mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-02-17 14:32:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add a test for CVE-2021-3449

Browse Source 
We perform a reneg handshake, where the second ClientHello drops the
sig_algs extension. It must also contain cert_sig_algs for the test to
work.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
This commit is contained in:
Matt Caswell 2021-03-18 15:29:04 +00:00
parent ae937a096c
commit 112580c27b
1 changed files with 35 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
test/recipes/70-test_renegotiation.t
View File

@ -38,7 +38,7 @@ my $proxy = TLSProxy::Proxy->new(
$proxy->clientflags("-no_tls1_3");
$proxy->reneg(1);
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 3;
plan tests => 4;
ok(TLSProxy::Message->success(), "Basic renegotiation");
#Test 2: Client does not send the Reneg SCSV. Reneg should fail
@ -78,6 +78,20 @@ SKIP: {
"Check ClientHello version is the same");
}
SKIP: {
skip "TLSv1.2 disabled", 1
if disabled("tls1_2");
#Test 4: Test for CVE-2021-3449. client_sig_algs instead of sig_algs in
# resumption ClientHello
$proxy->clear();
$proxy->filter(\&sigalgs_filter);
$proxy->clientflags("-tls1_2");
$proxy->reneg(1);
$proxy->start();
ok(TLSProxy::Message->fail(), "client_sig_algs instead of sig_algs");
}
sub reneg_filter
{
my $proxy = shift;
@ -97,3 +111,23 @@ sub reneg_filter
}
}
}
sub sigalgs_filter
{
my $proxy = shift;
my $cnt = 0;
# We're only interested in the second ClientHello message
foreach my $message (@{$proxy->message_list}) {
if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO) {
next if ($cnt++ == 0);
my $sigs = pack "C10", 0x00, 0x08,
# rsa_pkcs_sha{256,384,512,1}
0x04, 0x01, 0x05, 0x01, 0x06, 0x01, 0x02, 0x01;
$message->set_extension(TLSProxy::Message::EXT_SIG_ALGS_CERT, $sigs);
$message->delete_extension(TLSProxy::Message::EXT_SIG_ALGS);
$message->repack();
}
}
}