1 // Copyright 2021 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 //
15 ///////////////////////////////////////////////////////////////////////////////
16 #include "tink/config/tink_fips.h"
17
18 #include "gmock/gmock.h"
19 #include "gtest/gtest.h"
20 #include "absl/status/status.h"
21 #include "openssl/crypto.h"
22 #include "tink/aead/aead_config.h"
23 #include "tink/internal/fips_utils.h"
24 #include "tink/registry.h"
25 #include "tink/util/status.h"
26 #include "tink/util/test_matchers.h"
27
28 namespace crypto {
29 namespace tink {
30
31 namespace {
32
33 using testing::Eq;
34 using ::crypto::tink::test::IsOk;
35 using ::crypto::tink::test::StatusIs;
36
37 class FipsIncompatible {
38 public:
39 static constexpr crypto::tink::internal::FipsCompatibility kFipsStatus =
40 crypto::tink::internal::FipsCompatibility::kNotFips;
41 };
42
43 class FipsCompatibleWithBoringCrypto {
44 public:
45 static constexpr crypto::tink::internal::FipsCompatibility kFipsStatus =
46 crypto::tink::internal::FipsCompatibility::kRequiresBoringCrypto;
47 };
48
TEST(TinkFipsTest,FipsEnabledWhenBuiltInFipsMode)49 TEST(TinkFipsTest, FipsEnabledWhenBuiltInFipsMode) {
50 // Check if the built flag is set.
51 if (!internal::kUseOnlyFips) {
52 GTEST_SKIP() << "Only supported in FIPS-only mode";
53 }
54
55 EXPECT_THAT(IsFipsModeEnabled(), Eq(true));
56 }
57
TEST(TinkFipsTest,FipsDisabledWhenNotBuildInFipsMode)58 TEST(TinkFipsTest, FipsDisabledWhenNotBuildInFipsMode) {
59 // Check if the built flag is set.
60 if (internal::kUseOnlyFips) {
61 GTEST_SKIP() << "Not supported in FIPS-only mode";
62 }
63
64 EXPECT_THAT(IsFipsModeEnabled(), Eq(false));
65 }
66
TEST(TinkFipsTest,CompatibilityChecksWithBoringCrypto)67 TEST(TinkFipsTest, CompatibilityChecksWithBoringCrypto) {
68 if (!internal::IsFipsEnabledInSsl()) {
69 GTEST_SKIP() << "Test only run if BoringCrypto module is available.";
70 }
71
72 Registry::Reset();
73
74 // Tink is not build in FIPS mode, but the FIPS mode is enabled at runtime.
75 EXPECT_THAT(crypto::tink::RestrictToFips(), IsOk());
76
77 // In FIPS only mode compatibility checks should disallow algorithms
78 // with the FipsCompatibility::kNone flag.
79 EXPECT_THAT(internal::CheckFipsCompatibility<FipsIncompatible>(),
80 StatusIs(absl::StatusCode::kInternal));
81
82 // FIPS validated implementations should still be allowed.
83 EXPECT_THAT(
84 internal::CheckFipsCompatibility<FipsCompatibleWithBoringCrypto>(),
85 IsOk());
86
87 internal::UnSetFipsRestricted();
88 }
89
TEST(TinkFipsTest,CompatibilityChecksWithoutBoringCrypto)90 TEST(TinkFipsTest, CompatibilityChecksWithoutBoringCrypto) {
91 if (internal::IsFipsEnabledInSsl()) {
92 GTEST_SKIP() << "Test only run if BoringCrypto module is not available.";
93 }
94
95 Registry::Reset();
96
97 // Tink is not build in FIPS mode, but the FIPS mode is enabled at runtime.
98 EXPECT_THAT(crypto::tink::RestrictToFips(), IsOk());
99
100 // In FIPS only mode compatibility checks should disallow algorithms
101 // with the FipsCompatibility::kNone flag.
102 EXPECT_THAT(internal::CheckFipsCompatibility<FipsIncompatible>(),
103 StatusIs(absl::StatusCode::kInternal));
104
105 // FIPS validated implementations are not allowed if BoringCrypto is not
106 // available.
107 EXPECT_THAT(
108 internal::CheckFipsCompatibility<FipsCompatibleWithBoringCrypto>(),
109 StatusIs(absl::StatusCode::kInternal));
110
111 internal::UnSetFipsRestricted();
112 }
113
TEST(TinkFipsTest,FailIfRegistryNotEmpty)114 TEST(TinkFipsTest, FailIfRegistryNotEmpty) {
115 if (internal::kUseOnlyFips) {
116 GTEST_SKIP() << "Not supported in FIPS-only mode";
117 }
118
119 Registry::Reset();
120 internal::UnSetFipsRestricted();
121
122 EXPECT_THAT(AeadConfig::Register(), IsOk());
123 EXPECT_THAT(crypto::tink::RestrictToFips(),
124 StatusIs(absl::StatusCode::kInternal));
125 }
126
127 } // namespace
128
129 } // namespace tink
130 } // namespace crypto
131