ocsp-tests/certs/server_good.key ocsp-tests/certs/server_bad.key ocsp-tests/certs/server_good.template \
ocsp-tests/certs/server_bad.template ocsp-tests/certs/ocsp-staple-unrelated.der ocsp-tests/suppressions.valgrind \
data/listings-DTLS1.0 data/listings-SSL3.0 data/listings-TLS1.0 data/listings-TLS1.1 \
- data/listings-SSL3.0-TLS1.1 p11-kit-trust-data/Example_Root_CA.p11-kit \
+ data/listings-SSL3.0-TLS1.1 p11-kit-trust-data/Example_Root_CA.p11-kit server-kx-neg-common.c \
p11-kit-trust-data/Example_Root_CA.pem ocsp-resp-interesting/1492.der
mpi certificate_set_x509_crl dn parse_ca x509-dn x509-dn-decode record-sizes \
hostname-check cve-2008-4989 pkcs12_s2k chainverify record-sizes-range \
crq_key_id x509sign-verify sign-verify cve-2009-1415 cve-2009-1416 \
+ tls10-server-kx-neg tls11-server-kx-neg tls12-server-kx-neg ssl30-server-kx-neg \
crq_apis init_roundtrip pkcs12_s2k_pem dn2 mini-eagain tls-rehandshake-cert-3 \
nul-in-x509-names x509_altname pkcs12_encode mini-x509 ocsp-resp \
tls-rehandshake-cert rng-fork mini-eagain-dtls resume-dtls \
/*
- * Copyright (C) 2015 Nikos Mavrogiannopoulos
+ * Copyright (C) 2015-2017 Nikos Mavrogiannopoulos
*
* Author: Nikos Mavrogiannopoulos
*
* IPv4 server: server_ca3_localhost_utf8_cert, server_ca3_key - UTF8 names
* IPv4 server: server_ca3_localhost_inv_utf8_cert, server_ca3_key - invalid UTF8 names
* IPv4 server: insecure key: server_ca3_localhost_insecure_key, server_ca3_localhost_insecure_cert
+ * IPv4 server: RSA-decrypt key: server_ca3_localhost_rsa_decrypt_cert, server_ca3_key
+ * IPv4 server: RSA-sign-only key: server_ca3_localhost_rsa_sign_cert, server_ca3_key
*/
"6TXY44pCGHMFO6Kr\n"
"-----END CERTIFICATE-----\n";
+/* Marked as decrypt-only */
+static char server_localhost_ca3_rsa_decrypt_cert_pem[] =
+ "-----BEGIN CERTIFICATE-----\n"
+ "MIIEITCCAomgAwIBAgIIWU+IEie6JrYwDQYJKoZIhvcNAQELBQAwDzENMAsGA1UE\n"
+ "AxMEQ0EtMzAgFw0xNzA2MjUwOTUzMjNaGA85OTk5MTIzMTIzNTk1OVowADCCAaIw\n"
+ "DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBANk9eJmqLPfAu7P4Hhmcm4KmEsRf\n"
+ "uTXk1ylqYvf715riBfJ94VIdtJqKE9q4FRwMxVsv/B+SHFiIlEJfvCociQkrgSfl\n"
+ "oTNIMNrqkj8IjmVJuJd00MZsUuHlvwa6+F/PLLyUOMU03LdpuR9TbvS2fMVjmaRj\n"
+ "BiCO439GA+qHRvwxxP7FR433Hg+5JdeYwLWve/vLgm4zETxnMYOFbZpArkizpBi/\n"
+ "RYQtLmFW8HwZ0/ldDBMnDgcfmL9gRLtMQ1XZEHLNFjyEVD1JsrlgccaizNUkiUi7\n"
+ "Gbm/w3YiDVxbq3u3cee5lsNhEMIREyISKAHPy8RlnIWwwuDlnsmI0pIb9/4RH0LM\n"
+ "MlceDEFy1X0QRzYqZFPU/0l4j/FlQ6X2UqWNz63ybRSbcCzHl25abi1xmbsV5ydo\n"
+ "mJNcP+0QbripMpa0O6gjv5f0yMd7mW9/aAglPcKgpbbhGfo7V9z2gIKdUCLRXoUs\n"
+ "zhdobnRf00LrrpFUQWReKHxMcDWAL2b00kysPQIDAQABo4GNMIGKMAwGA1UdEwEB\n"
+ "/wQCMAAwFAYDVR0RBA0wC4IJbG9jYWxob3N0MBMGA1UdJQQMMAoGCCsGAQUFBwMB\n"
+ "MA8GA1UdDwEB/wQFAwMHIAAwHQYDVR0OBBYEFDOd4SfTi9X86wX8tceBaU9eO9nW\n"
+ "MB8GA1UdIwQYMBaAFPmohhljtqQUE2B2DwGaNTbv8bSvMA0GCSqGSIb3DQEBCwUA\n"
+ "A4IBgQAaq4+vai/FwYQ2fAjOsHsVV0nR5Zq55tT8Fexrj2/e9gr+bMV4HVxETByy\n"
+ "fLtMHGYv+8BENDaI2EOHTyKp5O2DNbITJSN7/ZIO4Rsk+N5m2FyF7DV/sAoxhN7R\n"
+ "mDy/jDtZyeIqKLptOQZbkRv3lf+vtJL3eakpgh5T/j14kT0QjLyJEZB1D9jurUsV\n"
+ "+fxYxQUpv4YInDeEk5aKfvZNdkEpbv56GYNc15mNiKryXoszdm+TKmHSVFH9wUj3\n"
+ "KAXBsQdMmZbd0ZFAEi7QV42Pr2x9+PrSE26bE6K31r02/RcxFQdL9E/3O+85S8eN\n"
+ "yOZoC/PIrm0mKIPn2NBGSKtCG8V1sTHHJyCwqQERp3pkaB7A9biCKExQN1d3Gsbe\n"
+ "C0R9bYimdbkYM6o7qi7OiLRKpYFgdVYaYEG3DRBpB3R3+EAKk91809tc9ow5xzkx\n"
+ "lWryqIzutm6rcClAnqeBIZEZIIvqZH8RcPBQEUajNCWRpBsbwF1xdWvIhP2R3y69\n"
+ "5dOfcuY=\n"
+ "-----END CERTIFICATE-----\n";
+
+/* Marked as sign-only */
+static char server_localhost_ca3_rsa_sign_cert_pem[] =
+ "-----BEGIN CERTIFICATE-----\n"
+ "MIIEITCCAomgAwIBAgIIWU+LoyEYfBYwDQYJKoZIhvcNAQELBQAwDzENMAsGA1UE\n"
+ "AxMEQ0EtMzAgFw0xNzA2MjUxMDA4MzZaGA85OTk5MTIzMTIzNTk1OVowADCCAaIw\n"
+ "DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBANk9eJmqLPfAu7P4Hhmcm4KmEsRf\n"
+ "uTXk1ylqYvf715riBfJ94VIdtJqKE9q4FRwMxVsv/B+SHFiIlEJfvCociQkrgSfl\n"
+ "oTNIMNrqkj8IjmVJuJd00MZsUuHlvwa6+F/PLLyUOMU03LdpuR9TbvS2fMVjmaRj\n"
+ "BiCO439GA+qHRvwxxP7FR433Hg+5JdeYwLWve/vLgm4zETxnMYOFbZpArkizpBi/\n"
+ "RYQtLmFW8HwZ0/ldDBMnDgcfmL9gRLtMQ1XZEHLNFjyEVD1JsrlgccaizNUkiUi7\n"
+ "Gbm/w3YiDVxbq3u3cee5lsNhEMIREyISKAHPy8RlnIWwwuDlnsmI0pIb9/4RH0LM\n"
+ "MlceDEFy1X0QRzYqZFPU/0l4j/FlQ6X2UqWNz63ybRSbcCzHl25abi1xmbsV5ydo\n"
