mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-04-24 06:02:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Introduce a test for single signature algorithm correctness

Browse Source 
The value of the first sent signature algorithm is overwritten.
This test forces only a single algorithm to be sent and then
validates that the client received such algorithm.
04 03 is the expected value for SECP256R1_SHA256.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
This commit is contained in:
Andrzej Kurek 2022-11-15 10:21:50 -05:00 committed by Paul Elliott
parent 96a0fd951f
commit ec71b0937f
2 changed files with 22 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
library/ssl_tls12_client.c
View File

@ -2654,7 +2654,7 @@ static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
for( size_t i = 0; i < sig_alg_len; i += 2 ) for( size_t i = 0; i < sig_alg_len; i += 2 )
{ {
MBEDTLS_SSL_DEBUG_MSG( 3, MBEDTLS_SSL_DEBUG_MSG( 3,
( "Supported Signature Algorithm found: %d,%d", ( "Supported Signature Algorithm found: %02x %02x",
sig_alg[i], sig_alg[i + 1] ) ); sig_alg[i], sig_alg[i + 1] ) );
} }
#endif #endif

29
tests/ssl-opt.sh
View File

@ -2371,6 +2371,19 @@ run_test "Unique IV in GCM" \
-u "IV used" \ -u "IV used" \
-U "IV used" -U "IV used"
# Test for correctness of sent single supported algorithm
requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_DEBUG_C
requires_config_enabled MBEDTLS_SSL_CLI_C
requires_config_enabled MBEDTLS_ECDSA_C
requires_hash_alg SHA_256
run_test "Single supported algorithm sending" \
"$P_SRV sig_algs=ecdsa_secp256r1_sha256 auth_mode=required" \
"$P_CLI sig_algs=ecdsa_secp256r1_sha256 debug_level=3" \
0 \
-c "Supported Signature Algorithm found: 04 03"
# Tests for certificate verification callback # Tests for certificate verification callback
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "Configuration-specific CRT verification callback" \ run_test "Configuration-specific CRT verification callback" \
@ -5274,8 +5287,8 @@ run_test "Authentication: client SHA256, server required" \
key_file=data_files/server6.key \ key_file=data_files/server6.key \
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \
0 \ 0 \
-c "Supported Signature Algorithm found: 4," \ -c "Supported Signature Algorithm found: 04 " \
-c "Supported Signature Algorithm found: 5," -c "Supported Signature Algorithm found: 05 "
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
@ -5285,8 +5298,8 @@ run_test "Authentication: client SHA384, server required" \
key_file=data_files/server6.key \ key_file=data_files/server6.key \
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \
0 \ 0 \
-c "Supported Signature Algorithm found: 4," \ -c "Supported Signature Algorithm found: 04 " \
-c "Supported Signature Algorithm found: 5," -c "Supported Signature Algorithm found: 05 "
requires_key_exchange_with_cert_in_tls12_or_tls13_enabled requires_key_exchange_with_cert_in_tls12_or_tls13_enabled
run_test "Authentication: client has no cert, server required (TLS)" \ run_test "Authentication: client has no cert, server required (TLS)" \
@ -5687,8 +5700,8 @@ run_test "Authentication, CA callback: client SHA256, server required" \
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \
0 \ 0 \
-s "use CA callback for X.509 CRT verification" \ -s "use CA callback for X.509 CRT verification" \
-c "Supported Signature Algorithm found: 4," \ -c "Supported Signature Algorithm found: 04 " \
-c "Supported Signature Algorithm found: 5," -c "Supported Signature Algorithm found: 05 "
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
@ -5700,8 +5713,8 @@ run_test "Authentication, CA callback: client SHA384, server required" \
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \
0 \ 0 \
-s "use CA callback for X.509 CRT verification" \ -s "use CA callback for X.509 CRT verification" \
-c "Supported Signature Algorithm found: 4," \ -c "Supported Signature Algorithm found: 04 " \
-c "Supported Signature Algorithm found: 5," -c "Supported Signature Algorithm found: 05 "
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2