"illegal or unsupported padding mode"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INAVLID_UKM_LENGTH),
"inavlid ukm length"},
+ {ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INDICATOR_INTEGRITY_FAILURE),
+ "indicator integrity failure"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INSUFFICIENT_DRBG_STRENGTH),
"insufficient drbg strength"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_AAD), "invalid aad"},
+ {ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_CONFIG_DATA),
+ "invalid config data"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_CONSTANT_LENGTH),
"invalid constant length"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_CURVE), "invalid curve"},
"invalid seed length"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_SIGNATURE_SIZE),
"invalid signature size"},
+ {ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_STATE), "invalid state"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_TAG), "invalid tag"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_TAGLEN), "invalid taglen"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_INVALID_X931_DIGEST),
"key size too small"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_MISSING_CEK_ALG), "missing cek alg"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_MISSING_CIPHER), "missing cipher"},
+ {ERR_PACK(ERR_LIB_PROV, 0, PROV_R_MISSING_CONFIG_DATA),
+ "missing config data"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_MISSING_CONSTANT), "missing constant"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_MISSING_KEY), "missing key"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_MISSING_MAC), "missing mac"},
"missing session id"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_MISSING_TYPE), "missing type"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_MISSING_XCGHASH), "missing xcghash"},
+ {ERR_PACK(ERR_LIB_PROV, 0, PROV_R_MODULE_INTEGRITY_FAILURE),
+ "module integrity failure"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_NOT_INSTANTIATED), "not instantiated"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_NOT_SUPPORTED), "not supported"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_NOT_XOF_OR_INVALID_LENGTH),
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_REQUIRE_CTR_MODE_CIPHER),
"require ctr mode cipher"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_RESEED_ERROR), "reseed error"},
+ {ERR_PACK(ERR_LIB_PROV, 0, PROV_R_SELF_TEST_KAT_FAILURE),
+ "self test kat failure"},
+ {ERR_PACK(ERR_LIB_PROV, 0, PROV_R_SELF_TEST_POST_FAILURE),
+ "self test post failure"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_TAG_NOTSET), "tag notset"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_TAG_NOT_NEEDED), "tag not needed"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_UNABLE_TO_FIND_CIPHERS),
use File::Spec;
use File::Copy;
use OpenSSL::Glob;
-use OpenSSL::Test qw/:DEFAULT srctop_dir bldtop_dir bldtop_file/;
+use OpenSSL::Test qw/:DEFAULT srctop_dir srctop_file bldtop_dir bldtop_file/;
use OpenSSL::Test::Utils;
BEGIN {
plan skip_all => "Test only supported in a fips build" if disabled("fips");
-plan tests => 12;
+plan tests => 23;
my $infile = bldtop_file('providers', platform->dso('fips'));
my $fipskey = $ENV{FIPSKEY} // '00';
+# Read in a text $infile and replace the regular expression in $srch with the
+# value in $repl and output to a new file $outfile.
+sub replace_line_file_internal {
+
+ my ($infile, $srch, $repl, $outfile) = @_;
+ my $msg;
+
+ open(my $in, "<", $infile) or return 0;
+ read($in, $msg, 1024);
+ close $in;
+
+ $msg =~ s/$srch/$repl/;
+
+ open(my $fh, ">", $outfile) or return 0;
+ print $fh $msg;
+ close $fh;
+ return 1;
+}
+
+# Read in the text input file 'fips.cnf'
+# and replace a single Key = Value line with a new value in $value.
+# OR remove the Key = Value line if the passed in $value is empty.
+# and then output a new file $outfile.
+# $key is the Key to find
+sub replace_line_file {
+ my ($key, $value, $outfile) = @_;
+
+ my $srch = qr/$key\s*=\s*\S*\n/;
+ my $rep;
+ if ($value eq "") {
+ $rep = "";
+ } else {
+ $rep = "$key = $value\n";
+ }
+ return replace_line_file_internal('fips.cnf', $srch, $rep, $outfile);
+}
+
+# Read in the text input file 'test/fips.cnf'
+# and replace the .cnf file used in
+# .include fipsmodule.cnf with a new value in $value.
