blob: 1403385a5d3bbe4d713d5534d9c019738b979037 [file] [log] [blame]
Jerry Yu305bfc32021-11-24 16:04:47 +08001#!/usr/bin/env python3
2
3# generate_tls13_compat_tests.py
4#
5# Copyright The Mbed TLS Contributors
6# SPDX-License-Identifier: Apache-2.0
7#
8# Licensed under the Apache License, Version 2.0 (the "License"); you may
9# not use this file except in compliance with the License.
10# You may obtain a copy of the License at
11#
12# http://www.apache.org/licenses/LICENSE-2.0
13#
14# Unless required by applicable law or agreed to in writing, software
15# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17# See the License for the specific language governing permissions and
18# limitations under the License.
19
20"""
21Generate TLSv1.3 Compat test cases
22
23"""
24
25import sys
Jerry Yudda036d2021-11-30 11:19:41 +080026import os
Jerry Yu305bfc32021-11-24 16:04:47 +080027import argparse
Jerry Yuc4aa1522021-11-26 11:13:58 +080028import itertools
Jerry Yu882c30d2021-12-01 10:59:59 +080029from collections import namedtuple
Jerry Yu305bfc32021-11-24 16:04:47 +080030
Jerry Yu882c30d2021-12-01 10:59:59 +080031# define certificates configuration entry
32Certificate = namedtuple("Certificate", ['cafile', 'certfile', 'keyfile'])
33# define the certificate parameters for signature algorithms
Jerry Yu305bfc32021-11-24 16:04:47 +080034CERTIFICATES = {
Jerry Yu882c30d2021-12-01 10:59:59 +080035 'ecdsa_secp256r1_sha256': Certificate('data_files/test-ca2.crt',
36 'data_files/ecdsa_secp256r1.crt',
37 'data_files/ecdsa_secp256r1.key'),
38 'ecdsa_secp384r1_sha384': Certificate('data_files/test-ca2.crt',
39 'data_files/ecdsa_secp384r1.crt',
40 'data_files/ecdsa_secp384r1.key'),
41 'ecdsa_secp521r1_sha512': Certificate('data_files/test-ca2.crt',
42 'data_files/ecdsa_secp521r1.crt',
43 'data_files/ecdsa_secp521r1.key'),
44 'rsa_pss_rsae_sha256': Certificate('data_files/test-ca_cat12.crt',
45 'data_files/server2-sha256.crt', 'data_files/server2.key'
46 )
Jerry Yu29deed42021-11-25 11:09:54 +080047}
Jerry Yu305bfc32021-11-24 16:04:47 +080048
49CIPHER_SUITE_IANA_VALUE = {
50 "TLS_AES_128_GCM_SHA256": 0x1301,
51 "TLS_AES_256_GCM_SHA384": 0x1302,
52 "TLS_CHACHA20_POLY1305_SHA256": 0x1303,
53 "TLS_AES_128_CCM_SHA256": 0x1304,
54 "TLS_AES_128_CCM_8_SHA256": 0x1305
55}
56
57SIG_ALG_IANA_VALUE = {
58 "ecdsa_secp256r1_sha256": 0x0403,
59 "ecdsa_secp384r1_sha384": 0x0503,
60 "ecdsa_secp521r1_sha512": 0x0603,
Jerry Yu29deed42021-11-25 11:09:54 +080061 'rsa_pss_rsae_sha256': 0x0804,
Jerry Yu305bfc32021-11-24 16:04:47 +080062}
63
64NAMED_GROUP_IANA_VALUE = {
65 'secp256r1': 0x17,
66 'secp384r1': 0x18,
67 'secp521r1': 0x19,
68 'x25519': 0x1d,
69 'x448': 0x1e,
70}
71
XiaokangQian68a87e42022-03-17 06:06:07 +000072
Jerry Yub7c12a42022-06-12 20:53:02 +080073class TLSProgram:
Jerry Yu305bfc32021-11-24 16:04:47 +080074 """
