| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
all.sh reports.
This patch includes the updated .sed script, and an experiment using bash instead to see how hard it would be to make a more robust parser.
The robust parser generates identical output as sed, but takes about 30x longer, so instead of subsecond operations, it takes almost half a minute. With that result, I think we can stay with sed and continue to update when we get new versions of gtests. (sigh).
time cat report.xml.0 | sed -f parsegtestreport.sed > r1
real 0m0.710s
user 0m0.705s
sys 0m0.008s
time cat report.xml.0 | sh parsegtestreport.sh > r2
real 0m25.066s
user 0m17.759s
sys 0m9.506s
[rrelyea@localhost common]$ diff r1 r2
updated: with review comments from Martin and move the report parsing to the common code so it can be shared with both ssl_gtests and gtests shell scripts.
Differential Revision: https://phabricator.services.mozilla.com/D120028
|
| |
|
|
|
|
| |
Remove support for RSAE in delegated credentials (both in DC signatures and SPKIs), add SignatureScheme list functionality to initial DC extension.
Differential Revision: https://phabricator.services.mozilla.com/D65252
|
| |
|
|
|
|
|
|
| |
end-entity certs with default scheme override r=mt
If an end-entity cert has an SPKI type of 'rsaEncryption', override the DC alg to be `ssl_sig_rsa_pss_rsae_sha256`.
Differential Revision: https://phabricator.services.mozilla.com/D49176
|
| |
|
|
| |
Differential Revision: https://phabricator.services.mozilla.com/D25654
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Summary: As a start, it only tests TLS 1.3 so far; 8 out of 18 are skipped because of failures.
Reviewers: franziskus, HubertKario, mt
Reviewed By: mt
Subscribers: mt
Bug #: 1485989
Differential Revision: https://phabricator.services.mozilla.com/D4217
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This adds support for the new codepoints that we added in TLS 1.3 draft -23.
In short, the split between rsa_pss_rsae and rsa_pss_pss made our support
for PSS inconsistent (we would generate only the former).
This adds support for the rsa_pss_pss_shaX signature schemes. It does so by
using the ssl_auth_rsa_pss codepoint, which I originally added, then we decided
not to use because the generic RSA codepoints were enough at the time. Now,
with the split on signature schemes, it isn't possible with the current
certificate configuration APIs to have everything work with just
ssl_auth_rsa_sign. We expect PSS keys to be configured alongside PKCS#1 keys
and use SSLAuthType to distinguish them, but if we only use ssl_auth_rsa_sign,
we can't find the right key when resuming.
In this way, we are assigning certificates an SSLAuthType based on the type of
the key and not the signature it has. That makes it cleaner than what we used
to have, at least.
That said, once we support signature_algorithms_cert extensions properly, we
will not want to bucket certificates on the server. Instead, we will have a
list and pick the first that matches, with no attempt to use types as we had.
There are just too many ways in which a certificate might be chosen or not when
you have to examine the entire chain. Of course, that's an even bigger change
than this.
The biggest change here is to attempt to determine the signature scheme based
on the certificate SPKI. If that works, then we use that signature scheme,
otherwise we fall back to the existing logic (which searches a list). For PSS
with parameters and EC (EC only in TLS 1.3), there is just one signature scheme
for a given SPKI, so that works out nicely. PSS without parameters, ECDSA, and
older RSA certificates fall back to searching. I expect all future schemes to
have just one scheme each, so it's a structure that I think supports that well.
|
| |
|
|
| |
Differential Revision: https://phabricator.services.mozilla.com/D1212
|
| | |
|
| |
|
|
| |
This series adds high level API to sign and verify RSA-PSS signatures on certificates and utilizes them in tools.
|
| | |
|
| |
|
|
|
|
| |
r=franziskus
Differential Revision: https://nss-review.dev.mozaws.net/D244
|
| |
|
|
|
|
|
| |
Reviewers: mt
Differential Revision: https://nss-review.dev.mozaws.net/D65
|
| |
|
|
| |
Differential Revision: https://nss-review.dev.mozaws.net/D19
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
process pipe, more output to help track down the stuck tests on windows, r=ekr
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
|
|
with test suite. r=kaie
|
