Add configuration option to disable/enable DSA signing and verification

DSA signing and verification is enabled by default

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

diff --git a/configure.ac b/configure.ac
index 62a7fbdf66c5b9af0fa50e2c7682dd7b8f1b73b8..fb0aefe1f49bed16363b356199e5fa4616b9a3ea 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -733,6 +733,14 @@ if test "$enable_non_suiteb" = "yes";then
 fi
 AM_CONDITIONAL(ENABLE_NON_SUITEB_CURVES, test "$enable_non_suiteb" = "yes")
 
+AC_ARG_ENABLE(dsa,
+  AS_HELP_STRING([--disable-dsa], [disable DSA]),
+  enable_dsa=$enableval, enable_dsa=yes)
+if test x$enable_dsa != xno; then
+    AC_DEFINE([ENABLE_DSA], 1, [Define if DSA is enabled.])
+fi
+AM_CONDITIONAL([ENABLE_DSA], [test x$enable_dsa != xno])
+
 # We MUST require a Nettle version that has rsa_sec_decrypt now.
 save_LIBS=$LIBS
 LIBS="$LIBS $HOGWEED_LIBS $NETTLE_LIBS $GMP_LIBS"

diff --git a/lib/crypto-selftests-pk.c b/lib/crypto-selftests-pk.c
index 5e638010699bd15dd72dcb1862154a1429df6cdd..c7ede99c66508ede44c925d6bba38b8357c438d6 100644 (file)
--- a/lib/crypto-selftests-pk.c
+++ b/lib/crypto-selftests-pk.c
@@ -110,11 +110,13 @@ static const char dsa_2048_privkey[] =
        "kTlCAhxYGpVgtfB96qmJukyl9GOGvfkwFTgEyIDoV84M\n"
        "-----END DSA PRIVATE KEY-----\n";
 
+#ifdef ENABLE_DSA
 static const char dsa_2048_sig[] =
        "\x30\x3d\x02\x1d\x00\xbe\x87\x2f\xcf\xa1\xe4\x86\x5c\x72\x58\x4a"
        "\x7b\x8f\x32\x7f\xa5\x1b\xdc\x5c\xae\xda\x98\xea\x15\x32\xed\x0c"
        "\x4e\x02\x1c\x4c\x76\x01\x2b\xcd\xb9\x33\x95\xf2\xfa\xde\x56\x01"
        "\xb7\xaa\xe4\x5a\x4a\x2e\xf1\x24\x5a\xd1\xb5\x83\x9a\x93\x61";
+#endif
 
 /* secp256r1 private key and signature */
 static const char ecdsa_secp256r1_privkey[] =
@@ -1007,6 +1009,7 @@ int gnutls_pk_self_test(unsigned flags, gnutls_pk_algorithm_t pk)
                        return 0;
 
                FALLTHROUGH;
+#ifdef ENABLE_DSA
        case GNUTLS_PK_DSA:
                if (is_post || !is_fips140_mode_enabled) {
                        PK_KNOWN_TEST(GNUTLS_PK_DSA, 2048, GNUTLS_DIG_SHA256,
@@ -1021,6 +1024,7 @@ int gnutls_pk_self_test(unsigned flags, gnutls_pk_algorithm_t pk)
                        return 0;
 
                FALLTHROUGH;
+#endif
        case GNUTLS_PK_EC:
                /* Test ECDH and ECDSA */
                ret = test_ecdh();

diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
index 3232ff1b0d12d51adf60af298f6230c4129e2fe0..b317b790d7c97e8c7cc70be3133dc870b5cb4fa3 100644 (file)
--- a/lib/nettle/pk.c
+++ b/lib/nettle/pk.c
@@ -1525,6 +1525,7 @@ static int _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
                }
                break;
        }
+#ifdef ENABLE_DSA
        case GNUTLS_PK_DSA: {
                struct dsa_params pub;
                bigint_t priv;
@@ -1602,6 +1603,7 @@ static int _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
                }
                break;
        }
+#endif
        case GNUTLS_PK_RSA: {
                struct rsa_private_key priv;
                struct rsa_public_key pub;
@@ -1945,6 +1947,7 @@ static int _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
                ecc_point_clear(&pub);
                break;
        }
+#ifdef ENABLE_DSA
        case GNUTLS_PK_DSA: {
                struct dsa_params pub;
                struct dsa_signature sig;
@@ -1980,6 +1983,7 @@ static int _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
 