+ "mJNcP+0QbripMpa0O6gjv5f0yMd7mW9/aAglPcKgpbbhGfo7V9z2gIKdUCLRXoUs\n"
+ "zhdobnRf00LrrpFUQWReKHxMcDWAL2b00kysPQIDAQABo4GNMIGKMAwGA1UdEwEB\n"
+ "/wQCMAAwFAYDVR0RBA0wC4IJbG9jYWxob3N0MBMGA1UdJQQMMAoGCCsGAQUFBwMB\n"
+ "MA8GA1UdDwEB/wQFAwMHgAAwHQYDVR0OBBYEFDOd4SfTi9X86wX8tceBaU9eO9nW\n"
+ "MB8GA1UdIwQYMBaAFPmohhljtqQUE2B2DwGaNTbv8bSvMA0GCSqGSIb3DQEBCwUA\n"
+ "A4IBgQC1cJd/z1CQSyDfUd2uuNDTvA3WXWxNhqHMLitT1GJS6nUez+wCaWT9UfVy\n"
+ "+56z/eMaVasZPQ8dOKYdPRuzL2l65DKUUaKFOyD+NGvOS08qKY+oVGN1Qbmaxbvt\n"
+ "6rvzpW9UHn75zLDOUOMrGDkW5L36mMP8I0Y5AcNBrO5yFBvH8MAHr3zO2VvTSt6T\n"
+ "ZHFrDlV/nL5E+swzrmF6MZXO1mupk/gtelYfRtigwSr51RY+Me3uaGNEQe30JLu6\n"
+ "0gp6/otBns9qJjSgX9qWIj9iTHq4A2CiHZkb4j3+/TNNGB8dkBV+EvV8I4Bqdk33\n"
+ "mz4hSjJBLqg2NYZ4TaztWFsgTvGOYncLGl5e4dIqB94ICEFIrWN32JzS61Mu5xlt\n"
+ "qBh/JOUSdMe6csZrDIw//UhUgLj7KdFO5FhSW3DXEl9PZGWVR+LJ+T3HjomHf+Bb\n"
+ "ATbBQk+9MkHTiDWxD4FbmPuSC/h4Vh+G1VkyrlClTLW6K/+0DmE2LPJvRV5udpux\n"
+ "Ar7fYYU=\n"
+ "-----END CERTIFICATE-----\n";
+
static char server_localhost_ca3_cert_chain_pem[] =
"-----BEGIN CERTIFICATE-----\n"
"MIIEKDCCApCgAwIBAgIMV6MdMjbIDKHKsL32MA0GCSqGSIb3DQEBCwUAMBIxEDAO\n"
const gnutls_datum_t server_ca3_localhost_cert = { (void*)server_localhost_ca3_cert_pem,
sizeof(server_localhost_ca3_cert_pem)-1};
+const gnutls_datum_t server_ca3_localhost_rsa_decrypt_cert = { (void*)server_localhost_ca3_rsa_decrypt_cert_pem,
+ sizeof(server_localhost_ca3_rsa_decrypt_cert_pem)-1};
+
+const gnutls_datum_t server_ca3_localhost_rsa_sign_cert = { (void*)server_localhost_ca3_rsa_sign_cert_pem,
+ sizeof(server_localhost_ca3_rsa_sign_cert_pem)-1};
+
const gnutls_datum_t server_ca3_localhost_cert_chain = {
(void*)server_localhost_ca3_cert_chain_pem,
sizeof(server_localhost_ca3_cert_chain_pem)-1
--- /dev/null
+/*
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ */
+#include <assert.h>
+
+typedef struct test_case_st {
+ const char *name;
+ int server_ret;
+ int client_ret;
+ unsigned have_anon_cred;
+ unsigned have_anon_dh_params;
+ unsigned have_srp_cred;
+ unsigned have_psk_cred;
+ unsigned have_psk_dh_params;
+ unsigned have_cert_cred;
+ unsigned have_cert_dh_params;
+ unsigned have_rsa_sign_cert;
+ unsigned have_ecc_sign_cert;
+ unsigned have_rsa_decrypt_cert;
+ unsigned not_on_fips;
+ const char *client_prio;
+ const char *server_prio;
+} test_case_st;
+
+static int
+serv_psk_func(gnutls_session_t session, const char *username,
+ gnutls_datum_t * key) {
+ key->data = gnutls_malloc(4);
+ assert(key->data != NULL);
+ key->data[0] = 0xDE;
+ key->data[1] = 0xAD;
+ key->data[2] = 0xBE;
+ key->data[3] = 0xEF;
+ key->size = 4;
+ return 0;
+}
+
+#define SALT_TEST1 "3a3xX3Myzb9YJn5X0R7sbx"
+#define VERIF_TEST1 "CEqjUZBlkQCocfOR0E4AsPZKOFYPGjKFMHW7KDcnpE4sH4.iGMbkygb/bViRNjskF9/TQdD46Mvlt6pLs5MZoTn8mO3G.RGyXdWuIrhnVn29p41Cpc5RhTLaeUm3asW6LF60VTKnGERC0eB37xZUsaTpzmaTNdD4mOoYCN3bD9Y"
+#define PRIME "Ewl2hcjiutMd3Fu2lgFnUXWSc67TVyy2vwYCKoS9MLsrdJVT9RgWTCuEqWJrfB6uE3LsE9GkOlaZabS7M29sj5TnzUqOLJMjiwEzArfiLr9WbMRANlF68N5AVLcPWvNx6Zjl3m5Scp0BzJBz9TkgfhzKJZ.WtP3Mv/67I/0wmRZ"
+gnutls_datum_t tprime =
+{
+ .data = (void*)PRIME,
+ .size = sizeof(PRIME)-1
+};
+
+gnutls_datum_t test1_verif =
+{
+ .data = (void*)VERIF_TEST1,
+ .size = sizeof(VERIF_TEST1)-1
+};
+
+gnutls_datum_t test1_salt =
+{
+ .data = (void*)SALT_TEST1,
+ .size = sizeof(SALT_TEST1)-1
+};
+
+static int
+serv_srp_func(gnutls_session_t session, const char *username,
+ gnutls_datum_t *salt, gnutls_datum_t *verifier, gnutls_datum_t *generator,
+ gnutls_datum_t *prime)
+{
+ int ret;
+ if (debug)
+ printf("srp: username %s\n", username);
+
+ generator->data = gnutls_malloc(1);
+ generator->data[0] = 2;
+ generator->size = 1;
+
+ ret = gnutls_srp_base64_decode2(&tprime, prime);
+ if (ret < 0)
+ fail("error in gnutls_srp_base64_decode2 -prime\n");
+
+ if (strcmp(username, "test1") == 0) {
+ ret = gnutls_srp_base64_decode2(&test1_verif, verifier);
+ if (ret < 0)
+ fail("error in gnutls_srp_base64_decode2 -verif\n");
+
+
+ ret = gnutls_srp_base64_decode2(&test1_salt, salt);
+ if (ret < 0)
+ fail("error in gnutls_srp_base64_decode2 -salt\n");
+ } else {
+ fail("Unknown username %s\n", username);
+ }
+
+ return 0;
+}
+
+static void try(test_case_st *test)
+{
+ int sret, cret;
