Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update - OpenSSL 1.1.1-pre7-dev

Browse Source
This commit is contained in:
Hakase
2018-05-23 23:52:41 +09:00
parent e8a0afd4a0
commit ef253190c7
624 changed files with 189420 additions and 8064 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/asn1_time_test.c
+2
View File
@@ -346,10 +346,12 @@ int setup_tests(void)
if (sizeof(time_t) > sizeof(uint32_t)) {
TEST_info("Adding 64-bit time_t tests");
ADD_ALL_TESTS(test_table_pos_64bit, OSSL_NELEM(tbl_testdata_pos_64bit));
#ifndef __hpux
if (!(t > 0) && ptm != NULL) {
TEST_info("Adding negative-sign 64-bit time_t tests");
ADD_ALL_TESTS(test_table_neg_64bit, OSSL_NELEM(tbl_testdata_neg_64bit));
}
#endif
}
ADD_ALL_TESTS(test_table_compare, OSSL_NELEM(tbl_compare_testdata));
return 1;
test/asynciotest.c
+4 -3
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL licenses, (the "License");
* you may not use this file except in compliance with the License.
@@ -42,7 +42,7 @@ struct async_ctrs {
unsigned int wctr;
};
static const BIO_METHOD *bio_f_async_filter()
static const BIO_METHOD *bio_f_async_filter(void)
{
if (methods_async == NULL) {
methods_async = BIO_meth_new(BIO_TYPE_ASYNC_FILTER, "Async filter");
@@ -299,7 +299,8 @@ static int test_asyncio(int test)
char buf[sizeof(testdata)];
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
&serverctx, &clientctx, cert, privkey)))
TLS1_VERSION, TLS_MAX_VERSION,
&serverctx, &clientctx, cert, privkey)))
goto end;
/*
test/asynctest.c
+5 -5
View File
@@ -87,7 +87,7 @@ static int blockpause(void *args)
return 1;
}
static int test_ASYNC_init_thread()
static int test_ASYNC_init_thread(void)
{
ASYNC_JOB *job1 = NULL, *job2 = NULL, *job3 = NULL;
int funcret1, funcret2, funcret3;
@@ -123,7 +123,7 @@ static int test_ASYNC_init_thread()
return 1;
}
static int test_ASYNC_start_job()
static int test_ASYNC_start_job(void)
{
ASYNC_JOB *job = NULL;
int funcret;
@@ -151,7 +151,7 @@ static int test_ASYNC_start_job()
return 1;
}
static int test_ASYNC_get_current_job()
static int test_ASYNC_get_current_job(void)
{
ASYNC_JOB *job = NULL;
int funcret;
@@ -178,7 +178,7 @@ static int test_ASYNC_get_current_job()
return 1;
}
static int test_ASYNC_WAIT_CTX_get_all_fds()
static int test_ASYNC_WAIT_CTX_get_all_fds(void)
{
ASYNC_JOB *job = NULL;
int funcret;
@@ -245,7 +245,7 @@ static int test_ASYNC_WAIT_CTX_get_all_fds()
return 1;
}
static int test_ASYNC_block_pause()
static int test_ASYNC_block_pause(void)
{
ASYNC_JOB *job = NULL;
int funcret;
test/bio_callback_test.c
+117
View File
@@ -0,0 +1,117 @@
/*
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include <string.h>
#include <openssl/bio.h>
#include "testutil.h"
#define MAXCOUNT 5
static int my_param_count;
static BIO *my_param_b[MAXCOUNT];
static int my_param_oper[MAXCOUNT];
static const char *my_param_argp[MAXCOUNT];
static int my_param_argi[MAXCOUNT];
static long my_param_argl[MAXCOUNT];
static long my_param_ret[MAXCOUNT];
static long my_bio_callback(BIO *b, int oper, const char *argp, int argi,
long argl, long ret)
{
if (my_param_count >= MAXCOUNT)
return -1;
my_param_b[my_param_count] = b;
my_param_oper[my_param_count] = oper;
my_param_argp[my_param_count] = argp;
my_param_argi[my_param_count] = argi;
my_param_argl[my_param_count] = argl;
my_param_ret[my_param_count] = ret;
my_param_count++;
return ret;
}
static int test_bio_callback(void)
{
int ok = 0;
BIO *bio;
int i;
char *test1 = "test";
char *test2 = "hello";
my_param_count = 0;
bio = BIO_new(BIO_s_mem());
if (bio == NULL)
goto err;
BIO_set_callback(bio, my_bio_callback);
i = BIO_write(bio, test1, 4);
if (!TEST_int_eq(i, 4)
|| !TEST_int_eq(my_param_count, 2)
|| !TEST_ptr_eq(my_param_b[0], bio)
|| !TEST_int_eq(my_param_oper[0], BIO_CB_WRITE)
|| !TEST_ptr_eq(my_param_argp[0], test1)
|| !TEST_int_eq(my_param_argi[0], 4)
|| !TEST_long_eq(my_param_argl[0], 0L)
|| !TEST_long_eq(my_param_ret[0], 1L)
|| !TEST_ptr_eq(my_param_b[1], bio)
|| !TEST_int_eq(my_param_oper[1], BIO_CB_WRITE | BIO_CB_RETURN)
|| !TEST_ptr_eq(my_param_argp[1], test1)
|| !TEST_int_eq(my_param_argi[1], 4)
|| !TEST_long_eq(my_param_argl[1], 0L)
|| !TEST_long_eq(my_param_ret[1], 4L))
goto err;
i = BIO_puts(bio, test2);
if (!TEST_int_eq(i, 5)
|| !TEST_int_eq(my_param_count, 4)
|| !TEST_ptr_eq(my_param_b[2], bio)
|| !TEST_int_eq(my_param_oper[2], BIO_CB_PUTS)
|| !TEST_ptr_eq(my_param_argp[2], test2)
|| !TEST_int_eq(my_param_argi[2], 0)
|| !TEST_long_eq(my_param_argl[2], 0L)
|| !TEST_long_eq(my_param_ret[2], 1L)
|| !TEST_ptr_eq(my_param_b[3], bio)
|| !TEST_int_eq(my_param_oper[3], BIO_CB_PUTS | BIO_CB_RETURN)
|| !TEST_ptr_eq(my_param_argp[3], test2)
|| !TEST_int_eq(my_param_argi[3], 0)
|| !TEST_long_eq(my_param_argl[3], 0L)
|| !TEST_long_eq(my_param_ret[3], 5L))
goto err;
i = BIO_free(bio);
if (!TEST_int_eq(i, 1)
|| !TEST_int_eq(my_param_count, 5)
|| !TEST_ptr_eq(my_param_b[4], bio)
|| !TEST_int_eq(my_param_oper[4], BIO_CB_FREE)
|| !TEST_ptr_eq(my_param_argp[4], NULL)
|| !TEST_int_eq(my_param_argi[4], 0)
|| !TEST_long_eq(my_param_argl[4], 0L)
|| !TEST_long_eq(my_param_ret[4], 1L))
goto finish;
ok = 1;
goto finish;
err:
BIO_free(bio);
finish:
/* This helps finding memory leaks with ASAN */
memset(my_param_b, 0, sizeof(my_param_b));
memset(my_param_argp, 0, sizeof(my_param_argp));
return ok;
}
int setup_tests(void)
{
ADD_TEST(test_bio_callback);
return 1;
}
test/bntest.c
+88 -3
View File
@@ -151,6 +151,78 @@ static int rand_neg(void)
}
static int test_swap(void)
{
BIGNUM *a = NULL, *b = NULL, *c = NULL, *d = NULL;
int top, cond, st = 0;
if (!TEST_ptr(a = BN_new())
|| !TEST_ptr(b = BN_new())
|| !TEST_ptr(c = BN_new())
|| !TEST_ptr(d = BN_new()))
goto err;
BN_bntest_rand(a, 1024, 1, 0);
BN_bntest_rand(b, 1024, 1, 0);
BN_copy(c, a);
BN_copy(d, b);
top = BN_num_bits(a)/BN_BITS2;
/* regular swap */
BN_swap(a, b);
if (!equalBN("swap", a, d)
|| !equalBN("swap", b, c))
goto err;
/* conditional swap: true */
cond = 1;
BN_consttime_swap(cond, a, b, top);
if (!equalBN("cswap true", a, c)
|| !equalBN("cswap true", b, d))
goto err;
/* conditional swap: false */
cond = 0;
BN_consttime_swap(cond, a, b, top);
if (!equalBN("cswap false", a, c)
|| !equalBN("cswap false", b, d))
goto err;
/* same tests but checking flag swap */
BN_set_flags(a, BN_FLG_CONSTTIME);
BN_swap(a, b);
if (!equalBN("swap, flags", a, d)
|| !equalBN("swap, flags", b, c)
|| !TEST_true(BN_get_flags(b, BN_FLG_CONSTTIME))
|| !TEST_false(BN_get_flags(a, BN_FLG_CONSTTIME)))
goto err;
cond = 1;
BN_consttime_swap(cond, a, b, top);
if (!equalBN("cswap true, flags", a, c)
|| !equalBN("cswap true, flags", b, d)
|| !TEST_true(BN_get_flags(a, BN_FLG_CONSTTIME))
|| !TEST_false(BN_get_flags(b, BN_FLG_CONSTTIME)))
goto err;
cond = 0;
BN_consttime_swap(cond, a, b, top);
if (!equalBN("cswap false, flags", a, c)
|| !equalBN("cswap false, flags", b, d)
|| !TEST_true(BN_get_flags(a, BN_FLG_CONSTTIME))
|| !TEST_false(BN_get_flags(b, BN_FLG_CONSTTIME)))
goto err;
st = 1;
err:
BN_free(a);
BN_free(b);
BN_free(c);
BN_free(d);
return st;
}
static int test_sub(void)
{
BIGNUM *a = NULL, *b = NULL, *c = NULL;
@@ -408,9 +480,21 @@ static int test_modexp_mont5(void)
BN_free(b);
b = BN_dup(a);
BN_MONT_CTX_set(mont, n, ctx);
BN_mod_mul_montgomery(c, a, a, mont, ctx);
BN_mod_mul_montgomery(d, a, b, mont, ctx);
if (!TEST_BN_eq(c, d))
if (!TEST_true(BN_mod_mul_montgomery(c, a, a, mont, ctx))
|| !TEST_true(BN_mod_mul_montgomery(d, a, b, mont, ctx))
|| !TEST_BN_eq(c, d))
goto err;
/* Regression test for bug in BN_from_montgomery_word */
BN_hex2bn(&a,
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF");
BN_hex2bn(&n,
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF");
BN_MONT_CTX_set(mont, n, ctx);
if (!TEST_false(BN_mod_mul_montgomery(d, a, a, mont, ctx)))
goto err;
/* Regression test for bug in rsaz_1024_mul_avx2 */
@@ -2106,6 +2190,7 @@ int setup_tests(void)
ADD_TEST(test_badmod);
ADD_TEST(test_expmodzero);
ADD_TEST(test_smallprime);
ADD_TEST(test_swap);
#ifndef OPENSSL_NO_EC2M
ADD_TEST(test_gf2m_add);
ADD_TEST(test_gf2m_mod);
test/build.info
+41 -2
View File
@@ -24,9 +24,11 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
ENDRAW[descrip.mms]
PROGRAMS_NO_INST=\
versions \
aborttest test_test \
sanitytest exdatatest bntest \
ectest ecstresstest ecdsatest gmdifftest pbelutest ideatest \
sm2sigtest sm2crypttest \
md2test \
hmactest \
rc2test rc4test rc5test \
@@ -40,13 +42,20 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
packettest asynctest secmemtest srptest memleaktest stack_test \
dtlsv1listentest ct_test threadstest afalgtest d2i_test \
ssl_test_ctx_test ssl_test x509aux cipherlist_test asynciotest \
bio_callback_test \
bioprinttest sslapitest dtlstest sslcorrupttest bio_enc_test \
pkey_meth_test pkey_meth_kdf_test uitest cipherbytes_test \
asn1_encode_test asn1_string_table_test \
x509_time_test x509_dup_cert_test x509_check_cert_pkey_test \
recordlentest drbgtest sslbuffertest \
recordlentest drbgtest drbg_cavs_test sslbuffertest \
time_offset_test pemtest ssl_cert_table_internal_test ciphername_test \
servername_test ocspapitest rsa_mp_test fatalerrtest tls13ccstest
servername_test ocspapitest rsa_mp_test fatalerrtest tls13ccstest \
sysdefaulttest
SOURCE[versions]=versions.c
INCLUDE[versions]=../include
DEPEND[versions]=../libcrypto
SOURCE[aborttest]=aborttest.c
INCLUDE[aborttest]=../include
@@ -80,6 +89,14 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
INCLUDE[ecdsatest]=../include
DEPEND[ecdsatest]=../libcrypto libtestutil.a
SOURCE[sm2sigtest]=sm2sigtest.c
INCLUDE[sm2sigtest]=../include
DEPEND[sm2sigtest]=../libcrypto libtestutil.a
SOURCE[sm2crypttest]=sm2crypttest.c
INCLUDE[sm2crypttest]=../include
DEPEND[sm2crypttest]=../libcrypto libtestutil.a
SOURCE[gmdifftest]=gmdifftest.c
INCLUDE[gmdifftest]=../include
DEPEND[gmdifftest]=../libcrypto libtestutil.a
@@ -280,6 +297,10 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
INCLUDE[asynciotest]=../include
DEPEND[asynciotest]=../libcrypto ../libssl libtestutil.a
SOURCE[bio_callback_test]=bio_callback_test.c
INCLUDE[bio_callback_test]=../include
DEPEND[bio_callback_test]=../libcrypto libtestutil.a
SOURCE[bioprinttest]=bioprinttest.c
INCLUDE[bioprinttest]=../include
DEPEND[bioprinttest]=../libcrypto libtestutil.a
@@ -324,6 +345,10 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
INCLUDE[drbgtest]=../include
DEPEND[drbgtest]=../libcrypto libtestutil.a
SOURCE[drbg_cavs_test]=drbg_cavs_test.c drbg_cavs_data.c
INCLUDE[drbg_cavs_test]=../include . ..
DEPEND[drbg_cavs_test]=../libcrypto libtestutil.a
SOURCE[x509_dup_cert_test]=x509_dup_cert_test.c
INCLUDE[x509_dup_cert_test]=../include
DEPEND[x509_dup_cert_test]=../libcrypto libtestutil.a
@@ -348,6 +373,13 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
INCLUDE[servername_test]=../include
DEPEND[servername_test]=../libcrypto ../libssl libtestutil.a
IF[{- !$disabled{cms} -}]
PROGRAMS_NO_INST=cmsapitest
SOURCE[cmsapitest]=cmsapitest.c
INCLUDE[cmsapitest]=../include
DEPEND[cmsapitest]=../libcrypto libtestutil.a
ENDIF
IF[{- !$disabled{psk} -}]
PROGRAMS_NO_INST=dtls_mtu_test
SOURCE[dtls_mtu_test]=dtls_mtu_test.c ssltestlib.c
@@ -358,7 +390,7 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
IF[{- !$disabled{shared} -}]
PROGRAMS_NO_INST=shlibloadtest
SOURCE[shlibloadtest]=shlibloadtest.c
INCLUDE[shlibloadtest]=../include
INCLUDE[shlibloadtest]=../include ../crypto/include
DEPEND[shlibloadtest]=libtestutil.a
ENDIF
@@ -499,6 +531,10 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
SOURCE[sslbuffertest]=sslbuffertest.c ssltestlib.c
INCLUDE[sslbuffertest]=../include
DEPEND[sslbuffertest]=../libcrypto ../libssl libtestutil.a
SOURCE[sysdefaulttest]=sysdefaulttest.c
INCLUDE[sysdefaulttest]=../include
DEPEND[sysdefaulttest]=../libcrypto ../libssl libtestutil.a
ENDIF
{-
@@ -507,8 +543,10 @@ ENDIF
use OpenSSL::Glob;
my @nogo_headers = ( "asn1_mac.h",
"opensslconf.h",
"__decc_include_prologue.h",
"__decc_include_epilogue.h" );
my @nogo_headers_re = ( qr/.*err\.h/ );
my @headerfiles = glob catfile($sourcedir,
updir(), "include", "openssl", "*.h");
@@ -516,6 +554,7 @@ ENDIF
my $name = basename($headerfile, ".h");
next if $disabled{$name};
next if grep { $_ eq lc("$name.h") } @nogo_headers;
next if grep { lc("$name.h") =~ m/$_/i } @nogo_headers_re;
$OUT .= <<"_____";
PROGRAMS_NO_INST=buildtest_$name
test/certs/mkcert.sh
+1 -1
View File
@@ -1,6 +1,6 @@
#! /bin/bash
#
# Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
# Copyright (c) 2016 Viktor Dukhovni <openssl-users@dukhovni.org>.
# All rights reserved.
#
test/cipherlist_test.c
+8 -8
View File
@@ -63,6 +63,13 @@ static CIPHERLIST_TEST_FIXTURE *set_up(const char *const test_case_name)
* are currently broken and should be considered mission impossible in libssl.
*/
static const uint32_t default_ciphers_in_order[] = {
#ifndef OPENSSL_NO_TLS1_3
TLS1_3_CK_AES_256_GCM_SHA384,
# if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
TLS1_3_CK_CHACHA20_POLY1305_SHA256,
# endif
TLS1_3_CK_AES_128_GCM_SHA256,
#endif
#ifndef OPENSSL_NO_TLS1_2
# ifndef OPENSSL_NO_EC
TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
@@ -127,13 +134,6 @@ static const uint32_t default_ciphers_in_order[] = {
TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
#endif
#ifndef OPENSSL_NO_TLS1_3
TLS1_3_CK_AES_256_GCM_SHA384,
# if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
TLS1_3_CK_CHACHA20_POLY1305_SHA256,
# endif
TLS1_3_CK_AES_128_GCM_SHA256,
#endif
#ifndef OPENSSL_NO_TLS1_2
TLS1_CK_RSA_WITH_AES_256_SHA256,
TLS1_CK_RSA_WITH_AES_128_SHA256,
@@ -215,7 +215,7 @@ static int test_default_cipherlist_explicit(void)
return result;
}
int setup_tests()
int setup_tests(void)
{
ADD_TEST(test_default_cipherlist_implicit);
ADD_TEST(test_default_cipherlist_explicit);
test/clienthellotest.c
+6 -3
View File
@@ -78,6 +78,8 @@ static int test_client_hello(int currtest)
ctx = SSL_CTX_new(TLS_method());
if (!TEST_ptr(ctx))
goto end;
if (!TEST_true(SSL_CTX_set_max_proto_version(ctx, TLS_MAX_VERSION)))
goto end;
switch(currtest) {
case TEST_SET_SESSION_TICK_DATA_VER_NEG:
@@ -97,8 +99,7 @@ static int test_client_hello(int currtest)
* ClientHello is already going to be quite long. To avoid getting one
* that is too long for this test we use a restricted ciphersuite list
*/
if (!TEST_true(SSL_CTX_set_cipher_list(ctx,
"TLS13-AES-128-GCM-SHA256")))
if (!TEST_true(SSL_CTX_set_cipher_list(ctx, "")))
goto end;
/* Fall through */
case TEST_ADD_PADDING:
@@ -121,7 +122,9 @@ static int test_client_hello(int currtest)
* not need padding.
*/
} else if (!TEST_true(SSL_CTX_set_cipher_list(ctx,
"AES128-SHA:TLS13-AES-128-GCM-SHA256"))) {
"AES128-SHA"))
|| !TEST_true(SSL_CTX_set_ciphersuites(ctx,
"TLS_AES_128_GCM_SHA256"))) {
goto end;
}
break;
test/cmsapitest.c
+93
View File
@@ -0,0 +1,93 @@
#include <string.h>
#include <openssl/cms.h>
#include <openssl/bio.h>
#include <openssl/x509.h>
#include <openssl/pem.h>
#include "testutil.h"
static X509 *cert = NULL;
static EVP_PKEY *privkey = NULL;
static int test_encrypt_decrypt(void)
{
int testresult = 0;
STACK_OF(X509) *certstack = sk_X509_new_null();
const char *msg = "Hello world";
BIO *msgbio = BIO_new_mem_buf(msg, strlen(msg));
BIO *outmsgbio = BIO_new(BIO_s_mem());
CMS_ContentInfo* content = NULL;
char buf[80];
if (!TEST_ptr(certstack) || !TEST_ptr(msgbio) || !TEST_ptr(outmsgbio))
goto end;
if (!TEST_int_gt(sk_X509_push(certstack, cert), 0))
goto end;
content = CMS_encrypt(certstack, msgbio, EVP_aes_128_cbc(), CMS_TEXT);
if (!TEST_ptr(content))
goto end;
if (!TEST_true(CMS_decrypt(content, privkey, cert, NULL, outmsgbio,
CMS_TEXT)))
goto end;
/* Check we got the message we first started with */
if (!TEST_int_eq(BIO_gets(outmsgbio, buf, sizeof(buf)), strlen(msg))
|| !TEST_int_eq(strcmp(buf, msg), 0))
goto end;
testresult = 1;
end:
sk_X509_free(certstack);
BIO_free(msgbio);
BIO_free(outmsgbio);
CMS_ContentInfo_free(content);
return testresult;
}
int setup_tests(void)
{
char *certin = NULL, *privkeyin = NULL;
BIO *certbio = NULL, *privkeybio = NULL;
if (!TEST_ptr(certin = test_get_argument(0))
|| !TEST_ptr(privkeyin = test_get_argument(1)))
return 0;
certbio = BIO_new_file(certin, "r");
if (!TEST_ptr(certbio))
return 0;
if (!TEST_true(PEM_read_bio_X509(certbio, &cert, NULL, NULL))) {
BIO_free(certbio);
return 0;
}
BIO_free(certbio);
privkeybio = BIO_new_file(privkeyin, "r");
if (!TEST_ptr(privkeybio)) {
X509_free(cert);
cert = NULL;
return 0;
}
if (!TEST_true(PEM_read_bio_PrivateKey(privkeybio, &privkey, NULL, NULL))) {
BIO_free(privkeybio);
X509_free(cert);
cert = NULL;
return 0;
}
BIO_free(privkeybio);
ADD_TEST(test_encrypt_decrypt);
return 1;
}
void cleanup_tests(void)
{
X509_free(cert);
EVP_PKEY_free(privkey);
}
test/conf_include_test.c
+1 -1
View File
@@ -30,7 +30,7 @@
#else
/* the test does not work without chdir() */
# define chdir(x) (-1);
# define DIRSEP ""
# define DIRSEP "/"
# define DIRSEP_PRESERVE 0
#endif
test/ctype_internal_test.c
+1 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
test/dhtest.c
+85
View File
@@ -26,6 +26,11 @@ static int cb(int p, int n, BN_GENCB *arg);
static int dh_test(void)
{
DH *dh;
BIGNUM *p, *q, *g;
const BIGNUM *p2, *q2, *g2;
BIGNUM *priv_key;
const BIGNUM *pub_key2, *priv_key2;
BN_GENCB *_cb = NULL;
DH *a = NULL;
DH *b = NULL;
@@ -39,6 +44,78 @@ static int dh_test(void)
int i, alen, blen, clen, aout, bout, cout;
int ret = 0;
if (!TEST_ptr(dh = DH_new())
|| !TEST_ptr(p = BN_new())
|| !TEST_ptr(q = BN_new())
|| !TEST_ptr(g = BN_new())
|| !TEST_ptr(priv_key = BN_new()))
goto err;
/*
* I) basic tests
*/
/* using a small predefined Sophie Germain DH group with generator 3 */
if (!TEST_true(BN_set_word(p, 4079L))
|| !TEST_true(BN_set_word(q, 2039L))
|| !TEST_true(BN_set_word(g, 3L))
|| !TEST_true(DH_set0_pqg(dh, p, q, g)))
goto err;
/* test the combined getter for p, q, and g */
DH_get0_pqg(dh, &p2, &q2, &g2);
if (!TEST_ptr_eq(p2, p)
|| !TEST_ptr_eq(q2, q)
|| !TEST_ptr_eq(g2, g))
goto err;
/* test the simple getters for p, q, and g */
if (!TEST_ptr_eq(DH_get0_p(dh), p2)
|| !TEST_ptr_eq(DH_get0_q(dh), q2)
|| !TEST_ptr_eq(DH_get0_g(dh), g2))
goto err;
/* set the private key only*/
if (!TEST_true(BN_set_word(priv_key, 1234L))
|| !TEST_true(DH_set0_key(dh, NULL, priv_key)))
goto err;
/* test the combined getter for pub_key and priv_key */
DH_get0_key(dh, &pub_key2, &priv_key2);
if (!TEST_ptr_eq(pub_key2, NULL)
|| !TEST_ptr_eq(priv_key2, priv_key))
goto err;
/* test the simple getters for pub_key and priv_key */
if (!TEST_ptr_eq(DH_get0_pub_key(dh), pub_key2)
|| !TEST_ptr_eq(DH_get0_priv_key(dh), priv_key2))
goto err;
/* now generate a key pair ... */
if (!DH_generate_key(dh))
goto err;
/* ... and check whether the private key was reused: */
/* test it with the combined getter for pub_key and priv_key */
DH_get0_key(dh, &pub_key2, &priv_key2);
if (!TEST_ptr(pub_key2)
|| !TEST_ptr_eq(priv_key2, priv_key))
goto err;
/* test it the simple getters for pub_key and priv_key */
if (!TEST_ptr_eq(DH_get0_pub_key(dh), pub_key2)
|| !TEST_ptr_eq(DH_get0_priv_key(dh), priv_key2))
goto err;
/* check whether the public key was calculated correclty */
TEST_uint_eq(BN_get_word(pub_key2), 3331L);
/*
* II) key generation
*/
/* generate a DH group ... */
if (!TEST_ptr(_cb = BN_GENCB_new()))
goto err;
BN_GENCB_set(_cb, &cb, NULL);
@@ -47,6 +124,7 @@ static int dh_test(void)
DH_GENERATOR_5, _cb)))
goto err;
/* ... and check whether it is valid */
if (!DH_check(a, &i))
goto err;
if (!TEST_false(i & DH_CHECK_P_NOT_PRIME)
@@ -57,6 +135,7 @@ static int dh_test(void)
DH_get0_pqg(a, &ap, NULL, &ag);
/* now create another copy of the DH group for the peer */
if (!TEST_ptr(b = DH_new()))
goto err;
@@ -66,6 +145,10 @@ static int dh_test(void)
goto err;
bp = bg = NULL;
/*
* III) simulate a key exchange
*/
if (!DH_generate_key(a))
goto err;
DH_get0_key(a, &apub_key, NULL);
@@ -114,6 +197,8 @@ static int dh_test(void)
BN_free(bg);
BN_free(cpriv_key);
BN_GENCB_free(_cb);
DH_free(dh);
return ret;
}
test/drbg_cavs_data.c
+170320
View File
File diff suppressed because it is too large Load Diff
test/drbg_cavs_data.h
+82
View File
@@ -0,0 +1,82 @@
/*
* Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
/*
* Known answer tests (KAT) for NIST SP800-90A DRBGs.
*/
#include <stddef.h>
#ifndef DRBG_CAVS_DATA_H
# define DRBG_CAVS_DATA_H
enum drbg_kat_type {
NO_RESEED,
PR_FALSE,
PR_TRUE
};
enum drbg_df {
USE_DF,
NO_DF,
NA
};
struct drbg_kat_no_reseed {
size_t count;
const unsigned char *entropyin;
const unsigned char *nonce;
const unsigned char *persstr;
const unsigned char *addin1;
const unsigned char *addin2;
const unsigned char *retbytes;
};
struct drbg_kat_pr_false {
size_t count;
const unsigned char *entropyin;
const unsigned char *nonce;
const unsigned char *persstr;
const unsigned char *entropyinreseed;
const unsigned char *addinreseed;
const unsigned char *addin1;
const unsigned char *addin2;
const unsigned char *retbytes;
};
struct drbg_kat_pr_true {
size_t count;
const unsigned char *entropyin;
const unsigned char *nonce;
const unsigned char *persstr;
const unsigned char *entropyinpr1;
const unsigned char *addin1;
const unsigned char *entropyinpr2;
const unsigned char *addin2;
const unsigned char *retbytes;
};
struct drbg_kat {
enum drbg_kat_type type;
enum drbg_df df;
int nid;
size_t entropyinlen;
size_t noncelen;
size_t persstrlen;
size_t addinlen;
size_t retbyteslen;
const void *t;
};
extern const struct drbg_kat *drbg_test[];
extern const size_t drbg_test_nelem;
#endif
test/drbg_cavs_test.c
+287
View File
@@ -0,0 +1,287 @@
/*
* Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <string.h>
#include "internal/nelem.h"
#include <openssl/crypto.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include <openssl/obj_mac.h>
#include <openssl/evp.h>
#include <openssl/aes.h>
#include "../crypto/rand/rand_lcl.h"
#include "testutil.h"
#include "drbg_cavs_data.h"
static int app_data_index;
typedef struct test_ctx_st {
const unsigned char *entropy;
size_t entropylen;
int entropycnt;
const unsigned char *nonce;
size_t noncelen;
int noncecnt;
} TEST_CTX;
static size_t kat_entropy(RAND_DRBG *drbg, unsigned char **pout,
int entropy, size_t min_len, size_t max_len,
int prediction_resistance)
{
TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_ex_data(drbg, app_data_index);
t->entropycnt++;
*pout = (unsigned char *)t->entropy;
return t->entropylen;
}
static size_t kat_nonce(RAND_DRBG *drbg, unsigned char **pout,
int entropy, size_t min_len, size_t max_len)
{
TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_ex_data(drbg, app_data_index);
t->noncecnt++;
*pout = (unsigned char *)t->nonce;
return t->noncelen;
}
/*
* Do a single NO_RESEED KAT:
*
* Instantiate
* Generate Random Bits (pr=false)
* Generate Random Bits (pr=false)
* Uninstantiate
*
* Return 0 on failure.
*/
static int single_kat_no_reseed(const struct drbg_kat *td)
{
struct drbg_kat_no_reseed *data = (struct drbg_kat_no_reseed *)td->t;
RAND_DRBG *drbg = NULL;
unsigned char *buff = NULL;
unsigned int flags = 0;
int failures = 0;
TEST_CTX t;
if (td->df != USE_DF)
flags |= RAND_DRBG_FLAG_CTR_NO_DF;
if (!TEST_ptr(drbg = RAND_DRBG_new(td->nid, flags, NULL)))
return 0;
if (!TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
kat_nonce, NULL))) {
failures++;
goto err;
}
memset(&t, 0, sizeof(t));
t.entropy = data->entropyin;
t.entropylen = td->entropyinlen;
t.nonce = data->nonce;
t.noncelen = td->noncelen;
RAND_DRBG_set_ex_data(drbg, app_data_index, &t);
buff = OPENSSL_malloc(td->retbyteslen);
if (buff == NULL)
goto err;
if (!TEST_true(RAND_DRBG_instantiate(drbg, data->persstr, td->persstrlen))
|| !TEST_true(RAND_DRBG_generate(drbg, buff, td->retbyteslen, 0,
data->addin1, td->addinlen))
|| !TEST_true(RAND_DRBG_generate(drbg, buff, td->retbyteslen, 0,
data->addin2, td->addinlen))
|| !TEST_true(RAND_DRBG_uninstantiate(drbg))
|| !TEST_mem_eq(data->retbytes, td->retbyteslen, buff,
td->retbyteslen))
failures++;
err:
if (buff != NULL)
OPENSSL_free(buff);
if (drbg != NULL) {
RAND_DRBG_uninstantiate(drbg);
RAND_DRBG_free(drbg);
}
return failures == 0;
}
/*-
* Do a single PR_FALSE KAT:
*
* Instantiate
* Reseed
* Generate Random Bits (pr=false)
* Generate Random Bits (pr=false)
* Uninstantiate
*
* Return 0 on failure.
*/
static int single_kat_pr_false(const struct drbg_kat *td)
{
struct drbg_kat_pr_false *data = (struct drbg_kat_pr_false *)td->t;
RAND_DRBG *drbg = NULL;
unsigned char *buff = NULL;
unsigned int flags = 0;
int failures = 0;
TEST_CTX t;
if (td->df != USE_DF)
flags |= RAND_DRBG_FLAG_CTR_NO_DF;
if (!TEST_ptr(drbg = RAND_DRBG_new(td->nid, flags, NULL)))
return 0;
if (!TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
kat_nonce, NULL))) {
failures++;
goto err;
}
memset(&t, 0, sizeof(t));
t.entropy = data->entropyin;
t.entropylen = td->entropyinlen;
t.nonce = data->nonce;
t.noncelen = td->noncelen;
RAND_DRBG_set_ex_data(drbg, app_data_index, &t);
buff = OPENSSL_malloc(td->retbyteslen);
if (buff == NULL)
goto err;
if (!TEST_true(RAND_DRBG_instantiate(drbg, data->persstr, td->persstrlen)))
failures++;
t.entropy = data->entropyinreseed;
t.entropylen = td->entropyinlen;
if (!TEST_true(RAND_DRBG_reseed(drbg, data->addinreseed, td->addinlen, 0))
|| !TEST_true(RAND_DRBG_generate(drbg, buff, td->retbyteslen, 0,
data->addin1, td->addinlen))
|| !TEST_true(RAND_DRBG_generate(drbg, buff, td->retbyteslen, 0,
data->addin2, td->addinlen))
|| !TEST_true(RAND_DRBG_uninstantiate(drbg))
|| !TEST_mem_eq(data->retbytes, td->retbyteslen, buff,
td->retbyteslen))
failures++;
err:
if (buff != NULL)
OPENSSL_free(buff);
if (drbg != NULL) {
RAND_DRBG_uninstantiate(drbg);
RAND_DRBG_free(drbg);
}
return failures == 0;
}
/*-
* Do a single PR_TRUE KAT:
*
* Instantiate
* Generate Random Bits (pr=true)
* Generate Random Bits (pr=true)
* Uninstantiate
*
* Return 0 on failure.
*/
static int single_kat_pr_true(const struct drbg_kat *td)
{
struct drbg_kat_pr_true *data = (struct drbg_kat_pr_true *)td->t;
RAND_DRBG *drbg = NULL;
unsigned char *buff = NULL;
unsigned int flags = 0;
int failures = 0;
TEST_CTX t;
if (td->df != USE_DF)
flags |= RAND_DRBG_FLAG_CTR_NO_DF;
if (!TEST_ptr(drbg = RAND_DRBG_new(td->nid, flags, NULL)))
return 0;
if (!TEST_true(RAND_DRBG_set_callbacks(drbg, kat_entropy, NULL,
kat_nonce, NULL))) {
failures++;
goto err;
}
memset(&t, 0, sizeof(t));
t.nonce = data->nonce;
t.noncelen = td->noncelen;
t.entropy = data->entropyin;
t.entropylen = td->entropyinlen;
RAND_DRBG_set_ex_data(drbg, app_data_index, &t);
buff = OPENSSL_malloc(td->retbyteslen);
if (buff == NULL)
goto err;
if (!TEST_true(RAND_DRBG_instantiate(drbg, data->persstr, td->persstrlen)))
failures++;
t.entropy = data->entropyinpr1;
t.entropylen = td->entropyinlen;
if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->retbyteslen, 1,
data->addin1, td->addinlen)))
failures++;
t.entropy = data->entropyinpr2;
t.entropylen = td->entropyinlen;
if (!TEST_true(RAND_DRBG_generate(drbg, buff, td->retbyteslen, 1,
data->addin2, td->addinlen))
|| !TEST_true(RAND_DRBG_uninstantiate(drbg))
|| !TEST_mem_eq(data->retbytes, td->retbyteslen, buff,
td->retbyteslen))
failures++;
err:
if (buff != NULL)
OPENSSL_free(buff);
if (drbg != NULL) {
RAND_DRBG_uninstantiate(drbg);
RAND_DRBG_free(drbg);
}
return failures == 0;
}
static int test_cavs_kats(int i)
{
const struct drbg_kat *td = drbg_test[i];
int rv = 0;
switch (td->type) {
case NO_RESEED:
if (!single_kat_no_reseed(td))
goto err;
break;
case PR_FALSE:
if (!single_kat_pr_false(td))
goto err;
break;
case PR_TRUE:
if (!single_kat_pr_true(td))
goto err;
break;
default: /* cant happen */
goto err;
}
rv = 1;
err:
return rv;
}
int setup_tests(void)
{
app_data_index = RAND_DRBG_get_ex_new_index(0L, NULL, NULL, NULL, NULL);
ADD_ALL_TESTS(test_cavs_kats, drbg_test_nelem);
return 1;
}
test/drbgtest.c
+190 -11
View File
@@ -16,6 +16,11 @@
#include <openssl/evp.h>
#include <openssl/aes.h>
#include "../crypto/rand/rand_lcl.h"
#include "../crypto/include/internal/rand_int.h"
#if defined(_WIN32)
# include <windows.h>
#endif
#include "testutil.h"
#include "drbgtest.h"
@@ -118,7 +123,8 @@ typedef struct test_ctx_st {
} TEST_CTX;
static size_t kat_entropy(RAND_DRBG *drbg, unsigned char **pout,
int entropy, size_t min_len, size_t max_len)
int entropy, size_t min_len, size_t max_len,
int prediction_resistance)
{
TEST_CTX *t = (TEST_CTX *)RAND_DRBG_get_ex_data(drbg, app_data_index);
@@ -182,7 +188,7 @@ static int single_kat(DRBG_SELFTEST_DATA *td)
/* Reseed DRBG with test entropy and additional input */
t.entropy = td->entropyreseed;
t.entropylen = td->entropyreseedlen;
if (!TEST_true(RAND_DRBG_reseed(drbg, td->adinreseed, td->adinreseedlen)
if (!TEST_true(RAND_DRBG_reseed(drbg, td->adinreseed, td->adinreseedlen, 0)
|| !TEST_true(RAND_DRBG_generate(drbg, buff, td->kat2len, 0,
td->adin2, td->adin2len))
|| !TEST_mem_eq(td->kat2, td->kat2len, buff, td->kat2len)))
@@ -415,12 +421,12 @@ static int error_check(DRBG_SELFTEST_DATA *td)
/* Test explicit reseed with too large additional input */
if (!init(drbg, td, &t)
|| RAND_DRBG_reseed(drbg, td->adin, drbg->max_adinlen + 1) > 0)
|| RAND_DRBG_reseed(drbg, td->adin, drbg->max_adinlen + 1, 0) > 0)
goto err;
/* Test explicit reseed with entropy source failure */
t.entropylen = 0;
if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen), 0)
if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0), 0)
|| !uninstantiate(drbg))
goto err;
@@ -428,7 +434,7 @@ static int error_check(DRBG_SELFTEST_DATA *td)
if (!init(drbg, td, &t))
goto err;
t.entropylen = drbg->max_entropylen + 1;
if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen), 0)
if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0), 0)
|| !uninstantiate(drbg))
goto err;
@@ -436,7 +442,7 @@ static int error_check(DRBG_SELFTEST_DATA *td)
if (!init(drbg, td, &t))
goto err;
t.entropylen = drbg->min_entropylen - 1;
if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen), 0)
if (!TEST_int_le(RAND_DRBG_reseed(drbg, td->adin, td->adinlen, 0), 0)
|| !uninstantiate(drbg))
goto err;
@@ -504,7 +510,8 @@ static HOOK_CTX *get_hook_ctx(RAND_DRBG *drbg)
/* Intercepts and counts calls to the get_entropy() callback */
static size_t get_entropy_hook(RAND_DRBG *drbg, unsigned char **pout,
int entropy, size_t min_len, size_t max_len)
int entropy, size_t min_len, size_t max_len,
int prediction_resistance)
{
size_t ret;
HOOK_CTX *ctx = get_hook_ctx(drbg);
@@ -512,8 +519,8 @@ static size_t get_entropy_hook(RAND_DRBG *drbg, unsigned char **pout,
if (ctx->fail != 0)
return 0;
ret = ctx->get_entropy(
drbg, pout, entropy, min_len, max_len);
ret = ctx->get_entropy(drbg, pout, entropy, min_len, max_len,
prediction_resistance);
if (ret != 0)
ctx->reseed_count++;
@@ -547,7 +554,7 @@ static void reset_hook_ctx(HOOK_CTX *ctx)
}
/* Resets all drbg hook contexts */
static void reset_drbg_hook_ctx()
static void reset_drbg_hook_ctx(void)
{
reset_hook_ctx(&master_ctx);
reset_hook_ctx(&public_ctx);
@@ -685,13 +692,28 @@ static int test_rand_reseed(void)
|| !TEST_ptr_eq(private->parent, master))
return 0;
/* uninstantiate the three global DRBGs */
RAND_DRBG_uninstantiate(private);
RAND_DRBG_uninstantiate(public);
RAND_DRBG_uninstantiate(master);
/* Install hooks for the following tests */
hook_drbg(master, &master_ctx);
hook_drbg(public, &public_ctx);
hook_drbg(private, &private_ctx);
/*
* Test initial state of shared DRBs
* Test initial seeding of shared DRBGs
*/
if (!TEST_true(test_drbg_reseed(1, master, public, private, 1, 1, 1)))
goto error;
reset_drbg_hook_ctx();
/*
* Test initial state of shared DRBGs
*/
if (!TEST_true(test_drbg_reseed(1, master, public, private, 0, 0, 0)))
goto error;
@@ -760,6 +782,159 @@ error:
return rv;
}
#if defined(OPENSSL_THREADS)
static int multi_thread_rand_bytes_succeeded = 1;
static int multi_thread_rand_priv_bytes_succeeded = 1;
static void run_multi_thread_test(void)
{
unsigned char buf[256];
time_t start = time(NULL);
RAND_DRBG *public, *private;
public = RAND_DRBG_get0_public();
private = RAND_DRBG_get0_private();
RAND_DRBG_set_reseed_time_interval(public, 1);
RAND_DRBG_set_reseed_time_interval(private, 1);
do {
if (RAND_bytes(buf, sizeof(buf)) <= 0)
multi_thread_rand_bytes_succeeded = 0;
if (RAND_priv_bytes(buf, sizeof(buf)) <= 0)
multi_thread_rand_priv_bytes_succeeded = 0;
}
while(time(NULL) - start < 5);
}
# if defined(OPENSSL_SYS_WINDOWS)
typedef HANDLE thread_t;
static DWORD WINAPI thread_run(LPVOID arg)
{
run_multi_thread_test();
return 0;
}
static int run_thread(thread_t *t)
{
*t = CreateThread(NULL, 0, thread_run, NULL, 0, NULL);
return *t != NULL;
}
static int wait_for_thread(thread_t thread)
{
return WaitForSingleObject(thread, INFINITE) == 0;
}
# else
typedef pthread_t thread_t;
static void *thread_run(void *arg)
{
run_multi_thread_test();
return NULL;
}
static int run_thread(thread_t *t)
{
return pthread_create(t, NULL, thread_run, NULL) == 0;
}
static int wait_for_thread(thread_t thread)
{
return pthread_join(thread, NULL) == 0;
}
# endif
/*
* The main thread will also run the test, so we'll have THREADS+1 parallel
* tests running
*/
# define THREADS 3
static int test_multi_thread(void)
{
thread_t t[THREADS];
int i;
for (i = 0; i < THREADS; i++)
run_thread(&t[i]);
run_multi_thread_test();
for (i = 0; i < THREADS; i++)
wait_for_thread(t[i]);
if (!TEST_true(multi_thread_rand_bytes_succeeded))
return 0;
if (!TEST_true(multi_thread_rand_priv_bytes_succeeded))
return 0;
return 1;
}
#endif
/*
* This function only returns the entropy already added with RAND_add(),
* and does not get entropy from the OS.
