mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-02-04 06:40:03 +00:00
ssl-opt.sh: Add certificate key usage tests for TLS 1.3
Those are adaptations of the already existing TLS 1.2 tests. It is not really possible to just remove the TLS 1.2 dependency of the existing tests because of the following: . in TLS 1.3 the ciphersuite selection on server side is not related to the server certificate . for tests involving OpenSSL the OpenSSL command line as to be adapted to TLS 1.3 . server authentication is mandatory in TLS 1.3 . a key with KeyEncipherment and not DigitalSignature usage is never acceptable Signed-off-by: Ronald Cron <ronald.cron@arm.com>
This commit is contained in:
Ronald Cron
parent
903c979376
commit
d28f5a98f1
209
tests/ssl-opt.sh
209
tests/ssl-opt.sh
@ -6016,7 +6016,6 @@ run_test "keyUsage srv: RSA, digitalSignature -> (EC)DHE-RSA" \
|
||||
0 \
|
||||
-c "Ciphersuite is TLS-[EC]*DHE-RSA-WITH-"
|
||||
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "keyUsage srv: RSA, keyEncipherment -> RSA" \
|
||||
"$P_SRV key_file=data_files/server2.key \
|
||||
@ -6151,6 +6150,78 @@ run_test "keyUsage cli: DigitalSignature, RSA: fail, soft" \
|
||||
-c "Ciphersuite is TLS-" \
|
||||
-c "! Usage does not match the keyUsage extension"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "keyUsage cli 1.3: DigitalSignature+KeyEncipherment, RSA: OK" \
|
||||
"$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server2.key \
|
||||
-cert data_files/server2.ku-ds_ke.crt" \
|
||||
"$P_CLI debug_level=3" \
|
||||
0 \
|
||||
-C "bad certificate (usage extensions)" \
|
||||
-C "Processing of the Certificate handshake message failed" \
|
||||
-c "Ciphersuite is"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "keyUsage cli 1.3: KeyEncipherment, RSA: KO" \
|
||||
"$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server2.key \
|
||||
-cert data_files/server2.ku-ke.crt" \
|
||||
"$P_CLI debug_level=1" \
|
||||
1 \
|
||||
-c "bad certificate (usage extensions)" \
|
||||
-c "Processing of the Certificate handshake message failed" \
|
||||
-C "Ciphersuite is"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "keyUsage cli 1.3: KeyAgreement, RSA: KO" \
|
||||
"$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server2.key \
|
||||
-cert data_files/server2.ku-ka.crt" \
|
||||
"$P_CLI debug_level=1" \
|
||||
1 \
|
||||
-c "bad certificate (usage extensions)" \
|
||||
-c "Processing of the Certificate handshake message failed" \
|
||||
-C "Ciphersuite is"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "keyUsage cli 1.3: DigitalSignature, ECDSA: OK" \
|
||||
"$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \
|
||||
-cert data_files/server5.ku-ds.crt" \
|
||||
"$P_CLI debug_level=3" \
|
||||
0 \
|
||||
-C "bad certificate (usage extensions)" \
|
||||
-C "Processing of the Certificate handshake message failed" \
|
||||
-c "Ciphersuite is"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "keyUsage cli 1.3: KeyEncipherment, ECDSA: KO" \
|
||||
"$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \
|
||||
-cert data_files/server5.ku-ke.crt" \
|
||||
"$P_CLI debug_level=1" \
|
||||
1 \
|
||||
-c "bad certificate (usage extensions)" \
|
||||
-c "Processing of the Certificate handshake message failed" \
|
||||
-C "Ciphersuite is"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "keyUsage cli 1.3: KeyAgreement, ECDSA: KO" \
|
||||
"$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \
|
||||
-cert data_files/server5.ku-ka.crt" \
|
||||
"$P_CLI debug_level=1" \
|
||||
1 \
|
||||
-c "bad certificate (usage extensions)" \
|
||||
-c "Processing of the Certificate handshake message failed" \
|
||||
-C "Ciphersuite is"
|
||||
|
||||
# Tests for keyUsage in leaf certificates, part 3:
|
||||
# server-side checking of client cert
|
||||
|
||||
@ -6199,6 +6270,50 @@ run_test "keyUsage cli-auth: ECDSA, KeyAgreement: fail (soft)" \
|
||||
-s "bad certificate (usage extensions)" \
|
||||
-S "Processing of the Certificate handshake message failed"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "keyUsage cli-auth 1.3: RSA, DigitalSignature: OK" \
|
||||
"$P_SRV debug_level=1 auth_mode=optional" \
|
||||
"$O_NEXT_CLI_NO_CERT -key data_files/server2.key \
|
||||
-cert data_files/server2.ku-ds.crt" \
|
||||
0 \
|
||||
-S "bad certificate (usage extensions)" \
|
||||
-S "Processing of the Certificate handshake message failed"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "keyUsage cli-auth 1.3: RSA, KeyEncipherment: fail (soft)" \
|
||||
"$P_SRV debug_level=1 auth_mode=optional" \
|
||||
"$O_NEXT_CLI_NO_CERT -key data_files/server2.key \
|
||||
-cert data_files/server2.ku-ke.crt" \
|
||||
0 \
|
||||
-s "bad certificate (usage extensions)" \
|
||||
