Skip to content

Commit e2d20f0

Browse files
lrstewartlrstewart
authored
Update fips_default security policy (#3378)
1 parent d8a779a commit e2d20f0

22 files changed

+231
-53
lines changed

‎tests/unit/s2n_async_pkey_test.c‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -400,6 +400,8 @@ int main(int argc, char **argv)
400400

401401
EXPECT_NOT_NULL(client_config = s2n_config_new());
402402
EXPECT_SUCCESS(s2n_config_set_unsafe_for_testing(client_config));
403+
/* Security policy must support all cipher suites in test_cipher_suites above */
404+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(client_config, "test_all"));
403405

404406
EXPECT_SUCCESS(s2n_config_set_verification_ca_location(client_config, S2N_DEFAULT_TEST_CERT_CHAIN, NULL));
405407

@@ -439,6 +441,8 @@ int main(int argc, char **argv)
439441

440442
EXPECT_NOT_NULL(client_config = s2n_config_new());
441443
EXPECT_SUCCESS(s2n_config_set_unsafe_for_testing(client_config));
444+
/* Security policy must support all cipher suites in test_cipher_suites above */
445+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(client_config, "test_all"));
442446

443447
EXPECT_SUCCESS(s2n_config_set_verification_ca_location(client_config, S2N_DEFAULT_TEST_CERT_CHAIN, NULL));
444448

@@ -478,6 +482,8 @@ int main(int argc, char **argv)
478482

479483
EXPECT_NOT_NULL(client_config = s2n_config_new());
480484
EXPECT_SUCCESS(s2n_config_set_unsafe_for_testing(client_config));
485+
/* Security policy must support all cipher suites in test_cipher_suites above */
486+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(client_config, "test_all"));
481487

482488
EXPECT_SUCCESS(s2n_config_set_verification_ca_location(client_config, S2N_DEFAULT_TEST_CERT_CHAIN, NULL));
483489

@@ -520,6 +526,8 @@ int main(int argc, char **argv)
520526

521527
EXPECT_NOT_NULL(client_config = s2n_config_new());
522528
EXPECT_SUCCESS(s2n_config_set_unsafe_for_testing(client_config));
529+
/* Security policy must support all cipher suites in test_cipher_suites above */
530+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(client_config, "test_all"));
523531

524532
EXPECT_SUCCESS(s2n_config_set_verification_ca_location(client_config, S2N_DEFAULT_TEST_CERT_CHAIN, NULL));
525533

‎tests/unit/s2n_cipher_suite_match_test.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -281,6 +281,8 @@ int main(int argc, char **argv)
281281

282282
EXPECT_NOT_NULL(server_config = s2n_config_new());
283283
EXPECT_SUCCESS(s2n_config_add_cert_chain_and_key_to_store(server_config, rsa_cert));
284+
/* Security policy must allow all test cipher suites */
285+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(server_config, "test_all"));
284286
EXPECT_SUCCESS(s2n_connection_set_config(conn, server_config));
285287

286288
/* TEST RSA */

‎tests/unit/s2n_client_extensions_test.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -344,6 +344,8 @@ int main(int argc, char **argv)
344344
EXPECT_SUCCESS(s2n_connection_set_io_pair(server_conn, &io_pair));
345345

346346
EXPECT_NOT_NULL(server_config = s2n_config_new());
347+
/* Security policy must allow cipher suite hard coded into client hello */
348+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(server_config, "test_all"));
347349
EXPECT_SUCCESS(s2n_read_test_pem_and_len(S2N_DEFAULT_TEST_CERT_CHAIN, (uint8_t *)cert_chain, &cert_chain_len, S2N_MAX_TEST_PEM_SIZE));
348350
EXPECT_SUCCESS(s2n_read_test_pem_and_len(S2N_DEFAULT_TEST_PRIVATE_KEY, (uint8_t *)private_key, &private_key_len, S2N_MAX_TEST_PEM_SIZE));
349351
EXPECT_NOT_NULL(chain_and_key = s2n_cert_chain_and_key_new());
@@ -550,6 +552,8 @@ int main(int argc, char **argv)
550552
EXPECT_SUCCESS(s2n_connection_set_io_pair(server_conn, &io_pair));
551553

