Aggregate FIPS test patches for upstream submission and backport whats already in
This commit is contained in:
Jakub Jelen
parent
af286f213c
commit
21fe8b5f71
@ -1,122 +0,0 @@
|
|||||||
diff -up libgcrypt-1.7.3/tests/benchmark.c.eccfix libgcrypt-1.7.3/tests/benchmark.c
|
|
||||||
--- libgcrypt-1.7.3/tests/benchmark.c.eccfix 2016-07-14 11:19:17.000000000 +0200
|
|
||||||
+++ libgcrypt-1.7.3/tests/benchmark.c 2016-11-22 16:21:00.109004197 +0100
|
|
||||||
@@ -1412,7 +1412,7 @@ ecc_bench (int iterations, int print_hea
|
|
||||||
{
|
|
||||||
#if USE_ECC
|
|
||||||
gpg_error_t err;
|
|
||||||
- const char *p_sizes[] = { "192", "224", "256", "384", "521", "Ed25519",
|
|
||||||
+ const char *p_sizes[] = { "224", "256", "384", "521", "Ed25519",
|
|
||||||
"gost256", "gost512" };
|
|
||||||
int testno;
|
|
||||||
|
|
||||||
diff -up libgcrypt-1.7.3/tests/dsa-rfc6979.c.eccfix libgcrypt-1.7.3/tests/dsa-rfc6979.c
|
|
||||||
--- libgcrypt-1.7.3/tests/dsa-rfc6979.c.eccfix 2016-02-18 09:38:03.000000000 +0100
|
|
||||||
+++ libgcrypt-1.7.3/tests/dsa-rfc6979.c 2016-11-22 16:22:11.804674008 +0100
|
|
||||||
@@ -210,16 +210,6 @@ check_dsa_rfc6979 (void)
|
|
||||||
" ))"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
- "ECDSA, 192 bits (prime field)",
|
|
||||||
- "(private-key"
|
|
||||||
- " (ecdsa"
|
|
||||||
- " (curve \"NIST P-192\")"
|
|
||||||
- " (q #04AC2C77F529F91689FEA0EA5EFEC7F210D8EEA0B9E047ED56"
|
|
||||||
- " 3BC723E57670BD4887EBC732C523063D0A7C957BC97C1C43#)"
|
|
||||||
- " (d #6FAB034934E4C0FC9AE67F5B5659A9D7D1FEFD187EE09FD4#)"
|
|
||||||
- " ))"
|
|
||||||
- },
|
|
||||||
- {
|
|
||||||
"ECDSA, 224 bits (prime field)",
|
|
||||||
"(private-key"
|
|
||||||
" (ecdsa"
|
|
||||||
@@ -443,89 +433,6 @@ check_dsa_rfc6979 (void)
|
|
||||||
"C9F0BDABCC0D880BB137A994CC7F3980CE91CC10FAF529FC46565B15CEA854E1"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
- "ECDSA, 192 bits (prime field)",
|
|
||||||
- "With SHA-1, message = \"sample\"",
|
|
||||||
- "sha1", "sample",
|
|
||||||
- "37D7CA00D2C7B0E5E412AC03BD44BA837FDD5B28CD3B0021",
|
|
||||||
- "98C6BD12B23EAF5E2A2045132086BE3EB8EBD62ABF6698FF",
|
|
||||||
- "57A22B07DEA9530F8DE9471B1DC6624472E8E2844BC25B64"
|
|
||||||
- },
|
|
||||||
- {
|
|
||||||
- "ECDSA, 192 bits (prime field)",
|
|
||||||
- "With SHA-224, message = \"sample\"",
|
|
||||||
- "sha224", "sample",
|
|
||||||
- "4381526B3FC1E7128F202E194505592F01D5FF4C5AF015D8",
|
|
||||||
- "A1F00DAD97AEEC91C95585F36200C65F3C01812AA60378F5",
|
|
||||||
- "E07EC1304C7C6C9DEBBE980B9692668F81D4DE7922A0F97A"
