Skip to content

test: Skip weak crypto tests in FIPS mode - #3757

Closed
stefanmb wants to merge 2 commits into
nodejs:masterfrom
stefanmb:fips-cs6-disable-weak-md5-rc4
Closed

test: Skip weak crypto tests in FIPS mode#3757
stefanmb wants to merge 2 commits into
nodejs:masterfrom
stefanmb:fips-cs6-disable-weak-md5-rc4

Conversation

@stefanmb

@stefanmbstefanmb commented Nov 10, 2015

Copy link
Copy Markdown
Contributor

FIPS 140-2 does not permit the use of MD5 and RC4, skip tests that use them in FIPS mode, or substitute with stronger crypto where applicable.

@mscdexmscdex added crypto Issues and PRs related to the crypto subsystem. test Issues and PRs related to the tests. labels Nov 11, 2015
@stefanmbstefanmb mentioned this pull request Nov 11, 2015
Closed
indutny
indutny reviewed Nov 11, 2015
View reviewed changes
Comment threadtest/parallel/test-crypto-binary-default.js Outdated

@indutnyindutnyNov 11, 2015

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would rather wrap is with if.

@shigekishigekiNov 12, 2015

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

me too.

@stefanmbstefanmbNov 12, 2015

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed.

@stefanmb
stefanmbforce-pushed the fips-cs6-disable-weak-md5-rc4 branch from 5e91045 to f42f961CompareNovember 12, 2015 23:02
@shigeki

shigeki commented Nov 13, 2015

Copy link
Copy Markdown
Contributor

@stefanmb I've just updated test-tls-honorcipherorder.js so as to work on only TLS1.2 ciphers to change

DES-CBC-SHA => AES256-SHA256
AES256-SHA => AES128-GCM-SHA256
RC4-SHA => AES128-SHA256
ECDHE-RSA-AES256-SHA => ECDHE-RSA-AES128-GCM-SHA256

Please refer the whole tests at https://gist.github.com/shigeki/f523f894f6d739f59364

All the symmetric cipher is AES so it looks very hard to distinguish them at a glance but it does not matter to test and check the cipher selection.
Only the test5 has a different scenario from the previous one because it need to add a TLS1.2 cipher not included the current default list. I think it is not a realistic test case and should be okay to change it.

@stefanmb
stefanmbforce-pushed the fips-cs6-disable-weak-md5-rc4 branch 2 times, most recently from f8ea05f to e6b1468CompareNovember 13, 2015 20:16
@stefanmb

stefanmb commented Nov 13, 2015

Copy link
Copy Markdown
ContributorAuthor

@shigeki

Thank you! I've included those changes as an additional commit in this PR.

indutny
indutny reviewed Nov 13, 2015
View reviewed changes
Comment threadtest/common.js Outdated

@indutnyindutnyNov 13, 2015

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style, please move get: on a next line and indent everything properly.

@stefanmbstefanmbNov 13, 2015

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, I'll change the line above it too as mine is an exact copy of the existing hasCrypto above it.

@stefanmb
stefanmbforce-pushed the fips-cs6-disable-weak-md5-rc4 branch 2 times, most recently from e09ee04 to af09eb8CompareNovember 13, 2015 20:51
@stefanmb

stefanmb commented Nov 13, 2015

Copy link
Copy Markdown
ContributorAuthor

@indutny Style (and formatting) issues fixed. Thanks!

@jasnell

jasnell commented Nov 16, 2015

Copy link
Copy Markdown
Member

@stefanmb ... ok, quite a few CI failures on multiple platforms. The failures look relevant.

@stefanmb
tls: test honor cipher order with TLS1.2
cc835ad
Modified tests to work in FIPS and non-FIPS mode using TLS1.2 crypto.
@stefanmb
stefanmbforce-pushed the fips-cs6-disable-weak-md5-rc4 branch from dd5ae5a to cc835adCompareNovember 16, 2015 16:56
@stefanmb

stefanmb commented Nov 16, 2015

Copy link
Copy Markdown
ContributorAuthor

@jasnell Oops, there was a typo in one of the tests - I fixed it. Let's try another run.

