Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

OpenSSL 1.1.1-pre2

Browse Source
This commit is contained in:
Hakase
2018-04-07 17:29:40 +09:00
parent 82a44d2483
commit bbac8ca55d
17755 changed files with 221242 additions and 98415 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/ssl-tests/01-simple.conf
+2 -2
View File
@@ -40,12 +40,12 @@ client = 1-Server signature algorithms bug-client
[1-Server signature algorithms bug-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = ECDSA+SHA256
ClientSignatureAlgorithms = PSS+SHA512:RSA+SHA512
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-Server signature algorithms bug-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA+SHA256
SignatureAlgorithms = PSS+SHA256:RSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
test/ssl-tests/01-simple.conf.in
+2 -2
View File
@@ -22,8 +22,8 @@ our @tests = (
{
name => "Server signature algorithms bug",
# Should have no effect as we aren't doing client auth
server => { "ClientSignatureAlgorithms" => "ECDSA+SHA256" },
client => { "SignatureAlgorithms" => "RSA+SHA256" },
server => { "ClientSignatureAlgorithms" => "PSS+SHA512:RSA+SHA512" },
client => { "SignatureAlgorithms" => "PSS+SHA256:RSA+SHA256" },
test => { "ExpectedResult" => "Success" },
},
test/ssl-tests/02-protocol-version.conf
+10064 -1219
View File
File diff suppressed because it is too large Load Diff
test/ssl-tests/04-client_auth.conf
+836 -296
View File
@@ -1,27 +1,43 @@
# Generated with generate_ssl_tests.pl
num_tests = 20
num_tests = 36
test-0 = 0-server-auth-flex
test-1 = 1-client-auth-flex-request
test-2 = 2-client-auth-flex-require-fail
test-3 = 3-client-auth-flex-require
test-4 = 4-client-auth-flex-noroot
test-5 = 5-server-auth-TLSv1
test-6 = 6-client-auth-TLSv1-request
test-7 = 7-client-auth-TLSv1-require-fail
test-8 = 8-client-auth-TLSv1-require
test-9 = 9-client-auth-TLSv1-noroot
test-10 = 10-server-auth-TLSv1.1
test-11 = 11-client-auth-TLSv1.1-request
test-12 = 12-client-auth-TLSv1.1-require-fail
test-13 = 13-client-auth-TLSv1.1-require
test-14 = 14-client-auth-TLSv1.1-noroot
test-15 = 15-server-auth-TLSv1.2
test-16 = 16-client-auth-TLSv1.2-request
test-17 = 17-client-auth-TLSv1.2-require-fail
test-18 = 18-client-auth-TLSv1.2-require
test-19 = 19-client-auth-TLSv1.2-noroot
test-4 = 4-client-auth-flex-require-non-empty-names
test-5 = 5-client-auth-flex-noroot
test-6 = 6-server-auth-TLSv1
test-7 = 7-client-auth-TLSv1-request
test-8 = 8-client-auth-TLSv1-require-fail
test-9 = 9-client-auth-TLSv1-require
test-10 = 10-client-auth-TLSv1-require-non-empty-names
test-11 = 11-client-auth-TLSv1-noroot
test-12 = 12-server-auth-TLSv1.1
test-13 = 13-client-auth-TLSv1.1-request
test-14 = 14-client-auth-TLSv1.1-require-fail
test-15 = 15-client-auth-TLSv1.1-require
test-16 = 16-client-auth-TLSv1.1-require-non-empty-names
test-17 = 17-client-auth-TLSv1.1-noroot
test-18 = 18-server-auth-TLSv1.2
test-19 = 19-client-auth-TLSv1.2-request
test-20 = 20-client-auth-TLSv1.2-require-fail
test-21 = 21-client-auth-TLSv1.2-require
test-22 = 22-client-auth-TLSv1.2-require-non-empty-names
test-23 = 23-client-auth-TLSv1.2-noroot
test-24 = 24-server-auth-DTLSv1
test-25 = 25-client-auth-DTLSv1-request
test-26 = 26-client-auth-DTLSv1-require-fail
test-27 = 27-client-auth-DTLSv1-require
test-28 = 28-client-auth-DTLSv1-require-non-empty-names
test-29 = 29-client-auth-DTLSv1-noroot
test-30 = 30-server-auth-DTLSv1.2
test-31 = 31-client-auth-DTLSv1.2-request
test-32 = 32-client-auth-DTLSv1.2-require-fail
test-33 = 33-client-auth-DTLSv1.2-require
test-34 = 34-client-auth-DTLSv1.2-require-non-empty-names
test-35 = 35-client-auth-DTLSv1.2-noroot
# ===========================================================
[0-server-auth-flex]
@@ -119,25 +135,29 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-3]
ExpectedClientCANames = empty
ExpectedClientCertType = RSA
ExpectedResult = Success
# ===========================================================
[4-client-auth-flex-noroot]
ssl_conf = 4-client-auth-flex-noroot-ssl
[4-client-auth-flex-require-non-empty-names]
ssl_conf = 4-client-auth-flex-require-non-empty-names-ssl
[4-client-auth-flex-noroot-ssl]
server = 4-client-auth-flex-noroot-server
client = 4-client-auth-flex-noroot-client
[4-client-auth-flex-require-non-empty-names-ssl]
server = 4-client-auth-flex-require-non-empty-names-server
client = 4-client-auth-flex-require-non-empty-names-client
[4-client-auth-flex-noroot-server]
[4-client-auth-flex-require-non-empty-names-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[4-client-auth-flex-noroot-client]
[4-client-auth-flex-require-non-empty-names-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
@@ -145,55 +165,55 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-4]
ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedClientCertType = RSA
ExpectedResult = Success
# ===========================================================
[5-client-auth-flex-noroot]
ssl_conf = 5-client-auth-flex-noroot-ssl
[5-client-auth-flex-noroot-ssl]
server = 5-client-auth-flex-noroot-server
client = 5-client-auth-flex-noroot-client
[5-client-auth-flex-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[5-client-auth-flex-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-5]
ExpectedResult = ServerFail
ExpectedServerAlert = UnknownCA
# ===========================================================
[5-server-auth-TLSv1]
ssl_conf = 5-server-auth-TLSv1-ssl
[6-server-auth-TLSv1]
ssl_conf = 6-server-auth-TLSv1-ssl
[5-server-auth-TLSv1-ssl]
server = 5-server-auth-TLSv1-server
client = 5-server-auth-TLSv1-client
[6-server-auth-TLSv1-ssl]
server = 6-server-auth-TLSv1-server
client = 6-server-auth-TLSv1-client
[5-server-auth-TLSv1-server]
[6-server-auth-TLSv1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[5-server-auth-TLSv1-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-5]
ExpectedResult = Success
# ===========================================================
[6-client-auth-TLSv1-request]
ssl_conf = 6-client-auth-TLSv1-request-ssl
[6-client-auth-TLSv1-request-ssl]
server = 6-client-auth-TLSv1-request-server
client = 6-client-auth-TLSv1-request-client
[6-client-auth-TLSv1-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[6-client-auth-TLSv1-request-client]
[6-server-auth-TLSv1-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
@@ -206,14 +226,42 @@ ExpectedResult = Success
# ===========================================================
[7-client-auth-TLSv1-require-fail]
ssl_conf = 7-client-auth-TLSv1-require-fail-ssl
[7-client-auth-TLSv1-request]
ssl_conf = 7-client-auth-TLSv1-request-ssl
[7-client-auth-TLSv1-require-fail-ssl]
server = 7-client-auth-TLSv1-require-fail-server
client = 7-client-auth-TLSv1-require-fail-client
[7-client-auth-TLSv1-request-ssl]
server = 7-client-auth-TLSv1-request-server
client = 7-client-auth-TLSv1-request-client
[7-client-auth-TLSv1-require-fail-server]
[7-client-auth-TLSv1-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[7-client-auth-TLSv1-request-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-7]
ExpectedResult = Success
# ===========================================================
[8-client-auth-TLSv1-require-fail]
ssl_conf = 8-client-auth-TLSv1-require-fail-ssl
[8-client-auth-TLSv1-require-fail-ssl]
server = 8-client-auth-TLSv1-require-fail-server
client = 8-client-auth-TLSv1-require-fail-client
[8-client-auth-TLSv1-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
@@ -222,28 +270,28 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[7-client-auth-TLSv1-require-fail-client]
[8-client-auth-TLSv1-require-fail-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-7]
[test-8]
ExpectedResult = ServerFail
ExpectedServerAlert = HandshakeFailure
# ===========================================================
[8-client-auth-TLSv1-require]
ssl_conf = 8-client-auth-TLSv1-require-ssl
[9-client-auth-TLSv1-require]
ssl_conf = 9-client-auth-TLSv1-require-ssl
[8-client-auth-TLSv1-require-ssl]
server = 8-client-auth-TLSv1-require-server
client = 8-client-auth-TLSv1-require-client
[9-client-auth-TLSv1-require-ssl]
server = 9-client-auth-TLSv1-require-server
client = 9-client-auth-TLSv1-require-client
[8-client-auth-TLSv1-require-server]
[9-client-auth-TLSv1-require-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
@@ -252,37 +300,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[8-client-auth-TLSv1-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-8]
ExpectedResult = Success
# ===========================================================
[9-client-auth-TLSv1-noroot]
ssl_conf = 9-client-auth-TLSv1-noroot-ssl
[9-client-auth-TLSv1-noroot-ssl]
server = 9-client-auth-TLSv1-noroot-server
client = 9-client-auth-TLSv1-noroot-client
[9-client-auth-TLSv1-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[9-client-auth-TLSv1-noroot-client]
[9-client-auth-TLSv1-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
@@ -292,84 +310,93 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-9]
ExpectedClientCANames = empty
ExpectedClientCertType = RSA
ExpectedResult = Success
# ===========================================================
[10-client-auth-TLSv1-require-non-empty-names]
ssl_conf = 10-client-auth-TLSv1-require-non-empty-names-ssl
[10-client-auth-TLSv1-require-non-empty-names-ssl]
server = 10-client-auth-TLSv1-require-non-empty-names-server
client = 10-client-auth-TLSv1-require-non-empty-names-client
[10-client-auth-TLSv1-require-non-empty-names-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
MaxProtocol = TLSv1
MinProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[10-client-auth-TLSv1-require-non-empty-names-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-10]
ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedClientCertType = RSA
ExpectedResult = Success
# ===========================================================
[11-client-auth-TLSv1-noroot]
ssl_conf = 11-client-auth-TLSv1-noroot-ssl
[11-client-auth-TLSv1-noroot-ssl]
server = 11-client-auth-TLSv1-noroot-server
client = 11-client-auth-TLSv1-noroot-client
[11-client-auth-TLSv1-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[11-client-auth-TLSv1-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-11]
ExpectedResult = ServerFail
ExpectedServerAlert = UnknownCA
# ===========================================================
[10-server-auth-TLSv1.1]
ssl_conf = 10-server-auth-TLSv1.1-ssl
[12-server-auth-TLSv1.1]
ssl_conf = 12-server-auth-TLSv1.1-ssl
[10-server-auth-TLSv1.1-ssl]
server = 10-server-auth-TLSv1.1-server
client = 10-server-auth-TLSv1.1-client
[12-server-auth-TLSv1.1-ssl]
server = 12-server-auth-TLSv1.1-server
client = 12-server-auth-TLSv1.1-client
[10-server-auth-TLSv1.1-server]
[12-server-auth-TLSv1.1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-server-auth-TLSv1.1-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-10]
ExpectedResult = Success
# ===========================================================
[11-client-auth-TLSv1.1-request]
ssl_conf = 11-client-auth-TLSv1.1-request-ssl
[11-client-auth-TLSv1.1-request-ssl]
server = 11-client-auth-TLSv1.1-request-server
client = 11-client-auth-TLSv1.1-request-client
[11-client-auth-TLSv1.1-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[11-client-auth-TLSv1.1-request-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-11]
ExpectedResult = Success
# ===========================================================
[12-client-auth-TLSv1.1-require-fail]
ssl_conf = 12-client-auth-TLSv1.1-require-fail-ssl
[12-client-auth-TLSv1.1-require-fail-ssl]
server = 12-client-auth-TLSv1.1-require-fail-server
client = 12-client-auth-TLSv1.1-require-fail-client
[12-client-auth-TLSv1.1-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[12-client-auth-TLSv1.1-require-fail-client]
[12-server-auth-TLSv1.1-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
@@ -377,34 +404,30 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-12]
ExpectedResult = ServerFail
ExpectedServerAlert = HandshakeFailure
ExpectedResult = Success
# ===========================================================
[13-client-auth-TLSv1.1-require]
ssl_conf = 13-client-auth-TLSv1.1-require-ssl
[13-client-auth-TLSv1.1-request]
ssl_conf = 13-client-auth-TLSv1.1-request-ssl
[13-client-auth-TLSv1.1-require-ssl]
server = 13-client-auth-TLSv1.1-require-server
client = 13-client-auth-TLSv1.1-require-client
[13-client-auth-TLSv1.1-request-ssl]
server = 13-client-auth-TLSv1.1-request-server
client = 13-client-auth-TLSv1.1-request-client
[13-client-auth-TLSv1.1-require-server]
[13-client-auth-TLSv1.1-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[13-client-auth-TLSv1.1-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
[13-client-auth-TLSv1.1-request-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -414,144 +437,152 @@ ExpectedResult = Success
# ===========================================================
[14-client-auth-TLSv1.1-noroot]
ssl_conf = 14-client-auth-TLSv1.1-noroot-ssl
[14-client-auth-TLSv1.1-require-fail]
ssl_conf = 14-client-auth-TLSv1.1-require-fail-ssl
[14-client-auth-TLSv1.1-noroot-ssl]
server = 14-client-auth-TLSv1.1-noroot-server
client = 14-client-auth-TLSv1.1-noroot-client
[14-client-auth-TLSv1.1-require-fail-ssl]
server = 14-client-auth-TLSv1.1-require-fail-server
client = 14-client-auth-TLSv1.1-require-fail-client
[14-client-auth-TLSv1.1-noroot-server]
[14-client-auth-TLSv1.1-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[14-client-auth-TLSv1.1-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-14]
ExpectedResult = ServerFail
ExpectedServerAlert = UnknownCA
# ===========================================================
[15-server-auth-TLSv1.2]
ssl_conf = 15-server-auth-TLSv1.2-ssl
[15-server-auth-TLSv1.2-ssl]
server = 15-server-auth-TLSv1.2-server
client = 15-server-auth-TLSv1.2-client
[15-server-auth-TLSv1.2-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-server-auth-TLSv1.2-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-15]
ExpectedResult = Success
# ===========================================================
[16-client-auth-TLSv1.2-request]
ssl_conf = 16-client-auth-TLSv1.2-request-ssl
[16-client-auth-TLSv1.2-request-ssl]
server = 16-client-auth-TLSv1.2-request-server
client = 16-client-auth-TLSv1.2-request-client
[16-client-auth-TLSv1.2-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[16-client-auth-TLSv1.2-request-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-16]
ExpectedResult = Success
# ===========================================================
[17-client-auth-TLSv1.2-require-fail]
ssl_conf = 17-client-auth-TLSv1.2-require-fail-ssl
[17-client-auth-TLSv1.2-require-fail-ssl]
server = 17-client-auth-TLSv1.2-require-fail-server
client = 17-client-auth-TLSv1.2-require-fail-client
[17-client-auth-TLSv1.2-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[17-client-auth-TLSv1.2-require-fail-client]
[14-client-auth-TLSv1.1-require-fail-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-17]
[test-14]
ExpectedResult = ServerFail
ExpectedServerAlert = HandshakeFailure
# ===========================================================
[18-client-auth-TLSv1.2-require]
ssl_conf = 18-client-auth-TLSv1.2-require-ssl
[15-client-auth-TLSv1.1-require]
ssl_conf = 15-client-auth-TLSv1.1-require-ssl
[18-client-auth-TLSv1.2-require-ssl]
server = 18-client-auth-TLSv1.2-require-server
client = 18-client-auth-TLSv1.2-require-client
[15-client-auth-TLSv1.1-require-ssl]
server = 15-client-auth-TLSv1.1-require-server
client = 15-client-auth-TLSv1.1-require-client
[18-client-auth-TLSv1.2-require-server]
[15-client-auth-TLSv1.1-require-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[15-client-auth-TLSv1.1-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-15]
ExpectedClientCANames = empty
ExpectedClientCertType = RSA
ExpectedResult = Success
# ===========================================================
[16-client-auth-TLSv1.1-require-non-empty-names]
ssl_conf = 16-client-auth-TLSv1.1-require-non-empty-names-ssl
[16-client-auth-TLSv1.1-require-non-empty-names-ssl]
server = 16-client-auth-TLSv1.1-require-non-empty-names-server
client = 16-client-auth-TLSv1.1-require-non-empty-names-client
[16-client-auth-TLSv1.1-require-non-empty-names-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[16-client-auth-TLSv1.1-require-non-empty-names-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-16]
ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedClientCertType = RSA
ExpectedResult = Success
# ===========================================================
[17-client-auth-TLSv1.1-noroot]
ssl_conf = 17-client-auth-TLSv1.1-noroot-ssl
[17-client-auth-TLSv1.1-noroot-ssl]
server = 17-client-auth-TLSv1.1-noroot-server
client = 17-client-auth-TLSv1.1-noroot-client
[17-client-auth-TLSv1.1-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[17-client-auth-TLSv1.1-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-17]
ExpectedResult = ServerFail
ExpectedServerAlert = UnknownCA
# ===========================================================
[18-server-auth-TLSv1.2]
ssl_conf = 18-server-auth-TLSv1.2-ssl
[18-server-auth-TLSv1.2-ssl]
server = 18-server-auth-TLSv1.2-server
client = 18-server-auth-TLSv1.2-client
[18-server-auth-TLSv1.2-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[18-client-auth-TLSv1.2-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
[18-server-auth-TLSv1.2-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -561,22 +592,82 @@ ExpectedResult = Success
# ===========================================================
[19-client-auth-TLSv1.2-noroot]
ssl_conf = 19-client-auth-TLSv1.2-noroot-ssl
[19-client-auth-TLSv1.2-request]
ssl_conf = 19-client-auth-TLSv1.2-request-ssl
[19-client-auth-TLSv1.2-noroot-ssl]
server = 19-client-auth-TLSv1.2-noroot-server
client = 19-client-auth-TLSv1.2-noroot-client
[19-client-auth-TLSv1.2-request-ssl]
server = 19-client-auth-TLSv1.2-request-server
client = 19-client-auth-TLSv1.2-request-client
[19-client-auth-TLSv1.2-noroot-server]
[19-client-auth-TLSv1.2-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[19-client-auth-TLSv1.2-request-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-19]
ExpectedResult = Success
# ===========================================================
[20-client-auth-TLSv1.2-require-fail]
ssl_conf = 20-client-auth-TLSv1.2-require-fail-ssl
[20-client-auth-TLSv1.2-require-fail-ssl]
server = 20-client-auth-TLSv1.2-require-fail-server
client = 20-client-auth-TLSv1.2-require-fail-client
[20-client-auth-TLSv1.2-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[19-client-auth-TLSv1.2-noroot-client]
[20-client-auth-TLSv1.2-require-fail-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-20]
ExpectedResult = ServerFail
ExpectedServerAlert = HandshakeFailure
# ===========================================================
[21-client-auth-TLSv1.2-require]
ssl_conf = 21-client-auth-TLSv1.2-require-ssl
[21-client-auth-TLSv1.2-require-ssl]
server = 21-client-auth-TLSv1.2-require-server
client = 21-client-auth-TLSv1.2-require-client
[21-client-auth-TLSv1.2-require-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = SHA256+RSA
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[21-client-auth-TLSv1.2-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
@@ -585,8 +676,457 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-19]
[test-21]
ExpectedClientCANames = empty
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
ExpectedClientSignType = RSA
ExpectedResult = Success
# ===========================================================
[22-client-auth-TLSv1.2-require-non-empty-names]
ssl_conf = 22-client-auth-TLSv1.2-require-non-empty-names-ssl
[22-client-auth-TLSv1.2-require-non-empty-names-ssl]
server = 22-client-auth-TLSv1.2-require-non-empty-names-server
client = 22-client-auth-TLSv1.2-require-non-empty-names-client
[22-client-auth-TLSv1.2-require-non-empty-names-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ClientSignatureAlgorithms = SHA256+RSA
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[22-client-auth-TLSv1.2-require-non-empty-names-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-22]
ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
ExpectedClientSignType = RSA
ExpectedResult = Success
# ===========================================================
[23-client-auth-TLSv1.2-noroot]
ssl_conf = 23-client-auth-TLSv1.2-noroot-ssl
[23-client-auth-TLSv1.2-noroot-ssl]
server = 23-client-auth-TLSv1.2-noroot-server
client = 23-client-auth-TLSv1.2-noroot-client
[23-client-auth-TLSv1.2-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[23-client-auth-TLSv1.2-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-23]
ExpectedResult = ServerFail
ExpectedServerAlert = UnknownCA
# ===========================================================
[24-server-auth-DTLSv1]
ssl_conf = 24-server-auth-DTLSv1-ssl
[24-server-auth-DTLSv1-ssl]
server = 24-server-auth-DTLSv1-server
client = 24-server-auth-DTLSv1-client
[24-server-auth-DTLSv1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[24-server-auth-DTLSv1-client]
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-24]
ExpectedResult = Success
Method = DTLS
# ===========================================================
[25-client-auth-DTLSv1-request]
ssl_conf = 25-client-auth-DTLSv1-request-ssl
[25-client-auth-DTLSv1-request-ssl]
server = 25-client-auth-DTLSv1-request-server
client = 25-client-auth-DTLSv1-request-client
[25-client-auth-DTLSv1-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[25-client-auth-DTLSv1-request-client]
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-25]
ExpectedResult = Success
Method = DTLS
# ===========================================================
[26-client-auth-DTLSv1-require-fail]
ssl_conf = 26-client-auth-DTLSv1-require-fail-ssl
[26-client-auth-DTLSv1-require-fail-ssl]
server = 26-client-auth-DTLSv1-require-fail-server
client = 26-client-auth-DTLSv1-require-fail-client
[26-client-auth-DTLSv1-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[26-client-auth-DTLSv1-require-fail-client]
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-26]
ExpectedResult = ServerFail
ExpectedServerAlert = HandshakeFailure
Method = DTLS
# ===========================================================
[27-client-auth-DTLSv1-require]
ssl_conf = 27-client-auth-DTLSv1-require-ssl
[27-client-auth-DTLSv1-require-ssl]
server = 27-client-auth-DTLSv1-require-server
client = 27-client-auth-DTLSv1-require-client
[27-client-auth-DTLSv1-require-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[27-client-auth-DTLSv1-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-27]
ExpectedClientCANames = empty
ExpectedClientCertType = RSA
ExpectedResult = Success
Method = DTLS
# ===========================================================
[28-client-auth-DTLSv1-require-non-empty-names]
ssl_conf = 28-client-auth-DTLSv1-require-non-empty-names-ssl
[28-client-auth-DTLSv1-require-non-empty-names-ssl]
server = 28-client-auth-DTLSv1-require-non-empty-names-server
client = 28-client-auth-DTLSv1-require-non-empty-names-client
[28-client-auth-DTLSv1-require-non-empty-names-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[28-client-auth-DTLSv1-require-non-empty-names-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-28]
ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedClientCertType = RSA
ExpectedResult = Success
Method = DTLS
# ===========================================================
[29-client-auth-DTLSv1-noroot]
ssl_conf = 29-client-auth-DTLSv1-noroot-ssl
[29-client-auth-DTLSv1-noroot-ssl]
server = 29-client-auth-DTLSv1-noroot-server
client = 29-client-auth-DTLSv1-noroot-client
[29-client-auth-DTLSv1-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[29-client-auth-DTLSv1-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1
MinProtocol = DTLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-29]
ExpectedResult = ServerFail
ExpectedServerAlert = UnknownCA
Method = DTLS
# ===========================================================
[30-server-auth-DTLSv1.2]
ssl_conf = 30-server-auth-DTLSv1.2-ssl
[30-server-auth-DTLSv1.2-ssl]
server = 30-server-auth-DTLSv1.2-server
client = 30-server-auth-DTLSv1.2-client
[30-server-auth-DTLSv1.2-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[30-server-auth-DTLSv1.2-client]
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-30]
ExpectedResult = Success
Method = DTLS
# ===========================================================
[31-client-auth-DTLSv1.2-request]
ssl_conf = 31-client-auth-DTLSv1.2-request-ssl
[31-client-auth-DTLSv1.2-request-ssl]
server = 31-client-auth-DTLSv1.2-request-server
client = 31-client-auth-DTLSv1.2-request-client
[31-client-auth-DTLSv1.2-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[31-client-auth-DTLSv1.2-request-client]
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-31]
ExpectedResult = Success
Method = DTLS
# ===========================================================
[32-client-auth-DTLSv1.2-require-fail]
ssl_conf = 32-client-auth-DTLSv1.2-require-fail-ssl
[32-client-auth-DTLSv1.2-require-fail-ssl]
server = 32-client-auth-DTLSv1.2-require-fail-server
client = 32-client-auth-DTLSv1.2-require-fail-client
[32-client-auth-DTLSv1.2-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[32-client-auth-DTLSv1.2-require-fail-client]
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-32]
ExpectedResult = ServerFail
ExpectedServerAlert = HandshakeFailure
Method = DTLS
# ===========================================================
[33-client-auth-DTLSv1.2-require]
ssl_conf = 33-client-auth-DTLSv1.2-require-ssl
[33-client-auth-DTLSv1.2-require-ssl]
server = 33-client-auth-DTLSv1.2-require-server
client = 33-client-auth-DTLSv1.2-require-client
[33-client-auth-DTLSv1.2-require-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[33-client-auth-DTLSv1.2-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-33]
ExpectedClientCANames = empty
ExpectedClientCertType = RSA
ExpectedResult = Success
Method = DTLS
# ===========================================================
[34-client-auth-DTLSv1.2-require-non-empty-names]
ssl_conf = 34-client-auth-DTLSv1.2-require-non-empty-names-ssl
[34-client-auth-DTLSv1.2-require-non-empty-names-ssl]
server = 34-client-auth-DTLSv1.2-require-non-empty-names-server
client = 34-client-auth-DTLSv1.2-require-non-empty-names-client
[34-client-auth-DTLSv1.2-require-non-empty-names-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[34-client-auth-DTLSv1.2-require-non-empty-names-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-34]
ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedClientCertType = RSA
ExpectedResult = Success
Method = DTLS
# ===========================================================
[35-client-auth-DTLSv1.2-noroot]
ssl_conf = 35-client-auth-DTLSv1.2-noroot-ssl
[35-client-auth-DTLSv1.2-noroot-ssl]
server = 35-client-auth-DTLSv1.2-noroot-server
client = 35-client-auth-DTLSv1.2-noroot-client
[35-client-auth-DTLSv1.2-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[35-client-auth-DTLSv1.2-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = DTLSv1.2
MinProtocol = DTLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-35]
ExpectedResult = ServerFail
ExpectedServerAlert = UnknownCA
Method = DTLS
test/ssl-tests/04-client_auth.conf.in
+157 -86
View File
@@ -8,116 +8,187 @@ use strict;
use warnings;
use OpenSSL::Test;
use OpenSSL::Test::Utils qw(anydisabled);
use OpenSSL::Test::Utils qw(anydisabled disabled);
setup("no_test_here");
