test: update tests to run with OpenSSL >= 3.0 FIPS mode

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #64960
Backport-PR-URL: #66233
Fixes: #48379
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Author: panva

lib/internal/crypto/webcrypto.js

@@ -1674,6 +1674,7 @@ class SubtleCrypto {
   }
 
   // Implements https://wicg.github.io/webcrypto-modern-algos/#SubtleCrypto-method-supports
+  // TODO(panva): Make supports() account for the active FIPS state.
   static supports(operation, algorithm, lengthOrAdditionalAlgorithm = null) {
     emitExperimentalWarning('The supports Web Crypto API method');
     if (this !== SubtleCrypto) throw new ERR_INVALID_THIS('SubtleCrypto constructor');

test/common/crypto.js

@@ -50,9 +50,14 @@ function assertApproximateSize(key, expectedSize) {
 function testEncryptDecrypt(publicKey, privateKey) {
   const message = 'Hello Node.js world!';
   const plaintext = Buffer.from(message, 'utf8');
+  const withOaepHash = (key) => {
+    if (!hasFIPS(3)) return key;
+    if (key?.key !== undefined) return { ...key, oaepHash: 'sha256' };
+    return { key, oaepHash: 'sha256' };
+  };
   for (const key of [publicKey, privateKey]) {
-    const ciphertext = publicEncrypt(key, plaintext);
-    const received = privateDecrypt(privateKey, ciphertext);
+    const ciphertext = publicEncrypt(withOaepHash(key), plaintext);
+    const received = privateDecrypt(withOaepHash(privateKey), ciphertext);
     assert.strictEqual(received.toString('utf8'), message);
   }
 }

test/fixtures/keys/Makefile

@@ -8,6 +8,7 @@ all: \
   ca5-cert.pem \
   ca6-cert.pem \
   agent1-cert.pem \
+  agent1-fips.pfx \
   agent1.pfx \
   agent2-cert.pem \
   agent3-cert.pem \
@@ -39,6 +40,7 @@ all: \
   dsa_private_encrypted_1025.pem \
   dsa_public_1025.pem \
   ec-cert.pem \
+  ec-fips.pfx \
   ec.pfx \
   fake-cnnic-root-cert.pem \
   intermediate-ca-cert.pem \
@@ -445,6 +447,20 @@ agent1.pfx: agent1-cert.pem agent1-key.pem ca1-cert.pem
 		-out agent1.pfx \
 		-password pass:sample
 
+# PKCS12KDF is unavailable under FIPS properties. Use PBMAC1 with PBKDF2
+# instead, alongside AES-256/PBKDF2 key protection.
+agent1-fips.pfx: agent1-cert.pem agent1-key.pem ca1-cert.pem
+	openssl pkcs12 -export \
+		-keypbe AES-256-CBC \
+		-certpbe AES-256-CBC \
+		-iter 2048 \
+		-pbmac1_pbkdf2 \
+		-in agent1-cert.pem \
+		-inkey agent1-key.pem \
+		-certfile ca1-cert.pem \
+		-out agent1-fips.pfx \
+		-password pass:password
+
 agent1-verify: agent1-cert.pem ca1-cert.pem
 	openssl verify -CAfile ca1-cert.pem agent1-cert.pem
 
@@ -788,6 +804,18 @@ ec.pfx: ec-cert.pem ec-key.pem
 		-out ec.pfx \
 		-password pass:
 
+# See agent1-fips.pfx for why the FIPS fixture uses PBMAC1.
+ec-fips.pfx: ec-cert.pem ec-key.pem
+	openssl pkcs12 -export \
+		-keypbe AES-256-CBC \
+		-certpbe AES-256-CBC \
+		-iter 2048 \
+		-pbmac1_pbkdf2 \
+		-in ec-cert.pem \
+		-inkey ec-key.pem \
+		-out ec-fips.pfx \
+		-password pass:password
+
 dh512.pem:
 	openssl dhparam -out dh512.pem 512
 

test/fixtures/keys/agent1-fips.pfx

@@ -4,10 +4,12 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3, 2))
   common.skip('requires OpenSSL >= 3.2');
+if (hasFIPS(3))
+  common.skip('Argon2 is not available in FIPS mode');
 