*
* Returns 0 on failure and the size of the buffer on success.
*/
static size_t get_pool_entropy(RAND_DRBG *drbg,
unsigned char **pout,
int entropy, size_t min_len, size_t max_len,
int prediction_resistance)
{
if (drbg->pool == NULL)
return 0;
if (drbg->pool->entropy < (size_t)entropy || drbg->pool->len < min_len
|| drbg->pool->len > max_len)
return 0;
*pout = drbg->pool->buffer;
return drbg->pool->len;
}
/*
* Clean up the entropy that get_pool_entropy() returned.
*/
static void cleanup_pool_entropy(RAND_DRBG *drbg, unsigned char *out, size_t outlen)
{
OPENSSL_secure_clear_free(drbg->pool->buffer, drbg->pool->max_len);
OPENSSL_free(drbg->pool);
drbg->pool = NULL;
}
/*
* Test that instantiating works when OS entropy is not available and that
* RAND_add() is enough to reseed it.
*/
static int test_rand_add(void)
{
RAND_DRBG *master = RAND_DRBG_get0_master();
RAND_DRBG_get_entropy_fn old_get_entropy = master->get_entropy;
RAND_DRBG_cleanup_entropy_fn old_cleanup_entropy = master->cleanup_entropy;
int rv = 0;
unsigned char rand_add_buf[256];
master->get_entropy = get_pool_entropy;
master->cleanup_entropy = cleanup_pool_entropy;
master->reseed_counter++;
RAND_DRBG_uninstantiate(master);
memset(rand_add_buf, 0xCD, sizeof(rand_add_buf));
RAND_add(rand_add_buf, sizeof(rand_add_buf), sizeof(rand_add_buf));
if (!TEST_true(RAND_DRBG_instantiate(master, NULL, 0)))
goto error;
rv = 1;
error:
master->get_entropy = old_get_entropy;
master->cleanup_entropy = old_cleanup_entropy;
return rv;
}
int setup_tests(void)
{
@@ -768,5 +943,9 @@ int setup_tests(void)
ADD_ALL_TESTS(test_kats, OSSL_NELEM(drbg_test));
ADD_ALL_TESTS(test_error_checks, OSSL_NELEM(drbg_test));
ADD_TEST(test_rand_reseed);
ADD_TEST(test_rand_add);
#if defined(OPENSSL_THREADS)
ADD_TEST(test_multi_thread);
#endif
return 1;
}
test/dtls_mtu_test.c
+1 -1
View File
@@ -189,7 +189,7 @@ static int run_mtu_tests(void)
return ret;
}
int setup_tests()
int setup_tests(void)
{
ADD_TEST(run_mtu_tests);
return 1;
test/dtlstest.c
+133 -4
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -46,7 +46,7 @@ static unsigned int timer_cb(SSL *s, unsigned int timer_us)
++timer_cb_count;
if (timer_us == 0)
return 1000000;
return 50000;
else
return 2 * timer_us;
}
@@ -61,8 +61,9 @@ static int test_dtls_unprocessed(int testidx)
timer_cb_count = 0;
if (!TEST_true(create_ssl_ctx_pair(DTLS_server_method(),
DTLS_client_method(), &sctx,
&cctx, cert, privkey)))
DTLS_client_method(),
DTLS1_VERSION, DTLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
return 0;
if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "AES128-SHA")))
@@ -113,6 +114,132 @@ static int test_dtls_unprocessed(int testidx)
return testresult;
}
#define CLI_TO_SRV_EPOCH_0_RECS 3
#define CLI_TO_SRV_EPOCH_1_RECS 1
#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
# define SRV_TO_CLI_EPOCH_0_RECS 12
#else
/*
* In this case we have no ServerKeyExchange message, because we don't have
* ECDHE or DHE. When it is present it gets fragmented into 3 records in this
* test.
*/
# define SRV_TO_CLI_EPOCH_0_RECS 9
#endif
#define SRV_TO_CLI_EPOCH_1_RECS 1
#define TOTAL_FULL_HAND_RECORDS \
(CLI_TO_SRV_EPOCH_0_RECS + CLI_TO_SRV_EPOCH_1_RECS + \
SRV_TO_CLI_EPOCH_0_RECS + SRV_TO_CLI_EPOCH_1_RECS)
#define CLI_TO_SRV_RESUME_EPOCH_0_RECS 3
#define CLI_TO_SRV_RESUME_EPOCH_1_RECS 1
#define SRV_TO_CLI_RESUME_EPOCH_0_RECS 2
#define SRV_TO_CLI_RESUME_EPOCH_1_RECS 1
#define TOTAL_RESUME_HAND_RECORDS \
(CLI_TO_SRV_RESUME_EPOCH_0_RECS + CLI_TO_SRV_RESUME_EPOCH_1_RECS + \
SRV_TO_CLI_RESUME_EPOCH_0_RECS + SRV_TO_CLI_RESUME_EPOCH_1_RECS)
#define TOTAL_RECORDS (TOTAL_FULL_HAND_RECORDS + TOTAL_RESUME_HAND_RECORDS)
static int test_dtls_drop_records(int idx)
{
SSL_CTX *sctx = NULL, *cctx = NULL;
SSL *serverssl = NULL, *clientssl = NULL;
BIO *c_to_s_fbio, *mempackbio;
int testresult = 0;
int epoch = 0;
SSL_SESSION *sess = NULL;
int cli_to_srv_epoch0, cli_to_srv_epoch1, srv_to_cli_epoch0;
if (!TEST_true(create_ssl_ctx_pair(DTLS_server_method(),
DTLS_client_method(),
DTLS1_VERSION, DTLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
return 0;
if (idx >= TOTAL_FULL_HAND_RECORDS) {
/* We're going to do a resumption handshake. Get a session first. */
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE))
|| !TEST_ptr(sess = SSL_get1_session(clientssl)))
goto end;
SSL_shutdown(clientssl);
SSL_shutdown(serverssl);
SSL_free(serverssl);
SSL_free(clientssl);
serverssl = clientssl = NULL;
cli_to_srv_epoch0 = CLI_TO_SRV_RESUME_EPOCH_0_RECS;
cli_to_srv_epoch1 = CLI_TO_SRV_RESUME_EPOCH_1_RECS;
srv_to_cli_epoch0 = SRV_TO_CLI_RESUME_EPOCH_0_RECS;
idx -= TOTAL_FULL_HAND_RECORDS;
} else {
cli_to_srv_epoch0 = CLI_TO_SRV_EPOCH_0_RECS;
cli_to_srv_epoch1 = CLI_TO_SRV_EPOCH_1_RECS;
srv_to_cli_epoch0 = SRV_TO_CLI_EPOCH_0_RECS;
}
c_to_s_fbio = BIO_new(bio_f_tls_dump_filter());
if (!TEST_ptr(c_to_s_fbio))
goto end;
/* BIO is freed by create_ssl_connection on error */
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, c_to_s_fbio)))
goto end;
if (sess != NULL) {
if (!TEST_true(SSL_set_session(clientssl, sess)))
goto end;
}
DTLS_set_timer_cb(clientssl, timer_cb);
DTLS_set_timer_cb(serverssl, timer_cb);
/* Work out which record to drop based on the test number */
if (idx >= cli_to_srv_epoch0 + cli_to_srv_epoch1) {
mempackbio = SSL_get_wbio(serverssl);
idx -= cli_to_srv_epoch0 + cli_to_srv_epoch1;
if (idx >= srv_to_cli_epoch0) {
epoch = 1;
idx -= srv_to_cli_epoch0;
}
} else {
mempackbio = SSL_get_wbio(clientssl);
if (idx >= cli_to_srv_epoch0) {
epoch = 1;
idx -= cli_to_srv_epoch0;
}
mempackbio = BIO_next(mempackbio);
}
BIO_ctrl(mempackbio, MEMPACKET_CTRL_SET_DROP_EPOCH, epoch, NULL);
BIO_ctrl(mempackbio, MEMPACKET_CTRL_SET_DROP_REC, idx, NULL);
if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
goto end;
if (sess != NULL && !TEST_true(SSL_session_reused(clientssl)))
goto end;
/* If the test did what we planned then it should have dropped a record */
if (!TEST_int_eq((int)BIO_ctrl(mempackbio, MEMPACKET_CTRL_GET_DROP_REC, 0,
NULL), -1))
goto end;
testresult = 1;
end:
SSL_SESSION_free(sess);
SSL_free(serverssl);
SSL_free(clientssl);
SSL_CTX_free(sctx);
SSL_CTX_free(cctx);
return testresult;
}
int setup_tests(void)
{
if (!TEST_ptr(cert = test_get_argument(0))
@@ -120,6 +247,8 @@ int setup_tests(void)
return 0;
ADD_ALL_TESTS(test_dtls_unprocessed, NUM_TESTS);
ADD_ALL_TESTS(test_dtls_drop_records, TOTAL_RECORDS);
return 1;
}
test/dtlsv1listentest.c
+1 -1
View File
@@ -348,7 +348,7 @@ static int dtls_listen_test(int i)
}
#endif
int setup_tests()
int setup_tests(void)
{
#ifndef OPENSSL_NO_SOCK
ADD_ALL_TESTS(dtls_listen_test, (int)OSSL_NELEM(testpackets));
test/ecdsatest.c
+1 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2002-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
*
* Licensed under the OpenSSL license (the "License"). You may not use
test/ectest.c
+10 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2001-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
*
* Licensed under the OpenSSL license (the "License"). You may not use
@@ -1377,6 +1377,15 @@ static int nistp_single_test(int idx)
if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
goto err;
/* regression test for felem_neg bug */
if (!TEST_true(BN_set_word(m, 32))
|| !TEST_true(BN_set_word(n, 31))
|| !TEST_true(EC_POINT_copy(P, G))
|| !TEST_true(EC_POINT_invert(NISTP, P, ctx))
|| !TEST_true(EC_POINT_mul(NISTP, Q, m, P, n, ctx))
|| !TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, G, ctx)))
goto err;
r = group_order_tests(NISTP);
err:
EC_GROUP_free(NISTP);
test/evp_test.c
+78 -26
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2015-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -911,31 +911,17 @@ static int mac_test_run(EVP_TEST *t)
}
#endif
if (!TEST_ptr(genctx = EVP_PKEY_CTX_new_id(expected->type, NULL))) {
t->err = "MAC_PKEY_CTX_ERROR";
if (expected->type == EVP_PKEY_CMAC)
key = EVP_PKEY_new_CMAC_key(NULL, expected->key, expected->key_len,
EVP_get_cipherbyname(expected->alg));
else
key = EVP_PKEY_new_raw_private_key(expected->type, NULL, expected->key,
expected->key_len);
if (key == NULL) {
t->err = "MAC_KEY_CREATE_ERROR";
goto err;
}
if (EVP_PKEY_keygen_init(genctx) <= 0) {
t->err = "MAC_KEYGEN_INIT_ERROR";
goto err;
}
if (expected->type == EVP_PKEY_CMAC
&& EVP_PKEY_CTX_ctrl_str(genctx, "cipher", expected->alg) <= 0) {
t->err = "MAC_ALGORITHM_SET_ERROR";
goto err;
}
if (EVP_PKEY_CTX_set_mac_key(genctx, expected->key,
expected->key_len) <= 0) {
t->err = "MAC_KEY_SET_ERROR";
goto err;
}
if (EVP_PKEY_keygen(genctx, &key) <= 0) {
t->err = "MAC_KEY_GENERATE_ERROR";
goto err;
}
if (expected->type == EVP_PKEY_HMAC) {
if (!TEST_ptr(md = EVP_get_digestbyname(expected->alg))) {
t->err = "MAC_ALGORITHM_SET_ERROR";
@@ -2392,7 +2378,7 @@ static void free_key_list(KEY_LIST *lst)
/*
* Is the key type an unsupported algorithm?
*/
static int key_unsupported()
static int key_unsupported(void)
{
long err = ERR_peek_error();
@@ -2427,6 +2413,23 @@ static char *take_value(PAIR *pp)
return p;
}
static int key_disabled(EVP_PKEY *pkey)
{
#if defined(OPENSSL_NO_SM2) && !defined(OPENSSL_NO_EC)
int type = EVP_PKEY_base_id(pkey);
if (type == EVP_PKEY_EC) {
EC_KEY *ec = EVP_PKEY_get0_EC_KEY(pkey);
int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
if (nid == NID_sm2)
return 1;
}
#endif /* OPENSSL_NO_SM2 */
return 0;
}
/*
* Read and parse one test. Return 0 if failure, 1 if okay.
*/
@@ -2453,20 +2456,69 @@ top:
if (strcmp(pp->key, "PrivateKey") == 0) {
pkey = PEM_read_bio_PrivateKey(t->s.key, NULL, 0, NULL);
if (pkey == NULL && !key_unsupported()) {
EVP_PKEY_free(pkey);
TEST_info("Can't read private key %s", pp->value);
TEST_openssl_errors();
return 0;
}
klist = &private_keys;
}
else if (strcmp(pp->key, "PublicKey") == 0) {
} else if (strcmp(pp->key, "PublicKey") == 0) {
pkey = PEM_read_bio_PUBKEY(t->s.key, NULL, 0, NULL);
if (pkey == NULL && !key_unsupported()) {
EVP_PKEY_free(pkey);
TEST_info("Can't read public key %s", pp->value);
TEST_openssl_errors();
return 0;
}
klist = &public_keys;
} else if (strcmp(pp->key, "PrivateKeyRaw") == 0
|| strcmp(pp->key, "PublicKeyRaw") == 0 ) {
char *strnid = NULL, *keydata = NULL;
unsigned char *keybin;
size_t keylen;
int nid;
if (strcmp(pp->key, "PrivateKeyRaw") == 0)
klist = &private_keys;
else
klist = &public_keys;
strnid = strchr(pp->value, ':');
if (strnid != NULL) {
*strnid++ = '\0';
keydata = strchr(strnid, ':');
if (keydata != NULL)
*keydata++ = '\0';
}
if (keydata == NULL) {
TEST_info("Failed to parse %s value", pp->key);
return 0;
}
nid = OBJ_txt2nid(strnid);
if (nid == NID_undef) {
TEST_info("Uncrecognised algorithm NID");
return 0;
}
if (!parse_bin(keydata, &keybin, &keylen)) {
TEST_info("Failed to create binary key");
return 0;
}
if (klist == &private_keys)
pkey = EVP_PKEY_new_raw_private_key(nid, NULL, keybin, keylen);
else
pkey = EVP_PKEY_new_raw_public_key(nid, NULL, keybin, keylen);
if (pkey == NULL && !key_unsupported()) {
TEST_info("Can't read %s data", pp->key);
OPENSSL_free(keybin);
TEST_openssl_errors();
return 0;
}
OPENSSL_free(keybin);
}
if (pkey != NULL && key_disabled(pkey)) {
EVP_PKEY_free(pkey);
pkey = NULL;
}
/* If we have a key add to list */
test/exdatatest.c
+1 -1
View File
@@ -127,7 +127,7 @@ typedef struct myobj_st {
int st;
} MYOBJ;
static MYOBJ *MYOBJ_new()
static MYOBJ *MYOBJ_new(void)
{
static int count = 0;
MYOBJ *obj = OPENSSL_malloc(sizeof(*obj));
test/fatalerrtest.c
+8 -3
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -28,8 +28,9 @@ static int test_fatalerr(void)
0x17, 0x03, 0x03, 0x00, 0x05, 'D', 'u', 'm', 'm', 'y'
};
if (!TEST_true(create_ssl_ctx_pair(TLS_method(), TLS_method(), &sctx, &cctx,
cert, privkey)))
if (!TEST_true(create_ssl_ctx_pair(TLS_method(), TLS_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
goto err;
/*
@@ -38,6 +39,10 @@ static int test_fatalerr(void)
*/
if (!TEST_true(SSL_CTX_set_cipher_list(sctx, "AES128-SHA"))
|| !TEST_true(SSL_CTX_set_cipher_list(cctx, "AES256-SHA"))
|| !TEST_true(SSL_CTX_set_ciphersuites(sctx,
"TLS_AES_128_GCM_SHA256"))
|| !TEST_true(SSL_CTX_set_ciphersuites(cctx,
"TLS_AES_256_GCM_SHA384"))
|| !TEST_true(create_ssl_objects(sctx, cctx, &sssl, &cssl, NULL,
NULL)))
goto err;
test/generate_buildtest.pl
+1 -1
View File
@@ -27,7 +27,7 @@ print <<"_____";
# include <openssl/$name.h>
#endif
int main()
int main(void)
{
return 0;
}
test/handshake_helper.c
+32 -10
View File
@@ -22,7 +22,7 @@
#include "handshake_helper.h"
#include "testutil.h"
HANDSHAKE_RESULT *HANDSHAKE_RESULT_new()
HANDSHAKE_RESULT *HANDSHAKE_RESULT_new(void)
{
HANDSHAKE_RESULT *ret;
@@ -469,12 +469,24 @@ static int generate_session_ticket_cb(SSL *s, void *arg)
return SSL_SESSION_set1_ticket_appdata(ss, app_data, strlen(app_data));
}
static SSL_TICKET_RETURN decrypt_session_ticket_cb(SSL *s, SSL_SESSION *ss,
const unsigned char *keyname,
size_t keyname_len,
SSL_TICKET_RETURN retv, void *arg)
static int decrypt_session_ticket_cb(SSL *s, SSL_SESSION *ss,
const unsigned char *keyname,
size_t keyname_len,
SSL_TICKET_STATUS status,
void *arg)
{
return retv;
switch (status) {
case SSL_TICKET_EMPTY:
case SSL_TICKET_NO_DECRYPT:
return SSL_TICKET_RETURN_IGNORE_RENEW;
case SSL_TICKET_SUCCESS:
return SSL_TICKET_RETURN_USE;
case SSL_TICKET_SUCCESS_RENEW:
return SSL_TICKET_RETURN_USE_RENEW;
default:
break;
}
return SSL_TICKET_RETURN_ABORT;
}
/*
@@ -1391,7 +1403,7 @@ static HANDSHAKE_RESULT *do_handshake_internal(
HANDSHAKE_EX_DATA server_ex_data, client_ex_data;
CTX_DATA client_ctx_data, server_ctx_data, server2_ctx_data;
HANDSHAKE_RESULT *ret = HANDSHAKE_RESULT_new();
int client_turn = 1, client_turn_count = 0;
int client_turn = 1, client_turn_count = 0, client_wait_count = 0;
connect_phase_t phase = HANDSHAKE;
handshake_status_t status = HANDSHAKE_RETRY;
const unsigned char* tick = NULL;
@@ -1574,9 +1586,19 @@ static HANDSHAKE_RESULT *do_handshake_internal(
ret->result = SSL_TEST_INTERNAL_ERROR;
goto err;
}
/* Continue. */
client_turn ^= 1;
if (client_turn && server.status == PEER_SUCCESS) {
/*
* The server may finish before the client because the
* client spends some turns processing NewSessionTickets.
*/
if (client_wait_count++ >= 2) {
ret->result = SSL_TEST_INTERNAL_ERROR;
goto err;
}
} else {
/* Continue. */
client_turn ^= 1;
}
}
break;
}
test/handshake_helper.h
+1 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
test/mdc2_internal_test.c
+1 -1
View File
@@ -64,7 +64,7 @@ static int test_mdc2(int idx)
return 1;
}
int setup_tests()
int setup_tests(void)
{
ADD_ALL_TESTS(test_mdc2, OSSL_NELEM(tests));
return 1;
test/modes_internal_test.c
+2 -2
View File
@@ -99,7 +99,7 @@ static const SIZED_DATA aes_cts128_vectors[] = {
CTS128_TEST_VECTOR(64),
};
static AES_KEY *cts128_encrypt_key_schedule()
static AES_KEY *cts128_encrypt_key_schedule(void)
{
static int init_key = 1;
static AES_KEY ks;
@@ -111,7 +111,7 @@ static AES_KEY *cts128_encrypt_key_schedule()
return &ks;
}
static AES_KEY *cts128_decrypt_key_schedule()
static AES_KEY *cts128_decrypt_key_schedule(void)
{
static int init_key = 1;
static AES_KEY ks;
test/ossl_shim/ossl_shim.cc
+4
View File
@@ -985,6 +985,10 @@ static bool DoExchange(bssl::UniquePtr<SSL_SESSION> *out_session,
SSL_set_max_cert_list(ssl.get(), config->max_cert_list);
}
if (!config->async) {
SSL_set_mode(ssl.get(), SSL_MODE_AUTO_RETRY);
}
int sock = Connect(config->port);
if (sock == -1) {
return false;
test/packettest.c
+1 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2015-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
test/pkey_meth_kdf_test.c
+1 -1
View File
@@ -170,7 +170,7 @@ static int test_kdf_scrypt(void)
}
#endif
int setup_tests()
int setup_tests(void)
{
ADD_TEST(test_kdf_tls1_prf);
ADD_TEST(test_kdf_hkdf);
test/pkey_meth_test.c
+1 -1
View File
@@ -75,7 +75,7 @@ static int test_pkey_meths(void)
return good;
}
int setup_tests()
int setup_tests(void)
{
ADD_TEST(test_asn1_meths);
ADD_TEST(test_pkey_meths);
test/rdrand_sanitytest.c
+7 -6
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2018-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -20,7 +20,7 @@
size_t OPENSSL_ia32_rdrand_bytes(unsigned char *buf, size_t len);
size_t OPENSSL_ia32_rdseed_bytes(unsigned char *buf, size_t len);
void OPENSSL_cpuid_setup();
void OPENSSL_cpuid_setup(void);
extern unsigned int OPENSSL_ia32cap_P[4];
@@ -81,12 +81,12 @@ end:
return testresult;
}
static int sanity_check_rdrand_bytes()
static int sanity_check_rdrand_bytes(void)
{
return sanity_check_bytes(OPENSSL_ia32_rdrand_bytes, 1000, 0, 10, 10);
}
static int sanity_check_rdseed_bytes()
static int sanity_check_rdseed_bytes(void)
{
/*-
* RDSEED may take many retries to succeed; note that this is effectively
@@ -97,7 +97,8 @@ static int sanity_check_rdseed_bytes()
return sanity_check_bytes(OPENSSL_ia32_rdseed_bytes, 1000, 1, 10000, 10);
}
int setup_tests() {
int setup_tests(void)
{
OPENSSL_cpuid_setup();
int have_rdseed = (OPENSSL_ia32cap_P[2] & (1 << 18)) != 0;
@@ -117,7 +118,7 @@ int setup_tests() {
#else
int setup_tests()
int setup_tests(void)
{
return 1;
}
test/recipes/04-test_bio_callback.t
+12
View File
@@ -0,0 +1,12 @@
#! /usr/bin/env perl
# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
use OpenSSL::Test::Simple;
simple_test("test_bio_callback", "bio_callback_test");
test/recipes/05-test_rand.t
+3 -2
View File
@@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -10,7 +10,8 @@ use strict;
use warnings;
use OpenSSL::Test;
plan tests => 1;
plan tests => 2;
setup("test_rand");
ok(run(test(["drbgtest"])));
ok(run(test(["drbg_cavs_test"])));
test/recipes/06-test-rdrand.t
+1 -1
View File
@@ -1,6 +1,6 @@
#! /usr/bin/perl
# Copyright 2018-2018 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
test/recipes/15-test_genrsa.t
+35 -7
View File
@@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -18,9 +18,37 @@ setup("test_genrsa");
plan tests => 5;
is(run(app([ 'openssl', 'genrsa', '-3', '-out', 'genrsatest.pem', '256'])), 0, "genrsa -3 256");
ok(run(app([ 'openssl', 'genrsa', '-3', '-out', 'genrsatest.pem', '512'])), "genrsa -3 512");
ok(run(app([ 'openssl', 'rsa', '-check', '-in', 'genrsatest.pem', '-noout'])), "rsa -check");
ok(run(app([ 'openssl', 'genrsa', '-f4', '-out', 'genrsatest.pem', '512'])), "genrsa -f4 512");
ok(run(app([ 'openssl', 'rsa', '-check', '-in', 'genrsatest.pem', '-noout'])), "rsa -check");
unlink 'genrsatest.pem';
# We want to know that an absurdly small number of bits isn't support
is(run(app([ 'openssl', 'genrsa', '-3', '-out', 'genrsatest.pem', '8'])), 0, "genrsa -3 8");
# Depending on the shared library, we might have different lower limits.
# Let's find it! This is a simple binary search
# ------------------------------------------------------------
# NOTE: $good may need an update in the future
# ------------------------------------------------------------
note "Looking for lowest amount of bits";
my $bad = 3; # Log2 of number of bits (2 << 3 == 8)
my $good = 11; # Log2 of number of bits (2 << 11 == 2048)
while ($good > $bad + 1) {
my $checked = int(($good + $bad + 1) / 2);
if (run(app([ 'openssl', 'genrsa', '-3', '-out', 'genrsatest.pem',
2 ** $checked ], stderr => undef))) {
note 2 ** $checked, " bits is good";
$good = $checked;
} else {
note 2 ** $checked, " bits is bad";
$bad = $checked;
}
}
$good++ if $good == $bad;
$good = 2 ** $good;
note "Found lowest allowed amount of bits to be $good";
ok(run(app([ 'openssl', 'genrsa', '-3', '-out', 'genrsatest.pem', $good ])),
"genrsa -3 $good");
ok(run(app([ 'openssl', 'rsa', '-check', '-in', 'genrsatest.pem', '-noout' ])),
"rsa -check");
ok(run(app([ 'openssl', 'genrsa', '-f4', '-out', 'genrsatest.pem', $good ])),
"genrsa -f4 $good");
ok(run(app([ 'openssl', 'rsa', '-check', '-in', 'genrsatest.pem', '-noout' ])),
"rsa -check");
test/recipes/15-test_out_option.t
+50 -37
View File
@@ -16,45 +16,58 @@ use OpenSSL::Test::Utils;
setup("test_out_option");
plan skip_all => "'-out' option tests are not available on Windows"
if $^O eq 'MSWin32';
plan tests => 4;
plan tests => 11;
# Test 1
SKIP: {
# Paths that should generate failure when trying to write to them.
# Directories are a safe bet for failure on most platforms.
# Notably, this isn't true on OpenVMS, as a default file name is
# appended under the hood when trying to "write" to a directory spec.
# From observation, that file is '.' (i.e. a file with no file name
# and no extension), so '[]' gets translated to '[].'
skip 'Directories become writable files on OpenVMS', 1 if $^O eq 'VMS';
# The following patterns should be tested:
#
# path dirname
# /usr/ /
# / /
# . .
# .. .
test_illegal_path('/usr/');
test_illegal_path('/');
test_illegal_path('./');
test_illegal_path('../');
# Test for trying to create a file in a non-exist directory
my @chars = ("A".."Z", "a".."z", "0".."9");
my $rand_path = $chars[rand @chars] for 1..32;
$rand_path .= "/test.pem";
test_illegal_path($rand_path);
test_legal_path('test.pem');
unlink 'test.pem';
sub test_illegal_path {
my $path = File::Spec->canonpath($_[0]);
my $start = time();
ok(!run(app([ 'openssl', 'genrsa', '-out', $path, '16384'])), "invalid output path: $path");
my $end = time();
# The above process should exit in 2 seconds if the path is not valid
ok($end - $start < 2, "check time consumed");
