2 # Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
15 use OpenSSL::Test qw/:DEFAULT srctop_dir srctop_file bldtop_dir bldtop_file/;
16 use OpenSSL::Test::Utils;
19 setup("test_fipsinstall");
21 use lib srctop_dir('Configurations');
22 use lib bldtop_dir('.');
25 plan skip_all => "Test only supported in a fips build" if disabled("fips");
29 my $infile = bldtop_file('providers', platform->dso('fips'));
30 my $fipskey = $ENV{FIPSKEY} // '00';
32 # Read in a text $infile and replace the regular expression in $srch with the
33 # value in $repl and output to a new file $outfile.
34 sub replace_line_file_internal {
36 my ($infile, $srch, $repl, $outfile) = @_;
39 open(my $in, "<", $infile) or return 0;
40 read($in, $msg, 1024);
43 $msg =~ s/$srch/$repl/;
45 open(my $fh, ">", $outfile) or return 0;
51 # Read in the text input file 'fips.cnf'
52 # and replace a single Key = Value line with a new value in $value.
53 # OR remove the Key = Value line if the passed in $value is empty.
54 # and then output a new file $outfile.
55 # $key is the Key to find
56 sub replace_line_file {
57 my ($key, $value, $outfile) = @_;
59 my $srch = qr/$key\s*=\s*\S*\n/;
64 $rep = "$key = $value\n";
66 return replace_line_file_internal('fips.cnf', $srch, $rep, $outfile);
69 # Read in the text input file 'test/fips.cnf'
70 # and replace the .cnf file used in
71 # .include fipsmodule.cnf with a new value in $value.
72 # and then output a new file $outfile.
73 # $key is the Key to find
74 sub replace_parent_line_file {
75 my ($value, $outfile) = @_;
76 my $srch = qr/fipsmodule.cnf/;
78 return replace_line_file_internal(srctop_file("test", 'fips.cnf'),
79 $srch, $rep, $outfile);
82 # fail if no module name
83 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module',
84 '-provider_name', 'fips',
85 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
86 '-section_name', 'fips_sect'])),
89 # fail to verify if the configuration file is missing
90 ok(!run(app(['openssl', 'fipsinstall', '-in', 'dummy.tmp', '-module', $infile,
91 '-provider_name', 'fips', '-mac_name', 'HMAC',
92 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
93 '-section_name', 'fips_sect', '-verify'])),
94 "fipsinstall verify fail");
97 # output a fips.cnf file containing mac data
98 ok(run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
99 '-provider_name', 'fips', '-mac_name', 'HMAC',
100 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
101 '-section_name', 'fips_sect'])),
104 # verify the fips.cnf file
105 ok(run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
106 '-provider_name', 'fips', '-mac_name', 'HMAC',
107 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
108 '-section_name', 'fips_sect', '-verify'])),
109 "fipsinstall verify");
111 ok(replace_line_file('module-mac', '', 'fips_no_module_mac.cnf')
112 && !run(app(['openssl', 'fipsinstall',
113 '-in', 'fips_no_module_mac.cnf',
115 '-provider_name', 'fips', '-mac_name', 'HMAC',
116 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
117 '-section_name', 'fips_sect', '-verify'])),
118 "fipsinstall verify fail no module mac");
120 ok(replace_line_file('install-mac', '', 'fips_no_install_mac.cnf')
121 && !run(app(['openssl', 'fipsinstall',
122 '-in', 'fips_no_install_mac.cnf',
124 '-provider_name', 'fips', '-mac_name', 'HMAC',
125 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
126 '-section_name', 'fips_sect', '-verify'])),
127 "fipsinstall verify fail no install indicator mac");
129 ok(replace_line_file('module-mac', '00:00:00:00:00:00',
130 'fips_bad_module_mac.cnf')
131 && !run(app(['openssl', 'fipsinstall',
132 '-in', 'fips_bad_module_mac.cnf',
134 '-provider_name', 'fips', '-mac_name', 'HMAC',
135 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
136 '-section_name', 'fips_sect', '-verify'])),
137 "fipsinstall verify fail if invalid module integrity value");
139 ok(replace_line_file('install-mac', '00:00:00:00:00:00',
140 'fips_bad_install_mac.cnf')
141 && !run(app(['openssl', 'fipsinstall',
142 '-in', 'fips_bad_install_mac.cnf',
144 '-provider_name', 'fips', '-mac_name', 'HMAC',
145 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
146 '-section_name', 'fips_sect', '-verify'])),
147 "fipsinstall verify fail if invalid install indicator integrity value");
149 ok(replace_line_file('install-status', 'INCORRECT_STATUS_STRING',
150 'fips_bad_indicator.cnf')
151 && !run(app(['openssl', 'fipsinstall',
152 '-in', 'fips_bad_indicator.cnf',
154 '-provider_name', 'fips', '-mac_name', 'HMAC',
155 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
156 '-section_name', 'fips_sect', '-verify'])),
157 "fipsinstall verify fail if invalid install indicator status");
