2 # Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
13 use File::Spec::Functions qw/curdir abs2rel/;
16 use OpenSSL::Test qw/:DEFAULT srctop_dir bldtop_dir bldtop_file srctop_file data_file/;
17 use OpenSSL::Test::Utils;
20 setup("test_cli_fips");
22 use lib srctop_dir('Configurations');
23 use lib bldtop_dir('.');
26 my $no_check = disabled("fips") || disabled('fips-securitychecks');
27 plan skip_all => "Test only supported in a fips build with security checks"
31 my $fipsmodule = bldtop_file('providers', platform->dso('fips'));
32 my $fipsconf = srctop_file("test", "fips-and-base.cnf");
33 my $defaultconf = srctop_file("test", "default.cnf");
34 my $tbs_data = $fipsmodule;
35 my $bogus_data = $fipsconf;
37 $ENV{OPENSSL_CONF} = $fipsconf;
39 ok(run(app(['openssl', 'list', '-public-key-methods', '-verbose'])),
40 "provider listing of public key methods");
41 ok(run(app(['openssl', 'list', '-public-key-algorithms', '-verbose'])),
42 "provider listing of public key algorithms");
43 ok(run(app(['openssl', 'list', '-key-managers', '-verbose'])),
44 "provider listing of keymanagers");
45 ok(run(app(['openssl', 'list', '-key-exchange-algorithms', '-verbose'])),
46 "provider listing of key exchange algorithms");
47 ok(run(app(['openssl', 'list', '-kem-algorithms', '-verbose'])),
48 "provider listing of key encapsulation algorithms");
49 ok(run(app(['openssl', 'list', '-signature-algorithms', '-verbose'])),
50 "provider listing of signature algorithms");
51 ok(run(app(['openssl', 'list', '-asymcipher-algorithms', '-verbose'])),
52 "provider listing of encryption algorithms");
53 ok(run(app(['openssl', 'list', '-key-managers', '-verbose', '-select', 'DSA' ])),
54 "provider listing of one item in the keymanager");
62 ok(run(app(['openssl', 'pkey',
66 $prefix.': '."Create the public key with $type parameters");
70 my $tsignverify_count = 9;
74 my $fips_pub_key = shift;
75 my $nonfips_key = shift;
76 my $nonfips_pub_key = shift;
77 my $fips_sigfile = $prefix.'.fips.sig';
78 my $nonfips_sigfile = $prefix.'.nonfips.sig';
82 $ENV{OPENSSL_CONF} = $fipsconf;
84 $sigfile = $fips_sigfile;
85 $testtext = $prefix.': '.
86 'Sign something with a FIPS key';
87 ok(run(app(['openssl', 'dgst', '-sha256',
93 $testtext = $prefix.': '.
94 'Verify something with a FIPS key';
95 ok(run(app(['openssl', 'dgst', '-sha256',
96 '-verify', $fips_pub_key,
97 '-signature', $sigfile,
101 $testtext = $prefix.': '.
102 'Verify a valid signature against the wrong data with a FIPS key'.
104 ok(!run(app(['openssl', 'dgst', '-sha256',
105 '-verify', $fips_pub_key,
106 '-signature', $sigfile,
110 $ENV{OPENSSL_CONF} = $defaultconf;
112 $sigfile = $nonfips_sigfile;
113 $testtext = $prefix.': '.
114 'Sign something with a non-FIPS key'.
115 ' with the default provider';
116 ok(run(app(['openssl', 'dgst', '-sha256',
117 '-sign', $nonfips_key,
122 $testtext = $prefix.': '.
123 'Verify something with a non-FIPS key'.
124 ' with the default provider';
125 ok(run(app(['openssl', 'dgst', '-sha256',
126 '-verify', $nonfips_pub_key,
127 '-signature', $sigfile,
131 $ENV{OPENSSL_CONF} = $fipsconf;
133 $testtext = $prefix.': '.
134 'Sign something with a non-FIPS key'.
136 ok(!run(app(['openssl', 'dgst', '-sha256',
137 '-sign', $nonfips_key,
138 '-out', $prefix.'.nonfips.fail.sig',
142 $testtext = $prefix.': '.
143 'Verify something with a non-FIPS key'.
145 ok(!run(app(['openssl', 'dgst', '-sha256',
146 '-verify', $nonfips_pub_key,
147 '-signature', $sigfile,
151 $testtext = $prefix.': '.
152 'Verify something with a non-FIPS key'.
153 ' in FIPS mode but with a non-FIPS property query';
154 ok(run(app(['openssl', 'dgst',
155 '-provider', 'default',
156 '-propquery', '?fips!=yes',
158 '-verify', $nonfips_pub_key,
159 '-signature', $sigfile,
163 $testtext = $prefix.': '.
