wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-23 00:47:31 +09:00
Code Issues Projects Releases Packages Wiki Activity

Replace NSS with Pale Moon's

Browse source
This commit is contained in:
wuggy 2026-06-29 21:29:25 +01:00
commit 8c2e376f94
2870 changed files with 1762232 additions and 1374220 deletions
Download patch file Download diff file Expand all files Collapse all files

88
security/nss/gtests/ssl_gtest/ssl_dhe_unittest.cc
View file

@ -1,4 +1,5 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/. */
@ -345,11 +346,11 @@ static const bool kTrueFalseArr[] = {true, false};
static ::testing::internal::ParamGenerator<bool> kTrueFalse =
::testing::ValuesIn(kTrueFalseArr);
INSTANTIATE_TEST_CASE_P(
INSTANTIATE_TEST_SUITE_P(
DamageYStream, TlsDamageDHYTest,
::testing::Combine(TlsConnectTestBase::kTlsVariantsStream,
TlsConnectTestBase::kTlsV10ToV12, kAllY, kTrueFalse));
INSTANTIATE_TEST_CASE_P(
INSTANTIATE_TEST_SUITE_P(
DamageYDatagram, TlsDamageDHYTest,
::testing::Combine(TlsConnectTestBase::kTlsVariantsDatagram,
TlsConnectTestBase::kTlsV11V12, kAllY, kTrueFalse));
@ -642,37 +643,6 @@ TEST_P(TlsConnectGenericPre13, InvalidDERSignatureFfdhe) {
client_->CheckErrorCode(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
}
// Replace SignatureAndHashAlgorithm of a SKE.
class DHEServerKEXSigAlgReplacer : public TlsHandshakeFilter {
public:
DHEServerKEXSigAlgReplacer(const std::shared_ptr<TlsAgent>& server,
SSLSignatureScheme sig_scheme)
: TlsHandshakeFilter(server, {kTlsHandshakeServerKeyExchange}),
sig_scheme_(sig_scheme) {}
protected:
virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
const DataBuffer& input,
DataBuffer* output) {
*output = input;
uint32_t len;
uint32_t idx = 0;
EXPECT_TRUE(output->Read(idx, 2, &len));
idx += 2 + len;
EXPECT_TRUE(output->Read(idx, 2, &len));
idx += 2 + len;
EXPECT_TRUE(output->Read(idx, 2, &len));
idx += 2 + len;
output->Write(idx, sig_scheme_, 2);
return CHANGE;
}
private:
SSLSignatureScheme sig_scheme_;
};
TEST_P(TlsConnectTls12, ConnectInconsistentSigAlgDHE) {
EnableOnlyDheCiphers();
@ -753,6 +723,34 @@ TEST_P(TlsConnectTls12, ConnectSigAlgDisabledByPolicyDhe) {
CheckSkeSigScheme(capture_ske, ssl_sig_rsa_pkcs1_sha384);
}
TEST_P(TlsConnectPre12, ConnectSigAlgDisabledWeakGroupByOption3072DhePre12) {
EnableOnlyDheCiphers();
// explicitly enable the weak groups
EXPECT_EQ(SECSuccess,
SSL_EnableWeakDHEPrimeGroup(server_->ssl_fd(), PR_TRUE));
EXPECT_EQ(SECSuccess,
SSL_EnableWeakDHEPrimeGroup(client_->ssl_fd(), PR_TRUE));
server_->SetNssOption(NSS_DH_MIN_KEY_SIZE, 3072);
Connect();
client_->CheckKEA(ssl_kea_dh, ssl_grp_ffdhe_3072, 3072);
server_->CheckKEA(ssl_kea_dh, ssl_grp_ffdhe_3072, 3072);
}
TEST_P(TlsConnectPre12, ConnectSigAlgDisabledWeakGroupByOption2048DhePre12) {
EnableOnlyDheCiphers();
// explicitly enable the weak groups
EXPECT_EQ(SECSuccess,
SSL_EnableWeakDHEPrimeGroup(server_->ssl_fd(), PR_TRUE));
EXPECT_EQ(SECSuccess,
SSL_EnableWeakDHEPrimeGroup(client_->ssl_fd(), PR_TRUE));
server_->SetNssOption(NSS_DH_MIN_KEY_SIZE, 2048);
Connect();
client_->CheckKEA(ssl_kea_dh, ssl_grp_ffdhe_2048, 2048);
server_->CheckKEA(ssl_kea_dh, ssl_grp_ffdhe_2048, 2048);
}
TEST_P(TlsConnectPre12, ConnectSigAlgDisabledByPolicyDhePre12) {
EnableOnlyDheCiphers();
@ -777,4 +775,28 @@ TEST_P(TlsConnectPre12, ConnectSigAlgDisabledByPolicyDhePre12) {
server_->CheckErrorCode(SSL_ERROR_UNSUPPORTED_HASH_ALGORITHM);
}
TEST_P(TlsConnectTls12, ConnectSigAlgDisablePreferredGroupByOption3072Dhe) {
EnableOnlyDheCiphers();
static const SSLDHEGroupType dhe_groups[] = {
ssl_ff_dhe_2048_group, // first in the lists is the preferred group
ssl_ff_dhe_3072_group};
server_->SetNssOption(NSS_DH_MIN_KEY_SIZE, 3072);
EXPECT_EQ(SECSuccess, SSL_DHEGroupPrefSet(server_->ssl_fd(), &dhe_groups[0],
PR_ARRAY_SIZE(dhe_groups)));
Connect();
// our option size should override the preferred group
client_->CheckKEA(ssl_kea_dh, ssl_grp_ffdhe_3072, 3072);
server_->CheckKEA(ssl_kea_dh, ssl_grp_ffdhe_3072, 3072);
}
TEST_P(TlsConnectTls12, ConnectSigAlgDisableGroupByOption3072Dhe) {
EnableOnlyDheCiphers();
server_->SetNssOption(NSS_DH_MIN_KEY_SIZE, 3072);
Connect();
client_->CheckKEA(ssl_kea_dh, ssl_grp_ffdhe_3072, 3072);
server_->CheckKEA(ssl_kea_dh, ssl_grp_ffdhe_3072, 3072);
}
} // namespace nss_test