From: Nikos Mavrogiannopoulos Date: Sun, 21 Jan 2018 14:49:42 +0000 (+0100) Subject: tests: added unit test of gnutls_fips140_set_mode X-Git-Tag: gnutls_3_6_3~458 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b319cf7deb74f74bc9794cd1f3ebbac67b05e8fb;p=thirdparty%2Fgnutls.git tests: added unit test of gnutls_fips140_set_mode Also ensure that 512-bit keys cannot be generated in FIPS140-2 mode Signed-off-by: Nikos Mavrogiannopoulos --- diff --git a/tests/Makefile.am b/tests/Makefile.am index f7342e4ca6..3a8004aa8a 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -114,7 +114,7 @@ ctests = mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniqueid mini-dtls-srtp rsa-encrypt-decrypt mini-loss-time gnutls-strcodes \ mini-record mini-dtls-record mini-handshake-timeout mini-record-range \ mini-cert-status rsa-psk global-init sec-params sign-verify-data \ - fips-test mini-global-load name-constraints x509-extensions \ + fips-test fips-override-test mini-global-load name-constraints x509-extensions \ long-session-id mini-x509-callbacks-intr mini-dtls-lowmtu set_x509_key_file-late \ crlverify mini-dtls-discard init_fds mini-record-failure memset \ tls-rehandshake-cert-2 custom-urls set_x509_key_mem set_x509_key_file \ diff --git a/tests/fips-override-test.c b/tests/fips-override-test.c new file mode 100644 index 0000000000..8e0be9d462 --- /dev/null +++ b/tests/fips-override-test.c @@ -0,0 +1,133 @@ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +unsigned audit_called = 0; + +/* This does check the FIPS140 override support with + * gnutls_fips140_set_mode(). + */ + +static void tls_log_func(int level, const char *str) +{ + fprintf(stderr, "<%d>| %s", level, str); +} + +static void audit_log_func(gnutls_session_t session, const char *str) +{ + audit_called = 1; +} + + +static void try_crypto(void) +{ + static uint8_t key16[16]; + static uint8_t iv16[16]; + gnutls_datum_t key = { key16, sizeof(key16) }; + gnutls_datum_t iv = { iv16, sizeof(iv16) }; + gnutls_cipher_hd_t ch; + gnutls_hmac_hd_t mh; + int ret; + gnutls_x509_privkey_t privkey; + + ret = + gnutls_cipher_init(&ch, GNUTLS_CIPHER_ARCFOUR_128, &key, &iv); + if (ret < 0) { + fail("gnutls_cipher_init failed\n"); + } + gnutls_cipher_deinit(ch); + + ret = + gnutls_cipher_init(&ch, GNUTLS_CIPHER_AES_128_CBC, &key, &iv); + if (ret < 0) { + fail("gnutls_cipher_init failed\n"); + } + gnutls_cipher_deinit(ch); + + ret = gnutls_hmac_init(&mh, GNUTLS_MAC_MD5, key.data, key.size); + if (ret < 0) { + fail("gnutls_hmac_init failed\n"); + } + gnutls_hmac_deinit(mh, NULL); + + ret = gnutls_hmac_init(&mh, GNUTLS_MAC_SHA1, key.data, key.size); + if (ret < 0) { + fail("gnutls_hmac_init failed\n"); + } + gnutls_hmac_deinit(mh, NULL); + + ret = gnutls_rnd(GNUTLS_RND_NONCE, key16, sizeof(key16)); + if (ret < 0) { + fail("gnutls_rnd failed\n"); + } + + assert(gnutls_x509_privkey_init(&privkey) == 0); + ret = gnutls_x509_privkey_generate(privkey, GNUTLS_PK_RSA, 512, 0); + if (ret < 0) { + fail("gnutls_x509_privkey_generate failed for 512-bit key\n"); + } + gnutls_x509_privkey_deinit(privkey); +} + +void doit(void) +{ + int ret; + unsigned int mode; + + fprintf(stderr, + "Please note that if in FIPS140 mode, you need to assure the