 // Exercises the native Argon2 job directly via internalBinding, bypassing
 // the JS validators, to ensure that if invalid parameters ever reach the

test/fixtures/keys/ec-fips.pfx

@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3, 2))
   common.skip('requires OpenSSL >= 3.2');
@@ -28,6 +28,19 @@ const secret = Buffer.alloc(8, 0x03);
 const associatedData = Buffer.alloc(12, 0x04);
 const defaults = { message, nonce, parallelism: 1, tagLength: 64, memory: 8, passes: 3 };
 
+if (hasFIPS(3)) {
+  assert.throws(() => crypto.argon2Sync('argon2id', defaults), {
+    name: 'Error',
+    message: /:digital envelope routines::unsupported$/,
+  });
+  crypto.argon2('argon2id', defaults, common.mustCall((err, result) => {
+    assert.strictEqual(err?.name, 'Error');
+    assert.match(err.message, /:digital envelope routines::unsupported$/);
+    assert.strictEqual(result, undefined);
+  }));
+  return;
+}
+
 const good = [
   // Test vectors from RFC 9106 https://www.rfc-editor.org/rfc/rfc9106.html#name-test-vectors
   // and OpenSSL 3.2 https://github.com/openssl/openssl/blob/6dfa998f7ea150f9c6d4e4727cf6d5c82a68a8da/test/recipes/30-test_evp_data/evpkdf_argon2.txt

test/parallel/test-crypto-argon2-job.js

@@ -3,12 +3,14 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 const assert = require('assert');
 const util = require('util');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
 
+const fips3 = hasFIPS(3);
+
 function test(
   publicFixture,
   privateFixture,
@@ -65,6 +67,17 @@ function test(
   }
 }
 
+function testSignFailure(privateFixture, algorithm, options, code, message) {
+  const key = { key: fixtures.readKey(privateFixture), ...options };
+  const data = Buffer.from('Hello world');
+  assert.throws(() => crypto.sign(algorithm, data, key), { code });
+  crypto.sign(algorithm, data, key, common.mustCall((err) => {
+    // Async crypto jobs in v24 preserve the OpenSSL message without a code.
+    assert.strictEqual(err?.name, 'Error');
+    assert.strictEqual(err.message, message);
+  }));
+}
+
 // RSA w/ default padding
 test('rsa_public.pem', 'rsa_private.pem', 'sha256', true);
 test('rsa_public.pem', 'rsa_private.pem', 'sha256', true,
@@ -94,14 +107,20 @@ if (!process.features.openssl_is_boringssl) {
   test('ed448_public.pem', 'ed448_private.pem', undefined, true);
 
   // ECDSA w/ der signature encoding
-  test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
-       false);
-  test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
-       false, { dsaEncoding: 'der' });
-
-  // ECDSA w/ ieee-p1363 signature encoding
-  test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384', false,
-       { dsaEncoding: 'ieee-p1363' });
+  if (fips3) {
+    testSignFailure('ec_secp256k1_private.pem', 'sha384', {},
+                    'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE',
+                    'error:03000096:digital envelope routines::operation not supported for this keytype');
+  } else {
+    test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
+         false);
+    test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
+         false, { dsaEncoding: 'der' });
+
+    // ECDSA w/ ieee-p1363 signature encoding
+    test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384', false,
+         { dsaEncoding: 'ieee-p1363' });
+  }
 
   // DSA w/ der signature encoding
   test('dsa_public.pem', 'dsa_private.pem', 'sha256',
@@ -156,7 +175,7 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
   const signature = crypto.randomBytes(16);
 
   let expected = /no default digest/;
-  if (hasOpenSSL3 || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3) || process.features.openssl_is_boringssl) {
     expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
   }
 
@@ -167,11 +186,21 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
 }
 
 {
-  const { privateKey } = crypto.generateKeyPairSync('rsa', {
-    modulusLength: 512
-  });
-  crypto.sign('sha512', 'message', privateKey, common.mustCall((err) => {
-    assert.ok(err);
-    assert.match(err.message, /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i);
-  }));
+  if (fips3) {
+    crypto.generateKeyPair('rsa', { modulusLength: 512 },
+                           common.mustCall((err) => {
+                             assert.strictEqual(err?.name, 'Error');
+                             assert.strictEqual(
+                               err.message, 'error:020000AE:rsa routines::invalid modulus');
+                           }));
+  } else {
+    const { privateKey } = crypto.generateKeyPairSync('rsa', {
+      modulusLength: 512
+    });
+    crypto.sign('sha512', 'message', privateKey, common.mustCall((err) => {
+      assert.ok(err);
+      assert.match(
+        err.message, /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i);
+    }));
+  }
 }

test/parallel/test-crypto-argon2.js

@@ -6,6 +6,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const fs = require('fs');
 const stream = require('stream');
 const tmpdir = require('../common/tmpdir');
@@ -120,6 +121,16 @@ function test(config) {
     return;
   }
 
