Skip to content

Commit 5699e8d

Browse files
panvapanva
committed
fixup! test: update tests to run with OpenSSL >= 3.0 FIPS mode
1 parent 4b890a6 commit 5699e8d

7 files changed

Lines changed: 60 additions & 24 deletions

‎test/parallel/test-crypto-argon2-job.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,12 @@ const common = require('../common');
44
if (!common.hasCrypto)
55
common.skip('missing crypto');
66

7-
const { hasOpenSSL } = require('../common/crypto');
7+
const { hasFIPS, hasOpenSSL } = require('../common/crypto');
88

99
if (!hasOpenSSL(3, 2))
1010
common.skip('requires OpenSSL >= 3.2');
11+
if (hasFIPS(3))
12+
common.skip('Argon2 is not available in FIPS mode');
1113

1214
// Exercises the native Argon2 job directly via internalBinding, bypassing
1315
// the JS validators, to ensure that if invalid parameters ever reach the

‎test/parallel/test-crypto-argon2.js‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ const common = require('../common');
33
if (!common.hasCrypto)
44
common.skip('missing crypto');
55

6-
const { hasOpenSSL } = require('../common/crypto');
6+
const { hasFIPS, hasOpenSSL } = require('../common/crypto');
77

88
if (!hasOpenSSL(3, 2))
99
common.skip('requires OpenSSL >= 3.2');
@@ -28,6 +28,17 @@ const secret = Buffer.alloc(8, 0x03);
2828
const associatedData = Buffer.alloc(12, 0x04);
2929
const defaults = { message, nonce, parallelism: 1, tagLength: 64, memory: 8, passes: 3 };
3030

31+
if (hasFIPS(3)) {
32+
assert.throws(() => crypto.argon2Sync('argon2id', defaults), {
33+
code: 'ERR_OSSL_EVP_UNSUPPORTED',
34+
});
35+
crypto.argon2('argon2id', defaults, common.mustCall((err, result) => {
36+
assert.strictEqual(err?.code, 'ERR_OSSL_EVP_UNSUPPORTED');
37+
assert.strictEqual(result, undefined);
38+
}));
39+
return;
40+
}
41+
3142
const good = [
3243
// Test vectors from RFC 9106 https://www.rfc-editor.org/rfc/rfc9106.html#name-test-vectors
3344
// and OpenSSL 3.2 https://github.com/openssl/openssl/blob/6dfa998f7ea150f9c6d4e4727cf6d5c82a68a8da/test/recipes/30-test_evp_data/evpkdf_argon2.txt

‎test/parallel/test-crypto-key-store.js‎

Lines changed: 25 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
const common = require('../common');
33
if (!common.hasCrypto)
44
common.skip('missing crypto');
5-
const { hasOpenSSL } = require('../common/crypto');
5+
const { hasFIPS, hasOpenSSL } = require('../common/crypto');
66
if (!hasOpenSSL(3))
77
common.skip('requires OpenSSL 3.x');
88

@@ -84,26 +84,32 @@ const data = Buffer.from('hello store');
8484
}
8585

8686
{
87-
const alice = generateKeyPairSync('x25519');
88-
const bob = generateKeyPairSync('x25519');
89-
const file = path.join(tmpdir.path, 'x25519.pem');
90-
fs.writeFileSync(file, alice.privateKey.export({
91-
format: 'pem',
92-
type: 'pkcs8',
93-
}));
94-
const url = pathToFileURL(file);
87+
if (hasFIPS(3, 5)) {
88+
assert.throws(() => generateKeyPairSync('x25519'), {
89+
code: 'ERR_OSSL_EVP_UNSUPPORTED',
90+
});
91+
} else {
92+
const alice = generateKeyPairSync('x25519');
93+
const bob = generateKeyPairSync('x25519');
94+
const file = path.join(tmpdir.path, 'x25519.pem');
95+
fs.writeFileSync(file, alice.privateKey.export({
96+
format: 'pem',
97+
type: 'pkcs8',
98+
}));
99+
const url = pathToFileURL(file);
95100

