tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

ssl_ecdh_unittest.cc (28749B)


      1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
      2 /* vim: set ts=2 et sw=2 tw=80: */
      3 /* This Source Code Form is subject to the terms of the Mozilla Public
      4 * License, v. 2.0. If a copy of the MPL was not distributed with this file,
      5 * You can obtain one at http://mozilla.org/MPL/2.0/. */
      6 
      7 #include <functional>
      8 #include <memory>
      9 #include "secerr.h"
     10 #include "ssl.h"
     11 #include "sslerr.h"
     12 #include "sslproto.h"
     13 
     14 extern "C" {
     15 // This is not something that should make you happy.
     16 #include "libssl_internals.h"
     17 }
     18 
     19 #include "gtest_utils.h"
     20 #include "nss_scoped_ptrs.h"
     21 #include "tls_connect.h"
     22 #include "tls_filter.h"
     23 #include "tls_parser.h"
     24 
     25 namespace nss_test {
     26 
     27 TEST_P(TlsConnectGenericPre13, ConnectEcdh) {
     28  SetExpectedVersion(std::get<1>(GetParam()));
     29  Reset(TlsAgent::kServerEcdhEcdsa);
     30  DisableAllCiphers();
     31  EnableSomeEcdhCiphers();
     32 
     33  Connect();
     34  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_ecdh_ecdsa,
     35            ssl_sig_none);
     36 }
     37 
     38 TEST_P(TlsConnectGenericPre13, ConnectEcdhWithoutDisablingSuites) {
     39  SetExpectedVersion(std::get<1>(GetParam()));
     40  Reset(TlsAgent::kServerEcdhEcdsa);
     41  EnableSomeEcdhCiphers();
     42 
     43  Connect();
     44  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_ecdh_ecdsa,
     45            ssl_sig_none);
     46 }
     47 
     48 TEST_P(TlsConnectGeneric, ConnectEcdhe) {
     49  Connect();
     50  CheckKeys();
     51 }
     52 
     53 // If we pick a 256-bit cipher suite and use a P-384 certificate, the server
     54 // should choose P-384 for key exchange too.  Only valid for TLS == 1.2 because
     55 // we don't have 256-bit ciphers before then and 1.3 doesn't try to couple
     56 // DHE size to symmetric size.
     57 TEST_P(TlsConnectTls12, ConnectEcdheP384) {
     58  Reset(TlsAgent::kServerEcdsa384);
     59  ConnectWithCipherSuite(TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256);
     60  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_ecdsa,
     61            ssl_sig_ecdsa_secp256r1_sha256);
     62 }
     63 
     64 TEST_P(TlsConnectGeneric, ConnectEcdheP384Client) {
     65  EnsureTlsSetup();
     66  const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1,
     67                                             ssl_grp_ffdhe_2048};
     68  client_->ConfigNamedGroups(groups);
     69  server_->ConfigNamedGroups(groups);
     70  Connect();
     71  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
     72            ssl_sig_rsa_pss_rsae_sha256);
     73 }
     74 
     75 // The bug https://bugzilla.mozilla.org/show_bug.cgi?id=1818487 updates the
     76 // generation of transcript for DTLS1.3
     77 // The following three tests are used to check the correctness of the
     78 // transcript.
     79 TEST_P(TlsConnectGeneric,
     80       ClientOfferTls11_Tls13ServerNegotiateEachVersionOneByOne_HRR) {
     81  EnsureTlsSetup();
     82  auto hrr_capture = MakeTlsFilter<TlsHandshakeRecorder>(
     83      server_, kTlsHandshakeHelloRetryRequest);
     84  const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1,
     85                                             ssl_grp_ffdhe_2048};
     86  server_->ConfigNamedGroups(groups);
     87  // DTLS does not support 1.0
     88  if (variant_ == ssl_variant_datagram) {
     89    client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
     90                             SSL_LIBRARY_VERSION_TLS_1_3);
     91  } else {
     92    client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_0,
     93                             SSL_LIBRARY_VERSION_TLS_1_3);
     94  }
     95  server_->SetVersionRange(version_, version_);
     96  Connect();
     97  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
     98            ssl_sig_rsa_pss_rsae_sha256);
     99 
    100  EXPECT_EQ(version_ == SSL_LIBRARY_VERSION_TLS_1_3,
    101            hrr_capture->buffer().len() != 0);
    102 }
    103 
    104 // This causes a HelloRetryRequest in TLS 1.3.  Earlier versions don't care.
