Commit graph

1028 commits

Author SHA1 Message Date
Gilles Peskine 3790b4714d Merge branch 'mbedtls-1.3' into mbedtls-1.3-restricted 2017-12-04 18:01:40 +00:00
Gilles Peskine 6e206364d9 Merge remote-tracking branch 'upstream-public/pr/1175' into mbedtls-1.3 2017-12-04 17:21:09 +01:00
Gilles Peskine 258bf599d6 Merge remote-tracking branch 'upstream-restricted/pr/426' into mbedtls-1.3-restricted 2017-12-01 18:03:15 +01:00
Gilles Peskine af86fb9ded Merge branch 'mbedtls-1.3' into mbedtls-1.3-restricted 2017-11-29 21:06:11 +01:00
Gilles Peskine 3a3228cf90 Merge remote-tracking branch 'upstream-public/pr/1155' into mbedtls-1.3 2017-11-29 20:55:11 +01:00
Gilles Peskine 2cd7c18f59 Merge branch 'mbedtls-1.3' into mbedtls-1.3-restricted 2017-11-28 18:43:57 +01:00
Gilles Peskine 8c946113ba Merge branch 'pr_1083' into mbedtls-1.3
Merge PR #1083 plus ChangeLog entry.
2017-11-28 18:42:21 +01:00
Gilles Peskine f15cbdab67 Merge remote-tracking branch 'upstream-public/pr/1109' into mbedtls-1.3 2017-11-28 18:41:31 +01:00
Gilles Peskine f945a2245e Merge remote-tracking branch 'upstream-public/pr/944' into mbedtls-1.3 2017-11-28 18:38:17 +01:00
Gilles Peskine b087a88300 Merge remote-tracking branch 'upstream-restricted/pr/405' into mbedtls-1.3-restricted 2017-11-28 16:22:41 +01:00
Gilles Peskine c5cf89e1cc Merge branch 'mbedtls-1.3' into mbedtls-1.3-restricted 2017-11-28 15:32:00 +01:00
Nicholas Wilson 25f762d248 Allow test suites to be run on Windows
For a start, they don't even compile with Visual Studio due to strcasecmp
being missing.  Secondly, on Windows Perl scripts aren't executable and have
to be run using the Perl interpreter directly; thankfully CMake is able to
find cygwin Perl straight away without problems.
2017-11-28 13:43:06 +00:00
Gilles Peskine 3036cbeb8e Merge branch 'mbedtls-1.3' into mbedtls-1.3-restricted 2017-11-24 16:07:43 +01:00
Gilles Peskine e298532394 Merge remote-tracking branch 'upstream-public/pr/1113' into mbedtls-1.3 2017-11-24 15:38:42 +01:00
Manuel Pégourié-Gonnard 408dfd1f6a Merge remote-tracking branch 'restricted/pr/418' into mbedtls-1.3-restricted
* restricted/pr/418:
  RSA PSS: remove redundant check; changelog
  RSA PSS: fix first byte check for keys of size 8N+1
  RSA PSS: fix minimum length check for keys of size 8N+1
  RSA: Fix another buffer overflow in PSS signature verification
  RSA: Fix buffer overflow in PSS signature verification
2017-11-23 12:16:05 +01:00
Darryl Green 851111dc16 Add tests for invalid private parameters in ecdsa_sign() 2017-11-20 15:54:05 +00:00
Hanno Becker 251bab5ceb Fix heap corruption in ssl_decrypt_buf
Previously, MAC validation for an incoming record proceeded as follows:

1) Make a copy of the MAC contained in the record;
2) Compute the expected MAC in place, overwriting the presented one;
3) Compare both.

This resulted in a record buffer overflow if truncated MAC was used, as in this
case the record buffer only reserved 10 bytes for the MAC, but the MAC
computation routine in 2) always wrote a full digest.

For specially crafted records, this could be used to perform a controlled write of
up to 6 bytes past the boundary of the heap buffer holding the record, thereby
corrupting the heap structures and potentially leading to a crash or remote code
execution.

This commit fixes this by making the following change:
1) Compute the expected MAC in a temporary buffer that has the size of the
   underlying message digest.
2) Compare to this to the MAC contained in the record, potentially
   restricting to the first 10 bytes if truncated HMAC is used.

