projects / openssl.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
clarify comment
[openssl.git] / fips / fips_test_suite.c
diff --git a/fips/fips_test_suite.c b/fips/fips_test_suite.c
index c14ecb3058d0b64cb028fda86f00c5c93c5ef786..c829d184a7f8a8bd037172a5d5ad525aa7a3b7ef 100644 (file)
--- a/fips/fips_test_suite.c
+++ b/fips/fips_test_suite.c
@@ -679,11 +679,28 @@ POST_ID id_list[] = {
        {NID_sha256, "SHA256"},
        {NID_sha384, "SHA384"},
        {NID_sha512, "SHA512"},
+       {NID_hmacWithSHA1, "HMAC-SHA1"},
+       {NID_hmacWithSHA224, "HMAC-SHA224"},
+       {NID_hmacWithSHA256, "HMAC-SHA256"},
+       {NID_hmacWithSHA384, "HMAC-SHA384"},
+       {NID_hmacWithSHA512, "HMAC-SHA512"},
        {EVP_PKEY_RSA, "RSA"},
        {EVP_PKEY_DSA, "DSA"},
        {EVP_PKEY_EC, "ECDSA"},
+       {NID_aes_128_cbc, "AES-128-CBC"},
+       {NID_aes_192_cbc, "AES-192-CBC"},
+       {NID_aes_256_cbc, "AES-256-CBC"},
+       {NID_aes_128_ctr, "AES-128-CTR"},
+       {NID_aes_192_ctr, "AES-192-CTR"},
+       {NID_aes_256_ctr, "AES-256-CTR"},
        {NID_aes_128_ecb, "AES-128-ECB"},
+       {NID_aes_128_xts, "AES-128-XTS"},
+       {NID_aes_256_xts, "AES-256-XTS"},
+       {NID_des_ede3_cbc, "DES-EDE3-CBC"},
        {NID_des_ede3_ecb, "DES-EDE3-ECB"},
+       {NID_X9_62_prime256v1, "P-256"},
+       {NID_secp384r1, "P-384"},
+       {NID_secp521r1, "P-521"},
        {0, NULL}
 };
 
@@ -696,7 +713,7 @@ static const char *lookup_id(int id)
                if (n->id == id)
                        return n->name;
                }
-       sprintf(out, "ID=%d\n", id);
+       sprintf(out, "ID=%d", id);
        return out;
        }
 
@@ -707,7 +724,11 @@ static int fail_key = -1;
 static int post_cb(int op, int id, int subid, void *ex)
        {
        const char *idstr, *exstr = "";
+       char asctmp[20];
        int keytype = -1;
+#ifdef FIPS_POST_TIME
+       static struct timespec start, end, tstart, tend;
+#endif
        switch(id)
                {
                case FIPS_TEST_INTEGRITY:
@@ -741,26 +762,44 @@ static int post_cb(int op, int id, int subid, void *ex)
 
                case FIPS_TEST_CMAC:
                idstr = "CMAC";
+               exstr = lookup_id(subid);
                break;
 
                case FIPS_TEST_GCM:
                idstr = "GCM";
                break;
 
-               case FIPS_TEST_CCM:
-               idstr = "CCM";
+               case FIPS_TEST_XTS:
+               idstr = "XTS";
+               exstr = lookup_id(subid);
                break;
 
-               case FIPS_TEST_XTS:
-               idstr = "HMAC";
+               case FIPS_TEST_CCM:
+               idstr = "CCM";
                break;
 
                case FIPS_TEST_X931:
                idstr = "X9.31 PRNG";
+               sprintf(asctmp, "keylen=%d", subid);
+               exstr = asctmp;
                break;
 
                case FIPS_TEST_DRBG:
                idstr = "DRBG";
+               if (*(int *)ex & DRBG_FLAG_CTR_USE_DF)
+                       {
+                       sprintf(asctmp, "%s DF", lookup_id(subid));
+                       exstr = asctmp;
+                       }
+               else if (subid >> 16)
+                       {
+                       sprintf(asctmp, "%s %s",
+                                       lookup_id(subid >> 16),
+                                       lookup_id(subid & 0xFFFF));
+                       exstr = asctmp;
+                       }
+               else
+                       exstr = lookup_id(subid);
                break;
 
                case FIPS_TEST_PAIRWISE:
@@ -786,19 +825,40 @@ static int post_cb(int op, int id, int subid, void *ex)
        switch(op)
                {
                case FIPS_POST_BEGIN:
+#ifdef FIPS_POST_TIME
+               clock_getres(CLOCK_REALTIME, &tstart);
+               printf("\tTimer resolution %ld s, %ld ns\n",
+                               (long)tstart.tv_sec, (long)tstart.tv_nsec);
+               clock_gettime(CLOCK_REALTIME, &tstart);
+#endif
                printf("\tPOST started\n");
                break;
 
