1// Copyright 2022 The BoringSSL Authors
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7//     https://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15// break-kat corrupts a known-answer-test input in a binary and writes the
16// corrupted binary to stdout. This is used to demonstrate that the KATs in the
17// binary notice the error.
18package main
19
20import (
21	"bytes"
22	"encoding/hex"
23	"flag"
24	"fmt"
25	"io"
26	"os"
27	"os/exec"
28	"sort"
29)
30
31var (
32	kats = map[string]string{
33		"HMAC-SHA-256":    "dad91293dfcf2a7c8ecd13fe353fa75b",
34		"AES-CBC-encrypt": "078609a6c5ac2544699adf682fa377f9be8ab6aef563e8c56a36b84f557fadd3",
35		"AES-CBC-decrypt": "347aa5a024b28257b36510be583d4f47adb7bbeedc6005bbbd0d0a9f06bb7b10",
36		"AES-GCM-encrypt": "8fcc4099808e75caaff582898848a88d808b55ab4e9370797d940be8cc1d7884",
37		"AES-GCM-decrypt": "35f3058f875760ff09d3120f70c4bc9ed7a86872e13452202176f7371ae04faae1dd391920f5d13953d896785994823c",
38		"DRBG":            "c4da0740d505f1ee280b95e58c4931ac6de846a0152fbb4a3f174cf4787a4f1a40c2b50babe14aae530be5886d910a27",
39		"DRBG-reseed":     "c7161ca36c2309b716e9859bb96c6d49bdc8352103a18cd24ef42ec97ef46bf446eb1a4576c186e9351803763a7912fe",
40		"HKDF":            "68678504b9b3add17d5967a1a7bd37993fd8a33ce7303071f39c096d1635b3c9",
41		"MLDSA-keygen":    "0c6f387d2ab43387f021b0da816c71f0bc815ef0b16af1124f354c273eedb42fe54a019a",
42		"MLDSA-sign":      "f8c725848b39d9d980f02ff7a02419087065e2c80ac4d3d5974931ea7bd664b66e6bf3c7",
43		"MLDSA-verify":    "4923cea1293b2400ccc3b19f1e803ed85a0d6e0ba64f35f845f420d848e1858205883fdd",
44		"MLKEM-keygen":    "d8c9397c3130d8ecb411a68efcc89a553cb7e6817e0288bd0691609bf5",
45		"MLKEM-encap":     "7d9f1cb4ae04d75fa6575ae0e429b573a974b7",
46		"MLKEM-decap":     "a3192a8c88fc996d2df9858d2c55363993f0494d7ec0be5a567b8a4243a5745d",
47		"SHA-1":           "132fd9bad5c1826263bafbb699f707a5",
48		"SHA-256":         "ff3b857da7236a2baa0f396b51522217",
49		"SHA-512":         "212512f8d2ad8322781c6c4d69a9daa1",
50		"SLHDSA-keygen":   "be6bd7e8e198eaf62d572f13fc79f26f",
51		"SLHDSA-sign":     "82d409744d97ae305318469f7b857b91d4e33310b709b550a7c48a46094ec9d4",
52		"SLHDSA-verify":   "3fd69193ee9708bdea110ba29f235ff2ec9888d12761f84dc6e3f0d7eb48d05cacf6e87f",
53		"TLS10-KDF":       "abc3657b094c7628a0b282996fe75a75f4984fd94d4ecc2fcf53a2c469a3f731",
54		"TLS12-KDF":       "c5438ee26fd4acbd259fc91855dc69bf884ee29322fcbfd2966a4623d42ec781",
55		"TLS13-KDF":       "024a0d80f357f2499a1244dac26dab66fc13ed85fca71dace146211119525874",
56		"RSA-sign":        "d2b56e53306f720d7929d8708bf46f1c22300305582b115bedcac722d8aa5ab2",
57		"RSA-verify":      "abe2cbc13d6bd39d48db5334ddbf8d070a93bdcb104e2cc5d0ee486ee295f6b31bda126c41890b98b73e70e6b65d82f95c663121755a90744c8d1c21148a1960be0eca446e9ff497f1345c537ef8119b9a4398e95c5c6de2b1c955905c5299d8ce7a3b6ab76380d9babdd15f610237e1f3f2aa1c1f1e770b62fbb596381b2ebdd77ecef9c90d4c92f7b6b05fed2936285fa94826e62055322a33b6f04c74ce69e5d8d737fb838b79d2d48e3daf71387531882531a95ac964d02ea413bf85952982bbc089527daff5b845c9a0f4d14ef1956d9c3acae882d12da66da0f35794f5ee32232333517db9315232a183b991654dbea41615345c885325926744a53915",
58		"ECDSA-sign":      "1e35930be860d0942ca7bbd6f6ded87f157e4de24f81ed4b875c0e018e89a81f",
59		"ECDSA-verify":    "6780c5fc70275e2c7061a0e7877bb174deadeb9887027f3fa83654158ba7f50c2d36e5799790bfbe2183d33e96f3c51f6a232f2a24488c8e5f64c37ea2cf0529",
60		"Z-computation":   "e7604491269afb5b102d6ea52cb59feb70aede6ce3bfb3e0105485abd861d77b",
