mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-09-22 16:37:31 +09:00
re-introduce old nss im too tired for this
This commit is contained in:
wuggy
parent
3c46be320d
commit
3a838106b9
2871 changed files with 1374431 additions and 1762417 deletions
228
security/nss/tests/ssl/ssl.sh
Executable file → Normal file
228
security/nss/tests/ssl/ssl.sh
Executable file → Normal file
|
|
@ -115,20 +115,9 @@ ssl_init()
|
|||
|
||||
NON_EC_SUITES=":0016:0032:0033:0038:0039:003B:003C:003D:0040:0041:0067:006A:006B"
|
||||
NON_EC_SUITES="${NON_EC_SUITES}:0084:009C:009D:009E:009F:00A2:00A3:CCAAcdeinvyz"
|
||||
TLS13_SUITES=":1301:1302:1303"
|
||||
|
||||
# List of cipher suites to test, including ECC cipher suites.
|
||||
CIPHER_SUITES="-c ${EC_SUITES}${NON_EC_SUITES}"
|
||||
TLS13_CIPHER_SUITES="-c ${TLS13_SUITES}${EC_SUITES}${NON_EC_SUITES}"
|
||||
|
||||
# in fips mode, turn off curve25519 until it's NIST approved
|
||||
FIPS_OPTIONS="-I P256,P384,P521,FF2048,FF3072,FF4096,FF6144,FF8192"
|
||||
|
||||
# in non-fips mode, tstclnt may run without the db password in some
|
||||
# cases, but in fips mode it's always needed
|
||||
CLIENT_PW=""
|
||||
CLIENT_PW_FIPS="-w nss"
|
||||
CLIENT_PW_NORMAL=""
|
||||
|
||||
if [ "${OS_ARCH}" != "WINNT" ]; then
|
||||
ulimit -n 1000 # make sure we have enough file descriptors
|
||||
|
|
@ -303,30 +292,17 @@ ignore_blank_lines()
|
|||
########################################################################
|
||||
ssl_cov()
|
||||
{
|
||||
verbose_save=${verbose}
|
||||
verbose="-v"
|
||||
#verbose="-v"
|
||||
html_head "SSL Cipher Coverage $NORM_EXT - server $SERVER_MODE/client $CLIENT_MODE"
|
||||
|
||||
testname=""
|
||||
|
||||
SAVE_SERVER_OPTIONS=${SERVER_OPTIONS}
|
||||
if [ "${SERVER_MODE}" = "fips" ] ; then
|
||||
SERVER_OPTIONS="${SERVER_OPTIONS} ${FIPS_OPTIONS}"
|
||||
fi
|
||||
SAVE_CLIENT_OPTIONS=${CLIENT_OPTIONS}
|
||||
if [ "${CLIENT_MODE}" = "fips" ] ; then
|
||||
CLIENT_OPTIONS="${CLIENT_OPTIONS} ${FIPS_OPTIONS}"
|
||||
fi
|
||||
|
||||
start_selfserv $CIPHER_SUITES # Launch the server
|
||||
|
||||
VMIN="ssl3"
|
||||
VMAX="tls1.1"
|
||||
# can't use a pipe here, because we may have to restart selfserv, and
|
||||
# doing so hides the server pid environment variable in the subshell in
|
||||
# cygwin, which means we can't kill selfserv at the end here.
|
||||
SSL_COV_TMP=$(mktemp /tmp/ssl_cov.XXXXXX)
|
||||
ignore_blank_lines ${SSLCOV} > ${SSL_COV_TMP}
|
||||
|
||||
ignore_blank_lines ${SSLCOV} | \
|
||||
while read ectype testmax param testname
|
||||
do
|
||||
echo "${testname}" | grep "EXPORT" > /dev/null
|
||||
|
|
@ -350,31 +326,6 @@ ssl_cov()
|
|||
if [ "$testmax" = "TLS12" ]; then
|
||||
VMAX="tls1.2"
