Skip to content

Commit 3845ae3

Browse files
tomato42tomato42
authored
Merge pull request #4 from redhat-qe-security/dss-on-fedora
DHE-DSS & RC4 on Fedora (and other non-RHEL distros) with gnutls
2 parents f0f7f97 + 348650d commit 3845ae3

File tree

4 files changed

+33
-17
lines changed

4 files changed

+33
-17
lines changed

‎gnutls/Interoperability/TLSv1-2-with-NSS/runtest.sh‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
PACKAGE="gnutls"
3333
PACKAGES="openssl gnutls nss"
3434

35+
GNUTLS_PRIO="NORMAL:+ARCFOUR-128:+DHE-DSS:+SIGN-DSA-SHA1:+SIGN-DSA-SHA224:+SIGN-DSA-SHA256"
3536
SERVER_UTIL="/usr/lib/nss/unsupported-tools/selfserv"
3637
CLIENT_UTIL="/usr/lib/nss/unsupported-tools/tstclnt"
3738
[ -f /usr/lib64/nss/unsupported-tools/selfserv ] && SERVER_UTIL="/usr/lib64/nss/unsupported-tools/selfserv"
@@ -391,7 +392,7 @@ rlJournalStart
391392
options=(gnutls-serv --http -p 4433)
392393
options+=(--x509keyfile ${C_KEY[$j]})
393394
options+=(--x509certfile "<(cat ${C_CERT[$j]} ${C_SUBCA[$j]})")
394-
options+=(--priority NORMAL:+VERS-TLS1.2)
395+
options+=(--priority ${GNUTLS_PRIO}:+VERS-TLS1.2)
395396
options+=(">server.log" "2>server.err" "&")
396397
rlRun "${options[*]}"
397398
gnutls_pid=$!
@@ -451,9 +452,9 @@ rlJournalStart
451452
options+=(--x509cafile $(x509Cert ca))
452453
options+=(-p 4433 localhost)
453454
if [[ $prot == "tls1_2" ]]; then
454-
options+=(--priority NORMAL:+VERS-TLS1.2)
455+
options+=(--priority ${GNUTLS_PRIO}:+VERS-TLS1.2)
455456
else
456-
options+=(--priority NORMAL:-VERS-TLS1.2)
457+
options+=(--priority ${GNUTLS_PRIO}:-VERS-TLS1.2)
457458
fi
458459
rlRun -s "expect gnutls-client.expect ${options[*]}"
459460
rlAssertGrep "GET / HTTP/1.0" $rlRun_LOG
@@ -484,7 +485,7 @@ rlJournalStart
484485

485486
rlLogInfo "Test proper"
486487
options=(--http -p 4433)
487-
options+=(--priority NORMAL:+VERS-TLS1.2)
488+
options+=(--priority ${GNUTLS_PRIO}:+VERS-TLS1.2)
488489
options+=(--x509keyfile ${C_KEY[$j]})
489490
options+=(--x509certfile '<(cat ${C_CERT[$j]} ${C_SUBCA[$j]})')
490491
options+=(--x509cafile '<(cat $(x509Cert ca) ${C_SUBCA[$j]})')
@@ -562,9 +563,9 @@ rlJournalStart
562563
options+=(--x509certfile ${C_CLNT_CERT[$j]})
563564
options+=(--x509keyfile ${C_CLNT_KEY[$j]})
564565
if [[ $prot == "tls1_2" ]]; then
565-
options+=(--priority NORMAL:+VERS-TLS1.2)
566+
options+=(--priority ${GNUTLS_PRIO}:+VERS-TLS1.2)
566567
else
567-
options+=(--priority NORMAL:-VERS-TLS1.2)
568+
options+=(--priority ${GNUTLS_PRIO}:-VERS-TLS1.2)
568569
fi
569570
rlRun -s "expect gnutls-client.expect ${options[*]}"
570571
rlAssertGrep "GET / HTTP/1.0" $rlRun_LOG

‎gnutls/Interoperability/TLSv1-2-with-OpenSSL/runtest.sh‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131

3232
PACKAGE="gnutls"
3333
PACKAGES="openssl gnutls"
34+
GNUTLS_PRIO="NORMAL:+ARCFOUR-128:+DHE-DSS:+SIGN-DSA-SHA1:+SIGN-DSA-SHA224:+SIGN-DSA-SHA256"
3435

3536
rlJournalStart
3637
rlPhaseStartSetup
@@ -379,10 +380,10 @@ rlJournalStart
379380
options=(gnutls-cli)
380381
options+=(--x509cafile $(x509Cert ca))
381382
if [[ $prot == tls1_2 ]]; then
382-
options+=(--priority NORMAL:+VERS-TLS1.2)
383+
options+=(--priority ${GNUTLS_PRIO}:+VERS-TLS1.2)
383384
fi
384385
if [[ $prot == tls1_1 ]]; then
385-
options+=(--priority NORMAL:-VERS-TLS1.2)
386+
options+=(--priority ${GNUTLS_PRIO}:-VERS-TLS1.2)
386387
fi
387388
options+=(-p 4433 localhost)
388389
rlRun -s "expect gnutls-client.expect ${options[*]}"
@@ -403,7 +404,7 @@ rlJournalStart
403404

404405
rlPhaseStartTest "GnuTLS server OpenSSL client ${C_NAME[$j]} cipher $prot protocol"
405406
options=(gnutls-serv --echo -p 4433)
406-
options+=(--priority NORMAL:+VERS-TLS1.2)
407+
options+=(--priority ${GNUTLS_PRIO}:+VERS-TLS1.2)
407408
options+=(--x509keyfile ${C_KEY[$j]})
408409
options+=(--x509certfile "<(cat ${C_CERT[$j]} ${C_SUBCA[$j]})")
409410
options+=(">server.log" "2>server.err" "&")
@@ -451,10 +452,10 @@ rlJournalStart
451452
options+=(--x509keyfile ${C_CLNT_KEY[$j]})
452453
options+=(--x509certfile ${C_CLNT_CERT[$j]})
453454
if [[ $prot == tls1_2 ]]; then
454-
options+=(--priority NORMAL:+VERS-TLS1.2)
455+
options+=(--priority ${GNUTLS_PRIO}:+VERS-TLS1.2)
455456
fi
456457
if [[ $prot == tls1_1 ]]; then
457-
options+=(--priority NORMAL:-VERS-TLS1.2)
458+
options+=(--priority ${GNUTLS_PRIO}:-VERS-TLS1.2)
458459
fi
459460
options+=(-p 4433 localhost)
460461
rlRun -s "expect gnutls-client.expect ${options[*]}"
@@ -475,7 +476,7 @@ rlJournalStart
475476

476477
rlPhaseStartTest "GnuTLS server OpenSSL client ${C_NAME[$j]} cipher $prot protocol client cert"
477478
options=(gnutls-serv --echo -p 4433)
478-
options+=(--priority NORMAL:+VERS-TLS1.2)
479+
options+=(--priority ${GNUTLS_PRIO}:+VERS-TLS1.2)
479480
options+=(--x509keyfile ${C_KEY[$j]})
480481
options+=(--x509certfile "<(cat ${C_CERT[$j]} ${C_SUBCA[$j]})")
481482
options+=(--x509cafile "<(cat $(x509Cert ca) ${C_SUBCA[$j]})")

‎nss/Interoperability/CC-nss-with-gnutls/runtest.sh‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
PACKAGE="nss"
3333
PACKAGES="nss gnutls"
3434

35+
GNUTLS_PRIO="NORMAL:+ARCFOUR-128:+DHE-DSS:+SIGN-DSA-SHA1:+SIGN-DSA-SHA224:+SIGN-DSA-SHA256"
3536
SERVER_UTIL="/usr/lib/nss/unsupported-tools/selfserv"
3637
CLIENT_UTIL="/usr/lib/nss/unsupported-tools/tstclnt"
3738
[ -f /usr/lib64/nss/unsupported-tools/selfserv ] && SERVER_UTIL="/usr/lib64/nss/unsupported-tools/selfserv"
@@ -545,6 +546,7 @@ rlJournalStart
545546
rlPhaseStartTest "GnuTLS server NSS client ${C_NAME[$j]} cipher $prot protocol"
546547
rlRun "gnutls-serv --http -p 4433 --x509keyfile ${C_KEY[$j]} \
547548
--x509certfile <(cat ${C_CERT[$j]} ${C_SUBCA[$j]}) \
549+
--priority ${GNUTLS_PRIO} \
548550
>server.log 2>server.err &"
549551
openssl_pid=$!
550552
rlRun "rlWaitForSocket 4433 -p $openssl_pid"
@@ -595,7 +597,9 @@ rlJournalStart
595597
options+=(--x509cafile $(x509Cert ca))
596598
options+=(-p 4433 localhost)
597599
if [[ $prot == "tls1_1" ]]; then
598-
options+=(--priority NORMAL:-VERS-TLS1.2)
600+
options+=(--priority ${GNUTLS_PRIO}:-VERS-TLS1.2)
601+
else
602+
options+=(--priority ${GNUTLS_PRIO})
599603
fi
600604
rlRun -s "expect gnutls-client.expect ${options[*]}"
601605
rlAssertGrep "GET / HTTP/1.0" $rlRun_LOG
@@ -625,7 +629,8 @@ rlJournalStart
625629
options+=(--x509certfile '<(cat ${C_CERT[$j]} ${C_SUBCA[$j]})')
626630
options+=(--x509cafile '<(cat $(x509Cert ca) ${C_SUBCA[$j]})')
627631
options+=(--require-client-cert --verify-client-cert)
628-
rlRun "gnutls-serv ${options[*]} >server.log 2>server.err &"
632+
rlRun "gnutls-serv --priority ${GNUTLS_PRIO} \
633+
${options[*]} >server.log 2>server.err &"
629634
openssl_pid=$!
630635
rlRun "rlWaitForSocket 4433 -p $openssl_pid"
631636