    105 TEST_P(TlsConnectGeneric, ConnectEcdheP384Server) {
    106  EnsureTlsSetup();
    107  auto hrr_capture = MakeTlsFilter<TlsHandshakeRecorder>(
    108      server_, kTlsHandshakeHelloRetryRequest);
    109  const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1};
    110  server_->ConfigNamedGroups(groups);
    111  Connect();
    112  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
    113            ssl_sig_rsa_pss_rsae_sha256);
    114  EXPECT_EQ(version_ == SSL_LIBRARY_VERSION_TLS_1_3,
    115            hrr_capture->buffer().len() != 0);
    116 }
    117 
    118 // This enables only P-256 on the client and disables it on the server.
    119 // This test will fail when we add other groups that identify as ECDHE.
    120 TEST_P(TlsConnectGeneric, ConnectEcdheGroupMismatch) {
    121  EnsureTlsSetup();
    122  const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_secp256r1,
    123                                                    ssl_grp_ffdhe_2048};
    124  const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ffdhe_2048};
    125  client_->ConfigNamedGroups(client_groups);
    126  server_->ConfigNamedGroups(server_groups);
    127 
    128  Connect();
    129  CheckKeys(ssl_kea_dh, ssl_auth_rsa_sign);
    130 }
    131 
    132 TEST_P(TlsKeyExchangeTest, P384Priority) {
    133  // P256, P384 and P521 are enabled. Both prefer P384.
    134  const std::vector<SSLNamedGroup> groups = {
    135      ssl_grp_ec_secp384r1, ssl_grp_ec_secp256r1, ssl_grp_ec_secp521r1};
    136  EnsureKeyShareSetup();
    137  ConfigNamedGroups(groups);
    138  client_->DisableAllCiphers();
    139  client_->EnableCiphersByKeyExchange(ssl_kea_ecdh);
    140  Connect();
    141 
    142  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
    143            ssl_sig_rsa_pss_rsae_sha256);
    144 
    145  std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp384r1};
    146  CheckKEXDetails(groups, shares);
    147 }
    148 
    149 TEST_P(TlsKeyExchangeTest, DuplicateGroupConfig) {
    150  const std::vector<SSLNamedGroup> groups = {
    151      ssl_grp_ec_secp384r1, ssl_grp_ec_secp384r1, ssl_grp_ec_secp384r1,
    152      ssl_grp_ec_secp256r1, ssl_grp_ec_secp256r1};
    153  EnsureKeyShareSetup();
    154  ConfigNamedGroups(groups);
    155  client_->DisableAllCiphers();
    156  client_->EnableCiphersByKeyExchange(ssl_kea_ecdh);
    157  Connect();
    158 
    159  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
    160            ssl_sig_rsa_pss_rsae_sha256);
    161 
    162  std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp384r1};
    163  std::vector<SSLNamedGroup> expectedGroups = {ssl_grp_ec_secp384r1,
    164                                               ssl_grp_ec_secp256r1};
    165  CheckKEXDetails(expectedGroups, shares);
    166 }
    167 
    168 TEST_P(TlsKeyExchangeTest, P384PriorityDHEnabled) {
    169  // P256, P384,  P521, and FFDHE2048 are enabled. Both prefer P384.
    170  const std::vector<SSLNamedGroup> groups = {
    171      ssl_grp_ec_secp384r1, ssl_grp_ffdhe_2048, ssl_grp_ec_secp256r1,
    172      ssl_grp_ec_secp521r1};
    173  EnsureKeyShareSetup();
    174  ConfigNamedGroups(groups);
    175  Connect();
    176 
    177  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
    178            ssl_sig_rsa_pss_rsae_sha256);
    179 
    180  if (version_ >= SSL_LIBRARY_VERSION_TLS_1_3) {
    181    std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp384r1};
    182    CheckKEXDetails(groups, shares);
    183  } else {
    184    std::vector<SSLNamedGroup> oldtlsgroups = {
    185        ssl_grp_ec_secp384r1, ssl_grp_ec_secp256r1, ssl_grp_ec_secp521r1};
    186    CheckKEXDetails(oldtlsgroups, std::vector<SSLNamedGroup>());
    187  }
    188 }
    189 
    190 TEST_P(TlsConnectGenericPre13, P384PriorityOnServer) {
    191  EnsureTlsSetup();
    192  client_->DisableAllCiphers();
    193  client_->EnableCiphersByKeyExchange(ssl_kea_ecdh);
    194 
    195  // The server prefers P384. It has to win.