|
|
||||||
- },
|
|
||||||
- {
|
|
||||||
- "ECDSA, 192 bits (prime field)",
|
|
||||||
- "With SHA-256, message = \"sample\"",
|
|
||||||
- "sha256", "sample",
|
|
||||||
- "32B1B6D7D42A05CB449065727A84804FB1A3E34D8F261496",
|
|
||||||
- "4B0B8CE98A92866A2820E20AA6B75B56382E0F9BFD5ECB55",
|
|
||||||
- "CCDB006926EA9565CBADC840829D8C384E06DE1F1E381B85"
|
|
||||||
- },
|
|
||||||
- {
|
|
||||||
- "ECDSA, 192 bits (prime field)",
|
|
||||||
- "With SHA-384, message = \"sample\"",
|
|
||||||
- "sha384", "sample",
|
|
||||||
- "4730005C4FCB01834C063A7B6760096DBE284B8252EF4311",
|
|
||||||
- "DA63BF0B9ABCF948FBB1E9167F136145F7A20426DCC287D5",
|
|
||||||
- "C3AA2C960972BD7A2003A57E1C4C77F0578F8AE95E31EC5E"
|
|
||||||
- },
|
|
||||||
- {
|
|
||||||
- "ECDSA, 192 bits (prime field)",
|
|
||||||
- "With SHA-512, message = \"sample\"",
|
|
||||||
- "sha512", "sample",
|
|
||||||
- "A2AC7AB055E4F20692D49209544C203A7D1F2C0BFBC75DB1",
|
|
||||||
- "4D60C5AB1996BD848343B31C00850205E2EA6922DAC2E4B8",
|
|
||||||
- "3F6E837448F027A1BF4B34E796E32A811CBB4050908D8F67"
|
|
||||||
- },
|
|
||||||
- {
|
|
||||||
- "ECDSA, 192 bits (prime field)",
|
|
||||||
- "With SHA-1, message = \"test\"",
|
|
||||||
- "sha1", "test",
|
|
||||||
- "D9CF9C3D3297D3260773A1DA7418DB5537AB8DD93DE7FA25",
|
|
||||||
- "0F2141A0EBBC44D2E1AF90A50EBCFCE5E197B3B7D4DE036D",
|
|
||||||
- "EB18BC9E1F3D7387500CB99CF5F7C157070A8961E38700B7"
|
|
||||||
- },
|
|
||||||
- {
|
|
||||||
- "ECDSA, 192 bits (prime field)",
|
|
||||||
- "With SHA-224, message = \"test\"",
|
|
||||||
- "sha224", "test",
|
|
||||||
- "F5DC805F76EF851800700CCE82E7B98D8911B7D510059FBE",
|
|
||||||
- "6945A1C1D1B2206B8145548F633BB61CEF04891BAF26ED34",
|
|
||||||
- "B7FB7FDFC339C0B9BD61A9F5A8EAF9BE58FC5CBA2CB15293"
|
|
||||||
- },
|
|
||||||
- {
|
|
||||||
- "ECDSA, 192 bits (prime field)",
|
|
||||||
- "With SHA-256, message = \"test\"",
|
|
||||||
- "sha256", "test",
|
|
||||||
- "5C4CE89CF56D9E7C77C8585339B006B97B5F0680B4306C6C",
|
|
||||||
- "3A718BD8B4926C3B52EE6BBE67EF79B18CB6EB62B1AD97AE",
|
|
||||||
- "5662E6848A4A19B1F1AE2F72ACD4B8BBE50F1EAC65D9124F"
|
|
||||||
- },
|
|
||||||
- {
|
|
||||||
- "ECDSA, 192 bits (prime field)",
|
|
||||||
- "With SHA-384, message = \"test\"",
|
|
||||||
- "sha384", "test",
|
|
||||||
- "5AFEFB5D3393261B828DB6C91FBC68C230727B030C975693",
|
|
||||||
- "B234B60B4DB75A733E19280A7A6034BD6B1EE88AF5332367",
|
|
||||||
- "7994090B2D59BB782BE57E74A44C9A1C700413F8ABEFE77A"
|
|
||||||
- },
|
|
||||||
- {
|
|
||||||
- "ECDSA, 192 bits (prime field)",
