ssl_ecdh_unittest.cc (28749B)
1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ 2 /* vim: set ts=2 et sw=2 tw=80: */ 3 /* This Source Code Form is subject to the terms of the Mozilla Public 4 * License, v. 2.0. If a copy of the MPL was not distributed with this file, 5 * You can obtain one at http://mozilla.org/MPL/2.0/. */ 6 7 #include <functional> 8 #include <memory> 9 #include "secerr.h" 10 #include "ssl.h" 11 #include "sslerr.h" 12 #include "sslproto.h" 13 14 extern "C" { 15 // This is not something that should make you happy. 16 #include "libssl_internals.h" 17 } 18 19 #include "gtest_utils.h" 20 #include "nss_scoped_ptrs.h" 21 #include "tls_connect.h" 22 #include "tls_filter.h" 23 #include "tls_parser.h" 24 25 namespace nss_test { 26 27 TEST_P(TlsConnectGenericPre13, ConnectEcdh) { 28 SetExpectedVersion(std::get<1>(GetParam())); 29 Reset(TlsAgent::kServerEcdhEcdsa); 30 DisableAllCiphers(); 31 EnableSomeEcdhCiphers(); 32 33 Connect(); 34 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_ecdh_ecdsa, 35 ssl_sig_none); 36 } 37 38 TEST_P(TlsConnectGenericPre13, ConnectEcdhWithoutDisablingSuites) { 39 SetExpectedVersion(std::get<1>(GetParam())); 40 Reset(TlsAgent::kServerEcdhEcdsa); 41 EnableSomeEcdhCiphers(); 42 43 Connect(); 44 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_ecdh_ecdsa, 45 ssl_sig_none); 46 } 47 48 TEST_P(TlsConnectGeneric, ConnectEcdhe) { 49 Connect(); 50 CheckKeys(); 51 } 52 53 // If we pick a 256-bit cipher suite and use a P-384 certificate, the server 54 // should choose P-384 for key exchange too. Only valid for TLS == 1.2 because 55 // we don't have 256-bit ciphers before then and 1.3 doesn't try to couple 56 // DHE size to symmetric size. 57 TEST_P(TlsConnectTls12, ConnectEcdheP384) { 58 Reset(TlsAgent::kServerEcdsa384); 59 ConnectWithCipherSuite(TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256); 60 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_ecdsa, 61 ssl_sig_ecdsa_secp256r1_sha256); 62 } 63 64 TEST_P(TlsConnectGeneric, ConnectEcdheP384Client) { 65 EnsureTlsSetup(); 66 const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1, 67 ssl_grp_ffdhe_2048}; 68 client_->ConfigNamedGroups(groups); 69 server_->ConfigNamedGroups(groups); 70 Connect(); 71 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign, 72 ssl_sig_rsa_pss_rsae_sha256); 73 } 74 75 // The bug https://bugzilla.mozilla.org/show_bug.cgi?id=1818487 updates the 76 // generation of transcript for DTLS1.3 77 // The following three tests are used to check the correctness of the 78 // transcript. 79 TEST_P(TlsConnectGeneric, 80 ClientOfferTls11_Tls13ServerNegotiateEachVersionOneByOne_HRR) { 81 EnsureTlsSetup(); 82 auto hrr_capture = MakeTlsFilter<TlsHandshakeRecorder>( 83 server_, kTlsHandshakeHelloRetryRequest); 84 const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1, 85 ssl_grp_ffdhe_2048}; 86 server_->ConfigNamedGroups(groups); 87 // DTLS does not support 1.0 88 if (variant_ == ssl_variant_datagram) { 89 client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1, 90 SSL_LIBRARY_VERSION_TLS_1_3); 91 } else { 92 client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_0, 93 SSL_LIBRARY_VERSION_TLS_1_3); 94 } 95 server_->SetVersionRange(version_, version_); 96 Connect(); 97 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign, 98 ssl_sig_rsa_pss_rsae_sha256); 99 100 EXPECT_EQ(version_ == SSL_LIBRARY_VERSION_TLS_1_3, 101 hrr_capture->buffer().len() != 0); 102 } 103 104 // This causes a HelloRetryRequest in TLS 1.3. Earlier versions don't care. 