99fdfb9f22
The current check has two problems: - It only runs on the server, where there isn't a curve list at all. This was a mistake in https://boringssl-review.googlesource.com/1843 which flipped it from client-only to server-only. - It only runs in TLS 1.2, so one could bypass it by just negotiating TLS 1.1. Upstream added it as part of their Suite B mode, which requires 1.2. Move it elsewhere. Though we do not check the entire chain, leaving that to the certificate verifier, signatures made by the leaf certificate are made by the SSL/TLS stack, so it's reasonable to check the curve as part of checking suitability of a leaf. Change-Id: I7c12f2a32ba946a20e9ba6c70eff23bebcb60bb2 Reviewed-on: https://boringssl-review.googlesource.com/6414 Reviewed-by: Adam Langley <agl@google.com>
111 lines
3.6 KiB
C++
111 lines
3.6 KiB
C++
/* Copyright (c) 2014, Google Inc.
|
|
*
|
|
* Permission to use, copy, modify, and/or distribute this software for any
|
|
* purpose with or without fee is hereby granted, provided that the above
|
|
* copyright notice and this permission notice appear in all copies.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
|
|
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
|
|
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
|
|
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
|
|
|
|
#ifndef HEADER_TEST_CONFIG
|
|
#define HEADER_TEST_CONFIG
|
|
|
|
#include <string>
|
|
|
|
|
|
struct TestConfig {
|
|
int port = 0;
|
|
bool is_server = false;
|
|
bool is_dtls = false;
|
|
bool resume = false;
|
|
bool fallback_scsv = false;
|
|
std::string digest_prefs;
|
|
std::string key_file;
|
|
std::string cert_file;
|
|
std::string expected_server_name;
|
|
std::string expected_certificate_types;
|
|
bool require_any_client_certificate = false;
|
|
std::string advertise_npn;
|
|
std::string expected_next_proto;
|
|
bool false_start = false;
|
|
std::string select_next_proto;
|
|
bool async = false;
|
|
bool write_different_record_sizes = false;
|
|
bool cbc_record_splitting = false;
|
|
bool partial_write = false;
|
|
bool no_tls12 = false;
|
|
bool no_tls11 = false;
|
|
bool no_tls1 = false;
|
|
bool no_ssl3 = false;
|
|
std::string expected_channel_id;
|
|
std::string send_channel_id;
|
|
bool shim_writes_first = false;
|
|
bool tls_d5_bug = false;
|
|
std::string host_name;
|
|
std::string advertise_alpn;
|
|
std::string expected_alpn;
|
|
std::string expected_advertised_alpn;
|
|
std::string select_alpn;
|
|
bool expect_session_miss = false;
|
|
bool expect_extended_master_secret = false;
|
|
std::string psk;
|
|
std::string psk_identity;
|
|
std::string srtp_profiles;
|
|
bool enable_ocsp_stapling = false;
|
|
std::string expected_ocsp_response;
|
|
bool enable_signed_cert_timestamps = false;
|
|
std::string expected_signed_cert_timestamps;
|
|
int min_version = 0;
|
|
int max_version = 0;
|
|
int mtu = 0;
|
|
bool implicit_handshake = false;
|
|
bool use_early_callback = false;
|
|
bool fail_early_callback = false;
|
|
bool install_ddos_callback = false;
|
|
bool fail_ddos_callback = false;
|
|
bool fail_second_ddos_callback = false;
|
|
std::string cipher;
|
|
std::string cipher_tls10;
|
|
std::string cipher_tls11;
|
|
bool handshake_never_done = false;
|
|
int export_keying_material = 0;
|
|
std::string export_label;
|
|
std::string export_context;
|
|
bool use_export_context = false;
|
|
bool no_legacy_server_connect = false;
|
|
bool tls_unique = false;
|
|
bool expect_ticket_renewal = false;
|
|
bool expect_no_session = false;
|
|
bool use_ticket_callback = false;
|
|
bool renew_ticket = false;
|
|
bool enable_client_custom_extension = false;
|
|
bool enable_server_custom_extension = false;
|
|
bool custom_extension_skip = false;
|
|
bool custom_extension_fail_add = false;
|
|
std::string ocsp_response;
|
|
bool check_close_notify = false;
|
|
bool shim_shuts_down = false;
|
|
bool microsoft_big_sslv3_buffer = false;
|
|
bool verify_fail = false;
|
|
bool verify_peer = false;
|
|
bool expect_verify_result = false;
|
|
std::string signed_cert_timestamps;
|
|
int expect_total_renegotiations = 0;
|
|
bool renegotiate_once = false;
|
|
bool renegotiate_freely = false;
|
|
bool renegotiate_ignore = false;
|
|
bool disable_npn = false;
|
|
int expect_server_key_exchange_hash = 0;
|
|
bool p384_only = false;
|
|
};
|
|
|
|
bool ParseConfig(int argc, char **argv, TestConfig *out_config);
|
|
|
|
|
|
#endif // HEADER_TEST_CONFIG
|