mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-03-25 04:43:32 +00:00
Change ffdh testing strategy
- Full tests generated by script only for ffdhe2048 group - Single G->m and m->G exchange test for each other group Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
This commit is contained in:
Przemek Stekiel
parent
7dda271c1d
commit
3484db4ce7
File diff suppressed because it is too large
Load Diff
@ -68,7 +68,6 @@ NAMED_GROUP_IANA_VALUE = {
|
||||
'x25519': 0x1d,
|
||||
'x448': 0x1e,
|
||||
'ffdhe2048': 0x100,
|
||||
'ffdhe8192': 0x104,
|
||||
}
|
||||
|
||||
|
||||
@ -149,7 +148,6 @@ class OpenSSLBase(TLSProgram):
|
||||
'x25519': 'X25519',
|
||||
'x448': 'X448',
|
||||
'ffdhe2048': 'ffdhe2048',
|
||||
'ffdhe8192': 'ffdhe8192',
|
||||
}
|
||||
|
||||
def cmd(self):
|
||||
@ -180,16 +178,11 @@ class OpenSSLBase(TLSProgram):
|
||||
ret = ["requires_openssl_tls1_3"]
|
||||
|
||||
# ffdh groups require at least openssl 3.0
|
||||
ffdh_groups = ['ffdhe2048', 'ffdhe8192']
|
||||
ffdh_groups = ['ffdhe2048']
|
||||
|
||||
if any(x in ffdh_groups for x in self._named_groups):
|
||||
ret = ["requires_openssl_tls1_3_with_ffdh"]
|
||||
|
||||
# ffdhe8192 has very long keys and requires intensive computation.
|
||||
# The test may fail on CI when executor is just very loaded. Give a second chance.
|
||||
if 'ffdhe8192' in self._named_groups:
|
||||
ret.append('client_needs_more_time 2')
|
||||
|
||||
return ret
|
||||
|
||||
|
||||
@ -263,7 +256,6 @@ class GnuTLSBase(TLSProgram):
|
||||
'x25519': ['GROUP-X25519'],
|
||||
'x448': ['GROUP-X448'],
|
||||
'ffdhe2048': ['GROUP-FFDHE2048'],
|
||||
'ffdhe8192': ['GROUP-FFDHE8192'],
|
||||
}
|
||||
|
||||
def pre_checks(self):
|
||||
@ -385,7 +377,7 @@ class MbedTLSBase(TLSProgram):
|
||||
'requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT')
|
||||
|
||||
ec_groups = ['secp256r1', 'secp384r1', 'secp521r1', 'x25519', 'x448']
|
||||
ffdh_groups = ['ffdhe2048', 'ffdhe8192']
|
||||
ffdh_groups = ['ffdhe2048']
|
||||
|
||||
if any(x in ec_groups for x in self._named_groups):
|
||||
ret.append('requires_config_enabled PSA_WANT_ALG_ECDH')
|
||||
|
||||
168
tests/ssl-opt.sh
168
tests/ssl-opt.sh
@ -13194,6 +13194,174 @@ run_test "TLS 1.3: NewSessionTicket: servername negative check, m->m" \
|
||||
-s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \
|
||||
-s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_SRV_C
|
||||
requires_config_enabled MBEDTLS_DEBUG_C
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||
requires_gnutls_tls1_3
|
||||
requires_gnutls_next_no_ticket
|
||||
requires_gnutls_next_disable_tls13_compat
|
||||
run_test "TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe3072,rsa_pss_rsae_sha256" \
|
||||
"$P_SRV crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe3072 tls13_kex_modes=ephemeral cookies=0 tickets=0" \
|
||||
"$G_NEXT_CLI_NO_CERT --debug=4 --single-key-share --x509cafile data_files/test-ca_cat12.crt --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE3072:+VERS-TLS1.3:%NO_TICKETS" \
|
||||
0 \
|
||||
-s "Protocol is TLSv1.3" \
|
||||
-s "server hello, chosen ciphersuite: TLS1-3-AES-128-GCM-SHA256 ( id=4865 )" \
|
||||
-s "received signature algorithm: 0x804" \
|
||||
-s "got named group: ffdhe3072(0101)" \
|
||||
-s "Certificate verification was skipped" \
|
||||
-C "received HelloRetryRequest message"
|
||||
|
||||
|
||||
requires_gnutls_tls1_3
|
||||
requires_gnutls_next_no_ticket
|
||||
requires_gnutls_next_disable_tls13_compat
|
||||
requires_config_enabled MBEDTLS_SSL_CLI_C
|
||||
requires_config_enabled MBEDTLS_DEBUG_C