                break;
        }
+#endif
        case GNUTLS_PK_RSA: {
                struct rsa_public_key pub;
                size_t bits;
@@ -2221,7 +2225,9 @@ static int _wrap_nettle_pk_exists(gnutls_pk_algorithm_t pk)
 {
        switch (pk) {
        case GNUTLS_PK_RSA:
+#ifdef ENABLE_DSA
        case GNUTLS_PK_DSA:
+#endif
        case GNUTLS_PK_DH:
        case GNUTLS_PK_ECDSA:
        case GNUTLS_PK_ECDH_X25519:
@@ -2245,7 +2251,9 @@ static int _wrap_nettle_pk_sign_exists(gnutls_sign_algorithm_t sign)
 {
        switch (sign) {
        case GNUTLS_SIGN_RSA_SHA1:
+#ifdef ENABLE_DSA
        case GNUTLS_SIGN_DSA_SHA1:
+#endif
        case GNUTLS_SIGN_RSA_MD5:
        case GNUTLS_SIGN_RSA_MD2:
        case GNUTLS_SIGN_RSA_RMD160:
@@ -2253,24 +2261,30 @@ static int _wrap_nettle_pk_sign_exists(gnutls_sign_algorithm_t sign)
        case GNUTLS_SIGN_RSA_SHA384:
        case GNUTLS_SIGN_RSA_SHA512:
        case GNUTLS_SIGN_RSA_SHA224:
+#ifdef ENABLE_DSA
        case GNUTLS_SIGN_DSA_SHA224:
        case GNUTLS_SIGN_DSA_SHA256:
+#endif
        case GNUTLS_SIGN_ECDSA_SHA1:
        case GNUTLS_SIGN_ECDSA_SHA224:
        case GNUTLS_SIGN_ECDSA_SHA256:
        case GNUTLS_SIGN_ECDSA_SHA384:
        case GNUTLS_SIGN_ECDSA_SHA512:
+#ifdef ENABLE_DSA
        case GNUTLS_SIGN_DSA_SHA384:
        case GNUTLS_SIGN_DSA_SHA512:
+#endif
        case GNUTLS_SIGN_ECDSA_SHA3_224:
        case GNUTLS_SIGN_ECDSA_SHA3_256:
        case GNUTLS_SIGN_ECDSA_SHA3_384:
        case GNUTLS_SIGN_ECDSA_SHA3_512:
 
+#ifdef ENABLE_DSA
        case GNUTLS_SIGN_DSA_SHA3_224:
        case GNUTLS_SIGN_DSA_SHA3_256:
        case GNUTLS_SIGN_DSA_SHA3_384:
        case GNUTLS_SIGN_DSA_SHA3_512:
+#endif
        case GNUTLS_SIGN_RSA_SHA3_224:
        case GNUTLS_SIGN_RSA_SHA3_256:
        case GNUTLS_SIGN_RSA_SHA3_384:
@@ -2319,7 +2333,9 @@ static int wrap_nettle_pk_generate_params(gnutls_pk_algorithm_t algo,
        params->algo = algo;
 
        switch (algo) {
+#ifdef ENABLE_DSA
        case GNUTLS_PK_DSA:
+#endif
        case GNUTLS_PK_DH: {
                struct dsa_params pub;
                struct dss_params_validation_seeds cert;
@@ -2812,7 +2828,9 @@ static int pct_test(gnutls_pk_algorithm_t algo,
        case GNUTLS_PK_EC: /* we only do keys for ECDSA */
        case GNUTLS_PK_EDDSA_ED25519:
        case GNUTLS_PK_EDDSA_ED448:
+#ifdef ENABLE_DSA
        case GNUTLS_PK_DSA:
+#endif
        case GNUTLS_PK_RSA_PSS:
        case GNUTLS_PK_GOST_01:
        case GNUTLS_PK_GOST_12_256:
@@ -2983,6 +3001,7 @@ wrap_nettle_pk_generate_keys(gnutls_pk_algorithm_t algo,
        }
 
        switch (algo) {
+#ifdef ENABLE_DSA
        case GNUTLS_PK_DSA:
 #ifdef ENABLE_FIPS140
                if (_gnutls_fips_mode_enabled() != 0) {
@@ -3035,6 +3054,7 @@ wrap_nettle_pk_generate_keys(gnutls_pk_algorithm_t algo,
                }
 #endif
                FALLTHROUGH;
+#endif
        case GNUTLS_PK_DH: {
                struct dsa_params pub;
                mpz_t r;
@@ -3686,8 +3706,10 @@ static int wrap_nettle_pk_verify_priv_params(gnutls_pk_algorithm_t algo,
        }
 
