mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-01-03 11:45:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add more details to FIPS comments

Browse Source 
Signed-off-by: Monis Khan <mok@vmware.com>
This commit is contained in:
Monis Khan
2022-03-31 14:48:52 -04:00
parent ce82d799c9
commit 15bc6a4a67
7 changed files with 47 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
test/integration/securetls_fips_test.go
View File

@@ -138,10 +138,11 @@ func TestSecureTLSSupervisor(t *testing.T) { // does not run in parallel because
require.Contains(t, stdout, testlib.GetExpectedCiphers(defaultECDSAOnly), "stdout:\n%s", stdout)
}
// this test ensures that if the list of default fips cipher
// suites changes, we will know.
// TestFIPSCipherSuites_Parallel ensures that if the list of default fips cipher suites changes,
// we will know. This is an integration test because we do not support build tags on unit tests.
func TestFIPSCipherSuites_Parallel(t *testing.T) {
_ = testlib.IntegrationEnv(t)
server := tlsserver.TLSTestServer(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// use the default fips config which contains a hard coded list of cipher suites
// that should be equal to the default list of fips cipher suites.
@@ -157,7 +158,7 @@ func TestFIPSCipherSuites_Parallel(t *testing.T) {
// and therefore uses goboring's default fips ciphers.
defaultConfig := &tls.Config{
RootCAs: pool,
NextProtos: ptls.Default(nil).NextProtos,
NextProtos: ptls.Default(nil).NextProtos, // we do not care about field for this test, so just make it match
}
transport := http.Transport{
TLSClientConfig: defaultConfig,

2
test/testlib/securetls.go
View File

@@ -87,7 +87,7 @@ func GetExpectedCiphers(config *tls.Config) string {
}
s.WriteString("\n")
}
tls12Bit = fmt.Sprintf(tls12Base, s.String(), getCipherSuitePreference())
tls12Bit = fmt.Sprintf(tls12Base, s.String(), cipherSuitePreference)
}
skip13 := config.MaxVersion == tls.VersionTLS12

4
test/testlib/securetls_preference_fips.go
View File

@@ -10,6 +10,4 @@ package testlib
// incorrectly shown as 'client' in some cases.
// in fips-only mode, it correctly shows the cipher preference
// as 'server', while in non-fips mode it shows as 'client'.
func getCipherSuitePreference() string {
return "server"
}
const cipherSuitePreference = "server"

4
test/testlib/securetls_preference_nonfips.go
View File

@@ -10,6 +10,4 @@ package testlib
// incorrectly shown as 'client' in some cases.
// in fips-only mode, it correctly shows the cipher preference
// as 'server', while in non-fips mode it shows as 'client'.
func getCipherSuitePreference() string {
return "client"
}
const cipherSuitePreference = "client"