Skip to content

test: accept decoder errors for wrong FIPS passphrases #65075

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Archkon wants to merge 1 commit into
base: main
Choose a base branch
from
+20 −10
Open

test: accept decoder errors for wrong FIPS passphrases #65075

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 20 additions & 10 deletions test/parallel/test-crypto-rsa-dsa.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,20 @@ const {
const fips3 = hasFIPS(3);
const fips35 = hasFIPS(3, 5);
const fips30 = fips3 && !fips35;
const fips4 = hasFIPS(4);
const fipsDigestErrorCode = 'ERR_OSSL_DIGEST_NOT_ALLOWED';
const wrongPassphrase = 'wrong-password';
const wrongPassphraseError =
/bad decrypt|DECRYPTION_FAILED|BAD_DECRYPT|bad password|DECODE[ _]ERROR/i;

// A wrong passphrase usually fails during cipher finalization, but CBC output
// can have valid padding by chance. OpenSSL then parses the bad plaintext and
// may report ASN.1 or decoder errors from the same failed key import.
function isWrongPassphraseError(err) {
return err.code === 'ERR_OSSL_BAD_DECRYPT' ||
wrongPassphraseError.test(err.message) ||
err.code?.startsWith('ERR_OSSL_ASN1_') ||
err.code === 'ERR_OSSL_UNSUPPORTED';
}

// Test certificates
const certPem = fixtures.readKey('rsa_cert.crt');
Expand Down Expand Up @@ -71,8 +82,8 @@ const openssl1DecryptError = {
library: 'digital envelope routines',
};

const decryptError = fips4 ?
{ code: 'ERR_OSSL_BAD_DECRYPT' } : hasOpenSSL(3) ?
const decryptError = fips3 ?
isWrongPassphraseError : hasOpenSSL(3) ?
{ message: 'error:1C800064:Provider routines::bad decrypt' } :
process.features.openssl_is_boringssl ? {
message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
Expand All @@ -83,13 +94,12 @@ const decryptError = fips4 ?
} :
openssl1DecryptError;

const decryptPrivateKeyError = fips4 ? {
code: 'ERR_OSSL_BAD_DECRYPT',
} : hasOpenSSL(3) ? {
message: 'error:1C800064:Provider routines::bad decrypt',
} : process.features.openssl_is_boringssl ? {
message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
} : openssl1DecryptError;
const decryptPrivateKeyError = fips3 ?
isWrongPassphraseError : hasOpenSSL(3) ? {
message: 'error:1C800064:Provider routines::bad decrypt',
} : process.features.openssl_is_boringssl ? {
message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
} : openssl1DecryptError;

function getBufferCopy(buf) {
return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
Expand Down
Loading