mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-03-27 23:37:08 +00:00
Change ffdh testing strategy
- Full tests generated by script only for ffdhe2048 group - Single G->m and m->G exchange test for each other group Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
This commit is contained in:
Przemek Stekiel
parent
7dda271c1d
commit
3484db4ce7
File diff suppressed because it is too large
Load Diff
@ -68,7 +68,6 @@ NAMED_GROUP_IANA_VALUE = {
|
|||||||
'x25519': 0x1d,
|
'x25519': 0x1d,
|
||||||
'x448': 0x1e,
|
'x448': 0x1e,
|
||||||
'ffdhe2048': 0x100,
|
'ffdhe2048': 0x100,
|
||||||
'ffdhe8192': 0x104,
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
@ -149,7 +148,6 @@ class OpenSSLBase(TLSProgram):
|
|||||||
'x25519': 'X25519',
|
'x25519': 'X25519',
|
||||||
'x448': 'X448',
|
'x448': 'X448',
|
||||||
'ffdhe2048': 'ffdhe2048',
|
'ffdhe2048': 'ffdhe2048',
|
||||||
'ffdhe8192': 'ffdhe8192',
|
|
||||||
}
|
}
|
||||||
|
|
||||||
def cmd(self):
|
def cmd(self):
|
||||||
@ -180,16 +178,11 @@ class OpenSSLBase(TLSProgram):
|
|||||||
ret = ["requires_openssl_tls1_3"]
|
ret = ["requires_openssl_tls1_3"]
|
||||||
|
|
||||||
# ffdh groups require at least openssl 3.0
|
# ffdh groups require at least openssl 3.0
|
||||||
ffdh_groups = ['ffdhe2048', 'ffdhe8192']
|
ffdh_groups = ['ffdhe2048']
|
||||||
|
|
||||||
if any(x in ffdh_groups for x in self._named_groups):
|
if any(x in ffdh_groups for x in self._named_groups):
|
||||||
ret = ["requires_openssl_tls1_3_with_ffdh"]
|
ret = ["requires_openssl_tls1_3_with_ffdh"]
|
||||||
|
|
||||||
# ffdhe8192 has very long keys and requires intensive computation.
|
|
||||||
# The test may fail on CI when executor is just very loaded. Give a second chance.
|
|
||||||
if 'ffdhe8192' in self._named_groups:
|
|
||||||
ret.append('client_needs_more_time 2')
|
|
||||||
|
|
||||||
return ret
|
return ret
|
||||||
|
|
||||||
|
|
||||||
@ -263,7 +256,6 @@ class GnuTLSBase(TLSProgram):
|
|||||||
'x25519': ['GROUP-X25519'],
|
'x25519': ['GROUP-X25519'],
|
||||||
'x448': ['GROUP-X448'],
|
'x448': ['GROUP-X448'],
|
||||||
'ffdhe2048': ['GROUP-FFDHE2048'],
|
'ffdhe2048': ['GROUP-FFDHE2048'],
|
||||||
'ffdhe8192': ['GROUP-FFDHE8192'],
|
|
||||||
}
|
}
|
||||||
|
|
||||||
def pre_checks(self):
|
def pre_checks(self):
|
||||||
@ -385,7 +377,7 @@ class MbedTLSBase(TLSProgram):
|
|||||||
'requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT')
|
'requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT')
|
||||||
|
|
||||||
ec_groups = ['secp256r1', 'secp384r1', 'secp521r1', 'x25519', 'x448']
|
ec_groups = ['secp256r1', 'secp384r1', 'secp521r1', 'x25519', 'x448']
|
||||||
ffdh_groups = ['ffdhe2048', 'ffdhe8192']
|
ffdh_groups = ['ffdhe2048']
|
||||||
|
|
||||||
if any(x in ec_groups for x in self._named_groups):
|
if any(x in ec_groups for x in self._named_groups):
|
||||||
ret.append('requires_config_enabled PSA_WANT_ALG_ECDH')
|
ret.append('requires_config_enabled PSA_WANT_ALG_ECDH')
|
||||||
|
|||||||
168
tests/ssl-opt.sh
168
tests/ssl-opt.sh
@ -13194,6 +13194,174 @@ run_test "TLS 1.3: NewSessionTicket: servername negative check, m->m" \
|
|||||||
-s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \
|
-s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \
|
||||||
-s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH"
|
-s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH"