    196  const std::vector<SSLNamedGroup> server_groups = {
    197      ssl_grp_ec_secp384r1, ssl_grp_ec_secp256r1, ssl_grp_ec_secp521r1};
    198  server_->ConfigNamedGroups(server_groups);
    199 
    200  Connect();
    201 
    202  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
    203            ssl_sig_rsa_pss_rsae_sha256);
    204 }
    205 
    206 TEST_P(TlsConnectGenericPre13, P384PriorityFromModelSocket) {
    207  EnsureModelSockets();
    208 
    209  /* Both prefer P384, set on the model socket. */
    210  const std::vector<SSLNamedGroup> groups = {
    211      ssl_grp_ec_secp384r1, ssl_grp_ec_secp256r1, ssl_grp_ec_secp521r1,
    212      ssl_grp_ffdhe_2048};
    213  client_model_->ConfigNamedGroups(groups);
    214  server_model_->ConfigNamedGroups(groups);
    215 
    216  Connect();
    217 
    218  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
    219            ssl_sig_rsa_pss_rsae_sha256);
    220 }
    221 
    222 class TlsKeyExchangeGroupCapture : public TlsHandshakeFilter {
    223 public:
    224  TlsKeyExchangeGroupCapture(const std::shared_ptr<TlsAgent> &a)
    225      : TlsHandshakeFilter(a, {kTlsHandshakeServerKeyExchange}),
    226        group_(ssl_grp_none) {}
    227 
    228  SSLNamedGroup group() const { return group_; }
    229 
    230 protected:
    231  virtual PacketFilter::Action FilterHandshake(const HandshakeHeader &header,
    232                                               const DataBuffer &input,
    233                                               DataBuffer *output) {
    234    uint32_t value = 0;
    235    EXPECT_TRUE(input.Read(0, 1, &value));
    236    EXPECT_EQ(3U, value) << "curve type has to be 3";
    237 
    238    EXPECT_TRUE(input.Read(1, 2, &value));
    239    group_ = static_cast<SSLNamedGroup>(value);
    240 
    241    return KEEP;
    242  }
    243 
    244 private:
    245  SSLNamedGroup group_;
    246 };
    247 
    248 // If we strip the client's supported groups extension, the server should assume
    249 // P-256 is supported by the client (<= 1.2 only).
    250 TEST_P(TlsConnectGenericPre13, DropSupportedGroupExtensionP256) {
    251  EnsureTlsSetup();
    252  MakeTlsFilter<TlsExtensionDropper>(client_, ssl_supported_groups_xtn);
    253  auto group_capture = MakeTlsFilter<TlsKeyExchangeGroupCapture>(server_);
    254 
    255  ConnectExpectAlert(server_, kTlsAlertDecryptError);
    256  client_->CheckErrorCode(SSL_ERROR_DECRYPT_ERROR_ALERT);
    257  server_->CheckErrorCode(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
    258 
    259  EXPECT_EQ(ssl_grp_ec_secp256r1, group_capture->group());
    260 }
    261 
    262 // Supported groups is mandatory in TLS 1.3.
    263 TEST_P(TlsConnectTls13, DropSupportedGroupExtension) {
    264  EnsureTlsSetup();
    265  MakeTlsFilter<TlsExtensionDropper>(client_, ssl_supported_groups_xtn);
    266  ConnectExpectAlert(server_, kTlsAlertMissingExtension);
    267  client_->CheckErrorCode(SSL_ERROR_MISSING_EXTENSION_ALERT);
    268  server_->CheckErrorCode(SSL_ERROR_MISSING_SUPPORTED_GROUPS_EXTENSION);
    269 }
    270 
    271 // If we only have a lame group, we fall back to static RSA.
    272 TEST_P(TlsConnectGenericPre13, UseLameGroup) {
    273  const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp192r1};
    274  client_->ConfigNamedGroups(groups);
    275  server_->ConfigNamedGroups(groups);
    276  Connect();
    277  CheckKeys(ssl_kea_rsa, ssl_grp_none, ssl_auth_rsa_decrypt, ssl_sig_none);
    278 }
    279 
    280 // In TLS 1.3, we can't generate the ClientHello.
