From 74394a5c393ce4bff11669b7029d96d01792806f Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Tue, 8 Mar 2022 06:50:12 -0500 Subject: [PATCH 01/12] Add a group_list argument to mocked ssl tests This will be used to force a group list in certain tests Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_ssl.function | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 1a31573624..83b32a568c 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -892,7 +892,8 @@ exit: int mbedtls_endpoint_init( mbedtls_endpoint *ep, int endpoint_type, int pk_alg, mbedtls_test_message_socket_context *dtls_context, mbedtls_test_message_queue *input_queue, - mbedtls_test_message_queue *output_queue ) + mbedtls_test_message_queue *output_queue, + uint16_t* group_list ) { int ret = -1; uintptr_t user_data_n; @@ -965,6 +966,9 @@ int mbedtls_endpoint_init( mbedtls_endpoint *ep, int endpoint_type, int pk_alg, MBEDTLS_SSL_PRESET_DEFAULT ); TEST_ASSERT( ret == 0 ); + if( group_list != NULL ) + mbedtls_ssl_conf_groups( &(ep->conf), group_list ); + ret = mbedtls_ssl_setup( &( ep->ssl ), &( ep->conf ) ); TEST_ASSERT( ret == 0 ); @@ -1936,7 +1940,7 @@ void perform_handshake( handshake_test_options* options ) TEST_ASSERT( mbedtls_endpoint_init( &client, MBEDTLS_SSL_IS_CLIENT, options->pk_alg, &client_context, &client_queue, - &server_queue ) == 0 ); + &server_queue, NULL ) == 0 ); #if defined(MBEDTLS_TIMING_C) mbedtls_ssl_set_timer_cb( &client.ssl, &timer_client, mbedtls_timing_set_delay, @@ -1947,7 +1951,7 @@ void perform_handshake( handshake_test_options* options ) { TEST_ASSERT( mbedtls_endpoint_init( &client, MBEDTLS_SSL_IS_CLIENT, options->pk_alg, NULL, NULL, - NULL ) == 0 ); + NULL, NULL ) == 0 ); } if( options->client_min_version != TEST_SSL_MINOR_VERSION_NONE ) @@ -1982,7 +1986,7 @@ void perform_handshake( handshake_test_options* options ) TEST_ASSERT( mbedtls_endpoint_init( &server, MBEDTLS_SSL_IS_SERVER, options->pk_alg, &server_context, &server_queue, - &client_queue) == 0 ); + &client_queue, NULL ) == 0 ); #if defined(MBEDTLS_TIMING_C) mbedtls_ssl_set_timer_cb( &server.ssl, &timer_server, mbedtls_timing_set_delay, @@ -1992,7 +1996,8 @@ void perform_handshake( handshake_test_options* options ) else { TEST_ASSERT( mbedtls_endpoint_init( &server, MBEDTLS_SSL_IS_SERVER, - options->pk_alg, NULL, NULL, NULL ) == 0 ); + options->pk_alg, NULL, NULL, + NULL, NULL ) == 0 ); } mbedtls_ssl_conf_authmode( &server.conf, options->srv_auth_mode ); @@ -4847,14 +4852,14 @@ void mbedtls_endpoint_sanity( int endpoint_type ) int ret = -1; ret = mbedtls_endpoint_init( NULL, endpoint_type, MBEDTLS_PK_RSA, - NULL, NULL, NULL ); + NULL, NULL, NULL, NULL ); TEST_ASSERT( MBEDTLS_ERR_SSL_BAD_INPUT_DATA == ret ); ret = mbedtls_endpoint_certificate_init( NULL, MBEDTLS_PK_RSA ); TEST_ASSERT( MBEDTLS_ERR_SSL_BAD_INPUT_DATA == ret ); ret = mbedtls_endpoint_init( &ep, endpoint_type, MBEDTLS_PK_RSA, - NULL, NULL, NULL ); + NULL, NULL, NULL, NULL ); TEST_ASSERT( ret == 0 ); exit: @@ -4870,13 +4875,13 @@ void move_handshake_to_state(int endpoint_type, int state, int need_pass) int ret = -1; ret = mbedtls_endpoint_init( &base_ep, endpoint_type, MBEDTLS_PK_RSA, - NULL, NULL, NULL ); + NULL, NULL, NULL, NULL ); TEST_ASSERT( ret == 0 ); ret = mbedtls_endpoint_init( &second_ep, ( endpoint_type == MBEDTLS_SSL_IS_SERVER ) ? MBEDTLS_SSL_IS_CLIENT : MBEDTLS_SSL_IS_SERVER, - MBEDTLS_PK_RSA, NULL, NULL, NULL ); + MBEDTLS_PK_RSA, NULL, NULL, NULL, NULL ); TEST_ASSERT( ret == 0 ); ret = mbedtls_mock_socket_connect( &(base_ep.socket), From b3427823bd9d164505df3ed4ffed84ecf696e992 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Tue, 8 Mar 2022 06:55:42 -0500 Subject: [PATCH 02/12] Test failing raw_key_agreement in ssl mock tests Force a bitflip in server key to make the raw key agreement fail, and then verify that no key slots are left open at the end. Use a Weierstrass curve to have a high chance of failure upon encountering such bitflip. Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_ssl.data | 3 ++ tests/suites/test_suite_ssl.function | 75 ++++++++++++++++++++++++++++ 2 files changed, 78 insertions(+) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index b9cad6acbd..715e653e92 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3360,3 +3360,6 @@ timing_final_delay_accessor Sanity test cid functions cid_sanity: + +Raw key agreement fail +raw_key_agreement_fail: diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 83b32a568c..871c838064 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5595,3 +5595,78 @@ void cid_sanity( ) /* END_CASE */ + +/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO */ +void raw_key_agreement_fail( ) +{ + enum { BUFFSIZE = 17000 }; + mbedtls_endpoint client, server; + mbedtls_psa_stats_t stats; + +#if defined(MBEDTLS_TIMING_C) + mbedtls_timing_delay_context timer_client, timer_server; +#endif + uint16_t iana_tls_group_list[] = { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1 }; + + mbedtls_test_message_queue server_queue, client_queue; + mbedtls_test_message_socket_context server_context, client_context; + + mbedtls_message_socket_init( &server_context ); + mbedtls_message_socket_init( &client_context ); + + USE_PSA_INIT( ); + + /* Client side, force SECP256R1 to make one key bitflip fail + * the raw key agreement. Flipping one bit with a Weierstrass + * curve (as opposed to a Montgomery curve) has a high chance of + * making it invalid. */ + TEST_ASSERT( mbedtls_endpoint_init( &client, MBEDTLS_SSL_IS_CLIENT, + MBEDTLS_PK_RSA, &client_context, + &client_queue, + &server_queue, iana_tls_group_list ) == 0 ); +#if defined(MBEDTLS_TIMING_C) + mbedtls_ssl_set_timer_cb( &client.ssl, &timer_client, + mbedtls_timing_set_delay, + mbedtls_timing_get_delay ); +#endif + + /* Server side */ + TEST_ASSERT( mbedtls_endpoint_init( &server, MBEDTLS_SSL_IS_SERVER, + MBEDTLS_PK_RSA, &server_context, + &server_queue, + &client_queue, NULL ) == 0 ); +#if defined(MBEDTLS_TIMING_C) + mbedtls_ssl_set_timer_cb( &server.ssl, &timer_server, + mbedtls_timing_set_delay, + mbedtls_timing_get_delay ); +#endif + + TEST_ASSERT( mbedtls_mock_socket_connect( &(client.socket), + &(server.socket), + BUFFSIZE ) == 0 ); + + TEST_ASSERT( mbedtls_move_handshake_to_state( &(client.ssl), + &(server.ssl), + MBEDTLS_SSL_CLIENT_KEY_EXCHANGE ) + == 0 ); + + /* Force a simulated bitflip in the server key. to make the + * raw key agreement in ssl_write_client_key_exchange fail. */ + (client.ssl).handshake->ecdh_psa_peerkey[5] ^= 0x02; + + TEST_ASSERT( mbedtls_move_handshake_to_state( &(client.ssl), + &(server.ssl), + MBEDTLS_SSL_HANDSHAKE_OVER ) + != 0 ); + + mbedtls_psa_get_stats( &stats ); + + /* Make sure that the key slot is destroyed properly in case of failure. */ + TEST_ASSERT( stats.empty_slots == MBEDTLS_PSA_KEY_SLOT_COUNT ); + +exit: + mbedtls_endpoint_free( &client, &client_context ); + mbedtls_endpoint_free( &server, &server_context ); + USE_PSA_DONE( ); +} +/* END_CASE */ From 65ded569e0ea2a41c59e0b561ff050137ff32454 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Tue, 8 