# We test version-flexible negotiation (undef) and each protocol version.
my @protocols = (undef, "SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2");
my @protocols = (undef, "SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", "DTLSv1", "DTLSv1.2");
my @is_disabled = (0);
push @is_disabled, anydisabled("ssl3", "tls1", "tls1_1", "tls1_2");
push @is_disabled, anydisabled("ssl3", "tls1", "tls1_1", "tls1_2", "dtls1", "dtls1_2");
our @tests = ();
sub generate_tests() {
foreach (0..$#protocols) {
my $protocol = $protocols[$_];
my $protocol_name = $protocol || "flex";
my $caalert;
my $method;
my $sctpenabled = 0;
if (!$is_disabled[$_]) {
if ($protocol_name eq "SSLv3") {
$caalert = "BadCertificate";
} else {
$caalert = "UnknownCA";
}
# Sanity-check simple handshake.
push @tests, {
name => "server-auth-${protocol_name}",
server => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol
},
client => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol
},
test => { "ExpectedResult" => "Success" },
};
if ($protocol_name =~ m/^DTLS/) {
$method = "DTLS";
$sctpenabled = 1 if !disabled("sctp");
}
my $clihash;
my $clisigtype;
my $clisigalgs;
# TODO(TLS1.3) add TLSv1.3 versions
if ($protocol_name eq "TLSv1.2") {
$clihash = "SHA256";
$clisigtype = "RSA";
$clisigalgs = "SHA256+RSA";
}
for (my $sctp = 0; $sctp <= $sctpenabled; $sctp++) {
# Sanity-check simple handshake.
push @tests, {
name => "server-auth-${protocol_name}"
.($sctp ? "-sctp" : ""),
server => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol
},
client => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol
},
test => {
"ExpectedResult" => "Success",
"Method" => $method,
},
};
$tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
# Handshake with client cert requested but not required or received.
push @tests, {
name => "client-auth-${protocol_name}-request",
server => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"VerifyMode" => "Request"
},
client => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol
},
test => { "ExpectedResult" => "Success" },
};
# Handshake with client cert requested but not required or received.
push @tests, {
name => "client-auth-${protocol_name}-request"
.($sctp ? "-sctp" : ""),
server => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"VerifyMode" => "Request"
},
client => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol
},
test => {
"ExpectedResult" => "Success",
"Method" => $method,
},
};
$tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
# Handshake with client cert required but not present.
push @tests, {
name => "client-auth-${protocol_name}-require-fail",
server => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Require",
},
client => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol
},
test => {
"ExpectedResult" => "ServerFail",
"ExpectedServerAlert" => "HandshakeFailure",
},
};
# Handshake with client cert required but not present.
push @tests, {
name => "client-auth-${protocol_name}-require-fail"
.($sctp ? "-sctp" : ""),
server => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Require",
},
client => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol
},
test => {
"ExpectedResult" => "ServerFail",
"ExpectedServerAlert" => "HandshakeFailure",
"Method" => $method,
},
};
$tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
# Successful handshake with client authentication.
push @tests, {
name => "client-auth-${protocol_name}-require",
server => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Request",
},
client => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => { "ExpectedResult" => "Success" },
};
# Successful handshake with client authentication.
push @tests, {
name => "client-auth-${protocol_name}-require"
.($sctp ? "-sctp" : ""),
server => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"ClientSignatureAlgorithms" => $clisigalgs,
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Request",
},
client => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"ExpectedResult" => "Success",
"ExpectedClientCertType" => "RSA",
"ExpectedClientSignType" => $clisigtype,
"ExpectedClientSignHash" => $clihash,
"ExpectedClientCANames" => "empty",
"Method" => $method,
},
};
$tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
# Handshake with client authentication but without the root certificate.
push @tests, {
name => "client-auth-${protocol_name}-noroot",
server => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"VerifyMode" => "Require",
},
client => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"ExpectedResult" => "ServerFail",
"ExpectedServerAlert" => $caalert,
},
};
# Successful handshake with client authentication non-empty names
push @tests, {
name => "client-auth-${protocol_name}-require-non-empty-names"
.($sctp ? "-sctp" : ""),
server => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"ClientSignatureAlgorithms" => $clisigalgs,
"ClientCAFile" => test_pem("root-cert.pem"),
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Request",
},
client => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"ExpectedResult" => "Success",
"ExpectedClientCertType" => "RSA",
"ExpectedClientSignType" => $clisigtype,
"ExpectedClientSignHash" => $clihash,
"ExpectedClientCANames" => test_pem("root-cert.pem"),
"Method" => $method,
},
};
$tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
# Handshake with client authentication but without the root certificate.
push @tests, {
name => "client-auth-${protocol_name}-noroot"
.($sctp ? "-sctp" : ""),
server => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"VerifyMode" => "Require",
},
client => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"ExpectedResult" => "ServerFail",
"ExpectedServerAlert" => $caalert,
"Method" => $method,
},
};
$tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
}
}
}
}
generate_tests();
test/ssl-tests/05-sni.conf
+106 -1
View File
@@ -1,6 +1,6 @@
# Generated with generate_ssl_tests.pl
num_tests = 6
num_tests = 9
test-0 = 0-SNI-switch-context
test-1 = 1-SNI-keep-context
@@ -8,6 +8,9 @@ test-2 = 2-SNI-no-server-support
test-3 = 3-SNI-no-client-support
test-4 = 4-SNI-bad-sni-ignore-mismatch
test-5 = 5-SNI-bad-sni-reject-mismatch
test-6 = 6-SNI-bad-clienthello-sni-ignore-mismatch
test-7 = 7-SNI-bad-clienthello-sni-reject-mismatch
test-8 = 8-SNI-clienthello-disable-v12
# ===========================================================
[0-SNI-switch-context]
@@ -201,3 +204,105 @@ ServerNameCallback = RejectMismatch
ServerName = invalid
# ===========================================================
[6-SNI-bad-clienthello-sni-ignore-mismatch]
ssl_conf = 6-SNI-bad-clienthello-sni-ignore-mismatch-ssl
[6-SNI-bad-clienthello-sni-ignore-mismatch-ssl]
server = 6-SNI-bad-clienthello-sni-ignore-mismatch-server
client = 6-SNI-bad-clienthello-sni-ignore-mismatch-client
server2 = 6-SNI-bad-clienthello-sni-ignore-mismatch-server
[6-SNI-bad-clienthello-sni-ignore-mismatch-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-SNI-bad-clienthello-sni-ignore-mismatch-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-6]
ExpectedResult = Success
ExpectedServerName = server1
server = 6-SNI-bad-clienthello-sni-ignore-mismatch-server-extra
server2 = 6-SNI-bad-clienthello-sni-ignore-mismatch-server-extra
client = 6-SNI-bad-clienthello-sni-ignore-mismatch-client-extra
[6-SNI-bad-clienthello-sni-ignore-mismatch-server-extra]
ServerNameCallback = ClientHelloIgnoreMismatch
[6-SNI-bad-clienthello-sni-ignore-mismatch-client-extra]
ServerName = invalid
# ===========================================================
[7-SNI-bad-clienthello-sni-reject-mismatch]
ssl_conf = 7-SNI-bad-clienthello-sni-reject-mismatch-ssl
[7-SNI-bad-clienthello-sni-reject-mismatch-ssl]
server = 7-SNI-bad-clienthello-sni-reject-mismatch-server
client = 7-SNI-bad-clienthello-sni-reject-mismatch-client
server2 = 7-SNI-bad-clienthello-sni-reject-mismatch-server
[7-SNI-bad-clienthello-sni-reject-mismatch-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-SNI-bad-clienthello-sni-reject-mismatch-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-7]
ExpectedResult = ServerFail
ExpectedServerAlert = UnrecognizedName
server = 7-SNI-bad-clienthello-sni-reject-mismatch-server-extra
server2 = 7-SNI-bad-clienthello-sni-reject-mismatch-server-extra
client = 7-SNI-bad-clienthello-sni-reject-mismatch-client-extra
[7-SNI-bad-clienthello-sni-reject-mismatch-server-extra]
ServerNameCallback = ClientHelloRejectMismatch
[7-SNI-bad-clienthello-sni-reject-mismatch-client-extra]
ServerName = invalid
# ===========================================================
[8-SNI-clienthello-disable-v12]
ssl_conf = 8-SNI-clienthello-disable-v12-ssl
[8-SNI-clienthello-disable-v12-ssl]
server = 8-SNI-clienthello-disable-v12-server
client = 8-SNI-clienthello-disable-v12-client
server2 = 8-SNI-clienthello-disable-v12-server
[8-SNI-clienthello-disable-v12-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-SNI-clienthello-disable-v12-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-8]
ExpectedProtocol = TLSv1.1
ExpectedServerName = server2
server = 8-SNI-clienthello-disable-v12-server-extra
server2 = 8-SNI-clienthello-disable-v12-server-extra
client = 8-SNI-clienthello-disable-v12-client-extra
[8-SNI-clienthello-disable-v12-server-extra]
ServerNameCallback = ClientHelloNoV12
[8-SNI-clienthello-disable-v12-client-extra]
ServerName = server2
test/ssl-tests/05-sni.conf.in
+57
View File
@@ -13,6 +13,7 @@ use strict;
use warnings;
package ssltests;
use OpenSSL::Test::Utils;
our @tests = (
{
@@ -109,4 +110,60 @@ our @tests = (
"ExpectedServerAlert" => "UnrecognizedName"
},
},
{
name => "SNI-bad-clienthello-sni-ignore-mismatch",
server => {
extra => {
"ServerNameCallback" => "ClientHelloIgnoreMismatch",
},
},
client => {
extra => {
"ServerName" => "invalid",
},
},
test => {
"ExpectedServerName" => "server1",
"ExpectedResult" => "Success"
},
},
{
name => "SNI-bad-clienthello-sni-reject-mismatch",
server => {
extra => {
"ServerNameCallback" => "ClientHelloRejectMismatch",
},
},
client => {
extra => {
"ServerName" => "invalid",
},
},
test => {
"ExpectedResult" => "ServerFail",
"ExpectedServerAlert" => "UnrecognizedName"
},
},
);
our @tests_tls_1_1 = (
{
name => "SNI-clienthello-disable-v12",
server => {
extra => {
"ServerNameCallback" => "ClientHelloNoV12",
},
},
client => {
extra => {
"ServerName" => "server2",
},
},
test => {
"ExpectedProtocol" => "TLSv1.1",
"ExpectedServerName" => "server2",
},
},
);
push @tests, @tests_tls_1_1 unless disabled("tls1_1");
test/ssl-tests/06-sni-ticket.conf
+33
View File
@@ -43,6 +43,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -84,6 +85,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -91,6 +93,7 @@ VerifyMode = Peer
[test-1]
ExpectedResult = Success
ExpectedServerName = server1
SessionIdExpected = Yes
SessionTicketExpected = Yes
server = 1-sni-session-ticket-server-extra
client = 1-sni-session-ticket-client-extra
@@ -126,6 +129,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -133,6 +137,7 @@ VerifyMode = Peer
[test-2]
ExpectedResult = Success
ExpectedServerName = server2
SessionIdExpected = Yes
SessionTicketExpected = Yes
server = 2-sni-session-ticket-server-extra
client = 2-sni-session-ticket-client-extra
@@ -168,6 +173,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -175,6 +181,7 @@ VerifyMode = Peer
[test-3]
ExpectedResult = Success
ExpectedServerName = server1
SessionIdExpected = Yes
SessionTicketExpected = Yes
server = 3-sni-session-ticket-server-extra
client = 3-sni-session-ticket-client-extra
@@ -210,6 +217,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[4-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -217,6 +225,7 @@ VerifyMode = Peer
[test-4]
ExpectedResult = Success
ExpectedServerName = server2
SessionIdExpected = Yes
SessionTicketExpected = No
server = 4-sni-session-ticket-server-extra
client = 4-sni-session-ticket-client-extra
@@ -252,6 +261,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[5-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -259,6 +269,7 @@ VerifyMode = Peer
[test-5]
ExpectedResult = Success
ExpectedServerName = server1
SessionIdExpected = Yes
SessionTicketExpected = No
server = 5-sni-session-ticket-server-extra
client = 5-sni-session-ticket-client-extra
@@ -294,6 +305,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -301,6 +313,7 @@ VerifyMode = Peer
[test-6]
ExpectedResult = Success
ExpectedServerName = server2
SessionIdExpected = Yes
SessionTicketExpected = No
server = 6-sni-session-ticket-server-extra
client = 6-sni-session-ticket-client-extra
@@ -336,6 +349,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -343,6 +357,7 @@ VerifyMode = Peer
[test-7]
ExpectedResult = Success
ExpectedServerName = server1
SessionIdExpected = Yes
SessionTicketExpected = No
server = 7-sni-session-ticket-server-extra
client = 7-sni-session-ticket-client-extra
@@ -378,6 +393,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -385,6 +401,7 @@ VerifyMode = Peer
[test-8]
ExpectedResult = Success
ExpectedServerName = server2
SessionIdExpected = Yes
SessionTicketExpected = No
server = 8-sni-session-ticket-server-extra
client = 8-sni-session-ticket-client-extra
@@ -420,6 +437,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[9-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -427,6 +445,7 @@ VerifyMode = Peer
[test-9]
ExpectedResult = Success
ExpectedServerName = server1
SessionIdExpected = Yes
SessionTicketExpected = No
server = 9-sni-session-ticket-server-extra
client = 9-sni-session-ticket-client-extra
@@ -462,6 +481,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -469,6 +489,7 @@ VerifyMode = Peer
[test-10]
ExpectedResult = Success
ExpectedServerName = server2
SessionIdExpected = Yes
SessionTicketExpected = No
server = 10-sni-session-ticket-server-extra
client = 10-sni-session-ticket-client-extra
@@ -504,6 +525,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -511,6 +533,7 @@ VerifyMode = Peer
[test-11]
ExpectedResult = Success
ExpectedServerName = server1
SessionIdExpected = Yes
SessionTicketExpected = No
server = 11-sni-session-ticket-server-extra
client = 11-sni-session-ticket-client-extra
@@ -546,6 +569,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -553,6 +577,7 @@ VerifyMode = Peer
[test-12]
ExpectedResult = Success
ExpectedServerName = server2
SessionIdExpected = Yes
SessionTicketExpected = No
server = 12-sni-session-ticket-server-extra
client = 12-sni-session-ticket-client-extra
@@ -588,6 +613,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -595,6 +621,7 @@ VerifyMode = Peer
[test-13]
ExpectedResult = Success
ExpectedServerName = server1
SessionIdExpected = Yes
SessionTicketExpected = No
server = 13-sni-session-ticket-server-extra
client = 13-sni-session-ticket-client-extra
@@ -630,6 +657,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -637,6 +665,7 @@ VerifyMode = Peer
[test-14]
ExpectedResult = Success
ExpectedServerName = server2
SessionIdExpected = Yes
SessionTicketExpected = No
server = 14-sni-session-ticket-server-extra
client = 14-sni-session-ticket-client-extra
@@ -672,6 +701,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -679,6 +709,7 @@ VerifyMode = Peer
[test-15]
ExpectedResult = Success
ExpectedServerName = server1
SessionIdExpected = Yes
SessionTicketExpected = No
server = 15-sni-session-ticket-server-extra
client = 15-sni-session-ticket-client-extra
@@ -714,6 +745,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[16-sni-session-ticket-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = -SessionTicket
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -721,6 +753,7 @@ VerifyMode = Peer
[test-16]
ExpectedResult = Success
ExpectedServerName = server2
SessionIdExpected = Yes
SessionTicketExpected = No
server = 16-sni-session-ticket-server-extra
client = 16-sni-session-ticket-client-extra
test/ssl-tests/06-sni-ticket.conf.in
+20 -14
View File
@@ -7,7 +7,7 @@
# https://www.openssl.org/source/license.html
## Test Session ticket
## Test SNI/Session tickets
use strict;
use warnings;
@@ -17,12 +17,15 @@ package ssltests;
our @tests = ();
#Note: MaxProtocol is set to TLSv1.2 as session tickets work differently in
#TLSv1.3.
