From 772f2188b487c9c30c6b8ffe2effc47d2230c177 Mon Sep 17 00:00:00 2001
From: Thijs Schreijer <thijs@thijsschreijer.nl>
Date: Sat, 2 Mar 2024 11:57:20 +0100
Subject: [PATCH] fix(certs): increase strength

---
 tests/certs/-newkey     | Bin 0 -> 1024 bytes
 tests/certs/clientA.bat |   4 ++--
 tests/certs/clientA.sh  |   4 ++--
 tests/certs/clientB.bat |   4 ++--
 tests/certs/clientB.sh  |   4 ++--
 tests/certs/rootA.bat   |   4 ++--
 tests/certs/rootA.sh    |   5 ++---
 tests/certs/rootB.bat   |   4 ++--
 tests/certs/rootB.sh    |   4 ++--
 tests/certs/serverA.bat |   4 ++--
 tests/certs/serverA.sh  |   4 ++--
 tests/certs/serverB.bat |   4 ++--
 tests/certs/serverB.sh  |   4 ++--
 tests/largetransfer.lua |  12 ++++++------
 tests/tls-sni.lua       |  18 +++++++++++-------
 15 files changed, 41 insertions(+), 38 deletions(-)
 create mode 100644 tests/certs/-newkey

diff --git a/tests/certs/-newkey b/tests/certs/-newkey
new file mode 100644
index 0000000000000000000000000000000000000000..336bd04ccc737b4d17a7b18c1746274b92abac6f
GIT binary patch
literal 1024
zcmV+b1poU^f(|Rnd=^L(lVbQD2vlhfUU-fp1Sv@B;Tv#|0GyCS-Ji&uTx;;rGpL#l
zR1g{t?p?+sdU{UOIF(SKWrh7U!#R-b3m-Z&CxI&FM41kYPtmOu$EBEESwUe3)(3qh
z<WP3!@(M9hq;a5y9s)o<gjN!w9+Fl@{^I6p=7pdOnjL!iyPey6HHKV|KF~8Vdk96I
z5uQFPcH=Vwv-~wJvX?HQW5TJ;855MfGeBPr&WpH>i;E=4IZZ$;)RCj5v!uCPusz6#
zAkn+HJi+pU#T4bmBOf~+pXL&ud<+rHv$j_n-hCJL$e>dwwijfepM=P&wWc1$R%m-o
z2$MjGCMxbfw;L(h`p8)BKt`jRZ57lG8`Fo8RC54g>O@>YEJ$L?3R;tSfWhashU0k^
zY9KSR8>FE#7RpR&#nHgy-ewrHw+$1=bNssO7*FrTrcISH(fy;I8`}jK((B{&qDxOt
znr@=gPlq%TkS$ZyGZ-~M$b95ZF=xQ3^Lp7Hp`PhmqvtSfm9D}5-XYm-()^X2#*eC8
z<pQm*8C$Pa%?02o<>{+4K04LvP4*o2UjHZ1nQsEcyz_1RC+jMN<H4Pp2l-oA^8|gP
z5o)cmilX1&DB>Xnq#_%~%jAx}XRB~a&`_y8u{Maxmj#|kvV%C(q&lAlHjF)IXd5T0
z=R3Yf--n+Kh4Ce|N3H`%H<~zryK6cV0ZKPoz$|U_4P=n}%`9QLBzl|EyB!~91bZU`
z$nA<ygb`pNTl?4=z0v7_(f<11XKef)+>k(+Jjcxsxt4kGnj2#)T&R|0ambv4A<74g
zuA+JhAK`^Bw9%@i{moCk0){(tGW&u9#naoFrCz&sMaRo1c`t(XYcA=lqd{#=R4-PF
zPzX(gx=Fy(TdwX^69n4tFY{0~l%gEOKjxFg`$Nr<y!~y%KVtN{q5j#ce(|ddX?D!J
zU)0>*48^N}E%CnEdil(D1#ZodVo`2D63c{x!jgkz)SznV+f@QEs5dJ(Z6Re!vrhGC
zb~)3T?BoZnIS6KeQm24joYQRh%=TJoonB@UdynFwJZ;sZk*83BEMwcg6+np~a2Npr
zDmBYF(zLxt_VOXJcGwus9_QMo{Z+RWD_DOpLoQ;+9I+B--A6-RmBNK%v1DfPP)kF3
zQZwaiPEdaZ`I#Qjpjiic3!TqLGJ;cPCbX!pKt0$qLOsniE7NL`PlTScAYSO1Yt*~x
z#m;t{?Zkz9!OJ42+|IassXOt#Vi7Xl!Toa$Gj_vK1JmJKKNTe6@V4HB4B)-XU2xet
ufn7VWF-}qUw>900(PMc`(x|{-+9JS<stS1?x<t&jzeJ!?Kt#@3FB2}hefmQH

