From 29a90816ff2dc5ec7e1f7b693bce61093abf5801 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Tue, 14 Jun 2011 15:35:49 +0000 Subject: Update key sizes to 2048 bits. Only build ssltest with fipsld. Include FIPS mode test for ssltest. --- test/CAss.cnf | 2 +- test/Makefile | 14 ++++++- test/Uss.cnf | 4 +- test/testfipsssl | 113 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 129 insertions(+), 4 deletions(-) create mode 100644 test/testfipsssl (limited to 'test') diff --git a/test/CAss.cnf b/test/CAss.cnf index 20f8f05e3d..109bc8c10b 100644 --- a/test/CAss.cnf +++ b/test/CAss.cnf @@ -7,7 +7,7 @@ RANDFILE = ./.rnd #################################################################### [ req ] -default_bits = 512 +default_bits = 2048 default_keyfile = keySS.pem distinguished_name = req_distinguished_name encrypt_rsa_key = no diff --git a/test/Makefile b/test/Makefile index 12694dc40a..be41c273e9 100644 --- a/test/Makefile +++ b/test/Makefile @@ -275,6 +275,9 @@ test_engine: test_ssl: keyU.ss certU.ss certCA.ss certP1.ss keyP1.ss certP2.ss keyP2.ss \ intP1.ss intP2.ss @echo "test SSL protocol" + @if [ -n "$(FIPSCANLIB)" ]; then \ + sh ./testfipsssl keyU.ss certU.ss certCA.ss; \ + fi ../util/shlib_wrap.sh ./$(SSLTEST) -test_cipherlist @sh ./testssl keyU.ss certU.ss certCA.ss @sh ./testsslproxy keyP1.ss certP1.ss intP1.ss @@ -344,6 +347,15 @@ BUILD_CMD=shlib_target=; if [ -n "$(SHARED_LIBS)" ]; then \ shlib_target="$(SHLIB_TARGET)"; \ fi; \ LIBRARIES="$(LIBSSL) $(LIBCRYPTO) $(LIBKRB5)"; \ + $(MAKE) -f $(TOP)/Makefile.shared -e \ + CC="$${CC}" APPNAME=$$target$(EXE_EXT) OBJECTS="$$target.o" \ + LIBDEPS="$(PEX_LIBS) $$LIBRARIES $(EX_LIBS)" \ + link_app.$${shlib_target} + +FIPS_BUILD_CMD=shlib_target=; if [ -n "$(SHARED_LIBS)" ]; then \ + shlib_target="$(SHLIB_TARGET)"; \ + fi; \ + LIBRARIES="$(LIBSSL) $(LIBCRYPTO) $(LIBKRB5)"; \ if [ -z "$(SHARED_LIBS)" -a -n "$(FIPSCANLIB)" ] ; then \ FIPSLD_CC="$(CC)"; CC=$(FIPSDIR)bin/fipsld; export CC FIPSLD_CC; \ fi; \ @@ -431,7 +443,7 @@ $(METHTEST)$(EXE_EXT): $(METHTEST).o $(DLIBCRYPTO) @target=$(METHTEST); $(BUILD_CMD) $(SSLTEST)$(EXE_EXT): $(SSLTEST).o $(DLIBSSL) $(DLIBCRYPTO) - @target=$(SSLTEST); $(BUILD_CMD) + @target=$(SSLTEST); $(FIPS_BUILD_CMD) $(ENGINETEST)$(EXE_EXT): $(ENGINETEST).o $(DLIBCRYPTO) @target=$(ENGINETEST); $(BUILD_CMD) diff --git a/test/Uss.cnf b/test/Uss.cnf index 0c0ebb5f67..58ac0ca54d 100644 --- a/test/Uss.cnf +++ b/test/Uss.cnf @@ -7,11 +7,11 @@ RANDFILE = ./.rnd #################################################################### [ req ] -default_bits = 512 +default_bits = 2048 default_keyfile = keySS.pem distinguished_name = req_distinguished_name encrypt_rsa_key = no -default_md = md2 +default_md = sha256 [ req_distinguished_name ] countryName = Country Name (2 letter code) diff --git a/test/testfipsssl b/test/testfipsssl new file mode 100644 index 0000000000..c4836edc25 --- /dev/null +++ b/test/testfipsssl @@ -0,0 +1,113 @@ +#!