Alexander Bokovoy
b016683552
Use AD-SUPPORT subpolicy when testing trust to Active Directory in FIPS mode. This is required in FIPS mode due to AD not supporting Kerberos AES-bases encryption types using FIPS-compliant PBKDF2 and KDF, as defined in RFC 8009. Fixes: https://pagure.io/freeipa/issue/9119 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Julien Rische <jrische@redhat.com> Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
77 lines
2.5 KiB
Python
77 lines
2.5 KiB
Python
#
|
|
# Copyright (C) 2019 FreeIPA Contributors see COPYING for license
|
|
#
|
|
"""FIPS testing helpers
|
|
|
|
Based on userspace FIPS mode by Ondrej Moris.
|
|
|
|
Userspace FIPS mode fakes a Kernel in FIPS enforcing mode. User space
|
|
programs behave like the Kernel was booted in FIPS enforcing mode. Kernel
|
|
space code still runs in standard mode.
|
|
"""
|
|
import os
|
|
from ipaplatform.paths import paths
|
|
|
|
FIPS_OVERLAY_DIR = "/var/tmp/userspace-fips"
|
|
FIPS_OVERLAY = os.path.join(FIPS_OVERLAY_DIR, "fips_enabled")
|
|
SYSTEM_FIPS = "/etc/system-fips"
|
|
|
|
|
|
def is_fips_enabled(host):
|
|
"""Check if host has """
|
|
result = host.run_command(
|
|
["cat", paths.PROC_FIPS_ENABLED], raiseonerr=False
|
|
)
|
|
if result.returncode == 1:
|
|
# FIPS mode not available
|
|
return None
|
|
elif result.returncode == 0:
|
|
return result.stdout_text.strip() == "1"
|
|
else:
|
|
raise RuntimeError(result.stderr_text)
|
|
|
|
|
|
def enable_userspace_fips(host):
|
|
# create /etc/system-fips
|
|
host.put_file_contents(SYSTEM_FIPS, "# userspace fips\n")
|
|
# fake Kernel FIPS mode with bind mount
|
|
host.run_command(["mkdir", "-p", FIPS_OVERLAY_DIR])
|
|
host.put_file_contents(FIPS_OVERLAY, "1\n")
|
|
host.run_command(
|
|
["chcon", "-t", "sysctl_crypto_t", "-u", "system_u", FIPS_OVERLAY]
|
|
)
|
|
host.run_command(
|
|
["mount", "--bind", FIPS_OVERLAY, paths.PROC_FIPS_ENABLED]
|
|
)
|
|
# set crypto policy to FIPS mode
|
|
host.run_command(["update-crypto-policies", "--show"])
|
|
host.run_command(["update-crypto-policies", "--set", "FIPS"])
|
|
# sanity check
|
|
assert is_fips_enabled(host)
|
|
result = host.run_command(
|
|
["openssl", "md5", "/dev/null"], raiseonerr=False
|
|
)
|
|
assert result.returncode == 1
|
|
assert "EVP_DigestInit_ex:disabled for FIPS" in result.stderr_text
|
|
|
|
|
|
def disable_userspace_fips(host):
|
|
host.run_command(["rm", "-f", SYSTEM_FIPS])
|
|
host.run_command(["update-crypto-policies", "--set", "DEFAULT"])
|
|
result = host.run_command(
|
|
["umount", paths.PROC_FIPS_ENABLED], raiseonerr=False
|
|
)
|
|
host.run_command(["rm", "-rf", FIPS_OVERLAY_DIR])
|
|
if result.returncode != 0:
|
|
raise RuntimeError(result.stderr_text)
|
|
|
|
# sanity check
|
|
assert not is_fips_enabled(host)
|
|
host.run_command(["openssl", "md5", "/dev/null"])
|
|
|
|
|
|
def enable_crypto_subpolicy(host, subpolicy):
|
|
result = host.run_command(["update-crypto-policies", "--show"])
|
|
policy = result.stdin_text.strip() + ":" + subpolicy
|
|
host.run_command(["update-crypto-policies", "--set", policy])
|