literal 0
HcmV?d00001

diff --git a/tests/certs/clientA.bat b/tests/certs/clientA.bat
index 112cdef..f70a832 100644
--- a/tests/certs/clientA.bat
+++ b/tests/certs/clientA.bat
@@ -1,8 +1,8 @@
 rem #!/bin/sh
 
-openssl req -newkey rsa:1024 -sha1 -keyout clientAkey.pem -out clientAreq.pem -nodes -config ./clientA.cnf -days 365 -batch
+openssl req -newkey rsa:2048 -sha256 -keyout clientAkey.pem -out clientAreq.pem -nodes -config ./clientA.cnf -days 365 -batch
 
-openssl x509 -req -in clientAreq.pem -sha1 -extfile ./clientA.cnf -extensions usr_cert -CA rootA.pem -CAkey rootAkey.pem -CAcreateserial -out clientAcert.pem -days 365
+openssl x509 -req -in clientAreq.pem -sha256 -extfile ./clientA.cnf -extensions usr_cert -CA rootA.pem -CAkey rootAkey.pem -CAcreateserial -out clientAcert.pem -days 365
 
 copy clientAcert.pem + rootA.pem clientA.pem
 
diff --git a/tests/certs/clientA.sh b/tests/certs/clientA.sh
index 0350ede..118e186 100755
--- a/tests/certs/clientA.sh
+++ b/tests/certs/clientA.sh
@@ -1,9 +1,9 @@
 #!/bin/sh
 
-openssl req -newkey rsa:1024 -sha1 -keyout clientAkey.pem -out clientAreq.pem \
+openssl req -newkey rsa:2048 -sha256 -keyout clientAkey.pem -out clientAreq.pem \
   -nodes -config ./clientA.cnf -days 365 -batch
 
-openssl x509 -req -in clientAreq.pem -sha1 -extfile ./clientA.cnf \
+openssl x509 -req -in clientAreq.pem -sha256 -extfile ./clientA.cnf \
   -extensions usr_cert -CA rootA.pem -CAkey rootAkey.pem -CAcreateserial \
   -out clientAcert.pem -days 365
 
diff --git a/tests/certs/clientB.bat b/tests/certs/clientB.bat
index 9f341f6..ded7537 100644
--- a/tests/certs/clientB.bat
+++ b/tests/certs/clientB.bat
@@ -1,8 +1,8 @@
 rem #!/bin/sh
 
-openssl req -newkey rsa:1024 -sha1 -keyout clientBkey.pem -out clientBreq.pem -nodes -config ./clientB.cnf -days 365 -batch
+openssl req -newkey rsa:2048 -sha256 -keyout clientBkey.pem -out clientBreq.pem -nodes -config ./clientB.cnf -days 365 -batch
 
-openssl x509 -req -in clientBreq.pem -sha1 -extfile ./clientB.cnf -extensions usr_cert -CA rootB.pem -CAkey rootBkey.pem -CAcreateserial -out clientBcert.pem -days 365
+openssl x509 -req -in clientBreq.pem -sha256 -extfile ./clientB.cnf -extensions usr_cert -CA rootB.pem -CAkey rootBkey.pem -CAcreateserial -out clientBcert.pem -days 365
 
 copy clientBcert.pem + rootB.pem clientB.pem
 
diff --git a/tests/certs/clientB.sh b/tests/certs/clientB.sh
index 94f8986..a39ae83 100755
--- a/tests/certs/clientB.sh
+++ b/tests/certs/clientB.sh
@@ -1,9 +1,9 @@
 #!/bin/sh
 