|
||||
fi
|
||||
if [ "$testmax" = "TLS13" ]; then
|
||||
# if our selfserv can only do up to tls1.2
|
||||
# restart it so it can do tls1.3, This requires
|
||||
# moving VMIN up to tls1.0 because you can't enable SSL3 and
|
||||
# TLS 1.3.
|
||||
if [ "$VMIN" = "ssl3" ]; then
|
||||
SERVER_VMIN="tls1.0"
|
||||
SERVER_VMAX="tls1.3"
|
||||
kill_selfserv
|
||||
start_selfserv ${TLS13_CIPHER_SUITES}
|
||||
unset SERVER_VMIN
|
||||
unset SERVER_VMAX
|
||||
VMIN="tls1.0"
|
||||
fi
|
||||
VMAX="tls1.3"
|
||||
fi
|
||||
# if we are testing ssl3 and our server can only do down to tls1.1,
|
||||
# restart it to enable ssl3
|
||||
if [ "$VMAX" = "ssl3" -a "$VMIN" = "tls1.1" ]; then
|
||||
kill_selfserv
|
||||
start_selfserv $CIPHER_SUITES
|
||||
VMIN="ssl3"
|
||||
fi
|
||||
|
||||
|
||||
|
||||
echo "tstclnt -4 -p ${PORT} -h ${HOSTADDR} -c ${param} -V ${VMIN}:${VMAX} ${CLIENT_OPTIONS} \\"
|
||||
echo " -f -d ${P_R_CLIENTDIR} $verbose -w nss < ${REQUEST_FILE}"
|
||||
|
|
@ -388,12 +339,8 @@ ssl_cov()
|
|||
rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
|
||||
html_msg $ret 0 "${testname}" \
|
||||
"produced a returncode of $ret, expected is 0"
|
||||
done < ${SSL_COV_TMP}
|
||||
rm -f ${SSL_COV_TMP}
|
||||
done
|
||||
|
||||
SERVER_OPTIONS=${SAVE_SERVER_OPTIONS}
|
||||
CLIENT_OPTIONS=${SAVE_CLIENT_OPTIONS}
|
||||
verbose=${verbose_save}
|
||||
kill_selfserv
|
||||
html "</TABLE><BR>"
|
||||
}
|
||||
|
|
@ -466,12 +413,21 @@ ssl_auth()
|
|||
echo "${testname}" | grep "TLS 1.3" > /dev/null
|
||||
TLS13=$?
|
||||
|
||||
# Currently TLS 1.3 tests are known to fail under FIPS mode,
|
||||
# because HKDF is implemented using the PKCS #11 functions
|
||||
# prohibited under FIPS mode.
|
||||
if [ "${TLS13}" -eq 0 ] && \
|
||||
[ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then
|
||||
echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ "${CLIENT_MODE}" = "fips" -a "${CAUTH}" -eq 0 ] ; then
|
||||
echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
|
||||
elif [ "$ectype" = "SNI" -a "$NORM_EXT" = "Extended Test" ] ; then
|
||||
echo "$SCRIPTNAME: skipping $testname for $NORM_EXT"
|
||||
else
|
||||
cparam=`echo $cparam | sed -e 's;\([^\\]\)_;\1 ;g' -e 's;\\\\_;_;g' -e "s/TestUser/$USER_NICKNAME/g" `
|
||||
cparam=`echo $cparam | sed -e 's;_; ;g' -e "s/TestUser/$USER_NICKNAME/g" `
|
||||
if [ "$ectype" = "SNI" ]; then
|
||||
cparam=`echo $cparam | sed -e "s/Host/$HOST/g" -e "s/Dom/$DOMSUF/g" `
|
||||
sparam=`echo $sparam | sed -e "s/Host/$HOST/g" -e "s/Dom/$DOMSUF/g" `
|
||||
|
|
@ -483,7 +439,7 @@ ssl_auth()
|
|||
SERVER_VMIN=tls1.0
|
||||
SERVER_VMAX=tls1.3
|
||||
fi
|
||||
start_selfserv `echo "$sparam" | sed -e 's;\([^\\]\)_;\1 ;g' -e 's;\\\\_;_;g'`
|
||||
start_selfserv `echo "$sparam" | sed -e 's,_, ,g'`
|
||||
|
||||
echo "tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f -d ${P_R_CLIENTDIR} $verbose ${CLIENT_OPTIONS} \\"
|
||||
echo " ${cparam} < ${REQUEST_FILE}"
|
||||
|
|
@ -522,6 +478,10 @@ ssl_stapling_sub()
|
|||
echo "$SCRIPTNAME: skipping $testname for $NORM_EXT"
|
||||
return 0
|
||||
fi
|
||||
if [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then
|
||||
echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
|
||||
return 0
|
||||
fi
|
||||
|
||||
SAVE_SERVER_OPTIONS=${SERVER_OPTIONS}
|
||||
SERVER_OPTIONS="${SERVER_OPTIONS} ${SO}"
|
||||
|
|
@ -534,10 +494,10 @@ ssl_stapling_sub()
|
|||
start_selfserv
|
||||
|
||||
echo "tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f -d ${P_R_CLIENTDIR} $verbose ${CLIENT_OPTIONS} \\"
|
||||
echo " -c v -T -O -F -M 1 -V ssl3:tls1.2 ${CLIENT_PW} < ${REQUEST_FILE}"
|
||||
echo " -c v -T -O -F -M 1 -V ssl3:tls1.2 < ${REQUEST_FILE}"
|
||||
rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
|
||||
${PROFTOOL} ${BINDIR}/tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f ${CLIENT_OPTIONS} \
|
||||
-d ${P_R_CLIENTDIR} $verbose -c v -T -O -F -M 1 -V ssl3:tls1.2 ${CLIENT_PW} < ${REQUEST_FILE} \
|
||||
-d ${P_R_CLIENTDIR} $verbose -c v -T -O -F -M 1 -V ssl3:tls1.2 < ${REQUEST_FILE} \
|
||||
>${TMP}/$HOST.tmp.$$ 2>&1
|
||||
ret=$?
