test: add test for invalid DSA key size

Check that invalid DSA key sizes are rejected in FIPS mode.

PR-URL: https://github.com/nodejs/node/pull/3756
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
Reviewed-By: James M Snell <jasnell@gmail.com>

diff --git a/test/fixtures/keys/Makefile b/test/fixtures/keys/Makefile
index 5cd3480..1439862 100644 (file)
--- a/test/fixtures/keys/Makefile
+++ b/test/fixtures/keys/Makefile
@@ -1,4 +1,4 @@
-all: agent1-cert.pem agent2-cert.pem agent3-cert.pem agent4-cert.pem agent5-cert.pem ca2-crl.pem ec-cert.pem dh512.pem dh1024.pem dh2048.pem rsa_private_1024.pem rsa_private_2048.pem rsa_private_4096.pem rsa_public_1024.pem rsa_public_2048.pem rsa_public_4096.pem
+all: agent1-cert.pem agent2-cert.pem agent3-cert.pem agent4-cert.pem agent5-cert.pem ca2-crl.pem ec-cert.pem dh512.pem dh1024.pem dh2048.pem dsa1025.pem dsa_private_1025.pem dsa_public_1025.pem rsa_private_1024.pem rsa_private_2048.pem rsa_private_4096.pem rsa_public_1024.pem rsa_public_2048.pem rsa_public_4096.pem
 
 
 #
@@ -267,6 +267,15 @@ dh1024.pem:
 dh2048.pem:
        openssl dhparam -out dh2048.pem 2048
 
+dsa1025.pem:
+       openssl dsaparam -out dsa1025.pem 1025
+
+dsa_private_1025.pem:
+       openssl gendsa -out dsa_private_1025.pem dsa1025.pem
+
+dsa_public_1025.pem:
+       openssl dsa -in dsa_private_1025.pem -pubout -out dsa_public_1025.pem
+
 rsa_private_1024.pem:
        openssl genrsa -out rsa_private_1024.pem 1024
 

diff --git a/test/fixtures/keys/dsa1025.pem b/test/fixtures/keys/dsa1025.pem
new file mode 100644 (file)
index 0000000..1b59f5e
--- /dev/null
+++ b/test/fixtures/keys/dsa1025.pem
@@ -0,0 +1,9 @@
+-----BEGIN DSA PARAMETERS-----
+MIIBLgKBiQCtjGXOH3Rq+lM09nwe6nbShOduCyfjgZhgMZ2WfY6PYLW3gNnhNYT7
+88rZbECcyKlyzRApFgs9KMfiqWfWIhQn+FmolmeUNdRXpmkGyJAqY63GobI8S1Jn
+xYbwdH7PsV1IwM56ylrnpdUDhSH7+Y95rgEIUXX9OHS503gzFFEHCmQl1/RS7Qxp
+AhUApmbNUvRisdjnyjhDK6RO3pafN90CgYhQLHJ+qq+nxLX/lqQL/tCFY3P6DlYc
+3ezT3Ic+3GhEMMXMBMJ+WRmRkCW5vh1grQyLVa/MLWvYgNkoUAO8eGElcloUero8
+m5Tp3bFArEqb8rJXWYM1sAlnl/Y0uFpw1AyHLuZC26z+SSeDbV9REtz14EknkFXk
+su4QN55ZQKoiBv2cFDMsIf9b
+-----END DSA PARAMETERS-----

