fix unit tests

Author: hdm

crypto/tls/common.go

@@ -8,7 +8,6 @@ import (
 	"bytes"
 	"container/list"
 	"context"
-	"crypto/rand"
 	"errors"
 	"fmt"
 	"io"
@@ -24,6 +23,7 @@ import (
 	"github.com/runZeroInc/excrypto/crypto/ecdsa"
 	"github.com/runZeroInc/excrypto/crypto/ed25519"
 	"github.com/runZeroInc/excrypto/crypto/elliptic"
+	"github.com/runZeroInc/excrypto/crypto/internal/rand"
 	"github.com/runZeroInc/excrypto/crypto/rsa"
 	"github.com/runZeroInc/excrypto/crypto/sha512"
 	"github.com/runZeroInc/excrypto/crypto/tls/internal/fips140tls"

crypto/x509/fingerprint.go

@@ -9,6 +9,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 
+	"github.com/runZeroInc/excrypto/crypto/internal/fips140only"
 	"github.com/runZeroInc/excrypto/crypto/md5"
 	"github.com/runZeroInc/excrypto/crypto/sha1"
 	"github.com/runZeroInc/excrypto/crypto/sha256"
@@ -20,13 +21,21 @@ import (
 type CertificateFingerprint []byte
 
 // MD5Fingerprint creates a fingerprint of data using the MD5 hash algorithm.
+// Returns nil when FIPS 140-only mode is enforced, since MD5 is not allowed.
 func MD5Fingerprint(data []byte) CertificateFingerprint {
+	if fips140only.Enforced() {
+		return nil
+	}
 	sum := md5.Sum(data)
 	return sum[:]
 }
 
 // SHA1Fingerprint creates a fingerprint of data using the SHA1 hash algorithm.
+// Returns nil when FIPS 140-only mode is enforced, since SHA-1 is not allowed.
 func SHA1Fingerprint(data []byte) CertificateFingerprint {
+	if fips140only.Enforced() {
+		return nil
+	}
 	sum := sha1.Sum(data)
 	return sum[:]
 }

crypto/x509/parser.go

@@ -21,6 +21,7 @@ import (
 	"github.com/runZeroInc/excrypto/crypto/ecdsa"
 	"github.com/runZeroInc/excrypto/crypto/ed25519"
 	"github.com/runZeroInc/excrypto/crypto/elliptic"
+	"github.com/runZeroInc/excrypto/crypto/internal/fips140only"
 	"github.com/runZeroInc/excrypto/crypto/rsa"
 	"github.com/runZeroInc/excrypto/crypto/sha256"
 	"github.com/runZeroInc/excrypto/crypto/x509/pkix"
@@ -31,6 +32,16 @@ import (
 	cryptobyte_asn1 "github.com/runZeroInc/excrypto/x/crypto/cryptobyte/asn1"
 )
 
+// signatureUsesNonFIPSHash reports whether the given signature algorithm
+// uses a hash (MD5, SHA-1) that panics in FIPS 140-only mode.
+func signatureUsesNonFIPSHash(algo SignatureAlgorithm) bool {
+	switch algo {
+	case MD2WithRSA, MD5WithRSA, SHA1WithRSA, DSAWithSHA1, ECDSAWithSHA1:
+		return true
+	}
+	return false
+}
+
 // isPrintable reports whether the given b is in the ASN.1 PrintableString set.
 // This is a simplified version of encoding/asn1.isPrintable.
 func isPrintable(b byte) bool {
@@ -1288,8 +1299,12 @@ func parseCertificate(in *certificate) (*Certificate, error) {
 	// zcrypto: Check if self-signed
 	if bytes.Equal(cert.RawSubject, cert.RawIssuer) {
 		// Possibly self-signed, check the signature against itself.
-		if err := cert.CheckSignature(cert.SignatureAlgorithm, cert.RawTBSCertificate, cert.Signature); err == nil {
-			cert.SelfSigned = true
+		// Skip in FIPS 140-only mode when the signature algorithm uses
+		// a hash that panics (MD5, SHA-1). The self-signed flag is informational.
+		if !fips140only.Enforced() || !signatureUsesNonFIPSHash(cert.SignatureAlgorithm) {
+			if err := cert.CheckSignature(cert.SignatureAlgorithm, cert.RawTBSCertificate, cert.Signature); err == nil {
+				cert.SelfSigned = true
+			}
 		}
 	}