+ gnutls_anon_client_credentials_t c_anon_cred;
+ gnutls_anon_server_credentials_t s_anon_cred;
+ gnutls_psk_client_credentials_t c_psk_cred;
+ gnutls_psk_server_credentials_t s_psk_cred;
+ gnutls_certificate_credentials_t s_cert_cred;
+ gnutls_certificate_credentials_t c_cert_cred;
+ gnutls_srp_server_credentials_t s_srp_cred;
+ gnutls_srp_client_credentials_t c_srp_cred;
+
+ gnutls_session_t server, client;
+ const gnutls_datum_t pskkey = { (void *) "DEADBEEF", 8 };
+
+ if (test->not_on_fips && gnutls_fips140_mode_enabled()) {
+ success("Skipping %s...\n", test->name);
+ return;
+ }
+
+ success("Running %s...\n", test->name);
+
+ assert(gnutls_anon_allocate_client_credentials(&c_anon_cred) >= 0);
+ assert(gnutls_anon_allocate_server_credentials(&s_anon_cred) >= 0);
+ assert(gnutls_psk_allocate_client_credentials(&c_psk_cred) >= 0);
+ assert(gnutls_psk_allocate_server_credentials(&s_psk_cred) >= 0);
+ assert(gnutls_srp_allocate_client_credentials(&c_srp_cred) >= 0);
+ assert(gnutls_srp_allocate_server_credentials(&s_srp_cred) >= 0);
+ assert(gnutls_certificate_allocate_credentials(&s_cert_cred) >= 0);
+ assert(gnutls_certificate_allocate_credentials(&c_cert_cred) >= 0);
+
+ assert(gnutls_init(&server, GNUTLS_SERVER)>=0);
+ assert(gnutls_init(&client, GNUTLS_CLIENT)>=0);
+
+ if (test->have_anon_cred) {
+ gnutls_credentials_set(server, GNUTLS_CRD_ANON, s_anon_cred);
+ if (test->have_anon_dh_params)
+ gnutls_anon_set_server_known_dh_params(s_anon_cred, GNUTLS_SEC_PARAM_MEDIUM);
+ }
+
+ if (test->have_cert_cred) {
+ gnutls_credentials_set(server, GNUTLS_CRD_CERTIFICATE, s_cert_cred);
+ if (test->have_cert_dh_params)
+ gnutls_certificate_set_known_dh_params(s_cert_cred, GNUTLS_SEC_PARAM_MEDIUM);
+ }
+
+ if (test->have_psk_cred) {
+ gnutls_credentials_set(server, GNUTLS_CRD_PSK, s_psk_cred);
+ if (test->have_psk_dh_params)
+ gnutls_psk_set_server_known_dh_params(s_psk_cred, GNUTLS_SEC_PARAM_MEDIUM);
+
+ gnutls_psk_set_server_credentials_function(s_psk_cred, serv_psk_func);
+ }
+
+ if (test->have_srp_cred) {
+ gnutls_credentials_set(server, GNUTLS_CRD_SRP, s_srp_cred);
+
+ gnutls_srp_set_server_credentials_function(s_srp_cred, serv_srp_func);
+ }
+
+ if (test->have_rsa_decrypt_cert) {
+ assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_localhost_rsa_decrypt_cert, &server_ca3_key, GNUTLS_X509_FMT_PEM) >= 0);
+ }
+
+ if (test->have_ecc_sign_cert) {
+ assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_localhost_ecc_cert, &server_ca3_ecc_key, GNUTLS_X509_FMT_PEM) >= 0);
+ }
+
+ if (test->have_rsa_sign_cert) {
+ assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_localhost_rsa_sign_cert, &server_ca3_key, GNUTLS_X509_FMT_PEM) >= 0);
+ }
+
+ /* client does everything */
+ gnutls_credentials_set(client, GNUTLS_CRD_ANON, c_anon_cred);
+ gnutls_credentials_set(client, GNUTLS_CRD_CERTIFICATE, c_cert_cred);
+ gnutls_credentials_set(client, GNUTLS_CRD_PSK, c_psk_cred);
+ gnutls_credentials_set(client, GNUTLS_CRD_SRP, c_srp_cred);
+
+ assert(gnutls_psk_set_client_credentials(c_psk_cred, "psk", &pskkey, GNUTLS_PSK_KEY_HEX) >= 0);
+
+ assert(gnutls_srp_set_client_credentials(c_srp_cred, "test1", "test") >= 0);
+
+ gnutls_transport_set_push_function(server, server_push);
+ gnutls_transport_set_pull_function(server, server_pull);
+ gnutls_transport_set_ptr(server, server);
+ assert(gnutls_priority_set_direct(server, test->server_prio, 0) >= 0);
+
+ gnutls_transport_set_push_function(client, client_push);
+ gnutls_transport_set_pull_function(client, client_pull);
+ gnutls_transport_set_ptr(client, client);
+ assert(gnutls_priority_set_direct(client, test->client_prio, 0) >= 0);
+
+ HANDSHAKE_EXPECT(client, server, test->client_ret, test->server_ret);
+
+ gnutls_deinit(server);
+ gnutls_deinit(client);
+ gnutls_anon_free_client_credentials(c_anon_cred);
+ gnutls_anon_free_server_credentials(s_anon_cred);
+ gnutls_psk_free_client_credentials(c_psk_cred);
+ gnutls_psk_free_server_credentials(s_psk_cred);
+ gnutls_srp_free_client_credentials(c_srp_cred);
+ gnutls_srp_free_server_credentials(s_srp_cred);
+ gnutls_certificate_free_credentials(s_cert_cred);
+ gnutls_certificate_free_credentials(c_cert_cred);
+
+ reset_buffers();
+}
--- /dev/null
+/*
