WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

MD5 vs. FIPS 140-3: fix gating so that unit.test succeeds when --enable-fips=v5 --enable-md5 (HMAC-MD5 is non-FIPS in 140-3, but even in a FIPS 140-3 build, the non-FIPS API can be accessed directly by #undef'ing wc_Hmac*()).

pull/4804/head
Daniel Pouzzner 2022-01-27 18:14:14 -06:00
parent d9073f39e1
commit 19042023f4
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
tests/api.c
View File

@ -13772,9 +13772,18 @@ static int test_wc_Md5HmacSetKey (void)
for (itr = 0; itr < times; itr++) { for (itr = 0; itr < times; itr++) {
ret = wc_HmacSetKey(&hmac, WC_MD5, (byte*)keys[itr], ret = wc_HmacSetKey(&hmac, WC_MD5, (byte*)keys[itr],
(word32)XSTRLEN(keys[itr])); (word32)XSTRLEN(keys[itr]));
#if defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 5)
wc_HmacFree(&hmac);
if (ret == BAD_FUNC_ARG)
return 0;
else {
return WOLFSSL_FATAL_ERROR;
}
#else
if (ret != 0) { if (ret != 0) {
flag = ret; flag = ret;
} }
#endif
} }
/* Bad args. */ /* Bad args. */
@ -14166,7 +14175,7 @@ static int test_wc_Sha384HmacSetKey (void)
static int test_wc_Md5HmacUpdate (void) static int test_wc_Md5HmacUpdate (void)
{ {
int flag = 0; int flag = 0;
#if !defined(NO_HMAC) && !defined(NO_MD5) #if !defined(NO_HMAC) && !defined(NO_MD5) && !(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 5))
Hmac hmac; Hmac hmac;
testVector a, b; testVector a, b;
int ret; int ret;
@ -14567,7 +14576,7 @@ static int test_wc_Sha384HmacUpdate (void)
static int test_wc_Md5HmacFinal (void) static int test_wc_Md5HmacFinal (void)
{ {
int flag = 0; int flag = 0;
#if !defined(NO_HMAC) && !defined(NO_MD5) #if !defined(NO_HMAC) && !defined(NO_MD5) && !(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 5))
Hmac hmac; Hmac hmac;
byte hash[WC_MD5_DIGEST_SIZE]; byte hash[WC_MD5_DIGEST_SIZE];
testVector a; testVector a;

3
tests/hash.c
View File

@ -130,7 +130,8 @@ int HashTest(void)
#endif #endif
#ifndef NO_HMAC #ifndef NO_HMAC
#ifndef NO_MD5 #if !defined(NO_MD5) && !(defined(HAVE_FIPS) && defined(HAVE_FIPS_VERSION) \
&& (HAVE_FIPS_VERSION >= 5))
if ( (ret = hmac_md5_test()) ) { if ( (ret = hmac_md5_test()) ) {
printf( " HMAC-MD5 test failed!\n"); printf( " HMAC-MD5 test failed!\n");
return ret; return ret;