159 # fail to verify the fips.cnf file if a different key is used
160 ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
161 '-provider_name', 'fips', '-mac_name', 'HMAC',
162 '-macopt', 'digest:SHA256', '-macopt', "hexkey:01",
163 '-section_name', 'fips_sect', '-verify'])),
164 "fipsinstall verify fail bad key");
166 # fail to verify the fips.cnf file if a different mac digest is used
167 ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
168 '-provider_name', 'fips', '-mac_name', 'HMAC',
169 '-macopt', 'digest:SHA512', '-macopt', "hexkey:$fipskey",
170 '-section_name', 'fips_sect', '-verify'])),
171 "fipsinstall verify fail incorrect digest");
173 # corrupt the module hmac
174 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
175 '-provider_name', 'fips', '-mac_name', 'HMAC',
176 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
177 '-section_name', 'fips_sect', '-corrupt_desc', 'HMAC'])),
178 "fipsinstall fails when the module integrity is corrupted");
180 # corrupt the first digest
181 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
182 '-provider_name', 'fips', '-mac_name', 'HMAC',
183 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
184 '-section_name', 'fips_sect', '-corrupt_desc', 'SHA1'])),
185 "fipsinstall fails when the digest result is corrupted");
187 # corrupt another digest
188 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
189 '-provider_name', 'fips', '-mac_name', 'HMAC',
190 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
191 '-section_name', 'fips_sect', '-corrupt_desc', 'SHA3'])),
192 "fipsinstall fails when the digest result is corrupted");
195 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips_fail.cnf', '-module', $infile,
196 '-provider_name', 'fips', '-mac_name', 'HMAC',
197 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
198 '-section_name', 'fips_sect', '-corrupt_desc', 'CTR'])),
199 "fipsinstall fails when the DRBG CTR result is corrupted");
203 skip "Skipping KAS DH corruption test because of no dh in this build", 1
206 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
207 '-provider_name', 'fips', '-mac_name', 'HMAC',
208 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
209 '-section_name', 'fips_sect',
210 '-corrupt_desc', 'DH',
211 '-corrupt_type', 'KAT_KA'])),
212 "fipsinstall fails when the kas result is corrupted");
215 # corrupt a Signature test
217 skip "Skipping Signature DSA corruption test because of no dsa in this build", 1
219 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
220 '-provider_name', 'fips', '-mac_name', 'HMAC',
221 '-macopt', 'digest:SHA256', '-macopt', "hexkey:$fipskey",
222 '-section_name', 'fips_sect',
223 '-corrupt_desc', 'DSA',
224 '-corrupt_type', 'KAT_Signature'])),
225 "fipsinstall fails when the signature result is corrupted");
228 # corrupt an Asymmetric cipher test
230 skip "Skipping Asymmetric RSA corruption test because of no rsa in this build", 1
232 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
233 '-corrupt_desc', 'RSA_Encrypt',
234 '-corrupt_type', 'KAT_AsymmetricCipher'])),
235 "fipsinstall fails when the asymmetric cipher result is corrupted");
238 $ENV{OPENSSL_CONF_INCLUDE} = ".";
240 ok(replace_parent_line_file('fips.cnf', 'fips_parent.cnf')
241 && run(app(['openssl', 'fipsinstall', '-config', 'fips_parent.cnf'])),
242 "verify fips provider loads from a configuration file");
244 ok(replace_parent_line_file('fips_no_module_mac.cnf',
245 'fips_parent_no_module_mac.cnf')
246 && !run(app(['openssl', 'fipsinstall',
247 '-config', 'fips_parent_no_module_mac.cnf'])),
248 "verify load config fail no module mac");
250 ok(replace_parent_line_file('fips_no_install_mac.cnf',
251 'fips_parent_no_install_mac.cnf')
252 && !run(app(['openssl', 'fipsinstall',
253 '-config', 'fips_parent_no_install_mac.cnf'])),
254 "verify load config fail no install mac");
256 ok(replace_parent_line_file('fips_bad_indicator.cnf',
257 'fips_parent_bad_indicator.cnf')
258 && !run(app(['openssl', 'fipsinstall',
259 '-config', 'fips_parent_bad_indicator.cnf'])),
260 "verify load config fail bad indicator");
263 ok(replace_parent_line_file('fips_bad_install_mac.cnf',
264 'fips_parent_bad_install_mac.cnf')
265 && !run(app(['openssl', 'fipsinstall',
266 '-config', 'fips_parent_bad_install_mac.cnf'])),
267 "verify load config fail bad install mac");
269 ok(replace_parent_line_file('fips_bad_module_mac.cnf',
270 'fips_parent_bad_module_mac.cnf')
271 && !run(app(['openssl', 'fipsinstall',
272 '-config', 'fips_parent_bad_module_mac.cnf'])),
273 "verify load config fail bad module mac");
275 delete $ENV{OPENSSL_CONF_INCLUDE};