Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added check for GNUtls in FIPS140 mode #679

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

Added check for GNUtls in FIPS140 mode #679

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
77b67d6
Added check for GNUtls in FIPS140 mode
pablo-herranz Nov 29, 2024
241d214
Compare with regex
pablo-herranz Dec 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 13 additions & 7 deletions tests/test_fips.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
"""

from pathlib import Path
from re import search

import pytest
from pytest_container import DerivedContainer
Expand Down Expand Up @@ -189,12 +190,21 @@ def test_gnutls_binary(container_per_test: ContainerData) -> None:

"""

container_per_test.connection.check_output(
c = container_per_test.connection

c.check_output(
"zypper --gpg-auto-import-keys -n ref && zypper -n install gcc gnutls gnutls-devel && zypper -n clean && "
"gcc -Og -g3 fips-test-gnutls.c -Wall -Wextra -Wpedantic -lgnutls -o fips-test-gnutls && "
"mv fips-test-gnutls /bin/fips-test-gnutls"
)

c.check_output("gnutls-cli --fips140-mode")

assert search(
r"library is in FIPS140(-3|-2|) mode",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we really need to support the empty match, |) here? which distribution produces that output?

c.check_output("gnutls-cli --fips140-mode")
), "Container library not in FIPS140 mode"

expected_fips_gnutls_digests = {
"sha1": "c87d25a09584c040f3bfc53b570199591deb10ba648a6a6ffffdaa0badb23b8baf90b6168dd16b3a",
"sha224": "54655eae3d97147de34564572231c34d6d0917dd7852b5b93647fb4fe53ee97e5e0a2a4d359b5b461409dc44d9315afbc3b7d6bc5cd598e6",
Expand All @@ -204,15 +214,11 @@ def test_gnutls_binary(container_per_test: ContainerData) -> None:
}

for digest in FIPS_GNUTLS_DIGESTS:
res = container_per_test.connection.check_output(
f"/bin/fips-test-gnutls {digest}"
)
res = c.check_output(f"/bin/fips-test-gnutls {digest}")
assert "Digest is: " + expected_fips_gnutls_digests[digest] in res

for digest in NONFIPS_GNUTLS_DIGESTS:
err_msg = container_per_test.connection.run_expect(
[1], f"/bin/fips-test-gnutls {digest}"
).stderr
err_msg = c.run_expect([1], f"/bin/fips-test-gnutls {digest}").stderr

assert (
"Hash calculation failed" in err_msg
Expand Down
Loading