-openssl req -newkey rsa:1024 -sha1 -keyout clientBkey.pem -out clientBreq.pem \
+openssl req -newkey rsa:2048 -sha256 -keyout clientBkey.pem -out clientBreq.pem \
   -nodes -config ./clientB.cnf -days 365 -batch
 
-openssl x509 -req -in clientBreq.pem -sha1 -extfile ./clientB.cnf \
+openssl x509 -req -in clientBreq.pem -sha256 -extfile ./clientB.cnf \
   -extensions usr_cert -CA rootB.pem -CAkey rootBkey.pem -CAcreateserial \
   -out clientBcert.pem -days 365
 
diff --git a/tests/certs/rootA.bat b/tests/certs/rootA.bat
index 6449bfa..d884e54 100644
--- a/tests/certs/rootA.bat
+++ b/tests/certs/rootA.bat
@@ -1,7 +1,7 @@
 REM #!/bin/sh
 
-openssl req -newkey rsa:1024 -sha1 -keyout rootAkey.pem -out rootAreq.pem -nodes -config ./rootA.cnf -days 365 -batch
+openssl req -newkey rsa:2048 -sha256 -keyout rootAkey.pem -out rootAreq.pem -nodes -config ./rootA.cnf -days 365 -batch
 
-openssl x509 -req -in rootAreq.pem -sha1 -extfile ./rootA.cnf -extensions v3_ca -signkey rootAkey.pem -out rootA.pem -days 365
+openssl x509 -req -in rootAreq.pem -sha256 -extfile ./rootA.cnf -extensions v3_ca -signkey rootAkey.pem -out rootA.pem -days 365
 
 openssl x509 -subject -issuer -noout -in rootA.pem
diff --git a/tests/certs/rootA.sh b/tests/certs/rootA.sh
index 7b588bf..77fe722 100755
--- a/tests/certs/rootA.sh
+++ b/tests/certs/rootA.sh
@@ -1,7 +1,6 @@
 #!/bin/sh
+openssl req -newkey rsa:2048 -sha256 -keyout rootAkey.pem -out rootAreq.pem -nodes -config ./rootA.cnf -days 365 -batch
 
-openssl req -newkey rsa:1024 -sha1 -keyout rootAkey.pem -out rootAreq.pem -nodes -config ./rootA.cnf -days 365 -batch
-
-openssl x509 -req -in rootAreq.pem -sha1 -extfile ./rootA.cnf -extensions v3_ca -signkey rootAkey.pem -out rootA.pem -days 365
+openssl x509 -req -in rootAreq.pem -sha256 -extfile ./rootA.cnf -extensions v3_ca -signkey rootAkey.pem -out rootA.pem -days 365
 
 openssl x509 -subject -issuer -noout -in rootA.pem
diff --git a/tests/certs/rootB.bat b/tests/certs/rootB.bat
index 99f358a..7226a8b 100644
--- a/tests/certs/rootB.bat
+++ b/tests/certs/rootB.bat
@@ -1,7 +1,7 @@
 rem #!/bin/sh
 
-openssl req -newkey rsa:1024 -sha1 -keyout rootBkey.pem -out rootBreq.pem -nodes -config ./rootB.cnf -days 365 -batch
+openssl req -newkey rsa:2048 -sha256 -keyout rootBkey.pem -out rootBreq.pem -nodes -config ./rootB.cnf -days 365 -batch
 
-openssl x509 -req -in rootBreq.pem -sha1 -extfile ./rootB.cnf -extensions v3_ca -signkey rootBkey.pem -out rootB.pem -days 365
+openssl x509 -req -in rootBreq.pem -sha256 -extfile ./rootB.cnf -extensions v3_ca -signkey rootBkey.pem -out rootB.pem -days 365
 
 openssl x509 -subject -issuer -noout -in rootB.pem
diff --git a/tests/certs/rootB.sh b/tests/certs/rootB.sh
index 53969b3..07b53a4 100755
--- a/tests/certs/rootB.sh
+++ b/tests/certs/rootB.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
-openssl req -newkey rsa:1024 -sha1 -keyout rootBkey.pem -out rootBreq.pem -nodes -config ./rootB.cnf -days 365 -batch
+openssl req -newkey rsa:2048 -sha256 -keyout rootBkey.pem -out rootBreq.pem -nodes -config ./rootB.cnf -days 365 -batch
 
