Stowage/go
2
0
Fork 0
mirror of https://github.com/golang/go.git synced 2025-12-08 06:10:04 +00:00
Code Issues Projects Releases Packages Wiki Activity

crypto/internal/fips140/check: remove Enabled

Browse source 
check.Enabled, internal/fips140.Enabled, and crypto/fips140.Enabled were
redundant. Package check can just use internal/fips140.Enabled.

check.Verified is still there for the tests and belt-and-suspenders
assurance in crypto/fips140.Enabled, although it's implied by Enabled.

For #69536

Change-Id: I83921cc925da841aba4da79a9a5e9ac526a3f2bf
Reviewed-on: https://go-review.googlesource.com/c/go/+/638855
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
This commit is contained in:
Filippo Valsorda 2024-12-17 20:03:22 +01:00 • committed by Gopher Robot
parent 4b652e9f5f
commit e7a8bd5d8b
3 changed files with 13 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/crypto/fips140/fips140.go
View file

@ -26,7 +26,7 @@ func Enabled() bool {
if currentlyEnabled != fips140.Enabled { if currentlyEnabled != fips140.Enabled {
panic("crypto/fips140: GODEBUG setting changed after program start") panic("crypto/fips140: GODEBUG setting changed after program start")
} }
if fips140.Enabled && !check.Enabled() { if fips140.Enabled && !check.Verified {
panic("crypto/fips140: FIPS 140-3 mode enabled, but integrity check didn't pass") panic("crypto/fips140: FIPS 140-3 mode enabled, but integrity check didn't pass")
} }
return fips140.Enabled return fips140.Enabled

28
src/crypto/internal/fips140/check/check.go
View file

@ -2,7 +2,7 @@
// Use of this source code is governed by a BSD-style // Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file. // license that can be found in the LICENSE file.
// Package check implements the FIPS-140 load-time code+data verification. // Package check implements the FIPS 140 load-time code+data verification.
// Every FIPS package providing cryptographic functionality except hmac and sha256 // Every FIPS package providing cryptographic functionality except hmac and sha256
// must import crypto/internal/fips140/check, so that the verification happens // must import crypto/internal/fips140/check, so that the verification happens
// before initialization of package global variables. // before initialization of package global variables.
@ -13,6 +13,7 @@
package check package check
import ( import (
"crypto/internal/fips140"
"crypto/internal/fips140/hmac" "crypto/internal/fips140/hmac"
"crypto/internal/fips140/sha256" "crypto/internal/fips140/sha256"
"crypto/internal/fips140deps/byteorder" "crypto/internal/fips140deps/byteorder"
@ -22,15 +23,9 @@ import (
"unsafe" "unsafe"
) )
// Enabled reports whether verification was enabled. // Verified is set when verification succeeded. It can be expected to always be
// If Enabled returns true, then verification succeeded, // true when [fips140.Enabled] is true, or init would have panicked.
// because if it failed the binary would have panicked at init time. var Verified bool
func Enabled() bool {
return enabled
}
var enabled bool // set when verification is enabled
var Verified bool // set when verification succeeds, for testing
// Supported reports whether the current GOOS/GOARCH is Supported at all. // Supported reports whether the current GOOS/GOARCH is Supported at all.
func Supported() bool { func Supported() bool {
@ -71,9 +66,7 @@ const fipsMagic = " Go fipsinfo \xff\x00"
var zeroSum [32]byte var zeroSum [32]byte
func init() { func init() {
v := godebug.Value("#fips140") if !fips140.Enabled {
enabled = v != "" && v != "off"
if !enabled {
return return
} }
@ -88,13 +81,6 @@ func init() {
panic("fips140: cannot verify in asan mode") panic("fips140: cannot verify in asan mode")
} }
switch v {
case "on", "only", "debug":
// ok
default:
panic("fips140: unknown GODEBUG setting fips140=" + v)
}
if !Supported() { if !Supported() {
panic("fips140: unavailable on " + runtime.GOOS + "-" + runtime.GOARCH) panic("fips140: unavailable on " + runtime.GOOS + "-" + runtime.GOARCH)
} }
@ -132,7 +118,7 @@ func init() {
panic("fips140: verification mismatch") panic("fips140: verification mismatch")
} }
if v == "debug" { if godebug.Value("#fips140") == "debug" {
println("fips140: verified code+data") println("fips140: verified code+data")
} }

6
src/crypto/internal/fips140/fips140.go
View file

@ -11,12 +11,16 @@ var Enabled bool
var debug bool var debug bool
func init() { func init() {
switch godebug.Value("#fips140") { v := godebug.Value("#fips140")
switch v {
case "on", "only": case "on", "only":
Enabled = true Enabled = true
case "debug": case "debug":
Enabled = true Enabled = true
debug = true debug = true
case "off", "":
default:
panic("fips140: unknown GODEBUG setting fips140=" + v)
} }
} }