From d306003ff8fa4d5fbbebdd2eb186137b6328dca4 Mon Sep 17 00:00:00 2001 From: Daniel McCarney Date: Wed, 20 Nov 2024 20:09:50 -0500 Subject: crypto/tls: test with FIPS 140-3 TLS mode For tests that are interested in testing the difference between TLS in FIPS 140-3 required mode or otherwise two new helpers are introduced, runWithFIPSEnabled and runWithFIPSDisabled. They take care of forcing the correct TLS FIPS 140-3 state regardless of the overal GODEBUG=fips state, and restoring it afterwards. For the tests that use features or test data not appropriate for TLS in FIPS 140-3 required mode we add skips. For some tests we can make them appropriate for both TLS FIPS 140-3 required or not by tweaking some parameters that weren't important to the subject under test, but would otherwise preclude TLS FIPS 140-3 required mode (e.g. because they used TLS 1.0 when the test could use TLS 1.2 instead). For others, switching test certificates to a RSA 2048 hierarchy is sufficient. We avoid regenerating the existing RSA 1024 certs as 2048 since it would invalidate recorded static flow data. Tests that rely on static message flows (primarily the client and server handshake) tests are skipped due to FIPS mode being non-deterministic and inappropriate for this style of testing. Change-Id: I311f3828dac890bb3ff8ebda6ed73d50f0797110 Reviewed-on: https://go-review.googlesource.com/c/go/+/629736 Reviewed-by: Roland Shoemaker Reviewed-by: Filippo Valsorda LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov --- src/cmd/dist/test.go | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'src/cmd') diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go index cd3c30da0b..c77aedbbd0 100644 --- a/src/cmd/dist/test.go +++ b/src/cmd/dist/test.go @@ -715,14 +715,12 @@ func (t *tester) registerTests() { // Check that all crypto packages compile (and test correctly, in longmode) with fips. if fipsSupported() { - /* TODO(cpu): Restore in #629736 // Test standard crypto packages with fips140=on. t.registerTest("GODEBUG=fips140=on go test crypto/...", &goTest{ variant: "gofips140", env: []string{"GODEBUG=fips140=on"}, - skip: "TestHandshake|TestServerResumption|TestClientAuth|TestRenegotiate", // TODO(cpu): remove in #629736 pkg: "crypto/...", - })*/ + }) // Test that earlier FIPS snapshots build. // In long mode, test that they work too. -- cgit v1.3