        break;
-       case GNUTLS_PK_DH:
-       case GNUTLS_PK_DSA: {
+#ifdef ENABLE_DSA
+       case GNUTLS_PK_DSA:
+#endif
+       case GNUTLS_PK_DH: {
                bigint_t t1 = NULL;
 
                if (params->params_nr != DSA_PRIVATE_PARAMS)
@@ -3919,7 +3941,9 @@ static int wrap_nettle_pk_verify_pub_params(gnutls_pk_algorithm_t algo,
        case GNUTLS_PK_RSA:
        case GNUTLS_PK_RSA_PSS:
        case GNUTLS_PK_RSA_OAEP:
+#ifdef ENABLE_DSA
        case GNUTLS_PK_DSA:
+#endif
        case GNUTLS_PK_EDDSA_ED25519:
        case GNUTLS_PK_EDDSA_ED448:
                return 0;
@@ -4074,6 +4098,7 @@ static int calc_rsa_priv(gnutls_pk_params_st *params)
        return 0;
 }
 
+#ifdef ENABLE_DSA
 static int calc_dsa_pub(gnutls_pk_params_st *params)
 {
        int ret;
@@ -4094,6 +4119,7 @@ static int calc_dsa_pub(gnutls_pk_params_st *params)
 
        return 0;
 }
+#endif
 
 static int wrap_nettle_pk_fixup(gnutls_pk_algorithm_t algo,
                                gnutls_direction_t direction,
@@ -4217,7 +4243,9 @@ static int wrap_nettle_pk_fixup(gnutls_pk_algorithm_t algo,
                                params->spki.salt_size, pub_size,
                                GNUTLS_E_PK_INVALID_PUBKEY_PARAMS);
                }
-       } else if (algo == GNUTLS_PK_DSA) {
+       }
+#ifdef ENABLE_DSA
+       else if (algo == GNUTLS_PK_DSA) {
                if (params->params[DSA_Y] == NULL) {
                        ret = calc_dsa_pub(params);
                        if (ret < 0)
@@ -4225,6 +4253,7 @@ static int wrap_nettle_pk_fixup(gnutls_pk_algorithm_t algo,
                        params->params_nr++;
                }
        }
+#endif
 #if ENABLE_GOST
        else if (algo == GNUTLS_PK_GOST_01 || algo == GNUTLS_PK_GOST_12_256 ||
                 algo == GNUTLS_PK_GOST_12_512) {

diff --git a/tests/Makefile.am b/tests/Makefile.am
index 189d0689b5c7aa2dfd77054850ca4e6da285e91f..c674835c1ff5c71835b90ad0c21645b9bbd3416b 100644 (file)
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -651,6 +651,12 @@ else
 TESTS_ENVIRONMENT += ENABLE_SSL3=0
 endif
 
+if ENABLE_DSA
+TESTS_ENVIRONMENT += ENABLE_DSA=1
+else
+TESTS_ENVIRONMENT += ENABLE_DSA=0
+endif
+
 if ENABLE_GOST
 TESTS_ENVIRONMENT += ENABLE_GOST=1
 else

diff --git a/tests/cert-tests/dsa.sh b/tests/cert-tests/dsa.sh
index e28b493461f80c17585c2b2d82ad0586ffbc03ba..fb8370c3dc3aada0f8dc9727b58412af10c5e1ea 100644 (file)
--- a/tests/cert-tests/dsa.sh
+++ b/tests/cert-tests/dsa.sh
@@ -27,6 +27,10 @@ unset RETCODE
 
 : ${CERTTOOL=../../src/certtool${EXEEXT}}
 
+if test "x$ENABLE_DSA" != "x1"; then
+       exit 77
+fi
+
 if ! test -x "${CERTTOOL}"; then
        exit 77
 fi

diff --git a/tests/cert-tests/provable-dh-default.sh b/tests/cert-tests/provable-dh-default.sh
index 83ab74f52ef7ff63c45f23b8c997266f217b2d00..6f060ebe02a50a214e31094a116e9fd608eda11a 100644 (file)
--- a/tests/cert-tests/provable-dh-default.sh
+++ b/tests/cert-tests/provable-dh-default.sh
@@ -24,6 +24,10 @@
 : ${DIFF=diff}
 OUTFILE=provable-dh$$.tmp
 
