Skip to content

Commit bcd34fc

Browse files
h-vnh-vn
authored
Merge pull request #433 from pghmcfc/no-sha1
Support running the test suite in an environment where sha1 isn't allowed by policy
2 parents bf68f39 + 0672d99 commit bcd34fc

File tree

5 files changed

+52
-17
lines changed

5 files changed

+52
-17
lines changed

‎Changes‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,14 @@ Revision history for Perl extension Net::SSLeay.
44
- Pass RAND_seed()'s sole argument to the underlying RAND_seed() function in
55
libcrypto, rather than passing the value of a non-existent second argument.
66
Fixes GH-427. Thanks to cgf1 for the report.
7+
- Avoid explicit and implicit use of weak hash algorithms,
8+
such as MD5 and SHA-1, in test suite. This allows tests
9+
44_sess.t and 45_exporter.t to correctly work on systems
10+
where crypto policies prohibit their direct use and TLS
11+
versions that require them. An example of such a system is
12+
Rocky Linux 9.2. Any Red Hat Enterprise Linux 9 and derived
13+
system is likely to have similar behaviour. Thanks to Paul
14+
Howarth for the investigation and patches.
715

816
1.93_02 2023-02-22
917
- Update ppport.h to version 3.68. This eliminates thousands of

‎t/local/33_x509_create_cert.t‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -98,8 +98,8 @@ is(Net::SSLeay::X509_NAME_cmp($ca_issuer, $ca_subject), 0, "X509_NAME_cmp");
9898
&Net::SSLeay::NID_crl_distribution_points => 'URI:http://pki.dom.com/crl1.pem,URI:http://pki.dom.com/crl2.pem',
9999
), "P_X509_add_extensions");
100100

101-
ok(my $sha1_digest = Net::SSLeay::EVP_get_digestbyname("sha1"), "EVP_get_digestbyname");
102-
ok(Net::SSLeay::X509_sign($x509, $ca_pk, $sha1_digest), "X509_sign");
101+
ok(my $sha256_digest = Net::SSLeay::EVP_get_digestbyname("sha256"), "EVP_get_digestbyname");
102+
ok(Net::SSLeay::X509_sign($x509, $ca_pk, $sha256_digest), "X509_sign");
103103

104104
is(Net::SSLeay::X509_get_version($x509), 3, "X509_get_version");
105105
is(Net::SSLeay::X509_verify($x509, Net::SSLeay::X509_get_pubkey($ca_cert)), 1, "X509_verify");
@@ -208,8 +208,8 @@ is(Net::SSLeay::X509_NAME_cmp($ca_issuer, $ca_subject), 0, "X509_NAME_cmp");
208208

209209
ok(Net::SSLeay::X509_REQ_set_version($req, 2), "X509_REQ_set_version");
210210

211-
ok(my $sha1_digest = Net::SSLeay::EVP_get_digestbyname("sha1"), "EVP_get_digestbyname");
212-
ok(Net::SSLeay::X509_REQ_sign($req, $pk, $sha1_digest), "X509_REQ_sign");
211+
ok(my $sha256_digest = Net::SSLeay::EVP_get_digestbyname("sha256"), "EVP_get_digestbyname");
212+
ok(Net::SSLeay::X509_REQ_sign($req, $pk, $sha256_digest), "X509_REQ_sign");
213213

214214
ok(my $req_pubkey = Net::SSLeay::X509_REQ_get_pubkey($req), "X509_REQ_get_pubkey");
215215
is(Net::SSLeay::X509_REQ_verify($req, $req_pubkey), 1, "X509_REQ_verify");
@@ -250,7 +250,7 @@ is(Net::SSLeay::X509_NAME_cmp($ca_issuer, $ca_subject), 0, "X509_NAME_cmp");
250250
ok(Net::SSLeay::X509_set_pubkey($x509ss,$tmppkey), "X509_set_pubkey");
251251
Net::SSLeay::EVP_PKEY_free($tmppkey);
252252

253-
ok(Net::SSLeay::X509_sign($x509ss, $ca_pk, $sha1_digest), "X509_sign");
253+
ok(Net::SSLeay::X509_sign($x509ss, $ca_pk, $sha256_digest), "X509_sign");
254254
like(my $crt_pem = Net::SSLeay::PEM_get_string_X509($x509ss), qr/-----BEGIN CERTIFICATE-----/, "PEM_get_string_X509");
255255

256256
#write_file("tmp_cert2.crt.pem", $crt_pem);
@@ -318,8 +318,8 @@ is(Net::SSLeay::X509_NAME_cmp($ca_issuer, $ca_subject), 0, "X509_NAME_cmp");
318318
ok(Net::SSLeay::P_ASN1_TIME_set_isotime(Net::SSLeay::X509_get_notAfter($x509), "2038-01-01T00:00:00Z"), "P_ASN1_TIME_set_isotime+X509_get_notAfter");
319319
}
320320

