From 4e8ff4f010f95ca5d6e36e5e0659d4a7d0f61d35 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Mon, 24 Mar 2014 17:17:50 +0100 Subject: [PATCH 01/10] unit-tests: Prevent a failing worker thread to go wild after it fails A worker raises SIGUSR1 to inform the main thread that the test fails. The main thread then starts cancelling workers, but the offending thread should be terminated immediately to prevent it from test continuation. --- src/libstrongswan/tests/test_suite.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/libstrongswan/tests/test_suite.c b/src/libstrongswan/tests/test_suite.c index 0f2e74b7c..fb40b05c1 100644 --- a/src/libstrongswan/tests/test_suite.c +++ b/src/libstrongswan/tests/test_suite.c @@ -136,7 +136,8 @@ static inline void test_failure() else { pthread_kill(main_thread, SIGUSR1); - /* how can we stop just the thread? longjmp to a restore point? */ + /* terminate thread to prevent it from going wild */ + pthread_exit(NULL); } } From 70889c42a6f6fd1709b074c5468d3ce1669f1aa3 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 25 Mar 2014 14:14:37 +0100 Subject: [PATCH 02/10] unit-tests: Catch timeouts during test runner deinit function The test runner deinit function often cancels all threads from the pool. This operation might hang on error conditions, hence we should include that hook in the test timeout to fail properly. --- src/libstrongswan/tests/test_runner.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/src/libstrongswan/tests/test_runner.c b/src/libstrongswan/tests/test_runner.c index 6bb1b290c..5ec4198e7 100644 --- a/src/libstrongswan/tests/test_runner.c +++ b/src/libstrongswan/tests/test_runner.c @@ -315,7 +315,7 @@ static void sum_leaks(report_data_t *data, int count, size_t bytes, * Do library cleanup and optionally check for memory leaks */ static bool post_test(test_runner_init_t init, bool check_leaks, - array_t *failures, char *name, int i) + array_t *failures, char *name, int i, int *leaks) { report_data_t data = { .failures = failures, @@ -325,7 +325,15 @@ static bool post_test(test_runner_init_t init, bool check_leaks, if (init) { - init(FALSE); + if (test_restore_point()) + { + init(FALSE); + } + else + { + library_deinit(); + return FALSE; + } } if (check_leaks && lib->leak_detective) { @@ -335,7 +343,8 @@ static bool post_test(test_runner_init_t init, bool check_leaks, } library_deinit(); - return data.leaks != 0; + *leaks = data.leaks; + return TRUE; } /** @@ -407,7 +416,8 @@ static bool run_case(test_case_t *tcase, test_runner_init_t init) { if (pre_test(init)) { - bool ok = FALSE, leaks = FALSE; + bool ok = FALSE; + int leaks = 0; test_setup_timeout(tcase->timeout); @@ -424,9 +434,11 @@ static bool run_case(test_case_t *tcase, test_runner_init_t init) { call_fixture(tcase, FALSE); } - } - leaks = post_test(init, ok, failures, tfun->name, i); + if (!post_test(init, ok, failures, tfun->name, i, &leaks)) + { + ok = FALSE; + } test_setup_timeout(0); From c0efaaebe36c0aa896952355e04b8e36ecbd051b Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Mon, 24 Mar 2014 13:47:03 +0100 Subject: [PATCH 03/10] tls: Create a unit-test runner --- configure.ac | 1 + src/libtls/Makefile.am | 2 ++ src/libtls/tests/.gitignore | 1 + src/libtls/tests/Makefile.am | 19 ++++++++++++ src/libtls/tests/tls_tests.c | 57 ++++++++++++++++++++++++++++++++++++ src/libtls/tests/tls_tests.h | 14 +++++++++ 6 files changed, 94 insertions(+) create mode 100644 src/libtls/tests/.gitignore create mode 100644 src/libtls/tests/Makefile.am create mode 100644 src/libtls/tests/tls_tests.c create mode 100644 src/libtls/tests/tls_tests.h diff --git a/configure.ac b/configure.ac index e8eb5a67c..f57410b62 100644 --- a/configure.ac +++ b/configure.ac @@ -1495,6 +1495,7 @@ AC_CONFIG_FILES([ src/libipsec/Makefile src/libsimaka/Makefile src/libtls/Makefile + src/libtls/tests/Makefile src/libradius/Makefile src/libtncif/Makefile src/libtnccs/Makefile diff --git a/src/libtls/Makefile.am b/src/libtls/Makefile.am index e5e3b8be9..d565a1479 100644 --- a/src/libtls/Makefile.am +++ b/src/libtls/Makefile.am @@ -21,3 +21,5 @@ nobase_tls_include_HEADERS = \ tls_crypto.h tls_prf.h tls_socket.h tls_eap.h tls_cache.h tls_peer.h \ tls_server.h tls_handshake.h tls_application.h tls_aead.h tls.h endif + +SUBDIRS = . tests diff --git a/src/libtls/tests/.gitignore b/src/libtls/tests/.gitignore new file mode 100644 index 000000000..f9c77cf4e --- /dev/null +++ b/src/libtls/tests/.gitignore @@ -0,0 +1 @@ +tls_tests diff --git a/src/libtls/tests/Makefile.am b/src/libtls/tests/Makefile.am new file mode 100644 index 000000000..11ea9f073 --- /dev/null +++ b/src/libtls/tests/Makefile.am @@ -0,0 +1,19 @@ +TESTS = tls_tests + +check_PROGRAMS = $(TESTS) + +tls_tests_SOURCES = \ + tls_tests.h tls_tests.c + +tls_tests_CFLAGS = \ + -I$(top_srcdir)/src/libtls \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libstrongswan/tests \ + -DPLUGINDIR=\""$(top_builddir)/src/libstrongswan/plugins\"" \ + -DPLUGINS=\""${s_plugins}\"" \ + @COVERAGE_CFLAGS@ + +tls_tests_LDFLAGS = @COVERAGE_LDFLAGS@ +tls_tests_LDADD = \ + $(top_builddir)/src/libtls/libtls.la \ + $(top_builddir)/src/libstrongswan/tests/libtest.la diff --git a/src/libtls/tests/tls_tests.c b/src/libtls/tests/tls_tests.c new file mode 100644 index 000000000..2c2c5bacc --- /dev/null +++ b/src/libtls/tests/tls_tests.c @@ -0,0 +1,57 @@ +/* + * Copyright (C) 2014 Martin Willi + * Copyright (C) 2014 revosec AG + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See . + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include + +/* declare test suite constructors */ +#define TEST_SUITE(x) test_suite_t* x(); +#define TEST_SUITE_DEPEND(x, ...) TEST_SUITE(x) +#include "tls_tests.h" +#undef TEST_SUITE +#undef TEST_SUITE_DEPEND + +static test_configuration_t tests[] = { +#define TEST_SUITE(x) \ + { .suite = x, }, +#define TEST_SUITE_DEPEND(x, type, args) \ + { .suite = x, .feature = PLUGIN_DEPENDS(type, args) }, +#include "tls_tests.h" + { .suite = NULL, } +}; + +static bool test_runner_init(bool init) +{ + if (init) + { + plugin_loader_add_plugindirs(PLUGINDIR, PLUGINS); + if (!lib->plugins->load(lib->plugins, PLUGINS)) + { + return FALSE; + } + } + else + { + lib->credmgr->flush_cache(lib->credmgr, CERT_ANY); + lib->processor->set_threads(lib->processor, 0); + lib->processor->cancel(lib->processor); + lib->plugins->unload(lib->plugins); + } + return TRUE; +} + +int main(int argc, char *argv[]) +{ + return test_runner_run("libtls", tests, test_runner_init); +} diff --git a/src/libtls/tests/tls_tests.h b/src/libtls/tests/tls_tests.h new file mode 100644 index 000000000..05502f18e --- /dev/null +++ b/src/libtls/tests/tls_tests.h @@ -0,0 +1,14 @@ +/* + * Copyright (C) 2014 Martin Willi + * Copyright (C) 2014 revosec AG + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See . + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ From ac5717c9e914edf89ede26ad1d0cbdf16004a6cb Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Mon, 24 Mar 2014 14:28:50 +0100 Subject: [PATCH 04/10] tls: Export a function to list supported TLS cipher suites --- src/libtls/tls_crypto.c | 75 +++++++++++++++++++++++++++++++---------- src/libtls/tls_crypto.h | 9 +++++ 2 files changed, 66 insertions(+), 18 