20-test_cli_fips.t 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405
  1. #! /usr/bin/env perl
  2. # Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. #
  4. # Licensed under the Apache License 2.0 (the "License"). You may not use
  5. # this file except in compliance with the License. You can obtain a copy
  6. # in the file LICENSE in the source distribution or at
  7. # https://www.openssl.org/source/license.html
  8. use strict;
  9. use warnings;
  10. use File::Spec;
  11. use File::Spec::Functions qw/curdir abs2rel/;
  12. use File::Copy;
  13. use OpenSSL::Glob;
  14. use OpenSSL::Test qw/:DEFAULT srctop_dir bldtop_dir bldtop_file srctop_file data_file/;
  15. use OpenSSL::Test::Utils;
  16. BEGIN {
  17. setup("test_cli_fips");
  18. }
  19. use lib srctop_dir('Configurations');
  20. use lib bldtop_dir('.');
  21. use platform;
  22. my $no_check = disabled("fips") || disabled('fips-securitychecks');
  23. plan skip_all => "Test only supported in a fips build with security checks"
  24. if $no_check;
  25. plan tests => 11;
  26. my $fipsmodule = bldtop_file('providers', platform->dso('fips'));
  27. my $fipsconf = srctop_file("test", "fips-and-base.cnf");
  28. my $defaultconf = srctop_file("test", "default.cnf");
  29. my $tbs_data = $fipsmodule;
  30. my $bogus_data = $fipsconf;
  31. $ENV{OPENSSL_CONF} = $fipsconf;
  32. ok(run(app(['openssl', 'list', '-public-key-methods', '-verbose'])),
  33. "provider listing of public key methods");
  34. ok(run(app(['openssl', 'list', '-public-key-algorithms', '-verbose'])),
  35. "provider listing of public key algorithms");
  36. ok(run(app(['openssl', 'list', '-key-managers', '-verbose'])),
  37. "provider listing of keymanagers");
  38. ok(run(app(['openssl', 'list', '-key-exchange-algorithms', '-verbose'])),
  39. "provider listing of key exchange algorithms");
  40. ok(run(app(['openssl', 'list', '-kem-algorithms', '-verbose'])),
  41. "provider listing of key encapsulation algorithms");
  42. ok(run(app(['openssl', 'list', '-signature-algorithms', '-verbose'])),
  43. "provider listing of signature algorithms");
  44. ok(run(app(['openssl', 'list', '-asymcipher-algorithms', '-verbose'])),
  45. "provider listing of encryption algorithms");
  46. ok(run(app(['openssl', 'list', '-key-managers', '-verbose', '-select', 'DSA' ])),
  47. "provider listing of one item in the keymanager");
  48. sub pubfrompriv {
  49. my $prefix = shift;
  50. my $key = shift;
  51. my $pub_key = shift;
  52. my $type = shift;
  53. ok(run(app(['openssl', 'pkey',
  54. '-in', $key,
  55. '-pubout',
  56. '-out', $pub_key])),
  57. $prefix.': '."Create the public key with $type parameters");
  58. }
  59. my $tsignverify_count = 9;
  60. sub tsignverify {
  61. my $prefix = shift;
  62. my $fips_key = shift;
  63. my $fips_pub_key = shift;
  64. my $nonfips_key = shift;
  65. my $nonfips_pub_key = shift;
  66. my $fips_sigfile = $prefix.'.fips.sig';
  67. my $nonfips_sigfile = $prefix.'.nonfips.sig';
  68. my $sigfile = '';
  69. my $testtext = '';
  70. $ENV{OPENSSL_CONF} = $fipsconf;
  71. $sigfile = $fips_sigfile;
  72. $testtext = $prefix.': '.
  73. 'Sign something with a FIPS key';
  74. ok(run(app(['openssl', 'dgst', '-sha256',
  75. '-sign', $fips_key,
  76. '-out', $sigfile,
  77. $tbs_data])),
  78. $testtext);
  79. $testtext = $prefix.': '.
  80. 'Verify something with a FIPS key';
  81. ok(run(app(['openssl', 'dgst', '-sha256',
  82. '-verify', $fips_pub_key,
  83. '-signature', $sigfile,
  84. $tbs_data])),
  85. $testtext);
  86. $testtext = $prefix.': '.
  87. 'Verify a valid signature against the wrong data with a FIPS key'.
