mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-05-11 06:28:17 +02:00
Merge pull request #6394 from mprse/enc_types_2_28_backport
Backport 2.28: Test TLS 1.2 builds with each encryption type
This commit is contained in:
Gilles Peskine
@@ -1268,6 +1268,163 @@ component_test_ecp_restartable_no_internal_rng () {
|
||||
# no SSL tests as they all depend on having a DRBG
|
||||
}
|
||||
|
||||
component_test_tls1_2_default_stream_cipher_only () {
|
||||
msg "build: default with only stream cipher"
|
||||
|
||||
# Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C
|
||||
scripts/config.py unset MBEDTLS_GCM_C
|
||||
scripts/config.py unset MBEDTLS_CCM_C
|
||||
scripts/config.py unset MBEDTLS_CHACHAPOLY_C
|
||||
# Disable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
|
||||
scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
|
||||
# Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
scripts/config.py unset MBEDTLS_SSL_ENCRYPT_THEN_MAC
|
||||
# Enable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER))
|
||||
scripts/config.py set MBEDTLS_CIPHER_NULL_CIPHER
|
||||
# Modules that depend on AEAD
|
||||
scripts/config.py unset MBEDTLS_SSL_CONTEXT_SERIALIZATION
|
||||
scripts/config.py unset MBEDTLS_SSL_TICKET_C
|
||||
|
||||
make
|
||||
|
||||
msg "test: default with only stream cipher"
|
||||
make test
|
||||
|
||||
# Not running ssl-opt.sh because most tests require a non-NULL ciphersuite.
|
||||
}
|
||||
|
||||
component_test_tls1_2_default_stream_cipher_only_use_psa () {
|
||||
msg "build: default with only stream cipher use psa"
|
||||
|
||||
scripts/config.py set MBEDTLS_USE_PSA_CRYPTO
|
||||
# Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C)
|
||||
scripts/config.py unset MBEDTLS_GCM_C
|
||||
scripts/config.py unset MBEDTLS_CCM_C
|
||||
scripts/config.py unset MBEDTLS_CHACHAPOLY_C
|
||||
# Disable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
|
||||
scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
|
||||
# Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
scripts/config.py unset MBEDTLS_SSL_ENCRYPT_THEN_MAC
|
||||
# Enable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER))
|
||||
scripts/config.py set MBEDTLS_CIPHER_NULL_CIPHER
|
||||
# Modules that depend on AEAD
|
||||
scripts/config.py unset MBEDTLS_SSL_CONTEXT_SERIALIZATION
|
||||
scripts/config.py unset MBEDTLS_SSL_TICKET_C
|
||||
|
||||
make
|
||||
|
||||
msg "test: default with only stream cipher use psa"
|
||||
make test
|
||||
|
||||
# Not running ssl-opt.sh because most tests require a non-NULL ciphersuite.
|
||||
}
|
||||
|
||||
component_test_tls1_2_default_cbc_legacy_cipher_only () {
|
||||
msg "build: default with only CBC-legacy cipher"
|
||||
|
||||
# Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C)
|
||||
scripts/config.py unset MBEDTLS_GCM_C
|
||||
scripts/config.py unset MBEDTLS_CCM_C
|
||||
scripts/config.py unset MBEDTLS_CHACHAPOLY_C
|
||||
# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
|
||||
scripts/config.py set MBEDTLS_CIPHER_MODE_CBC
|
||||
# Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
scripts/config.py unset MBEDTLS_SSL_ENCRYPT_THEN_MAC
|
||||
# Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER))
|
||||
scripts/config.py unset MBEDTLS_CIPHER_NULL_CIPHER
|
||||
# Modules that depend on AEAD
|
||||
scripts/config.py unset MBEDTLS_SSL_CONTEXT_SERIALIZATION
|
||||
scripts/config.py unset MBEDTLS_SSL_TICKET_C
|
||||
|
||||
make
|
||||
|
||||
msg "test: default with only CBC-legacy cipher"
|
||||
make test
|
||||
|
||||
msg "test: default with only CBC-legacy cipher - ssl-opt.sh (subset)"
|
||||
tests/ssl-opt.sh -f "TLS 1.2"
|
||||
}
|
||||
|
||||
component_test_tls1_2_deafult_cbc_legacy_cipher_only_use_psa () {
|
||||
msg "build: default with only CBC-legacy cipher use psa"
|
||||
|
||||
scripts/config.py set MBEDTLS_USE_PSA_CRYPTO
|
||||
# Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C)
|
||||
scripts/config.py unset MBEDTLS_GCM_C
|
||||
scripts/config.py unset MBEDTLS_CCM_C
|
||||
scripts/config.py unset MBEDTLS_CHACHAPOLY_C
|
||||
# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
|
||||
scripts/config.py set MBEDTLS_CIPHER_MODE_CBC
|
||||
# Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
scripts/config.py unset MBEDTLS_SSL_ENCRYPT_THEN_MAC
|
||||
# Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER))
|
||||
scripts/config.py unset MBEDTLS_CIPHER_NULL_CIPHER
|
||||
# Modules that depend on AEAD
|
||||
scripts/config.py unset MBEDTLS_SSL_CONTEXT_SERIALIZATION
|
||||
scripts/config.py unset MBEDTLS_SSL_TICKET_C
|
||||
|
||||
make
|
||||
|
||||
msg "test: default with only CBC-legacy cipher use psa"
|
||||