    281 TEST_P(TlsConnectTls13, UseLameGroup) {
    282  const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_sect283k1};
    283  client_->ConfigNamedGroups(groups);
    284  server_->ConfigNamedGroups(groups);
    285  client_->StartConnect();
    286  client_->Handshake();
    287  client_->CheckErrorCode(SSL_ERROR_NO_CIPHERS_SUPPORTED);
    288 }
    289 
    290 TEST_P(TlsConnectStreamPre13, ConfiguredGroupsRenegotiate) {
    291  EnsureTlsSetup();
    292  client_->DisableAllCiphers();
    293  client_->EnableCiphersByKeyExchange(ssl_kea_ecdh);
    294 
    295  const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_secp256r1};
    296  const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_secp256r1,
    297                                                    ssl_grp_ec_secp256r1};
    298  client_->ConfigNamedGroups(client_groups);
    299  server_->ConfigNamedGroups(server_groups);
    300 
    301  Connect();
    302 
    303  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
    304            ssl_sig_rsa_pss_rsae_sha256);
    305  CheckConnected();
    306 
    307  // The renegotiation has to use the same preferences as the original session.
    308  server_->PrepareForRenegotiate();
    309  client_->StartRenegotiate();
    310  Handshake();
    311  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
    312            ssl_sig_rsa_pss_rsae_sha256);
    313 }
    314 
    315 TEST_P(TlsKeyExchangeTest, Curve25519) {
    316  Reset(TlsAgent::kServerEcdsa256);
    317  const std::vector<SSLNamedGroup> groups = {
    318      ssl_grp_ec_curve25519, ssl_grp_ec_secp256r1, ssl_grp_ec_secp521r1};
    319  EnsureKeyShareSetup();
    320  ConfigNamedGroups(groups);
    321  Connect();
    322 
    323  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_ecdsa,
    324            ssl_sig_ecdsa_secp256r1_sha256);
    325  const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};
    326  CheckKEXDetails(groups, shares);
    327 }
    328 
    329 TEST_P(TlsConnectGenericPre13, GroupPreferenceServerPriority) {
    330  EnsureTlsSetup();
    331  client_->DisableAllCiphers();
    332  client_->EnableCiphersByKeyExchange(ssl_kea_ecdh);
    333 
    334  // The client prefers P256 while the server prefers 25519.
    335  // The server's preference has to win.
    336  const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_secp256r1,
    337                                                    ssl_grp_ec_curve25519};
    338  const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_curve25519,
    339                                                    ssl_grp_ec_secp256r1};
    340  client_->ConfigNamedGroups(client_groups);
    341  server_->ConfigNamedGroups(server_groups);
    342 
    343  Connect();
    344 
    345  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_rsa_sign,
    346            ssl_sig_rsa_pss_rsae_sha256);
    347 }
    348 
    349 #ifndef NSS_DISABLE_TLS_1_3
    350 TEST_P(TlsKeyExchangeTest13, Curve25519P256EqualPriorityClient13) {
    351  EnsureKeyShareSetup();
    352 
    353  // The client sends a P256 key share while the server prefers 25519.
    354  // We have to accept P256 without retry.
    355  const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_secp256r1,
    356                                                    ssl_grp_ec_curve25519};
    357  const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_curve25519,
    358                                                    ssl_grp_ec_secp256r1};
    359  client_->ConfigNamedGroups(client_groups);
    360  server_->ConfigNamedGroups(server_groups);
    361 
    362  Connect();
    363 
    364  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
    365            ssl_sig_rsa_pss_rsae_sha256);
    366  const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp256r1};
    367  CheckKEXDetails(client_groups, shares);
    368 }
    369 
    370 TEST_P(TlsKeyExchangeTest13, Curve25519P256EqualPriorityServer13) {
    371  EnsureKeyShareSetup();
    372 
    373  // The client sends a 25519 key share while the server prefers P256.
    374  // We have to accept 25519 without retry.
    375  const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_curve25519,
    376                                                    ssl_grp_ec_secp256r1};
    377  const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_secp256r1,
    378                                                    ssl_grp_ec_curve25519};
    379  client_->ConfigNamedGroups(client_groups);
    380  server_->ConfigNamedGroups(server_groups);
    381 
    382  Connect();
    383 
    384  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_rsa_sign,
    385            ssl_sig_rsa_pss_rsae_sha256);
    386  const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};
    387  CheckKEXDetails(client_groups, shares);
    388 }
    389 
    390 TEST_P(TlsKeyExchangeTest13, EqualPriorityTestRetryECServer13) {
    391  EnsureKeyShareSetup();
    392 
    393  // The client sends a 25519 key share while the server prefers P256.
    394  // The server prefers P-384 over x25519, so it must not consider P-256 and
    395  // x25519 to be equivalent. It will therefore request a P-256 share
    396  // with a HelloRetryRequest.
    397  const std::vector<SSLNamedGroup> client_groups = {
    398      ssl_grp_ec_curve25519, ssl_grp_ec_secp256r1, ssl_grp_ec_secp384r1};
    399  const std::vector<SSLNamedGroup> server_groups = {
    400      ssl_grp_ec_secp256r1, ssl_grp_ec_secp384r1, ssl_grp_ec_curve25519};
    401  client_->ConfigNamedGroups(client_groups);
    402  server_->ConfigNamedGroups(server_groups);
    403 
    404  Connect();
    405 
    406  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
    407            ssl_sig_rsa_pss_rsae_sha256);
    408  const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};
    409  CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1);
    410 }
    411 
    412 TEST_P(TlsKeyExchangeTest13, NotEqualPriorityWithIntermediateGroup13) {
    413  EnsureKeyShareSetup();
    414 
    415  // The client sends a 25519 key share while the server prefers P256.
    416  // The server prefers ffdhe_2048 over x25519, so it must not consider the
    417  // P-256 and x25519 to be equivalent. It will therefore request a P-256 share
    418  // with a HelloRetryRequest.
    419  const std::vector<SSLNamedGroup> client_groups = {
    420      ssl_grp_ec_curve25519, ssl_grp_ec_secp256r1, ssl_grp_ffdhe_2048};
    421  const std::vector<SSLNamedGroup> server_groups = {
    422      ssl_grp_ec_secp256r1, ssl_grp_ffdhe_2048, ssl_grp_ec_curve25519};
    423  client_->ConfigNamedGroups(client_groups);
    424  server_->ConfigNamedGroups(server_groups);
    425 
    426  Connect();
    427 
    428  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
    429            ssl_sig_rsa_pss_rsae_sha256);
    430  const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};
    431  CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1);
    432 }
    433 
    434 TEST_P(TlsKeyExchangeTest13,
    435       NotEqualPriorityWithUnsupportedFFIntermediateGroup13) {
    436  EnsureKeyShareSetup();
    437 
    438  // As in the previous test, the server prefers ffdhe_2048. Thus, even though
    439  // the client doesn't support this group, the server must not regard x25519 as
    440  // equivalent to P-256.
    441  const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_curve25519,
    442                                                    ssl_grp_ec_secp256r1};
    443  const std::vector<SSLNamedGroup> server_groups = {
    444      ssl_grp_ec_secp256r1, ssl_grp_ffdhe_2048, ssl_grp_ec_curve25519};
    445  client_->ConfigNamedGroups(client_groups);
    446  server_->ConfigNamedGroups(server_groups);
    447 
    448  Connect();
    449 
    450  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
    451            ssl_sig_rsa_pss_rsae_sha256);
    452  const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};
    453  CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1);
    454 }
    455 
    456 TEST_P(TlsKeyExchangeTest13,
    457       NotEqualPriorityWithUnsupportedECIntermediateGroup13) {
    458  EnsureKeyShareSetup();
    459 
    460  // As in the previous test, the server prefers P-384. Thus, even though
    461  // the client doesn't support this group, the server must not regard x25519 as
    462  // equivalent to P-256. The server sends a HelloRetryRequest.
    463  const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_curve25519,
    464                                                    ssl_grp_ec_secp256r1};
    465  const std::vector<SSLNamedGroup> server_groups = {
    466      ssl_grp_ec_secp256r1, ssl_grp_ec_secp384r1, ssl_grp_ec_curve25519};
    467  client_->ConfigNamedGroups(client_groups);
    468  server_->ConfigNamedGroups(server_groups);
    469 
    470  Connect();
    471 
    472  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
    473            ssl_sig_rsa_pss_rsae_sha256);
    474  const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};
    475  CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1);
    476 }
    477 
    478 TEST_P(TlsKeyExchangeTest13, EqualPriority13) {
    479  EnsureKeyShareSetup();
    480 
    481  // The client sends a 25519 key share while the server prefers P256.
    482  // We have to accept 25519 without retry because it's considered equivalent to
    483  // P256 by the server.
    484  const std::vector<SSLNamedGroup> client_groups = {
    485      ssl_grp_ec_curve25519, ssl_grp_ffdhe_2048, ssl_grp_ec_secp256r1};
    486  const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_secp256r1,
    487                                                    ssl_grp_ec_curve25519};
    488  client_->ConfigNamedGroups(client_groups);
    489  server_->ConfigNamedGroups(server_groups);
    490 
    491  Connect();
    492 
    493  CheckKeys(ssl_kea_ecdh, ssl_auth_rsa_sign);
    494  const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};
    495  CheckKEXDetails(client_groups, shares);
    496 }
    497 #endif
    498 
    499 TEST_P(TlsConnectGeneric, P256ClientAndCurve25519Server) {
    500  EnsureTlsSetup();
    501  client_->DisableAllCiphers();
    502  client_->EnableCiphersByKeyExchange(ssl_kea_ecdh);
    503 
    504  // The client sends a P256 key share while the server prefers 25519.
