QuasarApp/openssl
4
0
Fork 0
mirror of https://github.com/QuasarApp/openssl.git synced 2025-05-11 17:09:40 +00:00
Code Issues Projects Releases Wiki Activity

ssl_test: Add testcases for disallowing non-TLS1.3 curves with TLS1.3

Browse Source 
Also correctly mark max protocol version for some curves.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14154)
This commit is contained in:
Tomas Mraz 2021-02-11 18:18:49 +01:00
parent 89e14ca7c7
commit 9ff5bd612a
3 changed files with 1153 additions and 362 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
providers/common/capabilities.c
View File

@ -31,28 +31,50 @@ typedef struct tls_group_constants_st {
} TLS_GROUP_CONSTANTS; } TLS_GROUP_CONSTANTS;
static const TLS_GROUP_CONSTANTS group_list[35] = { static const TLS_GROUP_CONSTANTS group_list[35] = {
{ OSSL_TLS_GROUP_ID_sect163k1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_sect163k1, 80, TLS1_VERSION, TLS1_2_VERSION,
{ OSSL_TLS_GROUP_ID_sect163r1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_sect163r2, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_sect163r1, 80, TLS1_VERSION, TLS1_2_VERSION,
{ OSSL_TLS_GROUP_ID_sect193r1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_sect193r2, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_sect163r2, 80, TLS1_VERSION, TLS1_2_VERSION,
{ OSSL_TLS_GROUP_ID_sect233k1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_sect233r1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_sect193r1, 80, TLS1_VERSION, TLS1_2_VERSION,
{ OSSL_TLS_GROUP_ID_sect239k1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_sect283k1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_sect193r2, 80, TLS1_VERSION, TLS1_2_VERSION,
{ OSSL_TLS_GROUP_ID_sect283r1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_sect409k1, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_sect233k1, 112, TLS1_VERSION, TLS1_2_VERSION,
{ OSSL_TLS_GROUP_ID_sect409r1, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_sect571k1, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_sect233r1, 112, TLS1_VERSION, TLS1_2_VERSION,
{ OSSL_TLS_GROUP_ID_sect571r1, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_secp160k1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_sect239k1, 112, TLS1_VERSION, TLS1_2_VERSION,
{ OSSL_TLS_GROUP_ID_secp160r1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_secp160r2, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_sect283k1, 128, TLS1_VERSION, TLS1_2_VERSION,
{ OSSL_TLS_GROUP_ID_secp192k1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_secp192r1, 80, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_sect283r1, 128, TLS1_VERSION, TLS1_2_VERSION,
{ OSSL_TLS_GROUP_ID_secp224k1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_secp224r1, 112, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_sect409k1, 192, TLS1_VERSION, TLS1_2_VERSION,
{ OSSL_TLS_GROUP_ID_secp256k1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_sect409r1, 192, TLS1_VERSION, TLS1_2_VERSION,
DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_sect571k1, 256, TLS1_VERSION, TLS1_2_VERSION,
DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_sect571r1, 256, TLS1_VERSION, TLS1_2_VERSION,
DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_secp160k1, 80, TLS1_VERSION, TLS1_2_VERSION,
DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_secp160r1, 80, TLS1_VERSION, TLS1_2_VERSION,
DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_secp160r2, 80, TLS1_VERSION, TLS1_2_VERSION,
DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_secp192k1, 80, TLS1_VERSION, TLS1_2_VERSION,
DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_secp192r1, 80, TLS1_VERSION, TLS1_2_VERSION,
DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_secp224k1, 112, TLS1_VERSION, TLS1_2_VERSION,
DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_secp224r1, 112, TLS1_VERSION, TLS1_2_VERSION,
DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_secp256k1, 128, TLS1_VERSION, TLS1_2_VERSION,
DTLS1_VERSION, DTLS1_2_VERSION },
{ OSSL_TLS_GROUP_ID_secp256r1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_secp256r1, 128, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
{ OSSL_TLS_GROUP_ID_secp384r1, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_secp384r1, 192, TLS1_VERSION, 0, DTLS1_VERSION, 0 },
{ OSSL_TLS_GROUP_ID_secp521r1, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 }, { OSSL_TLS_GROUP_ID_secp521r1, 256, TLS1_VERSION, 0, DTLS1_VERSION, 0 },