|
||||
cat ${TMP}/$HOST.tmp.$$
|
||||
|
|
@ -567,6 +527,10 @@ ssl_stapling_stress()
|
|||
echo "$SCRIPTNAME: skipping $testname for $NORM_EXT"
|
||||
return 0
|
||||
fi
|
||||
if [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then
|
||||
echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
|
||||
return 0
|
||||
fi
|
||||
|
||||
SAVE_SERVER_OPTIONS=${SERVER_OPTIONS}
|
||||
SERVER_OPTIONS="${SERVER_OPTIONS} ${SO}"
|
||||
|
|
@ -637,6 +601,11 @@ ssl_signed_cert_timestamps()
|
|||
testname="ssl_signed_cert_timestamps"
|
||||
value=0
|
||||
|
||||
if [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then
|
||||
echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo "${testname}"
|
||||
|
||||
start_selfserv
|
||||
|
|
@ -644,10 +613,10 @@ ssl_signed_cert_timestamps()
|
|||
# Since we don't have server-side support, this test only covers advertising the
|
||||
# extension in the client hello.
|
||||
echo "tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f -d ${P_R_CLIENTDIR} $verbose ${CLIENT_OPTIONS} \\"
|
||||
echo " -U -V tls1.0:tls1.2 ${CLIENT_PW} < ${REQUEST_FILE}"
|
||||
echo " -U -V tls1.0:tls1.2 < ${REQUEST_FILE}"
|
||||
rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
|
||||
${PROFTOOL} ${BINDIR}/tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f ${CLIENT_OPTIONS} \
|
||||
-d ${P_R_CLIENTDIR} $verbose -U -V tls1.0:tls1.2 ${CLIENT_PW} < ${REQUEST_FILE} \
|
||||
-d ${P_R_CLIENTDIR} $verbose -U -V tls1.0:tls1.2 < ${REQUEST_FILE} \
|
||||
>${TMP}/$HOST.tmp.$$ 2>&1
|
||||
ret=$?
|
||||
cat ${TMP}/$HOST.tmp.$$
|
||||
|
|
@ -692,7 +661,7 @@ ssl_stress()
|
|||
start_selfserv `echo "$sparam" | sed -e 's,_, ,g'`
|
||||
|
||||
if [ "`uname -n`" = "sjsu" ] ; then
|
||||
echo "debugging disappearing selfserv... ps -ef | grep selfserv"
|
||||
echo "debugging disapering selfserv... ps -ef | grep selfserv"
|
||||
ps -ef | grep selfserv
|
||||
fi
|
||||
|
||||
|
|
@ -939,7 +908,6 @@ ssl_policy_listsuites()
|
|||
cp ${P_R_CLIENTDIR}/pkcs11.txt ${P_R_CLIENTDIR}/pkcs11.txt.sav
|
||||
|
||||
# Disallow all explicitly
|
||||
testname="listsuites with all cipher disallowed by policy"
|
||||
setup_policy "disallow=all" ${P_R_CLIENTDIR}
|
||||
RET_EXP=1
|
||||
list_enabled_suites | grep '^TLS_'
|
||||
|
|
@ -948,7 +916,6 @@ ssl_policy_listsuites()
|
|||
"produced a returncode of $RET, expected is $RET_EXP"
|
||||
|
||||
# Disallow RSA in key exchange explicitly
|
||||
testname="listsuites with rsa cipher disallowed by policy"
|
||||
setup_policy "disallow=rsa/ssl-key-exchange" ${P_R_CLIENTDIR}
|
||||
RET_EXP=1
|
||||
list_enabled_suites | grep '^TLS_RSA_'
|
||||
|
|
@ -956,83 +923,11 @@ ssl_policy_listsuites()
|
|||
html_msg $RET $RET_EXP "${testname}" \
|
||||
"produced a returncode of $RET, expected is $RET_EXP"
|
||||
|
||||
# allow by policy, but disable by default
|
||||
testname="listsuites with all ciphers enabled by policy but disabled by default"
|
||||
setup_policy "allow=all disable=all" ${P_R_CLIENTDIR}
|
||||
RET_EXP=1
|
||||
list_enabled_suites | grep '^TLS_'
|
||||
RET=$?
|
||||
html_msg $RET $RET_EXP "${testname}" \
|
||||
"produced a returncode of $RET, expected is $RET_EXP"
|
||||
|
||||
# allow by policy, but disable by default just rsa-kea
|
||||
testname="listsuites with all ciphers enabled by policy but rsa disabled by default"
|
||||
setup_policy "allow=all disable=rsa/ssl-key-exchange" ${P_R_CLIENTDIR}
|
||||
RET_EXP=1
|
||||
list_enabled_suites | grep '^TLS_RSA_'
|
||||
RET=$?
|
||||
html_msg $RET $RET_EXP "${testname}" \
|
||||
"produced a returncode of $RET, expected is $RET_EXP"
|
||||
|
||||
# list_enabled_suites tries to set a policy value explicitly, This will
|
||||
# cause list_enabled_suites to fail if we lock the policy
|
||||
testname="listsuites with policy locked"
|
||||
setup_policy "allow=all flags=policy-lock" ${P_R_CLIENTDIR}
|
||||
RET_EXP=1
|
||||
SSL_DIR="${P_R_CLIENTDIR}" ${BINDIR}/listsuites
|
||||
RET=$?