  88. ' (should fail)';
  89. ok(!run(app(['openssl', 'dgst', '-sha256',
  90. '-verify', $fips_pub_key,
  91. '-signature', $sigfile,
  92. $bogus_data])),
  93. $testtext);
  94. $ENV{OPENSSL_CONF} = $defaultconf;
  95. SKIP : {
  96. skip "FIPS failure testing", 6
  97. if ($nonfips_key eq '');
  98. $sigfile = $nonfips_sigfile;
  99. $testtext = $prefix.': '.
  100. 'Sign something with a non-FIPS key'.
  101. ' with the default provider';
  102. ok(run(app(['openssl', 'dgst', '-sha256',
  103. '-sign', $nonfips_key,
  104. '-out', $sigfile,
  105. $tbs_data])),
  106. $testtext);
  107. $testtext = $prefix.': '.
  108. 'Verify something with a non-FIPS key'.
  109. ' with the default provider';
  110. ok(run(app(['openssl', 'dgst', '-sha256',
  111. '-verify', $nonfips_pub_key,
  112. '-signature', $sigfile,
  113. $tbs_data])),
  114. $testtext);
  115. $ENV{OPENSSL_CONF} = $fipsconf;
  116. $testtext = $prefix.': '.
  117. 'Sign something with a non-FIPS key'.
  118. ' (should fail)';
  119. ok(!run(app(['openssl', 'dgst', '-sha256',
  120. '-sign', $nonfips_key,
  121. '-out', $prefix.'.nonfips.fail.sig',
  122. $tbs_data])),
  123. $testtext);
  124. $testtext = $prefix.': '.
  125. 'Verify something with a non-FIPS key'.
  126. ' (should fail)';
  127. ok(!run(app(['openssl', 'dgst', '-sha256',
  128. '-verify', $nonfips_pub_key,
  129. '-signature', $sigfile,
  130. $tbs_data])),
  131. $testtext);
  132. $testtext = $prefix.': '.
  133. 'Verify something with a non-FIPS key'.
  134. ' in FIPS mode but with a non-FIPS property query';
  135. ok(run(app(['openssl', 'dgst',
  136. '-provider', 'default',
  137. '-propquery', '?fips!=yes',
  138. '-sha256',
  139. '-verify', $nonfips_pub_key,
  140. '-signature', $sigfile,
  141. $tbs_data])),
  142. $testtext);
  143. $testtext = $prefix.': '.
  144. 'Verify a valid signature against the wrong data with a non-FIPS key'.
  145. ' (should fail)';
  146. ok(!run(app(['openssl', 'dgst', '-sha256',
  147. '-verify', $nonfips_pub_key,
  148. '-signature', $sigfile,
  149. $bogus_data])),
  150. $testtext);
  151. }
  152. }
  153. SKIP : {
  154. skip "FIPS EC tests because of no ec in this build", 1
  155. if disabled("ec");
  156. subtest EC => sub {
  157. my $testtext_prefix = 'EC';
  158. my $a_fips_curve = 'prime256v1';
  159. my $fips_key = $testtext_prefix.'.fips.priv.pem';
  160. my $fips_pub_key = $testtext_prefix.'.fips.pub.pem';
  161. my $a_nonfips_curve = 'brainpoolP256r1';
  162. my $nonfips_key = $testtext_prefix.'.nonfips.priv.pem';
  163. my $nonfips_pub_key = $testtext_prefix.'.nonfips.pub.pem';
  164. my $testtext = '';
  165. my $curvename = '';
  166. plan tests => 5 + $tsignverify_count;
  167. $ENV{OPENSSL_CONF} = $defaultconf;
  168. $curvename = $a_nonfips_curve;
  169. $testtext = $testtext_prefix.': '.
  170. 'Generate a key with a non-FIPS algorithm with the default provider';
  171. ok(run(app(['openssl', 'genpkey', '-algorithm', 'EC',
  172. '-pkeyopt', 'ec_paramgen_curve:'.$curvename,
  173. '-out', $nonfips_key])),
  174. $testtext);
  175. pubfrompriv($testtext_prefix, $nonfips_key, $nonfips_pub_key, "non-FIPS");
  176. $ENV{OPENSSL_CONF} = $fipsconf;
  177. $curvename = $a_fips_curve;
  178. $testtext = $testtext_prefix.': '.