|
|
||||||
- "With SHA-512, message = \"test\"",
|
|
||||||
- "sha512", "test",
|
|
||||||
- "0758753A5254759C7CFBAD2E2D9B0792EEE44136C9480527",
|
|
||||||
- "FE4F4AE86A58B6507946715934FE2D8FF9D95B6B098FE739",
|
|
||||||
- "74CF5605C98FBA0E1EF34D4B5A1577A7DCF59457CAE52290"
|
|
||||||
- },
|
|
||||||
-
|
|
||||||
-
|
|
||||||
-
|
|
||||||
- {
|
|
||||||
"ECDSA, 224 bits (prime field)",
|
|
||||||
"With SHA-1, message = \"sample\"",
|
|
||||||
"sha1", "sample",
|
|
||||||
@ -58,3 +58,16 @@ diff -up libgcrypt-1.8.3/src/global.c.fips-ctor libgcrypt-1.8.3/src/global.c
|
|||||||
_gcry_set_preferred_rng_type (0);
|
_gcry_set_preferred_rng_type (0);
|
||||||
_gcry_set_enforced_fips_mode ();
|
_gcry_set_enforced_fips_mode ();
|
||||||
}
|
}
|
||||||
|
diff --git a/tests/t-secmem.c b/tests/t-secmem.c
|
||||||
|
index 2b769134..1d33bbfd 100644
|
||||||
|
--- a/tests/t-secmem.c
|
||||||
|
+++ b/tests/t-secmem.c
|
||||||
|
@@ -54,7 +54,7 @@ test_secmem (void)
|
||||||
|
|
||||||
|
/* Allocating another 2k should fail for the default 16k pool. */
|
||||||
|
b = gcry_malloc_secure (chunk_size*4);
|
||||||
|
- if (b)
|
||||||
|
+ if (b && !gcry_fips_mode_active ())
|
||||||
|
fail ("allocation did not fail as expected\n");
|
||||||
|
|
||||||
|
for (i=0; i < DIM(a); i++)
|
||||||
|
|||||||
@ -16,3 +16,22 @@ diff -up libgcrypt-1.8.3/cipher/md.c.fips-enforce libgcrypt-1.8.3/cipher/md.c
|
|||||||
err = GPG_ERR_DIGEST_ALGO;
|
err = GPG_ERR_DIGEST_ALGO;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
diff --git a/tests/t-kdf.c b/tests/t-kdf.c
|
||||||
|
index 7a48e98a..48309b9a 100644
|
||||||
|
--- a/tests/t-kdf.c
|
||||||
|
+++ b/tests/t-kdf.c
|
||||||
|
@@ -1104,6 +1104,13 @@ check_pbkdf2 (void)
|
||||||
|
GCRY_KDF_PBKDF2, tv[tvidx].hashalgo,
|
||||||
|
tv[tvidx].salt, tv[tvidx].saltlen,
|
||||||
|
tv[tvidx].c, tv[tvidx].dklen, outbuf);
|
||||||
|
+ if (gcry_fips_mode_active() && tvidx > 6)
|
||||||
|
+ {
|
||||||
|
+ if (!err)
|
||||||
|
+ fail ("pbkdf2 test %d unexpectedly passed in FIPS mode: %s\n",
|
||||||
|
+ tvidx, gpg_strerror (err));
|
||||||
|
+ continue;
|
||||||
|
+ }
|
||||||
|
if (err)
|
||||||
|
fail ("pbkdf2 test %d failed: %s\n", tvidx, gpg_strerror (err));
|
||||||
|
else if (memcmp (outbuf, tv[tvidx].dk, tv[tvidx].dklen))
|
||||||
|
|
||||||
|
|||||||
@ -1,198 +0,0 @@
|
|||||||
diff -up libgcrypt-1.8.4/tests/basic.c.tests-fipsmode libgcrypt-1.8.4/tests/basic.c
|
|
||||||
--- libgcrypt-1.8.4/tests/basic.c.tests-fipsmode 2018-04-17 17:29:40.000000000 +0200
|
|
||||||
