removed pluto test vectors, --disable-self-test option
This commit is contained in:
Martin Willi
@@ -333,191 +333,6 @@ void ike_alg_show_connection(struct connection *c, const char *instance)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Apply a suite of testvectors to an encryption algorithm
|
||||
*/
|
||||
static bool ike_encrypt_test(const struct encrypt_desc *desc)
|
||||
{
|
||||
bool encrypt_results = TRUE;
|
||||
|
||||
if (desc->enc_testvectors == NULL)
|
||||
{
|
||||
plog(" %s encryption self-test not available",
|
||||
enum_name(&oakley_enc_names, desc->algo_id));
|
||||
}
|
||||
else
|
||||
{
|
||||
int i;
|
||||
encryption_algorithm_t enc_alg;
|
||||
|
||||
enc_alg = oakley_to_encryption_algorithm(desc->algo_id);
|
||||
|
||||
for (i = 0; desc->enc_testvectors[i].key != NULL; i++)
|
||||
{
|
||||
bool result;
|
||||
crypter_t *crypter;
|
||||
chunk_t key = { (u_char*)desc->enc_testvectors[i].key,
|
||||
desc->enc_testvectors[i].key_size };
|
||||
chunk_t plain = { (u_char*)desc->enc_testvectors[i].plain,
|
||||
desc->enc_testvectors[i].data_size};
|
||||
chunk_t cipher = { (u_char*)desc->enc_testvectors[i].cipher,
|
||||
desc->enc_testvectors[i].data_size};
|
||||
chunk_t encrypted = chunk_empty;
|
||||
chunk_t decrypted = chunk_empty;
|
||||
chunk_t iv;
|
||||
|
||||
crypter = lib->crypto->create_crypter(lib->crypto, enc_alg, key.len);
|
||||
if (crypter == NULL)
|
||||
{
|
||||
plog(" %s encryption function not available",
|
||||
enum_name(&oakley_enc_names, desc->algo_id));
|
||||
return FALSE;
|
||||
}
|
||||
iv = chunk_create((u_char*)desc->enc_testvectors[i].iv,
|
||||
crypter->get_block_size(crypter));
|
||||
crypter->set_key(crypter, key);
|
||||
crypter->decrypt(crypter, cipher, iv, &decrypted);
|
||||
result = chunk_equals(decrypted, plain);
|
||||
crypter->encrypt(crypter, plain, iv, &encrypted);
|
||||
result &= chunk_equals(encrypted, cipher);
|
||||
DBG(DBG_CRYPT,
|
||||
DBG_log(" enc testvector %d: %s", i, result ? "ok":"failed")
|
||||
)
|
||||
encrypt_results &= result;
|
||||
crypter->destroy(crypter);
|
||||
free(encrypted.ptr);
|
||||
free(decrypted.ptr);
|
||||
}
|
||||
plog(" %s encryption self-test %s",
|
||||
enum_name(&oakley_enc_names, desc->algo_id),
|
||||
encrypt_results ? "passed":"failed");
|
||||
}
|
||||
return encrypt_results;
|
||||
}
|
||||
|
||||
/**
|
||||
* Apply a suite of testvectors to a hash algorithm
|
||||
*/
|
||||
static bool ike_hash_test(const struct hash_desc *desc)
|
||||
{
|
||||
bool hash_results = TRUE;
|
||||
bool hmac_results = TRUE;
|
||||
|
||||
if (desc->hash_testvectors == NULL)
|
||||
{
|
||||
plog(" %s hash self-test not available",
|
||||
enum_name(&oakley_hash_names, desc->algo_id));
|
||||
}
|
||||
else
|
||||
{
|
||||
int i;
|
||||
hash_algorithm_t hash_alg;
|
||||
hasher_t *hasher;
|
||||
|
||||
hash_alg = oakley_to_hash_algorithm(desc->algo_id);
|
||||
hasher = lib->crypto->create_hasher(lib->crypto, hash_alg);
|
||||
if (hasher == NULL)
|
||||
{
|
||||
plog(" %s hash function not available",
|
||||
enum_name(&oakley_hash_names, desc->algo_id));
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