  179. 'Generate a key with a FIPS algorithm';
  180. ok(run(app(['openssl', 'genpkey', '-algorithm', 'EC',
  181. '-pkeyopt', 'ec_paramgen_curve:'.$curvename,
  182. '-out', $fips_key])),
  183. $testtext);
  184. pubfrompriv($testtext_prefix, $fips_key, $fips_pub_key, "FIPS");
  185. $curvename = $a_nonfips_curve;
  186. $testtext = $testtext_prefix.': '.
  187. 'Generate a key with a non-FIPS algorithm'.
  188. ' (should fail)';
  189. ok(!run(app(['openssl', 'genpkey', '-algorithm', 'EC',
  190. '-pkeyopt', 'ec_paramgen_curve:'.$curvename,
  191. '-out', $testtext_prefix.'.'.$curvename.'.priv.pem'])),
  192. $testtext);
  193. tsignverify($testtext_prefix, $fips_key, $fips_pub_key, $nonfips_key,
  194. $nonfips_pub_key);
  195. };
  196. }
  197. SKIP: {
  198. skip "FIPS RSA tests because of no rsa in this build", 1
  199. if disabled("rsa");
  200. subtest RSA => sub {
  201. my $testtext_prefix = 'RSA';
  202. my $fips_key = $testtext_prefix.'.fips.priv.pem';
  203. my $fips_pub_key = $testtext_prefix.'.fips.pub.pem';
  204. my $nonfips_key = $testtext_prefix.'.nonfips.priv.pem';
  205. my $nonfips_pub_key = $testtext_prefix.'.nonfips.pub.pem';
  206. my $testtext = '';
  207. plan tests => 5 + $tsignverify_count;
  208. $ENV{OPENSSL_CONF} = $defaultconf;
  209. $testtext = $testtext_prefix.': '.
  210. 'Generate a key with a non-FIPS algorithm with the default provider';
  211. ok(run(app(['openssl', 'genpkey', '-algorithm', 'RSA',
  212. '-pkeyopt', 'rsa_keygen_bits:512',
  213. '-out', $nonfips_key])),
  214. $testtext);
  215. pubfrompriv($testtext_prefix, $nonfips_key, $nonfips_pub_key, "non-FIPS");
  216. $ENV{OPENSSL_CONF} = $fipsconf;
  217. $testtext = $testtext_prefix.': '.
  218. 'Generate a key with a FIPS algorithm';
  219. ok(run(app(['openssl', 'genpkey', '-algorithm', 'RSA',
  220. '-pkeyopt', 'rsa_keygen_bits:2048',
  221. '-out', $fips_key])),
  222. $testtext);
  223. pubfrompriv($testtext_prefix, $fips_key, $fips_pub_key, "FIPS");
  224. $testtext = $testtext_prefix.': '.
  225. 'Generate a key with a non-FIPS algorithm'.
  226. ' (should fail)';
  227. ok(!run(app(['openssl', 'genpkey', '-algorithm', 'RSA',
  228. '-pkeyopt', 'rsa_keygen_bits:512',
  229. '-out', $testtext_prefix.'.fail.priv.pem'])),
  230. $testtext);
  231. tsignverify($testtext_prefix, $fips_key, $fips_pub_key, $nonfips_key,
  232. $nonfips_pub_key);
  233. };
  234. }
  235. SKIP : {
  236. skip "FIPS DSA tests because of no dsa in this build", 1
  237. if disabled("dsa");
  238. subtest DSA => sub {
  239. my $testtext_prefix = 'DSA';
  240. my $fips_key = $testtext_prefix.'.fips.priv.pem';
  241. my $fips_pub_key = $testtext_prefix.'.fips.pub.pem';
  242. my $nonfips_key = $testtext_prefix.'.nonfips.priv.pem';
  243. my $nonfips_pub_key = $testtext_prefix.'.nonfips.pub.pem';
  244. my $testtext = '';
  245. my $fips_param = $testtext_prefix.'.fips.param.pem';
  246. my $nonfips_param = $testtext_prefix.'.nonfips.param.pem';
  247. my $shortnonfips_param = $testtext_prefix.'.shortnonfips.param.pem';
  248. plan tests => 13 + $tsignverify_count;
  249. $ENV{OPENSSL_CONF} = $defaultconf;
  250. $testtext = $testtext_prefix.': '.
  251. 'Generate non-FIPS params with the default provider';
  252. ok(run(app(['openssl', 'genpkey', '-genparam',
  253. '-algorithm', 'DSA',
  254. '-pkeyopt', 'type:fips186_2',
  255. '-pkeyopt', 'dsa_paramgen_bits:512',
  256. '-out', $nonfips_param])),
  257. $testtext);
  258. $ENV{OPENSSL_CONF} = $fipsconf;
  259. $testtext = $testtext_prefix.': '.