+++ libgcrypt-1.8.4/tests/basic.c 2019-02-12 13:30:48.935791024 +0100
|
|
||||||
@@ -6964,7 +6964,7 @@ check_ciphers (void)
|
|
||||||
check_one_cipher (algos[i], GCRY_CIPHER_MODE_EAX, 0);
|
|
||||||
if (gcry_cipher_get_algo_blklen (algos[i]) == GCRY_CCM_BLOCK_LEN)
|
|
||||||
check_one_cipher (algos[i], GCRY_CIPHER_MODE_CCM, 0);
|
|
||||||
- if (gcry_cipher_get_algo_blklen (algos[i]) == GCRY_GCM_BLOCK_LEN)
|
|
||||||
+ if (!in_fips_mode && gcry_cipher_get_algo_blklen (algos[i]) == GCRY_GCM_BLOCK_LEN)
|
|
||||||
check_one_cipher (algos[i], GCRY_CIPHER_MODE_GCM, 0);
|
|
||||||
if (gcry_cipher_get_algo_blklen (algos[i]) == GCRY_OCB_BLOCK_LEN)
|
|
||||||
check_one_cipher (algos[i], GCRY_CIPHER_MODE_OCB, 0);
|
|
||||||
@@ -7010,12 +7010,18 @@ check_cipher_modes(void)
|
|
||||||
check_cfb_cipher ();
|
|
||||||
check_ofb_cipher ();
|
|
||||||
check_ccm_cipher ();
|
|
||||||
- check_gcm_cipher ();
|
|
||||||
- check_poly1305_cipher ();
|
|
||||||
- check_ocb_cipher ();
|
|
||||||
+ if (!in_fips_mode)
|
|
||||||
+ {
|
|
||||||
+ check_gcm_cipher ();
|
|
||||||
+ check_poly1305_cipher ();
|
|
||||||
+ check_ocb_cipher ();
|
|
||||||
+ }
|
|
||||||
check_xts_cipher ();
|
|
||||||
check_eax_cipher ();
|
|
||||||
- check_gost28147_cipher ();
|
|
||||||
+ if (!in_fips_mode)
|
|
||||||
+ {
|
|
||||||
+ check_gost28147_cipher ();
|
|
||||||
+ }
|
|
||||||
check_stream_cipher ();
|
|
||||||
check_stream_cipher_large_block ();
|
|
||||||
|
|
||||||
@@ -10001,7 +10007,7 @@ check_mac (void)
|
|
||||||
show_mac_not_available (algos[i].algo);
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
- if (gcry_mac_test_algo (algos[i].algo) && in_fips_mode)
|
|
||||||
+ if ((algos[i].algo == GCRY_MAC_GMAC_AES || gcry_mac_test_algo (algos[i].algo)) && in_fips_mode)
|
|
||||||
{
|
|
||||||
if (verbose)
|
|
||||||
fprintf (stderr, " algorithm %d not available in fips mode\n",
|
|
||||||
@@ -11095,8 +11101,6 @@ main (int argc, char **argv)
|
|
||||||
/* If we are in fips mode do some more tests. */
|
|
||||||
gcry_md_hd_t md;
|
|
||||||
|
|
||||||
- /* First trigger a self-test. */
|
|
||||||
- xgcry_control ((GCRYCTL_FORCE_FIPS_MODE, 0));
|
|
||||||
if (!gcry_control (GCRYCTL_OPERATIONAL_P, 0))
|
|
||||||
fail ("not in operational state after self-test\n");
|
|
||||||
|
|
||||||
@@ -11121,15 +11125,6 @@ main (int argc, char **argv)
|
|
||||||
gcry_md_close (md);
|
|
||||||
if (gcry_control (GCRYCTL_OPERATIONAL_P, 0))
|
|
||||||
fail ("expected error state but still in operational state\n");
|
|
||||||
- else
|
|
||||||
- {
|
|