diff --git a/test/fixtures/keys/dsa_private_1025.pem b/test/fixtures/keys/dsa_private_1025.pem
new file mode 100644 (file)
index 0000000..11f5e80
--- /dev/null
+++ b/test/fixtures/keys/dsa_private_1025.pem
@@ -0,0 +1,12 @@
+-----BEGIN DSA PRIVATE KEY-----
+MIIB0QIBAAKBiQCtjGXOH3Rq+lM09nwe6nbShOduCyfjgZhgMZ2WfY6PYLW3gNnh
+NYT788rZbECcyKlyzRApFgs9KMfiqWfWIhQn+FmolmeUNdRXpmkGyJAqY63GobI8
+S1JnxYbwdH7PsV1IwM56ylrnpdUDhSH7+Y95rgEIUXX9OHS503gzFFEHCmQl1/RS
+7QxpAhUApmbNUvRisdjnyjhDK6RO3pafN90CgYhQLHJ+qq+nxLX/lqQL/tCFY3P6
+DlYc3ezT3Ic+3GhEMMXMBMJ+WRmRkCW5vh1grQyLVa/MLWvYgNkoUAO8eGElcloU
+ero8m5Tp3bFArEqb8rJXWYM1sAlnl/Y0uFpw1AyHLuZC26z+SSeDbV9REtz14Ekn
+kFXksu4QN55ZQKoiBv2cFDMsIf9bAoGHFPpl8uRj7sNjsnIPPI9CuqlIoZXFNXeM
+X9Yu7T3s5mn5Q2ATcgnryDXwqpqle630wy1LZjjmtyE84oVJd4W6YTlzHNwIv2ql
+ymMzWBE5+BrRXtqIndvkaWJRSUwtZ7XPPeeCzqR5uXRAsy54azoFDoisuOO5dVOm
+VZERfp4Up+Duvws5+Gq2AhQlmsEI+CInYqsDR2ha+UcwXmGJSg==
+-----END DSA PRIVATE KEY-----

diff --git a/test/fixtures/keys/dsa_public_1025.pem b/test/fixtures/keys/dsa_public_1025.pem
new file mode 100644 (file)
index 0000000..e55e3d8
--- /dev/null
+++ b/test/fixtures/keys/dsa_public_1025.pem
@@ -0,0 +1,12 @@
+-----BEGIN PUBLIC KEY-----
+MIIBzTCCATsGByqGSM44BAEwggEuAoGJAK2MZc4fdGr6UzT2fB7qdtKE524LJ+OB
+mGAxnZZ9jo9gtbeA2eE1hPvzytlsQJzIqXLNECkWCz0ox+KpZ9YiFCf4WaiWZ5Q1
+1FemaQbIkCpjrcahsjxLUmfFhvB0fs+xXUjAznrKWuel1QOFIfv5j3muAQhRdf04
+dLnTeDMUUQcKZCXX9FLtDGkCFQCmZs1S9GKx2OfKOEMrpE7elp833QKBiFAscn6q
+r6fEtf+WpAv+0IVjc/oOVhzd7NPchz7caEQwxcwEwn5ZGZGQJbm+HWCtDItVr8wt
+a9iA2ShQA7x4YSVyWhR6ujyblOndsUCsSpvysldZgzWwCWeX9jS4WnDUDIcu5kLb
+rP5JJ4NtX1ES3PXgSSeQVeSy7hA3nllAqiIG/ZwUMywh/1sDgYsAAoGHFPpl8uRj
+7sNjsnIPPI9CuqlIoZXFNXeMX9Yu7T3s5mn5Q2ATcgnryDXwqpqle630wy1LZjjm
+tyE84oVJd4W6YTlzHNwIv2qlymMzWBE5+BrRXtqIndvkaWJRSUwtZ7XPPeeCzqR5
+uXRAsy54azoFDoisuOO5dVOmVZERfp4Up+Duvws5+Gq2
+-----END PUBLIC KEY-----

diff --git a/test/parallel/test-dsa-fips-invalid-key.js b/test/parallel/test-dsa-fips-invalid-key.js
new file mode 100644 (file)
index 0000000..0b57734
--- /dev/null
+++ b/test/parallel/test-dsa-fips-invalid-key.js
@@ -0,0 +1,24 @@
+'use strict';
+var common = require('../common');
+var assert = require('assert');
+
+if (!common.hasFipsCrypto) {
+  console.log('1..0 # Skipped: node compiled without FIPS OpenSSL.');
+  return;
+}
+
+var crypto = require('crypto');
+var fs = require('fs');
+
+var input = 'hello';
+
+var dsapub = fs.readFileSync(common.fixturesDir +
+                             '/keys/dsa_public_1025.pem');
+var dsapri = fs.readFileSync(common.fixturesDir +
+                             '/keys/dsa_private_1025.pem');
+var sign = crypto.createSign('DSS1');
+sign.update(input);
+
+assert.throws(function() {
+  sign.sign(dsapri);
+}, /PEM_read_bio_PrivateKey failed/);