summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTomas Mraz <tomas@openssl.org>2024-04-17 18:05:35 +0200
committerTomas Mraz <tomas@openssl.org>2024-04-19 10:32:27 +0200
commit0977eac5655138318a60a459a0d8de108dc614b5 (patch)
tree25cfdd7821e917de9f438b0f19b252b1b4659a0b
parentfccd1615eea5f81f2a12b2fb953e6606edbc59c8 (diff)
Adjust tests that were depending on X25519 and X448 in fips
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24099)
-rw-r--r--test/quicapitest.c27
-rw-r--r--test/ssl-tests/14-curves.cnf.in8
-rw-r--r--test/ssl-tests/20-cert-select.cnf216
-rw-r--r--test/ssl-tests/20-cert-select.cnf.in70
-rw-r--r--test/ssl-tests/28-seclevel.cnf.in6
5 files changed, 168 insertions, 159 deletions
diff --git a/test/quicapitest.c b/test/quicapitest.c
index 8d2b871b91..227f6de8c8 100644
--- a/test/quicapitest.c
+++ b/test/quicapitest.c
@@ -496,21 +496,15 @@ static int compare_with_file(BIO *membio)
*/
static int test_ssl_trace(void)
{
- SSL_CTX *cctx = SSL_CTX_new_ex(libctx, NULL, OSSL_QUIC_client_method());
+ SSL_CTX *cctx = NULL;
SSL *clientquic = NULL;
QUIC_TSERVER *qtserv = NULL;
int testresult = 0;
- BIO *bio = BIO_new(BIO_s_mem());
-
- /*
- * Ensure we only configure ciphersuites that are available with both the
- * default and fips providers to get the same output in both cases
- */
- if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, "TLS_AES_128_GCM_SHA256")))
- goto err;
+ BIO *bio = NULL;
- if (!TEST_ptr(cctx)
- || !TEST_ptr(bio)
+ if (!TEST_ptr(cctx = SSL_CTX_new_ex(libctx, NULL, OSSL_QUIC_client_method()))
+ || !TEST_ptr(bio = BIO_new(BIO_s_mem()))
+ || !TEST_true(SSL_CTX_set_ciphersuites(cctx, "TLS_AES_128_GCM_SHA256"))
|| !TEST_true(qtest_create_quic_objects(libctx, cctx, NULL, cert,
privkey,
QTEST_FLAG_FAKE_TIME,
@@ -524,8 +518,15 @@ static int test_ssl_trace(void)
if (!TEST_true(qtest_create_quic_connection(qtserv, clientquic)))
goto err;
- if (!TEST_true(compare_with_file(bio)))
- goto err;
+ /* Skip the comparison of the trace when the fips provider is used. */
+ if (is_fips) {
+ /* Check whether there was something written. */
+ if (!TEST_int_gt(BIO_pending(bio), 0))
+ goto err;
+ } else {
+ if (!TEST_true(compare_with_file(bio)))
+ goto err;
+ }
testresult = 1;
err:
diff --git a/test/ssl-tests/14-curves.cnf.in b/test/ssl-tests/14-curves.cnf.in
index 09b01e4acb..e6c048e8dd 100644
--- a/test/ssl-tests/14-curves.cnf.in
+++ b/test/ssl-tests/14-curves.cnf.in
@@ -12,8 +12,12 @@ use OpenSSL::Test::Utils qw(anydisabled);
our $fips_mode;
-my @curves = ("prime256v1", "secp384r1", "secp521r1", "X25519",
- "X448");
+my @curves = ("prime256v1", "secp384r1", "secp521r1");
+
+my @curves_no_fips = ("X25519", "X448");
+
+push @curves, @curves_no_fips if !$fips_mode;
+
#Curves *only* suitable for use in TLSv1.3
my @curves_tls_1_3 = ("ffdhe2048", "ffdhe3072", "ffdhe4096", "ffdhe6144",
"ffdhe8192");
diff --git a/test/ssl-tests/20-cert-select.cnf b/test/ssl-tests/20-cert-select.cnf
index 51d38b9b61..546b9ce091 100644
--- a/test/ssl-tests/20-cert-select.cnf
+++ b/test/ssl-tests/20-cert-select.cnf
@@ -19,12 +19,12 @@ test-13 = 13-Suite B P-256 Hash Algorithm Selection
test-14 = 14-Suite B P-384 Hash Algorithm Selection
test-15 = 15-Ed25519 CipherString and Signature Algorithm Selection
test-16 = 16-Ed448 CipherString and Signature Algorithm Selection
-test-17 = 17-Ed25519 CipherString and Curves Selection
-test-18 = 18-Ed448 CipherString and Curves Selection
-test-19 = 19-TLS 1.2 Ed25519 Client Auth
-test-20 = 20-TLS 1.2 Ed448 Client Auth
-test-21 = 21-ECDSA Signature Algorithm Selection SHA1
-test-22 = 22-ECDSA with brainpool
+test-17 = 17-TLS 1.2 Ed25519 Client Auth
+test-18 = 18-TLS 1.2 Ed448 Client Auth
+test-19 = 19-ECDSA Signature Algorithm Selection SHA1
+test-20 = 20-ECDSA with brainpool
+test-21 = 21-Ed25519 CipherString and Curves Selection
+test-22 = 22-Ed448 CipherString and Curves Selection
test-23 = 23-RSA-PSS Certificate CipherString Selection
test-24 = 24-RSA-PSS Certificate Legacy Signature Algorithm Selection
test-25 = 25-RSA-PSS Certificate Unified Signature Algorithm Selection
