Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Only abort when RSA PWCT fail in FIPS #2020

Merged
merged 2 commits into from
Dec 5, 2024

Conversation

samuel40791765
Copy link
Contributor

Description of changes:

We've been getting abort failures when building with FIPS mode against Ruby's break tests. The issue happens to be related to the abort call we do when calls to RSA_generate_key_ex fail.
In the original commit where this was introduced (6bdd4c3), it's mentioned that "It's required that the FIPS module aborts when PCT tests fail in RSA_check_fips()." Our current behavior fails regardless of a regular RSA failure or a PWCT failure, which causes regular RSA failures to unintentionally abort as well.
This changes aborting to only happen during failures in RSA_check_fips. Our existing death tests were also expecting failures during regular RSA failures rather than PWCT failures, so I've tweaked the tests to account for that. Ruby's RSA break test passes successfully with this change.

Call-outs:

The new test is ran when the CFLAG BORINGSSL_FIPS_BREAK_TESTS is set, so I've updated our test script to run tests when building with this dimension. This leverages our existing break tests to test PWCT aborting behavior.

Testing:

New test dimension

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

@samuel40791765 samuel40791765 requested a review from a team as a code owner November 27, 2024 01:42
@smittals2 smittals2 self-requested a review November 27, 2024 01:52
@codecov-commenter
Copy link

codecov-commenter commented Nov 27, 2024

Codecov Report

Attention: Patch coverage is 60.00000% with 2 lines in your changes missing coverage. Please review.

Project coverage is 78.69%. Comparing base (5982853) to head (734133d).

Files with missing lines Patch % Lines
crypto/fipsmodule/rsa/rsa_impl.c 60.00% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2020      +/-   ##
==========================================
- Coverage   78.69%   78.69%   -0.01%     
==========================================
  Files         598      598              
  Lines      103326   103329       +3     
  Branches    14687    14688       +1     
==========================================
  Hits        81310    81310              
- Misses      21366    21368       +2     
- Partials      650      651       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@samuel40791765
Copy link
Contributor Author

+ export BORINGSSL_FIPS_BREAK_TEST=RSA_PWCT
+ BORINGSSL_FIPS_BREAK_TEST=RSA_PWCT
+ /codebuild/output/src2176229394/src/github.com/aws/aws-lc/test_build_dir/crypto/crypto_test --gtest_filter=RSADeathTest.KeygenFailAndDie
Note: Google Test filter = RSADeathTest.KeygenFailAndDie
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from RSADeathTest
[ RUN      ] RSADeathTest.KeygenFailAndDie
[       OK ] RSADeathTest.KeygenFailAndDie (2080 ms)
[----------] 1 test from RSADeathTest (2080 ms total)

[----------] Global test environment tear-down
[==========] 1 test from 1 test suite ran. (2080 ms total)
[  PASSED  ] 1 test.
+ unset BORINGSSL_FIPS_BREAK_TEST

@samuel40791765 samuel40791765 merged commit 8226a05 into aws:main Dec 5, 2024
114 of 119 checks passed
@samuel40791765 samuel40791765 deleted the fix-rsa-fips-abort branch December 5, 2024 18:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants