shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-09 09:54:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

tests/torture_config: Use only allowed algorithms in FIPS mode

Browse Source 
Use only allowed algorithms if running in FIPS mode.

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
This commit is contained in:
Anderson Toshiyuki Sasaki
2019-06-05 15:19:22 +02:00
committed by Andreas Schneider
parent af031d8df6
commit ce888fd4c0
1 changed files with 47 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
tests/unittests/torture_config.c
View File

@@ -34,6 +34,8 @@ extern LIBSSH_THREAD int ssh_log_level;
#define GLOBAL_KNOWN_HOSTS "/etc/ssh/my_ssh_known_hosts" #define GLOBAL_KNOWN_HOSTS "/etc/ssh/my_ssh_known_hosts"
#define BIND_ADDRESS "::1" #define BIND_ADDRESS "::1"
static int setup_config_files(void **state) static int setup_config_files(void **state)
{ {
ssh_session session; ssh_session session;
@@ -222,7 +224,8 @@ static int teardown(void **state)
static void torture_config_from_file(void **state) { static void torture_config_from_file(void **state) {
ssh_session session = *state; ssh_session session = *state;
int ret; int ret;
char *v; char *v = NULL;
char *fips_algos = NULL;
ret = ssh_config_parse_file(session, LIBSSH_TESTCONFIG1); ret = ssh_config_parse_file(session, LIBSSH_TESTCONFIG1);
assert_true(ret == 0); assert_true(ret == 0);
@@ -250,14 +253,39 @@ static void torture_config_from_file(void **state) {
assert_string_equal(v, USERNAME); assert_string_equal(v, USERNAME);
SSH_STRING_FREE_CHAR(v); SSH_STRING_FREE_CHAR(v);
assert_string_equal(session->opts.wanted_methods[SSH_KEX], KEXALGORITHMS); if (ssh_fips_mode()) {
fips_algos = ssh_keep_fips_algos(SSH_KEX, KEXALGORITHMS);
assert_string_equal(session->opts.wanted_methods[SSH_HOSTKEYS], HOSTKEYALGORITHMS); assert_non_null(fips_algos);
assert_string_equal(session->opts.wanted_methods[SSH_KEX], fips_algos);
assert_string_equal(session->opts.pubkey_accepted_types, PUBKEYACCEPTEDTYPES); SAFE_FREE(fips_algos);
fips_algos = ssh_keep_fips_algos(SSH_HOSTKEYS, HOSTKEYALGORITHMS);
assert_string_equal(session->opts.wanted_methods[SSH_MAC_C_S], MACS); assert_non_null(fips_algos);
assert_string_equal(session->opts.wanted_methods[SSH_MAC_S_C], MACS); assert_string_equal(session->opts.wanted_methods[SSH_HOSTKEYS], fips_algos);
SAFE_FREE(fips_algos);
fips_algos = ssh_keep_fips_algos(SSH_HOSTKEYS, PUBKEYACCEPTEDTYPES);
assert_non_null(fips_algos);
assert_string_equal(session->opts.pubkey_accepted_types, fips_algos);
SAFE_FREE(fips_algos);
fips_algos = ssh_keep_fips_algos(SSH_MAC_C_S, MACS);
assert_non_null(fips_algos);
assert_string_equal(session->opts.wanted_methods[SSH_MAC_C_S], fips_algos);
SAFE_FREE(fips_algos);
fips_algos = ssh_keep_fips_algos(SSH_MAC_S_C, MACS);
assert_non_null(fips_algos);
assert_string_equal(session->opts.wanted_methods[SSH_MAC_S_C], fips_algos);
SAFE_FREE(fips_algos);
} else {
assert_non_null(session->opts.wanted_methods[SSH_KEX]);
assert_string_equal(session->opts.wanted_methods[SSH_KEX], KEXALGORITHMS);
assert_non_null(session->opts.wanted_methods[SSH_HOSTKEYS]);
assert_string_equal(session->opts.wanted_methods[SSH_HOSTKEYS], HOSTKEYALGORITHMS);
assert_non_null(session->opts.pubkey_accepted_types);
assert_string_equal(session->opts.pubkey_accepted_types, PUBKEYACCEPTEDTYPES);
assert_non_null(session->opts.wanted_methods[SSH_MAC_S_C]);
assert_string_equal(session->opts.wanted_methods[SSH_MAC_C_S], MACS);
assert_non_null(session->opts.wanted_methods[SSH_MAC_S_C]);
assert_string_equal(session->opts.wanted_methods[SSH_MAC_S_C], MACS);
}
} }
/** /**
@@ -849,10 +877,19 @@ static void torture_config_pubkeyacceptedkeytypes(void **state)
{ {
ssh_session session = *state; ssh_session session = *state;
int rc; int rc;
char *fips_algos;
rc = ssh_config_parse_file(session, LIBSSH_TEST_PUBKEYACCEPTEDKEYTYPES); rc = ssh_config_parse_file(session, LIBSSH_TEST_PUBKEYACCEPTEDKEYTYPES);
assert_int_equal(rc, SSH_OK); assert_int_equal(rc, SSH_OK);
assert_string_equal(session->opts.pubkey_accepted_types, PUBKEYACCEPTEDTYPES);
if (ssh_fips_mode()) {
fips_algos = ssh_keep_fips_algos(SSH_HOSTKEYS, PUBKEYACCEPTEDTYPES);
assert_non_null(fips_algos);
assert_string_equal(session->opts.pubkey_accepted_types, fips_algos);
SAFE_FREE(fips_algos);
} else {
assert_string_equal(session->opts.pubkey_accepted_types, PUBKEYACCEPTEDTYPES);
}
} }
int torture_run_tests(void) { int torture_run_tests(void) {