||||||
- /* Now run a self-test and to get back into
|
|
||||||
- operational state. */
|
|
||||||
- xgcry_control ((GCRYCTL_FORCE_FIPS_MODE, 0));
|
|
||||||
- if (!gcry_control (GCRYCTL_OPERATIONAL_P, 0))
|
|
||||||
- fail ("did not reach operational after error "
|
|
||||||
- "and self-test\n");
|
|
||||||
- }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
diff -up libgcrypt-1.8.4/tests/benchmark.c.tests-fipsmode libgcrypt-1.8.4/tests/benchmark.c
|
|
||||||
--- libgcrypt-1.8.4/tests/benchmark.c.tests-fipsmode 2019-02-12 11:31:44.859603883 +0100
|
|
||||||
+++ libgcrypt-1.8.4/tests/benchmark.c 2019-02-12 14:10:40.271999352 +0100
|
|
||||||
@@ -872,8 +872,10 @@ cipher_bench ( const char *algoname )
|
|
||||||
&& algo != GCRY_CIPHER_CHACHA20)
|
|
||||||
continue;
|
|
||||||
|
|
||||||
- if (modes[modeidx].req_blocksize > 0
|
|
||||||
- && blklen != modes[modeidx].req_blocksize)
|
|
||||||
+ if ((modes[modeidx].req_blocksize > 0
|
|
||||||
+ && blklen != modes[modeidx].req_blocksize)
|
|
||||||
+ || (in_fips_mode
|
|
||||||
+ && modes[modeidx].mode == GCRY_CIPHER_MODE_GCM))
|
|
||||||
{
|
|
||||||
printf (" %7s %7s", "-", "-" );
|
|
||||||
continue;
|
|
||||||
diff -up libgcrypt-1.8.4/tests/bench-slope.c.tests-fipsmode libgcrypt-1.8.4/tests/bench-slope.c
|
|
||||||
--- libgcrypt-1.8.4/tests/bench-slope.c.tests-fipsmode 2017-11-23 19:16:58.000000000 +0100
|
|
||||||
+++ libgcrypt-1.8.4/tests/bench-slope.c 2019-02-12 14:14:33.618763325 +0100
|
|
||||||
@@ -1338,7 +1338,7 @@ cipher_bench_one (int algo, struct bench
|
|
||||||
return;
|
|
||||||
|
|
||||||
/* GCM has restrictions for block-size */
|
|
||||||
- if (mode.mode == GCRY_CIPHER_MODE_GCM && blklen != GCRY_GCM_BLOCK_LEN)
|
|
||||||
+ if (mode.mode == GCRY_CIPHER_MODE_GCM && (gcry_fips_mode_active () || blklen != GCRY_GCM_BLOCK_LEN))
|
|
||||||
return;
|
|
||||||
|
|
||||||
/* XTS has restrictions for block-size */
|
|
||||||
diff -up libgcrypt-1.8.4/tests/pubkey.c.tests-fipsmode libgcrypt-1.8.4/tests/pubkey.c
|
|
||||||
--- libgcrypt-1.8.4/tests/pubkey.c.tests-fipsmode 2017-11-23 19:16:58.000000000 +0100
|
|
||||||
+++ libgcrypt-1.8.4/tests/pubkey.c 2019-02-12 13:52:25.658746415 +0100
|
|
||||||
@@ -504,15 +504,30 @@ get_dsa_key_with_domain_new (gcry_sexp_t
|
|
||||||
rc = gcry_sexp_new
|
|
||||||
(&key_spec,
|
|
||||||
"(genkey (dsa (transient-key)(domain"
|
|
||||||
- "(p #d3aed1876054db831d0c1348fbb1ada72507e5fbf9a62cbd47a63aeb7859d6921"
|
|
||||||
- "4adeb9146a6ec3f43520f0fd8e3125dd8bbc5d87405d1ac5f82073cd762a3f8d7"
|
|
||||||