+if test "x$ENABLE_DSA" != "x1"; then
+       exit 77
+fi
+
 if ! test -x "${CERTTOOL}"; then
        exit 77
 fi

diff --git a/tests/cert-tests/provable-dh.sh b/tests/cert-tests/provable-dh.sh
index be860ecf91a74bce6a6c92ac69f3b5b422072d44..3b6f3b16855d617c7d3da843e321ddb92771f9b0 100644 (file)
--- a/tests/cert-tests/provable-dh.sh
+++ b/tests/cert-tests/provable-dh.sh
@@ -24,6 +24,10 @@
 : ${DIFF=diff}
 OUTFILE=provable-dh$$.tmp
 
+if test "x$ENABLE_DSA" != "x1"; then
+       exit 77
+fi
+
 if ! test -x "${CERTTOOL}"; then
        exit 77
 fi

diff --git a/tests/cert-tests/provable-privkey-dsa2048.sh b/tests/cert-tests/provable-privkey-dsa2048.sh
index c2c9f252d23b5ff6da99e20b78edff1e45f452bb..9d6dbcdfcfbf1b41f616b83d273efb47813f28f6 100644 (file)
--- a/tests/cert-tests/provable-privkey-dsa2048.sh
+++ b/tests/cert-tests/provable-privkey-dsa2048.sh
@@ -24,6 +24,10 @@
 : ${DIFF=diff}
 OUTFILE=provable-privkey.tmp
 
+if test "x$ENABLE_DSA" != "x1"; then
+       exit 77
+fi
+
 if ! test -x "${CERTTOOL}"; then
        exit 77
 fi

diff --git a/tests/cert-tests/provable-privkey.sh b/tests/cert-tests/provable-privkey.sh
index bda8b8c4f52e43941a8d583658b6288d03255041..adafba1657ef8b3cfba6c6c70ee3b4565fbabe9c 100644 (file)
--- a/tests/cert-tests/provable-privkey.sh
+++ b/tests/cert-tests/provable-privkey.sh
@@ -24,6 +24,10 @@
 : ${DIFF=diff}
 OUTFILE=provable-privkey$$.tmp
 
+if test "x$ENABLE_DSA" != "x1"; then
+       exit 77
+fi
+
 if ! test -x "${CERTTOOL}"; then
        exit 77
 fi

diff --git a/tests/cert-tests/sha2-dsa-test.sh b/tests/cert-tests/sha2-dsa-test.sh
index 83f7e160fa386a82aa8fb92180d43ce596057a99..c2edabfcec0c9cd7177f6771843ef7e88fe89c5b 100644 (file)
--- a/tests/cert-tests/sha2-dsa-test.sh
+++ b/tests/cert-tests/sha2-dsa-test.sh
@@ -30,6 +30,10 @@ TMPFILE=sha2-dsa.$$.tmp
 USERFILE=user-dsa.$$.tmp
 VERIFYFILE=verify-dsa.$$.tmp
 
+if test "x$ENABLE_DSA" != "x1"; then
+       exit 77
+fi
+
 if ! test -x "${CERTTOOL}"; then
        exit 77
 fi

diff --git a/tests/client_dsa_key.c b/tests/client_dsa_key.c
index 18108d2e1db188dc181796c3ec405378aaa5afd6..fef99dbfd50c11cdc19c453e3e9b0776f2b91cca 100644 (file)
--- a/tests/client_dsa_key.c
+++ b/tests/client_dsa_key.c
@@ -23,8 +23,18 @@
 #include "config.h"
 #endif
 
-#include <stdio.h>
 #include <stdlib.h>
+
+#ifndef ENABLE_DSA
+
+int main(int argc, char **argv)
+{
+       exit(77);
+}
+
+#else
+
+#include <stdio.h>
 #include <string.h>
 #include <sys/types.h>
 #if !defined(_WIN32)
@@ -113,3 +123,5 @@ void doit(void)
        if (debug)
                success("success");
 }
+
+#endif /* ENABLE_DSA */

