1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
|
from test_util import run, assert_equal
import os
import nose
from nose.tools import make_decorator
# This file is auto-generated by configure
from variable import ENABLE_SHA384, ENABLE_GCM, ENABLE_SERVER_DHE
cwd = os.getcwd()
srcdir = os.path.dirname(cwd)
exe = "%s/test_cipher" % srcdir
openssl = "/usr/bin/openssl"
ciphernum = 0
CIPHERS_NOT_IN_NSS = ['ECDH-RSA-AES128-SHA256',
'ECDH-ECDSA-AES128-GCM-SHA256',
'ECDH-ECDSA-AES128-SHA256',
'ECDH-RSA-AES128-GCM-SHA256',
'EXP-DES-CBC-SHA',
'ECDH-RSA-AES256-GCM-SHA384',
'ECDH-ECDSA-AES256-SHA384',
'ECDH-RSA-AES256-SHA384',
'ECDH-ECDSA-AES256-GCM-SHA384',
'EXP-EDH-RSA-DES-CBC-SHA',
]
OPENSSL_CIPHERS_IGNORE = ":-SSLv2:-KRB5:-PSK:-ADH:-DSS:-SEED:-IDEA"
if ENABLE_SERVER_DHE == 0:
OPENSSL_CIPHERS_IGNORE += ':-DH'
def assert_equal_openssl(ciphers):
nss_ciphers = ciphers
ossl_ciphers = ciphers + OPENSSL_CIPHERS_IGNORE
(nss, err, rc) = run([exe, "--o", nss_ciphers])
assert rc == 0
(ossl, err, rc) = run([openssl, "ciphers", ossl_ciphers])
assert rc == 0
nss_list = nss.strip().split(':')
nss_list.sort()
ossl_list = ossl.strip().split(':')
ossl_list = list(set(ossl_list))
ossl_list.sort()
# NSS doesn't support the SHA-384 ciphers, remove them from the OpenSSL
# output.
t = list()
for o in ossl_list:
if not ENABLE_SHA384 and 'SHA384' in o:
continue
if not ENABLE_GCM and 'GCM' in o:
continue
if o in CIPHERS_NOT_IN_NSS:
continue
t.append(o)
ossl_list = t
if len(nss_list) > len(ossl_list):
diff = set(nss_list) - set(ossl_list)
elif len(ossl_list) > len(nss_list):
diff = set(ossl_list) - set(nss_list)
else:
diff = ''
assert nss_list == ossl_list, '%r != %r. Difference %r' % (':'.join(nss_list), ':'.join(ossl_list), diff)
def assert_no_NULL(nss_ciphers):
(nss, err, rc) = run([exe, "--o", nss_ciphers])
assert rc == 0
assert('NULL' not in nss)
class test_ciphers(object):
@classmethod
def setUpClass(cls):
(out, err, rc) = run([exe, "--count"])
assert rc == 0
cls.ciphernum = int(out)
def test_RSA(self):
assert_equal_openssl("RSA")
def test_kRSA(self):
assert_equal_openssl("kRSA")
def test_aRSA(self):
assert_equal_openssl("aRSA")
def test_EDH(self):
assert_equal_openssl("EDH")
def test_DH(self):
assert_equal_openssl("DH")
def test_RC4(self):
assert_equal_openssl("RC4")
def test_RC2(self):
assert_equal_openssl("RC2")
def test_AES(self):
assert_equal_openssl("AES")
def test_AESGCM(self):
assert_equal_openssl("AESGCM")
def test_AES128(self):
assert_equal_openssl("AES128")
def test_AES256(self):
assert_equal_openssl("AES256")
def test_CAMELLIA(self):
assert_equal_openssl("CAMELLIA")
def test_CAMELLIA128(self):
assert_equal_openssl("CAMELLIA128")
def test_CAMELLIA256(self):
assert_equal_openssl("CAMELLIA256")
def test_3DES(self):
assert_equal_openssl("3DES")
def test_DES(self):
assert_equal_openssl("DES")
def test_ALL(self):
assert_equal_openssl("ALL")
def test_ALL_no_AES(self):
assert_equal_openssl("ALL:-AES")
def test_COMPLEMENTOFALL(self):
assert_equal_openssl("COMPLEMENTOFALL")
# skipping DEFAULT as we use the NSS defaults
# skipping COMPLEMENTOFDEFAULT as these are all ADH ciphers
def test_SSLv3(self):
assert_equal_openssl("SSLv3")