@jasnell

jasnell commented Nov 16, 2015

Copy link
Copy Markdown
Member

New CI: https://ci.nodejs.org/job/node-test-pull-request/747/

@stefanmb

stefanmb commented Nov 16, 2015

Copy link
Copy Markdown
ContributorAuthor

@jasnell I see two unrelated failures.

@jasnell

jasnell commented Nov 16, 2015

Copy link
Copy Markdown
Member

LGTM
would like @nodejs/crypto to sign off tho

@indutny

indutny commented Nov 16, 2015

Copy link
Copy Markdown
Member

LGTM

@mhdawsonmhdawson self-assigned this Nov 19, 2015
@mhdawson

mhdawson commented Nov 19, 2015

Copy link
Copy Markdown
Member

Going to land CI run here: https://ci.nodejs.org/job/node-test-pull-request/787/

@mhdawson

mhdawson commented Nov 19, 2015

Copy link
Copy Markdown
Member

No relevant failures, a couple of centos machines had machine related issues and a failure on windows I'm pretty sure I've seen before

@jasnell

jasnell commented Nov 19, 2015

Copy link
Copy Markdown
Member

+1. let's land it!

mhdawson pushed a commit that referenced this pull request Nov 19, 2015
@stefanmb@mhdawson
test: skip/replace weak crypto tests in FIPS mode
e499ea8
FIPS 140-2 does not permit the use of MD5 and RC4, skip or tests
that use them, or substitute with stronger crypto where applicable.
PR-URL: #3757
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: James Snell <jasnell@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
@mhdawson

mhdawson commented Nov 19, 2015

Copy link
Copy Markdown
Member

Landed as e499ea8

@Fishrock123Fishrock123 mentioned this pull request Nov 26, 2015
Closed
MylesBorins pushed a commit that referenced this pull request Nov 30, 2015
@stefanmbMyles Borins
test: skip/replace weak crypto tests in FIPS mode
3338fd7
FIPS 140-2 does not permit the use of MD5 and RC4, skip or tests
that use them, or substitute with stronger crypto where applicable.
PR-URL: #3757
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: James Snell <jasnell@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
rvagg pushed a commit that referenced this pull request Dec 4, 2015
@stefanmb@rvagg
test: skip/replace weak crypto tests in FIPS mode
1889593
FIPS 140-2 does not permit the use of MD5 and RC4, skip or tests
that use them, or substitute with stronger crypto where applicable.
PR-URL: #3757
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: James Snell <jasnell@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
rvagg pushed a commit that referenced this pull request Dec 5, 2015
@stefanmb@rvagg
test: skip/replace weak crypto tests in FIPS mode
e129d83
FIPS 140-2 does not permit the use of MD5 and RC4, skip or tests
that use them, or substitute with stronger crypto where applicable.
PR-URL: #3757
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: James Snell <jasnell@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
This was referenced Dec 8, 2015
Closed
Merged
@jasnelljasnell mentioned this pull request Dec 17, 2015
Closed
jasnell pushed a commit that referenced this pull request Dec 17, 2015
@stefanmb@jasnell
test: skip/replace weak crypto tests in FIPS mode
4a26f74
FIPS 140-2 does not permit the use of MD5 and RC4, skip or tests
that use them, or substitute with stronger crypto where applicable.
PR-URL: #3757
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: James Snell <jasnell@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
jasnell pushed a commit that referenced this pull request Dec 23, 2015
@stefanmb@jasnell
test: skip/replace weak crypto tests in FIPS mode
04d8a65
FIPS 140-2 does not permit the use of MD5 and RC4, skip or tests
that use them, or substitute with stronger crypto where applicable.
PR-URL: #3757
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: James Snell <jasnell@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@mhdawsonmhdawson

Labels

cryptoIssues and PRs related to the crypto subsystem.testIssues and PRs related to the tests.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@stefanmb@shigeki@indutny@jasnell@mhdawson@mscdex@MylesBorins