deletions(-) diff --git a/src/libtls/tls_crypto.c b/src/libtls/tls_crypto.c index b3f9ae9e3..6addad8fe 100644 --- a/src/libtls/tls_crypto.c +++ b/src/libtls/tls_crypto.c @@ -648,8 +648,7 @@ static suite_algs_t *find_suite(tls_cipher_suite_t suite) /** * Filter a suite list using a transform enumerator */ -static void filter_suite(private_tls_crypto_t *this, - suite_algs_t suites[], int *count, int offset, +static void filter_suite(suite_algs_t suites[], int *count, int offset, enumerator_t*(*create_enumerator)(crypto_factory_t*)) { const char *plugin_name; @@ -721,8 +720,7 @@ static void filter_suite(private_tls_crypto_t *this, /** * Purge NULL encryption cipher suites from list */ -static void filter_null_suites(private_tls_crypto_t *this, - suite_algs_t suites[], int *count) +static void filter_null_suites(suite_algs_t suites[], int *count) { int i, remaining = 0; @@ -974,6 +972,26 @@ static void filter_specific_config_suites(private_tls_crypto_t *this, } } +/** + * Filter out unsupported suites on given suite array + */ +static void filter_unsupported_suites(suite_algs_t suites[], int *count) +{ + /* filter suite list by each algorithm */ + filter_suite(suites, count, offsetof(suite_algs_t, encr), + lib->crypto->create_crypter_enumerator); + filter_suite(suites, count, offsetof(suite_algs_t, encr), + lib->crypto->create_aead_enumerator); + filter_suite(suites, count, offsetof(suite_algs_t, mac), + lib->crypto->create_signer_enumerator); + filter_suite(suites, count, offsetof(suite_algs_t, prf), + lib->crypto->create_prf_enumerator); + filter_suite(suites, count, offsetof(suite_algs_t, hash), + lib->crypto->create_hasher_enumerator); + filter_suite(suites, count, offsetof(suite_algs_t, dh), + lib->crypto->create_dh_enumerator); +} + /** * Initialize the cipher suite list */ @@ -988,9 +1006,10 @@ static void build_cipher_suite_list(private_tls_crypto_t *this, { suites[i] = suite_algs[i]; } + if (require_encryption) { - filter_null_suites(this, suites, &count); + filter_null_suites(suites, &count); } if (!this->rsa) { @@ -1001,19 +1020,7 @@ static void build_cipher_suite_list(private_tls_crypto_t *this, filter_key_suites(this, suites, &count, KEY_ECDSA); } - /* filter suite list by each algorithm */ - filter_suite(this, suites, &count, offsetof(suite_algs_t, encr), - lib->crypto->create_crypter_enumerator); - filter_suite(this, suites, &count, offsetof(suite_algs_t, encr), - lib->crypto->create_aead_enumerator); - filter_suite(this, suites, &count, offsetof(suite_algs_t, mac), - lib->crypto->create_signer_enumerator); - filter_suite(this, suites, &count, offsetof(suite_algs_t, prf), - lib->crypto->create_prf_enumerator); - filter_suite(this, suites, &count, offsetof(suite_algs_t, hash), - lib->crypto->create_hasher_enumerator); - filter_suite(this, suites, &count, offsetof(suite_algs_t, dh), - lib->crypto->create_dh_enumerator); + filter_unsupported_suites(suites, &count); /* filter suites with strongswan.conf options */ filter_key_exchange_config_suites(this, suites, &count); @@ -1844,3 +1851,35 @@ tls_crypto_t *tls_crypto_create(tls_t *tls, tls_cache_t *cache) } return &this->public; } + +/** + * See header. + */ +int tls_crypto_get_supported_suites(bool null, tls_cipher_suite_t **out) +{ + suite_algs_t suites[countof(suite_algs)]; + int count = countof(suite_algs), i; + + /* initialize copy of suite list */ + for (i = 0; i < count; i++) + { + suites[i] = suite_algs[i]; + } + + filter_unsupported_suites(suites, &count); + + if (!null) + { + filter_null_suites(suites, &count); + } + + if (out) + { + *out = calloc(count, sizeof(tls_cipher_suite_t)); + for (i = 0; i < count; i++) + { + (*out)[i] = suites[i].suite; + } + } + return count; +} diff --git a/src/libtls/tls_crypto.h b/src/libtls/tls_crypto.h index 5512b1f48..a42e07bb3 100644 --- a/src/libtls/tls_crypto.h +++ b/src/libtls/tls_crypto.h @@ -572,4 +572,13 @@ struct tls_crypto_t { */ tls_crypto_t *tls_crypto_create(tls_t *tls, tls_cache_t *cache); +/** + * Get a list of all supported TLS cipher suites. + * + * @param null include supported NULL encryption suites + * @param suites pointer to allocated suites array, to free(), or NULL + * @return number of suites supported + */ +int tls_crypto_get_supported_suites(bool null, tls_cipher_suite_t **suites); + #endif /** TLS_CRYPTO_H_ @}*/ From ddf5222096321580dd307adcb2d61cbfbb96f463 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 25 Mar 2014 09:49:04 +0100 Subject: [PATCH 05/10] tls: Introduce a generic TLS purpose that accepts NULL encryption ciphers --- scripts/tls_test.c | 4 ++-- src/libtls/tls.c | 1 + src/libtls/tls.h | 2 ++ src/libtls/tls_crypto.c | 3 +++ 4 files changed, 8 insertions(+), 2 deletions(-) diff --git a/scripts/tls_test.c b/scripts/tls_test.c index 7ec477aae..3d47f6f7a 100644 --- a/scripts/tls_test.c +++ b/scripts/tls_test.c @@ -105,7 +105,7 @@ static int run_client(host_t *host, identification_t *server, close(fd); return 1; } - tls = tls_socket_create(FALSE, server, client, fd, cache); + tls = tls_socket_create(FALSE, server, client, fd, cache, TRUE); if (!tls) { close(fd); @@ -162,7 +162,7 @@ static int serve(host_t *host, identification_t *server, } DBG1(DBG_TLS, "%#H connected", host); - tls = tls_socket_create(TRUE, server, NULL, cfd, cache); + tls = tls_socket_create(TRUE, server, NULL, cfd, cache, TRUE); if (!tls) { close(fd); diff --git a/src/libtls/tls.c b/src/libtls/tls.c index 7314602b6..6e2955814 100644 --- a/src/libtls/tls.c +++ b/src/libtls/tls.c @@ -447,6 +447,7 @@ tls_t *tls_create(bool is_server, identification_t *server, case TLS_PURPOSE_EAP_TTLS: case TLS_PURPOSE_EAP_PEAP: case TLS_PURPOSE_GENERIC: + case TLS_PURPOSE_GENERIC_NULLOK: break; default: return NULL; diff --git a/src/libtls/tls.h b/src/libtls/tls.h index db332fbbf..fc1d9b9fd 100644 --- a/src/libtls/tls.h +++ b/src/libtls/tls.h @@ -107,6 +107,8 @@ enum tls_purpose_t { TLS_PURPOSE_EAP_PEAP, /** non-EAP TLS */ TLS_PURPOSE_GENERIC, + /** non-EAP TLS accepting NULL encryption */ + TLS_PURPOSE_GENERIC_NULLOK, /** EAP binding for TNC */ TLS_PURPOSE_EAP_TNC }; diff --git a/src/libtls/tls_crypto.c b/src/libtls/tls_crypto.c index 6addad8fe..4f67b20d6 100644 --- a/src/libtls/tls_crypto.c +++ b/src/libtls/tls_crypto.c @@ -1846,6 +1846,9 @@ tls_crypto_t *tls_crypto_create(tls_t *tls, tls_cache_t *cache) case TLS_PURPOSE_GENERIC: build_cipher_suite_list(this, TRUE); break; + case TLS_PURPOSE_GENERIC_NULLOK: + build_cipher_suite_list(this, FALSE); + break; default: break; } From 5313880261fe271ac5b334ccacf92d6253efaf3d Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 25 Mar 2014 10:19:41 +0100 Subject: [PATCH 06/10] tls: Support a null encryption flag on TLS socket abstraction --- src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c | 4 ++-- src/libpttls/pt_tls_client.c | 3 ++- src/libpttls/pt_tls_server.c | 2 +- src/libtls/tls_socket.c | 15 +++++++++++++-- src/libtls/tls_socket.h | 4 +++- 5 files changed, 21 insertions(+), 7 deletions(-) diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c index 5206ba4e7..af1b28adf 100644 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c +++ b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c @@ -876,7 +876,8 @@ static bool soap_init(private_tnc_ifmap_soap_t *this) } /* open TLS socket */ - this->tls = tls_socket_create(FALSE, server_id, client_id, this->fd, NULL); + this->tls = tls_socket_create(FALSE, server_id, client_id, this->fd, + NULL, FALSE); if (!this->tls) { DBG1(DBG_TNC, "creating TLS socket failed"); @@ -923,4 +924,3 @@ tnc_ifmap_soap_t *tnc_ifmap_soap_create() return &this->public; } - diff --git a/src/libpttls/pt_tls_client.c b/src/libpttls/pt_tls_client.c index 01a84cd14..98a2f4b47 100644 --- a/src/libpttls/pt_tls_client.c +++ b/src/libpttls/pt_tls_client.c @@ -84,7 +84,8 @@ static bool make_connection(private_pt_tls_client_t *this) return FALSE; } - this->tls = tls_socket_create(FALSE, this->server, this->client, fd, NULL); + this->tls = tls_socket_create(FALSE, this->server, this->client, fd, + NULL, FALSE); if (!this->tls) { close(fd); diff --git a/src/libpttls/pt_tls_server.c b/src/libpttls/pt_tls_server.c index 9af00e7c2..3c07475d9 100644 --- a/src/libpttls/pt_tls_server.c +++ b/src/libpttls/pt_tls_server.c @@ -532,7 +532,7 @@ pt_tls_server_t *pt_tls_server_create(identification_t *server, int fd, .destroy = _destroy, }, .state = PT_TLS_SERVER_VERSION, - .tls = tls_socket_create(TRUE, server, NULL, fd, NULL), + .tls = tls_socket_create(TRUE, server, NULL, fd, NULL, FALSE), .tnccs = (tls_t*)tnccs, .auth = auth, ); diff --git a/src/libtls/tls_socket.c b/src/libtls/tls_socket.c index 19232750b..4b18fa60e 100644 --- a/src/libtls/tls_socket.c +++ b/src/libtls/tls_socket.c @@ -406,9 +406,11 @@ METHOD(tls_socket_t, destroy, void, * See header */ tls_socket_t *tls_socket_create(bool is_server, identification_t *server, - identification_t *peer, int fd, tls_cache_t *cache) + identification_t *peer, int fd, tls_cache_t *cache, + bool nullok) { private_tls_socket_t *this; + tls_purpose_t purpose; INIT(this, .public = { @@ -430,7 +432,16 @@ tls_socket_t *tls_socket_create(bool is_server, identification_t *server, .fd = fd, ); - this->tls = tls_create(is_server, server, peer, TLS_PURPOSE_GENERIC, + if (nullok) + { + purpose = TLS_PURPOSE_GENERIC_NULLOK; + } + else + { + purpose = TLS_PURPOSE_GENERIC; + } + + this->tls = tls_create(is_server, server, peer, purpose, &this->app.application, cache); if (!this->tls) { diff --git a/src/libtls/tls_socket.h b/src/libtls/tls_socket.h index 75130a4d3..54278dd01 100644 --- a/src/libtls/tls_socket.h +++ b/src/libtls/tls_socket.h @@ -104,9 +104,11 @@ struct tls_socket_t { * @param peer client identity, NULL for no client authentication * @param fd socket to read/write from * @param cache session cache to use, or NULL + * @param nullok accept NULL encryption ciphers * @return TLS socket wrapper */ tls_socket_t *tls_socket_create(bool is_server, identification_t *server, - identification_t *peer, int fd, tls_cache_t *cache); + identification_t *peer, int fd, tls_cache_t *cache, + bool nullok); #endif /** TLS_SOCKET_H_ @}*/ From e15f64cc81818f3769b91b2372559a64f0b92b7b Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 25 Mar 2014 10:12:51 +0100 Subject: [PATCH 07/10] tls: Support a maximum TLS version to negotiate using TLS socket abstraction --- scripts/tls_test.c | 4 ++-- src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c | 2 +- src/libpttls/pt_tls_client.c | 2 +- src/libpttls/pt_tls_server.c | 2 +- src/libtls/tls_socket.c | 3 ++- src/libtls/tls_socket.h | 3 ++- 6 files changed, 9 insertions(+), 7 deletions(-) diff --git a/scripts/tls_test.c b/scripts/tls_test.c index 3d47f6f7a..84a32f96f 100644 --- a/scripts/tls_test.c +++ b/scripts/tls_test.c @@ -105,7 +105,7 @@ static int run_client(host_t *host, identification_t *server, close(fd); return 1; } - tls = tls_socket_create(FALSE, server, client, fd, cache, TRUE); + tls = tls_socket_create(FALSE, server, client, fd, cache, TLS_1_2, TRUE); if (!tls) { close(fd); @@ -162,7 +162,7 @@ static int serve(host_t *host, identification_t *server, } DBG1(DBG_TLS, "%#H connected", host); - tls = tls_socket_create(TRUE, server, NULL, cfd, cache, TRUE); + tls = tls_socket_create(TRUE, server, NULL, cfd, cache, TLS_1_2, TRUE); if (!tls) { close(fd); diff --git a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c index af1b28adf..a652e7067 100644 --- a/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c +++ b/src/libcharon/plugins/tnc_ifmap/tnc_ifmap_soap.c @@ -877,7 +877,7 @@ static bool soap_init(private_tnc_ifmap_soap_t *this) /* open TLS socket */ this->tls = tls_socket_create(FALSE, server_id, client_id, this->fd, - NULL, FALSE); + NULL, TLS_1_2, FALSE); if (!this->tls) { DBG1(DBG_TNC, "creating TLS socket failed"); diff --git a/src/libpttls/pt_tls_client.c b/src/libpttls/pt_tls_client.c index 98a2f4b47..315129d7e 100644 --- a/src/libpttls/pt_tls_client.c +++ b/src/libpttls/pt_tls_client.c @@ -85,7 +85,7 @@ static bool make_connection(private_pt_tls_client_t *this) } this->tls = tls_socket_create(FALSE, this->server, this->client, fd, - NULL, FALSE); + NULL, TLS_1_2, FALSE); if (!this->tls) { close(fd); diff --git a/src/libpttls/pt_tls_server.c b/src/libpttls/pt_tls_server.c index 3c07475d9..cedc2632c 100644 --- a/src/libpttls/pt_tls_server.c +++ b/src/libpttls/pt_tls_server.c @@ -532,7 +532,7 @@ pt_tls_server_t *pt_tls_server_create(identification_t *server, int fd, .destroy = _destroy, }, .state = PT_TLS_SERVER_VERSION, - .tls = tls_socket_create(TRUE, server, NULL, fd, NULL, FALSE), + .tls = tls_socket_create(TRUE, server, NULL, fd, NULL, TLS_1_2, FALSE), .tnccs = (tls_t*)tnccs, .auth = auth, ); diff --git a/src/libtls/tls_socket.c b/src/libtls/tls_socket.c index 4b18fa60e..648771e75 100644 --- a/src/libtls/tls_socket.c +++ b/src/libtls/tls_socket.c @@ -407,7 +407,7 @@ METHOD(tls_socket_t, destroy, void, */ tls_socket_t *tls_socket_create(bool is_server, identification_t *server, identification_t *peer, int fd, tls_cache_t *cache, - bool nullok) + tls_version_t max_version, bool nullok) { private_tls_socket_t *this; tls_purpose_t purpose; @@ -448,6 +448,7 @@ tls_socket_t *tls_socket_create(bool is_server, identification_t *server, free(this); return NULL; } + this->tls->set_version(this->tls, max_version); return &this->public; } diff --git a/src/libtls/tls_socket.h b/src/libtls/tls_socket.h index 54278dd01..0d4db3b41 100644 --- a/src/libtls/tls_socket.h +++ b/src/libtls/tls_socket.h @@ -104,11 +104,12 @@ struct tls_socket_t { * @param peer client identity, NULL for no client authentication * @param fd socket to read/write from * @param cache session cache to use, or NULL + * @param max_version maximun TLS version to negotiate * @param nullok accept NULL encryption ciphers * @return TLS socket wrapper */ tls_socket_t *tls_socket_create(bool is_server, identification_t *server, identification_t *peer, int fd, tls_cache_t *cache, - bool nullok); + tls_version_t max_version, bool nullok); #endif /** TLS_SOCKET_H_ @}*/ From 74162ed9973636fa92267d7bae3027c05f940752 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 1 Apr 2014 11:45:45 +0200 Subject: [PATCH 08/10] tls: Remove superfluous initializers in TLS AEAD implementations --- src/libtls/tls_aead.c | 1 - src/libtls/tls_aead_expl.c | 1 - src/libtls/tls_aead_impl.c | 1 - src/libtls/tls_aead_null.c | 1 - 4 files changed, 4 deletions(-) diff --git a/src/libtls/tls_aead.c b/src/libtls/tls_aead.c index be44cc098..1d0779dc0 