2 # Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
12 use File
::Spec
::Functions
qw(:DEFAULT abs2rel);
15 use OpenSSL
::Test qw
/:DEFAULT srctop_dir srctop_file bldtop_dir bldtop_file/;
16 use OpenSSL
::Test
::Utils
;
19 setup
("test_fipsinstall");
21 use lib srctop_dir
('Configurations');
22 use lib bldtop_dir
('.');
25 plan skip_all
=> "Test only supported in a fips build" if disabled
("fips");
29 my $infile = bldtop_file
('providers', platform
->dso('fips'));
30 my $fipskey = $ENV{FIPSKEY
} // '00';
32 # Read in a text $infile and replace the regular expression in $srch with the
33 # value in $repl and output to a new file $outfile.
34 sub replace_line_file_internal
{
36 my ($infile, $srch, $repl, $outfile) = @_;
39 open(my $in, "<", $infile) or return 0;
40 read($in, $msg, 1024);
43 $msg =~ s/$srch/$repl/;
45 open(my $fh, ">", $outfile) or return 0;
51 # Read in the text input file 'fips.cnf'
52 # and replace a single Key = Value line with a new value in $value.
53 # OR remove the Key = Value line if the passed in $value is empty.
54 # and then output a new file $outfile.
55 # $key is the Key to find
56 sub replace_line_file
{
57 my ($key, $value, $outfile) = @_;
59 my $srch = qr/$key\s*=\s*\S*\n/;
64 $rep = "$key = $value\n";
66 return replace_line_file_internal
('fips.cnf', $srch, $rep, $outfile);
69 # Read in the text input file 'test/fips.cnf'
70 # and replace the .cnf file used in
71 # .include fipsmodule.cnf with a new value in $value.
72 # and then output a new file $outfile.
73 # $key is the Key to find
74 sub replace_parent_line_file
{
75 my ($value, $outfile) = @_;
76 my $srch = qr/fipsmodule.cnf/;
78 return replace_line_file_internal
(srctop_file
("test", 'fips.cnf'),
79 $srch, $rep, $outfile);
82 # fail if no module name
83 ok
(!run
(app
(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module',
84 '-provider_name', 'fips',
85 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
86 '-section_name', 'fips_sect'])),
89 # fail to verify if the configuration file is missing
90 ok
(!run
(app
(['openssl', 'fipsinstall', '-in', 'dummy.tmp', '-module', $infile,
91 '-provider_name', 'fips', '-mac_name', 'HMAC',
92 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
93 '-section_name', 'fips_sect', '-verify'])),
94 "fipsinstall verify fail");
97 # output a fips.cnf file containing mac data
98 ok
(run
(app
(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
99 '-provider_name', 'fips', '-mac_name', 'HMAC',
100 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
101 '-section_name', 'fips_sect'])),
104 # verify the fips.cnf file
105 ok
(run
(app
(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
106 '-provider_name', 'fips', '-mac_name', 'HMAC',
107 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
108 '-section_name', 'fips_sect', '-verify'])),
109 "fipsinstall verify");
111 ok
(replace_line_file
('module-mac', '', 'fips_no_module_mac.cnf')
112 && !run
(app
(['openssl', 'fipsinstall',
113 '-in', 'fips_no_module_mac.cnf',
115 '-provider_name', 'fips', '-mac_name', 'HMAC',
116 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
117 '-section_name', 'fips_sect', '-verify'])),
118 "fipsinstall verify fail no module mac");
120 ok
(replace_line_file
('install-mac', '', 'fips_no_install_mac.cnf')
121 && !run
(app
(['openssl', 'fipsinstall',
122 '-in', 'fips_no_install_mac.cnf',
124 '-provider_name', 'fips', '-mac_name', 'HMAC',
125 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
126 '-section_name', 'fips_sect', '-verify'])),
127 "fipsinstall verify fail no install indicator mac");
129 ok
(replace_line_file
('module-mac', '00:00:00:00:00:00',
130 'fips_bad_module_mac.cnf')
131 && !run
(app
(['openssl', 'fipsinstall',
132 '-in', 'fips_bad_module_mac.cnf',
134 '-provider_name', 'fips', '-mac_name', 'HMAC',
135 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
136 '-section_name', 'fips_sect', '-verify'])),
137 "fipsinstall verify fail if invalid module integrity value");
139 ok
(replace_line_file
('install-mac', '00:00:00:00:00:00',
140 'fips_bad_install_mac.cnf')
141 && !run
(app
(['openssl', 'fipsinstall',
142 '-in', 'fips_bad_install_mac.cnf',
144 '-provider_name', 'fips', '-mac_name', 'HMAC',
145 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
146 '-section_name', 'fips_sect', '-verify'])),
147 "fipsinstall verify fail if invalid install indicator integrity value");
149 ok
(replace_line_file
('install-status', 'INCORRECT_STATUS_STRING',
150 'fips_bad_indicator.cnf')
151 && !run
(app
(['openssl', 'fipsinstall',
152 '-in', 'fips_bad_indicator.cnf',
154 '-provider_name', 'fips', '-mac_name', 'HMAC',
155 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
156 '-section_name', 'fips_sect', '-verify'])),
157 "fipsinstall verify fail if invalid install indicator status");
