|
| 1 | +'use strict'; |
| 2 | + |
| 3 | +const common = require('../common'); |
| 4 | + |
| 5 | +if (!common.hasCrypto) { |
| 6 | + common.skip('missing crypto'); |
| 7 | +} |
| 8 | + |
| 9 | +if (process.features.openssl_is_boringssl) { |
| 10 | + common.skip('BoringSSL does not support FIPS'); |
| 11 | +} |
| 12 | + |
| 13 | +const assert = require('node:assert'); |
| 14 | +const diagnosticsChannel = require('node:diagnostics_channel'); |
| 15 | +const { once } = require('node:events'); |
| 16 | +const { createHmac, subtle } = require('node:crypto'); |
| 17 | +const { Worker } = require('node:worker_threads'); |
| 18 | +const { |
| 19 | + spawnSyncAndExitWithoutError, |
| 20 | +} = require('../common/child_process'); |
| 21 | +const { hasFIPS, hasOpenSSL } = require('../common/crypto'); |
| 22 | + |
| 23 | +const channelName = 'crypto.fips.indicator'; |
| 24 | +const mode = process.env.NODE_TEST_FIPS_FORCE_MODE; |
| 25 | + |
| 26 | +if (!hasOpenSSL(3, 4)) { |
| 27 | + common.skip('OpenSSL 3.4 or later is required'); |
| 28 | +} else if (!hasFIPS(3, 4)) { |
| 29 | + common.skip('an active OpenSSL 3.4+ FIPS provider is required'); |
| 30 | +} else if (mode === 'provider') { |
| 31 | + assertSerializedMode(mode); |
| 32 | + assert.strictEqual( |
| 33 | + createHmac('sha256', Buffer.alloc(13)).digest().byteLength, 32); |
| 34 | +} else if (mode === 'strict') { |
| 35 | + assertSerializedMode(mode); |
| 36 | + const subscriber = common.mustNotCall(); |
| 37 | + diagnosticsChannel.subscribe(channelName, subscriber); |
| 38 | + assert.throws( |
| 39 | + () => createHmac('sha256', Buffer.alloc(13)).digest(), |
| 40 | + { code: /^ERR_OSSL_/ }); |
| 41 | + setImmediate(common.mustCall(() => { |
| 42 | + assert.strictEqual( |
| 43 | + diagnosticsChannel.unsubscribe(channelName, subscriber), true); |
| 44 | + })); |
| 45 | +} else if (mode === 'strict-events') { |
| 46 | + assertSerializedMode('strict'); |
| 47 | + testStrictEvents().then(common.mustCall()); |
| 48 | +} else { |
| 49 | + runParent(); |
| 50 | +} |
| 51 | + |
| 52 | +function assertSerializedMode(expected) { |
| 53 | + const { getOptionsAsFlagsFromBinding } = require('internal/options'); |
| 54 | + assert.ok(getOptionsAsFlagsFromBinding().includes(`--force-fips=${expected}`)); |
| 55 | +} |
| 56 | + |
| 57 | +function nextIndicator() { |
| 58 | + const keepAlive = setInterval(common.mustNotCall(), 10_000); |
| 59 | + const { promise, resolve } = Promise.withResolvers(); |
| 60 | + const subscriber = common.mustCall((event, name) => { |
| 61 | + assert.strictEqual(name, channelName); |
| 62 | + clearInterval(keepAlive); |
| 63 | + assert.strictEqual( |
| 64 | + diagnosticsChannel.unsubscribe(channelName, subscriber), true); |
| 65 | + resolve(event); |
| 66 | + }); |
| 67 | + diagnosticsChannel.subscribe(channelName, subscriber); |
| 68 | + return promise; |
| 69 | +} |
| 70 | + |
| 71 | +function runParent() { |
| 72 | + try { |
| 73 | + createHmac('sha256', Buffer.alloc(13)).digest(); |