-openssl x509 -req -in rootBreq.pem -sha1 -extfile ./rootB.cnf -extensions v3_ca -signkey rootBkey.pem -out rootB.pem -days 365
+openssl x509 -req -in rootBreq.pem -sha256 -extfile ./rootB.cnf -extensions v3_ca -signkey rootBkey.pem -out rootB.pem -days 365
 
 openssl x509 -subject -issuer -noout -in rootB.pem
diff --git a/tests/certs/serverA.bat b/tests/certs/serverA.bat
index 78934d5..c2cc9ba 100644
--- a/tests/certs/serverA.bat
+++ b/tests/certs/serverA.bat
@@ -1,8 +1,8 @@
 rem #!/bin/sh
 
-openssl req -newkey rsa:1024 -keyout serverAkey.pem -out serverAreq.pem -config ./serverA.cnf -nodes -days 365 -batch
+openssl req -newkey rsa:2048 -keyout serverAkey.pem -out serverAreq.pem -config ./serverA.cnf -nodes -days 365 -batch
 
-openssl x509 -req -in serverAreq.pem -sha1 -extfile ./serverA.cnf -extensions usr_cert -CA rootA.pem -CAkey rootAkey.pem -CAcreateserial -out serverAcert.pem -days 365
+openssl x509 -req -in serverAreq.pem -sha256 -extfile ./serverA.cnf -extensions usr_cert -CA rootA.pem -CAkey rootAkey.pem -CAcreateserial -out serverAcert.pem -days 365
 
 copy serverAcert.pem + rootA.pem serverA.pem
 
diff --git a/tests/certs/serverA.sh b/tests/certs/serverA.sh
index 7fa04e0..ac2b09d 100755
--- a/tests/certs/serverA.sh
+++ b/tests/certs/serverA.sh
@@ -1,9 +1,9 @@
 #!/bin/sh
 
-openssl req -newkey rsa:1024 -keyout serverAkey.pem -out serverAreq.pem \
+openssl req -newkey rsa:2048 -keyout serverAkey.pem -out serverAreq.pem \
    -config ./serverA.cnf -nodes -days 365 -batch
 
-openssl x509 -req -in serverAreq.pem -sha1 -extfile ./serverA.cnf \
+openssl x509 -req -in serverAreq.pem -sha256 -extfile ./serverA.cnf \
    -extensions usr_cert -CA rootA.pem -CAkey rootAkey.pem -CAcreateserial \
    -out serverAcert.pem -days 365
 
diff --git a/tests/certs/serverB.bat b/tests/certs/serverB.bat
index 294be57..232303a 100644
--- a/tests/certs/serverB.bat
+++ b/tests/certs/serverB.bat
@@ -1,8 +1,8 @@
 rem #!/bin/sh
 
-openssl req -newkey rsa:1024 -keyout serverBkey.pem -out serverBreq.pem -config ./serverB.cnf -nodes -days 365 -batch
+openssl req -newkey rsa:2048 -keyout serverBkey.pem -out serverBreq.pem -config ./serverB.cnf -nodes -days 365 -batch
 
-openssl x509 -req -in serverBreq.pem -sha1 -extfile ./serverB.cnf -extensions usr_cert -CA rootB.pem -CAkey rootBkey.pem -CAcreateserial -out serverBcert.pem -days 365
+openssl x509 -req -in serverBreq.pem -sha256 -extfile ./serverB.cnf -extensions usr_cert -CA rootB.pem -CAkey rootBkey.pem -CAcreateserial -out serverBcert.pem -days 365
 
 copy serverBcert.pem + rootB.pem serverB.pem
 
diff --git a/tests/certs/serverB.sh b/tests/certs/serverB.sh
index c75b00a..091f1ac 100755
--- a/tests/certs/serverB.sh
+++ b/tests/certs/serverB.sh
@@ -1,9 +1,9 @@
 #!/bin/sh
 
