X-Git-Url: https://git.librecmc.org/?a=blobdiff_plain;f=fips%2Ffipsalgtest.pl;h=30cd9c0ebde6a789ce599d698b5ed6d91942c01c;hb=7b6b246fd393cbe07bc1f0d456140efdff59f971;hp=af591d32ac75fdeeea16e726988061cf8795477b;hpb=c20de0386a33c3679367bf45b17b28584976739b;p=oweals%2Fopenssl.git

diff --git a/fips/fipsalgtest.pl b/fips/fipsalgtest.pl
index af591d32ac..30cd9c0ebd 100644
--- a/fips/fipsalgtest.pl
+++ b/fips/fipsalgtest.pl
@@ -434,6 +434,7 @@ my @fips_drbg_test_list = (
     # SP800-90 DRBG tests
     "SP800-90 DRBG",
     [ "CTR_DRBG",   "fips_drbgvs" ],
+    [ "Dual_EC_DRBG",   "fips_drbgvs" ],
     [ "Hash_DRBG",  "fips_drbgvs" ],
     [ "HMAC_DRBG",  "fips_drbgvs" ]
 
@@ -452,7 +453,7 @@ my @fips_ecdh_test_list = (
 
     # ECDH
     "ECDH Ephemeral Primitives Only",
-    [ "KAS_ECC_CDH_PrimitiveTest", "fips_ecdhvs WTF" ],
+    [ "KAS_ECC_CDH_PrimitiveTest", "fips_ecdhvs ecdhgen" ],
 #    [ "KASValidityTest_ECCEphemeralUnified_NOKC_ZZOnly_init",
 #							"fips_ecdhvs ecdhver" ],
 #    [ "KASValidityTest_ECCEphemeralUnified_NOKC_ZZOnly_resp",
@@ -472,13 +473,21 @@ my @fips_ecdh_test_list = (
 #
 
 my %verify_special = (
-    "PQGGen"        => "fips_dssvs pqgver",
-    "KeyPair"       => "fips_dssvs keyver",
-    "SigGen"        => "fips_dssvs sigver",
-    "SigGen15"      => "fips_rsavtest",
-    "SigGenRSA"     => "fips_rsavtest -x931",
-    "SigGenPSS(0)"  => "fips_rsavtest -saltlen 0",
-    "SigGenPSS(62)" => "fips_rsavtest -saltlen 62",
+    "DSA:PQGGen"        => "fips_dssvs pqgver",
+    "DSA:KeyPair"       => "fips_dssvs keyver",
+    "DSA:SigGen"        => "fips_dssvs sigver",
+    "DSA2:PQGGen"        => "fips_dssvs pqgver",
+    "DSA2:KeyPair"       => "fips_dssvs keyver",
+    "DSA2:SigGen"        => "fips_dssvs sigver",
+    "ECDSA:KeyPair"     => "fips_ecdsavs PKV",
+    "ECDSA:SigGen"      => "fips_ecdsavs SigVer",
+    "ECDSA2:KeyPair"    => "fips_ecdsavs PKV",
+    "ECDSA2:SigGen"     => "fips_ecdsavs SigVer",
+    "RSA:SigGen15"      => "fips_rsavtest",
+    "RSA:SigGenRSA"     => "fips_rsavtest -x931",
+    "RSA:SigGenPSS(0)"  => "fips_rsavtest -saltlen 0",
+    "RSA:SigGenPSS(62)" => "fips_rsavtest -saltlen 62",
+    "ECDH Ephemeral Primitives Only:KAS_ECC_CDH_PrimitiveTest" => "skip"
 );
 
 my $win32  = $^O =~ m/mswin/i;
@@ -501,31 +510,32 @@ my $no_warn_missing = 0;
 my $no_warn_bogus = 0;
 my $rmcmd = "rm -rf";
 my $mkcmd = "mkdir";
+my $cmpall = 0;
 