|
||||
html_msg $RET $RET_EXP "${testname}" \
|
||||
"produced a returncode of $RET, expected is $RET_EXP"
|
||||
|
||||
cp ${P_R_CLIENTDIR}/pkcs11.txt.sav ${P_R_CLIENTDIR}/pkcs11.txt
|
||||
|
||||
html "</TABLE><BR>"
|
||||
}
|
||||
|
||||
ssl_policy_pkix_ocsp()
|
||||
{
|
||||
#verbose="-v"
|
||||
html_head "Check that OCSP doesn't break if we disable sha1 $NORM_EXT - server $SERVER_MODE/client $CLIENT_MODE"
|
||||
|
||||
PKIX_SAVE=${NSS_ENABLE_PKIX_VERIFY-"unset"}
|
||||
NSS_ENABLE_PKIX_VERIFY="1"
|
||||
export NSS_ENABLE_PKIX_VERIFY
|
||||
|
||||
testname=""
|
||||
|
||||
if [ ! -f "${P_R_SERVERDIR}/pkcs11.txt" ] ; then
|
||||
html_failed "${SCRIPTNAME}: ${P_R_SERVERDIR} is not initialized"
|
||||
return 1;
|
||||
fi
|
||||
|
||||
echo "Saving pkcs11.txt"
|
||||
cp ${P_R_SERVERDIR}/pkcs11.txt ${P_R_SERVERDIR}/pkcs11.txt.sav
|
||||
|
||||
# Disallow sha1 explicitly. This will test if we are trying to verify the sha1 signature
|
||||
# on the GlobalSign root during OCSP processing
|
||||
setup_policy "disallow=sha1" ${P_R_SERVERDIR}
|
||||
RET_EXP=0
|
||||
echo " vfyserv -o wrong.host.badssl.com -d ${P_R_SERVERDIR} 2>&1 | tee ${P_R_SERVERDIR}/vfy.out"
|
||||
vfyserv -o wrong.host.badssl.com -d ${P_R_SERVERDIR} 2>&1 | tee ${P_R_SERVERDIR}/vfy.out
|
||||
# make sure we have the domain mismatch, not bad signature error
|
||||
echo "grep 12276 ${P_R_SERVERDIR}/vfy.out"
|
||||
grep 12276 ${P_R_SERVERDIR}/vfy.out
|
||||
RET=$?
|
||||
html_msg $RET $RET_EXP "${testname}" \
|
||||
"produced a returncode of $RET, expected is $RET_EXP"
|
||||
|
||||
if [ "${PKIX_SAVE}" = "unset" ]; then
|
||||
unset NSS_ENABLE_PKIX_VERIFY
|
||||
else
|
||||
NSS_ENABLE_PKIX_VERIFY=${PKIX_SAVE}
|
||||
export NSS_ENABLE_PKIX_VERIFY
|
||||
fi
|
||||
cp ${P_R_SERVERDIR}/pkcs11.txt.sav ${P_R_SERVERDIR}/pkcs11.txt
|
||||
|
||||
html "</TABLE><BR>"
|
||||
|
||||
}
|
||||
|
||||
############################## ssl_policy_selfserv #####################
|
||||
# local shell function to perform SSL Policy tests, using selfserv
|
||||
########################################################################
|
||||
|
|
@ -1052,21 +947,10 @@ ssl_policy_selfserv()
|
|||
cp ${P_R_SERVERDIR}/pkcs11.txt ${P_R_SERVERDIR}/pkcs11.txt.sav
|
||||
|
||||
# Disallow RSA in key exchange explicitly
|
||||
testname="Disallow RSA key exchange explicitly"
|
||||
setup_policy "disallow=rsa/ssl-key-exchange" ${P_R_SERVERDIR}
|
||||
|
||||
SAVE_SERVER_OPTIONS=${SERVER_OPTIONS}
|
||||
# make sure policy is working in the multiprocess case is working on
|
||||
# UNIX-like OS's. Other OS's can't properly clean up the child processes
|
||||
# when our test suite kills the parent, so just use the single process
|
||||
# self serve for them
|
||||
if [ "${OS_ARCH}" != "WINNT" -a "${OS_ARCH}" != "WIN95" -a "${OS_ARCH}" != "OS2" ]; then
|
||||
SERVER_OPTIONS="-M 3 ${SERVER_OPTIONS}"
|
||||
fi
|
||||
|
||||
start_selfserv $CIPHER_SUITES
|
||||
|
||||
SERVER_OPTIONS="${SAVE_SERVER_OPTIONS}"
|
||||
VMIN="ssl3"
|
||||
VMAX="tls1.2"
|
||||
|
||||
|
|
@ -1328,22 +1212,27 @@ ssl_dtls()
|
|||
testname="ssl_dtls"
|
||||
value=0
|
||||
|
||||
if [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then
|
||||
echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo "${testname}"
|
||||
|
||||
echo "tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f ${SERVER_OPTIONS} \\"
|
||||
echo " -d ${P_R_SERVERDIR} $verbose -U -V tls1.1:tls1.2 -P server -n ${HOSTADDR} -w nss < ${REQUEST_FILE} &"
|
||||
echo "tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f -d ${P_R_SERVERDIR} $verbose ${SERVER_OPTIONS} \\"
|
||||
echo " -U -V tls1.1:tls1.2 -P server -Q < ${REQUEST_FILE} &"
|
||||
|
||||
(sleep 2; cat ${REQUEST_FILE}) | ${PROFTOOL} ${BINDIR}/tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f ${SERVER_OPTIONS} \
|
||||
-d ${P_R_SERVERDIR} $verbose -U -V tls1.1:tls1.2 -P server -n ${HOSTADDR} -w nss 2>&1 &
|
||||
${PROFTOOL} ${BINDIR}/tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f ${SERVER_OPTIONS} \
|
||||
-d ${P_R_SERVERDIR} $verbose -U -V tls1.1:tls1.2 -P server -n ${HOSTADDR} -w nss < ${REQUEST_FILE} 2>&1 &
|
||||
|
||||
PID=$!