- "74322657c9da88a7d2f0e1a9ceb84a39cb40876179e6a76e400498de4bb9379b0"
|
|
||||||
- "5f5feb7b91eb8fea97ee17a955a0a8a37587a272c4719d6feb6b54ba4ab69#)"
|
|
||||||
- "(q #9c916d121de9a03f71fb21bc2e1c0d116f065a4f#)"
|
|
||||||
- "(g #8157c5f68ca40b3ded11c353327ab9b8af3e186dd2e8dade98761a0996dda99ab"
|
|
||||||
- "0250d3409063ad99efae48b10c6ab2bba3ea9a67b12b911a372a2bba260176fad"
|
|
||||||
- "b4b93247d9712aad13aa70216c55da9858f7a298deb670a403eb1e7c91b847f1e"
|
|
||||||
- "ccfbd14bd806fd42cf45dbb69cd6d6b43add2a78f7d16928eaa04458dea44#)"
|
|
||||||
+ " (p #a85378d8fd3f8d72ec7418080da21317e43ec4b62ba8c862"
|
|
||||||
+ " 3b7e4d04441dd1a0658662596493ca8e9e8fbb7e34aaddb6"
|
|
||||||
+ " 2e5d67b6d09a6e61b769e7c352aa2b10e20ca0636963b552"
|
|
||||||
+ " 3e86470decbbeda027e797e7b67635d4d49c30700e74af8a"
|
|
||||||
+ " 0ff156a801af57a26e7078f1d82f74908ecb6d07e70b3503"
|
|
||||||
+ " eed94fa32cf17a7fc3d6cf40dc7b00830e6a2566dc073e34"
|
|
||||||
+ " 3312517c6aa5152b4bfecd2e551fee346318a153423c996b"
|
|
||||||
+ " 0d5dcb9102aedd38798616f1f1e0d6c403525b1f9b3d4dc7"
|
|
||||||
+ " 66de2dfc4a56d7b8ba5963d60f3e16318870ad436952e557"
|
|
||||||
+ " 65374eab85e8ec17d6b9a4547b9b5f2752f3105be809b23a"
|
|
||||||
+ " 2c8d7469db02e24d592394a7dba069e9#)"
|
|
||||||
+ " (q #d277044e50f5a4e3f510a50a0b84fdffbca047ed27602056"
|
|
||||||
+ " 7441a0a5#)"
|
|
||||||
+ " (g #13d754e21fd241655da891c522a65a72a89bdc64ec9b54a8"
|
|
||||||
+ " 21ed4a898b490e0c4fcb72192a4a20f541f3f2925399f0ba"
|
|
||||||
+ " ecf929aafbf79dfe4332393b32cd2e2fcf272f32a627434a"
|
|
||||||
+ " 0df242b75b414df372121e53a553f222f836b000f016485b"
|
|
||||||
+ " 6bd0898451801dcd8de64cd5365696ffc532d528c506620a"
|
|
||||||
+ " 942a0305046d8f1876341f1e570bc3974ba6b9a438e97023"
|
|
||||||
+ " 02a2e6e67bfd06d32bc679962271d7b40cd72f386e64e0d7"
|
|
||||||
+ " ef86ca8ca5d14228dc2a4f16e3189886b5990674f4200f3a"
|
|
||||||
+ " 4cf65a3f0ddba1fa672dff2f5e143d10e4e97ae84f6da095"
|
|
||||||
+ " 35d5b9df259181a79b63b069e949972b02ba36b3586aab7e"
|
|
||||||
+ " 45f322f82e4e85ca3ab85591b3c2a966#)"
|
|
||||||
")))", 0, 1);
|
|
||||||
if (rc)
|
|
||||||
die ("error creating S-expression: %s\n", gcry_strerror (rc));
|
|
||||||
@@ -595,7 +610,7 @@ get_dsa_key_fips186_with_seed_new (gcry_
|
|
||||||
" (use-fips186)"
|
|
||||||
" (transient-key)"
|
|
||||||
" (derive-parms"
|
|
||||||
- " (seed #f770a4598ff756931fc529764513b103ce57d85f4ad8c5cf297c9b4d48241c5b#))))",
|
|
||||||
+ " (seed #8b4c4d671fff82e8ed932260206d0571e3a1c2cee8cd94cb73fe58f9b67488fa#))))",
|
|
||||||
0, 1);
|
|
||||||
if (rc)
|