552554
EXPECT_NOT_NULL(server_config = s2n_config_new());
555+
/* Security policy must allow cipher suite hard coded into client hello */
556+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(server_config, "test_all"));
553557
EXPECT_SUCCESS(s2n_read_test_pem(S2N_DEFAULT_TEST_CERT_CHAIN, cert_chain, S2N_MAX_TEST_PEM_SIZE));
554558
EXPECT_SUCCESS(s2n_read_test_pem(S2N_DEFAULT_TEST_PRIVATE_KEY, private_key, S2N_MAX_TEST_PEM_SIZE));
555559
EXPECT_NOT_NULL(chain_and_key = s2n_cert_chain_and_key_new());
@@ -908,6 +912,7 @@ int main(int argc, char **argv)
908912
EXPECT_SUCCESS(s2n_enable_tls13_in_test());
909913

910914
EXPECT_NOT_NULL(client_config = s2n_config_new());
915+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(client_config, "default_tls13"));
911916
EXPECT_SUCCESS(s2n_config_set_check_stapled_ocsp_response(client_config, 0));
912917
EXPECT_SUCCESS(s2n_config_disable_x509_verification(client_config));
913918
EXPECT_NOT_NULL(client_conn = s2n_connection_new(S2N_CLIENT));
@@ -927,6 +932,7 @@ int main(int argc, char **argv)
927932
EXPECT_SUCCESS(s2n_connections_set_io_pair(client_conn, server_conn, &io_pair));
928933

929934
EXPECT_NOT_NULL(server_config = s2n_config_new());
935+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(server_config, "default_tls13"));
930936
EXPECT_SUCCESS(s2n_read_test_pem(S2N_DEFAULT_ECDSA_TEST_CERT_CHAIN, cert_chain, S2N_MAX_TEST_PEM_SIZE));
931937
EXPECT_SUCCESS(s2n_read_test_pem(S2N_DEFAULT_ECDSA_TEST_PRIVATE_KEY, private_key, S2N_MAX_TEST_PEM_SIZE));
932938
EXPECT_SUCCESS(s2n_config_add_cert_chain_and_key(server_config, cert_chain, private_key));

‎tests/unit/s2n_client_hello_test.c‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -688,6 +688,8 @@ int main(int argc, char **argv)
688688

689689
EXPECT_NOT_NULL(server_config = s2n_config_new());
690690
EXPECT_SUCCESS(s2n_config_add_cert_chain_and_key_to_store(server_config, chain_and_key));
691+
/* Security policy must support SSLv2 */
692+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(server_config, "test_all"));
691693
EXPECT_SUCCESS(s2n_connection_set_config(server_conn, server_config));
692694

693695
/* Send the client hello message */
@@ -697,7 +699,7 @@ int main(int argc, char **argv)
697699
/* Verify that the sent client hello message is accepted */
698700
s2n_negotiate(server_conn, &server_blocked);
699701
EXPECT_TRUE(s2n_conn_get_current_message_type(server_conn) > CLIENT_HELLO);
700-
EXPECT_EQUAL(server_conn->handshake.handshake_type, NEGOTIATED | FULL_HANDSHAKE);
702+
EXPECT_TRUE(IS_NEGOTIATED(server_conn));
701703

702704
struct s2n_client_hello *client_hello = s2n_connection_get_client_hello(server_conn);
703705

