Stowage/go
2
0
Fork 0
mirror of https://github.com/golang/go.git synced 2026-06-27 03:11:23 +00:00
Code Issues Projects Releases Packages Wiki Activity

crypto/tls: remove a couple FIPS 140-3 mode skip from tests

Browse source 
Also, update related comments.

Updates #70505

Change-Id: I3fdcf81f86f8eaf7834223eb854824356a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/776705
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
TryBot-Bypass: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
This commit is contained in:
Filippo Valsorda 2026-05-09 19:42:36 +02:00 • committed by Gopher Robot
parent aca2bff284
commit 3825609217
4 changed files with 2 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/crypto/tls/handshake_client_test.go
View file

@ -909,7 +909,6 @@ func testResumption(t *testing.T, version uint16) {
t.Skip("skipping in -short mode")
}
// Note: using RSA 2048 test certificates because they are compatible with FIPS mode.
testCertificates := []Certificate{testRSA2048Cert}
serverConfig := &Config{
MaxVersion: version,
@ -1772,7 +1771,6 @@ func testVerifyConnection(t *testing.T, version uint16) {
},
}
for _, test := range tests {
// Note: using RSA 2048 test certificates because they are compatible with FIPS mode.
var serverCalled, clientCalled int
serverConfig := &Config{
@ -1827,7 +1825,6 @@ func TestVerifyPeerCertificate(t *testing.T) {
}
func testVerifyPeerCertificate(t *testing.T, version uint16) {
// Note: using RSA 2048 test certificates because they are compatible with FIPS mode.
sentinelErr := errors.New("TestVerifyPeerCertificate")
verifyPeerCertificateCallback := func(called *bool, rawCerts [][]byte, validatedChains [][]*x509.Certificate) error {
@ -2382,7 +2379,6 @@ func TestGetClientCertificate(t *testing.T) {
}
func testGetClientCertificate(t *testing.T, version uint16) {
// Note: using RSA 2048 test certificates because they are compatible with FIPS mode.
for i, test := range getClientCertificateTests {
serverConfig := testConfigServer.Clone()
serverConfig.Certificates = []Certificate{testRSA2048Cert}
@ -2561,7 +2557,6 @@ func TestResumptionKeepsOCSPAndSCT(t *testing.T) {
}
func testResumptionKeepsOCSPAndSCT(t *testing.T, ver uint16) {
// Note: using RSA 2048 test certificates because they are compatible with FIPS mode.
clientConfig := &Config{
MaxVersion: ver,
ClientSessionCache: NewLRUClientSessionCache(32),

2
src/crypto/tls/handshake_server_test.go
View file

@ -212,8 +212,6 @@ func TestDontSelectRSAWithECDSAKey(t *testing.T) {
}
func TestRenegotiationExtension(t *testing.T) {
skipFIPS(t) // #70505
clientHello := &clientHelloMsg{
vers: VersionTLS12,
compressionMethods: []uint8{compressionNone},

3
src/crypto/tls/handshake_test.go
View file

@ -54,8 +54,7 @@ var (
)
func runTestAndUpdateIfNeeded(t *testing.T, name string, run func(t *testing.T, update bool)) {
// FIPS mode is non-deterministic and so isn't suited for testing against static test transcripts.
skipFIPS(t)
skipFIPS(t) // FIPS 140-3 mode changes the advertised parameters.
// Go+BoringCrypto's boring.RandReader ignores the testing override set by
// cryptotest.SetGlobalRandom, so e.g. ECDH key generation would be

4
src/crypto/tls/tls_test.go
View file

@ -1426,7 +1426,7 @@ func TestBuildNameToCertificate_doesntModifyCertificates(t *testing.T) {
func testingKey(s string) string { return strings.ReplaceAll(s, "TESTING KEY", "PRIVATE KEY") }
func TestClientHelloInfo_SupportsCertificate(t *testing.T) {
skipFIPS(t) // Test certificates not FIPS compatible.
skipFIPS(t) // SHA-1, Ed25519, and legacy RSA kex test cases not FIPS compatible.
pkcs1Cert := testRSA2048Cert
pkcs1Cert.SupportedSignatureAlgorithms = []SignatureScheme{PKCS1WithSHA1, PKCS1WithSHA256}
@ -1861,8 +1861,6 @@ func TestPKCS1OnlyCert(t *testing.T) {
}
func TestVerifyCertificates(t *testing.T) {
skipFIPS(t) // Test certificates not FIPS compatible.
// See https://go.dev/issue/31641.
t.Run("TLSv12", func(t *testing.T) { testVerifyCertificates(t, VersionTLS12) })
t.Run("TLSv13", func(t *testing.T) { testVerifyCertificates(t, VersionTLS13) })