    505  const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_secp256r1};
    506  const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_curve25519};
    507 
    508  client_->ConfigNamedGroups(client_groups);
    509  server_->ConfigNamedGroups(server_groups);
    510 
    511  ConnectExpectAlert(server_, kTlsAlertHandshakeFailure);
    512  client_->CheckErrorCode(SSL_ERROR_NO_CYPHER_OVERLAP);
    513  server_->CheckErrorCode(SSL_ERROR_NO_CYPHER_OVERLAP);
    514 }
    515 
    516 TEST_P(TlsKeyExchangeTest13, MultipleClientShares) {
    517  EnsureKeyShareSetup();
    518 
    519  // The client sends 25519 and P256 key shares. The server prefers P256,
    520  // which must be chosen here.
    521  const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_curve25519,
    522                                                    ssl_grp_ec_secp256r1};
    523  const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_secp256r1,
    524                                                    ssl_grp_ec_curve25519};
    525  client_->ConfigNamedGroups(client_groups);
    526  server_->ConfigNamedGroups(server_groups);
    527 
    528  // Generate a key share on the client for both curves.
    529  EXPECT_EQ(SECSuccess, SSL_SendAdditionalKeyShares(client_->ssl_fd(), 1));
    530 
    531  Connect();
    532 
    533  // The server would accept 25519 but its preferred group (P256) has to win.
    534  CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
    535            ssl_sig_rsa_pss_rsae_sha256);
    536  const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519,
    537                                             ssl_grp_ec_secp256r1};
    538  CheckKEXDetails(client_groups, shares);
    539 }
    540 
    541 // Replace the point in the client key exchange message with an empty one
    542 class ECCClientKEXFilter : public TlsHandshakeFilter {
    543 public:
    544  ECCClientKEXFilter(const std::shared_ptr<TlsAgent> &client)
    545      : TlsHandshakeFilter(client, {kTlsHandshakeClientKeyExchange}) {}
    546 
    547 protected:
    548  virtual PacketFilter::Action FilterHandshake(const HandshakeHeader &header,
    549                                               const DataBuffer &input,
    550                                               DataBuffer *output) {
    551    // Replace the client key exchange message with an empty point
    552    output->Allocate(1);
    553    output->Write(0, 0U, 1);  // set point length 0
    554    return CHANGE;
    555  }
    556 };
    557 
    558 // Replace the point in the server key exchange message with an empty one
    559 class ECCServerKEXFilter : public TlsHandshakeFilter {
    560 public:
    561  ECCServerKEXFilter(const std::shared_ptr<TlsAgent> &server)
    562      : TlsHandshakeFilter(server, {kTlsHandshakeServerKeyExchange}) {}
    563 
    564 protected:
    565  virtual PacketFilter::Action FilterHandshake(const HandshakeHeader &header,
    566                                               const DataBuffer &input,
    567                                               DataBuffer *output) {
    568    // Replace the server key exchange message with an empty point
    569    output->Allocate(4);
    570    output->Write(0, 3U, 1);  // named curve
    571    uint32_t curve = 0;
    572    EXPECT_TRUE(input.Read(1, 2, &curve));  // get curve id
    573    output->Write(1, curve, 2);             // write curve id
    574    output->Write(3, 0U, 1);                // point length 0
    575    return CHANGE;
    576  }
    577 };
    578 
    579 TEST_P(TlsConnectGenericPre13, ConnectECDHEmptyServerPoint) {
    580  MakeTlsFilter<ECCServerKEXFilter>(server_);
    581  ConnectExpectAlert(client_, kTlsAlertIllegalParameter);
    582  client_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH);
    583 }
    584 
    585 TEST_P(TlsConnectGenericPre13, ConnectECDHEmptyClientPoint) {
    586  MakeTlsFilter<ECCClientKEXFilter>(client_);
    587  ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
    588  server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_KEY_EXCH);
    589 }
    590 
    591 // Damage ECParams/ECPoint of a SKE.