159 # fail to verify the fips.cnf file if a different key is used
160 ok
(!run
(app
(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
161 '-provider_name', 'fips', '-mac_name', 'HMAC',
162 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
163 '-section_name', 'fips_sect', '-verify'])),
164 "fipsinstall verify fail bad key");
166 # fail to verify the fips.cnf file if a different mac digest is used
167 ok
(!run
(app
(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
168 '-provider_name', 'fips', '-mac_name', 'HMAC',
169 '-macopt', 'digest:SHA512', '-macopt', "hexkey:$fipskey",
170 '-section_name', 'fips_sect', '-verify'])),
171 "fipsinstall verify fail incorrect digest");
173 # corrupt the module hmac
174 ok
(!run
(app
(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
175 '-provider_name', 'fips', '-mac_name', 'HMAC',
176 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
177 '-section_name', 'fips_sect', '-corrupt_desc', 'HMAC'])),
178 "fipsinstall fails when the module integrity is corrupted");
180 # corrupt the first digest
181 ok
(!run
(app
(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
182 '-provider_name', 'fips', '-mac_name', 'HMAC',
183 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
184 '-section_name', 'fips_sect', '-corrupt_desc', 'SHA1'])),
185 "fipsinstall fails when the digest result is corrupted");
187 # corrupt another digest
188 ok
(!run
(app
(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
189 '-provider_name', 'fips', '-mac_name', 'HMAC',
190 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
191 '-section_name', 'fips_sect', '-corrupt_desc', 'SHA3'])),
192 "fipsinstall fails when the digest result is corrupted");
195 ok
(!run
(app
(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
196 '-provider_name', 'fips', '-mac_name', 'HMAC',
197 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
198 '-section_name', 'fips_sect', '-corrupt_desc', 'CTR'])),
199 "fipsinstall fails when the DRBG CTR result is corrupted");
203 skip
"Skipping KAS DH corruption test because of no dh in this build", 1
206 ok
(!run
(app
(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
207 '-provider_name', 'fips', '-mac_name', 'HMAC',
208 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
209 '-section_name', 'fips_sect',
210 '-corrupt_desc', 'DH',
211 '-corrupt_type', 'KAT_KA'])),
212 "fipsinstall fails when the kas result is corrupted");
215 # corrupt a Signature test
217 skip
"Skipping Signature DSA corruption test because of no dsa in this build", 1
219 ok
(!run
(app
(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
220 '-provider_name', 'fips', '-mac_name', 'HMAC',
221 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
222 '-section_name', 'fips_sect',
223 '-corrupt_desc', 'DSA',
224 '-corrupt_type', 'KAT_Signature'])),
225 "fipsinstall fails when the signature result is corrupted");
228 # corrupt an Asymmetric cipher test
230 skip
"Skipping Asymmetric RSA corruption test because of no rsa in this build", 1
232 ok
(!run
(app
(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
233 '-corrupt_desc', 'RSA_Encrypt',
234 '-corrupt_type', 'KAT_AsymmetricCipher'])),
235 "fipsinstall fails when the asymmetric cipher result is corrupted");
238 # 'local' ensures that this change is only done in this file.
239 local $ENV{OPENSSL_CONF_INCLUDE
} = abs2rel
(curdir
());
241 ok
(replace_parent_line_file
('fips.cnf', 'fips_parent.cnf')
242 && run
(app
(['openssl', 'fipsinstall', '-config', 'fips_parent.cnf'])),
243 "verify fips provider loads from a configuration file");
245 ok
(replace_parent_line_file
('fips_no_module_mac.cnf',
246 'fips_parent_no_module_mac.cnf')
247 && !run
(app
(['openssl', 'fipsinstall',
248 '-config', 'fips_parent_no_module_mac.cnf'])),
249 "verify load config fail no module mac");
251 ok
(replace_parent_line_file
('fips_no_install_mac.cnf',
252 'fips_parent_no_install_mac.cnf')
253 && !run
(app
(['openssl', 'fipsinstall',
254 '-config', 'fips_parent_no_install_mac.cnf'])),
255 "verify load config fail no install mac");
257 ok
(replace_parent_line_file
('fips_bad_indicator.cnf',
258 'fips_parent_bad_indicator.cnf')
259 && !run
(app
(['openssl', 'fipsinstall',
260 '-config', 'fips_parent_bad_indicator.cnf'])),
261 "verify load config fail bad indicator");
264 ok
(replace_parent_line_file
('fips_bad_install_mac.cnf',
265 'fips_parent_bad_install_mac.cnf')
266 && !run
(app
(['openssl', 'fipsinstall',
267 '-config', 'fips_parent_bad_install_mac.cnf'])),
268 "verify load config fail bad install mac");
270 ok
(replace_parent_line_file
('fips_bad_module_mac.cnf',
271 'fips_parent_bad_module_mac.cnf')
272 && !run
(app
(['openssl', 'fipsinstall',
273 '-config', 'fips_parent_bad_module_mac.cnf'])),
274 "verify load config fail bad module mac");