105 TEST_P(TlsConnectGeneric, ConnectEcdheP384Server) { 106 EnsureTlsSetup(); 107 auto hrr_capture = MakeTlsFilter<TlsHandshakeRecorder>( 108 server_, kTlsHandshakeHelloRetryRequest); 109 const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1}; 110 server_->ConfigNamedGroups(groups); 111 Connect(); 112 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign, 113 ssl_sig_rsa_pss_rsae_sha256); 114 EXPECT_EQ(version_ == SSL_LIBRARY_VERSION_TLS_1_3, 115 hrr_capture->buffer().len() != 0); 116 } 117 118 // This enables only P-256 on the client and disables it on the server. 119 // This test will fail when we add other groups that identify as ECDHE. 120 TEST_P(TlsConnectGeneric, ConnectEcdheGroupMismatch) { 121 EnsureTlsSetup(); 122 const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_secp256r1, 123 ssl_grp_ffdhe_2048}; 124 const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ffdhe_2048}; 125 client_->ConfigNamedGroups(client_groups); 126 server_->ConfigNamedGroups(server_groups); 127 128 Connect(); 129 CheckKeys(ssl_kea_dh, ssl_auth_rsa_sign); 130 } 131 132 TEST_P(TlsKeyExchangeTest, P384Priority) { 133 // P256, P384 and P521 are enabled. Both prefer P384. 134 const std::vector<SSLNamedGroup> groups = { 135 ssl_grp_ec_secp384r1, ssl_grp_ec_secp256r1, ssl_grp_ec_secp521r1}; 136 EnsureKeyShareSetup(); 137 ConfigNamedGroups(groups); 138 client_->DisableAllCiphers(); 139 client_->EnableCiphersByKeyExchange(ssl_kea_ecdh); 140 Connect(); 141 142 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign, 143 ssl_sig_rsa_pss_rsae_sha256); 144 145 std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp384r1}; 146 CheckKEXDetails(groups, shares); 147 } 148 149 TEST_P(TlsKeyExchangeTest, DuplicateGroupConfig) { 150 const std::vector<SSLNamedGroup> groups = { 151 ssl_grp_ec_secp384r1, ssl_grp_ec_secp384r1, ssl_grp_ec_secp384r1, 152 ssl_grp_ec_secp256r1, ssl_grp_ec_secp256r1}; 153 EnsureKeyShareSetup(); 154 ConfigNamedGroups(groups); 155 client_->DisableAllCiphers(); 156 client_->EnableCiphersByKeyExchange(ssl_kea_ecdh); 157 Connect(); 158 159 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign, 160 ssl_sig_rsa_pss_rsae_sha256); 161 162 std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp384r1}; 163 std::vector<SSLNamedGroup> expectedGroups = {ssl_grp_ec_secp384r1, 164 ssl_grp_ec_secp256r1}; 165 CheckKEXDetails(expectedGroups, shares); 166 } 167 168 TEST_P(TlsKeyExchangeTest, P384PriorityDHEnabled) { 169 // P256, P384, P521, and FFDHE2048 are enabled. Both prefer P384. 170 const std::vector<SSLNamedGroup> groups = { 171 ssl_grp_ec_secp384r1, ssl_grp_ffdhe_2048, ssl_grp_ec_secp256r1, 172 ssl_grp_ec_secp521r1}; 173 EnsureKeyShareSetup(); 174 ConfigNamedGroups(groups); 175 Connect(); 176 177 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign, 178 ssl_sig_rsa_pss_rsae_sha256); 179 180 if (version_ >= SSL_LIBRARY_VERSION_TLS_1_3) { 181 std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp384r1}; 182 CheckKEXDetails(groups, shares); 183 } else { 184 std::vector<SSLNamedGroup> oldtlsgroups = { 185 ssl_grp_ec_secp384r1, ssl_grp_ec_secp256r1, ssl_grp_ec_secp521r1}; 186 CheckKEXDetails(oldtlsgroups, std::vector<SSLNamedGroup>()); 187 } 188 } 189 190 TEST_P(TlsConnectGenericPre13, P384PriorityOnServer) { 191 EnsureTlsSetup(); 192 client_->DisableAllCiphers(); 193 client_->EnableCiphersByKeyExchange(ssl_kea_ecdh); 194 195 // The server prefers P384. It has to win. 196 const std::vector<SSLNamedGroup> server_groups = { 197 ssl_grp_ec_secp384r1, ssl_grp_ec_secp256r1, ssl_grp_ec_secp521r1}; 