diff --git a/tests/common-key-tests.h b/tests/common-key-tests.h
index b36177bce5ec5743b25b3cb48ae291e05d0b3bd1..05329ce7576c3a939bb1e77ddd51bd2c8838a9d2 100644 (file)
--- a/tests/common-key-tests.h
+++ b/tests/common-key-tests.h
@@ -44,6 +44,7 @@ static const struct _key_tests_st common_key_tests[] = {
          .pk = GNUTLS_PK_RSA,
          .digest = GNUTLS_DIG_SHA256,
          .sigalgo = GNUTLS_SIGN_RSA_SHA256 },
+#ifdef ENABLE_DSA
        { .name = "dsa key",
          .key = { (void *)clidsa_ca3_key_pem, sizeof(clidsa_ca3_key_pem) - 1 },
          .cert = { (void *)clidsa_ca3_cert_pem,
@@ -51,6 +52,7 @@ static const struct _key_tests_st common_key_tests[] = {
          .pk = GNUTLS_PK_DSA,
          .digest = GNUTLS_DIG_SHA1,
          .sigalgo = GNUTLS_SIGN_DSA_SHA1 },
+#endif
        { .name = "ecdsa key",
          .key = { (void *)server_ca3_ecc_key_pem,
                   sizeof(server_ca3_ecc_key_pem) - 1 },

diff --git a/tests/crl-basic.c b/tests/crl-basic.c
index 95c440a4fca942a950a5f2c6bc97c5affbf540c0..802a3450360ccecf4467727ae1403dea8ab40006 100644 (file)
--- a/tests/crl-basic.c
+++ b/tests/crl-basic.c
@@ -60,6 +60,7 @@ static const char simple1_constraints[] =
        "9Yzpq6gAi39ZK+LjopgGDkrQjxzBIaoe2bcDqB7X\n"
        "-----END X509 CRL-----\n";
 
+#ifdef ENABLE_DSA
 static const char crl_dsa[] =
        "-----BEGIN X509 CRL-----\n"
        "MIGmMGUwCwYHKoZIzjgEAwUAMDgxCzAJBgNVBAYTAnVzMQwwCgYDVQQKEwNzdW4x\n"
@@ -67,6 +68,7 @@ static const char crl_dsa[] =
        "NTE3MTk1OTQwWjALBgcqhkjOOAQDBQADMAAwLQIUBBFLGYjUCVrRTGf3GTR6SGs/\n"
        "accCFQCUhnSmr+CXCWKq8DtydVwH9FLsRA==\n"
        "-----END X509 CRL-----\n";
+#endif
 
 static const char crl_rsa_sha1[] =
        "-----BEGIN X509 CRL-----\n"
@@ -108,6 +110,7 @@ static struct {
                   .crt_count = 0,
                   .this_update = 1410598756,
                   .next_update = 1442134756 },
+#ifdef ENABLE_DSA
                 { .name = "crl-dsa",
                   .crl = crl_dsa,
                   .sign_algo = GNUTLS_SIGN_DSA_SHA1,
@@ -115,6 +118,7 @@ static struct {
                   .crt_count = 0,
                   .this_update = 1116359980,
                   .next_update = 1147895980 },
+#endif
                 { .name = "crl-rsa-sha1",
                   .crl = crl_rsa_sha1,
                   .sign_algo = GNUTLS_SIGN_RSA_SHA1,

diff --git a/tests/crq_key_id.c b/tests/crq_key_id.c
index 5bf0a612501ebbe82aa447532b5c207c176aa4e0..74b6bfcc1443e0fc83796aa4776e0e98b3d6dd7d 100644 (file)
--- a/tests/crq_key_id.c
+++ b/tests/crq_key_id.c
@@ -63,6 +63,10 @@ void doit(void)
 
        for (algorithm = GNUTLS_PK_RSA; algorithm <= GNUTLS_PK_DSA;
             algorithm++) {
+#ifndef ENABLE_DSA
+               if (algorithm == GNUTLS_PK_DSA)
+                       continue;
+#endif
                ret = gnutls_x509_crq_init(&crq);
                if (ret < 0)
                        fail("gnutls_x509_crq_init: %d: %s\n", ret,

diff --git a/tests/cve-2009-1415.c b/tests/cve-2009-1415.c
index 3337e8d869c76a801193346371e089dea079d9b5..8e680d0aa6296733705bdecb467308aaea98cf6a 100644 (file)
--- a/tests/cve-2009-1415.c
+++ b/tests/cve-2009-1415.c
@@ -39,9 +39,19 @@
  * ...
  */
 
+#include <stdlib.h>
+
+#ifndef ENABLE_DSA
+
+int main(int argc, char **argv)
+{
+       exit(77);
+}
+
+#else
+
 #include <stdio.h>
 #include <stdarg.h>
-#include <stdlib.h>
 #include "utils.h"
 