  260. 'Generate FIPS params';
  261. ok(run(app(['openssl', 'genpkey', '-genparam',
  262. '-algorithm', 'DSA',
  263. '-pkeyopt', 'dsa_paramgen_bits:2048',
  264. '-out', $fips_param])),
  265. $testtext);
  266. $testtext = $testtext_prefix.': '.
  267. 'Generate non-FIPS params'.
  268. ' (should fail)';
  269. ok(!run(app(['openssl', 'genpkey', '-genparam',
  270. '-algorithm', 'DSA',
  271. '-pkeyopt', 'dsa_paramgen_bits:512',
  272. '-out', $testtext_prefix.'.fail.param.pem'])),
  273. $testtext);
  274. $testtext = $testtext_prefix.': '.
  275. 'Generate non-FIPS params using non-FIPS property query'.
  276. ' (dsaparam)';
  277. ok(run(app(['openssl', 'dsaparam', '-provider', 'default',
  278. '-propquery', '?fips!=yes',
  279. '-out', $shortnonfips_param, '1024'])),
  280. $testtext);
  281. $testtext = $testtext_prefix.': '.
  282. 'Generate non-FIPS params using non-FIPS property query'.
  283. ' (genpkey)';
  284. ok(run(app(['openssl', 'genpkey', '-provider', 'default',
  285. '-propquery', '?fips!=yes',
  286. '-genparam', '-algorithm', 'DSA',
  287. '-pkeyopt', 'dsa_paramgen_bits:512'])),
  288. $testtext);
  289. $ENV{OPENSSL_CONF} = $defaultconf;
  290. $testtext = $testtext_prefix.': '.
  291. 'Generate a key with non-FIPS params with the default provider';
  292. ok(run(app(['openssl', 'genpkey',
  293. '-paramfile', $nonfips_param,
  294. '-pkeyopt', 'type:fips186_2',
  295. '-out', $nonfips_key])),
  296. $testtext);
  297. pubfrompriv($testtext_prefix, $nonfips_key, $nonfips_pub_key, "non-FIPS");
  298. $ENV{OPENSSL_CONF} = $fipsconf;
  299. $testtext = $testtext_prefix.': '.
  300. 'Generate a key with FIPS parameters';
  301. ok(run(app(['openssl', 'genpkey',
  302. '-paramfile', $fips_param,
  303. '-pkeyopt', 'type:fips186_4',
  304. '-out', $fips_key])),
  305. $testtext);
  306. pubfrompriv($testtext_prefix, $fips_key, $fips_pub_key, "FIPS");
  307. $testtext = $testtext_prefix.': '.
  308. 'Generate a key with non-FIPS parameters'.
  309. ' (should fail)';
  310. ok(!run(app(['openssl', 'genpkey',
  311. '-paramfile', $nonfips_param,
  312. '-pkeyopt', 'type:fips186_2',
  313. '-out', $testtext_prefix.'.fail.priv.pem'])),
  314. $testtext);
  315. $testtext = $testtext_prefix.': '.
  316. 'Generate a key with non-FIPS parameters using non-FIPS property'.
  317. ' query (dsaparam)';
  318. ok(run(app(['openssl', 'dsaparam', '-provider', 'default',
  319. '-propquery', '?fips!=yes',
  320. '-noout', '-genkey', '1024'])),
  321. $testtext);
  322. $testtext = $testtext_prefix.': '.
  323. 'Generate a key with non-FIPS parameters using non-FIPS property'.
  324. ' query (gendsa)';
  325. ok(run(app(['openssl', 'gendsa', '-provider', 'default',
  326. '-propquery', '?fips!=yes',
  327. $shortnonfips_param])),
  328. $testtext);
  329. $testtext = $testtext_prefix.': '.
  330. 'Generate a key with non-FIPS parameters using non-FIPS property'.
  331. ' query (genpkey)';
  332. ok(run(app(['openssl', 'genpkey', '-provider', 'default',
  333. '-propquery', '?fips!=yes',
  334. '-paramfile', $nonfips_param,
  335. '-pkeyopt', 'type:fips186_2',
  336. '-out', $testtext_prefix.'.fail.priv.pem'])),
  337. $testtext);
  338. tsignverify($testtext_prefix, $fips_key, $fips_pub_key, '', '');
  339. };
  340. }