tests: modify tests to allow signatures with SHA1

There were several tests that were utilizing SHA1 signatures but were
not failing due to the bug in gnutls_pubkey_verify_hash2().

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

diff --git a/tests/client_dsa_key.c b/tests/client_dsa_key.c
index a1bfb85f3e3e73cbd48d4c0fd97036ca2a740656..eb2794ea8135cc6319c116dbb08a9ed0999a40a9 100644 (file)
--- a/tests/client_dsa_key.c
+++ b/tests/client_dsa_key.c
@@ -84,6 +84,7 @@ void doit(void)
        /* test gnutls_certificate_flags() */
        gnutls_certificate_allocate_credentials(&serv_cred);
        gnutls_certificate_set_flags(serv_cred, GNUTLS_CERTIFICATE_SKIP_KEY_CERT_MATCH);
+       gnutls_certificate_set_verify_flags(serv_cred, GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1);
 
        ret = gnutls_certificate_set_x509_trust_mem(serv_cred, &ca3_cert, GNUTLS_X509_FMT_PEM);
        if (ret < 0)

diff --git a/tests/openpgpself.c b/tests/openpgpself.c
index d255a807044f580b646f53aed90661045be32ca9..22b2e183c0cc99b26a3f10deb099fe033becd3be 100644 (file)
--- a/tests/openpgpself.c
+++ b/tests/openpgpself.c
@@ -174,7 +174,7 @@ static void client(int sds[])
 
                /* Use default priorities */
                gnutls_priority_set_direct(session,
-                                          "NORMAL:+CTYPE-OPENPGP:+DHE-DSS:+DHE-DSS:+SIGN-DSA-SHA1:+SIGN-DSA-SHA256", NULL);
+                                          "NORMAL:+CTYPE-OPENPGP:+DHE-DSS:+DHE-DSS:+SIGN-DSA-SHA1:+SIGN-DSA-SHA256:%VERIFY_ALLOW_SIGN_WITH_SHA1", NULL);
 
                /* put the x509 credentials to the current session
                 */
@@ -182,6 +182,7 @@ static void client(int sds[])
                                        xcred);
 
                gnutls_transport_set_int(session, sd);
+               gnutls_handshake_set_timeout(session, 20 * 1000);
 
                /* Perform the TLS handshake
                 */
@@ -258,7 +259,7 @@ static gnutls_session_t initialize_tls_session(void)
        /* avoid calling all the priority functions, since the defaults
         * are adequate.
         */
-       gnutls_priority_set_direct(session, "NORMAL:+CTYPE-OPENPGP:+DHE-DSS:+SIGN-DSA-SHA1:+SIGN-DSA-SHA256", NULL);
+       gnutls_priority_set_direct(session, "NORMAL:+CTYPE-OPENPGP:+DHE-DSS:+SIGN-DSA-SHA1:+SIGN-DSA-SHA256:%VERIFY_ALLOW_SIGN_WITH_SHA1", NULL);
 
        gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, pgp_cred);
 
@@ -517,6 +518,8 @@ static void server(int sds[])
                session = initialize_tls_session();
 
                gnutls_transport_set_int(session, sd);
+               gnutls_handshake_set_timeout(session, 20 * 1000);
+
                ret = gnutls_handshake(session);
                if (ret < 0) {
                        close(sd);

diff --git a/tests/suite/testcompat-main-openssl b/tests/suite/testcompat-main-openssl
index 28461de569cd392574b0cadf43e3ee531a4a5b24..6845642021fe6aacc5595ac4cf903a70a7cfe5f1 100755 (executable)
--- a/tests/suite/testcompat-main-openssl
+++ b/tests/suite/testcompat-main-openssl
@@ -302,7 +302,7 @@ run_client_suite() {
 
                if test "${NO_DSS}" != 1; then
                        echo "${PREFIX}Checking TLS 1.2 with DHE-DSS..."
-                       ${VALGRIND} "${CLI}" ${DEBUG} -p "${PORT}" 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+DHE-DSS:+SIGN-DSA-SHA1:+SIGN-DSA-SHA256${ADD}" --insecure --x509certfile "${CLI_CERT}" --x509keyfile "${CLI_KEY}" </dev/null >/dev/null || \
+                       ${VALGRIND} "${CLI}" ${DEBUG} -p "${PORT}" 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+DHE-DSS:+SIGN-DSA-SHA1:%VERIFY_ALLOW_SIGN_WITH_SHA1:+SIGN-DSA-SHA256${ADD}" --insecure --x509certfile "${CLI_CERT}" --x509keyfile "${CLI_KEY}" </dev/null >/dev/null || \
                                fail ${PID} "Failed"
                fi
 
