X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=fips%2Ffipsalgtest.pl;h=af591d32ac75fdeeea16e726988061cf8795477b;hp=24467e015304e82e8c24afab6d8f91785dd0b301;hb=2abaa9caafa0a7c2b380c614d343a1b52d74e5d1;hpb=37942b93af4fca91ca915d4da1f68d7965a9522f diff --git a/fips/fipsalgtest.pl b/fips/fipsalgtest.pl index 24467e0153..af591d32ac 100644 --- a/fips/fipsalgtest.pl +++ b/fips/fipsalgtest.pl @@ -1,5 +1,5 @@ #!/usr/bin/perl -w -# Perl utility to run or verify FIPS 140-2 CMVP algorithm tests based on the +# Perl utility to run or verify FIPS 140-2 CAVP algorithm tests based on the # pathnames of input algorithm test files actually present (the unqualified # file names are consistent but the pathnames are not). # @@ -12,16 +12,48 @@ my @fips_dsa_test_list = ( "DSA", - [ "PQGGen", "fips_dssvs pqg" ], - [ "KeyPair", "fips_dssvs keypair" ], - [ "SigGen", "fips_dssvs siggen" ], - [ "SigVer", "fips_dssvs sigver" ] + [ "PQGGen", "fips_dssvs pqg", "path:[^C]DSA/.*PQGGen" ], + [ "KeyPair", "fips_dssvs keypair", "path:[^C]DSA/.*KeyPair" ], + [ "SigGen", "fips_dssvs siggen", "path:[^C]DSA/.*SigGen" ], + [ "SigVer", "fips_dssvs sigver", "path:[^C]DSA/.*SigVer" ] ); my @fips_dsa_pqgver_test_list = ( - [ "PQGVer", "fips_dssvs pqgver" ] + [ "PQGVer", "fips_dssvs pqgver", "path:[^C]DSA/.*PQGVer" ] + +); + +# DSA2 tests +my @fips_dsa2_test_list = ( + + "DSA2", + + [ "PQGGen", "fips_dssvs pqg", "path:[^C]DSA2/.*PQGGen" ], + [ "KeyPair", "fips_dssvs keypair", "path:[^C]DSA2/.*KeyPair" ], + [ "SigGen", "fips_dssvs siggen", "path:[^C]DSA2/.*SigGen" ], + [ "SigVer", "fips_dssvs sigver", "path:[^C]DSA2/.*SigVer" ], + [ "PQGVer", "fips_dssvs pqgver", "path:[^C]DSA2/.*PQGVer" ] + +); + +# ECDSA and ECDSA2 tests +my @fips_ecdsa_test_list = ( + + "ECDSA", + + [ "KeyPair", "fips_ecdsavs KeyPair", "path:/ECDSA/.*KeyPair" ], + [ "PKV", "fips_ecdsavs PKV", "path:/ECDSA/.*PKV" ], + [ "SigGen", "fips_ecdsavs SigGen", "path:/ECDSA/.*SigGen" ], + [ "SigVer", "fips_ecdsavs SigVer", "path:/ECDSA/.*SigVer" ], + + "ECDSA2", + + [ "KeyPair", "fips_ecdsavs KeyPair", "path:/ECDSA2/.*KeyPair" ], + [ "PKV", "fips_ecdsavs PKV", "path:/ECDSA2/.*PKV" ], + [ "SigGen", "fips_ecdsavs SigGen", "path:/ECDSA2/.*SigGen" ], + [ "SigVer", "fips_ecdsavs SigVer", "path:/ECDSA2/.*SigVer" ], ); @@ -48,17 +80,20 @@ my @fips_rsa_test_list = ( my @fips_rsa_pss0_test_list = ( - [ "SigGenPSS(0)", "fips_rsastest -saltlen 0" ], - [ "SigVerPSS(0)", "fips_rsavtest -saltlen 0" ] + [ "SigGenPSS(0)", "fips_rsastest -saltlen 0", + 'file:^\s*#\s*salt\s+len:\s+0\s*$' ], + [ "SigVerPSS(0)", "fips_rsavtest -saltlen 0", + 'file:^\s*#\s*salt\s+len:\s+0\s*$' ], ); # RSA PSS salt length 62 tests my @fips_rsa_pss62_test_list = ( - [ "SigGenPSS(62)", "fips_rsastest -saltlen 62" ], - [ "SigVerPSS(62)", "fips_rsavtest -saltlen 62" ] - + [ "SigGenPSS(62)", "fips_rsastest -saltlen 62", + 'file:^\s*#\s*salt\s+len:\s+62\s*$' ], + [ "SigVerPSS(62)", "fips_rsavtest -saltlen 62", + 'file:^\s*#\s*salt\s+len:\s+62\s*$' ], ); # SHA tests @@ -101,8 +136,14 @@ my @fips_cmac_test_list = ( "CMAC", - [ "CMACGenAES256", "fips_cmactest -g" ], - [ "CMACVerAES256", "fips_cmactest -v" ] + [ "CMACGenAES128", "fips_cmactest -a aes128 -g" ], + [ "CMACVerAES128", "fips_cmactest -a aes128 -v" ], + [ "CMACGenAES192", "fips_cmactest -a aes192 -g" ], + [ "CMACVerAES192", "fips_cmactest -a aes192 -v" ], + [ "CMACGenAES256", "fips_cmactest -a aes256 -g" ], + [ "CMACVerAES256", "fips_cmactest -a aes256 -v" ], + [ "CMACGenTDES3", "fips_cmactest -a tdes3 -g" ], + [ "CMACVerTDES3", "fips_cmactest -a tdes3 -v" ], ); @@ -257,6 +298,55 @@ my @fips_aes_cfb1_test_list = ( ); +my @fips_aes_ccm_test_list = ( + + # AES CCM tests + + "AES CCM", + + [ "DVPT128", "fips_gcmtest -ccm" ], + [ "DVPT192", "fips_gcmtest -ccm" ], + [ "DVPT256", "fips_gcmtest -ccm" ], + [ "VADT128", "fips_gcmtest -ccm" ], + [ "VADT192", "fips_gcmtest -ccm" ], + [ "VADT256", "fips_gcmtest -ccm" ], + [ "VNT128", "fips_gcmtest -ccm" ], + [ "VNT192", "fips_gcmtest -ccm" ], + [ "VNT256", "fips_gcmtest -ccm" ], + [ "VPT128", "fips_gcmtest -ccm" ], + [ "VPT192", "fips_gcmtest -ccm" ], + [ "VPT256", "fips_gcmtest -ccm" ], + [ "VTT128", "fips_gcmtest -ccm" ], + [ "VTT192", "fips_gcmtest -ccm" ], + [ "VTT256", "fips_gcmtest -ccm" ] + +); + +my @fips_aes_gcm_test_list = ( + + # AES GCM tests + + "AES GCM", + + [ "gcmDecrypt128", "fips_gcmtest -decrypt" ], + [ "gcmDecrypt192", "fips_gcmtest -decrypt" ], + [ "gcmDecrypt256", "fips_gcmtest -decrypt" ], + [ "gcmEncryptIntIV128", "fips_gcmtest -encrypt" ], + [ "gcmEncryptIntIV192", "fips_gcmtest -encrypt" ], + [ "gcmEncryptIntIV256", "fips_gcmtest -encrypt" ], + +); + +my @fips_aes_xts_test_list = ( + # AES XTS tests + + "AES XTS", + + [ "XTSGenAES128", "fips_gcmtest -xts" ], + [ "XTSGenAES256", "fips_gcmtest -xts" ], + +); + # Triple DES tests my @fips_des3_test_list = ( @@ -339,6 +429,38 @@ my @fips_des3_cfb1_test_list = ( ); +my @fips_drbg_test_list = ( + + # SP800-90 DRBG tests + "SP800-90 DRBG", + [ "CTR_DRBG", "fips_drbgvs" ], + [ "Hash_DRBG", "fips_drbgvs" ], + [ "HMAC_DRBG", "fips_drbgvs" ] + +); + +my @fips_dh_test_list = ( + + # DH + "DH Ephemeral Primitives Only", + [ "KASValidityTest_FFCEphem_NOKC_ZZOnly_init", "fips_dhvs dhver" ], + [ "KASValidityTest_FFCEphem_NOKC_ZZOnly_resp", "fips_dhvs dhver" ], + +); + +my @fips_ecdh_test_list = ( + + # ECDH + "ECDH Ephemeral Primitives Only", + [ "KAS_ECC_CDH_PrimitiveTest", "fips_ecdhvs WTF" ], +# [ "KASValidityTest_ECCEphemeralUnified_NOKC_ZZOnly_init", +# "fips_ecdhvs ecdhver" ], +# [ "KASValidityTest_ECCEphemeralUnified_NOKC_ZZOnly_resp", +# "fips_ecdhvs ecdhver" ], + +); + + # Verification special cases. # In most cases the output of a test is deterministic and # it can be compared to a known good result. A few involve @@ -364,32 +486,46 @@ my $onedir = 0; my $filter = ""; my $tvdir; my $tprefix; -my $shwrap_prefix; my $debug = 0; my $quiet = 0; my $notest = 0; my $verify = 1; -my $rspdir = "rsp"; +my $rspdir = "resp"; my $ignore_missing = 0; my $ignore_bogus = 0; my $bufout = ''; my $list_tests = 0; +my $minimal_script = 0; +my $outfile = ''; +my $no_warn_missing = 0; +my $no_warn_bogus = 