|
||||||
|
|
||||||
|
requires_config_enabled MBEDTLS_SSL_SRV_C
|
||||||
|
requires_config_enabled MBEDTLS_DEBUG_C
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||||
|
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||||
|
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||||
|
requires_gnutls_tls1_3
|
||||||
|
requires_gnutls_next_no_ticket
|
||||||
|
requires_gnutls_next_disable_tls13_compat
|
||||||
|
run_test "TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe3072,rsa_pss_rsae_sha256" \
|
||||||
|
"$P_SRV crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe3072 tls13_kex_modes=ephemeral cookies=0 tickets=0" \
|
||||||
|
"$G_NEXT_CLI_NO_CERT --debug=4 --single-key-share --x509cafile data_files/test-ca_cat12.crt --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE3072:+VERS-TLS1.3:%NO_TICKETS" \
|
||||||
|
0 \
|
||||||
|
-s "Protocol is TLSv1.3" \
|
||||||
|
-s "server hello, chosen ciphersuite: TLS1-3-AES-128-GCM-SHA256 ( id=4865 )" \
|
||||||
|
-s "received signature algorithm: 0x804" \
|
||||||
|
-s "got named group: ffdhe3072(0101)" \
|
||||||
|
-s "Certificate verification was skipped" \
|
||||||
|
-C "received HelloRetryRequest message"
|
||||||
|
|
||||||
|
|
||||||
|
requires_gnutls_tls1_3
|
||||||
|
requires_gnutls_next_no_ticket
|
||||||
|
requires_gnutls_next_disable_tls13_compat
|
||||||
|
requires_config_enabled MBEDTLS_SSL_CLI_C
|
||||||
|
requires_config_enabled MBEDTLS_DEBUG_C
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||||
|
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||||
|
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||||
|
run_test "TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe3072,rsa_pss_rsae_sha256" \
|
||||||
|
"$G_NEXT_SRV_NO_CERT --http --disable-client-cert --debug=4 --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE3072:+VERS-TLS1.3:%NO_TICKETS" \
|
||||||
|
"$P_CLI ca_file=data_files/test-ca_cat12.crt debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe3072" \
|
||||||
|
0 \
|
||||||
|
-c "HTTP/1.0 200 OK" \
|
||||||
|
-c "Protocol is TLSv1.3" \
|
||||||
|
-c "server hello, chosen ciphersuite: ( 1301 ) - TLS1-3-AES-128-GCM-SHA256" \
|
||||||
|
-c "Certificate Verify: Signature algorithm ( 0804 )" \
|
||||||
|
-c "NamedGroup: ffdhe3072 ( 101 )" \
|
||||||
|
-c "Verifying peer X.509 certificate... ok" \
|
||||||
|
-C "received HelloRetryRequest message"
|
||||||
|
|
||||||
|
requires_config_enabled MBEDTLS_SSL_SRV_C
|
||||||
|
requires_config_enabled MBEDTLS_DEBUG_C
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||||
|
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||||
|
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||||
|
requires_gnutls_tls1_3
|
||||||
|
requires_gnutls_next_no_ticket
|
||||||
|
requires_gnutls_next_disable_tls13_compat
|
||||||
|
run_test "TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe4096,rsa_pss_rsae_sha256" \
|
||||||
|
"$P_SRV crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe4096 tls13_kex_modes=ephemeral cookies=0 tickets=0" \
|
||||||
|
"$G_NEXT_CLI_NO_CERT --debug=4 --single-key-share --x509cafile data_files/test-ca_cat12.crt --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE4096:+VERS-TLS1.3:%NO_TICKETS" \
|
||||||
|
0 \
|
||||||
|
-s "Protocol is TLSv1.3" \
|
||||||
|
