tests: added testcases for ciphersuite/KX negotiation with VKO-GOST

This verifies whether the ciphersuite negotiation will detect and
reject incompatible data present in credentials.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

diff --git a/tests/server-kx-neg-common.c b/tests/server-kx-neg-common.c
index ef9fed5e9df47496fc502bf837b633cd0e0f888c..961d16074ed1900d28177bda6b09bb4d7ed1d754 100644 (file)
--- a/tests/server-kx-neg-common.c
+++ b/tests/server-kx-neg-common.c
@@ -38,6 +38,8 @@ typedef struct test_case_st {
        unsigned have_ecc_sign_cert;
        unsigned have_ed25519_sign_cert;
        unsigned have_rsa_decrypt_cert;
+       unsigned have_gost12_256_cert;
+       unsigned have_gost12_512_cert;
        unsigned not_on_fips;
        unsigned exp_version;
        const char *client_prio;
@@ -222,6 +224,14 @@ static void try(test_case_st *test)
                assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_localhost_rsa_sign_cert, &server_ca3_key, GNUTLS_X509_FMT_PEM) >= 0);
        }
 
+       if (test->have_gost12_256_cert) {
+               assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_gost12_256_cert, &server_ca3_gost12_256_key, GNUTLS_X509_FMT_PEM) >= 0);
+       }
+
+       if (test->have_gost12_512_cert) {
+               assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_gost12_512_cert, &server_ca3_gost12_512_key, GNUTLS_X509_FMT_PEM) >= 0);
+       }
+
        /* client does everything */
        gnutls_credentials_set(client, GNUTLS_CRD_ANON, c_anon_cred);
        gnutls_credentials_set(client, GNUTLS_CRD_CERTIFICATE, c_cert_cred);

diff --git a/tests/tls12-server-kx-neg.c b/tests/tls12-server-kx-neg.c
index 1e55dfd3a02518defaea936af686c82fb8e76a3f..88d2666ef28268ed77dcdc3f9f0953b5a0d2830e 100644 (file)
--- a/tests/tls12-server-kx-neg.c
+++ b/tests/tls12-server-kx-neg.c
@@ -461,7 +461,72 @@ test_case_st tests[] = {
                .have_srp_cred = 1,
                .server_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.2",
                .client_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.2"
-       }
+       },
+
+#ifdef ENABLE_GOST
+       {
+               .name = "TLS 1.2 VKO-GOST-12 without cred",
+               .client_ret = GNUTLS_E_AGAIN,
+               .server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+               .not_on_fips = 1,
+               .server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2",
+               .client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2"
+       },
+       {
+               .name = "TLS 1.2 VKO-GOST-12 with cred but no cert",
+               .client_ret = GNUTLS_E_AGAIN,
+               .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+               .have_cert_cred = 1,
+               .not_on_fips = 1,
+               .server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2",
+               .client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2"
+       },
+       {
+               .name = "TLS 1.2 VKO-GOST-12 with cred but no GOST cert",
+               .client_ret = GNUTLS_E_AGAIN,
+               .server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+               .have_cert_cred = 1,
+               .have_rsa_sign_cert = 1,
+               .have_rsa_decrypt_cert = 1,
+               .not_on_fips = 1,
+               .server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2",
+               .client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2"
+       },
+       {
+               .name = "TLS 1.2 VKO-GOST-12 with cred and GOST12-256 cert",
+               .server_ret = 0,
+               .client_ret = 0,
+               .have_cert_cred = 1,
+               .have_gost12_256_cert = 1,
+               .not_on_fips = 1,
+               .server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2",
+               .client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2"
+       },
+       {
+               .name = "TLS 1.2 VKO-GOST-12 with cred and GOST12-512 cert",
+               .server_ret = 0,
+               .client_ret = 0,
+               .have_cert_cred = 1,
+               .have_gost12_512_cert = 1,
+               .not_on_fips = 1,
+               .server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2",
+               .client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2"
+       },
+       {
+               .name = "TLS 1.2 VKO-GOST-12 with cred and multiple certs",
+               .server_ret = 0,
+               .client_ret = 0,
+               .have_cert_cred = 1,
+               .have_ecc_sign_cert = 1,
+               .have_rsa_sign_cert = 1,
+               .have_rsa_decrypt_cert = 1,
+               .have_gost12_256_cert = 1,
+               .have_gost12_512_cert = 1,
+               .not_on_fips = 1,
+               .server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2",
+               .client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2"
+       },
+#endif
 };
 
 void doit(void)