for (i = 0; desc->hash_testvectors[i].msg_digest != NULL; i++)
|
||||
{
|
||||
u_char digest[MAX_DIGEST_LEN];
|
||||
chunk_t msg = { (u_char*)desc->hash_testvectors[i].msg,
|
||||
desc->hash_testvectors[i].msg_size };
|
||||
bool result;
|
||||
|
||||
hasher->get_hash(hasher, msg, digest);
|
||||
result = memeq(digest, desc->hash_testvectors[i].msg_digest
|
||||
, desc->hash_digest_size);
|
||||
DBG(DBG_CRYPT,
|
||||
DBG_log(" hash testvector %d: %s", i, result ? "ok":"failed")
|
||||
)
|
||||
hash_results &= result;
|
||||
}
|
||||
hasher->destroy(hasher);
|
||||
plog(" %s hash self-test %s", enum_name(&oakley_hash_names, desc->algo_id),
|
||||
hash_results ? "passed":"failed");
|
||||
}
|
||||
|
||||
if (desc->hmac_testvectors == NULL)
|
||||
{
|
||||
plog(" %s hmac self-test not available", enum_name(&oakley_hash_names, desc->algo_id));
|
||||
}
|
||||
else
|
||||
{
|
||||
int i;
|
||||
pseudo_random_function_t prf_alg;
|
||||
|
||||
prf_alg = oakley_to_prf(desc->algo_id);
|
||||
|
||||
for (i = 0; desc->hmac_testvectors[i].hmac != NULL; i++)
|
||||
{
|
||||
u_char digest[MAX_DIGEST_LEN];
|
||||
chunk_t key = { (u_char*)desc->hmac_testvectors[i].key,
|
||||
desc->hmac_testvectors[i].key_size };
|
||||
chunk_t msg = { (u_char*)desc->hmac_testvectors[i].msg,
|
||||
desc->hmac_testvectors[i].msg_size };
|
||||
prf_t *prf;
|
||||
bool result;
|
||||
|
||||
prf = lib->crypto->create_prf(lib->crypto, prf_alg);
|
||||
if (prf == NULL)
|
||||
{
|
||||
plog(" %s hmac function not available",
|
||||
enum_name(&oakley_hash_names, desc->algo_id));
|
||||
return FALSE;
|
||||
}
|
||||
prf->set_key(prf, key);
|
||||
prf->get_bytes(prf, msg, digest);
|
||||
prf->destroy(prf);
|
||||
result = memeq(digest, desc->hmac_testvectors[i].hmac,
|
||||
desc->hash_digest_size);
|
||||
DBG(DBG_CRYPT,
|
||||
DBG_log(" hmac testvector %d: %s", i, result ? "ok":"failed")
|
||||
)
|
||||
hmac_results &= result;
|
||||
}
|
||||
plog(" %s hmac self-test %s", enum_name(&oakley_hash_names, desc->algo_id)
|
||||
, hmac_results ? "passed":"failed");
|
||||
}
|
||||
return hash_results && hmac_results;
|
||||
}
|
||||
|
||||
/**
|
||||
* Apply test vectors to registered encryption and hash algorithms
|
||||
*/
|
||||
bool ike_alg_test(void)
|
||||
{
|
||||
bool all_results = TRUE;
|
||||
struct ike_alg *a;
|
||||
|
||||
plog("Testing registered IKE crypto algorithms:");
|
||||
|
||||
for (a = ike_alg_base[IKE_ALG_ENCRYPT]; a != NULL; a = a->algo_next)
|
||||
{
|
||||
struct encrypt_desc *desc = (struct encrypt_desc*)a;
|
||||
|
||||
all_results &= ike_encrypt_test(desc);
|
||||
}
|
||||
|
||||
for (a = ike_alg_base[IKE_ALG_HASH]; a != NULL; a = a->algo_next)
|
||||
{
|
||||
struct hash_desc *desc = (struct hash_desc*)a;
|
||||
|
||||
all_results &= ike_hash_test(desc);
|
||||
}
|
||||
|
||||
if (all_results)
|
||||
plog("All crypto self-tests passed");
|
||||
else
|
||||
plog("Some crypto self-tests failed");
|
||||
return all_results;
|
||||
}
|
||||
|
||||
/**
|
||||
* ML: make F_STRICT logic consider enc,hash/auth,modp algorithms
|
||||
*/
|
||||
|
||||
Reference in New Issue
Block a user