X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=fips%2Ffips_test_suite.c;h=c829d184a7f8a8bd037172a5d5ad525aa7a3b7ef;hp=e71a6930bca13fed2f259da329846c96f4be30a2;hb=00b0f2cb3e8235a6ff8c4d1c0476c687eb61afe6;hpb=706735aea34218c811beaaa34fe6199556aa4837 diff --git a/fips/fips_test_suite.c b/fips/fips_test_suite.c index e71a6930bc..c829d184a7 100644 --- a/fips/fips_test_suite.c +++ b/fips/fips_test_suite.c @@ -679,15 +679,28 @@ POST_ID id_list[] = { {NID_sha256, "SHA256"}, {NID_sha384, "SHA384"}, {NID_sha512, "SHA512"}, + {NID_hmacWithSHA1, "HMAC-SHA1"}, + {NID_hmacWithSHA224, "HMAC-SHA224"}, + {NID_hmacWithSHA256, "HMAC-SHA256"}, + {NID_hmacWithSHA384, "HMAC-SHA384"}, + {NID_hmacWithSHA512, "HMAC-SHA512"}, {EVP_PKEY_RSA, "RSA"}, {EVP_PKEY_DSA, "DSA"}, {EVP_PKEY_EC, "ECDSA"}, {NID_aes_128_cbc, "AES-128-CBC"}, {NID_aes_192_cbc, "AES-192-CBC"}, {NID_aes_256_cbc, "AES-256-CBC"}, + {NID_aes_128_ctr, "AES-128-CTR"}, + {NID_aes_192_ctr, "AES-192-CTR"}, + {NID_aes_256_ctr, "AES-256-CTR"}, {NID_aes_128_ecb, "AES-128-ECB"}, + {NID_aes_128_xts, "AES-128-XTS"}, + {NID_aes_256_xts, "AES-256-XTS"}, {NID_des_ede3_cbc, "DES-EDE3-CBC"}, {NID_des_ede3_ecb, "DES-EDE3-ECB"}, + {NID_X9_62_prime256v1, "P-256"}, + {NID_secp384r1, "P-384"}, + {NID_secp521r1, "P-521"}, {0, NULL} }; @@ -713,6 +726,9 @@ static int post_cb(int op, int id, int subid, void *ex) const char *idstr, *exstr = ""; char asctmp[20]; int keytype = -1; +#ifdef FIPS_POST_TIME + static struct timespec start, end, tstart, tend; +#endif switch(id) { case FIPS_TEST_INTEGRITY: @@ -753,12 +769,13 @@ static int post_cb(int op, int id, int subid, void *ex) idstr = "GCM"; break; - case FIPS_TEST_CCM: - idstr = "CCM"; + case FIPS_TEST_XTS: + idstr = "XTS"; + exstr = lookup_id(subid); break; - case FIPS_TEST_XTS: - idstr = "HMAC"; + case FIPS_TEST_CCM: + idstr = "CCM"; break; case FIPS_TEST_X931: @@ -769,6 +786,20 @@ static int post_cb(int op, int id, int subid, void *ex) case FIPS_TEST_DRBG: idstr = "DRBG"; + if (*(int *)ex & DRBG_FLAG_CTR_USE_DF) + { + sprintf(asctmp, "%s DF", lookup_id(subid)); + exstr = asctmp; + } + else if (subid >> 16) + { + sprintf(asctmp, "%s %s", + lookup_id(subid >> 16), + lookup_id(subid & 0xFFFF)); + exstr = asctmp; + } + else + exstr = lookup_id(subid); break; case FIPS_TEST_PAIRWISE: @@ -794,19 +825,40 @@ static int post_cb(int op, int id, int subid, void *ex) switch(op) { case FIPS_POST_BEGIN: +#ifdef FIPS_POST_TIME + clock_getres(CLOCK_REALTIME, &tstart); + printf("\tTimer resolution %ld s, %ld ns\n", + (long)tstart.tv_sec, (long)tstart.tv_nsec); + clock_gettime(CLOCK_REALTIME, &tstart); +#endif printf("\tPOST started\n"); break; case FIPS_POST_END: printf("\tPOST %s\n", id ? "Success" : "Failed"); +#ifdef FIPS_POST_TIME + clock_gettime(CLOCK_REALTIME, &tend); + printf("\t\tTook %f seconds\n", + (double)((tend.tv_sec+tend.tv_nsec*1e-9) + - (tstart.tv_sec+tstart.tv_nsec*1e-9))); +#endif break; case