164 'Verify a valid signature against the wrong data with a non-FIPS key'.
166 ok(!run(app(['openssl', 'dgst', '-sha256',
167 '-verify', $nonfips_pub_key,
168 '-signature', $sigfile,
174 skip "FIPS EC tests because of no ec in this build", 1
178 my $testtext_prefix = 'EC';
179 my $a_fips_curve = 'prime256v1';
180 my $fips_key = $testtext_prefix.'.fips.priv.pem';
181 my $fips_pub_key = $testtext_prefix.'.fips.pub.pem';
182 my $a_nonfips_curve = 'brainpoolP256r1';
183 my $nonfips_key = $testtext_prefix.'.nonfips.priv.pem';
184 my $nonfips_pub_key = $testtext_prefix.'.nonfips.pub.pem';
188 plan tests => 5 + $tsignverify_count;
190 $ENV{OPENSSL_CONF} = $defaultconf;
191 $curvename = $a_nonfips_curve;
192 $testtext = $testtext_prefix.': '.
193 'Generate a key with a non-FIPS algorithm with the default provider';
194 ok(run(app(['openssl', 'genpkey', '-algorithm', 'EC',
195 '-pkeyopt', 'ec_paramgen_curve:'.$curvename,
196 '-out', $nonfips_key])),
199 pubfrompriv($testtext_prefix, $nonfips_key, $nonfips_pub_key, "non-FIPS");
201 $ENV{OPENSSL_CONF} = $fipsconf;
203 $curvename = $a_fips_curve;
204 $testtext = $testtext_prefix.': '.
205 'Generate a key with a FIPS algorithm';
206 ok(run(app(['openssl', 'genpkey', '-algorithm', 'EC',
207 '-pkeyopt', 'ec_paramgen_curve:'.$curvename,
208 '-out', $fips_key])),
211 pubfrompriv($testtext_prefix, $fips_key, $fips_pub_key, "FIPS");
213 $curvename = $a_nonfips_curve;
214 $testtext = $testtext_prefix.': '.
215 'Generate a key with a non-FIPS algorithm'.
217 ok(!run(app(['openssl', 'genpkey', '-algorithm', 'EC',
218 '-pkeyopt', 'ec_paramgen_curve:'.$curvename,
219 '-out', $testtext_prefix.'.'.$curvename.'.priv.pem'])),
222 tsignverify($testtext_prefix, $fips_key, $fips_pub_key, $nonfips_key,
228 skip "FIPS RSA tests because of no rsa in this build", 1
232 my $testtext_prefix = 'RSA';
233 my $fips_key = $testtext_prefix.'.fips.priv.pem';
234 my $fips_pub_key = $testtext_prefix.'.fips.pub.pem';
235 my $nonfips_key = $testtext_prefix.'.nonfips.priv.pem';
236 my $nonfips_pub_key = $testtext_prefix.'.nonfips.pub.pem';
239 plan tests => 5 + $tsignverify_count;
241 $ENV{OPENSSL_CONF} = $defaultconf;
242 $testtext = $testtext_prefix.': '.
243 'Generate a key with a non-FIPS algorithm with the default provider';
244 ok(run(app(['openssl', 'genpkey', '-algorithm', 'RSA',
245 '-pkeyopt', 'rsa_keygen_bits:512',
246 '-out', $nonfips_key])),
249 pubfrompriv($testtext_prefix, $nonfips_key, $nonfips_pub_key, "non-FIPS");
251 $ENV{OPENSSL_CONF} = $fipsconf;
253 $testtext = $testtext_prefix.': '.
254 'Generate a key with a FIPS algorithm';
255 ok(run(app(['openssl', 'genpkey', '-algorithm', 'RSA',
256 '-pkeyopt', 'rsa_keygen_bits:2048',
257 '-out', $fips_key])),
260 pubfrompriv($testtext_prefix, $fips_key, $fips_pub_key, "FIPS");
262 $testtext = $testtext_prefix.': '.
263 'Generate a key with a non-FIPS algorithm'.