321-
ok(my $sha1_digest = Net::SSLeay::EVP_get_digestbyname("sha1"), "EVP_get_digestbyname");
322-
ok(Net::SSLeay::X509_sign($x509, $ca_pk, $sha1_digest), "X509_sign");
321+
ok(my $sha256_digest = Net::SSLeay::EVP_get_digestbyname("sha256"), "EVP_get_digestbyname");
322+
ok(Net::SSLeay::X509_sign($x509, $ca_pk, $sha256_digest), "X509_sign");
323323

324324
like(my $crt_pem = Net::SSLeay::PEM_get_string_X509($x509), qr/-----BEGIN CERTIFICATE-----/, "PEM_get_string_X509");
325325
like(my $key_pem = Net::SSLeay::PEM_get_string_PrivateKey($pk), qr/-----BEGIN (RSA )?PRIVATE KEY-----/, "PEM_get_string_PrivateKey");
@@ -333,8 +333,8 @@ is(Net::SSLeay::X509_NAME_cmp($ca_issuer, $ca_subject), 0, "X509_NAME_cmp");
333333
ok(my $bio = Net::SSLeay::BIO_new_file($req_pem, 'r'), "BIO_new_file");
334334
ok(my $req = Net::SSLeay::PEM_read_bio_X509_REQ($bio), "PEM_read_bio_X509");
335335

336-
ok(my $sha1_digest = Net::SSLeay::EVP_get_digestbyname("sha1"), "EVP_get_digestbyname");
337-
is(unpack("H*", Net::SSLeay::X509_REQ_digest($req, $sha1_digest)), "372c21a20a6d4e15bf8ecefb487cc604d9a10960", "X509_REQ_digest");
336+
ok(my $sha256_digest = Net::SSLeay::EVP_get_digestbyname("sha256"), "EVP_get_digestbyname");
337+
is(unpack("H*", Net::SSLeay::X509_REQ_digest($req, $sha256_digest)), "420e99da1e23e192409ab2a5f1a9b09ac03c52fa4b8bd0d19e561358f9880e88", "X509_REQ_digest");
338338

339339
ok(my $req2 = Net::SSLeay::X509_REQ_new(), "X509_REQ_new");
340340
ok(my $name = Net::SSLeay::X509_REQ_get_subject_name($req), "X509_REQ_get_subject_name");

‎t/local/34_x509_crl.t‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ ok(my $ca_pk = Net::SSLeay::PEM_read_bio_PrivateKey($bio2), "PEM_read_bio_Privat
3939
is(Net::SSLeay::P_ASN1_TIME_get_isotime($time_next), '2020-07-08T00:00:00Z', "P_ASN1_TIME_get_isotime next");
4040

4141
is(Net::SSLeay::X509_CRL_get_version($crl1), 1, "X509_CRL_get_version");
42-
ok(my $sha1_digest = Net::SSLeay::EVP_get_digestbyname("sha1"), "EVP_get_digestbyname");
43-
is(unpack("H*",Net::SSLeay::X509_CRL_digest($crl1, $sha1_digest)), 'f0e5c853477a206c03f7347aee09a01d91df0ac5', "X509_CRL_digest");
42+
ok(my $sha256_digest = Net::SSLeay::EVP_get_digestbyname("sha256"), "EVP_get_digestbyname");
43+
is(unpack("H*",Net::SSLeay::X509_CRL_digest($crl1, $sha256_digest)), '4edc18ec956e722cbcf96589a43535c2d1d557e3cec55b1e421897827c3bb8be', "X509_CRL_digest");
4444
}
4545

4646
{ ### X509_CRL create
@@ -81,9 +81,9 @@ ok(my $ca_pk = Net::SSLeay::PEM_read_bio_PrivateKey($bio2), "PEM_read_bio_Privat
8181
&Net::SSLeay::NID_authority_key_identifier => 'keyid:always,issuer:always',
8282
), "P_X509_CRL_add_extensions");
8383

84-
ok(my $sha1_digest = Net::SSLeay::EVP_get_digestbyname("sha1"), "EVP_get_digestbyname");
84+
ok(my $sha256_digest = Net::SSLeay::EVP_get_digestbyname("sha256"), "EVP_get_digestbyname");
8585
ok(Net::SSLeay::X509_CRL_sort($crl), "X509_CRL_sort");
86-
ok(Net::SSLeay::X509_CRL_sign($crl, $ca_pk, $sha1_digest), "X509_CRL_sign");
86+
ok(Net::SSLeay::X509_CRL_sign($crl, $ca_pk, $sha256_digest), "X509_CRL_sign");
8787

8888
like(my $crl_pem = Net::SSLeay::PEM_get_string_X509_CRL($crl), qr/-----BEGIN X509 CRL-----/, "PEM_get_string_X509_CRL");
8989