96-
const expected = diffieHellman({
97-
privateKey: alice.privateKey,
98-
publicKey: bob.publicKey,
99-
});
100-
assert.deepStrictEqual(
101-
diffieHellman({ privateKey: url, publicKey: bob.publicKey }),
102-
expected);
101+
const expected = diffieHellman({
102+
privateKey: alice.privateKey,
103+
publicKey: bob.publicKey,
104+
});
105+
assert.deepStrictEqual(
106+
diffieHellman({ privateKey: url, publicKey: bob.publicKey }),
107+
expected);
103108

104-
if (hasOpenSSL(3, 2)) {
105-
const { sharedKey, ciphertext } = encapsulate(alice.publicKey);
106-
assert.deepStrictEqual(decapsulate(url, ciphertext), sharedKey);
109+
if (hasOpenSSL(3, 2)) {
110+
const { sharedKey, ciphertext } = encapsulate(alice.publicKey);
111+
assert.deepStrictEqual(decapsulate(url, ciphertext), sharedKey);
112+
}
107113
}
108114
}
109115

‎test/parallel/test-webcrypto-derivebits-argon2.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,12 @@ const common = require('../common');
55
if (!common.hasCrypto)
66
common.skip('missing crypto');
77

8-
const { hasOpenSSL } = require('../common/crypto');
8+
const { hasFIPS, hasOpenSSL } = require('../common/crypto');
99

1010
if (!hasOpenSSL(3, 2))
1111
common.skip('requires OpenSSL >= 3.2');
12+
if (hasFIPS(3))
13+
common.skip('Argon2 is not available in FIPS mode');
1214

1315
const assert = require('assert');
1416
const { createSecretKey } = require('crypto');

‎test/parallel/test-webcrypto-promise-prototype-pollution.mjs‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,11 @@ const fips35UnavailableKeyGeneration = new Set([
3434
'X25519',
3535
'X448',
3636
]);
37+
const fips3UnavailableDerivation = new Set([
38+
'Argon2d',
39+
'Argon2i',
40+
'Argon2id',
41+
]);
3742

3843
Promise.prototype.then = common.mustNotCall('Promise.prototype.then');
3944

@@ -1038,6 +1043,14 @@ for (const [name, operations] of supportedAlgorithms) {
10381043
assert(fixture, `missing prototype pollution fixture for ${name}`);
10391044

10401045
const ctx = { __proto__: null };
1046+
if (fips3 && fips3UnavailableDerivation.has(name)) {
1047+
await fixture.importKey(ctx);
1048+
await assert.rejects(
1049+
fixture.deriveBits(ctx),
1050+
(err) => err.name === 'OperationError' &&
1051+
err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED');
1052+
continue;
1053+
}
10411054
if ((fips3 && name === 'ChaCha20-Poly1305') ||
10421055
(fips35 && fips35UnavailableKeyGeneration.has(name))) {
10431056
const expected = name === 'ChaCha20-Poly1305' ?

‎test/pummel/test-crypto-argon2-nonblocking-constructor.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,12 @@ const common = require('../common');
44
if (!common.hasCrypto)
55
common.skip('missing crypto');
66

7-
const { hasOpenSSL } = require('../common/crypto');
7+
const { hasFIPS, hasOpenSSL } = require('../common/crypto');
88

99
if (!hasOpenSSL(3, 2))
1010
common.skip('requires OpenSSL >= 3.2');
11+
if (hasFIPS(3))
12+
common.skip('Argon2 is not available in FIPS mode');
1113

1214
// Regression test for https://github.com/nodejs/node/issues/62861.
1315
// `AdditionalConfig` used to invoke the full Argon2 KDF synchronously inside

‎test/wpt/status/WebCryptoAPI.cjs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ if (!hasOpenSSL(3, 0)) {
4343
'sign_verify/kmac.tentative.https.any.js');
4444
}
4545

46-
if (!hasOpenSSL(3, 2)) {
46+
if (!hasOpenSSL(3, 2) || hasFIPS(3)) {
4747
skip(
4848
'derive_bits_keys/argon2.tentative.https.any.js',
4949
'import_export/Argon2_importKey.tentative.https.any.js');

0 commit comments

Comments
 (0)