From 0023e37fbd0c33cca41c5e6f7f420cb330c8aea6 Mon Sep 17 00:00:00 2001
From: Huijing Hei <hhei@redhat.com>
Date: Fri, 13 Feb 2026 17:48:43 +0800
Subject: [PATCH] tests: add `fips.hmac` to verify VM will fail to reboot with
 FIPS and wrong hmac

Fixes: https://issues.redhat.com/browse/COS-3430
---
 mantle/kola/harness.go           |   5 +-
 mantle/kola/register/register.go |   1 +
 mantle/kola/tests/fips/hmac.go   | 101 +++++++++++++++++++++++++++++++
 3 files changed, 105 insertions(+), 2 deletions(-)
 create mode 100644 mantle/kola/tests/fips/hmac.go

diff --git a/mantle/kola/harness.go b/mantle/kola/harness.go
index d34f27710b..764b98a16c 100644
--- a/mantle/kola/harness.go
+++ b/mantle/kola/harness.go
@@ -155,8 +155,9 @@ var (
 			skipFlag:          &[]register.Flag{register.NoEmergencyShellCheck}[0],
 		},
 		{
-			desc:  "dracut fatal",
-			match: regexp.MustCompile("dracut: Refusing to continue"),
+			desc:     "dracut fatal",
+			match:    regexp.MustCompile("dracut: Refusing to continue"),
+			skipFlag: &[]register.Flag{register.NoDracutFatalCheck}[0],
 		},
 		{
 			desc:  "kernel panic",
diff --git a/mantle/kola/register/register.go b/mantle/kola/register/register.go
index 65bedb205c..73d021181a 100644
--- a/mantle/kola/register/register.go
+++ b/mantle/kola/register/register.go
@@ -30,6 +30,7 @@ const (
 	NoInstanceCreds                   // don't grant credentials (AWS instance profile, GCP service account) to the instance
 	NoEmergencyShellCheck             // don't check console output for emergency shell invocation
 	AllowConfigWarnings               // ignore Ignition and Butane warnings instead of failing
+	NoDracutFatalCheck                // don't check console output for dracut fatal errors
 )
 
 // NativeFuncWrap is a wrapper for the NativeFunc which includes an optional string of arches and/or distributions to
diff --git a/mantle/kola/tests/fips/hmac.go b/mantle/kola/tests/fips/hmac.go
new file mode 100644
index 0000000000..00ef987242
--- /dev/null
+++ b/mantle/kola/tests/fips/hmac.go
@@ -0,0 +1,101 @@
+// Copyright 2025 Red Hat, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package fips
+
+import (
+	"strings"
+	"time"
+
+	"github.com/coreos/coreos-assembler/mantle/kola/cluster"
+	"github.com/coreos/coreos-assembler/mantle/kola/register"
+	"github.com/coreos/coreos-assembler/mantle/platform"
+	"github.com/coreos/coreos-assembler/mantle/platform/conf"
+)
+
+var fipsConfig = conf.Butane(`
+variant: fcos
+version: 1.3.0
+storage:
+  files:
+    - path: /etc/ignition-machine-config-encapsulated.json
+      mode: 0644
+      overwrite: true
+      contents:
+        inline: |
+          {
+            "spec": { "fips": true }
+          }
+`)
+
+func init() {
+	register.RegisterTest(&register.Test{
+		Name:        "fips.hmac",
+		Description: "Verify VM will fail to reboot with FIPS and wrong hmac.",
+		Run:         runFipsHMACTest,
+		ClusterSize: 1,
+		UserData:    fipsConfig,
+		Platforms:   []string{"qemu"},
+		Tags:        []string{"fips"},
+		Distros:     []string{"rhcos"},
+		Flags:       []register.Flag{register.NoDracutFatalCheck},
+	})
+}
+
+func runFipsHMACTest(c cluster.TestCluster) {
+	// Run basic FIPS checks
+	m := c.Machines()[0]
+	c.AssertCmdOutputContains(m, `cat /proc/sys/crypto/fips_enabled`, "1")
+	c.AssertCmdOutputContains(m, `update-crypto-policies --show`, "FIPS")
+
+	// Find /boot/ostree/<hash>/.vmlinuz.*.hmac
+	hmacFileBytes, err := c.SSH(m, "find /boot/ostree/ -name .vmlinuz-$(uname -r).hmac")
+	if err != nil {
+		c.Fatalf("Failed to find HMAC file: %v", err)
+	}
+	hmacFile := strings.TrimSpace(string(hmacFileBytes))
+	if hmacFile == "" {
+		c.Fatal("HMAC file not found")
+	}
+
+	// Remount /boot to change HMAC value in /boot/ostree/<hash>/.vmlinuz.*.hmac
+	c.RunCmdSync(m, "sudo mount -o remount,rw /boot")
+	c.RunCmdSyncf(m, "sudo sh -c 'echo change > %s'", hmacFile)
+
+	// Initiate reboot
+	if err := platform.StartReboot(m); err != nil {
+		c.Fatalf("Failed to initiate reboot: %v", err)
+	}
+
+	// Wait for the boot to fail. Since the HMAC is corrupted, the machine
+	// will fail FIPS integrity check and never come back online.
+	// Using a 90 second timeout to allow enough time for boot attempt to fail.
+	time.Sleep(90 * time.Second)
+
+	// Verify the machine did not come back online by attempting SSH
+	_, _, err = m.SSH("whoami")
+	if err == nil {
+		c.Fatal("Expected machine to fail booting with corrupted HMAC, but it came back online")
+	}
+
+	// Destroy the machine to populate console output
+	m.Destroy()
+
+	// Check console output for FIPS integrity failure message
+	consoleOutput := m.ConsoleOutput()
+	searchPattern := "dracut: FATAL: FIPS integrity test failed"
+	if !strings.Contains(consoleOutput, searchPattern) {
+		c.Fatalf("Expected to find '%s' in console output after HMAC corruption, but it was not found", searchPattern)
+	}
+}