|
||||
|
||||
sleep 1
|
||||
|
||||
echo "tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f ${CLIENT_OPTIONS} \\"
|
||||
echo " -d ${P_R_CLIENTDIR} $verbose -U -V tls1.1:tls1.2 -P client -Q ${CLIENT_PW} < ${REQUEST_FILE}"
|
||||
echo "tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f -d ${P_R_CLIENTDIR} $verbose ${CLIENT_OPTIONS} \\"
|
||||
echo " -U -V tls1.1:tls1.2 -P client -Q < ${REQUEST_FILE}"
|
||||
${PROFTOOL} ${BINDIR}/tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f ${CLIENT_OPTIONS} \
|
||||
-d ${P_R_CLIENTDIR} $verbose -U -V tls1.1:tls1.2 -P client -Q ${CLIENT_PW} < ${REQUEST_FILE} 2>&1
|
||||
-d ${P_R_CLIENTDIR} $verbose -U -V tls1.1:tls1.2 -P client -Q < ${REQUEST_FILE} 2>&1
|
||||
ret=$?
|
||||
html_msg $ret $value "${testname}" \
|
||||
"produced a returncode of $ret, expected is $value"
|
||||
|
|
@ -1358,6 +1247,11 @@ ssl_dtls()
|
|||
#########################################################################
|
||||
ssl_scheme()
|
||||
{
|
||||
if [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then
|
||||
echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
|
||||
return 0
|
||||
fi
|
||||
|
||||
html_head "SSL SCHEME $NORM_EXT - server $SERVER_MODE/client $CLIENT_MODE"
|
||||
|
||||
NO_ECC_CERTS=1
|
||||
|
|
@ -1370,9 +1264,9 @@ ssl_scheme()
|
|||
start_selfserv -V tls1.2:tls1.2 -J "$sscheme"
|
||||
|
||||
echo "tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f -d ${P_R_CLIENTDIR} $verbose ${CLIENT_OPTIONS} \\"
|
||||
echo " -V tls1.2:tls1.2 -J "$cscheme" ${CLIENT_PW} < ${REQUEST_FILE}"
|
||||
echo " -V tls1.2:tls1.2 -J "$cscheme" < ${REQUEST_FILE}"
|
||||
${PROFTOOL} ${BINDIR}/tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f ${CLIENT_OPTIONS} \
|
||||
-d ${P_R_CLIENTDIR} $verbose -V tls1.2:tls1.2 -J "$cscheme" ${CLIENT_PW} < ${REQUEST_FILE} 2>&1
|
||||
-d ${P_R_CLIENTDIR} $verbose -V tls1.2:tls1.2 -J "$cscheme" < ${REQUEST_FILE} 2>&1
|
||||
ret=$?
|
||||
# If both schemes include just one option and those options don't
|
||||
# match, then the test should fail; otherwise, assume that it works.
|
||||
|
|
@ -1398,6 +1292,11 @@ ssl_scheme()
|
|||
#########################################################################
|
||||
ssl_scheme_stress()
|
||||
{
|
||||
if [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then
|
||||
echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
|
||||
return 0
|
||||
fi
|
||||
|
||||
html_head "SSL SCHEME $NORM_EXT - server $SERVER_MODE/client $CLIENT_MODE"
|
||||
|
||||
NO_ECC_CERTS=1
|
||||
|
|
@ -1410,9 +1309,9 @@ ssl_scheme_stress()
|
|||
start_selfserv -V tls1.2:tls1.2 -J "$sscheme"
|
||||
|
||||
echo "strsclnt -4 -q -p ${PORT} -d ${P_R_CLIENTDIR} $verbose ${CLIENT_OPTIONS} \\"
|
||||
echo " -V tls1.2:tls1.2 -J "$cscheme" ${HOSTADDR} ${CLIENT_PW} < ${REQUEST_FILE}"
|
||||
echo " -V tls1.2:tls1.2 -J "$cscheme" ${HOSTADDR} < ${REQUEST_FILE}"
|
||||
${PROFTOOL} ${BINDIR}/strsclnt -4 -q -p ${PORT} ${CLIENT_OPTIONS} \
|
||||
-d ${P_R_CLIENTDIR} $verbose -V tls1.2:tls1.2 -J "$cscheme" ${HOSTADDR} ${CLIENT_PW} < ${REQUEST_FILE} 2>&1
|
||||
-d ${P_R_CLIENTDIR} $verbose -V tls1.2:tls1.2 -J "$cscheme" ${HOSTADDR} < ${REQUEST_FILE} 2>&1
|
||||
ret=$?
