ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Add TLS 'cipher-suites' checkconf test

Browse Source 
This commit adds a set of valid and invalid configuration files
samples that use the new 'cipher-suites' option of the 'tls'
statement.
This commit is contained in:
Artem Boldariev
2023-12-12 18:37:30 +02:00
parent 53f53e9b02
commit ed546007c9
6 changed files with 134 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
bin/tests/system/checkconf/bad-tls-cipher-suites-ciphers-string.conf Normal file
View File

@@ -0,0 +1,26 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
tls local-tls {
protocols { TLSv1.3; };
key-file "key.pem";
cert-file "cert.pem";
dhparam-file "dhparam.pem";
cipher-suites "HIGH:!aNULL:!MD5:!RC4";
prefer-server-ciphers yes;
session-tickets no;
};
options {
listen-on port 853 tls local-tls { 10.53.0.1; };
};

26
bin/tests/system/checkconf/bad-tls-cipher-suites-empty-string.conf Normal file
View File

@@ -0,0 +1,26 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
tls local-tls {
protocols { TLSv1.3; };
key-file "key.pem";
cert-file "cert.pem";
dhparam-file "dhparam.pem";
cipher-suites "";
prefer-server-ciphers yes;
session-tickets no;
};
options {
listen-on port 853 tls local-tls { 10.53.0.1; };
};

26
bin/tests/system/checkconf/bad-tls-cipher-suites-wrong-string.conf Normal file
View File

@@ -0,0 +1,26 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
tls local-tls {
protocols { TLSv1.3; };
key-file "key.pem";
cert-file "cert.pem";
dhparam-file "dhparam.pem";
cipher-suites "lalalalalgggg";
prefer-server-ciphers yes;
session-tickets no;
};
options {
listen-on port 853 tls local-tls { 10.53.0.1; };
};

26
bin/tests/system/checkconf/good-tls-cipher-suites-multiple-cipher-suites.conf Normal file
View File

@@ -0,0 +1,26 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
tls local-tls {
protocols { TLSv1.3; };
key-file "key.pem";
cert-file "cert.pem";
dhparam-file "dhparam.pem";
cipher-suites "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256";
prefer-server-ciphers yes;
session-tickets no;
};
options {
listen-on port 853 tls local-tls { 10.53.0.1; };
};

26
bin/tests/system/checkconf/good-tls-cipher-suites-one-cipher-suite.conf Normal file
View File

@@ -0,0 +1,26 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
tls local-tls {
protocols { TLSv1.3; };
key-file "key.pem";
cert-file "cert.pem";
dhparam-file "dhparam.pem";
cipher-suites "TLS_CHACHA20_POLY1305_SHA256";
prefer-server-ciphers yes;
session-tickets no;
};
options {
listen-on port 853 tls local-tls { 10.53.0.1; };
};

4
bin/tests/system/checkconf/tests.sh
View File

@@ -89,6 +89,10 @@ for good in good-*.conf; do
good-proxy-*doh*.conf) continue ;;
bad-proxy-*doh*.conf) continue ;;
esac
elif ! $FEATURETEST --have-openssl-cipher-suites; then
case $good in
good-tls-cipher-suites-*.conf) continue ;;
esac
fi
{
$CHECKCONF $good >checkconf.out$n 2>&1