75 Base class for generate server/client command.
76 """
Jerry Yub7c12a42022-06-12 20:53:02 +080077
Jerry Yu7de79852022-03-23 16:50:47 +080078 # pylint: disable=too-many-arguments
XiaokangQiana1931442022-03-25 11:58:22 +000079 def __init__(self, ciphersuite=None, signature_algorithm=None, named_group=None,
80 cert_sig_alg=None, compat_mode=True):
Jerry Yu7918efe2021-12-01 15:29:10 +080081 self._ciphers = []
82 self._sig_algs = []
83 self._named_groups = []
Jerry Yu7de79852022-03-23 16:50:47 +080084 self._cert_sig_algs = []
85 if ciphersuite:
86 self.add_ciphersuites(ciphersuite)
87 if named_group:
88 self.add_named_groups(named_group)
89 if signature_algorithm:
90 self.add_signature_algorithms(signature_algorithm)
91 if cert_sig_alg:
92 self.add_cert_signature_algorithms(cert_sig_alg)
Ronald Cronae937252021-12-10 09:55:15 +010093 self._compat_mode = compat_mode
Jerry Yu305bfc32021-11-24 16:04:47 +080094
Jerry Yu7918efe2021-12-01 15:29:10 +080095 # add_ciphersuites should not override by sub class
Jerry Yu305bfc32021-11-24 16:04:47 +080096 def add_ciphersuites(self, *ciphersuites):
Jerry Yu7918efe2021-12-01 15:29:10 +080097 self._ciphers.extend(
98 [cipher for cipher in ciphersuites if cipher not in self._ciphers])
Jerry Yu305bfc32021-11-24 16:04:47 +080099
Jerry Yu7918efe2021-12-01 15:29:10 +0800100 # add_signature_algorithms should not override by sub class
Jerry Yu305bfc32021-11-24 16:04:47 +0800101 def add_signature_algorithms(self, *signature_algorithms):
Jerry Yu7918efe2021-12-01 15:29:10 +0800102 self._sig_algs.extend(
103 [sig_alg for sig_alg in signature_algorithms if sig_alg not in self._sig_algs])
Jerry Yu305bfc32021-11-24 16:04:47 +0800104
Jerry Yu7de79852022-03-23 16:50:47 +0800105 # add_named_groups should not override by sub class
Jerry Yu305bfc32021-11-24 16:04:47 +0800106 def add_named_groups(self, *named_groups):
Jerry Yu7918efe2021-12-01 15:29:10 +0800107 self._named_groups.extend(
108 [named_group for named_group in named_groups if named_group not in self._named_groups])
Jerry Yu305bfc32021-11-24 16:04:47 +0800109
Jerry Yu7de79852022-03-23 16:50:47 +0800110 # add_cert_signature_algorithms should not override by sub class
111 def add_cert_signature_algorithms(self, *signature_algorithms):
112 self._cert_sig_algs.extend(
113 [sig_alg for sig_alg in signature_algorithms if sig_alg not in self._cert_sig_algs])
114
Jerry Yub7c12a42022-06-12 20:53:02 +0800115 # pylint: disable=no-self-use
Jerry Yu305bfc32021-11-24 16:04:47 +0800116 def pre_checks(self):
117 return []
118
Jerry Yub7c12a42022-06-12 20:53:02 +0800119 # pylint: disable=no-self-use
Jerry Yu305bfc32021-11-24 16:04:47 +0800120 def cmd(self):
Jerry Yu7de79852022-03-23 16:50:47 +0800121 if not self._cert_sig_algs:
122 self._cert_sig_algs = list(CERTIFICATES.keys())
Jerry Yub7c12a42022-06-12 20:53:02 +0800123 return self.pre_cmd()
Jerry Yu305bfc32021-11-24 16:04:47 +0800124
Jerry Yub7c12a42022-06-12 20:53:02 +0800125 # pylint: disable=no-self-use
Jerry Yu305bfc32021-11-24 16:04:47 +0800126 def post_checks(self):
127 return []
128
Jerry Yub7c12a42022-06-12 20:53:02 +0800129 # pylint: disable=no-self-use
XiaokangQianb1847a22022-06-08 07:49:31 +0000130 def pre_cmd(self):
Jerry Yub7c12a42022-06-12 20:53:02 +0800131 return ['false']
Jerry Yu305bfc32021-11-24 16:04:47 +0800132
Jerry Yub7c12a42022-06-12 20:53:02 +0800133 # pylint: disable=unused-argument,no-self-use
XiaokangQian9b938b72022-06-10 03:10:59 +0000134 def hrr_post_checks(self, named_group):
135 return []
136
XiaokangQianb1847a22022-06-08 07:49:31 +0000137
138class OpenSSLBase(TLSProgram):
Jerry Yu305bfc32021-11-24 16:04:47 +0800139 """
XiaokangQianb1847a22022-06-08 07:49:31 +0000140 Generate base test commands for OpenSSL.
Jerry Yu305bfc32021-11-24 16:04:47 +0800141 """
Jerry Yu305bfc32021-11-24 16:04:47 +0800142
143 NAMED_GROUP = {
144 'secp256r1': 'P-256',
145 'secp384r1': 'P-384',
146 'secp521r1': 'P-521',
147 'x25519': 'X25519',
148 'x448': 'X448',
149 }
150
Jerry Yu305bfc32021-11-24 16:04:47 +0800151 def cmd(self):
Jerry Yub7c12a42022-06-12 20:53:02 +0800152 ret = super().cmd()
XiaokangQiand5d5b602022-05-23 09:16:20 +0000153
154 if self._ciphers:
155 ciphersuites = ':'.join(self._ciphers)
156 ret += ["-ciphersuites {ciphersuites}".format(ciphersuites=ciphersuites)]
157
158 if self._sig_algs:
159 signature_algorithms = set(self._sig_algs + self._cert_sig_algs)
160 signature_algorithms = ':'.join(signature_algorithms)
161 ret += ["-sigalgs {signature_algorithms}".format(
162 signature_algorithms=signature_algorithms)]
163
164 if self._named_groups:
165 named_groups = ':'.join(
166 map(lambda named_group: self.NAMED_GROUP[named_group], self._named_groups))
167 ret += ["-groups {named_groups}".format(named_groups=named_groups)]
168
169 ret += ['-msg -tls1_3']
170 if not self._compat_mode:
171 ret += ['-no_middlebox']
172
XiaokangQianb1847a22022-06-08 07:49:31 +0000173 return ret
174
175 def pre_checks(self):
176 return ["requires_openssl_tls1_3"]
177
XiaokangQianb1847a22022-06-08 07:49:31 +0000178
179class OpenSSLServ(OpenSSLBase):
180 """