FIPS_POST_STARTED: printf("\t\t%s %s test started\n", idstr, exstr); +#ifdef FIPS_POST_TIME + clock_gettime(CLOCK_REALTIME, &start); +#endif break; case FIPS_POST_SUCCESS: printf("\t\t%s %s test OK\n", idstr, exstr); +#ifdef FIPS_POST_TIME + clock_gettime(CLOCK_REALTIME, &end); + printf("\t\t\tTook %f seconds\n", + (double)((end.tv_sec+end.tv_nsec*1e-9) + - (start.tv_sec+start.tv_nsec*1e-9))); +#endif break; case FIPS_POST_FAIL: @@ -834,11 +886,12 @@ int main(int argc,char **argv) int do_drbg_stick = 0; int no_exit = 0; - fips_algtest_init_nofips(); FIPS_post_set_callback(post_cb); - printf("\tFIPS-mode test application\n\n"); + printf("\tFIPS-mode test application\n"); + + printf("\t%s\n\n", FIPS_module_version_text()); if (argv[1]) { /* Corrupted KAT tests */ @@ -847,8 +900,12 @@ int main(int argc,char **argv) } else if (!strcmp(argv[1], "aes")) { fail_id = FIPS_TEST_CIPHER; fail_sub = NID_aes_128_ecb; + } else if (!strcmp(argv[1], "aes-ccm")) { + fail_id = FIPS_TEST_CCM; } else if (!strcmp(argv[1], "aes-gcm")) { fail_id = FIPS_TEST_GCM; + } else if (!strcmp(argv[1], "aes-xts")) { + fail_id = FIPS_TEST_XTS; } else if (!strcmp(argv[1], "des")) { fail_id = FIPS_TEST_CIPHER; fail_sub = NID_des_ede3_ecb; @@ -884,13 +941,17 @@ int main(int argc,char **argv) } else if (!strcmp(argv[1], "cmac")) { fail_id = FIPS_TEST_CMAC; } else if (!strcmp(argv[1], "drbg")) { - FIPS_corrupt_drbg(); + fail_id = FIPS_TEST_DRBG; } else if (!strcmp(argv[1], "rng")) { fail_id = FIPS_TEST_X931; + } else if (!strcmp(argv[1], "post")) { + fail_id = -1; } else if (!strcmp(argv[1], "rngstick")) { do_rng_stick = 1; no_exit = 1; printf("RNG test with stuck continuous test...\n"); + } else if (!strcmp(argv[1], "drbgentstick")) { + do_entropy_stick(); } else if (!strcmp(argv[1], "drbgstick")) { do_drbg_stick = 1; no_exit = 1; @@ -900,7 +961,8 @@ int main(int argc,char **argv) exit(1); } if (!no_exit) { - if (!FIPS_mode_set(1)) { + fips_algtest_init_nofips(); + if (!FIPS_module_mode_set(1)) { printf("Power-up self test failed\n"); exit(1); } @@ -909,6 +971,8 @@ int main(int argc,char **argv) } } + fips_algtest_init_nofips(); + /* Non-Approved cryptographic operation */ printf("1. Non-Approved cryptographic operation test...\n"); @@ -917,8 +981,8 @@ int main(int argc,char **argv) /* Power-up self test */ ERR_clear_error(); - test_msg("2. Automatic power-up self test", FIPS_mode_set(1)); - if (!FIPS_mode()) + test_msg("2. Automatic power-up self test", FIPS_module_mode_set(1)); + if (!FIPS_module_mode()) exit(1); if (do_drbg_stick) FIPS_drbg_stick(); @@ -1013,6 +1077,10 @@ int main(int argc,char **argv) Zeroize() ? "successful as expected" : Fail("failed INCORRECTLY!") ); + printf("11. Complete DRBG health check...\n\t%s\n", + FIPS_selftest_drbg_all() ? "successful as expected" + : Fail("failed INCORRECTLY!") ); + printf("\nAll tests completed with %d errors\n", Error); return Error ? 1 : 0; }