Horton

Re: Allow tests to pass in OpenSSL FIPS mode

Peter Eisentraut <peter.eisentraut@enterprisedb.com>

View thread View on postgr.es
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
To: pgsql-hackers <pgsql-hackers@postgresql.org>
Cc: Michael Paquier <michael@paquier.xyz>
Date: 2022-12-07T14:14:09Z
Lists: pgsql-hackers

Attachments

On 13.10.22 12:26, Peter Eisentraut wrote:
>> I think that the other md5() computations done in the main regression
>> test suite could just be switched to use one of the sha*() functions
>> as they just want to put their hands on text values.  It looks like a
>> few of them have some expections with the output size and
>> generate_series(), though, but this could be tweaked by making the
>> series shorter, for example.
> 
> Right, that's the rest of my original patch.  I'll come back with an 
> updated version of that.

Here is the next step.  To contain the scope, I focused on just "make 
check" for now.  This patch removes all incidental calls to md5(), 
replacing them with sha256(), so that they'd pass with or without FIPS 
mode.  (Two tests would need alternative expected files: md5 and 
password.  I have not included those here.)

Some tests inspect the actual md5 result strings or build statistics 
based on them.  I have tried to carefully preserve the meaning of the 
original tests, to the extent that they could be inferred, in some cases 
adjusting example values by matching the md5 outputs to the equivalent 
sha256 outputs.  Some cases are tricky or mysterious or both and could 
use another look.

Commits

  1. Add regression expected-files for older OpenSSL in FIPS mode.

  2. Allow tests to pass in OpenSSL FIPS mode (rest)

  3. Allow tests to pass in OpenSSL FIPS mode (TAP tests)

  4. pgcrypto: Allow tests to pass in OpenSSL FIPS mode

  5. pgcrypto: Split off pgp-encrypt-md5 test

  6. citext: Allow tests to pass in OpenSSL FIPS mode

  7. Remove incidental md5() function uses from main regression tests

  8. Improve/correct comments

  9. Put tests of md5() function into separate test file