-s "server hello, chosen ciphersuite: TLS1-3-AES-128-GCM-SHA256 ( id=4865 )" \
|
||||||
|
-s "received signature algorithm: 0x804" \
|
||||||
|
-s "got named group: ffdhe4096(0102)" \
|
||||||
|
-s "Certificate verification was skipped" \
|
||||||
|
-C "received HelloRetryRequest message"
|
||||||
|
|
||||||
|
|
||||||
|
requires_gnutls_tls1_3
|
||||||
|
requires_gnutls_next_no_ticket
|
||||||
|
requires_gnutls_next_disable_tls13_compat
|
||||||
|
requires_config_enabled MBEDTLS_SSL_CLI_C
|
||||||
|
requires_config_enabled MBEDTLS_DEBUG_C
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||||
|
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||||
|
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||||
|
run_test "TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe4096,rsa_pss_rsae_sha256" \
|
||||||
|
"$G_NEXT_SRV_NO_CERT --http --disable-client-cert --debug=4 --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE4096:+VERS-TLS1.3:%NO_TICKETS" \
|
||||||
|
"$P_CLI ca_file=data_files/test-ca_cat12.crt debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe4096" \
|
||||||
|
0 \
|
||||||
|
-c "HTTP/1.0 200 OK" \
|
||||||
|
-c "Protocol is TLSv1.3" \
|
||||||
|
-c "server hello, chosen ciphersuite: ( 1301 ) - TLS1-3-AES-128-GCM-SHA256" \
|
||||||
|
-c "Certificate Verify: Signature algorithm ( 0804 )" \
|
||||||
|
-c "NamedGroup: ffdhe4096 ( 102 )" \
|
||||||
|
-c "Verifying peer X.509 certificate... ok" \
|
||||||
|
-C "received HelloRetryRequest message"
|
||||||
|
|
||||||
|
requires_config_enabled MBEDTLS_SSL_SRV_C
|
||||||
|
requires_config_enabled MBEDTLS_DEBUG_C
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||||
|
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||||
|
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||||
|
requires_gnutls_tls1_3
|
||||||
|
requires_gnutls_next_no_ticket
|
||||||
|
requires_gnutls_next_disable_tls13_compat
|
||||||
|
run_test "TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe6144,rsa_pss_rsae_sha256" \
|
||||||
|
"$P_SRV crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe6144 tls13_kex_modes=ephemeral cookies=0 tickets=0" \
|
||||||
|
"$G_NEXT_CLI_NO_CERT --debug=4 --single-key-share --x509cafile data_files/test-ca_cat12.crt --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE6144:+VERS-TLS1.3:%NO_TICKETS" \
|
||||||
|
0 \
|
||||||
|
-s "Protocol is TLSv1.3" \
|
||||||
|
-s "server hello, chosen ciphersuite: TLS1-3-AES-128-GCM-SHA256 ( id=4865 )" \
|
||||||
|
-s "received signature algorithm: 0x804" \
|
||||||
|
-s "got named group: ffdhe6144(0103)" \
|
||||||
|
-s "Certificate verification was skipped" \
|
||||||
|
-C "received HelloRetryRequest message"
|
||||||
|
|
||||||
|
requires_gnutls_tls1_3
|
||||||
|
requires_gnutls_next_no_ticket
|
||||||
|
requires_gnutls_next_disable_tls13_compat
|
||||||
|
requires_config_enabled MBEDTLS_SSL_CLI_C
|
||||||
|
requires_config_enabled MBEDTLS_DEBUG_C
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||||
|
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||||
|
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||||
|
run_test "TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe6144,rsa_pss_rsae_sha256" \
|
||||||
|
"$G_NEXT_SRV_NO_CERT --http --disable-client-cert --debug=4 --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE6144:+VERS-TLS1.3:%NO_TICKETS" \
|
||||||
|
