Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update - OpenSSL 1.1.1-pre7-dev

Browse Source
This commit is contained in:
Hakase
2018-05-23 23:52:41 +09:00
parent e8a0afd4a0
commit ef253190c7
624 changed files with 189420 additions and 8064 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/recipes/04-test_bio_callback.t
+12
View File
@@ -0,0 +1,12 @@
#! /usr/bin/env perl
# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
use OpenSSL::Test::Simple;
simple_test("test_bio_callback", "bio_callback_test");
test/recipes/05-test_rand.t
+3 -2
View File
@@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -10,7 +10,8 @@ use strict;
use warnings;
use OpenSSL::Test;
plan tests => 1;
plan tests => 2;
setup("test_rand");
ok(run(test(["drbgtest"])));
ok(run(test(["drbg_cavs_test"])));
test/recipes/06-test-rdrand.t
+1 -1
View File
@@ -1,6 +1,6 @@
#! /usr/bin/perl
# Copyright 2018-2018 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
test/recipes/15-test_genrsa.t
+35 -7
View File
@@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -18,9 +18,37 @@ setup("test_genrsa");
plan tests => 5;
is(run(app([ 'openssl', 'genrsa', '-3', '-out', 'genrsatest.pem', '256'])), 0, "genrsa -3 256");
ok(run(app([ 'openssl', 'genrsa', '-3', '-out', 'genrsatest.pem', '512'])), "genrsa -3 512");
ok(run(app([ 'openssl', 'rsa', '-check', '-in', 'genrsatest.pem', '-noout'])), "rsa -check");
ok(run(app([ 'openssl', 'genrsa', '-f4', '-out', 'genrsatest.pem', '512'])), "genrsa -f4 512");
ok(run(app([ 'openssl', 'rsa', '-check', '-in', 'genrsatest.pem', '-noout'])), "rsa -check");
unlink 'genrsatest.pem';
# We want to know that an absurdly small number of bits isn't support
is(run(app([ 'openssl', 'genrsa', '-3', '-out', 'genrsatest.pem', '8'])), 0, "genrsa -3 8");
# Depending on the shared library, we might have different lower limits.
# Let's find it! This is a simple binary search
# ------------------------------------------------------------
# NOTE: $good may need an update in the future
# ------------------------------------------------------------
note "Looking for lowest amount of bits";
my $bad = 3; # Log2 of number of bits (2 << 3 == 8)
my $good = 11; # Log2 of number of bits (2 << 11 == 2048)
while ($good > $bad + 1) {
my $checked = int(($good + $bad + 1) / 2);
if (run(app([ 'openssl', 'genrsa', '-3', '-out', 'genrsatest.pem',
2 ** $checked ], stderr => undef))) {
note 2 ** $checked, " bits is good";
$good = $checked;
} else {
note 2 ** $checked, " bits is bad";
$bad = $checked;
}
}
$good++ if $good == $bad;
$good = 2 ** $good;
note "Found lowest allowed amount of bits to be $good";
ok(run(app([ 'openssl', 'genrsa', '-3', '-out', 'genrsatest.pem', $good ])),
"genrsa -3 $good");
ok(run(app([ 'openssl', 'rsa', '-check', '-in', 'genrsatest.pem', '-noout' ])),
"rsa -check");
ok(run(app([ 'openssl', 'genrsa', '-f4', '-out', 'genrsatest.pem', $good ])),
"genrsa -f4 $good");
ok(run(app([ 'openssl', 'rsa', '-check', '-in', 'genrsatest.pem', '-noout' ])),
"rsa -check");
test/recipes/15-test_out_option.t
+50 -37
View File
@@ -16,45 +16,58 @@ use OpenSSL::Test::Utils;
setup("test_out_option");
plan skip_all => "'-out' option tests are not available on Windows"
if $^O eq 'MSWin32';
plan tests => 4;
plan tests => 11;
# Test 1
SKIP: {
# Paths that should generate failure when trying to write to them.
# Directories are a safe bet for failure on most platforms.
# Notably, this isn't true on OpenVMS, as a default file name is
# appended under the hood when trying to "write" to a directory spec.
# From observation, that file is '.' (i.e. a file with no file name
# and no extension), so '[]' gets translated to '[].'
skip 'Directories become writable files on OpenVMS', 1 if $^O eq 'VMS';