198 server_->ConfigNamedGroups(server_groups); 199 200 Connect(); 201 202 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign, 203 ssl_sig_rsa_pss_rsae_sha256); 204 } 205 206 TEST_P(TlsConnectGenericPre13, P384PriorityFromModelSocket) { 207 EnsureModelSockets(); 208 209 /* Both prefer P384, set on the model socket. */ 210 const std::vector<SSLNamedGroup> groups = { 211 ssl_grp_ec_secp384r1, ssl_grp_ec_secp256r1, ssl_grp_ec_secp521r1, 212 ssl_grp_ffdhe_2048}; 213 client_model_->ConfigNamedGroups(groups); 214 server_model_->ConfigNamedGroups(groups); 215 216 Connect(); 217 218 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign, 219 ssl_sig_rsa_pss_rsae_sha256); 220 } 221 222 class TlsKeyExchangeGroupCapture : public TlsHandshakeFilter { 223 public: 224 TlsKeyExchangeGroupCapture(const std::shared_ptr<TlsAgent> &a) 225 : TlsHandshakeFilter(a, {kTlsHandshakeServerKeyExchange}), 226 group_(ssl_grp_none) {} 227 228 SSLNamedGroup group() const { return group_; } 229 230 protected: 231 virtual PacketFilter::Action FilterHandshake(const HandshakeHeader &header, 232 const DataBuffer &input, 233 DataBuffer *output) { 234 uint32_t value = 0; 235 EXPECT_TRUE(input.Read(0, 1, &value)); 236 EXPECT_EQ(3U, value) << "curve type has to be 3"; 237 238 EXPECT_TRUE(input.Read(1, 2, &value)); 239 group_ = static_cast<SSLNamedGroup>(value); 240 241 return KEEP; 242 } 243 244 private: 245 SSLNamedGroup group_; 246 }; 247 248 // If we strip the client's supported groups extension, the server should assume 249 // P-256 is supported by the client (<= 1.2 only). 250 TEST_P(TlsConnectGenericPre13, DropSupportedGroupExtensionP256) { 251 EnsureTlsSetup(); 252 MakeTlsFilter<TlsExtensionDropper>(client_, ssl_supported_groups_xtn); 253 auto group_capture = MakeTlsFilter<TlsKeyExchangeGroupCapture>(server_); 254 255 ConnectExpectAlert(server_, kTlsAlertDecryptError); 256 client_->CheckErrorCode(SSL_ERROR_DECRYPT_ERROR_ALERT); 257 server_->CheckErrorCode(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE); 258 259 EXPECT_EQ(ssl_grp_ec_secp256r1, group_capture->group()); 260 } 261 262 // Supported groups is mandatory in TLS 1.3. 263 TEST_P(TlsConnectTls13, DropSupportedGroupExtension) { 264 EnsureTlsSetup(); 265 MakeTlsFilter<TlsExtensionDropper>(client_, ssl_supported_groups_xtn); 266 ConnectExpectAlert(server_, kTlsAlertMissingExtension); 267 client_->CheckErrorCode(SSL_ERROR_MISSING_EXTENSION_ALERT); 268 server_->CheckErrorCode(SSL_ERROR_MISSING_SUPPORTED_GROUPS_EXTENSION); 269 } 270 271 // If we only have a lame group, we fall back to static RSA. 272 TEST_P(TlsConnectGenericPre13, UseLameGroup) { 273 const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp192r1}; 274 client_->ConfigNamedGroups(groups); 275 server_->ConfigNamedGroups(groups); 276 Connect(); 277 CheckKeys(ssl_kea_rsa, ssl_grp_none, ssl_auth_rsa_decrypt, ssl_sig_none); 278 } 279 280 // In TLS 1.3, we can't generate the ClientHello. 281 TEST_P(TlsConnectTls13, UseLameGroup) { 282 const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_sect283k1}; 283 client_->ConfigNamedGroups(groups); 284 server_->ConfigNamedGroups(groups); 285 client_->StartConnect(); 286 client_->Handshake(); 287 client_->CheckErrorCode(SSL_ERROR_NO_CIPHERS_SUPPORTED); 288 } 289 290 TEST_P(TlsConnectStreamPre13, ConfiguredGroupsRenegotiate) { 291 EnsureTlsSetup(); 292 client_->DisableAllCiphers(); 293 client_->EnableCiphersByKeyExchange(ssl_kea_ecdh); 294 295 const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_secp256r1}; 296 const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_secp256r1, 297 ssl_grp_ec_secp256r1}; 298 client_->ConfigNamedGroups(client_groups); 299 server_->ConfigNamedGroups(server_groups); 300 301 Connect(); 302 303 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign, 304 ssl_sig_rsa_pss_rsae_sha256); 305 CheckConnected(); 306 307 // The renegotiation has to use the same preferences as the original session. 