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||
run_test "TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe3072,rsa_pss_rsae_sha256" \
|
||||
"$G_NEXT_SRV_NO_CERT --http --disable-client-cert --debug=4 --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE3072:+VERS-TLS1.3:%NO_TICKETS" \
|
||||
"$P_CLI ca_file=data_files/test-ca_cat12.crt debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe3072" \
|
||||
0 \
|
||||
-c "HTTP/1.0 200 OK" \
|
||||
-c "Protocol is TLSv1.3" \
|
||||
-c "server hello, chosen ciphersuite: ( 1301 ) - TLS1-3-AES-128-GCM-SHA256" \
|
||||
-c "Certificate Verify: Signature algorithm ( 0804 )" \
|
||||
-c "NamedGroup: ffdhe3072 ( 101 )" \
|
||||
-c "Verifying peer X.509 certificate... ok" \
|
||||
-C "received HelloRetryRequest message"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_SRV_C
|
||||
requires_config_enabled MBEDTLS_DEBUG_C
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||
requires_gnutls_tls1_3
|
||||
requires_gnutls_next_no_ticket
|
||||
requires_gnutls_next_disable_tls13_compat
|
||||
run_test "TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe4096,rsa_pss_rsae_sha256" \
|
||||
"$P_SRV crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe4096 tls13_kex_modes=ephemeral cookies=0 tickets=0" \
|
||||
"$G_NEXT_CLI_NO_CERT --debug=4 --single-key-share --x509cafile data_files/test-ca_cat12.crt --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE4096:+VERS-TLS1.3:%NO_TICKETS" \
|
||||
0 \
|
||||
-s "Protocol is TLSv1.3" \
|
||||
-s "server hello, chosen ciphersuite: TLS1-3-AES-128-GCM-SHA256 ( id=4865 )" \
|
||||
-s "received signature algorithm: 0x804" \
|
||||
-s "got named group: ffdhe4096(0102)" \
|
||||
-s "Certificate verification was skipped" \
|
||||
-C "received HelloRetryRequest message"
|
||||
|
||||
|
||||
requires_gnutls_tls1_3
|
||||
requires_gnutls_next_no_ticket
|
||||
requires_gnutls_next_disable_tls13_compat
|
||||
requires_config_enabled MBEDTLS_SSL_CLI_C
|
||||
requires_config_enabled MBEDTLS_DEBUG_C
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||
run_test "TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe4096,rsa_pss_rsae_sha256" \
|
||||
"$G_NEXT_SRV_NO_CERT --http --disable-client-cert --debug=4 --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE4096:+VERS-TLS1.3:%NO_TICKETS" \
|
||||
"$P_CLI ca_file=data_files/test-ca_cat12.crt debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe4096" \
|
||||
0 \
|
||||
-c "HTTP/1.0 200 OK" \
|
||||
-c "Protocol is TLSv1.3" \
|
||||
-c "server hello, chosen ciphersuite: ( 1301 ) - TLS1-3-AES-128-GCM-SHA256" \
|
||||
-c "Certificate Verify: Signature algorithm ( 0804 )" \
|
||||
-c "NamedGroup: ffdhe4096 ( 102 )" \
|
||||
-c "Verifying peer X.509 certificate... ok" \
|
||||
-C "received HelloRetryRequest message"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_SRV_C
|
||||
requires_config_enabled MBEDTLS_DEBUG_C
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||
requires_gnutls_tls1_3
|
||||
requires_gnutls_next_no_ticket
|
||||
requires_gnutls_next_disable_tls13_compat
|
||||
run_test "TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe6144,rsa_pss_rsae_sha256" \
|
||||
"$P_SRV crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe6144 tls13_kex_modes=ephemeral cookies=0 tickets=0" \
|
||||
"$G_NEXT_CLI_NO_CERT --debug=4 --single-key-share --x509cafile data_files/test-ca_cat12.crt --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE6144:+VERS-TLS1.3:%NO_TICKETS" \
|
||||
0 \
|
||||
-s "Protocol is TLSv1.3" \
|
||||
