|
 |
700847 |
diff -up nss/cmd/fipstest/fipstest.c.1212106 nss/cmd/fipstest/fipstest.c
|
|
|
700847 |
--- nss/cmd/fipstest/fipstest.c.1212106 2015-04-28 15:10:27.428991019 -0700
|
|
|
700847 |
+++ nss/cmd/fipstest/fipstest.c 2015-04-28 15:14:18.281661223 -0700
|
|
|
700847 |
@@ -5746,12 +5746,13 @@ tls(char *reqfn)
|
|
|
700847 |
|
|
|
700847 |
CK_MECHANISM master_mech = { CKM_TLS_MASTER_KEY_DERIVE , NULL, 0 };
|
|
|
700847 |
CK_MECHANISM key_block_mech = { CKM_TLS_KEY_AND_MAC_DERIVE , NULL, 0};
|
|
|
700847 |
- CK_SSL3_MASTER_KEY_DERIVE_PARAMS master_params;
|
|
|
700847 |
- CK_SSL3_KEY_MAT_PARAMS key_block_params;
|
|
|
700847 |
+ CK_TLS12_MASTER_KEY_DERIVE_PARAMS master_params;
|
|
|
700847 |
+ CK_TLS12_KEY_MAT_PARAMS key_block_params;
|
|
|
700847 |
CK_SSL3_KEY_MAT_OUT key_material;
|
|
|
700847 |
CK_RV crv;
|
|
|
700847 |
|
|
|
700847 |
/* set up PKCS #11 parameters */
|
|
|
700847 |
+ master_params.prfHashMechanism = CKM_SHA256;
|
|
|
700847 |
master_params.pVersion = NULL;
|
|
|
700847 |
master_params.RandomInfo.pClientRandom = clientHello_random;
|
|
|
700847 |
master_params.RandomInfo.ulClientRandomLen = sizeof(clientHello_random);
|
|
|
700847 |
@@ -5759,6 +5760,7 @@ tls(char *reqfn)
|
|
|
700847 |
master_params.RandomInfo.ulServerRandomLen = sizeof(serverHello_random);
|
|
|
700847 |
master_mech.pParameter = (void *) &master_params;
|
|
|
700847 |
master_mech.ulParameterLen = sizeof(master_params);
|
|
|
700847 |
+ key_block_params.prfHashMechanism = CKM_SHA256;
|
|
|
700847 |
key_block_params.ulMacSizeInBits = 0;
|
|
|
700847 |
key_block_params.ulKeySizeInBits = 0;
|
|
|
700847 |
key_block_params.ulIVSizeInBits = 0;
|
|
|
700847 |
@@ -5801,14 +5803,35 @@ tls(char *reqfn)
|
|
|
700847 |
/* [Xchange - SHA1] */
|
|
|
700847 |
if (buf[0] == '[') {
|
|
|
700847 |
if (strncmp(buf, "[TLS", 4) == 0) {
|
|
|
700847 |
- if (buf[7] == '0') {
|
|
|
700847 |
- master_mech.mechanism = CKM_TLS_MASTER_KEY_DERIVE;
|
|
|
700847 |
- key_block_mech.mechanism = CKM_TLS_KEY_AND_MAC_DERIVE;
|
|
|
700847 |
- } else if (buf[7] == '2') {
|
|
|
700847 |
- master_mech.mechanism =
|
|
|
700847 |
- CKM_NSS_TLS_MASTER_KEY_DERIVE_SHA256;
|
|
|
700847 |
- key_block_mech.mechanism =
|
|
|
700847 |
- CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256;
|
|
|
700847 |
+ if (buf[7] == '0') {
|
|
|
700847 |
+ master_mech.mechanism = CKM_TLS_MASTER_KEY_DERIVE;
|
|
|
700847 |
+ key_block_mech.mechanism = CKM_TLS_KEY_AND_MAC_DERIVE;
|
|
|
700847 |
+ master_mech.ulParameterLen = sizeof(CK_SSL3_MASTER_KEY_DERIVE_PARAMS);
|
|
|
700847 |
+ key_block_mech.ulParameterLen = sizeof(CK_SSL3_KEY_MAT_PARAMS);
|
|
|
700847 |
+ } else if (buf[7] == '2') {
|
|
|
700847 |
+ if (strncmp(&buf[10], "SHA-1", 5) == 0) {
|
|
|
700847 |
+ master_params.prfHashMechanism = CKM_SHA_1;
|
|
|
700847 |
+ key_block_params.prfHashMechanism = CKM_SHA_1;
|
|
|
700847 |
+ } else if (strncmp(&buf[10], "SHA-224", 7) == 0) {
|
|
|
700847 |
+ master_params.prfHashMechanism = CKM_SHA224;
|
|
|
700847 |
+ key_block_params.prfHashMechanism = CKM_SHA224;
|
|
|
700847 |
+ } else if (strncmp(&buf[10], "SHA-256", 7) == 0) {
|
|
|
700847 |
+ master_params.prfHashMechanism = CKM_SHA256;
|
|
|
700847 |
+ key_block_params.prfHashMechanism = CKM_SHA256;
|
|
|
700847 |
+ } else if (strncmp(&buf[10], "SHA-384", 7)== 0) {
|
|
|
700847 |
+ master_params.prfHashMechanism = CKM_SHA384;
|
|
|
700847 |
+ key_block_params.prfHashMechanism = CKM_SHA384;
|
|
|
700847 |
+ } else if (strncmp(&buf[10], "SHA-512", 7) == 0) {
|
|
|
700847 |
+ master_params.prfHashMechanism = CKM_SHA512;
|
|
|
700847 |
+ key_block_params.prfHashMechanism = CKM_SHA512;
|
|
|
700847 |
+ } else {
|
|
|
700847 |
+ fprintf(tlsresp, "ERROR: Unable to find prf Hash type");
|
|
|
700847 |
+ goto loser;
|
|
|
700847 |
+ }
|
|
|
700847 |
+ master_mech.mechanism = CKM_TLS12_MASTER_KEY_DERIVE;
|
|
|
700847 |
+ key_block_mech.mechanism = CKM_TLS12_KEY_AND_MAC_DERIVE;
|
|
|
700847 |
+ master_mech.ulParameterLen = sizeof(master_params);
|
|
|
700847 |
+ key_block_mech.ulParameterLen = sizeof(key_block_params);
|
|
|
700847 |
} else {
|
|
|
700847 |
fprintf(stderr, "Unknown TLS type %x\n", buf);
|
|
|
700847 |
goto loser;
|
|
|
700847 |
@@ -6121,6 +6144,11 @@ int main(int argc, char **argv)
|
|
|
700847 |
} else if (strcmp(argv[1], "ddrbg") == 0) {
|
|
|
700847 |
debug = 1;
|
|
|
700847 |
drbg(argv[2]);
|
|
|
700847 |
+ /*************/
|
|
|
700847 |
+ /* TLS */
|
|
|
700847 |
+ /*************/
|
|
|
700847 |
+ } else if (strcmp(argv[1], "tls") == 0) {
|
|
|
700847 |
+ tls(argv[2]);
|
|
|
700847 |
}
|
|
|
700847 |
return 0;
|
|
|
700847 |
}
|