Import OpenSSL 1.1.1f
This commit is contained in:
Steve Dower
@@ -216,9 +216,9 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
|
||||
[4-Ed448 CipherString and Signature Algorithm Selection-client]
|
||||
CipherString = aECDSA
|
||||
MaxProtocol = TLSv1.2
|
||||
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
|
||||
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
|
||||
SignatureAlgorithms = ed448:ECDSA+SHA256
|
||||
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
|
||||
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
|
||||
VerifyMode = Peer
|
||||
|
||||
[test-4]
|
||||
@@ -421,7 +421,7 @@ CipherString = aECDSA
|
||||
Curves = X448
|
||||
MaxProtocol = TLSv1.2
|
||||
SignatureAlgorithms = ECDSA+SHA256:ed448
|
||||
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
|
||||
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
|
||||
VerifyMode = Peer
|
||||
|
||||
[test-10]
|
||||
@@ -1454,7 +1454,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
|
||||
[44-TLS 1.3 Ed448 Signature Algorithm Selection-client]
|
||||
CipherString = DEFAULT
|
||||
SignatureAlgorithms = ed448
|
||||
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
|
||||
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
|
||||
VerifyMode = Peer
|
||||
|
||||
[test-44]
|
||||
|
||||
@@ -134,7 +134,8 @@ our @tests = (
|
||||
"CipherString" => "aECDSA",
|
||||
"MaxProtocol" => "TLSv1.2",
|
||||
"SignatureAlgorithms" => "ed448:ECDSA+SHA256",
|
||||
"RequestCAFile" => test_pem("root-cert.pem"),
|
||||
"RequestCAFile" => test_pem("root-ed448-cert.pem"),
|
||||
"VerifyCAFile" => test_pem("root-ed448-cert.pem"),
|
||||
},
|
||||
test => {
|
||||
"ExpectedServerCertType" =>, "Ed448",
|
||||
@@ -231,6 +232,7 @@ our @tests = (
|
||||
"CipherString" => "aECDSA",
|
||||
"MaxProtocol" => "TLSv1.2",
|
||||
"SignatureAlgorithms" => "ECDSA+SHA256:ed448",
|
||||
"VerifyCAFile" => test_pem("root-ed448-cert.pem"),
|
||||
# Excluding P-256 from the supported curves list means server
|
||||
# certificate should be Ed25519 and not P-256
|
||||
"Curves" => "X448"
|
||||
@@ -727,6 +729,7 @@ my @tests_tls_1_3 = (
|
||||
server => $server_tls_1_3,
|
||||
client => {
|
||||
"SignatureAlgorithms" => "ed448",
|
||||
"VerifyCAFile" => test_pem("root-ed448-cert.pem"),
|
||||
},
|
||||
test => {
|
||||
"ExpectedServerCertType" => "Ed448",
|
||||
|
||||
@@ -1,11 +1,13 @@
|
||||
# Generated with generate_ssl_tests.pl
|
||||
|
||||
num_tests = 4
|
||||
num_tests = 6
|
||||
|
||||
test-0 = 0-SECLEVEL 3 with default key
|
||||
test-1 = 1-SECLEVEL 3 with ED448 key
|
||||
test-2 = 2-SECLEVEL 3 with P-384 key, X25519 ECDHE
|
||||
test-3 = 3-SECLEVEL 3 with ED448 key, TLSv1.2
|
||||
test-1 = 1-SECLEVEL 4 with ED448 key
|
||||
test-2 = 2-SECLEVEL 5 server with ED448 key
|
||||
test-3 = 3-SECLEVEL 5 client with ED448 key
|
||||
test-4 = 4-SECLEVEL 3 with P-384 key, X25519 ECDHE
|
||||
test-5 = 5-SECLEVEL 3 with ED448 key, TLSv1.2
|
||||
# ===========================================================
|
||||
|
||||
[0-SECLEVEL 3 with default key]
|
||||
@@ -31,21 +33,21 @@ ExpectedResult = ServerFail
|
||||
|
||||
# ===========================================================
|
||||
|
||||
[1-SECLEVEL 3 with ED448 key]
|
||||
ssl_conf = 1-SECLEVEL 3 with ED448 key-ssl
|
||||
[1-SECLEVEL 4 with ED448 key]
|
||||
ssl_conf = 1-SECLEVEL 4 with ED448 key-ssl
|
||||
|
||||
[1-SECLEVEL 3 with ED448 key-ssl]
|
||||
server = 1-SECLEVEL 3 with ED448 key-server
|
||||
client = 1-SECLEVEL 3 with ED448 key-client
|
||||
[1-SECLEVEL 4 with ED448 key-ssl]
|
||||
server = 1-SECLEVEL 4 with ED448 key-server
|
||||
client = 1-SECLEVEL 4 with ED448 key-client
|
||||
|
||||
[1-SECLEVEL 3 with ED448 key-server]
|
||||
[1-SECLEVEL 4 with ED448 key-server]
|
||||
Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
|
||||
CipherString = DEFAULT:@SECLEVEL=3
|
||||
CipherString = DEFAULT:@SECLEVEL=4
|
||||
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
|
||||
|
||||
[1-SECLEVEL 3 with ED448 key-client]
|
||||
CipherString = DEFAULT
|
||||
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
|
||||
[1-SECLEVEL 4 with ED448 key-client]
|
||||
CipherString = DEFAULT:@SECLEVEL=4
|
||||
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
|
||||
VerifyMode = Peer
|
||||
|
||||
[test-1]
|
||||
@@ -54,49 +56,95 @@ ExpectedResult = Success
|
||||
|
||||
# ===========================================================
|
||||
|
||||
[2-SECLEVEL 3 with P-384 key, X25519 ECDHE]
|
||||
ssl_conf = 2-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl
|
||||
[2-SECLEVEL 5 server with ED448 key]
|
||||
ssl_conf = 2-SECLEVEL 5 server with ED448 key-ssl
|
||||
|
||||
[2-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl]
|
||||
server = 2-SECLEVEL 3 with P-384 key, X25519 ECDHE-server
|
||||
client = 2-SECLEVEL 3 with P-384 key, X25519 ECDHE-client
|
||||
[2-SECLEVEL 5 server with ED448 key-ssl]
|
||||
server = 2-SECLEVEL 5 server with ED448 key-server
|
||||
client = 2-SECLEVEL 5 server with ED448 key-client
|
||||
|
||||
[2-SECLEVEL 3 with P-384 key, X25519 ECDHE-server]
|
||||
[2-SECLEVEL 5 server with ED448 key-server]
|
||||
Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
|
||||
CipherString = DEFAULT:@SECLEVEL=5
|
||||
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
|
||||
|
||||
[2-SECLEVEL 5 server with ED448 key-client]
|
||||
CipherString = DEFAULT:@SECLEVEL=4
|
||||
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
|
||||
VerifyMode = Peer
|
||||
|
||||
[test-2]
|
||||
ExpectedResult = ServerFail
|
||||
|
||||
|
||||
# ===========================================================
|
||||
|
||||
[3-SECLEVEL 5 client with ED448 key]
|
||||
ssl_conf = 3-SECLEVEL 5 client with ED448 key-ssl
|
||||
|
||||
[3-SECLEVEL 5 client with ED448 key-ssl]
|
||||
server = 3-SECLEVEL 5 client with ED448 key-server
|
||||
client = 3-SECLEVEL 5 client with ED448 key-client
|
||||
|
||||
[3-SECLEVEL 5 client with ED448 key-server]
|
||||
Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
|
||||
CipherString = DEFAULT:@SECLEVEL=4
|
||||
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
|
||||
|
||||
[3-SECLEVEL 5 client with ED448 key-client]
|
||||
CipherString = DEFAULT:@SECLEVEL=5
|
||||
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
|
||||
VerifyMode = Peer
|
||||
|
||||
[test-3]
|
||||
ExpectedResult = ServerFail
|
||||
|
||||
|
||||
# ===========================================================
|
||||
|
||||
[4-SECLEVEL 3 with P-384 key, X25519 ECDHE]
|
||||
ssl_conf = 4-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl
|
||||
|
||||
[4-SECLEVEL 3 with P-384 key, X25519 ECDHE-ssl]
|
||||
server = 4-SECLEVEL 3 with P-384 key, X25519 ECDHE-server
|
||||
client = 4-SECLEVEL 3 with P-384 key, X25519 ECDHE-client
|
||||
|
||||
[4-SECLEVEL 3 with P-384 key, X25519 ECDHE-server]
|
||||
Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem
|
||||
CipherString = DEFAULT:@SECLEVEL=3
|
||||
Groups = X25519
|
||||
PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem
|
||||
|
||||
[2-SECLEVEL 3 with P-384 key, X25519 ECDHE-client]
|
||||
[4-SECLEVEL 3 with P-384 key, X25519 ECDHE-client]
|
||||
CipherString = ECDHE:@SECLEVEL=3
|
||||
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
|
||||
VerifyMode = Peer
|
||||
|
||||
[test-2]
|
||||
[test-4]
|
||||
ExpectedResult = Success
|
||||
|
||||
|
||||
# ===========================================================
|
||||
|
||||
[3-SECLEVEL 3 with ED448 key, TLSv1.2]
|
||||
ssl_conf = 3-SECLEVEL 3 with ED448 key, TLSv1.2-ssl
|
||||
[5-SECLEVEL 3 with ED448 key, TLSv1.2]
|
||||
ssl_conf = 5-SECLEVEL 3 with ED448 key, TLSv1.2-ssl
|
||||
|
||||
[3-SECLEVEL 3 with ED448 key, TLSv1.2-ssl]
|
||||
server = 3-SECLEVEL 3 with ED448 key, TLSv1.2-server
|
||||
client = 3-SECLEVEL 3 with ED448 key, TLSv1.2-client
|
||||
[5-SECLEVEL 3 with ED448 key, TLSv1.2-ssl]
|
||||
server = 5-SECLEVEL 3 with ED448 key, TLSv1.2-server
|
||||
client = 5-SECLEVEL 3 with ED448 key, TLSv1.2-client
|
||||
|
||||
[3-SECLEVEL 3 with ED448 key, TLSv1.2-server]
|
||||
[5-SECLEVEL 3 with ED448 key, TLSv1.2-server]
|
||||
Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
|
||||
CipherString = DEFAULT:@SECLEVEL=3
|
||||
MaxProtocol = TLSv1.2
|
||||
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
|
||||
|
||||
[3-SECLEVEL 3 with ED448 key, TLSv1.2-client]
|
||||
[5-SECLEVEL 3 with ED448 key, TLSv1.2-client]
|
||||
CipherString = DEFAULT
|
||||
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
|
||||
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-ed448-cert.pem
|
||||
VerifyMode = Peer
|
||||
|
||||
[test-3]
|
||||
[test-5]
|
||||
ExpectedResult = Success
|
||||
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# -*- mode: perl; -*-
|
||||
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
# Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the OpenSSL license (the "License"). You may not use
|
||||
# this file except in compliance with the License. You can obtain a copy
|
||||
@@ -23,13 +23,38 @@ our @tests = (
|
||||
|
||||
our @tests_ec = (
|
||||
{
|
||||
name => "SECLEVEL 3 with ED448 key",
|
||||
server => { "CipherString" => "DEFAULT:\@SECLEVEL=3",
|
||||
name => "SECLEVEL 4 with ED448 key",
|
||||
server => { "CipherString" => "DEFAULT:\@SECLEVEL=4",
|
||||
"Certificate" => test_pem("server-ed448-cert.pem"),
|
||||
"PrivateKey" => test_pem("server-ed448-key.pem") },
|
||||
client => { },
|
||||
client => { "CipherString" => "DEFAULT:\@SECLEVEL=4",
|
||||
"VerifyCAFile" => test_pem("root-ed448-cert.pem") },
|
||||
test => { "ExpectedResult" => "Success" },
|
||||
},
|
||||
{
|
||||
# The Ed488 signature algorithm will not be enabled.
|
||||
# Because of the config order, the certificate is first loaded, and
|
||||
# then the security level is chaged. If you try this with s_server
|
||||
# the order will be reversed and it will instead fail to load the key.
|
||||
name => "SECLEVEL 5 server with ED448 key",
|
||||
server => { "CipherString" => "DEFAULT:\@SECLEVEL=5",
|
||||
"Certificate" => test_pem("server-ed448-cert.pem"),
|
||||
"PrivateKey" => test_pem("server-ed448-key.pem") },
|
||||
client => { "CipherString" => "DEFAULT:\@SECLEVEL=4",
|
||||
"VerifyCAFile" => test_pem("root-ed448-cert.pem") },
|
||||
test => { "ExpectedResult" => "ServerFail" },
|
||||
},
|
||||
{
|
||||
# The client will not sent the Ed488 signature algorithm, so the server
|
||||
# doesn't have a useable signature algorithm for the certificate.
|
||||
name => "SECLEVEL 5 client with ED448 key",
|
||||
server => { "CipherString" => "DEFAULT:\@SECLEVEL=4",
|
||||
"Certificate" => test_pem("server-ed448-cert.pem"),
|
||||
"PrivateKey" => test_pem("server-ed448-key.pem") },
|
||||
client => { "CipherString" => "DEFAULT:\@SECLEVEL=5",
|
||||
"VerifyCAFile" => test_pem("root-ed448-cert.pem") },
|
||||
test => { "ExpectedResult" => "ServerFail" },
|
||||
},
|
||||
{
|
||||
name => "SECLEVEL 3 with P-384 key, X25519 ECDHE",
|
||||
server => { "CipherString" => "DEFAULT:\@SECLEVEL=3",
|
||||
@@ -49,7 +74,7 @@ our @tests_tls1_2 = (
|
||||
"Certificate" => test_pem("server-ed448-cert.pem"),
|
||||
"PrivateKey" => test_pem("server-ed448-key.pem"),
|
||||
"MaxProtocol" => "TLSv1.2" },
|
||||
client => { },
|
||||
client => { "VerifyCAFile" => test_pem("root-ed448-cert.pem") },
|
||||
test => { "ExpectedResult" => "Success" },
|
||||
},
|
||||
);
|
||||
|
||||
Reference in New Issue
Block a user