tests: skip TLS 1.2 resume tests without EMS under FIPS

In FIPS mode, extended master secret is required and those tests are
not supported.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

diff --git a/tests/multi-alerts.c b/tests/multi-alerts.c
index bbd6df25b89eaa0d3ea0d86e094be5a380016f09..7412d48fa136ec50aded94e6604dd4027b2543a8 100644 (file)
--- a/tests/multi-alerts.c
+++ b/tests/multi-alerts.c
@@ -197,6 +197,14 @@ void doit(void)
        int sockets[2];
        int err;
 
+       /* This test does not work under FIPS, as extended master
+        * secret extension needs to be negotiated through extensions,
+        * but the fixture does not contain the extension.
+        */
+       if (gnutls_fips140_mode_enabled()) {
+               exit(77);
+       }
+
        err = socketpair(AF_UNIX, SOCK_STREAM, 0, sockets);
        if (err == -1) {
                perror("socketpair");

diff --git a/tests/no-extensions.c b/tests/no-extensions.c
index 87986af2e27baf8a5a1bd205d9ada19c746e787a..bb543b59bbedf144a0ac7346364b08faa6bcf26c 100644 (file)
--- a/tests/no-extensions.c
+++ b/tests/no-extensions.c
@@ -210,6 +210,13 @@ void start(const char *prio, gnutls_protocol_t exp_version)
 
 void doit(void)
 {
+       /* This test does not work under FIPS, as extended master
+        * secret extension needs to be negotiated through extensions.
+        */
+       if (gnutls_fips140_mode_enabled()) {
+               exit(77);
+       }
+
        start("NORMAL:-VERS-ALL:+VERS-TLS1.0:%NO_EXTENSIONS", GNUTLS_TLS1_0);
        start("NORMAL:-VERS-ALL:+VERS-TLS1.1:%NO_EXTENSIONS", GNUTLS_TLS1_1);
        start("NORMAL:-VERS-ALL:+VERS-TLS1.2:%NO_EXTENSIONS", GNUTLS_TLS1_2);

diff --git a/tests/ocsp-tests/ocsp-must-staple-connection.sh b/tests/ocsp-tests/ocsp-must-staple-connection.sh
index eb9d8db7f8e29cdc6e10c40816c4fcb60b3d093d..880e50bbe51181f51c6076e3647d9831a87ea76f 100755 (executable)
--- a/tests/ocsp-tests/ocsp-must-staple-connection.sh
+++ b/tests/ocsp-tests/ocsp-must-staple-connection.sh
@@ -401,39 +401,43 @@ kill "${TLS_SERVER_PID}"
 wait "${TLS_SERVER_PID}"
 unset TLS_SERVER_PID
 
-echo "=== Test 7: OSCP response error - client doesn't send status_request ==="
-
-eval "${GETPORT}"
-# Port for gnutls-serv
-TLS_SERVER_PORT=$PORT
-PORT=${TLS_SERVER_PORT}
-launch_bare_server \
-         datefudge "${TESTDATE}" \
-         "${SERV}" --echo --disable-client-cert \
-         --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
-         --x509certfile="${SERVER_CERT_FILE}" \
-         --port="${TLS_SERVER_PORT}" \
-         --ocsp-response="${srcdir}/ocsp-tests/response3.der" --ignore-ocsp-response-errors
-TLS_SERVER_PID="${!}"
-wait_server $TLS_SERVER_PID
+if test "${GNUTLS_FORCE_FIPS_MODE}" != 1; then
+
+    echo "=== Test 7: OSCP response error - client doesn't send status_request ==="
+
+    eval "${GETPORT}"
+    # Port for gnutls-serv
+    TLS_SERVER_PORT=$PORT
+    PORT=${TLS_SERVER_PORT}
+    launch_bare_server \
+       datefudge "${TESTDATE}" \
+       "${SERV}" --echo --disable-client-cert \
+       --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
+       --x509certfile="${SERVER_CERT_FILE}" \
+       --port="${TLS_SERVER_PORT}" \
+       --ocsp-response="${srcdir}/ocsp-tests/response3.der" --ignore-ocsp-response-errors
+    TLS_SERVER_PID="${!}"
+    wait_server $TLS_SERVER_PID
+
+    wait_for_port "${TLS_SERVER_PORT}"
+
+    echo "test 123456" | \
+       datefudge -s "${TESTDATE}" \
+                 "${CLI}" --priority "NORMAL:%NO_EXTENSIONS" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
+                 --port="${TLS_SERVER_PORT}" localhost
+    rc=$?
 
