test/ssl-tests/14-curves.cnf.in

   1 # -*- mode: perl; -*-
   2
   3 ## SSL test configurations
   4
   5 package ssltests;
   6
   7 use strict;
   8 use warnings;
   9
  10 use OpenSSL::Test;
  11 use OpenSSL::Test::Utils qw(anydisabled);
  12
  13 our $fips_mode;
  14
  15 my @curves = ("prime256v1", "secp384r1", "secp521r1", "X25519",
  16               "X448");
  17 #Curves *only* suitable for use in TLSv1.3
  18 my @curves_tls_1_3 = ("brainpoolP256r1tls13", "brainpoolP384r1tls13",
  19                       "brainpoolP512r1tls13");
  20
  21 #It so happens that all the curves in @curves_tls_1_3 are non-fips curves
  22 push @curves, @curves_tls_1_3 if !$fips_mode;
  23
  24 my @curves_tls_1_2 = ("sect233k1", "sect233r1",
  25               "sect283k1", "sect283r1", "sect409k1", "sect409r1",
  26               "sect571k1", "sect571r1", "secp224r1");
  27
  28 my @curves_non_fips = ("sect163k1", "sect163r2", "prime192v1",
  29                        "sect163r1", "sect193r1", "sect193r2", "sect239k1",
  30                        "secp160k1", "secp160r1", "secp160r2", "secp192k1",
  31                        "secp224k1",  "secp256k1", "brainpoolP256r1",
  32                        "brainpoolP384r1", "brainpoolP512r1");
  33
  34 push @curves_tls_1_2, @curves_non_fips if !$fips_mode;
  35
  36 our @tests = ();
  37
  38 sub generate_tests() {
  39     foreach (0..$#curves) {
  40         my $curve = $curves[$_];
  41         push @tests, {
  42             name => "curve-${curve}",
  43             server => {
  44                 "Curves" => $curve,
  45                 "CipherString" => 'DEFAULT@SECLEVEL=1',
  46                 "MaxProtocol" => "TLSv1.3"
  47             },
  48             client => {
  49                 "CipherString" => 'ECDHE@SECLEVEL=1',
  50                 "MaxProtocol" => "TLSv1.3",
  51                 "Curves" => $curve
  52             },
  53             test   => {
  54                 "ExpectedTmpKeyType" => $curve,
  55                 "ExpectedProtocol" => "TLSv1.3",
  56                 "ExpectedResult" => "Success"
  57             },
  58         };
  59     }
  60     foreach (0..$#curves_tls_1_2) {
  61         my $curve = $curves_tls_1_2[$_];
  62         push @tests, {
  63             name => "curve-${curve}",
  64             server => {
  65                 "Curves" => $curve,
  66                 "CipherString" => 'DEFAULT@SECLEVEL=1',
  67                 "MaxProtocol" => "TLSv1.3"
  68             },
  69             client => {
  70                 "CipherString" => 'ECDHE@SECLEVEL=1',
  71                 "MaxProtocol" => "TLSv1.2",
  72                 "Curves" => $curve
  73             },
  74             test   => {
  75                 "ExpectedTmpKeyType" => $curve,
  76                 "ExpectedProtocol" => "TLSv1.2",
  77                 "ExpectedResult" => "Success"
  78             },
  79         };
  80     }
  81     foreach (0..$#curves_tls_1_2) {
  82         my $curve = $curves_tls_1_2[$_];
  83         push @tests, {
  84             name => "curve-${curve}-tls13",
  85             server => {
  86                 "Curves" => $curve,
  87                 "CipherString" => 'DEFAULT@SECLEVEL=1',
  88                 "MaxProtocol" => "TLSv1.3"
  89             },
  90             client => {
  91                 "CipherString" => 'ECDHE@SECLEVEL=1',
  92                 "MinProtocol" => "TLSv1.3",
  93                 "Curves" => $curve
  94             },
  95             test   => {
  96                 "ExpectedResult" => "ClientFail"
  97             },
  98         };
  99     }
 100     if (!$fips_mode) {
 101         foreach (0..$#curves_tls_1_3) {
 102             my $curve = $curves_tls_1_3[$_];
 103             push @tests, {
 104                 name => "curve-${curve}-tls13-in-tls12",
 105                 server => {
 106                     "Curves" => $curve,
 107                     "CipherString" => 'DEFAULT@SECLEVEL=1',
 108                     "MaxProtocol" => "TLSv1.3"
 109                 },
 110                 client => {
 111                     "CipherString" => 'ECDHE@SECLEVEL=1',
 112                     "MaxProtocol" => "TLSv1.2",
 113                     "Curves" => $curve
 114                 },
 115                 test   => {
 116                     #These curves are only suitable for TLSv1.3 so we expect the
 117                     #server to fail because it has no shared groups for TLSv1.2
 118                     #ECDHE key exchange
 119                     "ExpectedResult" => "ServerFail"
 120                 },
 121             };
 122         }
 123     }
 124 }
 125
 126 generate_tests();