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+/* This program tests the ciphersuite negotiation for various key exchange
+ * methods and options. */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnutls/gnutls.h>
+#include "utils.h"
+#include "cert-common.h"
+#include "eagain-common.h"
+
+#include "server-kx-neg-common.c"
+
+test_case_st tests[] = {
+ {
+ .name = "SSL 3.0 ANON-DH without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .server_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-SSL3.0",
+ .client_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-SSL3.0"
+ },
+ {
+ .name = "SSL 3.0 ANON-DH with cred but no DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_anon_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-SSL3.0",
+ .client_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-SSL3.0"
+ },
+ {
+ .name = "SSL 3.0 ANON-DH with cred and DH params",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_anon_cred = 1,
+ .have_anon_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-SSL3.0",
+ .client_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-SSL3.0"
+ },
+ {
+ .name = "SSL 3.0 DHE-RSA without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0"
+ },
+ {
+ .name = "SSL 3.0 DHE-RSA with cred but no DH params or cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0"
+ },
+ {
+ .name = "SSL 3.0 DHE-RSA with cred and cert but no DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0"
+ },
+ {
+ .name = "SSL 3.0 DHE-RSA with cred and DH params but no cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0"
+ },
+ {
+ .name = "SSL 3.0 DHE-RSA with cred and incompatible cert and DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0"
+ },
+ {
+ .name = "SSL 3.0 DHE-RSA with cred and cert and DH params",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0"
+ },
+ {
+ .name = "SSL 3.0 DHE-RSA with cred and multiple certs and DH params",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-SSL3.0"
+ },
+ {
+ .name = "SSL 3.0 DHE-PSK without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-SSL3.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-SSL3.0"
+ },
+ {
+ .name = "SSL 3.0 DHE-PSK with cred but no DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_psk_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-SSL3.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-SSL3.0"
+ },
+ {
+ .name = "SSL 3.0 DHE-PSK with cred DH params",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_psk_cred = 1,
+ .have_psk_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-SSL3.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-SSL3.0"
+ }
+};
+
+void doit(void)
+{
+#ifdef ENABLE_SSL3
+ unsigned i;
+ global_init();
+
+ for (i=0;i<sizeof(tests)/sizeof(tests[0]);i++) {
+ try(&tests[i]);
+ }
+
+ gnutls_global_deinit();
+#else
+ exit(77);
+#endif
+}
--- /dev/null
+/*
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+/* This program tests the ciphersuite negotiation for various key exchange
+ * methods and options. */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnutls/gnutls.h>
+#include "utils.h"
+#include "cert-common.h"
+#include "eagain-common.h"
+
+#include "server-kx-neg-common.c"
+
+test_case_st tests[] = {
+ {
+ .name = "TLS 1.0 ANON-DH without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .server_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 ANON-DH with cred but no DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_anon_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 ANON-DH with cred and DH params",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_anon_cred = 1,
+ .have_anon_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 DHE-RSA without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 DHE-RSA with cred but no DH params or cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 DHE-RSA with cred and cert but no DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 DHE-RSA with cred and DH params but no cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 DHE-RSA with cred and incompatible cert and DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 DHE-RSA with cred and cert and DH params",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 DHE-RSA with cred and multiple certs and DH params",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 DHE-PSK without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 DHE-PSK with cred but no DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_psk_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 DHE-PSK with cred DH params",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_psk_cred = 1,
