X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=fips%2Ffipsalgtest.pl;h=30cd9c0ebde6a789ce599d698b5ed6d91942c01c;hp=048e3e83d79057fb6a571c819e11a632589ccd69;hb=8b5dd340919e511137696792279f595a70ae2762;hpb=1eb8939695fe334fb5af2fef87fa410c0d281d89 diff --git a/fips/fipsalgtest.pl b/fips/fipsalgtest.pl index 048e3e83d7..30cd9c0ebd 100644 --- a/fips/fipsalgtest.pl +++ b/fips/fipsalgtest.pl @@ -12,16 +12,48 @@ my @fips_dsa_test_list = ( "DSA", - [ "PQGGen", "fips_dssvs pqg" ], - [ "KeyPair", "fips_dssvs keypair" ], - [ "SigGen", "fips_dssvs siggen" ], - [ "SigVer", "fips_dssvs sigver" ] + [ "PQGGen", "fips_dssvs pqg", "path:[^C]DSA/.*PQGGen" ], + [ "KeyPair", "fips_dssvs keypair", "path:[^C]DSA/.*KeyPair" ], + [ "SigGen", "fips_dssvs siggen", "path:[^C]DSA/.*SigGen" ], + [ "SigVer", "fips_dssvs sigver", "path:[^C]DSA/.*SigVer" ] ); my @fips_dsa_pqgver_test_list = ( - [ "PQGVer", "fips_dssvs pqgver" ] + [ "PQGVer", "fips_dssvs pqgver", "path:[^C]DSA/.*PQGVer" ] + +); + +# DSA2 tests +my @fips_dsa2_test_list = ( + + "DSA2", + + [ "PQGGen", "fips_dssvs pqg", "path:[^C]DSA2/.*PQGGen" ], + [ "KeyPair", "fips_dssvs keypair", "path:[^C]DSA2/.*KeyPair" ], + [ "SigGen", "fips_dssvs siggen", "path:[^C]DSA2/.*SigGen" ], + [ "SigVer", "fips_dssvs sigver", "path:[^C]DSA2/.*SigVer" ], + [ "PQGVer", "fips_dssvs pqgver", "path:[^C]DSA2/.*PQGVer" ] + +); + +# ECDSA and ECDSA2 tests +my @fips_ecdsa_test_list = ( + + "ECDSA", + + [ "KeyPair", "fips_ecdsavs KeyPair", "path:/ECDSA/.*KeyPair" ], + [ "PKV", "fips_ecdsavs PKV", "path:/ECDSA/.*PKV" ], + [ "SigGen", "fips_ecdsavs SigGen", "path:/ECDSA/.*SigGen" ], + [ "SigVer", "fips_ecdsavs SigVer", "path:/ECDSA/.*SigVer" ], + + "ECDSA2", + + [ "KeyPair", "fips_ecdsavs KeyPair", "path:/ECDSA2/.*KeyPair" ], + [ "PKV", "fips_ecdsavs PKV", "path:/ECDSA2/.*PKV" ], + [ "SigGen", "fips_ecdsavs SigGen", "path:/ECDSA2/.*SigGen" ], + [ "SigVer", "fips_ecdsavs SigVer", "path:/ECDSA2/.*SigVer" ], ); @@ -49,9 +81,9 @@ my @fips_rsa_test_list = ( my @fips_rsa_pss0_test_list = ( [ "SigGenPSS(0)", "fips_rsastest -saltlen 0", - '^\s*#\s*salt\s+len:\s+0\s*$' ], + 'file:^\s*#\s*salt\s+len:\s+0\s*$' ], [ "SigVerPSS(0)", "fips_rsavtest -saltlen 0", - '^\s*#\s*salt\s+len:\s+0\s*$' ], + 'file:^\s*#\s*salt\s+len:\s+0\s*$' ], ); @@ -59,9 +91,9 @@ my @fips_rsa_pss0_test_list = ( my @fips_rsa_pss62_test_list = ( [ "SigGenPSS(62)", "fips_rsastest -saltlen 62", - '^\s*#\s*salt\s+len:\s+62\s*$' ], + 'file:^\s*#\s*salt\s+len:\s+62\s*$' ], [ "SigVerPSS(62)", "fips_rsavtest -saltlen 62", - '^\s*#\s*salt\s+len:\s+62\s*$' ], + 'file:^\s*#\s*salt\s+len:\s+62\s*$' ], ); # SHA tests @@ -299,6 +331,9 @@ my @fips_aes_gcm_test_list = ( [ "gcmDecrypt128", "fips_gcmtest -decrypt" ], [ "gcmDecrypt192", "fips_gcmtest -decrypt" ], [ "gcmDecrypt256", "fips_gcmtest -decrypt" ], + [ "gcmEncryptIntIV128", "fips_gcmtest -encrypt" ], + [ "gcmEncryptIntIV192", "fips_gcmtest -encrypt" ], + [ "gcmEncryptIntIV256", "fips_gcmtest -encrypt" ], ); @@ -399,7 +434,9 @@ my @fips_drbg_test_list = ( # SP800-90 DRBG tests "SP800-90 DRBG", [ "CTR_DRBG", "fips_drbgvs" ], - [ "Hash_DRBG", "fips_drbgvs" ] + [ "Dual_EC_DRBG", "fips_drbgvs" ], + [ "Hash_DRBG", "fips_drbgvs" ], + [ "HMAC_DRBG", "fips_drbgvs" ] ); @@ -416,10 +453,11 @@ my @fips_ecdh_test_list = ( # ECDH "ECDH Ephemeral Primitives Only", - [ "KASValidityTest_ECCEphemeralUnified_NOKC_ZZOnly_init", - "fips_ecdhvs ecdhver" ], - [ "KASValidityTest_ECCEphemeralUnified_NOKC_ZZOnly_resp", - "fips_ecdhvs ecdhver" ], + [ "KAS_ECC_CDH_PrimitiveTest", "fips_ecdhvs ecdhgen" ], +# [ "KASValidityTest_ECCEphemeralUnified_NOKC_ZZOnly_init", +# "fips_ecdhvs ecdhver" ], +# [ "KASValidityTest_ECCEphemeralUnified_NOKC_ZZOnly_resp", +# "fips_ecdhvs ecdhver" ], ); @@ -435,13 +473,21 @@ my @fips_ecdh_test_list = ( # my %verify_special = ( - "PQGGen" => "fips_dssvs pqgver", - "KeyPair" => "fips_dssvs keyver", - "SigGen" => "fips_dssvs sigver", - "SigGen15" => "fips_rsavtest", - "SigGenRSA" => "fips_rsavtest -x931", - "SigGenPSS(0)" => "fips_rsavtest -saltlen 0", - "SigGenPSS(62)" => "fips_rsavtest -saltlen 62", + "DSA:PQGGen" => "fips_dssvs pqgver", + "DSA:KeyPair" => "fips_dssvs keyver", + "DSA:SigGen" => "fips_dssvs sigver", + "DSA2:PQGGen" => "fips_dssvs pqgver", + "DSA2:KeyPair" => "fips_dssvs keyver", + "DSA2:SigGen" => "fips_dssvs sigver", + "ECDSA:KeyPair" => "fips_ecdsavs PKV", + "ECDSA:SigGen" => "fips_ecdsavs SigVer", + "ECDSA2:KeyPair" => "fips_ecdsavs PKV", + "ECDSA2:SigGen" => "fips_ecdsavs SigVer", + "RSA:SigGen15" => "fips_rsavtest", + "RSA:SigGenRSA" => "fips_rsavtest -x931", + "RSA:SigGenPSS(0)" => "fips_rsavtest -saltlen 0", + "RSA:SigGenPSS(62)" => "fips_rsavtest -saltlen 62", + "ECDH Ephemeral Primitives Only:KAS_ECC_CDH_PrimitiveTest" => "skip" ); my $win32 = $^O =~ m/mswin/i; @@ -453,7 +499,7 @@ my $debug = 0; my $quiet = 0; my $notest = 0; my $verify = 1; -my $rspdir = "rsp"; +my $rspdir = "resp"; my $ignore_missing = 0; my $ignore_bogus = 0; my $bufout = ''; @@ -464,28 +510,32 @@ my $no_warn_missing = 0; my $no_warn_bogus = 0; my $rmcmd = "rm -rf"; my $mkcmd = "mkdir"; +my $cmpall = 0; my %fips_enabled = ( - dsa => 1, - "dsa-pqgver" => 0, - rsa => 1, - "rsa-pss0" => 0, + "dsa" => 1, + "dsa2" => 2, + "dsa-pqgver" => 2, + "ecdsa" => 2, + "rsa" => 1, + "rsa-pss0" => 2, "rsa-pss62" => 1, - sha => 1, - hmac => 1, - cmac => 0, + "sha" => 1, + "hmac" => 1, + "cmac" => 2, "rand-aes" => 1, "rand-des2" => 0, - aes => 1, - "aes-cfb1" => 0, - des3 => 1, - "des3-cfb1" => 0, - drbg => 0, - ccm => 0, - "aes-xts" => 0, - gcm => 0, - dh => 0, - ecdh => 0, + "aes" => 1, + "aes-cfb1" => 2, + "des3" => 1, + "des3-cfb1" => 2, + "drbg" => 2, + "aes-ccm" => 2, + "aes-xts" => 2, + "aes-gcm" => 2, + "dh" => 0, + "ecdh" => 2, + "v2" => 1, ); foreach (@ARGV) { @@ -521,6 +571,9 @@ foreach (@ARGV) { } elsif ( $_ eq "--generate" ) { $verify = 0; } + elsif ( $_ eq "--compare-all" ) { + $cmpall = 1; + } elsif ( $_ eq "--notest" ) { $notest = 1; } @@ -536,6 +589,11 @@ foreach (@ARGV) { elsif (/--tprefix=(.*)$/) { $tprefix = $1; } + elsif (/^--disable-all$/) { + foreach (keys %fips_enabled) { + $fips_enabled{$_} = 0; + } + } elsif (/^--(enable|disable)-(.*)$/) { if ( !exists $fips_enabled{$2} ) { print STDERR "Unknown test $2\n"; @@ -571,8 +629,17 @@ foreach (@ARGV) { my @fips_test_list; + +if (!