@@ -858,6 +860,8 @@ int main(int argc, char **argv)
858860
server_conn->actual_protocol_version = S2N_TLS12;
859861
server_conn->server_protocol_version = S2N_TLS12;
860862
server_conn->client_protocol_version = S2N_TLS12;
863+
/* Security policy must allow cipher suite hard coded into client hello */
864+
EXPECT_SUCCESS(s2n_connection_set_cipher_preferences(server_conn, "test_all"));
861865
EXPECT_SUCCESS(s2n_connection_set_io_pair(server_conn, &io_pair));
862866

863867
EXPECT_NOT_NULL(server_config = s2n_config_new());
@@ -1072,6 +1076,8 @@ int main(int argc, char **argv)
10721076
server_conn->actual_protocol_version = S2N_TLS12;
10731077
server_conn->server_protocol_version = S2N_TLS12;
10741078
server_conn->client_protocol_version = S2N_TLS12;
1079+
/* Security policy must allow cipher suite hard coded into client hello */
1080+
EXPECT_SUCCESS(s2n_connection_set_cipher_preferences(server_conn, "test_all"));
10751081
EXPECT_SUCCESS(s2n_connection_set_io_pair(server_conn, &io_pair));
10761082

10771083
/* Recreate config */
@@ -1201,6 +1207,8 @@ int main(int argc, char **argv)
12011207
EXPECT_SUCCESS(s2n_io_pair_init_non_blocking(&io_pair));
12021208

12031209
EXPECT_NOT_NULL(server_conn = s2n_connection_new(S2N_SERVER));
1210+
/* Security policy must allow cipher suite hard coded into client hello */
1211+
EXPECT_SUCCESS(s2n_connection_set_cipher_preferences(server_conn, "test_all"));
12041212
EXPECT_SUCCESS(s2n_connection_set_io_pair(server_conn, &io_pair));
12051213

12061214
EXPECT_NOT_NULL(server_config = s2n_config_new());

‎tests/unit/s2n_client_secure_renegotiation_test.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,8 @@ int main(int argc, char **argv)
102102
EXPECT_SUCCESS(s2n_connection_set_io_pair(client_conn, &io_pair));
103103

104104
EXPECT_NOT_NULL(client_config = s2n_config_new());
105+
/* Security policy must allow cipher suite hard coded into server hello */
106+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(client_config, "test_all"));
105107
EXPECT_SUCCESS(s2n_connection_set_config(client_conn, client_config));
106108

107109
/* Send the client hello */
@@ -175,6 +177,8 @@ int main(int argc, char **argv)
175177
EXPECT_SUCCESS(s2n_connection_set_io_pair(client_conn, &io_pair));
176178

177179
EXPECT_NOT_NULL(client_config = s2n_config_new());
180+
/* Security policy must allow cipher suite hard coded into server hello */
181+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(client_config, "test_all"));
178182
EXPECT_SUCCESS(s2n_connection_set_config(client_conn, client_config));
179183

180184
/* Send the client hello */

‎tests/unit/s2n_client_supported_versions_extension_test.c‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -217,7 +217,8 @@ int main(int argc, char **argv)
217217
POSIX_GUARD(s2n_stuffer_write_uint16(&extension, invalid_version_list[i]));
218218
}
219219

220-
EXPECT_FAILURE_WITH_ERRNO(s2n_client_supported_versions_extension.recv(server_conn, &extension), S2N_ERR_BAD_MESSAGE);
220+
EXPECT_FAILURE_WITH_ERRNO(s2n_client_supported_versions_extension.recv(server_conn, &extension),
221+
S2N_ERR_UNKNOWN_PROTOCOL_VERSION);
221222

222223
EXPECT_SUCCESS(s2n_connection_free(server_conn));
223224
EXPECT_SUCCESS(s2n_stuffer_free(&extension));
@@ -283,7 +284,7 @@ int main(int argc, char **argv)
283284
EXPECT_NOT_NULL(server_conn = s2n_connection_new(S2N_SERVER));
284285
EXPECT_SUCCESS(s2n_connection_set_config(server_conn, config));
285286

