test: update tests to run with OpenSSL >= 3.0 FIPS mode

Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Author: panva

lib/internal/crypto/webcrypto.js

@@ -1604,6 +1604,7 @@ class SubtleCrypto {
   }
 
   // Implements https://wicg.github.io/webcrypto-modern-algos/#SubtleCrypto-method-supports
+  // TODO(panva): Make supports() account for the active FIPS state.
   static supports(operation, algorithm, lengthOrAdditionalAlgorithm = null) {
     emitExperimentalWarning('The supports Web Crypto API method');
     if (this !== SubtleCrypto) throw new ERR_INVALID_THIS('SubtleCrypto constructor');

test/common/crypto.js

@@ -50,9 +50,14 @@ function assertApproximateSize(key, expectedSize) {
 function testEncryptDecrypt(publicKey, privateKey) {
   const message = 'Hello Node.js world!';
   const plaintext = Buffer.from(message, 'utf8');
+  const withOaepHash = (key) => {
+    if (!hasFIPS(3)) return key;
+    if (key?.key !== undefined) return { ...key, oaepHash: 'sha256' };
+    return { key, oaepHash: 'sha256' };
+  };
   for (const key of [publicKey, privateKey]) {
-    const ciphertext = publicEncrypt(key, plaintext);
-    const received = privateDecrypt(privateKey, ciphertext);
+    const ciphertext = publicEncrypt(withOaepHash(key), plaintext);
+    const received = privateDecrypt(withOaepHash(privateKey), ciphertext);
     assert.strictEqual(received.toString('utf8'), message);
   }
 }
@@ -118,6 +123,10 @@ const hasOpenSSL = (major = 0, minor = 0, patch = 0) => {
   return OPENSSL_VERSION_NUMBER >= opensslVersionNumber(major, minor, patch);
 };
 
+const hasFIPS = (major = 0, minor = 0, patch = 0) => {
+  return crypto.getFips() === 1 && hasOpenSSL(major, minor, patch);
+};
+
 let opensslCli = null;
 
 module.exports = {
@@ -134,6 +143,7 @@ module.exports = {
   sec1Exp,
   sec1EncExp,
   hasOpenSSL,
+  hasFIPS,
   get hasOpenSSL3() {
     return hasOpenSSL(3);
   },

test/fixtures/keys/Makefile

@@ -8,6 +8,7 @@ all: \
   ca5-cert.pem \
   ca6-cert.pem \
   agent1-cert.pem \
+  agent1-fips.pfx \
   agent1.pfx \
   agent2-cert.pem \
   agent3-cert.pem \
@@ -39,6 +40,7 @@ all: \
   dsa_private_encrypted_1025.pem \
   dsa_public_1025.pem \
   ec-cert.pem \
+  ec-fips.pfx \
   ec.pfx \
   fake-cnnic-root-cert.pem \
   intermediate-ca-cert.pem \
@@ -444,6 +446,20 @@ agent1.pfx: agent1-cert.pem agent1-key.pem ca1-cert.pem
 		-out agent1.pfx \
 		-password pass:sample
 
+# PKCS12KDF is unavailable under FIPS properties. Use PBMAC1 with PBKDF2
+# instead, alongside AES-256/PBKDF2 key protection.
+agent1-fips.pfx: agent1-cert.pem agent1-key.pem ca1-cert.pem
+	openssl pkcs12 -export \
+		-keypbe AES-256-CBC \
+		-certpbe AES-256-CBC \
+		-iter 2048 \
+		-pbmac1_pbkdf2 \
+		-in agent1-cert.pem \
+		-inkey agent1-key.pem \
+		-certfile ca1-cert.pem \
+		-out agent1-fips.pfx \
+		-password pass:password
+
 agent1-verify: agent1-cert.pem ca1-cert.pem
 	openssl verify -CAfile ca1-cert.pem agent1-cert.pem
 
@@ -787,6 +803,18 @@ ec.pfx: ec-cert.pem ec-key.pem
 		-out ec.pfx \
 		-password pass:
 
+# See agent1-fips.pfx for why the FIPS fixture uses PBMAC1.
+ec-fips.pfx: ec-cert.pem ec-key.pem
+	openssl pkcs12 -export \
+		-keypbe AES-256-CBC \
+		-certpbe AES-256-CBC \
+		-iter 2048 \
+		-pbmac1_pbkdf2 \
+		-in ec-cert.pem \
+		-inkey ec-key.pem \
+		-out ec-fips.pfx \
+		-password pass:password
+
 dh512.pem:
 	openssl dhparam -out dh512.pem 512
 

test/fixtures/keys/agent1-fips.pfx

@@ -3,12 +3,14 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 const assert = require('assert');
 const util = require('util');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
 