sub generate_tests() {
foreach my $c ("SessionTicket", "-SessionTicket") {
foreach my $s1 ("SessionTicket", "-SessionTicket") {
foreach my $s2 ("SessionTicket", "-SessionTicket") {
foreach my $n ("server1", "server2") {
my $result = expected_result($c, $s1, $s2, $n);
foreach my $s1 ("SessionTicket", "-SessionTicket") {
foreach my $s2 ("SessionTicket", "-SessionTicket") {
foreach my $n ("server1", "server2") {
my $ticket_result = expected_result($c, $s1, $s2, $n);
my $session_id_result = "Yes"; # always, even with a ticket
push @tests, {
"name" => "sni-session-ticket",
"client" => {
@@ -30,6 +33,7 @@ sub generate_tests() {
"extra" => {
"ServerName" => $n,
},
"MaxProtocol" => "TLSv1.2"
},
"server" => {
"Options" => $s1,
@@ -38,13 +42,14 @@ sub generate_tests() {
"ServerNameCallback" => "IgnoreMismatch",
},
},
"server2" => {
"Options" => $s2,
},
"server2" => {
"Options" => $s2,
},
"test" => {
"ExpectedServerName" => $n,
"ExpectedResult" => "Success",
"SessionTicketExpected" => $result,
"SessionIdExpected" => $session_id_result,
"SessionTicketExpected" => $ticket_result,
}
};
}
@@ -72,23 +77,24 @@ sub expected_result {
push @tests, {
"name" => "sni-session-ticket",
"client" => {
"Options" => "SessionTicket",
"MaxProtocol" => "TLSv1.2",
"Options" => "SessionTicket",
"extra" => {
"ServerName" => "server1",
}
},
"server" => {
"Options" => "SessionTicket",
"Options" => "SessionTicket",
"extra" => {
"BrokenSessionTicket" => "Yes",
},
},
"server2" => {
"Options" => "SessionTicket",
"Options" => "SessionTicket",
},
"test" => {
"ExpectedResult" => "Success",
"SessionTicketExpected" => "No",
"ExpectedResult" => "Success",
"SessionTicketExpected" => "No",
}
};
test/ssl-tests/08-npn.conf
+22
View File
@@ -38,6 +38,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-npn-simple-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -69,6 +70,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-npn-client-finds-match-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -100,6 +102,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-npn-client-honours-server-pref-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -131,6 +134,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-npn-client-first-pref-on-mismatch-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -162,6 +166,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[4-npn-no-server-support-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -188,6 +193,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[5-npn-no-client-support-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -220,6 +226,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-npn-with-sni-no-context-switch-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -264,6 +271,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-npn-with-sni-context-switch-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -308,6 +316,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-npn-selected-sni-server-supports-npn-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -351,6 +360,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[9-npn-selected-sni-server-does-not-support-npn-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -384,6 +394,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-alpn-preferred-over-npn-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -423,6 +434,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-sni-npn-preferred-over-alpn-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -464,6 +476,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-npn-simple-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -506,6 +519,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-npn-server-switch-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -546,11 +560,13 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-npn-client-switch-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[14-npn-client-switch-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -596,6 +612,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-npn-client-first-pref-on-mismatch-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -641,6 +658,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[16-npn-no-server-support-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -676,11 +694,13 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[17-npn-no-client-support-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[17-npn-no-client-support-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -721,6 +741,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[18-alpn-preferred-over-npn-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -768,6 +789,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[19-npn-used-if-alpn-not-supported-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
test/ssl-tests/08-npn.conf.in
+28 -5
View File
@@ -7,14 +7,13 @@
# https://www.openssl.org/source/license.html
## Test NPN negotiation
## Test NPN. Note that NPN is only supported up to TLSv1.2
use strict;
use warnings;
package ssltests;
our @tests = (
{
name => "npn-simple",
@@ -27,6 +26,7 @@ our @tests = (
extra => {
"NPNProtocols" => "foo",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedNPNProtocol" => "foo",
@@ -43,6 +43,7 @@ our @tests = (
extra => {
"NPNProtocols" => "foo,bar",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedNPNProtocol" => "bar",
@@ -59,6 +60,7 @@ our @tests = (
extra => {
"NPNProtocols" => "foo,bar",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedNPNProtocol" => "bar",
@@ -75,6 +77,7 @@ our @tests = (
extra => {
"NPNProtocols" => "foo,bar",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedNPNProtocol" => "foo",
@@ -82,11 +85,12 @@ our @tests = (
},
{
name => "npn-no-server-support",
server => { },
server => {},
client => {
extra => {
"NPNProtocols" => "foo",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedNPNProtocol" => undef,
@@ -99,7 +103,9 @@ our @tests = (
"NPNProtocols" => "foo",
},
},
client => { },
client => {
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedNPNProtocol" => undef,
},
@@ -122,6 +128,7 @@ our @tests = (
"NPNProtocols" => "foo,bar",
"ServerName" => "server1",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedServerName" => "server1",
@@ -146,6 +153,7 @@ our @tests = (
"NPNProtocols" => "foo,bar",
"ServerName" => "server2",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedServerName" => "server2",
@@ -169,6 +177,7 @@ our @tests = (
"NPNProtocols" => "foo,bar",
"ServerName" => "server2",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedServerName" => "server2",
@@ -189,6 +198,7 @@ our @tests = (
"NPNProtocols" => "foo,bar",
"ServerName" => "server2",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedServerName" => "server2",
@@ -208,6 +218,7 @@ our @tests = (
"ALPNProtocols" => "foo",
"NPNProtocols" => "bar",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedALPNProtocol" => "foo",
@@ -233,6 +244,7 @@ our @tests = (
"ALPNProtocols" => "foo",
"NPNProtocols" => "bar",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedALPNProtocol" => undef,
@@ -251,6 +263,7 @@ our @tests = (
extra => {
"NPNProtocols" => "foo",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"HandshakeMode" => "Resume",
@@ -274,6 +287,7 @@ our @tests = (
extra => {
"NPNProtocols" => "foo,bar,baz",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"HandshakeMode" => "Resume",
@@ -292,11 +306,13 @@ our @tests = (
extra => {
"NPNProtocols" => "foo,baz",
},
"MaxProtocol" => "TLSv1.2"
},
resume_client => {
extra => {
"NPNProtocols" => "bar,baz",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"HandshakeMode" => "Resume",
@@ -320,6 +336,7 @@ our @tests = (
extra => {
"NPNProtocols" => "foo,bar",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"HandshakeMode" => "Resume",
@@ -339,6 +356,7 @@ our @tests = (
extra => {
"NPNProtocols" => "foo",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"HandshakeMode" => "Resume",
@@ -357,8 +375,11 @@ our @tests = (
extra => {
"NPNProtocols" => "foo",
},
"MaxProtocol" => "TLSv1.2"
},
resume_client => {
"MaxProtocol" => "TLSv1.2"
},
resume_client => { },
test => {
"HandshakeMode" => "Resume",
"ResumptionExpected" => "Yes",
@@ -383,6 +404,7 @@ our @tests = (
"ALPNProtocols" => "foo",
"NPNProtocols" => "bar,baz",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"HandshakeMode" => "Resume",
@@ -409,6 +431,7 @@ our @tests = (
"ALPNProtocols" => "foo",
"NPNProtocols" => "bar,baz",
},
"MaxProtocol" => "TLSv1.2"
},
test => {
"HandshakeMode" => "Resume",
test/ssl-tests/09-alpn.conf.in
+3 -2
View File
@@ -7,7 +7,7 @@
# https://www.openssl.org/source/license.html
## Test ALPN negotiation
## Test version negotiation
use strict;
use warnings;
@@ -314,7 +314,8 @@ our @tests = (
"ALPNProtocols" => "foo",
},
},
resume_client => { },
resume_client => {
},
test => {
"HandshakeMode" => "Resume",
"ResumptionExpected" => "Yes",
test/ssl-tests/10-resumption.conf
+1288 -217
View File
@@ -1,6 +1,6 @@
# Generated with generate_ssl_tests.pl
num_tests = 36
num_tests = 65
test-0 = 0-resumption
test-1 = 1-resumption
@@ -38,6 +38,35 @@ test-32 = 32-resumption
test-33 = 33-resumption
test-34 = 34-resumption
test-35 = 35-resumption
test-36 = 36-resumption
test-37 = 37-resumption
test-38 = 38-resumption
test-39 = 39-resumption
test-40 = 40-resumption
test-41 = 41-resumption
test-42 = 42-resumption
test-43 = 43-resumption
test-44 = 44-resumption
test-45 = 45-resumption
test-46 = 46-resumption
test-47 = 47-resumption
test-48 = 48-resumption
test-49 = 49-resumption
test-50 = 50-resumption
test-51 = 51-resumption
test-52 = 52-resumption
test-53 = 53-resumption
test-54 = 54-resumption
test-55 = 55-resumption
test-56 = 56-resumption
test-57 = 57-resumption
test-58 = 58-resumption
test-59 = 59-resumption
test-60 = 60-resumption
test-61 = 61-resumption
test-62 = 62-resumption
test-63 = 63-resumption
test-64 = 64-resumption-with-hrr
# ===========================================================
[0-resumption]
@@ -268,15 +297,15 @@ resume-client = 6-resumption-client
[6-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
MaxProtocol = TLSv1
MinProtocol = TLSv1
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
MaxProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-resumption-client]
@@ -285,7 +314,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-6]
ExpectedProtocol = TLSv1
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
@@ -304,15 +333,15 @@ resume-client = 7-resumption-client
[7-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
MaxProtocol = TLSv1
MinProtocol = TLSv1
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
MaxProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-resumption-client]
@@ -321,7 +350,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-7]
ExpectedProtocol = TLSv1
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
@@ -348,7 +377,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MaxProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-resumption-client]
@@ -357,9 +386,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-8]
ExpectedProtocol = TLSv1.1
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = Yes
ResumptionExpected = No
# ===========================================================
@@ -384,7 +413,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[9-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MaxProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[9-resumption-client]
@@ -393,9 +422,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-9]
ExpectedProtocol = TLSv1.1
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = Yes
ResumptionExpected = No
# ===========================================================
@@ -420,7 +449,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MaxProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-resumption-client]
@@ -429,9 +458,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-10]
ExpectedProtocol = TLSv1.2
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = No
ResumptionExpected = Yes
# ===========================================================
@@ -456,7 +485,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MaxProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-resumption-client]
@@ -465,9 +494,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-11]
ExpectedProtocol = TLSv1.2
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = No
ResumptionExpected = Yes
# ===========================================================
@@ -484,15 +513,15 @@ resume-client = 12-resumption-client
[12-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-resumption-client]
@@ -501,7 +530,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-12]
ExpectedProtocol = TLSv1
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
@@ -520,15 +549,15 @@ resume-client = 13-resumption-client
[13-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-resumption-client]
@@ -537,7 +566,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-13]
ExpectedProtocol = TLSv1
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
@@ -556,15 +585,15 @@ resume-client = 14-resumption-client
[14-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MaxProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-resumption-client]
@@ -573,7 +602,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-14]
ExpectedProtocol = TLSv1.1
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
@@ -592,15 +621,15 @@ resume-client = 15-resumption-client
[15-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MaxProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-resumption-client]
@@ -609,7 +638,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-15]
ExpectedProtocol = TLSv1.1
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
@@ -636,7 +665,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[16-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MaxProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[16-resumption-client]
@@ -645,9 +674,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-16]
ExpectedProtocol = TLSv1.2
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = Yes
ResumptionExpected = No
# ===========================================================
@@ -672,7 +701,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[17-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MaxProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[17-resumption-client]
@@ -681,9 +710,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-17]
ExpectedProtocol = TLSv1.2
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = Yes
ResumptionExpected = No
# ===========================================================
@@ -694,32 +723,32 @@ ssl_conf = 18-resumption-ssl
[18-resumption-ssl]
server = 18-resumption-server
client = 18-resumption-client
resume-server = 18-resumption-server
resume-client = 18-resumption-resume-client
resume-server = 18-resumption-resume-server
resume-client = 18-resumption-client
[18-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[18-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[18-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[18-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-18]
ExpectedProtocol = TLSv1
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = Yes
ResumptionExpected = No
# ===========================================================
@@ -730,32 +759,32 @@ ssl_conf = 19-resumption-ssl
[19-resumption-ssl]
server = 19-resumption-server
client = 19-resumption-client
resume-server = 19-resumption-server
resume-client = 19-resumption-resume-client
resume-server = 19-resumption-resume-server
resume-client = 19-resumption-client
[19-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[19-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[19-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[19-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-19]
ExpectedProtocol = TLSv1
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = Yes
ResumptionExpected = No
# ===========================================================
@@ -766,32 +795,32 @@ ssl_conf = 20-resumption-ssl
[20-resumption-ssl]
server = 20-resumption-server
client = 20-resumption-client
resume-server = 20-resumption-server
resume-client = 20-resumption-resume-client
resume-server = 20-resumption-resume-server
resume-client = 20-resumption-client
[20-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[20-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[20-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[20-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-20]
ExpectedProtocol = TLSv1.1
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
ResumptionExpected = Yes
# ===========================================================
@@ -802,32 +831,32 @@ ssl_conf = 21-resumption-ssl
[21-resumption-ssl]
server = 21-resumption-server
client = 21-resumption-client
resume-server = 21-resumption-server
resume-client = 21-resumption-resume-client
resume-server = 21-resumption-resume-server
resume-client = 21-resumption-client
[21-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[21-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[21-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[21-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-21]
ExpectedProtocol = TLSv1.1
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
ResumptionExpected = Yes
# ===========================================================
@@ -838,30 +867,30 @@ ssl_conf = 22-resumption-ssl
[22-resumption-ssl]
server = 22-resumption-server
client = 22-resumption-client
resume-server = 22-resumption-server
resume-client = 22-resumption-resume-client
resume-server = 22-resumption-resume-server
resume-client = 22-resumption-client
[22-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[22-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[22-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[22-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-22]
ExpectedProtocol = TLSv1.2
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
@@ -874,30 +903,30 @@ ssl_conf = 23-resumption-ssl
[23-resumption-ssl]
server = 23-resumption-server
client = 23-resumption-client
resume-server = 23-resumption-server
resume-client = 23-resumption-resume-client
resume-server = 23-resumption-resume-server
resume-client = 23-resumption-client
[23-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[23-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[23-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[23-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-23]
ExpectedProtocol = TLSv1.2
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
@@ -910,25 +939,25 @@ ssl_conf = 24-resumption-ssl
[24-resumption-ssl]
server = 24-resumption-server
client = 24-resumption-client
resume-server = 24-resumption-server
resume-client = 24-resumption-resume-client
resume-server = 24-resumption-resume-server
resume-client = 24-resumption-client
[24-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[24-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[24-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[24-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -946,25 +975,25 @@ ssl_conf = 25-resumption-ssl
[25-resumption-ssl]
server = 25-resumption-server
client = 25-resumption-client
resume-server = 25-resumption-server
resume-client = 25-resumption-resume-client
resume-server = 25-resumption-resume-server
resume-client = 25-resumption-client
[25-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[25-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[25-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[25-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -982,32 +1011,32 @@ ssl_conf = 26-resumption-ssl
[26-resumption-ssl]
server = 26-resumption-server
client = 26-resumption-client
resume-server = 26-resumption-server
resume-client = 26-resumption-resume-client
resume-server = 26-resumption-resume-server
resume-client = 26-resumption-client
[26-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[26-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[26-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[26-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-26]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = Yes
ResumptionExpected = No
# ===========================================================
@@ -1018,32 +1047,32 @@ ssl_conf = 27-resumption-ssl
[27-resumption-ssl]
server = 27-resumption-server
client = 27-resumption-client
resume-server = 27-resumption-server
resume-client = 27-resumption-resume-client
resume-server = 27-resumption-resume-server
resume-client = 27-resumption-client
[27-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[27-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[27-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[27-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-27]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = Yes
ResumptionExpected = No
# ===========================================================
@@ -1054,25 +1083,25 @@ ssl_conf = 28-resumption-ssl
[28-resumption-ssl]
server = 28-resumption-server
client = 28-resumption-client
resume-server = 28-resumption-server
resume-client = 28-resumption-resume-client
resume-server = 28-resumption-resume-server
resume-client = 28-resumption-client
[28-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[28-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[28-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[28-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -1090,25 +1119,25 @@ ssl_conf = 29-resumption-ssl
[29-resumption-ssl]
server = 29-resumption-server
client = 29-resumption-client
resume-server = 29-resumption-server
resume-client = 29-resumption-resume-client
resume-server = 29-resumption-resume-server
resume-client = 29-resumption-client
[29-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[29-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[29-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[29-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -1126,32 +1155,32 @@ ssl_conf = 30-resumption-ssl
[30-resumption-ssl]
server = 30-resumption-server
client = 30-resumption-client
resume-server = 30-resumption-server
resume-client = 30-resumption-resume-client
resume-server = 30-resumption-resume-server
resume-client = 30-resumption-client
[30-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[30-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[30-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[30-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-30]
ExpectedProtocol = TLSv1
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
ResumptionExpected = Yes
# ===========================================================
@@ -1162,32 +1191,32 @@ ssl_conf = 31-resumption-ssl
[31-resumption-ssl]
server = 31-resumption-server
client = 31-resumption-client
resume-server = 31-resumption-server
resume-client = 31-resumption-resume-client
resume-server = 31-resumption-resume-server
resume-client = 31-resumption-client
[31-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[31-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[31-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[31-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-31]
ExpectedProtocol = TLSv1
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
ResumptionExpected = Yes
# ===========================================================
@@ -1209,21 +1238,21 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[32-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[32-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-32]
ExpectedProtocol = TLSv1.1
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
ResumptionExpected = Yes
# ===========================================================
@@ -1245,21 +1274,21 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[33-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[33-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-33]
ExpectedProtocol = TLSv1.1
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
ResumptionExpected = Yes
# ===========================================================
@@ -1281,21 +1310,21 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[34-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[34-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-34]
ExpectedProtocol = TLSv1.2
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = Yes
ResumptionExpected = No
# ===========================================================
@@ -1317,20 +1346,1062 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[35-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[35-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-35]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[36-resumption]
ssl_conf = 36-resumption-ssl
[36-resumption-ssl]
server = 36-resumption-server
client = 36-resumption-client
resume-server = 36-resumption-server
resume-client = 36-resumption-resume-client
[36-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[36-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[36-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-36]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[37-resumption]
ssl_conf = 37-resumption-ssl
[37-resumption-ssl]
server = 37-resumption-server
client = 37-resumption-client
resume-server = 37-resumption-server
resume-client = 37-resumption-resume-client
[37-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[37-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[37-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-37]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[38-resumption]
ssl_conf = 38-resumption-ssl
[38-resumption-ssl]
server = 38-resumption-server
client = 38-resumption-client
resume-server = 38-resumption-server
resume-client = 38-resumption-resume-client
[38-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[38-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[38-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-38]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[39-resumption]
ssl_conf = 39-resumption-ssl
[39-resumption-ssl]
server = 39-resumption-server
client = 39-resumption-client
resume-server = 39-resumption-server
resume-client = 39-resumption-resume-client
[39-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[39-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[39-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-39]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[40-resumption]
ssl_conf = 40-resumption-ssl
[40-resumption-ssl]
server = 40-resumption-server
client = 40-resumption-client
resume-server = 40-resumption-server
resume-client = 40-resumption-resume-client
[40-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[40-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[40-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-40]
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[41-resumption]
ssl_conf = 41-resumption-ssl
[41-resumption-ssl]
server = 41-resumption-server
client = 41-resumption-client
resume-server = 41-resumption-server
resume-client = 41-resumption-resume-client
[41-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[41-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[41-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-41]
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[42-resumption]
ssl_conf = 42-resumption-ssl
[42-resumption-ssl]
server = 42-resumption-server
client = 42-resumption-client
resume-server = 42-resumption-server
resume-client = 42-resumption-resume-client
[42-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[42-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[42-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-42]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = Yes
# ===========================================================
[43-resumption]
ssl_conf = 43-resumption-ssl
[43-resumption-ssl]
server = 43-resumption-server
client = 43-resumption-client
resume-server = 43-resumption-server
resume-client = 43-resumption-resume-client
[43-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[43-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[43-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-43]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = Yes
# ===========================================================
[44-resumption]
ssl_conf = 44-resumption-ssl
[44-resumption-ssl]
server = 44-resumption-server
client = 44-resumption-client
resume-server = 44-resumption-server
resume-client = 44-resumption-resume-client
[44-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[44-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[44-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-44]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[45-resumption]
ssl_conf = 45-resumption-ssl
[45-resumption-ssl]
server = 45-resumption-server
client = 45-resumption-client
resume-server = 45-resumption-server
resume-client = 45-resumption-resume-client
[45-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[45-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[45-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-45]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[46-resumption]
ssl_conf = 46-resumption-ssl
[46-resumption-ssl]
server = 46-resumption-server
client = 46-resumption-client
resume-server = 46-resumption-server
resume-client = 46-resumption-resume-client
[46-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[46-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[46-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-46]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[47-resumption]
ssl_conf = 47-resumption-ssl
[47-resumption-ssl]
server = 47-resumption-server
client = 47-resumption-client
resume-server = 47-resumption-server
resume-client = 47-resumption-resume-client
[47-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[47-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[47-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-47]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[48-resumption]
ssl_conf = 48-resumption-ssl
[48-resumption-ssl]
server = 48-resumption-server
client = 48-resumption-client
resume-server = 48-resumption-server
resume-client = 48-resumption-resume-client
[48-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[48-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[48-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-48]
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[49-resumption]
ssl_conf = 49-resumption-ssl
[49-resumption-ssl]
server = 49-resumption-server
client = 49-resumption-client
resume-server = 49-resumption-server
resume-client = 49-resumption-resume-client
[49-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[49-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[49-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-49]
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[50-resumption]
ssl_conf = 50-resumption-ssl
[50-resumption-ssl]
server = 50-resumption-server
client = 50-resumption-client
resume-server = 50-resumption-server
resume-client = 50-resumption-resume-client
[50-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[50-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[50-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-50]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[51-resumption]
ssl_conf = 51-resumption-ssl
[51-resumption-ssl]
server = 51-resumption-server
client = 51-resumption-client
resume-server = 51-resumption-server
resume-client = 51-resumption-resume-client
[51-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[51-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[51-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-51]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[52-resumption]
ssl_conf = 52-resumption-ssl
[52-resumption-ssl]
server = 52-resumption-server
client = 52-resumption-client
resume-server = 52-resumption-server
resume-client = 52-resumption-resume-client
[52-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[52-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[52-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-52]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = Yes
# ===========================================================
[53-resumption]
ssl_conf = 53-resumption-ssl
[53-resumption-ssl]
server = 53-resumption-server
client = 53-resumption-client
resume-server = 53-resumption-server
resume-client = 53-resumption-resume-client
[53-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[53-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[53-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-53]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = Yes
# ===========================================================
[54-resumption]
ssl_conf = 54-resumption-ssl
[54-resumption-ssl]
server = 54-resumption-server
client = 54-resumption-client
resume-server = 54-resumption-server
resume-client = 54-resumption-resume-client
[54-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[54-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[54-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-54]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[55-resumption]
ssl_conf = 55-resumption-ssl
[55-resumption-ssl]
server = 55-resumption-server
client = 55-resumption-client
resume-server = 55-resumption-server
resume-client = 55-resumption-resume-client
[55-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[55-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[55-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-55]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[56-resumption]
ssl_conf = 56-resumption-ssl
[56-resumption-ssl]
server = 56-resumption-server
client = 56-resumption-client
resume-server = 56-resumption-server
resume-client = 56-resumption-resume-client
[56-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[56-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[56-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-56]
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[57-resumption]
ssl_conf = 57-resumption-ssl
[57-resumption-ssl]
server = 57-resumption-server
client = 57-resumption-client
resume-server = 57-resumption-server
resume-client = 57-resumption-resume-client
[57-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[57-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[57-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-57]
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[58-resumption]
ssl_conf = 58-resumption-ssl
[58-resumption-ssl]
server = 58-resumption-server
client = 58-resumption-client
resume-server = 58-resumption-server
resume-client = 58-resumption-resume-client
[58-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[58-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[58-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-58]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[59-resumption]
ssl_conf = 59-resumption-ssl
[59-resumption-ssl]
server = 59-resumption-server
client = 59-resumption-client
resume-server = 59-resumption-server
resume-client = 59-resumption-resume-client
[59-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[59-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[59-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-59]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[60-resumption]
ssl_conf = 60-resumption-ssl
[60-resumption-ssl]
server = 60-resumption-server
client = 60-resumption-client
resume-server = 60-resumption-server
resume-client = 60-resumption-resume-client
[60-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[60-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[60-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-60]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[61-resumption]
ssl_conf = 61-resumption-ssl
[61-resumption-ssl]
server = 61-resumption-server
client = 61-resumption-client
resume-server = 61-resumption-server
resume-client = 61-resumption-resume-client
[61-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[61-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[61-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-61]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[62-resumption]
ssl_conf = 62-resumption-ssl
[62-resumption-ssl]
server = 62-resumption-server
client = 62-resumption-client
resume-server = 62-resumption-server
resume-client = 62-resumption-resume-client
[62-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[62-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[62-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-62]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = Yes
# ===========================================================
[63-resumption]
ssl_conf = 63-resumption-ssl
[63-resumption-ssl]
server = 63-resumption-server
client = 63-resumption-client
resume-server = 63-resumption-server
resume-client = 63-resumption-resume-client
[63-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[63-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[63-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-63]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = Yes
# ===========================================================
[64-resumption-with-hrr]
ssl_conf = 64-resumption-with-hrr-ssl
[64-resumption-with-hrr-ssl]
server = 64-resumption-with-hrr-server
client = 64-resumption-with-hrr-client
resume-server = 64-resumption-with-hrr-server
resume-client = 64-resumption-with-hrr-resume-client
[64-resumption-with-hrr-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = P-256
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[64-resumption-with-hrr-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[64-resumption-with-hrr-resume-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-64]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
Method = TLS
ResumptionExpected = Yes
test/ssl-tests/12-ct.conf.in
+1 -1
View File
@@ -7,7 +7,7 @@
# https://www.openssl.org/source/license.html
## Test CT support
## Test version negotiation
use strict;
use warnings;
test/ssl-tests/13-fragmentation.conf
+181 -1
View File
@@ -1,6 +1,6 @@
# Generated with generate_ssl_tests.pl
num_tests = 16
num_tests = 22
test-0 = 0-one-fragment-minus-app-data
test-1 = 1-one-fragment-app-data
@@ -18,6 +18,12 @@ test-12 = 12-large-app-data-aes-sha1-multibuffer-odd-fragment
test-13 = 13-large-app-data-aes-sha2-multibuffer-odd-fragment
test-14 = 14-small-app-data-aes-sha1-multibuffer
test-15 = 15-small-app-data-aes-sha2-multibuffer
test-16 = 16-Maximum Fragment Len extension set to 1024 w. FragmentSize disabled
test-17 = 17-Maximum Fragment Len extension equal FragmentSize to 2048
test-18 = 18-Maximum Fragment Len extension 512 lower than FragmentSize 1024
test-19 = 19-Maximum Fragment Len extension 1024 lower than FragmentSize 1024
test-20 = 20-Maximum Fragment Len extension 4096 greater than FragmentSize 2048
test-21 = 21-Maximum Fragment Len extension 2048 greater than FragmentSize 1024
# ===========================================================
[0-one-fragment-minus-app-data]
@@ -267,6 +273,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-large-app-data-aes-sha1-multibuffer-client]
CipherString = AES128-SHA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -291,6 +298,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-large-app-data-aes-sha2-multibuffer-client]
CipherString = AES128-SHA256
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -315,6 +323,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-large-app-data-aes-sha1-multibuffer-odd-fragment-client]
CipherString = AES128-SHA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -339,6 +348,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-large-app-data-aes-sha2-multibuffer-odd-fragment-client]
CipherString = AES128-SHA256
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -363,6 +373,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-small-app-data-aes-sha1-multibuffer-client]
CipherString = AES128-SHA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -387,6 +398,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-small-app-data-aes-sha2-multibuffer-client]
CipherString = AES128-SHA256
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -395,3 +407,171 @@ ApplicationData = 4096
MaxFragmentSize = 4096
# ===========================================================
[16-Maximum Fragment Len extension set to 1024 w. FragmentSize disabled]
ssl_conf = 16-Maximum Fragment Len extension set to 1024 w. FragmentSize disabled-ssl
[16-Maximum Fragment Len extension set to 1024 w. FragmentSize disabled-ssl]
server = 16-Maximum Fragment Len extension set to 1024 w. FragmentSize disabled-server
client = 16-Maximum Fragment Len extension set to 1024 w. FragmentSize disabled-client
[16-Maximum Fragment Len extension set to 1024 w. FragmentSize disabled-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[16-Maximum Fragment Len extension set to 1024 w. FragmentSize disabled-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-16]
ApplicationData = 3072
MaxFragmentSize = 16384
client = 16-Maximum Fragment Len extension set to 1024 w. FragmentSize disabled-client-extra
[16-Maximum Fragment Len extension set to 1024 w. FragmentSize disabled-client-extra]
MaxFragmentLenExt = 1024
# ===========================================================
[17-Maximum Fragment Len extension equal FragmentSize to 2048]
ssl_conf = 17-Maximum Fragment Len extension equal FragmentSize to 2048-ssl
[17-Maximum Fragment Len extension equal FragmentSize to 2048-ssl]
server = 17-Maximum Fragment Len extension equal FragmentSize to 2048-server
client = 17-Maximum Fragment Len extension equal FragmentSize to 2048-client
[17-Maximum Fragment Len extension equal FragmentSize to 2048-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[17-Maximum Fragment Len extension equal FragmentSize to 2048-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-17]
ApplicationData = 3072
MaxFragmentSize = 2048
client = 17-Maximum Fragment Len extension equal FragmentSize to 2048-client-extra
[17-Maximum Fragment Len extension equal FragmentSize to 2048-client-extra]
MaxFragmentLenExt = 2048
# ===========================================================
[18-Maximum Fragment Len extension 512 lower than FragmentSize 1024]
ssl_conf = 18-Maximum Fragment Len extension 512 lower than FragmentSize 1024-ssl
[18-Maximum Fragment Len extension 512 lower than FragmentSize 1024-ssl]
server = 18-Maximum Fragment Len extension 512 lower than FragmentSize 1024-server
client = 18-Maximum Fragment Len extension 512 lower than FragmentSize 1024-client
[18-Maximum Fragment Len extension 512 lower than FragmentSize 1024-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[18-Maximum Fragment Len extension 512 lower than FragmentSize 1024-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-18]
ApplicationData = 3072
MaxFragmentSize = 1024
client = 18-Maximum Fragment Len extension 512 lower than FragmentSize 1024-client-extra
[18-Maximum Fragment Len extension 512 lower than FragmentSize 1024-client-extra]
MaxFragmentLenExt = 512
# ===========================================================
[19-Maximum Fragment Len extension 1024 lower than FragmentSize 1024]
ssl_conf = 19-Maximum Fragment Len extension 1024 lower than FragmentSize 1024-ssl
[19-Maximum Fragment Len extension 1024 lower than FragmentSize 1024-ssl]
server = 19-Maximum Fragment Len extension 1024 lower than FragmentSize 1024-server
client = 19-Maximum Fragment Len extension 1024 lower than FragmentSize 1024-client
[19-Maximum Fragment Len extension 1024 lower than FragmentSize 1024-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[19-Maximum Fragment Len extension 1024 lower than FragmentSize 1024-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-19]
ApplicationData = 3072
MaxFragmentSize = 1024
client = 19-Maximum Fragment Len extension 1024 lower than FragmentSize 1024-client-extra
[19-Maximum Fragment Len extension 1024 lower than FragmentSize 1024-client-extra]
MaxFragmentLenExt = 2048
# ===========================================================
[20-Maximum Fragment Len extension 4096 greater than FragmentSize 2048]
ssl_conf = 20-Maximum Fragment Len extension 4096 greater than FragmentSize 2048-ssl
[20-Maximum Fragment Len extension 4096 greater than FragmentSize 2048-ssl]
server = 20-Maximum Fragment Len extension 4096 greater than FragmentSize 2048-server
client = 20-Maximum Fragment Len extension 4096 greater than FragmentSize 2048-client
[20-Maximum Fragment Len extension 4096 greater than FragmentSize 2048-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[20-Maximum Fragment Len extension 4096 greater than FragmentSize 2048-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-20]
ApplicationData = 8196
MaxFragmentSize = 2048
client = 20-Maximum Fragment Len extension 4096 greater than FragmentSize 2048-client-extra
[20-Maximum Fragment Len extension 4096 greater than FragmentSize 2048-client-extra]
MaxFragmentLenExt = 4096
# ===========================================================
[21-Maximum Fragment Len extension 2048 greater than FragmentSize 1024]
ssl_conf = 21-Maximum Fragment Len extension 2048 greater than FragmentSize 1024-ssl
[21-Maximum Fragment Len extension 2048 greater than FragmentSize 1024-ssl]
server = 21-Maximum Fragment Len extension 2048 greater than FragmentSize 1024-server
client = 21-Maximum Fragment Len extension 2048 greater than FragmentSize 1024-client
[21-Maximum Fragment Len extension 2048 greater than FragmentSize 1024-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[21-Maximum Fragment Len extension 2048 greater than FragmentSize 1024-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-21]
ApplicationData = 3072
MaxFragmentSize = 1024
client = 21-Maximum Fragment Len extension 2048 greater than FragmentSize 1024-client-extra
[21-Maximum Fragment Len extension 2048 greater than FragmentSize 1024-client-extra]