|
||||||
die ("error creating S-expression: %s\n", gcry_strerror (rc));
|
|
||||||
diff -up libgcrypt-1.8.4/tests/t-cv25519.c.tests-fipsmode libgcrypt-1.8.4/tests/t-cv25519.c
|
|
||||||
--- libgcrypt-1.8.4/tests/t-cv25519.c.tests-fipsmode 2017-11-23 19:16:58.000000000 +0100
|
|
||||||
+++ libgcrypt-1.8.4/tests/t-cv25519.c 2019-02-12 14:02:35.935705390 +0100
|
|
||||||
@@ -560,6 +560,9 @@ main (int argc, char **argv)
|
|
||||||
xgcry_control ((GCRYCTL_SET_DEBUG_FLAGS, 1u , 0));
|
|
||||||
xgcry_control ((GCRYCTL_ENABLE_QUICK_RANDOM, 0));
|
|
||||||
xgcry_control ((GCRYCTL_INITIALIZATION_FINISHED, 0));
|
|
||||||
+ /* Curve25519 isn't supported in fips mode */
|
|
||||||
+ if (gcry_fips_mode_active())
|
|
||||||
+ return 77;
|
|
||||||
|
|
||||||
start_timer ();
|
|
||||||
check_cv25519 ();
|
|
||||||
diff -up libgcrypt-1.8.4/tests/t-x448.c.tests-fipsmode libgcrypt-1.8.4/tests/t-x448.c
|
|
||||||
--- libgcrypt-1.8.4/tests/t-x448.c.tests-fipsmode 2017-11-23 19:16:58.000000000 +0100
|
|
||||||
+++ libgcrypt-1.8.4/tests/t-x448.c 2019-02-12 14:02:35.935705390 +0100
|
|
||||||
@@ -560,6 +560,9 @@ main (int argc, char **argv)
|
|
||||||
xgcry_control ((GCRYCTL_SET_DEBUG_FLAGS, 1u , 0));
|
|
||||||
xgcry_control ((GCRYCTL_ENABLE_QUICK_RANDOM, 0));
|
|
||||||
xgcry_control ((GCRYCTL_INITIALIZATION_FINISHED, 0));
|
|
||||||
+ /* x448 isn't supported in fips mode */
|
|
||||||
+ if (gcry_fips_mode_active())
|
|
||||||
+ return 77;
|
|
||||||
|
|
||||||
start_timer ();
|
|
||||||
check_x448 ();
|
|
||||||
diff -up libgcrypt-1.8.4/tests/t-secmem.c.tests-fipsmode libgcrypt-1.8.4/tests/t-secmem.c
|
|
||||||
--- libgcrypt-1.8.4/tests/t-secmem.c.tests-fipsmode 2017-11-23 19:19:54.000000000 +0100
|
|
||||||
+++ libgcrypt-1.8.4/tests/t-secmem.c 2019-02-12 11:51:02.462190538 +0100
|
|
||||||
@@ -174,7 +174,8 @@ main (int argc, char **argv)
|
|
||||||
xgcry_control ((GCRYCTL_SET_DEBUG_FLAGS, 1u , 0));
|
|
||||||
xgcry_control ((GCRYCTL_ENABLE_QUICK_RANDOM, 0));
|
|
||||||
xgcry_control ((GCRYCTL_INIT_SECMEM, pool_size, 0));
|
|
||||||
- gcry_set_outofcore_handler (outofcore_handler, NULL);
|
|
||||||
+ if (!gcry_fips_mode_active ())
|
|
||||||
+ gcry_set_outofcore_handler (outofcore_handler, NULL);
|
|
||||||
xgcry_control ((GCRYCTL_INITIALIZATION_FINISHED, 0));
|
|
||||||
|
|
||||||
/* Libgcrypt prints a warning when the first overflow is allocated;
|
|
||||||
@@ -184,7 +185,8 @@ main (int argc, char **argv)
|
|
||||||
|
|
||||||
|
|
||||||
test_secmem ();
|
|
||||||
- test_secmem_overflow ();
|
|
||||||
