Add TLS_RSA_WITH_AES_256_GCM_SHA384 to ssl_compliance_policy_cnsa1_202603

Suprisingly, despite a steady stream of problems in this cipher suite
since 1998, RFC 9151 actually includes it.

This requires fixing up the tests slightly. compliance_policy_tests.go
was silently relying on no compliance policy allowing RSA key exchange.
(RSA key exchange does not exercise the signature algorithm or curve.)

Bug: 495413980
Change-Id: I27224cf42e1652eb4bfc8112e06980607775cbff
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/97347
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

ssl/ssl_lib.cc

diff --git a/ssl/ssl_lib.cc b/ssl/ssl_lib.cc
index 29ac089..96cce25 100644
--- a/ssl/ssl_lib.cc
+++ b/ssl/ssl_lib.cc
@@ -3564,7 +3564,8 @@
 
 static const char kTLS12Ciphers[] =
     "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
-    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384";
+    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+    "TLS_RSA_WITH_AES_256_GCM_SHA384";
 
 static int Configure(SSLContext *ctx) {
   ctx->compliance_policy = ssl_compliance_policy_cnsa1_202603;

ssl/test/runner/cipher_suite_tests.go

diff --git a/ssl/test/runner/cipher_suite_tests.go b/ssl/test/runner/cipher_suite_tests.go
index 01a0ecb..4880d37 100644
--- a/ssl/test/runner/cipher_suite_tests.go
+++ b/ssl/test/runner/cipher_suite_tests.go
@@ -68,6 +68,14 @@
 	return !hasComponent(suiteName, "WITH")
 }
 
+func isPSKSuite(suiteName string) bool {
+	return hasComponent(suiteName, "PSK")
+}
+
+func isRSAKeyExchange(suiteName string) bool {
+	return strings.HasPrefix(suiteName, "RSA_WITH_")
+}
+
 func addTestForCipherSuite(suite testCipherSuite, ver tlsVersion, protocol protocol) {
 	const psk = "12345"
 	const pskIdentity = "luggage combo"

ssl/test/runner/compliance_policy_tests.go

diff --git a/ssl/test/runner/compliance_policy_tests.go b/ssl/test/runner/compliance_policy_tests.go
index 8a4b8c2..7ccf636 100644
--- a/ssl/test/runner/compliance_policy_tests.go
+++ b/ssl/test/runner/compliance_policy_tests.go
@@ -15,6 +15,17 @@
 package runner
 
 func addCompliancePolicyTests() {
+	// When testing curves and signature algorithms, we need to exclude RSA key
+	// exchange ciphers, otherwise the server will just fall back to those. One
+	// of the compliance policies still allows these, despite the issues being
+	// known since 1998.
+	var ecdheAndSignCiphers []uint16
+	for _, suite := range testCipherSuites {
+		if !isPSKSuite(suite.name) && !isRSAKeyExchange(suite.name) {
+			ecdheAndSignCiphers = append(ecdheAndSignCiphers, suite.id)
+		}
+	}
+
 	for _, protocol := range []protocol{tls, quic} {
 		for _, suite := range testCipherSuites {
 			var isFIPSCipherSuite bool
@@ -36,6 +47,8 @@
 				TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
 				isWPACipherSuite = true
 				isCNSA1CipherSuite = true
+			case TLS_RSA_WITH_AES_256_GCM_SHA384:
+				isCNSA1CipherSuite = true
 			}
 
 			var isCNSA2CipherSuite bool
@@ -173,6 +186,7 @@
 					config: Config{
 						MinVersion:       VersionTLS12,
 						MaxVersion:       VersionTLS13,
+						CipherSuites:     ecdheAndSignCiphers,
 						CurvePreferences: []CurveID{curve.id},
 					},
 					flags: []string{
@@ -188,6 +202,7 @@
 					config: Config{
 						MinVersion:       VersionTLS12,
 						MaxVersion:       VersionTLS13,
+						CipherSuites:     ecdheAndSignCiphers,
 						CurvePreferences: []CurveID{curve.id},
 					},
 					flags: []string{
@@ -289,6 +304,7 @@
 					config: Config{
 						MinVersion:                VersionTLS12,
 						MaxVersion:                maxVersion,
+						CipherSuites:              ecdheAndSignCiphers,
 						VerifySignatureAlgorithms: []signatureAlgorithm{sigalg.id},
 					},
 					// Use the base certificate. We wish to pick up the signature algorithm
@@ -303,9 +319,10 @@
 					protocol: protocol,
 					name:     "Compliance" + policy.flag + "-" + protocol.String() + "-Client-" + sigalg.name,
 					config: Config{
-						MinVersion: VersionTLS12,
-						MaxVersion: maxVersion,
-						Credential: cert,
+						MinVersion:   VersionTLS12,
+						MaxVersion:   maxVersion,
+						CipherSuites: ecdheAndSignCiphers,
+						Credential:   cert,
 					},
 					flags: []string{
 						policy.flag,