$fips_enabled{"v2"}) { + foreach (keys %fips_enabled) { + $fips_enabled{$_} = 0 if $fips_enabled{$_} == 2; + } +} + push @fips_test_list, @fips_dsa_test_list if $fips_enabled{"dsa"}; push @fips_test_list, @fips_dsa_pqgver_test_list if $fips_enabled{"dsa-pqgver"}; +push @fips_test_list, @fips_dsa2_test_list if $fips_enabled{"dsa2"}; +push @fips_test_list, @fips_ecdsa_test_list if $fips_enabled{"ecdsa"}; push @fips_test_list, @fips_rsa_test_list if $fips_enabled{"rsa"}; push @fips_test_list, @fips_rsa_pss0_test_list if $fips_enabled{"rsa-pss0"}; push @fips_test_list, @fips_rsa_pss62_test_list if $fips_enabled{"rsa-pss62"}; @@ -608,8 +675,6 @@ foreach (@fips_test_list) { my $nm = $$_[0]; $$_[3] = ""; $$_[4] = ""; - print STDERR "Duplicate test $nm\n" if exists $fips_tests{$nm}; - $fips_tests{$nm} = $_; } $tvdir = "." unless defined $tvdir; @@ -681,26 +746,36 @@ sub Help { ( my $cmd ) = ( $0 =~ m#([^/]+)$# ); print < Optional root for *.req file search - --filter= - --onedir Assume all components in current directory - --rspdir= Name of subdirectories containing *.rsp files, default "rsp" - --tprefix= - --ignore-bogus Ignore duplicate or bogus files - --ignore-missing Ignore missing test files - --quiet Shhh.... - --generate Generate algorithm test output - --win32 Win32 environment - --enable- Enable algorithm set . - --disable- Disable algorithm set . + --debug Enable debug output + --dir= Optional root for *.req file search + --filter= Regex for input files of interest + --onedir Assume all components in current directory + --rspdir= Name of subdirectories containing *.rsp files, default "resp" + --tprefix= Pathname prefix for directory containing test programs + --ignore-bogus Ignore duplicate or bogus files + --ignore-missing Ignore missing test files + --quiet Shhh.... + --quiet-bogus Skip unrecognized file warnings + --quiet-missing Skip missing request file warnings + --generate Generate algorithm test output + --generate-script= Generate script to call algorithm programs + --minimal-script Simplest possible output for --generate-script + --win32 Win32 environment + --compare-all Verify unconditionally for all tests + --list-tests Show individual tests + --mkdir= Specify "mkdir" command + --notest Exit before running tests + --rm= Specify "rm" command + --script-tprefix Pathname prefix for --generate-script output + --enable- Enable algorithm set . + --disable- Disable algorithm set . Where can be one of: EOF while (my ($key, $value) = each %fips_enabled) { printf "\t\t%-20s(%s by default)\n", $key , - $value ? "enabled" : "disabled"; + $value == 1 ? "enabled" : "disabled"; } } @@ -798,9 +873,21 @@ sub find_test { my ( $test, $path ) = @_; foreach $tref (@fips_test_list) { next unless ref($tref); - my ( $tst, $cmd, $regexp, $req, $resp ) = @$tref; + my ( $tst, $cmd, $excmd, $req, $resp ) = @$tref; + my $regexp; $tst =~ s/\(.*$//; - if ($tst eq $test) { + $test =~ s/_186-2//; + if (defined $excmd) { + if ($excmd =~ /^path:(.*)$/) { + my $fmatch = $1; + return $tref if ($path =~ /$fmatch/); + next; + } + elsif ($excmd =~ /^file:(.*)$/) { + $regexp = $1; + } + } + if ($test eq $tst) { return $tref if (!defined $regexp); my $found = 0; my $line; @@ -857,6 +944,7 @@ sub run_tests { my ( $tname, $tref ); my $bad = 0; my $lastdir = ""; + $stprefix = $tprefix unless defined $stprefix; if ($outfile ne "") { open OUT, ">$outfile" || die "Can't open $outfile"; } @@ -872,7 +960,6 @@ echo Running Algorithm Tests END } else { - $stprefix = $tprefix unless defined $stprefix; print OUT <