From d9ed13ea67736039c13a786173d44e1ac84d1daa Mon Sep 17 00:00:00 2001 From: Jun Aruga Date: Tue, 7 Nov 2023 14:36:17 +0100 Subject: [PATCH] Fix test_pkey_dh.rb in FIPS. Add dh2048_fips.pem file (DH 2048 bits) in FIPS case, because a logic to generate the pem file in FIPS module is different from the logic in non-FIPS default behavior. Created the DH file with 2048 bits, because the following command failed to generate the DH 1024 bits pem file in FIPS. ``` $ OPENSSL_CONF=/home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/ssl/openssl_fips.cnf \ /home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/bin/openssl dhparam -out dh1024_fips.pem 1024 Generating DH parameters, 1024 bit long safe prime dhparam: Generating DH key parameters failed ``` The dh2048_fips.pem file was created by the following command. ``` $ OPENSSL_CONF=/home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/ssl/openssl_fips.cnf \ /home/jaruga/.local/openssl-3.3.0-dev-fips-debug-1aa08644ec/bin/openssl dhparam -out dh2048_fips.pem 2048 ``` --- Rakefile | 1 + test/openssl/fixtures/pkey/dh2048_fips.pem | 8 ++++ test/openssl/test_pkey_dh.rb | 55 ++++++++++++---------- test/openssl/utils.rb | 12 ++++- 4 files changed, 49 insertions(+), 27 deletions(-) create mode 100644 test/openssl/fixtures/pkey/dh2048_fips.pem diff --git a/Rakefile b/Rakefile index c673a8bc1..5d087ea14 100644 --- a/Rakefile +++ b/Rakefile @@ -29,6 +29,7 @@ Rake::TestTask.new(:test_fips_internal) do |t| t.test_files = FileList[ 'test/openssl/test_fips.rb', 'test/openssl/test_pkey.rb', + 'test/openssl/test_pkey_dh.rb', 'test/openssl/test_pkey_ec.rb', ] t.warning = true diff --git a/test/openssl/fixtures/pkey/dh2048_fips.pem b/test/openssl/fixtures/pkey/dh2048_fips.pem new file mode 100644 index 000000000..9b182b720 --- /dev/null +++ b/test/openssl/fixtures/pkey/dh2048_fips.pem @@ -0,0 +1,8 @@ +-----BEGIN DH PARAMETERS----- +MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz ++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a +87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7 +YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi +7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD +ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg== +-----END DH PARAMETERS----- diff --git a/test/openssl/test_pkey_dh.rb b/test/openssl/test_pkey_dh.rb index 161af1897..bc3a76699 100644 --- a/test/openssl/test_pkey_dh.rb +++ b/test/openssl/test_pkey_dh.rb @@ -5,6 +5,7 @@ class OpenSSL::TestPKeyDH < OpenSSL::PKeyTestCase NEW_KEYLEN = 2048 + KEY_NAME = (OpenSSL.fips_mode) ? "dh2048_fips" : "dh1024" def test_new_empty dh = OpenSSL::PKey::DH.new @@ -18,15 +19,25 @@ def test_new_generate assert_key(dh) end if ENV["OSSL_TEST_ALL"] - def test_new_break + def test_new_break_on_non_fips + omit_on_fips + assert_nil(OpenSSL::PKey::DH.new(NEW_KEYLEN) { break }) assert_raise(RuntimeError) do OpenSSL::PKey::DH.new(NEW_KEYLEN) { raise } end end + def test_new_break_on_fips + omit_on_non_fips + + # The block argument is not executed in FIPS case. + assert(OpenSSL::PKey::DH.new(NEW_KEYLEN) { break }) + assert(OpenSSL::PKey::DH.new(NEW_KEYLEN) { raise }) + end + def test_derive_key - params = Fixtures.pkey("dh1024") + params = Fixtures.pkey(KEY_NAME) dh1 = OpenSSL::PKey.generate_key(params) dh2 = OpenSSL::PKey.generate_key(params) dh1_pub = OpenSSL::PKey.read(dh1.public_to_der) @@ -44,34 +55,28 @@ def test_derive_key end def test_DHparams - dh1024 = Fixtures.pkey("dh1024") - dh1024params = dh1024.public_key + dh = Fixtures.pkey(KEY_NAME) + dh_params = dh.public_key asn1 = OpenSSL::ASN1::Sequence([ - OpenSSL::ASN1::Integer(dh1024.p), - OpenSSL::ASN1::Integer(dh1024.g) + OpenSSL::ASN1::Integer(dh.p), + OpenSSL::ASN1::Integer(dh.g) ]) key = OpenSSL::PKey::DH.new(asn1.to_der) - assert_same_dh dh1024params, key - - pem = <<~EOF - -----BEGIN DH PARAMETERS----- - MIGHAoGBAKnKQ8MNK6nYZzLrrcuTsLxuiJGXoOO5gT+tljOTbHBuiktdMTITzIY0 - pFxIvjG05D7HoBZQfrR0c92NGWPkAiCkhQKB8JCbPVzwNLDy6DZ0pmofDKrEsYHG - AQjjxMXhwULlmuR/K+WwlaZPiLIBYalLAZQ7ZbOPeVkJ8ePao0eLAgEC - -----END DH PARAMETERS----- - EOF + assert_same_dh dh_params, key + + pem = Fixtures.pkey_str(KEY_NAME) key = OpenSSL::PKey::DH.new(pem) - assert_same_dh dh1024params, key + assert_same_dh dh_params, key key = OpenSSL::PKey.read(pem) - assert_same_dh dh1024params, key + assert_same_dh dh_params, key - assert_equal asn1.to_der, dh1024.to_der - assert_equal pem, dh1024.export + assert_equal asn1.to_der, dh.to_der + assert_equal pem, dh.export end def test_public_key - dh = Fixtures.pkey("dh1024") + dh = Fixtures.pkey(KEY_NAME) public_key = dh.public_key assert_no_key(public_key) #implies public_key.public? is false! assert_equal(dh.to_der, public_key.to_der) @@ -80,7 +85,7 @@ def test_public_key def test_generate_key # Deprecated in v3.0.0; incompatible with OpenSSL 3.0 - dh = Fixtures.pkey("dh1024").public_key # creates a copy with params only + dh = Fixtures.pkey(KEY_NAME).public_key # creates a copy with params only assert_no_key(dh) dh.generate_key! assert_key(dh) @@ -91,7 +96,7 @@ def test_generate_key end if !openssl?(3, 0, 0) def test_params_ok? - dh0 = Fixtures.pkey("dh1024") + dh0 = Fixtures.pkey(KEY_NAME) dh1 = OpenSSL::PKey::DH.new(OpenSSL::ASN1::Sequence([ OpenSSL::ASN1::Integer(dh0.p), @@ -108,7 +113,7 @@ def test_params_ok? def test_dup # Parameters only - dh1 = Fixtures.pkey("dh1024") + dh1 = Fixtures.pkey(KEY_NAME) dh2 = dh1.dup assert_equal dh1.to_der, dh2.to_der assert_not_equal nil, dh1.p @@ -125,7 +130,7 @@ def test_dup end # With a key pair - dh3 = OpenSSL::PKey.generate_key(Fixtures.pkey("dh1024")) + dh3 = OpenSSL::PKey.generate_key(Fixtures.pkey(KEY_NAME)) dh4 = dh3.dup assert_equal dh3.to_der, dh4.to_der assert_equal dh1.to_der, dh4.to_der # encodes parameters only @@ -136,7 +141,7 @@ def test_dup end def test_marshal - dh = Fixtures.pkey("dh1024") + dh = Fixtures.pkey(KEY_NAME) deserialized = Marshal.load(Marshal.dump(dh)) assert_equal dh.to_der, deserialized.to_der diff --git a/test/openssl/utils.rb b/test/openssl/utils.rb index cd70d4886..407ee369e 100644 --- a/test/openssl/utils.rb +++ b/test/openssl/utils.rb @@ -16,7 +16,11 @@ module Fixtures module_function def pkey(name) - OpenSSL::PKey.read(read_file("pkey", name)) + OpenSSL::PKey.read(pkey_str(name)) + end + + def pkey_str(name) + read_file("pkey", name) end def read_file(category, name) @@ -151,7 +155,11 @@ def teardown def omit_on_fips return unless OpenSSL.fips_mode - omit 'An encryption used in the test is not FIPS-approved' + omit <<~MESSAGE + Only for OpenSSL non-FIPS with the following possible reasons: + * A testing logic is non-FIPS specific. + * An encryption used in the test is not FIPS-approved. + MESSAGE end def omit_on_non_fips