+  if (hasFIPS(3)) {
+    assert.throws(() => crypto.createDecipheriv(
+      config.cipher, config.key, config.iv, {
+        authTagLength: config.authTagLength,
+      }), {
+      code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+    });
+    return;
+  }
+
   direct(config);
   mstream(config);
   fstream(config);

test/parallel/test-crypto-async-sign-verify.js

@@ -29,9 +29,10 @@ const assert = require('assert');
 const crypto = require('crypto');
 const { inspect } = require('util');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
-const isFipsEnabled = crypto.getFips();
+const isFipsEnabled = crypto.getFips() === 1;
+const fips3 = hasFIPS(3);
 
 //
 // Test authenticated encryption modes.
@@ -718,6 +719,14 @@ for (const test of TEST_CASES) {
     const ciphertext = Buffer.concat([cipher.update(plain), cipher.final()]);
     const tag = cipher.getAuthTag();
 
+    if (fips3 && mode === 'ccm') {
+      assert.throws(() => crypto.createDecipheriv(
+        `aes-128-${mode}`, key, iv, opts), {
+        code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+      });
+      continue;
+    }
+
     const decipher = crypto.createDecipheriv(`aes-128-${mode}`, key, iv, opts);
     decipher.setAuthTag(tag);
     assert.throws(() => {
@@ -804,7 +813,7 @@ for (const test of TEST_CASES) {
     } catch (err) {
       // OpenSSL without https://github.com/openssl/openssl/pull/32427
       // cannot finalize an empty CCM message unless update() was called.
-      if (hasOpenSSL3) {
+      if (hasOpenSSL(3)) {
         assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET');
       } else {
         assert.match(err.message, /Unsupported state/);
@@ -818,7 +827,14 @@ for (const test of TEST_CASES) {
   }
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (fips3) {
+  assert.throws(() => crypto.createCipheriv(
+    'chacha20-poly1305', Buffer.alloc(32), Buffer.alloc(12), {
+      authTagLength: 16,
+    }), {
+    code: 'ERR_OSSL_EVP_UNSUPPORTED',
+  });
+} else if (!process.features.openssl_is_boringssl) {
   const key = Buffer.alloc(32);
   const iv = Buffer.alloc(12);
 
@@ -836,7 +852,7 @@ if (!process.features.openssl_is_boringssl) {
 
 // ChaCha20-Poly1305 should respect the authTagLength option and should not
 // require the authentication tag before calls to update() during decryption.
-if (!process.features.openssl_is_boringssl) {
+if (!fips3 && !process.features.openssl_is_boringssl) {
   const key = Buffer.alloc(32);
   const iv = Buffer.alloc(12);
 
@@ -887,7 +903,7 @@ if (!process.features.openssl_is_boringssl) {
 // shorter tags as long as their length was valid according to NIST SP 800-38D.
 // For ChaCha20-Poly1305, we intentionally deviate from that because there are
 // no recommended or approved authentication tag lengths below 16 bytes.
-if (!process.features.openssl_is_boringssl) {
+if (!fips3 && !process.features.openssl_is_boringssl) {
   const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => {
     return algo === 'chacha20-poly1305' && tampered === false;
   });
@@ -926,7 +942,7 @@ if (!process.features.openssl_is_boringssl) {
 }
 
 // https://github.com/nodejs/node/issues/45874
-if (!process.features.openssl_is_boringssl) {
+if (!fips3 && !process.features.openssl_is_boringssl) {
   const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => {
     return algo === 'chacha20-poly1305' && tampered === false;
   });
@@ -973,7 +989,7 @@ if (ciphers.includes('aes-128-ccm')) {
   const tag = cipher.getAuthTag();
   assert.strictEqual(tag.length, 16);
 
-  if (isFipsEnabled && hasOpenSSL3) {
+  if (fips3) {
     assert.throws(() => crypto.createDecipheriv(
       'aes-128-ccm', key, nonce, { authTagLength: 16 }), {
       code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',