[go] crypto/tls: add BoGo coverage for FIPS 140-3 EMS enforcement

0 views

Skip to first unread message

Daniel McCarney (Gerrit)

unread,

Aug 6, 2026, 9:58:05 AM (4 days ago) Aug 6

to goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, David Chase, golang...@luci-project-accounts.iam.gserviceaccount.com, Roland Shoemaker, Filippo Valsorda, golang-co...@googlegroups.com

Daniel McCarney submitted the change

Change information

Commit message:

crypto/tls: add BoGo coverage for FIPS 140-3 EMS enforcement

Prior to this commit the enforcement of Extended Master Secret in FIPS
140-3 mode, and the fips140ems GODEBUG that disables it, had no test
coverage. The pre-existing TestBogoSuite is skipped in FIPS mode, and
testing against a peer without EMS support is tricky in other contexts
since crypto/tls cannot be configured to disable the extension.

This commit extracts the runner invocation from TestBogoSuite into
a helper that takes a test filter and extra environment variables, and
add TestBogoSuiteFIPSEMS, which enables FIPS mode in the shim via
GODEBUG. This lets us test a specific subset of BoGo tests with FIPS
enforcement enabled.

We use this to run the EMS tests twice, once with enforcement on,
expecting the non-EMS TLS 1.2 handshake and resumption tests to fail,
and once with fips140ems=0, expecting them to pass.

Updates #80516

Change-Id: If938c5145e795400edd6c33fbe723082c370e9cc

Reviewed-on: https://go-review.googlesource.com/c/go/+/805540

Reviewed-by: Roland Shoemaker <rol...@golang.org>

LUCI-TryBot-Result: golang...@luci-project-accounts.iam.gserviceaccount.com <golang...@luci-project-accounts.iam.gserviceaccount.com>

Reviewed-by: David Chase <drc...@google.com>

Files:

M src/crypto/tls/bogo_shim_test.go

Change size: M

Delta: 1 file changed, 143 insertions(+), 64 deletions(-)

Branch: refs/heads/master

Submit Requirements:

Code-Review: +2 by Roland Shoemaker, +1 by David Chase
TryBots-Pass: LUCI-TryBot-Result+1 by golang...@luci-project-accounts.iam.gserviceaccount.com

Open in Gerrit

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

open

diffy

satisfied_requirement

Reply all

Reply to author

Forward

0 new messages