-
Notifications
You must be signed in to change notification settings - Fork 66
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1841 from vmware-tanzu/new_fips_compiler
Support new golang fips compiler
- Loading branch information
Showing
12 changed files
with
191 additions
and
116 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| // Copyright 2021-2024 the Pinniped contributors. All Rights Reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| //go:build !fips_strict | ||
|
|
||
| package tlsserver | ||
|
|
||
| import "crypto/tls" | ||
|
|
||
| // GetExpectedTLS13Ciphers returns the expected TLS 1.3 cipher for a non-FIPS build. | ||
| func GetExpectedTLS13Ciphers() []uint16 { | ||
| // TLS 1.3 ciphers are not configurable, so we can hard-code them here. | ||
| return []uint16{ | ||
| tls.TLS_AES_128_GCM_SHA256, | ||
| tls.TLS_AES_256_GCM_SHA384, | ||
| tls.TLS_CHACHA20_POLY1305_SHA256, | ||
| } | ||
| } | ||
|
|
||
| // GetExpectedTLS13CipherNMapKeyExchangeInfoValue returns the expected key exchange info value | ||
| // which is shown by nmap in parenthesis next to the cipher name for a non-FIPS build. | ||
| func GetExpectedTLS13CipherNMapKeyExchangeInfoValue(cipher uint16) string { | ||
| switch cipher { | ||
| case tls.TLS_AES_128_GCM_SHA256, | ||
| tls.TLS_AES_256_GCM_SHA384, | ||
| tls.TLS_CHACHA20_POLY1305_SHA256: | ||
| return "ecdh_x25519" | ||
| default: | ||
| return "unknown key exchange value" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| // Copyright 2021-2024 the Pinniped contributors. All Rights Reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| //go:build fips_strict | ||
|
|
||
| package tlsserver | ||
|
|
||
| import "crypto/tls" | ||
|
|
||
| // GetExpectedTLS13Ciphers returns the expected TLS 1.3 cipher for a FIPS build. | ||
| func GetExpectedTLS13Ciphers() []uint16 { | ||
| // TLS 1.3 ciphers are not configurable, so we can hard-code them here. | ||
| return []uint16{ | ||
| tls.TLS_AES_128_GCM_SHA256, | ||
| tls.TLS_AES_256_GCM_SHA384, | ||
| // tls.TLS_CHACHA20_POLY1305_SHA256 is not supported by boring crypto | ||
| } | ||
| } | ||
|
|
||
| // GetExpectedTLS13CipherNMapKeyExchangeInfoValue returns the expected key exchange info value | ||
| // which is shown by nmap in parenthesis next to the cipher name for a FIPS build. | ||
| func GetExpectedTLS13CipherNMapKeyExchangeInfoValue(cipher uint16) string { | ||
| switch cipher { | ||
| case tls.TLS_AES_128_GCM_SHA256, | ||
| tls.TLS_AES_256_GCM_SHA384: | ||
| return "secp256r1" | ||
| default: | ||
| return "unknown key exchange value" | ||
| } | ||
| } |
Oops, something went wrong.