MaxFragmentLenExt = 2048
test/ssl-tests/13-fragmentation.conf.in
+89 -2
View File
@@ -1,5 +1,5 @@
# -*- mode: perl; -*-
# Copyright 2016-2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -104,7 +104,7 @@ our @tests = (
# When the buffer / fragment size ratio is sufficiently large,
# multi-buffer code kicks in on some platforms for AES-SHA. The
# exact minimum ratio depends on the platform, and is usually
# around 4. Since the the test buffer is 64kB, a 4kB fragment is
# around 4. Since the test buffer is 64kB, a 4kB fragment is
# easily sufficient.
#
# (We run this test on all platforms though it's only true multibuffer
@@ -114,6 +114,7 @@ our @tests = (
server => { },
client => {
CipherString => "AES128-SHA",
MaxProtocol => "TLSv1.2"
},
test => {
ApplicationData => 1024 * 1024,
@@ -125,6 +126,7 @@ our @tests = (
server => { },
client => {
CipherString => "AES128-SHA256",
MaxProtocol => "TLSv1.2"
},
test => {
ApplicationData => 1024 * 1024,
@@ -136,6 +138,7 @@ our @tests = (
server => { },
client => {
CipherString => "AES128-SHA",
MaxProtocol => "TLSv1.2"
},
test => {
ApplicationData => 1024 * 1024 + 3,
@@ -147,6 +150,7 @@ our @tests = (
server => { },
client => {
CipherString => "AES128-SHA256",
MaxProtocol => "TLSv1.2"
},
test => {
ApplicationData => 1024 * 1024 - 3,
@@ -161,6 +165,7 @@ our @tests = (
server => { },
client => {
CipherString => "AES128-SHA",
MaxProtocol => "TLSv1.2"
},
test => {
ApplicationData => 4 * 1024,
@@ -172,10 +177,92 @@ our @tests = (
server => { },
client => {
CipherString => "AES128-SHA256",
MaxProtocol => "TLSv1.2"
},
test => {
ApplicationData => 4 * 1024,
MaxFragmentSize => 4 * 1024,
}
},
############################################
# Default (Max) Fragment Size is 512.
# Default Application data size is 256.
{
name => "Maximum Fragment Len extension set to 1024 w. FragmentSize disabled",
server => { },
client => {
extra => {
MaxFragmentLenExt => 1024,
},
},
test => {
ApplicationData => 3072,
MaxFragmentSize => 16384,
}
},
{
name => "Maximum Fragment Len extension equal FragmentSize to 2048",
server => { },
client => {
extra => {
MaxFragmentLenExt => 2048,
},
},
test => {
ApplicationData => 3072,
MaxFragmentSize => 2048,
}
},
{
name => "Maximum Fragment Len extension 512 lower than FragmentSize 1024",
server => { },
client => {
extra => {
MaxFragmentLenExt => 512,
},
},
test => {
ApplicationData => 3072,
MaxFragmentSize => 1024,
}
},
{
name => "Maximum Fragment Len extension 1024 lower than FragmentSize 1024",
server => { },
client => {
extra => {
MaxFragmentLenExt => 2048,
},
},
test => {
ApplicationData => 3072,
MaxFragmentSize => 1024,
}
},
{
name => "Maximum Fragment Len extension 4096 greater than FragmentSize 2048",
server => { },
client => {
extra => {
MaxFragmentLenExt => 4096,
},
},
test => {
ApplicationData => 8196,
MaxFragmentSize => 2048,
}
},
{
name => "Maximum Fragment Len extension 2048 greater than FragmentSize 1024",
server => { },
client => {
extra => {
MaxFragmentLenExt => 2048,
},
},
test => {
ApplicationData => 3072,
MaxFragmentSize => 1024,
}
},
);
test/ssl-tests/14-curves.conf
+58
View File
@@ -44,11 +44,13 @@ client = 0-curve-sect163k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect163k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-curve-sect163k1-client]
CipherString = ECDHE
Curves = sect163k1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -70,11 +72,13 @@ client = 1-curve-sect163r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect163r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-curve-sect163r1-client]
CipherString = ECDHE
Curves = sect163r1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -96,11 +100,13 @@ client = 2-curve-sect163r2-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect163r2
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-curve-sect163r2-client]
CipherString = ECDHE
Curves = sect163r2
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -122,11 +128,13 @@ client = 3-curve-sect193r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect193r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-curve-sect193r1-client]
CipherString = ECDHE
Curves = sect193r1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -148,11 +156,13 @@ client = 4-curve-sect193r2-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect193r2
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[4-curve-sect193r2-client]
CipherString = ECDHE
Curves = sect193r2
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -174,11 +184,13 @@ client = 5-curve-sect233k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect233k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[5-curve-sect233k1-client]
CipherString = ECDHE
Curves = sect233k1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -200,11 +212,13 @@ client = 6-curve-sect233r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect233r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-curve-sect233r1-client]
CipherString = ECDHE
Curves = sect233r1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -226,11 +240,13 @@ client = 7-curve-sect239k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect239k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-curve-sect239k1-client]
CipherString = ECDHE
Curves = sect239k1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -252,11 +268,13 @@ client = 8-curve-sect283k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect283k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-curve-sect283k1-client]
CipherString = ECDHE
Curves = sect283k1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -278,11 +296,13 @@ client = 9-curve-sect283r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect283r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[9-curve-sect283r1-client]
CipherString = ECDHE
Curves = sect283r1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -304,11 +324,13 @@ client = 10-curve-sect409k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect409k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-curve-sect409k1-client]
CipherString = ECDHE
Curves = sect409k1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -330,11 +352,13 @@ client = 11-curve-sect409r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect409r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-curve-sect409r1-client]
CipherString = ECDHE
Curves = sect409r1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -356,11 +380,13 @@ client = 12-curve-sect571k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect571k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-curve-sect571k1-client]
CipherString = ECDHE
Curves = sect571k1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -382,11 +408,13 @@ client = 13-curve-sect571r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = sect571r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-curve-sect571r1-client]
CipherString = ECDHE
Curves = sect571r1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -408,11 +436,13 @@ client = 14-curve-secp160k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = secp160k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-curve-secp160k1-client]
CipherString = ECDHE
Curves = secp160k1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -434,11 +464,13 @@ client = 15-curve-secp160r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = secp160r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-curve-secp160r1-client]
CipherString = ECDHE
Curves = secp160r1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -460,11 +492,13 @@ client = 16-curve-secp160r2-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = secp160r2
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[16-curve-secp160r2-client]
CipherString = ECDHE
Curves = secp160r2
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -486,11 +520,13 @@ client = 17-curve-secp192k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = secp192k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[17-curve-secp192k1-client]
CipherString = ECDHE
Curves = secp192k1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -512,11 +548,13 @@ client = 18-curve-prime192v1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = prime192v1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[18-curve-prime192v1-client]
CipherString = ECDHE
Curves = prime192v1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -538,11 +576,13 @@ client = 19-curve-secp224k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = secp224k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[19-curve-secp224k1-client]
CipherString = ECDHE
Curves = secp224k1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -564,11 +604,13 @@ client = 20-curve-secp224r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = secp224r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[20-curve-secp224r1-client]
CipherString = ECDHE
Curves = secp224r1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -590,11 +632,13 @@ client = 21-curve-secp256k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = secp256k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[21-curve-secp256k1-client]
CipherString = ECDHE
Curves = secp256k1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -616,11 +660,13 @@ client = 22-curve-prime256v1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = prime256v1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[22-curve-prime256v1-client]
CipherString = ECDHE
Curves = prime256v1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -642,11 +688,13 @@ client = 23-curve-secp384r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = secp384r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[23-curve-secp384r1-client]
CipherString = ECDHE
Curves = secp384r1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -668,11 +716,13 @@ client = 24-curve-secp521r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = secp521r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[24-curve-secp521r1-client]
CipherString = ECDHE
Curves = secp521r1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -694,11 +744,13 @@ client = 25-curve-brainpoolP256r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = brainpoolP256r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[25-curve-brainpoolP256r1-client]
CipherString = ECDHE
Curves = brainpoolP256r1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -720,11 +772,13 @@ client = 26-curve-brainpoolP384r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = brainpoolP384r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[26-curve-brainpoolP384r1-client]
CipherString = ECDHE
Curves = brainpoolP384r1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -746,11 +800,13 @@ client = 27-curve-brainpoolP512r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = brainpoolP512r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[27-curve-brainpoolP512r1-client]
CipherString = ECDHE
Curves = brainpoolP512r1
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -772,11 +828,13 @@ client = 28-curve-X25519-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Curves = X25519
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[28-curve-X25519-client]
CipherString = ECDHE
Curves = X25519
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
test/ssl-tests/14-curves.conf.in
+6 -3
View File
@@ -25,12 +25,15 @@ sub generate_tests() {
foreach (0..$#curves) {
my $curve = $curves[$_];
push @tests, {
name => "curve-${curve}",
name => "curve-${curve}",
server => {
"Curves" => $curve
"Curves" => $curve,
# TODO(TLS1.3): Can we get this to work for TLSv1.3?
"MaxProtocol" => "TLSv1.2"
},
client => {
"CipherString" => "ECDHE",
"CipherString" => "ECDHE",
"MaxProtocol" => "TLSv1.2",
"Curves" => $curve
},
test => {
test/ssl-tests/16-dtls-certstatus.conf.in
+34 -1
View File
@@ -13,7 +13,7 @@ use strict;
use warnings;
package ssltests;
use OpenSSL::Test::Utils;
our @tests = (
{
@@ -41,5 +41,38 @@ our @tests = (
"Method" => "DTLS",
"ExpectedResult" => "ClientFail"
}
}
);
our @tests_sctp = (
{
name => "certstatus-good",
server => {
extra => {
"CertStatus" => "GoodResponse",
},
},
client => {},
test => {
"Method" => "DTLS",
"UseSCTP" => "Yes",
"ExpectedResult" => "Success"
}
},
{
name => "certstatus-bad",
server => {
extra => {
"CertStatus" => "BadResponse",
},
},
client => {},
test => {
"Method" => "DTLS",
"UseSCTP" => "Yes",
"ExpectedResult" => "ClientFail"
}
},
);
push @tests, @tests_sctp unless disabled("sctp") || disabled("sock");
test/ssl-tests/17-renegotiate.conf
+8 -4
View File
@@ -28,6 +28,7 @@ client = 0-renegotiate-client-no-resume-client
[0-renegotiate-client-no-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = NoResumptionOnRenegotiation
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
@@ -55,6 +56,7 @@ client = 1-renegotiate-client-resume-client
[1-renegotiate-client-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-renegotiate-client-resume-client]
@@ -81,6 +83,7 @@ client = 2-renegotiate-server-no-resume-client
[2-renegotiate-server-no-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = NoResumptionOnRenegotiation
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
@@ -108,6 +111,7 @@ client = 3-renegotiate-server-resume-client
[3-renegotiate-server-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-renegotiate-server-resume-client]
@@ -198,12 +202,12 @@ client = 6-renegotiate-aead-to-non-aead-client
[6-renegotiate-aead-to-non-aead-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = NoResumptionOnRenegotiation
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-renegotiate-aead-to-non-aead-client]
CipherString = AES128-GCM-SHA256
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -230,12 +234,12 @@ client = 7-renegotiate-non-aead-to-aead-client
[7-renegotiate-non-aead-to-aead-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = NoResumptionOnRenegotiation
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-renegotiate-non-aead-to-aead-client]
CipherString = AES128-SHA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -262,12 +266,12 @@ client = 8-renegotiate-non-aead-to-non-aead-client
[8-renegotiate-non-aead-to-non-aead-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = NoResumptionOnRenegotiation
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-renegotiate-non-aead-to-non-aead-client]
CipherString = AES128-SHA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -294,12 +298,12 @@ client = 9-renegotiate-aead-to-aead-client
[9-renegotiate-aead-to-aead-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = NoResumptionOnRenegotiation
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[9-renegotiate-aead-to-aead-client]
CipherString = AES128-GCM-SHA256
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
test/ssl-tests/17-renegotiate.conf.in
+15 -9
View File
@@ -1,5 +1,5 @@
# -*- mode: perl; -*-
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2016 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -19,7 +19,8 @@ our @tests = (
{
name => "renegotiate-client-no-resume",
server => {
"Options" => "NoResumptionOnRenegotiation"
"Options" => "NoResumptionOnRenegotiation",
"MaxProtocol" => "TLSv1.2"
},
client => {},
test => {
@@ -31,7 +32,9 @@ our @tests = (
},
{
name => "renegotiate-client-resume",
server => {},
server => {
"MaxProtocol" => "TLSv1.2"
},
client => {},
test => {
"Method" => "TLS",
@@ -43,7 +46,8 @@ our @tests = (
{
name => "renegotiate-server-no-resume",
server => {
"Options" => "NoResumptionOnRenegotiation"
"Options" => "NoResumptionOnRenegotiation",
"MaxProtocol" => "TLSv1.2"
},
client => {},
test => {
@@ -55,7 +59,9 @@ our @tests = (
},
{
name => "renegotiate-server-resume",
server => {},
server => {
"MaxProtocol" => "TLSv1.2"
},
client => {},
test => {
"Method" => "TLS",
@@ -108,10 +114,10 @@ our @tests_tls1_2 = (
name => "renegotiate-aead-to-non-aead",
server => {
"Options" => "NoResumptionOnRenegotiation",
"MaxProtocol" => "TLSv1.2"
},
client => {
"CipherString" => "AES128-GCM-SHA256",
"MaxProtocol" => "TLSv1.2",
extra => {
"RenegotiateCiphers" => "AES128-SHA"
}
@@ -127,10 +133,10 @@ our @tests_tls1_2 = (
name => "renegotiate-non-aead-to-aead",
server => {
"Options" => "NoResumptionOnRenegotiation",
"MaxProtocol" => "TLSv1.2"
},
client => {
"CipherString" => "AES128-SHA",
"MaxProtocol" => "TLSv1.2",
extra => {
"RenegotiateCiphers" => "AES128-GCM-SHA256"
}
@@ -146,10 +152,10 @@ our @tests_tls1_2 = (
name => "renegotiate-non-aead-to-non-aead",
server => {
"Options" => "NoResumptionOnRenegotiation",
"MaxProtocol" => "TLSv1.2"
},
client => {
"CipherString" => "AES128-SHA",
"MaxProtocol" => "TLSv1.2",
extra => {
"RenegotiateCiphers" => "AES256-SHA"
}
@@ -165,10 +171,10 @@ our @tests_tls1_2 = (
name => "renegotiate-aead-to-aead",
server => {
"Options" => "NoResumptionOnRenegotiation",
"MaxProtocol" => "TLSv1.2"
},
client => {
"CipherString" => "AES128-GCM-SHA256",
"MaxProtocol" => "TLSv1.2",
extra => {
"RenegotiateCiphers" => "AES256-GCM-SHA384"
}
test/ssl-tests/18-dtls-renegotiate.conf
+9
View File
@@ -36,6 +36,7 @@ ExpectedResult = Success
HandshakeMode = RenegotiateClient
Method = DTLS
ResumptionExpected = No
UseSCTP = No
# ===========================================================
@@ -62,6 +63,7 @@ ExpectedResult = Success
HandshakeMode = RenegotiateClient
Method = DTLS
ResumptionExpected = Yes
UseSCTP = No
# ===========================================================
@@ -88,6 +90,7 @@ ExpectedResult = Success
HandshakeMode = RenegotiateServer
Method = DTLS
ResumptionExpected = No
UseSCTP = No
# ===========================================================
@@ -118,6 +121,7 @@ ExpectedResult = Success
HandshakeMode = RenegotiateServer
Method = DTLS
ResumptionExpected = No
UseSCTP = No
# ===========================================================
@@ -148,6 +152,7 @@ ExpectedResult = Success
HandshakeMode = RenegotiateServer
Method = DTLS
ResumptionExpected = No
UseSCTP = No
# ===========================================================
@@ -175,6 +180,7 @@ ExpectedResult = Success
HandshakeMode = RenegotiateClient
Method = DTLS
ResumptionExpected = No
UseSCTP = No
client = 5-renegotiate-aead-to-non-aead-client-extra
[5-renegotiate-aead-to-non-aead-client-extra]
@@ -206,6 +212,7 @@ ExpectedResult = Success
HandshakeMode = RenegotiateClient
Method = DTLS
ResumptionExpected = No
UseSCTP = No
client = 6-renegotiate-non-aead-to-aead-client-extra
[6-renegotiate-non-aead-to-aead-client-extra]
@@ -237,6 +244,7 @@ ExpectedResult = Success
HandshakeMode = RenegotiateClient
Method = DTLS
ResumptionExpected = No
UseSCTP = No
client = 7-renegotiate-non-aead-to-non-aead-client-extra
[7-renegotiate-non-aead-to-non-aead-client-extra]
@@ -268,6 +276,7 @@ ExpectedResult = Success
HandshakeMode = RenegotiateClient
Method = DTLS
ResumptionExpected = No
UseSCTP = No
client = 8-renegotiate-aead-to-aead-client-extra
[8-renegotiate-aead-to-aead-client-extra]
test/ssl-tests/18-dtls-renegotiate.conf.in
+173 -155
View File
@@ -15,160 +15,178 @@ use warnings;
package ssltests;
use OpenSSL::Test::Utils;
our @tests = (
{
name => "renegotiate-client-no-resume",
server => {
"Options" => "NoResumptionOnRenegotiation"
},
client => {},
test => {
"Method" => "DTLS",
"HandshakeMode" => "RenegotiateClient",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "renegotiate-client-resume",
server => {},
client => {},
test => {
"Method" => "DTLS",
"HandshakeMode" => "RenegotiateClient",
"ResumptionExpected" => "Yes",
"ExpectedResult" => "Success"