                case FIPS_POST_END:
                printf("\tPOST %s\n", id ? "Success" : "Failed");
+#ifdef FIPS_POST_TIME
+               clock_gettime(CLOCK_REALTIME, &tend);
+               printf("\t\tTook %f seconds\n",
+                       (double)((tend.tv_sec+tend.tv_nsec*1e-9)
+                        - (tstart.tv_sec+tstart.tv_nsec*1e-9)));
+#endif
                break;
 
                case FIPS_POST_STARTED:
                printf("\t\t%s %s test started\n", idstr, exstr);
+#ifdef FIPS_POST_TIME
+               clock_gettime(CLOCK_REALTIME, &start);
+#endif
                break;
 
                case FIPS_POST_SUCCESS:
                printf("\t\t%s %s test OK\n", idstr, exstr);
+#ifdef FIPS_POST_TIME
+               clock_gettime(CLOCK_REALTIME, &end);
+               printf("\t\t\tTook %f seconds\n",
+                       (double)((end.tv_sec+end.tv_nsec*1e-9)
+                        - (start.tv_sec+start.tv_nsec*1e-9)));
+#endif
                break;
 
                case FIPS_POST_FAIL:
@@ -826,11 +886,12 @@ int main(int argc,char **argv)
     int do_drbg_stick = 0;
     int no_exit = 0;
 
-    fips_algtest_init_nofips();
 
     FIPS_post_set_callback(post_cb);
 
-    printf("\tFIPS-mode test application\n\n");
+    printf("\tFIPS-mode test application\n");
+
+    printf("\t%s\n\n", FIPS_module_version_text());
 
     if (argv[1]) {
         /* Corrupted KAT tests */
@@ -839,8 +900,12 @@ int main(int argc,char **argv)
         } else if (!strcmp(argv[1], "aes")) {
            fail_id = FIPS_TEST_CIPHER;
            fail_sub = NID_aes_128_ecb; 
+        } else if (!strcmp(argv[1], "aes-ccm")) {
+           fail_id = FIPS_TEST_CCM;
         } else if (!strcmp(argv[1], "aes-gcm")) {
            fail_id = FIPS_TEST_GCM;
+        } else if (!strcmp(argv[1], "aes-xts")) {
+           fail_id = FIPS_TEST_XTS;
         } else if (!strcmp(argv[1], "des")) {
            fail_id = FIPS_TEST_CIPHER;
            fail_sub = NID_des_ede3_ecb;        
@@ -873,14 +938,20 @@ int main(int argc,char **argv)
            fail_id = FIPS_TEST_DIGEST;
         } else if (!strcmp(argv[1], "hmac")) {
            fail_id = FIPS_TEST_HMAC;
+        } else if (!strcmp(argv[1], "cmac")) {
+           fail_id = FIPS_TEST_CMAC;
        } else if (!strcmp(argv[1], "drbg")) {
-           FIPS_corrupt_drbg();
+           fail_id = FIPS_TEST_DRBG;
        } else if (!strcmp(argv[1], "rng")) {
-           FIPS_corrupt_x931();
+           fail_id = FIPS_TEST_X931;
+       } else if (!strcmp(argv[1], "post")) {
+           fail_id = -1;
        } else if (!strcmp(argv[1], "rngstick")) {
            do_rng_stick = 1;
            no_exit = 1;
            printf("RNG test with stuck continuous test...\n");
+       } else if (!strcmp(argv[1], "drbgentstick")) {
+               do_entropy_stick();
        } else if (!strcmp(argv[1], "drbgstick")) {
            do_drbg_stick = 1;
            no_exit = 1;
@@ -890,7 +961,8 @@ int main(int argc,char **argv)
             exit(1);
         }
        if (!no_exit) {
-               if (!FIPS_mode_set(1)) {
+               fips_algtest_init_nofips();
+               if (!FIPS_module_mode_set(1)) {
                    printf("Power-up self test failed\n");
                    exit(1);
                }
@@ -899,6 +971,8 @@ int main(int argc,char **argv)
        }
     }
 
+    fips_algtest_init_nofips();
+
     /* Non-Approved cryptographic operation
     */
     printf("1. Non-Approved cryptographic operation test...\n");
@@ -907,8 +981,8 @@ int main(int argc,char **argv)
     /* Power-up self test
     */
     ERR_clear_error();
-    test_msg("2. Automatic power-up self test", FIPS_mode_set(1));
-    if (!FIPS_mode())
+    test_msg("2. Automatic power-up self test", FIPS_module_mode_set(1));
+    if (!FIPS_module_mode())
        exit(1);
     if (do_drbg_stick)
             FIPS_drbg_stick();
@@ -1003,6 +1077,10 @@ int main(int argc,char **argv)
                Zeroize() ? "successful as expected"
                                        : Fail("failed INCORRECTLY!") );
 
+    printf("11. Complete DRBG health check...\n\t%s\n",
+               FIPS_selftest_drbg_all() ? "successful as expected"
+                                       : Fail("failed INCORRECTLY!") );
+
     printf("\nAll tests completed with %d errors\n", Error);
     return Error ? 1 : 0;
     }
Unnamed repository; edit this file 'description' to name the repository.