A similar fix is applied to the encryption routine `ssl_encrypt_buf`.
2017-11-20 10:31:23 +00:00
Hanno Becker be812f68c5 Add build and ssl-opt.sh run for SSL_DISABLE_RENEGOTIATION to all.sh 2017-10-25 09:51:30 +01:00
Hanno Becker e8f3d933e9 Add dep'n on !DISABLE_RENEGOTIATION to renego tests in ssl-opt.sh 2017-10-25 09:51:13 +01:00
Gilles Peskine 5d9224e11c RSA PSS: fix first byte check for keys of size 8N+1
For a key of size 8N+1, check that the first byte after applying the
public key operation is 0 (it could have been 1 instead). The code was
incorrectly doing a no-op check instead, which led to invalid
signatures being accepted. Not a security flaw, since you would need the
private key to craft such an invalid signature, but a bug nonetheless.
2017-10-19 15:47:13 +02:00
Gilles Peskine 7addb7f0a0 RSA PSS: fix minimum length check for keys of size 8N+1
The check introduced by the previous security fix was off by one. It
fixed the buffer overflow but was not compliant with the definition of
PSS which technically led to accepting some invalid signatures (but
not signatures made without the private key).
2017-10-18 19:13:22 +02:00
Gilles Peskine 511bb84c60 RSA: Fix another buffer overflow in PSS signature verification
Fix buffer overflow in RSA-PSS signature verification when the masking
operation results in an all-zero buffer. This could happen at any key size.
2017-10-17 19:33:48 +02:00
Gilles Peskine 55db24ca50 RSA: Fix buffer overflow in PSS signature verification
Fix buffer overflow in RSA-PSS signature verification when the hash is
too large for the key size. Found by Seth Terashima, Qualcomm.

Added a non-regression test and a positive test with the smallest
permitted key size for a SHA-512 hash.
2017-10-17 19:30:12 +02:00
Andres Amaya Garcia 8a6ba0b495 Improve leap year test names in x509parse.data 2017-10-12 21:18:21 +01:00
Andres AG 7c02d13746 Correctly handle leap year in x509_date_is_valid()
This patch ensures that invalid dates on leap years with 100 or 400
years intervals are handled correctly.
2017-10-12 21:08:46 +01:00
Janos Follath ea111c5501 Renegotiation: Add tests for SigAlg ext parsing
This commit adds regression tests for the bug when we didn't parse the
Signature Algorithm extension when renegotiating. (By nature, this bug
affected only the server)

The tests check for the fallback hash (SHA1) in the server log to detect
that the Signature Algorithm extension hasn't been parsed at least in
one of the handshakes.

A more direct way of testing is not possible with the current test
framework, since the Signature Algorithm extension is parsed in the
first handshake and any corresponding debug message is present in the
logs.
2017-10-11 14:06:40 +01:00
Hanno Becker c143653a19 Add tests for encrypted 2048 and 4096-bit RSA keys
This commit adds multiple RSA keys of various sizes and unifies their naming scheme.
2017-10-06 14:31:51 +01:00
Hanno Becker ef4acc569d Minor style and typo corrections 2017-10-05 08:37:56 +01:00
Hanno Becker 524f255c5b Extend x509write_crt suite by RSA_ALT signing test 2017-10-05 08:37:56 +01:00
Hanno Becker 3c89dca09e Omit version from X.509 v1 certificates
The version field in an X.509 certificate is optional and defaults to v1, so it
may be omitted in this case.
2017-10-05 07:39:45 +01:00
Janos Follath 5f9df9b2ad DHM: Add negative tests for parameter checking
A bug in the dhm_check_range() function makes it pass even when the
parameters are not in the range. This commit adds tests for signalling
this problem as well as a couple of other negative tests.
2017-09-21 10:33:13 +01:00
Hanno Becker 3674a4865c Guard some tests by presence of default entropy 2017-09-08 10:56:19 +01:00
Hanno Becker adb9bd23d9 Add internal macro ENTROPY_HAVE_DEFAULT indicating default entropy
This commit adds the macro ENTROPY_HAVE_DEFAULT to the helper test file tests/suites/helpers.function to be able to make
tests depend on the presence of a default entropy source.
2017-09-08 10:53:30 +01:00
Hanno Becker cffe2daf25 Support negative dependencies in test cases
The entropy test suite uses a negative dependency "depends_on:!CONFIG_FLAG" for one of its tests. This kind of
dependency (running a test only if some configuration flag is not defined) is currently not supported and instead
results in the respective test case being dropped.