    592 class ECCServerKEXDamager : public TlsHandshakeFilter {
    593 public:
    594  ECCServerKEXDamager(const std::shared_ptr<TlsAgent> &server, ECType ec_type,
    595                      SSLNamedGroup named_curve)
    596      : TlsHandshakeFilter(server, {kTlsHandshakeServerKeyExchange}),
    597        ec_type_(ec_type),
    598        named_curve_(named_curve) {}
    599 
    600 protected:
    601  virtual PacketFilter::Action FilterHandshake(const HandshakeHeader &header,
    602                                               const DataBuffer &input,
    603                                               DataBuffer *output) {
    604    size_t offset = 0;
    605    output->Allocate(5);
    606    offset = output->Write(offset, ec_type_, 1);
    607    offset = output->Write(offset, named_curve_, 2);
    608    // Write a point with fmt != EC_POINT_FORM_UNCOMPRESSED.
    609    offset = output->Write(offset, 1U, 1);
    610    (void)output->Write(offset, 0x02, 1);  // EC_POINT_FORM_COMPRESSED_Y0
    611    return CHANGE;
    612  }
    613 
    614 private:
    615  ECType ec_type_;
    616  SSLNamedGroup named_curve_;
    617 };
    618 
    619 TEST_P(TlsConnectGenericPre13, ConnectUnsupportedCurveType) {
    620  EnsureTlsSetup();
    621  client_->DisableAllCiphers();
    622  client_->EnableCiphersByKeyExchange(ssl_kea_ecdh);
    623 
    624  MakeTlsFilter<ECCServerKEXDamager>(server_, ec_type_explicitPrime,
    625                                     ssl_grp_none);
    626  ConnectExpectAlert(client_, kTlsAlertHandshakeFailure);
    627  client_->CheckErrorCode(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE);
    628 }
    629 
    630 TEST_P(TlsConnectGenericPre13, ConnectUnsupportedCurve) {
    631  EnsureTlsSetup();
    632  client_->DisableAllCiphers();
    633  client_->EnableCiphersByKeyExchange(ssl_kea_ecdh);
    634 
    635  MakeTlsFilter<ECCServerKEXDamager>(server_, ec_type_named,
    636                                     ssl_grp_ffdhe_2048);
    637  ConnectExpectAlert(client_, kTlsAlertHandshakeFailure);
    638  client_->CheckErrorCode(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE);
    639 }
    640 
    641 TEST_P(TlsConnectGenericPre13, ConnectUnsupportedPointFormat) {
    642  EnsureTlsSetup();
    643  client_->DisableAllCiphers();
    644  client_->EnableCiphersByKeyExchange(ssl_kea_ecdh);
    645 
    646  MakeTlsFilter<ECCServerKEXDamager>(server_, ec_type_named,
    647                                     ssl_grp_ec_secp256r1);
    648  ConnectExpectAlert(client_, kTlsAlertHandshakeFailure);
    649  client_->CheckErrorCode(SEC_ERROR_UNSUPPORTED_EC_POINT_FORM);
    650 }
    651 
    652 TEST_P(TlsConnectTls12, ConnectUnsupportedSigAlg) {
    653  EnsureTlsSetup();
    654  client_->DisableAllCiphers();
    655  client_->EnableCiphersByKeyExchange(ssl_kea_ecdh);
    656 
    657  MakeTlsFilter<ECCServerKEXSigAlgReplacer>(server_, ssl_sig_none);
    658  ConnectExpectAlert(client_, kTlsAlertIllegalParameter);
    659  client_->CheckErrorCode(SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM);
    660 }
    661 
    662 TEST_P(TlsConnectTls12, ConnectIncorrectSigAlg) {
    663  EnsureTlsSetup();
    664  client_->DisableAllCiphers();
    665  client_->EnableCiphersByKeyExchange(ssl_kea_ecdh);
    666 
    667  MakeTlsFilter<ECCServerKEXSigAlgReplacer>(server_,
    668                                            ssl_sig_ecdsa_secp256r1_sha256);
    669  ConnectExpectAlert(client_, kTlsAlertIllegalParameter);
    670  client_->CheckErrorCode(SSL_ERROR_INCORRECT_SIGNATURE_ALGORITHM);
    671 }
    672 
    673 static void CheckSkeSigScheme(
    674    std::shared_ptr<TlsHandshakeRecorder> &capture_ske,
    675    uint16_t expected_scheme) {
    676  TlsParser parser(capture_ske->buffer());
    677  uint32_t tmp = 0;
    678  EXPECT_TRUE(parser.Read(&tmp, 1)) << " read curve_type";
    679  EXPECT_EQ(3U, tmp) << "curve type has to be 3";
    680  EXPECT_TRUE(parser.Skip(2)) << " read namedcurve";
    681  EXPECT_TRUE(parser.SkipVariable(1)) << " read public";
    682 
    683  EXPECT_TRUE(parser.Read(&tmp, 2)) << " read sig_scheme";
    684  EXPECT_EQ(expected_scheme, static_cast<uint16_t>(tmp));
    685 }
    686 
    687 TEST_P(TlsConnectTls12, ConnectSigAlgEnabledByPolicy) {
    688  EnsureTlsSetup();
    689  client_->DisableAllCiphers();
    690  client_->EnableCiphersByKeyExchange(ssl_kea_ecdh);
    691 
    692  const std::vector<SSLSignatureScheme> schemes = {ssl_sig_rsa_pkcs1_sha1,
    693                                                   ssl_sig_rsa_pkcs1_sha384};
    694 
    695  client_->SetSignatureSchemes(schemes.data(), schemes.size());
    696  server_->SetSignatureSchemes(schemes.data(), schemes.size());
    697  auto capture_ske = MakeTlsFilter<TlsHandshakeRecorder>(
    698      server_, kTlsHandshakeServerKeyExchange);
    699 
    700  StartConnect();
    701  client_->Handshake();  // Send ClientHello
    702 
    703  // Enable SHA-1 by policy.
