From 60e44286fa3c0c0d9aad5c3c56379268590f4d20 Mon Sep 17 00:00:00 2001 From: Piotr Tabor Date: Mon, 8 Feb 2021 20:38:06 +0100 Subject: [PATCH] Fix pkg/tlsutil (test) to not fail on 386. In fact this commit rewrites the functionality to use upstream list of ciphers instead of checking whether the lists are in sync using ast analysis. --- .travis.yml | 4 --- pkg/tlsutil/cipher_suites.go | 48 +++++++++++-------------------- pkg/tlsutil/cipher_suites_test.go | 44 ++++++++++++++++------------ 3 files changed, 43 insertions(+), 53 deletions(-) diff --git a/.travis.yml b/.travis.yml index 18149c3c2e4..691422d2b51 100644 --- a/.travis.yml +++ b/.travis.yml @@ -30,14 +30,10 @@ env: matrix: fast_finish: true allow_failures: - - go: 1.15.7 - env: TARGET=linux-amd64-grpcproxy - go: 1.15.7 env: TARGET=linux-amd64-coverage - go: tip env: TARGET=linux-amd64-fmt-unit-go-tip-2-cpu - - go: 1.15.7 - env: TARGET=linux-386-unit-1-cpu exclude: - go: tip env: TARGET=linux-amd64-fmt diff --git a/pkg/tlsutil/cipher_suites.go b/pkg/tlsutil/cipher_suites.go index 3932aa72757..f278a61f8a0 100644 --- a/pkg/tlsutil/cipher_suites.go +++ b/pkg/tlsutil/cipher_suites.go @@ -16,38 +16,24 @@ package tlsutil import "crypto/tls" -// cipher suites implemented by Go -// https://github.com/golang/go/blob/dev.boringcrypto.go1.14/src/crypto/tls/cipher_suites.go -var cipherSuites = map[string]uint16{ - "TLS_RSA_WITH_RC4_128_SHA": tls.TLS_RSA_WITH_RC4_128_SHA, - "TLS_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, - "TLS_RSA_WITH_AES_128_CBC_SHA": tls.TLS_RSA_WITH_AES_128_CBC_SHA, - "TLS_RSA_WITH_AES_256_CBC_SHA": tls.TLS_RSA_WITH_AES_256_CBC_SHA, - "TLS_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_RSA_WITH_AES_128_CBC_SHA256, - "TLS_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_RSA_WITH_AES_128_GCM_SHA256, - "TLS_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_RSA_WITH_AES_256_GCM_SHA384, - "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, - "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, - "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, - "TLS_ECDHE_RSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, - "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, - "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, - "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, -} - // GetCipherSuite returns the corresponding cipher suite, // and boolean value if it is supported. func GetCipherSuite(s string) (uint16, bool) { - v, ok := cipherSuites[s] - return v, ok + for _, c := range tls.CipherSuites() { + if s == c.Name { + return c.ID, true + } + } + for _, c := range tls.InsecureCipherSuites() { + if s == c.Name { + return c.ID, true + } + } + switch s { + case "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305": + return tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, true + case "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305": + return tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, true + } + return 0, false } diff --git a/pkg/tlsutil/cipher_suites_test.go b/pkg/tlsutil/cipher_suites_test.go index ff6d97ffefb..a17b46c2fee 100644 --- a/pkg/tlsutil/cipher_suites_test.go +++ b/pkg/tlsutil/cipher_suites_test.go @@ -15,28 +15,36 @@ package tlsutil import ( - "go/importer" - "reflect" - "strings" + "crypto/tls" "testing" ) -func TestGetCipherSuites(t *testing.T) { - pkg, err := importer.For("source", nil).Import("crypto/tls") - if err != nil { - t.Fatal(err) +func TestGetCipherSuite_not_existing(t *testing.T) { + _, ok := GetCipherSuite("not_existing") + if ok { + t.Fatal("Expected not ok") } - cm := make(map[string]uint16) - for _, s := range pkg.Scope().Names() { - if strings.HasPrefix(s, "TLS_RSA_") || strings.HasPrefix(s, "TLS_ECDHE_") { - v, ok := GetCipherSuite(s) - if !ok { - t.Fatalf("Go implements missing cipher suite %q (%v)", s, v) - } - cm[s] = v - } +} + +func CipherSuiteExpectedToExist(tb testing.TB, cipher string, expectedId uint16) { + vid, ok := GetCipherSuite(cipher) + if !ok { + tb.Errorf("Expected %v cipher to exist", cipher) } - if !reflect.DeepEqual(cm, cipherSuites) { - t.Fatalf("found unmatched cipher suites %v (Go) != %v", cm, cipherSuites) + if vid != expectedId { + tb.Errorf("For %v expected=%v found=%v", cipher, expectedId, vid) } } + +func TestGetCipherSuite_success(t *testing.T) { + CipherSuiteExpectedToExist(t, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) + CipherSuiteExpectedToExist(t, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) + + // Explicit test for legacy names + CipherSuiteExpectedToExist(t, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256) + CipherSuiteExpectedToExist(t, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256) +} + +func TestGetCipherSuite_insecure(t *testing.T) { + CipherSuiteExpectedToExist(t, "TLS_ECDHE_RSA_WITH_RC4_128_SHA", tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA) +}