+ .have_psk_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-RSA without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-RSA with cred but no common curve or cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-RSA with cred and cert but no common curve",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-RSA with cred and common curve but no cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-RSA with cred and incompatible cert and common curve",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-RSA with cred and cert and common curve",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-RSA with cred and multiple certs and common curve",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+
+ {
+ .name = "TLS 1.0 ECDHE-ECDSA without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-ECDSA with cred but no common curve or cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-ECDSA with cred and cert but no common curve",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-ECDSA with cred and common curve but no ECDSA cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-ECDSA with cred and common curve but no cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-ECDSA with cred and cert and common curve",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_cert_cred = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-ECDSA with cred and multiple certs and common curve",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_cert_cred = 1,
+ .have_ecc_sign_cert = 1,
+ .have_rsa_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+
+ {
+ .name = "TLS 1.0 ECDHE-PSK without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-PSK with cred but no common curve",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_psk_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.0:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.0:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.0 ECDHE-PSK with cred and common curve",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_psk_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 RSA-PSK without cert cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .have_psk_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 RSA-PSK without psk cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_psk_cred = 0,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 RSA-PSK with cred but invalid cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_psk_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 RSA-PSK with cred",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_psk_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 RSA-PSK with cred and multiple certs",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_psk_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 SRP-RSA without cert cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .have_srp_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 SRP-RSA without srp cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_srp_cred = 0,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 SRP-RSA with cred but invalid cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_srp_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 SRP-RSA with cred",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_srp_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 SRP-RSA with cred and multiple certs",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_srp_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 SRP without srp cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .have_srp_cred = 0,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.0"
+ },
+ {
+ .name = "TLS 1.0 SRP with cred",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_srp_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.0",