308 server_->PrepareForRenegotiate(); 309 client_->StartRenegotiate(); 310 Handshake(); 311 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign, 312 ssl_sig_rsa_pss_rsae_sha256); 313 } 314 315 TEST_P(TlsKeyExchangeTest, Curve25519) { 316 Reset(TlsAgent::kServerEcdsa256); 317 const std::vector<SSLNamedGroup> groups = { 318 ssl_grp_ec_curve25519, ssl_grp_ec_secp256r1, ssl_grp_ec_secp521r1}; 319 EnsureKeyShareSetup(); 320 ConfigNamedGroups(groups); 321 Connect(); 322 323 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_ecdsa, 324 ssl_sig_ecdsa_secp256r1_sha256); 325 const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519}; 326 CheckKEXDetails(groups, shares); 327 } 328 329 TEST_P(TlsConnectGenericPre13, GroupPreferenceServerPriority) { 330 EnsureTlsSetup(); 331 client_->DisableAllCiphers(); 332 client_->EnableCiphersByKeyExchange(ssl_kea_ecdh); 333 334 // The client prefers P256 while the server prefers 25519. 335 // The server's preference has to win. 336 const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_secp256r1, 337 ssl_grp_ec_curve25519}; 338 const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_curve25519, 339 ssl_grp_ec_secp256r1}; 340 client_->ConfigNamedGroups(client_groups); 341 server_->ConfigNamedGroups(server_groups); 342 343 Connect(); 344 345 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_rsa_sign, 346 ssl_sig_rsa_pss_rsae_sha256); 347 } 348 349 #ifndef NSS_DISABLE_TLS_1_3 350 TEST_P(TlsKeyExchangeTest13, Curve25519P256EqualPriorityClient13) { 351 EnsureKeyShareSetup(); 352 353 // The client sends a P256 key share while the server prefers 25519. 354 // We have to accept P256 without retry. 355 const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_secp256r1, 356 ssl_grp_ec_curve25519}; 357 const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_curve25519, 358 ssl_grp_ec_secp256r1}; 359 client_->ConfigNamedGroups(client_groups); 360 server_->ConfigNamedGroups(server_groups); 361 362 Connect(); 363 364 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign, 365 ssl_sig_rsa_pss_rsae_sha256); 366 const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp256r1}; 367 CheckKEXDetails(client_groups, shares); 368 } 369 370 TEST_P(TlsKeyExchangeTest13, Curve25519P256EqualPriorityServer13) { 371 EnsureKeyShareSetup(); 372 373 // The client sends a 25519 key share while the server prefers P256. 374 // We have to accept 25519 without retry. 375 const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_curve25519, 376 ssl_grp_ec_secp256r1}; 377 const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_secp256r1, 378 ssl_grp_ec_curve25519}; 379 client_->ConfigNamedGroups(client_groups); 380 server_->ConfigNamedGroups(server_groups); 381 382 Connect(); 383 384 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_rsa_sign, 385 ssl_sig_rsa_pss_rsae_sha256); 386 const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519}; 387 CheckKEXDetails(client_groups, shares); 388 } 389 390 TEST_P(TlsKeyExchangeTest13, EqualPriorityTestRetryECServer13) { 391 EnsureKeyShareSetup(); 392 393 // The client sends a 25519 key share while the server prefers P256. 