Merge branch 'gost-split-3' into 'master'

Add GOST-CNT ciphersuite support

See merge request gnutls/gnutls!1119

11 files changed, 268 insertions, 14 deletions

diff --git a/NEWS b/NEWS
index 85398a7f69..05833c83ef 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,14 @@ See the end for copying conditions.
 ** libgnutls: Introduced the gnutls_ocsp_req_const_t which is compatible
    with gnutls_ocsp_req_t but const.
 
+** libgnutls: Added support for GOST CNT_IMIT ciphersuite (as defined by
+   draft-smyshlyaev-tls12-gost-suites-06).
+   By default this ciphersuite is disabled. One has to add following items to priority strings:
+   +VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001.
+   Note, that server will fail to negotiate GOST ciphersuites if TLS 1.3 is
+   enabled both on a server and a client. It is recommended for now to disable
+   TLS 1.3 in setups where GOST ciphersuites are enabled on GnuTLS-based servers.
+
 ** API and ABI modifications:
 gnutls_ocsp_req_const_t: Added
 
diff --git a/doc/cha-gtls-app.texi b/doc/cha-gtls-app.texi
index 4a6a53811b..74fed786b7 100644
--- a/doc/cha-gtls-app.texi
+++ b/doc/cha-gtls-app.texi
@@ -1460,9 +1460,9 @@ GROUP-FFDHE2048, GROUP-FFDHE3072, GROUP-FFDHE4096, GROUP-FFDHE6144, and
 GROUP-FFDHE8192.
 Groups include both elliptic curve groups, e.g., SECP256R1, as well as 
 finite field groups such as FFDHE2048. Catch all which enables all groups
-from NORMAL priority is GROUP-ALL. The helper keywords GROUP-DH-ALL and
-GROUP-EC-ALL are also available, restricting the groups to finite fields
-(DH) and elliptic curves.
+from NORMAL priority is GROUP-ALL. The helper keywords GROUP-DH-ALL,
+GROUP-GOST-ALL and GROUP-EC-ALL are also available, restricting the groups
+to finite fields (DH), GOST curves and generic elliptic curves.
 
 @item Elliptic curves (legacy) @tab
 CURVE-SECP192R1, CURVE-SECP224R1, CURVE-SECP256R1, CURVE-SECP384R1,
diff --git a/lib/algorithms.h b/lib/algorithms.h
index 0d14331154..fadf269871 100644
--- a/lib/algorithms.h
+++ b/lib/algorithms.h
@@ -488,6 +488,24 @@ static inline int _gnutls_kx_is_dhe(gnutls_kx_algorithm_t kx)
 	return 0;
 }
 
+static inline unsigned _gnutls_kx_is_vko_gost(gnutls_kx_algorithm_t kx)
+{
+	if (kx == GNUTLS_KX_VKO_GOST_12)
+		return 1;
+
+	return 0;
+}
+
+static inline bool
+_sign_is_gost(const gnutls_sign_entry_st *se)
+{
+	gnutls_pk_algorithm_t pk = se->pk;
+
+	return  (pk == GNUTLS_PK_GOST_01) ||
+		(pk == GNUTLS_PK_GOST_12_256) ||
+		(pk == GNUTLS_PK_GOST_12_512);
+}
+
 static inline int _sig_is_ecdsa(gnutls_sign_algorithm_t sig)
 {
 	if (sig == GNUTLS_SIGN_ECDSA_SHA1 || sig == GNUTLS_SIGN_ECDSA_SHA224 ||
diff --git a/lib/algorithms/ciphersuites.c b/lib/algorithms/ciphersuites.c
index b7abfe607f..2c76f84d6d 100644
--- a/lib/algorithms/ciphersuites.c
+++ b/lib/algorithms/ciphersuites.c
@@ -334,6 +334,11 @@
 #define GNUTLS_ECDHE_PSK_NULL_SHA256 { 0xC0, 0x3A }
 #define GNUTLS_ECDHE_PSK_NULL_SHA384 { 0xC0, 0x3B }
 