| 74 | + } catch (error) { |
| 75 | + assert.match(error.code, /^ERR_OSSL_/); |
| 76 | + common.printSkipMessage( |
| 77 | + 'the FIPS provider rejects unapproved operations before signaling'); |
| 78 | + return; |
| 79 | + } |
| 80 | + |
| 81 | + for (const [args, childMode] of [ |
| 82 | + [['--force-fips'], 'provider'], |
| 83 | + [['--force-fips=provider'], 'provider'], |
| 84 | + [['--force-fips=strict'], 'strict'], |
| 85 | + [[ |
| 86 | + '--force-fips=strict', |
| 87 | + '--enable-fips-indicator-events', |
| 88 | + ], 'strict-events'], |
| 89 | + ]) { |
| 90 | + spawnSyncAndExitWithoutError( |
| 91 | + process.execPath, [...args, '--expose-internals', __filename], { |
| 92 | + env: { ...process.env, NODE_TEST_FIPS_FORCE_MODE: childMode }, |
| 93 | + }); |
| 94 | + } |
| 95 | +} |
| 96 | + |
| 97 | +async function testStrictEvents() { |
| 98 | + const key = Buffer.alloc(13); |
| 99 | + |
| 100 | + assert.throws( |
| 101 | + () => createHmac('sha256', key).digest(), |
| 102 | + { code: /^ERR_OSSL_/ }); |
| 103 | + |
| 104 | + let eventPromise = nextIndicator(); |
| 105 | + assert.throws( |
| 106 | + () => createHmac('sha256', key).digest(), |
| 107 | + { code: /^ERR_OSSL_/ }); |
| 108 | + assert.deepStrictEqual(await eventPromise, { |
| 109 | + operation: 'HMAC', |
| 110 | + reason: 'keysize', |
| 111 | + blocked: true, |
| 112 | + count: 1, |
| 113 | + dropped: 0, |
| 114 | + }); |
| 115 | + |
| 116 | + const hmacKey = await subtle.importKey( |
| 117 | + 'raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']); |
| 118 | + eventPromise = nextIndicator(); |
| 119 | + await assert.rejects( |
| 120 | + subtle.sign('HMAC', hmacKey, Buffer.alloc(0)), |
| 121 | + { name: 'OperationError' }); |
| 122 | + const webCryptoEvent = await eventPromise; |
| 123 | + assert.strictEqual(webCryptoEvent.operation, 'HMAC'); |
| 124 | + assert.strictEqual(webCryptoEvent.reason, 'keysize'); |
| 125 | + assert.strictEqual(webCryptoEvent.blocked, true); |
| 126 | + |
| 127 | + eventPromise = nextIndicator(); |
| 128 | + const worker = new Worker(` |
| 129 | + 'use strict'; |
| 130 | + const { createHmac } = require('node:crypto'); |
| 131 | + const { workerData } = require('node:worker_threads'); |
| 132 | + createHmac('sha256', workerData.key).digest(); |
| 133 | + `, { |
| 134 | + eval: true, |
| 135 | + workerData: { key }, |
| 136 | + }); |
| 137 | + const errorPromise = once(worker, 'error'); |
| 138 | + const exitPromise = new Promise((resolve) => worker.on('exit', resolve)); |
| 139 | + const [[error], workerEvent] = await Promise.all([ |
| 140 | + errorPromise, |
| 141 | + eventPromise, |
| 142 | + ]); |
| 143 | + assert.match(error.code, /^ERR_OSSL_/); |
| 144 | + assert.deepStrictEqual(workerEvent, { |
| 145 | + operation: 'HMAC', |
| 146 | + reason: 'keysize', |
| 147 | + blocked: true, |
| 148 | + count: 1, |
| 149 | + dropped: 0, |
| 150 | + }); |
| 151 | + const exitCode = await exitPromise; |
| 152 | + assert.strictEqual(exitCode, 1); |
| 153 | +} |
0 commit comments