personal_interest_mirrors/nebula
1
0
Fork 0
mirror of https://github.com/slackhq/nebula.git synced 2026-08-16 14:27:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

test fips140.Enforced mode

Browse Source
This commit is contained in:
Wade Simmons
2026-07-24 10:03:22 -04:00
parent 00b498f9f9
commit 0e1f5342ac
2 changed files with 102 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pki.go
+9 -5
View File
@@ -238,11 +238,15 @@ func (cs *CertState) getCertificate(v cert.Version) cert.Certificate {
return nil
}
func newCipherSuite(curve cert.Curve, pkcs11backed bool, cipher string) (noise.CipherSuite, error) {
// newCipherSuite builds the noise.CipherSuite for the given curve and cipher.
// When fips140Enforced is true (FIPS 140-only mode), non-approved algorithms
// (Curve25519 and ChaChaPoly) are rejected with an error. Callers pass
// fips140.Enforced() for fips140Enforced.
func newCipherSuite(curve cert.Curve, pkcs11backed bool, cipher string, fips140Enforced bool) (noise.CipherSuite, error) {
var dhFunc noise.DHFunc
switch curve {
case cert.Curve_CURVE25519:
if fips140.Enforced() {
if fips140Enforced {
return nil, errors.New("pki: use of Curve25519 is not allowed in FIPS 140-only mode")
}
dhFunc = noise.DH25519
@@ -257,7 +261,7 @@ func newCipherSuite(curve cert.Curve, pkcs11backed bool, cipher string) (noise.C
}
if cipher == "chachapoly" {
if fips140.Enforced() {
if fips140Enforced {
return nil, errors.New("pki: use of ChaChaPoly is not allowed in FIPS 140-only mode")
}
return noise.NewCipherSuite(dhFunc, noise.CipherChaChaPoly, noise.HashSHA256), nil
@@ -420,7 +424,7 @@ func newCertState(dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, p
if err != nil {
return nil, fmt.Errorf("error marshalling v1 certificate for handshake: %w", err)
}
ncs, err := newCipherSuite(v1.Curve(), pkcs11backed, cipher)
ncs, err := newCipherSuite(v1.Curve(), pkcs11backed, cipher, fips140.Enforced())
if err != nil {
return nil, err
}
@@ -445,7 +449,7 @@ func newCertState(dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, p
if err != nil {
return nil, fmt.Errorf("error marshalling v2 certificate for handshake: %w", err)
}
ncs, err := newCipherSuite(v2.Curve(), pkcs11backed, cipher)
ncs, err := newCipherSuite(v2.Curve(), pkcs11backed, cipher, fips140.Enforced())
if err != nil {
return nil, err
}