make test
|
||||
|
||||
msg "test: default with only CBC-legacy cipher use psa - ssl-opt.sh (subset)"
|
||||
tests/ssl-opt.sh -f "TLS 1.2"
|
||||
}
|
||||
|
||||
component_test_tls1_2_default_cbc_legacy_cbc_etm_cipher_only () {
|
||||
msg "build: default with only CBC-legacy and CBC-EtM ciphers"
|
||||
|
||||
# Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C)
|
||||
scripts/config.py unset MBEDTLS_GCM_C
|
||||
scripts/config.py unset MBEDTLS_CCM_C
|
||||
scripts/config.py unset MBEDTLS_CHACHAPOLY_C
|
||||
# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
|
||||
scripts/config.py set MBEDTLS_CIPHER_MODE_CBC
|
||||
# Enable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
scripts/config.py set MBEDTLS_SSL_ENCRYPT_THEN_MAC
|
||||
# Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER))
|
||||
scripts/config.py unset MBEDTLS_CIPHER_NULL_CIPHER
|
||||
# Modules that depend on AEAD
|
||||
scripts/config.py unset MBEDTLS_SSL_CONTEXT_SERIALIZATION
|
||||
scripts/config.py unset MBEDTLS_SSL_TICKET_C
|
||||
|
||||
make
|
||||
|
||||
msg "test: default with only CBC-legacy and CBC-EtM ciphers"
|
||||
make test
|
||||
|
||||
msg "test: default with only CBC-legacy and CBC-EtM ciphers - ssl-opt.sh (subset)"
|
||||
tests/ssl-opt.sh -f "TLS 1.2"
|
||||
}
|
||||
|
||||
component_test_tls1_2_default_cbc_legacy_cbc_etm_cipher_only_use_psa () {
|
||||
msg "build: default with only CBC-legacy and CBC-EtM ciphers use psa"
|
||||
|
||||
scripts/config.py set MBEDTLS_USE_PSA_CRYPTO
|
||||
# Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C)
|
||||
scripts/config.py unset MBEDTLS_GCM_C
|
||||
scripts/config.py unset MBEDTLS_CCM_C
|
||||
scripts/config.py unset MBEDTLS_CHACHAPOLY_C
|
||||
# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
|
||||
scripts/config.py set MBEDTLS_CIPHER_MODE_CBC
|
||||
# Enable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
scripts/config.py set MBEDTLS_SSL_ENCRYPT_THEN_MAC
|
||||
# Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER))
|
||||
scripts/config.py unset MBEDTLS_CIPHER_NULL_CIPHER
|
||||
# Modules that depend on AEAD
|
||||
scripts/config.py unset MBEDTLS_SSL_CONTEXT_SERIALIZATION
|
||||
scripts/config.py unset MBEDTLS_SSL_TICKET_C
|
||||
|
||||
make
|
||||
|
||||
msg "test: default with only CBC-legacy and CBC-EtM ciphers use psa"
|
||||
make test
|
||||
|
||||
msg "test: default with only CBC-legacy and CBC-EtM ciphers use psa - ssl-opt.sh (subset)"
|
||||
tests/ssl-opt.sh -f "TLS 1.2"
|
||||
}
|
||||
|
||||
component_test_new_ecdh_context () {
|
||||
msg "build: new ECDH context (ASan build)" # ~ 6 min
|
||||
scripts/config.py unset MBEDTLS_ECDH_LEGACY_CONTEXT
|
||||
|
||||
@@ -6595,6 +6595,7 @@ run_test "Per-version suites: TLS 1.1" \
|
||||
|
||||
requires_config_enabled MBEDTLS_CAMELLIA_C
|
||||
requires_config_enabled MBEDTLS_AES_C
|
||||
requires_config_enabled MBEDTLS_GCM_C
|
||||
run_test "Per-version suites: TLS 1.2" \
|
||||
"$P_SRV version_suites=TLS-RSA-WITH-CAMELLIA-128-CBC-SHA,TLS-RSA-WITH-AES-256-CBC-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
|
||||
"$P_CLI force_version=tls12" \
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
/* BEGIN_HEADER */
|
||||
#include "mbedtls/cipher.h"
|
||||
|
||||
#if defined(MBEDTLS_AES_C)
|
||||
#include "mbedtls/aes.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_GCM_C)
|
||||
#include "mbedtls/gcm.h"
|
||||
|
||||
@@ -22,15 +22,15 @@ mbedtls_cmac_setkey:MBEDTLS_CIPHER_DES_EDE3_ECB:192:0
|
||||
|
||||
CMAC init #5 AES-224: bad key size
|
||||
depends_on:MBEDTLS_AES_C
|
||||
mbedtls_cmac_setkey:MBEDTLS_CIPHER_ID_AES:224:MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA
|
||||
mbedtls_cmac_setkey:MBEDTLS_CIPHER_AES_128_ECB:224:MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA
|
||||
|
||||
CMAC init #6 AES-0: bad key size
|
||||
depends_on:MBEDTLS_AES_C
|
||||
mbedtls_cmac_setkey:MBEDTLS_CIPHER_ID_AES:0:MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA
|
||||
mbedtls_cmac_setkey:MBEDTLS_CIPHER_AES_128_ECB:0:MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA
|
||||
|
||||
CMAC init #7 Camellia: wrong cipher
|
||||
depends_on:MBEDTLS_CAMELLIA_C
|
||||
mbedtls_cmac_setkey:MBEDTLS_CIPHER_ID_CAMELLIA:128:MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA
|
||||
mbedtls_cmac_setkey:MBEDTLS_CIPHER_CAMELLIA_192_ECB:128:MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA
|
||||
|
||||
CMAC Single Blocks #1 - Empty block, no updates
|
||||
mbedtls_cmac_multiple_blocks:MBEDTLS_CIPHER_AES_128_ECB:"2b7e151628aed2a6abf7158809cf4f3c":128:16:"":-1:"":-1:"":-1:"":-1:"bb1d6929e95937287fa37d129b756746"
|
||||
|
||||
Reference in New Issue
Block a user