286-
uint8_t supported_version_list[] = { S2N_UNKNOWN_PROTOCOL_VERSION };
287+
uint8_t supported_version_list[] = { S2N_SSLv3 };
287288
uint8_t supported_version_list_length = sizeof(supported_version_list);
288289

289290
struct s2n_stuffer extension;
@@ -292,7 +293,8 @@ int main(int argc, char **argv)
292293
EXPECT_SUCCESS(write_test_supported_versions_list(&extension, supported_version_list,
293294
supported_version_list_length));
294295

295-
EXPECT_FAILURE_WITH_ERRNO(s2n_client_supported_versions_extension.recv(server_conn, &extension), S2N_ERR_BAD_MESSAGE);
296+
EXPECT_FAILURE_WITH_ERRNO(s2n_client_supported_versions_extension.recv(server_conn, &extension),
297+
S2N_ERR_PROTOCOL_VERSION_UNSUPPORTED);
296298
EXPECT_EQUAL(get_alert(server_conn), PROTOCOL_VERSION_ALERT);
297299

298300
EXPECT_SUCCESS(s2n_connection_free(server_conn));
@@ -310,7 +312,8 @@ int main(int argc, char **argv)
310312

311313
EXPECT_SUCCESS(s2n_stuffer_write_uint8(&extension, 0));
312314

313-
EXPECT_FAILURE_WITH_ERRNO(s2n_client_supported_versions_extension.recv(server_conn, &extension), S2N_ERR_BAD_MESSAGE);
315+
EXPECT_FAILURE_WITH_ERRNO(s2n_client_supported_versions_extension.recv(server_conn, &extension),
316+
S2N_ERR_UNKNOWN_PROTOCOL_VERSION);
314317
EXPECT_EQUAL(get_alert(server_conn), PROTOCOL_VERSION_ALERT);
315318

316319
EXPECT_SUCCESS(s2n_connection_free(server_conn));

‎tests/unit/s2n_drain_alert_test.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,8 @@ int main(int argc, char **argv)
9898
EXPECT_SUCCESS(s2n_connection_set_io_pair(server_conn, &io_pair));
9999

100100
EXPECT_NOT_NULL(server_config = s2n_config_new());
101+
/* Security policy must allow cipher suite hard coded into client hello */
102+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(server_config, "test_all"));
101103
EXPECT_SUCCESS(s2n_read_test_pem(S2N_DEFAULT_TEST_CERT_CHAIN, cert_chain, S2N_MAX_TEST_PEM_SIZE));
102104
EXPECT_SUCCESS(s2n_read_test_pem(S2N_DEFAULT_TEST_PRIVATE_KEY, private_key, S2N_MAX_TEST_PEM_SIZE));
103105
EXPECT_NOT_NULL(chain_and_key = s2n_cert_chain_and_key_new());

‎tests/unit/s2n_handshake_test.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,8 @@ int main(int argc, char **argv)
251251
S2N_DEFAULT_TEST_CERT_CHAIN, S2N_DEFAULT_TEST_PRIVATE_KEY));
252252

253253
EXPECT_NOT_NULL(server_config = s2n_config_new());
254+
/* We need a security policy that only supports RSA certificates for auth */
255+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(server_config, "20170210"));
254256
EXPECT_SUCCESS(s2n_config_add_cert_chain_and_key_to_store(server_config, chain_and_key));
255257
EXPECT_SUCCESS(s2n_config_add_dhparams(server_config, dhparams_pem));
256258
/* Enable signature validation for async sign call */
@@ -364,6 +366,8 @@ int main(int argc, char **argv)
364366
S2N_DEFAULT_TEST_CERT_CHAIN, S2N_DEFAULT_TEST_PRIVATE_KEY));
365367

366368
EXPECT_NOT_NULL(server_config = s2n_config_new());
369+
/* We need a security policy that only supports RSA certificates for auth */
370+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(server_config, "20170210"));
367371