100644 --- a/src/libtls/tls_aead.c +++ b/src/libtls/tls_aead.c @@ -191,7 +191,6 @@ tls_aead_t *tls_aead_create_aead(encryption_algorithm_t encr, size_t encr_size) .public = { .encrypt = _encrypt, .decrypt = _decrypt, - .get_iv_size = _get_iv_size, .get_mac_key_size = _get_mac_key_size, .get_encr_key_size = _get_encr_key_size, .get_iv_size = _get_iv_size, diff --git a/src/libtls/tls_aead_expl.c b/src/libtls/tls_aead_expl.c index f047d6584..5e4d33e14 100644 --- a/src/libtls/tls_aead_expl.c +++ b/src/libtls/tls_aead_expl.c @@ -201,7 +201,6 @@ tls_aead_t *tls_aead_create_explicit(integrity_algorithm_t mac, .public = { .encrypt = _encrypt, .decrypt = _decrypt, - .get_iv_size = _get_iv_size, .get_mac_key_size = _get_mac_key_size, .get_encr_key_size = _get_encr_key_size, .get_iv_size = _get_iv_size, diff --git a/src/libtls/tls_aead_impl.c b/src/libtls/tls_aead_impl.c index 9b259fc1d..fb14026e0 100644 --- a/src/libtls/tls_aead_impl.c +++ b/src/libtls/tls_aead_impl.c @@ -192,7 +192,6 @@ tls_aead_t *tls_aead_create_implicit(integrity_algorithm_t mac, .public = { .encrypt = _encrypt, .decrypt = _decrypt, - .get_iv_size = _get_iv_size, .get_mac_key_size = _get_mac_key_size, .get_encr_key_size = _get_encr_key_size, .get_iv_size = _get_iv_size, diff --git a/src/libtls/tls_aead_null.c b/src/libtls/tls_aead_null.c index b80a0bc54..595b64000 100644 --- a/src/libtls/tls_aead_null.c +++ b/src/libtls/tls_aead_null.c @@ -140,7 +140,6 @@ tls_aead_t *tls_aead_create_null(integrity_algorithm_t alg) .public = { .encrypt = _encrypt, .decrypt = _decrypt, - .get_iv_size = _get_iv_size, .get_mac_key_size = _get_mac_key_size, .get_encr_key_size = _get_encr_key_size, .get_iv_size = _get_iv_size, From 2c8d77394ccb0e504a2581809f405ed6116d3e3e Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Mon, 24 Mar 2014 18:01:00 +0100 Subject: [PATCH 09/10] tls: Add socket based tests testing all supported suites with TLS 1.2/1.1/1.0 --- src/libtls/tests/Makefile.am | 1 + src/libtls/tests/suites/test_socket.c | 524 ++++++++++++++++++++++++++ src/libtls/tests/tls_tests.h | 2 + 3 files changed, 527 insertions(+) create mode 100644 src/libtls/tests/suites/test_socket.c diff --git a/src/libtls/tests/Makefile.am b/src/libtls/tests/Makefile.am index 11ea9f073..94f321bbd 100644 --- a/src/libtls/tests/Makefile.am +++ b/src/libtls/tests/Makefile.am @@ -3,6 +3,7 @@ TESTS = tls_tests check_PROGRAMS = $(TESTS) tls_tests_SOURCES = \ + suites/test_socket.c \ tls_tests.h tls_tests.c tls_tests_CFLAGS = \ diff --git a/src/libtls/tests/suites/test_socket.c b/src/libtls/tests/suites/test_socket.c new file mode 100644 index 000000000..42a4607b7 --- /dev/null +++ b/src/libtls/tests/suites/test_socket.c @@ -0,0 +1,524 @@ +/* + * Copyright (C) 2014 Martin Willi + * Copyright (C) 2014 revosec AG + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See . + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include + +#include +#include + +#include +#include + +#include "tls_socket.h" + +/** + * Credentials for authentication + */ +static mem_cred_t *creds; + +/** + * RSA private key, 2048 bit + */ +static char rsa[] = { + 0x30,0x82,0x04,0xa4,0x02,0x01,0x00,0x02,0x82,0x01,0x01,0x00,0xee,0xa3,0x28,0xcc, + 0x48,0xca,0x37,0xfc,0xb6,0xfa,0xfc,0x18,0x0d,0xa2,0x28,0x44,0xb4,0x16,0x56,0xf7, + 0x97,0x5f,0x38,0x83,0xfc,0xd4,0x30,0xea,0xf7,0x5e,0xaa,0xd4,0x21,0x0e,0x71,0x49, + 0x13,0x39,0xaf,0x89,0xa1,0x1d,0x1b,0x9a,0x08,0x44,0xff,0x0b,0xeb,0x4b,0xad,0x8e, + 0xc4,0x6d,0x1e,0x0c,0x02,0xbb,0x17,0x59,0xc7,0x66,0xc7,0xff,0x4c,0x3c,0x11,0x40, + 0x1a,0xe3,0xca,0x34,0xf8,0x41,0xe0,0x39,0x3e,0xce,0x72,0x9f,0x56,0x9e,0x69,0xad, + 0x98,0x43,0x5f,0x35,0xc2,0xd0,0xd9,0xbc,0x8b,0xed,0xc6,0xc7,0x74,0x73,0x74,0x30, + 0x92,0x86,0x39,0x26,0x3d,0xf1,0xd5,0x16,0x45,0x7d,0xcc,0x90,0x54,0xff,0x44,0x74, + 0xf3,0xba,0x41,0x5c,0x58,0xa4,0x66,0xe6,0x9d,0x58,0xbe,0x7e,0x89,0xe1,0x7c,0xf7, + 0x28,0xb0,0xde,0xe2,0x01,0x0a,0x89,0xc7,0x63,0x3f,0xef,0x2b,0xcb,0xef,0x65,0x89, + 0x82,0x23,0x32,0xa7,0xa3,0x1c,0x0d,0xc6,0x8f,0x76,0x59,0x8b,0x55,0x65,0x9c,0x91, + 0xd4,0x93,0x89,0xad,0x37,0x47,0x23,0x25,0xb3,0x53,0xea,0xef,0x73,0xeb,0x97,0xd3, + 0xd7,0x74,0x38,0x73,0x8d,0x16,0x0d,0x6f,0xae,0x59,0x33,0x4e,0x24,0xe9,0x52,0xf6, + 0x6f,0x8c,0x5c,0x13,0xcf,0x1d,0x0a,0xcc,0xb7,0x6a,0x88,0xce,0x91,0xe2,0xe0,0xcb, + 0xc6,0xd2,0xfb,0x81,0xf6,0xd2,0x9f,0x0a,0x82,0x70,0x80,0xbf,0x93,0x70,0xc0,0x57, + 0x23,0x6e,0x97,0x1c,0x9d,0x7d,0xf0,0xa3,0x54,0x86,0xec,0x40,0xae,0x09,0x20,0xed, + 0x02,0x43,0xa3,0xf8,0x7e,0x0e,0x5b,0xd0,0x22,0x7b,0x74,0x39,0x02,0x03,0x01,0x00, + 0x01,0x02,0x82,0x01,0x01,0x00,0xd9,0x5b,0x99,0x74,0x80,0xb4,0x57,0xcc,0x82,0x2a, + 0x17,0x66,0x1d,0x3c,0xde,0xea,0xbd,0x11,0x40,0x03,0x62,0x47,0xe3,0xe5,0x2c,0x6b, + 0x65,0x67,0x0f,0x0b,0x96,0x13,0x83,0x4c,0x71,0x58,0xfa,0xfe,0xe6,0xe9,0x37,0xeb, + 0x98,0x51,0x73,0x48,0xcc,0xf9,0xe1,0x46,0x5b,0xfe,0x16,0xe1,0xc0,0xa5,0x75,0xf3, + 0x4d,0x30,0x84,0x14,0x15,0x04,0x6f,0x3e,0xa3,0x03,0xbd,0xba,0x4f,0x5a,0x71,0xe9, + 0x26,0xbf,0x5d,0x7a,0x93,0x22,0x98,0xb5,0xcf,0x51,0xc3,0xc7,0x51,0xb8,0x59,0x0a, + 0xfb,0xd7,0xe5,0xa8,0x1d,0x0f,0x5c,0xfd,0x30,0x0e,0x71,0xd7,0x79,0xc4,0x60,0x55, + 0x9e,0x1e,0x1c,0x0b,0x9a,0x40,0xb8,0x7a,0x8d,0xb2,0xec,0xb0,0x70,0x8a,0x19,0x5f, + 0x1d,0x2e,0xde,0x90,0x8f,0x68,0x56,0x08,0xce,0x0c,0x08,0xde,0xc7,0xf8,0x13,0xef, + 0xd2,0xbc,0x92,0xb6,0xfb,0xec,0xb6,0x04,0xf6,0x8f,0x7d,0x95,0xe9,0xeb,0xc7,0xfb, + 0xcc,0x4f,0xad,0x41,0xf1,0x4c,0x79,0x07,0xdd,0x4b,0x40,0xb4,0x74,0x44,0x9a,0x06, + 0x0a,0x0f,0xb2,0xda,0x12,0x46,0xe5,0xee,0x01,0x64,0xe5,0xf0,0x82,0x69,0xf9,0xf1, + 0xe9,0x41,0x13,0x5a,0xee,0xc0,0x37,0x9a,0xbe,0x9a,0x9a,0x06,0x4b,0x52,0xd6,0xf3, + 0x1b,0x30,0x64,0x93,0x3a,0x97,0xe1,0xdc,0x50,0x1f,0x46,0xc4,0x81,0x6a,0x17,0x52, + 0x49,0x85,0xc6,0x85,0xb7,0x60,0xd4,0xf0,0xd1,0x6a,0xeb,0x50,0x8c,0xb7,0xeb,0x1f, + 0x17,0x0e,0xf0,0xfd,0x67,0x03,0x7c,0x74,0x1a,0xac,0x66,0x81,0x00,0x45,0x5e,0xf3, + 0xd9,0x9d,0x22,0x99,0xc4,0x11,0x02,0x81,0x81,0x00,0xfa,0x44,0x32,0x14,0xb2,0x82, + 0x28,0x02,0x46,0x05,0xdd,0x8d,0xb1,0x9f,0x9e,0x6f,0x61,0xf2,0x01,0xa0,0x2b,0x76, + 0xee,0x46,0xaa,0x2d,0x2d,0x5b,0xd2,0x67,0x90,0x36,0xbb,0xa0,0x07,0xdf,0x9b,0xad, + 0x18,0x1e,0xa7,0xe6,0x36,0xc6,0x49,0xda,0xc5,0x0d,0x52,0x29,0x5a,0x40,0xcf,0xdf, + 0x8d,0xd0,0xa3,0xc2,0x34,0x17,0x9f,0xb5,0xf1,0x67,0xac,0x29,0x10,0xc2,0x5c,0x62, + 0xe3,0xe2,0x5c,0x9f,0x93,0xcc,0xb5,0xeb,0x16,0x64,0x44,0x9f,0x6b,0x5a,0xac,0x19, + 0x09,0xff,0x4b,0x78,0x7f,0xec,0x5a,0xbd,0xe9,0xcb,0x74,0xbb,0x30,0x13,0xc5,0x25, + 0x8b,0xac,0x8d,0xf9,0xa9,0x99,0x25,0xf5,0xce,0x07,0xb6,0x2b,0x1b,0x42,0xed,0x3a, + 0x30,0x4a,0xfc,0x5f,0xf0,0xe2,0x26,0xa6,0x60,0x5d,0x02,0x81,0x81,0x00,0xf4,0x1a, + 0xc2,0x7e,0xa0,0xa0,0xad,0x20,0x65,0x04,0xe8,0xf7,0xb0,0xb1,0x76,0x79,0x08,0x18, + 0x58,0x93,0x21,0xf1,0x56,0x58,0x58,0x18,0x4a,0x5c,0x59,0x08,0x27,0x64,0x09,0xcb, + 0x0b,0x0b,0x4e,0x26,0xc8,0x0b,0x87,0x67,0x40,0xc1,0xab,0x31,0x60,0xa6,0x78,0xdd, + 0x78,0xc8,0x86,0x38,0xbd,0x19,0xde,0x0b,0x70,0x72,0xec,0x36,0x88,0x39,0x69,0x70, + 0xda,0xa6,0x2e,0xf9,0x5c,0xd8,0x17,0xc5,0xfa,0xf8,0xa5,0xc9,0x9b,0xf0,0xfe,0x03, + 0x71,0x57,0xfa,0x58,0x0f,0x33,0xc3,0xab,0xce,0xb0,0x5d,0xd0,0x40,0x07,0x9a,0x0b, + 0xff,0xb9,0xaa,0x9d,0xc5,0x33,0x7f,0x5f,0x48,0x7e,0x54,0x82,0xd1,0xdf,0x75,0x69, + 0xee,0xe5,0xf5,0x80,0x44,0xce,0x52,0x72,0x14,0x2c,0xe6,0xa7,0xd5,0x8d,0x02,0x81, + 