+const fips3 = hasFIPS(3);
+
 function test(
   publicFixture,
   privateFixture,
@@ -65,6 +67,15 @@ function test(
   }
 }
 
+function testSignFailure(privateFixture, algorithm, options, code) {
+  const key = { key: fixtures.readKey(privateFixture), ...options };
+  const data = Buffer.from('Hello world');
+  assert.throws(() => crypto.sign(algorithm, data, key), { code });
+  crypto.sign(algorithm, data, key, common.mustCall((err) => {
+    assert.strictEqual(err?.code, code);
+  }));
+}
+
 // RSA w/ default padding
 test('rsa_public.pem', 'rsa_private.pem', 'sha256', true);
 test('rsa_public.pem', 'rsa_private.pem', 'sha256', true,
@@ -94,14 +105,19 @@ if (!process.features.openssl_is_boringssl) {
   test('ed448_public.pem', 'ed448_private.pem', undefined, true);
 
   // ECDSA w/ der signature encoding
-  test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
-       false);
-  test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
-       false, { dsaEncoding: 'der' });
-
-  // ECDSA w/ ieee-p1363 signature encoding
-  test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384', false,
-       { dsaEncoding: 'ieee-p1363' });
+  if (fips3) {
+    testSignFailure('ec_secp256k1_private.pem', 'sha384', {},
+                    'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE');
+  } else {
+    test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
+         false);
+    test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
+         false, { dsaEncoding: 'der' });
+
+    // ECDSA w/ ieee-p1363 signature encoding
+    test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384', false,
+         { dsaEncoding: 'ieee-p1363' });
+  }
 
   // DSA w/ der signature encoding
   test('dsa_public.pem', 'dsa_private.pem', 'sha256',
@@ -157,7 +173,7 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
 
   let expected = /no default digest/;
   let expectedCode = 'ERR_OSSL_EVP_NO_DEFAULT_DIGEST';
-  if (hasOpenSSL3 || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3) || process.features.openssl_is_boringssl) {
     expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
     expectedCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
   }
@@ -170,12 +186,21 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
 }
 
 {
-  const { privateKey } = crypto.generateKeyPairSync('rsa', {
-    modulusLength: 512
-  });
-  crypto.sign('sha512', 'message', privateKey, common.mustCall((err) => {
-    assert.ok(err);
-    assert.match(err.message, /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i);
-    assert.match(err.code, /^ERR_OSSL_.*DIGEST_TOO_BIG_FOR_RSA_KEY$/);
-  }));
+  if (fips3) {
+    crypto.generateKeyPair('rsa', { modulusLength: 512 },
+                           common.mustCall((err) => {
+                             assert.strictEqual(
+                               err?.code, 'ERR_OSSL_RSA_INVALID_MODULUS');
+                           }));
+  } else {
+    const { privateKey } = crypto.generateKeyPairSync('rsa', {
+      modulusLength: 512
+    });
+    crypto.sign('sha512', 'message', privateKey, common.mustCall((err) => {
+      assert.ok(err);
+      assert.match(
+        err.message, /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i);
+      assert.match(err.code, /^ERR_OSSL_.*DIGEST_TOO_BIG_FOR_RSA_KEY$/);
+    }));
+  }
 }

test/fixtures/keys/ec-fips.pfx

@@ -6,6 +6,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const fs = require('fs');
 const stream = require('stream');
 const tmpdir = require('../common/tmpdir');
@@ -120,6 +121,16 @@ function test(config) {
     return;
   }
 
+  if (hasFIPS(3)) {
+    assert.throws(() => crypto.createDecipheriv(
+      config.cipher, config.key, config.iv, {
+        authTagLength: config.authTagLength,
+      }), {
+      code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+    });
+    return;
+  }
+
   direct(config);
   mstream(config);
   fstream(config);

test/parallel/test-crypto-async-sign-verify.js

@@ -29,9 +29,10 @@ const assert = require('assert');
 const crypto = require('crypto');
 const { inspect } = require('util');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
-const isFipsEnabled = crypto.getFips();
+const isFipsEnabled = crypto.getFips() === 1;
+const fips3 = hasFIPS(3);
 
 //
 // Test authenticated encryption modes.
@@ -559,6 +560,14 @@ for (const test of TEST_CASES) {
     const ciphertext = Buffer.concat([cipher.update(plain), cipher.final()]);
     const tag = cipher.getAuthTag();
 