# Note that directories must end with a slash here, because of how
# File::Spec massages them into directory specs on some platforms.
my $path = File::Spec->canonpath('./');
ok(!run(app([ 'openssl', 'rand', '-out', $path, '1'])),
"invalid output path: $path");
}
sub test_legal_path {
my $path = File::Spec->canonpath($_[0]);
ok(run(app([ 'openssl', 'genrsa', '-out', $path, '2048'])), "valid output path: $path");
# Test 2
{
my $path = File::Spec->canonpath('randomname.bin');
ok(run(app([ 'openssl', 'rand', '-out', $path, '1'])),
"valid output path: $path");
}
# Test 3
{
# Test for trying to create a file in a non-exist directory
my $rand_path = "";
do {
my @chars = ("A".."Z", "a".."z", "0".."9");
$rand_path .= $chars[rand @chars] for 1..32;
} while (-d File::Spec->catdir('.', $rand_path));
$rand_path .= "/randomname.bin";
my $path = File::Spec->canonpath($rand_path);
ok(!run(app([ 'openssl', 'rand', '-out', $path, '1'])),
"invalid output path: $path");
}
# Test 4
SKIP: {
skip "It's not safe to use perl's idea of the NULL device in an explicitly cross compiled build", 1
unless (config('CROSS_COMPILE') // '') eq '';
my $path = File::Spec->canonpath(File::Spec->devnull());
ok(run(app([ 'openssl', 'rand', '-out', $path, '1'])),
"valid output path: $path");
}
# Cleanup
END {
unlink 'randomname.bin' if -f 'randomname.bin';
}
test/recipes/30-test_evp_data/evppkey.txt
+109 -1
View File
@@ -1,5 +1,5 @@
#
# Copyright 2001-2017 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -726,8 +726,22 @@ PublicKey=Bob-25519-PUBLIC
MCowBQYDK2VuAyEA3p7bfXt9wbTTW2HC7OQ1Nz+DQ8hbeGdNrfx+FG+IK08=
-----END PUBLIC KEY-----
#Raw versions of the same keys as above
PrivateKeyRaw=Alice-25519-Raw:X25519:77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a
PublicKeyRaw=Alice-25519-PUBLIC-Raw:X25519:8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a
PrivPubKeyPair = Alice-25519-Raw:Alice-25519-PUBLIC-Raw
PrivateKeyRaw=Bob-25519-Raw:X25519:5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb
PublicKeyRaw=Bob-25519-PUBLIC-Raw:X25519:de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f
PrivPubKeyPair = Bob-25519:Bob-25519-PUBLIC
PrivPubKeyPair = Bob-25519-Raw:Bob-25519-PUBLIC-Raw
Derive=Alice-25519
PeerKey=Bob-25519-PUBLIC
SharedSecret=4A5D9D5BA4CE2DE1728E3BF480350F25E07E21C947D19E3376F09B3C1E161742
@@ -736,6 +750,14 @@ Derive=Bob-25519
PeerKey=Alice-25519-PUBLIC
SharedSecret=4A5D9D5BA4CE2DE1728E3BF480350F25E07E21C947D19E3376F09B3C1E161742
Derive=Alice-25519-Raw
PeerKey=Bob-25519-PUBLIC-Raw
SharedSecret=4A5D9D5BA4CE2DE1728E3BF480350F25E07E21C947D19E3376F09B3C1E161742
Derive=Bob-25519-Raw
PeerKey=Alice-25519-PUBLIC-Raw
SharedSecret=4A5D9D5BA4CE2DE1728E3BF480350F25E07E21C947D19E3376F09B3C1E161742
# Illegal sign/verify operations with X25519 key
Sign=Alice-25519
@@ -778,6 +800,20 @@ QjKhPKcG3LV67D2uB73BxnvzNgk=
PrivPubKeyPair = Bob-448:Bob-448-PUBLIC
#Raw versions of the same keys as above
PrivateKeyRaw=Alice-448-Raw:X448:9a8f4925d1519f5775cf46b04b5800d4ee9ee8bae8bc5565d498c28dd9c9baf574a9419744897391006382a6f127ab1d9ac2d8c0a598726b
PublicKeyRaw=Alice-448-PUBLIC-Raw:X448:9b08f7cc31b7e3e67d22d5aea121074a273bd2b83de09c63faa73d2c22c5d9bbc836647241d953d40c5b12da88120d53177f80e532c41fa0
PrivPubKeyPair = Alice-448-Raw:Alice-448-PUBLIC-Raw
PrivateKeyRaw=Bob-448-Raw:X448:1c306a7ac2a0e2e0990b294470cba339e6453772b075811d8fad0d1d6927c120bb5ee8972b0d3e21374c9c921b09d1b0366f10b65173992d
PublicKeyRaw=Bob-448-PUBLIC-Raw:X448:3eb7a829b0cd20f5bcfc0b599b6feccf6da4627107bdb0d4f345b43027d8b972fc3e34fb4232a13ca706dcb57aec3dae07bdc1c67bf33609
PrivPubKeyPair = Bob-448-Raw:Bob-448-PUBLIC-Raw
Derive=Alice-448
PeerKey=Bob-448-PUBLIC
SharedSecret=07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d
@@ -786,6 +822,14 @@ Derive=Bob-448
PeerKey=Alice-448-PUBLIC
SharedSecret=07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d
Derive=Alice-448-Raw
PeerKey=Bob-448-PUBLIC-Raw
SharedSecret=07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d
Derive=Bob-448-Raw
PeerKey=Alice-448-PUBLIC-Raw
SharedSecret=07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d
# Illegal sign/verify operations with X448 key
Sign=Alice-448
@@ -17433,8 +17477,15 @@ PublicKey=ED25519-5-PUBLIC
MCowBQYDK2VwAyEA7Bcrk61eVjv0kyxw4SRQNMNUZ+8u/U1k6/gZaDRn4r8=
-----END PUBLIC KEY-----
#Raw versions of the ED25519-1 keys
PrivateKeyRaw=ED25519-1-Raw:ED25519:9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60
PublicKeyRaw=ED25519-1-PUBLIC-Raw:ED25519:d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a
PrivPubKeyPair = ED25519-1:ED25519-1-PUBLIC
PrivPubKeyPair = ED25519-1-Raw:ED25519-1-PUBLIC-Raw
OneShotDigestSign = NULL
Key = ED25519-1
Input = ""
@@ -17507,6 +17558,17 @@ DigestSign = SHA256
Key = ED25519-1
Result = DIGESTSIGNINIT_ERROR
# Raw tests
OneShotDigestSign = NULL
Key = ED25519-1-Raw
Input = ""
Output = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b
OneShotDigestVerify = NULL
Key = ED25519-1-PUBLIC-Raw
Input = ""
Output = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b
Title = ED448 tests from RFC8032
@@ -17606,6 +17668,11 @@ MEMwBQYDK2VxAzoAqBsuinClrJT/28ybrfw/6wgB8lhXi7EUrUTs4ewOeZ2gjv+4
HF1oXAxW9k7srvjN8RzDhzeDjPQA
-----END PUBLIC KEY-----
#Raw versions of the ED448-1 keys
PrivateKeyRaw=ED448-1-Raw:ED448:6c82a562cb808d10d632be89c8513ebf6c929f34ddfa8c9f63c9960ef6e348a3528c8a3fcc2f044e39a3fc5b94492f8f032e7549a20098f95b
PublicKeyRaw=ED448-1-PUBLIC-Raw:ED448:5fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180
PrivPubKeyPair = ED448-1:ED448-1-PUBLIC
PrivPubKeyPair = ED448-2:ED448-2-PUBLIC
@@ -17622,6 +17689,8 @@ PrivPubKeyPair = ED448-7:ED448-7-PUBLIC
PrivPubKeyPair = ED448-8:ED448-8-PUBLIC
PrivPubKeyPair = ED448-1-Raw:ED448-1-PUBLIC-Raw
OneShotDigestSign = NULL
Key = ED448-1
Input = ""
@@ -17698,6 +17767,17 @@ DigestSign = SHA256
Key = ED448-1
Result = DIGESTSIGNINIT_ERROR
# Raw keys
OneShotDigestSign = NULL
Key = ED448-1-Raw
Input = ""
Output = 533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4dbb61149f05a7363268c71d95808ff2e652600
OneShotDigestVerify = NULL
Key = ED448-1-PUBLIC-Raw
Input = ""
Output = 533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4dbb61149f05a7363268c71d95808ff2e652600
# Key generation tests
KeyGen = rsaEncryption
@@ -18289,3 +18369,31 @@ SharedSecret=4E48335CB2A508C3481729F42C49CFC0A9DA673F9FA4FBD968B3C5B78DBFA869529
Derive=ffdhe8192-2
PeerKey=ffdhe8192-1-pub
SharedSecret=4E48335CB2A508C3481729F42C49CFC0A9DA673F9FA4FBD968B3C5B78DBFA8695295642D1337C54229370B33068481F6A6E1B021F8B09B7C6B3E4DB581AD4C7ACF5C230A1FD4107EAE55530A8376856A65E079DE1BDA41B050E9B53A088ACADB879CCBC683A13BB925D48497BF7021FEB9DA214DD77FCBB6D0D46EC2BB9C7A9AFB93FC236E4EB61CB0F0C8E025D8CF4AF8B3B0F28B3E2CFAE6E760DC7877C71046179154FBE1A50A315C4DBA6D9E06406D389B614B1FC422C72FBB958C0A2EE21694CD32136F9CF0A1205E0D3A4B10CC9C98B3B4524A0CDC9455D3021AC44057CEF4A97E85166068769E9E644CC447095243BB90368A1CE6F0E3C69CA180F5B9D51F590A812B1375460CF10A7E718A83A2F6B00D8E28BAB45CEAB8AF0EB02988ED9221416EC061C1C4081552D3D0849D243DB473EC7B90180C3891E768DD2D7002CF505D369700CAF02A4B9DD1F2828C4ACC1F2EB47100DC2DB5620ADA971D1B0B0FAC9F9E3492B591FC85AC3DCB3826A8DA5842F4AE145FE33BFCDD0B6CD15C9836A5862EDB3D87A0CDBD724AE19A79A55D4F0BFF7870019926181933C840EACFB70FBC0EF182057DC09E06798EB4C9AAC2285F22F5D907A432C6D00CC44D07D77E77D1ACC183A174146ECFBDA26FF922CEBD2FA288EF2D23F65C0AAAD0F05DBFB6CA12446082D1F5774877483C3858442E305CF2A9637CE0EBB702DB70FF336E5B0413F3E8791960F1F0A9877C9076213D40657283D546AE52B73FF4449E60F8B6FE30D4CC0BA1ACA7A7DC155EC73C48B21477983D004261267D710D8A5E8CBD0656F1A963F248E887E8C2BF87BCAE7A0D4891BF21FCF35893584B29E18E842A23EA329ADD3D6AD994B5CBFBBFAB5A26932E8F799B2B0FA7789DE7A4A5C4B7FA81971819EA7F33B5BF6577F917BDE9C3680BCC5B15F1EAB4524A1B6DEE96B9F108A77344269A1757685D0404C832E4E0C5A29F808CFA6290316C0EBB2EF0A7431F62A5FBCDC66527AD8A04C0F10AF88C7CE1F1F22C41B71CE278BB704E88145608C28AD78402487031F6B13604CC6687161EBB78E7AF7AA0BC3CCB9AD8B00D7C01980599904B71F5DBC06A691E5638566BE36522B7FED69E24C28F8EA798BA3E9CCEB8AB8CF5651379A21A38315B05C66205616BBC6A3DD5573C9C6FBA2E3488E055E5F36857016D9300BFCE9F38D7C7CCD07FCF1EF41F8347CADCB12C400536374CF269613B05069B6D94CADA3B1F4ACBB68FA1ED175B01D840D871B3B0CDB918CDF15C79169A398C189AEA78860081DB423C89D350587E26D6D77B4C762B4F2A030345679F724CFBB08DB03E8CEB4FF0B91422BD2EB5C1C356D209049CFA2D6447F69B1E1DF0850FFBB6BB9F8D5B147765C023F76524A808456DEBF6A9134E3364DF462D4807FE6D4D036A4E59A4D56F8A30D8A27F4DFA174940B713A7E4
Title = SM2 tests
PrivateKey=SM2_key1
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqBHM9VAYItBG0wawIBAQQg0JFWczAXva2An9m7
2MaT9gIwWTFptvlKrxyO4TjMmbWhRANCAAQ5OirZ4n5DrKqrhaGdO4VZHhRAYVcX
Wt3Te/d/8Mr57Tf886i09VwDhSMmH8pmNq/mp6+ioUgqYG9cs6GLLioe
-----END PRIVATE KEY-----
Verify = SM2_key1
Ctrl = digest:SM3
Input = D7AD397F6FFA5D4F7F11E7217F241607DC30618C236D2C09C1B9EA8FDADEE2E8
Output = 3046022100AB1DB64DE7C40EDBDE6651C9B8EBDB804673DB836E5D5C7FE15DCF9ED2725037022100EBA714451FF69B0BB930B379E192E7CD5FA6E3C41C7FBD8303B799AB54A54621
Decrypt = SM2_key1
Input = 30818A0220466BE2EF5C11782EC77864A0055417F407A5AFC11D653C6BCE69E417BB1D05B6022062B572E21FF0DDF5C726BD3F9FF2EAE56E6294713A607E9B9525628965F62CC804203C1B5713B5DB2728EB7BF775E44F4689FC32668BDC564F52EA45B09E8DF2A5F40422084A9D0CC2997092B7D3C404FCE95956EB604D732B2307A8E5B8900ED6608CA5B197
Output = "The floofy bunnies hop at midnight"
# This is a "fake" test as it does only verify that the SM2 EVP_PKEY interface
# is capable of creating a signature without failing, but it does not say
# anything about the generated signature being valid, nor does it test the
# correct implementation of the cryptosystem.
Sign = SM2_key1
Ctrl = digest:SM3
Input = D7AD397F6FFA5D4F7F11E7217F241607DC30618C236D2C09C1B9EA8FDADEE2E8
Output = 3045022100f11bf36e75bb304f094fb42a4ca22377d0cc768637c5011cd59fb9ed4b130c98022035545ffe2c2efb3abee4fee661468946d886004fae8ea5311593e48f7fe21b91
Result = KEYOP_MISMATCH
test/recipes/70-test_renegotiation.t
+29 -1
View File
@@ -38,7 +38,7 @@ my $proxy = TLSProxy::Proxy->new(
$proxy->clientflags("-no_tls1_3");
$proxy->reneg(1);
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 2;
plan tests => 3;
ok(TLSProxy::Message->success(), "Basic renegotiation");
#Test 2: Client does not send the Reneg SCSV. Reneg should fail
@@ -49,6 +49,34 @@ $proxy->reneg(1);
$proxy->start();
ok(TLSProxy::Message->fail(), "No client SCSV");
SKIP: {
skip "TLSv1.2 or TLSv1.1 disabled", 1
if disabled("tls1_2") || disabled("tls1_1");
#Test 3: Check that the ClientHello version remains the same in the reneg
# handshake
$proxy->clear();
$proxy->filter(undef);
$proxy->clientflags("-no_tls1_3");
$proxy->serverflags("-no_tls1_3 -no_tls1_2");
$proxy->reneg(1);
$proxy->start();
my $chversion;
my $chmatch = 0;
foreach my $message (@{$proxy->message_list}) {
if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO) {
if (!defined $chversion) {
$chversion = $message->client_version;
} else {
if ($chversion == $message->client_version) {
$chmatch = 1;
}
}
}
}
ok(TLSProxy::Message->success() && $chmatch,
"Check ClientHello version is the same");
}
sub reneg_filter
{
my $proxy = shift;
test/recipes/70-test_sslcbcpadding.t
+25 -6
View File
@@ -7,6 +7,8 @@
# https://www.openssl.org/source/license.html
use strict;
use feature 'state';
use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/;
use OpenSSL::Test::Utils;
use TLSProxy::Proxy;
@@ -41,26 +43,31 @@ my @test_offsets = (0, 128, 254, 255);
# Test that maximally-padded records are accepted.
my $bad_padding_offset = -1;
$proxy->serverflags("-tls1_2");
$proxy->serverconnects(1 + scalar(@test_offsets));
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 1 + scalar(@test_offsets);
ok(TLSProxy::Message->success(), "Maximally-padded record test");
# Test that invalid padding is rejected.
my $fatal_alert; # set by add_maximal_padding_filter on client's fatal alert
foreach my $offset (@test_offsets) {
$proxy->clear();
$proxy->serverflags("-tls1_2");
$bad_padding_offset = $offset;
$proxy->start();
ok(TLSProxy::Message->fail(), "Invalid padding byte $bad_padding_offset");
$fatal_alert = 0;
$proxy->clearClient();
$proxy->clientstart();
ok($fatal_alert, "Invalid padding byte $bad_padding_offset");
}
sub add_maximal_padding_filter
{
my $proxy = shift;
my $messages = $proxy->message_list;
state $sent_corrupted_payload;
if ($proxy->flight == 0) {
# Disable Encrypt-then-MAC.
foreach my $message (@{$proxy->message_list}) {
foreach my $message (@{$messages}) {
if ($message->mt != TLSProxy::Message::MT_CLIENT_HELLO) {
next;
}
@@ -69,9 +76,16 @@ sub add_maximal_padding_filter
$message->process_extensions();
$message->repack();
}
$sent_corrupted_payload = 0;
return;
}
if ($proxy->flight == 3) {
my $last_message = @{$messages}[-1];
if (defined($last_message)
&& $last_message->server
&& $last_message->mt == TLSProxy::Message::MT_FINISHED
&& !@{$last_message->records}[0]->{sent}) {
# Insert a maximally-padded record. Assume a block size of 16 (AES) and
# a MAC length of 20 (SHA-1).
my $block_size = 16;
@@ -88,6 +102,7 @@ sub add_maximal_padding_filter
# Add padding.
for (my $i = 0; $i < 256; $i++) {
if ($i == $bad_padding_offset) {
$sent_corrupted_payload = 1;
$data .= "\xfe";
} else {
$data .= "\xff";
@@ -108,5 +123,9 @@ sub add_maximal_padding_filter
# Send the record immediately after the server Finished.
push @{$proxy->record_list}, $record;
} elsif ($sent_corrupted_payload) {
# Check for bad_record_mac from client
my $last_record = @{$proxy->record_list}[-1];
$fatal_alert = 1 if $last_record->is_fatal_alert(0) == 20;
}
}
test/recipes/70-test_sslextension.t
+38 -11
View File
@@ -7,6 +7,8 @@
# https://www.openssl.org/source/license.html
use strict;
use feature 'state';
use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/;
use OpenSSL::Test::Utils;
use TLSProxy::Proxy;
@@ -37,6 +39,7 @@ use constant {
};
my $testtype;
my $fatal_alert = 0; # set by filter on fatal alert
$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
my $proxy = TLSProxy::Proxy->new(
@@ -98,11 +101,13 @@ sub inject_duplicate_extension_clienthello
my $proxy = shift;
# We're only interested in the initial ClientHello
if ($proxy->flight != 0) {
if ($proxy->flight == 0) {
inject_duplicate_extension($proxy, TLSProxy::Message::MT_CLIENT_HELLO);
return;
}
inject_duplicate_extension($proxy, TLSProxy::Message::MT_CLIENT_HELLO);
my $last_record = @{$proxy->{record_list}}[-1];
$fatal_alert = 1 if $last_record->is_fatal_alert(1);
}
sub inject_duplicate_extension_serverhello
@@ -110,26 +115,43 @@ sub inject_duplicate_extension_serverhello
my $proxy = shift;
# We're only interested in the initial ServerHello
if ($proxy->flight != 1) {
if ($proxy->flight == 0) {
return;
} elsif ($proxy->flight == 1) {
inject_duplicate_extension($proxy, TLSProxy::Message::MT_SERVER_HELLO);
return;
}
inject_duplicate_extension($proxy, TLSProxy::Message::MT_SERVER_HELLO);
my $last_record = @{$proxy->{record_list}}[-1];
$fatal_alert = 1 if $last_record->is_fatal_alert(0);
}
sub inject_unsolicited_extension
{
my $proxy = shift;
my $message;
state $sent_unsolisited_extension;
if ($proxy->flight == 0) {
$sent_unsolisited_extension = 0;
return;
}
# We're only interested in the initial ServerHello/EncryptedExtensions
if ($proxy->flight != 1) {
if ($sent_unsolisited_extension) {
my $last_record = @{$proxy->record_list}[-1];
$fatal_alert = 1 if $last_record->is_fatal_alert(0);
}
return;
}
if ($testtype == UNSOLICITED_SERVER_NAME_TLS13) {
$message = ${$proxy->message_list}[2];
die "Expecting EE message ".($message->mt).", ".${$proxy->message_list}[1]->mt.", ".${$proxy->message_list}[3]->mt if $message->mt != TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS;
return if (!defined($message = ${$proxy->message_list}[2]));
die "Expecting EE message ".($message->mt).","
.${$proxy->message_list}[1]->mt.", "
.${$proxy->message_list}[3]->mt
if $message->mt != TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS;
} else {
$message = ${$proxy->message_list}[1];
}
@@ -148,17 +170,19 @@ sub inject_unsolicited_extension
}
$message->set_extension($type, $ext);
$message->repack();
$sent_unsolisited_extension = 1;
}
# Test 1-2: Sending a duplicate extension should fail.
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 7;
ok(TLSProxy::Message->fail(), "Duplicate ClientHello extension");
ok($fatal_alert, "Duplicate ClientHello extension");
$fatal_alert = 0;
$proxy->clear();
$proxy->filter(\&inject_duplicate_extension_serverhello);
$proxy->start();
ok(TLSProxy::Message->fail(), "Duplicate ServerHello extension");
ok($fatal_alert, "Duplicate ServerHello extension");
SKIP: {
skip "TLS <= 1.2 disabled", 3 if $no_below_tls13;
@@ -170,12 +194,13 @@ SKIP: {
ok(TLSProxy::Message->success, "Zero extension length test");
#Test 4: Inject an unsolicited extension (<= TLSv1.2)
$fatal_alert = 0;
$proxy->clear();
$proxy->filter(\&inject_unsolicited_extension);
$testtype = UNSOLICITED_SERVER_NAME;
$proxy->clientflags("-no_tls1_3 -noservername");
$proxy->start();
ok(TLSProxy::Message->fail(), "Unsolicited server name extension");
ok($fatal_alert, "Unsolicited server name extension");
#Test 5: Inject a noncompliant supported_groups extension (<= TLSv1.2)
$proxy->clear();
@@ -190,20 +215,22 @@ SKIP: {
skip "TLS <= 1.2 or CT disabled", 1
if $no_below_tls13 || disabled("ct");
#Test 6: Same as above for the SCT extension which has special handling
$fatal_alert = 0;
$proxy->clear();
$testtype = UNSOLICITED_SCT;
$proxy->clientflags("-no_tls1_3");
$proxy->start();
ok(TLSProxy::Message->fail(), "Unsolicited sct extension");
ok($fatal_alert, "Unsolicited sct extension");
}
SKIP: {
skip "TLS 1.3 disabled", 1 if disabled("tls1_3");
#Test 7: Inject an unsolicited extension (TLSv1.3)
$fatal_alert = 0;
$proxy->clear();
$proxy->filter(\&inject_unsolicited_extension);
$testtype = UNSOLICITED_SERVER_NAME_TLS13;
$proxy->clientflags("-noservername");
$proxy->start();
ok(TLSProxy::Message->fail(), "Unsolicited server name extension (TLSv1.3)");
ok($fatal_alert, "Unsolicited server name extension (TLSv1.3)");
}
test/recipes/70-test_sslrecords.t
+89 -43
View File
@@ -7,6 +7,8 @@
# https://www.openssl.org/source/license.html
use strict;
use feature 'state';
use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/;
use OpenSSL::Test::Utils;
use TLSProxy::Proxy;
@@ -35,6 +37,7 @@ my $proxy = TLSProxy::Proxy->new(
);
my $boundary_test_type;
my $fatal_alert = 0; # set by filters at expected fatal alerts
#Test 1: Injecting out of context empty records should fail
my $content_type = TLSProxy::Record::RT_APPLICATION_DATA;
@@ -42,7 +45,7 @@ my $inject_recs_num = 1;
$proxy->serverflags("-tls1_2");
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 18;
ok(TLSProxy::Message->fail(), "Out of context empty records test");
ok($fatal_alert, "Out of context empty records test");
#Test 2: Injecting in context empty records should succeed
$proxy->clear();
@@ -52,21 +55,23 @@ $proxy->start();
ok(TLSProxy::Message->success(), "In context empty records test");
#Test 3: Injecting too many in context empty records should fail
$fatal_alert = 0;
$proxy->clear();
#We allow 32 consecutive in context empty records
$inject_recs_num = 33;
$proxy->serverflags("-tls1_2");
$proxy->start();
ok(TLSProxy::Message->fail(), "Too many in context empty records test");
ok($fatal_alert, "Too many in context empty records test");
#Test 4: Injecting a fragmented fatal alert should fail. We expect the server to
# send back an alert of its own because it cannot handle fragmented
# alerts
$fatal_alert = 0;
$proxy->clear();
$proxy->filter(\&add_frag_alert_filter);
$proxy->serverflags("-tls1_2");
$proxy->start();
ok(TLSProxy::Message->fail(), "Fragmented alert records test");
ok($fatal_alert, "Fragmented alert records test");
#Run some SSLv2 ClientHello tests
@@ -122,51 +127,56 @@ ok(TLSProxy::Message->fail(), "Alert before SSLv2 ClientHello test");
#Unrecognised record type tests
#Test 10: Sending an unrecognised record type in TLS1.2 should fail
$fatal_alert = 0;
$proxy->clear();
$proxy->serverflags("-tls1_2");
$proxy->filter(\&add_unknown_record_type);
$proxy->start();
ok(TLSProxy::Message->fail(), "Unrecognised record type in TLS1.2");
ok($fatal_alert, "Unrecognised record type in TLS1.2");
SKIP: {
skip "TLSv1.1 disabled", 1 if disabled("tls1_1");
#Test 11: Sending an unrecognised record type in TLS1.1 should fail
$fatal_alert = 0;
$proxy->clear();
$proxy->clientflags("-tls1_1");
$proxy->start();
ok(TLSProxy::Message->fail(), "Unrecognised record type in TLS1.1");
ok($fatal_alert, "Unrecognised record type in TLS1.1");
}
#Test 12: Sending a different record version in TLS1.2 should fail
$fatal_alert = 0;
$proxy->clear();
$proxy->clientflags("-tls1_2");
$proxy->filter(\&change_version);
$proxy->start();
ok(TLSProxy::Message->fail(), "Changed record version in TLS1.2");
ok($fatal_alert, "Changed record version in TLS1.2");
#TLS1.3 specific tests
SKIP: {
skip "TLSv1.3 disabled", 6 if disabled("tls1_3");
#Test 13: Sending a different record version in TLS1.3 should succeed
#Test 13: Sending a different record version in TLS1.3 should fail
$proxy->clear();
$proxy->filter(\&change_version);
$proxy->start();
ok(TLSProxy::Message->success(), "Changed record version in TLS1.3");
ok(TLSProxy::Message->fail(), "Changed record version in TLS1.3");
#Test 14: Sending an unrecognised record type in TLS1.3 should fail
$fatal_alert = 0;
$proxy->clear();
$proxy->filter(\&add_unknown_record_type);
$proxy->start();
ok(TLSProxy::Message->fail(), "Unrecognised record type in TLS1.3");
ok($fatal_alert, "Unrecognised record type in TLS1.3");
#Test 15: Sending an outer record type other than app data once encrypted
#should fail
$fatal_alert = 0;
$proxy->clear();
$proxy->filter(\&change_outer_record_type);
$proxy->start();
ok(TLSProxy::Message->fail(), "Wrong outer record type in TLS1.3");
ok($fatal_alert, "Wrong outer record type in TLS1.3");
use constant {
DATA_AFTER_SERVER_HELLO => 0,
@@ -176,36 +186,41 @@ SKIP: {
#Test 16: Sending a ServerHello which doesn't end on a record boundary
# should fail
$fatal_alert = 0;
$proxy->clear();
$boundary_test_type = DATA_AFTER_SERVER_HELLO;
$proxy->filter(\&not_on_record_boundary);
$proxy->start();
ok(TLSProxy::Message->fail(), "Record not on boundary in TLS1.3 (ServerHello)");
ok($fatal_alert, "Record not on boundary in TLS1.3 (ServerHello)");
#Test 17: Sending a Finished which doesn't end on a record boundary
# should fail
$fatal_alert = 0;
$proxy->clear();
$boundary_test_type = DATA_AFTER_FINISHED;
$proxy->filter(\&not_on_record_boundary);
$proxy->start();
ok(TLSProxy::Message->fail(), "Record not on boundary in TLS1.3 (Finished)");
ok($fatal_alert, "Record not on boundary in TLS1.3 (Finished)");
#Test 18: Sending a KeyUpdate which doesn't end on a record boundary
# should fail
$fatal_alert = 0;
$proxy->clear();
$boundary_test_type = DATA_AFTER_KEY_UPDATE;
$proxy->filter(\&not_on_record_boundary);
$proxy->start();
ok(TLSProxy::Message->fail(), "Record not on boundary in TLS1.3 (KeyUpdate)");
ok($fatal_alert, "Record not on boundary in TLS1.3 (KeyUpdate)");
}
sub add_empty_recs_filter
{
my $proxy = shift;
my $records = $proxy->record_list;
# We're only interested in the initial ClientHello
if ($proxy->flight != 0) {
$fatal_alert = 1 if @{$records}[-1]->is_fatal_alert(1) == 10;
return;
}
@@ -221,18 +236,19 @@ sub add_empty_recs_filter
"",
""
);
push @{$proxy->record_list}, $record;
push @{$records}, $record;
}
}
sub add_frag_alert_filter
{
my $proxy = shift;
my $records = $proxy->record_list;
my $byte;
# We're only interested in the initial ClientHello
if ($proxy->flight != 0) {
$fatal_alert = 1 if @{$records}[-1]->is_fatal_alert(1) == 10;
return;
}
@@ -262,7 +278,7 @@ sub add_frag_alert_filter
$byte,
$byte
);
push @{$proxy->record_list}, $record;
push @{$records}, $record;
# And finally the description (Unexpected message) in a third record
$byte = pack('C', TLSProxy::Message::AL_DESC_UNEXPECTED_MESSAGE);
@@ -277,7 +293,7 @@ sub add_frag_alert_filter
$byte,
$byte
);
push @{$proxy->record_list}, $record;
push @{$records}, $record;
}
sub add_sslv2_filter
@@ -430,17 +446,22 @@ sub add_sslv2_filter
sub add_unknown_record_type
{
my $proxy = shift;
my $records = $proxy->record_list;
state $added_record;
# We'll change a record after the initial version neg has taken place
if ($proxy->flight != 1) {
if ($proxy->flight == 0) {
$added_record = 0;
return;
} elsif ($proxy->flight != 1 || $added_record) {
$fatal_alert = 1 if @{$records}[-1]->is_fatal_alert(0) == 10;
return;
}
my $lastrec = ${$proxy->record_list}[-1];
my $record = TLSProxy::Record->new(
1,
TLSProxy::Record::RT_UNKNOWN,
$lastrec->version(),
@{$records}[-1]->version(),
1,
0,
1,
@@ -457,64 +478,86 @@ sub add_unknown_record_type
$i++;
splice @{$proxy->record_list}, $i, 0, $record;
$added_record = 1;
}
sub change_version
{
my $proxy = shift;
my $records = $proxy->record_list;
# We'll change a version after the initial version neg has taken place
if ($proxy->flight != 2) {
if ($proxy->flight != 1) {
$fatal_alert = 1 if @{$records}[-1]->is_fatal_alert(0) == 70;
return;
}
(${$proxy->record_list}[-1])->version(TLSProxy::Record::VERS_TLS_1_1);
if ($#{$records} > 1) {
# ... typically in ServerHelloDone
@{$records}[-1]->version(TLSProxy::Record::VERS_TLS_1_1);
}
}
sub change_outer_record_type
{
my $proxy = shift;
my $records = $proxy->record_list;
# We'll change a record after the initial version neg has taken place
if ($proxy->flight != 1) {
$fatal_alert = 1 if @{$records}[-1]->is_fatal_alert(0) == 10;
return;
}
#Find ServerHello record and change record after that
my $i;
for ($i = 0; ${$proxy->record_list}[$i]->flight() < 1; $i++) {
next;
# Find CCS record and change record after that
my $i = 0;
foreach my $record (@{$records}) {
last if $record->content_type == TLSProxy::Record::RT_CCS;
$i++;
}
if (defined(${$records}[++$i])) {
${$records}[$i]->outer_content_type(TLSProxy::Record::RT_HANDSHAKE);
}
#Skip CCS and ServerHello
$i += 2;
${$proxy->record_list}[$i]->outer_content_type(TLSProxy::Record::RT_HANDSHAKE);
}
sub not_on_record_boundary
{
my $proxy = shift;
my $records = $proxy->record_list;
my $data;
#Find server's first flight
if ($proxy->flight != 1) {
$fatal_alert = 1 if @{$records}[-1]->is_fatal_alert(0) == 10;
return;
}
if ($boundary_test_type == DATA_AFTER_SERVER_HELLO) {
#Merge the ServerHello and EncryptedExtensions records into one
my $i;
for ($i = 0; ${$proxy->record_list}[$i]->flight() < 1; $i++) {
next;
my $i = 0;
foreach my $record (@{$records}) {
if ($record->content_type == TLSProxy::Record::RT_HANDSHAKE) {
$record->{sent} = 1; # pretend it's sent already
last;
}
$i++;
}
$data = ${$proxy->record_list}[$i]->data();
$data .= ${$proxy->record_list}[$i + 1]->decrypt_data();
${$proxy->record_list}[$i]->data($data);
${$proxy->record_list}[$i]->len(length $data);
#Delete the old EncryptedExtensions record
splice @{$proxy->record_list}, $i + 1, 1;
if (defined(${$records}[$i+1])) {
$data = ${$records}[$i]->data();
$data .= ${$records}[$i+1]->decrypt_data();
${$records}[$i+1]->data($data);
${$records}[$i+1]->len(length $data);
#Delete the old ServerHello record
splice @{$records}, $i, 1;
}
} elsif ($boundary_test_type == DATA_AFTER_FINISHED) {
$data = ${$proxy->record_list}[-1]->decrypt_data;
return if @{$proxy->{message_list}}[-1]->{mt}
!= TLSProxy::Message::MT_FINISHED;
my $last_record = @{$records}[-1];
$data = $last_record->decrypt_data;
#Add a KeyUpdate message onto the end of the Finished record
my $keyupdate = pack "C5",
@@ -528,15 +571,18 @@ sub not_on_record_boundary
$data .= pack("C", TLSProxy::Record::RT_HANDSHAKE).("\0"x16);
#Update the record
${$proxy->record_list}[-1]->data($data);
${$proxy->record_list}[-1]->len(length $data);
$last_record->data($data);
$last_record->len(length $data);
} else {
return if @{$proxy->{message_list}}[-1]->{mt}
!= TLSProxy::Message::MT_FINISHED;
#KeyUpdates must end on a record boundary
my $record = TLSProxy::Record->new(
1,
TLSProxy::Record::RT_APPLICATION_DATA,
TLSProxy::Record::VERS_TLS_1_0,
TLSProxy::Record::VERS_TLS_1_2,
0,
0,
0,
@@ -558,6 +604,6 @@ sub not_on_record_boundary
$record->data($data);
$record->len(length $data);
push @{$proxy->record_list}, $record;
push @{$records}, $record;
}
}
test/recipes/70-test_sslsigalgs.t
+9 -9
View File
@@ -116,7 +116,7 @@ SKIP: {
# should succeed
$proxy->clear();
$proxy->serverflags("-no_tls1_3");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->filter(undef);
$proxy->start();
ok(TLSProxy::Message->success, "TLSv1.3 client TLSv1.2 server");
@@ -131,7 +131,7 @@ SKIP: {
$proxy->clear();
$testtype = NO_SIG_ALGS_EXT;
$proxy->clientflags("-no_tls1_3");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->success, "No TLSv1.2 sigalgs");
@@ -139,7 +139,7 @@ SKIP: {
$proxy->clear();
$testtype = EMPTY_SIG_ALGS_EXT;
$proxy->clientflags("-no_tls1_3");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->fail, "Empty TLSv1.2 sigalgs");
@@ -147,7 +147,7 @@ SKIP: {
$proxy->clear();
$testtype = NO_KNOWN_SIG_ALGS;
$proxy->clientflags("-no_tls1_3");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->fail, "No known TLSv1.3 sigalgs");
@@ -156,7 +156,7 @@ SKIP: {
$proxy->clear();
$testtype = NO_PSS_SIG_ALGS;
$proxy->clientflags("-no_tls1_3");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->success, "No PSS TLSv1.2 sigalgs");
@@ -164,7 +164,7 @@ SKIP: {
$proxy->clear();
$testtype = PSS_ONLY_SIG_ALGS;
$proxy->serverflags("-no_tls1_3");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->success, "PSS only sigalgs in TLSv1.2");
@@ -175,7 +175,7 @@ SKIP: {
$proxy->clear();
$testtype = PSS_ONLY_SIG_ALGS;
$proxy->clientflags("-no_tls1_3 -sigalgs RSA+SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->fail, "Sigalg we did not send in TLSv1.2");
@@ -183,7 +183,7 @@ SKIP: {
# matches the certificate should fail in TLSv1.2
$proxy->clear();
$proxy->clientflags("-no_tls1_3 -sigalgs ECDSA+SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->filter(undef);
$proxy->start();
ok(TLSProxy::Message->fail, "No matching TLSv1.2 sigalgs");
@@ -197,7 +197,7 @@ SKIP: {
"server-ecdsa-cert.pem") .
" -key " . srctop_file("test", "certs",
"server-ecdsa-key.pem")),
$proxy->ciphers("ECDHE-ECDSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-ECDSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->success, "No TLSv1.2 sigalgs, ECDSA");
}
test/recipes/70-test_sslversions.t
+4 -3
View File
@@ -138,7 +138,8 @@ sub modify_supported_versions_filter
$ext = pack "C5",
0x04, # Length
0x03, 0x03, #TLSv1.2
0x03, 0x04; #TLSv1.3
#TODO(TLS1.3): Fix before release
0x7f, 0x1c; #TLSv1.3 (draft 28)
} elsif ($testtype == UNRECOGNISED_VERSIONS) {
$ext = pack "C5",
0x04, # Length
@@ -152,8 +153,8 @@ sub modify_supported_versions_filter
} elsif ($testtype == WITH_TLS1_4) {
$ext = pack "C5",
0x04, # Length
0x03, 0x05, #TLSv1.4
0x03, 0x04; #TLSv1.3
#TODO(TLS1.3): Fix before release
0x7f, 0x1c; #TLSv1.3 (draft 28)
}
if ($testtype == REVERSE_ORDER_VERSIONS
|| $testtype == UNRECOGNISED_VERSIONS
test/recipes/70-test_tls13hrr.t
+2 -3
View File
@@ -53,7 +53,7 @@ ok(TLSProxy::Message->fail(), "Server ciphersuite changes");
# we end up selecting a different ciphersuite between HRR and the SH
$proxy->clear();
$proxy->serverflags("-curves P-256");
$proxy->ciphers("TLS13-AES-128-GCM-SHA256:TLS13-AES-256-GCM-SHA384");
$proxy->ciphersuitess("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384");
$testtype = CHANGE_CH1_CIPHERSUITE;
$proxy->start();
ok(TLSProxy::Message->fail(), "Client ciphersuite changes");
@@ -85,8 +85,7 @@ sub hrr_filter
my $ch1 = ${$proxy->message_list}[0];
# The server prefers TLS13-AES-256-GCM-SHA384 so it will pick that next
# time around
# The server will always pick TLS_AES_256_GCM_SHA384
my @ciphersuites = (TLSProxy::Message::CIPHER_TLS13_AES_128_GCM_SHA256);
$ch1->ciphersuite_len(2 * scalar @ciphersuites);
$ch1->ciphersuites(\@ciphersuites);
test/recipes/70-test_tls13psk.t
+4 -4
View File
@@ -63,7 +63,7 @@ $proxy->start();
ok(TLSProxy::Message->fail(), "PSK not last");
#Test 3: Attempt a resume after an HRR where PSK hash matches selected
# ciperhsuite. Should see PSK on second ClientHello
# ciphersuite. Should see PSK on second ClientHello
$proxy->clear();
$proxy->clientflags("-sess_in ".$session);
$proxy->serverflags("-curves P-256");
@@ -82,10 +82,10 @@ $proxy->clear();
$proxy->clientflags("-sess_in ".$session);
$proxy->filter(\&modify_psk_filter);
$proxy->serverflags("-curves P-256");
$proxy->cipherc("TLS13-AES-128-GCM-SHA256:TLS13-AES-256-GCM-SHA384");
$proxy->ciphers("TLS13-AES-256-GCM-SHA384");
$proxy->ciphersuitesc("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384");
$proxy->ciphersuitess("TLS_AES_256_GCM_SHA384");
#We force an early failure because TLS Proxy doesn't actually support
#TLS13-AES-256-GCM-SHA384. That doesn't matter for this test though.
#TLS_AES_256_GCM_SHA384. That doesn't matter for this test though.
