@@ -1764,33 +1764,28 @@ def test_get_ephemeral_key
17641764 end
17651765 end
17661766
1767- if !aws_lc? # AWS-LC does not support DHE ciphersuites.
1768- # DHE
1769- # TODO: SSL_CTX_set1_groups() is required for testing this with TLS 1.3
1770- ctx_proc2 = proc { |ctx |
1771- ctx . max_version = OpenSSL ::SSL ::TLS1_2_VERSION
1772- ctx . ciphers = "EDH"
1773- ctx . tmp_dh = Fixtures . pkey ( "dh-1" )
1774- }
1775- start_server ( ctx_proc : ctx_proc2 ) do |port |
1767+ # DHE
1768+ # OpenSSL 3.0 added support for named FFDHE groups in TLS 1.3
1769+ # LibreSSL does not support named FFDHE groups currently
1770+ # AWS-LC does not support DHE ciphersuites
1771+ if openssl? ( 3 , 0 , 0 )
1772+ start_server do |port |
17761773 ctx = OpenSSL ::SSL ::SSLContext . new
1777- ctx . max_version = OpenSSL ::SSL ::TLS1_2_VERSION
1778- ctx . ciphers = "EDH"
1774+ ctx . groups = "ffdhe3072"
17791775 server_connect ( port , ctx ) { |ssl |
17801776 assert_instance_of OpenSSL ::PKey ::DH , ssl . tmp_key
1777+ assert_equal 3072 , ssl . tmp_key . p . num_bits
1778+ ssl . puts "abc" ; assert_equal "abc\n " , ssl . gets
17811779 }
17821780 end
17831781 end
17841782
17851783 # ECDHE
17861784 ctx_proc3 = proc { |ctx |
1787- ctx . ciphers = "DEFAULT:!kRSA:!kEDH"
1788- ctx . ecdh_curves = "P-256"
1785+ ctx . groups = "P-256"
17891786 }
17901787 start_server ( ctx_proc : ctx_proc3 ) do |port |
1791- ctx = OpenSSL ::SSL ::SSLContext . new
1792- ctx . ciphers = "DEFAULT:!kRSA:!kEDH"
1793- server_connect ( port , ctx ) { |ssl |
1788+ server_connect ( port ) { |ssl |
17941789 assert_instance_of OpenSSL ::PKey ::EC , ssl . tmp_key
17951790 ssl . puts "abc" ; assert_equal "abc\n " , ssl . gets
17961791 }
@@ -2001,17 +1996,17 @@ def test_tmp_dh
20011996 end
20021997 end
20031998
2004- def test_ecdh_curves_tls12
1999+ def test_set_groups_tls12
20052000 ctx_proc = -> ctx {
20062001 # Enable both ECDHE (~ TLS 1.2) cipher suites and TLS 1.3
20072002 ctx . max_version = OpenSSL ::SSL ::TLS1_2_VERSION
20082003 ctx . ciphers = "kEECDH"
2009- ctx . ecdh_curves = "P-384:P-521"
2004+ ctx . groups = "P-384:P-521"
20102005 }
20112006 start_server ( ctx_proc : ctx_proc , ignore_listener_error : true ) do |port |
20122007 # Test 1: Client=P-256:P-384, Server=P-384:P-521 --> P-384
20132008 ctx = OpenSSL ::SSL ::SSLContext . new
2014- ctx . ecdh_curves = "P-256:P-384"
2009+ ctx . groups = "P-256:P-384"
20152010 server_connect ( port , ctx ) { |ssl |
20162011 cs = ssl . cipher [ 0 ]
20172012 assert_match ( /\A ECDH/ ) , cs
@@ -2021,29 +2016,36 @@ def test_ecdh_curves_tls12
20212016
20222017 # Test 2: Client=P-256, Server=P-521:P-384 --> Fail
20232018 ctx = OpenSSL ::SSL ::SSLContext . new
2024- ctx . ecdh_curves = "P-256"
2019+ ctx . groups = "P-256"
20252020 assert_raise ( OpenSSL ::SSL ::SSLError ) {
20262021 server_connect ( port , ctx ) { }
20272022 }
20282023
20292024 # Test 3: Client=P-521:P-384, Server=P-521:P-384 --> P-521
20302025 ctx = OpenSSL ::SSL ::SSLContext . new
2031- ctx . ecdh_curves = "P-521:P-384"
2026+ ctx . groups = "P-521:P-384"
20322027 server_connect ( port , ctx ) { |ssl |
20332028 assert_equal "secp521r1" , ssl . tmp_key . group . curve_name
20342029 ssl . puts "abc" ; assert_equal "abc\n " , ssl . gets
20352030 }
2031+
2032+ # Test 4: #ecdh_curves= alias
2033+ ctx = OpenSSL ::SSL ::SSLContext . new
2034+ ctx . ecdh_curves = "P-256:P-384"
2035+ server_connect ( port , ctx ) { |ssl |
2036+ assert_equal "secp384r1" , ssl . tmp_key . group . curve_name
2037+ }
20362038 end
20372039 end
20382040
2039- def test_ecdh_curves_tls13
2041+ def test_set_groups_tls13
20402042 ctx_proc = -> ctx {
20412043 # Assume TLS 1.3 is enabled and chosen by default
2042- ctx . ecdh_curves = "P-384:P-521"
2044+ ctx . groups = "P-384:P-521"
20432045 }
20442046 start_server ( ctx_proc : ctx_proc , ignore_listener_error : true ) do |port |
20452047 ctx = OpenSSL ::SSL ::SSLContext . new
2046- ctx . ecdh_curves = "P-256:P-384" # disable P-521
2048+ ctx . groups = "P-256:P-384" # disable P-521
20472049
20482050 server_connect ( port , ctx ) { |ssl |
20492051 assert_equal "TLSv1.3" , ssl . ssl_version
0 commit comments