Mar 2022 11:46:51 -0500 Subject: [PATCH 03/12] Update raw key agreement test dependencies Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_ssl.function | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 871c838064..e114caeddc 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5594,9 +5594,7 @@ void cid_sanity( ) } /* END_CASE */ - - -/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO */ +/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ void raw_key_agreement_fail( ) { enum { BUFFSIZE = 17000 }; From cc28e9a25248aaec60308d3051939c647b0db5ad Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Tue, 8 Mar 2022 18:36:35 -0500 Subject: [PATCH 04/12] Tests: add missing group termination Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_ssl.function | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index e114caeddc..b4a615ce15 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5604,7 +5604,8 @@ void raw_key_agreement_fail( ) #if defined(MBEDTLS_TIMING_C) mbedtls_timing_delay_context timer_client, timer_server; #endif - uint16_t iana_tls_group_list[] = { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1 }; + uint16_t iana_tls_group_list[] = { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1, + MBEDTLS_SSL_IANA_TLS_GROUP_NONE }; mbedtls_test_message_queue server_queue, client_queue; mbedtls_test_message_socket_context server_context, client_context; From 41b7e66e61f00b33a8fc7a234b8bea0cda533450 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Wed, 9 Mar 2022 05:10:38 -0500 Subject: [PATCH 05/12] Tests: add missing requirements for the raw key agreement test SECP384R1 is needed for the default loaded certificate. Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_ssl.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index b4a615ce15..e0b6d0d408 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5594,7 +5594,7 @@ void cid_sanity( ) } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ +/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_ENTROPY_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_CTR_DRBG_C:MBEDTLS_ECP_C */ void raw_key_agreement_fail( ) { enum { BUFFSIZE = 17000 }; From 39d88d491855f9b7bd4bb60928bf82ce402419d4 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Thu, 31 Mar 2022 06:30:54 -0400 Subject: [PATCH 06/12] Change the number of expected free key slots TLS code now uses PSA to generate an ECDH private key. Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_ssl.function | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index e0b6d0d408..2ce2443102 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5600,6 +5600,7 @@ void raw_key_agreement_fail( ) enum { BUFFSIZE = 17000 }; mbedtls_endpoint client, server; mbedtls_psa_stats_t stats; + size_t free_slots_before = -1; #if defined(MBEDTLS_TIMING_C) mbedtls_timing_delay_context timer_client, timer_server; @@ -5649,6 +5650,11 @@ void raw_key_agreement_fail( ) MBEDTLS_SSL_CLIENT_KEY_EXCHANGE ) == 0 ); + mbedtls_psa_get_stats( &stats ); + /* Save the number of slots in use up to this point. + * With PSA, one can be used for the ECDH private key. */ + free_slots_before = stats.empty_slots; + /* Force a simulated bitflip in the server key. to make the * raw key agreement in ssl_write_client_key_exchange fail. */ (client.ssl).handshake->ecdh_psa_peerkey[5] ^= 0x02; @@ -5661,11 +5667,15 @@ void raw_key_agreement_fail( ) mbedtls_psa_get_stats( &stats ); /* Make sure that the key slot is destroyed properly in case of failure. */ - TEST_ASSERT( stats.empty_slots == MBEDTLS_PSA_KEY_SLOT_COUNT ); + TEST_ASSERT( free_slots_before == stats.empty_slots ); exit: mbedtls_endpoint_free( &client, &client_context ); mbedtls_endpoint_free( &server, &server_context ); + + mbedtls_psa_get_stats( &stats ); + TEST_ASSERT( stats.empty_slots == MBEDTLS_PSA_KEY_SLOT_COUNT ); + USE_PSA_DONE( ); } /* END_CASE */ From cb33bc5d0b8e33d3db06fa27816062c93a871c1c Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Thu, 31 Mar 2022 07:17:18 -0400 Subject: [PATCH 07/12] Change the bit to flip to guarantee failure For weistrass curves the pair is encoded as 0x04 || x || y. Flipping one of the bits in the first byte should be a sure failure. Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_ssl.function | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 2ce2443102..c84427cb93 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5654,10 +5654,10 @@ void raw_key_agreement_fail( ) /* Save the number of slots in use up to this point. * With PSA, one can be used for the ECDH private key. */ free_slots_before = stats.empty_slots; - + /* Force a simulated bitflip in the server key. to make the * raw key agreement in ssl_write_client_key_exchange fail. */ - (client.ssl).handshake->ecdh_psa_peerkey[5] ^= 0x02; + (client.ssl).handshake->ecdh_psa_peerkey[0] ^= 0x02; TEST_ASSERT( mbedtls_move_handshake_to_state( &(client.ssl), &(server.ssl), @@ -5672,10 +5672,10 @@ void raw_key_agreement_fail( ) exit: mbedtls_endpoint_free( &client, &client_context ); mbedtls_endpoint_free( &server, &server_context ); - + mbedtls_psa_get_stats( &stats ); TEST_ASSERT( stats.empty_slots == MBEDTLS_PSA_KEY_SLOT_COUNT ); - + USE_PSA_DONE( ); } /* END_CASE */ From 28f883eba5c61f515a3ca58bf2a0b6af448f10c4 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 8 Apr 2022 07:55:27 -0400 Subject: [PATCH 08/12] Remove RSA & DTLS dependency in raw key agreement test Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_ssl.function | 36 ++++++---------------------- 1 file changed, 7 insertions(+), 29 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index c84427cb93..5246187c2c 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5594,7 +5594,7 @@ void cid_sanity( ) } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_ENTROPY_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_CTR_DRBG_C:MBEDTLS_ECP_C */ +/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_ENTROPY_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_CTR_DRBG_C:MBEDTLS_ECP_C:MBEDTLS_ECDSA_C */ void raw_key_agreement_fail( ) { enum { BUFFSIZE = 17000 }; @@ -5602,18 +5602,8 @@ void raw_key_agreement_fail( ) mbedtls_psa_stats_t stats; size_t free_slots_before = -1; -#if defined(MBEDTLS_TIMING_C) - mbedtls_timing_delay_context timer_client, timer_server; -#endif uint16_t iana_tls_group_list[] = { MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1, MBEDTLS_SSL_IANA_TLS_GROUP_NONE }; - - mbedtls_test_message_queue server_queue, client_queue; - mbedtls_test_message_socket_context server_context, client_context; - - mbedtls_message_socket_init( &server_context ); - mbedtls_message_socket_init( &client_context ); - USE_PSA_INIT( ); /* Client side, force SECP256R1 to make one key bitflip fail @@ -5621,25 +5611,13 @@ void raw_key_agreement_fail( ) * curve (as opposed to a Montgomery curve) has a high chance of * making it invalid. */ TEST_ASSERT( mbedtls_endpoint_init( &client, MBEDTLS_SSL_IS_CLIENT, - MBEDTLS_PK_RSA, &client_context, - &client_queue, - &server_queue, iana_tls_group_list ) == 0 ); -#if