From 5b3c4485f18ce2738ac034446524e91c243e40d6 Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Fri, 12 Oct 2018 17:24:14 +0200 Subject: [PATCH 1/3] Unbreak SECLEVEL 3 regression causing it to not accept any ciphers. --- ssl/ssl_cert.c | 4 +-- test/recipes/80-test_ssl_new.t | 2 +- test/ssl-tests/28-seclevel.conf | 52 ++++++++++++++++++++++++++++++ test/ssl-tests/28-seclevel.conf.in | 29 +++++++++++++++++ 4 files changed, 84 insertions(+), 3 deletions(-) create mode 100644 test/ssl-tests/28-seclevel.conf create mode 100644 test/ssl-tests/28-seclevel.conf.in diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c index 52a4a7eaadd20..7d7357fb3a65f 100644 --- a/ssl/ssl_cert.c +++ b/ssl/ssl_cert.c @@ -951,8 +951,8 @@ static int ssl_security_default_callback(const SSL *s, const SSL_CTX *ctx, if (level >= 2 && c->algorithm_enc == SSL_RC4) return 0; /* Level 3: forward secure ciphersuites only */ - if (level >= 3 && (c->min_tls != TLS1_3_VERSION || - !(c->algorithm_mkey & (SSL_kEDH | SSL_kEECDH)))) + if (level >= 3 && c->min_tls != TLS1_3_VERSION && + !(c->algorithm_mkey & (SSL_kEDH | SSL_kEECDH))) return 0; break; } diff --git a/test/recipes/80-test_ssl_new.t b/test/recipes/80-test_ssl_new.t index e15d87eb46419..da8302d206bf3 100644 --- a/test/recipes/80-test_ssl_new.t +++ b/test/recipes/80-test_ssl_new.t @@ -28,7 +28,7 @@ map { s/\^// } @conf_files if $^O eq "VMS"; # We hard-code the number of tests to double-check that the globbing above # finds all files as expected. -plan tests => 27; # = scalar @conf_srcs +plan tests => 28; # = scalar @conf_srcs # Some test results depend on the configuration of enabled protocols. We only # verify generated sources in the default configuration. diff --git a/test/ssl-tests/28-seclevel.conf b/test/ssl-tests/28-seclevel.conf new file mode 100644 index 0000000000000..1a52dd3099c0f --- /dev/null +++ b/test/ssl-tests/28-seclevel.conf @@ -0,0 +1,52 @@ +# Generated with generate_ssl_tests.pl + +num_tests = 2 + +test-0 = 0-SECLEVEL 3 with default key +test-1 = 1-SECLEVEL 3 with ED448 key +# =========================================================== + +[0-SECLEVEL 3 with default key] +ssl_conf = 0-SECLEVEL 3 with default key-ssl + +[0-SECLEVEL 3 with default key-ssl] +server = 0-SECLEVEL 3 with default key-server +client = 0-SECLEVEL 3 with default key-client + +[0-SECLEVEL 3 with default key-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT:@SECLEVEL=3 +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[0-SECLEVEL 3 with default key-client] +CipherString = DEFAULT +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-0] +ExpectedResult = ServerFail + + +# =========================================================== + +[1-SECLEVEL 3 with ED448 key] +ssl_conf = 1-SECLEVEL 3 with ED448 key-ssl + +[1-SECLEVEL 3 with ED448 key-ssl] +server = 1-SECLEVEL 3 with ED448 key-server +client = 1-SECLEVEL 3 with ED448 key-client + +[1-SECLEVEL 3 with ED448 key-server] +Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +CipherString = DEFAULT:@SECLEVEL=3 +PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem + +[1-SECLEVEL 3 with ED448 key-client] +CipherString = DEFAULT +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-1] +ExpectedResult = Success + + diff --git a/test/ssl-tests/28-seclevel.conf.in b/test/ssl-tests/28-seclevel.conf.in new file mode 100644 index 0000000000000..c56366367e222 --- /dev/null +++ b/test/ssl-tests/28-seclevel.conf.in @@ -0,0 +1,29 @@ +# -*- mode: perl; -*- +# Copyright 2016-2016 The OpenSSL Project Authors. All Rights Reserved. +# +# Licensed under the OpenSSL license (the "License"). You may not use +# this file except in compliance with the License. You can obtain a copy +# in the file LICENSE in the source distribution or at +# https://www.openssl.org/source/license.html + + +## SSL test configurations + +package ssltests; + +our @tests = ( + { + name => "SECLEVEL 3 with default key", + server => { "CipherString" => "DEFAULT:\@SECLEVEL=3" }, + client => { }, + test => { "ExpectedResult" => "ServerFail" }, + }, + { + name => "SECLEVEL 3 with ED448 key", + server => { "CipherString" => "DEFAULT:\@SECLEVEL=3", + "Certificate" => test_pem("server-ed448-cert.pem"), + "PrivateKey" => test_pem("server-ed448-key.pem") }, + client => { }, + test => { "ExpectedResult" => "Success" }, + }, +); From c54633837ba96010f9ded04775e7d0423818abed Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Mon, 15 Oct 2018 10:02:44 +0200 Subject: [PATCH 2/3] fixup! Unbreak SECLEVEL 3 regression causing it to not accept any