181 Generate test commands for OpenSSL server.
182 """
183
184 def cmd(self):
Jerry Yub7c12a42022-06-12 20:53:02 +0800185 ret = super().cmd()
XiaokangQianb1847a22022-06-08 07:49:31 +0000186 ret += ['-num_tickets 0 -no_resume_ephemeral -no_cache']
Jerry Yub7c12a42022-06-12 20:53:02 +0800187 return ret
XiaokangQiand5d5b602022-05-23 09:16:20 +0000188
XiaokangQiand5d5b602022-05-23 09:16:20 +0000189 def post_checks(self):
XiaokangQianb1847a22022-06-08 07:49:31 +0000190 return ['-c "HTTP/1.0 200 ok"']
191
192 def pre_cmd(self):
Jerry Yub7c12a42022-06-12 20:53:02 +0800193 ret = ['$O_NEXT_SRV_NO_CERT']
194 for _, cert, key in map(lambda sig_alg: CERTIFICATES[sig_alg], self._cert_sig_algs):
195 ret += ['-cert {cert} -key {key}'.format(cert=cert, key=key)]
196 return ret
197
198
199class OpenSSLCli(OpenSSLBase):
200 """
201 Generate test commands for OpenSSL client.
202 """
203
204 def pre_cmd(self):
205 return ['$O_NEXT_CLI_NO_CERT',
206 '-CAfile {cafile}'.format(cafile=CERTIFICATES[self._cert_sig_algs[0]].cafile)]
XiaokangQiand5d5b602022-05-23 09:16:20 +0000207
208
XiaokangQianb1847a22022-06-08 07:49:31 +0000209class GnuTLSBase(TLSProgram):
XiaokangQiand5d5b602022-05-23 09:16:20 +0000210 """
XiaokangQianb1847a22022-06-08 07:49:31 +0000211 Generate base test commands for GnuTLS.
XiaokangQiand5d5b602022-05-23 09:16:20 +0000212 """
213
214 CIPHER_SUITE = {
215 'TLS_AES_256_GCM_SHA384': [
216 'AES-256-GCM',
217 'SHA384',
218 'AEAD'],
219 'TLS_AES_128_GCM_SHA256': [
220 'AES-128-GCM',
221 'SHA256',
222 'AEAD'],
223 'TLS_CHACHA20_POLY1305_SHA256': [
224 'CHACHA20-POLY1305',
225 'SHA256',
226 'AEAD'],
227 'TLS_AES_128_CCM_SHA256': [
228 'AES-128-CCM',
229 'SHA256',
230 'AEAD'],
231 'TLS_AES_128_CCM_8_SHA256': [
232 'AES-128-CCM-8',
233 'SHA256',
234 'AEAD']}
235
236 SIGNATURE_ALGORITHM = {
237 'ecdsa_secp256r1_sha256': ['SIGN-ECDSA-SECP256R1-SHA256'],
238 'ecdsa_secp521r1_sha512': ['SIGN-ECDSA-SECP521R1-SHA512'],
239 'ecdsa_secp384r1_sha384': ['SIGN-ECDSA-SECP384R1-SHA384'],
240 'rsa_pss_rsae_sha256': ['SIGN-RSA-PSS-RSAE-SHA256']}
241
242 NAMED_GROUP = {
243 'secp256r1': ['GROUP-SECP256R1'],
244 'secp384r1': ['GROUP-SECP384R1'],
245 'secp521r1': ['GROUP-SECP521R1'],
246 'x25519': ['GROUP-X25519'],
247 'x448': ['GROUP-X448'],
248 }
249
250 def pre_checks(self):
251 return ["requires_gnutls_tls1_3",
252 "requires_gnutls_next_no_ticket",
253 "requires_gnutls_next_disable_tls13_compat", ]
254
XiaokangQiand5d5b602022-05-23 09:16:20 +0000255 def cmd(self):
Jerry Yub7c12a42022-06-12 20:53:02 +0800256 ret = super().cmd()
XiaokangQiand5d5b602022-05-23 09:16:20 +0000257
258 priority_string_list = []
259
260 def update_priority_string_list(items, map_table):
261 for item in items:
262 for i in map_table[item]:
263 if i not in priority_string_list:
264 yield i
265
266 if self._ciphers:
267 priority_string_list.extend(update_priority_string_list(
268 self._ciphers, self.CIPHER_SUITE))
269 else:
270 priority_string_list.extend(['CIPHER-ALL', 'MAC-ALL'])
271
272 if self._sig_algs:
273 signature_algorithms = set(self._sig_algs + self._cert_sig_algs)
274 priority_string_list.extend(update_priority_string_list(
275 signature_algorithms, self.SIGNATURE_ALGORITHM))
276 else:
277 priority_string_list.append('SIGN-ALL')
278
279
280 if self._named_groups:
281 priority_string_list.extend(update_priority_string_list(
282 self._named_groups, self.NAMED_GROUP))
283 else:
284 priority_string_list.append('GROUP-ALL')
285
286 priority_string_list = ['NONE'] + \
287 priority_string_list + ['VERS-TLS1.3']
288
289 priority_string = ':+'.join(priority_string_list)
290 priority_string += ':%NO_TICKETS'
291
292 if not self._compat_mode:
293 priority_string += [':%DISABLE_TLS13_COMPAT_MODE']
294
295 ret += ['--priority={priority_string}'.format(
296 priority_string=priority_string)]
XiaokangQianb1847a22022-06-08 07:49:31 +0000297 return ret
298
299class GnuTLSServ(GnuTLSBase):
300 """
301 Generate test commands for GnuTLS server.
302 """
303
Jerry Yub7c12a42022-06-12 20:53:02 +0800304 def pre_cmd(self):
305 ret = ['$G_NEXT_SRV_NO_CERT', '--http', '--disable-client-cert', '--debug=4']
XiaokangQianb1847a22022-06-08 07:49:31 +0000306
Jerry Yub7c12a42022-06-12 20:53:02 +0800307 for _, cert, key in map(lambda sig_alg: CERTIFICATES[sig_alg], self._cert_sig_algs):
308 ret += ['--x509certfile {cert} --x509keyfile {key}'.format(
309 cert=cert, key=key)]
XiaokangQiand5d5b602022-05-23 09:16:20 +0000310 return ret
311
Jerry Yub7c12a42022-06-12 20:53:02 +0800312 def post_checks(self):
313 return ['-c "HTTP/1.0 200 OK"']
314
315
316class GnuTLSCli(GnuTLSBase):
317 """
318 Generate test commands for GnuTLS client.
319 """
320
XiaokangQianb1847a22022-06-08 07:49:31 +0000321 def pre_cmd(self):
Jerry Yub7c12a42022-06-12 20:53:02 +0800322 return ['$G_NEXT_CLI_NO_CERT', '--debug=4', '--single-key-share',
323 '--x509cafile {cafile}'.format(cafile=CERTIFICATES[self._cert_sig_algs[0]].cafile)]
XiaokangQiand5d5b602022-05-23 09:16:20 +0000324
XiaokangQianb1847a22022-06-08 07:49:31 +0000325
326class MbedTLSBase(TLSProgram):
Jerry Yu305bfc32021-11-24 16:04:47 +0800327 """
XiaokangQianb1847a22022-06-08 07:49:31 +0000328 Generate base test commands for mbedTLS.
Jerry Yu305bfc32021-11-24 16:04:47 +0800329 """
Jerry Yu29deed42021-11-25 11:09:54 +0800330
Jerry Yu305bfc32021-11-24 16:04:47 +0800331 CIPHER_SUITE = {
332 'TLS_AES_256_GCM_SHA384': 'TLS1-3-AES-256-GCM-SHA384',
333 'TLS_AES_128_GCM_SHA256': 'TLS1-3-AES-128-GCM-SHA256',
334 'TLS_CHACHA20_POLY1305_SHA256': 'TLS1-3-CHACHA20-POLY1305-SHA256',
335 'TLS_AES_128_CCM_SHA256': 'TLS1-3-AES-128-CCM-SHA256',
336 'TLS_AES_128_CCM_8_SHA256': 'TLS1-3-AES-128-CCM-8-SHA256'}
337
Jerry Yu7918efe2021-12-01 15:29:10 +0800338 def cmd(self):
Jerry Yub7c12a42022-06-12 20:53:02 +0800339 ret = super().cmd()
340 ret += ['debug_level=4']
341
Jerry Yu305bfc32021-11-24 16:04:47 +0800342
XiaokangQiana1931442022-03-25 11:58:22 +0000343 if self._ciphers:
344 ciphers = ','.join(
345 map(lambda cipher: self.CIPHER_SUITE[cipher], self._ciphers))
346 ret += ["force_ciphersuite={ciphers}".format(ciphers=ciphers)]
Jerry Yu305bfc32021-11-24 16:04:47 +0800347
XiaokangQiana1931442022-03-25 11:58:22 +0000348 if self._sig_algs + self._cert_sig_algs:
349 ret += ['sig_algs={sig_algs}'.format(
350 sig_algs=','.join(set(self._sig_algs + self._cert_sig_algs)))]
Jerry Yu305bfc32021-11-24 16:04:47 +0800351
Jerry Yu7918efe2021-12-01 15:29:10 +0800352 if self._named_groups:
XiaokangQian8031ba72022-03-22 12:53:45 +0000353 named_groups = ','.join(self._named_groups)
Jerry Yu7918efe2021-12-01 15:29:10 +0800354 ret += ["curves={named_groups}".format(named_groups=named_groups)]
XiaokangQianb1847a22022-06-08 07:49:31 +0000355 return ret
356
357 def pre_checks(self):
358 ret = ['requires_config_enabled MBEDTLS_DEBUG_C',
Ronald Cron928cbd32022-10-04 16:14:26 +0200359 'requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED']
XiaokangQianb1847a22022-06-08 07:49:31 +0000360
361 if self._compat_mode:
362 ret += ['requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE']
363
364 if 'rsa_pss_rsae_sha256' in self._sig_algs + self._cert_sig_algs:
365 ret.append(
366 'requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT')
367 return ret
368
XiaokangQianb1847a22022-06-08 07:49:31 +0000369
370class MbedTLSServ(MbedTLSBase):
371 """
