dotnet / dotnet/runtime

Consider a FIPS category for cryptography smoke tests

Open
#122,151 4 comments 0 reactions 0 assignees View on GitHub
area-System.Security test-enhancement
Dominant language
C#
Stars
18.3k
Forks
5.6k
PR merge metrics
PR metrics pending

Description

The folks at Azure Linux would like to be able to validate SCOSSL on a FIPS-enforced configuration. The .NET test suite right now assumes that the test environment is not FIPS-enforced, and as discussed in https://github.com/dotnet/runtime/issues/110625 updating every single unit test to correctly handle being in a FIPS enforced environment is a significant undertaking. Thousands of tests fail in a FIPS-enforced environment, making it difficult to sift through the results meaningfully.

As an alternative, we could create a suite of tests that should pass in a FIPS constrained environment. For example, we could decorate tests with an xunit category like:

```C#
[Trait(XunitConstants.Category, "FIPS")]
```

And put that on tests and classes that should pass under FIPS, then can be run like so:

```shell
./dotnet.sh test src/libraries/System.Security.Cryptography/tests --filter category=FIPS /p:FullAssemblySigningSupported=false
```

The idea would not be to decorate every single thing that is FIPS compatible with the attribute, but to create a reasonable enough smoke test suite to exercise certain things.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.