|
Packit Service |
4684c1 |
/*
|
|
Packit Service |
4684c1 |
* Copyright (C) 2017 Red Hat, Inc.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* Author: Nikos Mavrogiannopoulos
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* This file is part of GnuTLS.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* GnuTLS is free software; you can redistribute it and/or modify it
|
|
Packit Service |
4684c1 |
* under the terms of the GNU General Public License as published by
|
|
Packit Service |
4684c1 |
* the Free Software Foundation; either version 3 of the License, or
|
|
Packit Service |
4684c1 |
* (at your option) any later version.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* GnuTLS is distributed in the hope that it will be useful, but
|
|
Packit Service |
4684c1 |
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
Packit Service |
4684c1 |
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Packit Service |
4684c1 |
* General Public License for more details.
|
|
Packit Service |
4684c1 |
*
|
|
Packit Service |
4684c1 |
* You should have received a copy of the GNU General Public License
|
|
Packit Service |
4684c1 |
* along with GnuTLS; if not, write to the Free Software Foundation,
|
|
Packit Service |
4684c1 |
* Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
|
Packit Service |
4684c1 |
*/
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#ifdef HAVE_CONFIG_H
|
|
Packit Service |
4684c1 |
#include <config.h>
|
|
Packit Service |
4684c1 |
#endif
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#include <stdio.h>
|
|
Packit Service |
4684c1 |
#include <stdlib.h>
|
|
Packit Service |
4684c1 |
#include <stdint.h>
|
|
Packit Service |
4684c1 |
#include <string.h>
|
|
Packit Service |
4684c1 |
#include <errno.h>
|
|
Packit Service |
4684c1 |
#include <gnutls/gnutls.h>
|
|
Packit Service |
4684c1 |
#include <gnutls/crypto.h>
|
|
Packit Service |
4684c1 |
#include <signal.h>
|
|
Packit Service |
4684c1 |
#include <unistd.h>
|
|
Packit Service |
4684c1 |
#ifndef _WIN32
|
|
Packit Service |
4684c1 |
# include <netinet/in.h>
|
|
Packit Service |
4684c1 |
# include <sys/types.h>
|
|
Packit Service |
4684c1 |
# include <sys/socket.h>
|
|
Packit Service |
4684c1 |
# include <sys/wait.h>
|
|
Packit Service |
4684c1 |
# include <pthread.h>
|
|
Packit Service |
4684c1 |
#endif
|
|
Packit Service |
4684c1 |
#include "utils.h"
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#ifdef _WIN32
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
void doit(void)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
exit(77);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#else
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
/* Tests whether we can use gnutls_fips140_set_mode() and
|
|
Packit Service |
4684c1 |
* gnutls_fips140_mode_enabled() under mutliple threads.
|
|
Packit Service |
4684c1 |
*/
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
typedef struct thread_data_st {
|
|
Packit Service |
4684c1 |
unsigned mode;
|
|
Packit Service |
4684c1 |
unsigned set_mode;
|
|
Packit Service |
4684c1 |
int line;
|
|
Packit Service |
4684c1 |
pthread_t id;
|
|
Packit Service |
4684c1 |
} thread_data_st;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
static void *test_set_per_thread(void *arg)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
thread_data_st *data = arg;
|
|
Packit Service |
4684c1 |
unsigned mode;
|
|
Packit Service |
4684c1 |
int ret;
|
|
Packit Service |
4684c1 |
unsigned char digest[20];
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
mode = gnutls_fips140_mode_enabled();
|
|
Packit Service |
4684c1 |
if (mode != data->mode)
|
|
Packit Service |
4684c1 |
fail("%d: gnutls_fips140_mode_enabled: wrong mode returned (%d, exp: %d)\n", data->line, mode, data->mode);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (data->set_mode)
|
|
Packit Service |
4684c1 |
gnutls_fips140_set_mode(data->set_mode, GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
mode = gnutls_fips140_mode_enabled();
|
|
Packit Service |
4684c1 |
if (mode != data->set_mode) {
|
|
Packit Service |
4684c1 |
fail("%d: gnutls_fips140_mode_enabled: wrong mode returned after set (%d, exp: %d)\n", data->line, mode, data->set_mode);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
/* reset mode */
|
|
Packit Service |
4684c1 |
gnutls_fips140_set_mode(data->mode, GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
Packit Service |
4684c1 |
mode = gnutls_fips140_mode_enabled();
|
|
Packit Service |
4684c1 |
if (mode != data->mode)
|
|
Packit Service |
4684c1 |
fail("%d: gnutls_fips140_mode_enabled: wrong mode returned after set (%d, exp: %d)\n", data->line, mode, data->mode);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret = gnutls_hmac_fast(GNUTLS_MAC_MD5, "keykeykey", 9, "abcdefgh",
|
|
Packit Service |
4684c1 |
8, digest);
|
|
Packit Service |
4684c1 |
if (mode == GNUTLS_FIPS140_STRICT && ret >= 0) {