372 Generate test commands for mbedTLS server.
373 """
374
375 def cmd(self):
Jerry Yub7c12a42022-06-12 20:53:02 +0800376 ret = super().cmd()
XiaokangQianb1847a22022-06-08 07:49:31 +0000377 ret += ['tls13_kex_modes=ephemeral cookies=0 tickets=0']
Jerry Yu7918efe2021-12-01 15:29:10 +0800378 return ret
Jerry Yu305bfc32021-11-24 16:04:47 +0800379
380 def pre_checks(self):
XiaokangQian9b938b72022-06-10 03:10:59 +0000381 return ['requires_config_enabled MBEDTLS_SSL_SRV_C'] + super().pre_checks()
Jerry Yu305bfc32021-11-24 16:04:47 +0800382
383 def post_checks(self):
Ronald Crona1b8f6e2022-03-18 14:04:12 +0100384 check_strings = ["Protocol is TLSv1.3"]
Jerry Yu7de79852022-03-23 16:50:47 +0800385 if self._ciphers:
386 check_strings.append(
XiaokangQianb1847a22022-06-08 07:49:31 +0000387 "server hello, chosen ciphersuite: {} ( id={:04d} )".format(
388 self.CIPHER_SUITE[self._ciphers[0]],
389 CIPHER_SUITE_IANA_VALUE[self._ciphers[0]]))
390 if self._sig_algs:
391 check_strings.append(
392 "received signature algorithm: 0x{:x}".format(
393 SIG_ALG_IANA_VALUE[self._sig_algs[0]]))
394
395 for named_group in self._named_groups:
396 check_strings += ['got named group: {named_group}({iana_value:04x})'.format(
397 named_group=named_group,
398 iana_value=NAMED_GROUP_IANA_VALUE[named_group])]
399
Ronald Croneac00ad2022-09-13 10:16:31 +0200400 check_strings.append("Certificate verification was skipped")
XiaokangQianb1847a22022-06-08 07:49:31 +0000401 return ['-s "{}"'.format(i) for i in check_strings]
402
403 def pre_cmd(self):
Jerry Yub7c12a42022-06-12 20:53:02 +0800404 ret = ['$P_SRV']
405 for _, cert, key in map(lambda sig_alg: CERTIFICATES[sig_alg], self._cert_sig_algs):
406 ret += ['crt_file={cert} key_file={key}'.format(cert=cert, key=key)]
407 return ret
XiaokangQianb1847a22022-06-08 07:49:31 +0000408
XiaokangQian9b938b72022-06-10 03:10:59 +0000409 def hrr_post_checks(self, named_group):
410 return ['-s "HRR selected_group: {:s}"'.format(named_group)]
411
XiaokangQianb1847a22022-06-08 07:49:31 +0000412
XiaokangQianb1847a22022-06-08 07:49:31 +0000413class MbedTLSCli(MbedTLSBase):
414 """
415 Generate test commands for mbedTLS client.
416 """
417
XiaokangQianb1847a22022-06-08 07:49:31 +0000418 def pre_cmd(self):
Jerry Yub7c12a42022-06-12 20:53:02 +0800419 return ['$P_CLI',
420 'ca_file={cafile}'.format(cafile=CERTIFICATES[self._cert_sig_algs[0]].cafile)]
XiaokangQianb1847a22022-06-08 07:49:31 +0000421
422 def pre_checks(self):
XiaokangQian9b938b72022-06-10 03:10:59 +0000423 return ['requires_config_enabled MBEDTLS_SSL_CLI_C'] + super().pre_checks()
XiaokangQianb1847a22022-06-08 07:49:31 +0000424
XiaokangQian9b938b72022-06-10 03:10:59 +0000425 def hrr_post_checks(self, named_group):
426 ret = ['-c "received HelloRetryRequest message"']
427 ret += ['-c "selected_group ( {:d} )"'.format(NAMED_GROUP_IANA_VALUE[named_group])]
XiaokangQianb1847a22022-06-08 07:49:31 +0000428 return ret
429
430 def post_checks(self):
431 check_strings = ["Protocol is TLSv1.3"]
432 if self._ciphers:
433 check_strings.append(
Jerry Yu7de79852022-03-23 16:50:47 +0800434 "server hello, chosen ciphersuite: ( {:04x} ) - {}".format(
435 CIPHER_SUITE_IANA_VALUE[self._ciphers[0]],
436 self.CIPHER_SUITE[self._ciphers[0]]))
437 if self._sig_algs:
438 check_strings.append(
439 "Certificate Verify: Signature algorithm ( {:04x} )".format(
440 SIG_ALG_IANA_VALUE[self._sig_algs[0]]))
441
442 for named_group in self._named_groups:
443 check_strings += ['NamedGroup: {named_group} ( {iana_value:x} )'.format(
444 named_group=named_group,
445 iana_value=NAMED_GROUP_IANA_VALUE[named_group])]
446
447 check_strings.append("Verifying peer X.509 certificate... ok")
Jerry Yu305bfc32021-11-24 16:04:47 +0800448 return ['-c "{}"'.format(i) for i in check_strings]
449
Jerry Yu305bfc32021-11-24 16:04:47 +0800450
XiaokangQianb1847a22022-06-08 07:49:31 +0000451SERVER_CLASSES = {'OpenSSL': OpenSSLServ, 'GnuTLS': GnuTLSServ, 'mbedTLS': MbedTLSServ}
452CLIENT_CLASSES = {'OpenSSL': OpenSSLCli, 'GnuTLS': GnuTLSCli, 'mbedTLS': MbedTLSCli}
Jerry Yu305bfc32021-11-24 16:04:47 +0800453
454
Ronald Cron9d0a3e82022-04-05 16:13:38 +0200455def generate_compat_test(client=None, server=None, cipher=None, named_group=None, sig_alg=None):
Jerry Yu305bfc32021-11-24 16:04:47 +0800456 """