+ .client_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.0"
+ }
+};
+
+void doit(void)
+{
+ unsigned i;
+ global_init();
+
+ for (i=0;i<sizeof(tests)/sizeof(tests[0]);i++) {
+ try(&tests[i]);
+ }
+
+ gnutls_global_deinit();
+}
--- /dev/null
+/*
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+/* This program tests the ciphersuite negotiation for various key exchange
+ * methods and options. */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnutls/gnutls.h>
+#include "utils.h"
+#include "cert-common.h"
+#include "eagain-common.h"
+
+#include "server-kx-neg-common.c"
+
+test_case_st tests[] = {
+ {
+ .name = "TLS 1.1 ANON-DH without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .server_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 ANON-DH with cred but no DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_anon_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 ANON-DH with cred and DH params",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_anon_cred = 1,
+ .have_anon_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 DHE-RSA without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 DHE-RSA with cred but no DH params or cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 DHE-RSA with cred and cert but no DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 DHE-RSA with cred and DH params but no cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 DHE-RSA with cred and incompatible cert and DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 DHE-RSA with cred and cert and DH params",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 DHE-RSA with cred and multiple certs and DH params",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 DHE-PSK without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 DHE-PSK with cred but no DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_psk_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 DHE-PSK with cred DH params",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_psk_cred = 1,
+ .have_psk_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-RSA without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-RSA with cred but no common curve or cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-RSA with cred and cert but no common curve",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-RSA with cred and common curve but no cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-RSA with cred and incompatible cert and common curve",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-RSA with cred and cert and common curve",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-RSA with cred and multiple certs and common curve",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+
+ {
+ .name = "TLS 1.1 ECDHE-ECDSA without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-ECDSA with cred but no common curve or cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-ECDSA with cred and cert but no common curve",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-ECDSA with cred and common curve but no ECDSA cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-ECDSA with cred and common curve but no cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-ECDSA with cred and cert and common curve",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_cert_cred = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-ECDSA with cred and multiple certs and common curve",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_cert_cred = 1,
+ .have_ecc_sign_cert = 1,
+ .have_rsa_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+
+ {