+/* draft-smyshlyaev-tls12-gost-suites */
+#ifdef ENABLE_GOST
+#define GNUTLS_GOSTR341112_256_28147_CNT_IMIT { 0xc1, 0x02 }
+#endif
+
 #define CIPHER_SUITES_COUNT (sizeof(cs_algorithms)/sizeof(gnutls_cipher_suite_entry_st)-1)
 
 /* The following is a potential list of ciphersuites. For the options to be
@@ -1173,6 +1178,12 @@ static const gnutls_cipher_suite_entry_st cs_algorithms[] = {
 	      GNUTLS_DTLS_VERSION_MIN),
 #endif
 
+#ifdef ENABLE_GOST
+	ENTRY_PRF(GNUTLS_GOSTR341112_256_28147_CNT_IMIT,
+		  GNUTLS_CIPHER_GOST28147_TC26Z_CNT, GNUTLS_KX_VKO_GOST_12,
+		  GNUTLS_MAC_GOST28147_TC26Z_IMIT, GNUTLS_TLS1_2,
+		  GNUTLS_VERSION_UNKNOWN, GNUTLS_MAC_STREEBOG_256),
+#endif
 
 	{0, {0, 0}, 0, 0, 0, 0, 0, 0}
 };
diff --git a/lib/auth/cert.c b/lib/auth/cert.c
index fd8fba54d1..fabd7c8a41 100644
--- a/lib/auth/cert.c
+++ b/lib/auth/cert.c
@@ -55,9 +55,13 @@ selected_certs_set(gnutls_session_t session,
 		   gnutls_status_request_ocsp_func ocsp_func,
 		   void *ocsp_func_ptr);
 
-#define MAX_CLIENT_SIGN_ALGOS 3
+#define MAX_CLIENT_SIGN_ALGOS 5
 #define CERTTYPE_SIZE (MAX_CLIENT_SIGN_ALGOS+1)
-typedef enum CertificateSigType { RSA_SIGN = 1, DSA_SIGN = 2, ECDSA_SIGN = 64
+typedef enum CertificateSigType { RSA_SIGN = 1, DSA_SIGN = 2, ECDSA_SIGN = 64,
+#ifdef ENABLE_GOST
+	GOSTR34102012_256_SIGN = 67,
+	GOSTR34102012_512_SIGN = 68
+#endif
 } CertificateSigType;
 
 /* Moves data from an internal certificate struct (gnutls_pcert_st) to
@@ -1017,6 +1021,12 @@ inline static int _gnutls_check_supported_sign_algo(CertificateSigType algo)
 		return GNUTLS_PK_DSA;
 	case ECDSA_SIGN:
 		return GNUTLS_PK_EC;
+#ifdef ENABLE_GOST
+	case GOSTR34102012_256_SIGN:
+		return GNUTLS_PK_GOST_12_256;
+	case GOSTR34102012_512_SIGN:
+		return GNUTLS_PK_GOST_12_512;
+#endif
 	}
 
 	return -1;
@@ -1267,7 +1277,7 @@ _gnutls_gen_cert_server_cert_req(gnutls_session_t session,
 				 gnutls_buffer_st * data)
 {
 	gnutls_certificate_credentials_t cred;
-	int ret;
+	int ret, i;
 	uint8_t tmp_data[CERTTYPE_SIZE];
 	const version_entry_st *ver = get_version(session);
 	unsigned init_pos = data->length;
@@ -1287,12 +1297,21 @@ _gnutls_gen_cert_server_cert_req(gnutls_session_t session,
 		return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
 	}
 
-	tmp_data[0] = CERTTYPE_SIZE - 1;
-	tmp_data[1] = RSA_SIGN;
-	tmp_data[2] = DSA_SIGN;
-	tmp_data[3] = ECDSA_SIGN;	/* only these for now */
+	i = 1;
+#ifdef ENABLE_GOST
+	if (_gnutls_kx_is_vko_gost(session->security_parameters.cs->kx_algorithm)) {
+		tmp_data[i++] = GOSTR34102012_256_SIGN;
+		tmp_data[i++] = GOSTR34102012_512_SIGN;
+	} else
+#endif
+	{
+		tmp_data[i++] = RSA_SIGN;
+		tmp_data[i++] = DSA_SIGN;
+		tmp_data[i++] = ECDSA_SIGN;
+	}
+	tmp_data[0] = i - 1;
 