-wait_for_port "${TLS_SERVER_PORT}"
+    if test "${rc}" != "0"; then
+       echo "Connecting to server with valid certificate and OCSP error response failed"
+       exit ${rc}
+    fi
 
-echo "test 123456" | \
-    datefudge -s "${TESTDATE}" \
-             "${CLI}" --priority "NORMAL:%NO_EXTENSIONS" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
-             --port="${TLS_SERVER_PORT}" localhost
-rc=$?
+    kill "${TLS_SERVER_PID}"
+    wait "${TLS_SERVER_PID}"
+    unset TLS_SERVER_PID
 
-if test "${rc}" != "0"; then
-    echo "Connecting to server with valid certificate and OCSP error response failed"
-    exit ${rc}
 fi
 
-kill "${TLS_SERVER_PID}"
-wait "${TLS_SERVER_PID}"
-unset TLS_SERVER_PID
-
 echo "=== Test 8: OSCP response error - client sends status_request, no TLS feature extension ==="
 
 eval "${GETPORT}"

diff --git a/tests/rehandshake-ext-secret.c b/tests/rehandshake-ext-secret.c
index cdb8f5e838be11a4cd4582e747a8a66de39a83e5..93d26ca4c7857e6b150133754cb19c14b84ca5c9 100644 (file)
--- a/tests/rehandshake-ext-secret.c
+++ b/tests/rehandshake-ext-secret.c
@@ -153,6 +153,14 @@ static void try(unsigned onclient)
 
 void doit(void)
 {
+       /* This test does not work with TLS 1.2 under FIPS, as
+        * extended master secret extension needs to be negotiated
+        * through extensions, while %NO_SESSION_HASH is set.
+        */
+       if (gnutls_fips140_mode_enabled()) {
+               exit(77);
+       }
+
        try(0);
        reset_buffers();
        try(1);

diff --git a/tests/resume.c b/tests/resume.c
index d307ee2accdc1576ca8169ee65becb3b673544b2..83e750af6695a6c314e17699945c216600878e27 100644 (file)
--- a/tests/resume.c
+++ b/tests/resume.c
@@ -90,6 +90,7 @@ struct params_res {
        int change_ciphersuite;
        int early_start;
        int no_early_start;
+       int no_fips;
 };
 
 pid_t child;
@@ -125,14 +126,16 @@ struct params_res resume_tests[] = {
         .enable_session_ticket_client = ST_NONE,
         .expect_resume = 0,
         .first_no_ext_master = 0,
-        .second_no_ext_master = 1},
+        .second_no_ext_master = 1,
+        .no_fips = 1},
        {.desc = "try to resume from db (none -> ext master secret)",
         .enable_db = 1,
         .enable_session_ticket_server = ST_NONE,
         .enable_session_ticket_client = ST_NONE,
         .expect_resume = 0,
         .first_no_ext_master = 1,
-        .second_no_ext_master = 0},
+        .second_no_ext_master = 0,
+        .no_fips = 1},
 # endif
 # if defined(TLS13)
        /* only makes sense under TLS1.3 as negotiation involves a new
@@ -214,7 +217,8 @@ struct params_res resume_tests[] = {
         .enable_session_ticket_client = ST_ALL,
         .expect_resume = 0,
         .first_no_ext_master = 0,
-        .second_no_ext_master = 1},
+        .second_no_ext_master = 1,
+        .no_fips = 1},
        {.desc =
         "try to resume from session ticket (none -> ext master secret)",
         .enable_db = 0,
@@ -222,7 +226,8 @@ struct params_res resume_tests[] = {
         .enable_session_ticket_client = ST_ALL,
         .expect_resume = 0,
         .first_no_ext_master = 1,
-        .second_no_ext_master = 0},
+        .second_no_ext_master = 0,
+        .no_fips = 1},
        {.desc = "try to resume from session ticket (server only)",
         .enable_db = 0,
         .enable_session_ticket_server = ST_ALL,
@@ -967,6 +972,12 @@ void doit(void)
                int client_sds[SESSIONS], server_sds[SESSIONS];
                int j;
 
+               if (resume_tests[i].no_fips && gnutls_fips140_mode_enabled()) {
+                       success("skipping %s under FIPS mode\n",
+                               resume_tests[i].desc);
+                       continue;
+               }
+
                printf("%s\n", resume_tests[i].desc);
 
                for (j = 0; j < SESSIONS; j++) {

diff --git a/tests/status-request.c b/tests/status-request.c
index 752b222d9ad84726ff153c0222e6a5f4277d9714..5c165ae5f0672c24aab5df6cb72869325be2c25a 100644 (file)
--- a/tests/status-request.c
+++ b/tests/status-request.c
@@ -289,7 +289,13 @@ void start(const char *prio)
 
 void doit(void)
 {
-       start("NORMAL:-VERS-ALL:+VERS-TLS1.2");
+       /* This test does not work with TLS 1.2 under FIPS, as
+        * extended master secret extension needs to be negotiated
+        * through extensions.
+        */
+       if (!gnutls_fips140_mode_enabled()) {
+               start("NORMAL:-VERS-ALL:+VERS-TLS1.2");
+       }
        start("NORMAL:-VERS-ALL:+VERS-TLS1.3");
        start("NORMAL");
 }