+# and then output a new file $outfile.
+# $key is the Key to find
+sub replace_parent_line_file {
+ my ($value, $outfile) = @_;
+ my $srch = qr/fipsmodule.cnf/;
+ my $rep = "$value";
+ return replace_line_file_internal(srctop_file("test", 'fips.cnf'),
+ $srch, $rep, $outfile);
+}
+
# fail if no module name
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module',
'-provider_name', 'fips',
'-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
- '-section_name', 'fips_install'])),
+ '-section_name', 'fips_sect'])),
"fipsinstall fail");
# fail to verify if the configuration file is missing
ok(!run(app(['openssl', 'fipsinstall', '-in', 'dummy.tmp', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
- '-section_name', 'fips_install', '-verify'])),
+ '-section_name', 'fips_sect', '-verify'])),
"fipsinstall verify fail");
ok(run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
- '-section_name', 'fips_install'])),
+ '-section_name', 'fips_sect'])),
"fipsinstall");
# verify the fips.cnf file
ok(run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
- '-section_name', 'fips_install', '-verify'])),
+ '-section_name', 'fips_sect', '-verify'])),
"fipsinstall verify");
+ok(replace_line_file('module-mac', '', 'fips_no_module_mac.cnf')
+ && !run(app(['openssl', 'fipsinstall',
+ '-in', 'fips_no_module_mac.cnf',
+ '-module', $infile,
+ '-provider_name', 'fips', '-mac_name', 'HMAC',
+ '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
+ '-section_name', 'fips_sect', '-verify'])),
+ "fipsinstall verify fail no module mac");
+
+ok(replace_line_file('install-mac', '', 'fips_no_install_mac.cnf')
+ && !run(app(['openssl', 'fipsinstall',
+ '-in', 'fips_no_install_mac.cnf',
+ '-module', $infile,
+ '-provider_name', 'fips', '-mac_name', 'HMAC',
+ '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
+ '-section_name', 'fips_sect', '-verify'])),
+ "fipsinstall verify fail no install indicator mac");
+
+ok(replace_line_file('module-mac', '00:00:00:00:00:00',
+ 'fips_bad_module_mac.cnf')
+ && !run(app(['openssl', 'fipsinstall',
+ '-in', 'fips_bad_module_mac.cnf',
+ '-module', $infile,
+ '-provider_name', 'fips', '-mac_name', 'HMAC',
+ '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
+ '-section_name', 'fips_sect', '-verify'])),
+ "fipsinstall verify fail if invalid module integrity value");
+
+ok(replace_line_file('install-mac', '00:00:00:00:00:00',
+ 'fips_bad_install_mac.cnf')
+ && !run(app(['openssl', 'fipsinstall',
+ '-in', 'fips_bad_install_mac.cnf',
+ '-module', $infile,
+ '-provider_name', 'fips', '-mac_name', 'HMAC',
+ '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
+ '-section_name', 'fips_sect', '-verify'])),
+ "fipsinstall verify fail if invalid install indicator integrity value");
+
+ok(replace_line_file('install-status', 'INCORRECT_STATUS_STRING',
+ 'fips_bad_indicator.cnf')
+ && !run(app(['openssl', 'fipsinstall',
+ '-in', 'fips_bad_indicator.cnf',
+ '-module', $infile,
+ '-provider_name', 'fips', '-mac_name', 'HMAC',
+ '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
+ '-section_name', 'fips_sect', '-verify'])),
+ "fipsinstall verify fail if invalid install indicator status");
+
# fail to verify the fips.cnf file if a different key is used
ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
- '-section_name', 'fips_install', '-verify'])),
+ '-section_name', 'fips_sect', '-verify'])),
"fipsinstall verify fail bad key");
# fail to verify the fips.cnf file if a different mac digest is used
ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA512', '-macopt', "hexkey:$fipskey",