 #include <gnutls/gnutls.h>
@@ -112,3 +122,5 @@ int main(void)
 
        return 0;
 }
+
+#endif /* ENABLE_DSA */

diff --git a/tests/cve-2009-1416.c b/tests/cve-2009-1416.c
index a738c9ad9716c527bbdd34b5fdbad9238f57d2d7..29a412e545e14bfcdd718544263e3d950d1c800e 100644 (file)
--- a/tests/cve-2009-1416.c
+++ b/tests/cve-2009-1416.c
@@ -36,9 +36,19 @@
  *
  */
 
+#include <stdlib.h>
+
+#ifndef ENABLE_DSA
+
+int main(int argc, char **argv)
+{
+       exit(77);
+}
+
+#else
+
 #include <stdio.h>
 #include <stdarg.h>
-#include <stdlib.h>
 #include <string.h>
 #include "utils.h"
 
@@ -86,3 +96,5 @@ int main(void)
 
        return 0;
 }
+
+#endif /* ENABLE_DSA */

diff --git a/tests/gnutls-strcodes.c b/tests/gnutls-strcodes.c
index 9dcbb2158beca88eda1fd0a0c12e17ba32e59ed6..500d39f9719efa4ef35f8492942ca1348a7e4929 100644 (file)
--- a/tests/gnutls-strcodes.c
+++ b/tests/gnutls-strcodes.c
@@ -101,6 +101,17 @@ void doit(void)
        for (i = GNUTLS_SIGN_UNKNOWN + 1; i <= GNUTLS_SIGN_MAX; i++) {
                if (i == 19)
                        continue;
+#ifndef ENABLE_DSA
+               if (i == GNUTLS_SIGN_DSA_SHA1 || i == GNUTLS_SIGN_DSA_SHA224 ||
+                   i == GNUTLS_SIGN_DSA_SHA256 ||
+                   i == GNUTLS_SIGN_DSA_SHA384 ||
+                   i == GNUTLS_SIGN_DSA_SHA512 ||
+                   i == GNUTLS_SIGN_DSA_SHA3_224 ||
+                   i == GNUTLS_SIGN_DSA_SHA3_256 ||
+                   i == GNUTLS_SIGN_DSA_SHA3_384 ||
+                   i == GNUTLS_SIGN_DSA_SHA3_512)
+                       continue;
+#endif
                check_unique_non_null(gnutls_sign_algorithm_get_name(i));
        }
 

diff --git a/tests/gnutls_x509_privkey_import.c b/tests/gnutls_x509_privkey_import.c
index f1182916de300b44e68f2929fa8e5cfcad390020..387674d88a07d173466ca731613c69e00ea9cfdb 100644 (file)
--- a/tests/gnutls_x509_privkey_import.c
+++ b/tests/gnutls_x509_privkey_import.c
@@ -197,12 +197,14 @@ static const test_st tests[] = { {
                                         .sig = GNUTLS_SIGN_RSA_PSS_SHA256,
                                         .key = &server_ca3_rsa_pss2_key,
                                 },
+#ifdef ENABLE_DSA
                                 {
                                         .name = "dsa key",
                                         .pk = GNUTLS_PK_DSA,
                                         .sig = GNUTLS_SIGN_DSA_SHA1,
                                         .key = &dsa_key,
                                 },
+#endif
                                 {
                                         .name = "ed25519 key (PKCS#8)",
                                         .pk = GNUTLS_PK_EDDSA_ED25519,

diff --git a/tests/key-import-export.c b/tests/key-import-export.c
index 7fec313325ed8a416af0801bad7cd7f12b4aebe5..51f92840b410bca0ee36a37d945678a3decadd26 100644 (file)
--- a/tests/key-import-export.c
+++ b/tests/key-import-export.c
@@ -318,7 +318,10 @@ static int check_privkey_import_export(void)
                { &_rsa_u, NULL, &_rsa_e2 },
        };
        gnutls_privkey_t key;
-       gnutls_datum_t p, q, g, y, x;
+#ifdef ENABLE_DSA
+       gnutls_datum_t g;
+#endif
+       gnutls_datum_t p, q, y, x;
        gnutls_datum_t m, e, u, e1, e2, d;
        gnutls_ecc_curve_t curve;
 #ifdef ENABLE_GOST
@@ -330,6 +333,7 @@ static int check_privkey_import_export(void)
 
        global_init();
 