 my %fips_enabled = (
-    dsa         => 1,
-    dsa2        => 2,
+    "dsa"        => 1,
+    "dsa2"       => 2,
     "dsa-pqgver"  => 2,
-    ecdsa       => 2,
-    rsa         => 1,
-    "rsa-pss0"  => 0,
+    "ecdsa"      => 2,
+    "rsa"        => 1,
+    "rsa-pss0"  => 2,
     "rsa-pss62" => 1,
-    sha         => 1,
-    hmac        => 1,
-    cmac        => 2,
+    "sha"        => 1,
+    "hmac"       => 1,
+    "cmac"       => 2,
     "rand-aes"  => 1,
     "rand-des2" => 0,
-    aes         => 1,
+    "aes"        => 1,
     "aes-cfb1"  => 2,
-    des3        => 1,
+    "des3"       => 1,
     "des3-cfb1" => 2,
-    drbg	=> 2,
+    "drbg"	=> 2,
     "aes-ccm"	=> 2,
     "aes-xts"	=> 2,
     "aes-gcm"	=> 2,
-    dh		=> 0,
-    ecdh	=> 2,
-    v2		=> 0,
+    "dh"	=> 0,
+    "ecdh"	=> 2,
+    "v2"	=> 1,
 );
 
 foreach (@ARGV) {
@@ -561,6 +571,9 @@ foreach (@ARGV) {
     } elsif ( $_ eq "--generate" ) {
         $verify = 0;
     }
+    elsif ( $_ eq "--compare-all" ) {
+        $cmpall = 1;
+    }
     elsif ( $_ eq "--notest" ) {
         $notest = 1;
     }
@@ -576,6 +589,11 @@ foreach (@ARGV) {
     elsif (/--tprefix=(.*)$/) {
         $tprefix = $1;
     }
+    elsif (/^--disable-all$/) {
+	foreach (keys %fips_enabled) {
+		$fips_enabled{$_} = 0;
+	}
+    }
     elsif (/^--(enable|disable)-(.*)$/) {
         if ( !exists $fips_enabled{$2} ) {
             print STDERR "Unknown test $2\n";
@@ -619,8 +637,8 @@ if (!$fips_enabled{"v2"}) {
 }
 
 push @fips_test_list, @fips_dsa_test_list       if $fips_enabled{"dsa"};
-push @fips_test_list, @fips_dsa2_test_list      if $fips_enabled{"dsa2"};
 push @fips_test_list, @fips_dsa_pqgver_test_list if $fips_enabled{"dsa-pqgver"};
+push @fips_test_list, @fips_dsa2_test_list      if $fips_enabled{"dsa2"};
 push @fips_test_list, @fips_ecdsa_test_list     if $fips_enabled{"ecdsa"};
 push @fips_test_list, @fips_rsa_test_list       if $fips_enabled{"rsa"};
 push @fips_test_list, @fips_rsa_pss0_test_list  if $fips_enabled{"rsa-pss0"};
@@ -728,19 +746,29 @@ sub Help {
     ( my $cmd ) = ( $0 =~ m#([^/]+)$# );
     print <<EOF;
 $cmd: generate run CAVP algorithm tests
-	--debug                     Enable debug output
-	--dir=<dirname>             Optional root for *.req file search
-	--filter=<regexp>
-	--onedir <dirname>          Assume all components in current directory
-	--rspdir=<dirname>          Name of subdirectories containing *.rsp files, default "resp"
-	--tprefix=<prefix>
-	--ignore-bogus              Ignore duplicate or bogus files
-	--ignore-missing            Ignore missing test files
-	--quiet                     Shhh....
-	--generate                  Generate algorithm test output
-	--win32                     Win32 environment
-	--enable-<alg>		    Enable algorithm set <alg>.
-	--disable-<alg>		    Disable algorithm set <alg>.
+	--debug                       Enable debug output
+	--dir=<dirname>               Optional root for *.req file search
+	--filter=<regexp>	      Regex for input files of interest
+	--onedir <dirname>            Assume all components in current directory
+	--rspdir=<dirname>            Name of subdirectories containing *.rsp files, default "resp"
+	--tprefix=<prefix>            Pathname prefix for directory containing test programs
+	--ignore-bogus                Ignore duplicate or bogus files
+	--ignore-missing              Ignore missing test files
+	--quiet                       Shhh....
+	--quiet-bogus                 Skip unrecognized file warnings
+	--quiet-missing               Skip missing request file warnings
+	--generate                    Generate algorithm test output
+	--generate-script=<filename>  Generate script to call algorithm programs
+	--minimal-script              Simplest possible output for --generate-script
+	--win32                       Win32 environment
+	--compare-all                 Verify unconditionally for all tests
+	--list-tests                  Show individual tests
+	--mkdir=<cmd>                 Specify "mkdir" command
+	--notest                      Exit before running tests
+	--rm=<cmd>                    Specify "rm" command
+	--script-tprefix              Pathname prefix for --generate-script output
+	--enable-<alg>		      Enable algorithm set <alg>.
+	--disable-<alg>		      Disable algorithm set <alg>.
 	Where <alg> can be one of:
 EOF
 