0x81,0x00,0xb8,0xf7,0x70,0x20,0x35,0xf2,0xd6,0x89,0x1f,0xa1,0xb4,0x26,0xc6,0x51, + 0xd7,0xb2,0x30,0xac,0xc1,0xa0,0xd4,0x9e,0xf8,0xea,0x87,0x5a,0x0e,0x7d,0x1f,0xdb, + 0xe5,0x0d,0x5e,0xcc,0x9f,0x25,0x18,0x14,0xed,0x8f,0xb2,0xbe,0x06,0x5b,0xb5,0x38, + 0x18,0x8d,0x88,0xdd,0x01,0x54,0x87,0x8e,0x8d,0x6c,0xd7,0xab,0x6f,0xfe,0xc9,0xce, + 0x9a,0x15,0xea,0x7b,0x0b,0x64,0xeb,0x0d,0x37,0xaa,0x14,0x94,0xe8,0x92,0xd3,0x1d, + 0x66,0x16,0x43,0x55,0xa3,0xed,0x86,0xe6,0x96,0xa9,0xf5,0xe8,0xa0,0x7b,0x5a,0x71, + 0xa4,0x7a,0xf7,0xd2,0x65,0x6d,0x27,0x37,0x61,0xac,0xed,0xdd,0xc9,0x08,0x64,0xb2, + 0xf0,0x4c,0x68,0xca,0x21,0x42,0xec,0xbc,0x25,0xf7,0x35,0xe1,0xde,0xd1,0xf6,0x88, + 0xdf,0x0d,0x02,0x81,0x80,0x44,0xb0,0xcb,0x0e,0x6b,0x11,0x0b,0xe6,0xd3,0xc6,0x7f, + 0xf0,0x43,0x6e,0x8c,0xd2,0x1e,0x2f,0x0b,0xad,0xcb,0x9d,0x68,0x18,0xd0,0x21,0x75, + 0xbb,0x6a,0xea,0x5a,0x7b,0x52,0x2e,0x2a,0xdb,0x71,0x90,0x84,0x36,0x8a,0x51,0xc9, + 0xed,0x35,0xc9,0x5d,0x53,0x3b,0x2b,0xc7,0x73,0x56,0x21,0xdd,0x44,0xcc,0x31,0x17, + 0xe1,0x9f,0x0a,0xf1,0x66,0x86,0x7f,0x55,0x67,0xf2,0x4c,0x05,0x8e,0x61,0x92,0x3a, + 0xbf,0x81,0x97,0xac,0x24,0x32,0xb6,0xb1,0x4c,0x7a,0x8c,0x11,0x2b,0x15,0xe2,0xe0, + 0xf4,0xcc,0x51,0x6f,0xd3,0x33,0xcc,0x30,0x98,0x04,0xa5,0x04,0xfb,0x2a,0xda,0x9b, + 0x41,0xc1,0x72,0x56,0xb0,0xb5,0x0f,0xac,0x44,0x55,0xc3,0x54,0x99,0x62,0xa5,0xeb, + 0x7b,0x7f,0x24,0xb7,0x79,0x02,0x81,0x80,0x0a,0x3b,0x9b,0x91,0x1d,0x9b,0x04,0x4e, + 0xdf,0xd9,0xe6,0x47,0xf3,0x79,0xb7,0x17,0xcf,0x42,0xa5,0xde,0x94,0xf0,0xfe,0xed, + 0x46,0xf6,0xaf,0x3e,0x6c,0x91,0x01,0x89,0x79,0x81,0xea,0x2b,0x82,0x68,0x0e,0xd8, + 0x25,0xaf,0x79,0x8b,0x14,0xfd,0xf2,0x29,0x20,0x34,0x2d,0x0b,0x08,0x8c,0x3b,0x2b, + 0xfc,0x75,0xe9,0x4e,0x21,0xa6,0xb2,0x35,0x67,0x8d,0x4c,0x90,0x94,0x02,0xd5,0x32, + 0x23,0xc6,0xa0,0x92,0x2e,0xfa,0x97,0x48,0x5b,0x95,0xc3,0xf1,0xbc,0x6b,0xe8,0x4c, + 0x92,0x6f,0x5e,0x3d,0xf9,0xbd,0x2c,0xf0,0x83,0x1c,0xe6,0xb3,0x45,0x68,0x32,0x8d, + 0x85,0x20,0xcb,0x9d,0xd2,0x30,0x5a,0x57,0xa4,0x6e,0x27,0xb5,0x29,0x14,0xdb,0xf1, + 0x4b,0x9a,0xc3,0xc1,0xc5,0x37,0x6d,0x1b, +}; + +/** + * ECDSA private key + */ +static char ecdsa[] = { + 0x30,0x81,0xa4,0x02,0x01,0x01,0x04,0x30,0xc0,0x1f,0xfd,0x65,0xc6,0xc4,0x4c,0xb8, + 0xff,0x56,0x08,0xb5,0xbd,0xb8,0xf5,0x93,0xf7,0x51,0x0e,0x92,0x1f,0x06,0xbf,0xa6, + 0xd9,0x1d,0xae,0xa3,0x16,0x0d,0x0f,0xc9,0xd5,0x97,0x90,0x46,0xf1,0x98,0xa8,0x18, + 0x07,0xba,0xcf,0x91,0x8e,0x07,0xed,0x88,0xa0,0x07,0x06,0x05,0x2b,0x81,0x04,0x00, + 0x22,0xa1,0x64,0x03,0x62,0x00,0x04,0xd6,0xba,0xe1,0xf0,0x09,0x22,0x21,0x12,0x69, + 0xed,0x0e,0xd5,0x02,0x8c,0xb8,0x52,0xbb,0x57,0x68,0x0e,0xf3,0xdb,0xb9,0xb1,0xee, + 0x9c,0x67,0xa0,0xb8,0xdc,0x13,0x1e,0x5b,0x44,0x71,0x04,0xef,0x4e,0xe3,0xdd,0xf4, + 0xa6,0xc3,0xba,0x77,0x53,0xb8,0x28,0x5f,0xd2,0x97,0x05,0xa3,0x5b,0xe6,0xde,0x0a, + 0xce,0x11,0xa8,0xaf,0x02,0xbd,0xfa,0x17,0xf9,0xa7,0x38,0x3e,0x5b,0x57,0xb0,0x01, + 0xb3,0xc6,0x09,0x29,0x65,0xae,0xfb,0x87,0x92,0xa3,0xd7,0x3d,0x9a,0x1c,0x52,0x09, + 0xb1,0x47,0xc8,0xf6,0x18,0xbb,0x97, +}; + +/** + * TLS certificate for RSA key + */ +static char rsa_crt[] = { + 0x30,0x82,0x03,0x1f,0x30,0x82,0x02,0x07,0xa0,0x03,0x02,0x01,0x02,0x02,0x09,0x00, + 0xf0,0xbb,0xac,0xc3,0xa1,0x6b,0xf3,0x1c,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86, + 0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x30,0x34,0x31,0x0b,0x30,0x09,0x06,0x03,0x55, + 0x04,0x06,0x13,0x02,0x43,0x48,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x0a,0x13, + 0x0a,0x73,0x74,0x72,0x6f,0x6e,0x67,0x53,0x77,0x61,0x6e,0x31,0x10,0x30,0x0e,0x06, + 0x03,0x55,0x04,0x03,0x13,0x07,0x74,0x6c,0x73,0x2d,0x72,0x73,0x61,0x30,0x1e,0x17, + 0x0d,0x31,0x34,0x30,0x33,0x32,0x34,0x31,0x36,0x32,0x37,0x32,0x36,0x5a,0x17,0x0d, + 0x31,0x37,0x30,0x33,0x32,0x33,0x31,0x36,0x32,0x37,0x32,0x36,0x5a,0x30,0x34,0x31, + 0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x43,0x48,0x31,0x13,0x30,0x11, + 0x06,0x03,0x55,0x04,0x0a,0x13,0x0a,0x73,0x74,0x72,0x6f,0x6e,0x67,0x53,0x77,0x61, + 0x6e,0x31,0x10,0x30,0x0e,0x06,0x03,0x55,0x04,0x03,0x13,0x07,0x74,0x6c,0x73,0x2d, + 0x72,0x73,0x61,0x30,0x82,0x01,0x22,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7, + 0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x82,0x01,0x0f,0x00,0x30,0x82,0x01,0x0a,0x02, + 0x82,0x01,0x01,0x00,0xee,0xa3,0x28,0xcc,0x48,0xca,0x37,0xfc,0xb6,0xfa,0xfc,0x18, + 0x0d,0xa2,0x28,0x44,0xb4,0x16,0x56,0xf7,0x97,0x5f,0x38,0x83,0xfc,0xd4,0x30,0xea, + 0xf7,0x5e,0xaa,0xd4,0x21,0x0e,0x71,0x49,0x13,0x39,0xaf,0x89,0xa1,0x1d,0x1b,0x9a, + 0x08,0x44,0xff,0x0b,0xeb,0x4b,0xad,0x8e,0xc4,0x6d,0x1e,0x0c,0x02,0xbb,0x17,0x59, + 0xc7,0x66,0xc7,0xff,0x4c,0x3c,0x11,0x40,0x1a,0xe3,0xca,0x34,0xf8,0x41,0xe0,0x39, + 0x3e,0xce,0x72,0x9f,0x56,0x9e,0x69,0xad,0x98,0x43,0x5f,0x35,0xc2,0xd0,0xd9,0xbc, + 0x8b,0xed,0xc6,0xc7,0x74,0x73,0x74,0x30,0x92,0x86,0x39,0x26,0x3d,0xf1,0xd5,0x16, + 0x45,0x7d,0xcc,0x90,0x54,0xff,0x44,0x74,0xf3,0xba,0x41,0x5c,0x58,0xa4,0x66,0xe6, + 0x9d,0x58,0xbe,0x7e,0x89,0xe1,0x7c,0xf7,0x28,0xb0,0xde,0xe2,0x01,0x0a,0x89,0xc7, + 0x63,0x3f,0xef,0x2b,0xcb,0xef,0x65,0x89,0x82,0x23,0x32,0xa7,0xa3,0x1c,0x0d,0xc6, + 0x8f,0x76,0x59,0x8b,0x55,0x65,0x9c,0x91,0xd4,0x93,0x89,0xad,0x37,0x47,0x23,0x25, + 0xb3,0x53,0xea,0xef,0x73,0xeb,0x97,0xd3,0xd7,0x74,0x38,0x73,0x8d,0x16,0x0d,0x6f, + 0xae,0x59,0x33,0x4e,0x24,0xe9,0x52,0xf6,0x6f,0x8c,0x5c,0x13,0xcf,0x1d,0x0a,0xcc, + 0xb7,0x6a,0x88,0xce,0x91,0xe2,0xe0,0xcb,0xc6,0xd2,0xfb,0x81,0xf6,0xd2,0x9f,0x0a, + 0x82,0x70,0x80,0xbf,0x93,0x70,0xc0,0x57,0x23,0x6e,0x97,0x1c,0x9d,0x7d,0xf0,0xa3, + 0x54,0x86,0xec,0x40,0xae,0x09,0x20,0xed,0x02,0x43,0xa3,0xf8,0x7e,0x0e,0x5b,0xd0, + 0x22,0x7b,0x74,0x39,0x02,0x03,0x01,0x00,0x01,0xa3,0x34,0x30,0x32,0x30,0x1f,0x06, + 0x03,0x55,0x1d,0x23,0x04,0x18,0x30,0x16,0x80,0x14,0x96,0x0e,0xc8,0xd3,0xb3,0x3f, + 0xd1,0x11,0xb6,0x36,0x70,0xdb,0x37,0x98,0x3c,0xab,0x69,0x03,0x69,0x56,0x30,0x0f, + 0x06,0x03,0x55,0x1d,0x11,0x04,0x08,0x30,0x06,0x87,0x04,0x7f,0x00,0x00,0x01,0x30, + 0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x05,0x05,0x00,0x03,0x82, + 0x01,0x01,0x00,0x94,0x1d,0x08,0xda,0x7b,0xc4,0xa3,0xf4,0x40,0x54,0xae,0x45,0x6a, + 0xb3,0x62,0xb6,0x0b,0x35,0xc7,0x5f,0xed,0xb9,0x42,0x33,0xd5,0x32,0x80,0x23,0x76, + 0x87,0xae,0x59,0xbb,0x77,0x00,0xc4,0xbf,0x60,0x3b,0x9b,0x04,0x46,0x52,0xde,0x9f, + 0x16,0xc6,0x96,0x5e,0x7a,0xb5,0xbb,0x49,0x6a,0x89,0x4a,0x60,0x0b,0x85,0x15,0xec, + 0xbb,0x83,0x79,0x01,0xfa,0x3c,0xd5,0x1e,0x6a,0x75,0xe7,0x93,0xc9,0xc4,0xbb,0xea, + 0xad,0xa2,0x23,0x32,0xc5,0x57,0x4c,0x41,0xb2,0x41,0x91,0x53,0x5e,0xaf,0x98,0x83, + 0xcb,0x6b,0xa8,0x2f,0xc8,0x06,0x16,0x18,0x5a,0x75,0xe1,0xee,0xac,0xc0,0x28,0x08, + 0x0a,0x09,0xd1,0x03,0xba,0x65,0xf1,0x89,0xcc,0x63,0x6f,0xb2,0x70,0xdc,0x46,0x2b, + 0x62,0x5b,0x64,0xd4,0x7a,0xc4,0x12,0xe2,0x88,0x3a,0x54,0x0a,0xf5,0x1e,0x1c,0x9e, + 0x9a,0xb2,0x62,0xf9,0xd3,0x02,0xf0,0xc1,0xf0,0x7b,0x4d,0xf3,0x44,0xd8,0x3c,0x13, + 0x1d,0xfc,0x78,0xa3,0x54,0x68,0xce,0x43,0x31,0x78,0x58,0x2f,0x5d,0xb8,0xa7,0xff, + 0x54,0xae,0x6e,0x25,0xd7,0x40,0x6c,0x59,0x7b,0x5f,0x18,0x31,0xe9,0xfc,0x53,0x34, + 0xb2,0xb0,0x18,0xd4,0x2c,0x85,0x9d,0xad,0x2d,0xd2,0x05,0x5d,0x2e,0x47,0xee,0x09, + 0x3d,0x05,0x2e,0x46,0x66,0xea,0x09,0xb2,0x81,0xd3,0x9b,0x28,0xbf,0xf9,0x9c,0x54, + 0x98,0xb7,0x2d,0x38,0xd8,0xae,0x03,0x70,0xae,0x1e,0xd4,0xa9,0xb7,0x2e,0xdb,0x02, + 