+ .name = "TLS 1.1 ECDHE-PSK without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-PSK with cred but no common curve",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_psk_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.1:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.1:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.1 ECDHE-PSK with cred and common curve",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_psk_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 RSA-PSK without cert cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .have_psk_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 RSA-PSK without psk cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_psk_cred = 0,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 RSA-PSK with cred but invalid cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_psk_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 RSA-PSK with cred",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_psk_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 RSA-PSK with cred and multiple certs",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_psk_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 SRP-RSA without cert cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .have_srp_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 SRP-RSA without srp cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_srp_cred = 0,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 SRP-RSA with cred but invalid cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_srp_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 SRP-RSA with cred",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_srp_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 SRP-RSA with cred and multiple certs",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_srp_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 SRP without srp cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .have_srp_cred = 0,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.1"
+ },
+ {
+ .name = "TLS 1.1 SRP with cred",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_srp_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.1",
+ .client_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.1"
+ }
+};
+
+void doit(void)
+{
+ unsigned i;
+ global_init();
+
+ for (i=0;i<sizeof(tests)/sizeof(tests[0]);i++) {
+ try(&tests[i]);
+ }
+
+ gnutls_global_deinit();
+}
--- /dev/null
+/*
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+/* This program tests the ciphersuite negotiation for various key exchange
+ * methods and options. */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <gnutls/gnutls.h>
+#include "utils.h"
+#include "cert-common.h"
+#include "eagain-common.h"
+
+#include "server-kx-neg-common.c"
+
+test_case_st tests[] = {
+ {
+ .name = "TLS 1.2 ANON-DH without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .server_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 ANON-DH with cred but no DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_anon_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 ANON-DH with cred and DH params",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_anon_cred = 1,
+ .have_anon_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ANON-DH:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 DHE-RSA without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 DHE-RSA with cred but no DH params or cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 DHE-RSA with cred and cert but no DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 DHE-RSA with cred and DH params but no cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 DHE-RSA with cred and incompatible cert and DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 DHE-RSA with cred and cert and DH params",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 DHE-RSA with cred and multiple certs and DH params",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_cert_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 DHE-PSK without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 DHE-PSK with cred but no DH params",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_psk_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 DHE-PSK with cred DH params",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_psk_cred = 1,
+ .have_psk_dh_params = 1,
+ .server_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+DHE-PSK:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-RSA without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-RSA with cred but no common curve or cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-RSA with cred and cert but no common curve",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-RSA with cred and common curve but no cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-RSA with cred and incompatible cert and common curve",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-RSA with cred and cert and common curve",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-RSA with cred and multiple certs and common curve",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+