}
},
# Note: Unlike the TLS tests, we will never do resumption with server
# initiated reneg. This is because an OpenSSL DTLS client will always do a full
# handshake (i.e. it doesn't supply a session id) when it receives a
# HelloRequest. This is different to the OpenSSL TLS implementation where an
# OpenSSL client will always try an abbreviated handshake (i.e. it will supply
# the session id). This goes all the way to commit 48ae85b6f when abbreviated
# handshake support was first added. Neither behaviour is wrong, but the
# discrepancy is strange. TODO: Should we harmonise the TLS and DTLS behaviour,
# and if so, what to?
{
name => "renegotiate-server-resume",
server => {},
client => {},
test => {
"Method" => "DTLS",
"HandshakeMode" => "RenegotiateServer",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "renegotiate-client-auth-require",
server => {
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Require",
},
client => {
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"Method" => "DTLS",
"HandshakeMode" => "RenegotiateServer",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "renegotiate-client-auth-once",
server => {
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Once",
},
client => {
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"Method" => "DTLS",
"HandshakeMode" => "RenegotiateServer",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
}
);
our @tests_dtls1_2 = (
{
name => "renegotiate-aead-to-non-aead",
server => {
"Options" => "NoResumptionOnRenegotiation"
},
client => {
"CipherString" => "AES128-GCM-SHA256",
extra => {
"RenegotiateCiphers" => "AES128-SHA"
}
},
test => {
"Method" => "DTLS",
"HandshakeMode" => "RenegotiateClient",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "renegotiate-non-aead-to-aead",
server => {
"Options" => "NoResumptionOnRenegotiation"
},
client => {
"CipherString" => "AES128-SHA",
extra => {
"RenegotiateCiphers" => "AES128-GCM-SHA256"
}
},
test => {
"Method" => "DTLS",
"HandshakeMode" => "RenegotiateClient",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "renegotiate-non-aead-to-non-aead",
server => {
"Options" => "NoResumptionOnRenegotiation"
},
client => {
"CipherString" => "AES128-SHA",
extra => {
"RenegotiateCiphers" => "AES256-SHA"
}
},
test => {
"Method" => "DTLS",
"HandshakeMode" => "RenegotiateClient",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "renegotiate-aead-to-aead",
server => {
"Options" => "NoResumptionOnRenegotiation"
},
client => {
"CipherString" => "AES128-GCM-SHA256",
extra => {
"RenegotiateCiphers" => "AES256-GCM-SHA384"
}
},
test => {
"Method" => "DTLS",
"HandshakeMode" => "RenegotiateClient",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
);
our @tests = ();
foreach my $sctp ("No", "Yes")
{
next if disabled("sctp") && $sctp eq "Yes";
push @tests, @tests_dtls1_2 unless disabled("dtls1_2");
my $suffix = ($sctp eq "No") ? "" : "-sctp";
our @tests_basic = (
{
name => "renegotiate-client-no-resume".$suffix,
server => {
"Options" => "NoResumptionOnRenegotiation"
},
client => {},
test => {
"Method" => "DTLS",
"UseSCTP" => $sctp,
"HandshakeMode" => "RenegotiateClient",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "renegotiate-client-resume".$suffix,
server => {},
client => {},
test => {
"Method" => "DTLS",
"UseSCTP" => $sctp,
"HandshakeMode" => "RenegotiateClient",
"ResumptionExpected" => "Yes",
"ExpectedResult" => "Success"
}
},
# Note: Unlike the TLS tests, we will never do resumption with server
# initiated reneg. This is because an OpenSSL DTLS client will always do a full
# handshake (i.e. it doesn't supply a session id) when it receives a
# HelloRequest. This is different to the OpenSSL TLS implementation where an
# OpenSSL client will always try an abbreviated handshake (i.e. it will supply
# the session id). This goes all the way to commit 48ae85b6f when abbreviated
# handshake support was first added. Neither behaviour is wrong, but the
# discrepancy is strange. TODO: Should we harmonise the TLS and DTLS behaviour,
# and if so, what to?
{
name => "renegotiate-server-resume".$suffix,
server => {},
client => {},
test => {
"Method" => "DTLS",
"UseSCTP" => $sctp,
"HandshakeMode" => "RenegotiateServer",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "renegotiate-client-auth-require".$suffix,
server => {
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Require",
},
client => {
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"Method" => "DTLS",
"UseSCTP" => $sctp,
"HandshakeMode" => "RenegotiateServer",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "renegotiate-client-auth-once".$suffix,
server => {
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Once",
},
client => {
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"Method" => "DTLS",
"UseSCTP" => $sctp,
"HandshakeMode" => "RenegotiateServer",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
}
);
push @tests, @tests_basic;
next if disabled("dtls1_2");
our @tests_dtls1_2 = (
{
name => "renegotiate-aead-to-non-aead".$suffix,
server => {
"Options" => "NoResumptionOnRenegotiation"
},
client => {
"CipherString" => "AES128-GCM-SHA256",
extra => {
"RenegotiateCiphers" => "AES128-SHA"
}
},
test => {
"Method" => "DTLS",
"UseSCTP" => $sctp,
"HandshakeMode" => "RenegotiateClient",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "renegotiate-non-aead-to-aead".$suffix,
server => {
"Options" => "NoResumptionOnRenegotiation"
},
client => {
"CipherString" => "AES128-SHA",
extra => {
"RenegotiateCiphers" => "AES128-GCM-SHA256"
}
},
test => {
"Method" => "DTLS",
"UseSCTP" => $sctp,
"HandshakeMode" => "RenegotiateClient",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "renegotiate-non-aead-to-non-aead".$suffix,
server => {
"Options" => "NoResumptionOnRenegotiation"
},
client => {
"CipherString" => "AES128-SHA",
extra => {
"RenegotiateCiphers" => "AES256-SHA"
}
},
test => {
"Method" => "DTLS",
"UseSCTP" => $sctp,
"HandshakeMode" => "RenegotiateClient",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "renegotiate-aead-to-aead".$suffix,
server => {
"Options" => "NoResumptionOnRenegotiation"
},
client => {
"CipherString" => "AES128-GCM-SHA256",
extra => {
"RenegotiateCiphers" => "AES256-GCM-SHA384"
}
},
test => {
"Method" => "DTLS",
"UseSCTP" => $sctp,
"HandshakeMode" => "RenegotiateClient",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
);
push @tests, @tests_dtls1_2;
}
test/ssl-tests/19-mac-then-encrypt.conf
+6
View File
@@ -25,6 +25,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-disable-encrypt-then-mac-server-sha-client]
CipherString = AES128-SHA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -48,6 +49,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-disable-encrypt-then-mac-client-sha-client]
CipherString = AES128-SHA
MaxProtocol = TLSv1.2
Options = -EncryptThenMac
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -73,6 +75,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-disable-encrypt-then-mac-both-sha-client]
CipherString = AES128-SHA
MaxProtocol = TLSv1.2
Options = -EncryptThenMac
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -98,6 +101,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-disable-encrypt-then-mac-server-sha2-client]
CipherString = AES128-SHA256
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -121,6 +125,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[4-disable-encrypt-then-mac-client-sha2-client]
CipherString = AES128-SHA256
MaxProtocol = TLSv1.2
Options = -EncryptThenMac
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -146,6 +151,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[5-disable-encrypt-then-mac-both-sha2-client]
CipherString = AES128-SHA256
MaxProtocol = TLSv1.2
Options = -EncryptThenMac
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
test/ssl-tests/19-mac-then-encrypt.conf.in
+13
View File
@@ -11,6 +11,8 @@
package ssltests;
use OpenSSL::Test::Utils;
our @tests = (
{
name => "disable-encrypt-then-mac-server-sha",
@@ -19,6 +21,7 @@ our @tests = (
},
client => {
"CipherString" => "AES128-SHA",
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedResult" => "Success",
@@ -31,6 +34,7 @@ our @tests = (
client => {
"CipherString" => "AES128-SHA",
"Options" => "-EncryptThenMac",
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedResult" => "Success",
@@ -44,11 +48,15 @@ our @tests = (
client => {
"CipherString" => "AES128-SHA",
"Options" => "-EncryptThenMac",
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedResult" => "Success",
},
},
);
my @tests_tls1_2 = (
{
name => "disable-encrypt-then-mac-server-sha2",
server => {
@@ -56,6 +64,7 @@ our @tests = (
},
client => {
"CipherString" => "AES128-SHA256",
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedResult" => "Success",
@@ -68,6 +77,7 @@ our @tests = (
client => {
"CipherString" => "AES128-SHA256",
"Options" => "-EncryptThenMac",
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedResult" => "Success",
@@ -81,9 +91,12 @@ our @tests = (
client => {
"CipherString" => "AES128-SHA256",
"Options" => "-EncryptThenMac",
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedResult" => "Success",
},
},
);
push @tests, @tests_tls1_2 unless disabled("tls1_2");
test/ssl-tests/20-cert-select.conf
+1249
View File
@@ -0,0 +1,1249 @@
# Generated with generate_ssl_tests.pl
num_tests = 39
test-0 = 0-ECDSA CipherString Selection
test-1 = 1-Ed25519 CipherString and Signature Algorithm Selection
test-2 = 2-RSA CipherString Selection
test-3 = 3-RSA-PSS Certificate CipherString Selection
test-4 = 4-P-256 CipherString and Signature Algorithm Selection
test-5 = 5-Ed25519 CipherString and Curves Selection
test-6 = 6-ECDSA CipherString Selection, no ECDSA certificate
test-7 = 7-ECDSA Signature Algorithm Selection
test-8 = 8-ECDSA Signature Algorithm Selection SHA384
test-9 = 9-ECDSA Signature Algorithm Selection SHA1
test-10 = 10-ECDSA Signature Algorithm Selection compressed point
test-11 = 11-ECDSA Signature Algorithm Selection, no ECDSA certificate
test-12 = 12-RSA Signature Algorithm Selection
test-13 = 13-RSA-PSS Signature Algorithm Selection
test-14 = 14-RSA-PSS Certificate Legacy Signature Algorithm Selection
test-15 = 15-RSA-PSS Certificate Unified Signature Algorithm Selection
test-16 = 16-Only RSA-PSS Certificate
test-17 = 17-RSA-PSS Certificate, no PSS signature algorithms
test-18 = 18-Suite B P-256 Hash Algorithm Selection
test-19 = 19-Suite B P-384 Hash Algorithm Selection
test-20 = 20-TLS 1.2 Ed25519 Client Auth
test-21 = 21-Only RSA-PSS Certificate, TLS v1.1
test-22 = 22-TLS 1.3 ECDSA Signature Algorithm Selection
test-23 = 23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point
test-24 = 24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1
test-25 = 25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS
test-26 = 26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS
test-27 = 27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate
test-28 = 28-TLS 1.3 RSA Signature Algorithm Selection, no PSS
test-29 = 29-TLS 1.3 RSA-PSS Signature Algorithm Selection
test-30 = 30-TLS 1.3 Ed25519 Signature Algorithm Selection
test-31 = 31-TLS 1.3 Ed25519 CipherString and Groups Selection
test-32 = 32-TLS 1.3 RSA Client Auth Signature Algorithm Selection
test-33 = 33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names
test-34 = 34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection
test-35 = 35-TLS 1.3 Ed25519 Client Auth
test-36 = 36-TLS 1.2 DSA Certificate Test
test-37 = 37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms
test-38 = 38-TLS 1.3 DSA Certificate Test
# ===========================================================
[0-ECDSA CipherString Selection]
ssl_conf = 0-ECDSA CipherString Selection-ssl
[0-ECDSA CipherString Selection-ssl]
server = 0-ECDSA CipherString Selection-server
client = 0-ECDSA CipherString Selection-client
[0-ECDSA CipherString Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-ECDSA CipherString Selection-client]
CipherString = aECDSA
MaxProtocol = TLSv1.2
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-0]
ExpectedResult = Success
ExpectedServerCANames = empty
ExpectedServerCertType = P-256
ExpectedServerSignType = EC
# ===========================================================
[1-Ed25519 CipherString and Signature Algorithm Selection]
ssl_conf = 1-Ed25519 CipherString and Signature Algorithm Selection-ssl
[1-Ed25519 CipherString and Signature Algorithm Selection-ssl]
server = 1-Ed25519 CipherString and Signature Algorithm Selection-server
client = 1-Ed25519 CipherString and Signature Algorithm Selection-client
[1-Ed25519 CipherString and Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-Ed25519 CipherString and Signature Algorithm Selection-client]
CipherString = aECDSA
MaxProtocol = TLSv1.2
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
SignatureAlgorithms = ed25519:ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-1]
ExpectedResult = Success
ExpectedServerCANames = empty
ExpectedServerCertType = Ed25519
ExpectedServerSignType = Ed25519
# ===========================================================
[2-RSA CipherString Selection]
ssl_conf = 2-RSA CipherString Selection-ssl
[2-RSA CipherString Selection-ssl]
server = 2-RSA CipherString Selection-server
client = 2-RSA CipherString Selection-client
[2-RSA CipherString Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-RSA CipherString Selection-client]
CipherString = aRSA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-2]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignType = RSA-PSS
# ===========================================================
[3-RSA-PSS Certificate CipherString Selection]
ssl_conf = 3-RSA-PSS Certificate CipherString Selection-ssl
[3-RSA-PSS Certificate CipherString Selection-ssl]
server = 3-RSA-PSS Certificate CipherString Selection-server
client = 3-RSA-PSS Certificate CipherString Selection-client
[3-RSA-PSS Certificate CipherString Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.2
PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-RSA-PSS Certificate CipherString Selection-client]
CipherString = aRSA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-3]
ExpectedResult = Success
ExpectedServerCertType = RSA-PSS
ExpectedServerSignType = RSA-PSS
# ===========================================================
[4-P-256 CipherString and Signature Algorithm Selection]
ssl_conf = 4-P-256 CipherString and Signature Algorithm Selection-ssl
[4-P-256 CipherString and Signature Algorithm Selection-ssl]
server = 4-P-256 CipherString and Signature Algorithm Selection-server
client = 4-P-256 CipherString and Signature Algorithm Selection-client
[4-P-256 CipherString and Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[4-P-256 CipherString and Signature Algorithm Selection-client]
CipherString = aECDSA
MaxProtocol = TLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ed25519
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-4]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
ExpectedServerSignType = EC
# ===========================================================
[5-Ed25519 CipherString and Curves Selection]
ssl_conf = 5-Ed25519 CipherString and Curves Selection-ssl
[5-Ed25519 CipherString and Curves Selection-ssl]
server = 5-Ed25519 CipherString and Curves Selection-server
client = 5-Ed25519 CipherString and Curves Selection-client
[5-Ed25519 CipherString and Curves Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[5-Ed25519 CipherString and Curves Selection-client]
CipherString = aECDSA
Curves = X25519
MaxProtocol = TLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ed25519
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-5]
ExpectedResult = Success
ExpectedServerCertType = Ed25519
ExpectedServerSignType = Ed25519
# ===========================================================
[6-ECDSA CipherString Selection, no ECDSA certificate]
ssl_conf = 6-ECDSA CipherString Selection, no ECDSA certificate-ssl
[6-ECDSA CipherString Selection, no ECDSA certificate-ssl]
server = 6-ECDSA CipherString Selection, no ECDSA certificate-server
client = 6-ECDSA CipherString Selection, no ECDSA certificate-client
[6-ECDSA CipherString Selection, no ECDSA certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-ECDSA CipherString Selection, no ECDSA certificate-client]
CipherString = aECDSA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-6]
ExpectedResult = ServerFail
# ===========================================================
[7-ECDSA Signature Algorithm Selection]
ssl_conf = 7-ECDSA Signature Algorithm Selection-ssl
[7-ECDSA Signature Algorithm Selection-ssl]
server = 7-ECDSA Signature Algorithm Selection-server
client = 7-ECDSA Signature Algorithm Selection-client
[7-ECDSA Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-ECDSA Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-7]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
ExpectedServerSignType = EC
# ===========================================================
[8-ECDSA Signature Algorithm Selection SHA384]
ssl_conf = 8-ECDSA Signature Algorithm Selection SHA384-ssl
[8-ECDSA Signature Algorithm Selection SHA384-ssl]
server = 8-ECDSA Signature Algorithm Selection SHA384-server
client = 8-ECDSA Signature Algorithm Selection SHA384-client
[8-ECDSA Signature Algorithm Selection SHA384-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-ECDSA Signature Algorithm Selection SHA384-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA384
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-8]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA384
ExpectedServerSignType = EC
# ===========================================================
[9-ECDSA Signature Algorithm Selection SHA1]
ssl_conf = 9-ECDSA Signature Algorithm Selection SHA1-ssl
[9-ECDSA Signature Algorithm Selection SHA1-ssl]
server = 9-ECDSA Signature Algorithm Selection SHA1-server
client = 9-ECDSA Signature Algorithm Selection SHA1-client
[9-ECDSA Signature Algorithm Selection SHA1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[9-ECDSA Signature Algorithm Selection SHA1-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-9]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA1
ExpectedServerSignType = EC
# ===========================================================
[10-ECDSA Signature Algorithm Selection compressed point]
ssl_conf = 10-ECDSA Signature Algorithm Selection compressed point-ssl
[10-ECDSA Signature Algorithm Selection compressed point-ssl]
server = 10-ECDSA Signature Algorithm Selection compressed point-server
client = 10-ECDSA Signature Algorithm Selection compressed point-client
[10-ECDSA Signature Algorithm Selection compressed point-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-ECDSA Signature Algorithm Selection compressed point-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-10]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
ExpectedServerSignType = EC
# ===========================================================
[11-ECDSA Signature Algorithm Selection, no ECDSA certificate]
ssl_conf = 11-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
[11-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
server = 11-ECDSA Signature Algorithm Selection, no ECDSA certificate-server
client = 11-ECDSA Signature Algorithm Selection, no ECDSA certificate-client
[11-ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-11]
ExpectedResult = ServerFail
# ===========================================================
[12-RSA Signature Algorithm Selection]
ssl_conf = 12-RSA Signature Algorithm Selection-ssl
[12-RSA Signature Algorithm Selection-ssl]
server = 12-RSA Signature Algorithm Selection-server
client = 12-RSA Signature Algorithm Selection-client
[12-RSA Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-RSA Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-12]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
ExpectedServerSignType = RSA
# ===========================================================
[13-RSA-PSS Signature Algorithm Selection]
ssl_conf = 13-RSA-PSS Signature Algorithm Selection-ssl
[13-RSA-PSS Signature Algorithm Selection-ssl]
server = 13-RSA-PSS Signature Algorithm Selection-server
client = 13-RSA-PSS Signature Algorithm Selection-client
[13-RSA-PSS Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-RSA-PSS Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA-PSS+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-13]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
ExpectedServerSignType = RSA-PSS
# ===========================================================
[14-RSA-PSS Certificate Legacy Signature Algorithm Selection]
ssl_conf = 14-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl
[14-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl]
server = 14-RSA-PSS Certificate Legacy Signature Algorithm Selection-server
client = 14-RSA-PSS Certificate Legacy Signature Algorithm Selection-client
[14-RSA-PSS Certificate Legacy Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.2
PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-RSA-PSS Certificate Legacy Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA-PSS+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-14]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
ExpectedServerSignType = RSA-PSS
# ===========================================================
[15-RSA-PSS Certificate Unified Signature Algorithm Selection]
ssl_conf = 15-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl
[15-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl]
server = 15-RSA-PSS Certificate Unified Signature Algorithm Selection-server
client = 15-RSA-PSS Certificate Unified Signature Algorithm Selection-client
[15-RSA-PSS Certificate Unified Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.2
PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-RSA-PSS Certificate Unified Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = rsa_pss_pss_sha256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-15]
ExpectedResult = Success
ExpectedServerCertType = RSA-PSS
ExpectedServerSignHash = SHA256
ExpectedServerSignType = RSA-PSS
# ===========================================================
[16-Only RSA-PSS Certificate]
ssl_conf = 16-Only RSA-PSS Certificate-ssl
[16-Only RSA-PSS Certificate-ssl]
server = 16-Only RSA-PSS Certificate-server
client = 16-Only RSA-PSS Certificate-client
[16-Only RSA-PSS Certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
[16-Only RSA-PSS Certificate-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-16]
ExpectedResult = Success
ExpectedServerCertType = RSA-PSS
ExpectedServerSignHash = SHA256
ExpectedServerSignType = RSA-PSS
# ===========================================================
[17-RSA-PSS Certificate, no PSS signature algorithms]
ssl_conf = 17-RSA-PSS Certificate, no PSS signature algorithms-ssl
[17-RSA-PSS Certificate, no PSS signature algorithms-ssl]
server = 17-RSA-PSS Certificate, no PSS signature algorithms-server
client = 17-RSA-PSS Certificate, no PSS signature algorithms-client
[17-RSA-PSS Certificate, no PSS signature algorithms-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
[17-RSA-PSS Certificate, no PSS signature algorithms-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-17]
ExpectedResult = ServerFail
# ===========================================================
[18-Suite B P-256 Hash Algorithm Selection]
ssl_conf = 18-Suite B P-256 Hash Algorithm Selection-ssl
[18-Suite B P-256 Hash Algorithm Selection-ssl]
server = 18-Suite B P-256 Hash Algorithm Selection-server
client = 18-Suite B P-256 Hash Algorithm Selection-client
[18-Suite B P-256 Hash Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = SUITEB128
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p256-server-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p256-server-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[18-Suite B P-256 Hash Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA384:ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
VerifyMode = Peer
[test-18]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
ExpectedServerSignType = EC
# ===========================================================
[19-Suite B P-384 Hash Algorithm Selection]
ssl_conf = 19-Suite B P-384 Hash Algorithm Selection-ssl
[19-Suite B P-384 Hash Algorithm Selection-ssl]
server = 19-Suite B P-384 Hash Algorithm Selection-server
client = 19-Suite B P-384 Hash Algorithm Selection-client
[19-Suite B P-384 Hash Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = SUITEB128
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[19-Suite B P-384 Hash Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
VerifyMode = Peer
[test-19]
ExpectedResult = Success
ExpectedServerCertType = P-384
ExpectedServerSignHash = SHA384
ExpectedServerSignType = EC
# ===========================================================
[20-TLS 1.2 Ed25519 Client Auth]
ssl_conf = 20-TLS 1.2 Ed25519 Client Auth-ssl
[20-TLS 1.2 Ed25519 Client Auth-ssl]
server = 20-TLS 1.2 Ed25519 Client Auth-server
client = 20-TLS 1.2 Ed25519 Client Auth-client
[20-TLS 1.2 Ed25519 Client Auth-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[20-TLS 1.2 Ed25519 Client Auth-client]
CipherString = DEFAULT
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-20]
ExpectedClientCertType = Ed25519
ExpectedClientSignType = Ed25519
ExpectedResult = Success