-S "Processing of the Certificate handshake message failed"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "keyUsage cli-auth 1.3: ECDSA, DigitalSignature: OK" \
|
||||
"$P_SRV debug_level=1 auth_mode=optional" \
|
||||
"$O_NEXT_CLI_NO_CERT -key data_files/server5.key \
|
||||
-cert data_files/server5.ku-ds.crt" \
|
||||
0 \
|
||||
-S "bad certificate (usage extensions)" \
|
||||
-S "Processing of the Certificate handshake message failed"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "keyUsage cli-auth 1.3: ECDSA, KeyAgreement: fail (soft)" \
|
||||
"$P_SRV debug_level=1 auth_mode=optional" \
|
||||
"$O_NEXT_CLI_NO_CERT -key data_files/server5.key \
|
||||
-cert data_files/server5.ku-ka.crt" \
|
||||
0 \
|
||||
-s "bad certificate (usage extensions)" \
|
||||
-S "Processing of the Certificate handshake message failed"
|
||||
|
||||
# Tests for extendedKeyUsage, part 1: server-side certificate/suite selection
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
@ -6271,6 +6386,54 @@ run_test "extKeyUsage cli: codeSign -> fail" \
|
||||
-c "Processing of the Certificate handshake message failed" \
|
||||
-C "Ciphersuite is TLS-"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "extKeyUsage cli 1.3: serverAuth -> OK" \
|
||||
"$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \
|
||||
-cert data_files/server5.eku-srv.crt" \
|
||||
"$P_CLI debug_level=1" \
|
||||
0 \
|
||||
-C "bad certificate (usage extensions)" \
|
||||
-C "Processing of the Certificate handshake message failed" \
|
||||
-c "Ciphersuite is"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "extKeyUsage cli 1.3: serverAuth,clientAuth -> OK" \
|
||||
"$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \
|
||||
-cert data_files/server5.eku-srv_cli.crt" \
|
||||
"$P_CLI debug_level=1" \
|
||||
0 \
|
||||
-C "bad certificate (usage extensions)" \
|
||||
-C "Processing of the Certificate handshake message failed" \
|
||||
-c "Ciphersuite is"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "extKeyUsage cli 1.3: codeSign,anyEKU -> OK" \
|
||||
"$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \
|
||||
-cert data_files/server5.eku-cs_any.crt" \
|
||||
"$P_CLI debug_level=1" \
|
||||
0 \
|
||||
-C "bad certificate (usage extensions)" \
|
||||
-C "Processing of the Certificate handshake message failed" \
|
||||
-c "Ciphersuite is"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "extKeyUsage cli 1.3: codeSign -> fail" \
|
||||
"$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \
|
||||
-cert data_files/server5.eku-cs.crt" \
|
||||
"$P_CLI debug_level=1" \
|
||||
1 \
|
||||
-c "bad certificate (usage extensions)" \
|
||||
-c "Processing of the Certificate handshake message failed" \
|
||||
-C "Ciphersuite is"
|
||||
|
||||
# Tests for extendedKeyUsage, part 3: server-side checking of client cert
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
@ -6318,6 +6481,50 @@ run_test "extKeyUsage cli-auth: codeSign -> fail (hard)" \
|
||||
-s "bad certificate (usage extensions)" \
|
||||
-s "Processing of the Certificate handshake message failed"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "extKeyUsage cli-auth 1.3: clientAuth -> OK" \
|
||||
"$P_SRV debug_level=1 auth_mode=optional" \
|
||||
"$O_NEXT_CLI_NO_CERT -key data_files/server5.key \
|
||||
-cert data_files/server5.eku-cli.crt" \
|
||||
0 \
|
||||
-S "bad certificate (usage extensions)" \
|
||||
-S "Processing of the Certificate handshake message failed"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "extKeyUsage cli-auth 1.3: serverAuth,clientAuth -> OK" \
|
||||
"$P_SRV debug_level=1 auth_mode=optional" \
|
||||
"$O_NEXT_CLI_NO_CERT -key data_files/server5.key \
|
||||
-cert data_files/server5.eku-srv_cli.crt" \
|
||||
0 \
|
||||
-S "bad certificate (usage extensions)" \
|
||||
-S "Processing of the Certificate handshake message failed"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "extKeyUsage cli-auth 1.3: codeSign,anyEKU -> OK" \
|
||||
"$P_SRV debug_level=1 auth_mode=optional" \
|
||||
"$O_NEXT_CLI_NO_CERT -key data_files/server5.key \
|
||||
-cert data_files/server5.eku-cs_any.crt" \
|
||||
0 \
|
||||
-S "bad certificate (usage extensions)" \
|
||||
-S "Processing of the Certificate handshake message failed"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
|
||||
requires_openssl_tls1_3
|
||||
requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "extKeyUsage cli-auth 1.3: codeSign -> fail (soft)" \
|
||||
"$P_SRV debug_level=1 auth_mode=optional" \
|
||||
"$O_NEXT_CLI_NO_CERT -key data_files/server5.key \
|
||||
-cert data_files/server5.eku-cs.crt" \
|
||||
0 \
|
||||
-s "bad certificate (usage extensions)" \
|
||||
-S "Processing of the Certificate handshake message failed"
|
||||
|
||||
# Tests for DHM parameters loading
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user