@@ -684,7 +689,9 @@ rlJournalStart
684689
options+=(--x509certfile ${C_CLNT_CERT[$j]})
685690
options+=(--x509keyfile ${C_CLNT_KEY[$j]})
686691
if [[ $prot == tls1_1 ]]; then
687-
options+=(--priority NORMAL:-VERS-TLS1.2)
692+
options+=(--priority ${GNUTLS_PRIO}:-VERS-TLS1.2)
693+
else
694+
options+=(--priority ${GNUTLS_PRIO})
688695
fi
689696
rlRun -s "expect gnutls-client.expect ${options[*]}"
690697
rlAssertGrep "GET / HTTP/1.0" $rlRun_LOG

‎openssl/Interoperability/CC-openssl-with-gnutls/runtest.sh‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131

3232
PACKAGE="openssl"
3333
PACKAGES="nss gnutls"
34+
GNUTLS_PRIO="NORMAL:+ARCFOUR-128:+DHE-DSS:+SIGN-DSA-SHA1:+SIGN-DSA-SHA224:+SIGN-DSA-SHA256"
3435

3536
rlJournalStart
3637
rlPhaseStartSetup
@@ -544,7 +545,9 @@ rlJournalStart
544545
options=(gnutls-cli)
545546
options+=(--x509cafile $(x509Cert ca))
546547
if [[ $prot == tls1_1 ]]; then
547-
options+=(--priority NORMAL:-VERS-TLS1.2)
548+
options+=(--priority ${GNUTLS_PRIO}:-VERS-TLS1.2)
549+
else
550+
options+=(--priority ${GNUTLS_PRIO})
548551
fi
549552
options+=(-p 4433 localhost)
550553
rlRun -s "expect gnutls-client.expect ${options[*]}"
@@ -562,6 +565,7 @@ rlJournalStart
562565
rlPhaseStartTest "GnuTLS server OpenSSL client ${C_NAME[$j]} cipher $prot protocol"
563566
rlRun "gnutls-serv --echo -p 4433 --x509keyfile ${C_KEY[$j]} \
564567
--x509certfile <(cat ${C_CERT[$j]} ${C_SUBCA[$j]}) \
568+
--priority ${GNUTLS_PRIO} \
565569
>server.log 2>server.err &"
566570
gnutls_pid=$!
567571
rlRun "rlWaitForSocket 4433 -p $gnutls_pid"
@@ -601,7 +605,9 @@ rlJournalStart
601605
options+=(--x509keyfile ${C_CLNT_KEY[$j]})
602606
options+=(--x509certfile ${C_CLNT_CERT[$j]})
603607
if [[ $prot == tls1_1 ]]; then
604-
options+=(--priority NORMAL:-VERS-TLS1.2)
608+
options+=(--priority ${GNUTLS_PRIO}:-VERS-TLS1.2)
609+
else
610+
options+=(--priority ${GNUTLS_PRIO})
605611
fi
606612
options+=(-p 4433 localhost)
607613
rlRun -s "expect gnutls-client.expect ${options[*]}"
@@ -621,6 +627,7 @@ rlJournalStart
621627
--x509certfile <(cat ${C_CERT[$j]} ${C_SUBCA[$j]}) \
622628
--x509cafile <(cat $(x509Cert ca) ${C_SUBCA[$j]}) \
623629
--require-client-cert --verify-client-cert \
630+
--priority ${GNUTLS_PRIO} \
624631
>server.log 2>server.err &"
625632
gnutls_pid=$!
626633
rlRun "rlWaitForSocket 4433 -p $gnutls_pid"

0 commit comments

Comments
 (0)