+ {
+ .name = "TLS 1.2 ECDHE-ECDSA without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-ECDSA with cred but no common curve or cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-ECDSA with cred and cert but no common curve",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-ECDSA with cred and common curve but no ECDSA cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-ECDSA with cred and common curve but no cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-ECDSA with cred and cert and common curve",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_cert_cred = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-ECDSA with cred and multiple certs and common curve",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_cert_cred = 1,
+ .have_ecc_sign_cert = 1,
+ .have_rsa_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-ECDSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+
+ {
+ .name = "TLS 1.2 ECDHE-PSK without cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-PSK with cred but no common curve",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_psk_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.2:-CURVE-ALL:+CURVE-SECP256R1",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.2:-CURVE-ALL:+CURVE-SECP384R1"
+ },
+ {
+ .name = "TLS 1.2 ECDHE-PSK with cred and common curve",
+ .client_ret = 0,
+ .server_ret = 0,
+ .have_psk_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+ECDHE-PSK:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 RSA-PSK without cert cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .have_psk_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 RSA-PSK without psk cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_psk_cred = 0,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 RSA-PSK with cred but invalid cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_psk_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 RSA-PSK with cred",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_psk_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 RSA-PSK with cred and multiple certs",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_psk_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+RSA-PSK:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 SRP-RSA without cert cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .have_srp_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 SRP-RSA without srp cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_srp_cred = 0,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 SRP-RSA with cred but invalid cert",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+ .have_srp_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_decrypt_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 SRP-RSA with cred",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_srp_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 SRP-RSA with cred and multiple certs",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_srp_cred = 1,
+ .have_cert_cred = 1,
+ .have_rsa_sign_cert = 1,
+ .have_ecc_sign_cert = 1,
+ .have_rsa_decrypt_cert = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+SRP-RSA:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 SRP without srp cred",
+ .client_ret = GNUTLS_E_AGAIN,
+ .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+ .have_srp_cred = 0,
+ .have_cert_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.2"
+ },
+ {
+ .name = "TLS 1.2 SRP with cred",
+ .server_ret = 0,
+ .client_ret = 0,
+ .have_srp_cred = 1,
+ .server_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.2",
+ .client_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.2"
+ }
+};
+
+void doit(void)
+{
+ unsigned i;
+ global_init();
+
+ for (i=0;i<sizeof(tests)/sizeof(tests[0]);i++) {
+ try(&tests[i]);
+ }
+
+ gnutls_global_deinit();
+}
projects / thirdparty / gnutls.git / commitdiff
