coreos / coreos/coreos-assembler

Add negative test to verify fail to fetch the file resource with non-FIPS algorithms

Open
#4,520 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
393
Forks
193
Avg merge
17h 6m
Merged PRs (30d)
5

Description

According to https://github.com/coreos/coreos-assembler/pull/4477#issuecomment-4156120051, https://github.com/coreos/coreos-assembler/pull/4477#issuecomment-4091519907, https://github.com/coreos/coreos-assembler/pull/4477#issuecomment-4091846830

When testing this, we do not need both the client & server to be FIPS enabled to have a valid TLS connection, just care about the part you control to be in FIPS mode.

PR https://github.com/coreos/coreos-assembler/pull/4373 (enable FIPS on client) covers the test that Ignition config fetch file from the FIPS-compliant nginx, we need to add a negative test, that verifies that attempting to use algorithms that aren't FIPS compliant nginx will make the connection fail.

The steps are:

  • On server side (none FIPS):

Build nginx container, add ssl_ecdh_curve X25519 in nginx.conf, that means: When a client connects, I want to use the X25519 curve to negotiate the encryption keys (that is none FIPS-compliant).
Run nginx

  • On client (enable FIPS):
    Start with FIPS enabled, use ignition to fetch file from server failed

See the details in https://hackmd.io/6KV-LsE3QReu34nQQOgruA?view

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review PR 4373 and the linked HackMD for the existing FIPS-enabled client test and test entry point. Build the non-FIPS nginx container with ssl_ecdh_curve X25519, run it, then exercise Ignition with a FIPS-enabled client. Done means the file fetch fails when the server requires the non-FIPS algorithm.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go, nginx
Domain
security, testing-qa
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.