- '-section_name', 'fips_install', '-verify'])),
+ '-section_name', 'fips_sect', '-verify'])),
"fipsinstall verify fail incorrect digest");
# corrupt the module hmac
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
- '-section_name', 'fips_install', '-corrupt_desc', 'HMAC'])),
+ '-section_name', 'fips_sect', '-corrupt_desc', 'HMAC'])),
"fipsinstall fails when the module integrity is corrupted");
# corrupt the first digest
-ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
+ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
- '-section_name', 'fips_install', '-corrupt_desc', 'SHA1'])),
+ '-section_name', 'fips_sect', '-corrupt_desc', 'SHA1'])),
"fipsinstall fails when the digest result is corrupted");
# corrupt another digest
-ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
+ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
- '-section_name', 'fips_install', '-corrupt_desc', 'SHA3'])),
+ '-section_name', 'fips_sect', '-corrupt_desc', 'SHA3'])),
"fipsinstall fails when the digest result is corrupted");
# corrupt DRBG
-ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
+ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
- '-section_name', 'fips_install', '-corrupt_desc', 'CTR'])),
+ '-section_name', 'fips_sect', '-corrupt_desc', 'CTR'])),
"fipsinstall fails when the DRBG CTR result is corrupted");
# corrupt a KAS test
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
- '-section_name', 'fips_install',
+ '-section_name', 'fips_sect',
'-corrupt_desc', 'DH',
'-corrupt_type', 'KAT_KA'])),
"fipsinstall fails when the kas result is corrupted");
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile,
'-provider_name', 'fips', '-mac_name', 'HMAC',
'-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
- '-section_name', 'fips_install',
+ '-section_name', 'fips_sect',
'-corrupt_desc', 'DSA',
'-corrupt_type', 'KAT_Signature'])),
"fipsinstall fails when the signature result is corrupted");
}
+
+$ENV{OPENSSL_CONF_INCLUDE} = ".";
+
+ok(replace_parent_line_file('fips.cnf', 'fips_parent.cnf')
+ && run(app(['openssl', 'fipsinstall', '-config', 'fips_parent.cnf'])),
+ "verify fips provider loads from a configuration file");
+
+ok(replace_parent_line_file('fips_no_module_mac.cnf',
+ 'fips_parent_no_module_mac.cnf')
+ && !run(app(['openssl', 'fipsinstall',
+ '-config', 'fips_parent_no_module_mac.cnf'])),
+ "verify load config fail no module mac");
+
+ok(replace_parent_line_file('fips_no_install_mac.cnf',
+ 'fips_parent_no_install_mac.cnf')
+ && !run(app(['openssl', 'fipsinstall',
+ '-config', 'fips_parent_no_install_mac.cnf'])),
+ "verify load config fail no install mac");
+
+ok(replace_parent_line_file('fips_bad_indicator.cnf',
+ 'fips_parent_bad_indicator.cnf')
+ && !run(app(['openssl', 'fipsinstall',
+ '-config', 'fips_parent_bad_indicator.cnf'])),
+ "verify load config fail bad indicator");
+
+
+ok(replace_parent_line_file('fips_bad_install_mac.cnf',
+ 'fips_parent_bad_install_mac.cnf')
+ && !run(app(['openssl', 'fipsinstall',
+ '-config', 'fips_parent_bad_install_mac.cnf'])),
+ "verify load config fail bad install mac");
+
+ok(replace_parent_line_file('fips_bad_module_mac.cnf',
+ 'fips_parent_bad_module_mac.cnf')
+ && !run(app(['openssl', 'fipsinstall',
+ '-config', 'fips_parent_bad_module_mac.cnf'])),
+ "verify load config fail bad module mac");
+
+delete $ENV{OPENSSL_CONF_INCLUDE};
projects / thirdparty / openssl.git / commitdiff