$testtype = ILLEGAL_EXT_SECOND_CH;
$proxy->start();
#Check if the PSK is present in the second ClientHello
test/recipes/80-test_cipherlist.t
+7 -2
View File
@@ -1,6 +1,6 @@
#! /usr/bin/perl
#
# Copyright 2016-2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -12,11 +12,16 @@ use strict;
use warnings;
use OpenSSL::Test::Simple;
use OpenSSL::Test;
use OpenSSL::Test qw(:DEFAULT openssl_versions);
use OpenSSL::Test::Utils qw(alldisabled available_protocols);
setup("test_cipherlist");
my ($build_version, $library_version) = openssl_versions();
plan skip_all =>
"This test recipe isn't supported when doing regression testing"
if $build_version != $library_version;
my $no_anytls = alldisabled(available_protocols("tls"));
# If we have no protocols, then we also have no supported ciphers.
test/recipes/80-test_cmsapi.t
+21
View File
@@ -0,0 +1,21 @@
#! /usr/bin/env perl
# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
use OpenSSL::Test::Utils;
use OpenSSL::Test qw/:DEFAULT srctop_file/;
setup("test_cmsapi");
plan skip_all => "CMS is disabled in this build" if disabled("cms");
plan tests => 1;
ok(run(test(["cmsapitest", srctop_file("test", "certs", "servercert.pem"),
srctop_file("test", "certs", "serverkey.pem")])),
"running cmsapitest");
test/recipes/80-test_ssl_new.t
+1
View File
@@ -68,6 +68,7 @@ my %conf_dependent_tests = (
"20-cert-select.conf" => !$is_default_tls || $no_dh || $no_dsa,
"22-compression.conf" => !$is_default_tls,
"25-cipher.conf" => disabled("poly1305") || disabled("chacha"),
"27-ticket-appdata.conf" => !$is_default_tls,
);
# Add your test here if it should be skipped for some compile-time
test/recipes/80-test_ssl_old.t
+15 -6
View File
@@ -432,9 +432,12 @@ sub testssl {
if $protocolciphersuitecount + scalar(keys %ciphersuites) == 0;
# The count of protocols is because in addition to the ciphersuites
# we got above, we're running a weak DH test for each protocol
plan tests => scalar(@protocols) + $protocolciphersuitecount
+ scalar(keys %ciphersuites);
# we got above, we're running a weak DH test for each protocol (except
# TLSv1.3)
my $testcount = scalar(@protocols) + $protocolciphersuitecount
+ scalar(keys %ciphersuites);
$testcount-- unless $no_tls1_3;
plan tests => $testcount;
foreach my $protocol (@protocols) {
ok($ciphersstatus{$protocol}, "Getting ciphers for $protocol");
@@ -445,21 +448,27 @@ sub testssl {
# ssltest_old doesn't know -tls1_3, but that's fine, since that's
# the default choice if TLSv1.3 enabled
my $flag = $protocol eq "-tls1_3" ? "" : $protocol;
my $ciphersuites = "";
foreach my $cipher (@{$ciphersuites{$protocol}}) {
if ($protocol eq "-ssl3" && $cipher =~ /ECDH/ ) {
note "*****SKIPPING $protocol $cipher";
ok(1);
} else {
if ($protocol eq "-tls1_3") {
$ciphersuites = $cipher;
$cipher = "";
}
ok(run(test([@ssltest, @exkeys, "-cipher", $cipher,
$flag || ()])),
"Testing $cipher");
"-ciphersuites", $ciphersuites, $flag || ()])),
"Testing $cipher");
}
}
next if $protocol eq "-tls1_3";
is(run(test([@ssltest,
"-s_cipher", "EDH",
"-c_cipher", 'EDH:@SECLEVEL=1',
"-dhe512",
$protocol eq "SSLv3" ? ("-ssl3") : ()])), 0,
$protocol])), 0,
"testing connection with weak DH, expecting failure");
}
};
test/recipes/90-test_shlibload.t
+4 -2
View File
@@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -20,7 +20,7 @@ use configdata;
plan skip_all => "Test only supported in a shared build" if disabled("shared");
plan tests => 3;
plan tests => 4;
my $libcrypto_idx = $unified_info{rename}->{libcrypto} // "libcrypto";
my $libssl_idx = $unified_info{rename}->{libssl} // "libssl";
@@ -35,4 +35,6 @@ ok(run(test(["shlibloadtest", "-ssl_first", $libcrypto, $libssl])),
"running shlibloadtest -ssl_first");
ok(run(test(["shlibloadtest", "-just_crypto", $libcrypto, $libssl])),
"running shlibloadtest -just_crypto");
ok(run(test(["shlibloadtest", "-dso_ref", $libcrypto, $libssl])),
"running shlibloadtest -dso_ref");
test/recipes/90-test_sslapi.t
+10 -2
View File
@@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -9,6 +9,7 @@
use OpenSSL::Test::Utils;
use OpenSSL::Test qw/:DEFAULT srctop_file/;
use File::Temp qw(tempfile);
setup("test_sslapi");
@@ -17,5 +18,12 @@ plan skip_all => "No TLS/SSL protocols are supported by this OpenSSL build"
plan tests => 1;
(undef, my $tmpfilename) = tempfile();
ok(run(test(["sslapitest", srctop_file("apps", "server.pem"),
srctop_file("apps", "server.pem")])), "running sslapitest");
srctop_file("apps", "server.pem"),
srctop_file("test", "recipes", "90-test_sslapi_data",
"passwd.txt"), $tmpfilename])),
"running sslapitest");
unlink $tmpfilename;
test/recipes/90-test_sslapi_data/passwd.txt
+1
View File
@@ -0,0 +1 @@
V 1auIY/NQXwKWVeWaYg.YV0AaU.mpHSsZw8PWfrYT0oMTPYekTqGXu6ElyTN64DmK03V3P2yVRdhN0UBxMBujLnTauROkuEep/vp7S5xhW1VK8zg1gtJslTqOp4l.GTJF9x0WYmS6VNRnj5AVi3mgfVJ3nmzlMJUMm7niQxm5awLZZ8xykox1j6MFRa80y02Ub87A88DwqA5wrIM/Uojx9VBxUhTHC.353aBA/rL4O/179rgIBbhID08RA6uLv7pIJQVl5OjYsRu/XzQsgFFW6Wog7PaB.AATqArzXZieZxs/teOiFKPSgKI.76vvVEMQIifSj3hRuVK/immK.9hBCTHYjAv96MUmitb0ErPYJRl2MeBC8M6aHJ8FaMmak.Qv.bwyiqpEjlX1a9KjdBAKIaAswECjeP6G0Gk5v1g5D7ZmP5JUK7Wp/X9sKuZZYOsDwEGfXNmmJG6Y3TETx105HT2QMJ5ti5QCbrd71VWABmVWpHJc03YLUExw6WtYdUW0YHTbRKVntgVe2hOQD.XPtFPn2SwxbGonq1bwEvdCp22uTb5HFSC3I7amCUTZteVmMgqJAcx.x.2yfliESVvpmG.dnDFkp6vsQxch6Q1dV5rDmR4GGSy8FoPSFXc7NS0kCSs.qsTqLSmHN1XMzwrwYuVbItXBwetwxcIcdi.sFG6OLuwRUGaNOXiMwhlDHyQtVfEm3L/KIjPpzLlYRAJWF9M40FIcNsI6xiMNhvUGNO7LaBHKSV3oHlwUWWUnL7Uo/ePH8lBpGadYPxObXZ1/wOcWdJ1Rb5dB9orSSTSvoNrZyALKO.swl7pP7beYq6bUx8qtBJLaqI2zQzr1tnmJi8azVicuFtsDs363ntCRtd1LLT3CX3EBVXMbEy6xgAKWI2GL3HO6v8k3Gv96UeGFN/w5yAz61mbajDrSeJekUaKgfucV8h9tgHNlTA1kGowd2Yn/EQdVc/qSETddySqNC0mXlPW1tgb2ixV6sWbYrb5TLBUdztdw5L2D62Aal.9IjpTEKc4F/gMjYsazIX6nzpXZtWnYP7dIOpSi4c.48B2RIeDrZVMzUF.9QOF9Dk1fy5Z2X91z8J2I0GuqIWKKfwnx4xA3RbGUds1Cv2XvUA1tP7eqtvs/mTsC8KWApNSpL6K.U.Pt0ee6F76CV.ZcBXTbXl9zJZ0H1peiehzZpbuIPLZPtzIHClRQovjqdrlEUzS5VdSgCfNhEUr3ZOpG3cCKO4Lk25jZuQtoFmyxUuRAIXejLizCd727hO7rHZoD.GGm4HiNaH2jgZaftoFhfSBXvPRGYfcj.ZkiLyurNlumMXTduHImB1ZMkZ1af5dggKaQG4bJe9WbF6KYxmeRwV 1oFJIzMwXA0RFKXCGcSV0nAToL5 test 8192 A test user
test/recipes/90-test_store.t
+38 -33
View File
@@ -89,84 +89,89 @@ indir "store_$$" => sub {
foreach (@noexist_files) {
my $file = srctop_file($_);
ok(!run(app(["openssl", "storeutl", $file])));
ok(!run(app(["openssl", "storeutl", to_abs_file($file)])));
ok(!run(app(["openssl", "storeutl", "-noout", $file])));
ok(!run(app(["openssl", "storeutl", "-noout",
to_abs_file($file)])));
{
local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
ok(!run(app(["openssl", "storeutl", to_abs_file_uri($file)])));
ok(!run(app(["openssl", "storeutl", "-noout",
to_abs_file_uri($file)])));
}
}
foreach (@src_files) {
my $file = srctop_file($_);
ok(run(app(["openssl", "storeutl", $file])));
ok(run(app(["openssl", "storeutl", to_abs_file($file)])));
ok(run(app(["openssl", "storeutl", "-noout", $file])));
ok(run(app(["openssl", "storeutl", "-noout", to_abs_file($file)])));
{
local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
ok(run(app(["openssl", "storeutl", to_abs_file_uri($file)])));
ok(run(app(["openssl", "storeutl",
ok(run(app(["openssl", "storeutl", "-noout",
to_abs_file_uri($file)])));
ok(run(app(["openssl", "storeutl", "-noout",
to_abs_file_uri($file, 0, "")])));
ok(run(app(["openssl", "storeutl",
ok(run(app(["openssl", "storeutl", "-noout",
to_abs_file_uri($file, 0, "localhost")])));
ok(!run(app(["openssl", "storeutl",
ok(!run(app(["openssl", "storeutl", "-noout",
to_abs_file_uri($file, 0, "dummy")])));
}
}
foreach (@generated_files) {
ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
$_])));
ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
to_abs_file($_)])));
ok(run(app(["openssl", "storeutl", "-noout", "-passin",
"pass:password", $_])));
ok(run(app(["openssl", "storeutl", "-noout", "-passin",
"pass:password", to_abs_file($_)])));
{
local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
to_abs_file_uri($_)])));
ok(!run(app(["openssl", "storeutl", "-passin", "pass:password",
to_file_uri($_)])));
ok(run(app(["openssl", "storeutl", "-noout", "-passin",
"pass:password", to_abs_file_uri($_)])));
ok(!run(app(["openssl", "storeutl", "-noout", "-passin",
"pass:password", to_file_uri($_)])));
}
}
foreach (values %generated_file_files) {
local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
ok(run(app(["openssl", "storeutl", $_])));
ok(run(app(["openssl", "storeutl", "-noout", $_])));
}
foreach (@noexist_file_files) {
local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
ok(!run(app(["openssl", "storeutl", $_])));
ok(!run(app(["openssl", "storeutl", "-noout", $_])));
}
{
my $dir = srctop_dir("test", "certs");
ok(run(app(["openssl", "storeutl", $dir])));
ok(run(app(["openssl", "storeutl", to_abs_file($dir, 1)])));
ok(run(app(["openssl", "storeutl", "-noout", $dir])));
ok(run(app(["openssl", "storeutl", "-noout",
to_abs_file($dir, 1)])));
{
local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
ok(run(app(["openssl", "storeutl", to_abs_file_uri($dir, 1)])));
ok(run(app(["openssl", "storeutl", "-noout",
to_abs_file_uri($dir, 1)])));
}
}
ok(!run(app(['openssl', 'storeutl',
ok(!run(app(['openssl', 'storeutl', '-noout',
'-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
srctop_file('test', 'testx509.pem')])),
"Checking that -subject can't be used with a single file");
ok(run(app(['openssl', 'storeutl', '-certs',
ok(run(app(['openssl', 'storeutl', '-certs', '-noout',
srctop_file('test', 'testx509.pem')])),
"Checking that -certs returns 1 object on a certificate file");
ok(run(app(['openssl', 'storeutl', '-certs',
ok(run(app(['openssl', 'storeutl', '-certs', '-noout',
srctop_file('test', 'testcrl.pem')])),
"Checking that -certs returns 0 objects on a CRL file");
ok(run(app(['openssl', 'storeutl', '-crls',
ok(run(app(['openssl', 'storeutl', '-crls', '-noout',
srctop_file('test', 'testx509.pem')])),
"Checking that -crls returns 0 objects on a certificate file");
ok(run(app(['openssl', 'storeutl', '-crls',
ok(run(app(['openssl', 'storeutl', '-crls', '-noout',
srctop_file('test', 'testcrl.pem')])),
"Checking that -crls returns 1 object on a CRL file");
@@ -177,24 +182,24 @@ indir "store_$$" => sub {
# '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert'
# issuer from testcrl.pem:
# '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority'
ok(run(app(['openssl', 'storeutl',
ok(run(app(['openssl', 'storeutl', '-noout',
'-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
catdir(curdir(), 'rehash')])));
ok(run(app(['openssl', 'storeutl',
ok(run(app(['openssl', 'storeutl', '-noout',
'-subject',
'/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
catdir(curdir(), 'rehash')])));
ok(run(app(['openssl', 'storeutl', '-certs',
ok(run(app(['openssl', 'storeutl', '-noout', '-certs',
'-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
catdir(curdir(), 'rehash')])));
ok(run(app(['openssl', 'storeutl', '-crls',
ok(run(app(['openssl', 'storeutl', '-noout', '-crls',
'-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
catdir(curdir(), 'rehash')])));
ok(run(app(['openssl', 'storeutl', '-certs',
ok(run(app(['openssl', 'storeutl', '-noout', '-certs',
'-subject',
'/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
catdir(curdir(), 'rehash')])));
ok(run(app(['openssl', 'storeutl', '-crls',
ok(run(app(['openssl', 'storeutl', '-noout', '-crls',
'-subject',
'/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
catdir(curdir(), 'rehash')])));
test/recipes/90-test_sysdefault.t
+23
View File
@@ -0,0 +1,23 @@
#! /usr/bin/env perl
# Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
use OpenSSL::Test::Utils;
use OpenSSL::Test qw/:DEFAULT srctop_file/;
my $test_name = "test_sysdefault";
setup($test_name);
plan skip_all => "$test_name is not supported in this build"
if disabled("tls1_2") || disabled("rsa");
plan tests => 1;
$ENV{OPENSSL_CONF} = srctop_file("test", "sysdefault.cnf");
ok(run(test(["sysdefaulttest"])), "sysdefaulttest");
test/recipes/99-test_fuzz.t
+6 -6
View File
@@ -1,5 +1,5 @@
#!/usr/bin/env perl
# Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -26,14 +26,14 @@ plan tests => scalar @fuzzers;
foreach my $f (@fuzzers) {
subtest "Fuzzing $f" => sub {
my @files = glob(srctop_file('fuzz', 'corpora', $f, '*'));
push @files, glob(srctop_file('fuzz', 'corpora', "$f-*", '*'));
my @dirs = glob(srctop_file('fuzz', 'corpora', $f));
push @dirs, glob(srctop_file('fuzz', 'corpora', "$f-*"));
plan skip_all => "No corpora for $f-test" unless @files;
plan skip_all => "No corpora for $f-test" unless @dirs;
plan tests => scalar @files;
plan tests => scalar @dirs;
foreach (@files) {
foreach (@dirs) {
ok(run(fuzz(["$f-test", $_])));
}
}
test/recordlentest.c
+3 -6
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -103,6 +103,7 @@ static int test_record_overflow(int idx)
ERR_clear_error();
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
goto end;
@@ -157,11 +158,7 @@ static int test_record_overflow(int idx)
overf_expected = 0;
}
if (idx == TEST_ENCRYPTED_OVERFLOW_TLS1_3_OK
|| idx == TEST_ENCRYPTED_OVERFLOW_TLS1_3_NOT_OK)
recversion = TLS1_VERSION;
else
recversion = TLS1_2_VERSION;
recversion = TLS1_2_VERSION;
if (!TEST_true(write_record(serverbio, len, SSL3_RT_APPLICATION_DATA,
recversion)))
test/run_tests.pl
+3 -1
View File
@@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -28,6 +28,8 @@ my $bldtop = $ENV{BLDTOP} || $ENV{TOP};
my $recipesdir = catdir($srctop, "test", "recipes");
my $libdir = rel2abs(catdir($srctop, "util", "perl"));
$ENV{OPENSSL_CONF} = catdir($srctop, "apps", "openssl.cnf");
my %tapargs =
( verbosity => $ENV{VERBOSE} || $ENV{V} || $ENV{HARNESS_VERBOSE} ? 1 : 0,
lib => [ $libdir ],
test/shlibloadtest.c
+63 -4
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -13,18 +13,24 @@
#include <openssl/opensslv.h>
#include <openssl/ssl.h>
#include <openssl/ossl_typ.h>
#include "internal/dso_conf.h"
#include "testutil.h"
typedef void DSO;
typedef const SSL_METHOD * (*TLS_method_t)(void);
typedef SSL_CTX * (*SSL_CTX_new_t)(const SSL_METHOD *meth);
typedef void (*SSL_CTX_free_t)(SSL_CTX *);
typedef unsigned long (*ERR_get_error_t)(void);
typedef unsigned long (*OpenSSL_version_num_t)(void);
typedef DSO * (*DSO_dsobyaddr_t)(void (*addr)(void), int flags);
typedef int (*DSO_free_t)(DSO *dso);
typedef enum test_types_en {
CRYPTO_FIRST,
SSL_FIRST,
JUST_CRYPTO
JUST_CRYPTO,
DSO_REFTEST
} TEST_TYPE;
static TEST_TYPE test_type;
@@ -119,9 +125,13 @@ static int test_lib(void)
|| !TEST_true(shlib_load(path_crypto, &cryptolib)))
goto end;
break;
case DSO_REFTEST:
if (!TEST_true(shlib_load(path_crypto, &cryptolib)))
goto end;
break;
}
if (test_type != JUST_CRYPTO) {
if (test_type != JUST_CRYPTO && test_type != DSO_REFTEST) {
if (!TEST_true(shlib_sym(ssllib, "TLS_method", &symbols[0].sym))
|| !TEST_true(shlib_sym(ssllib, "SSL_CTX_new", &symbols[1].sym))
|| !TEST_true(shlib_sym(ssllib, "SSL_CTX_free", &symbols[2].sym)))
@@ -141,9 +151,52 @@ static int test_lib(void)
myERR_get_error = (ERR_get_error_t)symbols[0].func;
if (!TEST_int_eq(myERR_get_error(), 0))
goto end;
/*
* The bits that COMPATIBILITY_MASK lets through MUST be the same in
* the library and in the application.
* The bits that are masked away MUST be a larger or equal number in
* the library compared to the application.
*/
# define COMPATIBILITY_MASK 0xfff00000L
myOpenSSL_version_num = (OpenSSL_version_num_t)symbols[1].func;
if (!TEST_int_eq(myOpenSSL_version_num(), OPENSSL_VERSION_NUMBER))
if (!TEST_int_eq(myOpenSSL_version_num() & COMPATIBILITY_MASK,
OPENSSL_VERSION_NUMBER & COMPATIBILITY_MASK))
goto end;
if (!TEST_int_ge(myOpenSSL_version_num() & ~COMPATIBILITY_MASK,
OPENSSL_VERSION_NUMBER & ~COMPATIBILITY_MASK))
goto end;
if (test_type == DSO_REFTEST) {
# ifdef DSO_DLFCN
DSO_dsobyaddr_t myDSO_dsobyaddr;
DSO_free_t myDSO_free;
/*
* This is resembling the code used in ossl_init_base() and
* OPENSSL_atexit() to block unloading the library after dlclose().
* We are not testing this on Windows, because it is done there in a
* completely different way. Especially as a call to DSO_dsobyaddr()
* will always return an error, because DSO_pathbyaddr() is not
* implemented there.
*/
if (!TEST_true(shlib_sym(cryptolib, "DSO_dsobyaddr", &symbols[0].sym))
|| !TEST_true(shlib_sym(cryptolib, "DSO_free",
&symbols[1].sym)))
goto end;
myDSO_dsobyaddr = (DSO_dsobyaddr_t)symbols[0].func;
myDSO_free = (DSO_free_t)symbols[1].func;
{
DSO *hndl;
/* use known symbol from crypto module */
if (!TEST_ptr(hndl = myDSO_dsobyaddr((void (*)(void))ERR_get_error, 0)))
goto end;
myDSO_free(hndl);
}
# endif /* DSO_DLFCN */
}
switch (test_type) {
case JUST_CRYPTO:
@@ -160,6 +213,10 @@ static int test_lib(void)
|| !TEST_true(shlib_close(cryptolib)))
goto end;
break;
case DSO_REFTEST:
if (!TEST_true(shlib_close(cryptolib)))
goto end;
break;
}
result = 1;
@@ -179,6 +236,8 @@ int setup_tests(void)
test_type = SSL_FIRST;
} else if (strcmp(p, "-just_crypto") == 0) {
test_type = JUST_CRYPTO;
} else if (strcmp(p, "-dso_ref") == 0) {
test_type = JUST_CRYPTO;
} else {
TEST_error("Unrecognised argument");
return 0;
test/sm2crypttest.c
+254
View File
@@ -0,0 +1,254 @@
/*
* Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <openssl/bio.h>
#include <openssl/evp.h>
#include <openssl/bn.h>
#include <openssl/crypto.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include "testutil.h"
#ifndef OPENSSL_NO_SM2
# include <openssl/sm2.h>
static RAND_METHOD fake_rand;
static const RAND_METHOD *saved_rand;
static uint8_t *fake_rand_bytes = NULL;
static size_t fake_rand_bytes_offset = 0;
static int get_faked_bytes(unsigned char *buf, int num)
{
int i;
if (fake_rand_bytes == NULL)
return saved_rand->bytes(buf, num);
for (i = 0; i != num; ++i)
buf[i] = fake_rand_bytes[fake_rand_bytes_offset + i];
fake_rand_bytes_offset += num;
return 1;
}
static int start_fake_rand(const char *hex_bytes)
{
/* save old rand method */
if (!TEST_ptr(saved_rand = RAND_get_rand_method()))
return 0;
fake_rand = *saved_rand;
/* use own random function */
fake_rand.bytes = get_faked_bytes;
fake_rand_bytes = OPENSSL_hexstr2buf(hex_bytes, NULL);
fake_rand_bytes_offset = 0;
/* set new RAND_METHOD */
if (!TEST_true(RAND_set_rand_method(&fake_rand)))
return 0;
return 1;
}
static int restore_rand(void)
{
OPENSSL_free(fake_rand_bytes);
fake_rand_bytes = NULL;
fake_rand_bytes_offset = 0;
if (!TEST_true(RAND_set_rand_method(saved_rand)))
return 0;
return 1;
}
static EC_GROUP *create_EC_group(const char *p_hex, const char *a_hex,
const char *b_hex, const char *x_hex,
const char *y_hex, const char *order_hex,
const char *cof_hex)
{
BIGNUM *p = NULL;
BIGNUM *a = NULL;
BIGNUM *b = NULL;
BIGNUM *g_x = NULL;
BIGNUM *g_y = NULL;
BIGNUM *order = NULL;
BIGNUM *cof = NULL;
EC_POINT *generator = NULL;
EC_GROUP *group = NULL;
BN_hex2bn(&p, p_hex);
BN_hex2bn(&a, a_hex);
BN_hex2bn(&b, b_hex);
group = EC_GROUP_new_curve_GFp(p, a, b, NULL);
BN_free(p);
BN_free(a);
BN_free(b);
if (group == NULL)
return NULL;
generator = EC_POINT_new(group);
if (generator == NULL)
return NULL;
BN_hex2bn(&g_x, x_hex);
BN_hex2bn(&g_y, y_hex);
if (EC_POINT_set_affine_coordinates_GFp(group, generator, g_x, g_y, NULL) ==
0)
return NULL;
BN_free(g_x);
BN_free(g_y);
BN_hex2bn(&order, order_hex);
BN_hex2bn(&cof, cof_hex);
if (EC_GROUP_set_generator(group, generator, order, cof) == 0)
return NULL;
EC_POINT_free(generator);
BN_free(order);
BN_free(cof);
return group;
}
static int test_sm2(const EC_GROUP *group,
const EVP_MD *digest,
const char *privkey_hex,
const char *message,
const char *k_hex, const char *ctext_hex)
{
const size_t msg_len = strlen(message);
BIGNUM *priv = NULL;
EC_KEY *key = NULL;
EC_POINT *pt = NULL;
unsigned char *expected = OPENSSL_hexstr2buf(ctext_hex, NULL);
size_t ctext_len = 0;
size_t ptext_len = 0;
uint8_t *ctext = NULL;
uint8_t *recovered = NULL;
size_t recovered_len = msg_len;
int rc = 0;
BN_hex2bn(&priv, privkey_hex);
key = EC_KEY_new();
EC_KEY_set_group(key, group);
EC_KEY_set_private_key(key, priv);
pt = EC_POINT_new(group);
EC_POINT_mul(group, pt, priv, NULL, NULL, NULL);
EC_KEY_set_public_key(key, pt);
BN_free(priv);
EC_POINT_free(pt);
ctext_len = SM2_ciphertext_size(key, digest, msg_len);
ctext = OPENSSL_zalloc(ctext_len);
if (ctext == NULL)
goto done;
start_fake_rand(k_hex);
rc = SM2_encrypt(key, digest,
(const uint8_t *)message, msg_len, ctext, &ctext_len);
restore_rand();
TEST_mem_eq(ctext, ctext_len, expected, ctext_len);
if (rc == 0)
goto done;
ptext_len = SM2_plaintext_size(key, digest, ctext_len);
TEST_int_eq(ptext_len, msg_len);
recovered = OPENSSL_zalloc(ptext_len);
if (recovered == NULL)
goto done;
rc = SM2_decrypt(key, digest, ctext, ctext_len, recovered, &recovered_len);
TEST_int_eq(recovered_len, msg_len);
TEST_mem_eq(recovered, recovered_len, message, msg_len);
if (rc == 0)
return 0;
rc = 1;
done:
OPENSSL_free(ctext);
OPENSSL_free(recovered);
OPENSSL_free(expected);
EC_KEY_free(key);
return rc;
}
static int sm2_crypt_test(void)
{
int rc;
EC_GROUP *test_group =
create_EC_group
("8542D69E4C044F18E8B92435BF6FF7DE457283915C45517D722EDB8B08F1DFC3",
"787968B4FA32C3FD2417842E73BBFEFF2F3C848B6831D7E0EC65228B3937E498",
"63E4C6D3B23B0C849CF84241484BFE48F61D59A5B16BA06E6E12D1DA27C5249A",
"421DEBD61B62EAB6746434EBC3CC315E32220B3BADD50BDC4C4E6C147FEDD43D",
"0680512BCBB42C07D47349D2153B70C4E5D7FDFCBFA36EA1A85841B9E46E09A2",
"8542D69E4C044F18E8B92435BF6FF7DD297720630485628D5AE74EE7C32E79B7",
"1");
if (test_group == NULL)
return 0;
rc = test_sm2(test_group,
EVP_sm3(),
"1649AB77A00637BD5E2EFE283FBF353534AA7F7CB89463F208DDBC2920BB0DA0",
"encryption standard",
"004C62EEFD6ECFC2B95B92FD6C3D9575148AFA17425546D49018E5388D49DD7B4F",
"307B0220245C26FB68B1DDDDB12C4B6BF9F2B6D5FE60A383B0D18D1C4144ABF1"
"7F6252E7022076CB9264C2A7E88E52B19903FDC47378F605E36811F5C07423A2"
"4B84400F01B804209C3D7360C30156FAB7C80A0276712DA9D8094A634B766D3A"
"285E07480653426D0413650053A89B41C418B0C3AAD00D886C00286467");
if (rc == 0)
return 0;
/* Same test as above except using SHA-256 instead of SM3 */
rc = test_sm2(test_group,
EVP_sha256(),
"1649AB77A00637BD5E2EFE283FBF353534AA7F7CB89463F208DDBC2920BB0DA0",
"encryption standard",
"004C62EEFD6ECFC2B95B92FD6C3D9575148AFA17425546D49018E5388D49DD7B4F",
"307B0220245C26FB68B1DDDDB12C4B6BF9F2B6D5FE60A383B0D18D1C4144ABF17F6252E7022076CB9264C2A7E88E52B19903FDC47378F605E36811F5C07423A24B84400F01B80420BE89139D07853100EFA763F60CBE30099EA3DF7F8F364F9D10A5E988E3C5AAFC0413229E6C9AEE2BB92CAD649FE2C035689785DA33");
if (rc == 0)
return 0;
EC_GROUP_free(test_group);
return 1;
}
#endif
int setup_tests(void)
{
#ifdef OPENSSL_NO_SM2
TEST_note("SM2 is disabled.");
#else
ADD_TEST(sm2_crypt_test);
#endif
return 1;
}
test/sm2sigtest.c
+238
View File
@@ -0,0 +1,238 @@
/*
* Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2017 Ribose Inc. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <openssl/bio.h>
#include <openssl/evp.h>
#include <openssl/bn.h>
#include <openssl/crypto.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include "testutil.h"
#ifndef OPENSSL_NO_SM2
# include <openssl/sm2.h>
static RAND_METHOD fake_rand;
static const RAND_METHOD *saved_rand;
static uint8_t *fake_rand_bytes = NULL;
static size_t fake_rand_bytes_offset = 0;
static int get_faked_bytes(unsigned char *buf, int num)
{
int i;
if (fake_rand_bytes == NULL)
return saved_rand->bytes(buf, num);
for (i = 0; i != num; ++i)
buf[i] = fake_rand_bytes[fake_rand_bytes_offset + i];
fake_rand_bytes_offset += num;
return 1;
}
static int start_fake_rand(const char *hex_bytes)
{
/* save old rand method */
if (!TEST_ptr(saved_rand = RAND_get_rand_method()))
return 0;
fake_rand = *saved_rand;
/* use own random function */
fake_rand.bytes = get_faked_bytes;
fake_rand_bytes = OPENSSL_hexstr2buf(hex_bytes, NULL);
fake_rand_bytes_offset = 0;
/* set new RAND_METHOD */
if (!TEST_true(RAND_set_rand_method(&fake_rand)))
return 0;
return 1;
}
static int restore_rand(void)
{
OPENSSL_free(fake_rand_bytes);
fake_rand_bytes = NULL;
fake_rand_bytes_offset = 0;
if (!TEST_true(RAND_set_rand_method(saved_rand)))
return 0;
return 1;
}
static EC_GROUP *create_EC_group(const char *p_hex, const char *a_hex,
const char *b_hex, const char *x_hex,
const char *y_hex, const char *order_hex,
const char *cof_hex)
{
BIGNUM *p = NULL;
BIGNUM *a = NULL;
BIGNUM *b = NULL;
BIGNUM *g_x = NULL;
BIGNUM *g_y = NULL;
BIGNUM *order = NULL;
BIGNUM *cof = NULL;
EC_POINT *generator = NULL;
EC_GROUP *group = NULL;
BN_hex2bn(&p, p_hex);
BN_hex2bn(&a, a_hex);
BN_hex2bn(&b, b_hex);
group = EC_GROUP_new_curve_GFp(p, a, b, NULL);
BN_free(p);
BN_free(a);
BN_free(b);
if (group == NULL)
return NULL;
generator = EC_POINT_new(group);
if (generator == NULL)
return NULL;
BN_hex2bn(&g_x, x_hex);
BN_hex2bn(&g_y, y_hex);
if (EC_POINT_set_affine_coordinates_GFp(group, generator, g_x, g_y, NULL) ==
0)
return NULL;
BN_free(g_x);
BN_free(g_y);
BN_hex2bn(&order, order_hex);
BN_hex2bn(&cof, cof_hex);
if (EC_GROUP_set_generator(group, generator, order, cof) == 0)
return NULL;
EC_POINT_free(generator);
BN_free(order);
BN_free(cof);
return group;
}
static int test_sm2(const EC_GROUP *group,
const char *userid,
const char *privkey_hex,
const char *message,
const char *k_hex, const char *r_hex, const char *s_hex)
{
const size_t msg_len = strlen(message);
int ok = -1;
BIGNUM *priv = NULL;
EC_POINT *pt = NULL;
EC_KEY *key = NULL;
ECDSA_SIG *sig = NULL;
const BIGNUM *sig_r = NULL;
const BIGNUM *sig_s = NULL;
BIGNUM *r = NULL;
BIGNUM *s = NULL;
BN_hex2bn(&priv, privkey_hex);
key = EC_KEY_new();
EC_KEY_set_group(key, group);
EC_KEY_set_private_key(key, priv);
pt = EC_POINT_new(group);
EC_POINT_mul(group, pt, priv, NULL, NULL, NULL);
EC_KEY_set_public_key(key, pt);
start_fake_rand(k_hex);
sig = SM2_do_sign(key, EVP_sm3(), userid, (const uint8_t *)message, msg_len);
restore_rand();
if (sig == NULL)
return 0;
ECDSA_SIG_get0(sig, &sig_r, &sig_s);
BN_hex2bn(&r, r_hex);
BN_hex2bn(&s, s_hex);
if (BN_cmp(r, sig_r) != 0) {
printf("Signature R mismatch: ");
BN_print_fp(stdout, r);
printf(" != ");
BN_print_fp(stdout, sig_r);
printf("\n");
ok = 0;
}
if (BN_cmp(s, sig_s) != 0) {
printf("Signature S mismatch: ");
BN_print_fp(stdout, s);
printf(" != ");
BN_print_fp(stdout, sig_s);
printf("\n");
ok = 0;
}
ok = SM2_do_verify(key, EVP_sm3(), sig, userid, (const uint8_t *)message, msg_len);
ECDSA_SIG_free(sig);
EC_POINT_free(pt);
EC_KEY_free(key);
BN_free(priv);
BN_free(r);
BN_free(s);
return ok;
}
static int sm2_sig_test(void)
{
int rc = 0;
/* From draft-shen-sm2-ecdsa-02 */
EC_GROUP *test_group =
create_EC_group
("8542D69E4C044F18E8B92435BF6FF7DE457283915C45517D722EDB8B08F1DFC3",
"787968B4FA32C3FD2417842E73BBFEFF2F3C848B6831D7E0EC65228B3937E498",
"63E4C6D3B23B0C849CF84241484BFE48F61D59A5B16BA06E6E12D1DA27C5249A",
"421DEBD61B62EAB6746434EBC3CC315E32220B3BADD50BDC4C4E6C147FEDD43D",
"0680512BCBB42C07D47349D2153B70C4E5D7FDFCBFA36EA1A85841B9E46E09A2",
"8542D69E4C044F18E8B92435BF6FF7DD297720630485628D5AE74EE7C32E79B7",
"1");
if (test_group == NULL)
return 0;
rc = test_sm2(test_group,
"ALICE123@YAHOO.COM",
"128B2FA8BD433C6C068C8D803DFF79792A519A55171B1B650C23661D15897263",
"message digest",
"006CB28D99385C175C94F94E934817663FC176D925DD72B727260DBAAE1FB2F96F",
"40F1EC59F793D9F49E09DCEF49130D4194F79FB1EED2CAA55BACDB49C4E755D1",
"6FC6DAC32C5D5CF10C77DFB20F7C2EB667A457872FB09EC56327A67EC7DEEBE7");
EC_GROUP_free(test_group);
return rc;
}
#endif
int setup_tests(void)
{
#ifdef OPENSSL_NO_SM2
TEST_note("SM2 is disabled.");
#else
ADD_TEST(sm2_sig_test);
#endif
return 1;
}
test/ssl-tests/02-protocol-version.conf
+2
View File
@@ -18787,6 +18787,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[676-ciphersuite-sanity-check-client-client]
CipherString = AES128-SHA
Ciphersuites =
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
@@ -18806,6 +18807,7 @@ client = 677-ciphersuite-sanity-check-server-client
[677-ciphersuite-sanity-check-server-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = AES128-SHA
Ciphersuites =
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[677-ciphersuite-sanity-check-server-client]
test/ssl-tests/20-cert-select.conf
+626 -557
View File
@@ -1,52 +1,54 @@
# Generated with generate_ssl_tests.pl
num_tests = 45
num_tests = 47
test-0 = 0-ECDSA CipherString Selection
test-1 = 1-Ed25519 CipherString and Signature Algorithm Selection
test-2 = 2-Ed448 CipherString and Signature Algorithm Selection
test-3 = 3-RSA CipherString Selection
test-4 = 4-RSA-PSS Certificate CipherString Selection
test-5 = 5-P-256 CipherString and Signature Algorithm Selection
test-6 = 6-Ed25519 CipherString and Curves Selection
test-7 = 7-Ed448 CipherString and Curves Selection
test-8 = 8-ECDSA CipherString Selection, no ECDSA certificate
test-9 = 9-ECDSA Signature Algorithm Selection
test-10 = 10-ECDSA Signature Algorithm Selection SHA384
test-11 = 11-ECDSA Signature Algorithm Selection SHA1
test-12 = 12-ECDSA Signature Algorithm Selection compressed point
test-13 = 13-ECDSA Signature Algorithm Selection, no ECDSA certificate
test-14 = 14-RSA Signature Algorithm Selection
test-15 = 15-RSA-PSS Signature Algorithm Selection
test-16 = 16-RSA-PSS Certificate Legacy Signature Algorithm Selection
test-17 = 17-RSA-PSS Certificate Unified Signature Algorithm Selection
test-18 = 18-Only RSA-PSS Certificate
test-19 = 19-RSA-PSS Certificate, no PSS signature algorithms
test-20 = 20-Suite B P-256 Hash Algorithm Selection
test-21 = 21-Suite B P-384 Hash Algorithm Selection
test-22 = 22-TLS 1.2 Ed25519 Client Auth
test-23 = 23-TLS 1.2 Ed448 Client Auth
test-24 = 24-Only RSA-PSS Certificate, TLS v1.1
test-25 = 25-TLS 1.3 ECDSA Signature Algorithm Selection
test-26 = 26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point
test-27 = 27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1
test-28 = 28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS
test-29 = 29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS
test-30 = 30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate
test-31 = 31-TLS 1.3 RSA Signature Algorithm Selection, no PSS
test-32 = 32-TLS 1.3 RSA-PSS Signature Algorithm Selection
test-33 = 33-TLS 1.3 Ed25519 Signature Algorithm Selection
test-34 = 34-TLS 1.3 Ed448 Signature Algorithm Selection
test-35 = 35-TLS 1.3 Ed25519 CipherString and Groups Selection
test-36 = 36-TLS 1.3 Ed448 CipherString and Groups Selection
test-37 = 37-TLS 1.3 RSA Client Auth Signature Algorithm Selection
test-38 = 38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names
test-39 = 39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection
test-40 = 40-TLS 1.3 Ed25519 Client Auth
test-41 = 41-TLS 1.3 Ed448 Client Auth
test-42 = 42-TLS 1.2 DSA Certificate Test
test-43 = 43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms
test-44 = 44-TLS 1.3 DSA Certificate Test
test-1 = 1-ECDSA CipherString Selection
test-2 = 2-ECDSA CipherString Selection
test-3 = 3-Ed25519 CipherString and Signature Algorithm Selection
test-4 = 4-Ed448 CipherString and Signature Algorithm Selection
test-5 = 5-RSA CipherString Selection
test-6 = 6-RSA-PSS Certificate CipherString Selection
test-7 = 7-P-256 CipherString and Signature Algorithm Selection
test-8 = 8-Ed25519 CipherString and Curves Selection
test-9 = 9-Ed448 CipherString and Curves Selection
test-10 = 10-ECDSA CipherString Selection, no ECDSA certificate
test-11 = 11-ECDSA Signature Algorithm Selection
test-12 = 12-ECDSA Signature Algorithm Selection SHA384
test-13 = 13-ECDSA Signature Algorithm Selection SHA1
test-14 = 14-ECDSA Signature Algorithm Selection compressed point
test-15 = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate
test-16 = 16-RSA Signature Algorithm Selection
test-17 = 17-RSA-PSS Signature Algorithm Selection
test-18 = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection
test-19 = 19-RSA-PSS Certificate Unified Signature Algorithm Selection
test-20 = 20-Only RSA-PSS Certificate
test-21 = 21-RSA-PSS Certificate, no PSS signature algorithms
test-22 = 22-Suite B P-256 Hash Algorithm Selection
test-23 = 23-Suite B P-384 Hash Algorithm Selection
test-24 = 24-TLS 1.2 Ed25519 Client Auth
test-25 = 25-TLS 1.2 Ed448 Client Auth
test-26 = 26-Only RSA-PSS Certificate, TLS v1.1
test-27 = 27-TLS 1.3 ECDSA Signature Algorithm Selection
test-28 = 28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point
test-29 = 29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1
test-30 = 30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS
test-31 = 31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS
test-32 = 32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate
test-33 = 33-TLS 1.3 RSA Signature Algorithm Selection, no PSS
test-34 = 34-TLS 1.3 RSA-PSS Signature Algorithm Selection
test-35 = 35-TLS 1.3 Ed25519 Signature Algorithm Selection
test-36 = 36-TLS 1.3 Ed448 Signature Algorithm Selection
test-37 = 37-TLS 1.3 Ed25519 CipherString and Groups Selection
test-38 = 38-TLS 1.3 Ed448 CipherString and Groups Selection
test-39 = 39-TLS 1.3 RSA Client Auth Signature Algorithm Selection
test-40 = 40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names
test-41 = 41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection
test-42 = 42-TLS 1.3 Ed25519 Client Auth
test-43 = 43-TLS 1.3 Ed448 Client Auth
test-44 = 44-TLS 1.2 DSA Certificate Test
test-45 = 45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms
test-46 = 46-TLS 1.3 DSA Certificate Test
# ===========================================================
[0-ECDSA CipherString Selection]
@@ -84,14 +86,77 @@ ExpectedServerSignType = EC
# ===========================================================
[1-Ed25519 CipherString and Signature Algorithm Selection]
ssl_conf = 1-Ed25519 CipherString and Signature Algorithm Selection-ssl
[1-ECDSA CipherString Selection]
ssl_conf = 1-ECDSA CipherString Selection-ssl
[1-Ed25519 CipherString and Signature Algorithm Selection-ssl]
server = 1-Ed25519 CipherString and Signature Algorithm Selection-server
client = 1-Ed25519 CipherString and Signature Algorithm Selection-client
[1-ECDSA CipherString Selection-ssl]
server = 1-ECDSA CipherString Selection-server
client = 1-ECDSA CipherString Selection-client
[1-Ed25519 CipherString and Signature Algorithm Selection-server]
[1-ECDSA CipherString Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
Groups = P-384
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-ECDSA CipherString Selection-client]
CipherString = aECDSA
Groups = P-256:P-384
MaxProtocol = TLSv1.2
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-1]
ExpectedResult = Success
ExpectedServerCANames = empty
ExpectedServerCertType = P-256
ExpectedServerSignType = EC
# ===========================================================
[2-ECDSA CipherString Selection]
ssl_conf = 2-ECDSA CipherString Selection-ssl
[2-ECDSA CipherString Selection-ssl]
server = 2-ECDSA CipherString Selection-server
client = 2-ECDSA CipherString Selection-client
[2-ECDSA CipherString Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
Groups = P-256:P-384
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-ECDSA CipherString Selection-client]
CipherString = aECDSA
Groups = P-384
MaxProtocol = TLSv1.2
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-2]
ExpectedResult = ServerFail
# ===========================================================
[3-Ed25519 CipherString and Signature Algorithm Selection]
ssl_conf = 3-Ed25519 CipherString and Signature Algorithm Selection-ssl
[3-Ed25519 CipherString and Signature Algorithm Selection-ssl]
server = 3-Ed25519 CipherString and Signature Algorithm Selection-server
client = 3-Ed25519 CipherString and Signature Algorithm Selection-client
[3-Ed25519 CipherString and Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -103,7 +168,7 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-Ed25519 CipherString and Signature Algorithm Selection-client]
[3-Ed25519 CipherString and Signature Algorithm Selection-client]
CipherString = aECDSA
MaxProtocol = TLSv1.2
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
@@ -111,7 +176,7 @@ SignatureAlgorithms = ed25519:ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-1]
[test-3]
ExpectedResult = Success
ExpectedServerCANames = empty
ExpectedServerCertType = Ed25519
@@ -120,14 +185,14 @@ ExpectedServerSignType = Ed25519
# ===========================================================
[2-Ed448 CipherString and Signature Algorithm Selection]
ssl_conf = 2-Ed448 CipherString and Signature Algorithm Selection-ssl
[4-Ed448 CipherString and Signature Algorithm Selection]
ssl_conf = 4-Ed448 CipherString and Signature Algorithm Selection-ssl
[2-Ed448 CipherString and Signature Algorithm Selection-ssl]
server = 2-Ed448 CipherString and Signature Algorithm Selection-server
client = 2-Ed448 CipherString and Signature Algorithm Selection-client
[4-Ed448 CipherString and Signature Algorithm Selection-ssl]
server = 4-Ed448 CipherString and Signature Algorithm Selection-server
client = 4-Ed448 CipherString and Signature Algorithm Selection-client
[2-Ed448 CipherString and Signature Algorithm Selection-server]
[4-Ed448 CipherString and Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -139,7 +204,7 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-Ed448 CipherString and Signature Algorithm Selection-client]
[4-Ed448 CipherString and Signature Algorithm Selection-client]
CipherString = aECDSA
MaxProtocol = TLSv1.2
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
@@ -147,7 +212,7 @@ SignatureAlgorithms = ed448:ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-2]
[test-4]
ExpectedResult = Success
ExpectedServerCANames = empty
ExpectedServerCertType = Ed448
@@ -156,14 +221,14 @@ ExpectedServerSignType = Ed448
# ===========================================================
[3-RSA CipherString Selection]
ssl_conf = 3-RSA CipherString Selection-ssl
[5-RSA CipherString Selection]
ssl_conf = 5-RSA CipherString Selection-ssl
[3-RSA CipherString Selection-ssl]
server = 3-RSA CipherString Selection-server
client = 3-RSA CipherString Selection-client
[5-RSA CipherString Selection-ssl]
server = 5-RSA CipherString Selection-server
client = 5-RSA CipherString Selection-client
[3-RSA CipherString Selection-server]
[5-RSA CipherString Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -175,13 +240,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-RSA CipherString Selection-client]
[5-RSA CipherString Selection-client]
CipherString = aRSA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-3]