0; +my $rmcmd = "rm -rf"; +my $mkcmd = "mkdir"; my %fips_enabled = ( dsa => 1, - "dsa-pqgver" => 0, + dsa2 => 2, + "dsa-pqgver" => 2, + ecdsa => 2, rsa => 1, "rsa-pss0" => 0, "rsa-pss62" => 1, sha => 1, hmac => 1, - cmac => 1, + cmac => 2, "rand-aes" => 1, "rand-des2" => 0, aes => 1, - "aes-cfb1" => 0, + "aes-cfb1" => 2, des3 => 1, - "des3-cfb1" => 0 + "des3-cfb1" => 2, + drbg => 2, + "aes-ccm" => 2, + "aes-xts" => 2, + "aes-gcm" => 2, + dh => 0, + ecdh => 2, + v2 => 0, ); foreach (@ARGV) { @@ -402,13 +538,27 @@ foreach (@ARGV) { elsif ( $_ eq "--debug" ) { $debug = 1; } + elsif ( $_ eq "--quiet-missing" ) { + $ignore_missing = 1; + $no_warn_missing = 1; + } elsif ( $_ eq "--ignore-missing" ) { $ignore_missing = 1; } + elsif ( $_ eq "--quiet-bogus" ) { + $ignore_bogus = 1; + $no_warn_bogus = 1; + } elsif ( $_ eq "--ignore-bogus" ) { $ignore_bogus = 1; } - elsif ( $_ eq "--generate" ) { + elsif ( $_ eq "--minimal-script" ) { + $minimal_script = 1; + } + elsif (/--generate-script=(.*)$/) { + $outfile = $1; + $verify = 0; + } elsif ( $_ eq "--generate" ) { $verify = 0; } elsif ( $_ eq "--notest" ) { @@ -426,12 +576,10 @@ foreach (@ARGV) { elsif (/--tprefix=(.*)$/) { $tprefix = $1; } - elsif (/--shwrap_prefix=(.*)$/) { - $shwrap_prefix = $1; - } elsif (/^--(enable|disable)-(.*)$/) { if ( !exists $fips_enabled{$2} ) { print STDERR "Unknown test $2\n"; + exit(1); } if ( $1 eq "enable" ) { $fips_enabled{$2} = 1; @@ -443,6 +591,15 @@ foreach (@ARGV) { elsif (/--filter=(.*)$/) { $filter = $1; } + elsif (/--rm=(.*)$/) { + $rmcmd = $1; + } + elsif (/--script-tprefix=(.*)$/) { + $stprefix = $1; + } + elsif (/--mkdir=(.*)$/) { + $mkcmd = $1; + } elsif (/^--list-tests$/) { $list_tests = 1; } @@ -454,8 +611,17 @@ foreach (@ARGV) { my @fips_test_list; + +if (!$fips_enabled{"v2"}) { + foreach (keys %fips_enabled) { + $fips_enabled{$_} = 0 if $fips_enabled{$_} == 2; + } +} + push @fips_test_list, @fips_dsa_test_list if $fips_enabled{"dsa"}; +push @fips_test_list, @fips_dsa2_test_list if $fips_enabled{"dsa2"}; push @fips_test_list, @fips_dsa_pqgver_test_list if $fips_enabled{"dsa-pqgver"}; +push @fips_test_list, @fips_ecdsa_test_list if $fips_enabled{"ecdsa"}; push @fips_test_list, @fips_rsa_test_list if $fips_enabled{"rsa"}; push @fips_test_list, @fips_rsa_pss0_test_list if $fips_enabled{"rsa-pss0"}; push @fips_test_list, @fips_rsa_pss62_test_list if $fips_enabled{"rsa-pss62"}; @@ -468,6 +634,12 @@ push @fips_test_list, @fips_aes_test_list if $fips_enabled{"aes"}; push @fips_test_list, @fips_aes_cfb1_test_list if $fips_enabled{"aes-cfb1"}; push @fips_test_list, @fips_des3_test_list if $fips_enabled{"des3"}; push @fips_test_list, @fips_des3_cfb1_test_list if $fips_enabled{"des3-cfb1"}; +push @fips_test_list, @fips_drbg_test_list if $fips_enabled{"drbg"}; +push @fips_test_list, @fips_aes_ccm_test_list if $fips_enabled{"aes-ccm"}; +push @fips_test_list, @fips_aes_gcm_test_list if $fips_enabled{"aes-gcm"}; +push @fips_test_list, @fips_aes_xts_test_list if $fips_enabled{"aes-xts"}; +push @fips_test_list, @fips_dh_test_list if $fips_enabled{"dh"}; +push @fips_test_list, @fips_ecdh_test_list if $fips_enabled{"ecdh"}; if ($list_tests) { my ( $test, $en ); @@ -482,11 +654,9 @@ if ($list_tests) { foreach (@fips_test_list) { next unless ref($_); - my $nm = $_->[0]; - $_->[2] = ""; - $_->[3] = ""; - print STDERR "Duplicate test $nm\n" if exists $fips_tests{$nm}; - $fips_tests{$nm} = $_; + my $nm = $$_[0]; + $$_[3] = ""; + $$_[4] = ""; } $tvdir = "." unless defined $tvdir; @@ -504,17 +674,13 @@ if ($win32) { else { if ($onedir) { $tprefix = "./" unless defined $tprefix; - $shwrap_prefix = "./" unless defined $shwrap_prefix; } else { $tprefix = "../test/" unless defined $tprefix; - $shwrap_prefix = "../util/" unless defined $shwrap_prefix; } } -sanity_check_exe( $win32, $tprefix, $shwrap_prefix ); - -my $cmd_prefix = $win32 ? "" : "${shwrap_prefix}shlib_wrap.sh "; +sanity_check_exe( $win32, $tprefix) if $outfile eq ""; find_files( $filter, $tvdir ); @@ -524,8 +690,8 @@ my ( $runerr, $cmperr, $cmpok, $scheckrunerr, $scheckerr, $scheckok, $skipcnt ) = ( 0, 0, 0, 0, 0, 0, 0 ); exit(0) if $notest; - -run_tests( $verify, $win32, $tprefix, $filter, $tvdir ); +print "Outputting commands to $outfile\n" if $outfile ne ""; +run_tests( $verify, $win32, $tprefix, $filter, $tvdir, $outfile ); if ($verify) { print "ALGORITHM TEST VERIFY SUMMARY REPORT:\n"; @@ -544,7 +710,7 @@ if ($verify) { print "***ALL TESTS SUCCESSFUL***\n"; } } -else { +elsif ($outfile eq "") { print "ALGORITHM TEST SUMMARY REPORT:\n"; print "Tests skipped due to missing files: $skipcnt\n"; print "Algorithm test program execution failures: $runerr\n"; @@ -561,13 +727,12 @@ else { sub Help { ( my $cmd ) = ( $0 =~ m#([^/]+)$# ); print < Optional root for *.req file search --filter= --onedir Assume all components in current directory - --rspdir= Name of subdirectories containing *.rsp files, default "rsp" - --shwrap_prefix= + --rspdir= Name of subdirectories containing *.rsp files, default "resp" --tprefix= --ignore-bogus Ignore duplicate or bogus files --ignore-missing Ignore missing test files @@ -582,17 +747,16 @@ EOF while (my ($key, $value) = each %fips_enabled) { printf "\t\t%-20s(%s by default)\n", $key , - $value ? "enabled" : "disabled"; + $value == 1 ? "enabled" : "disabled"; } } # Sanity check to see if all necessary executables exist sub sanity_check_exe { - my ( $win32, $tprefix, $shwrap_prefix ) = @_; + my ( $win32, $tprefix, ) = @_; my %exe_list; my $bad = 0; - $exe_list{ $shwrap_prefix . "shlib_wrap.sh" } = 1 unless $win32; foreach (@fips_test_list) { next unless ref($_); my $cmd = $_->[1]; @@ -621,17 +785,18 @@ sub sanity_check_exe { sub find_files { my ( $filter, $dir ) = @_; - my ( $dirh, $testname ); + my ( $dirh, $testname, $tref ); opendir( $dirh, $dir ); while ( $_ = readdir($dirh) ) { next if ( $_ eq "." || $_ eq ".." ); $_ = "$dir/$_"; if ( -f "$_" ) { if (/\/([^\/]*)\.rsp$/) { - $testname = fix_pss( $1, $_ ); - if ( exists $fips_tests{$testname} ) { - if ( $fips_tests{$testname}->[3] eq "" ) { - $fips_tests{$testname}->[3] = $_; + $tref = find_test($1, $_); + if ( defined $tref ) { + $testname = $$tref[0]; + if ( $$tref[4] eq "" ) { + $$tref[4] = $_; } else { print STDERR @@ -640,16 +805,17 @@ sub find_files { } } else { - print STDERR "WARNING: bogus file $_\n"; + print STDERR "WARNING: bogus file $_\n" unless $no_warn_bogus; $nbogus++; } } next unless /$filter.