mirror of
https://github.com/cloudflare/cloudflared.git
synced 2025-06-18 15:36:34 +00:00
31a870b291
## Summary Nowadays, Cloudflared only supports X25519Kyber768Draft00 (0x6399,25497) but older versions may use different preferences. For FIPS compliance we are required to use P256Kyber768Draft00 (0xfe32,65074) which is supported in our internal fork of [Go-Boring-1.22.10](https://bitbucket.cfdata.org/projects/PLAT/repos/goboring/browse?at=refs/heads/go-boring/1.22.10 "Follow link"). In the near future, Go will support by default the X25519MLKEM768 (0x11ec,4588) given this we may drop the usage of our public fork of GO. To summarise: * Cloudflared FIPS: QUIC_CURVE_PREFERENCES=65074 * Cloudflared non-FIPS: QUIC_CURVE_PREFERENCES=4588 Closes TUN-8855
85 lines
2.7 KiB
Go
85 lines
2.7 KiB
Go
package supervisor
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/cloudflare/cloudflared/features"
|
|
)
|
|
|
|
func TestCurvePreferences(t *testing.T) {
|
|
// This tests if the correct curves are returned
|
|
// given a PostQuantumMode and a FIPS enabled bool
|
|
t.Parallel()
|
|
|
|
tests := []struct {
|
|
name string
|
|
currentCurves []tls.CurveID
|
|
expectedCurves []tls.CurveID
|
|
pqMode features.PostQuantumMode
|
|
fipsEnabled bool
|
|
}{
|
|
{
|
|
name: "FIPS with Prefer PQ",
|
|
pqMode: features.PostQuantumPrefer,
|
|
fipsEnabled: true,
|
|
currentCurves: []tls.CurveID{tls.CurveP384},
|
|
expectedCurves: []tls.CurveID{P256Kyber768Draft00PQKex, tls.CurveP256},
|
|
},
|
|
{
|
|
name: "FIPS with Strict PQ",
|
|
pqMode: features.PostQuantumStrict,
|
|
fipsEnabled: true,
|
|
currentCurves: []tls.CurveID{tls.CurveP256, tls.CurveP384},
|
|
expectedCurves: []tls.CurveID{P256Kyber768Draft00PQKex},
|
|
},
|
|
{
|
|
name: "FIPS with Prefer PQ - no duplicates",
|
|
pqMode: features.PostQuantumPrefer,
|
|
fipsEnabled: true,
|
|
currentCurves: []tls.CurveID{tls.CurveP256},
|
|
expectedCurves: []tls.CurveID{P256Kyber768Draft00PQKex, tls.CurveP256},
|
|
},
|
|
{
|
|
name: "Non FIPS with Prefer PQ",
|
|
pqMode: features.PostQuantumPrefer,
|
|
fipsEnabled: false,
|
|
currentCurves: []tls.CurveID{tls.CurveP256},
|
|
expectedCurves: []tls.CurveID{X25519MLKEM768PQKex, X25519Kyber768Draft00PQKex, tls.CurveP256},
|
|
},
|
|
{
|
|
name: "Non FIPS with Prefer PQ - no duplicates",
|
|
pqMode: features.PostQuantumPrefer,
|
|
fipsEnabled: false,
|
|
currentCurves: []tls.CurveID{X25519Kyber768Draft00PQKex, tls.CurveP256},
|
|
expectedCurves: []tls.CurveID{X25519MLKEM768PQKex, X25519Kyber768Draft00PQKex, tls.CurveP256},
|
|
},
|
|
{
|
|
name: "Non FIPS with Prefer PQ - correct preference order",
|
|
pqMode: features.PostQuantumPrefer,
|
|
fipsEnabled: false,
|
|
currentCurves: []tls.CurveID{tls.CurveP256, X25519Kyber768Draft00PQKex},
|
|
expectedCurves: []tls.CurveID{X25519MLKEM768PQKex, X25519Kyber768Draft00PQKex, tls.CurveP256},
|
|
},
|
|
{
|
|
name: "Non FIPS with Strict PQ",
|
|
pqMode: features.PostQuantumStrict,
|
|
fipsEnabled: false,
|
|
currentCurves: []tls.CurveID{tls.CurveP256},
|
|
expectedCurves: []tls.CurveID{X25519MLKEM768PQKex, X25519Kyber768Draft00PQKex},
|
|
},
|
|
}
|
|
|
|
for _, tcase := range tests {
|
|
t.Run(tcase.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
curves, err := curvePreference(tcase.pqMode, tcase.fipsEnabled, tcase.currentCurves)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, tcase.expectedCurves, curves)
|
|
})
|
|
}
|
|
}
|