@@ -650,7 +650,7 @@ run_server_suite() {
                if test "${NO_DSS}" != 1; then
                        echo "${PREFIX}Check TLS 1.2 with DHE-DSS ciphersuite"
                        eval "${GETPORT}"
-                       launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+DHE-DSS:+SIGN-DSA-SHA1:+SIGN-DSA-SHA256${ADD}" --x509certfile "${SERV_DSA_CERT}" --x509keyfile "${SERV_DSA_KEY}" --dhparams "${DH_PARAMS}"
+                       launch_server $$ --priority "NONE:+CIPHER-ALL:%VERIFY_ALLOW_SIGN_WITH_SHA1:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+DHE-DSS:+SIGN-DSA-SHA1:+SIGN-DSA-SHA256${ADD}" --x509certfile "${SERV_DSA_CERT}" --x509keyfile "${SERV_DSA_KEY}" --dhparams "${DH_PARAMS}"
                        PID=$!
                        wait_server ${PID}
 

diff --git a/tests/suite/tls-fuzzer/tls-fuzzer-cert.sh b/tests/suite/tls-fuzzer/tls-fuzzer-cert.sh
index dc6280eef9d3bb823997a563327a5d96529e860f..30cfe25c3856cb46867e12b284371d44bf2a5736 100755 (executable)
--- a/tests/suite/tls-fuzzer/tls-fuzzer-cert.sh
+++ b/tests/suite/tls-fuzzer/tls-fuzzer-cert.sh
@@ -49,10 +49,10 @@ wait_for_free_port $PORT
 
 retval=0
 
-PRIORITY="NORMAL:+ARCFOUR-128:+3DES-CBC:+DHE-DSS:+SIGN-DSA-SHA256:+SIGN-DSA-SHA1:-CURVE-SECP192R1:+VERS-SSL3.0"
+PRIORITY="NORMAL:+ARCFOUR-128:%VERIFY_ALLOW_SIGN_WITH_SHA1:+3DES-CBC:+DHE-DSS:+SIGN-DSA-SHA256:+SIGN-DSA-SHA1:-CURVE-SECP192R1:+VERS-SSL3.0"
 ${CLI} --list --priority "${PRIORITY}" >/dev/null 2>&1
 if test $? != 0;then
-       PRIORITY="NORMAL:+ARCFOUR-128:+3DES-CBC:+DHE-DSS:+SIGN-DSA-SHA256:+SIGN-DSA-SHA1:+VERS-SSL3.0"
+       PRIORITY="NORMAL:+ARCFOUR-128:%VERIFY_ALLOW_SIGN_WITH_SHA1:+3DES-CBC:+DHE-DSS:+SIGN-DSA-SHA256:+SIGN-DSA-SHA1:+VERS-SSL3.0"
 fi
 
 TLS_PY=./tlslite-ng/scripts/tls.py

diff --git a/tests/suite/tls-fuzzer/tls-fuzzer-nocert.sh b/tests/suite/tls-fuzzer/tls-fuzzer-nocert.sh
index 8231b9c2c5d928ed1df3c43caa43f88be0079cbf..62d75344f71e5c909f741e03e5ac283aa1c90638 100755 (executable)
--- a/tests/suite/tls-fuzzer/tls-fuzzer-nocert.sh
+++ b/tests/suite/tls-fuzzer/tls-fuzzer-nocert.sh
@@ -49,10 +49,10 @@ wait_for_free_port $PORT
 
 retval=0
 
-PRIORITY="NORMAL:+ARCFOUR-128:+3DES-CBC:+DHE-DSS:+SIGN-DSA-SHA256:+SIGN-DSA-SHA1:-CURVE-SECP192R1:+VERS-SSL3.0"
+PRIORITY="NORMAL:%VERIFY_ALLOW_SIGN_WITH_SHA1:+ARCFOUR-128:+3DES-CBC:+DHE-DSS:+SIGN-DSA-SHA256:+SIGN-DSA-SHA1:-CURVE-SECP192R1:+VERS-SSL3.0"
 ${CLI} --list --priority "${PRIORITY}" >/dev/null 2>&1
 if test $? != 0;then
-       PRIORITY="NORMAL:+ARCFOUR-128:+3DES-CBC:+DHE-DSS:+SIGN-DSA-SHA256:+SIGN-DSA-SHA1:+VERS-SSL3.0"
+       PRIORITY="NORMAL:%VERIFY_ALLOW_SIGN_WITH_SHA1:+ARCFOUR-128:+3DES-CBC:+DHE-DSS:+SIGN-DSA-SHA256:+SIGN-DSA-SHA1:+VERS-SSL3.0"
 fi
 
 TLS_PY=./tlslite-ng/scripts/tls.py

diff --git a/tests/x509sign-verify-common.h b/tests/x509sign-verify-common.h
index 1aaf3dce65b2fa9c36668ca17555b88ac9a6916a..9f87229403be65a110d49688fef017f7c8c7841b 100644 (file)
--- a/tests/x509sign-verify-common.h
+++ b/tests/x509sign-verify-common.h
@@ -71,10 +71,12 @@ void test_sig(gnutls_pk_algorithm_t pk, unsigned hash, unsigned bits)
        const gnutls_datum_t *hash_data;
        int ret;
        unsigned j;
+       unsigned vflags = 0;
 