@@ -916,6 +944,7 @@ sub run_tests {
     my ( $tname, $tref );
     my $bad = 0;
     my $lastdir = "";
+    $stprefix = $tprefix unless defined $stprefix;
     if ($outfile ne "") {
 	open OUT, ">$outfile" || die "Can't open $outfile";
     }
@@ -931,7 +960,6 @@ echo Running Algorithm Tests
 
 END
 	} else {
-	$stprefix = $tprefix unless defined $stprefix;
 	    print OUT <<END;
 #!/bin/sh
 
@@ -950,6 +978,8 @@ END
 
     }
 
+    my $ttype = "";
+
     foreach (@fips_test_list) {
         if ( !ref($_) ) {
 	    if ($outfile ne "") {
@@ -958,6 +988,7 @@ END
 	    } else {	
             	print "Running $_ tests\n" unless $quiet;
 	    }
+	    $ttype = $_;
             next;
         }
         my ( $tname, $tcmd, $regexp, $req, $rsp ) = @$_;
@@ -1016,8 +1047,12 @@ END
         my $cmd = "$tcmd \"$req\" \"$out\"";
         print STDERR "DEBUG: running test $tname\n" if ( $debug && !$verify );
 	if ($outfile ne "") {
-	    print OUT "echo \"    running $tname test\"\n" unless $minimal_script;
-	    print OUT "\${TPREFIX}$cmd\n";
+	    if ($minimal_script) {
+		print OUT "$stprefix$cmd\n";
+	    } else {
+		print OUT "echo \"    running $tname test\"\n" unless $minimal_script;
+		print OUT "\${TPREFIX}$cmd\n";
+	    }
         } else {
             $cmd = "$tprefix$cmd";
             system($cmd);
@@ -1029,10 +1064,15 @@ END
             }
         }
         if ($verify) {
-            if ( exists $verify_special{$tname} ) {
+            if ( exists $verify_special{"$ttype:$tname"} && !$cmpall) {
                 my $vout = $rsp;
                 $vout =~ s/\.rsp$/.ver/;
-                $tcmd = $verify_special{$tname};
+                $tcmd = $verify_special{"$ttype:$tname"};
+		if ($tcmd eq "skip") {
+			print STDERR "DEBUG: No verify possible: skipped.\n" if $debug;
+			$scheckok++;
+			next;
+		}
                 $cmd  = "$tprefix$tcmd ";
                 $cmd .= "\"$out\" \"$vout\"";
                 system($cmd);
@@ -1089,6 +1129,7 @@ sub cmp_file {
     my ( $tname, $rsp, $tst ) = @_;
     my ( $rspf,    $tstf );
     my ( $rspline, $tstline );
+    my $monte = 0;
     if ( !open( $rspf, $rsp ) ) {
         print STDERR "ERROR: can't open request file $rsp\n";
         return 0;
@@ -1097,6 +1138,7 @@ sub cmp_file {
         print STDERR "ERROR: can't open output file $tst\n";
         return 0;
     }
+    $monte = 1 if ($rsp =~ /Monte[123]/);
     for ( ; ; ) {
         $rspline = next_line($rspf);
         $tstline = next_line($tstf);
@@ -1104,6 +1146,21 @@ sub cmp_file {
             print STDERR "DEBUG: $tname file comparison OK\n" if $debug;
             return 1;
         }
+	# Workaround for old broken DES3 MCT format which added bogus
+	# extra lines: after [ENCRYPT] or [DECRYPT] skip until first
+	# COUNT line.
+	if ($monte) {
+		if ($rspline =~ /CRYPT/) {
+			do {
+				$rspline = next_line($rspf);
+			} while (defined($rspline) && $rspline !~ /COUNT/);
+		}
+		if ($tstline =~ /CRYPT/) {
+			do {
+				$tstline = next_line($tstf);
+			} while (defined($tstline) && $tstline !~ /COUNT/);
+		}
+	}
         if ( !defined($rspline) ) {
             print STDERR "ERROR: $tname EOF on $rsp\n";
             return 0;