Skip to content

Commit 11a4fc6

Browse files
mbrozmbroz
committed
tests: use utility to detect FIPS mode
Also try to use crypto lib/kernel check where appropriate. This can be useful for local testing (non-FIPS kernel) byt should not break real FIPS systems.
1 parent e4c498d commit 11a4fc6

12 files changed

Lines changed: 25 additions & 60 deletions

‎tests/00modules-test‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ if [ "$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)" = "1" ] ; then
1717
echo "Kernel running in FIPS mode."
1818
fi
1919

20+
./crypto-check fips_mode && echo "Crypto backend running in FIPS mode."
21+
./crypto-check fips_mode_kernel && echo "Kernel running in FIPS mode."
22+
2023
if [ -f /etc/os-release ] ; then
2124
source /etc/os-release
2225
echo "$PRETTY_NAME ($NAME) $VERSION"

‎tests/align-test‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@ PWD1="93R4P4pIqAH8"
1010
PWD2="mymJeD8ivEhE"
1111
FAST_PBKDF="--pbkdf-force-iterations 1000"
1212

13-
FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)
14-
1513
if [ -n "$CRYPTSETUP_TESTS_RUN_IN_MESON" ]; then
1614
CRYPTSETUP_VALGRIND=$CRYPTSETUP
1715
else
@@ -22,7 +20,7 @@ fi
2220

2321
fips_mode()
2422
{
25-
[ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ]
23+
./crypto-check fips_mode
2624
}
2725

2826
cleanup() {

‎tests/api-test.c‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@
6464
#define LUKS_PHDR_SIZE_B 1024
6565

6666
static int _fips_mode = 0;
67+
static int _fips_mode_kernel = 0;
6768

6869
static char *DEVICE_1 = NULL;
6970
static char *DEVICE_2 = NULL;
@@ -293,8 +294,9 @@ static int _setup(void)
293294
return 1;
294295

295296
_fips_mode = fips_mode();
297+
_fips_mode_kernel = fips_mode_kernel();
296298
if (_debug)
297-
printf("FIPS MODE: %d\n", _fips_mode);
299+
printf("FIPS MODE: LIB %d, KERNEL %d\n", _fips_mode, _fips_mode_kernel);
298300

299301
/* Use default log callback */
300302
crypt_set_log_callback(NULL, &global_log_callback, NULL);
@@ -1833,7 +1835,7 @@ static void TcryptTest(void)
18331835
CRYPT_FREE(cd);
18341836

18351837
// Following test uses non-FIPS algorithms in the cipher chain
1836-
if(_fips_mode)
1838+
if(_fips_mode || _fips_mode_kernel)
18371839
return;
18381840

18391841
OK_(crypt_init(&cd, tcrypt_dev2));

‎tests/api_test.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ int t_dm_capi_string_supported(void);
3131
int t_set_readahead(const char *device, unsigned value);
3232

3333
int fips_mode(void);
34+
int fips_mode_kernel(void);
3435

3536
int create_dmdevice_over_device(const char *dm_name, const char *device, uint64_t size, uint64_t offset);
3637

‎tests/compat-test‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,6 @@ KEY_MATERIAL5_EXT="S331776-395264"
5050
TEST_UUID="12345678-1234-1234-1234-123456789abc"
5151

5252
LOOPDEV=$(losetup -f 2>/dev/null)
53-
FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)
5453

5554
remove_mapping()
5655
{
@@ -83,7 +82,7 @@ trap _sigchld CHLD
8382

8483
fips_mode()
8584
{
86-
[ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ]
85+
./crypto-check fips_mode
8786
}
8887

8988
can_fail_fips()

‎tests/compat-test-opal‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,6 @@ FAST_PBKDF_OPT="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
4242

4343
TEST_UUID="12345678-1234-1234-1234-123456789abc"
4444

45-
FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)
46-
4745
remove_mapping()
4846
{
4947
[ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove --retry $DEV_NAME2
@@ -73,7 +71,7 @@ trap _sigchld CHLD
7371

7472
fips_mode()
7573
{
76-
[ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ]
74+
./crypto-check fips_mode
7775
}
7876

7977
can_fail_fips()

‎tests/compat-test2‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ FAST_PBKDF_OPT="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
4848
TEST_UUID="12345678-1234-1234-1234-123456789abc"
4949

5050
LOOPDEV=$(losetup -f 2>/dev/null)
51-
FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)
5251

5352
remove_mapping()
5453
{
@@ -88,7 +87,7 @@ trap _sigchld CHLD
8887

8988
fips_mode()
9089
{
91-
[ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ]
90+
./crypto-check fips_mode
9291
}
9392

