|
| 1 | +'use strict'; |
| 2 | +var common = require('../common'); |
| 3 | +var assert = require('assert'); |
| 4 | +var spawnSync = require('child_process').spawnSync; |
| 5 | +var path = require('path'); |
| 6 | + |
| 7 | +if (!common.hasCrypto) { |
| 8 | + console.log('1..0 # Skipped: missing crypto'); |
| 9 | + return; |
| 10 | +} |
| 11 | + |
| 12 | +const FIPS_ENABLED = 1; |
| 13 | +const FIPS_DISABLED = 0; |
| 14 | +const FIPS_ERROR_STRING = 'Error: Cannot set FIPS mode'; |
| 15 | +const OPTION_ERROR_STRING = 'bad option'; |
| 16 | +const CNF_FIPS_ON = path.join(common.fixturesDir, 'openssl_fips_enabled.cnf'); |
| 17 | +const CNF_FIPS_OFF = path.join(common.fixturesDir, 'openssl_fips_disabled.cnf'); |
| 18 | +var num_children_ok = 0; |
| 19 | + |
| 20 | +function compiledWithFips() { |
| 21 | + return process.config.variables.openssl_fips ? true : false; |
| 22 | +} |
| 23 | + |
| 24 | +function addToEnv(newVar, value) { |
| 25 | + var envCopy = {}; |
| 26 | + for (const e in process.env) { |
| 27 | + envCopy[e] = process.env[e]; |
| 28 | + } |
| 29 | + envCopy[newVar] = value; |
| 30 | + return envCopy; |
| 31 | +} |
| 32 | + |
| 33 | +function testHelper(stream, args, expectedOutput, cmd, env) { |
| 34 | + const fullArgs = args.concat(['-e', 'console.log(' + cmd + ')']); |
| 35 | + const child = spawnSync(process.execPath, fullArgs, { |
| 36 | + cwd: path.dirname(process.execPath), |
| 37 | + env: env |
| 38 | + }); |
| 39 | + |
| 40 | + console.error('Spawned child [pid:' + child.pid + '] with cmd ' + |
| 41 | + cmd + ' and args \'' + args + '\''); |
| 42 | + |
| 43 | + function childOk(child) { |
| 44 | + console.error('Child #' + ++num_children_ok + |
| 45 | + ' [pid:' + child.pid + '] OK.'); |
| 46 | + } |
| 47 | + |
| 48 | + function responseHandler(buffer, expectedOutput) { |
| 49 | + const response = buffer.toString(); |
| 50 | + assert.notEqual(0, response.length); |
| 51 | + if (FIPS_ENABLED !== expectedOutput && FIPS_DISABLED !== expectedOutput) { |
| 52 | + // In the case of expected errors just look for a substring. |
| 53 | + assert.notEqual(-1, response.indexOf(expectedOutput)); |
| 54 | + } else { |
| 55 | + // Normal path where we expect either FIPS enabled or disabled. |
| 56 | + assert.equal(expectedOutput, response); |
| 57 | + } |
| 58 | + childOk(child); |
| 59 | + } |
| 60 | + |
| 61 | + responseHandler(child[stream], expectedOutput); |
| 62 | +} |
| 63 | + |
| 64 | +// By default FIPS should be off in both FIPS and non-FIPS builds. |
| 65 | +testHelper( |
| 66 | + 'stdout', |
| 67 | + [], |
| 68 | + FIPS_DISABLED, |
| 69 | + 'require("crypto").fips', |
| 70 | + addToEnv('OPENSSL_CONF', '')); |
| 71 | + |
| 72 | +// --enable-fips should turn FIPS mode on |
| 73 | +testHelper( |
| 74 | + compiledWithFips() ? 'stdout' : 'stderr', |
| 75 | + ['--enable-fips'], |
| 76 | + compiledWithFips() ? FIPS_ENABLED : OPTION_ERROR_STRING, |
| 77 | + 'require("crypto").fips', |
| 78 | + process.env); |
| 79 | + |
| 80 | +//--force-fips should turn FIPS mode on |
| 81 | +testHelper( |
| 82 | + compiledWithFips() ? 'stdout' : 'stderr', |
| 83 | + ['--force-fips'], |
| 84 | + compiledWithFips() ? FIPS_ENABLED : OPTION_ERROR_STRING, |
| 85 | + 'require("crypto").fips', |
| 86 | + process.env); |
| 87 | + |
| 88 | +// OpenSSL config file should be able to turn on FIPS mode |
| 89 | +testHelper( |
| 90 | + 'stdout', |
| 91 | + [], |
| 92 | + compiledWithFips() ? FIPS_ENABLED : FIPS_DISABLED, |
| 93 | + 'require("crypto").fips', |
| 94 | + addToEnv('OPENSSL_CONF', CNF_FIPS_ON)); |
| 95 | + |