394 // The server prefers P-384 over x25519, so it must not consider P-256 and 395 // x25519 to be equivalent. It will therefore request a P-256 share 396 // with a HelloRetryRequest. 397 const std::vector<SSLNamedGroup> client_groups = { 398 ssl_grp_ec_curve25519, ssl_grp_ec_secp256r1, ssl_grp_ec_secp384r1}; 399 const std::vector<SSLNamedGroup> server_groups = { 400 ssl_grp_ec_secp256r1, ssl_grp_ec_secp384r1, ssl_grp_ec_curve25519}; 401 client_->ConfigNamedGroups(client_groups); 402 server_->ConfigNamedGroups(server_groups); 403 404 Connect(); 405 406 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign, 407 ssl_sig_rsa_pss_rsae_sha256); 408 const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519}; 409 CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1); 410 } 411 412 TEST_P(TlsKeyExchangeTest13, NotEqualPriorityWithIntermediateGroup13) { 413 EnsureKeyShareSetup(); 414 415 // The client sends a 25519 key share while the server prefers P256. 416 // The server prefers ffdhe_2048 over x25519, so it must not consider the 417 // P-256 and x25519 to be equivalent. It will therefore request a P-256 share 418 // with a HelloRetryRequest. 419 const std::vector<SSLNamedGroup> client_groups = { 420 ssl_grp_ec_curve25519, ssl_grp_ec_secp256r1, ssl_grp_ffdhe_2048}; 421 const std::vector<SSLNamedGroup> server_groups = { 422 ssl_grp_ec_secp256r1, ssl_grp_ffdhe_2048, ssl_grp_ec_curve25519}; 423 client_->ConfigNamedGroups(client_groups); 424 server_->ConfigNamedGroups(server_groups); 425 426 Connect(); 427 428 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign, 429 ssl_sig_rsa_pss_rsae_sha256); 430 const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519}; 431 CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1); 432 } 433 434 TEST_P(TlsKeyExchangeTest13, 435 NotEqualPriorityWithUnsupportedFFIntermediateGroup13) { 436 EnsureKeyShareSetup(); 437 438 // As in the previous test, the server prefers ffdhe_2048. Thus, even though 439 // the client doesn't support this group, the server must not regard x25519 as 440 // equivalent to P-256. 441 const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_curve25519, 442 ssl_grp_ec_secp256r1}; 443 const std::vector<SSLNamedGroup> server_groups = { 444 ssl_grp_ec_secp256r1, ssl_grp_ffdhe_2048, ssl_grp_ec_curve25519}; 445 client_->ConfigNamedGroups(client_groups); 446 server_->ConfigNamedGroups(server_groups); 447 448 Connect(); 449 450 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign, 451 ssl_sig_rsa_pss_rsae_sha256); 452 const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519}; 453 CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1); 454 } 455 456 TEST_P(TlsKeyExchangeTest13, 457 NotEqualPriorityWithUnsupportedECIntermediateGroup13) { 458 EnsureKeyShareSetup(); 459 460 // As in the previous test, the server prefers P-384. Thus, even though 461 // the client doesn't support this group, the server must not regard x25519 as 462 // equivalent to P-256. The server sends a HelloRetryRequest. 463 const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_curve25519, 464 ssl_grp_ec_secp256r1}; 465 const std::vector<SSLNamedGroup> server_groups = { 466 ssl_grp_ec_secp256r1, ssl_grp_ec_secp384r1, ssl_grp_ec_curve25519}; 467 client_->ConfigNamedGroups(client_groups); 468 server_->ConfigNamedGroups(server_groups); 469 470 Connect(); 471 472 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign, 473 ssl_sig_rsa_pss_rsae_sha256); 474 const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519}; 475 CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1); 476 } 477 478 TEST_P(TlsKeyExchangeTest13, EqualPriority13) { 479 EnsureKeyShareSetup(); 480 481 // The client sends a 25519 key share while the server prefers P256. 