Fix symcrypt errors in crypto_test

[maxtropets]

root [ /workspace/build ]# ./crypto_test
[doctest] doctest version is "2.4.11"
[doctest] run with "--help" for options
[ERROR] error:41080106:SCOSSL::passed invalid argument:Decoded content length does not fit in derField buffer. pbDerField [0x55ebfc892490, 0x55ebfc8924f8), pbContent [0x55ebfc892492, 0x55ebfc8924f9) at /usr/src/azl/BUILD/SymCrypt-OpenSSL-1.5.1/ScosslCommon/src/scossl_ecc.c, line 285
[ERROR] error:410C0107:SCOSSL::operation fail:scossl_ecdsa_remove_der failed at /usr/src/azl/BUILD/SymCrypt-OpenSSL-1.5.1/ScosslCommon/src/scossl_ecc.c, line 586
[ERROR] error:41080106:SCOSSL::passed invalid argument:Decoded content length does not fit in derField buffer. pbDerField [0x55ebfc85cc30, 0x55ebfc85cc77), pbContent [0x55ebfc85cc32, 0x55ebfc85cc78) at /usr/src/azl/BUILD/SymCrypt-OpenSSL-1.5.1/ScosslCommon/src/scossl_ecc.c, line 285
[ERROR] error:410C0107:SCOSSL::operation fail:scossl_ecdsa_remove_der failed at /usr/src/azl/BUILD/SymCrypt-OpenSSL-1.5.1/ScosslCommon/src/scossl_ecc.c, line 586
[ERROR] error:41080106:SCOSSL::passed invalid argument:cbR (48) or cbS (48) too big for cbSymCryptSignature (64) at /usr/src/azl/BUILD/SymCrypt-OpenSSL-1.5.1/ScosslCommon/src/scossl_ecc.c, line 400
[ERROR] error:410C0107:SCOSSL::operation fail:scossl_ecdsa_remove_der failed at /usr/src/azl/BUILD/SymCrypt-OpenSSL-1.5.1/ScosslCommon/src/scossl_ecc.c, line 586

[maxtropets]

Ok, seems like all the output is from these two testcases

TEST_CASE("Sign, fail to verify with bad signature")
TEST_CASE("Sign, fail to verify with wrong key on wrong curve")

Both test negative scenarios, one is corrupting a signature, another is using a wrong curve.

[maxtropets]

Both tests try out

static constexpr CurveID supported_curves[] = {
  CurveID::SECP384R1, CurveID::SECP256R1};

The corrupted signature produces error msgs for boths, however TEST_CASE("Sign, fail to verify with wrong key on wrong curve") only does it for SECP384R1

[maxtropets]

Errors from TEST_CASE("Sign, fail to verify with bad signature")

• https://github.com/microsoft/SymCrypt-OpenSSL/blob/main/ScosslCommon/src/scossl_ecc.c#L285
• https://github.com/microsoft/SymCrypt-OpenSSL/blob/main/ScosslCommon/src/scossl_ecc.c#L586

From TEST_CASE("Sign, fail to verify with wrong key on wrong curve")

• https://github.com/microsoft/SymCrypt-OpenSSL/blob/main/ScosslCommon/src/scossl_ecc.c#L400

From CCF perspective, all produced here.

That seems logical, now the question is - do we want them to be there in production or shall we look for suppression mechanisms?

My opinion - we don't failure scenarios, so we can keep those, as they may be useful and shall not be populated to often.

Would like to hear more opinions, @eddyashton, @achamayou

[eddyashton]

do we want them to be there in production or shall we look for suppression mechanisms?

We want to suppress these in production - we handle the failure ourselves and don't want to see symcrypt's internal logging. It's fine if they remain for debug builds, where there's a chance they're eventually useful.

[maxtropets]

Looked for ways to shut it up, seems like there's this function
https://github.com/microsoft/SymCrypt-OpenSSL/blob/main/ScosslCommon/inc/scossl_helpers.h#L84

but I don't see a header under /usr/...

I wonder if there's a way to access it via symcrypt somehow?..

[achamayou]

@maxtropets might need to install a symcrypt-devel or similarly named to get the relevant header

[maxtropets]

SO far

• Checked there's no devel package
• found nm -CD /usr/lib/engines-3/symcryptengine.so | grep set_trace is there

We could've defined void SCOSSL_set_trace_level(int trace_level, int ossl_ERR_level); and call it, but linker doesn't find a symbol, obviously. Removing LINKER:--no-undefined doesn't solve the issue.

I wonder if there is a way to defer the linkage to runtime until symcrypt is loaded?.

[maxtropets]

Currently postponed as awaiting response on microsoft/SymCrypt-OpenSSL#95.