[test-5]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignType = RSA-PSS
@@ -189,14 +254,14 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
[4-RSA-PSS Certificate CipherString Selection]
ssl_conf = 4-RSA-PSS Certificate CipherString Selection-ssl
[6-RSA-PSS Certificate CipherString Selection]
ssl_conf = 6-RSA-PSS Certificate CipherString Selection-ssl
[4-RSA-PSS Certificate CipherString Selection-ssl]
server = 4-RSA-PSS Certificate CipherString Selection-server
client = 4-RSA-PSS Certificate CipherString Selection-client
[6-RSA-PSS Certificate CipherString Selection-ssl]
server = 6-RSA-PSS Certificate CipherString Selection-server
client = 6-RSA-PSS Certificate CipherString Selection-client
[4-RSA-PSS Certificate CipherString Selection-server]
[6-RSA-PSS Certificate CipherString Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -210,13 +275,13 @@ PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[4-RSA-PSS Certificate CipherString Selection-client]
[6-RSA-PSS Certificate CipherString Selection-client]
CipherString = aRSA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-4]
[test-6]
ExpectedResult = Success
ExpectedServerCertType = RSA-PSS
ExpectedServerSignType = RSA-PSS
@@ -224,14 +289,14 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
[5-P-256 CipherString and Signature Algorithm Selection]
ssl_conf = 5-P-256 CipherString and Signature Algorithm Selection-ssl
[7-P-256 CipherString and Signature Algorithm Selection]
ssl_conf = 7-P-256 CipherString and Signature Algorithm Selection-ssl
[5-P-256 CipherString and Signature Algorithm Selection-ssl]
server = 5-P-256 CipherString and Signature Algorithm Selection-server
client = 5-P-256 CipherString and Signature Algorithm Selection-client
[7-P-256 CipherString and Signature Algorithm Selection-ssl]
server = 7-P-256 CipherString and Signature Algorithm Selection-server
client = 7-P-256 CipherString and Signature Algorithm Selection-client
[5-P-256 CipherString and Signature Algorithm Selection-server]
[7-P-256 CipherString and Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -243,14 +308,14 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[5-P-256 CipherString and Signature Algorithm Selection-client]
[7-P-256 CipherString and Signature Algorithm Selection-client]
CipherString = aECDSA
MaxProtocol = TLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ed25519
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-5]
[test-7]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
@@ -259,14 +324,14 @@ ExpectedServerSignType = EC
# ===========================================================
[6-Ed25519 CipherString and Curves Selection]
ssl_conf = 6-Ed25519 CipherString and Curves Selection-ssl
[8-Ed25519 CipherString and Curves Selection]
ssl_conf = 8-Ed25519 CipherString and Curves Selection-ssl
[6-Ed25519 CipherString and Curves Selection-ssl]
server = 6-Ed25519 CipherString and Curves Selection-server
client = 6-Ed25519 CipherString and Curves Selection-client
[8-Ed25519 CipherString and Curves Selection-ssl]
server = 8-Ed25519 CipherString and Curves Selection-server
client = 8-Ed25519 CipherString and Curves Selection-client
[6-Ed25519 CipherString and Curves Selection-server]
[8-Ed25519 CipherString and Curves Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -278,7 +343,7 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-Ed25519 CipherString and Curves Selection-client]
[8-Ed25519 CipherString and Curves Selection-client]
CipherString = aECDSA
Curves = X25519
MaxProtocol = TLSv1.2
@@ -286,7 +351,7 @@ SignatureAlgorithms = ECDSA+SHA256:ed25519
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-6]
[test-8]
ExpectedResult = Success
ExpectedServerCertType = Ed25519
ExpectedServerSignType = Ed25519
@@ -294,14 +359,14 @@ ExpectedServerSignType = Ed25519
# ===========================================================
[7-Ed448 CipherString and Curves Selection]
ssl_conf = 7-Ed448 CipherString and Curves Selection-ssl
[9-Ed448 CipherString and Curves Selection]
ssl_conf = 9-Ed448 CipherString and Curves Selection-ssl
[7-Ed448 CipherString and Curves Selection-ssl]
server = 7-Ed448 CipherString and Curves Selection-server
client = 7-Ed448 CipherString and Curves Selection-client
[9-Ed448 CipherString and Curves Selection-ssl]
server = 9-Ed448 CipherString and Curves Selection-server
client = 9-Ed448 CipherString and Curves Selection-client
[7-Ed448 CipherString and Curves Selection-server]
[9-Ed448 CipherString and Curves Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -313,7 +378,7 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-Ed448 CipherString and Curves Selection-client]
[9-Ed448 CipherString and Curves Selection-client]
CipherString = aECDSA
Curves = X448
MaxProtocol = TLSv1.2
@@ -321,7 +386,7 @@ SignatureAlgorithms = ECDSA+SHA256:ed448
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-7]
[test-9]
ExpectedResult = Success
ExpectedServerCertType = Ed448
ExpectedServerSignType = Ed448
@@ -329,39 +394,39 @@ ExpectedServerSignType = Ed448
# ===========================================================
[8-ECDSA CipherString Selection, no ECDSA certificate]
ssl_conf = 8-ECDSA CipherString Selection, no ECDSA certificate-ssl
[10-ECDSA CipherString Selection, no ECDSA certificate]
ssl_conf = 10-ECDSA CipherString Selection, no ECDSA certificate-ssl
[8-ECDSA CipherString Selection, no ECDSA certificate-ssl]
server = 8-ECDSA CipherString Selection, no ECDSA certificate-server
client = 8-ECDSA CipherString Selection, no ECDSA certificate-client
[10-ECDSA CipherString Selection, no ECDSA certificate-ssl]
server = 10-ECDSA CipherString Selection, no ECDSA certificate-server
client = 10-ECDSA CipherString Selection, no ECDSA certificate-client
[8-ECDSA CipherString Selection, no ECDSA certificate-server]
[10-ECDSA CipherString Selection, no ECDSA certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-ECDSA CipherString Selection, no ECDSA certificate-client]
[10-ECDSA CipherString Selection, no ECDSA certificate-client]
CipherString = aECDSA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-8]
[test-10]
ExpectedResult = ServerFail
# ===========================================================
[9-ECDSA Signature Algorithm Selection]
ssl_conf = 9-ECDSA Signature Algorithm Selection-ssl
[11-ECDSA Signature Algorithm Selection]
ssl_conf = 11-ECDSA Signature Algorithm Selection-ssl
[9-ECDSA Signature Algorithm Selection-ssl]
server = 9-ECDSA Signature Algorithm Selection-server
client = 9-ECDSA Signature Algorithm Selection-client
[11-ECDSA Signature Algorithm Selection-ssl]
server = 11-ECDSA Signature Algorithm Selection-server
client = 11-ECDSA Signature Algorithm Selection-client
[9-ECDSA Signature Algorithm Selection-server]
[11-ECDSA Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -373,13 +438,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[9-ECDSA Signature Algorithm Selection-client]
[11-ECDSA Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-9]
[test-11]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
@@ -388,14 +453,14 @@ ExpectedServerSignType = EC
# ===========================================================
[10-ECDSA Signature Algorithm Selection SHA384]
ssl_conf = 10-ECDSA Signature Algorithm Selection SHA384-ssl
[12-ECDSA Signature Algorithm Selection SHA384]
ssl_conf = 12-ECDSA Signature Algorithm Selection SHA384-ssl
[10-ECDSA Signature Algorithm Selection SHA384-ssl]
server = 10-ECDSA Signature Algorithm Selection SHA384-server
client = 10-ECDSA Signature Algorithm Selection SHA384-client
[12-ECDSA Signature Algorithm Selection SHA384-ssl]
server = 12-ECDSA Signature Algorithm Selection SHA384-server
client = 12-ECDSA Signature Algorithm Selection SHA384-client
[10-ECDSA Signature Algorithm Selection SHA384-server]
[12-ECDSA Signature Algorithm Selection SHA384-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -407,13 +472,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-ECDSA Signature Algorithm Selection SHA384-client]
[12-ECDSA Signature Algorithm Selection SHA384-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA384
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-10]
[test-12]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA384
@@ -422,14 +487,14 @@ ExpectedServerSignType = EC
# ===========================================================
[11-ECDSA Signature Algorithm Selection SHA1]
ssl_conf = 11-ECDSA Signature Algorithm Selection SHA1-ssl
[13-ECDSA Signature Algorithm Selection SHA1]
ssl_conf = 13-ECDSA Signature Algorithm Selection SHA1-ssl
[11-ECDSA Signature Algorithm Selection SHA1-ssl]
server = 11-ECDSA Signature Algorithm Selection SHA1-server
client = 11-ECDSA Signature Algorithm Selection SHA1-client
[13-ECDSA Signature Algorithm Selection SHA1-ssl]
server = 13-ECDSA Signature Algorithm Selection SHA1-server
client = 13-ECDSA Signature Algorithm Selection SHA1-client
[11-ECDSA Signature Algorithm Selection SHA1-server]
[13-ECDSA Signature Algorithm Selection SHA1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -441,13 +506,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-ECDSA Signature Algorithm Selection SHA1-client]
[13-ECDSA Signature Algorithm Selection SHA1-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-11]
[test-13]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA1
@@ -456,14 +521,14 @@ ExpectedServerSignType = EC
# ===========================================================
[12-ECDSA Signature Algorithm Selection compressed point]
ssl_conf = 12-ECDSA Signature Algorithm Selection compressed point-ssl
[14-ECDSA Signature Algorithm Selection compressed point]
ssl_conf = 14-ECDSA Signature Algorithm Selection compressed point-ssl
[12-ECDSA Signature Algorithm Selection compressed point-ssl]
server = 12-ECDSA Signature Algorithm Selection compressed point-server
client = 12-ECDSA Signature Algorithm Selection compressed point-client
[14-ECDSA Signature Algorithm Selection compressed point-ssl]
server = 14-ECDSA Signature Algorithm Selection compressed point-server
client = 14-ECDSA Signature Algorithm Selection compressed point-client
[12-ECDSA Signature Algorithm Selection compressed point-server]
[14-ECDSA Signature Algorithm Selection compressed point-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem
@@ -471,13 +536,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-ECDSA Signature Algorithm Selection compressed point-client]
[14-ECDSA Signature Algorithm Selection compressed point-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-12]
[test-14]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
@@ -486,39 +551,39 @@ ExpectedServerSignType = EC
# ===========================================================
[13-ECDSA Signature Algorithm Selection, no ECDSA certificate]
ssl_conf = 13-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
[15-ECDSA Signature Algorithm Selection, no ECDSA certificate]
ssl_conf = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
[13-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
server = 13-ECDSA Signature Algorithm Selection, no ECDSA certificate-server
client = 13-ECDSA Signature Algorithm Selection, no ECDSA certificate-client
[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
server = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-server
client = 15-ECDSA Signature Algorithm Selection, no ECDSA certificate-client
[13-ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
[15-ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-13]
[test-15]
ExpectedResult = ServerFail
# ===========================================================
[14-RSA Signature Algorithm Selection]
ssl_conf = 14-RSA Signature Algorithm Selection-ssl
[16-RSA Signature Algorithm Selection]
ssl_conf = 16-RSA Signature Algorithm Selection-ssl
[14-RSA Signature Algorithm Selection-ssl]
server = 14-RSA Signature Algorithm Selection-server
client = 14-RSA Signature Algorithm Selection-client
[16-RSA Signature Algorithm Selection-ssl]
server = 16-RSA Signature Algorithm Selection-server
client = 16-RSA Signature Algorithm Selection-client
[14-RSA Signature Algorithm Selection-server]
[16-RSA Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -530,13 +595,13 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-RSA Signature Algorithm Selection-client]
[16-RSA Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-14]
[test-16]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
@@ -545,14 +610,14 @@ ExpectedServerSignType = RSA
# ===========================================================
[15-RSA-PSS Signature Algorithm Selection]
ssl_conf = 15-RSA-PSS Signature Algorithm Selection-ssl
[17-RSA-PSS Signature Algorithm Selection]
ssl_conf = 17-RSA-PSS Signature Algorithm Selection-ssl
[15-RSA-PSS Signature Algorithm Selection-ssl]
server = 15-RSA-PSS Signature Algorithm Selection-server
client = 15-RSA-PSS Signature Algorithm Selection-client
[17-RSA-PSS Signature Algorithm Selection-ssl]
server = 17-RSA-PSS Signature Algorithm Selection-server
client = 17-RSA-PSS Signature Algorithm Selection-client
[15-RSA-PSS Signature Algorithm Selection-server]
[17-RSA-PSS Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -564,112 +629,86 @@ Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-RSA-PSS Signature Algorithm Selection-client]
[17-RSA-PSS Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA-PSS+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-15]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
ExpectedServerSignType = RSA-PSS
# ===========================================================
[16-RSA-PSS Certificate Legacy Signature Algorithm Selection]
ssl_conf = 16-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl
[16-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl]
server = 16-RSA-PSS Certificate Legacy Signature Algorithm Selection-server
client = 16-RSA-PSS Certificate Legacy Signature Algorithm Selection-client
[16-RSA-PSS Certificate Legacy Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[16-RSA-PSS Certificate Legacy Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA-PSS+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-16]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
ExpectedServerSignType = RSA-PSS
# ===========================================================
[17-RSA-PSS Certificate Unified Signature Algorithm Selection]
ssl_conf = 17-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl
[17-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl]
server = 17-RSA-PSS Certificate Unified Signature Algorithm Selection-server
client = 17-RSA-PSS Certificate Unified Signature Algorithm Selection-client
[17-RSA-PSS Certificate Unified Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[17-RSA-PSS Certificate Unified Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = rsa_pss_pss_sha256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-17]
ExpectedResult = Success
ExpectedServerCertType = RSA-PSS
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
ExpectedServerSignType = RSA-PSS
# ===========================================================
[18-Only RSA-PSS Certificate]
ssl_conf = 18-Only RSA-PSS Certificate-ssl
[18-RSA-PSS Certificate Legacy Signature Algorithm Selection]
ssl_conf = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl
[18-Only RSA-PSS Certificate-ssl]
server = 18-Only RSA-PSS Certificate-server
client = 18-Only RSA-PSS Certificate-client
[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-ssl]
server = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-server
client = 18-RSA-PSS Certificate Legacy Signature Algorithm Selection-client
[18-Only RSA-PSS Certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[18-Only RSA-PSS Certificate-client]
[18-RSA-PSS Certificate Legacy Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA-PSS+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-18]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
ExpectedServerSignType = RSA-PSS
# ===========================================================
[19-RSA-PSS Certificate Unified Signature Algorithm Selection]
ssl_conf = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl
[19-RSA-PSS Certificate Unified Signature Algorithm Selection-ssl]
server = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-server
client = 19-RSA-PSS Certificate Unified Signature Algorithm Selection-client
[19-RSA-PSS Certificate Unified Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.2
PSS.Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
PSS.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[19-RSA-PSS Certificate Unified Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = rsa_pss_pss_sha256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-19]
ExpectedResult = Success
ExpectedServerCertType = RSA-PSS
ExpectedServerSignHash = SHA256
ExpectedServerSignType = RSA-PSS
@@ -677,38 +716,64 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
[19-RSA-PSS Certificate, no PSS signature algorithms]
ssl_conf = 19-RSA-PSS Certificate, no PSS signature algorithms-ssl
[20-Only RSA-PSS Certificate]
ssl_conf = 20-Only RSA-PSS Certificate-ssl
[19-RSA-PSS Certificate, no PSS signature algorithms-ssl]
server = 19-RSA-PSS Certificate, no PSS signature algorithms-server
client = 19-RSA-PSS Certificate, no PSS signature algorithms-client
[20-Only RSA-PSS Certificate-ssl]
server = 20-Only RSA-PSS Certificate-server
client = 20-Only RSA-PSS Certificate-client
[19-RSA-PSS Certificate, no PSS signature algorithms-server]
[20-Only RSA-PSS Certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
[19-RSA-PSS Certificate, no PSS signature algorithms-client]
[20-Only RSA-PSS Certificate-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-20]
ExpectedResult = Success
ExpectedServerCertType = RSA-PSS
ExpectedServerSignHash = SHA256
ExpectedServerSignType = RSA-PSS
# ===========================================================
[21-RSA-PSS Certificate, no PSS signature algorithms]
ssl_conf = 21-RSA-PSS Certificate, no PSS signature algorithms-ssl
[21-RSA-PSS Certificate, no PSS signature algorithms-ssl]
server = 21-RSA-PSS Certificate, no PSS signature algorithms-server
client = 21-RSA-PSS Certificate, no PSS signature algorithms-client
[21-RSA-PSS Certificate, no PSS signature algorithms-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
[21-RSA-PSS Certificate, no PSS signature algorithms-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-19]
[test-21]
ExpectedResult = ServerFail
# ===========================================================
[20-Suite B P-256 Hash Algorithm Selection]
ssl_conf = 20-Suite B P-256 Hash Algorithm Selection-ssl
[22-Suite B P-256 Hash Algorithm Selection]
ssl_conf = 22-Suite B P-256 Hash Algorithm Selection-ssl
[20-Suite B P-256 Hash Algorithm Selection-ssl]
server = 20-Suite B P-256 Hash Algorithm Selection-server
client = 20-Suite B P-256 Hash Algorithm Selection-client
[22-Suite B P-256 Hash Algorithm Selection-ssl]
server = 22-Suite B P-256 Hash Algorithm Selection-server
client = 22-Suite B P-256 Hash Algorithm Selection-client
[20-Suite B P-256 Hash Algorithm Selection-server]
[22-Suite B P-256 Hash Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = SUITEB128
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p256-server-cert.pem
@@ -716,13 +781,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p256-server-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[20-Suite B P-256 Hash Algorithm Selection-client]
[22-Suite B P-256 Hash Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA384:ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
VerifyMode = Peer
[test-20]
[test-22]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
@@ -731,14 +796,14 @@ ExpectedServerSignType = EC
# ===========================================================
[21-Suite B P-384 Hash Algorithm Selection]
ssl_conf = 21-Suite B P-384 Hash Algorithm Selection-ssl
[23-Suite B P-384 Hash Algorithm Selection]
ssl_conf = 23-Suite B P-384 Hash Algorithm Selection-ssl
[21-Suite B P-384 Hash Algorithm Selection-ssl]
server = 21-Suite B P-384 Hash Algorithm Selection-server
client = 21-Suite B P-384 Hash Algorithm Selection-client
[23-Suite B P-384 Hash Algorithm Selection-ssl]
server = 23-Suite B P-384 Hash Algorithm Selection-server
client = 23-Suite B P-384 Hash Algorithm Selection-client
[21-Suite B P-384 Hash Algorithm Selection-server]
[23-Suite B P-384 Hash Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = SUITEB128
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/p384-server-cert.pem
@@ -746,13 +811,13 @@ ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/p384-server-key.pem
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[21-Suite B P-384 Hash Algorithm Selection-client]
[23-Suite B P-384 Hash Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/p384-root.pem
VerifyMode = Peer
[test-21]
[test-23]
ExpectedResult = Success
ExpectedServerCertType = P-384
ExpectedServerSignHash = SHA384
@@ -761,21 +826,21 @@ ExpectedServerSignType = EC
# ===========================================================
[22-TLS 1.2 Ed25519 Client Auth]
ssl_conf = 22-TLS 1.2 Ed25519 Client Auth-ssl
[24-TLS 1.2 Ed25519 Client Auth]
ssl_conf = 24-TLS 1.2 Ed25519 Client Auth-ssl
[22-TLS 1.2 Ed25519 Client Auth-ssl]
server = 22-TLS 1.2 Ed25519 Client Auth-server
client = 22-TLS 1.2 Ed25519 Client Auth-client
[24-TLS 1.2 Ed25519 Client Auth-ssl]
server = 24-TLS 1.2 Ed25519 Client Auth-server
client = 24-TLS 1.2 Ed25519 Client Auth-client
[22-TLS 1.2 Ed25519 Client Auth-server]
[24-TLS 1.2 Ed25519 Client Auth-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[22-TLS 1.2 Ed25519 Client Auth-client]
[24-TLS 1.2 Ed25519 Client Auth-client]
CipherString = DEFAULT
Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem
@@ -784,7 +849,7 @@ MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-22]
[test-24]
ExpectedClientCertType = Ed25519
ExpectedClientSignType = Ed25519
ExpectedResult = Success
@@ -792,21 +857,21 @@ ExpectedResult = Success
# ===========================================================
[23-TLS 1.2 Ed448 Client Auth]
ssl_conf = 23-TLS 1.2 Ed448 Client Auth-ssl
[25-TLS 1.2 Ed448 Client Auth]
ssl_conf = 25-TLS 1.2 Ed448 Client Auth-ssl
[23-TLS 1.2 Ed448 Client Auth-ssl]
server = 23-TLS 1.2 Ed448 Client Auth-server
client = 23-TLS 1.2 Ed448 Client Auth-client
[25-TLS 1.2 Ed448 Client Auth-ssl]
server = 25-TLS 1.2 Ed448 Client Auth-server
client = 25-TLS 1.2 Ed448 Client Auth-client
[23-TLS 1.2 Ed448 Client Auth-server]
[25-TLS 1.2 Ed448 Client Auth-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[23-TLS 1.2 Ed448 Client Auth-client]
[25-TLS 1.2 Ed448 Client Auth-client]
CipherString = DEFAULT
Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem
Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem
@@ -815,7 +880,7 @@ MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-23]
[test-25]
ExpectedClientCertType = Ed448
ExpectedClientSignType = Ed448
ExpectedResult = Success
@@ -823,102 +888,38 @@ ExpectedResult = Success
# ===========================================================
[24-Only RSA-PSS Certificate, TLS v1.1]
ssl_conf = 24-Only RSA-PSS Certificate, TLS v1.1-ssl
[26-Only RSA-PSS Certificate, TLS v1.1]
ssl_conf = 26-Only RSA-PSS Certificate, TLS v1.1-ssl
[24-Only RSA-PSS Certificate, TLS v1.1-ssl]
server = 24-Only RSA-PSS Certificate, TLS v1.1-server
client = 24-Only RSA-PSS Certificate, TLS v1.1-client
[26-Only RSA-PSS Certificate, TLS v1.1-ssl]
server = 26-Only RSA-PSS Certificate, TLS v1.1-server
client = 26-Only RSA-PSS Certificate, TLS v1.1-client
[24-Only RSA-PSS Certificate, TLS v1.1-server]
[26-Only RSA-PSS Certificate, TLS v1.1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/server-pss-cert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/server-pss-key.pem
[24-Only RSA-PSS Certificate, TLS v1.1-client]
[26-Only RSA-PSS Certificate, TLS v1.1-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-24]
ExpectedResult = ServerFail
# ===========================================================
[25-TLS 1.3 ECDSA Signature Algorithm Selection]
ssl_conf = 25-TLS 1.3 ECDSA Signature Algorithm Selection-ssl
[25-TLS 1.3 ECDSA Signature Algorithm Selection-ssl]
server = 25-TLS 1.3 ECDSA Signature Algorithm Selection-server
client = 25-TLS 1.3 ECDSA Signature Algorithm Selection-client
[25-TLS 1.3 ECDSA Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[25-TLS 1.3 ECDSA Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-25]
ExpectedResult = Success
ExpectedServerCANames = empty
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
ExpectedServerSignType = EC
# ===========================================================
[26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point]
ssl_conf = 26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl
[26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl]
server = 26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server
client = 26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client
[26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[26-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-26]
ExpectedResult = ServerFail
# ===========================================================
[27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1]
ssl_conf = 27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl
[27-TLS 1.3 ECDSA Signature Algorithm Selection]
ssl_conf = 27-TLS 1.3 ECDSA Signature Algorithm Selection-ssl
[27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl]
server = 27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server
client = 27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client
[27-TLS 1.3 ECDSA Signature Algorithm Selection-ssl]
server = 27-TLS 1.3 ECDSA Signature Algorithm Selection-server
client = 27-TLS 1.3 ECDSA Signature Algorithm Selection-client
[27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server]
[27-TLS 1.3 ECDSA Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -931,26 +932,94 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[27-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client]
[27-TLS 1.3 ECDSA Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-27]
ExpectedResult = Success
ExpectedServerCANames = empty
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
ExpectedServerSignType = EC
# ===========================================================
[28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point]
ssl_conf = 28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl
[28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-ssl]
server = 28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server
client = 28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client
[28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-cecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-cecdsa-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[28-TLS 1.3 ECDSA Signature Algorithm Selection compressed point-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-28]
ExpectedResult = Success
ExpectedServerCANames = empty
ExpectedServerCertType = P-256
ExpectedServerSignHash = SHA256
ExpectedServerSignType = EC
# ===========================================================
[29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1]
ssl_conf = 29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl
[29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-ssl]
server = 29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server
client = 29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client
[29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ecdsa-key.pem
Ed25519.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed25519-cert.pem
Ed25519.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed25519-key.pem
Ed448.Certificate = ${ENV::TEST_CERTS_DIR}/server-ed448-cert.pem
Ed448.PrivateKey = ${ENV::TEST_CERTS_DIR}/server-ed448-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[29-TLS 1.3 ECDSA Signature Algorithm Selection SHA1-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-27]
[test-29]
ExpectedResult = ServerFail
# ===========================================================
[28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS]
ssl_conf = 28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl
[30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS]
ssl_conf = 30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl
[28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl]
server = 28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server
client = 28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client
[30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-ssl]
server = 30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server
client = 30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client
[28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server]
[30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -963,14 +1032,14 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[28-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client]
[30-TLS 1.3 ECDSA Signature Algorithm Selection with PSS-client]
CipherString = DEFAULT
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
SignatureAlgorithms = ECDSA+SHA256:RSA-PSS+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-28]
[test-30]
ExpectedResult = Success
ExpectedServerCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedServerCertType = P-256
@@ -980,14 +1049,14 @@ ExpectedServerSignType = EC
# ===========================================================
[29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS]
ssl_conf = 29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl
[31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS]
ssl_conf = 31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl
[29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl]
server = 29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server
client = 29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client
[31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-ssl]
server = 31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server
client = 31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client
[29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server]
[31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1000,13 +1069,13 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[29-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client]
[31-TLS 1.3 RSA Signature Algorithm Selection SHA384 with PSS-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA384:RSA-PSS+SHA384
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-29]
[test-31]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA384
@@ -1015,40 +1084,40 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
[30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate]
ssl_conf = 30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
[32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate]
ssl_conf = 32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl
[30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
server = 30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server
client = 30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client
[32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-ssl]
server = 32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server
client = 32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client
[30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
[32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[30-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
[32-TLS 1.3 ECDSA Signature Algorithm Selection, no ECDSA certificate-client]
CipherString = DEFAULT
SignatureAlgorithms = ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-30]
[test-32]
ExpectedResult = ServerFail
# ===========================================================
[31-TLS 1.3 RSA Signature Algorithm Selection, no PSS]
ssl_conf = 31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl
[33-TLS 1.3 RSA Signature Algorithm Selection, no PSS]
ssl_conf = 33-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl
[31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl]
server = 31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server
client = 31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client
[33-TLS 1.3 RSA Signature Algorithm Selection, no PSS-ssl]
server = 33-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server
client = 33-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client
[31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server]
[33-TLS 1.3 RSA Signature Algorithm Selection, no PSS-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1061,26 +1130,26 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[31-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client]
[33-TLS 1.3 RSA Signature Algorithm Selection, no PSS-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-31]
[test-33]
ExpectedResult = ServerFail
# ===========================================================
[32-TLS 1.3 RSA-PSS Signature Algorithm Selection]
ssl_conf = 32-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl
[34-TLS 1.3 RSA-PSS Signature Algorithm Selection]
ssl_conf = 34-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl
[32-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl]
server = 32-TLS 1.3 RSA-PSS Signature Algorithm Selection-server
client = 32-TLS 1.3 RSA-PSS Signature Algorithm Selection-client
[34-TLS 1.3 RSA-PSS Signature Algorithm Selection-ssl]
server = 34-TLS 1.3 RSA-PSS Signature Algorithm Selection-server
client = 34-TLS 1.3 RSA-PSS Signature Algorithm Selection-client
[32-TLS 1.3 RSA-PSS Signature Algorithm Selection-server]
[34-TLS 1.3 RSA-PSS Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1093,13 +1162,13 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[32-TLS 1.3 RSA-PSS Signature Algorithm Selection-client]
[34-TLS 1.3 RSA-PSS Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = RSA-PSS+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-32]
[test-34]
ExpectedResult = Success
ExpectedServerCertType = RSA
ExpectedServerSignHash = SHA256
@@ -1108,14 +1177,14 @@ ExpectedServerSignType = RSA-PSS
# ===========================================================
[33-TLS 1.3 Ed25519 Signature Algorithm Selection]
ssl_conf = 33-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl
[35-TLS 1.3 Ed25519 Signature Algorithm Selection]
ssl_conf = 35-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl
[33-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl]
server = 33-TLS 1.3 Ed25519 Signature Algorithm Selection-server
client = 33-TLS 1.3 Ed25519 Signature Algorithm Selection-client
[35-TLS 1.3 Ed25519 Signature Algorithm Selection-ssl]
server = 35-TLS 1.3 Ed25519 Signature Algorithm Selection-server
client = 35-TLS 1.3 Ed25519 Signature Algorithm Selection-client
[33-TLS 1.3 Ed25519 Signature Algorithm Selection-server]
[35-TLS 1.3 Ed25519 Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1128,13 +1197,13 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[33-TLS 1.3 Ed25519 Signature Algorithm Selection-client]
[35-TLS 1.3 Ed25519 Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ed25519
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-33]
[test-35]
ExpectedResult = Success
ExpectedServerCertType = Ed25519
ExpectedServerSignType = Ed25519
@@ -1142,14 +1211,14 @@ ExpectedServerSignType = Ed25519
# ===========================================================
[34-TLS 1.3 Ed448 Signature Algorithm Selection]
ssl_conf = 34-TLS 1.3 Ed448 Signature Algorithm Selection-ssl
[36-TLS 1.3 Ed448 Signature Algorithm Selection]
ssl_conf = 36-TLS 1.3 Ed448 Signature Algorithm Selection-ssl
[34-TLS 1.3 Ed448 Signature Algorithm Selection-ssl]
server = 34-TLS 1.3 Ed448 Signature Algorithm Selection-server
client = 34-TLS 1.3 Ed448 Signature Algorithm Selection-client
[36-TLS 1.3 Ed448 Signature Algorithm Selection-ssl]
server = 36-TLS 1.3 Ed448 Signature Algorithm Selection-server
client = 36-TLS 1.3 Ed448 Signature Algorithm Selection-client
[34-TLS 1.3 Ed448 Signature Algorithm Selection-server]
[36-TLS 1.3 Ed448 Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1162,13 +1231,13 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[34-TLS 1.3 Ed448 Signature Algorithm Selection-client]
[36-TLS 1.3 Ed448 Signature Algorithm Selection-client]
CipherString = DEFAULT
SignatureAlgorithms = ed448
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-34]
[test-36]
ExpectedResult = Success
ExpectedServerCertType = Ed448
ExpectedServerSignType = Ed448
@@ -1176,14 +1245,14 @@ ExpectedServerSignType = Ed448
# ===========================================================
[35-TLS 1.3 Ed25519 CipherString and Groups Selection]
ssl_conf = 35-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl
[37-TLS 1.3 Ed25519 CipherString and Groups Selection]
ssl_conf = 37-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl
[35-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl]
server = 35-TLS 1.3 Ed25519 CipherString and Groups Selection-server
client = 35-TLS 1.3 Ed25519 CipherString and Groups Selection-client
[37-TLS 1.3 Ed25519 CipherString and Groups Selection-ssl]
server = 37-TLS 1.3 Ed25519 CipherString and Groups Selection-server
client = 37-TLS 1.3 Ed25519 CipherString and Groups Selection-client
[35-TLS 1.3 Ed25519 CipherString and Groups Selection-server]
[37-TLS 1.3 Ed25519 CipherString and Groups Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1196,14 +1265,14 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[35-TLS 1.3 Ed25519 CipherString and Groups Selection-client]
[37-TLS 1.3 Ed25519 CipherString and Groups Selection-client]
CipherString = DEFAULT
Groups = X25519
SignatureAlgorithms = ECDSA+SHA256:ed25519
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-35]
[test-37]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignType = EC
@@ -1211,14 +1280,14 @@ ExpectedServerSignType = EC
# ===========================================================
[36-TLS 1.3 Ed448 CipherString and Groups Selection]
ssl_conf = 36-TLS 1.3 Ed448 CipherString and Groups Selection-ssl
[38-TLS 1.3 Ed448 CipherString and Groups Selection]
ssl_conf = 38-TLS 1.3 Ed448 CipherString and Groups Selection-ssl