482 // We have to accept 25519 without retry because it's considered equivalent to 483 // P256 by the server. 484 const std::vector<SSLNamedGroup> client_groups = { 485 ssl_grp_ec_curve25519, ssl_grp_ffdhe_2048, ssl_grp_ec_secp256r1}; 486 const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_secp256r1, 487 ssl_grp_ec_curve25519}; 488 client_->ConfigNamedGroups(client_groups); 489 server_->ConfigNamedGroups(server_groups); 490 491 Connect(); 492 493 CheckKeys(ssl_kea_ecdh, ssl_auth_rsa_sign); 494 const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519}; 495 CheckKEXDetails(client_groups, shares); 496 } 497 #endif 498 499 TEST_P(TlsConnectGeneric, P256ClientAndCurve25519Server) { 500 EnsureTlsSetup(); 501 client_->DisableAllCiphers(); 502 client_->EnableCiphersByKeyExchange(ssl_kea_ecdh); 503 504 // The client sends a P256 key share while the server prefers 25519. 505 const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_secp256r1}; 506 const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_curve25519}; 507 508 client_->ConfigNamedGroups(client_groups); 509 server_->ConfigNamedGroups(server_groups); 510 511 ConnectExpectAlert(server_, kTlsAlertHandshakeFailure); 512 client_->CheckErrorCode(SSL_ERROR_NO_CYPHER_OVERLAP); 513 server_->CheckErrorCode(SSL_ERROR_NO_CYPHER_OVERLAP); 514 } 515 516 TEST_P(TlsKeyExchangeTest13, MultipleClientShares) { 517 EnsureKeyShareSetup(); 518 519 // The client sends 25519 and P256 key shares. The server prefers P256, 520 // which must be chosen here. 521 const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ec_curve25519, 522 ssl_grp_ec_secp256r1}; 523 const std::vector<SSLNamedGroup> server_groups = {ssl_grp_ec_secp256r1, 524 ssl_grp_ec_curve25519}; 525 client_->ConfigNamedGroups(client_groups); 526 server_->ConfigNamedGroups(server_groups); 527 528 // Generate a key share on the client for both curves. 529 EXPECT_EQ(SECSuccess, SSL_SendAdditionalKeyShares(client_->ssl_fd(), 1)); 530 531 Connect(); 532 533 // The server would accept 25519 but its preferred group (P256) has to win. 534 CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign, 535 ssl_sig_rsa_pss_rsae_sha256); 536 const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519, 537 ssl_grp_ec_secp256r1}; 538 CheckKEXDetails(client_groups, shares); 539 } 540 541 // Replace the point in the client key exchange message with an empty one 542 class ECCClientKEXFilter : public TlsHandshakeFilter { 543 public: 544 ECCClientKEXFilter(const std::shared_ptr<TlsAgent> &client) 545 : TlsHandshakeFilter(client, {kTlsHandshakeClientKeyExchange}) {} 546 547 protected: 548 virtual PacketFilter::Action FilterHandshake(const HandshakeHeader &header, 549 const DataBuffer &input, 550 DataBuffer *output) { 551 // Replace the client key exchange message with an empty point 552 output->Allocate(1); 553 output->Write(0, 0U, 1); // set point length 0 554 return CHANGE; 555 } 556 }; 557 558 // Replace the point in the server key exchange message with an empty one 559 class ECCServerKEXFilter : public TlsHandshakeFilter { 560 public: 561 ECCServerKEXFilter(const std::shared_ptr<TlsAgent> &server) 562 : TlsHandshakeFilter(server, {kTlsHandshakeServerKeyExchange}) {} 563 564 protected: 565 virtual PacketFilter::Action FilterHandshake(const HandshakeHeader &header, 566 const DataBuffer &input, 567 DataBuffer *output) { 568 // Replace the server key exchange message with an empty point 569 output->Allocate(4); 570 output->Write(0, 3U, 1); // named curve 571 uint32_t curve = 0; 572 EXPECT_TRUE(input.Read(1, 2, &curve)); // get curve id 573 output->Write(1, curve, 2); // write curve id 574 output->Write(3, 0U, 1); // point length 0 575 return CHANGE; 576 } 577 }; 578 579 TEST_P(TlsConnectGenericPre13, ConnectECDHEmptyServerPoint) { 580 MakeTlsFilter<ECCServerKEXFilter>(server_); 581 ConnectExpectAlert(client_, kTlsAlertIllegalParameter); 582 client_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH); 583 } 584 585 TEST_P(TlsConnectGenericPre13, ConnectECDHEmptyClientPoint) { 586 MakeTlsFilter<ECCClientKEXFilter>(client_); 587 ConnectExpectAlert(server_, kTlsAlertIllegalParameter); 588 server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_KEY_EXCH); 589 } 590 591 // Damage ECParams/ECPoint of a SKE. 592 class ECCServerKEXDamager : public TlsHandshakeFilter { 593 public: 594 ECCServerKEXDamager(const std::shared_ptr<TlsAgent> &server, ECType ec_type, 595 SSLNamedGroup named_curve) 596 : TlsHandshakeFilter(server, {kTlsHandshakeServerKeyExchange}), 597 ec_type_(ec_type), 598 named_curve_(named_curve) {} 599 600 protected: 601 virtual PacketFilter::Action FilterHandshake(const HandshakeHeader &header, 602 const DataBuffer &input, 603 DataBuffer *output) { 604 size_t offset = 0; 605 output->Allocate(5); 606 offset = output->Write(offset, ec_type_, 1); 607 offset = output->Write(offset, named_curve_, 2); 608 // Write a point with fmt != EC_POINT_FORM_UNCOMPRESSED. 609 offset = output->Write(offset, 1U, 1); 610 (void)output->Write(offset, 0x02, 1); // EC_POINT_FORM_COMPRESSED_Y0 611 return CHANGE; 612 } 613 614 private: 615 ECType ec_type_; 616 SSLNamedGroup named_curve_; 617 }; 618 619 TEST_P(TlsConnectGenericPre13, ConnectUnsupportedCurveType) { 620 EnsureTlsSetup(); 621 client_->DisableAllCiphers(); 622 client_->EnableCiphersByKeyExchange(ssl_kea_ecdh); 623 624 MakeTlsFilter<ECCServerKEXDamager>(server_, ec_type_explicitPrime, 625 ssl_grp_none); 626 ConnectExpectAlert(client_, kTlsAlertHandshakeFailure); 627 client_->CheckErrorCode(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE); 628 } 629 630 TEST_P(TlsConnectGenericPre13, ConnectUnsupportedCurve) { 631 EnsureTlsSetup(); 632 client_->DisableAllCiphers(); 633 client_->EnableCiphersByKeyExchange(ssl_kea_ecdh); 634 635 MakeTlsFilter<ECCServerKEXDamager>(server_, ec_type_named, 636 ssl_grp_ffdhe_2048); 637 ConnectExpectAlert(client_, kTlsAlertHandshakeFailure); 638 client_->CheckErrorCode(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE); 639 } 640 641 TEST_P(TlsConnectGenericPre13, ConnectUnsupportedPointFormat) { 642 EnsureTlsSetup(); 643 client_->DisableAllCiphers(); 644 client_->EnableCiphersByKeyExchange(ssl_kea_ecdh); 645 646 MakeTlsFilter<ECCServerKEXDamager>(server_, ec_type_named, 647 ssl_grp_ec_secp256r1); 648 ConnectExpectAlert(client_, kTlsAlertHandshakeFailure); 649 client_->CheckErrorCode(SEC_ERROR_UNSUPPORTED_EC_POINT_FORM); 650 } 651 652 TEST_P(TlsConnectTls12, ConnectUnsupportedSigAlg) { 653 EnsureTlsSetup(); 654 client_->DisableAllCiphers(); 655 client_->EnableCiphersByKeyExchange(ssl_kea_ecdh); 656 657 MakeTlsFilter<ECCServerKEXSigAlgReplacer>(server_, ssl_sig_none); 658 ConnectExpectAlert(client_, kTlsAlertIllegalParameter); 659 client_->CheckErrorCode(SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM); 660 } 661 662 