+    if (fips3 && mode === 'ccm') {
+      assert.throws(() => crypto.createDecipheriv(
+        `aes-128-${mode}`, key, iv, opts), {
+        code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+      });
+      continue;
+    }
+
     const decipher = crypto.createDecipheriv(`aes-128-${mode}`, key, iv, opts);
     decipher.setAuthTag(tag);
     assert.throws(() => {
@@ -636,15 +645,22 @@ for (const test of TEST_CASES) {
     const cipher = crypto.createCipheriv('aes-128-ccm', key, iv, opts);
     assert.throws(() => {
       cipher.final();
-    }, hasOpenSSL3 ? {
+    }, hasOpenSSL(3) ? {
       code: 'ERR_OSSL_TAG_NOT_SET'
     } : {
       message: /Unsupported state/
     });
   }
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (fips3) {
+  assert.throws(() => crypto.createCipheriv(
+    'chacha20-poly1305', Buffer.alloc(32), Buffer.alloc(12), {
+      authTagLength: 16,
+    }), {
+    code: 'ERR_OSSL_EVP_UNSUPPORTED',
+  });
+} else if (!process.features.openssl_is_boringssl) {
   const key = Buffer.alloc(32);
   const iv = Buffer.alloc(12);
 
@@ -662,7 +678,7 @@ if (!process.features.openssl_is_boringssl) {
 
 // ChaCha20-Poly1305 should respect the authTagLength option and should not
 // require the authentication tag before calls to update() during decryption.
-if (!process.features.openssl_is_boringssl) {
+if (!fips3 && !process.features.openssl_is_boringssl) {
   const key = Buffer.alloc(32);
   const iv = Buffer.alloc(12);
 
@@ -713,7 +729,7 @@ if (!process.features.openssl_is_boringssl) {
 // shorter tags as long as their length was valid according to NIST SP 800-38D.
 // For ChaCha20-Poly1305, we intentionally deviate from that because there are
 // no recommended or approved authentication tag lengths below 16 bytes.
-if (!process.features.openssl_is_boringssl) {
+if (!fips3 && !process.features.openssl_is_boringssl) {
   const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => {
     return algo === 'chacha20-poly1305' && tampered === false;
   });
@@ -752,7 +768,7 @@ if (!process.features.openssl_is_boringssl) {
 }
 
 // https://github.com/nodejs/node/issues/45874
-if (!process.features.openssl_is_boringssl) {
+if (!fips3 && !process.features.openssl_is_boringssl) {
   const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => {
     return algo === 'chacha20-poly1305' && tampered === false;
   });
@@ -798,13 +814,20 @@ if (ciphers.includes('aes-128-ccm')) {
   const tag = cipher.getAuthTag();
   assert.strictEqual(tag.length, 16);
 
-  const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
-    authTagLength: 16,
-  });
-  decipher.setAuthTag(tag);
-  decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
-  decipher.update(new DataView(new ArrayBuffer(0)));
-  decipher.final();
+  if (fips3) {
+    assert.throws(() => crypto.createDecipheriv(
+      'aes-128-ccm', key, nonce, { authTagLength: 16 }), {
+      code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+    });
+  } else {
+    const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+      authTagLength: 16,
+    });
+    decipher.setAuthTag(tag);
+    decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+    decipher.update(new DataView(new ArrayBuffer(0)));
+    decipher.final();
+  }
 } else {
   common.printSkipMessage('Skipping unsupported aes-128-ccm test');
 }

test/parallel/test-crypto-authenticated-stream.js

@@ -26,6 +26,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const { Certificate } = crypto;
 const fixtures = require('../common/fixtures');
 
@@ -42,7 +43,7 @@ function copyArrayBuffer(buf) {
 function checkMethods(certificate) {
 
   if (!process.features.openssl_is_boringssl)
-    assert.strictEqual(certificate.verifySpkac(spkacValid), true);
+    assert.strictEqual(certificate.verifySpkac(spkacValid), !hasFIPS(3));
   assert.strictEqual(certificate.verifySpkac(spkacFail), false);
 
   assert.strictEqual(
@@ -59,9 +60,10 @@ function checkMethods(certificate) {
 
   if (!process.features.openssl_is_boringssl) {
     const ab = copyArrayBuffer(spkacValid);
-    assert.strictEqual(certificate.verifySpkac(ab), true);
-    assert.strictEqual(certificate.verifySpkac(new Uint8Array(ab)), true);
-    assert.strictEqual(certificate.verifySpkac(new DataView(ab)), true);
+    const expected = !hasFIPS(3);
+    assert.strictEqual(certificate.verifySpkac(ab), expected);
+    assert.strictEqual(certificate.verifySpkac(new Uint8Array(ab)), expected);
+    assert.strictEqual(certificate.verifySpkac(new DataView(ab)), expected);
   }
 }