0x6a,0x84,0x0f,0x6c,0xe8,0xb8,0x25,0x73,0x84,0x13,0x9f,0x34,0x24,0xb8,0xfc,0x96, + 0x4c,0x91,0xfa, +}; + +/** + * TLS certificate for ECDSA key + */ +static char ecdsa_crt[] = { + 0x30,0x82,0x01,0xd3,0x30,0x82,0x01,0x59,0xa0,0x03,0x02,0x01,0x02,0x02,0x09,0x00, + 0xaa,0x92,0xf5,0x39,0x85,0xf5,0xd5,0xa3,0x30,0x09,0x06,0x07,0x2a,0x86,0x48,0xce, + 0x3d,0x04,0x01,0x30,0x36,0x31,0x0b,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02, + 0x43,0x48,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x0a,0x13,0x0a,0x73,0x74,0x72, + 0x6f,0x6e,0x67,0x53,0x77,0x61,0x6e,0x31,0x12,0x30,0x10,0x06,0x03,0x55,0x04,0x03, + 0x13,0x09,0x74,0x6c,0x73,0x2d,0x65,0x63,0x64,0x73,0x61,0x30,0x1e,0x17,0x0d,0x31, + 0x34,0x30,0x33,0x32,0x34,0x31,0x36,0x32,0x39,0x33,0x34,0x5a,0x17,0x0d,0x31,0x37, + 0x30,0x33,0x32,0x33,0x31,0x36,0x32,0x39,0x33,0x34,0x5a,0x30,0x36,0x31,0x0b,0x30, + 0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x43,0x48,0x31,0x13,0x30,0x11,0x06,0x03, + 0x55,0x04,0x0a,0x13,0x0a,0x73,0x74,0x72,0x6f,0x6e,0x67,0x53,0x77,0x61,0x6e,0x31, + 0x12,0x30,0x10,0x06,0x03,0x55,0x04,0x03,0x13,0x09,0x74,0x6c,0x73,0x2d,0x65,0x63, + 0x64,0x73,0x61,0x30,0x76,0x30,0x10,0x06,0x07,0x2a,0x86,0x48,0xce,0x3d,0x02,0x01, + 0x06,0x05,0x2b,0x81,0x04,0x00,0x22,0x03,0x62,0x00,0x04,0xd6,0xba,0xe1,0xf0,0x09, + 0x22,0x21,0x12,0x69,0xed,0x0e,0xd5,0x02,0x8c,0xb8,0x52,0xbb,0x57,0x68,0x0e,0xf3, + 0xdb,0xb9,0xb1,0xee,0x9c,0x67,0xa0,0xb8,0xdc,0x13,0x1e,0x5b,0x44,0x71,0x04,0xef, + 0x4e,0xe3,0xdd,0xf4,0xa6,0xc3,0xba,0x77,0x53,0xb8,0x28,0x5f,0xd2,0x97,0x05,0xa3, + 0x5b,0xe6,0xde,0x0a,0xce,0x11,0xa8,0xaf,0x02,0xbd,0xfa,0x17,0xf9,0xa7,0x38,0x3e, + 0x5b,0x57,0xb0,0x01,0xb3,0xc6,0x09,0x29,0x65,0xae,0xfb,0x87,0x92,0xa3,0xd7,0x3d, + 0x9a,0x1c,0x52,0x09,0xb1,0x47,0xc8,0xf6,0x18,0xbb,0x97,0xa3,0x34,0x30,0x32,0x30, + 0x1f,0x06,0x03,0x55,0x1d,0x23,0x04,0x18,0x30,0x16,0x80,0x14,0x4f,0x1e,0x5d,0x94, + 0x85,0xe2,0xbc,0x86,0x0e,0x80,0xce,0x17,0x92,0x42,0xb4,0xb8,0x19,0x67,0xb8,0xfe, + 0x30,0x0f,0x06,0x03,0x55,0x1d,0x11,0x04,0x08,0x30,0x06,0x87,0x04,0x7f,0x00,0x00, + 0x01,0x30,0x09,0x06,0x07,0x2a,0x86,0x48,0xce,0x3d,0x04,0x01,0x03,0x69,0x00,0x30, + 0x66,0x02,0x31,0x00,0xdc,0x6e,0x3b,0xe4,0x9f,0x36,0xa5,0xa8,0x88,0x8d,0xcf,0x2d, + 0xa1,0x6e,0x33,0x68,0x73,0xd6,0x6a,0xd6,0x1d,0x00,0xe5,0x5c,0x76,0x09,0x5e,0xe9, + 0x7a,0x3a,0x00,0x5e,0xbc,0xef,0x0d,0x8d,0x95,0x5c,0x2b,0xfc,0xa4,0xe3,0xe3,0xcf, + 0x74,0x95,0x00,0x21,0x02,0x31,0x00,0x8f,0x40,0x3e,0xfc,0xe9,0xae,0x17,0x9b,0x36, + 0x39,0xe2,0x79,0xa5,0x7b,0x5d,0xe3,0xe0,0x84,0x68,0x7e,0x00,0x57,0xbe,0x4d,0xe3, + 0x0e,0xff,0x20,0x9c,0xce,0xd1,0x43,0x76,0x00,0x6e,0x59,0x7b,0xac,0x94,0x05,0xef, + 0xed,0xca,0x8b,0xe5,0x7f,0xa5,0xd7, +}; + +START_SETUP(setup_creds) +{ + private_key_t *key; + certificate_t *cert; + + creds = mem_cred_create(); + + key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA, + BUILD_BLOB, chunk_from_thing(rsa), BUILD_END); + if (key) + { + creds->add_key(creds, key); + } + key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ECDSA, + BUILD_BLOB, chunk_from_thing(ecdsa), BUILD_END); + if (key) + { + creds->add_key(creds, key); + } + cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509, + BUILD_BLOB, chunk_from_thing(rsa_crt), BUILD_END); + if (cert) + { + creds->add_cert(creds, TRUE, cert); + } + cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509, + BUILD_BLOB, chunk_from_thing(ecdsa_crt), BUILD_END); + if (cert) + { + creds->add_cert(creds, TRUE, cert); + } + + lib->credmgr->add_set(lib->credmgr, &creds->set); +} +END_SETUP + +START_TEARDOWN(teardown_creds) +{ + lib->credmgr->remove_set(lib->credmgr, &creds->set); + creds->destroy(creds); +} +END_TEARDOWN + +/** + * Configuration for an echo server + */ +typedef struct { + tls_version_t version; + u_int16_t port; + char *addr; + chunk_t data; + int fd; + bool cauth; +} echo_server_config_t; + +/** + * Run an echo server + */ +static job_requeue_t serve_echo(echo_server_config_t *config) +{ + tls_socket_t *tls; + int sfd, cfd; + identification_t *server, *client = NULL; + ssize_t len, total, done; + char buf[128]; + + server = identification_create_from_string(config->addr); + if (config->cauth) + { + client = server; + } + sfd = config->fd; + while (TRUE) + { + cfd = accept(sfd, NULL, NULL); + if (cfd < 0) + { + break; + } + + tls = tls_socket_create(TRUE, server, client, cfd, NULL, + config->version, TRUE); + ck_assert(tls != NULL); + + while (TRUE) + { + len = tls->read(tls, buf, sizeof(buf), TRUE); + if (len <= 0) + { + break; + } + total = 0; + while (total < len) + { + done = tls->write(tls, buf + total, len - total); + ck_assert_msg(done > 0, "%s", strerror(errno)); + total += done; + } + } + + tls->destroy(tls); + close(cfd); + } + server->destroy(server); + + return JOB_REQUEUE_NONE; +} + +/** + * Start a echo server using config + */ +static void start_echo_server(echo_server_config_t *config) +{ + host_t *host; + int on = 1; + + host = host_create_from_string(config->addr, config->port); + + config->fd = socket(AF_INET, SOCK_STREAM, 0); + ck_assert(config->fd != -1); + ck_assert(setsockopt(config->fd, SOL_SOCKET, SO_REUSEADDR, + (void*)&on, sizeof(on)) != -1); + ck_assert_msg(bind(config->fd, host->get_sockaddr(host), + *host->get_sockaddr_len(host)) != -1, "%s", strerror(errno)); + host->destroy(host); + ck_assert(listen(config->fd, 1) != -1); + + lib->processor->set_threads(lib->processor, 8); + + lib->processor->queue_job(lib->processor, (job_t*) + callback_job_create((void*)serve_echo, config, NULL, NULL)); +} + +/** + * Run client to perform echo test + */ +static void run_echo_client(echo_server_config_t *config) +{ + tls_socket_t *tls; + ssize_t len, rd, wr; + int fd; + host_t *host; + identification_t *server, *client = NULL; + char buf[128]; + + host = host_create_from_string(config->addr, config->port); + server = identification_create_from_string(config->addr); + if (config->cauth) + { + client = server; + } + + fd = socket(AF_INET, SOCK_STREAM, 0); + ck_assert(fd != -1); + ck_assert(connect(fd, host->get_sockaddr(host), + *host->get_sockaddr_len(host)) != -1); + tls = tls_socket_create(FALSE, server, client, fd, NULL, + config->version, TRUE); + ck_assert(tls != NULL); + + wr = rd = 0; + while (rd < config->data.len) + { + len = tls->write(tls, config->data.ptr + wr, config->data.len - wr); + ck_assert(len >= 0); + wr += len; + + len = tls->read(tls, buf, sizeof(buf), FALSE); + if (len == -1 && errno == EWOULDBLOCK) + { + continue; + } + if (len == 0) + { + ck_assert_int_eq(rd, config->data.len); + break; + } + ck_assert(len > 0); + ck_assert(rd + len <= config->data.len); + ck_assert(memeq(buf, config->data.ptr + rd, len)); + rd += len; + } + + tls->destroy(tls); + close(fd); + host->destroy(host); + server->destroy(server); +} + +/** + * Common test wrapper function for different test variants + */ +static void test_tls(tls_version_t version, u_int16_t port, bool cauth, u_int i) +{ + echo_server_config_t *config; + tls_cipher_suite_t *suites; + char suite[128]; + int count; + + INIT(config, + .version = version, + .addr = "127.0.0.1", + .port = port, + .cauth = cauth, + .data = chunk_from_chars(0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08), + ); + + start_echo_server(config); + + count = tls_crypto_get_supported_suites(TRUE, &suites); + + ck_assert(i < count); + snprintf(suite, sizeof(suite), "%N", tls_cipher_suite_names, suites[i]); + lib->settings->set_str(lib->settings, "%s.tls.suites", suite, lib->ns); + + run_echo_client(config); + + free(suites); + + shutdown(config->fd, SHUT_RDWR); + close(config->fd); + + free(config); +} + +START_TEST(test_tls12) +{ + test_tls(TLS_1_2, 5671, FALSE, _i); +} +END_TEST + +START_TEST(test_tls12_mutual) +{ + test_tls(TLS_1_2, 5672, TRUE, _i); +} +END_TEST + +START_TEST(test_tls11) +{ + test_tls(TLS_1_1, 5673, FALSE, _i); +} +END_TEST + +START_TEST(test_tls11_mutual) +{ + test_tls(TLS_1_1, 5674, TRUE, _i); +} +END_TEST + +START_TEST(test_tls10) +{ + test_tls(TLS_1_0, 5675, FALSE, _i); +} +END_TEST + +START_TEST(test_tls10_mutual) +{ + test_tls(TLS_1_0, 5676, TRUE, _i); +} +END_TEST + +Suite *socket_suite_create() +{ + Suite *s; + TCase *tc; + int count; + + count = tls_crypto_get_supported_suites(TRUE, NULL); + + s = suite_create("socket"); + + tc = tcase_create("TLS 1.2/anon"); + tcase_add_checked_fixture(tc, setup_creds, teardown_creds); + tcase_add_loop_test(tc, test_tls12, 0, count); + suite_add_tcase(s, tc); + + tc = tcase_create("TLS 1.2/mutl"); + tcase_add_checked_fixture(tc, setup_creds, teardown_creds); + tcase_add_loop_test(tc, test_tls12_mutual, 0, count); + suite_add_tcase(s, tc); + + tc = tcase_create("TLS 1.1/anon"); + tcase_add_checked_fixture(tc, setup_creds, teardown_creds); + tcase_add_loop_test(tc, test_tls11, 0, count); + suite_add_tcase(s, tc); + + tc = tcase_create("TLS 1.1/mutl"); + tcase_add_checked_fixture(tc, setup_creds, teardown_creds); + tcase_add_loop_test(tc, test_tls11_mutual, 0, count); + suite_add_tcase(s, tc); + + tc = tcase_create("TLS 1.0/anon"); + tcase_add_checked_fixture(tc, setup_creds, teardown_creds); + tcase_add_loop_test(tc, test_tls10, 0, count); + suite_add_tcase(s, tc); + + tc = tcase_create("TLS 1.0/mutl"); + tcase_add_checked_fixture(tc, setup_creds, teardown_creds); + tcase_add_loop_test(tc, test_tls10_mutual, 0, count); + suite_add_tcase(s, tc); + + return s; +} diff --git a/src/libtls/tests/tls_tests.h b/src/libtls/tests/tls_tests.h index 05502f18e..2b6715a78 100644 --- a/src/libtls/tests/tls_tests.h +++ b/src/libtls/tests/tls_tests.h @@ -12,3 +12,5 @@ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License * for more details. */ + +TEST_SUITE(socket_suite_create) From 5ba9f734577321f0445ee38625cdea075d1bb9cf Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Tue, 25 Mar 2014 09:25:14 +0100 Subject: [PATCH 10/10] tls: Add a test case to check correct enum name mapping of cipher suites --- src/libtls/tests/Makefile.am | 2 + src/libtls/tests/suites/test_suites.c | 247 ++++++++++++++++++++++++++ src/libtls/tests/tls_tests.h | 1 + 3 files changed, 250 insertions(+) create mode 100644 src/libtls/tests/suites/test_suites.c diff --git a/src/libtls/tests/Makefile.am b/src/libtls/tests/Makefile.am index 94f321bbd..1c0e2f941 100644 --- a/src/libtls/tests/Makefile.am +++ b/src/libtls/tests/Makefile.am @@ -4,6 +4,7 @@ check_PROGRAMS = $(TESTS) tls_tests_SOURCES = \ suites/test_socket.c \ + suites/test_suites.c \ tls_tests.h tls_tests.c tls_tests_CFLAGS = \ @@ -17,4 +18,5 @@ tls_tests_CFLAGS = \ tls_tests_LDFLAGS = @COVERAGE_LDFLAGS@ tls_tests_LDADD = \ $(top_builddir)/src/libtls/libtls.la \ + $(top_builddir)/src/libstrongswan/libstrongswan.la \ $(top_builddir)/src/libstrongswan/tests/libtest.la diff --git a/src/libtls/tests/suites/test_suites.c b/src/libtls/tests/suites/test_suites.c new file mode 100644 index 000000000..f8ae12eb3 --- /dev/null +++ b/src/libtls/tests/suites/test_suites.c @@ -0,0 +1,247 @@ +/* + * Copyright (C) 2014 Martin Willi + * Copyright (C) 2014 revosec AG + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See . + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include + +#include + +#include "tls_crypto.h" + +START_TEST(test_cipher_names) +{ + char buf[128]; + +#define CHECK_NAME(x) { \ + snprintf(buf, sizeof(buf), "%N", tls_cipher_suite_names, x); \ + ck_assert_str_eq(#x, buf); } + + CHECK_NAME(TLS_NULL_WITH_NULL_NULL); + CHECK_NAME(TLS_RSA_WITH_NULL_MD5); + CHECK_NAME(TLS_RSA_WITH_NULL_SHA); + CHECK_NAME(TLS_RSA_EXPORT_WITH_RC4_40_MD5); + CHECK_NAME(TLS_RSA_WITH_RC4_128_MD5); + CHECK_NAME(TLS_RSA_WITH_RC4_128_SHA); + CHECK_NAME(TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5); + CHECK_NAME(TLS_RSA_WITH_IDEA_CBC_SHA); + CHECK_NAME(TLS_RSA_EXPORT_WITH_DES40_CBC_SHA); + CHECK_NAME(TLS_RSA_WITH_DES_CBC_SHA); + CHECK_NAME(TLS_RSA_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA); + CHECK_NAME(TLS_DH_DSS_WITH_DES_CBC_SHA); + CHECK_NAME(TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA); + CHECK_NAME(TLS_DH_RSA_WITH_DES_CBC_SHA); + CHECK_NAME(TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA); + CHECK_NAME(TLS_DHE_DSS_WITH_DES_CBC_SHA); + CHECK_NAME(TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA); + CHECK_NAME(TLS_DHE_RSA_WITH_DES_CBC_SHA); + CHECK_NAME(TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_DH_anon_EXPORT_WITH_RC4_40_MD5); + CHECK_NAME(TLS_DH_anon_WITH_RC4_128_MD5); + CHECK_NAME(TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA); + CHECK_NAME(TLS_DH_anon_WITH_DES_CBC_SHA); + CHECK_NAME(TLS_DH_anon_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_KRB5_WITH_DES_CBC_SHA); + CHECK_NAME(TLS_KRB5_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_KRB5_WITH_RC4_128_SHA); + CHECK_NAME(TLS_KRB5_WITH_IDEA_CBC_SHA); + CHECK_NAME(TLS_KRB5_WITH_DES_CBC_MD5); + CHECK_NAME(TLS_KRB5_WITH_3DES_EDE_CBC_MD5); + CHECK_NAME(TLS_KRB5_WITH_RC4_128_MD5); + CHECK_NAME(TLS_KRB5_WITH_IDEA_CBC_MD5); + CHECK_NAME(TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA); + CHECK_NAME(TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA); + CHECK_NAME(TLS_KRB5_EXPORT_WITH_RC4_40_SHA); + CHECK_NAME(TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5); + CHECK_NAME(TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5); + CHECK_NAME(TLS_KRB5_EXPORT_WITH_RC4_40_MD5); + CHECK_NAME(TLS_PSK_WITH_NULL_SHA); + CHECK_NAME(TLS_DHE_PSK_WITH_NULL_SHA); + CHECK_NAME(TLS_RSA_PSK_WITH_NULL_SHA); + CHECK_NAME(TLS_RSA_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_DH_DSS_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_DH_RSA_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_DHE_DSS_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_DHE_RSA_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_DH_anon_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_RSA_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_DH_DSS_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_DH_RSA_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_DHE_DSS_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_DHE_RSA_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_DH_anon_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_RSA_WITH_NULL_SHA256); + CHECK_NAME(TLS_RSA_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_RSA_WITH_AES_256_CBC_SHA256); + CHECK_NAME(TLS_DH_DSS_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_DH_RSA_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_DHE_DSS_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_RSA_WITH_CAMELLIA_128_CBC_SHA); + CHECK_NAME(TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA); + CHECK_NAME(TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA); + CHECK_NAME(TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA); + CHECK_NAME(TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA); + CHECK_NAME(TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA); + CHECK_NAME(TLS_DHE_RSA_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_DH_DSS_WITH_AES_256_CBC_SHA256); + CHECK_NAME(TLS_DH_RSA_WITH_AES_256_CBC_SHA256); + CHECK_NAME(TLS_DHE_DSS_WITH_AES_256_CBC_SHA256); + CHECK_NAME(TLS_DHE_RSA_WITH_AES_256_CBC_SHA256); + CHECK_NAME(TLS_DH_anon_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_DH_anon_WITH_AES_256_CBC_SHA256); + CHECK_NAME(TLS_RSA_WITH_CAMELLIA_256_CBC_SHA); + CHECK_NAME(TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA); + CHECK_NAME(TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA); + CHECK_NAME(TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA); + CHECK_NAME(TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA); + CHECK_NAME(TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA); + CHECK_NAME(TLS_PSK_WITH_RC4_128_SHA); + CHECK_NAME(TLS_PSK_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_PSK_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_PSK_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_DHE_PSK_WITH_RC4_128_SHA); + CHECK_NAME(TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_DHE_PSK_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_DHE_PSK_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_RSA_PSK_WITH_RC4_128_SHA); + CHECK_NAME(TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_RSA_PSK_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_RSA_PSK_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_RSA_WITH_SEED_CBC_SHA); + CHECK_NAME(TLS_DH_DSS_WITH_SEED_CBC_SHA); + CHECK_NAME(TLS_DH_RSA_WITH_SEED_CBC_SHA); + CHECK_NAME(TLS_DHE_DSS_WITH_SEED_CBC_SHA); + CHECK_NAME(TLS_DHE_RSA_WITH_SEED_CBC_SHA); + CHECK_NAME(TLS_DH_anon_WITH_SEED_CBC_SHA); + CHECK_NAME(TLS_RSA_WITH_AES_128_GCM_SHA256); + CHECK_NAME(TLS_RSA_WITH_AES_256_GCM_SHA384); + CHECK_NAME(TLS_DHE_RSA_WITH_AES_128_GCM_SHA256); + CHECK_NAME(TLS_DHE_RSA_WITH_AES_256_GCM_SHA384); + CHECK_NAME(TLS_DH_RSA_WITH_AES_128_GCM_SHA256); + CHECK_NAME(TLS_DH_RSA_WITH_AES_256_GCM_SHA384); + CHECK_NAME(TLS_DHE_DSS_WITH_AES_128_GCM_SHA256); + CHECK_NAME(TLS_DHE_DSS_WITH_AES_256_GCM_SHA384); + CHECK_NAME(TLS_DH_DSS_WITH_AES_128_GCM_SHA256); + CHECK_NAME(TLS_DH_DSS_WITH_AES_256_GCM_SHA384); + CHECK_NAME(TLS_DH_anon_WITH_AES_128_GCM_SHA256); + CHECK_NAME(TLS_DH_anon_WITH_AES_256_GCM_SHA384); + CHECK_NAME(TLS_PSK_WITH_AES_128_GCM_SHA256); + CHECK_NAME(TLS_PSK_WITH_AES_256_GCM_SHA384); + CHECK_NAME(TLS_DHE_PSK_WITH_AES_128_GCM_SHA256); + CHECK_NAME(TLS_DHE_PSK_WITH_AES_256_GCM_SHA384); + CHECK_NAME(TLS_RSA_PSK_WITH_AES_128_GCM_SHA256); + CHECK_NAME(TLS_RSA_PSK_WITH_AES_256_GCM_SHA384); + CHECK_NAME(TLS_PSK_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_PSK_WITH_AES_256_CBC_SHA384); + CHECK_NAME(TLS_PSK_WITH_NULL_SHA256); + CHECK_NAME(TLS_PSK_WITH_NULL_SHA384); + CHECK_NAME(TLS_DHE_PSK_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_DHE_PSK_WITH_AES_256_CBC_SHA384); + CHECK_NAME(TLS_DHE_PSK_WITH_NULL_SHA256); + CHECK_NAME(TLS_DHE_PSK_WITH_NULL_SHA384); + CHECK_NAME(TLS_RSA_PSK_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_RSA_PSK_WITH_AES_256_CBC_SHA384); + CHECK_NAME(TLS_RSA_PSK_WITH_NULL_SHA256); + CHECK_NAME(TLS_RSA_PSK_WITH_NULL_SHA384); + CHECK_NAME(TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256); + CHECK_NAME(TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256); + CHECK_NAME(TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256); + CHECK_NAME(TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256); + CHECK_NAME(TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256); + CHECK_NAME(TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256); + CHECK_NAME(TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256); + CHECK_NAME(TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256); + CHECK_NAME(TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256); + CHECK_NAME(TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256); + CHECK_NAME(TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256); + CHECK_NAME(TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256); + CHECK_NAME(TLS_EMPTY_RENEGOTIATION_INFO_SCSV); + CHECK_NAME(TLS_ECDH_ECDSA_WITH_NULL_SHA); + CHECK_NAME(TLS_ECDH_ECDSA_WITH_RC4_128_SHA); + CHECK_NAME(TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_ECDHE_ECDSA_WITH_NULL_SHA); + CHECK_NAME(TLS_ECDHE_ECDSA_WITH_RC4_128_SHA); + CHECK_NAME(TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_ECDH_RSA_WITH_NULL_SHA); + CHECK_NAME(TLS_ECDH_RSA_WITH_RC4_128_SHA); + CHECK_NAME(TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_ECDHE_RSA_WITH_NULL_SHA); + CHECK_NAME(TLS_ECDHE_RSA_WITH_RC4_128_SHA); + CHECK_NAME(TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_ECDH_anon_WITH_NULL_SHA); + CHECK_NAME(TLS_ECDH_anon_WITH_RC4_128_SHA); + CHECK_NAME(TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_ECDH_anon_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_ECDH_anon_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_SRP_SHA_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_SRP_SHA_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384); + CHECK_NAME(TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384); + CHECK_NAME(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384); + CHECK_NAME(TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384); + CHECK_NAME(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256); + CHECK_NAME(TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384); + CHECK_NAME(TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256); + CHECK_NAME(TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384); + CHECK_NAME(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256); + CHECK_NAME(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384); + CHECK_NAME(TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256); + CHECK_NAME(TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384); + CHECK_NAME(TLS_ECDHE_PSK_WITH_RC4_128_SHA); + CHECK_NAME(TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA); + CHECK_NAME(TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA); + CHECK_NAME(TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA); + CHECK_NAME(TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256); + CHECK_NAME(TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384); + CHECK_NAME(TLS_ECDHE_PSK_WITH_NULL_SHA); + CHECK_NAME(TLS_ECDHE_PSK_WITH_NULL_SHA256); + CHECK_NAME(TLS_ECDHE_PSK_WITH_NULL_SHA384); +} +END_TEST + +Suite *suites_suite_create() +{ + Suite *s; + TCase *tc; + + s = suite_create("suites"); + + tc = tcase_create("cipher-names"); + tcase_add_test(tc, test_cipher_names); + suite_add_tcase(s, tc); + + return s; +} diff --git a/src/libtls/tests/tls_tests.h b/src/libtls/tests/tls_tests.h index 2b6715a78..489b2ddb1 100644 --- a/src/libtls/tests/tls_tests.h +++ b/src/libtls/tests/tls_tests.h @@ -14,3 +14,4 @@ */ TEST_SUITE(socket_suite_create) +TEST_SUITE(suites_suite_create)