-s "server hello, chosen ciphersuite: TLS1-3-AES-128-GCM-SHA256 ( id=4865 )" \
|
||||
-s "received signature algorithm: 0x804" \
|
||||
-s "got named group: ffdhe6144(0103)" \
|
||||
-s "Certificate verification was skipped" \
|
||||
-C "received HelloRetryRequest message"
|
||||
|
||||
requires_gnutls_tls1_3
|
||||
requires_gnutls_next_no_ticket
|
||||
requires_gnutls_next_disable_tls13_compat
|
||||
requires_config_enabled MBEDTLS_SSL_CLI_C
|
||||
requires_config_enabled MBEDTLS_DEBUG_C
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||
run_test "TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe6144,rsa_pss_rsae_sha256" \
|
||||
"$G_NEXT_SRV_NO_CERT --http --disable-client-cert --debug=4 --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE6144:+VERS-TLS1.3:%NO_TICKETS" \
|
||||
"$P_CLI ca_file=data_files/test-ca_cat12.crt debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe6144" \
|
||||
0 \
|
||||
-c "HTTP/1.0 200 OK" \
|
||||
-c "Protocol is TLSv1.3" \
|
||||
-c "server hello, chosen ciphersuite: ( 1301 ) - TLS1-3-AES-128-GCM-SHA256" \
|
||||
-c "Certificate Verify: Signature algorithm ( 0804 )" \
|
||||
-c "NamedGroup: ffdhe6144 ( 103 )" \
|
||||
-c "Verifying peer X.509 certificate... ok" \
|
||||
-C "received HelloRetryRequest message"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_SRV_C
|
||||
requires_config_enabled MBEDTLS_DEBUG_C
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||
requires_gnutls_tls1_3
|
||||
requires_gnutls_next_no_ticket
|
||||
requires_gnutls_next_disable_tls13_compat
|
||||
client_needs_more_time 4
|
||||
run_test "TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe8192,rsa_pss_rsae_sha256" \
|
||||
"$P_SRV crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe8192 tls13_kex_modes=ephemeral cookies=0 tickets=0" \
|
||||
"$G_NEXT_CLI_NO_CERT --debug=4 --single-key-share --x509cafile data_files/test-ca_cat12.crt --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE8192:+VERS-TLS1.3:%NO_TICKETS" \
|
||||
0 \
|
||||
-s "Protocol is TLSv1.3" \
|
||||
-s "server hello, chosen ciphersuite: TLS1-3-AES-128-GCM-SHA256 ( id=4865 )" \
|
||||
-s "received signature algorithm: 0x804" \
|
||||
-s "got named group: ffdhe8192(0104)" \
|
||||
-s "Certificate verification was skipped" \
|
||||
-C "received HelloRetryRequest message"
|
||||
|
||||
requires_gnutls_tls1_3
|
||||
requires_gnutls_next_no_ticket
|
||||
requires_gnutls_next_disable_tls13_compat
|
||||
requires_config_enabled MBEDTLS_SSL_CLI_C
|
||||
requires_config_enabled MBEDTLS_DEBUG_C
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||
client_needs_more_time 4
|
||||
run_test "TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe8192,rsa_pss_rsae_sha256" \
|
||||
"$G_NEXT_SRV_NO_CERT --http --disable-client-cert --debug=4 --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE8192:+VERS-TLS1.3:%NO_TICKETS" \
|
||||
"$P_CLI ca_file=data_files/test-ca_cat12.crt debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe8192" \
|
||||
0 \
|
||||
-c "HTTP/1.0 200 OK" \
|
||||
-c "Protocol is TLSv1.3" \
|
||||
-c "server hello, chosen ciphersuite: ( 1301 ) - TLS1-3-AES-128-GCM-SHA256" \
|
||||
-c "Certificate Verify: Signature algorithm ( 0804 )" \
|
||||
-c "NamedGroup: ffdhe8192 ( 104 )" \
|
||||
-c "Verifying peer X.509 certificate... ok" \
|
||||
-C "received HelloRetryRequest message"
|
||||
|
||||
# Test heap memory usage after handshake
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
requires_config_enabled MBEDTLS_MEMORY_DEBUG
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user