mirror of
https://github.com/openssl/openssl.git
synced 2025-01-12 13:36:28 +08:00
36fc5fc6bd
Added an API to optionally set a self test callback. The callback has the following 2 purposes (1) Output information about the KAT tests. (2) Allow the ability to corrupt one of the KAT's The fipsinstall program uses the API. Some KATS are not included in this PR since the required functionality did not yet exist in the provider. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10374)
95 lines
3.8 KiB
Perl
95 lines
3.8 KiB
Perl
#! /usr/bin/env perl
|
|
# Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License 2.0 (the "License"). You may not use
|
|
# this file except in compliance with the License. You can obtain a copy
|
|
# in the file LICENSE in the source distribution or at
|
|
# https://www.openssl.org/source/license.html
|
|
|
|
use strict;
|
|
use warnings;
|
|
|
|
use File::Spec;
|
|
use File::Copy;
|
|
use OpenSSL::Glob;
|
|
use OpenSSL::Test qw/:DEFAULT srctop_dir bldtop_dir bldtop_file/;
|
|
use OpenSSL::Test::Utils;
|
|
|
|
BEGIN {
|
|
setup("test_fipsinstall");
|
|
}
|
|
use lib srctop_dir('Configurations');
|
|
use lib bldtop_dir('.');
|
|
use platform;
|
|
|
|
plan skip_all => "Test only supported in a fips build" if disabled("fips");
|
|
|
|
plan tests => 9;
|
|
|
|
my $infile = bldtop_file('providers', platform->dso('fips'));
|
|
$ENV{OPENSSL_MODULES} = bldtop_dir("providers");
|
|
|
|
# fail if no module name
|
|
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module',
|
|
'-provider_name', 'fips',
|
|
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
|
|
'-section_name', 'fips_install'])),
|
|
"fipsinstall fail");
|
|
|
|
# fail to verify if the configuration file is missing
|
|
ok(!run(app(['openssl', 'fipsinstall', '-in', 'dummy.tmp', '-module', $infile,
|
|
'-provider_name', 'fips', '-mac_name', 'HMAC',
|
|
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
|
|
'-section_name', 'fips_install', '-verify'])),
|
|
"fipsinstall verify fail");
|
|
|
|
|
|
# output a fips.conf file containing mac data
|
|
ok(run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile,
|
|
'-provider_name', 'fips', '-mac_name', 'HMAC',
|
|
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
|
|
'-section_name', 'fips_install'])),
|
|
"fipsinstall");
|
|
|
|
# verify the fips.conf file
|
|
ok(run(app(['openssl', 'fipsinstall', '-in', 'fips.conf', '-module', $infile,
|
|
'-provider_name', 'fips', '-mac_name', 'HMAC',
|
|
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
|
|
'-section_name', 'fips_install', '-verify'])),
|
|
"fipsinstall verify");
|
|
|
|
# fail to verify the fips.conf file if a different key is used
|
|
ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.conf', '-module', $infile,
|
|
'-provider_name', 'fips', '-mac_name', 'HMAC',
|
|
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:01',
|
|
'-section_name', 'fips_install', '-verify'])),
|
|
"fipsinstall verify fail bad key");
|
|
|
|
# fail to verify the fips.conf file if a different mac digest is used
|
|
ok(!run(app(['openssl', 'fipsinstall', '-in', 'fips.conf', '-module', $infile,
|
|
'-provider_name', 'fips', '-mac_name', 'HMAC',
|
|
'-macopt', 'digest:SHA512', '-macopt', 'hexkey:00',
|
|
'-section_name', 'fips_install', '-verify'])),
|
|
"fipsinstall verify fail incorrect digest");
|
|
|
|
# corrupt the module hmac
|
|
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile,
|
|
'-provider_name', 'fips', '-mac_name', 'HMAC',
|
|
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
|
|
'-section_name', 'fips_install', '-corrupt_desc', 'HMAC'])),
|
|
"fipsinstall fails when the module integrity is corrupted");
|
|
|
|
# corrupt the first digest
|
|
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile,
|
|
'-provider_name', 'fips', '-mac_name', 'HMAC',
|
|
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
|
|
'-section_name', 'fips_install', '-corrupt_desc', 'SHA1'])),
|
|
"fipsinstall fails when the digest result is corrupted");
|
|
|
|
# corrupt another digest
|
|
ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.conf', '-module', $infile,
|
|
'-provider_name', 'fips', '-mac_name', 'HMAC',
|
|
'-macopt', 'digest:SHA256', '-macopt', 'hexkey:00',
|
|
'-section_name', 'fips_install', '-corrupt_desc', 'SHA3'])),
|
|
"fipsinstall fails when the digest result is corrupted");
|