summaryrefslogtreecommitdiff
path: root/tests/common-cert-key-exchange.c
Commit message (Collapse)AuthorAgeFilesLines
* raw public keys: apply the key usage bits the same way as X.509Nikos Mavrogiannopoulos2019-02-061-0/+92
| | | | | | | That is, we require a signing certificate when negotiating TLS1.3, or when sending a client certificate (on all cases). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Fallback to TLS 1.2 when incompatible with signature certs are providedNikos Mavrogiannopoulos2019-02-061-29/+28
| | | | | | | | | | This only takes into account certificates in the credentials structure. If certificates are provided in a callback, these must be checked by the provider. For that we assume that the credentials structure is filled when associated with a session; if not then the fallback mechanism will not work and the handshake will fail. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Implemented support for raw public-key functionality (RFC7250).Tom Vrancken2018-12-151-22/+49
| | | | Signed-off-by: Tom Vrancken <dev@tomvrancken.nl>
* ANON,SRP,NULL ciphersuites: when set do not negotiate TLS1.3 or laterNikos Mavrogiannopoulos2018-04-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | The reason is that these ciphersuites cannot be negotiated using TLS1.3. There is a different strategy followed for these. * NULL ciphersuites: they are not something normally enabled and used for debugging purposes mostly. When set both in client and server side only TLS1.2 can be used. * SRP ciphersuites: they are used on client side when the client is actually performing a username-password authentication with SRP. On server side we can have indeed a server support SRP and non-SRP. In that case we limit both on TLS1.2. That an unfortunate restriction, but is not a regression and IMHO these servers would most likely be phased out as very few would want to stick to TLS1.2 connections for SRP; or we may have an SRP update for TLS1.3 which could lift that limitation in the future. * ANON ciphersuites: they are used in certain client/server setups where very basic level of security is required, and in opportunistic encryption scenarios. There is a difference in the handling of these cases. In the case of Anon-only server/clients they provide the session with anonymous credentials structure; in the case of opportunistic encryption they provide both certificate and anonymous credentials. Thus we allow the protocol (TLS1.3) be in the priorities, but if we see no certificate or PSK credentials we disable TLS1.3 negotiation. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added negative tests for RSA-PSS key exchangeNikos Mavrogiannopoulos2018-03-091-0/+88
| | | | | | Relates #400 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test for hello retry request supportNikos Mavrogiannopoulos2018-02-191-2/+15
| | | | | | Resolves #285 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: introduced basic TLS1.3 key exchange test suiteNikos Mavrogiannopoulos2018-02-191-3/+9
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Revert "priority: disable the enabled by default RSA-PSS signature algorithms"Nikos Mavrogiannopoulos2018-02-191-4/+2
| | | | | | This reverts commit ef44477127952c13e93d7ea88f7b549bf36602f5. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* priority: disable the enabled by default RSA-PSS signature algorithmstmp-tests-include-ccmNikos Mavrogiannopoulos2018-02-121-2/+4
| | | | | | | | They have been modified in the latest (yet unsupported) TLS 1.3 drafts, so prevent causes interoperability failures by keeping them on. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: added reproducer for DTLS infinite loopNikos Mavrogiannopoulos2017-09-191-2/+9
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added TLS handshake test with EdDSA25519 certificatesNikos Mavrogiannopoulos2017-07-171-2/+5
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: key-exchange: added error checking in gnutls_certificate_set_x509_key_memtmp-more-rsa-pss-related-changesNikos Mavrogiannopoulos2017-06-061-3/+12
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added tests for RSA-PSS key exchange under TLS 1.2Nikos Mavrogiannopoulos2017-05-291-31/+28
| | | | | | That includes tests with RSA and RSA-PSS server and client certificates. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* several spacing fixes to keep syntax-check happyNikos Mavrogiannopoulos2016-09-111-4/+4
|
* tests: added key exchange checks for all DTLS protocolsNikos Mavrogiannopoulos2016-05-141-0/+167
|
* tests: separated the key exchange checksNikos Mavrogiannopoulos2016-05-141-0/+211
That is introduce separate checks for each key exchange on every TLS version.
View Lorry Controller Status