diff options
| author | Daniel McCarney <daniel@binaryparadox.net> | 2024-11-20 20:09:50 -0500 |
|---|---|---|
| committer | Filippo Valsorda <filippo@golang.org> | 2024-11-22 00:00:26 +0000 |
| commit | d306003ff8fa4d5fbbebdd2eb186137b6328dca4 (patch) | |
| tree | d83ac99b1246ea02ad02deb791389eb2dee34ce0 /src/cmd | |
| parent | 3467a91c0b05dcfb54030ab50c708d0b935618a1 (diff) | |
| download | go-d306003ff8fa4d5fbbebdd2eb186137b6328dca4.tar.xz | |
crypto/tls: test with FIPS 140-3 TLS mode
For tests that are interested in testing the difference between TLS in
FIPS 140-3 required mode or otherwise two new helpers are introduced,
runWithFIPSEnabled and runWithFIPSDisabled. They take care of forcing
the correct TLS FIPS 140-3 state regardless of the overal GODEBUG=fips
state, and restoring it afterwards.
For the tests that use features or test data not appropriate for
TLS in FIPS 140-3 required mode we add skips. For some tests we can make
them appropriate for both TLS FIPS 140-3 required or not by tweaking some
parameters that weren't important to the subject under test, but would
otherwise preclude TLS FIPS 140-3 required mode (e.g. because they used
TLS 1.0 when the test could use TLS 1.2 instead). For others, switching
test certificates to a RSA 2048 hierarchy is sufficient. We avoid
regenerating the existing RSA 1024 certs as 2048 since it would
invalidate recorded static flow data.
Tests that rely on static message flows (primarily the client and server
handshake) tests are skipped due to FIPS mode being non-deterministic
and inappropriate for this style of testing.
Change-Id: I311f3828dac890bb3ff8ebda6ed73d50f0797110
Reviewed-on: https://go-review.googlesource.com/c/go/+/629736
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Diffstat (limited to 'src/cmd')
| -rw-r--r-- | src/cmd/dist/test.go | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go index cd3c30da0b..c77aedbbd0 100644 --- a/src/cmd/dist/test.go +++ b/src/cmd/dist/test.go @@ -715,14 +715,12 @@ func (t *tester) registerTests() { // Check that all crypto packages compile (and test correctly, in longmode) with fips. if fipsSupported() { - /* TODO(cpu): Restore in #629736 // Test standard crypto packages with fips140=on. t.registerTest("GODEBUG=fips140=on go test crypto/...", &goTest{ variant: "gofips140", env: []string{"GODEBUG=fips140=on"}, - skip: "TestHandshake|TestServerResumption|TestClientAuth|TestRenegotiate", // TODO(cpu): remove in #629736 pkg: "crypto/...", - })*/ + }) // Test that earlier FIPS snapshots build. // In long mode, test that they work too. |