defined(MBEDTLS_TIMING_C) - mbedtls_ssl_set_timer_cb( &client.ssl, &timer_client, - mbedtls_timing_set_delay, - mbedtls_timing_get_delay ); -#endif + MBEDTLS_PK_ECDSA, NULL, NULL, + NULL, iana_tls_group_list ) == 0 ); /* Server side */ TEST_ASSERT( mbedtls_endpoint_init( &server, MBEDTLS_SSL_IS_SERVER, - MBEDTLS_PK_RSA, &server_context, - &server_queue, - &client_queue, NULL ) == 0 ); -#if defined(MBEDTLS_TIMING_C) - mbedtls_ssl_set_timer_cb( &server.ssl, &timer_server, - mbedtls_timing_set_delay, - mbedtls_timing_get_delay ); -#endif + MBEDTLS_PK_ECDSA, NULL, NULL, + NULL, NULL ) == 0 ); TEST_ASSERT( mbedtls_mock_socket_connect( &(client.socket), &(server.socket), @@ -5670,8 +5648,8 @@ void raw_key_agreement_fail( ) TEST_ASSERT( free_slots_before == stats.empty_slots ); exit: - mbedtls_endpoint_free( &client, &client_context ); - mbedtls_endpoint_free( &server, &server_context ); + mbedtls_endpoint_free( &client, NULL ); + mbedtls_endpoint_free( &server, NULL ); mbedtls_psa_get_stats( &stats ); TEST_ASSERT( stats.empty_slots == MBEDTLS_PSA_KEY_SLOT_COUNT ); From 6cbc9986fb51a4e22a6061a7bc87a4a2e98ef6df Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 7 Apr 2022 20:43:05 +0200 Subject: [PATCH 09/12] Remove redundant empty slot count check USE_PSA_DONE() already checks that there are no used key slots. The call to TEST_ASSERT() wouldn't have worked properly on failure anyway, since it would jump back to the exit label. Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_ssl.function | 3 --- 1 file changed, 3 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 5246187c2c..efa297fd88 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5651,9 +5651,6 @@ exit: mbedtls_endpoint_free( &client, NULL ); mbedtls_endpoint_free( &server, NULL ); - mbedtls_psa_get_stats( &stats ); - TEST_ASSERT( stats.empty_slots == MBEDTLS_PSA_KEY_SLOT_COUNT ); - USE_PSA_DONE( ); } /* END_CASE */ From b4f874d1dad0b265a707b5385cc27d8da3d164ce Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 8 Apr 2022 16:48:09 -0400 Subject: [PATCH 10/12] raw_key_agreement_fail: Add a nominal run Ensure that the nominal run works properly, so that it's apparent that the injected failure is responsible for the failure of the handshake. Signed-off-by: Gilles Peskine --- tests/suites/test_suite_ssl.data | 7 +++++-- tests/suites/test_suite_ssl.function | 25 +++++++++++++++---------- 2 files changed, 20 insertions(+), 12 deletions(-) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 715e653e92..5eaef8e13f 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3361,5 +3361,8 @@ timing_final_delay_accessor Sanity test cid functions cid_sanity: -Raw key agreement fail -raw_key_agreement_fail: +Raw key agreement: nominal +raw_key_agreement_fail:0 + +Raw key agreement: bad server key +raw_key_agreement_fail:1 diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index efa297fd88..061bd23b21 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5595,7 +5595,7 @@ void cid_sanity( ) /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_ENTROPY_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_CTR_DRBG_C:MBEDTLS_ECP_C:MBEDTLS_ECDSA_C */ -void raw_key_agreement_fail( ) +void raw_key_agreement_fail( int bad_server_ecdhe_key ) { enum { BUFFSIZE = 17000 }; mbedtls_endpoint client, server; @@ -5633,19 +5633,24 @@ void raw_key_agreement_fail( ) * With PSA, one can be used for the ECDH private key. */ free_slots_before = stats.empty_slots; - /* Force a simulated bitflip in the server key. to make the - * raw key agreement in