-openssl req -newkey rsa:1024 -keyout serverBkey.pem -out serverBreq.pem \
+openssl req -newkey rsa:2048 -keyout serverBkey.pem -out serverBreq.pem \
    -config ./serverB.cnf -nodes -days 365 -batch
 
-openssl x509 -req -in serverBreq.pem -sha1 -extfile ./serverB.cnf \
+openssl x509 -req -in serverBreq.pem -sha256 -extfile ./serverB.cnf \
    -extensions usr_cert -CA rootB.pem -CAkey rootBkey.pem -CAcreateserial \
    -out serverBcert.pem -days 365
 
diff --git a/tests/largetransfer.lua b/tests/largetransfer.lua
index 21045a9..6f9d556 100644
--- a/tests/largetransfer.lua
+++ b/tests/largetransfer.lua
@@ -97,22 +97,22 @@ runtest()   -- run test using regular connection (s/cparams == nil)
 -- set ssl parameters and do it again
 sparams = {
    mode = "server",
-   protocol = "tlsv1",
+   protocol = "any",
    key = "tests/certs/serverAkey.pem",
    certificate = "tests/certs/serverA.pem",
    cafile = "tests/certs/rootA.pem",
    verify = {"peer", "fail_if_no_peer_cert"},
-   options = {"all", "no_sslv2"},
-}
+   options = {"all", "no_sslv2", "no_sslv3", "no_tlsv1"},
+  }
 cparams = {
    mode = "client",
-   protocol = "tlsv1",
+   protocol = "any",
    key = "tests/certs/clientAkey.pem",
    certificate = "tests/certs/clientA.pem",
    cafile = "tests/certs/rootA.pem",
    verify = {"peer", "fail_if_no_peer_cert"},
-   options = {"all", "no_sslv2"},
-}
+   options = {"all", "no_sslv2", "no_sslv3", "no_tlsv1"},
+  }
 done = 0
 start = socket.gettime()
 runtest()
diff --git a/tests/tls-sni.lua b/tests/tls-sni.lua
index 94841b3..c2b7453 100644
--- a/tests/tls-sni.lua
+++ b/tests/tls-sni.lua
@@ -16,12 +16,12 @@ end
 local server_params = {
   wrap = {
     mode = "server",
-    protocol = "tlsv1",
+    protocol = "any",
     key = "tests/certs/serverAkey.pem",
     certificate = "tests/certs/serverA.pem",
     cafile = "tests/certs/rootA.pem",
     verify = {"peer", "fail_if_no_peer_cert"},
-    options = {"all", "no_sslv2"},
+    options = {"all", "no_sslv2", "no_sslv3", "no_tlsv1"},
   },
   sni = {
     strict = true, -- only allow connection 'myhost.com'
@@ -33,12 +33,12 @@ server_params.sni.names["myhost.com"] = ssl.newcontext(server_params.wrap)
 local client_params = {
   wrap = {
     mode = "client",
-    protocol = "tlsv1",
+    protocol = "any",
     key = "tests/certs/clientAkey.pem",
     certificate = "tests/certs/clientA.pem",
     cafile = "tests/certs/rootA.pem",
     verify = {"peer", "fail_if_no_peer_cert"},
-    options = {"all", "no_sslv2"},
+    options = {"all", "no_sslv2", "no_sslv3", "no_tlsv1"},
   },
   sni = {
     names = "" -- will be added in test below
@@ -63,7 +63,7 @@ local function echoHandler(skt)
       return -- close this client connection, after stopping the server
 
     end
-    skt:send(data)
+    skt:send(data.."\n")
   end
 end
 
@@ -92,12 +92,16 @@ copas.addthread(function()
   local skt = copas.wrap(socket.tcp(), client_params)
   local success, ok = pcall(skt.connect, skt, "localhost", port)
   if not (success and ok) then
-    print "expected connection to be completed"
+    print("expected connection to be completed", success, ok)
     os.exit(1)
   end
 
+  assert(skt:send("hello world\n"))
+  assert(skt:receive() == "hello world")
   print "succesfully completed test"
-  os.exit(0)
+
+  -- send exit signal to server
+  skt:send("exit\n")
 end)
 
 -- no ugly errors please, comment out when debugging