|
||||
# If both schemes include just one option and those options don't
|
||||
# match, then the test should fail; otherwise, assume that it works.
|
||||
|
|
@ -1449,9 +1348,9 @@ ssl_exporter()
|
|||
start_selfserv -V tls1.2:tls1.2 -x "$exporter"
|
||||
|
||||
echo "tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f -d ${P_R_CLIENTDIR} $verbose ${CLIENT_OPTIONS} \\"
|
||||
echo " -V tls1.2:tls1.2 -x $exporter ${CLIENT_PW} < ${REQUEST_FILE}"
|
||||
echo " -V tls1.2:tls1.2 -x $exporter < ${REQUEST_FILE}"
|
||||
${PROFTOOL} ${BINDIR}/tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f ${CLIENT_OPTIONS} \
|
||||
-d ${P_R_CLIENTDIR} $verbose -V tls1.2:tls1.2 -x "$exporter" ${CLIENT_PW} < ${REQUEST_FILE} 2>&1 > client.out
|
||||
-d ${P_R_CLIENTDIR} $verbose -V tls1.2:tls1.2 -x "$exporter" < ${REQUEST_FILE} 2>&1 > client.out
|
||||
kill_selfserv
|
||||
diff <(LC_ALL=C grep -A1 "^ *Keying Material:" server.out) \
|
||||
<(LC_ALL=C grep -A1 "^ *Keying Material:" client.out)
|
||||
|
|
@ -1635,7 +1534,6 @@ ssl_run_tests()
|
|||
if [ "${TEST_MODE}" = "SHARED_DB" ] ; then
|
||||
ssl_policy_listsuites
|
||||
ssl_policy_selfserv
|
||||
ssl_policy_pkix_ocsp
|
||||
ssl_policy
|
||||
fi
|
||||
;;
|
||||
|
|
@ -1667,11 +1565,9 @@ ssl_run_tests()
|
|||
case "${CLIENT_MODE}" in
|
||||
"normal")
|
||||
CLIENT_OPTIONS=
|
||||
CLIENT_PW=${CLIENT_PW_NORMAL}
|
||||
;;
|
||||
"fips")
|
||||
CLIENT_OPTIONS=
|
||||
CLIENT_PW=${CLIENT_PW_FIPS}
|
||||
SERVER_OPTIONS=
|
||||
ssl_set_fips client on
|
||||
;;
|
||||
*)
|
||||
|
|
|
|||
0
security/nss/tests/ssl/ssl_dist_stress.sh
Executable file → Normal file
0
security/nss/tests/ssl/ssl_dist_stress.sh
Executable file → Normal file
|
|
@ -66,9 +66,6 @@
|
|||
noECC TLS12 :009E TLS12_DHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
noECC TLS12 :00A2 TLS12_DHE_DSS_WITH_AES_128_GCM_SHA256
|
||||
noECC TLS12 :CCAA TLS12_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
||||
noECC TLS13 :1301 TLS13_DHE_WITH_AES_128_GCM_SHA256
|
||||
noECC TLS13 :1302 TLS13_DHE_WITH_AES_256_GCM_SHA384
|
||||
noECC TLS13 :1303 TLS13_DHE_WITH_CHACHA20_POLY1305_SHA256
|
||||
#
|
||||
# ECC ciphers (TLS)
|
||||
#
|
||||
|
|
@ -149,7 +146,3 @@
|
|||
#
|
||||
ECC TLS12 :C02F TLS12_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - RSA-PSS
|
||||
ECC TLS12 :C030 TLS12_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - RSA-PSS
