', 'default',
331 '-propquery', '?fips!=yes',
332 '-out', $shortnonfips_param, '1024'])),
335 $testtext = $testtext_prefix.': '.
336 'Generate non-FIPS params using non-FIPS property query'.
338 ok
(run
(app
(['openssl', 'genpkey', '-provider', 'default',
339 '-propquery', '?fips!=yes',
340 '-genparam', '-algorithm', 'DSA',
341 '-pkeyopt', 'dsa_paramgen_bits:512'])),
344 $ENV{OPENSSL_CONF
} = $defaultconf;
346 $testtext = $testtext_prefix.': '.
347 'Generate a key with non-FIPS params with the default provider';
348 ok
(run
(app
(['openssl', 'genpkey',
349 '-paramfile', $nonfips_param,
350 '-pkeyopt', 'type:fips186_2',
351 '-out', $nonfips_key])),
354 pubfrompriv
($testtext_prefix, $nonfips_key, $nonfips_pub_key, "non-FIPS");
356 $ENV{OPENSSL_CONF
} = $fipsconf;
358 $testtext = $testtext_prefix.': '.
359 'Generate a key with FIPS parameters';
360 ok
(run
(app
(['openssl', 'genpkey',
361 '-paramfile', $fips_param,
362 '-pkeyopt', 'type:fips186_4',
363 '-out', $fips_key])),
366 pubfrompriv
($testtext_prefix, $fips_key, $fips_pub_key, "FIPS");
368 $testtext = $testtext_prefix.': '.
369 'Generate a key with non-FIPS parameters'.
371 ok
(!run
(app
(['openssl', 'genpkey',
372 '-paramfile', $nonfips_param,
373 '-pkeyopt', 'type:fips186_2',
374 '-out', $testtext_prefix.'.fail.priv.pem'])),
377 $testtext = $testtext_prefix.': '.
378 'Generate a key with non-FIPS parameters using non-FIPS property'.
380 ok
(run
(app
(['openssl', 'dsaparam', '-provider', 'default',
381 '-propquery', '?fips!=yes',
382 '-noout', '-genkey', '1024'])),
385 $testtext = $testtext_prefix.': '.
386 'Generate a key with non-FIPS parameters using non-FIPS property'.
388 ok
(run
(app
(['openssl', 'gendsa', '-provider', 'default',
389 '-propquery', '?fips!=yes',
390 $shortnonfips_param])),
393 $testtext = $testtext_prefix.': '.
394 'Generate a key with non-FIPS parameters using non-FIPS property'.
396 ok
(run
(app
(['openssl', 'genpkey', '-provider', 'default',
397 '-propquery', '?fips!=yes',
398 '-paramfile', $nonfips_param,
399 '-pkeyopt', 'type:fips186_2',
400 '-out', $testtext_prefix.'.fail.priv.pem'])),
403 tsignverify
($testtext_prefix, $fips_key, $fips_pub_key, '', '');