2 # Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
15 use OpenSSL::Test qw/:DEFAULT srctop_dir bldtop_dir bldtop_file/;
16 use OpenSSL::Test::Utils;
19 setup("test_fipsinstall");
21 use lib srctop_dir('Configurations');
22 use lib bldtop_dir('.');
25 plan skip_all => "Test only supported in a fips build" if disabled("fips");
29 my $infile = bldtop_file('providers', platform->dso('fips'));
31 # fail if no module name
32 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module',
33 '-provider_name', 'fips',
34 '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
35 '-section_name', 'fips_install'])),
38 # fail to verify if the configuration file is missing
39 ok(!run(app(['openssl', 'fipsinstall', '-in', 'dummy.tmp', '-module', $infile,
40 '-provider_name', 'fips', '-mac_name', 'HMAC',
41 '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
42 '-section_name', 'fips_install', '-verify'])),
43 "fipsinstall verify fail");
46 # output a fips.cnf file containing mac data
47 ok(run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
48 '-provider_name', 'fips', '-mac_name', 'HMAC',
49 '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
50 '-section_name', 'fips_install'])),
53 # verify the fips.cnf file
54 ok(run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
55 '-provider_name', 'fips', '-mac_name', 'HMAC',
56 '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
57 '-section_name', 'fips_install', '-verify'])),
58 "fipsinstall verify");
60 # fail to verify the fips.cnf file if a different key is used
61 ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
62 '-provider_name', 'fips', '-mac_name', 'HMAC',
63 '-macopt', 'digest:SHA256', '-macopt', 'hexkey:01',
64 '-section_name', 'fips_install', '-verify'])),
65 "fipsinstall verify fail bad key");
67 # fail to verify the fips.cnf file if a different mac digest is used
68 ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.cnf', '-module', $infile,
69 '-provider_name', 'fips', '-mac_name', 'HMAC',
70 '-macopt', 'digest:SHA512', '-macopt', 'hexkey:00',
71 '-section_name', 'fips_install', '-verify'])),
72 "fipsinstall verify fail incorrect digest");
74 # corrupt the module hmac
75 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
76 '-provider_name', 'fips', '-mac_name', 'HMAC',
77 '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
78 '-section_name', 'fips_install', '-corrupt_desc', 'HMAC'])),
79 "fipsinstall fails when the module integrity is corrupted");
81 # corrupt the first digest
82 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
83 '-provider_name', 'fips', '-mac_name', 'HMAC',
84 '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
85 '-section_name', 'fips_install', '-corrupt_desc', 'SHA1'])),
86 "fipsinstall fails when the digest result is corrupted");
88 # corrupt another digest
89 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
90 '-provider_name', 'fips', '-mac_name', 'HMAC',
91 '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
92 '-section_name', 'fips_install', '-corrupt_desc', 'SHA3'])),
93 "fipsinstall fails when the digest result is corrupted");
96 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
97 '-provider_name', 'fips', '-mac_name', 'HMAC',
98 '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
99 '-section_name', 'fips_install', '-corrupt_desc', 'CTR'])),
100 "fipsinstall fails when the DRBG CTR result is corrupted");
104 skip "Skipping KAS DH corruption test because of no dh in this build", 1
107 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile,
108 '-provider_name', 'fips', '-mac_name', 'HMAC',
109 '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
110 '-section_name', 'fips_install',
111 '-corrupt_desc', 'DH',
112 '-corrupt_type', 'KAT_KA'])),
113 "fipsinstall fails when the kas result is corrupted");
116 # corrupt a Signature test
118 skip "Skipping Signature DSA corruption test because of no dsa in this build", 1
120 ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile,
121 '-provider_name', 'fips', '-mac_name', 'HMAC',
122 '-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
123 '-section_name', 'fips_install',
124 '-corrupt_desc', 'DSA',
125 '-corrupt_type', 'KAT_Signature'])),
126 "fipsinstall fails when the signature result is corrupted");