coreos / coreos/coreos-assembler
Add negative test to verify fail to fetch the file resource with non-FIPS algorithms
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 393
- Forks
- 193
- Avg merge
- 17h 6m
- Merged PRs (30d)
- 5
Description
According to https://github.com/coreos/coreos-assembler/pull/4477#issuecomment-4156120051, https://github.com/coreos/coreos-assembler/pull/4477#issuecomment-4091519907, https://github.com/coreos/coreos-assembler/pull/4477#issuecomment-4091846830
When testing this, we do not need both the client & server to be FIPS enabled to have a valid TLS connection, just care about the part you control to be in FIPS mode.
PR https://github.com/coreos/coreos-assembler/pull/4373 (enable FIPS on client) covers the test that Ignition config fetch file from the FIPS-compliant nginx, we need to add a negative test, that verifies that attempting to use algorithms that aren't FIPS compliant nginx will make the connection fail.
The steps are:
- On server side (none FIPS):
Build nginx container, add ssl_ecdh_curve X25519 in nginx.conf, that means: When a client connects, I want to use the X25519 curve to negotiate the encryption keys (that is none FIPS-compliant).
Run nginx
- On client (enable FIPS):
Start with FIPS enabled, use ignition to fetch file from server failed
See the details in https://hackmd.io/6KV-LsE3QReu34nQQOgruA?view
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review PR 4373 and the linked HackMD for the existing FIPS-enabled client test and test entry point. Build the non-FIPS nginx container with ssl_ecdh_curve X25519, run it, then exercise Ignition with a FIPS-enabled client. Done means the file fetch fails when the server requires the non-FIPS algorithm.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go, nginx
- Domain
- security, testing-qa
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100