*\.req$/i; if (/\/([^\/]*)\.req$/) { - $testname = fix_pss( $1, $_ ); - if ( exists $fips_tests{$testname} ) { - if ( $fips_tests{$testname}->[2] eq "" ) { - $fips_tests{$testname}->[2] = $_; + $tref = find_test($1, $_); + if ( defined $tref ) { + $testname = $$tref[0]; + if ( $$tref[3] eq "" ) { + $$tref[3] = $_; } else { print STDERR @@ -659,7 +825,7 @@ sub find_files { } elsif ( !/SHAmix\.req$/ ) { - print STDERR "WARNING: unrecognized filename $_\n"; + print STDERR "WARNING: unrecognized filename $_\n" unless $no_warn_bogus; $nbogus++; } } @@ -670,39 +836,56 @@ sub find_files { } closedir($dirh); } +# +# Find test based on filename. +# In ambiguous cases search file contents for a match +# -sub fix_pss { +sub find_test { my ( $test, $path ) = @_; - my $sl = ""; - local $_; - if ( $test =~ /PSS/ ) { - open( IN, $path ) || die "Can't Open File $path"; - while () { - if (/^\s*#\s*salt\s+len:\s+(\d+)\s*$/i) { - $sl = $1; - last; - } - } - close IN; - if ( $sl eq "" ) { - print STDERR "WARNING: No Salt length detected for file $path\n"; - } - else { - return $test . "($sl)"; - } + foreach $tref (@fips_test_list) { + next unless ref($tref); + my ( $tst, $cmd, $excmd, $req, $resp ) = @$tref; + my $regexp; + $tst =~ s/\(.*$//; + $test =~ s/_186-2//; + if (defined $excmd) { + if ($excmd =~ /^path:(.*)$/) { + my $fmatch = $1; + return $tref if ($path =~ /$fmatch/); + next; + } + elsif ($excmd =~ /^file:(.*)$/) { + $regexp = $1; + } + } + if ($test eq $tst) { + return $tref if (!defined $regexp); + my $found = 0; + my $line; + open( IN, $path ) || die "Can't Open File $path"; + while ($line = ) { + if ($line =~ /$regexp/i) { + $found = 1; + last; + } + } + close IN; + return $tref if $found == 1; + } } - return $test; + return undef; } sub sanity_check_files { my $bad = 0; foreach (@fips_test_list) { next unless ref($_); - my ( $tst, $cmd, $req, $resp ) = @$_; + my ( $tst, $cmd, $regexp, $req, $resp ) = @$_; #print STDERR "FILES $tst, $cmd, $req, $resp\n"; if ( $req eq "" ) { - print STDERR "WARNING: missing request file for $tst\n"; + print STDERR "WARNING: missing request file for $tst\n" unless $no_warn_missing; $bad = 1; next; } @@ -729,22 +912,62 @@ sub sanity_check_files { } sub run_tests { - my ( $verify, $win32, $tprefix, $filter, $tvdir ) = @_; + my ( $verify, $win32, $tprefix, $filter, $tvdir, $outfile ) = @_; my ( $tname, $tref ); my $bad = 0; + my $lastdir = ""; + if ($outfile ne "") { + open OUT, ">$outfile" || die "Can't open $outfile"; + } + if ($outfile ne "" && !$minimal_script) { + if ($win32) { + print OUT <<\END; +@echo off +rem Test vector run script +rem Auto generated by fipsalgtest.pl script +rem Do not edit + +echo Running Algorithm Tests + +END + } else { + $stprefix = $tprefix unless defined $stprefix; + print OUT <