1 files changed, 141 insertions, 0 deletions
diff --git a/tests/fips-override-test.c b/tests/fips-override-test.c
new file mode 100644
index 0000000..5b92a1d
--- /dev/null
+++ b/tests/fips-override-test.c
@@ -0,0 +1,141 @@
+#include <config.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <utils.h>
+#include <stdlib.h>
+#include <gnutls/gnutls.h>
+#include <gnutls/crypto.h>
+#include <gnutls/abstract.h>
+#include <gnutls/x509.h>
+#include <assert.h>
+
+unsigned audit_called = 0;
+
+/* This does check the FIPS140 override support with
+ * gnutls_fips140_set_mode().
+ */
+
+static void tls_log_func(int level, const char *str)
+{
+	fprintf(stderr, "<%d>| %s", level, str);
+}
+
+static void audit_log_func(gnutls_session_t session, const char *str)
+{
+	audit_called = 1;
+}
+
+
+static void try_crypto(void)
+{
+	static uint8_t key16[16];
+	static uint8_t iv16[16];
+	gnutls_datum_t key = { key16, sizeof(key16) };
+	gnutls_datum_t iv = { iv16, sizeof(iv16) };
+	gnutls_cipher_hd_t ch;
+	gnutls_hmac_hd_t mh;
+	int ret;
+	gnutls_x509_privkey_t privkey;
+
+	ret =
+	    gnutls_cipher_init(&ch, GNUTLS_CIPHER_ARCFOUR_128, &key, &iv);
+	if (ret < 0) {
+		fail("gnutls_cipher_init failed\n");
+	}
+	gnutls_cipher_deinit(ch);
+
+	ret =
+	    gnutls_cipher_init(&ch, GNUTLS_CIPHER_AES_128_CBC, &key, &iv);
+	if (ret < 0) {
+		fail("gnutls_cipher_init failed\n");
+	}
+	gnutls_cipher_deinit(ch);
+
+	ret = gnutls_hmac_init(&mh, GNUTLS_MAC_MD5, key.data, key.size);
+	if (ret < 0) {
+		fail("gnutls_hmac_init failed\n");
+	}
+	gnutls_hmac_deinit(mh, NULL);
+
+	ret = gnutls_hmac_init(&mh, GNUTLS_MAC_SHA1, key.data, key.size);
+	if (ret < 0) {
+		fail("gnutls_hmac_init failed\n");
+	}
+	gnutls_hmac_deinit(mh, NULL);
+
+	ret = gnutls_rnd(GNUTLS_RND_NONCE, key16, sizeof(key16));
+	if (ret < 0) {
+		fail("gnutls_rnd failed\n");
+	}
+
+	assert(gnutls_x509_privkey_init(&privkey) == 0);
+	ret = gnutls_x509_privkey_generate(privkey, GNUTLS_PK_RSA, 512, 0);
+	if (ret < 0) {
+		fail("gnutls_x509_privkey_generate failed for 512-bit key\n");
+	}
+	gnutls_x509_privkey_deinit(privkey);
+}
+
+void doit(void)
+{
+	int ret;
+	unsigned int mode;
+
+	fprintf(stderr,
+		"Please note that if in FIPS140 mode, you need to assure the library's integrity prior to running this test\n");
+
+	gnutls_global_set_log_function(tls_log_func);
+	gnutls_global_set_audit_log_function(audit_log_func);
+	if (debug)
+		gnutls_global_set_log_level(4711);
+
+	mode = gnutls_fips140_mode_enabled();
+	if (mode == 0) {
+		success("We are not in FIPS140 mode\n");
+		exit(77);
+	}
+
+	ret = global_init();
+	if (ret < 0) {
+		fail("Cannot initialize library\n");
+	}
+
+	/* switch to lax mode and check whether forbidden algorithms are accessible */
+	gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, 0);
+
+	try_crypto();
+
+	/* check whether audit log was called */
+	if (audit_called) {
+		fail("the audit function was called in lax mode!\n");
+	}
+
+	gnutls_fips140_set_mode(GNUTLS_FIPS140_LOG, 0);
+
+	try_crypto();
+
+	/* check whether audit log was called */
+	if (!audit_called) {
+		fail("the audit function was not called in log mode!\n");
+	}
+
+	gnutls_fips140_set_mode(GNUTLS_FIPS140_SELFTESTS, 0);
+	if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_STRICT)
+		fail("switching to selftests didn't switch the lib to the expected mode\n");
+
+	gnutls_fips140_set_mode(532, 0);
+	if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_STRICT)
+		fail("switching to unknown mode didn't switch the lib to the expected mode\n");
+
+	GNUTLS_FIPS140_SET_LAX_MODE();
+	if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_LAX)
+		fail("switching to lax mode did not succeed!\n");
+
+	GNUTLS_FIPS140_SET_STRICT_MODE();
+	if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_STRICT)
+		fail("switching to strict mode did not succeed!\n");
+
+	gnutls_global_deinit();
+	return;
+}