# ===========================================================
[21-Only RSA-PSS Certificate, TLS v1.1]
ssl_conf = 21-Only RSA-PSS Certificate, TLS v1.1-ssl
[21-Only RSA-PSS Certificate, TLS v1.1-ssl]
server = 21-Only RSA-PSS Certificate, TLS v1.1-server
client = 21-Only RSA-PSS Certificate, TLS v1.1-client
[21-Only RSA-PSS Certificate, TLS v1.1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
[21-Only RSA-PSS Certificate, TLS v1.1-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-21]
ExpectedResult = ServerFail
# ===========================================================
[22-TLS 1.3 ECDSA Signature Algorithm Selection]
ssl_conf = 22-TLS 1.3 ECDSA Signature Algorithm Selection-ssl
[22-TLS 1.3 ECDSA Signature Algorithm Selection-ssl]
server = 22-TLS 1.3 ECDSA Signature Algorithm Selection-server
client = 22-TLS 1.3 ECDSA Signature Algorithm Selection-client
[22-TLS 1.3 ECDSA Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[22-TLS 1.3 ECDSA Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-22]
ExpectedResult = Success
ExpectedServerCANames = empty
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
ExpectedServerSignType = EC
# ===========================================================
[23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point]
ssl_conf = 23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl
[23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl]
server = 23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server
client = 23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client
[23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[23-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-23]
ExpectedResult = ServerFail
# ===========================================================
[24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1]
ssl_conf = 24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl
[24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl]
server = 24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server
client = 24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client
[24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[24-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-24]
ExpectedResult = ServerFail
# ===========================================================
[25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS]
ssl_conf = 25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl
[25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl]
server = 25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server
client = 25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client
[25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[25-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client]
CipherString = DEFAULT
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
SignatureAlgorithms = ECDSA+SHA256:RSA-PSS+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-25]
ExpectedResult = Success
ExpectedServerCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
ExpectedServerSignType = EC
# ===========================================================
[26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS]
ssl_conf = 26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl
[26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl]
server = 26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server
client = 26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client
[26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[26-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA384:RSA-PSS+SHA384
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-26]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA384
ExpectedServerSignType = RSA-PSS
# ===========================================================
[27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate]
ssl_conf = 27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
[27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
server = 27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server
client = 27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client
[27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[27-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-27]
ExpectedResult = ServerFail
# ===========================================================
[28-TLS 1.3 RSA Signature Algorithm Selection, no PSS]
ssl_conf = 28-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl
[28-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl]
server = 28-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server
client = 28-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client
[28-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[28-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-28]
ExpectedResult = ServerFail
# ===========================================================
[29-TLS 1.3 RSA-PSS Signature Algorithm Selection]
ssl_conf = 29-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl
[29-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl]
server = 29-TLS 1.3 RSA-PSS Signature Algorithm Selection-server
client = 29-TLS 1.3 RSA-PSS Signature Algorithm Selection-client
[29-TLS 1.3 RSA-PSS Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[29-TLS 1.3 RSA-PSS Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA-PSS+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-29]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
ExpectedServerSignType = RSA-PSS
# ===========================================================
[30-TLS 1.3 Ed25519 Signature Algorithm Selection]
ssl_conf = 30-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl
[30-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl]
server = 30-TLS 1.3 Ed25519 Signature Algorithm Selection-server
client = 30-TLS 1.3 Ed25519 Signature Algorithm Selection-client
[30-TLS 1.3 Ed25519 Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[30-TLS 1.3 Ed25519 Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ed25519
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-30]
ExpectedResult = Success
ExpectedServerCertType = Ed25519
ExpectedServerSignType = Ed25519
# ===========================================================
[31-TLS 1.3 Ed25519 CipherString and Groups Selection]
ssl_conf = 31-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl
[31-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl]
server = 31-TLS 1.3 Ed25519 CipherString and Groups Selection-server
client = 31-TLS 1.3 Ed25519 CipherString and Groups Selection-client
[31-TLS 1.3 Ed25519 CipherString and Groups Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[31-TLS 1.3 Ed25519 CipherString and Groups Selection-client]
CipherString = DEFAULT
Groups = X25519
SignatureAlgorithms = ECDSA+SHA256:ed25519
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-31]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignType = EC
# ===========================================================
[32-TLS 1.3 RSA Client Auth Signature Algorithm Selection]
ssl_conf = 32-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl
[32-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl]
server = 32-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server
client = 32-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client
[32-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = PSS+SHA256
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[32-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client]
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
RSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-32]
ExpectedClientCANames = empty
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
ExpectedClientSignType = RSA-PSS
ExpectedResult = Success
# ===========================================================
[33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names]
ssl_conf = 33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl
[33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl]
server = 33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server
client = 33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client
[33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = PSS+SHA256
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[33-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client]
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
RSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-33]
ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
ExpectedClientSignType = RSA-PSS
ExpectedResult = Success
# ===========================================================
[34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection]
ssl_conf = 34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl
[34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl]
server = 34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server
client = 34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client
[34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = ECDSA+SHA256
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[34-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client]
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
RSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-34]
ExpectedClientCertType = P-256
ExpectedClientSignHash = SHA256
ExpectedClientSignType = EC
ExpectedResult = Success
# ===========================================================
[35-TLS 1.3 Ed25519 Client Auth]
ssl_conf = 35-TLS 1.3 Ed25519 Client Auth-ssl
[35-TLS 1.3 Ed25519 Client Auth-ssl]
server = 35-TLS 1.3 Ed25519 Client Auth-server
client = 35-TLS 1.3 Ed25519 Client Auth-client
[35-TLS 1.3 Ed25519 Client Auth-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[35-TLS 1.3 Ed25519 Client Auth-client]
CipherString = DEFAULT
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-35]
ExpectedClientCertType = Ed25519
ExpectedClientSignType = Ed25519
ExpectedResult = Success
# ===========================================================
[36-TLS 1.2 DSA Certificate Test]
ssl_conf = 36-TLS 1.2 DSA Certificate Test-ssl
[36-TLS 1.2 DSA Certificate Test-ssl]
server = 36-TLS 1.2 DSA Certificate Test-server
client = 36-TLS 1.2 DSA Certificate Test-client
[36-TLS 1.2 DSA Certificate Test-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ALL
DHParameters = ${ENV::TEST_CERTS_DIR}/dhp2048.pem
DSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-dsa-cert.pem
DSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-dsa-key.pem
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[36-TLS 1.2 DSA Certificate Test-client]
CipherString = ALL
SignatureAlgorithms = DSA+SHA256:DSA+SHA1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-36]
ExpectedResult = Success
# ===========================================================
[37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms]
ssl_conf = 37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl
[37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl]
server = 37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server
client = 37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client
[37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = ECDSA+SHA1:DSA+SHA256:RSA+SHA256
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[37-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-37]
ExpectedResult = ServerFail
# ===========================================================
[38-TLS 1.3 DSA Certificate Test]
ssl_conf = 38-TLS 1.3 DSA Certificate Test-ssl
[38-TLS 1.3 DSA Certificate Test-ssl]
server = 38-TLS 1.3 DSA Certificate Test-server
client = 38-TLS 1.3 DSA Certificate Test-client
[38-TLS 1.3 DSA Certificate Test-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ALL
DSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-dsa-cert.pem
DSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-dsa-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[38-TLS 1.3 DSA Certificate Test-client]
CipherString = ALL
SignatureAlgorithms = DSA+SHA1:DSA+SHA256:ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-38]
ExpectedResult = ServerFail
test/ssl-tests/20-cert-select.conf.in
+641
View File
@@ -0,0 +1,641 @@
# -*- mode: perl; -*-
## SSL test configurations
use strict;
use warnings;
package ssltests;
use OpenSSL::Test::Utils;
my $server = {
"ECDSA.Certificate" => test_pem("server-ecdsa-cert.pem"),
"ECDSA.PrivateKey" => test_pem("server-ecdsa-key.pem"),
"EdDSA.Certificate" => test_pem("server-ed25519-cert.pem"),
"EdDSA.PrivateKey" => test_pem("server-ed25519-key.pem"),
"MaxProtocol" => "TLSv1.2"
};
my $server_pss = {
"PSS.Certificate" => test_pem("server-pss-cert.pem"),
"PSS.PrivateKey" => test_pem("server-pss-key.pem"),
"ECDSA.Certificate" => test_pem("server-ecdsa-cert.pem"),
"ECDSA.PrivateKey" => test_pem("server-ecdsa-key.pem"),
"EdDSA.Certificate" => test_pem("server-ed25519-cert.pem"),
"EdDSA.PrivateKey" => test_pem("server-ed25519-key.pem"),
"MaxProtocol" => "TLSv1.2"
};
my $server_pss_only = {
"Certificate" => test_pem("server-pss-cert.pem"),
"PrivateKey" => test_pem("server-pss-key.pem"),
};
our @tests = (
{
name => "ECDSA CipherString Selection",
server => $server,
client => {
"CipherString" => "aECDSA",
"MaxProtocol" => "TLSv1.2",
"RequestCAFile" => test_pem("root-cert.pem"),
},
test => {
"ExpectedServerCertType" =>, "P-256",
"ExpectedServerSignType" =>, "EC",
# Note: certificate_authorities not sent for TLS < 1.3
"ExpectedServerCANames" =>, "empty",
"ExpectedResult" => "Success"
},
},
{
name => "Ed25519 CipherString and Signature Algorithm Selection",
server => $server,
client => {
"CipherString" => "aECDSA",
"MaxProtocol" => "TLSv1.2",
"SignatureAlgorithms" => "ed25519:ECDSA+SHA256",
"RequestCAFile" => test_pem("root-cert.pem"),
},
test => {
"ExpectedServerCertType" =>, "Ed25519",
"ExpectedServerSignType" =>, "Ed25519",
# Note: certificate_authorities not sent for TLS < 1.3
"ExpectedServerCANames" =>, "empty",
"ExpectedResult" => "Success"
},
},
{
name => "RSA CipherString Selection",
server => $server,
client => {
"CipherString" => "aRSA",
"MaxProtocol" => "TLSv1.2",
},
test => {
"ExpectedServerCertType" =>, "RSA",
"ExpectedServerSignType" =>, "RSA-PSS",
"ExpectedResult" => "Success"
},
},
{
name => "RSA-PSS Certificate CipherString Selection",
server => $server_pss,
client => {
"CipherString" => "aRSA",
"MaxProtocol" => "TLSv1.2",
},
test => {
"ExpectedServerCertType" =>, "RSA-PSS",
"ExpectedServerSignType" =>, "RSA-PSS",
"ExpectedResult" => "Success"
},
},
{
name => "P-256 CipherString and Signature Algorithm Selection",
server => $server,
client => {
"CipherString" => "aECDSA",
"MaxProtocol" => "TLSv1.2",
"SignatureAlgorithms" => "ECDSA+SHA256:ed25519",
},
test => {
"ExpectedServerCertType" => "P-256",
"ExpectedServerSignHash" => "SHA256",
"ExpectedServerSignType" => "EC",
"ExpectedResult" => "Success"
},
},
{
name => "Ed25519 CipherString and Curves Selection",
server => $server,
client => {
"CipherString" => "aECDSA",
"MaxProtocol" => "TLSv1.2",
"SignatureAlgorithms" => "ECDSA+SHA256:ed25519",
# Excluding P-256 from the supported curves list means server
# certificate should be Ed25519 and not P-256
"Curves" => "X25519"
},
test => {
"ExpectedServerCertType" =>, "Ed25519",
"ExpectedServerSignType" =>, "Ed25519",
"ExpectedResult" => "Success"
},
},
{
name => "ECDSA CipherString Selection, no ECDSA certificate",
server => {
"MaxProtocol" => "TLSv1.2"
},
client => {
"CipherString" => "aECDSA",
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedResult" => "ServerFail"
},
},
{
name => "ECDSA Signature Algorithm Selection",
server => $server,
client => {
"SignatureAlgorithms" => "ECDSA+SHA256",
},
test => {
"ExpectedServerCertType" => "P-256",
"ExpectedServerSignHash" => "SHA256",
"ExpectedServerSignType" => "EC",
"ExpectedResult" => "Success"
},
},
{
name => "ECDSA Signature Algorithm Selection SHA384",
server => $server,
client => {
"SignatureAlgorithms" => "ECDSA+SHA384",
},
test => {
"ExpectedServerCertType" => "P-256",
"ExpectedServerSignHash" => "SHA384",
"ExpectedServerSignType" => "EC",
"ExpectedResult" => "Success"
},
},
{
name => "ECDSA Signature Algorithm Selection SHA1",
server => $server,
client => {
"SignatureAlgorithms" => "ECDSA+SHA1",
},
test => {
"ExpectedServerCertType" => "P-256",
"ExpectedServerSignHash" => "SHA1",
"ExpectedServerSignType" => "EC",
"ExpectedResult" => "Success"
},
},
{
name => "ECDSA Signature Algorithm Selection compressed point",
server => {
"ECDSA.Certificate" => test_pem("server-cecdsa-cert.pem"),
"ECDSA.PrivateKey" => test_pem("server-cecdsa-key.pem"),
"MaxProtocol" => "TLSv1.2"
},
client => {
"SignatureAlgorithms" => "ECDSA+SHA256",
},
test => {
"ExpectedServerCertType" => "P-256",
"ExpectedServerSignHash" => "SHA256",
"ExpectedServerSignType" => "EC",
"ExpectedResult" => "Success"
},
},
{
name => "ECDSA Signature Algorithm Selection, no ECDSA certificate",
server => {
"MaxProtocol" => "TLSv1.2"
},
client => {
"SignatureAlgorithms" => "ECDSA+SHA256",
},
test => {
"ExpectedResult" => "ServerFail"
},
},
{
name => "RSA Signature Algorithm Selection",
server => $server,
client => {
"SignatureAlgorithms" => "RSA+SHA256",
},
test => {
"ExpectedServerCertType" => "RSA",
"ExpectedServerSignHash" => "SHA256",
"ExpectedServerSignType" => "RSA",
"ExpectedResult" => "Success"
},
},
{
name => "RSA-PSS Signature Algorithm Selection",
server => $server,
client => {
"SignatureAlgorithms" => "RSA-PSS+SHA256",
},
test => {
"ExpectedServerCertType" => "RSA",
"ExpectedServerSignHash" => "SHA256",
"ExpectedServerSignType" => "RSA-PSS",
"ExpectedResult" => "Success"
},
},
{
name => "RSA-PSS Certificate Legacy Signature Algorithm Selection",
server => $server_pss,
client => {
"SignatureAlgorithms" => "RSA-PSS+SHA256",
},
test => {
"ExpectedServerCertType" => "RSA",
"ExpectedServerSignHash" => "SHA256",
"ExpectedServerSignType" => "RSA-PSS",
"ExpectedResult" => "Success"
},
},
{
name => "RSA-PSS Certificate Unified Signature Algorithm Selection",
server => $server_pss,
client => {
"SignatureAlgorithms" => "rsa_pss_pss_sha256",
},
test => {
"ExpectedServerCertType" => "RSA-PSS",
"ExpectedServerSignHash" => "SHA256",
"ExpectedServerSignType" => "RSA-PSS",
"ExpectedResult" => "Success"
},
},
{
name => "Only RSA-PSS Certificate",
server => $server_pss_only,
client => {},
test => {
"ExpectedServerCertType" => "RSA-PSS",
"ExpectedServerSignHash" => "SHA256",
"ExpectedServerSignType" => "RSA-PSS",
"ExpectedResult" => "Success"
},
},
{
name => "RSA-PSS Certificate, no PSS signature algorithms",
server => $server_pss_only,
client => {
"SignatureAlgorithms" => "RSA+SHA256",
},
test => {
"ExpectedResult" => "ServerFail"
},
},
{
name => "Suite B P-256 Hash Algorithm Selection",
server => {
"ECDSA.Certificate" => test_pem("p256-server-cert.pem"),
"ECDSA.PrivateKey" => test_pem("p256-server-key.pem"),
"MaxProtocol" => "TLSv1.2",
"CipherString" => "SUITEB128"
},
client => {
"VerifyCAFile" => test_pem("p384-root.pem"),
"SignatureAlgorithms" => "ECDSA+SHA384:ECDSA+SHA256"
},
test => {
"ExpectedServerCertType" => "P-256",
"ExpectedServerSignHash" => "SHA256",
"ExpectedServerSignType" => "EC",
"ExpectedResult" => "Success"
},
},
{
name => "Suite B P-384 Hash Algorithm Selection",
server => {
"ECDSA.Certificate" => test_pem("p384-server-cert.pem"),
"ECDSA.PrivateKey" => test_pem("p384-server-key.pem"),
"MaxProtocol" => "TLSv1.2",
"CipherString" => "SUITEB128"
},
client => {
"VerifyCAFile" => test_pem("p384-root.pem"),
"SignatureAlgorithms" => "ECDSA+SHA256:ECDSA+SHA384"
},
test => {
"ExpectedServerCertType" => "P-384",
"ExpectedServerSignHash" => "SHA384",
"ExpectedServerSignType" => "EC",
"ExpectedResult" => "Success"
},
},
{
name => "TLS 1.2 Ed25519 Client Auth",
server => {
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Require"
},
client => {
"EdDSA.Certificate" => test_pem("client-ed25519-cert.pem"),
"EdDSA.PrivateKey" => test_pem("client-ed25519-key.pem"),
"MinProtocol" => "TLSv1.2",
"MaxProtocol" => "TLSv1.2"
},
test => {
"ExpectedClientCertType" => "Ed25519",
"ExpectedClientSignType" => "Ed25519",
"ExpectedResult" => "Success"
},
},
);
my @tests_tls_1_1 = (
{
name => "Only RSA-PSS Certificate, TLS v1.1",
server => $server_pss_only,
client => {
"MaxProtocol" => "TLSv1.1",
},
test => {
"ExpectedResult" => "ServerFail"
},
},
);
push @tests, @tests_tls_1_1 unless disabled("tls1_1");
my $server_tls_1_3 = {
"ECDSA.Certificate" => test_pem("server-ecdsa-cert.pem"),
"ECDSA.PrivateKey" => test_pem("server-ecdsa-key.pem"),
"EdDSA.Certificate" => test_pem("server-ed25519-cert.pem"),
"EdDSA.PrivateKey" => test_pem("server-ed25519-key.pem"),
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3"
};
my $server_tls_1_3_pss = {
"PSS.Certificate" => test_pem("server-pss-cert.pem"),
"PSS.PrivateKey" => test_pem("server-pss-key.pem"),
"ECDSA.Certificate" => test_pem("server-ecdsa-cert.pem"),
"ECDSA.PrivateKey" => test_pem("server-ecdsa-key.pem"),
"EdDSA.Certificate" => test_pem("server-ed25519-cert.pem"),
"EdDSA.PrivateKey" => test_pem("server-ed25519-key.pem"),
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3"
};
my $client_tls_1_3 = {
"RSA.Certificate" => test_pem("ee-client-chain.pem"),
"RSA.PrivateKey" => test_pem("ee-key.pem"),
"ECDSA.Certificate" => test_pem("ee-ecdsa-client-chain.pem"),
"ECDSA.PrivateKey" => test_pem("ee-ecdsa-key.pem"),
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3"
};
my @tests_tls_1_3 = (
{
name => "TLS 1.3 ECDSA Signature Algorithm Selection",
server => $server_tls_1_3,
client => {
"SignatureAlgorithms" => "ECDSA+SHA256",
},
test => {
"ExpectedServerCertType" => "P-256",
"ExpectedServerSignHash" => "SHA256",
"ExpectedServerSignType" => "EC",
"ExpectedServerCANames" => "empty",
"ExpectedResult" => "Success"
},
},
{
name => "TLS 1.3 ECDSA Signature Algorithm Selection compressed point",
server => {
"ECDSA.Certificate" => test_pem("server-cecdsa-cert.pem"),
"ECDSA.PrivateKey" => test_pem("server-cecdsa-key.pem"),
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3"
},
client => {
"SignatureAlgorithms" => "ECDSA+SHA256",
},
test => {
"ExpectedResult" => "ServerFail"
},
},
{
name => "TLS 1.3 ECDSA Signature Algorithm Selection SHA1",
server => $server_tls_1_3,
client => {
"SignatureAlgorithms" => "ECDSA+SHA1",
},
test => {
"ExpectedResult" => "ServerFail"
},
},
{
name => "TLS 1.3 ECDSA Signature Algorithm Selection with PSS",
server => $server_tls_1_3,
client => {
"SignatureAlgorithms" => "ECDSA+SHA256:RSA-PSS+SHA256",
"RequestCAFile" => test_pem("root-cert.pem"),
},
test => {
"ExpectedServerCertType" => "P-256",
"ExpectedServerSignHash" => "SHA256",
"ExpectedServerSignType" => "EC",
"ExpectedServerCANames" => test_pem("root-cert.pem"),
"ExpectedResult" => "Success"
},
},
{
name => "TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS",
server => $server_tls_1_3,
client => {
"SignatureAlgorithms" => "ECDSA+SHA384:RSA-PSS+SHA384",
},
test => {
"ExpectedServerCertType" => "RSA",
"ExpectedServerSignHash" => "SHA384",
"ExpectedServerSignType" => "RSA-PSS",
"ExpectedResult" => "Success"
},
},
{
name => "TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3"
},
client => {
"SignatureAlgorithms" => "ECDSA+SHA256",
},
test => {
"ExpectedResult" => "ServerFail"
},
},
{
name => "TLS 1.3 RSA Signature Algorithm Selection, no PSS",
server => $server_tls_1_3,
client => {
"SignatureAlgorithms" => "RSA+SHA256",
},
test => {
"ExpectedResult" => "ServerFail"
},
},
{
name => "TLS 1.3 RSA-PSS Signature Algorithm Selection",
server => $server_tls_1_3,
client => {
"SignatureAlgorithms" => "RSA-PSS+SHA256",
},
test => {
"ExpectedServerCertType" => "RSA",
"ExpectedServerSignHash" => "SHA256",
"ExpectedServerSignType" => "RSA-PSS",
"ExpectedResult" => "Success"
},
},
{
name => "TLS 1.3 Ed25519 Signature Algorithm Selection",
server => $server_tls_1_3,
client => {
"SignatureAlgorithms" => "ed25519",
},
test => {
"ExpectedServerCertType" => "Ed25519",
"ExpectedServerSignType" => "Ed25519",
"ExpectedResult" => "Success"
},
},
{
name => "TLS 1.3 Ed25519 CipherString and Groups Selection",
server => $server_tls_1_3,
client => {
"SignatureAlgorithms" => "ECDSA+SHA256:ed25519",
# Excluding P-256 from the supported groups list should
# mean server still uses a P-256 certificate because supported
# groups is not used in signature selection for TLS 1.3
"Groups" => "X25519"
},
test => {
"ExpectedServerCertType" =>, "P-256",
"ExpectedServerSignType" =>, "EC",
"ExpectedResult" => "Success"
},
},
{
name => "TLS 1.3 RSA Client Auth Signature Algorithm Selection",
server => {
"ClientSignatureAlgorithms" => "PSS+SHA256",
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Require"
},
client => $client_tls_1_3,
test => {
"ExpectedClientCertType" => "RSA",
"ExpectedClientSignHash" => "SHA256",
"ExpectedClientSignType" => "RSA-PSS",
"ExpectedClientCANames" => "empty",
"ExpectedResult" => "Success"
},
},
{
name => "TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names",
server => {
"ClientSignatureAlgorithms" => "PSS+SHA256",
"VerifyCAFile" => test_pem("root-cert.pem"),
"RequestCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Require"
},
client => $client_tls_1_3,
test => {
"ExpectedClientCertType" => "RSA",
"ExpectedClientSignHash" => "SHA256",
"ExpectedClientSignType" => "RSA-PSS",
"ExpectedClientCANames" => test_pem("root-cert.pem"),
"ExpectedResult" => "Success"
},
},
{
name => "TLS 1.3 ECDSA Client Auth Signature Algorithm Selection",
server => {
"ClientSignatureAlgorithms" => "ECDSA+SHA256",