[36-TLS 1.3 Ed448 CipherString and Groups Selection-ssl]
server = 36-TLS 1.3 Ed448 CipherString and Groups Selection-server
client = 36-TLS 1.3 Ed448 CipherString and Groups Selection-client
[38-TLS 1.3 Ed448 CipherString and Groups Selection-ssl]
server = 38-TLS 1.3 Ed448 CipherString and Groups Selection-server
client = 38-TLS 1.3 Ed448 CipherString and Groups Selection-client
[36-TLS 1.3 Ed448 CipherString and Groups Selection-server]
[38-TLS 1.3 Ed448 CipherString and Groups Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-ecdsa-cert.pem
@@ -1231,14 +1300,14 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[36-TLS 1.3 Ed448 CipherString and Groups Selection-client]
[38-TLS 1.3 Ed448 CipherString and Groups Selection-client]
CipherString = DEFAULT
Groups = X448
SignatureAlgorithms = ECDSA+SHA256:ed448
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-36]
[test-38]
ExpectedResult = Success
ExpectedServerCertType = P-256
ExpectedServerSignType = EC
@@ -1246,14 +1315,14 @@ ExpectedServerSignType = EC
# ===========================================================
[37-TLS 1.3 RSA Client Auth Signature Algorithm Selection]
ssl_conf = 37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl
[39-TLS 1.3 RSA Client Auth Signature Algorithm Selection]
ssl_conf = 39-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl
[37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl]
server = 37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server
client = 37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client
[39-TLS 1.3 RSA Client Auth Signature Algorithm Selection-ssl]
server = 39-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server
client = 39-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client
[37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server]
[39-TLS 1.3 RSA Client Auth Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = PSS+SHA256
@@ -1261,80 +1330,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[37-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client]
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
RSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-37]
ExpectedClientCANames = empty
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
ExpectedClientSignType = RSA-PSS
ExpectedResult = Success
# ===========================================================
[38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names]
ssl_conf = 38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl
[38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl]
server = 38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server
client = 38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client
[38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = PSS+SHA256
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[38-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client]
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
RSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-38]
ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
ExpectedClientSignType = RSA-PSS
ExpectedResult = Success
# ===========================================================
[39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection]
ssl_conf = 39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl
[39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl]
server = 39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server
client = 39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client
[39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = ECDSA+SHA256
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[39-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client]
[39-TLS 1.3 RSA Client Auth Signature Algorithm Selection-client]
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
@@ -1346,6 +1342,79 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-39]
ExpectedClientCANames = empty
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
ExpectedClientSignType = RSA-PSS
ExpectedResult = Success
# ===========================================================
[40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names]
ssl_conf = 40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl
[40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-ssl]
server = 40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server
client = 40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client
[40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = PSS+SHA256
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
RequestCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[40-TLS 1.3 RSA Client Auth Signature Algorithm Selection non-empty CA Names-client]
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
RSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-40]
ExpectedClientCANames = ${ENV::TEST_CERTS_DIR}/root-cert.pem
ExpectedClientCertType = RSA
ExpectedClientSignHash = SHA256
ExpectedClientSignType = RSA-PSS
ExpectedResult = Success
# ===========================================================
[41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection]
ssl_conf = 41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl
[41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-ssl]
server = 41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server
client = 41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client
[41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = ECDSA+SHA256
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[41-TLS 1.3 ECDSA Client Auth Signature Algorithm Selection-client]
CipherString = DEFAULT
ECDSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-client-chain.pem
ECDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-ecdsa-key.pem
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
RSA.Certificate = ${ENV::TEST_CERTS_DIR}/ee-client-chain.pem
RSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/ee-key.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-41]
ExpectedClientCertType = P-256
ExpectedClientSignHash = SHA256
ExpectedClientSignType = EC
@@ -1354,21 +1423,21 @@ ExpectedResult = Success
# ===========================================================
[40-TLS 1.3 Ed25519 Client Auth]
ssl_conf = 40-TLS 1.3 Ed25519 Client Auth-ssl
[42-TLS 1.3 Ed25519 Client Auth]
ssl_conf = 42-TLS 1.3 Ed25519 Client Auth-ssl
[40-TLS 1.3 Ed25519 Client Auth-ssl]
server = 40-TLS 1.3 Ed25519 Client Auth-server
client = 40-TLS 1.3 Ed25519 Client Auth-client
[42-TLS 1.3 Ed25519 Client Auth-ssl]
server = 42-TLS 1.3 Ed25519 Client Auth-server
client = 42-TLS 1.3 Ed25519 Client Auth-client
[40-TLS 1.3 Ed25519 Client Auth-server]
[42-TLS 1.3 Ed25519 Client Auth-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[40-TLS 1.3 Ed25519 Client Auth-client]
[42-TLS 1.3 Ed25519 Client Auth-client]
CipherString = DEFAULT
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed25519-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed25519-key.pem
@@ -1377,7 +1446,7 @@ MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-40]
[test-42]
ExpectedClientCertType = Ed25519
ExpectedClientSignType = Ed25519
ExpectedResult = Success
@@ -1385,21 +1454,21 @@ ExpectedResult = Success
# ===========================================================
[41-TLS 1.3 Ed448 Client Auth]
ssl_conf = 41-TLS 1.3 Ed448 Client Auth-ssl
[43-TLS 1.3 Ed448 Client Auth]
ssl_conf = 43-TLS 1.3 Ed448 Client Auth-ssl
[41-TLS 1.3 Ed448 Client Auth-ssl]
server = 41-TLS 1.3 Ed448 Client Auth-server
client = 41-TLS 1.3 Ed448 Client Auth-client
[43-TLS 1.3 Ed448 Client Auth-ssl]
server = 43-TLS 1.3 Ed448 Client Auth-server
client = 43-TLS 1.3 Ed448 Client Auth-client
[41-TLS 1.3 Ed448 Client Auth-server]
[43-TLS 1.3 Ed448 Client Auth-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Require
[41-TLS 1.3 Ed448 Client Auth-client]
[43-TLS 1.3 Ed448 Client Auth-client]
CipherString = DEFAULT
EdDSA.Certificate = ${ENV::TEST_CERTS_DIR}/client-ed448-cert.pem
EdDSA.PrivateKey = ${ENV::TEST_CERTS_DIR}/client-ed448-key.pem
@@ -1408,7 +1477,7 @@ MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-41]
[test-43]
ExpectedClientCertType = Ed448
ExpectedClientSignType = Ed448
ExpectedResult = Success
@@ -1416,14 +1485,14 @@ ExpectedResult = Success
# ===========================================================
[42-TLS 1.2 DSA Certificate Test]
ssl_conf = 42-TLS 1.2 DSA Certificate Test-ssl
[44-TLS 1.2 DSA Certificate Test]
ssl_conf = 44-TLS 1.2 DSA Certificate Test-ssl
[42-TLS 1.2 DSA Certificate Test-ssl]
server = 42-TLS 1.2 DSA Certificate Test-server
client = 42-TLS 1.2 DSA Certificate Test-client
[44-TLS 1.2 DSA Certificate Test-ssl]
server = 44-TLS 1.2 DSA Certificate Test-server
client = 44-TLS 1.2 DSA Certificate Test-client
[42-TLS 1.2 DSA Certificate Test-server]
[44-TLS 1.2 DSA Certificate Test-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ALL
DHParameters = ${ENV::TEST_CERTS_DIR}/dhp2048.pem
@@ -1433,26 +1502,26 @@ MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[42-TLS 1.2 DSA Certificate Test-client]
[44-TLS 1.2 DSA Certificate Test-client]
CipherString = ALL
SignatureAlgorithms = DSA+SHA256:DSA+SHA1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-42]
[test-44]
ExpectedResult = Success
# ===========================================================
[43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms]
ssl_conf = 43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl
[45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms]
ssl_conf = 45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl
[43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl]
server = 43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server
client = 43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client
[45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-ssl]
server = 45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server
client = 45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client
[43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server]
[45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
ClientSignatureAlgorithms = ECDSA+SHA1:DSA+SHA256:RSA+SHA256
@@ -1460,25 +1529,25 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/root-cert.pem
VerifyMode = Request
[43-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client]
[45-TLS 1.3 Client Auth No TLS 1.3 Signature Algorithms-client]
CipherString = DEFAULT
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-43]
[test-45]
ExpectedResult = ServerFail
# ===========================================================
[44-TLS 1.3 DSA Certificate Test]
ssl_conf = 44-TLS 1.3 DSA Certificate Test-ssl
[46-TLS 1.3 DSA Certificate Test]
ssl_conf = 46-TLS 1.3 DSA Certificate Test-ssl
[44-TLS 1.3 DSA Certificate Test-ssl]
server = 44-TLS 1.3 DSA Certificate Test-server
client = 44-TLS 1.3 DSA Certificate Test-client
[46-TLS 1.3 DSA Certificate Test-ssl]
server = 46-TLS 1.3 DSA Certificate Test-server
client = 46-TLS 1.3 DSA Certificate Test-client
[44-TLS 1.3 DSA Certificate Test-server]
[46-TLS 1.3 DSA Certificate Test-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = ALL
DSA.Certificate = ${ENV::TEST_CERTS_DIR}/server-dsa-cert.pem
@@ -1487,13 +1556,13 @@ MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[44-TLS 1.3 DSA Certificate Test-client]
[46-TLS 1.3 DSA Certificate Test-client]
CipherString = ALL
SignatureAlgorithms = DSA+SHA1:DSA+SHA256:ECDSA+SHA256
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-44]
[test-46]
ExpectedResult = ServerFail
test/ssl-tests/20-cert-select.conf.in
+49 -1
View File
@@ -53,6 +53,50 @@ our @tests = (
"ExpectedResult" => "Success"
},
},
{
name => "ECDSA CipherString Selection",
server => {
"ECDSA.Certificate" => test_pem("server-ecdsa-cert.pem"),
"ECDSA.PrivateKey" => test_pem("server-ecdsa-key.pem"),
"MaxProtocol" => "TLSv1.2",
#Deliberately set supported_groups to one not in the cert. This
#should be tolerated
"Groups" => "P-384"
},
client => {
"CipherString" => "aECDSA",
"MaxProtocol" => "TLSv1.2",
"Groups" => "P-256:P-384",
"RequestCAFile" => test_pem("root-cert.pem"),
},
test => {
"ExpectedServerCertType" =>, "P-256",
"ExpectedServerSignType" =>, "EC",
# Note: certificate_authorities not sent for TLS < 1.3
"ExpectedServerCANames" =>, "empty",
"ExpectedResult" => "Success"
},
},
{
name => "ECDSA CipherString Selection",
server => {
"ECDSA.Certificate" => test_pem("server-ecdsa-cert.pem"),
"ECDSA.PrivateKey" => test_pem("server-ecdsa-key.pem"),
"MaxProtocol" => "TLSv1.2",
"Groups" => "P-256:P-384"
},
client => {
"CipherString" => "aECDSA",
"MaxProtocol" => "TLSv1.2",
#Deliberately set groups to not include the certificate group. This
#should fail
"Groups" => "P-384",
"RequestCAFile" => test_pem("root-cert.pem"),
},
test => {
"ExpectedResult" => "ServerFail"
},
},
{
name => "Ed25519 CipherString and Signature Algorithm Selection",
server => $server,
@@ -467,7 +511,11 @@ my @tests_tls_1_3 = (
"SignatureAlgorithms" => "ECDSA+SHA256",
},
test => {
"ExpectedResult" => "ServerFail"
"ExpectedServerCertType" => "P-256",
"ExpectedServerSignHash" => "SHA256",
"ExpectedServerSignType" => "EC",
"ExpectedServerCANames" => "empty",
"ExpectedResult" => "Success"
},
},
{
test/ssl-tests/protocol_version.pm
+3 -1
View File
@@ -1,5 +1,5 @@
# -*- mode: perl; -*-
# Copyright 2016-2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -137,6 +137,7 @@ sub generate_version_tests {
"client" => {
#Offering only <=TLSv1.2 ciphersuites with TLSv1.3 should fail
"CipherString" => "AES128-SHA",
"Ciphersuites" => "",
},
"server" => {
"MaxProtocol" => "TLSv1.2"
@@ -154,6 +155,7 @@ sub generate_version_tests {
"server" => {
#Allowing only <=TLSv1.2 ciphersuites with TLSv1.3 should fail
"CipherString" => "AES128-SHA",
"Ciphersuites" => "",
},
"test" => {
"ExpectedResult" => "ServerFail",
test/ssl_cert_table_internal_test.c
+2 -2
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -76,7 +76,7 @@ static int test_ssl_cert_table(void)
return 1;
}
int setup_tests()
int setup_tests(void)
{
ADD_TEST(test_ssl_cert_table);
return 1;
test/ssl_test.c
+33 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -406,15 +406,27 @@ static int test_handshake(int idx)
#ifndef OPENSSL_NO_DTLS
if (test_ctx->method == SSL_TEST_METHOD_DTLS) {
server_ctx = SSL_CTX_new(DTLS_server_method());
if (!TEST_true(SSL_CTX_set_max_proto_version(server_ctx,
DTLS_MAX_VERSION)))
goto err;
if (test_ctx->extra.server.servername_callback !=
SSL_TEST_SERVERNAME_CB_NONE) {
if (!TEST_ptr(server2_ctx = SSL_CTX_new(DTLS_server_method())))
goto err;
}
client_ctx = SSL_CTX_new(DTLS_client_method());
if (!TEST_true(SSL_CTX_set_max_proto_version(client_ctx,
DTLS_MAX_VERSION)))
goto err;
if (test_ctx->handshake_mode == SSL_TEST_HANDSHAKE_RESUME) {
resume_server_ctx = SSL_CTX_new(DTLS_server_method());
if (!TEST_true(SSL_CTX_set_max_proto_version(resume_server_ctx,
DTLS_MAX_VERSION)))
goto err;
resume_client_ctx = SSL_CTX_new(DTLS_client_method());
if (!TEST_true(SSL_CTX_set_max_proto_version(resume_client_ctx,
DTLS_MAX_VERSION)))
goto err;
if (!TEST_ptr(resume_server_ctx)
|| !TEST_ptr(resume_client_ctx))
goto err;
@@ -423,23 +435,43 @@ static int test_handshake(int idx)
#endif
if (test_ctx->method == SSL_TEST_METHOD_TLS) {
server_ctx = SSL_CTX_new(TLS_server_method());
if (!TEST_true(SSL_CTX_set_max_proto_version(server_ctx,
TLS_MAX_VERSION)))
goto err;
/* SNI on resumption isn't supported/tested yet. */
if (test_ctx->extra.server.servername_callback !=
SSL_TEST_SERVERNAME_CB_NONE) {
if (!TEST_ptr(server2_ctx = SSL_CTX_new(TLS_server_method())))
goto err;
if (!TEST_true(SSL_CTX_set_max_proto_version(server2_ctx,
TLS_MAX_VERSION)))
goto err;
}
client_ctx = SSL_CTX_new(TLS_client_method());
if (!TEST_true(SSL_CTX_set_max_proto_version(client_ctx,
TLS_MAX_VERSION)))
goto err;
if (test_ctx->handshake_mode == SSL_TEST_HANDSHAKE_RESUME) {
resume_server_ctx = SSL_CTX_new(TLS_server_method());
if (!TEST_true(SSL_CTX_set_max_proto_version(resume_server_ctx,
TLS_MAX_VERSION)))
goto err;
resume_client_ctx = SSL_CTX_new(TLS_client_method());
if (!TEST_true(SSL_CTX_set_max_proto_version(resume_client_ctx,
TLS_MAX_VERSION)))
goto err;
if (!TEST_ptr(resume_server_ctx)
|| !TEST_ptr(resume_client_ctx))
goto err;
}
}
#ifdef OPENSSL_NO_AUTOLOAD_CONFIG
if (!TEST_true(OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL)))
goto err;
#endif
if (!TEST_ptr(server_ctx)
|| !TEST_ptr(client_ctx)
|| !TEST_int_gt(CONF_modules_load(conf, test_app, 0), 0))
test/ssl_test_ctx.c
+1 -1
View File
@@ -709,7 +709,7 @@ static const ssl_test_server_option ssl_test_server_options[] = {
{ "SessionTicketAppData", &parse_server_session_ticket_app_data },
};
SSL_TEST_CTX *SSL_TEST_CTX_new()
SSL_TEST_CTX *SSL_TEST_CTX_new(void)
{
SSL_TEST_CTX *ret;
test/ssl_test_ctx_test.c
+1 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
test/sslapitest.c
+1581 -204
View File
@@ -14,16 +14,22 @@
#include <openssl/crypto.h>
#include <openssl/ssl.h>
#include <openssl/ocsp.h>
#include <openssl/srp.h>
#include <openssl/txt_db.h>
#include <openssl/aes.h>
#include "ssltestlib.h"
#include "testutil.h"
#include "testutil/output.h"
#include "internal/nelem.h"
#include "../ssl/ssl_locl.h"
static char *cert = NULL;
static char *privkey = NULL;
static char *srpvfile = NULL;
static char *tmpfilename = NULL;
#define LOG_BUFFER_SIZE 1024
#define LOG_BUFFER_SIZE 2048
static char server_log_buffer[LOG_BUFFER_SIZE + 1] = {0};
static size_t server_log_buffer_index = 0;
static char client_log_buffer[LOG_BUFFER_SIZE + 1] = {0};
@@ -49,10 +55,13 @@ static X509 *ocspcert = NULL;
struct sslapitest_log_counts {
unsigned int rsa_key_exchange_count;
unsigned int master_secret_count;
unsigned int client_early_secret_count;
unsigned int client_handshake_secret_count;
unsigned int server_handshake_secret_count;
unsigned int client_application_secret_count;
unsigned int server_application_secret_count;
unsigned int early_exporter_secret_count;
unsigned int exporter_secret_count;
};
@@ -134,10 +143,13 @@ static int test_keylog_output(char *buffer, const SSL *ssl,
size_t master_key_size = SSL_MAX_MASTER_KEY_LENGTH;
unsigned int rsa_key_exchange_count = 0;
unsigned int master_secret_count = 0;
unsigned int client_early_secret_count = 0;
unsigned int client_handshake_secret_count = 0;
unsigned int server_handshake_secret_count = 0;
unsigned int client_application_secret_count = 0;
unsigned int server_application_secret_count = 0;
unsigned int early_exporter_secret_count = 0;
unsigned int exporter_secret_count = 0;
for (token = strtok(buffer, " \n"); token != NULL;
token = strtok(NULL, " \n")) {
@@ -191,17 +203,22 @@ static int test_keylog_output(char *buffer, const SSL *ssl,
master_key_size)))
return 0;
master_secret_count++;
} else if (strcmp(token, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0
} else if (strcmp(token, "CLIENT_EARLY_TRAFFIC_SECRET") == 0
|| strcmp(token, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0
|| strcmp(token, "SERVER_HANDSHAKE_TRAFFIC_SECRET") == 0
|| strcmp(token, "CLIENT_TRAFFIC_SECRET_0") == 0
|| strcmp(token, "SERVER_TRAFFIC_SECRET_0") == 0) {
|| strcmp(token, "SERVER_TRAFFIC_SECRET_0") == 0
|| strcmp(token, "EARLY_EXPORTER_SECRET") == 0
|| strcmp(token, "EXPORTER_SECRET") == 0) {
/*
* TLSv1.3 secret. Tokens should be: 64 ASCII bytes of hex-encoded
* client random, and then the hex-encoded secret. In this case,
* we treat all of these secrets identically and then just
* distinguish between them when counting what we saw.
*/
if (strcmp(token, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0)
if (strcmp(token, "CLIENT_EARLY_TRAFFIC_SECRET") == 0)
client_early_secret_count++;
else if (strcmp(token, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0)
client_handshake_secret_count++;
else if (strcmp(token, "SERVER_HANDSHAKE_TRAFFIC_SECRET") == 0)
server_handshake_secret_count++;
@@ -209,6 +226,10 @@ static int test_keylog_output(char *buffer, const SSL *ssl,
client_application_secret_count++;
else if (strcmp(token, "SERVER_TRAFFIC_SECRET_0") == 0)
server_application_secret_count++;
else if (strcmp(token, "EARLY_EXPORTER_SECRET") == 0)
early_exporter_secret_count++;
else if (strcmp(token, "EXPORTER_SECRET") == 0)
exporter_secret_count++;
client_random_size = SSL_get_client_random(ssl,
actual_client_random,
@@ -242,6 +263,8 @@ static int test_keylog_output(char *buffer, const SSL *ssl,
expected->rsa_key_exchange_count)
|| !TEST_size_t_eq(master_secret_count,
expected->master_secret_count)
|| !TEST_size_t_eq(client_early_secret_count,
expected->client_early_secret_count)
|| !TEST_size_t_eq(client_handshake_secret_count,
expected->client_handshake_secret_count)
|| !TEST_size_t_eq(server_handshake_secret_count,
@@ -249,7 +272,11 @@ static int test_keylog_output(char *buffer, const SSL *ssl,
|| !TEST_size_t_eq(client_application_secret_count,
expected->client_application_secret_count)
|| !TEST_size_t_eq(server_application_secret_count,
expected->server_application_secret_count))
expected->server_application_secret_count)
|| !TEST_size_t_eq(early_exporter_secret_count,
expected->early_exporter_secret_count)
|| !TEST_size_t_eq(exporter_secret_count,
expected->exporter_secret_count))
return 0;
return 1;
}
@@ -271,6 +298,7 @@ static int test_keylog(void)
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
return 0;
@@ -338,8 +366,11 @@ static int test_keylog_no_master_key(void)
{
SSL_CTX *cctx = NULL, *sctx = NULL;
SSL *clientssl = NULL, *serverssl = NULL;
SSL_SESSION *sess = NULL;
int testresult = 0;
struct sslapitest_log_counts expected = {0};
unsigned char buf[1];
size_t readbytes, written;
/* Clean up logging space */
memset(client_log_buffer, 0, sizeof(client_log_buffer));
@@ -348,9 +379,11 @@ static int test_keylog_no_master_key(void)
server_log_buffer_index = 0;
error_writing_log = 0;
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(), &sctx,
&cctx, cert, privkey)))
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey))
|| !TEST_true(SSL_CTX_set_max_early_data(sctx,
SSL3_RT_MAX_PLAIN_LENGTH)))
return 0;
if (!TEST_true(SSL_CTX_get_keylog_callback(cctx) == NULL)
@@ -384,6 +417,46 @@ static int test_keylog_no_master_key(void)
expected.server_handshake_secret_count = 1;
expected.client_application_secret_count = 1;
expected.server_application_secret_count = 1;
expected.exporter_secret_count = 1;
if (!TEST_true(test_keylog_output(client_log_buffer, clientssl,
SSL_get_session(clientssl), &expected))
|| !TEST_true(test_keylog_output(server_log_buffer, serverssl,
SSL_get_session(serverssl),
&expected)))
goto end;
/* Terminate old session and resume with early data. */
sess = SSL_get1_session(clientssl);
SSL_shutdown(clientssl);
SSL_shutdown(serverssl);
SSL_free(serverssl);
SSL_free(clientssl);
serverssl = clientssl = NULL;
/* Reset key log */
memset(client_log_buffer, 0, sizeof(client_log_buffer));
memset(server_log_buffer, 0, sizeof(server_log_buffer));
client_log_buffer_index = 0;
server_log_buffer_index = 0;
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
&clientssl, NULL, NULL))
|| !TEST_true(SSL_set_session(clientssl, sess))
/* Here writing 0 length early data is enough. */
|| !TEST_true(SSL_write_early_data(clientssl, NULL, 0, &written))
|| !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
&readbytes),
SSL_READ_EARLY_DATA_ERROR)
|| !TEST_int_eq(SSL_get_early_data_status(serverssl),
SSL_EARLY_DATA_ACCEPTED)
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE))
|| !TEST_true(SSL_session_reused(clientssl)))
goto end;
/* In addition to the previous entries, expect early secrets. */
expected.client_early_secret_count = 1;
expected.early_exporter_secret_count = 1;
if (!TEST_true(test_keylog_output(client_log_buffer, clientssl,
SSL_get_session(clientssl), &expected))
|| !TEST_true(test_keylog_output(server_log_buffer, serverssl,
@@ -394,6 +467,7 @@ static int test_keylog_no_master_key(void)
testresult = 1;
end:
SSL_SESSION_free(sess);
SSL_free(serverssl);
SSL_free(clientssl);
SSL_CTX_free(sctx);
@@ -451,9 +525,9 @@ static int test_client_hello_cb(void)
SSL *clientssl = NULL, *serverssl = NULL;
int testctr = 0, testresult = 0;
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(), &sctx,
&cctx, cert, privkey)))
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
goto end;
SSL_CTX_set_client_hello_cb(sctx, full_client_hello_callback, &testctr);
@@ -489,7 +563,9 @@ end:
#endif
static int execute_test_large_message(const SSL_METHOD *smeth,
const SSL_METHOD *cmeth, int read_ahead)
const SSL_METHOD *cmeth,
int min_version, int max_version,
int read_ahead)
{
SSL_CTX *cctx = NULL, *sctx = NULL;
SSL *clientssl = NULL, *serverssl = NULL;
@@ -507,8 +583,8 @@ static int execute_test_large_message(const SSL_METHOD *smeth,
if (!TEST_ptr(chaincert))
goto end;
if (!TEST_true(create_ssl_ctx_pair(smeth, cmeth, &sctx,
&cctx, cert, privkey)))
if (!TEST_true(create_ssl_ctx_pair(smeth, cmeth, min_version, max_version,
&sctx, &cctx, cert, privkey)))
goto end;
if (read_ahead) {
@@ -565,12 +641,14 @@ static int execute_test_large_message(const SSL_METHOD *smeth,
static int test_large_message_tls(void)
{
return execute_test_large_message(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
0);
}
static int test_large_message_tls_read_ahead(void)
{
return execute_test_large_message(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
1);
}
@@ -582,7 +660,9 @@ static int test_large_message_dtls(void)
* read_ahead is set.
*/
return execute_test_large_message(DTLS_server_method(),
DTLS_client_method(), 0);
DTLS_client_method(),
DTLS1_VERSION, DTLS_MAX_VERSION,
0);
}
#endif
@@ -641,8 +721,9 @@ static int test_tlsext_status_type(void)
OCSP_RESPID *id = NULL;
BIO *certbio = NULL;
if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), &sctx,
&cctx, cert, privkey))
if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey))
return 0;
if (SSL_CTX_get_tlsext_status_type(cctx) != -1)
@@ -801,13 +882,17 @@ static int execute_test_session(int maxprot, int use_int_cache,
SSL *serverssl3 = NULL, *clientssl3 = NULL;
# endif
SSL_SESSION *sess1 = NULL, *sess2 = NULL;
int testresult = 0;
int testresult = 0, numnewsesstick = 1;
new_called = remove_called = 0;
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(), &sctx,
&cctx, cert, privkey)))
/* TLSv1.3 sends 2 NewSessionTickets */
if (maxprot == TLS1_3_VERSION)
numnewsesstick = 2;
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
return 0;
/*
@@ -842,7 +927,9 @@ static int execute_test_session(int maxprot, int use_int_cache,
if (use_int_cache && !TEST_false(SSL_CTX_add_session(cctx, sess1)))
goto end;
if (use_ext_cache
&& (!TEST_int_eq(new_called, 1) || !TEST_int_eq(remove_called, 0)))
&& (!TEST_int_eq(new_called, numnewsesstick)
|| !TEST_int_eq(remove_called, 0)))
goto end;
new_called = remove_called = 0;
@@ -857,11 +944,11 @@ static int execute_test_session(int maxprot, int use_int_cache,
if (maxprot == TLS1_3_VERSION) {
/*
* In TLSv1.3 we should have created a new session even though we have
* resumed. The original session should also have been removed.
* resumed.
*/
if (use_ext_cache
&& (!TEST_int_eq(new_called, 1)
|| !TEST_int_eq(remove_called, 1)))
|| !TEST_int_eq(remove_called, 0)))
goto end;
} else {
/*
@@ -891,7 +978,8 @@ static int execute_test_session(int maxprot, int use_int_cache,
goto end;
if (use_ext_cache
&& (!TEST_int_eq(new_called, 1) || !TEST_int_eq(remove_called, 0)))
&& (!TEST_int_eq(new_called, numnewsesstick)
|| !TEST_int_eq(remove_called, 0)))
goto end;
new_called = remove_called = 0;
@@ -984,14 +1072,27 @@ static int execute_test_session(int maxprot, int use_int_cache,
|| !TEST_ptr(sess2 = SSL_get1_session(serverssl1)))
goto end;
/* Should fail because it should already be in the cache */
if (use_int_cache && !TEST_false(SSL_CTX_add_session(sctx, sess2)))
goto end;
if (use_int_cache) {
if (maxprot == TLS1_3_VERSION && !use_ext_cache) {
/*
* In TLSv1.3 it should not have been added to the internal cache,
* except in the case where we also have an external cache (in that
* case it gets added to the cache in order to generate remove
* events after timeout).
*/
if (!TEST_false(SSL_CTX_remove_session(sctx, sess2)))
goto end;
} else {
/* Should fail because it should already be in the cache */
if (!TEST_false(SSL_CTX_add_session(sctx, sess2)))
goto end;
}
}
if (use_ext_cache) {
SSL_SESSION *tmp = sess2;
if (!TEST_int_eq(new_called, 1)
if (!TEST_int_eq(new_called, numnewsesstick)
|| !TEST_int_eq(remove_called, 0)
|| !TEST_int_eq(get_called, 0))
goto end;
@@ -1000,7 +1101,7 @@ static int execute_test_session(int maxprot, int use_int_cache,
* the external cache. We take a copy first because
* SSL_CTX_remove_session() also marks the session as non-resumable.
*/
if (use_int_cache) {
if (use_int_cache && maxprot != TLS1_3_VERSION) {
if (!TEST_ptr(tmp = SSL_SESSION_dup(sess2))
|| !TEST_true(SSL_CTX_remove_session(sctx, sess2)))
goto end;
@@ -1020,15 +1121,16 @@ static int execute_test_session(int maxprot, int use_int_cache,
goto end;
if (use_ext_cache) {
if (!TEST_int_eq(new_called, 0)
|| !TEST_int_eq(remove_called, 0))
if (!TEST_int_eq(remove_called, 0))
goto end;
if (maxprot == TLS1_3_VERSION) {
if (!TEST_int_eq(get_called, 0))
if (!TEST_int_eq(new_called, 1)
|| !TEST_int_eq(get_called, 0))
goto end;
} else {
if (!TEST_int_eq(get_called, 1))
if (!TEST_int_eq(new_called, 0)
|| !TEST_int_eq(get_called, 1))
goto end;
}
}
@@ -1095,11 +1197,156 @@ static int test_session_with_both_cache(void)
#endif
}
#define USE_NULL 0
#define USE_BIO_1 1
#define USE_BIO_2 2
#ifndef OPENSSL_NO_TLS1_3
static SSL_SESSION *sesscache[6];
static int do_cache;
#define TOTAL_SSL_SET_BIO_TESTS (3 * 3 * 3 * 3)
static int new_cachesession_cb(SSL *ssl, SSL_SESSION *sess)
{
if (do_cache) {
sesscache[new_called] = sess;
} else {
/* We don't need the reference to the session, so free it */
SSL_SESSION_free(sess);
}
new_called++;
return 1;
}
static int post_handshake_verify(SSL *sssl, SSL *cssl)
{
SSL_set_verify(sssl, SSL_VERIFY_PEER, NULL);
if (!TEST_true(SSL_verify_client_post_handshake(sssl)))
return 0;
/* Start handshake on the server and client */
if (!TEST_int_eq(SSL_do_handshake(sssl), 1)
|| !TEST_int_le(SSL_read(cssl, NULL, 0), 0)
|| !TEST_int_le(SSL_read(sssl, NULL, 0), 0)
|| !TEST_true(create_ssl_connection(sssl, cssl,
SSL_ERROR_NONE)))
return 0;
return 1;
}
static int test_tickets(int idx)
{
SSL_CTX *sctx = NULL, *cctx = NULL;
SSL *serverssl = NULL, *clientssl = NULL;
int testresult = 0, i;
size_t j;
/* idx is the test number, but also the number of tickets we want */
new_called = 0;
do_cache = 1;
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION, &sctx,
&cctx, cert, privkey))
|| !TEST_true(SSL_CTX_set_num_tickets(sctx, idx)))
goto end;
SSL_CTX_set_session_cache_mode(cctx, SSL_SESS_CACHE_CLIENT
| SSL_SESS_CACHE_NO_INTERNAL_STORE);
SSL_CTX_sess_set_new_cb(cctx, new_cachesession_cb);
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
&clientssl, NULL, NULL)))
goto end;
SSL_force_post_handshake_auth(clientssl);
if (!TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE))
/* Check we got the number of tickets we were expecting */
|| !TEST_int_eq(idx, new_called))
goto end;
/* After a post-handshake authentication we should get new tickets issued */
if (!post_handshake_verify(serverssl, clientssl)
|| !TEST_int_eq(idx * 2, new_called))
goto end;
SSL_shutdown(clientssl);
SSL_shutdown(serverssl);
SSL_free(serverssl);
SSL_free(clientssl);
serverssl = clientssl = NULL;
/* Stop caching sessions - just count them */
do_cache = 0;
/* Test that we can resume with all the tickets we got given */
for (i = 0; i < idx * 2; i++) {
new_called = 0;
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
&clientssl, NULL, NULL))
|| !TEST_true(SSL_set_session(clientssl, sesscache[i])))
goto end;
SSL_force_post_handshake_auth(clientssl);
if (!TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE))
|| !TEST_true(SSL_session_reused(clientssl))
/* Following a resumption we only get 1 ticket */
|| !TEST_int_eq(new_called, 1))
goto end;
new_called = 0;
/* After a post-handshake authentication we should get 1 new ticket */
if (!post_handshake_verify(serverssl, clientssl)
|| !TEST_int_eq(new_called, 1))
goto end;
SSL_shutdown(clientssl);
SSL_shutdown(serverssl);
SSL_free(serverssl);
SSL_free(clientssl);
serverssl = clientssl = NULL;
SSL_SESSION_free(sesscache[i]);
sesscache[i] = NULL;
}
testresult = 1;
end:
SSL_free(serverssl);
SSL_free(clientssl);
for (j = 0; j < OSSL_NELEM(sesscache); j++) {
SSL_SESSION_free(sesscache[j]);
sesscache[j] = NULL;
}
SSL_CTX_free(sctx);
SSL_CTX_free(cctx);
return testresult;
}
#endif
#define USE_NULL 0
#define USE_BIO_1 1
#define USE_BIO_2 2
#define USE_DEFAULT 3
#define CONNTYPE_CONNECTION_SUCCESS 0
#define CONNTYPE_CONNECTION_FAIL 1
#define CONNTYPE_NO_CONNECTION 2
#define TOTAL_NO_CONN_SSL_SET_BIO_TESTS (3 * 3 * 3 * 3)
#define TOTAL_CONN_SUCCESS_SSL_SET_BIO_TESTS (2 * 2)
#if !defined(OPENSSL_NO_TLS1_3) && !defined(OPENSSL_NO_TLS1_2)
# define TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS (2 * 2)
#else
# define TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS 0
#endif
#define TOTAL_SSL_SET_BIO_TESTS TOTAL_NO_CONN_SSL_SET_BIO_TESTS \
+ TOTAL_CONN_SUCCESS_SSL_SET_BIO_TESTS \
+ TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS
static void setupbio(BIO **res, BIO *bio1, BIO *bio2, int type)
{
@@ -1116,28 +1363,65 @@ static void setupbio(BIO **res, BIO *bio1, BIO *bio2, int type)
}
}
/*
* Tests calls to SSL_set_bio() under various conditions.
*
* For the first 3 * 3 * 3 * 3 = 81 tests we do 2 calls to SSL_set_bio() with
* various combinations of valid BIOs or NULL being set for the rbio/wbio. We
* then do more tests where we create a successful connection first using our
* standard connection setup functions, and then call SSL_set_bio() with
* various combinations of valid BIOs or NULL. We then repeat these tests
* following a failed connection. In this last case we are looking to check that
* SSL_set_bio() functions correctly in the case where s->bbio is not NULL.
*/
static int test_ssl_set_bio(int idx)
{
SSL_CTX *ctx;
SSL_CTX *sctx = NULL, *cctx = NULL;
BIO *bio1 = NULL;
BIO *bio2 = NULL;
BIO *irbio = NULL, *iwbio = NULL, *nrbio = NULL, *nwbio = NULL;
SSL *ssl = NULL;
int initrbio, initwbio, newrbio, newwbio;
SSL *serverssl = NULL, *clientssl = NULL;
int initrbio, initwbio, newrbio, newwbio, conntype;
int testresult = 0;
initrbio = idx % 3;
idx /= 3;
initwbio = idx % 3;
idx /= 3;
newrbio = idx % 3;
idx /= 3;
newwbio = idx;
if (!TEST_int_le(newwbio, 2))
return 0;
if (idx < TOTAL_NO_CONN_SSL_SET_BIO_TESTS) {
initrbio = idx % 3;
idx /= 3;
initwbio = idx % 3;
idx /= 3;
newrbio = idx % 3;
idx /= 3;
newwbio = idx % 3;
conntype = CONNTYPE_NO_CONNECTION;
} else {
idx -= TOTAL_NO_CONN_SSL_SET_BIO_TESTS;
initrbio = initwbio = USE_DEFAULT;
newrbio = idx % 2;
idx /= 2;
newwbio = idx % 2;
idx /= 2;
conntype = idx % 2;
}
if (!TEST_ptr(ctx = SSL_CTX_new(TLS_method()))
|| !TEST_ptr(ssl = SSL_new(ctx)))
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
goto end;
if (conntype == CONNTYPE_CONNECTION_FAIL) {
/*
* We won't ever get here if either TLSv1.3 or TLSv1.2 is disabled
* because we reduced the number of tests in the definition of
* TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS to avoid this scenario. By setting
* mismatched protocol versions we will force a connection failure.
*/
SSL_CTX_set_min_proto_version(sctx, TLS1_3_VERSION);
SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION);
}
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL)))
goto end;
if (initrbio == USE_BIO_1
@@ -1156,19 +1440,27 @@ static int test_ssl_set_bio(int idx)
goto end;
}
setupbio(&irbio, bio1, bio2, initrbio);
setupbio(&iwbio, bio1, bio2, initwbio);
if (initrbio != USE_DEFAULT) {
setupbio(&irbio, bio1, bio2, initrbio);
setupbio(&iwbio, bio1, bio2, initwbio);
SSL_set_bio(clientssl, irbio, iwbio);
/*
* We want to maintain our own refs to these BIO, so do an up ref for each
* BIO that will have ownership transferred in the SSL_set_bio() call
*/
if (irbio != NULL)
BIO_up_ref(irbio);
if (iwbio != NULL && iwbio != irbio)
BIO_up_ref(iwbio);
/*
* We want to maintain our own refs to these BIO, so do an up ref for
* each BIO that will have ownership transferred in the SSL_set_bio()
* call
*/
if (irbio != NULL)
BIO_up_ref(irbio);
if (iwbio != NULL && iwbio != irbio)
BIO_up_ref(iwbio);
}
SSL_set_bio(ssl, irbio, iwbio);
if (conntype != CONNTYPE_NO_CONNECTION
&& !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE)
== (conntype == CONNTYPE_CONNECTION_SUCCESS)))
goto end;
setupbio(&nrbio, bio1, bio2, newrbio);
setupbio(&nwbio, bio1, bio2, newwbio);
@@ -1187,12 +1479,11 @@ static int test_ssl_set_bio(int idx)
&& (nwbio != iwbio || (nwbio == iwbio && irbio == iwbio)))
BIO_up_ref(nwbio);
SSL_set_bio(ssl, nrbio, nwbio);
SSL_set_bio(clientssl, nrbio, nwbio);
testresult = 1;
end:
SSL_free(ssl);
BIO_free(bio1);
BIO_free(bio2);
@@ -1202,7 +1493,10 @@ static int test_ssl_set_bio(int idx)
* functions. If we haven't done enough then this will only be detected in
* a crypto-mdebug build
*/
SSL_CTX_free(ctx);
SSL_free(serverssl);
SSL_free(clientssl);
SSL_CTX_free(sctx);
SSL_CTX_free(cctx);
return testresult;
}
@@ -1335,9 +1629,9 @@ static int test_set_sigalgs(int idx)
curr = testctx ? &testsigalgs[idx]
: &testsigalgs[idx - OSSL_NELEM(testsigalgs)];
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(), &sctx,
&cctx, cert, privkey)))
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
return 0;
/*
@@ -1449,6 +1743,7 @@ static int use_session_cb(SSL *ssl, const EVP_MD *md, const unsigned char **id,
return 1;
}
#ifndef OPENSSL_NO_PSK
static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *id,
unsigned int max_id_len,
unsigned char *psk,
@@ -1476,6 +1771,7 @@ static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *id,
return psklen;
}
#endif /* OPENSSL_NO_PSK */
static int find_session_cb(SSL *ssl, const unsigned char *identity,
size_t identity_len, SSL_SESSION **sess)
@@ -1503,6 +1799,7 @@ static int find_session_cb(SSL *ssl, const unsigned char *identity,
return 1;
}
#ifndef OPENSSL_NO_PSK
static unsigned int psk_server_cb(SSL *ssl, const char *identity,
unsigned char *psk, unsigned int max_psk_len)
{
@@ -1529,6 +1826,7 @@ static unsigned int psk_server_cb(SSL *ssl, const char *identity,
return psklen;
}
#endif /* OPENSSL_NO_PSK */
#define MSG1 "Hello"
#define MSG2 "World."