| 96 | +// --enable-fips should take precedence over OpenSSL config file |
| 97 | +testHelper( |
| 98 | + compiledWithFips() ? 'stdout' : 'stderr', |
| 99 | + ['--enable-fips'], |
| 100 | + compiledWithFips() ? FIPS_ENABLED : OPTION_ERROR_STRING, |
| 101 | + 'require("crypto").fips', |
| 102 | + addToEnv('OPENSSL_CONF', CNF_FIPS_OFF)); |
| 103 | + |
| 104 | +// --force-fips should take precedence over OpenSSL config file |
| 105 | +testHelper( |
| 106 | + compiledWithFips() ? 'stdout' : 'stderr', |
| 107 | + ['--force-fips'], |
| 108 | + compiledWithFips() ? FIPS_ENABLED : OPTION_ERROR_STRING, |
| 109 | + 'require("crypto").fips', |
| 110 | + addToEnv('OPENSSL_CONF', CNF_FIPS_OFF)); |
| 111 | + |
| 112 | +// setFipsCrypto should be able to turn FIPS mode on |
| 113 | +testHelper( |
| 114 | + compiledWithFips() ? 'stdout' : 'stderr', |
| 115 | + [], |
| 116 | + compiledWithFips() ? FIPS_ENABLED : FIPS_ERROR_STRING, |
| 117 | + '(require("crypto").fips = true,' + |
| 118 | + 'require("crypto").fips)', |
| 119 | + addToEnv('OPENSSL_CONF', '')); |
| 120 | + |
| 121 | +// setFipsCrypto should be able to turn FIPS mode on and off |
| 122 | +testHelper( |
| 123 | + compiledWithFips() ? 'stdout' : 'stderr', |
| 124 | + [], |
| 125 | + compiledWithFips() ? FIPS_DISABLED : FIPS_ERROR_STRING, |
| 126 | + '(require("crypto").fips = true,' + |
| 127 | + 'require("crypto").fips = false,' + |
| 128 | + 'require("crypto").fips)', |
| 129 | + addToEnv('OPENSSL_CONF', '')); |
| 130 | + |
| 131 | +// setFipsCrypto takes precedence over OpenSSL config file, FIPS on |
| 132 | +testHelper( |
| 133 | + compiledWithFips() ? 'stdout' : 'stderr', |
| 134 | + [], |
| 135 | + compiledWithFips() ? FIPS_ENABLED : FIPS_ERROR_STRING, |
| 136 | + '(require("crypto").fips = true,' + |
| 137 | + 'require("crypto").fips)', |
| 138 | + addToEnv('OPENSSL_CONF', CNF_FIPS_OFF)); |
| 139 | + |
| 140 | +// setFipsCrypto takes precedence over OpenSSL config file, FIPS off |
| 141 | +testHelper( |
| 142 | + compiledWithFips() ? 'stdout' : 'stderr', |
| 143 | + [], |
| 144 | + compiledWithFips() ? FIPS_DISABLED : FIPS_ERROR_STRING, |
| 145 | + '(require("crypto").fips = false,' + |
| 146 | + 'require("crypto").fips)', |
| 147 | + addToEnv('OPENSSL_CONF', CNF_FIPS_ON)); |
| 148 | + |
| 149 | +// --enable-fips does not prevent use of setFipsCrypto API |
| 150 | +testHelper( |
| 151 | + compiledWithFips() ? 'stdout' : 'stderr', |
| 152 | + ['--enable-fips'], |
| 153 | + compiledWithFips() ? FIPS_DISABLED : OPTION_ERROR_STRING, |
| 154 | + '(require("crypto").fips = false,' + |
| 155 | + 'require("crypto").fips)', |
| 156 | + process.env); |
| 157 | + |
| 158 | +// --force-fips prevents use of setFipsCrypto API |
| 159 | +testHelper( |
| 160 | + 'stderr', |
| 161 | + ['--force-fips'], |
| 162 | + compiledWithFips() ? FIPS_ERROR_STRING : OPTION_ERROR_STRING, |
| 163 | + 'require("crypto").fips = false', |
| 164 | + process.env); |
| 165 | + |
| 166 | +// --force-fips and --enable-fips order does not matter |
| 167 | +testHelper( |
| 168 | + 'stderr', |
| 169 | + ['--force-fips', '--enable-fips'], |
| 170 | + compiledWithFips() ? FIPS_ERROR_STRING : OPTION_ERROR_STRING, |
| 171 | + 'require("crypto").fips = false', |
| 172 | + process.env); |
| 173 | + |
| 174 | +//--enable-fips and --force-fips order does not matter |
| 175 | +testHelper( |
| 176 | + 'stderr', |
| 177 | + ['--enable-fips', '--force-fips'], |
| 178 | + compiledWithFips() ? FIPS_ERROR_STRING : OPTION_ERROR_STRING, |
| 179 | + 'require("crypto").fips = false', |
| 180 | + process.env); |
0 commit comments