def test_SSLv3_equals_TLSv1(self):
(nss, err, rc) = run([exe, "--o", "SSLv3"])
(nss2, err, rc2) = run([exe, "--o", "TLSv1"])
assert rc == 0
assert rc2 == 0
assert_equal(nss, nss2)
def test_TLSv12(self):
assert_equal_openssl("TLSv1.2")
def test_NULL(self):
assert_equal_openssl("NULL")
def test_nss_rsa_rc4_128(self):
# Test NSS cipher parsing
(out, err, rc) = run([exe, "+rsa_rc4_128_md5,+rsa_rc4_128_sha"])
assert rc == 0
assert_equal(out, 'rsa_rc4_128_md5, rsa_rc4_128_sha')
def test_EXP(self):
assert_equal_openssl("EXP")
def test_EXPORT(self):
assert_equal_openssl("EXPORT")
def test_EXPORT40(self):
assert_equal_openssl("EXPORT40")
def test_MD5(self):
assert_equal_openssl("MD5")
def test_SHA(self):
assert_equal_openssl("SHA")
def test_HIGH(self):
assert_equal_openssl("HIGH")
def test_MEDIUM(self):
assert_equal_openssl("MEDIUM")
def test_LOW(self):
assert_equal_openssl("LOW")
def test_SHA256(self):
assert_equal_openssl("SHA256")
def test_SHA_MD5_minus_AES(self):
assert_equal_openssl("SHA:MD5:-AES")
def test_SHA_MD5_not_AES(self):
assert_equal_openssl("!AES:SHA:MD5")
def test_aECDH(self):
assert_equal_openssl("aECDH")
def test_kECDH(self):
assert_equal_openssl("kECDH")
def test_kECDHe(self):
assert_equal_openssl("kECDHe")
def test_kECDHr(self):
assert_equal_openssl("kECDHr")
def test_kEECDH(self):
assert_equal_openssl("kEECDH")
def test_AECDH(self):
assert_equal_openssl("AECDH")
def test_EECDH(self):
assert_equal_openssl("EECDH")
def test_ECDSA(self):
assert_equal_openssl("ECDSA")
def test_aECDSA(self):
assert_equal_openssl("aECDSA")
def test_ECDH(self):
assert_equal_openssl("ECDH")
def test_AES_no_ECDH(self):
assert_equal_openssl("AES:-ECDH")
def test_AES_plus_RSA(self):
assert_equal_openssl("AES+RSA")
def test_logical_and_3DES_RSA(self):
assert_equal_openssl("3DES+RSA")
def test_logical_and_RSA_RC4(self):
assert_equal_openssl("RSA+RC4")
def test_logical_and_ECDH_SHA(self):
assert_equal_openssl("ECDH+SHA")
def test_logical_and_RSA_RC4_no_SHA(self):
assert_equal_openssl("RSA+RC4:!SHA")
def test_additive_RSA_RC4(self):
assert_equal_openssl("RSA:+RC4")
def test_additive_ECDH_plus_aRSA(self):
assert_equal_openssl("ECDH+aRSA")
def test_negative_plus_RSA_MD5(self):
assert_equal_openssl("-RC2:RSA+MD5")
def test_DEFAULT_aRSA(self):
assert_no_NULL("DEFAULT:aRSA")
def test_nss_subtraction(self):
(out, err, rc) = run([exe, "+rsa_rc4_128_md5,+rsa_rc4_128_sha,-rsa_rc4_128_md5"])
assert rc == 0
assert_equal(out, 'rsa_rc4_128_sha')
def test_openssl_cipher(self):
(out, err, rc) = run([exe, "DES-CBC3-SHA"])
assert rc == 0
assert_equal(out, 'rsa_3des_sha')
def test_openssl_cipherlist(self):
(out, err, rc) = run([exe, "DES-CBC3-SHA:RC4-SHA"])
assert rc == 0
assert_equal(out, 'rsa_rc4_128_sha, rsa_3des_sha')
# As long as at least one is valid, things are ok
def test_nss_unknown(self):
(out, err, rc) = run([exe, "+rsa_rc4_128_md5,+unknown"])
assert rc == 0
assert_equal(out, 'rsa_rc4_128_md5')
def test_nss_single(self):
(out, err, rc) = run([exe, "+aes_128_sha_256"])
assert rc == 0
assert_equal(out, 'aes_128_sha_256')
def test_openssl_single_cipher(self):
assert_equal_openssl("RC4-SHA")
def test_invalid_format(self):
(out, err, rc) = run([exe, "none"])
assert rc == 1
|