@@ -1548,12 +1846,10 @@ static unsigned int psk_server_cb(SSL *ssl, const char *identity,
static int setupearly_data_test(SSL_CTX **cctx, SSL_CTX **sctx, SSL **clientssl,
SSL **serverssl, SSL_SESSION **sess, int idx)
{
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(), sctx,
cctx, cert, privkey))
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
sctx, cctx, cert, privkey))
|| !TEST_true(SSL_CTX_set_max_early_data(*sctx,
SSL3_RT_MAX_PLAIN_LENGTH))
|| !TEST_true(SSL_CTX_set_max_early_data(*cctx,
SSL3_RT_MAX_PLAIN_LENGTH)))
return 0;
@@ -1618,8 +1914,15 @@ static int setupearly_data_test(SSL_CTX **cctx, SSL_CTX **sctx, SSL **clientssl,
}
serverpsk = clientpsk;
if (sess != NULL)
if (sess != NULL) {
if (!TEST_true(SSL_SESSION_up_ref(clientpsk))) {
SSL_SESSION_free(clientpsk);
SSL_SESSION_free(serverpsk);
clientpsk = serverpsk = NULL;
return 0;
}
*sess = clientpsk;
}
return 1;
}
@@ -1775,10 +2078,13 @@ static int test_early_data_read_write(int idx)
goto end;
/*
* Make sure we process the NewSessionTicket. This arrives post-handshake.
* We attempt a read which we do not expect to return any data.
* Make sure we process the two NewSessionTickets. These arrive
* post-handshake. We attempt reads which we do not expect to return any
* data.
*/
if (!TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes)))
if (!TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
|| !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf),
&readbytes)))
goto end;
/* Server should be able to write normal data */
@@ -1788,9 +2094,7 @@ static int test_early_data_read_write(int idx)
|| !TEST_mem_eq(buf, readbytes, MSG7, strlen(MSG7)))
goto end;
/* We keep the PSK session around if using PSK */
if (idx != 2)
SSL_SESSION_free(sess);
SSL_SESSION_free(sess);
sess = SSL_get1_session(clientssl);
use_session_cb_cnt = 0;
find_session_cb_cnt = 0;
@@ -1840,8 +2144,58 @@ static int test_early_data_read_write(int idx)
testresult = 1;
end:
if (sess != clientpsk)
SSL_SESSION_free(sess);
SSL_SESSION_free(sess);
SSL_SESSION_free(clientpsk);
SSL_SESSION_free(serverpsk);
clientpsk = serverpsk = NULL;
SSL_free(serverssl);
SSL_free(clientssl);
SSL_CTX_free(sctx);
SSL_CTX_free(cctx);
return testresult;
}
static int test_early_data_replay(int idx)
{
SSL_CTX *cctx = NULL, *sctx = NULL;
SSL *clientssl = NULL, *serverssl = NULL;
int testresult = 0;
SSL_SESSION *sess = NULL;
if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
&serverssl, &sess, idx)))
goto end;
/*
* The server is configured to accept early data. Create a connection to
* "use up" the ticket
*/
if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
|| !TEST_true(SSL_session_reused(clientssl)))
goto end;
SSL_shutdown(clientssl);
SSL_shutdown(serverssl);
SSL_free(serverssl);
SSL_free(clientssl);
serverssl = clientssl = NULL;
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
&clientssl, NULL, NULL))
|| !TEST_true(SSL_set_session(clientssl, sess))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE))
/*
* This time we should not have resumed the session because we
* already used it once.
*/
|| !TEST_false(SSL_session_reused(clientssl)))
goto end;
testresult = 1;
end:
SSL_SESSION_free(sess);
SSL_SESSION_free(clientpsk);
SSL_SESSION_free(serverpsk);
clientpsk = serverpsk = NULL;
@@ -1928,8 +2282,7 @@ static int early_data_skip_helper(int hrr, int idx)
testresult = 1;
end:
if (sess != clientpsk)
SSL_SESSION_free(clientpsk);
SSL_SESSION_free(clientpsk);
SSL_SESSION_free(serverpsk);
clientpsk = serverpsk = NULL;
SSL_SESSION_free(sess);
@@ -2000,15 +2353,6 @@ static int test_early_data_not_sent(int idx)
|| !TEST_size_t_eq(written, strlen(MSG2)))
goto end;
/*
* Should block due to the NewSessionTicket arrival unless we're using
* read_ahead
*/
if (idx != 1) {
if (!TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes)))
goto end;
}
if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
|| !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
goto end;
@@ -2016,8 +2360,8 @@ static int test_early_data_not_sent(int idx)
testresult = 1;
end:
/* If using PSK then clientpsk and sess are the same */
SSL_SESSION_free(sess);
SSL_SESSION_free(clientpsk);
SSL_SESSION_free(serverpsk);
clientpsk = serverpsk = NULL;
SSL_free(serverssl);
@@ -2225,6 +2569,7 @@ static int test_early_data_psk(int idx)
testresult = 1;
end:
SSL_SESSION_free(sess);
SSL_SESSION_free(clientpsk);
SSL_SESSION_free(serverpsk);
clientpsk = serverpsk = NULL;
@@ -2282,8 +2627,8 @@ static int test_early_data_not_expected(int idx)
testresult = 1;
end:
/* If using PSK then clientpsk and sess are the same */
SSL_SESSION_free(sess);
SSL_SESSION_free(clientpsk);
SSL_SESSION_free(serverpsk);
clientpsk = serverpsk = NULL;
SSL_free(serverssl);
@@ -2356,7 +2701,6 @@ static int test_early_data_tls1_2(int idx)
testresult = 1;
end:
/* If using PSK then clientpsk and sess are the same */
SSL_SESSION_free(clientpsk);
SSL_SESSION_free(serverpsk);
clientpsk = serverpsk = NULL;
@@ -2369,6 +2713,87 @@ static int test_early_data_tls1_2(int idx)
}
# endif /* OPENSSL_NO_TLS1_2 */
/*
* Test configuring the TLSv1.3 ciphersuites
*
* Test 0: Set a default ciphersuite in the SSL_CTX (no explicit cipher_list)
* Test 1: Set a non-default ciphersuite in the SSL_CTX (no explicit cipher_list)
* Test 2: Set a default ciphersuite in the SSL (no explicit cipher_list)
* Test 3: Set a non-default ciphersuite in the SSL (no explicit cipher_list)
* Test 4: Set a default ciphersuite in the SSL_CTX (SSL_CTX cipher_list)
* Test 5: Set a non-default ciphersuite in the SSL_CTX (SSL_CTX cipher_list)
* Test 6: Set a default ciphersuite in the SSL (SSL_CTX cipher_list)
* Test 7: Set a non-default ciphersuite in the SSL (SSL_CTX cipher_list)
* Test 8: Set a default ciphersuite in the SSL (SSL cipher_list)
* Test 9: Set a non-default ciphersuite in the SSL (SSL cipher_list)
*/
static int test_set_ciphersuite(int idx)
{
SSL_CTX *cctx = NULL, *sctx = NULL;
SSL *clientssl = NULL, *serverssl = NULL;
int testresult = 0;
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey))
|| !TEST_true(SSL_CTX_set_ciphersuites(sctx,
"TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256")))
goto end;
if (idx >=4 && idx <= 7) {
/* SSL_CTX explicit cipher list */
if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "AES256-GCM-SHA384")))
goto end;
}
if (idx == 0 || idx == 4) {
/* Default ciphersuite */
if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
"TLS_AES_128_GCM_SHA256")))
goto end;
} else if (idx == 1 || idx == 5) {
/* Non default ciphersuite */
if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
"TLS_AES_128_CCM_SHA256")))
goto end;
}
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
&clientssl, NULL, NULL)))
goto end;
if (idx == 8 || idx == 9) {
/* SSL explicit cipher list */
if (!TEST_true(SSL_set_cipher_list(clientssl, "AES256-GCM-SHA384")))
goto end;
}
if (idx == 2 || idx == 6 || idx == 8) {
/* Default ciphersuite */
if (!TEST_true(SSL_set_ciphersuites(clientssl,
"TLS_AES_128_GCM_SHA256")))
goto end;
} else if (idx == 3 || idx == 7 || idx == 9) {
/* Non default ciphersuite */
if (!TEST_true(SSL_set_ciphersuites(clientssl,
"TLS_AES_128_CCM_SHA256")))
goto end;
}
if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
goto end;
testresult = 1;
end:
SSL_free(serverssl);
SSL_free(clientssl);
SSL_CTX_free(sctx);
SSL_CTX_free(cctx);
return testresult;
}
static int test_ciphersuite_change(void)
{
SSL_CTX *cctx = NULL, *sctx = NULL;
@@ -2378,11 +2803,11 @@ static int test_ciphersuite_change(void)
const SSL_CIPHER *aes_128_gcm_sha256 = NULL;
/* Create a session based on SHA-256 */
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(), &sctx,
&cctx, cert, privkey))
|| !TEST_true(SSL_CTX_set_cipher_list(cctx,
"TLS13-AES-128-GCM-SHA256"))
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey))
|| !TEST_true(SSL_CTX_set_ciphersuites(cctx,
"TLS_AES_128_GCM_SHA256"))
|| !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
&clientssl, NULL, NULL))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
@@ -2400,8 +2825,8 @@ static int test_ciphersuite_change(void)
# if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
/* Check we can resume a session with a different SHA-256 ciphersuite */
if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
"TLS13-CHACHA20-POLY1305-SHA256"))
if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
"TLS_CHACHA20_POLY1305_SHA256"))
|| !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL))
|| !TEST_true(SSL_set_session(clientssl, clntsess))
@@ -2423,7 +2848,7 @@ static int test_ciphersuite_change(void)
* Check attempting to resume a SHA-256 session with no SHA-256 ciphersuites
* succeeds but does not resume.
*/
if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "TLS13-AES-256-GCM-SHA384"))
if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, "TLS_AES_256_GCM_SHA384"))
|| !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL))
|| !TEST_true(SSL_set_session(clientssl, clntsess))
@@ -2441,7 +2866,7 @@ static int test_ciphersuite_change(void)
serverssl = clientssl = NULL;
/* Create a session based on SHA384 */
if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "TLS13-AES-256-GCM-SHA384"))
if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, "TLS_AES_256_GCM_SHA384"))
|| !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
&clientssl, NULL, NULL))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
@@ -2455,10 +2880,10 @@ static int test_ciphersuite_change(void)
SSL_free(clientssl);
serverssl = clientssl = NULL;
if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
"TLS13-AES-128-GCM-SHA256:TLS13-AES-256-GCM-SHA384"))
|| !TEST_true(SSL_CTX_set_cipher_list(sctx,
"TLS13-AES-256-GCM-SHA384"))
if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
"TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384"))
|| !TEST_true(SSL_CTX_set_ciphersuites(sctx,
"TLS_AES_256_GCM_SHA384"))
|| !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL))
|| !TEST_true(SSL_set_session(clientssl, clntsess))
@@ -2498,6 +2923,13 @@ static int test_ciphersuite_change(void)
return testresult;
}
/*
* Test TLSv1.3 PSKs
* Test 0 = Test new style callbacks
* Test 1 = Test both new and old style callbacks
* Test 2 = Test old style callbacks
* Test 3 = Test old style callbacks with no certificate
*/
static int test_tls13_psk(int idx)
{
SSL_CTX *sctx = NULL, *cctx = NULL;
@@ -2511,17 +2943,23 @@ static int test_tls13_psk(int idx)
};
int testresult = 0;
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(), &sctx,
&cctx, cert, privkey)))
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, idx == 3 ? NULL : cert,
idx == 3 ? NULL : privkey)))
goto end;
/*
* We use a ciphersuite with SHA256 to ease testing old style PSK callbacks
* which will always default to SHA256
*/
if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "TLS13-AES-128-GCM-SHA256")))
goto end;
if (idx != 3) {
/*
* We use a ciphersuite with SHA256 to ease testing old style PSK
* callbacks which will always default to SHA256. This should not be
* necessary if we have no cert/priv key. In that case the server should
* prefer SHA256 automatically.
*/
if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
"TLS_AES_128_GCM_SHA256")))
goto end;
}
/*
* Test 0: New style callbacks only
@@ -2532,47 +2970,54 @@ static int test_tls13_psk(int idx)
SSL_CTX_set_psk_use_session_callback(cctx, use_session_cb);
SSL_CTX_set_psk_find_session_callback(sctx, find_session_cb);
}
if (idx == 1 || idx == 2) {
#ifndef OPENSSL_NO_PSK
if (idx >= 1) {
SSL_CTX_set_psk_client_callback(cctx, psk_client_cb);
SSL_CTX_set_psk_server_callback(sctx, psk_server_cb);
}
#endif
srvid = pskid;
use_session_cb_cnt = 0;
find_session_cb_cnt = 0;
psk_client_cb_cnt = 0;
psk_server_cb_cnt = 0;
/* Check we can create a connection if callback decides not to send a PSK */
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE))
|| !TEST_false(SSL_session_reused(clientssl))
|| !TEST_false(SSL_session_reused(serverssl)))
goto end;
if (idx != 3) {
/*
* Check we can create a connection if callback decides not to send a
* PSK
*/
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE))
|| !TEST_false(SSL_session_reused(clientssl))
|| !TEST_false(SSL_session_reused(serverssl)))
goto end;
if (idx == 0 || idx == 1) {
if (!TEST_true(use_session_cb_cnt == 1)
|| !TEST_true(find_session_cb_cnt == 0)
/*
* If no old style callback then below should be 0
* otherwise 1
*/
|| !TEST_true(psk_client_cb_cnt == idx)
|| !TEST_true(psk_server_cb_cnt == 0))
goto end;
} else {
if (!TEST_true(use_session_cb_cnt == 0)
|| !TEST_true(find_session_cb_cnt == 0)
|| !TEST_true(psk_client_cb_cnt == 1)
|| !TEST_true(psk_server_cb_cnt == 0))
goto end;
if (idx == 0 || idx == 1) {
if (!TEST_true(use_session_cb_cnt == 1)
|| !TEST_true(find_session_cb_cnt == 0)
/*
* If no old style callback then below should be 0
* otherwise 1
*/
|| !TEST_true(psk_client_cb_cnt == idx)
|| !TEST_true(psk_server_cb_cnt == 0))
goto end;
} else {
if (!TEST_true(use_session_cb_cnt == 0)
|| !TEST_true(find_session_cb_cnt == 0)
|| !TEST_true(psk_client_cb_cnt == 1)
|| !TEST_true(psk_server_cb_cnt == 0))
goto end;
}
shutdown_ssl_connection(serverssl, clientssl);
serverssl = clientssl = NULL;
use_session_cb_cnt = psk_client_cb_cnt = 0;
}
shutdown_ssl_connection(serverssl, clientssl);
serverssl = clientssl = NULL;
use_session_cb_cnt = psk_client_cb_cnt = 0;
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL)))
goto end;
@@ -2652,39 +3097,41 @@ static int test_tls13_psk(int idx)
use_session_cb_cnt = find_session_cb_cnt = 0;
psk_client_cb_cnt = psk_server_cb_cnt = 0;
/*
* Check that if the server rejects the PSK we can still connect, but with
* a full handshake
*/
srvid = "Dummy Identity";
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE))
|| !TEST_false(SSL_session_reused(clientssl))
|| !TEST_false(SSL_session_reused(serverssl)))
goto end;
if (idx != 3) {
/*
* Check that if the server rejects the PSK we can still connect, but with
* a full handshake
*/
srvid = "Dummy Identity";
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE))
|| !TEST_false(SSL_session_reused(clientssl))
|| !TEST_false(SSL_session_reused(serverssl)))
goto end;
if (idx == 0 || idx == 1) {
if (!TEST_true(use_session_cb_cnt == 1)
|| !TEST_true(find_session_cb_cnt == 1)
|| !TEST_true(psk_client_cb_cnt == 0)
/*
* If no old style callback then below should be 0
* otherwise 1
*/
|| !TEST_true(psk_server_cb_cnt == idx))
goto end;
} else {
if (!TEST_true(use_session_cb_cnt == 0)
|| !TEST_true(find_session_cb_cnt == 0)
|| !TEST_true(psk_client_cb_cnt == 1)
|| !TEST_true(psk_server_cb_cnt == 1))
goto end;
if (idx == 0 || idx == 1) {
if (!TEST_true(use_session_cb_cnt == 1)
|| !TEST_true(find_session_cb_cnt == 1)
|| !TEST_true(psk_client_cb_cnt == 0)
/*
* If no old style callback then below should be 0
* otherwise 1
*/
|| !TEST_true(psk_server_cb_cnt == idx))
goto end;
} else {
if (!TEST_true(use_session_cb_cnt == 0)
|| !TEST_true(find_session_cb_cnt == 0)
|| !TEST_true(psk_client_cb_cnt == 1)
|| !TEST_true(psk_server_cb_cnt == 1))
goto end;
}
shutdown_ssl_connection(serverssl, clientssl);
serverssl = clientssl = NULL;
}
shutdown_ssl_connection(serverssl, clientssl);
serverssl = clientssl = NULL;
testresult = 1;
end:
@@ -2744,9 +3191,9 @@ static int test_stateless(void)
SSL *serverssl = NULL, *clientssl = NULL;
int testresult = 0;
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(), &sctx,
&cctx, cert, privkey)))
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
goto end;
/* The arrival of CCS messages can confuse the test */
@@ -2968,14 +3415,15 @@ static int test_custom_exts(int tst)
clntaddnewcb = clntparsenewcb = srvaddnewcb = srvparsenewcb = 0;
snicb = 0;
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(), &sctx,
&cctx, cert, privkey)))
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
goto end;
if (tst == 2
&& !TEST_true(create_ssl_ctx_pair(TLS_server_method(), NULL, &sctx2,
NULL, cert, privkey)))
&& !TEST_true(create_ssl_ctx_pair(TLS_server_method(), NULL,
TLS1_VERSION, TLS_MAX_VERSION,
&sctx2, NULL, cert, privkey)))
goto end;
@@ -3083,9 +3531,10 @@ static int test_custom_exts(int tst)
|| (tst == 2 && snicb != 1))
goto end;
} else {
/* In this case there 2 NewSessionTicket messages created */
if (clntaddnewcb != 1
|| clntparsenewcb != 4
|| srvaddnewcb != 4
|| clntparsenewcb != 5
|| srvaddnewcb != 5
|| srvparsenewcb != 1)
goto end;
}
@@ -3129,10 +3578,13 @@ static int test_custom_exts(int tst)
|| srvparsenewcb != 2)
goto end;
} else {
/* No Certificate message extensions in the resumption handshake */
/*
* No Certificate message extensions in the resumption handshake,
* 2 NewSessionTickets in the initial handshake, 1 in the resumption
*/
if (clntaddnewcb != 2
|| clntparsenewcb != 7
|| srvaddnewcb != 7
|| clntparsenewcb != 8
|| srvaddnewcb != 8
|| srvparsenewcb != 2)
goto end;
}
@@ -3244,9 +3696,9 @@ static int test_export_key_mat(int tst)
if (tst == 3)
return 1;
#endif
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(), &sctx,
&cctx, cert, privkey)))
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
goto end;
OPENSSL_assert(tst >= 0 && (size_t)tst < OSSL_NELEM(protocols));
@@ -3398,8 +3850,7 @@ static int test_export_key_mat_early(int idx)
testresult = 1;
end:
if (sess != clientpsk)
SSL_SESSION_free(sess);
SSL_SESSION_free(sess);
SSL_SESSION_free(clientpsk);
SSL_SESSION_free(serverpsk);
clientpsk = serverpsk = NULL;
@@ -3424,9 +3875,9 @@ static int test_ssl_clear(int idx)
#endif
/* Create an initial connection */
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(), &sctx,
&cctx, cert, privkey))
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey))
|| (idx == 1
&& !TEST_true(SSL_CTX_set_max_proto_version(cctx,
TLS1_2_VERSION)))
@@ -3580,8 +4031,8 @@ static int test_pha_key_update(void)
SSL *clientssl = NULL, *serverssl = NULL;
int testresult = 0;
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(),
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
return 0;
@@ -3632,12 +4083,918 @@ static int test_pha_key_update(void)
}
#endif
#if !defined(OPENSSL_NO_SRP) && !defined(OPENSSL_NO_TLS1_2)
static SRP_VBASE *vbase = NULL;
static int ssl_srp_cb(SSL *s, int *ad, void *arg)
{
int ret = SSL3_AL_FATAL;
char *username;
SRP_user_pwd *user = NULL;
username = SSL_get_srp_username(s);
if (username == NULL) {
*ad = SSL_AD_INTERNAL_ERROR;
goto err;
}
user = SRP_VBASE_get1_by_user(vbase, username);
if (user == NULL) {
*ad = SSL_AD_INTERNAL_ERROR;
goto err;
}
if (SSL_set_srp_server_param(s, user->N, user->g, user->s, user->v,
user->info) <= 0) {
*ad = SSL_AD_INTERNAL_ERROR;
goto err;
}
ret = 0;
err:
SRP_user_pwd_free(user);
return ret;
}
static int create_new_vfile(char *userid, char *password, const char *filename)
{
char *gNid = NULL;
OPENSSL_STRING *row = OPENSSL_zalloc(sizeof(row) * (DB_NUMBER + 1));
TXT_DB *db = NULL;
int ret = 0;
BIO *out = NULL, *dummy = BIO_new_mem_buf("", 0);
size_t i;
if (!TEST_ptr(dummy) || !TEST_ptr(row))
goto end;
gNid = SRP_create_verifier(userid, password, &row[DB_srpsalt],
&row[DB_srpverifier], NULL, NULL);
if (!TEST_ptr(gNid))
goto end;
/*
* The only way to create an empty TXT_DB is to provide a BIO with no data
* in it!
*/
db = TXT_DB_read(dummy, DB_NUMBER);
if (!TEST_ptr(db))
goto end;
out = BIO_new_file(filename, "w");
if (!TEST_ptr(out))
goto end;
row[DB_srpid] = OPENSSL_strdup(userid);
row[DB_srptype] = OPENSSL_strdup("V");
row[DB_srpgN] = OPENSSL_strdup(gNid);
if (!TEST_ptr(row[DB_srpid])
|| !TEST_ptr(row[DB_srptype])
|| !TEST_ptr(row[DB_srpgN])
|| !TEST_true(TXT_DB_insert(db, row)))
goto end;
row = NULL;
if (!TXT_DB_write(out, db))
goto end;
ret = 1;
end:
if (row != NULL) {
for (i = 0; i < DB_NUMBER; i++)
OPENSSL_free(row[i]);
}
OPENSSL_free(row);
BIO_free(dummy);
BIO_free(out);
TXT_DB_free(db);
return ret;
}
static int create_new_vbase(char *userid, char *password)
{
BIGNUM *verifier = NULL, *salt = NULL;
const SRP_gN *lgN = NULL;
SRP_user_pwd *user_pwd = NULL;
int ret = 0;
lgN = SRP_get_default_gN(NULL);
if (!TEST_ptr(lgN))
goto end;
if (!TEST_true(SRP_create_verifier_BN(userid, password, &salt, &verifier,
lgN->N, lgN->g)))
goto end;
user_pwd = OPENSSL_zalloc(sizeof(*user_pwd));
if (!TEST_ptr(user_pwd))
goto end;
user_pwd->N = lgN->N;
user_pwd->g = lgN->g;
user_pwd->id = OPENSSL_strdup(userid);
if (!TEST_ptr(user_pwd->id))
goto end;
user_pwd->v = verifier;
user_pwd->s = salt;
verifier = salt = NULL;
if (sk_SRP_user_pwd_insert(vbase->users_pwd, user_pwd, 0) == 0)
goto end;
user_pwd = NULL;
ret = 1;
end:
SRP_user_pwd_free(user_pwd);
BN_free(salt);
BN_free(verifier);
return ret;
}
/*
* SRP tests
*
* Test 0: Simple successful SRP connection, new vbase
* Test 1: Connection failure due to bad password, new vbase
* Test 2: Simple successful SRP connection, vbase loaded from existing file
* Test 3: Connection failure due to bad password, vbase loaded from existing
* file
* Test 4: Simple successful SRP connection, vbase loaded from new file
* Test 5: Connection failure due to bad password, vbase loaded from new file
*/
static int test_srp(int tst)
{
char *userid = "test", *password = "password", *tstsrpfile;
SSL_CTX *cctx = NULL, *sctx = NULL;
SSL *clientssl = NULL, *serverssl = NULL;
int ret, testresult = 0;
vbase = SRP_VBASE_new(NULL);
if (!TEST_ptr(vbase))
goto end;
if (tst == 0 || tst == 1) {
if (!TEST_true(create_new_vbase(userid, password)))
goto end;
} else {
if (tst == 4 || tst == 5) {
if (!TEST_true(create_new_vfile(userid, password, tmpfilename)))
goto end;
tstsrpfile = tmpfilename;
} else {
tstsrpfile = srpvfile;
}
if (!TEST_int_eq(SRP_VBASE_init(vbase, tstsrpfile), SRP_NO_ERROR))
goto end;
}
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
goto end;
if (!TEST_int_gt(SSL_CTX_set_srp_username_callback(sctx, ssl_srp_cb), 0)
|| !TEST_true(SSL_CTX_set_cipher_list(cctx, "SRP-AES-128-CBC-SHA"))
|| !TEST_true(SSL_CTX_set_max_proto_version(sctx, TLS1_2_VERSION))
|| !TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION))
|| !TEST_int_gt(SSL_CTX_set_srp_username(cctx, userid), 0))
goto end;
if (tst % 2 == 1) {
if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, "badpass"), 0))
goto end;
} else {
if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, password), 0))
goto end;
}
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL)))
goto end;
ret = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE);
if (ret) {
if (!TEST_true(tst % 2 == 0))
goto end;
} else {
if (!TEST_true(tst % 2 == 1))
goto end;
}
testresult = 1;
end:
SRP_VBASE_free(vbase);
vbase = NULL;
SSL_free(serverssl);
SSL_free(clientssl);
SSL_CTX_free(sctx);
SSL_CTX_free(cctx);
return testresult;
}
#endif
static int info_cb_failed = 0;
static int info_cb_offset = 0;
static int info_cb_this_state = -1;
static struct info_cb_states_st {
int where;
const char *statestr;
} info_cb_states[][60] = {
{
/* TLSv1.2 server followed by resumption */
{SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
{SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
{SSL_CB_LOOP, "TWSC"}, {SSL_CB_LOOP, "TWSKE"}, {SSL_CB_LOOP, "TWSD"},
{SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWSD"}, {SSL_CB_LOOP, "TRCKE"},
{SSL_CB_LOOP, "TRCCS"}, {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWST"},
{SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
{SSL_CB_ALERT, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
{SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"},
{SSL_CB_LOOP, "TWSH"}, {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
{SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_LOOP, "TRCCS"},
{SSL_CB_LOOP, "TRFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
{SSL_CB_EXIT, NULL}, {0, NULL},
}, {
/* TLSv1.2 client followed by resumption */
{SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
{SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWCH"},
{SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TRSC"}, {SSL_CB_LOOP, "TRSKE"},
{SSL_CB_LOOP, "TRSD"}, {SSL_CB_LOOP, "TWCKE"}, {SSL_CB_LOOP, "TWCCS"},
{SSL_CB_LOOP, "TWFIN"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWFIN"},
{SSL_CB_LOOP, "TRST"}, {SSL_CB_LOOP, "TRCCS"}, {SSL_CB_LOOP, "TRFIN"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL}, {SSL_CB_ALERT, NULL},
{SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
{SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWCH"},
{SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TRCCS"}, {SSL_CB_LOOP, "TRFIN"},
{SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL}, {0, NULL},
}, {
/* TLSv1.3 server followed by resumption */
{SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
{SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
{SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"}, {SSL_CB_LOOP, "TWSC"},
{SSL_CB_LOOP, "TRSCV"}, {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_LOOP, "TED"},
{SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TRFIN"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
{SSL_CB_LOOP, "TWST"}, {SSL_CB_HANDSHAKE_DONE, NULL},
{SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "TWST"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
{SSL_CB_ALERT, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
{SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"},
{SSL_CB_LOOP, "TWSH"}, {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"},
{SSL_CB_LOOP, "TWFIN"}, {SSL_CB_LOOP, "TED"}, {SSL_CB_EXIT, NULL},
{SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TRFIN"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
{SSL_CB_LOOP, "TWST"}, {SSL_CB_HANDSHAKE_DONE, NULL},
{SSL_CB_EXIT, NULL}, {0, NULL},
}, {
/* TLSv1.3 client followed by resumption */
{SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
{SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWCH"},
{SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"}, {SSL_CB_LOOP, "TRSC"},
{SSL_CB_LOOP, "TRSCV"}, {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWCCS"},
{SSL_CB_LOOP, "TWFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
{SSL_CB_EXIT, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
{SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "TRST"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
{SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "SSLOK "},
{SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "TRST"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
{SSL_CB_ALERT, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
{SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL},
{SSL_CB_LOOP, "TWCH"}, {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"},
{SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
{SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "SSLOK "},
{SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "TRST"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL}, {0, NULL},
}, {
/* TLSv1.3 server, early_data */
{SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
{SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
{SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"}, {SSL_CB_LOOP, "TWFIN"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
{SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "TED"},
{SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TWEOED"}, {SSL_CB_LOOP, "TRFIN"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
{SSL_CB_LOOP, "TWST"}, {SSL_CB_HANDSHAKE_DONE, NULL},
{SSL_CB_EXIT, NULL}, {0, NULL},
}, {
/* TLSv1.3 client, early_data */
{SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
{SSL_CB_LOOP, "TWCH"}, {SSL_CB_LOOP, "TWCCS"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
{SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "TED"},
{SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"},
{SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TPEDE"}, {SSL_CB_LOOP, "TWEOED"},
{SSL_CB_LOOP, "TWFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
{SSL_CB_EXIT, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
{SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "TRST"},
{SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL}, {0, NULL},
}, {
{0, NULL},
}
};
static void sslapi_info_callback(const SSL *s, int where, int ret)
{
struct info_cb_states_st *state = info_cb_states[info_cb_offset];
/* We do not ever expect a connection to fail in this test */
if (!TEST_false(ret == 0)) {
info_cb_failed = 1;
return;
}
/*
* Do some sanity checks. We never expect these things to happen in this
* test
*/
if (!TEST_false((SSL_is_server(s) && (where & SSL_ST_CONNECT) != 0))
|| !TEST_false(!SSL_is_server(s) && (where & SSL_ST_ACCEPT) != 0)
|| !TEST_int_ne(state[++info_cb_this_state].where, 0)) {
info_cb_failed = 1;
return;
}
/* Now check we're in the right state */
if (!TEST_true((where & state[info_cb_this_state].where) != 0)) {
info_cb_failed = 1;
return;
}
if ((where & SSL_CB_LOOP) != 0
&& !TEST_int_eq(strcmp(SSL_state_string(s),
state[info_cb_this_state].statestr), 0)) {
info_cb_failed = 1;
return;
}
/* Check that, if we've got SSL_CB_HANDSHAKE_DONE we are not in init */
if ((where & SSL_CB_HANDSHAKE_DONE) && SSL_in_init((SSL *)s) != 0) {
info_cb_failed = 1;
return;
}
}
/*
* Test the info callback gets called when we expect it to.
*
* Test 0: TLSv1.2, server
* Test 1: TLSv1.2, client
* Test 2: TLSv1.3, server
* Test 3: TLSv1.3, client
* Test 4: TLSv1.3, server, early_data
* Test 5: TLSv1.3, client, early_data
*/
static int test_info_callback(int tst)
{
SSL_CTX *cctx = NULL, *sctx = NULL;
SSL *clientssl = NULL, *serverssl = NULL;
SSL_SESSION *clntsess = NULL;
int testresult = 0;
int tlsvers;
if (tst < 2) {
/* We need either ECDHE or DHE for the TLSv1.2 test to work */
#if !defined(OPENSSL_NO_TLS1_2) && (!defined(OPENSSL_NO_EC) \
|| !defined(OPENSSL_NO_DH))
tlsvers = TLS1_2_VERSION;
#else
return 1;
#endif
} else {
#ifndef OPENSSL_NO_TLS1_3
tlsvers = TLS1_3_VERSION;
#else
return 1;
#endif
}
/* Reset globals */
info_cb_failed = 0;
info_cb_this_state = -1;
info_cb_offset = tst;
#ifndef OPENSSL_NO_TLS1_3
if (tst >= 4) {
SSL_SESSION *sess = NULL;
size_t written, readbytes;
unsigned char buf[80];
/* early_data tests */
if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
&serverssl, &sess, 0)))
goto end;
/* We don't actually need this reference */
SSL_SESSION_free(sess);
SSL_set_info_callback((tst % 2) == 0 ? serverssl : clientssl,
sslapi_info_callback);
/* Write and read some early data and then complete the connection */
if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
&written))
|| !TEST_size_t_eq(written, strlen(MSG1))
|| !TEST_int_eq(SSL_read_early_data(serverssl, buf,
sizeof(buf), &readbytes),
SSL_READ_EARLY_DATA_SUCCESS)
|| !TEST_mem_eq(MSG1, readbytes, buf, strlen(MSG1))
|| !TEST_int_eq(SSL_get_early_data_status(serverssl),
SSL_EARLY_DATA_ACCEPTED)
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE))
|| !TEST_false(info_cb_failed))
goto end;
testresult = 1;
goto end;
}
#endif
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(),
tlsvers, tlsvers, &sctx, &cctx, cert,
privkey)))
goto end;
/*
* For even numbered tests we check the server callbacks. For odd numbers we
* check the client.
*/
SSL_CTX_set_info_callback((tst % 2) == 0 ? sctx : cctx,
sslapi_info_callback);
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
&clientssl, NULL, NULL))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE))
|| !TEST_false(info_cb_failed))
goto end;
clntsess = SSL_get1_session(clientssl);
SSL_shutdown(clientssl);
SSL_shutdown(serverssl);
SSL_free(serverssl);
SSL_free(clientssl);
serverssl = clientssl = NULL;
/* Now do a resumption */
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
NULL))
|| !TEST_true(SSL_set_session(clientssl, clntsess))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE))
|| !TEST_true(SSL_session_reused(clientssl))
|| !TEST_false(info_cb_failed))
goto end;
testresult = 1;
end:
SSL_free(serverssl);
SSL_free(clientssl);
SSL_SESSION_free(clntsess);
SSL_CTX_free(sctx);
SSL_CTX_free(cctx);
return testresult;
}
static int test_ssl_pending(int tst)
{
SSL_CTX *cctx = NULL, *sctx = NULL;
SSL *clientssl = NULL, *serverssl = NULL;
int testresult = 0;
char msg[] = "A test message";
char buf[5];
size_t written, readbytes;
if (tst == 0) {
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
goto end;
} else {
#ifndef OPENSSL_NO_DTLS
if (!TEST_true(create_ssl_ctx_pair(DTLS_server_method(),
DTLS_client_method(),
DTLS1_VERSION, DTLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
goto end;
#else
return 1;
#endif
}
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE)))
goto end;
if (!TEST_int_eq(SSL_pending(clientssl), 0)
|| !TEST_false(SSL_has_pending(clientssl))
|| !TEST_int_eq(SSL_pending(serverssl), 0)
|| !TEST_false(SSL_has_pending(serverssl))
|| !TEST_true(SSL_write_ex(serverssl, msg, sizeof(msg), &written))
|| !TEST_size_t_eq(written, sizeof(msg))
|| !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
|| !TEST_size_t_eq(readbytes, sizeof(buf))
|| !TEST_int_eq(SSL_pending(clientssl), (int)(written - readbytes))
|| !TEST_true(SSL_has_pending(clientssl)))
goto end;
testresult = 1;
end:
SSL_free(serverssl);
SSL_free(clientssl);
SSL_CTX_free(sctx);
SSL_CTX_free(cctx);
return testresult;
}
static struct {
unsigned int maxprot;
const char *clntciphers;
const char *clnttls13ciphers;
const char *srvrciphers;
const char *srvrtls13ciphers;
const char *shared;
} shared_ciphers_data[] = {
/*
* We can't establish a connection (even in TLSv1.1) with these ciphersuites if
* TLSv1.3 is enabled but TLSv1.2 is disabled.
*/
#if defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
{
TLS1_2_VERSION,
"AES128-SHA:AES256-SHA",
NULL,
"AES256-SHA:DHE-RSA-AES128-SHA",
NULL,
"AES256-SHA"
},
{
TLS1_2_VERSION,
"AES128-SHA:DHE-RSA-AES128-SHA:AES256-SHA",
NULL,
"AES128-SHA:DHE-RSA-AES256-SHA:AES256-SHA",
NULL,
"AES128-SHA:AES256-SHA"
},
{
TLS1_2_VERSION,
"AES128-SHA:AES256-SHA",
NULL,
"AES128-SHA:DHE-RSA-AES128-SHA",
NULL,
"AES128-SHA"
},
#endif
/*
* This test combines TLSv1.3 and TLSv1.2 ciphersuites so they must both be
* enabled.