+#ifdef ENABLE_DSA
        ret = gnutls_privkey_init(&key);
        if (ret < 0)
                fail("error\n");
@@ -396,6 +400,7 @@ static int check_privkey_import_export(void)
        gnutls_free(y.data);
        gnutls_free(x.data);
        gnutls_privkey_deinit(key);
+#endif
 
        /* RSA */
 
@@ -667,6 +672,7 @@ static int check_privkey_import_export(void)
        return 0;
 }
 
+#ifdef ENABLE_DSA
 static int check_dsa(void)
 {
        gnutls_privkey_t key;
@@ -747,6 +753,7 @@ static int check_dsa(void)
 
        return 0;
 }
+#endif
 
 static int check_rsa(void)
 {
@@ -1159,10 +1166,12 @@ void doit(void)
                exit(1);
        }
 
+#ifdef ENABLE_DSA
        if (check_dsa() != 0) {
                fail("error in DSA check\n");
                exit(1);
        }
+#endif
 
        if (check_rsa() != 0) {
                fail("error in RSA check\n");

diff --git a/tests/privkey-keygen.c b/tests/privkey-keygen.c
index 10a5d4dbeefb344ce6a0a62d8b7a0a8103625f52..6003430de3946c75980c7b2094f5cbc6fa8c3a59 100644 (file)
--- a/tests/privkey-keygen.c
+++ b/tests/privkey-keygen.c
@@ -139,6 +139,9 @@ void doit(void)
                for (algorithm = GNUTLS_PK_RSA; algorithm <= GNUTLS_PK_MAX;
                     algorithm++) {
                        if (algorithm == GNUTLS_PK_DH ||
+#ifndef ENABLE_DSA
+                           algorithm == GNUTLS_PK_DSA ||
+#endif
                            algorithm == GNUTLS_PK_ECDH_X25519 ||
                            algorithm == GNUTLS_PK_ECDH_X448)
                                continue;

diff --git a/tests/sign-is-secure.c b/tests/sign-is-secure.c
index 3b28415b6c7acf64ad935ea664b06ad5c6da05b0..da9fcd2731025ab7bc4346519c2b912975e8d632 100644 (file)
--- a/tests/sign-is-secure.c
+++ b/tests/sign-is-secure.c
@@ -80,7 +80,9 @@ void doit(void)
        unsigned i;
 
        CHECK_INSECURE_FOR_CERTS_SIG(GNUTLS_SIGN_RSA_SHA1);
+#ifdef ENABLE_DSA
        CHECK_INSECURE_FOR_CERTS_SIG(GNUTLS_SIGN_DSA_SHA1);
+#endif
        CHECK_INSECURE_FOR_CERTS_SIG(GNUTLS_SIGN_ECDSA_SHA1);
 
        CHECK_INSECURE_SIG(GNUTLS_SIGN_RSA_MD5);

diff --git a/tests/sign-verify-deterministic.c b/tests/sign-verify-deterministic.c
index bdd5a49c7db3cefcc724b70fd5656b93f83cbb69..4adccd17864b4aef8cc071e4557c728746126c56 100644 (file)
--- a/tests/sign-verify-deterministic.c
+++ b/tests/sign-verify-deterministic.c
@@ -58,6 +58,7 @@ struct _key_tests_st {
 };
 
 /* Test vectors from RFC 6979 */
+#ifdef ENABLE_DSA
 static const char dsa_privkey_rfc6979[] =
        "-----BEGIN DSA PRIVATE KEY-----\n"
        "MIIBugIBAAKBgQCG9coD3P6yJQY/+DCgx2m53Z1hU62R184n94fEMni0R+ZTO4ax\n"
@@ -71,6 +72,7 @@ static const char dsa_privkey_rfc6979[] =
        "xeRzUIJTseaC9ly9xPrpPC6iEjkOVJBahuIiMXC0Tqp9pd2f/Pt/OwIUQRYCyxmm\n"
        "zMNElNedmO8eftWvJfc=\n"
        "-----END DSA PRIVATE KEY-----\n";
+#endif
 
 static const char ecdsa_secp256r1_privkey_rfc6979[] =
        "-----BEGIN EC PRIVATE KEY-----\n"
@@ -82,6 +84,7 @@ static const char ecdsa_secp256r1_privkey_rfc6979[] =
 static const char sample[] = "sample";
 