    704  SECStatus rv = NSS_SetAlgorithmPolicy(SEC_OID_SHA1, NSS_USE_ALG_IN_SSL_KX, 0);
    705  ASSERT_EQ(SECSuccess, rv);
    706  rv = NSS_SetAlgorithmPolicy(SEC_OID_APPLY_SSL_POLICY, NSS_USE_POLICY_IN_SSL,
    707                              0);
    708  ASSERT_EQ(SECSuccess, rv);
    709 
    710  Handshake();  // Remainder of handshake
    711  // The server should now report that it is connected
    712  EXPECT_EQ(TlsAgent::STATE_CONNECTED, server_->state());
    713 
    714  CheckSkeSigScheme(capture_ske, ssl_sig_rsa_pkcs1_sha1);
    715 }
    716 
    717 TEST_P(TlsConnectTls12, ConnectSigAlgDisabledByPolicy) {
    718  EnsureTlsSetup();
    719  client_->DisableAllCiphers();
    720  client_->EnableCiphersByKeyExchange(ssl_kea_ecdh);
    721 
    722  const std::vector<SSLSignatureScheme> schemes = {ssl_sig_rsa_pkcs1_sha1,
    723                                                   ssl_sig_rsa_pkcs1_sha384};
    724 
    725  client_->SetSignatureSchemes(schemes.data(), schemes.size());
    726  server_->SetSignatureSchemes(schemes.data(), schemes.size());
    727  auto capture_ske = MakeTlsFilter<TlsHandshakeRecorder>(
    728      server_, kTlsHandshakeServerKeyExchange);
    729 
    730  StartConnect();
    731  client_->Handshake();  // Send ClientHello
    732 
    733  // Disable SHA-1 by policy.
    734  SECStatus rv = NSS_SetAlgorithmPolicy(SEC_OID_SHA1, 0, NSS_USE_ALG_IN_SSL_KX);
    735  ASSERT_EQ(SECSuccess, rv);
    736  rv = NSS_SetAlgorithmPolicy(SEC_OID_APPLY_SSL_POLICY, NSS_USE_POLICY_IN_SSL,
    737                              0);
    738  ASSERT_EQ(SECSuccess, rv);
    739 
    740  Handshake();  // Remainder of handshake
    741  // The server should now report that it is connected
    742  EXPECT_EQ(TlsAgent::STATE_CONNECTED, server_->state());
    743 
    744  CheckSkeSigScheme(capture_ske, ssl_sig_rsa_pkcs1_sha384);
    745 }
    746 
    747 INSTANTIATE_TEST_SUITE_P(KeyExchangeTest, TlsKeyExchangeTest,
    748                         ::testing::Combine(TlsConnectTestBase::kTlsVariantsAll,
    749                                            TlsConnectTestBase::kTlsV11Plus));
    750 
    751 #ifndef NSS_DISABLE_TLS_1_3
    752 INSTANTIATE_TEST_SUITE_P(KeyExchangeTest, TlsKeyExchangeTest13,
    753                         ::testing::Combine(TlsConnectTestBase::kTlsVariantsAll,
    754                                            TlsConnectTestBase::kTlsV13));
    755 #endif
    756 
    757 }  // namespace nss_test