From: Tomas Mraz Date: Wed, 17 Apr 2024 16:05:35 +0000 (+0200) Subject: test/ssl-tests: Avoid depending on X25519 and X448 being fips approved X-Git-Tag: openssl-3.1.6~23 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=99a6fe4c4ac0bc5b3e53baa1ada8f4159fad093f;p=thirdparty%2Fopenssl.git test/ssl-tests: Avoid depending on X25519 and X448 being fips approved Reviewed-by: Paul Dale Reviewed-by: Tom Cosgrove (Merged from https://github.com/openssl/openssl/pull/24348) (cherry picked from commit 32ca45d3f905d014c44e1570617d96a7372c324d) --- diff --git a/test/ssl-tests/14-curves.cnf.in b/test/ssl-tests/14-curves.cnf.in index 1e003bace0b..33201df281f 100644 --- a/test/ssl-tests/14-curves.cnf.in +++ b/test/ssl-tests/14-curves.cnf.in @@ -12,8 +12,11 @@ use OpenSSL::Test::Utils qw(anydisabled); our $fips_mode; -my @curves = ("prime256v1", "secp384r1", "secp521r1", "X25519", - "X448"); +my @curves = ("prime256v1", "secp384r1", "secp521r1"); + +my @curves_no_fips = ("X25519", "X448"); + +push @curves, @curves_no_fips if !$fips_mode; #Curves *only* suitable for use in TLSv1.3 my @curves_tls_1_3 = ("ffdhe2048", "ffdhe3072", "ffdhe4096", "ffdhe6144", diff --git a/test/ssl-tests/20-cert-select.cnf b/test/ssl-tests/20-cert-select.cnf index 819c72b5a84..6e4c032b95d 100644 --- a/test/ssl-tests/20-cert-select.cnf +++ b/test/ssl-tests/20-cert-select.cnf @@ -19,12 +19,12 @@ test-13 = 13-Suite B P-256 Hash Algorithm Selection test-14 = 14-Suite B P-384 Hash Algorithm Selection test-15 = 15-Ed25519 CipherString and Signature Algorithm Selection test-16 = 16-Ed448 CipherString and Signature Algorithm Selection -test-17 = 17-Ed25519 CipherString and Curves Selection -test-18 = 18-Ed448 CipherString and Curves Selection -test-19 = 19-TLS 1.2 Ed25519 Client Auth -test-20 = 20-TLS 1.2 Ed448 Client Auth -test-21 = 21-ECDSA Signature Algorithm Selection SHA1 -test-22 = 22-ECDSA with brainpool +test-17 = 17-TLS 1.2 Ed25519 Client Auth +test-18 = 18-TLS 1.2 Ed448 Client Auth +test-19 = 19-ECDSA Signature Algorithm Selection SHA1 +test-20 = 20-ECDSA with brainpool +test-21 = 21-Ed25519 CipherString and Curves Selection +test-22 = 22-Ed448 CipherString and Curves Selection test-23 = 23-RSA-PSS Certificate CipherString Selection test-24 = 24-RSA-PSS Certificate Legacy Signature Algorithm Selection test-25 = 25-RSA-PSS Certificate Unified Signature Algorithm Selection @@ -602,91 +602,21 @@ ExpectedServerSignType = Ed448 # =========================================================== -[17-Ed25519 CipherString and Curves Selection] -ssl_conf = 17-Ed25519 CipherString and Curves Selection-ssl +[17-TLS 1.2 Ed25519 Client Auth] +ssl_conf = 17-TLS 1.2 Ed25519 Client Auth-ssl -[17-Ed25519 CipherString and Curves Selection-ssl] -server = 17-Ed25519 CipherString and Curves Selection-server -client = 17-Ed25519 CipherString and Curves Selection-client +[17-TLS 1.2 Ed25519 Client Auth-ssl] +server = 17-TLS 1.2 Ed25519 Client Auth-server +client = 17-TLS 1.2 Ed25519 Client Auth-client -[17-Ed25519 CipherString and Curves Selection-server] -Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem -CipherString = DEFAULT -ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem -ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem -Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem -Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem -MaxProtocol = TLSv1.2 -PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem - -[17-Ed25519 CipherString and Curves Selection-client] -CipherString = aECDSA -Curves = X25519 -MaxProtocol = TLSv1.2 -SignatureAlgorithms = ECDSA+SHA256:ed25519 -VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem -VerifyMode = Peer - -[test-17] -ExpectedResult = Success -ExpectedServerCertType = Ed25519 -ExpectedServerSignType = Ed25519 - - -# =========================================================== - -[18-Ed448 CipherString and Curves Selection] -ssl_conf = 18-Ed448 CipherString and Curves Selection-ssl - -[18-Ed448 CipherString and Curves Selection-ssl] -server = 18-Ed448 CipherString and Curves Selection-server -client = 18-Ed448 CipherString and Curves Selection-client - -[18-Ed448 CipherString and Curves Selection-server] -Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem -CipherString = DEFAULT -ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem -ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem -Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem -Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem -Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem -Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem -MaxProtocol = TLSv1.2 -PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem - -[18-Ed448 CipherString and Curves Selection-client] -CipherString = aECDSA -Curves = X448 -MaxProtocol = TLSv1.2 -SignatureAlgorithms = ECDSA+SHA256:ed448 -VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem -VerifyMode = Peer - -[test-18] -ExpectedResult = Success -ExpectedServerCertType = Ed448 -ExpectedServerSignType = Ed448 - - -# =========================================================== - -[19-TLS 1.2 Ed25519 Client Auth] -ssl_conf = 19-TLS 1.2 Ed25519 Client Auth-ssl - -[19-TLS 1.2 Ed25519 Client Auth-ssl] -server = 19-TLS 1.2 Ed25519 Client Auth-server -client = 19-TLS 1.2 Ed25519 Client Auth-client - -[19-TLS 1.2 Ed25519 Client Auth-server] +[17-TLS 1.2 Ed25519 Client Auth-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem VerifyMode = Require -[19-TLS 1.2 Ed25519 Client Auth-client] +[17-TLS 1.2 Ed25519 Client Auth-client] CipherString = DEFAULT Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem @@ -695,7 +625,7 @@ MinProtocol = TLSv1.2 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-19] +[test-17] ExpectedClientCertType = Ed25519 ExpectedClientSignType = Ed25519 ExpectedResult = Success @@ -703,21 +633,21 @@ ExpectedResult = Success # =========================================================== -[20-TLS 1.2 Ed448 Client Auth] -ssl_conf = 20-TLS 1.2 Ed448 Client Auth-ssl +[18-TLS 1.2 Ed448 Client Auth] +ssl_conf = 18-TLS 1.2 Ed448 Client Auth-ssl -[20-TLS 1.2 Ed448 Client Auth-ssl] -server = 20-TLS 1.2 Ed448 Client Auth-server -client = 20-TLS 1.2 Ed448 Client Auth-client +[18-TLS 1.2 Ed448 Client Auth-ssl] +server = 18-TLS 1.2 Ed448 Client Auth-server +client = 18-TLS 1.2 Ed448 Client Auth-client -[20-TLS 1.2 Ed448 Client Auth-server] +[18-TLS 1.2 Ed448 Client Auth-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem VerifyMode = Require -[20-TLS 1.2 Ed448 Client Auth-client] +[18-TLS 1.2 Ed448 Client Auth-client] CipherString = DEFAULT Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem @@ -726,7 +656,7 @@ MinProtocol = TLSv1.2 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-20] +[test-18] ExpectedClientCertType = Ed448 ExpectedClientSignType = Ed448 ExpectedResult = Success @@ -734,14 +664,14 @@ ExpectedResult = Success # =========================================================== -[21-ECDSA Signature Algorithm Selection SHA1] -ssl_conf = 21-ECDSA Signature Algorithm Selection SHA1-ssl +[19-ECDSA Signature Algorithm Selection SHA1] +ssl_conf = 19-ECDSA Signature Algorithm Selection SHA1-ssl -[21-ECDSA Signature Algorithm Selection SHA1-ssl] -server = 21-ECDSA Signature Algorithm Selection SHA1-server -client = 21-ECDSA Signature Algorithm Selection SHA1-client +[19-ECDSA Signature Algorithm Selection SHA1-ssl] +server = 19-ECDSA Signature Algorithm Selection SHA1-server +client = 19-ECDSA Signature Algorithm Selection SHA1-client -[21-ECDSA Signature Algorithm Selection SHA1-server] +[19-ECDSA Signature Algorithm Selection SHA1-server] Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem CipherString = DEFAULT:@SECLEVEL=0 ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem @@ -753,13 +683,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem MaxProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem -[21-ECDSA Signature Algorithm Selection SHA1-client] +[19-ECDSA Signature Algorithm Selection SHA1-client] CipherString = DEFAULT:@SECLEVEL=0 SignatureAlgorithms = ECDSA+SHA1 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-21] +[test-19] ExpectedResult = Success ExpectedServerCertType = P-256 ExpectedServerSignHash = SHA1 @@ -768,20 +698,20 @@ ExpectedServerSignType = EC # =========================================================== -[22-ECDSA with brainpool] -ssl_conf = 22-ECDSA with brainpool-ssl +[20-ECDSA with brainpool] +ssl_conf = 20-ECDSA with brainpool-ssl -[22-ECDSA with brainpool-ssl] -server = 22-ECDSA with brainpool-server -client = 22-ECDSA with brainpool-client +[20-ECDSA with brainpool-ssl] +server = 20-ECDSA with brainpool-server +client = 20-ECDSA with brainpool-client -[22-ECDSA with brainpool-server] +[20-ECDSA with brainpool-server] Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-cert.pem CipherString = DEFAULT Groups = brainpoolP256r1 PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-brainpoolP256r1-key.pem -[22-ECDSA with brainpool-client] +[20-ECDSA with brainpool-client] CipherString = aECDSA Groups = brainpoolP256r1 MaxProtocol = TLSv1.2 @@ -789,13 +719,83 @@ RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyMode = Peer -[test-22] +[test-20] ExpectedResult = Success ExpectedServerCANames = empty ExpectedServerCertType = brainpoolP256r1 ExpectedServerSignType = EC +# =========================================================== + +[21-Ed25519 CipherString and Curves Selection] +ssl_conf = 21-Ed25519 CipherString and Curves Selection-ssl + +[21-Ed25519 CipherString and Curves Selection-ssl] +server = 21-Ed25519 CipherString and Curves Selection-server +client = 21-Ed25519 CipherString and Curves Selection-client + +[21-Ed25519 CipherString and Curves Selection-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem +ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem +MaxProtocol = TLSv1.2 +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[21-Ed25519 CipherString and Curves Selection-client] +CipherString = aECDSA +Curves = X25519 +MaxProtocol = TLSv1.2 +SignatureAlgorithms = ECDSA+SHA256:ed25519 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-21] +ExpectedResult = Success +ExpectedServerCertType = Ed25519 +ExpectedServerSignType = Ed25519 + + +# =========================================================== + +[22-Ed448 CipherString and Curves Selection] +ssl_conf = 22-Ed448 CipherString and Curves Selection-ssl + +[22-Ed448 CipherString and Curves Selection-ssl] +server = 22-Ed448 CipherString and Curves Selection-server +client = 22-Ed448 CipherString and Curves Selection-client + +[22-Ed448 CipherString and Curves Selection-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem +ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem +Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem +Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem +Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem +Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem +MaxProtocol = TLSv1.2 +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[22-Ed448 CipherString and Curves Selection-client] +CipherString = aECDSA +Curves = X448 +MaxProtocol = TLSv1.2 +SignatureAlgorithms = ECDSA+SHA256:ed448 +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem +VerifyMode = Peer + +[test-22] +ExpectedResult = Success +ExpectedServerCertType = Ed448 +ExpectedServerSignType = Ed448 + + # =========================================================== [23-RSA-PSS Certificate CipherString Selection] diff --git a/test/ssl-tests/20-cert-select.cnf.in b/test/ssl-tests/20-cert-select.cnf.in index f0bc80886d4..259595e2700 100644 --- a/test/ssl-tests/20-cert-select.cnf.in +++ b/test/ssl-tests/20-cert-select.cnf.in @@ -328,41 +328,6 @@ our @tests = ( "ExpectedResult" => "Success" }, }, - { - name => "Ed25519 CipherString and Curves Selection", - server => $server, - client => { - "CipherString" => "aECDSA", - "MaxProtocol" => "TLSv1.2", - "SignatureAlgorithms" => "ECDSA+SHA256:ed25519", - # Excluding P-256 from the supported curves list means server - # certificate should be Ed25519 and not P-256 - "Curves" => "X25519" - }, - test => { - "ExpectedServerCertType" =>, "Ed25519", - "ExpectedServerSignType" =>, "Ed25519", - "ExpectedResult" => "Success" - }, - }, - { - name => "Ed448 CipherString and Curves Selection", - server => $server, - client => { - "CipherString" => "aECDSA", - "MaxProtocol" => "TLSv1.2", - "SignatureAlgorithms" => "ECDSA+SHA256:ed448", - "VerifyCAFile" => test_pem("root-ed448-cert.pem"), - # Excluding P-256 from the supported curves list means server - # certificate should be Ed25519 and not P-256 - "Curves" => "X448" - }, - test => { - "ExpectedServerCertType" =>, "Ed448", - "ExpectedServerSignType" =>, "Ed448", - "ExpectedResult" => "Success" - }, - }, { name => "TLS 1.2 Ed25519 Client Auth", server => { @@ -446,6 +411,41 @@ my @tests_non_fips = ( "ExpectedResult" => "Success" }, }, + { + name => "Ed25519 CipherString and Curves Selection", + server => $server, + client => { + "CipherString" => "aECDSA", + "MaxProtocol" => "TLSv1.2", + "SignatureAlgorithms" => "ECDSA+SHA256:ed25519", + # Excluding P-256 from the supported curves list means server + # certificate should be Ed25519 and not P-256 + "Curves" => "X25519" + }, + test => { + "ExpectedServerCertType" =>, "Ed25519", + "ExpectedServerSignType" =>, "Ed25519", + "ExpectedResult" => "Success" + }, + }, + { + name => "Ed448 CipherString and Curves Selection", + server => $server, + client => { + "CipherString" => "aECDSA", + "MaxProtocol" => "TLSv1.2", + "SignatureAlgorithms" => "ECDSA+SHA256:ed448", + "VerifyCAFile" => test_pem("root-ed448-cert.pem"), + # Excluding P-256 from the supported curves list means server + # certificate should be Ed25519 and not P-256 + "Curves" => "X448" + }, + test => { + "ExpectedServerCertType" =>, "Ed448", + "ExpectedServerSignType" =>, "Ed448", + "ExpectedResult" => "Success" + }, + }, ); my @tests_pss = ( diff --git a/test/ssl-tests/28-seclevel.cnf.in b/test/ssl-tests/28-seclevel.cnf.in index a1d44a534a0..90c8f54dcd2 100644 --- a/test/ssl-tests/28-seclevel.cnf.in +++ b/test/ssl-tests/28-seclevel.cnf.in @@ -56,7 +56,10 @@ our @tests_ec = ( client => { "CipherString" => "DEFAULT:\@SECLEVEL=5", "VerifyCAFile" => test_pem("root-ed448-cert.pem") }, test => { "ExpectedResult" => "ServerFail" }, - }, + } +); + +our @tests_ec_non_fips = ( { name => "SECLEVEL 3 with P-384 key, X25519 ECDHE", server => { "CipherString" => "DEFAULT:\@SECLEVEL=3", @@ -81,5 +84,6 @@ our @tests_tls1_2 = ( }, ); +push @tests_ec, @tests_ec_non_fips unless $fips_mode; push @tests, @tests_ec unless disabled("ec"); push @tests, @tests_tls1_2 unless disabled("tls1_2") || disabled("ec");