457 Generate test case with `ssl-opt.sh` format.
458 """
Jerry Yudda036d2021-11-30 11:19:41 +0800459 name = 'TLS 1.3 {client[0]}->{server[0]}: {cipher},{named_group},{sig_alg}'.format(
Ronald Crondf5f8682022-04-05 16:01:03 +0200460 client=client, server=server, cipher=cipher[4:], sig_alg=sig_alg, named_group=named_group)
Jerry Yu7de79852022-03-23 16:50:47 +0800461
462 server_object = SERVER_CLASSES[server](ciphersuite=cipher,
463 named_group=named_group,
464 signature_algorithm=sig_alg,
465 cert_sig_alg=sig_alg)
466 client_object = CLIENT_CLASSES[client](ciphersuite=cipher,
467 named_group=named_group,
468 signature_algorithm=sig_alg,
469 cert_sig_alg=sig_alg)
Jerry Yu305bfc32021-11-24 16:04:47 +0800470
Jerry Yub7c12a42022-06-12 20:53:02 +0800471 cmd = ['run_test "{}"'.format(name),
472 '"{}"'.format(' '.join(server_object.cmd())),
473 '"{}"'.format(' '.join(client_object.cmd())),
474 '0']
XiaokangQiand5d5b602022-05-23 09:16:20 +0000475 cmd += server_object.post_checks()
476 cmd += client_object.post_checks()
477 cmd += ['-C "received HelloRetryRequest message"']
478 prefix = ' \\\n' + (' '*9)
479 cmd = prefix.join(cmd)
480 return '\n'.join(server_object.pre_checks() + client_object.pre_checks() + [cmd])
481
482
Ronald Cron9d0a3e82022-04-05 16:13:38 +0200483def generate_hrr_compat_test(client=None, server=None,
484 client_named_group=None, server_named_group=None,
485 cert_sig_alg=None):
XiaokangQian7069cbc2022-02-24 08:30:39 +0000486 """
XiaokangQianeff93f92022-03-23 06:14:26 +0000487 Generate Hello Retry Request test case with `ssl-opt.sh` format.
XiaokangQian7069cbc2022-02-24 08:30:39 +0000488 """
XiaokangQianeff93f92022-03-23 06:14:26 +0000489 name = 'TLS 1.3 {client[0]}->{server[0]}: HRR {c_named_group} -> {s_named_group}'.format(
XiaokangQian2e17fb82022-03-28 03:30:05 +0000490 client=client, server=server, c_named_group=client_named_group,
491 s_named_group=server_named_group)
492 server_object = SERVER_CLASSES[server](named_group=server_named_group,
493 cert_sig_alg=cert_sig_alg)
XiaokangQiana1931442022-03-25 11:58:22 +0000494
XiaokangQian2e17fb82022-03-28 03:30:05 +0000495 client_object = CLIENT_CLASSES[client](named_group=client_named_group,
496 cert_sig_alg=cert_sig_alg)
XiaokangQiana1931442022-03-25 11:58:22 +0000497 client_object.add_named_groups(server_named_group)
XiaokangQian7069cbc2022-02-24 08:30:39 +0000498
Jerry Yub7c12a42022-06-12 20:53:02 +0800499 cmd = ['run_test "{}"'.format(name),
500 '"{}"'.format(' '.join(server_object.cmd())),
501 '"{}"'.format(' '.join(client_object.cmd())),
502 '0']
XiaokangQian7069cbc2022-02-24 08:30:39 +0000503 cmd += server_object.post_checks()
XiaokangQiana1931442022-03-25 11:58:22 +0000504 cmd += client_object.post_checks()
XiaokangQian9b938b72022-06-10 03:10:59 +0000505 cmd += server_object.hrr_post_checks(server_named_group)
506 cmd += client_object.hrr_post_checks(server_named_group)
XiaokangQiand5d5b602022-05-23 09:16:20 +0000507 prefix = ' \\\n' + (' '*9)
508 cmd = prefix.join(cmd)
509 return '\n'.join(server_object.pre_checks() +
510 client_object.pre_checks() +
511 [cmd])
Jerry Yu7f5e5ad2021-11-29 17:37:19 +0800512
513SSL_OUTPUT_HEADER = '''#!/bin/sh
Jerry Yucdcb6832021-11-29 16:50:13 +0800514
515# {filename}
516#
517# Copyright The Mbed TLS Contributors
518# SPDX-License-Identifier: Apache-2.0
519#
520# Licensed under the Apache License, Version 2.0 (the "License"); you may
521# not use this file except in compliance with the License.