|
|
Packit Service |
4684c1 |
fail("gnutls_hmac_fast(MD5): succeeded in strict mode!\n");
|
|
Packit Service |
4684c1 |
} else if (mode != GNUTLS_FIPS140_STRICT && ret < 0) {
|
|
Packit Service |
4684c1 |
fail("gnutls_hmac_fast(MD5): failed in non-strict mode!\n");
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
/* put to a random state */
|
|
Packit Service |
4684c1 |
gnutls_fips140_set_mode(data->set_mode, GNUTLS_FIPS140_SET_MODE_THREAD);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
pthread_exit(0);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#define MAX_THREADS 48
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
void doit(void)
|
|
Packit Service |
4684c1 |
{
|
|
Packit Service |
4684c1 |
int ret;
|
|
Packit Service |
4684c1 |
thread_data_st *data;
|
|
Packit Service |
4684c1 |
unsigned i, j;
|
|
Packit Service |
4684c1 |
unsigned mode;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
signal(SIGPIPE, SIG_IGN);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
mode = gnutls_fips140_mode_enabled();
|
|
Packit Service |
4684c1 |
if (mode == 0) {
|
|
Packit Service |
4684c1 |
success("We are not in FIPS140 mode\n");
|
|
Packit Service |
4684c1 |
exit(77);
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
data = calloc(1, sizeof(thread_data_st)*MAX_THREADS);
|
|
Packit Service |
4684c1 |
if (data == NULL)
|
|
Packit Service |
4684c1 |
abort();
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
success("starting threads\n");
|
|
Packit Service |
4684c1 |
/* Test if changes per thread apply, and whether the global
|
|
Packit Service |
4684c1 |
* setting will remain the same */
|
|
Packit Service |
4684c1 |
for (i=0;i
|
|
Packit Service |
4684c1 |
data[i].line = __LINE__;
|
|
Packit Service |
4684c1 |
data[i].mode = mode;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
j = i%3;
|
|
Packit Service |
4684c1 |
if (j==0)
|
|
Packit Service |
4684c1 |
data[i].set_mode = GNUTLS_FIPS140_LAX;
|
|
Packit Service |
4684c1 |
else if (j==1)
|
|
Packit Service |
4684c1 |
data[i].set_mode = GNUTLS_FIPS140_LOG;
|
|
Packit Service |
4684c1 |
else
|
|
Packit Service |
4684c1 |
data[i].set_mode = GNUTLS_FIPS140_STRICT;
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
ret = pthread_create(&data[i].id, NULL, test_set_per_thread, &data[i]);
|
|
Packit Service |
4684c1 |
if (ret != 0) {
|
|
Packit Service |
4684c1 |
abort();
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
success("waiting for threads to finish\n");
|
|
Packit Service |
4684c1 |
for (i=0;i
|
|
Packit Service |
4684c1 |
ret = pthread_join(data[i].id, NULL);
|
|
Packit Service |
4684c1 |
if (ret != 0)
|
|
Packit Service |
4684c1 |
abort();
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
success("checking main process mode\n");
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
/* main thread should be in the same state */
|
|
Packit Service |
4684c1 |
if (mode != gnutls_fips140_mode_enabled())
|
|
Packit Service |
4684c1 |
fail("gnutls_fips140_mode_enabled: main thread changed mode (%d, exp: %d)\n", gnutls_fips140_mode_enabled(), mode);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
success("checking whether global changes are seen in threads\n");
|
|
Packit Service |
4684c1 |
/* Test if changes globally are visible in threads */
|
|
Packit Service |
4684c1 |
mode = GNUTLS_FIPS140_LOG;
|
|
Packit Service |
4684c1 |
gnutls_fips140_set_mode(mode, 0);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
for (i=0;i
|
|
Packit Service |
4684c1 |
data[i].line = __LINE__;
|
|
Packit Service |
4684c1 |
data[i].mode = mode;
|
|
Packit Service |
4684c1 |
data[i].set_mode = GNUTLS_FIPS140_LAX;
|
|
Packit Service |
4684c1 |
ret = pthread_create(&data[i].id, NULL, test_set_per_thread, &data[i]);
|
|
Packit Service |
4684c1 |
if (ret != 0)
|
|
Packit Service |
4684c1 |
abort();
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
success("waiting for threads to finish\n");
|
|
Packit Service |
4684c1 |
for (i=0;i
|
|
Packit Service |
4684c1 |
ret = pthread_join(data[i].id, NULL);
|
|
Packit Service |
4684c1 |
if (ret != 0)
|
|
Packit Service |
4684c1 |
abort();
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
if (mode != gnutls_fips140_mode_enabled())
|
|
Packit Service |
4684c1 |
fail("gnutls_fips140_mode_enabled: main thread changed mode (%d, exp: %d)\n", gnutls_fips140_mode_enabled(), mode);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
gnutls_fips140_set_mode(GNUTLS_FIPS140_SELFTESTS, 0);
|
|
Packit Service |
4684c1 |
if (GNUTLS_FIPS140_SELFTESTS == gnutls_fips140_mode_enabled())
|
|
Packit Service |
4684c1 |
fail("gnutls_fips140_mode_enabled: setting to GNUTLS_FIPS140_SELFTESTS succeeded!\n");
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
free(data);
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
}
|
|
Packit Service |
4684c1 |
|
|
Packit Service |
4684c1 |
#endif /* _WIN32 */
|