"$P_CLI ca_file=data_files/test-ca_cat12.crt debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe6144" \
|
||||||
|
0 \
|
||||||
|
-c "HTTP/1.0 200 OK" \
|
||||||
|
-c "Protocol is TLSv1.3" \
|
||||||
|
-c "server hello, chosen ciphersuite: ( 1301 ) - TLS1-3-AES-128-GCM-SHA256" \
|
||||||
|
-c "Certificate Verify: Signature algorithm ( 0804 )" \
|
||||||
|
-c "NamedGroup: ffdhe6144 ( 103 )" \
|
||||||
|
-c "Verifying peer X.509 certificate... ok" \
|
||||||
|
-C "received HelloRetryRequest message"
|
||||||
|
|
||||||
|
requires_config_enabled MBEDTLS_SSL_SRV_C
|
||||||
|
requires_config_enabled MBEDTLS_DEBUG_C
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||||
|
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||||
|
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||||
|
requires_gnutls_tls1_3
|
||||||
|
requires_gnutls_next_no_ticket
|
||||||
|
requires_gnutls_next_disable_tls13_compat
|
||||||
|
client_needs_more_time 4
|
||||||
|
run_test "TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe8192,rsa_pss_rsae_sha256" \
|
||||||
|
"$P_SRV crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe8192 tls13_kex_modes=ephemeral cookies=0 tickets=0" \
|
||||||
|
"$G_NEXT_CLI_NO_CERT --debug=4 --single-key-share --x509cafile data_files/test-ca_cat12.crt --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE8192:+VERS-TLS1.3:%NO_TICKETS" \
|
||||||
|
0 \
|
||||||
|
-s "Protocol is TLSv1.3" \
|
||||||
|
-s "server hello, chosen ciphersuite: TLS1-3-AES-128-GCM-SHA256 ( id=4865 )" \
|
||||||
|
-s "received signature algorithm: 0x804" \
|
||||||
|
-s "got named group: ffdhe8192(0104)" \
|
||||||
|
-s "Certificate verification was skipped" \
|
||||||
|
-C "received HelloRetryRequest message"
|
||||||
|
|
||||||
|
requires_gnutls_tls1_3
|
||||||
|
requires_gnutls_next_no_ticket
|
||||||
|
requires_gnutls_next_disable_tls13_compat
|
||||||
|
requires_config_enabled MBEDTLS_SSL_CLI_C
|
||||||
|
requires_config_enabled MBEDTLS_DEBUG_C
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||||||
|
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||||
|
requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT
|
||||||
|
requires_config_enabled PSA_WANT_ALG_FFDH
|
||||||
|
client_needs_more_time 4
|
||||||
|
run_test "TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe8192,rsa_pss_rsae_sha256" \
|
||||||
|
"$G_NEXT_SRV_NO_CERT --http --disable-client-cert --debug=4 --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE8192:+VERS-TLS1.3:%NO_TICKETS" \
|
||||||
|
"$P_CLI ca_file=data_files/test-ca_cat12.crt debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 curves=ffdhe8192" \
|
||||||
|
0 \
|
||||||
|
-c "HTTP/1.0 200 OK" \
|
||||||
|
-c "Protocol is TLSv1.3" \
|
||||||
|
-c "server hello, chosen ciphersuite: ( 1301 ) - TLS1-3-AES-128-GCM-SHA256" \
|
||||||
|
-c "Certificate Verify: Signature algorithm ( 0804 )" \
|
||||||
|
-c "NamedGroup: ffdhe8192 ( 104 )" \
|
||||||
|
-c "Verifying peer X.509 certificate... ok" \
|
||||||
|
-C "received HelloRetryRequest message"
|
||||||
|
|
||||||
# Test heap memory usage after handshake
|
# Test heap memory usage after handshake
|
||||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||||
requires_config_enabled MBEDTLS_MEMORY_DEBUG
|
requires_config_enabled MBEDTLS_MEMORY_DEBUG
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user