# The following patterns should be tested:
#
# path dirname
# /usr/ /
# / /
# . .
# .. .
test_illegal_path('/usr/');
test_illegal_path('/');
test_illegal_path('./');
test_illegal_path('../');
# Test for trying to create a file in a non-exist directory
my @chars = ("A".."Z", "a".."z", "0".."9");
my $rand_path = $chars[rand @chars] for 1..32;
$rand_path .= "/test.pem";
test_illegal_path($rand_path);
test_legal_path('test.pem');
unlink 'test.pem';
sub test_illegal_path {
my $path = File::Spec->canonpath($_[0]);
my $start = time();
ok(!run(app([ 'openssl', 'genrsa', '-out', $path, '16384'])), "invalid output path: $path");
my $end = time();
# The above process should exit in 2 seconds if the path is not valid
ok($end - $start < 2, "check time consumed");
# Note that directories must end with a slash here, because of how
# File::Spec massages them into directory specs on some platforms.
my $path = File::Spec->canonpath('./');
ok(!run(app([ 'openssl', 'rand', '-out', $path, '1'])),
"invalid output path: $path");
}
sub test_legal_path {
my $path = File::Spec->canonpath($_[0]);
ok(run(app([ 'openssl', 'genrsa', '-out', $path, '2048'])), "valid output path: $path");
# Test 2
{
my $path = File::Spec->canonpath('randomname.bin');
ok(run(app([ 'openssl', 'rand', '-out', $path, '1'])),
"valid output path: $path");
}
# Test 3
{
# Test for trying to create a file in a non-exist directory
my $rand_path = "";
do {
my @chars = ("A".."Z", "a".."z", "0".."9");
$rand_path .= $chars[rand @chars] for 1..32;
} while (-d File::Spec->catdir('.', $rand_path));
$rand_path .= "/randomname.bin";
my $path = File::Spec->canonpath($rand_path);
ok(!run(app([ 'openssl', 'rand', '-out', $path, '1'])),
"invalid output path: $path");
}
# Test 4
SKIP: {
skip "It's not safe to use perl's idea of the NULL device in an explicitly cross compiled build", 1
unless (config('CROSS_COMPILE') // '') eq '';
my $path = File::Spec->canonpath(File::Spec->devnull());
ok(run(app([ 'openssl', 'rand', '-out', $path, '1'])),
"valid output path: $path");
}
# Cleanup
END {
unlink 'randomname.bin' if -f 'randomname.bin';
}
test/recipes/30-test_evp_data/evppkey.txt
+109 -1
View File
@@ -1,5 +1,5 @@
#
# Copyright 2001-2017 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -726,8 +726,22 @@ PublicKey=Bob-25519-PUBLIC
MCowBQYDK2VuAyEA3p7bfXt9wbTTW2HC7OQ1Nz+DQ8hbeGdNrfx+FG+IK08=
-----END PUBLIC KEY-----
#Raw versions of the same keys as above
PrivateKeyRaw=Alice-25519-Raw:X25519:77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a
PublicKeyRaw=Alice-25519-PUBLIC-Raw:X25519:8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a
PrivPubKeyPair = Alice-25519-Raw:Alice-25519-PUBLIC-Raw
PrivateKeyRaw=Bob-25519-Raw:X25519:5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb
PublicKeyRaw=Bob-25519-PUBLIC-Raw:X25519:de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f
PrivPubKeyPair = Bob-25519:Bob-25519-PUBLIC
PrivPubKeyPair = Bob-25519-Raw:Bob-25519-PUBLIC-Raw
Derive=Alice-25519
PeerKey=Bob-25519-PUBLIC
SharedSecret=4A5D9D5BA4CE2DE1728E3BF480350F25E07E21C947D19E3376F09B3C1E161742
@@ -736,6 +750,14 @@ Derive=Bob-25519
PeerKey=Alice-25519-PUBLIC