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Require"
},
client => $client_tls_1_3,
test => {
"ExpectedClientCertType" => "P-256",
"ExpectedClientSignHash" => "SHA256",
"ExpectedClientSignType" => "EC",
"ExpectedResult" => "Success"
},
},
{
name => "TLS 1.3 Ed25519 Client Auth",
server => {
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Require"
},
client => {
"EdDSA.Certificate" => test_pem("client-ed25519-cert.pem"),
"EdDSA.PrivateKey" => test_pem("client-ed25519-key.pem"),
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3"
},
test => {
"ExpectedClientCertType" => "Ed25519",
"ExpectedClientSignType" => "Ed25519",
"ExpectedResult" => "Success"
},
},
);
push @tests, @tests_tls_1_3 unless disabled("tls1_3");
my @tests_dsa_tls_1_2 = (
{
name => "TLS 1.2 DSA Certificate Test",
server => {
"DSA.Certificate" => test_pem("server-dsa-cert.pem"),
"DSA.PrivateKey" => test_pem("server-dsa-key.pem"),
"DHParameters" => test_pem("dhp2048.pem"),
"MinProtocol" => "TLSv1.2",
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ALL",
},
client => {
"SignatureAlgorithms" => "DSA+SHA256:DSA+SHA1",
"CipherString" => "ALL",
},
test => {
"ExpectedResult" => "Success"
},
},
);
my @tests_dsa_tls_1_3 = (
{
name => "TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms",
server => {
"ClientSignatureAlgorithms" => "ECDSA+SHA1:DSA+SHA256:RSA+SHA256",
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Request"
},
client => {},
test => {
"ExpectedResult" => "ServerFail"
},
},
{
name => "TLS 1.3 DSA Certificate Test",
server => {
"DSA.Certificate" => test_pem("server-dsa-cert.pem"),
"DSA.PrivateKey" => test_pem("server-dsa-key.pem"),
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"CipherString" => "ALL",
},
client => {
"SignatureAlgorithms" => "DSA+SHA1:DSA+SHA256:ECDSA+SHA256",
"CipherString" => "ALL",
},
test => {
"ExpectedResult" => "ServerFail"
},
},
);
if (!disabled("dsa")) {
push @tests, @tests_dsa_tls_1_2 unless disabled("dh");
push @tests, @tests_dsa_tls_1_3 unless disabled("tls1_3");
}
test/ssl-tests/21-key-update.conf
+112
View File
@@ -0,0 +1,112 @@
# Generated with generate_ssl_tests.pl
num_tests = 4
test-0 = 0-update-key-client-update-not-requested
test-1 = 1-update-key-server-update-not-requested
test-2 = 2-update-key-client-update-requested
test-3 = 3-update-key-server-update-requested
# ===========================================================
[0-update-key-client-update-not-requested]
ssl_conf = 0-update-key-client-update-not-requested-ssl
[0-update-key-client-update-not-requested-ssl]
server = 0-update-key-client-update-not-requested-server
client = 0-update-key-client-update-not-requested-client
[0-update-key-client-update-not-requested-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-update-key-client-update-not-requested-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-0]
ExpectedResult = Success
HandshakeMode = KeyUpdateClient
KeyUpdateType = KeyUpdateNotRequested
ResumptionExpected = No
# ===========================================================
[1-update-key-server-update-not-requested]
ssl_conf = 1-update-key-server-update-not-requested-ssl
[1-update-key-server-update-not-requested-ssl]
server = 1-update-key-server-update-not-requested-server
client = 1-update-key-server-update-not-requested-client
[1-update-key-server-update-not-requested-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-update-key-server-update-not-requested-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-1]
ExpectedResult = Success
HandshakeMode = KeyUpdateServer
KeyUpdateType = KeyUpdateNotRequested
ResumptionExpected = No
# ===========================================================
[2-update-key-client-update-requested]
ssl_conf = 2-update-key-client-update-requested-ssl
[2-update-key-client-update-requested-ssl]
server = 2-update-key-client-update-requested-server
client = 2-update-key-client-update-requested-client
[2-update-key-client-update-requested-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-update-key-client-update-requested-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-2]
ExpectedResult = Success
HandshakeMode = KeyUpdateClient
KeyUpdateType = KeyUpdateRequested
ResumptionExpected = No
# ===========================================================
[3-update-key-server-update-requested]
ssl_conf = 3-update-key-server-update-requested-ssl
[3-update-key-server-update-requested-ssl]
server = 3-update-key-server-update-requested-server
client = 3-update-key-server-update-requested-client
[3-update-key-server-update-requested-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-update-key-server-update-requested-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-3]
ExpectedResult = Success
HandshakeMode = KeyUpdateServer
KeyUpdateType = KeyUpdateRequested
ResumptionExpected = No
test/ssl-tests/21-key-update.conf.in
+62
View File
@@ -0,0 +1,62 @@
# -*- mode: perl; -*-
# Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
## Test KeyUpdate
use strict;
use warnings;
package ssltests;
our @tests = (
{
name => "update-key-client-update-not-requested",
server => {},
client => {},
test => {
"HandshakeMode" => "KeyUpdateClient",
"KeyUpdateType" => "KeyUpdateNotRequested",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "update-key-server-update-not-requested",
server => {},
client => {},
test => {
"HandshakeMode" => "KeyUpdateServer",
"KeyUpdateType" => "KeyUpdateNotRequested",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "update-key-client-update-requested",
server => {},
client => {},
test => {
"HandshakeMode" => "KeyUpdateClient",
"KeyUpdateType" => "KeyUpdateRequested",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "update-key-server-update-requested",
server => {},
client => {},
test => {
"HandshakeMode" => "KeyUpdateServer",
"KeyUpdateType" => "KeyUpdateRequested",
"ResumptionExpected" => "No",
"ExpectedResult" => "Success"
}
}
);
test/ssl-tests/22-compression.conf
+216
View File
@@ -0,0 +1,216 @@
# Generated with generate_ssl_tests.pl
num_tests = 8
test-0 = 0-tlsv1_3-both-compress
test-1 = 1-tlsv1_3-client-compress
test-2 = 2-tlsv1_3-server-compress
test-3 = 3-tlsv1_3-neither-compress
test-4 = 4-tlsv1_2-both-compress
test-5 = 5-tlsv1_2-client-compress
test-6 = 6-tlsv1_2-server-compress
test-7 = 7-tlsv1_2-neither-compress
# ===========================================================
[0-tlsv1_3-both-compress]
ssl_conf = 0-tlsv1_3-both-compress-ssl
[0-tlsv1_3-both-compress-ssl]
server = 0-tlsv1_3-both-compress-server
client = 0-tlsv1_3-both-compress-client
[0-tlsv1_3-both-compress-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = Compression
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-tlsv1_3-both-compress-client]
CipherString = DEFAULT
Options = Compression
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-0]
CompressionExpected = No
ExpectedResult = Success
# ===========================================================
[1-tlsv1_3-client-compress]
ssl_conf = 1-tlsv1_3-client-compress-ssl
[1-tlsv1_3-client-compress-ssl]
server = 1-tlsv1_3-client-compress-server
client = 1-tlsv1_3-client-compress-client
[1-tlsv1_3-client-compress-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-tlsv1_3-client-compress-client]
CipherString = DEFAULT
Options = Compression
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-1]
CompressionExpected = No
ExpectedResult = Success
# ===========================================================
[2-tlsv1_3-server-compress]
ssl_conf = 2-tlsv1_3-server-compress-ssl
[2-tlsv1_3-server-compress-ssl]
server = 2-tlsv1_3-server-compress-server
client = 2-tlsv1_3-server-compress-client
[2-tlsv1_3-server-compress-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = Compression
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-tlsv1_3-server-compress-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-2]
CompressionExpected = No
ExpectedResult = Success
# ===========================================================
[3-tlsv1_3-neither-compress]
ssl_conf = 3-tlsv1_3-neither-compress-ssl
[3-tlsv1_3-neither-compress-ssl]
server = 3-tlsv1_3-neither-compress-server
client = 3-tlsv1_3-neither-compress-client
[3-tlsv1_3-neither-compress-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-tlsv1_3-neither-compress-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-3]
CompressionExpected = No
ExpectedResult = Success
# ===========================================================
[4-tlsv1_2-both-compress]
ssl_conf = 4-tlsv1_2-both-compress-ssl
[4-tlsv1_2-both-compress-ssl]
server = 4-tlsv1_2-both-compress-server
client = 4-tlsv1_2-both-compress-client
[4-tlsv1_2-both-compress-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = Compression
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[4-tlsv1_2-both-compress-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = Compression
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-4]
CompressionExpected = Yes
ExpectedResult = Success
# ===========================================================
[5-tlsv1_2-client-compress]
ssl_conf = 5-tlsv1_2-client-compress-ssl
[5-tlsv1_2-client-compress-ssl]
server = 5-tlsv1_2-client-compress-server
client = 5-tlsv1_2-client-compress-client
[5-tlsv1_2-client-compress-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[5-tlsv1_2-client-compress-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
Options = Compression
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-5]
CompressionExpected = No
ExpectedResult = Success
# ===========================================================
[6-tlsv1_2-server-compress]
ssl_conf = 6-tlsv1_2-server-compress-ssl
[6-tlsv1_2-server-compress-ssl]
server = 6-tlsv1_2-server-compress-server
client = 6-tlsv1_2-server-compress-client
[6-tlsv1_2-server-compress-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = Compression
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-tlsv1_2-server-compress-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-6]
CompressionExpected = No
ExpectedResult = Success
# ===========================================================
[7-tlsv1_2-neither-compress]
ssl_conf = 7-tlsv1_2-neither-compress-ssl
[7-tlsv1_2-neither-compress-ssl]
server = 7-tlsv1_2-neither-compress-server
client = 7-tlsv1_2-neither-compress-client
[7-tlsv1_2-neither-compress-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-tlsv1_2-neither-compress-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-7]
CompressionExpected = No
ExpectedResult = Success
test/ssl-tests/22-compression.conf.in
+127
View File
@@ -0,0 +1,127 @@
# -*- mode: perl; -*-
# Copyright 2016-2016 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
## Test Compression
use strict;
use warnings;
package ssltests;
use OpenSSL::Test::Utils;
our @tests = ();
our @tests_tls1_3 = (
{
name => "tlsv1_3-both-compress",
server => {
"Options" => "Compression"
},
client => {
"Options" => "Compression"
},
test => {
"CompressionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "tlsv1_3-client-compress",
server => {
},
client => {
"Options" => "Compression"
},
test => {
"CompressionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "tlsv1_3-server-compress",
server => {
"Options" => "Compression"
},
client => {
},
test => {
"CompressionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "tlsv1_3-neither-compress",
server => {
},
client => {
},
test => {
"CompressionExpected" => "No",
"ExpectedResult" => "Success"
}
},
);
our @tests_tls1_2 = (
{
name => "tlsv1_2-both-compress",
server => {
"Options" => "Compression"
},
client => {
"Options" => "Compression",
"MaxProtocol" => "TLSv1.2"
},
test => {
"CompressionExpected" => "Yes",
"ExpectedResult" => "Success"
}
},
{
name => "tlsv1_2-client-compress",
server => {
},
client => {
"Options" => "Compression",
"MaxProtocol" => "TLSv1.2"
},
test => {
"CompressionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "tlsv1_2-server-compress",
server => {
"Options" => "Compression"
},
client => {
"MaxProtocol" => "TLSv1.2"
},
test => {
"CompressionExpected" => "No",
"ExpectedResult" => "Success"
}
},
{
name => "tlsv1_2-neither-compress",
server => {
},
client => {
"MaxProtocol" => "TLSv1.2"
},
test => {
"CompressionExpected" => "No",
"ExpectedResult" => "Success"
}
},
);
push @tests, @tests_tls1_3 unless disabled("tls1_3");
push @tests, @tests_tls1_2 unless alldisabled(("tls1_2", "tls1_1", "tls1",
"ssl3"));
test/ssl-tests/23-srp.conf
+148
View File
@@ -0,0 +1,148 @@
# Generated with generate_ssl_tests.pl
num_tests = 4
test-0 = 0-srp
test-1 = 1-srp-bad-password
test-2 = 2-srp-auth
test-3 = 3-srp-auth-bad-password
# ===========================================================
[0-srp]
ssl_conf = 0-srp-ssl
[0-srp-ssl]
server = 0-srp-server
client = 0-srp-client
[0-srp-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = SRP
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-srp-client]
CipherString = SRP
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-0]
ExpectedResult = Success
server = 0-srp-server-extra
client = 0-srp-client-extra
[0-srp-server-extra]
SRPPassword = password
SRPUser = user
[0-srp-client-extra]
SRPPassword = password
SRPUser = user
# ===========================================================
[1-srp-bad-password]
ssl_conf = 1-srp-bad-password-ssl
[1-srp-bad-password-ssl]
server = 1-srp-bad-password-server
client = 1-srp-bad-password-client
[1-srp-bad-password-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = SRP
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-srp-bad-password-client]
CipherString = SRP
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-1]
ExpectedResult = ServerFail
server = 1-srp-bad-password-server-extra
client = 1-srp-bad-password-client-extra
[1-srp-bad-password-server-extra]
SRPPassword = password
SRPUser = user
[1-srp-bad-password-client-extra]
SRPPassword = passw0rd
SRPUser = user
# ===========================================================
[2-srp-auth]
ssl_conf = 2-srp-auth-ssl
[2-srp-auth-ssl]
server = 2-srp-auth-server
client = 2-srp-auth-client
[2-srp-auth-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = aSRP
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-srp-auth-client]
CipherString = aSRP
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-2]
ExpectedResult = Success
server = 2-srp-auth-server-extra
client = 2-srp-auth-client-extra
[2-srp-auth-server-extra]
SRPPassword = password
SRPUser = user
[2-srp-auth-client-extra]
SRPPassword = password
SRPUser = user
# ===========================================================
[3-srp-auth-bad-password]
ssl_conf = 3-srp-auth-bad-password-ssl
[3-srp-auth-bad-password-ssl]
server = 3-srp-auth-bad-password-server
client = 3-srp-auth-bad-password-client
[3-srp-auth-bad-password-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = aSRP
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-srp-auth-bad-password-client]
CipherString = aSRP
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-3]
ExpectedResult = ServerFail
server = 3-srp-auth-bad-password-server-extra
client = 3-srp-auth-bad-password-client-extra
[3-srp-auth-bad-password-server-extra]
SRPPassword = password
SRPUser = user
[3-srp-auth-bad-password-client-extra]
SRPPassword = passw0rd
SRPUser = user
test/ssl-tests/23-srp.conf.in
+107
View File
@@ -0,0 +1,107 @@
# -*- mode: perl; -*-
# Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
use strict;
use warnings;
package ssltests;
# SRP is only supported up to TLSv1.2
our @tests = (
{
name => "srp",
server => {
"CipherString" => "SRP",
"MaxProtocol" => "TLSv1.2",
extra => {
"SRPUser" => "user",
"SRPPassword" => "password",
},
},
client => {
"CipherString" => "SRP",
"MaxProtocol" => "TLSv1.2",
extra => {
"SRPUser" => "user",
"SRPPassword" => "password",
},
},
test => {
"ExpectedResult" => "Success"
},
},
{
name => "srp-bad-password",
server => {
"CipherString" => "SRP",
"MaxProtocol" => "TLSv1.2",
extra => {
"SRPUser" => "user",
"SRPPassword" => "password",
},
},
client => {
"CipherString" => "SRP",
"MaxProtocol" => "TLSv1.2",
extra => {
"SRPUser" => "user",
"SRPPassword" => "passw0rd",
},
},
test => {
# Server fails first with bad client Finished.
"ExpectedResult" => "ServerFail"
},
},
{
name => "srp-auth",
server => {
"CipherString" => "aSRP",
"MaxProtocol" => "TLSv1.2",
extra => {
"SRPUser" => "user",
"SRPPassword" => "password",
},
},
client => {
"CipherString" => "aSRP",
"MaxProtocol" => "TLSv1.2",
extra => {
"SRPUser" => "user",
"SRPPassword" => "password",
},
},
test => {
"ExpectedResult" => "Success"
},
},
{
name => "srp-auth-bad-password",
server => {
"CipherString" => "aSRP",
"MaxProtocol" => "TLSv1.2",
extra => {
"SRPUser" => "user",
"SRPPassword" => "password",
},
},
client => {
"CipherString" => "aSRP",
"MaxProtocol" => "TLSv1.2",
extra => {
"SRPUser" => "user",
"SRPPassword" => "passw0rd",
},
},
test => {
# Server fails first with bad client Finished.
"ExpectedResult" => "ServerFail"
},
},
);
test/ssl-tests/24-padding.conf
+34
View File
@@ -0,0 +1,34 @@
# Generated with generate_ssl_tests.pl
num_tests = 1
test-0 = 0-default
# ===========================================================
[0-default]
ssl_conf = 0-default-ssl
[0-default-ssl]
server = 0-default-server
client = 0-default-client
[0-default-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
RecordPadding = 64
[0-default-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
RecordPadding = 11
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-0]
ExpectedResult = Success
test/ssl-tests/24-padding.conf.in
+25
View File
@@ -0,0 +1,25 @@
# -*- mode: perl; -*-
# Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
## SSL test configurations
package ssltests;
our @tests = (
{
name => "default",
server => { "RecordPadding" => 64,
"MaxProtocol" => "TLSv1.3",
"MinProtocol" => "TLSv1.3" },
client => { "RecordPadding" => 11,
"MaxProtocol" => "TLSv1.3",
"MinProtocol" => "TLSv1.3" },
test => { "ExpectedResult" => "Success" },
},
);
test/ssl-tests/25-cipher.conf
+244
View File
@@ -0,0 +1,244 @@
# Generated with generate_ssl_tests.pl
num_tests = 9
test-0 = 0-cipher-server-1
test-1 = 1-cipher-server-2
test-2 = 2-cipher-server-client-list
test-3 = 3-cipher-server-pref-1
test-4 = 4-cipher-server-pref-2
test-5 = 5-cipher-server-pref-client-list
test-6 = 6-cipher-server-pref-not-mobile
test-7 = 7-cipher-server-pref-mobile
test-8 = 8-cipher-server-pref-mobile2
# ===========================================================
[0-cipher-server-1]
ssl_conf = 0-cipher-server-1-ssl
[0-cipher-server-1-ssl]
server = 0-cipher-server-1-server
client = 0-cipher-server-1-client
[0-cipher-server-1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-cipher-server-1-client]
CipherString = ECDHE-RSA-AES256-SHA384
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-0]
ExpectedCipher = ECDHE-RSA-AES256-SHA384
# ===========================================================
[1-cipher-server-2]
ssl_conf = 1-cipher-server-2-ssl
[1-cipher-server-2-ssl]
server = 1-cipher-server-2-server
client = 1-cipher-server-2-client
[1-cipher-server-2-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-cipher-server-2-client]
CipherString = ECDHE-RSA-AES128-SHA256
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-1]
ExpectedCipher = ECDHE-RSA-AES128-SHA256
# ===========================================================
[2-cipher-server-client-list]
ssl_conf = 2-cipher-server-client-list-ssl
[2-cipher-server-client-list-ssl]
server = 2-cipher-server-client-list-server
client = 2-cipher-server-client-list-client
[2-cipher-server-client-list-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-cipher-server-client-list-client]
CipherString = ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-2]
ExpectedCipher = ECDHE-RSA-AES128-SHA256
# ===========================================================
[3-cipher-server-pref-1]
ssl_conf = 3-cipher-server-pref-1-ssl
[3-cipher-server-pref-1-ssl]
server = 3-cipher-server-pref-1-server
client = 3-cipher-server-pref-1-client
[3-cipher-server-pref-1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256
MaxProtocol = TLSv1.2
Options = ServerPreference
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-cipher-server-pref-1-client]
CipherString = ECDHE-RSA-AES256-SHA384
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-3]
ExpectedCipher = ECDHE-RSA-AES256-SHA384
# ===========================================================
[4-cipher-server-pref-2]
ssl_conf = 4-cipher-server-pref-2-ssl
[4-cipher-server-pref-2-ssl]
server = 4-cipher-server-pref-2-server
client = 4-cipher-server-pref-2-client
[4-cipher-server-pref-2-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256
MaxProtocol = TLSv1.2
Options = ServerPreference
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[4-cipher-server-pref-2-client]
CipherString = ECDHE-RSA-AES128-SHA256
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-4]
ExpectedCipher = ECDHE-RSA-AES128-SHA256
# ===========================================================
[5-cipher-server-pref-client-list]
ssl_conf = 5-cipher-server-pref-client-list-ssl
[5-cipher-server-pref-client-list-ssl]
server = 5-cipher-server-pref-client-list-server
client = 5-cipher-server-pref-client-list-client
[5-cipher-server-pref-client-list-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256
MaxProtocol = TLSv1.2
Options = ServerPreference
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[5-cipher-server-pref-client-list-client]
CipherString = ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-5]
ExpectedCipher = ECDHE-RSA-AES256-SHA384
# ===========================================================
[6-cipher-server-pref-not-mobile]
ssl_conf = 6-cipher-server-pref-not-mobile-ssl
[6-cipher-server-pref-not-mobile-ssl]
server = 6-cipher-server-pref-not-mobile-server
client = 6-cipher-server-pref-not-mobile-client
[6-cipher-server-pref-not-mobile-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-CHACHA20-POLY1305
MaxProtocol = TLSv1.2
Options = ServerPreference
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-cipher-server-pref-not-mobile-client]
CipherString = ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-6]
ExpectedCipher = ECDHE-RSA-AES256-SHA384
# ===========================================================
[7-cipher-server-pref-mobile]
ssl_conf = 7-cipher-server-pref-mobile-ssl
[7-cipher-server-pref-mobile-ssl]
server = 7-cipher-server-pref-mobile-server
client = 7-cipher-server-pref-mobile-client
[7-cipher-server-pref-mobile-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-CHACHA20-POLY1305
MaxProtocol = TLSv1.2
Options = ServerPreference,PrioritizeChaCha
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-cipher-server-pref-mobile-client]
CipherString = ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-CHACHA20-POLY1305
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-7]
ExpectedCipher = ECDHE-RSA-AES256-SHA384
# ===========================================================
[8-cipher-server-pref-mobile2]
ssl_conf = 8-cipher-server-pref-mobile2-ssl
[8-cipher-server-pref-mobile2-ssl]
server = 8-cipher-server-pref-mobile2-server
client = 8-cipher-server-pref-mobile2-client
[8-cipher-server-pref-mobile2-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-CHACHA20-POLY1305
MaxProtocol = TLSv1.2
Options = ServerPreference,PrioritizeChaCha
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-cipher-server-pref-mobile2-client]
CipherString = ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-8]
ExpectedCipher = ECDHE-RSA-CHACHA20-POLY1305
test/ssl-tests/25-cipher.conf.in
+156
View File
@@ -0,0 +1,156 @@
# -*- mode: perl; -*-
# Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
## Test version negotiation
use strict;
use warnings;
package ssltests;
use OpenSSL::Test::Utils;
our @tests = (
{
name => "cipher-server-1",
server => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256",
},
client => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES256-SHA384"
},
test => {
"ExpectedCipher" => "ECDHE-RSA-AES256-SHA384",
},
},
{
name => "cipher-server-2",
server => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256",
},
client => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES128-SHA256"
},
test => {
"ExpectedCipher" => "ECDHE-RSA-AES128-SHA256",
},
},
{
name => "cipher-server-client-list",
server => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256",
},
client => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384",
},
test => {
"ExpectedCipher" => "ECDHE-RSA-AES128-SHA256",
},
},
{
name => "cipher-server-pref-1",
server => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256",
"Options" => "ServerPreference",
},
client => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES256-SHA384"
},
test => {
"ExpectedCipher" => "ECDHE-RSA-AES256-SHA384",
},
},
{
name => "cipher-server-pref-2",
server => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256",
"Options" => "ServerPreference",
},
client => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES128-SHA256"
},
test => {
"ExpectedCipher" => "ECDHE-RSA-AES128-SHA256",
},
},
{
name => "cipher-server-pref-client-list",
server => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256",
"Options" => "ServerPreference",
},
client => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384",
},
test => {
"ExpectedCipher" => "ECDHE-RSA-AES256-SHA384",
},
},
{
name => "cipher-server-pref-not-mobile",
server => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-CHACHA20-POLY1305",
"Options" => "ServerPreference",
},
client => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384",
},
test => {
"ExpectedCipher" => "ECDHE-RSA-AES256-SHA384",
},
},
{
name => "cipher-server-pref-mobile",
server => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-CHACHA20-POLY1305",
"Options" => "ServerPreference,PrioritizeChaCha",
},
client => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-CHACHA20-POLY1305",
},
test => {
"ExpectedCipher" => "ECDHE-RSA-AES256-SHA384",
},
},
);
my @tests_poly1305 = (
{
name => "cipher-server-pref-mobile2",
server => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-CHACHA20-POLY1305",
"Options" => "ServerPreference,PrioritizeChaCha",
},
client => {
"MaxProtocol" => "TLSv1.2",
"CipherString" => "ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384",
},
test => {
"ExpectedCipher" => "ECDHE-RSA-CHACHA20-POLY1305",
},
},
);
push @tests, @tests_poly1305 unless disabled("poly1305") || disabled("chacha");
test/ssl-tests/26-tls13_client_auth.conf
+476
View File
@@ -0,0 +1,476 @@
# Generated with generate_ssl_tests.pl
num_tests = 14
test-0 = 0-server-auth-TLSv1.3
test-1 = 1-client-auth-TLSv1.3-request
test-2 = 2-client-auth-TLSv1.3-require-fail
test-3 = 3-client-auth-TLSv1.3-require
test-4 = 4-client-auth-TLSv1.3-require-non-empty-names
test-5 = 5-client-auth-TLSv1.3-noroot
test-6 = 6-client-auth-TLSv1.3-request-post-handshake
test-7 = 7-client-auth-TLSv1.3-require-fail-post-handshake
test-8 = 8-client-auth-TLSv1.3-require-post-handshake
test-9 = 9-client-auth-TLSv1.3-require-non-empty-names-post-handshake
test-10 = 10-client-auth-TLSv1.3-noroot-post-handshake
test-11 = 11-client-auth-TLSv1.3-request-force-client-post-handshake
test-12 = 12-client-auth-TLSv1.3-request-force-server-post-handshake
test-13 = 13-client-auth-TLSv1.3-request-force-both-post-handshake
# ===========================================================
[0-server-auth-TLSv1.3]
ssl_conf = 0-server-auth-TLSv1.3-ssl
[0-server-auth-TLSv1.3-ssl]
server = 0-server-auth-TLSv1.3-server
client = 0-server-auth-TLSv1.3-client
[0-server-auth-TLSv1.3-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-server-auth-TLSv1.3-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-0]
ExpectedResult = Success
# ===========================================================
[1-client-auth-TLSv1.3-request]
ssl_conf = 1-client-auth-TLSv1.3-request-ssl
[1-client-auth-TLSv1.3-request-ssl]
server = 1-client-auth-TLSv1.3-request-server
client = 1-client-auth-TLSv1.3-request-client
[1-client-auth-TLSv1.3-request-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Request
[1-client-auth-TLSv1.3-request-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-1]
ExpectedResult = Success
# ===========================================================
[2-client-auth-TLSv1.3-require-fail]
ssl_conf = 2-client-auth-TLSv1.3-require-fail-ssl
[2-client-auth-TLSv1.3-require-fail-ssl]
server = 2-client-auth-TLSv1.3-require-fail-server
client = 2-client-auth-TLSv1.3-require-fail-client
[2-client-auth-TLSv1.3-require-fail-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[2-client-auth-TLSv1.3-require-fail-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-2]
ExpectedResult = ServerFail
ExpectedServerAlert = HandshakeFailure
# ===========================================================
[3-client-auth-TLSv1.3-require]
ssl_conf = 3-client-auth-TLSv1.3-require-ssl
[3-client-auth-TLSv1.3-require-ssl]
server = 3-client-auth-TLSv1.3-require-server
client = 3-client-auth-TLSv1.3-require-client
[3-client-auth-TLSv1.3-require-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = PSS+SHA256
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[3-client-auth-TLSv1.3-require-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-3]
ExpectedClientCANames = empty
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
ExpectedClientSignType = RSA-PSS
ExpectedResult = Success
# ===========================================================
[4-client-auth-TLSv1.3-require-non-empty-names]
ssl_conf = 4-client-auth-TLSv1.3-require-non-empty-names-ssl
[4-client-auth-TLSv1.3-require-non-empty-names-ssl]
server = 4-client-auth-TLSv1.3-require-non-empty-names-server
client = 4-client-auth-TLSv1.3-require-non-empty-names-client
[4-client-auth-TLSv1.3-require-non-empty-names-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ClientSignatureAlgorithms = PSS+SHA256
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[4-client-auth-TLSv1.3-require-non-empty-names-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-4]
ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
ExpectedClientSignType = RSA-PSS
ExpectedResult = Success
# ===========================================================
[5-client-auth-TLSv1.3-noroot]
ssl_conf = 5-client-auth-TLSv1.3-noroot-ssl
[5-client-auth-TLSv1.3-noroot-ssl]
server = 5-client-auth-TLSv1.3-noroot-server
client = 5-client-auth-TLSv1.3-noroot-client
[5-client-auth-TLSv1.3-noroot-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = Require
[5-client-auth-TLSv1.3-noroot-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-5]
ExpectedResult = ServerFail
ExpectedServerAlert = UnknownCA
# ===========================================================
[6-client-auth-TLSv1.3-request-post-handshake]
ssl_conf = 6-client-auth-TLSv1.3-request-post-handshake-ssl
[6-client-auth-TLSv1.3-request-post-handshake-ssl]
server = 6-client-auth-TLSv1.3-request-post-handshake-server
client = 6-client-auth-TLSv1.3-request-post-handshake-client
[6-client-auth-TLSv1.3-request-post-handshake-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = RequestPostHandshake
[6-client-auth-TLSv1.3-request-post-handshake-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-6]
ExpectedResult = ServerFail
HandshakeMode = PostHandshakeAuth
# ===========================================================
[7-client-auth-TLSv1.3-require-fail-post-handshake]
ssl_conf = 7-client-auth-TLSv1.3-require-fail-post-handshake-ssl
[7-client-auth-TLSv1.3-require-fail-post-handshake-ssl]
server = 7-client-auth-TLSv1.3-require-fail-post-handshake-server
client = 7-client-auth-TLSv1.3-require-fail-post-handshake-client
[7-client-auth-TLSv1.3-require-fail-post-handshake-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = RequirePostHandshake
[7-client-auth-TLSv1.3-require-fail-post-handshake-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-7]
ExpectedResult = ServerFail
HandshakeMode = PostHandshakeAuth
# ===========================================================
[8-client-auth-TLSv1.3-require-post-handshake]
ssl_conf = 8-client-auth-TLSv1.3-require-post-handshake-ssl
[8-client-auth-TLSv1.3-require-post-handshake-ssl]
server = 8-client-auth-TLSv1.3-require-post-handshake-server
client = 8-client-auth-TLSv1.3-require-post-handshake-client
[8-client-auth-TLSv1.3-require-post-handshake-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = PSS+SHA256
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = RequestPostHandshake
[8-client-auth-TLSv1.3-require-post-handshake-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-8]
ExpectedClientCANames = empty
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
ExpectedClientSignType = RSA-PSS
ExpectedResult = Success
HandshakeMode = PostHandshakeAuth
# ===========================================================
[9-client-auth-TLSv1.3-require-non-empty-names-post-handshake]
ssl_conf = 9-client-auth-TLSv1.3-require-non-empty-names-post-handshake-ssl
[9-client-auth-TLSv1.3-require-non-empty-names-post-handshake-ssl]
server = 9-client-auth-TLSv1.3-require-non-empty-names-post-handshake-server
client = 9-client-auth-TLSv1.3-require-non-empty-names-post-handshake-client
[9-client-auth-TLSv1.3-require-non-empty-names-post-handshake-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ClientSignatureAlgorithms = PSS+SHA256
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = RequestPostHandshake
[9-client-auth-TLSv1.3-require-non-empty-names-post-handshake-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-9]
ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
ExpectedClientSignType = RSA-PSS
ExpectedResult = Success
HandshakeMode = PostHandshakeAuth
# ===========================================================
[10-client-auth-TLSv1.3-noroot-post-handshake]
ssl_conf = 10-client-auth-TLSv1.3-noroot-post-handshake-ssl
[10-client-auth-TLSv1.3-noroot-post-handshake-ssl]
server = 10-client-auth-TLSv1.3-noroot-post-handshake-server
client = 10-client-auth-TLSv1.3-noroot-post-handshake-client
[10-client-auth-TLSv1.3-noroot-post-handshake-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = RequirePostHandshake
[10-client-auth-TLSv1.3-noroot-post-handshake-client]
Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-10]
ExpectedResult = ServerFail
ExpectedServerAlert = UnknownCA
HandshakeMode = PostHandshakeAuth
# ===========================================================
[11-client-auth-TLSv1.3-request-force-client-post-handshake]
ssl_conf = 11-client-auth-TLSv1.3-request-force-client-post-handshake-ssl
[11-client-auth-TLSv1.3-request-force-client-post-handshake-ssl]
server = 11-client-auth-TLSv1.3-request-force-client-post-handshake-server
client = 11-client-auth-TLSv1.3-request-force-client-post-handshake-client
[11-client-auth-TLSv1.3-request-force-client-post-handshake-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = RequestPostHandshake
[11-client-auth-TLSv1.3-request-force-client-post-handshake-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-11]
ExpectedResult = Success
HandshakeMode = PostHandshakeAuth
client = 11-client-auth-TLSv1.3-request-force-client-post-handshake-client-extra
[11-client-auth-TLSv1.3-request-force-client-post-handshake-client-extra]
ForcePHA = Yes
# ===========================================================
[12-client-auth-TLSv1.3-request-force-server-post-handshake]
ssl_conf = 12-client-auth-TLSv1.3-request-force-server-post-handshake-ssl
[12-client-auth-TLSv1.3-request-force-server-post-handshake-ssl]
server = 12-client-auth-TLSv1.3-request-force-server-post-handshake-server
client = 12-client-auth-TLSv1.3-request-force-server-post-handshake-client
[12-client-auth-TLSv1.3-request-force-server-post-handshake-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = RequestPostHandshake
[12-client-auth-TLSv1.3-request-force-server-post-handshake-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-12]
ExpectedResult = ClientFail
HandshakeMode = PostHandshakeAuth
server = 12-client-auth-TLSv1.3-request-force-server-post-handshake-server-extra
[12-client-auth-TLSv1.3-request-force-server-post-handshake-server-extra]
ForcePHA = Yes
# ===========================================================
[13-client-auth-TLSv1.3-request-force-both-post-handshake]
ssl_conf = 13-client-auth-TLSv1.3-request-force-both-post-handshake-ssl
[13-client-auth-TLSv1.3-request-force-both-post-handshake-ssl]
server = 13-client-auth-TLSv1.3-request-force-both-post-handshake-server
client = 13-client-auth-TLSv1.3-request-force-both-post-handshake-client
[13-client-auth-TLSv1.3-request-force-both-post-handshake-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyMode = RequestPostHandshake
[13-client-auth-TLSv1.3-request-force-both-post-handshake-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-13]
ExpectedResult = Success
HandshakeMode = PostHandshakeAuth
server = 13-client-auth-TLSv1.3-request-force-both-post-handshake-server-extra
client = 13-client-auth-TLSv1.3-request-force-both-post-handshake-client-extra
[13-client-auth-TLSv1.3-request-force-both-post-handshake-server-extra]
ForcePHA = Yes
[13-client-auth-TLSv1.3-request-force-both-post-handshake-client-extra]
ForcePHA = Yes
test/ssl-tests/26-tls13_client_auth.conf.in
+293
View File
@@ -0,0 +1,293 @@
# -*- mode: perl; -*-
# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
## Test TLSv1.3 certificate authentication
## Similar to 04-client_auth.conf.in output, but specific for
## TLSv1.3 and post-handshake authentication
use strict;
use warnings;
package ssltests;
use OpenSSL::Test::Utils;
our @tests = (
{
name => "server-auth-TLSv1.3",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
},
test => {
"ExpectedResult" => "Success",
},
},
{
name => "client-auth-TLSv1.3-request",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"VerifyMode" => "Request",
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
},
test => {
"ExpectedResult" => "Success",
},
},
{
name => "client-auth-TLSv1.3-require-fail",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Require",
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
},
test => {
"ExpectedResult" => "ServerFail",
"ExpectedServerAlert" => "HandshakeFailure",
},
},
{
name => "client-auth-TLSv1.3-require",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"ClientSignatureAlgorithms" => "PSS+SHA256",
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Request",
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"ExpectedResult" => "Success",
"ExpectedClientCertType" => "RSA",
"ExpectedClientSignType" => "RSA-PSS",
"ExpectedClientSignHash" => "SHA256",
"ExpectedClientCANames" => "empty"
},
},
{
name => "client-auth-TLSv1.3-require-non-empty-names",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"ClientSignatureAlgorithms" => "PSS+SHA256",
"ClientCAFile" => test_pem("root-cert.pem"),
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Request",
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"ExpectedResult" => "Success",
"ExpectedClientCertType" => "RSA",
"ExpectedClientSignType" => "RSA-PSS",
"ExpectedClientSignHash" => "SHA256",
"ExpectedClientCANames" => test_pem("root-cert.pem"),
},
},
{
name => "client-auth-TLSv1.3-noroot",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"VerifyMode" => "Require",
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"ExpectedResult" => "ServerFail",
"ExpectedServerAlert" => "UnknownCA",
},
},
{
name => "client-auth-TLSv1.3-request-post-handshake",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"VerifyMode" => "RequestPostHandshake",
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
},
test => {
"ExpectedResult" => "ServerFail",
"HandshakeMode" => "PostHandshakeAuth",
},
},
{
name => "client-auth-TLSv1.3-require-fail-post-handshake",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "RequirePostHandshake",
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
},
test => {
"ExpectedResult" => "ServerFail",
"HandshakeMode" => "PostHandshakeAuth",
},
},
{
name => "client-auth-TLSv1.3-require-post-handshake",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"ClientSignatureAlgorithms" => "PSS+SHA256",
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "RequestPostHandshake",
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"ExpectedResult" => "Success",
"HandshakeMode" => "PostHandshakeAuth",
"ExpectedClientCertType" => "RSA",
"ExpectedClientSignType" => "RSA-PSS",
"ExpectedClientSignHash" => "SHA256",
"ExpectedClientCANames" => "empty"
},
},
{
name => "client-auth-TLSv1.3-require-non-empty-names-post-handshake",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"ClientSignatureAlgorithms" => "PSS+SHA256",
"ClientCAFile" => test_pem("root-cert.pem"),
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "RequestPostHandshake",
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"ExpectedResult" => "Success",
"HandshakeMode" => "PostHandshakeAuth",
"ExpectedClientCertType" => "RSA",
"ExpectedClientSignType" => "RSA-PSS",
"ExpectedClientSignHash" => "SHA256",
"ExpectedClientCANames" => test_pem("root-cert.pem"),
},
},
{
name => "client-auth-TLSv1.3-noroot-post-handshake",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"VerifyMode" => "RequirePostHandshake",
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"ExpectedResult" => "ServerFail",
"HandshakeMode" => "PostHandshakeAuth",
"ExpectedServerAlert" => "UnknownCA",
},
},
{
name => "client-auth-TLSv1.3-request-force-client-post-handshake",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"VerifyMode" => "RequestPostHandshake",
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
extra => {
"ForcePHA" => "Yes",
},
},
test => {
"ExpectedResult" => "Success",
"HandshakeMode" => "PostHandshakeAuth",
},
},
{
name => "client-auth-TLSv1.3-request-force-server-post-handshake",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"VerifyMode" => "RequestPostHandshake",
extra => {
"ForcePHA" => "Yes",
},
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
},
test => {
"ExpectedResult" => "ClientFail",
"HandshakeMode" => "PostHandshakeAuth",
},
},
{
name => "client-auth-TLSv1.3-request-force-both-post-handshake",
server => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
"VerifyMode" => "RequestPostHandshake",
extra => {
"ForcePHA" => "Yes",
},
},
client => {
"MinProtocol" => "TLSv1.3",
"MaxProtocol" => "TLSv1.3",
extra => {
"ForcePHA" => "Yes",
},
},
test => {
"ExpectedResult" => "Success",
"HandshakeMode" => "PostHandshakeAuth",
},
},
);
test/ssl-tests/protocol_version.pm
+144 -79
View File
@@ -17,15 +17,15 @@ use warnings;
use List::Util qw/max min/;
use OpenSSL::Test;
use OpenSSL::Test::Utils qw/anydisabled alldisabled/;
use OpenSSL::Test::Utils qw/anydisabled alldisabled disabled/;
setup("no_test_here");
my @tls_protocols = ("SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2");
my @tls_protocols = ("SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3");
# undef stands for "no limit".
my @min_tls_protocols = (undef, "SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2");
my @max_tls_protocols = ("SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", undef);
my @min_tls_protocols = (undef, "SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3");
my @max_tls_protocols = ("SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3", undef);
my @is_tls_disabled = anydisabled("ssl3", "tls1", "tls1_1", "tls1_2");
my @is_tls_disabled = anydisabled("ssl3", "tls1", "tls1_1", "tls1_2", "tls1_3");
my $min_tls_enabled; my $max_tls_enabled;
@@ -74,7 +74,7 @@ foreach my $i (0..$#dtls_protocols) {
sub no_tests {
my ($dtls) = @_;
return $dtls ? alldisabled("dtls1", "dtls1_2") :
alldisabled("ssl3", "tls1", "tls1_1", "tls1_2");
alldisabled("ssl3", "tls1", "tls1_1", "tls1_2", "tls1_3");
}
sub generate_version_tests {
@@ -96,35 +96,70 @@ sub generate_version_tests {
my @tests = ();
foreach my $c_min (0..$#min_protocols) {
my $c_max_min = $c_min == 0 ? 0 : $c_min - 1;
foreach my $c_max ($c_max_min..$#max_protocols) {
foreach my $s_min (0..$#min_protocols) {
my $s_max_min = $s_min == 0 ? 0 : $s_min - 1;
foreach my $s_max ($s_max_min..$#max_protocols) {
my ($result, $protocol) =
expected_result($c_min, $c_max, $s_min, $s_max,
$min_enabled, $max_enabled, \@protocols);
push @tests, {
"name" => "version-negotiation",
"client" => {
"MinProtocol" => $min_protocols[$c_min],
"MaxProtocol" => $max_protocols[$c_max],
},
"server" => {
"MinProtocol" => $min_protocols[$s_min],
"MaxProtocol" => $max_protocols[$s_max],
},
"test" => {
"ExpectedResult" => $result,
"ExpectedProtocol" => $protocol,
"Method" => $method,
}
};
for (my $sctp = 0; $sctp < ($dtls && !disabled("sctp") ? 2 : 1); $sctp++) {
foreach my $c_min (0..$#min_protocols) {
my $c_max_min = $c_min == 0 ? 0 : $c_min - 1;
foreach my $c_max ($c_max_min..$#max_protocols) {
foreach my $s_min (0..$#min_protocols) {
my $s_max_min = $s_min == 0 ? 0 : $s_min - 1;
foreach my $s_max ($s_max_min..$#max_protocols) {
my ($result, $protocol) =
expected_result($c_min, $c_max, $s_min, $s_max,
$min_enabled, $max_enabled,
\@protocols);
push @tests, {
"name" => "version-negotiation",
"client" => {
"MinProtocol" => $min_protocols[$c_min],
"MaxProtocol" => $max_protocols[$c_max],
},
"server" => {
"MinProtocol" => $min_protocols[$s_min],
"MaxProtocol" => $max_protocols[$s_max],
},
"test" => {
"ExpectedResult" => $result,
"ExpectedProtocol" => $protocol,
"Method" => $method,
}
};
$tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
}
}
}
}
}
return @tests if disabled("tls1_3") || disabled("tls1_2") || $dtls;
#Add some version/ciphersuite sanity check tests
push @tests, {
"name" => "ciphersuite-sanity-check-client",
"client" => {
#Offering only <=TLSv1.2 ciphersuites with TLSv1.3 should fail
"CipherString" => "AES128-SHA",
},
"server" => {
"MaxProtocol" => "TLSv1.2"
},
"test" => {
"ExpectedResult" => "ClientFail",
}
};
push @tests, {
"name" => "ciphersuite-sanity-check-server",
"client" => {
"CipherString" => "AES128-SHA",
"MaxProtocol" => "TLSv1.2"
},
"server" => {
#Allowing only <=TLSv1.2 ciphersuites with TLSv1.3 should fail
"CipherString" => "AES128-SHA",
},
"test" => {
"ExpectedResult" => "ServerFail",
}
};
return @tests;
}
@@ -137,6 +172,7 @@ sub generate_resumption_tests {
my @protocols = $dtls ? @dtls_protocols : @tls_protocols;
my $min_enabled = $dtls ? $min_dtls_enabled : $min_tls_enabled;
my $max_enabled = $dtls ? $max_dtls_enabled : $max_tls_enabled;
if (no_tests($dtls)) {
return;
@@ -146,10 +182,10 @@ sub generate_resumption_tests {
my @client_tests = ();
# Obtain the first session against a fixed-version server/client.
foreach my $original_protocol($min_enabled..$#protocols) {
foreach my $original_protocol($min_enabled..$max_enabled) {
# Upgrade or downgrade the server/client max version support and test
# that it upgrades, downgrades or resumes the session as well.
foreach my $resume_protocol($min_enabled..$#protocols) {
foreach my $resume_protocol($min_enabled..$max_enabled) {
my $resumption_expected;
# We should only resume on exact version match.
if ($original_protocol eq $resume_protocol) {
@@ -158,50 +194,74 @@ sub generate_resumption_tests {
$resumption_expected = "No";
}
foreach my $ticket ("SessionTicket", "-SessionTicket") {
# Client is flexible, server upgrades/downgrades.
push @server_tests, {
"name" => "resumption",
"client" => { },
"server" => {
"MinProtocol" => $protocols[$original_protocol],
"MaxProtocol" => $protocols[$original_protocol],
"Options" => $ticket,
},
"resume_server" => {
"MaxProtocol" => $protocols[$resume_protocol],
},
"test" => {
"ExpectedProtocol" => $protocols[$resume_protocol],
"Method" => $method,
"HandshakeMode" => "Resume",
"ResumptionExpected" => $resumption_expected,
}
};
# Server is flexible, client upgrades/downgrades.
push @client_tests, {
"name" => "resumption",
"client" => {
"MinProtocol" => $protocols[$original_protocol],
"MaxProtocol" => $protocols[$original_protocol],
},
"server" => {
"Options" => $ticket,
},
"resume_client" => {
"MaxProtocol" => $protocols[$resume_protocol],
},
"test" => {
"ExpectedProtocol" => $protocols[$resume_protocol],
"Method" => $method,
"HandshakeMode" => "Resume",
"ResumptionExpected" => $resumption_expected,
}
};
for (my $sctp = 0; $sctp < ($dtls && !disabled("sctp") ? 2 : 1);
$sctp++) {
foreach my $ticket ("SessionTicket", "-SessionTicket") {
# Client is flexible, server upgrades/downgrades.
push @server_tests, {
"name" => "resumption",
"client" => { },
"server" => {
"MinProtocol" => $protocols[$original_protocol],
"MaxProtocol" => $protocols[$original_protocol],
"Options" => $ticket,
},
"resume_server" => {
"MaxProtocol" => $protocols[$resume_protocol],
},
"test" => {
"ExpectedProtocol" => $protocols[$resume_protocol],
"Method" => $method,
"HandshakeMode" => "Resume",
"ResumptionExpected" => $resumption_expected,
}
};
$server_tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
# Server is flexible, client upgrades/downgrades.
push @client_tests, {
"name" => "resumption",
"client" => {
"MinProtocol" => $protocols[$original_protocol],
"MaxProtocol" => $protocols[$original_protocol],
},
"server" => {
"Options" => $ticket,
},
"resume_client" => {
"MaxProtocol" => $protocols[$resume_protocol],
},
"test" => {
"ExpectedProtocol" => $protocols[$resume_protocol],
"Method" => $method,
"HandshakeMode" => "Resume",
"ResumptionExpected" => $resumption_expected,
}
};
$client_tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
}
}
}
}
if (!disabled("tls1_3") && !$dtls) {
push @client_tests, {
"name" => "resumption-with-hrr",
"client" => {
},
"server" => {
"Curves" => "P-256"
},
"resume_client" => {
},
"test" => {
"ExpectedProtocol" => "TLSv1.3",
"Method" => "TLS",
"HandshakeMode" => "Resume",
"ResumptionExpected" => "Yes",
}
};
}
return (@server_tests, @client_tests);
}
@@ -224,9 +284,7 @@ sub expected_result {
if ($c_min > $c_max) {
# Client should fail to even send a hello.
# This results in an internal error since the server will be
# waiting for input that never arrives.
return ("InternalError", undef);
return ("ClientFail", undef);
} elsif ($s_min > $s_max) {
# Server has no protocols, should always fail.
return ("ServerFail", undef);
@@ -234,9 +292,16 @@ sub expected_result {
# Server doesn't support the client range.
return ("ServerFail", undef);
} elsif ($c_min > $s_max) {
# Server will try with a version that is lower than the lowest
# supported client version.
return ("ClientFail", undef);
my @prots = @$protocols;
if ($prots[$c_max] eq "TLSv1.3") {
# Client will have sent supported_versions, so server will know
# that there are no overlapping versions.
return ("ServerFail", undef);
} else {
# Server will try with a version that is lower than the lowest
# supported client version.
return ("ClientFail", undef);
}
} else {
# Server and client ranges overlap.
my $max_common = $s_max < $c_max ? $s_max : $c_max;