-	ret = _gnutls_buffer_append_data(data, tmp_data, CERTTYPE_SIZE);
+	ret = _gnutls_buffer_append_data(data, tmp_data, i);
 	if (ret < 0)
 		return gnutls_assert_val(ret);
 
diff --git a/lib/ext/signature.c b/lib/ext/signature.c
index 8dba4c6ca7..3f3652f51e 100644
--- a/lib/ext/signature.c
+++ b/lib/ext/signature.c
@@ -97,6 +97,12 @@ _gnutls_sign_algorithm_write_params(gnutls_session_t session,
 		if (prev && prev->id[0] == aid->id[0] && prev->id[1] == aid->id[1])
 			continue;
 
+		/* Ignore non-GOST sign types for CertReq */
+		if (session->security_parameters.cs &&
+		    _gnutls_kx_is_vko_gost(session->security_parameters.cs->kx_algorithm) &&
+		    !_sign_is_gost(session->internals.priorities->sigalg.entry[i]))
+			continue;
+
 		_gnutls_handshake_log
 		    ("EXT[%p]: sent signature algo (%d.%d) %s\n", session,
 		     (int)aid->id[0], (int)aid->id[1],
diff --git a/lib/priority.c b/lib/priority.c
index 1f0841fef1..c1669220c6 100644
--- a/lib/priority.c
+++ b/lib/priority.c
@@ -136,6 +136,19 @@ static const int _supported_groups_ecdh[] = {
 	0
 };
 
+static const int _supported_groups_gost[] = {
+#ifdef ENABLE_GOST
+	GNUTLS_GROUP_GC256A,
+	GNUTLS_GROUP_GC256B,
+	GNUTLS_GROUP_GC256C,
+	GNUTLS_GROUP_GC256D,
+	GNUTLS_GROUP_GC512A,
+	GNUTLS_GROUP_GC512B,
+	GNUTLS_GROUP_GC512C,
+#endif
+	0
+};
+
 static const int _supported_groups_normal[] = {
 	GNUTLS_GROUP_SECP256R1,
 	GNUTLS_GROUP_SECP384R1,
@@ -1605,7 +1618,8 @@ static int set_ciphersuite_list(gnutls_priority_t priority_cache)
 
 				if (ce != NULL && priority_cache->cs.size < MAX_CIPHERSUITE_SIZE) {
 					priority_cache->cs.entry[priority_cache->cs.size++] = ce;
-					if (!have_ec && _gnutls_kx_is_ecc(ce->kx_algorithm)) {
+					if (!have_ec && (_gnutls_kx_is_ecc(ce->kx_algorithm) ||
+							 _gnutls_kx_is_vko_gost(ce->kx_algorithm))) {
 						have_ec = 1;
 						add_ec(priority_cache);
 					}
@@ -2060,6 +2074,12 @@ gnutls_priority_init(gnutls_priority_t * priority_cache,
 					bulk_given_fn(&(*priority_cache)->
 						_supported_ecc,
 						_supported_groups_ecdh);
+				} else if (strncasecmp
+				    (&broken_list[i][1], "GROUP-GOST-ALL",
+				     12) == 0) {
+					bulk_given_fn(&(*priority_cache)->
+						_supported_ecc,
+						_supported_groups_gost);
 				} else {
 					if ((algo =
 					     gnutls_group_get_id
diff --git a/tests/server-kx-neg-common.c b/tests/server-kx-neg-common.c
index ef9fed5e9d..961d16074e 100644
--- a/tests/server-kx-neg-common.c
+++ b/tests/server-kx-neg-common.c
@@ -38,6 +38,8 @@ typedef struct test_case_st {
 	unsigned have_ecc_sign_cert;
 	unsigned have_ed25519_sign_cert;
 	unsigned have_rsa_decrypt_cert;
+	unsigned have_gost12_256_cert;
+	unsigned have_gost12_512_cert;
 	unsigned not_on_fips;
 	unsigned exp_version;
 	const char *client_prio;
@@ -222,6 +224,14 @@ static void try(test_case_st *test)
 		assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_localhost_rsa_sign_cert, &server_ca3_key, GNUTLS_X509_FMT_PEM) >= 0);
 	}
 