library's integrity prior to running this test\n"); + + gnutls_global_set_log_function(tls_log_func); + gnutls_global_set_audit_log_function(audit_log_func); + if (debug) + gnutls_global_set_log_level(4711); + + mode = gnutls_fips140_mode_enabled(); + if (mode == 0) { + success("We are not in FIPS140 mode\n"); + exit(77); + } + + ret = global_init(); + if (ret < 0) { + fail("Cannot initialize library\n"); + } + + /* switch to lax mode and check whether forbidden algorithms are accessible */ + gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, 0); + + try_crypto(); + + /* check whether audit log was called */ + if (audit_called) { + fail("the audit function was called in lax mode!\n"); + } + + gnutls_fips140_set_mode(GNUTLS_FIPS140_LOG, 0); + + try_crypto(); + + /* check whether audit log was called */ + if (!audit_called) { + fail("the audit function was not called in log mode!\n"); + } + + gnutls_fips140_set_mode(GNUTLS_FIPS140_SELFTESTS, 0); + if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_STRICT) + fail("switching to selftests didn't switch the lib to the expected mode\n"); + + gnutls_fips140_set_mode(532, 0); + if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_STRICT) + fail("switching to unknown mode didn't switch the lib to the expected mode\n"); + + gnutls_global_deinit(); + return; +} diff --git a/tests/fips-test.c b/tests/fips-test.c index 2d37c0f2f8..23d2318122 100644 --- a/tests/fips-test.c +++ b/tests/fips-test.c @@ -61,12 +61,23 @@ void doit(void) } gnutls_cipher_deinit(ch); + ret = + gnutls_cipher_init(&ch, GNUTLS_CIPHER_ARCFOUR_128, &key, &iv); + if (ret != GNUTLS_E_UNWANTED_ALGORITHM) { + fail("gnutls_cipher_init succeeded for arcfour\n"); + } + ret = gnutls_hmac_init(&mh, GNUTLS_MAC_SHA1, key.data, key.size); if (ret < 0) { fail("gnutls_hmac_init failed\n"); } gnutls_hmac_deinit(mh, NULL); + ret = gnutls_hmac_init(&mh, GNUTLS_MAC_MD5, key.data, key.size); + if (ret != GNUTLS_E_UNWANTED_ALGORITHM) { + fail("gnutls_hmac_init succeeded for md5\n"); + } + ret = gnutls_rnd(GNUTLS_RND_NONCE, key16, sizeof(key16)); if (ret < 0) { fail("gnutls_rnd failed\n"); @@ -84,18 +95,22 @@ void doit(void) } gnutls_privkey_deinit(privkey); - ret = gnutls_x509_privkey_init(&xprivkey); - if (ret < 0) { - fail("gnutls_privkey_init failed\n"); - } - gnutls_x509_privkey_deinit(xprivkey); - ret = gnutls_init(&session, 0); if (ret < 0) { fail("gnutls_init failed\n"); } gnutls_deinit(session); + ret = gnutls_x509_privkey_init(&xprivkey); + if (ret < 0) { + fail("gnutls_privkey_init failed\n"); + } + ret = gnutls_x509_privkey_generate(xprivkey, GNUTLS_PK_RSA, 512, 0); + if (ret != GNUTLS_E_PK_GENERATION_ERROR) { + fail("gnutls_x509_privkey_generate succeeded (%d) for 512-bit key\n", ret); + } + gnutls_x509_privkey_deinit(xprivkey); + /* Test when FIPS140 is set to error state */ _gnutls_lib_simulate_error(); diff --git a/tests/gnutls_hmac_fast.c b/tests/gnutls_hmac_fast.c index 35d8ba1651..604ffcd396 100644 --- a/tests/gnutls_hmac_fast.c +++ b/tests/gnutls_hmac_fast.c @@ -62,7 +62,7 @@ void doit(void) /* enable MD5 usage */ if (gnutls_fips140_mode_enabled()) { - gnutls_fips140_set_mode(GNUTLS_FIPS140_LOG); + gnutls_fips140_set_mode(GNUTLS_FIPS140_LOG, 0); } err =