522# You may obtain a copy of the License at
523#
524# http://www.apache.org/licenses/LICENSE-2.0
525#
526# Unless required by applicable law or agreed to in writing, software
527# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
528# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
529# See the License for the specific language governing permissions and
530# limitations under the License.
531#
532# Purpose
533#
534# List TLS1.3 compat test cases. They are generated by
XiaokangQiana1931442022-03-25 11:58:22 +0000535# `{cmd}`.
Jerry Yucdcb6832021-11-29 16:50:13 +0800536#
537# PLEASE DO NOT EDIT THIS FILE. IF NEEDED, PLEASE MODIFY `generate_tls13_compat_tests.py`
538# AND REGENERATE THIS FILE.
539#
540'''
Jerry Yu29deed42021-11-25 11:09:54 +0800541
Jerry Yu305bfc32021-11-24 16:04:47 +0800542def main():
Jerry Yudda036d2021-11-30 11:19:41 +0800543 """
544 Main function of this program
545 """
Jerry Yu305bfc32021-11-24 16:04:47 +0800546 parser = argparse.ArgumentParser()
547
Jerry Yucdcb6832021-11-29 16:50:13 +0800548 parser.add_argument('-o', '--output', nargs='?',
Jerry Yu7f5e5ad2021-11-29 17:37:19 +0800549 default=None, help='Output file path if `-a` was set')
Jerry Yucdcb6832021-11-29 16:50:13 +0800550
Jerry Yuc4aa1522021-11-26 11:13:58 +0800551 parser.add_argument('-a', '--generate-all-tls13-compat-tests', action='store_true',
552 default=False, help='Generate all available tls13 compat tests')
553
Jerry Yu305bfc32021-11-24 16:04:47 +0800554 parser.add_argument('--list-ciphers', action='store_true',
555 default=False, help='List supported ciphersuites')
556
557 parser.add_argument('--list-sig-algs', action='store_true',
558 default=False, help='List supported signature algorithms')
559
560 parser.add_argument('--list-named-groups', action='store_true',
561 default=False, help='List supported named groups')
562
563 parser.add_argument('--list-servers', action='store_true',
564 default=False, help='List supported TLS servers')
565
566 parser.add_argument('--list-clients', action='store_true',
567 default=False, help='List supported TLS Clients')
568
Jerry Yub4ac8f32021-12-01 10:41:37 +0800569 parser.add_argument('server', choices=SERVER_CLASSES.keys(), nargs='?',
570 default=list(SERVER_CLASSES.keys())[0],
Jerry Yu305bfc32021-11-24 16:04:47 +0800571 help='Choose TLS server program for test')
Jerry Yub4ac8f32021-12-01 10:41:37 +0800572 parser.add_argument('client', choices=CLIENT_CLASSES.keys(), nargs='?',
573 default=list(CLIENT_CLASSES.keys())[0],
Jerry Yu305bfc32021-11-24 16:04:47 +0800574 help='Choose TLS client program for test')
575 parser.add_argument('cipher', choices=CIPHER_SUITE_IANA_VALUE.keys(), nargs='?',
576 default=list(CIPHER_SUITE_IANA_VALUE.keys())[0],
577 help='Choose cipher suite for test')
578 parser.add_argument('sig_alg', choices=SIG_ALG_IANA_VALUE.keys(), nargs='?',
579 default=list(SIG_ALG_IANA_VALUE.keys())[0],
580 help='Choose cipher suite for test')
581 parser.add_argument('named_group', choices=NAMED_GROUP_IANA_VALUE.keys(), nargs='?',
582 default=list(NAMED_GROUP_IANA_VALUE.keys())[0],
583 help='Choose cipher suite for test')
584
585 args = parser.parse_args()
Jerry Yucdcb6832021-11-29 16:50:13 +0800586
Jerry Yu7f5e5ad2021-11-29 17:37:19 +0800587 def get_all_test_cases():
Jerry Yu7de79852022-03-23 16:50:47 +0800588 # Generate normal compat test cases
Ronald Cron9d0a3e82022-04-05 16:13:38 +0200589 for client, server, cipher, named_group, sig_alg in \
590 itertools.product(CLIENT_CLASSES.keys(),
Jerry Yu7de79852022-03-23 16:50:47 +0800591 SERVER_CLASSES.keys(),