TEST_P(TlsConnectTls12, ConnectIncorrectSigAlg) { 663 EnsureTlsSetup(); 664 client_->DisableAllCiphers(); 665 client_->EnableCiphersByKeyExchange(ssl_kea_ecdh); 666 667 MakeTlsFilter<ECCServerKEXSigAlgReplacer>(server_, 668 ssl_sig_ecdsa_secp256r1_sha256); 669 ConnectExpectAlert(client_, kTlsAlertIllegalParameter); 670 client_->CheckErrorCode(SSL_ERROR_INCORRECT_SIGNATURE_ALGORITHM); 671 } 672 673 static void CheckSkeSigScheme( 674 std::shared_ptr<TlsHandshakeRecorder> &capture_ske, 675 uint16_t expected_scheme) { 676 TlsParser parser(capture_ske->buffer()); 677 uint32_t tmp = 0; 678 EXPECT_TRUE(parser.Read(&tmp, 1)) << " read curve_type"; 679 EXPECT_EQ(3U, tmp) << "curve type has to be 3"; 680 EXPECT_TRUE(parser.Skip(2)) << " read namedcurve"; 681 EXPECT_TRUE(parser.SkipVariable(1)) << " read public"; 682 683 EXPECT_TRUE(parser.Read(&tmp, 2)) << " read sig_scheme"; 684 EXPECT_EQ(expected_scheme, static_cast<uint16_t>(tmp)); 685 } 686 687 TEST_P(TlsConnectTls12, ConnectSigAlgEnabledByPolicy) { 688 EnsureTlsSetup(); 689 client_->DisableAllCiphers(); 690 client_->EnableCiphersByKeyExchange(ssl_kea_ecdh); 691 692 const std::vector<SSLSignatureScheme> schemes = {ssl_sig_rsa_pkcs1_sha1, 693 ssl_sig_rsa_pkcs1_sha384}; 694 695 client_->SetSignatureSchemes(schemes.data(), schemes.size()); 696 server_->SetSignatureSchemes(schemes.data(), schemes.size()); 697 auto capture_ske = MakeTlsFilter<TlsHandshakeRecorder>( 698 server_, kTlsHandshakeServerKeyExchange); 699 700 StartConnect(); 701 client_->Handshake(); // Send ClientHello 702 703 // Enable SHA-1 by policy. 704 SECStatus rv = NSS_SetAlgorithmPolicy(SEC_OID_SHA1, NSS_USE_ALG_IN_SSL_KX, 0); 705 ASSERT_EQ(SECSuccess, rv); 706 rv = NSS_SetAlgorithmPolicy(SEC_OID_APPLY_SSL_POLICY, NSS_USE_POLICY_IN_SSL, 707 0); 708 ASSERT_EQ(SECSuccess, rv); 709 710 Handshake(); // Remainder of handshake 711 // The server should now report that it is connected 712 EXPECT_EQ(TlsAgent::STATE_CONNECTED, server_->state()); 713 714 CheckSkeSigScheme(capture_ske, ssl_sig_rsa_pkcs1_sha1); 715 } 716 717 TEST_P(TlsConnectTls12, ConnectSigAlgDisabledByPolicy) { 718 EnsureTlsSetup(); 719 client_->DisableAllCiphers(); 720 client_->EnableCiphersByKeyExchange(ssl_kea_ecdh); 721 722 const std::vector<SSLSignatureScheme> schemes = {ssl_sig_rsa_pkcs1_sha1, 723 ssl_sig_rsa_pkcs1_sha384}; 724 725 client_->SetSignatureSchemes(schemes.data(), schemes.size()); 726 server_->SetSignatureSchemes(schemes.data(), schemes.size()); 727 auto capture_ske = MakeTlsFilter<TlsHandshakeRecorder>( 728 server_, kTlsHandshakeServerKeyExchange); 729 730 StartConnect(); 731 client_->Handshake(); // Send ClientHello 732 733 // Disable SHA-1 by policy. 734 SECStatus rv = NSS_SetAlgorithmPolicy(SEC_OID_SHA1, 0, NSS_USE_ALG_IN_SSL_KX); 735 ASSERT_EQ(SECSuccess, rv); 736 rv = NSS_SetAlgorithmPolicy(SEC_OID_APPLY_SSL_POLICY, NSS_USE_POLICY_IN_SSL, 737 0); 738 ASSERT_EQ(SECSuccess, rv); 739 740 Handshake(); // Remainder of handshake 741 // The server should now report that it is connected 742 EXPECT_EQ(TlsAgent::STATE_CONNECTED, server_->state()); 743 744 CheckSkeSigScheme(capture_ske, ssl_sig_rsa_pkcs1_sha384); 745 } 746 747 INSTANTIATE_TEST_SUITE_P(KeyExchangeTest, TlsKeyExchangeTest, 748 ::testing::Combine(TlsConnectTestBase::kTlsVariantsAll, 749 TlsConnectTestBase::kTlsV11Plus)); 750 751 #ifndef NSS_DISABLE_TLS_1_3 752 INSTANTIATE_TEST_SUITE_P(KeyExchangeTest, TlsKeyExchangeTest13, 753 ::testing::Combine(TlsConnectTestBase::kTlsVariantsAll, 754 TlsConnectTestBase::kTlsV13)); 755 #endif 756 757 } // namespace nss_test