@@ -602,91 +602,21 @@ ExpectedServerSignType = Ed448
# ===========================================================
-[17-Ed25519 CipherString and Curves Selection]
-ssl_conf = 17-Ed25519 CipherString and Curves Selection-ssl
+[17-TLS 1.2 Ed25519 Client Auth]
+ssl_conf = 17-TLS 1.2 Ed25519 Client Auth-ssl
-[17-Ed25519 CipherString and Curves Selection-ssl]
-server = 17-Ed25519 CipherString and Curves Selection-server
-client = 17-Ed25519 CipherString and Curves Selection-client
+[17-TLS 1.2 Ed25519 Client Auth-ssl]
+server = 17-TLS 1.2 Ed25519 Client Auth-server
+client = 17-TLS 1.2 Ed25519 Client Auth-client
-[17-Ed25519 CipherString and Curves Selection-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
-Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
-Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
-Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
-Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
-MaxProtocol = TLSv1.2
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[17-Ed25519 CipherString and Curves Selection-client]
-CipherString = aECDSA
-Curves = X25519
-MaxProtocol = TLSv1.2
-SignatureAlgorithms = ECDSA+SHA256:ed25519
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
-VerifyMode = Peer
-
-[test-17]
-ExpectedResult = Success
-ExpectedServerCertType = Ed25519
-ExpectedServerSignType = Ed25519
-
-
-# ===========================================================
-
-[18-Ed448 CipherString and Curves Selection]
-ssl_conf = 18-Ed448 CipherString and Curves Selection-ssl
-
-[18-Ed448 CipherString and Curves Selection-ssl]
-server = 18-Ed448 CipherString and Curves Selection-server
-client = 18-Ed448 CipherString and Curves Selection-client
-
-[18-Ed448 CipherString and Curves Selection-server]
-Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
-CipherString = DEFAULT
-ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
-ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
-Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
-Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
-Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
-Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
-MaxProtocol = TLSv1.2
-PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-
-[18-Ed448 CipherString and Curves Selection-client]
-CipherString = aECDSA
-Curves = X448
-MaxProtocol = TLSv1.2
-SignatureAlgorithms = ECDSA+SHA256:ed448
-VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
-VerifyMode = Peer
-
-[test-18]
-ExpectedResult = Success
-ExpectedServerCertType = Ed448
-ExpectedServerSignType = Ed448
-
-
-# ===========================================================
-
-[19-TLS 1.2 Ed25519 Client Auth]
-ssl_conf = 19-TLS 1.2 Ed25519 Client Auth-ssl
-
-[19-TLS 1.2 Ed25519 Client Auth-ssl]
-server = 19-TLS 1.2 Ed25519 Client Auth-server
-client = 19-TLS 1.2 Ed25519 Client Auth-client
-
-[19-TLS 1.2 Ed25519 Client Auth-server]
+[17-TLS 1.2 Ed25519 Client Auth-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
-[19-TLS 1.2 Ed25519 Client Auth-client]
+[17-TLS 1.2 Ed25519 Client Auth-client]
CipherString = DEFAULT
Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem
@@ -695,7 +625,7 @@ MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-19]
+[test-17]
ExpectedClientCertType = Ed25519
ExpectedClientSignType = Ed25519
ExpectedResult = Success
@@ -703,21 +633,21 @@ ExpectedResult = Success
# ===========================================================
-[20-TLS 1.2 Ed448 Client Auth]
-ssl_conf = 20-TLS 1.2 Ed448 Client Auth-ssl
+[18-TLS 1.2 Ed448 Client Auth]
+ssl_conf = 18-TLS 1.2 Ed448 Client Auth-ssl
-[20-TLS 1.2 Ed448 Client Auth-ssl]
-server = 20-TLS 1.2 Ed448 Client Auth-server
-client = 20-TLS 1.2 Ed448 Client Auth-client
+[18-TLS 1.2 Ed448 Client Auth-ssl]
+server = 18-TLS 1.2 Ed448 Client Auth-server
+client = 18-TLS 1.2 Ed448 Client Auth-client
-[20-TLS 1.2 Ed448 Client Auth-server]
+[18-TLS 1.2 Ed448 Client Auth-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
-[20-TLS 1.2 Ed448 Client Auth-client]
+[18-TLS 1.2 Ed448 Client Auth-client]
CipherString = DEFAULT
Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem
Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem
@@ -726,7 +656,7 @@ MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-20]
+[test-18]
ExpectedClientCertType = Ed448
ExpectedClientSignType = Ed448
ExpectedResult = Success
@@ -734,14 +664,14 @@ ExpectedResult = Success
# ===========================================================
-[21-ECDSA Signature Algorithm Selection SHA1]
-ssl_conf = 21-ECDSA Signature Algorithm Selection SHA1-ssl
+[19-ECDSA Signature Algorithm Selection SHA1]
+ssl_conf = 19-ECDSA Signature Algorithm Selection SHA1-ssl
-[21-ECDSA Signature Algorithm Selection SHA1-ssl]
-server = 21-ECDSA Signature Algorithm Selection SHA1-server
-client = 21-ECDSA Signature Algorithm Selection SHA1-client
+[19-ECDSA Signature Algorithm Selection SHA1-ssl]
+server = 19-ECDSA Signature Algorithm Selection SHA1-server
+client = 19-ECDSA Signature Algorithm Selection SHA1-client
-[21-ECDSA Signature Algorithm Selection SHA1-server]
+[19-ECDSA Signature Algorithm Selection SHA1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT:@SECLEVEL=0
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -753,13 +683,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
-[21-ECDSA Signature Algorithm Selection SHA1-client]
+[19-ECDSA Signature Algorithm Selection SHA1-client]
CipherString = DEFAULT:@SECLEVEL=0
SignatureAlgorithms = ECDSA+SHA1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-21]
+[test-19]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA1
@@ -768,20 +698,20 @@ ExpectedServerSignType = EC
# ===========================================================
-[22-ECDSA with brainpool]
-ssl_conf = 22-ECDSA with brainpool-ssl
+[20-ECDSA with brainpool]
+ssl_conf = 20-ECDSA with brainpool-ssl
-[22-ECDSA with brainpool-ssl]
-server = 22-ECDSA with brainpool-server
-client = 22-ECDSA with brainpool-client
+[20-ECDSA with brainpool-ssl]
+server = 20-ECDSA with brainpool-server
+client = 20-ECDSA with brainpool-client
-[22-ECDSA with brainpool-server]
+[20-ECDSA with brainpool-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-cert.pem
CipherString = DEFAULT
Groups = brainpoolP256r1
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-key.pem
-[22-ECDSA with brainpool-client]
+[20-ECDSA with brainpool-client]
CipherString = aECDSA
Groups = brainpoolP256r1
MaxProtocol = TLSv1.2
@@ -789,7 +719,7 @@ RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
-[test-22]
+[test-20]
ExpectedResult = Success
ExpectedServerCANames = empty
ExpectedServerCertType = brainpoolP256r1
@@ -798,6 +728,76 @@ ExpectedServerSignType = EC
# ===========================================================
+[21-Ed25519 CipherString and Curves Selection]
+ssl_conf = 21-Ed25519 CipherString and Curves Selection-ssl
+
+[21-Ed25519 CipherString and Curves Selection-ssl]
+server = 21-Ed25519 CipherString and Curves Selection-server
+client = 21-Ed25519 CipherString and Curves Selection-client
+
+[21-Ed25519 CipherString and Curves Selection-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
+Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
+Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
+Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
+Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
+MaxProtocol = TLSv1.2
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[21-Ed25519 CipherString and Curves Selection-client]
+CipherString = aECDSA
+Curves = X25519
+MaxProtocol = TLSv1.2
+SignatureAlgorithms = ECDSA+SHA256:ed25519
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-21]
+ExpectedResult = Success
+ExpectedServerCertType = Ed25519
+ExpectedServerSignType = Ed25519
+
+
+# ===========================================================
+
+[22-Ed448 CipherString and Curves Selection]
+ssl_conf = 22-Ed448 CipherString and Curves Selection-ssl
+
+[22-Ed448 CipherString and Curves Selection-ssl]
+server = 22-Ed448 CipherString and Curves Selection-server
+client = 22-Ed448 CipherString and Curves Selection-client
+
+[22-Ed448 CipherString and Curves Selection-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
+ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
+Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
+Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
+Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
+Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
+MaxProtocol = TLSv1.2
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[22-Ed448 CipherString and Curves Selection-client]
+CipherString = aECDSA
+Curves = X448
+MaxProtocol = TLSv1.2
+SignatureAlgorithms = ECDSA+SHA256:ed448
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
+VerifyMode = Peer
+
+[test-22]
+ExpectedResult = Success
+ExpectedServerCertType = Ed448
+ExpectedServerSignType = Ed448
+
+
+# ===========================================================
+
[23-RSA-PSS Certificate CipherString Selection]
ssl_conf = 23-RSA-PSS Certificate CipherString Selection-ssl
diff --git a/test/ssl-tests/20-cert-select.cnf.in b/test/ssl-tests/20-cert-select.cnf.in
index b8e689d565..6c9db7a907 100644
--- a/test/ssl-tests/20-cert-select.cnf.in
+++ b/test/ssl-tests/20-cert-select.cnf.in
@@ -329,41 +329,6 @@ our @tests = (
},
},
{
- name => "Ed25519 CipherString and Curves Selection",
- server => $server,
- client => {
- "CipherString" => "aECDSA",
- "MaxProtocol" => "TLSv1.2",
- "SignatureAlgorithms" => "ECDSA+SHA256:ed25519",
- # Excluding P-256 from the supported curves list means server
- # certificate should be Ed25519 and not P-256
- "Curves" => "X25519"
- },
- test => {
- "ExpectedServerCertType" =>, "Ed25519",
- "ExpectedServerSignType" =>, "Ed25519",
- "ExpectedResult" => "Success"
- },
- },
- {
- name => "Ed448 CipherString and Curves Selection",
- server => $server,
- client => {
- "CipherString" => "aECDSA",
- "MaxProtocol" => "TLSv1.2",
- "SignatureAlgorithms" => "ECDSA+SHA256:ed448",
- "VerifyCAFile" => test_pem("root-ed448-cert.pem"),
- # Excluding P-256 from the supported curves list means server
- # certificate should be Ed25519 and not P-256
- "Curves" => "X448"
- },
- test => {
- "ExpectedServerCertType" =>, "Ed448",
- "ExpectedServerSignType" =>, "Ed448",
- "ExpectedResult" => "Success"
- },
- },
- {
name => "TLS 1.2 Ed25519 Client Auth",
server => {
"VerifyCAFile" => test_pem("root-cert.pem"),
@@ -446,6 +411,41 @@ my @tests_non_fips = (
"ExpectedResult" => "Success"
},
},
+ {
+ name => "Ed25519 CipherString and Curves Selection",
+ server => $server,
+ client => {
+ "CipherString" => "aECDSA",
+ "MaxProtocol" => "TLSv1.2",
+ "SignatureAlgorithms" => "ECDSA+SHA256:ed25519",
+ # Excluding P-256 from the supported curves list means server
+ # certificate should be Ed25519 and not P-256
+ "Curves" => "X25519"
+ },
+ test => {
+ "ExpectedServerCertType" =>, "Ed25519",
+ "ExpectedServerSignType" =>, "Ed25519",
+ "ExpectedResult" => "Success"
+ },
+ },
+ {
+ name => "Ed448 CipherString and Curves Selection",
+ server => $server,
+ client => {
+ "CipherString" => "aECDSA",
+ "MaxProtocol" => "TLSv1.2",
+ "SignatureAlgorithms" => "ECDSA+SHA256:ed448",
+ "VerifyCAFile" => test_pem("root-ed448-cert.pem"),
+ # Excluding P-256 from the supported curves list means server
+ # certificate should be Ed25519 and not P-256
+ "Curves" => "X448"
+ },
+ test => {
+ "ExpectedServerCertType" =>, "Ed448",
+ "ExpectedServerSignType" =>, "Ed448",
+ "ExpectedResult" => "Success"
+ },
+ },
);
my @tests_pss = (
diff --git a/test/ssl-tests/28-seclevel.cnf.in b/test/ssl-tests/28-seclevel.cnf.in
index 9204f215e5..789817cc9a 100644
--- a/test/ssl-tests/28-seclevel.cnf.in
+++ b/test/ssl-tests/28-seclevel.cnf.in
@@ -56,7 +56,10 @@ our @tests_ec = (
client => { "CipherString" => "DEFAULT:\@SECLEVEL=5",
"VerifyCAFile" => test_pem("root-ed448-cert.pem") },
test => { "ExpectedResult" => "ServerFail" },
- },
+ }
+);
+
+our @tests_ec_non_fips = (
{
name => "SECLEVEL 3 with P-384 key, X25519 ECDHE",
server => { "CipherString" => "DEFAULT:\@SECLEVEL=3",
@@ -81,5 +84,6 @@ our @tests_tls1_2 = (
},
);
+push @tests_ec, @tests_ec_non_fips unless $fips_mode;
push @tests, @tests_ec unless disabled("ecx");
push @tests, @tests_tls1_2 unless disabled("tls1_2") || disabled("ecx");