+	if (test->have_gost12_256_cert) {
+		assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_gost12_256_cert, &server_ca3_gost12_256_key, GNUTLS_X509_FMT_PEM) >= 0);
+	}
+
+	if (test->have_gost12_512_cert) {
+		assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_gost12_512_cert, &server_ca3_gost12_512_key, GNUTLS_X509_FMT_PEM) >= 0);
+	}
+
 	/* client does everything */
 	gnutls_credentials_set(client, GNUTLS_CRD_ANON, c_anon_cred);
 	gnutls_credentials_set(client, GNUTLS_CRD_CERTIFICATE, c_cert_cred);
diff --git a/tests/tls12-cert-key-exchange.c b/tests/tls12-cert-key-exchange.c
index d8563c0943..1b3d77fbf1 100644
--- a/tests/tls12-cert-key-exchange.c
+++ b/tests/tls12-cert-key-exchange.c
@@ -150,5 +150,32 @@ void doit(void)
 			GNUTLS_E_AGAIN, GNUTLS_E_KEY_USAGE_VIOLATION,
 			&rawpk_public_key2, &rawpk_private_key2, 0, &rawpk_public_key1, &rawpk_private_key1, GNUTLS_KEY_KEY_ENCIPHERMENT);
 
+#ifdef ENABLE_GOST
+	if (!gnutls_fips140_mode_enabled()) {
+		server_priority = "NORMAL:+CTYPE-ALL"
+			":+VKO-GOST-12"
+			":+GROUP-GOST-ALL"
+			":+GOST28147-TC26Z-CNT"
+			":+GOST28147-TC26Z-IMIT"
+			":+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001";
+		const char *gost_client_prio = "NORMAL:-VERS-ALL:+VERS-TLS1.2:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001";
+		try_with_key("TLS 1.2 with gost12 256 no-cli-cert (ctype X.509)", gost_client_prio, GNUTLS_KX_VKO_GOST_12, GNUTLS_SIGN_GOST_256, GNUTLS_SIGN_UNKNOWN,
+			&server_ca3_gost12_256_cert, &server_ca3_gost12_256_key, NULL, NULL, 0, GNUTLS_CRT_X509, GNUTLS_CRT_UNKNOWN);
+		try_with_key("TLS 1.2 with gost12 256 ask cli-cert (ctype X.509)", gost_client_prio, GNUTLS_KX_VKO_GOST_12, GNUTLS_SIGN_GOST_256, GNUTLS_SIGN_UNKNOWN,
+			&server_ca3_gost12_256_cert, &server_ca3_gost12_256_key, NULL, NULL, ASK_CERT, GNUTLS_CRT_X509, GNUTLS_CRT_X509);
+		try_with_key("TLS 1.2 with gost12 256 use cli-cert (ctype X.509)", gost_client_prio, GNUTLS_KX_VKO_GOST_12, GNUTLS_SIGN_GOST_256, GNUTLS_SIGN_GOST_256,
+			&server_ca3_gost12_256_cert, &server_ca3_gost12_256_key, &cligost12_256_ca3_cert, &cligost12_256_ca3_key, USE_CERT, GNUTLS_CRT_X509, GNUTLS_CRT_X509);
+		try_with_key("TLS 1.2 with gost12 512 no-cli-cert (ctype X.509)", gost_client_prio, GNUTLS_KX_VKO_GOST_12, GNUTLS_SIGN_GOST_512, GNUTLS_SIGN_UNKNOWN,
+			&server_ca3_gost12_512_cert, &server_ca3_gost12_512_key, NULL, NULL, 0, GNUTLS_CRT_X509, GNUTLS_CRT_UNKNOWN);
+		try_with_key("TLS 1.2 with gost12 512 ask cli-cert (ctype X.509)", gost_client_prio, GNUTLS_KX_VKO_GOST_12, GNUTLS_SIGN_GOST_512, GNUTLS_SIGN_UNKNOWN,
+			&server_ca3_gost12_512_cert, &server_ca3_gost12_512_key, NULL, NULL, ASK_CERT, GNUTLS_CRT_X509, GNUTLS_CRT_X509);
+		try_with_key("TLS 1.2 with gost12 512 use cli-cert (ctype X.509)", gost_client_prio, GNUTLS_KX_VKO_GOST_12, GNUTLS_SIGN_GOST_512, GNUTLS_SIGN_GOST_512,
+			&server_ca3_gost12_512_cert, &server_ca3_gost12_512_key, &cligost12_512_ca3_cert, &cligost12_512_ca3_key, USE_CERT, GNUTLS_CRT_X509, GNUTLS_CRT_X509);