SharedSecret=4A5D9D5BA4CE2DE1728E3BF480350F25E07E21C947D19E3376F09B3C1E161742
Derive=Alice-25519-Raw
PeerKey=Bob-25519-PUBLIC-Raw
SharedSecret=4A5D9D5BA4CE2DE1728E3BF480350F25E07E21C947D19E3376F09B3C1E161742
Derive=Bob-25519-Raw
PeerKey=Alice-25519-PUBLIC-Raw
SharedSecret=4A5D9D5BA4CE2DE1728E3BF480350F25E07E21C947D19E3376F09B3C1E161742
# Illegal sign/verify operations with X25519 key
Sign=Alice-25519
@@ -778,6 +800,20 @@ QjKhPKcG3LV67D2uB73BxnvzNgk=
PrivPubKeyPair = Bob-448:Bob-448-PUBLIC
#Raw versions of the same keys as above
PrivateKeyRaw=Alice-448-Raw:X448:9a8f4925d1519f5775cf46b04b5800d4ee9ee8bae8bc5565d498c28dd9c9baf574a9419744897391006382a6f127ab1d9ac2d8c0a598726b
PublicKeyRaw=Alice-448-PUBLIC-Raw:X448:9b08f7cc31b7e3e67d22d5aea121074a273bd2b83de09c63faa73d2c22c5d9bbc836647241d953d40c5b12da88120d53177f80e532c41fa0
PrivPubKeyPair = Alice-448-Raw:Alice-448-PUBLIC-Raw
PrivateKeyRaw=Bob-448-Raw:X448:1c306a7ac2a0e2e0990b294470cba339e6453772b075811d8fad0d1d6927c120bb5ee8972b0d3e21374c9c921b09d1b0366f10b65173992d
PublicKeyRaw=Bob-448-PUBLIC-Raw:X448:3eb7a829b0cd20f5bcfc0b599b6feccf6da4627107bdb0d4f345b43027d8b972fc3e34fb4232a13ca706dcb57aec3dae07bdc1c67bf33609
PrivPubKeyPair = Bob-448-Raw:Bob-448-PUBLIC-Raw
Derive=Alice-448
PeerKey=Bob-448-PUBLIC
SharedSecret=07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d
@@ -786,6 +822,14 @@ Derive=Bob-448
PeerKey=Alice-448-PUBLIC
SharedSecret=07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d
Derive=Alice-448-Raw
PeerKey=Bob-448-PUBLIC-Raw
SharedSecret=07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d
Derive=Bob-448-Raw
PeerKey=Alice-448-PUBLIC-Raw
SharedSecret=07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d
# Illegal sign/verify operations with X448 key
Sign=Alice-448
@@ -17433,8 +17477,15 @@ PublicKey=ED25519-5-PUBLIC
MCowBQYDK2VwAyEA7Bcrk61eVjv0kyxw4SRQNMNUZ+8u/U1k6/gZaDRn4r8=
-----END PUBLIC KEY-----
#Raw versions of the ED25519-1 keys
PrivateKeyRaw=ED25519-1-Raw:ED25519:9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60
PublicKeyRaw=ED25519-1-PUBLIC-Raw:ED25519:d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a
PrivPubKeyPair = ED25519-1:ED25519-1-PUBLIC
PrivPubKeyPair = ED25519-1-Raw:ED25519-1-PUBLIC-Raw
OneShotDigestSign = NULL
Key = ED25519-1
Input = ""
@@ -17507,6 +17558,17 @@ DigestSign = SHA256
Key = ED25519-1
Result = DIGESTSIGNINIT_ERROR
# Raw tests
OneShotDigestSign = NULL
Key = ED25519-1-Raw
Input = ""
Output = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b
OneShotDigestVerify = NULL
Key = ED25519-1-PUBLIC-Raw
Input = ""
Output = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b
Title = ED448 tests from RFC8032
@@ -17606,6 +17668,11 @@ MEMwBQYDK2VxAzoAqBsuinClrJT/28ybrfw/6wgB8lhXi7EUrUTs4ewOeZ2gjv+4
HF1oXAxW9k7srvjN8RzDhzeDjPQA
-----END PUBLIC KEY-----
#Raw versions of the ED448-1 keys
PrivateKeyRaw=ED448-1-Raw:ED448:6c82a562cb808d10d632be89c8513ebf6c929f34ddfa8c9f63c9960ef6e348a3528c8a3fcc2f044e39a3fc5b94492f8f032e7549a20098f95b
PublicKeyRaw=ED448-1-PUBLIC-Raw:ED448:5fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180
PrivPubKeyPair = ED448-1:ED448-1-PUBLIC
PrivPubKeyPair = ED448-2:ED448-2-PUBLIC
@@ -17622,6 +17689,8 @@ PrivPubKeyPair = ED448-7:ED448-7-PUBLIC