1396
test/ssl-tests/14-curves.cnf
View File

File diff suppressed because it is too large Load Diff

53
test/ssl-tests/14-curves.cnf.in
View File

@ -12,19 +12,20 @@ use OpenSSL::Test::Utils qw(anydisabled);
our $fips_mode; our $fips_mode;
my @curves = ("sect233k1", "sect233r1", my @curves = ("prime256v1", "secp384r1", "secp521r1", "X25519",
"sect283k1", "sect283r1", "sect409k1", "sect409r1",
"sect571k1", "sect571r1", "secp224r1",
"prime256v1", "secp384r1", "secp521r1", "X25519",
"X448"); "X448");
my @curves_tls_1_2 = ("sect233k1", "sect233r1",
"sect283k1", "sect283r1", "sect409k1", "sect409r1",
"sect571k1", "sect571r1", "secp224r1");
my @curves_non_fips = ("sect163k1", "sect163r2", "prime192v1", my @curves_non_fips = ("sect163k1", "sect163r2", "prime192v1",
"sect163r1", "sect193r1", "sect193r2", "sect239k1", "sect163r1", "sect193r1", "sect193r2", "sect239k1",
"secp160k1", "secp160r1", "secp160r2", "secp192k1", "secp160k1", "secp160r1", "secp160r2", "secp192k1",
"secp224k1", "secp256k1", "brainpoolP256r1", "secp224k1", "secp256k1", "brainpoolP256r1",
"brainpoolP384r1", "brainpoolP512r1"); "brainpoolP384r1", "brainpoolP512r1");
push @curves, @curves_non_fips if !$fips_mode; push @curves_tls_1_2, @curves_non_fips if !$fips_mode;
our @tests = (); our @tests = ();
@ -35,8 +36,27 @@ sub generate_tests() {
name => "curve-${curve}", name => "curve-${curve}",
server => { server => {
"Curves" => $curve, "Curves" => $curve,
# TODO(TLS1.3): Can we get this to work for TLSv1.3? "MaxProtocol" => "TLSv1.3"
"MaxProtocol" => "TLSv1.2" },
client => {
"CipherString" => "ECDHE",
"MaxProtocol" => "TLSv1.3",
"Curves" => $curve
},
test => {
"ExpectedTmpKeyType" => $curve,
"ExpectedProtocol" => "TLSv1.3",
"ExpectedResult" => "Success"
},
};
}
foreach (0..$#curves_tls_1_2) {
my $curve = $curves_tls_1_2[$_];
push @tests, {
name => "curve-${curve}",
server => {
"Curves" => $curve,
"MaxProtocol" => "TLSv1.3"
}, },
client => { client => {
"CipherString" => "ECDHE", "CipherString" => "ECDHE",
@ -45,10 +65,29 @@ sub generate_tests() {
}, },
test => { test => {
"ExpectedTmpKeyType" => $curve, "ExpectedTmpKeyType" => $curve,
"ExpectedProtocol" => "TLSv1.2",
"ExpectedResult" => "Success" "ExpectedResult" => "Success"
}, },
}; };
} }
foreach (0..$#curves_tls_1_2) {
my $curve = $curves_tls_1_2[$_];
push @tests, {
name => "curve-${curve}-tls13",
server => {
"Curves" => $curve,
"MaxProtocol" => "TLSv1.3"
},
client => {
"CipherString" => "ECDHE",
"MinProtocol" => "TLSv1.3",
"Curves" => $curve
},
test => {
"ExpectedResult" => "ClientFail"
},
};
}
} }
generate_tests(); generate_tests();