*/
#if !defined(OPENSSL_NO_TLS1_3) && !defined(OPENSSL_NO_TLS1_2) \
&& !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
{
TLS1_3_VERSION,
"AES128-SHA:AES256-SHA",
NULL,
"AES256-SHA:AES128-SHA256",
NULL,
"TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:"
"TLS_AES_128_GCM_SHA256:AES256-SHA"
},
#endif
#ifndef OPENSSL_NO_TLS1_3
{
TLS1_3_VERSION,
"AES128-SHA",
"TLS_AES_256_GCM_SHA384",
"AES256-SHA",
"TLS_AES_256_GCM_SHA384",
"TLS_AES_256_GCM_SHA384"
},
#endif
};
static int test_ssl_get_shared_ciphers(int tst)
{
SSL_CTX *cctx = NULL, *sctx = NULL;
SSL *clientssl = NULL, *serverssl = NULL;
int testresult = 0;
char buf[1024];
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(),
TLS1_VERSION,
shared_ciphers_data[tst].maxprot,
&sctx, &cctx, cert, privkey)))
goto end;
if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
shared_ciphers_data[tst].clntciphers))
|| (shared_ciphers_data[tst].clnttls13ciphers != NULL
&& !TEST_true(SSL_CTX_set_ciphersuites(cctx,
shared_ciphers_data[tst].clnttls13ciphers)))
|| !TEST_true(SSL_CTX_set_cipher_list(sctx,
shared_ciphers_data[tst].srvrciphers))
|| (shared_ciphers_data[tst].srvrtls13ciphers != NULL
&& !TEST_true(SSL_CTX_set_ciphersuites(sctx,
shared_ciphers_data[tst].srvrtls13ciphers))))
goto end;
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE)))
goto end;
if (!TEST_ptr(SSL_get_shared_ciphers(serverssl, buf, sizeof(buf)))
|| !TEST_int_eq(strcmp(buf, shared_ciphers_data[tst].shared), 0)) {
TEST_info("Shared ciphers are: %s\n", buf);
goto end;
}
testresult = 1;
end:
SSL_free(serverssl);
SSL_free(clientssl);
SSL_CTX_free(sctx);
SSL_CTX_free(cctx);
return testresult;
}
static const char *appdata = "Hello World";
static int gen_tick_called, dec_tick_called, tick_key_cb_called;
static int tick_key_renew = 0;
static SSL_TICKET_RETURN tick_dec_ret = SSL_TICKET_RETURN_ABORT;
static int gen_tick_cb(SSL *s, void *arg)
{
gen_tick_called = 1;
return SSL_SESSION_set1_ticket_appdata(SSL_get_session(s), appdata,
strlen(appdata));
}
static SSL_TICKET_RETURN dec_tick_cb(SSL *s, SSL_SESSION *ss,
const unsigned char *keyname,
size_t keyname_length,
SSL_TICKET_STATUS status,
void *arg)
{
void *tickdata;
size_t tickdlen;
dec_tick_called = 1;
if (status == SSL_TICKET_EMPTY)
return SSL_TICKET_RETURN_IGNORE_RENEW;
if (!TEST_true(status == SSL_TICKET_SUCCESS
|| status == SSL_TICKET_SUCCESS_RENEW))
return SSL_TICKET_RETURN_ABORT;
if (!TEST_true(SSL_SESSION_get0_ticket_appdata(ss, &tickdata,
&tickdlen))
|| !TEST_size_t_eq(tickdlen, strlen(appdata))
|| !TEST_int_eq(memcmp(tickdata, appdata, tickdlen), 0))
return SSL_TICKET_RETURN_ABORT;
if (tick_key_cb_called) {
/* Don't change what the ticket key callback wanted to do */
switch (status) {
case SSL_TICKET_NO_DECRYPT:
return SSL_TICKET_RETURN_IGNORE_RENEW;
case SSL_TICKET_SUCCESS:
return SSL_TICKET_RETURN_USE;
case SSL_TICKET_SUCCESS_RENEW:
return SSL_TICKET_RETURN_USE_RENEW;
default:
return SSL_TICKET_RETURN_ABORT;
}
}
return tick_dec_ret;
}
static int tick_key_cb(SSL *s, unsigned char key_name[16],
unsigned char iv[EVP_MAX_IV_LENGTH], EVP_CIPHER_CTX *ctx,
HMAC_CTX *hctx, int enc)
{
const unsigned char tick_aes_key[16] = "0123456789abcdef";
const unsigned char tick_hmac_key[16] = "0123456789abcdef";
tick_key_cb_called = 1;
memset(iv, 0, AES_BLOCK_SIZE);
memset(key_name, 0, 16);
if (!EVP_CipherInit_ex(ctx, EVP_aes_128_cbc(), NULL, tick_aes_key, iv, enc)
|| !HMAC_Init_ex(hctx, tick_hmac_key, sizeof(tick_hmac_key),
EVP_sha256(), NULL))
return -1;
return tick_key_renew ? 2 : 1;
}
/*
* Test the various ticket callbacks
* Test 0: TLSv1.2, no ticket key callback, no ticket, no renewal
* Test 1: TLSv1.3, no ticket key callback, no ticket, no renewal
* Test 2: TLSv1.2, no ticket key callback, no ticket, renewal
* Test 3: TLSv1.3, no ticket key callback, no ticket, renewal
* Test 4: TLSv1.2, no ticket key callback, ticket, no renewal
* Test 5: TLSv1.3, no ticket key callback, ticket, no renewal
* Test 6: TLSv1.2, no ticket key callback, ticket, renewal
* Test 7: TLSv1.3, no ticket key callback, ticket, renewal
* Test 8: TLSv1.2, ticket key callback, ticket, no renewal
* Test 9: TLSv1.3, ticket key callback, ticket, no renewal
* Test 10: TLSv1.2, ticket key callback, ticket, renewal
* Test 11: TLSv1.3, ticket key callback, ticket, renewal
*/
static int test_ticket_callbacks(int tst)
{
SSL_CTX *cctx = NULL, *sctx = NULL;
SSL *clientssl = NULL, *serverssl = NULL;
SSL_SESSION *clntsess = NULL;
int testresult = 0;
#ifdef OPENSSL_NO_TLS1_2
if (tst % 2 == 0)
return 1;
#endif
#ifdef OPENSSL_NO_TLS1_3
if (tst % 2 == 1)
return 1;
#endif
gen_tick_called = dec_tick_called = tick_key_cb_called = 0;
/* Which tests the ticket key callback should request renewal for */
if (tst == 10 || tst == 11)
tick_key_renew = 1;
else
tick_key_renew = 0;
/* Which tests the decrypt ticket callback should request renewal for */
switch (tst) {
case 0:
case 1:
tick_dec_ret = SSL_TICKET_RETURN_IGNORE;
break;
case 2:
case 3:
tick_dec_ret = SSL_TICKET_RETURN_IGNORE_RENEW;
break;
case 4:
case 5:
tick_dec_ret = SSL_TICKET_RETURN_USE;
break;
case 6:
case 7:
tick_dec_ret = SSL_TICKET_RETURN_USE_RENEW;
break;
default:
tick_dec_ret = SSL_TICKET_RETURN_ABORT;
}
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(),
TLS1_VERSION,
((tst % 2) == 0) ? TLS1_2_VERSION
: TLS1_3_VERSION,
&sctx, &cctx, cert, privkey)))
goto end;
/*
* We only want sessions to resume from tickets - not the session cache. So
* switch the cache off.
*/
if (!TEST_true(SSL_CTX_set_session_cache_mode(sctx, SSL_SESS_CACHE_OFF)))
goto end;
if (!TEST_true(SSL_CTX_set_session_ticket_cb(sctx, gen_tick_cb, dec_tick_cb,
NULL)))
goto end;
if (tst >= 8
&& !TEST_true(SSL_CTX_set_tlsext_ticket_key_cb(sctx, tick_key_cb)))
goto end;
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
NULL, NULL))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE)))
goto end;
/*
* The decrypt ticket key callback in TLSv1.2 should be called even though
* we have no ticket yet, because it gets called with a status of
* SSL_TICKET_EMPTY (the client indicates support for tickets but does not
* actually send any ticket data). This does not happen in TLSv1.3 because
* it is not valid to send empty ticket data in TLSv1.3.
*/
if (!TEST_int_eq(gen_tick_called, 1)
|| !TEST_int_eq(dec_tick_called, ((tst % 2) == 0) ? 1 : 0))
goto end;
gen_tick_called = dec_tick_called = 0;
clntsess = SSL_get1_session(clientssl);
SSL_shutdown(clientssl);
SSL_shutdown(serverssl);
SSL_free(serverssl);
SSL_free(clientssl);
serverssl = clientssl = NULL;
/* Now do a resumption */
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
NULL))
|| !TEST_true(SSL_set_session(clientssl, clntsess))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE)))
goto end;
if (tick_dec_ret == SSL_TICKET_RETURN_IGNORE
|| tick_dec_ret == SSL_TICKET_RETURN_IGNORE_RENEW) {
if (!TEST_false(SSL_session_reused(clientssl)))
goto end;
} else {
if (!TEST_true(SSL_session_reused(clientssl)))
goto end;
}
if (!TEST_int_eq(gen_tick_called,
(tick_key_renew
|| tick_dec_ret == SSL_TICKET_RETURN_IGNORE_RENEW
|| tick_dec_ret == SSL_TICKET_RETURN_USE_RENEW)
? 1 : 0)
|| !TEST_int_eq(dec_tick_called, 1))
goto end;
testresult = 1;
end:
SSL_SESSION_free(clntsess);
SSL_free(serverssl);
SSL_free(clientssl);
SSL_CTX_free(sctx);
SSL_CTX_free(cctx);
return testresult;
}
int setup_tests(void)
{
if (!TEST_ptr(cert = test_get_argument(0))
|| !TEST_ptr(privkey = test_get_argument(1)))
|| !TEST_ptr(privkey = test_get_argument(1))
|| !TEST_ptr(srpvfile = test_get_argument(2))
|| !TEST_ptr(tmpfilename = test_get_argument(3)))
return 0;
if (getenv("OPENSSL_TEST_GETCOUNTS") != NULL) {
#ifdef OPENSSL_NO_CRYPTO_MDEBUG
TEST_error("not supported in this build");
return 0;
#else
int i, mcount, rcount, fcount;
for (i = 0; i < 4; i++)
test_export_key_mat(i);
CRYPTO_get_alloc_counts(&mcount, &rcount, &fcount);
test_printf_stdout("malloc %d realloc %d free %d\n",
mcount, rcount, fcount);
return 1;
#endif
}
ADD_TEST(test_large_message_tls);
ADD_TEST(test_large_message_tls_read_ahead);
#ifndef OPENSSL_NO_DTLS
@@ -3649,6 +5006,9 @@ int setup_tests(void)
ADD_TEST(test_session_with_only_int_cache);
ADD_TEST(test_session_with_only_ext_cache);
ADD_TEST(test_session_with_both_cache);
#ifndef OPENSSL_NO_TLS1_3
ADD_ALL_TESTS(test_tickets, 3);
#endif
ADD_ALL_TESTS(test_ssl_set_bio, TOTAL_SSL_SET_BIO_TESTS);
ADD_TEST(test_ssl_bio_pop_next_bio);
ADD_TEST(test_ssl_bio_pop_ssl_bio);
@@ -3666,6 +5026,11 @@ int setup_tests(void)
#endif
#ifndef OPENSSL_NO_TLS1_3
ADD_ALL_TESTS(test_early_data_read_write, 3);
/*
* We don't do replay tests for external PSK. Replay protection isn't used
* in that scenario.
*/
ADD_ALL_TESTS(test_early_data_replay, 2);
ADD_ALL_TESTS(test_early_data_skip, 3);
ADD_ALL_TESTS(test_early_data_skip_hrr, 3);
ADD_ALL_TESTS(test_early_data_not_sent, 3);
@@ -3676,8 +5041,13 @@ int setup_tests(void)
# endif
#endif
#ifndef OPENSSL_NO_TLS1_3
ADD_ALL_TESTS(test_set_ciphersuite, 10);
ADD_TEST(test_ciphersuite_change);
ADD_ALL_TESTS(test_tls13_psk, 3);
#ifdef OPENSSL_NO_PSK
ADD_ALL_TESTS(test_tls13_psk, 1);
#else
ADD_ALL_TESTS(test_tls13_psk, 4);
#endif /* OPENSSL_NO_PSK */
ADD_ALL_TESTS(test_custom_exts, 5);
ADD_TEST(test_stateless);
ADD_TEST(test_pha_key_update);
@@ -3691,6 +5061,13 @@ int setup_tests(void)
#endif
ADD_ALL_TESTS(test_ssl_clear, 2);
ADD_ALL_TESTS(test_max_fragment_len_ext, OSSL_NELEM(max_fragment_len_test));
#if !defined(OPENSSL_NO_SRP) && !defined(OPENSSL_NO_TLS1_2)
ADD_ALL_TESTS(test_srp, 6);
#endif
ADD_ALL_TESTS(test_info_callback, 6);
ADD_ALL_TESTS(test_ssl_pending, 2);
ADD_ALL_TESTS(test_ssl_get_shared_ciphers, OSSL_NELEM(shared_ciphers_data));
ADD_ALL_TESTS(test_ticket_callbacks, 12);
return 1;
}
test/sslbuffertest.c
+2 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL licenses, (the "License");
* you may not use this file except in compliance with the License.
@@ -166,6 +166,7 @@ int setup_tests(void)
return 0;
if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&serverctx, &clientctx, cert, pkey)) {
TEST_error("Failed to create SSL_CTX pair\n");
return 0;
test/sslcorrupttest.c
+12 -16
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -137,7 +137,7 @@ static void bio_f_tls_corrupt_filter_free(void)
*/
static const char **cipher_list = NULL;
static int setup_cipher_list()
static int setup_cipher_list(void)
{
SSL_CTX *ctx = NULL;
SSL *ssl = NULL;
@@ -193,28 +193,24 @@ static int test_ssl_corrupt(int testidx)
TEST_info("Starting #%d, %s", testidx, cipher_list[testidx]);
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
TLS_client_method(), &sctx,
&cctx, cert, privkey)))
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey)))
return 0;
if (!TEST_true(SSL_CTX_set_cipher_list(cctx, cipher_list[testidx])))
goto end;
if (!TEST_ptr(ciphers = SSL_CTX_get_ciphers(cctx))
if (!TEST_true(SSL_CTX_set_cipher_list(cctx, cipher_list[testidx]))
|| !TEST_true(SSL_CTX_set_ciphersuites(cctx, ""))
|| !TEST_ptr(ciphers = SSL_CTX_get_ciphers(cctx))
|| !TEST_int_eq(sk_SSL_CIPHER_num(ciphers), 1)
|| !TEST_ptr(currcipher = sk_SSL_CIPHER_value(ciphers, 0)))
goto end;
/*
* If we haven't got a TLSv1.3 cipher, then we mustn't attempt to use
* TLSv1.3. Version negotiation happens before cipher selection, so we will
* get a "no shared cipher" error.
* No ciphers we are using are TLSv1.3 compatible so we should not attempt
* to negotiate TLSv1.3
*/
if (strcmp(SSL_CIPHER_get_version(currcipher), "TLSv1.3") != 0) {
if (!TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION)))
goto end;
}
if (!TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION)))
goto end;
if (!TEST_ptr(c_to_s_fbio = BIO_new(bio_f_tls_corrupt_filter())))
goto end;
test/ssltest_old.c
+36 -15
View File
@@ -1,5 +1,5 @@
/*
* Copyright 1995-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
* Copyright 2005 Nokia. All rights reserved.
*
@@ -423,7 +423,7 @@ static int serverinfo_cli_parse_cb(SSL *s, unsigned int ext_type,
return 1;
}
static int verify_serverinfo()
static int verify_serverinfo(void)
{
if (serverinfo_sct != serverinfo_sct_seen)
return -1;
@@ -612,6 +612,7 @@ static int custom_ext_3_srv_add_cb(SSL *s, unsigned int ext_type,
}
static char *cipher = NULL;
static char *ciphersuites = NULL;
static int verbose = 0;
static int debug = 0;
@@ -671,7 +672,8 @@ static void sv_usage(void)
fprintf(stderr, " -c_cert arg - Client certificate file\n");
fprintf(stderr,
" -c_key arg - Client key file (default: same as -c_cert)\n");
fprintf(stderr, " -cipher arg - The cipher list\n");
fprintf(stderr, " -cipher arg - The TLSv1.2 and below cipher list\n");
fprintf(stderr, " -ciphersuites arg - The TLSv1.3 ciphersuites\n");
fprintf(stderr, " -bio_pair - Use BIO pairs\n");
fprintf(stderr, " -ipv4 - Use IPv4 connection on localhost\n");
fprintf(stderr, " -ipv6 - Use IPv6 connection on localhost\n");
@@ -918,7 +920,6 @@ int main(int argc, char *argv[])
verbose = 0;
debug = 0;
cipher = 0;
bio_err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);
@@ -1046,6 +1047,10 @@ int main(int argc, char *argv[])
if (--argc < 1)
goto bad;
cipher = *(++argv);
} else if (strcmp(*argv, "-ciphersuites") == 0) {
if (--argc < 1)
goto bad;
ciphersuites = *(++argv);
} else if (strcmp(*argv, "-CApath") == 0) {
if (--argc < 1)
goto bad;
@@ -1325,17 +1330,24 @@ int main(int argc, char *argv[])
} else if (tls1_2) {
min_version = TLS1_2_VERSION;
max_version = TLS1_2_VERSION;
} else {
min_version = SSL3_VERSION;
max_version = TLS_MAX_VERSION;
}
#endif
#ifndef OPENSSL_NO_DTLS
if (dtls || dtls1 || dtls12)
if (dtls || dtls1 || dtls12) {
meth = DTLS_method();
if (dtls1) {
min_version = DTLS1_VERSION;
max_version = DTLS1_VERSION;
} else if (dtls12) {
min_version = DTLS1_2_VERSION;
max_version = DTLS1_2_VERSION;
if (dtls1) {
min_version = DTLS1_VERSION;
max_version = DTLS1_VERSION;
} else if (dtls12) {
min_version = DTLS1_2_VERSION;
max_version = DTLS1_2_VERSION;
} else {
min_version = DTLS_MIN_VERSION;
max_version = DTLS_MAX_VERSION;
}
}
#endif
@@ -1377,6 +1389,14 @@ int main(int argc, char *argv[])
goto end;
}
}
if (ciphersuites != NULL) {
if (!SSL_CTX_set_ciphersuites(c_ctx, ciphersuites)
|| !SSL_CTX_set_ciphersuites(s_ctx, ciphersuites)
|| !SSL_CTX_set_ciphersuites(s_ctx2, ciphersuites)) {
ERR_print_errors(bio_err);
goto end;
}
}
#ifndef OPENSSL_NO_CT
if (ct_validation &&
@@ -1816,7 +1836,8 @@ int doit_localhost(SSL *s_ssl, SSL *c_ssl, int family, long count,
int err_in_client = 0;
int err_in_server = 0;
acpt = BIO_new_accept("0");
acpt = BIO_new_accept(family == BIO_FAMILY_IPV4 ? "127.0.0.1:0"
: "[::1]:0");
if (acpt == NULL)
goto err;
BIO_set_accept_ip_family(acpt, family);
@@ -2815,7 +2836,7 @@ static int app_verify_callback(X509_STORE_CTX *ctx, void *arg)
* $ openssl dhparam -C -noout -dsaparam 1024
* (The third function has been renamed to avoid name conflicts.)
*/
static DH *get_dh512()
static DH *get_dh512(void)
{
static unsigned char dh512_p[] = {
0xCB, 0xC8, 0xE1, 0x86, 0xD0, 0x1F, 0x94, 0x17, 0xA6, 0x99, 0xF0,
@@ -2849,7 +2870,7 @@ static DH *get_dh512()
return dh;
}
static DH *get_dh1024()
static DH *get_dh1024(void)
{
static unsigned char dh1024_p[] = {
0xF8, 0x81, 0x89, 0x7D, 0x14, 0x24, 0xC5, 0xD1, 0xE6, 0xF7, 0xBF,
@@ -2893,7 +2914,7 @@ static DH *get_dh1024()
return dh;
}
static DH *get_dh1024dsa()
static DH *get_dh1024dsa(void)
{
static unsigned char dh1024_p[] = {
0xC8, 0x00, 0xF7, 0x08, 0x07, 0x89, 0x4D, 0x90, 0x53, 0xF3, 0xD5,
test/ssltestlib.c
+112 -18
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -12,6 +12,34 @@
#include "internal/nelem.h"
#include "ssltestlib.h"
#include "testutil.h"
#include "e_os.h"
#ifdef OPENSSL_SYS_UNIX
# include <unistd.h>
static ossl_inline void ossl_sleep(unsigned int millis) {
usleep(millis * 1000);
}
#elif defined(_WIN32)
# include <windows.h>
static ossl_inline void ossl_sleep(unsigned int millis) {
Sleep(millis);
}
#else
/* Fallback to a busy wait */
static ossl_inline void ossl_sleep(unsigned int millis) {
struct timeval start, now;
unsigned int elapsedms;
gettimeofday(&start, NULL);
do {
gettimeofday(&now, NULL);
elapsedms = (((now.tv_sec - start.tv_sec) * 1000000)
+ now.tv_usec - start.tv_usec) / 1000;
} while (elapsedms < millis);
}
#endif
static int tls_dump_new(BIO *bi);
static int tls_dump_free(BIO *a);
@@ -252,7 +280,10 @@ typedef struct mempacket_test_ctx_st {
unsigned int currrec;
unsigned int currpkt;
unsigned int lastpkt;
unsigned int injected;
unsigned int noinject;
unsigned int dropepoch;
int droprec;
} MEMPACKET_TEST_CTX;
static int mempacket_test_new(BIO *bi);
@@ -295,6 +326,8 @@ static int mempacket_test_new(BIO *bio)
OPENSSL_free(ctx);
return 0;
}
ctx->dropepoch = 0;
ctx->droprec = -1;
BIO_set_init(bio, 1);
BIO_set_data(bio, ctx);
return 1;
@@ -312,8 +345,8 @@ static int mempacket_test_free(BIO *bio)
}
/* Record Header values */
#define EPOCH_HI 4
#define EPOCH_LO 5
#define EPOCH_HI 3
#define EPOCH_LO 4
#define RECORD_SEQUENCE 10
#define RECORD_LEN_HI 11
#define RECORD_LEN_LO 12
@@ -341,15 +374,15 @@ static int mempacket_test_read(BIO *bio, char *out, int outl)
if (outl > thispkt->len)
outl = thispkt->len;
if (thispkt->type != INJECT_PACKET_IGNORE_REC_SEQ) {
if (thispkt->type != INJECT_PACKET_IGNORE_REC_SEQ
&& (ctx->injected || ctx->droprec >= 0)) {
/*
* Overwrite the record sequence number. We strictly number them in
* the order received. Since we are actually a reliable transport
* we know that there won't be any re-ordering. We overwrite to deal
* with any packets that have been injected
*/
for (rem = thispkt->len, rec = thispkt->data
; rem > 0; rec += len, rem -= len) {
for (rem = thispkt->len, rec = thispkt->data; rem > 0; rem -= len) {
if (rem < DTLS1_RT_HEADER_LENGTH)
return -1;
epoch = (rec[EPOCH_HI] << 8) | rec[EPOCH_LO];
@@ -364,10 +397,23 @@ static int mempacket_test_read(BIO *bio, char *out, int outl)
seq >>= 8;
offset++;
} while (seq > 0);
ctx->currrec++;
len = ((rec[RECORD_LEN_HI] << 8) | rec[RECORD_LEN_LO])
+ DTLS1_RT_HEADER_LENGTH;
if (rem < (int)len)
return -1;
if (ctx->droprec == (int)ctx->currrec && ctx->dropepoch == epoch) {
if (rem > (int)len)
memmove(rec, rec + len, rem - len);
outl -= len;
ctx->droprec = -1;
if (outl == 0)
BIO_set_retry_read(bio);
} else {
rec += len;
}
ctx->currrec++;
}
}
@@ -390,6 +436,7 @@ int mempacket_test_inject(BIO *bio, const char *in, int inl, int pktnum,
if (pktnum >= 0) {
if (ctx->noinject)
return -1;
ctx->injected = 1;
} else {
ctx->noinject = 1;
}
@@ -488,6 +535,15 @@ static long mempacket_test_ctrl(BIO *bio, int cmd, long num, void *ptr)
case BIO_CTRL_FLUSH:
ret = 1;
break;
case MEMPACKET_CTRL_SET_DROP_EPOCH:
ctx->dropepoch = (unsigned int)num;
break;
case MEMPACKET_CTRL_SET_DROP_REC:
ctx->droprec = (int)num;
break;
case MEMPACKET_CTRL_GET_DROP_REC:
ret = ctx->droprec;
break;
case BIO_CTRL_RESET:
case BIO_CTRL_DUP:
case BIO_CTRL_PUSH:
@@ -511,6 +567,7 @@ static int mempacket_test_puts(BIO *bio, const char *str)
}
int create_ssl_ctx_pair(const SSL_METHOD *sm, const SSL_METHOD *cm,
int min_proto_version, int max_proto_version,
SSL_CTX **sctx, SSL_CTX **cctx, char *certfile,
char *privkeyfile)
{
@@ -521,12 +578,31 @@ int create_ssl_ctx_pair(const SSL_METHOD *sm, const SSL_METHOD *cm,
|| (cctx != NULL && !TEST_ptr(clientctx = SSL_CTX_new(cm))))
goto err;
if (!TEST_int_eq(SSL_CTX_use_certificate_file(serverctx, certfile,
SSL_FILETYPE_PEM), 1)
|| !TEST_int_eq(SSL_CTX_use_PrivateKey_file(serverctx, privkeyfile,
SSL_FILETYPE_PEM), 1)
|| !TEST_int_eq(SSL_CTX_check_private_key(serverctx), 1))
if ((min_proto_version > 0
&& !TEST_true(SSL_CTX_set_min_proto_version(serverctx,
min_proto_version)))
|| (max_proto_version > 0
&& !TEST_true(SSL_CTX_set_max_proto_version(serverctx,
max_proto_version))))
goto err;
if (clientctx != NULL
&& ((min_proto_version > 0
&& !TEST_true(SSL_CTX_set_min_proto_version(clientctx,
min_proto_version)))
|| (max_proto_version > 0
&& !TEST_true(SSL_CTX_set_max_proto_version(clientctx,
max_proto_version)))))
goto err;
if (certfile != NULL && privkeyfile != NULL) {
if (!TEST_int_eq(SSL_CTX_use_certificate_file(serverctx, certfile,
SSL_FILETYPE_PEM), 1)
|| !TEST_int_eq(SSL_CTX_use_PrivateKey_file(serverctx,
privkeyfile,
SSL_FILETYPE_PEM), 1)
|| !TEST_int_eq(SSL_CTX_check_private_key(serverctx), 1))
goto err;
}
#ifndef OPENSSL_NO_DH
SSL_CTX_set_dh_auto(serverctx, 1);
@@ -606,10 +682,11 @@ int create_ssl_objects(SSL_CTX *serverctx, SSL_CTX *clientctx, SSL **sssl,
int create_ssl_connection(SSL *serverssl, SSL *clientssl, int want)
{
int retc = -1, rets = -1, err, abortctr = 0;
int retc = -1, rets = -1, err, abortctr = 0, i;
int clienterr = 0, servererr = 0;
unsigned char buf;
size_t readbytes;
int isdtls = SSL_is_dtls(serverssl);
do {
err = SSL_ERROR_WANT_WRITE;
@@ -641,22 +718,39 @@ int create_ssl_connection(SSL *serverssl, SSL *clientssl, int want)
return 0;
if (clienterr && servererr)
return 0;
if (isdtls) {
if (rets > 0 && retc <= 0)
DTLSv1_handle_timeout(serverssl);
if (retc > 0 && rets <= 0)
DTLSv1_handle_timeout(clientssl);
}
if (++abortctr == MAXLOOPS) {
TEST_info("No progress made");
return 0;
}
if (isdtls && abortctr <= 50 && (abortctr % 10) == 0) {
/*
* It looks like we're just spinning. Pause for a short period to
* give the DTLS timer a chance to do something. We only do this for
* the first few times to prevent hangs.
*/
ossl_sleep(50);
}
} while (retc <=0 || rets <= 0);
/*
* We attempt to read some data on the client side which we expect to fail.
* This will ensure we have received the NewSessionTicket in TLSv1.3 where
* appropriate.
* appropriate. We do this twice because there are 2 NewSesionTickets.
*/
if (SSL_read_ex(clientssl, &buf, sizeof(buf), &readbytes) > 0) {
if (!TEST_ulong_eq(readbytes, 0))
for (i = 0; i < 2; i++) {
if (SSL_read_ex(clientssl, &buf, sizeof(buf), &readbytes) > 0) {
if (!TEST_ulong_eq(readbytes, 0))
return 0;
} else if (!TEST_int_eq(SSL_get_error(clientssl, 0),
SSL_ERROR_WANT_READ)) {
return 0;
} else if (!TEST_int_eq(SSL_get_error(clientssl, 0), SSL_ERROR_WANT_READ)) {
return 0;
}
}
return 1;
test/ssltestlib.h
+10 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -13,6 +13,7 @@
# include <openssl/ssl.h>
int create_ssl_ctx_pair(const SSL_METHOD *sm, const SSL_METHOD *cm,
int min_proto_version, int max_proto_version,
SSL_CTX **sctx, SSL_CTX **cctx, char *certfile,
char *privkeyfile);
int create_ssl_objects(SSL_CTX *serverctx, SSL_CTX *clientctx, SSL **sssl,
@@ -31,6 +32,14 @@ void bio_s_mempacket_test_free(void);
#define INJECT_PACKET 1
#define INJECT_PACKET_IGNORE_REC_SEQ 2
/*
* Mempacket BIO ctrls. We make them large enough to not clash with standard BIO
* ctrl codes.
*/
#define MEMPACKET_CTRL_SET_DROP_EPOCH (1 << 15)
#define MEMPACKET_CTRL_SET_DROP_REC (2 << 15)
#define MEMPACKET_CTRL_GET_DROP_REC (3 << 15)
int mempacket_test_inject(BIO *bio, const char *in, int inl, int pktnum,
int type);
test/sysdefault.cnf
+15
View File
@@ -0,0 +1,15 @@
# Configuration file to test system default SSL configuration
openssl_conf = default_conf
[ default_conf ]
ssl_conf = ssl_sect
[ssl_sect]
system_default = ssl_default_sect
[ssl_default_sect]
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
test/sysdefaulttest.c
+50
View File
@@ -0,0 +1,50 @@
/*
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include <openssl/opensslconf.h>
#include <string.h>
#include <openssl/evp.h>
#include <openssl/ssl.h>
#include <openssl/tls1.h>
#include "testutil.h"
static SSL_CTX *ctx;
static int test_func(void)
{
if (!TEST_int_eq(SSL_CTX_get_min_proto_version(ctx), TLS1_2_VERSION)
&& !TEST_int_eq(SSL_CTX_get_max_proto_version(ctx), TLS1_2_VERSION)) {
TEST_info("min/max version setting incorrect");
return 0;
}
return 1;
}
int global_init(void)
{
if (!OPENSSL_init_ssl(OPENSSL_INIT_ENGINE_ALL_BUILTIN
| OPENSSL_INIT_LOAD_CONFIG, NULL))
return 0;
return 1;
}
int setup_tests(void)
{
if (!TEST_ptr(ctx = SSL_CTX_new(TLS_method())))
return 0;
ADD_TEST(test_func);
return 1;
}
void cleanup_tests(void)
{
SSL_CTX_free(ctx);
}
test/test_test.c
+6 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
@@ -531,6 +531,10 @@ static int test_bn_output(int n)
return 1;
}
static int test_memcmp(void)
{
return CRYPTO_memcmp("ab","cd",2);
}
int setup_tests(void)
{
@@ -553,6 +557,7 @@ int setup_tests(void)
ADD_TEST(test_messages);
ADD_TEST(test_single_eval);
ADD_TEST(test_output);
ADD_TEST(test_memcmp);
ADD_ALL_TESTS(test_bn_output, OSSL_NELEM(bn_output_tests));
return 1;
}
test/time_offset_test.c
+1 -1
View File
@@ -106,7 +106,7 @@ static int test_offset(int idx)
return 1;
}
int setup_tests()
int setup_tests(void)
{
ADD_ALL_TESTS(test_offset, OSSL_NELEM(tests));
return 1;
test/tls13ccstest.c
+2 -3
View File
@@ -37,7 +37,7 @@ static int watchccs_puts(BIO *bp, const char *str);
static BIO_METHOD *method_watchccs = NULL;
static const BIO_METHOD *bio_f_watchccs_filter()
static const BIO_METHOD *bio_f_watchccs_filter(void)
{
if (method_watchccs == NULL) {
method_watchccs = BIO_meth_new(BIO_TYPE_WATCHCCS_FILTER,
@@ -255,10 +255,9 @@ static int test_tls13ccs(int tst)
chsessidlen = 0;
if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(),
TLS1_VERSION, TLS_MAX_VERSION,
&sctx, &cctx, cert, privkey))
|| !TEST_true(SSL_CTX_set_max_early_data(sctx,
SSL3_RT_MAX_PLAIN_LENGTH))
|| !TEST_true(SSL_CTX_set_max_early_data(cctx,
SSL3_RT_MAX_PLAIN_LENGTH)))
goto err;
test/tls13encryptiontest.c
+16 -10
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -92,7 +92,7 @@ static RECORD_DATA refdata[] = {
"83dd29f64508b2ec3e635a2134fc0e1a39d3ecb51dcddfcf8382c88ffe2a7378"
"42ad1de7fe505b6c4d1673870f6fc2a0f2f7972acaee368a1599d64ba18798f1"
"0333f9779bd5b05f9b084d03dab2f3d80c2eb74ec70c9866ea31c18b491cd597"
"aae3e941205fcc38a3a10ce8c0269f02ccc9c51278e25f1a0f0731a9"
"aae3e941205fcc38a3a10ce8f2e230d97e3406b77ee53d84d89ca548"
},
"d2dd45f87ad87801a85ac38187f9023b",
"f0a14f808692cef87a3daf70",
@@ -106,7 +106,7 @@ static RECORD_DATA refdata[] = {
},
{
"fa15e92daa21cd05d8f9c3152a61748d9aaf049da559718e583f95aacecad657"
"b52a6562da09a5819e864d86ac2989360a1eb22795","",""
"b52a6562da66864fd14969acc30dc04a78c38283c5","",""
},
"40e1201d75d419627f04c88530a15c9d",
"a0f073f3b35e18f96969696b",
@@ -128,7 +128,7 @@ static RECORD_DATA refdata[] = {
"836905229eac811c4ef8b2faa89867e9ffc586f7f03c216591aa5e620eac3c62"
"dfe60f846036bd7ecc4464b584af184e9644e94ee1d7834dba408a51cbe42480"
"04796ed9c558e0f5f96115a6f6ba487e17d16a2e20a3d3a650a9a070fb53d9da"
"82864b5621d77650bd0c7947e9889917b53d0515627c72b0ded521","",""
"82864b5621d77650bd0c7972f592aa8546de09b8e46921fab4d876","",""
},
"3381f6b3f94500f16226de440193e858",
"4f1d73cc1d465eb30021c41f",
@@ -142,8 +142,8 @@ static RECORD_DATA refdata[] = {
},
{
"e306178ad97f74bb64f35eaf3c39846b83aef8472cbc9046749b81a949dfb12c"
"fbc65cbabd20ade92c1f944605892ceeb12fdee8a927bce77c83036ac5a794a8"
"f54a69","",""
"fbc65cbabd20ade92c1f944605892ceeb12fde5781d40e2ca080fc921b750b8c"
"21bd8d","",""
},
"eb23a804904b80ba4fe8399e09b1ce42",
"efa8c50c06b9c9b8c483e174",
@@ -157,8 +157,8 @@ static RECORD_DATA refdata[] = {
},
{
"467d99a807dbf778e6ffd8be52456c70665f890811ef2f3c495d5bbe983feeda"
"b0c251dde596bc7e2b135909ec9f9166fb0152e8c16a84e4b1039256467f9538"
"be4463","",""
"b0c251dde596bc7e2b135909ec9f9166fb01526c70c7e42b6df52d63b0000222"
"cb2047","",""
},
"3381f6b3f94500f16226de440193e858",
"4f1d73cc1d465eb30021c41f",
@@ -170,7 +170,7 @@ static RECORD_DATA refdata[] = {
"010015","",""
},
{
"6bdf60847ba6fb650da36e872adc684a4af2e8","",""
"6bdf609107610cff95d70387a67b89e2494f0d","",""
},
"eb23a804904b80ba4fe8399e09b1ce42",
"efa8c50c06b9c9b8c483e174",
@@ -182,7 +182,7 @@ static RECORD_DATA refdata[] = {
"010015","",""
},
{
"621b7cc1962cd8a70109fee68a52efedf87d2e","",""
"621b7c60d32528b149b36a78c8891a8d2f65ad","",""
},
"3381f6b3f94500f16226de440193e858",
"4f1d73cc1d465eb30021c41f",
@@ -306,7 +306,13 @@ static int test_tls13_encryption(void)
int ret = 0;
size_t ivlen, ctr;
/*
* Encrypted TLSv1.3 records always have an outer content type of
* application data, and a record version of TLSv1.2.
*/
rec.data = NULL;
rec.type = SSL3_RT_APPLICATION_DATA;
rec.rec_version = TLS1_2_VERSION;
ctx = SSL_CTX_new(TLS_method());
if (!TEST_ptr(ctx)) {
test/tls13secretstest.c
+1 -1
View File
@@ -399,7 +399,7 @@ static int test_handshake_secrets(void)
return ret;
}
int setup_tests()
int setup_tests(void)
{
ADD_TEST(test_handshake_secrets);
return 1;
test/v3nametest.c
+1 -1
View File
@@ -251,7 +251,7 @@ static const struct set_name_fn name_fns[] = {
{set_altname_email, "set rfc822Name", 0, 1},
};
static X509 *make_cert()
static X509 *make_cert(void)
{
X509 *crt = NULL;
test/verify_extra_test.c
+39 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright 2015-2017 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -138,6 +138,43 @@ static int test_alt_chains_cert_forgery(void)
return ret;
}
static int test_store_ctx(void)
{
X509_STORE_CTX *sctx = NULL;
X509 *x = NULL;
BIO *bio = NULL;
int testresult = 0, ret;
bio = BIO_new_file(bad_f, "r");
if (bio == NULL)
goto err;
x = PEM_read_bio_X509(bio, NULL, 0, NULL);
if (x == NULL)
goto err;
sctx = X509_STORE_CTX_new();
if (sctx == NULL)
goto err;
if (!X509_STORE_CTX_init(sctx, NULL, x, NULL))
goto err;
/* Verifying a cert where we have no trusted certs should fail */
ret = X509_verify_cert(sctx);
if (ret == 0) {
/* This is the result we were expecting: Test passed */
testresult = 1;
}
err:
X509_STORE_CTX_free(sctx);
X509_free(x);
BIO_free(bio);
return testresult;
}
int setup_tests(void)
{
if (!TEST_ptr(roots_f = test_get_argument(0))
@@ -148,5 +185,6 @@ int setup_tests(void)
}
ADD_TEST(test_alt_chains_cert_forgery);
ADD_TEST(test_store_ctx);
return 1;
}
test/versions.c
+20
View File
@@ -0,0 +1,20 @@
/*
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <stdio.h>
#include <openssl/opensslv.h>
#include <openssl/crypto.h>
/* A simple helper for the perl function OpenSSL::Test::openssl_versions */
int main(void)
{
printf("Build version: 0x%08lX\n", OPENSSL_VERSION_NUMBER);
printf("Library version: 0x%08lX\n", OpenSSL_version_num());
return 0;
}
test/x509_internal_test.c
+1 -1
View File
@@ -57,7 +57,7 @@ static int test_standard_exts(void)
return good;
}
int setup_tests()
int setup_tests(void)
{
ADD_TEST(test_standard_exts);
return 1;
test/x509_time_test.c
+1 -1
View File
@@ -482,7 +482,7 @@ static int test_x509_time_print(int idx)
return ret;
}
int setup_tests()
int setup_tests(void)
{
ADD_TEST(test_x509_cmp_time_current);
ADD_ALL_TESTS(test_x509_cmp_time, OSSL_NELEM(x509_cmp_tests));