From 26468aea6483135b156fb03a5693c495dbad2e0f Mon Sep 17 00:00:00 2001 From: Bob Beck Date: Wed, 12 Jun 2024 22:27:36 +0000 Subject: Fix test_fips in google3 This makes test_fips build and link even when not building FIPS. (as google3 does). The module hash function is just #defined away to abort() as we won't ever get that far when test_fips is actually run without FIPS. Change-Id: I5d55f0bd1b3f29298aaa6216ebee633e8b4ac6fe Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/69307 Reviewed-by: David Benjamin --- util/fipstools/CMakeLists.txt | 12 +++++------- util/fipstools/test_fips.c | 43 +++++++++++++++++++++++++++---------------- 2 files changed, 32 insertions(+), 23 deletions(-) (limited to 'util') diff --git a/util/fipstools/CMakeLists.txt b/util/fipstools/CMakeLists.txt index 87abf0a..69e1284 100644 --- a/util/fipstools/CMakeLists.txt +++ b/util/fipstools/CMakeLists.txt @@ -1,8 +1,6 @@ -if(FIPS) - add_executable( - test_fips +add_executable( + test_fips - test_fips.c - ) - target_link_libraries(test_fips crypto) -endif() + test_fips.c +) +target_link_libraries(test_fips crypto) diff --git a/util/fipstools/test_fips.c b/util/fipstools/test_fips.c index bb36853..87ef89e 100644 --- a/util/fipstools/test_fips.c +++ b/util/fipstools/test_fips.c @@ -37,7 +37,9 @@ #include "../../crypto/fipsmodule/tls/internal.h" #include "../../crypto/internal.h" +OPENSSL_MSVC_PRAGMA(warning(disable : 4295)) +#if defined(BORINGSSL_FIPS) static void hexdump(const void *a, size_t len) { const unsigned char *in = (const unsigned char *)a; for (size_t i = 0; i < len; i++) { @@ -46,6 +48,7 @@ static void hexdump(const void *a, size_t len) { printf("\n"); } +#endif int main(int argc, char **argv) { // Ensure that the output is line-buffered rather than fully buffered. When @@ -62,17 +65,27 @@ int main(int argc, char **argv) { const uint32_t module_version = FIPS_version(); if (module_version == 0) { printf("No module version set\n"); - goto err; + printf("FAIL\n"); + fflush(stdout); + abort(); } printf("Module: '%s', version: %" PRIu32 " hash:\n", FIPS_module_name(), module_version); -#if !defined(OPENSSL_ASAN) - hexdump(FIPS_module_hash(), SHA256_DIGEST_LENGTH); +#if !defined(BORINGSSL_FIPS) + // |module_version| will be zero, so the non-FIPS build will never get + // this far. + printf("Non zero module version in non-FIPS build - should not happen!\n"); + printf("FAIL\n"); + fflush(stdout); + abort(); +} #else +#if defined(OPENSSL_ASAN) printf("(not available when compiled for ASAN)"); +#else + hexdump(FIPS_module_hash(), SHA256_DIGEST_LENGTH); #endif - printf("\n"); static const uint8_t kAESKey[16] = "BoringCrypto Key"; static const uint8_t kPlaintext[64] = @@ -149,8 +162,8 @@ int main(int argc, char **argv) { printf("About to AES-GCM open "); hexdump(output, out_len); if (!EVP_AEAD_CTX_open(&aead_ctx, output, &out_len, sizeof(output), nonce, - EVP_AEAD_nonce_length(EVP_aead_aes_128_gcm()), - output, out_len, NULL, 0)) { + EVP_AEAD_nonce_length(EVP_aead_aes_128_gcm()), output, + out_len, NULL, 0)) { printf("AES-GCM decrypt failed\n"); goto err; } @@ -178,8 +191,8 @@ int main(int argc, char **argv) { memcpy(&des_iv, &kDESIV, sizeof(des_iv)); printf("About to 3DES-CBC decrypt "); hexdump(kPlaintext, sizeof(kPlaintext)); - DES_ede3_cbc_encrypt(output, output, sizeof(kPlaintext), &des1, - &des2, &des3, &des_iv, DES_DECRYPT); + DES_ede3_cbc_encrypt(output, output, sizeof(kPlaintext), &des1, &des2, &des3, + &des_iv, DES_DECRYPT); printf(" got "); hexdump(output, sizeof(kPlaintext)); @@ -281,9 +294,8 @@ int main(int argc, char **argv) { hexdump(kPlaintextSHA256, sizeof(kPlaintextSHA256)); ECDSA_SIG *sig = ECDSA_do_sign(kPlaintextSHA256, sizeof(kPlaintextSHA256), ec_key); - if (sig == NULL || - !ECDSA_do_verify(kPlaintextSHA256, sizeof(kPlaintextSHA256), sig, - ec_key)) { + if (sig == NULL || !ECDSA_do_verify(kPlaintextSHA256, + sizeof(kPlaintextSHA256), sig, ec_key)) { printf("ECDSA Sign/Verify PWCT failed.\n"); goto err; } @@ -305,7 +317,7 @@ int main(int argc, char **argv) { /* ECDSA with an invalid public key. */ ec_key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); - static const uint8_t kNotValidX926[] = {1,2,3,4,5,6}; + static const uint8_t kNotValidX926[] = {1, 2, 3, 4, 5, 6}; if (!EC_KEY_oct2key(ec_key, kNotValidX926, sizeof(kNotValidX926), /*ctx=*/NULL)) { printf("Error while parsing invalid ECDSA public key\n"); @@ -387,10 +399,8 @@ int main(int argc, char **argv) { /* FFDH */ printf("About to compute FFDH key-agreement:\n"); DH *dh = DH_get_rfc7919_2048(); - uint8_t dh_result[2048/8]; - if (!dh || - !DH_generate_key(dh) || - sizeof(dh_result) != DH_size(dh) || + uint8_t dh_result[2048 / 8]; + if (!dh || !DH_generate_key(dh) || sizeof(dh_result) != DH_size(dh) || DH_compute_key_padded(dh_result, DH_get0_pub_key(dh), dh) != sizeof(dh_result)) { fprintf(stderr, "FFDH failed.\n"); @@ -409,3 +419,4 @@ err: fflush(stdout); abort(); } +#endif // !defined(BORINGSSL_FIPS) -- cgit v1.1