265 ok(!run(app(['openssl', 'genpkey', '-algorithm', 'RSA',
266 '-pkeyopt', 'rsa_keygen_bits:512',
267 '-out', $testtext_prefix.'.fail.priv.pem'])),
270 tsignverify($testtext_prefix, $fips_key, $fips_pub_key, $nonfips_key,
276 skip "FIPS DSA tests because of no dsa in this build", 1
280 my $testtext_prefix = 'DSA';
281 my $fips_key = $testtext_prefix.'.fips.priv.pem';
282 my $fips_pub_key = $testtext_prefix.'.fips.pub.pem';
283 my $nonfips_key = $testtext_prefix.'.nonfips.priv.pem';
284 my $nonfips_pub_key = $testtext_prefix.'.nonfips.pub.pem';
286 my $fips_param = $testtext_prefix.'.fips.param.pem';
287 my $nonfips_param = $testtext_prefix.'.nonfips.param.pem';
288 my $shortnonfips_param = $testtext_prefix.'.shortnonfips.param.pem';
290 plan tests => 13 + $tsignverify_count;
292 $ENV{OPENSSL_CONF} = $defaultconf;
294 $testtext = $testtext_prefix.': '.
295 'Generate non-FIPS params with the default provider';
296 ok(run(app(['openssl', 'genpkey', '-genparam',
298 '-pkeyopt', 'type:fips186_2',
299 '-pkeyopt', 'dsa_paramgen_bits:512',
300 '-out', $nonfips_param])),
303 $ENV{OPENSSL_CONF} = $fipsconf;
305 $testtext = $testtext_prefix.': '.
306 'Generate FIPS params';
307 ok(run(app(['openssl', 'genpkey', '-genparam',
309 '-pkeyopt', 'dsa_paramgen_bits:2048',
310 '-out', $fips_param])),
313 $testtext = $testtext_prefix.': '.
314 'Generate non-FIPS params'.
316 ok(!run(app(['openssl', 'genpkey', '-genparam',
318 '-pkeyopt', 'dsa_paramgen_bits:512',
319 '-out', $testtext_prefix.'.fail.param.pem'])),
322 $testtext = $testtext_prefix.': '.
323 'Generate non-FIPS params using non-FIPS property query'.
325 ok(run(app(['openssl', 'dsaparam', '-provider', 'default',
326 '-propquery', '?fips!=yes',
327 '-out', $shortnonfips_param, '1024'])),
330 $testtext = $testtext_prefix.': '.
331 'Generate non-FIPS params using non-FIPS property query'.
333 ok(run(app(['openssl', 'genpkey', '-provider', 'default',
334 '-propquery', '?fips!=yes',
335 '-genparam', '-algorithm', 'DSA',
336 '-pkeyopt', 'dsa_paramgen_bits:512'])),
339 $ENV{OPENSSL_CONF} = $defaultconf;
341 $testtext = $testtext_prefix.': '.
342 'Generate a key with non-FIPS params with the default provider';
343 ok(run(app(['openssl', 'genpkey',
344 '-paramfile', $nonfips_param,
345 '-pkeyopt', 'type:fips186_2',
346 '-out', $nonfips_key])),
349 pubfrompriv($testtext_prefix, $nonfips_key, $nonfips_pub_key, "non-FIPS");
351 $ENV{OPENSSL_CONF} = $fipsconf;
353 $testtext = $testtext_prefix.': '.
354 'Generate a key with FIPS parameters';
355 ok(run(app(['openssl', 'genpkey',
356 '-paramfile', $fips_param,
357 '-pkeyopt', 'type:fips186_4',
358 '-out', $fips_key])),
361 pubfrompriv($testtext_prefix, $fips_key, $fips_pub_key, "FIPS");
363 $testtext = $testtext_prefix.': '.
364 'Generate a key with non-FIPS parameters'.
366 ok(!run(app(['openssl', 'genpkey',
367 '-paramfile', $nonfips_param,
368 '-pkeyopt', 'type:fips186_2',
369 '-out', $testtext_prefix.'.fail.priv.pem'])),
372 $testtext = $testtext_prefix.': '.
373 'Generate a key with non-FIPS parameters using non-FIPS property'.
375 ok(run(app(['openssl', 'dsaparam', '-provider', 'default',
376 '-propquery', '?fips!=yes',
377 '-noout', '-genkey', '1024'])),
380 $testtext = $testtext_prefix.': '.
381 'Generate a key with non-FIPS parameters using non-FIPS property'.
383 ok(run(app(['openssl', 'gendsa', '-provider', 'default',
384 '-propquery', '?fips!=yes',
385 $shortnonfips_param])),
388 $testtext = $testtext_prefix.': '.
389 'Generate a key with non-FIPS parameters using non-FIPS property'.
391 ok(run(app(['openssl', 'genpkey', '-provider', 'default',
392 '-propquery', '?fips!=yes',
393 '-paramfile', $nonfips_param,
394 '-pkeyopt', 'type:fips186_2',
395 '-out', $testtext_prefix.'.fail.priv.pem'])),
398 tsignverify($testtext_prefix, $fips_key, $fips_pub_key, $nonfips_key,