‎t/local/44_sess.t‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
use lib 'inc';
44

5-
use Net::SSLeay;
5+
use Net::SSLeay qw( ERROR_SSL );
66
use Test::Net::SSLeay qw(
77
can_fork data_file_path initialise_libssl is_protocol_usable new_ctx
88
tcp_socket
@@ -14,7 +14,7 @@ use English qw( $EVAL_ERROR $OSNAME $PERL_VERSION -no_match_vars );
1414
if (not can_fork()) {
1515
plan skip_all => "fork() not supported on this system";
1616
} else {
17-
plan tests => 58;
17+
plan tests => 59;
1818
}
1919

2020
initialise_libssl();
@@ -150,6 +150,7 @@ sub server_remove_cb
150150
my ($server_ctx, $client_ctx, $server_ssl, $client_ssl);
151151

152152
my $server = tcp_socket();
153+
my $proto_count = 0;
153154

154155
sub server
155156
{
@@ -265,6 +266,14 @@ sub client {
265266
Net::SSLeay::set_fd($ssl, $cl);
266267
my $ret = Net::SSLeay::connect($ssl);
267268
if ($ret <= 0) {
269+
# Connection might fail due to attempted use of algorithm in key
270+
# exchange that is forbidden by security policy, resulting in ERROR_SSL
271+
my $ssl_err = Net::SSLeay::get_error($ssl, $ret);
272+
if ($ssl_err == ERROR_SSL) {
273+
diag("Protocol $proto, connect() failed, maybe due to security policy");
274+
$usable{$round} = 0;
275+
next;
276+
}
268277
diag("Protocol $proto, connect() returns $ret, Error: ".Net::SSLeay::ERR_error_string(Net::SSLeay::ERR_get_error()));
269278
}
270279
my $msg = Net::SSLeay::read($ssl);
@@ -284,6 +293,7 @@ sub client {
284293
Net::SSLeay::shutdown($ssl);
285294
Net::SSLeay::free($ssl);
286295
close($cl) || die("client close: $!");
296+
$proto_count += 1;
287297
}
288298

289299
maybe_sleep();
@@ -369,6 +379,8 @@ sub test_stats {
369379
}
370380
}
371381

382+
cmp_ok($proto_count, '>=', 1, "At least one protocol fully testable");
383+
372384
# use Data::Dumper; print "Server:\n" . Dumper(\%srv_stats);
373385
# use Data::Dumper; print "Client:\n" . Dumper(\%clt_stats);
374386
}

‎t/local/45_exporter.t‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
use lib 'inc';
44

5-
use Net::SSLeay;
5+
use Net::SSLeay qw( ERROR_SSL );
66
use Test::Net::SSLeay qw(
77
can_fork data_file_path initialise_libssl is_protocol_usable new_ctx
88
tcp_socket
@@ -15,7 +15,7 @@ if (not can_fork()) {
1515
} elsif (!defined &Net::SSLeay::export_keying_material) {
1616
plan skip_all => "No export_keying_material()";
1717
} else {
18-
plan tests => 36;
18+
plan tests => 37;
1919
}
2020

2121
initialise_libssl();
@@ -37,6 +37,7 @@ my (%server_stats, %client_stats);
3737
my ($server_ctx, $client_ctx, $server_ssl, $client_ssl);
3838

3939
my $server = tcp_socket();
40+
my $proto_count = 0;
4041

4142
sub server
4243
{
@@ -88,6 +89,16 @@ sub client {
8889
Net::SSLeay::set_fd( $ssl, $cl );
8990
my $ret = Net::SSLeay::connect($ssl);
9091
if ($ret <= 0) {
92+
# Connection might fail due to attempted use of algorithm in key
93+
# exchange that is forbidden by security policy, resulting in ERROR_SSL
94+
my $ssl_err = Net::SSLeay::get_error($ssl, $ret);
95+
if ($ssl_err == ERROR_SSL) {
96+
diag("Protocol $round, connect() failed, maybe due to security policy");
97+
SKIP: {
98+
skip( "$round not available in this enviornment", 9 );
99+
}
100+
next;
101+
}
91102
diag("Protocol $round, connect() returns $ret, Error: ".Net::SSLeay::ERR_error_string(Net::SSLeay::ERR_get_error()));
92103
}
93104

@@ -100,6 +111,7 @@ sub client {
100111
Net::SSLeay::shutdown($ssl);
101112
Net::SSLeay::free($ssl);
102113
close($cl) || die("client close: $!");
114+
$proto_count += 1;
103115
}
104116
else {
105117
SKIP: {
@@ -168,4 +180,7 @@ sub test_export_early
168180
server();
169181
client();
170182
waitpid $pid, 0;
183+
184+
cmp_ok($proto_count, '>=', 1, "At least one protocol fully testable");
185+
171186
exit(0);

0 commit comments

Comments
 (0)