-       if (hash == GNUTLS_DIG_SHA1)
+       if (hash == GNUTLS_DIG_SHA1) {
                hash_data = &sha1_data;
-       else if (hash == GNUTLS_DIG_SHA256)
+               vflags |= GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1;
+       } else if (hash == GNUTLS_DIG_SHA256)
                hash_data = &sha256_data;
        else
                abort();
@@ -108,7 +110,7 @@ void test_sig(gnutls_pk_algorithm_t pk, unsigned hash, unsigned bits)
 
                ret =
                    gnutls_pubkey_verify_hash2(pubkey,
-                                               sign_algo, 0,
+                                               sign_algo, vflags,
                                                hash_data, &signature);
                if (ret < 0) {
                        print_keys(privkey, pubkey);
@@ -118,7 +120,7 @@ void test_sig(gnutls_pk_algorithm_t pk, unsigned hash, unsigned bits)
                /* should fail */
                ret =
                    gnutls_pubkey_verify_hash2(pubkey,
-                                               sign_algo, 0,
+                                               sign_algo, vflags,
                                                &invalid_hash_data,
                                                &signature);
                if (ret != GNUTLS_E_PK_SIG_VERIFY_FAILED) {
@@ -131,14 +133,14 @@ void test_sig(gnutls_pk_algorithm_t pk, unsigned hash, unsigned bits)
                                      (pubkey, NULL), hash);
 
                ret =
-                   gnutls_pubkey_verify_hash2(pubkey, sign_algo, 0,
+                   gnutls_pubkey_verify_hash2(pubkey, sign_algo, vflags,
                                                hash_data, &signature);
                if (ret < 0)
                        ERR;
 
                /* should fail */
                ret =
-                   gnutls_pubkey_verify_hash2(pubkey, sign_algo, 0,
+                   gnutls_pubkey_verify_hash2(pubkey, sign_algo, vflags,
                                                &invalid_hash_data,
                                                &signature);
                if (ret != GNUTLS_E_PK_SIG_VERIFY_FAILED) {
@@ -168,7 +170,7 @@ void test_sig(gnutls_pk_algorithm_t pk, unsigned hash, unsigned bits)
                        ret =
                            gnutls_pubkey_verify_hash2(pubkey,
                                                        sign_algo,
-                                                       GNUTLS_PUBKEY_VERIFY_FLAG_TLS1_RSA,
+                                                       vflags|GNUTLS_PUBKEY_VERIFY_FLAG_TLS1_RSA,
                                                        hash_data,
                                                        &signature);
                        if (ret < 0) {

diff --git a/tests/x509sign-verify.c b/tests/x509sign-verify.c
index c945bdee3574adf9b8285a8ce002a46d6ac219c0..69b004f427a1436c04912bba2084954cec1f5b0e 100644 (file)
--- a/tests/x509sign-verify.c
+++ b/tests/x509sign-verify.c
@@ -209,22 +209,23 @@ void doit(void)
                        testfail("gnutls_x509_pubkey_import\n");
 
                ret =
-                   gnutls_pubkey_verify_hash2(pubkey, tests[i].sigalgo, 0, hash_data,
+                   gnutls_pubkey_verify_hash2(pubkey, tests[i].sigalgo, GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1, hash_data,
                                              &signature);
                if (ret < 0)
                        testfail("gnutls_x509_pubkey_verify_hash2\n");
 
                ret =
-                   gnutls_pubkey_verify_hash2(pubkey, tests[i].sigalgo, 0, hash_data,
+                   gnutls_pubkey_verify_hash2(pubkey, tests[i].sigalgo, GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1, hash_data,
                                              &signature2);
                if (ret < 0)
                        testfail("gnutls_x509_pubkey_verify_hash-1 (hashed data)\n");
 
                /* should fail */
                ret =
-                   gnutls_pubkey_verify_hash2(pubkey, tests[i].sigalgo, 0,
-                                             invalid_hash_data,
-                                             &signature2);
+                   gnutls_pubkey_verify_hash2(pubkey, tests[i].sigalgo,
+                                              GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1,
+                                              invalid_hash_data,
+                                              &signature2);
                if (ret != GNUTLS_E_PK_SIG_VERIFY_FAILED)
                        testfail("gnutls_x509_pubkey_verify_hash-2 (hashed data)\n");
 
@@ -233,14 +234,14 @@ void doit(void)
                                      (pubkey, NULL), tests[i].digest);
 
                ret =
-                   gnutls_pubkey_verify_hash2(pubkey, sign_algo, 0,
+                   gnutls_pubkey_verify_hash2(pubkey, sign_algo, GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1,
                                                hash_data, &signature2);
                if (ret < 0)
                        testfail("gnutls_x509_pubkey_verify_hash2-1 (hashed data)\n");
 
                /* should fail */
                ret =
-                   gnutls_pubkey_verify_hash2(pubkey, sign_algo, 0,
+                   gnutls_pubkey_verify_hash2(pubkey, sign_algo, GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1,
                                                invalid_hash_data,
                                                &signature2);
                if (ret != GNUTLS_E_PK_SIG_VERIFY_FAILED)