|
||||
# test TLS 1.3
|
||||
ECC TLS13 :1301 TLS13_ECDHE_WITH_AES_128_GCM_SHA256
|
||||
ECC TLS13 :1302 TLS13_ECDHE_WITH_AES_256_GCM_SHA384
|
||||
ECC TLS13 :1303 TLS13_ECDHE_WITH_CHACHA20_POLY1305_SHA256
|
||||
|
|
|
|||
|
|
@ -7,14 +7,8 @@
|
|||
# The policy string is set to the config= line in the pkcs11.txt
|
||||
# it currently has 2 keywords:
|
||||
#
|
||||
# disallow= turn off the use of this algorithm by policy. (implies disable)
|
||||
# disallow= turn off the use of this algorithm by policy.
|
||||
# allow= allow this algorithm to by used if selected by policy.
|
||||
# disable= turn off the use of this algorithm even if allowed by policy
|
||||
# (application can override)
|
||||
# enable= turn off this algorithm by default (implies allow)
|
||||
# flags= policy-lock: can't change policy with NSS_SetAlgorithmPolicy,
|
||||
# NSS_SetOption, or SSL_SetCipherPolicy
|
||||
# ssl-lock: can't change the cipher suite settings with the application.
|
||||
#
|
||||
# The syntax is disallow=algorithm{/uses}:algorithm{/uses}
|
||||
# where {} signifies an optional element
|
||||
|
|
@ -82,9 +76,6 @@
|
|||
# SECT571R1
|
||||
# Signatures:
|
||||
# DSA
|
||||
# RSA-PKCS
|
||||
# RSA-PSS
|
||||
# ECDSA
|
||||
# Hashes:
|
||||
# MD2
|
||||
# MD4
|
||||
|
|
@ -146,8 +137,7 @@
|
|||
# ssl-key-exchange
|
||||
# key-exchange (includes ssl-key-exchange)
|
||||
# cert-signature
|
||||
# all-signature (includes cert-signature)
|
||||
# signature (all signatures off, some signature allowed based on other option)
|
||||
# signature (includes cert-signature)
|
||||
# all (includes all of the above)
|
||||
#-----------------------------------------------
|
||||
# In addition there are the following options:
|
||||
|
|
@ -157,52 +147,31 @@
|
|||
# they have the following syntax:
|
||||
# allow=min-rsa=512:min-dh=1024
|
||||
#
|
||||
# in the following tests, we use the cipher suite 'd':
|
||||
# d SSL3 RSA WITH 3DES EDE CBC SHA (=:000a).
|
||||
# NOTE: the certificates used in validation are rsa-pkcs1/sha256 signed.
|
||||
#
|
||||
# Exp Enable Enable Cipher Config Policy Test Name
|
||||
# Ret EC TLS
|
||||
# turn on single cipher
|
||||
0 noECC SSL3 d disallow=all_allow=hmac-sha1:sha256:rsa-pkcs:rsa:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Allowed by Narrow Policy
|
||||
0 noECC SSL3 d disallow=all_allow=hmac-sha1/ssl,ssl-key-exchange:sha256/all-signature:rsa-pkcs/all-signature:rsa/ssl-key-exchange:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Allowed by Strict Policy
|
||||
0 noECC SSL3 d disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:rsa-pkcs/all:dsa/all:rsa-pss/all:ecdsa/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-version-max=tls1.2 Allow All Explicitly
|
||||
1 noECC SSL3 d disallow=all Disallow All Explicitly
|
||||
0 noECC SSL3 d disallow=all_allow=hmac-sha1:sha256:rsa:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Allowed by Narrow Policy
|
||||
0 noECC SSL3 d disallow=all_allow=hmac-sha1/ssl,ssl-key-exchange:sha256/cert-signature:rsa/ssl-key-exchange:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Allowed by Strict Policy
|
||||
0 noECC SSL3 d disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-version-max=tls1.2 Allow All Explicitly
|
||||
1 noECC SSL3 d disallow=all Disallow All Explicitly.
|
||||
# turn off signature only
|
||||
1 noECC SSL3 d disallow=all/signature Disallow all signatures with Explicitly
|
||||
1 noECC SSL3 d disallow=sha256 Disallow SHA256 Explicitly
|
||||
1 noECC SSL3 d disallow=sha256/cert-signature Disallow SHA256 Certificate signature Explicitly
|
||||
1 noECC SSL3 d disallow=sha256/signature Disallow All SHA256 signatures Explicitly
|
||||
1 noECC SSL3 d disallow=sha256/all-signature Disallow Any SHA256 signature Explicitly
|
||||
1 noECC SSL3 d disallow=all_allow=hmac-sha1:rsa/ssl-key-exchange:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Disallow SHA256 Signatures Implicitly Narrow
|
||||
1 noECC SSL3 d disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha384/all:sha512/all:rsa-pkcs/all:rsa-pss/all:dsa/all:ecdsa/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-version-max=tls1.2 Disallow SHA256 Signatures Implicitly
|
||||
1 noECC SSL3 d disallow=sha256 Disallow SHA256 Signatures Explicitly.
|
||||
1 noECC SSL3 d disallow=all_allow=hmac-sha1:rsa/ssl-key-exchange:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Disallow SHA256 Signatures Implicitly Narrow.
|
||||
1 noECC SSL3 d disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha384/all:sha512/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-version-max=tls1.2 Disallow SHA256 Signatures Implicitly.
|
||||
# turn off single cipher
|
||||
1 noECC SSL3 d disallow=des-ede3-cbc Disallow Cipher Explicitly
|
||||
1 noECC SSL3 d disallow=all_allow=hmac-sha1:sha256:rsa-pkcs:rsa:des-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Disallow Cipher Implicitly Narrow
|
||||
1 noECC SSL3 d disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:rsa-pkcs/all:rsa-pss/all:ecdsa/all:dsa/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-verion-max=tls1.2 Disallow Cipher Implicitly
|
||||
1 noECC SSL3 d disallow=all_allow=hmac-sha1:sha256:rsa:des-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Disallow Cipher Implicitly Narrow.
|
||||
1 noECC SSL3 d disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-verion-max=tls1.2 Disallow Cipher Implicitly.
