yuzu-mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-mirror/mbedtls.git synced 2026-04-05 06:26:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

Add tests for enforced extended master secret flag

Browse source
This commit is contained in:
Jarno Lamsa 2019-06-10 15:51:11 +03:00
parent 18b9a491e1
commit 41b359114d
3 changed files with 82 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

25
programs/ssl/ssl_client2.c
View file

@ -122,6 +122,7 @@ int main( void )
#define DFL_FALLBACK -1
#define DFL_EXTENDED_MS -1
#define DFL_ETM -1
#define DFL_EXTENDED_MS_ENFORCE -1
#define GET_REQUEST "GET %s HTTP/1.0\r\nExtra-header: "
#define GET_REQUEST_END "\r\n\r\n"
@ -243,7 +244,8 @@ int main( void )
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
#define USAGE_EMS \
" extended_ms=0/1 default: (library default: on)\n"
" extended_ms=0/1 default: (library default: on)\n" \
" enforce_extended_master_secret=0/1 default: (library default: off)\n"
#else
#define USAGE_EMS ""
#endif
@ -410,6 +412,8 @@ struct options
int fallback; /* is this a fallback connection? */
int dgram_packing; /* allow/forbid datagram packing */
int extended_ms; /* negotiate extended master secret? */
int enforce_extended_master_secret; /* Enforce the usage of extended
* master secret */
int etm; /* negotiate encrypt then mac? */
int cid_enabled; /* whether to use the CID extension or not */
int cid_enabled_renego; /* whether to use the CID extension or not
@ -825,6 +829,7 @@ int main( int argc, char *argv[] )
opt.dtls_mtu = DFL_DTLS_MTU;
opt.fallback = DFL_FALLBACK;
opt.extended_ms = DFL_EXTENDED_MS;
opt.enforce_extended_master_secret = DFL_EXTENDED_MS_ENFORCE;
opt.etm = DFL_ETM;
opt.dgram_packing = DFL_DGRAM_PACKING;
@ -1025,6 +1030,21 @@ int main( int argc, char *argv[] )
default: goto usage;
}
}
else if( strcmp( p, "enforce_extended_master_secret" ) == 0 )
{
switch( atoi( q ) )
{
case 0:
opt.enforce_extended_master_secret =
MBEDTLS_SSL_EXTENDED_MS_ENFORCE_DISABLED;
break;
case 1:
opt.enforce_extended_master_secret =
MBEDTLS_SSL_EXTENDED_MS_ENFORCE_ENABLED;
break;
default: goto usage;
}
}
else if( strcmp( p, "curves" ) == 0 )
opt.curves = q;
else if( strcmp( p, "etm" ) == 0 )
@ -1638,6 +1658,9 @@ int main( int argc, char *argv[] )
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
if( opt.extended_ms != DFL_EXTENDED_MS )
mbedtls_ssl_conf_extended_master_secret( &conf, opt.extended_ms );
if( opt.enforce_extended_master_secret != DFL_EXTENDED_MS_ENFORCE )
mbedtls_ssl_conf_extended_master_secret_enforce( &conf,
opt.enforce_extended_master_secret );
#endif
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)

25
programs/ssl/ssl_server2.c
View file

@ -163,6 +163,7 @@ int main( void )
#define DFL_DGRAM_PACKING 1
#define DFL_EXTENDED_MS -1
#define DFL_ETM -1
#define DFL_EXTENDED_MS_ENFORCE -1
#define LONG_RESPONSE "<p>01-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \
"02-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \
@ -342,7 +343,8 @@ int main( void )
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
#define USAGE_EMS \
" extended_ms=0/1 default: (library default: on)\n"
" extended_ms=0/1 default: (library default: on)\n" \
" enforce_extended_master_secret=0/1 default: (library default: off)\n"
#else
#define USAGE_EMS ""
#endif
@ -525,6 +527,8 @@ struct options
const char *alpn_string; /* ALPN supported protocols */
const char *dhm_file; /* the file with the DH parameters */
int extended_ms; /* allow negotiation of extended MS? */
int enforce_extended_master_secret; /* Enforce the usage of extended
* master secret */
int etm; /* allow negotiation of encrypt-then-MAC? */
int transport; /* TLS or DTLS? */
int cookies; /* Use cookies for DTLS? -1 to break them */
@ -1494,6 +1498,7 @@ int main( int argc, char *argv[] )
opt.dgram_packing = DFL_DGRAM_PACKING;
opt.badmac_limit = DFL_BADMAC_LIMIT;
opt.extended_ms = DFL_EXTENDED_MS;
opt.enforce_extended_master_secret = DFL_EXTENDED_MS_ENFORCE;
opt.etm = DFL_ETM;
for( i = 1; i < argc; i++ )
@ -1813,6 +1818,21 @@ int main( int argc, char *argv[] )
default: goto usage;
}
}
else if( strcmp( p, "enforce_extended_master_secret" ) == 0 )
{
switch( atoi( q ) )
{
case 0:
opt.enforce_extended_master_secret =
MBEDTLS_SSL_EXTENDED_MS_ENFORCE_DISABLED;
break;
case 1:
opt.enforce_extended_master_secret =
MBEDTLS_SSL_EXTENDED_MS_ENFORCE_ENABLED;
break;
default: goto usage;
}
}
else if( strcmp( p, "etm" ) == 0 )
{
switch( atoi( q ) )
@ -2440,6 +2460,9 @@ int main( int argc, char *argv[] )
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
if( opt.extended_ms != DFL_EXTENDED_MS )
mbedtls_ssl_conf_extended_master_secret( &conf, opt.extended_ms );
if( opt.enforce_extended_master_secret != DFL_EXTENDED_MS_ENFORCE )
mbedtls_ssl_conf_extended_master_secret_enforce( &conf,
opt.enforce_extended_master_secret );
#endif
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)