61		"FFDH":            "a14f8ad36be37b18b8f35864392f150ab7ee22c47e1870052a3f17918274af18aaeaf4cf6aacfde96c9d586eb7ebaff6b03fe3b79a8e2ff9dd6df34caaf2ac70fd3771d026b41a561ee90e4337d0575f8a0bd160c868e7e3cef88aa1d88448b1e4742ba11480a9f8a8b737347c408d74a7d57598c48875629df0c85327a124ddec1ad50cd597a985588434ce19c6f044a1696b5f244b899b7e77d4f6f20213ae8eb15d37eb8e67e6c8bdbc4fd6e17426283da96f23a897b210058c7c70fb126a5bf606dbeb1a6d5cca04184c4e95c2e8a70f50f5c1eabd066bd79c180456316ac02d366eb3b0e7ba82fb70dcbd737ca55734579dd250fffa8e0584be99d32b35",
62	}
63
64	listTests = flag.Bool("list-tests", false, "List known test values and exit")
65)
66
67func main() {
68	flag.Parse()
69
70	if *listTests {
71		for _, kat := range sortedKATs() {
72			fmt.Println(kat)
73		}
74		os.Exit(0)
75	}
76
77	if flag.NArg() == 0 || flag.NArg() > 2 || (flag.NArg() == 2 && kats[flag.Arg(1)] == "") {
78		fmt.Fprintln(os.Stderr, "Usage: break-kat <binary path> <test to break> > output")
79		fmt.Fprintln(os.Stderr, "       break-kat <binary path>  (to run all tests)")
80		fmt.Fprintln(os.Stderr, "Possible values for <test to break>:")
81		for _, kat := range sortedKATs() {
82			fmt.Fprintln(os.Stderr, " ", kat)
83		}
84		os.Exit(1)
85	}
86
87	inPath := flag.Arg(0)
88	binaryContents, err := os.ReadFile(inPath)
89	if err != nil {
90		fmt.Fprintln(os.Stderr, err)
91		os.Exit(2)
92	}
93
94	if flag.NArg() == 2 {
95		breakBinary(binaryContents, flag.Arg(1), os.Stdout)
96		return
97	}
98
99	for _, test := range sortedKATs() {
100		fmt.Printf("\n### Running test for %q\n\n", test)
101
102		const outFile = "test_fips_broken"
103		output, err := os.OpenFile(outFile, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0755)
104		if err != nil {
105			panic(err)
106		}
107		breakBinary(binaryContents, test, output)
108		output.Close()
109
110		cmd := exec.Command("./" + outFile)
111		cmd.Stdout = os.Stdout
112		cmd.Stderr = os.Stdout
113		if err := cmd.Run(); err != nil {
114			fmt.Printf("(task failed with: %s)\n", err)
115		} else {
116			fmt.Println("(task exec successful)")
117		}
118		os.Remove(outFile)
119	}
120
121	for _, test := range []string{"ECDSA_PWCT", "RSA_PWCT", "MLDSA_PWCT", "MLKEM_PWCT", "SLHDSA_PWCT", "CRNG"} {
122		fmt.Printf("\n### Running test for %q\n\n", test)
123
124		cmd := exec.Command("./" + inPath)
125		cmd.Env = append(cmd.Environ(), "BORINGSSL_FIPS_BREAK_TEST="+test)
126		cmd.Stdout = os.Stdout
127		cmd.Stderr = os.Stdout
128		if err := cmd.Run(); err != nil {
129			fmt.Printf("(task failed with: %s)\n", err)
130		} else {
131			fmt.Println("(task exec successful)")
132		}
133	}
134}
135
136func breakBinary(binaryContents []byte, test string, output io.Writer) {
137	testInputValue, err := hex.DecodeString(kats[test])
138	if err != nil {
139		panic("invalid KAT data: " + err.Error())
140	}
141
142	brokenContents := make([]byte, len(binaryContents))
143	copy(brokenContents, binaryContents)
144
145	found := false
146	for {
147		i := bytes.Index(brokenContents, testInputValue)
148		if i < 0 {
149			break
150		}
151		found = true
152
153		// Zero out the entire value because the compiler may produce code
154		// where parts of the value are embedded in the instructions.
155		// See crbug.com/399818730
156		for j := range testInputValue {
157			brokenContents[i+j] = 0
158		}
159	}
160
161	if !found {
162		fmt.Fprintln(os.Stderr, "Expected test input value for", test, "was not found in binary.")
163		os.Exit(3)
164	}
165
166	if n, err := output.Write(brokenContents); err != nil || n != len(brokenContents) {
167		fmt.Fprintf(os.Stderr, "Bad write: %s (%d vs expected %d)\n", err, n, len(brokenContents))
168		os.Exit(1)
169	}
170}
171
172func sortedKATs() []string {
173	var ret []string
174	for kat := range kats {
175		ret = append(ret, kat)
176	}
177	sort.Strings(ret)
178	return ret
179}
180