368372
struct s2n_security_policy security_policy = {
369373
.minimum_protocol_version = server_config->security_policy->minimum_protocol_version,

‎tests/unit/s2n_mutual_auth_test.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,9 +63,15 @@ int main(int argc, char **argv)
6363
EXPECT_SUCCESS(s2n_read_test_pem(S2N_DEFAULT_TEST_CERT_CHAIN, cert_chain_pem, S2N_MAX_TEST_PEM_SIZE));
6464
EXPECT_SUCCESS(s2n_read_test_pem(S2N_DEFAULT_TEST_PRIVATE_KEY, private_key_pem, S2N_MAX_TEST_PEM_SIZE));
6565
EXPECT_SUCCESS(s2n_read_test_pem(S2N_DEFAULT_TEST_DHPARAMS, dhparams_pem, S2N_MAX_TEST_PEM_SIZE));
66+
/* Later versions of the default security policies include ECDSA, which this test does not handle.
67+
* We can't just add an ECDSA certificate to the test, because only one cert is allowed in client mode.
68+
* Freeze the version of the security policy used by this test. */
69+
EXPECT_SUCCESS(s2n_config_set_cipher_preferences(config, "20170210"));
70+
6671
EXPECT_NOT_NULL(chain_and_key = s2n_cert_chain_and_key_new());
6772
EXPECT_SUCCESS(s2n_cert_chain_and_key_load_pem(chain_and_key, cert_chain_pem, private_key_pem));
6873
EXPECT_SUCCESS(s2n_config_add_cert_chain_and_key_to_store(config, chain_and_key));
74+
6975
EXPECT_SUCCESS(s2n_config_add_dhparams(config, dhparams_pem));
7076
EXPECT_NOT_NULL(default_security_policy = config->security_policy);
7177
EXPECT_NOT_NULL(default_cipher_preferences = default_security_policy->cipher_preferences);

‎tests/unit/s2n_optional_client_auth_test.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,16 @@ int main(int argc, char **argv)
4848
EXPECT_SUCCESS(s2n_read_test_pem(S2N_DEFAULT_TEST_CERT_CHAIN, cert_chain_pem, S2N_MAX_TEST_PEM_SIZE));
4949
EXPECT_SUCCESS(s2n_read_test_pem(S2N_DEFAULT_TEST_PRIVATE_KEY, private_key_pem, S2N_MAX_TEST_PEM_SIZE));
5050
EXPECT_SUCCESS(s2n_read_test_pem(S2N_DEFAULT_TEST_DHPARAMS, dhparams_pem, S2N_MAX_TEST_PEM_SIZE));
51+
5152
EXPECT_NOT_NULL(chain_and_key = s2n_cert_chain_and_key_new());
5253
EXPECT_SUCCESS(s2n_cert_chain_and_key_load_pem(chain_and_key, cert_chain_pem, private_key_pem));
5354
EXPECT_SUCCESS(s2n_config_add_cert_chain_and_key_to_store(server_config, chain_and_key));
55+
56+
DEFER_CLEANUP(struct s2n_cert_chain_and_key *ecdsa_chain = NULL, s2n_cert_chain_and_key_ptr_free);
57+
EXPECT_SUCCESS(s2n_test_cert_chain_and_key_new(&ecdsa_chain,
58+
S2N_DEFAULT_ECDSA_TEST_CERT_CHAIN, S2N_DEFAULT_ECDSA_TEST_PRIVATE_KEY));
59+
EXPECT_SUCCESS(s2n_config_add_cert_chain_and_key_to_store(server_config, ecdsa_chain));
60+
5461
EXPECT_SUCCESS(s2n_config_add_dhparams(server_config, dhparams_pem));
5562
EXPECT_NOT_NULL(default_security_policy = server_config->security_policy);
5663
EXPECT_NOT_NULL(default_cipher_preferences = default_security_policy->cipher_preferences);

0 commit comments

Comments
 (0)