+		try_with_key("TLS 1.2 with gost12 512 use cli-cert gost12 256 (ctype X.509)", gost_client_prio, GNUTLS_KX_VKO_GOST_12, GNUTLS_SIGN_GOST_512, GNUTLS_SIGN_GOST_256,
+			&server_ca3_gost12_512_cert, &server_ca3_gost12_512_key, &cligost12_256_ca3_cert, &cligost12_256_ca3_key, USE_CERT, GNUTLS_CRT_X509, GNUTLS_CRT_X509);
+		server_priority = NULL;
+	}
+#endif
+
 	gnutls_global_deinit();
 }
diff --git a/tests/tls12-server-kx-neg.c b/tests/tls12-server-kx-neg.c
index 1e55dfd3a0..88d2666ef2 100644
--- a/tests/tls12-server-kx-neg.c
+++ b/tests/tls12-server-kx-neg.c
@@ -461,7 +461,72 @@ test_case_st tests[] = {
 		.have_srp_cred = 1,
 		.server_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.2",
 		.client_prio = "NORMAL:-KX-ALL:+SRP:-VERS-ALL:+VERS-TLS1.2"
-	}
+	},
+
+#ifdef ENABLE_GOST
+	{
+		.name = "TLS 1.2 VKO-GOST-12 without cred",
+		.client_ret = GNUTLS_E_AGAIN,
+		.server_ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS,
+		.not_on_fips = 1,
+		.server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2",
+		.client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2"
+	},
+	{
+		.name = "TLS 1.2 VKO-GOST-12 with cred but no cert",
+		.client_ret = GNUTLS_E_AGAIN,
+		.server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+		.have_cert_cred = 1,
+		.not_on_fips = 1,
+		.server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2",
+		.client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2"
+	},
+	{
+		.name = "TLS 1.2 VKO-GOST-12 with cred but no GOST cert",
+		.client_ret = GNUTLS_E_AGAIN,
+		.server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+		.have_cert_cred = 1,
+		.have_rsa_sign_cert = 1,
+		.have_rsa_decrypt_cert = 1,
+		.not_on_fips = 1,
+		.server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2",
+		.client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2"
+	},
+	{
+		.name = "TLS 1.2 VKO-GOST-12 with cred and GOST12-256 cert",
+		.server_ret = 0,
+		.client_ret = 0,
+		.have_cert_cred = 1,
+		.have_gost12_256_cert = 1,
+		.not_on_fips = 1,
+		.server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2",
+		.client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2"
+	},
+	{
+		.name = "TLS 1.2 VKO-GOST-12 with cred and GOST12-512 cert",
+		.server_ret = 0,
+		.client_ret = 0,
+		.have_cert_cred = 1,
+		.have_gost12_512_cert = 1,
+		.not_on_fips = 1,
+		.server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2",
+		.client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2"
+	},
+	{
+		.name = "TLS 1.2 VKO-GOST-12 with cred and multiple certs",
+		.server_ret = 0,
+		.client_ret = 0,
+		.have_cert_cred = 1,
+		.have_ecc_sign_cert = 1,
+		.have_rsa_sign_cert = 1,
+		.have_rsa_decrypt_cert = 1,
+		.have_gost12_256_cert = 1,
+		.have_gost12_512_cert = 1,
+		.not_on_fips = 1,
+		.server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2",
+		.client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:-VERS-ALL:+VERS-TLS1.2"
+	},
+#endif
 };
 