ssl_write_client_key_exchange fail. */ - (client.ssl).handshake->ecdh_psa_peerkey[0] ^= 0x02; + if( bad_server_ecdhe_key ) + { + /* Force a simulated bitflip in the server key. to make the + * raw key agreement in ssl_write_client_key_exchange fail. */ + (client.ssl).handshake->ecdh_psa_peerkey[0] ^= 0x02; + } - TEST_ASSERT( mbedtls_move_handshake_to_state( &(client.ssl), - &(server.ssl), - MBEDTLS_SSL_HANDSHAKE_OVER ) - != 0 ); + TEST_EQUAL( mbedtls_move_handshake_to_state( &(client.ssl), + &(server.ssl), + MBEDTLS_SSL_HANDSHAKE_OVER ), + bad_server_ecdhe_key ? MBEDTLS_ERR_SSL_HW_ACCEL_FAILED : 0 ); mbedtls_psa_get_stats( &stats ); - /* Make sure that the key slot is destroyed properly in case of failure. */ - TEST_ASSERT( free_slots_before == stats.empty_slots ); + /* Make sure that the key slot is already destroyed in case of failure, + * without waiting to close the connection. */ + if( bad_server_ecdhe_key ) + TEST_EQUAL( free_slots_before, stats.empty_slots ); exit: mbedtls_endpoint_free( &client, NULL ); From 57f58b0e659e509ce5b07a0f60a11941653c5d93 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 8 Apr 2022 08:10:53 -0400 Subject: [PATCH 11/12] Prefer TEST_EQUAL over TEST_ASSERT in test suites Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_ssl.function | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 061bd23b21..4d329a21a0 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5610,23 +5610,23 @@ void raw_key_agreement_fail( int bad_server_ecdhe_key ) * the raw key agreement. Flipping one bit with a Weierstrass * curve (as opposed to a Montgomery curve) has a high chance of * making it invalid. */ - TEST_ASSERT( mbedtls_endpoint_init( &client, MBEDTLS_SSL_IS_CLIENT, + TEST_EQUAL( mbedtls_endpoint_init( &client, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_PK_ECDSA, NULL, NULL, - NULL, iana_tls_group_list ) == 0 ); + NULL, iana_tls_group_list ), 0 ); /* Server side */ - TEST_ASSERT( mbedtls_endpoint_init( &server, MBEDTLS_SSL_IS_SERVER, + TEST_EQUAL( mbedtls_endpoint_init( &server, MBEDTLS_SSL_IS_SERVER, MBEDTLS_PK_ECDSA, NULL, NULL, - NULL, NULL ) == 0 ); + NULL, NULL ), 0 ); - TEST_ASSERT( mbedtls_mock_socket_connect( &(client.socket), + TEST_EQUAL( mbedtls_mock_socket_connect( &(client.socket), &(server.socket), - BUFFSIZE ) == 0 ); + BUFFSIZE ), 0 ); - TEST_ASSERT( mbedtls_move_handshake_to_state( &(client.ssl), + TEST_EQUAL( mbedtls_move_handshake_to_state( &(client.ssl), &(server.ssl), MBEDTLS_SSL_CLIENT_KEY_EXCHANGE ) - == 0 ); + , 0 ); mbedtls_psa_get_stats( &stats ); /* Save the number of slots in use up to this point. From 83e60eef4dfe32e934b29844f6ebad72c7709b42 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Thu, 14 Apr 2022 08:51:41 -0400 Subject: [PATCH 12/12] tests: fix bitflip comment Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_ssl.function | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 4d329a21a0..d63ed56845 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5607,9 +5607,8 @@ void raw_key_agreement_fail( int bad_server_ecdhe_key ) USE_PSA_INIT( ); /* Client side, force SECP256R1 to make one key bitflip fail - * the raw key agreement. Flipping one bit with a Weierstrass - * curve (as opposed to a Montgomery curve) has a high chance of - * making it invalid. */ + * the raw key agreement. Flipping the first byte makes the + * required 0x04 identifier invalid. */ TEST_EQUAL( mbedtls_endpoint_init( &client, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_PK_ECDSA, NULL, NULL, NULL, iana_tls_group_list ), 0 );