|
||||
# turn off H-Mac
|
||||
1 noECC SSL3 d disallow=hmac-sha1 Disallow HMAC Explicitly
|
||||
1 noECC SSL3 d disallow=all_allow=md5:sha256:rsa:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Disallow HMAC Implicitly Narrow
|
||||
1 noECC SSL3 d disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-version-max=tls1.2 Disallow HMAC Signatures Implicitly
|
||||
1 noECC SSL3 d disallow=all_allow=md5:sha256:rsa:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Disallow HMAC Implicitly Narrow.
|
||||
1 noECC SSL3 d disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-version-max=tls1.2 Disallow HMAC Signatures Implicitly.
|
||||
# turn off key exchange
|
||||
1 noECC SSL3 d disallow=rsa/ssl-key-exchange Disallow Key Exchange Explicitly
|
||||
1 noECC SSL3 d disallow=all_allow=hmac-sha1:sha256:rsa-pkcs:dh-dss:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Disallow Key Exchange Implicitly Narrow
|
||||
1 noECC SSL3 d disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:rsa-pkcs/all:rsa-pss/all:ecdsa/all:dsa/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-version-max=tls1.2 Disallow Key Exchange Signatures Implicitly
|
||||
1 noECC SSL3 d disallow=rsa/ssl-key-exchange Disallow Key Exchange Explicitly.
|
||||
1 noECC SSL3 d disallow=all_allow=hmac-sha1:sha256:dh-dss:des-ede3-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0 Disallow Key Exchange Implicitly Narrow.
|
||||
1 noECC SSL3 d disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=ssl2.0:tls-version-max=tls1.2 Disallow Key Exchnage Signatures Implicitly.
|
||||
# turn off version
|
||||
1 noECC SSL3 d allow=tls-version-min=tls1.0:tls-version-max=tls1.2 Disallow Version Exlicitly
|
||||
1 noECC SSL3 d disallow=all_allow=hmac-sha1:sha256:rsa-pkcs:rsa:des-ede3-cbc:tls-version-min=tls1.0:tls-version-max=tls1.2 Disallow Version Implicitly Narrow
|
||||
1 noECC SSL3 d disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:rsa-pkcs/all:rsa-pss/all:ecdsa/all:dsa/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=tls1.0:tls-version-max=tls1.2 Disallow Version Implicitly
|
||||
0 noECC SSL3 d disallow=dsa Disallow DSA Signatures Explicitly
|
||||
1 noECC SSL3 d disallow=rsa-pkcs Disallow RSA PKCS 1 Signatures Explicitly
|
||||
1 noECC SSL3 d allow=rsa-min=16384:key-size-flags=key-size-verify Restrict RSA keys on signature verification
|
||||
1 noECC SSL3 d allow=rsa-min=16384:key-size-flags=key-size-sign Restrict RSA keys on signing
|
||||
1 noECC SSL3 d allow=rsa-min=16384:key-size-flags=key-size-ssl Restrict RSA keys when used in SSL
|
||||
0 noECC SSL3 d allow=rsa-min=1023 Restrict RSA keys when used in SSL
|
||||
# test default settings
|
||||
# NOTE: tstclient will attempt to overide the defaults, so we detect we
|
||||
# were successful by locking in our settings
|
||||
0 noECC SSL3 d allow=all_disable=all Disable all by default, application override
|
||||
1 noECC SSL3 d allow=all_disable=all_flags=ssl-lock,policy-lock Disable all by default, prevent application from enabling
|
||||
0 noECC SSL3 d allow=all_disable=all_flags=policy-lock Disable all by default, lock policy (application can still change the ciphers)
|
||||
# explicitly enable :002f RSA_AES_128_CBC_SHA1 and lock it in
|
||||
0 noECC SSL3 d allow=all_disable=all_enable=hmac-sha1:sha256:rsa-pkcs:rsa:aes128-cbc:tls-version-min=ssl3.0:tls-version-max=ssl3.0_flags=ssl-lock Lock in a different ciphersuite that the one the application asks for
|
||||
1 noECC SSL3 d disallow=all_allow=hmac-sha1:sha256:rsa:des-ede3-cbc:tls-version-min=tls1.0:tls-version-max=tls1.2 Disallow Version Implicitly Narrow.
|
||||
1 noECC SSL3 d disallow=all_allow=md2/all:md4/all:md5/all:sha1/all:sha256/all:sha384/all:sha512/all:hmac-sha1/all:hmac-sha224/all:hmac-sha256/all:hmac-sha384/all:hmac-sha512/all:hmac-md5/all:camellia128-cbc/all:camellia192-cbc/all:camellia256-cbc/all:seed-cbc/all:des-ede3-cbc/all:des-40-cbc/all:des-cbc/all:null-cipher/all:rc2/all:rc4/all:idea/all:rsa/all:rsa-export/all:dhe-rsa/all:dhe-dss/all:ecdhe-ecdsa/all:ecdhe-rsa/all:ecdh-ecdsa/all:ecdh-rsa/all:tls-version-min=tls1.0:tls-version-max=tls1.2 Disallow Version Implicitly.
|
||||
0 noECC SSL3 d disallow=dsa Disallow DSA Signatures Explicitly.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue