OERV-RUNTIME/boringssl
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Test SSL_get_curve_id behavior on resume.

Browse Source 
Also test that TLS 1.3 can be resumed at a different curve.

Change-Id: Ic58e03ad858c861958b7c934813c3e448fb2829c
Reviewed-on: https://boringssl-review.googlesource.com/12692
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
This commit is contained in:
David Benjamin
2016-12-14 01:08:02 +00:00
committed by CQ bot account: commit-bot@chromium.org
parent 4882a6c50b
commit 8a55ce4954
4 changed files with 68 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ssl/test/bssl_shim.cc
+7 -3
View File
@@ -1359,11 +1359,15 @@ static bool CheckHandshakeProperties(SSL *ssl, bool is_resume) {
return false;
}
if (config->expect_curve_id != 0) {
int expect_curve_id = config->expect_curve_id;
if (is_resume && config->expect_resume_curve_id != 0) {
expect_curve_id = config->expect_resume_curve_id;
}
if (expect_curve_id != 0) {
uint16_t curve_id = SSL_get_curve_id(ssl);
if (static_cast<uint16_t>(config->expect_curve_id) != curve_id) {
if (static_cast<uint16_t>(expect_curve_id) != curve_id) {
fprintf(stderr, "curve_id was %04x, wanted %04x\n", curve_id,
static_cast<uint16_t>(config->expect_curve_id));
static_cast<uint16_t>(expect_curve_id));
return false;
}
}
ssl/test/runner/runner.go
+59
View File
@@ -8104,6 +8104,65 @@ func addCurveTests() {
shouldFail: true,
expectedError: ":INVALID_ENCODING:",
})
// The previous curve ID should be reported on TLS 1.2 resumption.
testCases = append(testCases, testCase{
name: "CurveID-Resume-Client",
config: Config{
MaxVersion: VersionTLS12,
CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
CurvePreferences: []CurveID{CurveX25519},
},
flags: []string{"-expect-curve-id", strconv.Itoa(int(CurveX25519))},
resumeSession: true,
})
testCases = append(testCases, testCase{
testType: serverTest,
name: "CurveID-Resume-Server",
config: Config{
MaxVersion: VersionTLS12,
CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
CurvePreferences: []CurveID{CurveX25519},
},
flags: []string{"-expect-curve-id", strconv.Itoa(int(CurveX25519))},
resumeSession: true,
})
// TLS 1.3 allows resuming at a differet curve. If this happens, the new
// one should be reported.
testCases = append(testCases, testCase{
name: "CurveID-Resume-Client-TLS13",
config: Config{
MaxVersion: VersionTLS13,
CurvePreferences: []CurveID{CurveX25519},
},
resumeConfig: &Config{
MaxVersion: VersionTLS13,
CurvePreferences: []CurveID{CurveP256},
},
flags: []string{
"-expect-curve-id", strconv.Itoa(int(CurveX25519)),
"-expect-resume-curve-id", strconv.Itoa(int(CurveP256)),
},
resumeSession: true,
})
testCases = append(testCases, testCase{
testType: serverTest,
name: "CurveID-Resume-Server-TLS13",
config: Config{
MaxVersion: VersionTLS13,
CurvePreferences: []CurveID{CurveX25519},
},
resumeConfig: &Config{
MaxVersion: VersionTLS13,
CurvePreferences: []CurveID{CurveP256},
},
flags: []string{
"-expect-curve-id", strconv.Itoa(int(CurveX25519)),
"-expect-resume-curve-id", strconv.Itoa(int(CurveP256)),
},
resumeSession: true,
})
}
func addTLS13RecordTests() {
ssl/test/test_config.cc
+1
View File
@@ -164,6 +164,7 @@ const Flag<int> kIntFlags[] = {
{ "-expect-peer-signature-algorithm",
&TestConfig::expect_peer_signature_algorithm },
{ "-expect-curve-id", &TestConfig::expect_curve_id },
{ "-expect-resume-curve-id", &TestConfig::expect_resume_curve_id },
{ "-initial-timeout-duration-ms", &TestConfig::initial_timeout_duration_ms },
{ "-max-cert-list", &TestConfig::max_cert_list },
{ "-expect-cipher-aes", &TestConfig::expect_cipher_aes },
ssl/test/test_config.h
+1
View File
@@ -107,6 +107,7 @@ struct TestConfig {
bool enable_all_curves = false;
bool use_sparse_dh_prime = false;
int expect_curve_id = 0;
int expect_resume_curve_id = 0;
bool use_old_client_cert_callback = false;
int initial_timeout_duration_ms = 0;
bool use_null_client_ca_list = false;