coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Test TLS 1.2 signature algorithm policy enforcement

Browse Source 
Add ssl-opt.sh tests exercising mbedtls_ssl_conf_sig_algs in TLS 1.2
with (hash,sig) pairs expressed as hex: positive control, hash-
accepted/signature-rejected (client and server side), and signature-
accepted/hash-rejected via a stricter server policy.

Signed-off-by: v1rtu3x <149050962+v1rtu3x@users.noreply.github.com>
This commit is contained in:
v1rtu3x 2026-10-07 10:10:16 +03:00
parent d0af7c1f3b
commit fd919be981
1 changed files with 57 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
tests/ssl-opt.sh
View File

@ -2589,6 +2589,63 @@ run_test "Single supported algorithm sending: openssl client" \
-key $DATA_FILES_PATH/server6.key" \
0
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_CLI_C
requires_config_enabled MBEDTLS_SSL_SRV_C
requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
requires_config_enabled PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC
requires_hash_alg SHA_256
run_test "TLS 1.2: sig_algs (hash,sig) hex pair accepted with RSA server cert" \
"$P_SRV force_version=tls12 \
crt_file=$DATA_FILES_PATH/server2-sha256.crt key_file=$DATA_FILES_PATH/server2.key" \
"$P_CLI force_version=tls12 sig_algs=0401" \
0 \
-s "Ciphersuite is" \
-c "Ciphersuite is"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_CLI_C
requires_config_enabled MBEDTLS_SSL_SRV_C
requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
requires_config_enabled PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC
requires_hash_alg SHA_256
run_test "TLS 1.2: sig_algs policy - hash accepted but signature rejected (client)" \
"$P_SRV force_version=tls12 \
crt_file=$DATA_FILES_PATH/server2-sha256.crt key_file=$DATA_FILES_PATH/server2.key" \
"$P_CLI force_version=tls12 sig_algs=0403" \
1 \
-s "The handshake negotiation failed" \
-c "Last error was: -0x7780 - SSL - A fatal alert message was received from our peer"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_CLI_C
requires_config_enabled MBEDTLS_SSL_SRV_C
requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
requires_config_enabled PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC
requires_hash_alg SHA_256
requires_hash_alg SHA_384
run_test "TLS 1.2: sig_algs policy - signature accepted but hash rejected (server)" \
"$P_SRV force_version=tls12 sig_algs=0501 \
crt_file=$DATA_FILES_PATH/server2-sha256.crt key_file=$DATA_FILES_PATH/server2.key" \
"$P_CLI force_version=tls12 sig_algs=0401" \
1 \
-s "The handshake negotiation failed" \
-c "Last error was: -0x7780 - SSL - A fatal alert message was received from our peer"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_CLI_C
requires_config_enabled MBEDTLS_SSL_SRV_C
requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
requires_config_enabled PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC
requires_hash_alg SHA_256
run_test "TLS 1.2: sig_algs policy - server rejects its certificate's signature type" \
"$P_SRV force_version=tls12 sig_algs=0403 \
crt_file=$DATA_FILES_PATH/server2-sha256.crt key_file=$DATA_FILES_PATH/server2.key" \
"$P_CLI force_version=tls12" \
1 \
-s "The handshake negotiation failed" \
-c "Last error was: -0x7780 - SSL - A fatal alert message was received from our peer"
# Tests for certificate verification callback
run_test "Configuration-specific CRT verification callback" \
"$P_SRV debug_level=3" \