 void doit(void)
diff --git a/tests/tls13-server-kx-neg.c b/tests/tls13-server-kx-neg.c
index 1b52fb56a1..0c8a20979c 100644
--- a/tests/tls13-server-kx-neg.c
+++ b/tests/tls13-server-kx-neg.c
@@ -223,7 +223,77 @@ test_case_st tests[] = {
 		.server_prio = "NORMAL:-KX-ALL:+SRP:"PVERSION,
 		.client_prio = "NORMAL:-KX-ALL:+SRP:"PVERSION,
 		.exp_version = GNUTLS_TLS1_2,
-	}
+	},
+#ifdef ENABLE_GOST
+	{
+		.name = "TLS 1.3 server, TLS 1.2 client VKO-GOST-12 with cred and GOST-256 cert",
+		.server_ret = 0,
+		.client_ret = 0,
+		.have_cert_cred = 1,
+		.have_gost12_256_cert = 1,
+		.not_on_fips = 1,
+		.server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:"PVERSION,
+		.client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:" "-VERS-ALL:+VERS-TLS1.2",
+		.exp_version = GNUTLS_TLS1_2,
+	},
+	{
+		.name = "TLS 1.3 server, TLS 1.2 client VKO-GOST-12 with cred and GOST-512 cert",
+		.server_ret = 0,
+		.client_ret = 0,
+		.have_cert_cred = 1,
+		.have_gost12_512_cert = 1,
+		.not_on_fips = 1,
+		.server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:"PVERSION,
+		.client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:" "-VERS-ALL:+VERS-TLS1.2",
+		.exp_version = GNUTLS_TLS1_2,
+	},
+	{
+		.name = "TLS 1.2 server TLS 1.3 client VKO-GOST-12 with cred and GOST-256 cert",
+		.server_ret = 0,
+		.client_ret = 0,
+		.have_cert_cred = 1,
+		.have_gost12_256_cert = 1,
+		.not_on_fips = 1,
+		.server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:" "-VERS-ALL:+VERS-TLS1.2",
+		.client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:"PVERSION,
+		.exp_version = GNUTLS_TLS1_2,
+	},
+	{
+		.name = "TLS 1.2 server TLS 1.3 client with cred and GOST-512 cert",
+		.server_ret = 0,
+		.client_ret = 0,
+		.have_cert_cred = 1,
+		.have_gost12_512_cert = 1,
+		.not_on_fips = 1,
+		.server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:" "-VERS-ALL:+VERS-TLS1.2",
+		.client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:"PVERSION,
+		.exp_version = GNUTLS_TLS1_2,
+	},
+	/* Ideally for the next two test cases we should fallback to TLS 1.2 + GOST
+	 * but this is unsuppored for now */
+	{
+		.name = "TLS 1.3 server and client VKO-GOST-12 with cred and GOST-256 cert",
+		.server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+		.client_ret = GNUTLS_E_AGAIN,
+		.have_cert_cred = 1,
+		.have_gost12_256_cert = 1,
+		.not_on_fips = 1,
+		.server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:"PVERSION,
+		.client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:"PVERSION,
+		.exp_version = GNUTLS_TLS1_2,
+	},
+	{
+		.name = "TLS 1.3 server and client VKO-GOST-12 with cred and GOST-512 cert",
+		.server_ret = GNUTLS_E_NO_CIPHER_SUITES,
+		.client_ret = GNUTLS_E_AGAIN,
+		.have_cert_cred = 1,
+		.have_gost12_512_cert = 1,
+		.not_on_fips = 1,
+		.server_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:"PVERSION,
+		.client_prio = "NORMAL:-KX-ALL:+VKO-GOST-12:+GROUP-GOST-ALL:+GOST28147-TC26Z-CNT:+GOST28147-TC26Z-IMIT:+SIGN-GOSTR341012-512:+SIGN-GOSTR341012-256:+SIGN-GOSTR341001:"PVERSION,
+		.exp_version = GNUTLS_TLS1_2,
+	},
+#endif
 };
 
 void doit(void)