This commit adds support for negative dependencies in test cases.
2017-09-08 10:39:07 +01:00
Hanno Becker 65382c38e8 Fix typos in entropy test data 2017-09-08 10:36:26 +01:00
Hanno Becker 8cd5d43639 Initialize RSA context in RSA test suite before first potentially failing operation
The function `rsa_gen_key` from `test_suite_rsa.function` initialized a stack allocated RSA context only after
seeding the CTR DRBG. If the latter operation failed, the cleanup code tried to free the uninitialized RSA context,
potentially resulting in a segmentation fault. Fixes one aspect of #1023.
2017-09-08 10:35:32 +01:00
Simon Butcher 03bd0229ab Update version to 1.3.21 2017-08-10 11:52:14 +01:00
Simon Butcher e513cf7f26 Remove the check in ssl-opt.sh for MAX_INTERMEDIATE_CA
The check uses grep, not config.pl, on the x509 headers - not where it should
be configured - config.h. grep syntax isn't very portable. Without config.pl
it's quite hard to do this check properly so removing this check.
2017-07-28 13:16:50 +01:00
Simon Butcher 4c338d539a Fix threshold checks for MBEDTLS_X509_MAX_INTERMEDIATE_CA 2017-07-28 13:16:50 +01:00
Hanno Becker 88252333e2 Fix typo 2017-07-28 13:15:57 +01:00
Hanno Becker 63ee8c1b73 Check threshold for POLARSSL_X509_MAX_INTERMEDIATE_CA in X509 tests
The X509 test suite assumes that POLARSSL_X509_MAX_INTERMEDIATE_CA is below
the hardcoded threshold 20 used in the long certificate chain generating
script tests/data_files/dir-max/long.sh. This commit adds a compile-time
check for that.
2017-07-28 13:15:57 +01:00
Hanno Becker 806c680eba Improve Readme for long test certificate chains 2017-07-28 13:15:57 +01:00
Hanno Becker 5a0ea97cfb Check value of POLARSSL_X509_MAX_INTERMEDIATE_CA in ssl-opt.sh
Some tests in ssl-opt.sh assumes the value 8 for the maximal number
POLARSSL_X509_MAX_INTERMEDIATE_CA of intermediate CA's. This commit
adds a check before conducting the respective tests.
2017-07-28 13:15:57 +01:00
Janos Follath 1fbc5fb027 Fix typos 2017-07-28 13:15:57 +01:00
Manuel Pégourié-Gonnard 33e8d34e95 Fix filtering bug in ssl-opt.sh
If the first test to be run according to -e and -f options is just after a
test that would have been skipped due to a require_xxx instruction, then it
would be incorrectly skipped.
2017-07-28 13:15:57 +01:00
Manuel Pégourié-Gonnard e23f7b312d Make test script more portable
seq isn't POSIX and isn't present by default on BSDs
2017-07-28 13:15:57 +01:00
Manuel Pégourié-Gonnard 77644f2815 Improve comments 2017-07-28 13:15:57 +01:00
Manuel Pégourié-Gonnard a68d591176 Add SSL tests for long cert chains 2017-07-28 13:15:57 +01:00
Manuel Pégourié-Gonnard d0e755716f Only return VERIFY_FAILED from a single point
Everything else is a fatal error. Also improve documentation about that for
the vrfy callback.
2017-07-28 13:15:57 +01:00
Manuel Pégourié-Gonnard 8af7bfa982 Improve behaviour on fatal errors
If we didn't walk the whole chain, then there may be any kind of errors in the
part of the chain we didn't check, so setting all flags looks like the safe
thing to do.
2017-07-28 13:15:57 +01:00