From 795592865c96b58016a883ac6390c985f140918d Mon Sep 17 00:00:00 2001 From: Peter Eisentraut Date: Fri, 17 Nov 2023 14:40:13 +0100 Subject: [PATCH] pgcrypto: Allow tests to pass in OpenSSL FIPS mode This adds several alternative expected files for when MD5 and 3DES are not available. This is similar to the alternative expected files for when the legacy provider is disabled. In fact, running the pgcrypto tests in FIPS mode makes use of some of these existing alternative expected files as well (e.g., for blowfish). These new expected files currently cover the FIPS mode provided by OpenSSL 3.x as well as the modified OpenSSL 3.x from Red Hat (e.g., Fedora 38), but not the modified OpenSSL 1.x from Red Hat (e.g., Fedora 35). (The latter will have some error message wording differences.) Reviewed-by: Tom Lane Reviewed-by: Daniel Gustafsson Discussion: https://www.postgresql.org/message-id/flat/dbbd927f-ef1f-c9a1-4ec6-c759778ac852%40enterprisedb.com --- contrib/pgcrypto/expected/3des_1.out | 29 ++++++++++++ contrib/pgcrypto/expected/crypt-md5_1.out | 16 +++++++ contrib/pgcrypto/expected/hmac-md5_1.out | 44 +++++++++++++++++++ contrib/pgcrypto/expected/md5_1.out | 17 +++++++ .../pgcrypto/expected/pgp-encrypt-md5_1.out | 7 +++ 5 files changed, 113 insertions(+) create mode 100644 contrib/pgcrypto/expected/3des_1.out create mode 100644 contrib/pgcrypto/expected/crypt-md5_1.out create mode 100644 contrib/pgcrypto/expected/hmac-md5_1.out create mode 100644 contrib/pgcrypto/expected/md5_1.out create mode 100644 contrib/pgcrypto/expected/pgp-encrypt-md5_1.out diff --git a/contrib/pgcrypto/expected/3des_1.out b/contrib/pgcrypto/expected/3des_1.out new file mode 100644 index 00000000000..fb1d1f6f0c0 --- /dev/null +++ b/contrib/pgcrypto/expected/3des_1.out @@ -0,0 +1,29 @@ +-- +-- 3DES cipher +-- +-- test vector from somewhere +SELECT encrypt('\x8000000000000000', + '\x010101010101010101010101010101010101010101010101', + '3des-ecb/pad:none'); +ERROR: encrypt error: Cipher cannot be initialized +select encrypt('', 'foo', '3des'); +ERROR: encrypt error: Cipher cannot be initialized +-- 10 bytes key +select encrypt('foo', '0123456789', '3des'); +ERROR: encrypt error: Cipher cannot be initialized +-- 22 bytes key +select encrypt('foo', '0123456789012345678901', '3des'); +ERROR: encrypt error: Cipher cannot be initialized +-- decrypt +select encode(decrypt(encrypt('foo', '0123456', '3des'), '0123456', '3des'), 'escape'); +ERROR: encrypt error: Cipher cannot be initialized +-- iv +select encrypt_iv('foo', '0123456', 'abcd', '3des'); +ERROR: encrypt_iv error: Cipher cannot be initialized +select encode(decrypt_iv('\x50735067b073bb93', '0123456', 'abcd', '3des'), 'escape'); +ERROR: decrypt_iv error: Cipher cannot be initialized +-- long message +select encrypt('Lets try a longer message.', '0123456789012345678901', '3des'); +ERROR: encrypt error: Cipher cannot be initialized +select encode(decrypt(encrypt('Lets try a longer message.', '0123456789012345678901', '3des'), '0123456789012345678901', '3des'), 'escape'); +ERROR: encrypt error: Cipher cannot be initialized diff --git a/contrib/pgcrypto/expected/crypt-md5_1.out b/contrib/pgcrypto/expected/crypt-md5_1.out new file mode 100644 index 00000000000..0ffda34ab4c --- /dev/null +++ b/contrib/pgcrypto/expected/crypt-md5_1.out @@ -0,0 +1,16 @@ +-- +-- crypt() and gen_salt(): md5 +-- +SELECT crypt('', '$1$Szzz0yzz'); +ERROR: crypt(3) returned NULL +SELECT crypt('foox', '$1$Szzz0yzz'); +ERROR: crypt(3) returned NULL +CREATE TABLE ctest (data text, res text, salt text); +INSERT INTO ctest VALUES ('password', '', ''); +UPDATE ctest SET salt = gen_salt('md5'); +UPDATE ctest SET res = crypt(data, salt); +ERROR: crypt(3) returned NULL +SELECT res = crypt(data, res) AS "worked" +FROM ctest; +ERROR: invalid salt +DROP TABLE ctest; diff --git a/contrib/pgcrypto/expected/hmac-md5_1.out b/contrib/pgcrypto/expected/hmac-md5_1.out new file mode 100644 index 00000000000..56875b0f63e --- /dev/null +++ b/contrib/pgcrypto/expected/hmac-md5_1.out @@ -0,0 +1,44 @@ +-- +-- HMAC-MD5 +-- +SELECT hmac( +'Hi There', +'\x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b'::bytea, +'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized +-- 2 +SELECT hmac( +'Jefe', +'what do ya want for nothing?', +'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized +-- 3 +SELECT hmac( +'\xdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd'::bytea, +'\xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'::bytea, +'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized +-- 4 +SELECT hmac( +'\xcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd'::bytea, +'\x0102030405060708090a0b0c0d0e0f10111213141516171819'::bytea, +'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized +-- 5 +SELECT hmac( +'Test With Truncation', +'\x0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c'::bytea, +'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized +-- 6 +SELECT hmac( +'Test Using Larger Than Block-Size Key - Hash Key First', +'\xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'::bytea, +'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized +-- 7 +SELECT hmac( +'Test Using Larger Than Block-Size Key and Larger Than One Block-Size Data', +'\xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'::bytea, +'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized diff --git a/contrib/pgcrypto/expected/md5_1.out b/contrib/pgcrypto/expected/md5_1.out new file mode 100644 index 00000000000..decb215c482 --- /dev/null +++ b/contrib/pgcrypto/expected/md5_1.out @@ -0,0 +1,17 @@ +-- +-- MD5 message digest +-- +SELECT digest('', 'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized +SELECT digest('a', 'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized +SELECT digest('abc', 'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized +SELECT digest('message digest', 'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized +SELECT digest('abcdefghijklmnopqrstuvwxyz', 'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized +SELECT digest('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789', 'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized +SELECT digest('12345678901234567890123456789012345678901234567890123456789012345678901234567890', 'md5'); +ERROR: Cannot use "md5": Cipher cannot be initialized diff --git a/contrib/pgcrypto/expected/pgp-encrypt-md5_1.out b/contrib/pgcrypto/expected/pgp-encrypt-md5_1.out new file mode 100644 index 00000000000..612ca1d19c4 --- /dev/null +++ b/contrib/pgcrypto/expected/pgp-encrypt-md5_1.out @@ -0,0 +1,7 @@ +-- +-- PGP encrypt using MD5 +-- +select pgp_sym_decrypt( + pgp_sym_encrypt('Secret.', 'key', 's2k-digest-algo=md5'), + 'key', 'expect-s2k-digest-algo=md5'); +ERROR: Unsupported digest algorithm