 static const struct _key_tests_st tests[] = {
+#ifdef ENABLE_DSA
        { .name = "dsa key",
          .key = { (void *)dsa_privkey_rfc6979,
                   sizeof(dsa_privkey_rfc6979) - 1 },
@@ -92,6 +95,7 @@ static const struct _key_tests_st tests[] = {
          .digest = GNUTLS_DIG_SHA256,
          .sigalgo = GNUTLS_SIGN_DSA_SHA256,
          .sign_flags = GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE },
+#endif
        { .name = "ecdsa key",
          .key = { (void *)ecdsa_secp256r1_privkey_rfc6979,
                   sizeof(ecdsa_secp256r1_privkey_rfc6979) - 1 },

diff --git a/tests/testpkcs11.sh b/tests/testpkcs11.sh
index 486a16db947afa87db28d8a0e88e3dea98b2857b..39bb08f9ccf0e48afd4f78ff29c1005a01b5c30e 100755 (executable)
--- a/tests/testpkcs11.sh
+++ b/tests/testpkcs11.sh
@@ -1177,15 +1177,20 @@ fi
 generate_temp_rsa_privkey "${TOKEN}" "${TEST_PIN}" 2048
 delete_temp_privkey "${TOKEN}" "${TEST_PIN}" rsa-2048
 
-generate_temp_dsa_privkey "${TOKEN}" "${TEST_PIN}" 3072
-delete_temp_privkey "${TOKEN}" "${TEST_PIN}" dsa-3072
+if test "x$ENABLE_DSA" = "x1"; then
+       generate_temp_dsa_privkey "${TOKEN}" "${TEST_PIN}" 3072
+       delete_temp_privkey "${TOKEN}" "${TEST_PIN}" dsa-3072
+fi
 
 import_temp_rsa_privkey "${TOKEN}" "${TEST_PIN}" 1024
 delete_temp_privkey "${TOKEN}" "${TEST_PIN}" rsa-1024
 import_temp_ecc_privkey "${TOKEN}" "${TEST_PIN}" 256
 delete_temp_privkey "${TOKEN}" "${TEST_PIN}" ecc-256
-import_temp_dsa_privkey "${TOKEN}" "${TEST_PIN}" 2048
-delete_temp_privkey "${TOKEN}" "${TEST_PIN}" dsa-2048
+
+if test "x$ENABLE_DSA" = "x1"; then
+       import_temp_dsa_privkey "${TOKEN}" "${TEST_PIN}" 2048
+       delete_temp_privkey "${TOKEN}" "${TEST_PIN}" dsa-2048
+fi
 
 if test $have_ed25519 != 0;then
        import_temp_ed25519_privkey "${TOKEN}" "${TEST_PIN}" ed25519

diff --git a/tests/x509sign-verify-error.c b/tests/x509sign-verify-error.c
index 767057a6cb972ca6de1876267f5d251a27d4340e..e014f40a2c507d521932da1e65f30548204bd08b 100644 (file)
--- a/tests/x509sign-verify-error.c
+++ b/tests/x509sign-verify-error.c
@@ -116,6 +116,7 @@ static char pem2_cert[] =
        "QcDzQ8REwidsfh9uKAluk1c/KQ==\n"
        "-----END CERTIFICATE-----\n";
 
+#ifdef ENABLE_DSA
 static char pem2_key[] =
        "-----BEGIN DSA PRIVATE KEY-----\n"
        "MIIBugIBAAKBgQC5hPVagb4aDcWKc48Mmy+btg5Lw3Qaf2StnfMoxaBHvJtXVvGX\n"
@@ -129,12 +130,16 @@ static char pem2_key[] =
        "jlvXN8gyPpbCPvRD2n2RAg+3vPjvj/dBAF6W3w8IltzqsukGgq/SLwIUS5/r/2ya\n"
        "AoNBXjeBjgCGMei2m8E=\n"
        "-----END DSA PRIVATE KEY-----\n";
+#endif
 
 const gnutls_datum_t cert_dat[] = { { (void *)pem1_cert, sizeof(pem1_cert) },
                                    { (void *)pem2_cert, sizeof(pem2_cert) } };
 
 const gnutls_datum_t key_dat[] = { { (void *)pem1_key, sizeof(pem1_key) },
-                                  { (void *)pem2_key, sizeof(pem2_key) } };
+#ifdef ENABLE_DSA
+                                  { (void *)pem2_key, sizeof(pem2_key) }
+#endif
+};
 
 void _gnutls_lib_simulate_error(void);
 void _gnutls_lib_force_operational(void);