Ronald Cron9d0a3e82022-04-05 16:13:38 +0200592 CIPHER_SUITE_IANA_VALUE.keys(),
593 NAMED_GROUP_IANA_VALUE.keys(),
594 SIG_ALG_IANA_VALUE.keys()):
XiaokangQianfb1a3fe2022-06-09 06:37:33 +0000595 if server == 'mbedTLS' or client == 'mbedTLS':
XiaokangQianb1847a22022-06-08 07:49:31 +0000596 yield generate_compat_test(client=client, server=server,
XiaokangQianfb1a3fe2022-06-09 06:37:33 +0000597 cipher=cipher, named_group=named_group,
598 sig_alg=sig_alg)
XiaokangQiana1931442022-03-25 11:58:22 +0000599
XiaokangQiand5d5b602022-05-23 09:16:20 +0000600
XiaokangQiana1931442022-03-25 11:58:22 +0000601 # Generate Hello Retry Request compat test cases
XiaokangQian2e17fb82022-03-28 03:30:05 +0000602 for client, server, client_named_group, server_named_group in \
603 itertools.product(CLIENT_CLASSES.keys(),
XiaokangQiana1931442022-03-25 11:58:22 +0000604 SERVER_CLASSES.keys(),
XiaokangQian2e17fb82022-03-28 03:30:05 +0000605 NAMED_GROUP_IANA_VALUE.keys(),
606 NAMED_GROUP_IANA_VALUE.keys()):
Jerry Yub7c12a42022-06-12 20:53:02 +0800607
XiaokangQian9b938b72022-06-10 03:10:59 +0000608 if (client == 'mbedTLS' or server == 'mbedTLS') and \
609 client_named_group != server_named_group:
610 yield generate_hrr_compat_test(client=client, server=server,
611 client_named_group=client_named_group,
612 server_named_group=server_named_group,
613 cert_sig_alg="ecdsa_secp256r1_sha256")
XiaokangQiand5d5b602022-05-23 09:16:20 +0000614
Jerry Yu7f5e5ad2021-11-29 17:37:19 +0800615 if args.generate_all_tls13_compat_tests:
616 if args.output:
617 with open(args.output, 'w', encoding="utf-8") as f:
Jerry Yub4ac8f32021-12-01 10:41:37 +0800618 f.write(SSL_OUTPUT_HEADER.format(
XiaokangQiana1931442022-03-25 11:58:22 +0000619 filename=os.path.basename(args.output), cmd=' '.join(sys.argv)))
Jerry Yu7f5e5ad2021-11-29 17:37:19 +0800620 f.write('\n\n'.join(get_all_test_cases()))
Jerry Yudda036d2021-11-30 11:19:41 +0800621 f.write('\n')
Jerry Yu7f5e5ad2021-11-29 17:37:19 +0800622 else:
Jerry Yu7de79852022-03-23 16:50:47 +0800623 print('\n\n'.join(get_all_test_cases()))
Jerry Yuc4aa1522021-11-26 11:13:58 +0800624 return 0
625
Jerry Yu305bfc32021-11-24 16:04:47 +0800626 if args.list_ciphers or args.list_sig_algs or args.list_named_groups \
Jerry Yu29deed42021-11-25 11:09:54 +0800627 or args.list_servers or args.list_clients:
Jerry Yu305bfc32021-11-24 16:04:47 +0800628 if args.list_ciphers:
Jerry Yu7f5e5ad2021-11-29 17:37:19 +0800629 print(*CIPHER_SUITE_IANA_VALUE.keys())
Jerry Yu305bfc32021-11-24 16:04:47 +0800630 if args.list_sig_algs:
Jerry Yu7f5e5ad2021-11-29 17:37:19 +0800631 print(*SIG_ALG_IANA_VALUE.keys())
Jerry Yu305bfc32021-11-24 16:04:47 +0800632 if args.list_named_groups:
Jerry Yu7f5e5ad2021-11-29 17:37:19 +0800633 print(*NAMED_GROUP_IANA_VALUE.keys())
Jerry Yu305bfc32021-11-24 16:04:47 +0800634 if args.list_servers:
Jerry Yub4ac8f32021-12-01 10:41:37 +0800635 print(*SERVER_CLASSES.keys())
Jerry Yu305bfc32021-11-24 16:04:47 +0800636 if args.list_clients:
Jerry Yub4ac8f32021-12-01 10:41:37 +0800637 print(*CLIENT_CLASSES.keys())
Jerry Yu305bfc32021-11-24 16:04:47 +0800638 return 0
Jerry Yucdcb6832021-11-29 16:50:13 +0800639
XiaokangQiana1931442022-03-25 11:58:22 +0000640 print(generate_compat_test(server=args.server, client=args.client, sig_alg=args.sig_alg,
641 cipher=args.cipher, named_group=args.named_group))
Jerry Yucdcb6832021-11-29 16:50:13 +0800642 return 0
Jerry Yu305bfc32021-11-24 16:04:47 +0800643
Jerry Yu29deed42021-11-25 11:09:54 +0800644
Jerry Yu305bfc32021-11-24 16:04:47 +0800645if __name__ == "__main__":
646 sys.exit(main())