ciphers. --- test/ssl-tests/28-seclevel.conf | 27 ++++++++++++++++++++++++++- test/ssl-tests/28-seclevel.conf.in | 9 +++++++++ 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/test/ssl-tests/28-seclevel.conf b/test/ssl-tests/28-seclevel.conf index 1a52dd3099c0f..25565f4894746 100644 --- a/test/ssl-tests/28-seclevel.conf +++ b/test/ssl-tests/28-seclevel.conf @@ -1,9 +1,10 @@ # Generated with generate_ssl_tests.pl -num_tests = 2 +num_tests = 3 test-0 = 0-SECLEVEL 3 with default key test-1 = 1-SECLEVEL 3 with ED448 key +test-2 = 2-SECLEVEL 3 with ED448 key, TLSv1.2 # =========================================================== [0-SECLEVEL 3 with default key] @@ -50,3 +51,27 @@ VerifyMode = Peer ExpectedResult = Success +# =========================================================== + +[2-SECLEVEL 3 with ED448 key, TLSv1.2] +ssl_conf = 2-SECLEVEL 3 with ED448 key, TLSv1.2-ssl + +[2-SECLEVEL 3 with ED448 key, TLSv1.2-ssl] +server = 2-SECLEVEL 3 with ED448 key, TLSv1.2-server +client = 2-SECLEVEL 3 with ED448 key, TLSv1.2-client + +[2-SECLEVEL 3 with ED448 key, TLSv1.2-server] +Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +CipherString = DEFAULT:@SECLEVEL=3 +MaxProtocol = TLSv1.2 +PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem + +[2-SECLEVEL 3 with ED448 key, TLSv1.2-client] +CipherString = DEFAULT +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-2] +ExpectedResult = Success + + diff --git a/test/ssl-tests/28-seclevel.conf.in b/test/ssl-tests/28-seclevel.conf.in index c56366367e222..a68b8d58f6010 100644 --- a/test/ssl-tests/28-seclevel.conf.in +++ b/test/ssl-tests/28-seclevel.conf.in @@ -26,4 +26,13 @@ our @tests = ( client => { }, test => { "ExpectedResult" => "Success" }, }, + { + name => "SECLEVEL 3 with ED448 key, TLSv1.2", + server => { "CipherString" => "DEFAULT:\@SECLEVEL=3", + "Certificate" => test_pem("server-ed448-cert.pem"), + "PrivateKey" => test_pem("server-ed448-key.pem"), + "MaxProtocol" => "TLSv1.2" }, + client => { }, + test => { "ExpectedResult" => "Success" }, + }, ); From 2276d32ad8973d7c4ecb674f370fa8b521368b12 Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Mon, 15 Oct 2018 10:35:31 +0200 Subject: [PATCH 3/3] fixup! Unbreak SECLEVEL 3 regression causing it to not accept any ciphers. --- test/ssl-tests/28-seclevel.conf | 27 ++++++++++++++++++++++++++- test/ssl-tests/28-seclevel.conf.in | 10 ++++++++++ 2 files changed, 36 insertions(+), 1 deletion(-) diff --git a/test/ssl-tests/28-seclevel.conf b/test/ssl-tests/28-seclevel.conf index 25565f4894746..ddc2448f853a4 100644 --- a/test/ssl-tests/28-seclevel.conf +++ b/test/ssl-tests/28-seclevel.conf @@ -1,10 +1,11 @@ # Generated with generate_ssl_tests.pl -num_tests = 3 +num_tests = 4 test-0 = 0-SECLEVEL 3 with default key test-1 = 1-SECLEVEL 3 with ED448 key test-2 = 2-SECLEVEL 3 with ED448 key, TLSv1.2 +test-3 = 3-SECLEVEL 3 with P-384 key, X25519 ECDHE # =========================================================== [0-SECLEVEL 3 with default key] @@ -75,3 +76,27 @@ VerifyMode = Peer ExpectedResult = Success +# =========================================================== + +[3-SECLEVEL 3 with P-384 key, X25519 ECDHE] +ssl_conf = 3-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl + +[3-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl] +server = 3-SECLEVEL 3 with P-384 key, X25519 ECDHE-server +client = 3-SECLEVEL 3 with P-384 key, X25519 ECDHE-client + +[3-SECLEVEL 3 with P-384 key, X25519 ECDHE-server] +Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem +CipherString = DEFAULT:@SECLEVEL=3 +Groups = X25519 +PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem + +[3-SECLEVEL 3 with P-384 key, X25519 ECDHE-client] +CipherString = ECDHE:@SECLEVEL=3 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem +VerifyMode = Peer + +[test-3] +ExpectedResult = Success + + diff --git a/test/ssl-tests/28-seclevel.conf.in b/test/ssl-tests/28-seclevel.conf.in index a68b8d58f6010..5a1ee4638fd18 100644 --- a/test/ssl-tests/28-seclevel.conf.in +++ b/test/ssl-tests/28-seclevel.conf.in @@ -35,4 +35,14 @@ our @tests = ( client => { }, test => { "ExpectedResult" => "Success" }, }, + { + name => "SECLEVEL 3 with P-384 key, X25519 ECDHE", + server => { "CipherString" => "DEFAULT:\@SECLEVEL=3", + "Certificate" => test_pem("p384-server-cert.pem"), + "PrivateKey" => test_pem("p384-server-key.pem"), + "Groups" => "X25519" }, + client => { "CipherString" => "ECDHE:\@SECLEVEL=3", + "VerifyCAFile" => test_pem("p384-root.pem") }, + test => { "ExpectedResult" => "Success" }, + }, );