From c3f447a698e171c6829d606cc36ef21191253017 Mon Sep 17 00:00:00 2001 From: Piotr Tabor Date: Mon, 8 Feb 2021 20:38:06 +0100 Subject: [PATCH] Fix pkg/tlsutil (test) to not fail on 386. In fact this commit rewrites the functionality to use upstream list of ciphers instead of checking whether the lists are in sync using ast analysis. --- pkg/tlsutil/cipher_suites.go | 46 +++++++++++------------------ pkg/tlsutil/cipher_suites_test.go | 48 ++++++++++++++++++------------- 2 files changed, 45 insertions(+), 49 deletions(-) diff --git a/pkg/tlsutil/cipher_suites.go b/pkg/tlsutil/cipher_suites.go index b5916bb54..f278a61f8 100644 --- a/pkg/tlsutil/cipher_suites.go +++ b/pkg/tlsutil/cipher_suites.go @@ -16,36 +16,24 @@ package tlsutil import "crypto/tls" -// cipher suites implemented by Go -// https://github.com/golang/go/blob/dev.boringcrypto.go1.10/src/crypto/tls/cipher_suites.go -var cipherSuites = map[string]uint16{ - "TLS_RSA_WITH_RC4_128_SHA": tls.TLS_RSA_WITH_RC4_128_SHA, - "TLS_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, - "TLS_RSA_WITH_AES_128_CBC_SHA": tls.TLS_RSA_WITH_AES_128_CBC_SHA, - "TLS_RSA_WITH_AES_256_CBC_SHA": tls.TLS_RSA_WITH_AES_256_CBC_SHA, - "TLS_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_RSA_WITH_AES_128_CBC_SHA256, - "TLS_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_RSA_WITH_AES_128_GCM_SHA256, - "TLS_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_RSA_WITH_AES_256_GCM_SHA384, - "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, - "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, - "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, - "TLS_ECDHE_RSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, - "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, - "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, - "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, -} - // GetCipherSuite returns the corresponding cipher suite, // and boolean value if it is supported. func GetCipherSuite(s string) (uint16, bool) { - v, ok := cipherSuites[s] - return v, ok + for _, c := range tls.CipherSuites() { + if s == c.Name { + return c.ID, true + } + } + for _, c := range tls.InsecureCipherSuites() { + if s == c.Name { + return c.ID, true + } + } + switch s { + case "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305": + return tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, true + case "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305": + return tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, true + } + return 0, false } diff --git a/pkg/tlsutil/cipher_suites_test.go b/pkg/tlsutil/cipher_suites_test.go index ff6d97ffe..a17b46c2f 100644 --- a/pkg/tlsutil/cipher_suites_test.go +++ b/pkg/tlsutil/cipher_suites_test.go @@ -15,28 +15,36 @@ package tlsutil import ( - "go/importer" - "reflect" - "strings" + "crypto/tls" "testing" ) -func TestGetCipherSuites(t *testing.T) { - pkg, err := importer.For("source", nil).Import("crypto/tls") - if err != nil { - t.Fatal(err) - } - cm := make(map[string]uint16) - for _, s := range pkg.Scope().Names() { - if strings.HasPrefix(s, "TLS_RSA_") || strings.HasPrefix(s, "TLS_ECDHE_") { - v, ok := GetCipherSuite(s) - if !ok { - t.Fatalf("Go implements missing cipher suite %q (%v)", s, v) - } - cm[s] = v - } - } - if !reflect.DeepEqual(cm, cipherSuites) { - t.Fatalf("found unmatched cipher suites %v (Go) != %v", cm, cipherSuites) +func TestGetCipherSuite_not_existing(t *testing.T) { + _, ok := GetCipherSuite("not_existing") + if ok { + t.Fatal("Expected not ok") } } + +func CipherSuiteExpectedToExist(tb testing.TB, cipher string, expectedId uint16) { + vid, ok := GetCipherSuite(cipher) + if !ok { + tb.Errorf("Expected %v cipher to exist", cipher) + } + if vid != expectedId { + tb.Errorf("For %v expected=%v found=%v", cipher, expectedId, vid) + } +} + +func TestGetCipherSuite_success(t *testing.T) { + CipherSuiteExpectedToExist(t, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) + CipherSuiteExpectedToExist(t, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) + + // Explicit test for legacy names + CipherSuiteExpectedToExist(t, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256) + CipherSuiteExpectedToExist(t, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256) +} + +func TestGetCipherSuite_insecure(t *testing.T) { + CipherSuiteExpectedToExist(t, "TLS_ECDHE_RSA_WITH_RC4_128_SHA", tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA) +}