+ if (!gcry_fips_mode_active ())
|
|
||||||
+ test_secmem_overflow ();
|
|
||||||
/* FIXME: We need to improve the tests, for example by registering
|
|
||||||
* our own log handler and comparing the output of
|
|
||||||
* PRIV_CTL_DUMP_SECMEM_STATS to expected pattern. */
|
|
||||||
1804
libgcrypt-1.9.3-fips-tests.patch
Normal file
1804
libgcrypt-1.9.3-fips-tests.patch
Normal file
File diff suppressed because it is too large
Load Diff
@ -27,15 +27,13 @@ Patch2: libgcrypt-1.8.5-use-fipscheck.patch
|
|||||||
# modify FIPS RSA and DSA keygen to comply with requirements
|
# modify FIPS RSA and DSA keygen to comply with requirements
|
||||||
Patch5: libgcrypt-1.8.4-fips-keygen.patch
|
Patch5: libgcrypt-1.8.4-fips-keygen.patch
|
||||||
# fix the tests to work correctly in the FIPS mode
|
# fix the tests to work correctly in the FIPS mode
|
||||||
Patch6: libgcrypt-1.8.4-tests-fipsmode.patch
|
Patch6: libgcrypt-1.9.3-fips-tests.patch
|
||||||
# update the CAVS tests
|
# update the CAVS tests
|
||||||
Patch7: libgcrypt-1.7.3-fips-cavs.patch
|
Patch7: libgcrypt-1.7.3-fips-cavs.patch
|
||||||
# use poll instead of select when gathering randomness
|
# use poll instead of select when gathering randomness
|
||||||
Patch11: libgcrypt-1.8.4-use-poll.patch
|
Patch11: libgcrypt-1.8.4-use-poll.patch
|
||||||
# slight optimalization of mpicoder.c to silence Valgrind (#968288)
|
# slight optimalization of mpicoder.c to silence Valgrind (#968288)
|
||||||
Patch13: libgcrypt-1.6.1-mpicoder-gccopt.patch
|
Patch13: libgcrypt-1.6.1-mpicoder-gccopt.patch
|
||||||
# fix tests to work with approved ECC
|
|
||||||
Patch14: libgcrypt-1.7.3-ecc-test-fix.patch
|
|
||||||
# Run the FIPS mode initialization in the shared library constructor
|
# Run the FIPS mode initialization in the shared library constructor
|
||||||
Patch18: libgcrypt-1.8.3-fips-ctor.patch
|
Patch18: libgcrypt-1.8.3-fips-ctor.patch
|
||||||
# Do not try to open /dev/urandom if getrandom() works
|
# Do not try to open /dev/urandom if getrandom() works
|
||||||
@ -92,7 +90,6 @@ applications using libgcrypt.
|
|||||||
%patch7 -p1 -b .cavs
|
%patch7 -p1 -b .cavs
|
||||||
%patch11 -p1 -b .use-poll
|
%patch11 -p1 -b .use-poll
|
||||||
%patch13 -p1 -b .gccopt
|
%patch13 -p1 -b .gccopt
|
||||||
%patch14 -p1 -b .eccfix
|
|
||||||
%patch18 -p1 -b .fips-ctor
|
%patch18 -p1 -b .fips-ctor
|
||||||
%patch24 -p1 -b .getrandom
|
%patch24 -p1 -b .getrandom
|
||||||
%patch26 -p1 -b .fips-enttest
|
%patch26 -p1 -b .fips-enttest
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user