9493
can_fail_fips()

‎tests/crypto-vectors.c‎

Lines changed: 3 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,6 @@
1818
# define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
1919
#endif
2020

21-
static bool fips_active = false;
22-
2321
static void printhex(const char *s, const char *buf, size_t len)
2422
{
2523
size_t i;
@@ -31,24 +29,6 @@ static void printhex(const char *s, const char *buf, size_t len)
3129
fflush(stdout);
3230
}
3331

34-
static bool fips_mode(void)
35-
{
36-
int fd;
37-
char buf = 0;
38-
39-
fd = open("/proc/sys/crypto/fips_enabled", O_RDONLY);
40-
41-
if (fd < 0)
42-
return false;
43-
44-
if (read(fd, &buf, 1) != 1)
45-
buf = '0';
46-
47-
close(fd);
48-
49-
return (buf == '1');
50-
}
51-
5232
/*
5333
* KDF tests
5434
*/
@@ -1043,7 +1023,7 @@ static int pbkdf_test_vectors(void)
10431023
vec->salt, vec->salt_length,
10441024
result, vec->output_length,
10451025
vec->iterations, vec->memory, vec->parallelism) < 0) {
1046-
if (vec->can_fail_fips && fips_mode()) {
1026+
if (vec->can_fail_fips && crypt_fips_mode()) {
10471027
printf("[API FAILED, IGNORED (FIPS mode)]\n");
10481028
continue;
10491029
}
@@ -1552,7 +1532,7 @@ static int kernel_capi_check_test(void)
15521532
if (!r)
15531533
printf("[OK]\n");
15541534
else if (r == -ENOENT || r == -ENOTSUP ||
1555-
(fips_active && !capi_test_vectors[i].fips))
1535+
(crypt_fips_mode_kernel() && !capi_test_vectors[i].fips))
15561536
printf("[N/A]\n");
15571537
else
15581538
return EXIT_FAILURE;
@@ -1580,8 +1560,6 @@ int main(__attribute__ ((unused)) int argc, __attribute__ ((unused))char *argv[]
15801560
}
15811561
#endif
15821562

1583-
fips_active = fips_mode();
1584-
15851563
if (crypt_backend_init())
15861564
exit_test("Crypto backend init error.", EXIT_FAILURE);
15871565

@@ -1615,7 +1593,7 @@ int main(__attribute__ ((unused)) int argc, __attribute__ ((unused))char *argv[]
16151593
exit_test("Kernel CAPI test failed.", EXIT_FAILURE);
16161594

16171595
if (default_alg_test()) {
1618-
if (fips_mode())
1596+
if (crypt_fips_mode())
16191597
printf("\nDefault compiled-in algorithms test ignored (FIPS mode on).\n");
16201598
else
16211599
exit_test("\nDefault compiled-in algorithms test failed.", EXIT_FAILURE);

‎tests/keyring-compat-test‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,6 @@ else
3333
CRYPTSETUP_LIB_VALGRIND=../.libs
3434
fi
3535

36-
FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)
37-
3836
remove_mapping()
3937
{
4038
[ -b /dev/mapper/$NAME ] && dmsetup remove --retry $NAME
@@ -115,9 +113,9 @@ test_and_prepare_keyring() {
115113
load_key "$HEXKEY_16" user test_key "$TEST_KEYRING" || skip "Kernel keyring service is useless on this system, test skipped."
116114
}
117115

118-
fips_mode()
116+
fips_mode_kernel()
119117
{
120-
[ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ]
118+
./crypto-check fips_mode_kernel
121119
}
122120

123121
add_device() {
@@ -205,7 +203,7 @@ diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corrupti
205203
echo "OK"
206204

207205
#test serpent cipher, cbc mode, tcw IV
208-
fips_mode || {
206+
fips_mode_kernel || {
209207
echo -n "Testing $CIPHER_CBC_TCW..."
210208
dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_TCW $HEXKEY_64 0 $DEV 0" || fail
211209
sha256sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail

‎tests/luks2-reencryption-test‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,6 @@ HAVE_KEYRING=0
5454
JSON_MSIZE=16384
5555
IMG_JSON=luks2-digest-1.json
5656

57-
FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null)
58-
5957
dm_crypt_features()
6058
{
6159
VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv)
@@ -163,7 +161,7 @@ skip()
163161

164162
fips_mode()
165163
{
166-
[ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ]
164+
./crypto-check fips_mode || ./crypto-check fips_mode_kernel
167165
}
168166

169167
add_scsi_device() {

0 commit comments

Comments
 (0)