yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Introduce a test for single signature algorithm correctness

Browse source 
The value of the first sent signature algorithm is overwritten.
This test forces only a single algorithm to be sent and then
validates that the client received such algorithm.
04 03 is the expected value for SECP256R1_SHA256.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
This commit is contained in:
Andrzej Kurek 2022-11-15 10:21:50 -05:00 committed by Paul Elliott
parent 96a0fd951f
commit ec71b0937f
2 changed files with 22 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
library/ssl_tls12_client.c
View file

@ -2654,7 +2654,7 @@ static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
for( size_t i = 0; i < sig_alg_len; i += 2 )
{
MBEDTLS_SSL_DEBUG_MSG( 3,
( "Supported Signature Algorithm found: %d,%d",
( "Supported Signature Algorithm found: %02x %02x",
sig_alg[i], sig_alg[i + 1] ) );
}
#endif

29
tests/ssl-opt.sh
View file

@ -2371,6 +2371,19 @@ run_test "Unique IV in GCM" \
-u "IV used" \
-U "IV used"
# Test for correctness of sent single supported algorithm
requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_DEBUG_C
requires_config_enabled MBEDTLS_SSL_CLI_C
requires_config_enabled MBEDTLS_ECDSA_C
requires_hash_alg SHA_256
run_test "Single supported algorithm sending" \
"$P_SRV sig_algs=ecdsa_secp256r1_sha256 auth_mode=required" \
"$P_CLI sig_algs=ecdsa_secp256r1_sha256 debug_level=3" \
0 \
-c "Supported Signature Algorithm found: 04 03"
# Tests for certificate verification callback
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "Configuration-specific CRT verification callback" \
@ -5274,8 +5287,8 @@ run_test "Authentication: client SHA256, server required" \
key_file=data_files/server6.key \
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \
0 \
-c "Supported Signature Algorithm found: 4," \
-c "Supported Signature Algorithm found: 5,"
-c "Supported Signature Algorithm found: 04 " \
-c "Supported Signature Algorithm found: 05 "
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
@ -5285,8 +5298,8 @@ run_test "Authentication: client SHA384, server required" \
key_file=data_files/server6.key \
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \
0 \
-c "Supported Signature Algorithm found: 4," \
-c "Supported Signature Algorithm found: 5,"
-c "Supported Signature Algorithm found: 04 " \
-c "Supported Signature Algorithm found: 05 "
requires_key_exchange_with_cert_in_tls12_or_tls13_enabled
run_test "Authentication: client has no cert, server required (TLS)" \
@ -5687,8 +5700,8 @@ run_test "Authentication, CA callback: client SHA256, server required" \
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \
0 \
-s "use CA callback for X.509 CRT verification" \
-c "Supported Signature Algorithm found: 4," \
-c "Supported Signature Algorithm found: 5,"
-c "Supported Signature Algorithm found: 04 " \
-c "Supported Signature Algorithm found: 05 "
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
@ -5700,8 +5713,8 @@ run_test "Authentication, CA callback: client SHA384, server required" \
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \
0 \
-s "use CA callback for X.509 CRT verification" \
-c "Supported Signature Algorithm found: 4," \
-c "Supported Signature Algorithm found: 5,"
-c "Supported Signature Algorithm found: 04 " \
-c "Supported Signature Algorithm found: 05 "
requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2