/bin/sh + +if [ "$1" = "" ]; then + key=../apps/server.pem +else + key="$1" +fi +if [ "$2" = "" ]; then + cert=../apps/server.pem +else + cert="$2" +fi + +ciphers="DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:EXP1024-DHE-DSS-DES-CBC-SHA:EXP1024-DES-CBC-SHA:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA" + +ssltest="../util/shlib_wrap.sh ./ssltest -F -key $key -cert $cert -c_key $key -c_cert $cert -cipher $ciphers" + +if ../util/shlib_wrap.sh ../apps/openssl x509 -in $cert -text -noout | fgrep 'DSA Public Key' >/dev/null; then + dsa_cert=YES +else + dsa_cert=NO +fi + +if [ "$3" = "" ]; then + CA="-CApath ../certs" +else + CA="-CAfile $3" +fi + +if [ "$4" = "" ]; then + extra="" +else + extra="$4" +fi + +############################################################################# + +echo test ssl3 is forbidden in FIPS mode +$ssltest -ssl3 $extra && exit 1 + +echo test ssl2 is forbidden in FIPS mode +$ssltest -ssl2 $extra && exit 1 + +echo test tls1 +$ssltest -tls1 $extra || exit 1 + +echo test tls1 with server authentication +$ssltest -tls1 -server_auth $CA $extra || exit 1 + +echo test tls1 with client authentication +$ssltest -tls1 -client_auth $CA $extra || exit 1 + +echo test tls1 with both client and server authentication +$ssltest -tls1 -server_auth -client_auth $CA $extra || exit 1 + +echo test tls1 via BIO pair +$ssltest -bio_pair -tls1 $extra || exit 1 + +echo test tls1 with server authentication via BIO pair +$ssltest -bio_pair -tls1 -server_auth $CA $extra || exit 1 + +echo test tls1 with client authentication via BIO pair +$ssltest -bio_pair -tls1 -client_auth $CA $extra || exit 1 + +echo test tls1 with both client and server authentication via BIO pair +$ssltest -bio_pair -tls1 -server_auth -client_auth $CA $extra || exit 1 + +# note that all the below actually choose TLS... + +if [ $dsa_cert = NO ]; then + echo test sslv2/sslv3 w/o DHE via BIO pair + $ssltest -bio_pair -no_dhe $extra || exit 1 +fi + +echo test sslv2/sslv3 with 1024bit DHE via BIO pair +$ssltest -bio_pair -dhe1024dsa -v $extra || exit 1 + +echo test sslv2/sslv3 with server authentication +$ssltest -bio_pair -server_auth $CA $extra || exit 1 + +echo test sslv2/sslv3 with client authentication via BIO pair +$ssltest -bio_pair -client_auth $CA $extra || exit 1 + +echo test sslv2/sslv3 with both client and server authentication via BIO pair +$ssltest -bio_pair -server_auth -client_auth $CA $extra || exit 1 + +echo test sslv2/sslv3 with both client and server authentication via BIO pair and app verify +$ssltest -bio_pair -server_auth -client_auth -app_verify $CA $extra || exit 1 + +############################################################################# + +if ../util/shlib_wrap.sh ../apps/openssl no-dh; then + echo skipping anonymous DH tests +else + echo test tls1 with 1024bit anonymous DH, multiple handshakes + $ssltest -v -bio_pair -tls1 -cipher ADH -dhe1024dsa -num 10 -f -time $extra || exit 1 +fi + +if ../util/shlib_wrap.sh ../apps/openssl no-rsa; then + echo skipping RSA tests +else + echo test tls1 with 1024bit RSA, no DHE, multiple handshakes + ../util/shlib_wrap.sh ./ssltest -v -bio_pair -tls1 -cert ../apps/server2.pem -no_dhe -num 10 -f -time $extra || exit 1 + + if ../util/shlib_wrap.sh ../apps/openssl no-dh; then + echo skipping RSA+DHE tests + else + echo test tls1 with 1024bit RSA, 1024bit DHE, multiple handshakes + ../util/shlib_wrap.sh ./ssltest -v -bio_pair -tls1 -cert ../apps/server2.pem -dhe1024dsa -num 10 -f -time $extra || exit 1 + fi +fi + +exit 0 -- cgit v1.2.3