PrivPubKeyPair = ED448-8:ED448-8-PUBLIC
PrivPubKeyPair = ED448-1-Raw:ED448-1-PUBLIC-Raw
OneShotDigestSign = NULL
Key = ED448-1
Input = ""
@@ -17698,6 +17767,17 @@ DigestSign = SHA256
Key = ED448-1
Result = DIGESTSIGNINIT_ERROR
# Raw keys
OneShotDigestSign = NULL
Key = ED448-1-Raw
Input = ""
Output = 533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4dbb61149f05a7363268c71d95808ff2e652600
OneShotDigestVerify = NULL
Key = ED448-1-PUBLIC-Raw
Input = ""
Output = 533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4dbb61149f05a7363268c71d95808ff2e652600
# Key generation tests
KeyGen = rsaEncryption
@@ -18289,3 +18369,31 @@ SharedSecret=4E48335CB2A508C3481729F42C49CFC0A9DA673F9FA4FBD968B3C5B78DBFA869529
Derive=ffdhe8192-2
PeerKey=ffdhe8192-1-pub
SharedSecret=4E48335CB2A508C3481729F42C49CFC0A9DA673F9FA4FBD968B3C5B78DBFA8695295642D1337C54229370B33068481F6A6E1B021F8B09B7C6B3E4DB581AD4C7ACF5C230A1FD4107EAE55530A8376856A65E079DE1BDA41B050E9B53A088ACADB879CCBC683A13BB925D48497BF7021FEB9DA214DD77FCBB6D0D46EC2BB9C7A9AFB93FC236E4EB61CB0F0C8E025D8CF4AF8B3B0F28B3E2CFAE6E760DC7877C71046179154FBE1A50A315C4DBA6D9E06406D389B614B1FC422C72FBB958C0A2EE21694CD32136F9CF0A1205E0D3A4B10CC9C98B3B4524A0CDC9455D3021AC44057CEF4A97E85166068769E9E644CC447095243BB90368A1CE6F0E3C69CA180F5B9D51F590A812B1375460CF10A7E718A83A2F6B00D8E28BAB45CEAB8AF0EB02988ED9221416EC061C1C4081552D3D0849D243DB473EC7B90180C3891E768DD2D7002CF505D369700CAF02A4B9DD1F2828C4ACC1F2EB47100DC2DB5620ADA971D1B0B0FAC9F9E3492B591FC85AC3DCB3826A8DA5842F4AE145FE33BFCDD0B6CD15C9836A5862EDB3D87A0CDBD724AE19A79A55D4F0BFF7870019926181933C840EACFB70FBC0EF182057DC09E06798EB4C9AAC2285F22F5D907A432C6D00CC44D07D77E77D1ACC183A174146ECFBDA26FF922CEBD2FA288EF2D23F65C0AAAD0F05DBFB6CA12446082D1F5774877483C3858442E305CF2A9637CE0EBB702DB70FF336E5B0413F3E8791960F1F0A9877C9076213D40657283D546AE52B73FF4449E60F8B6FE30D4CC0BA1ACA7A7DC155EC73C48B21477983D004261267D710D8A5E8CBD0656F1A963F248E887E8C2BF87BCAE7A0D4891BF21FCF35893584B29E18E842A23EA329ADD3D6AD994B5CBFBBFAB5A26932E8F799B2B0FA7789DE7A4A5C4B7FA81971819EA7F33B5BF6577F917BDE9C3680BCC5B15F1EAB4524A1B6DEE96B9F108A77344269A1757685D0404C832E4E0C5A29F808CFA6290316C0EBB2EF0A7431F62A5FBCDC66527AD8A04C0F10AF88C7CE1F1F22C41B71CE278BB704E88145608C28AD78402487031F6B13604CC6687161EBB78E7AF7AA0BC3CCB9AD8B00D7C01980599904B71F5DBC06A691E5638566BE36522B7FED69E24C28F8EA798BA3E9CCEB8AB8CF5651379A21A38315B05C66205616BBC6A3DD5573C9C6FBA2E3488E055E5F36857016D9300BFCE9F38D7C7CCD07FCF1EF41F8347CADCB12C400536374CF269613B05069B6D94CADA3B1F4ACBB68FA1ED175B01D840D871B3B0CDB918CDF15C79169A398C189AEA78860081DB423C89D350587E26D6D77B4C762B4F2A030345679F724CFBB08DB03E8CEB4FF0B91422BD2EB5C1C356D209049CFA2D6447F69B1E1DF0850FFBB6BB9F8D5B147765C023F76524A808456DEBF6A9134E3364DF462D4807FE6D4D036A4E59A4D56F8A30D8A27F4DFA174940B713A7E4
Title = SM2 tests
PrivateKey=SM2_key1
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqBHM9VAYItBG0wawIBAQQg0JFWczAXva2An9m7
2MaT9gIwWTFptvlKrxyO4TjMmbWhRANCAAQ5OirZ4n5DrKqrhaGdO4VZHhRAYVcX
Wt3Te/d/8Mr57Tf886i09VwDhSMmH8pmNq/mp6+ioUgqYG9cs6GLLioe
-----END PRIVATE KEY-----
Verify = SM2_key1
Ctrl = digest:SM3
Input = D7AD397F6FFA5D4F7F11E7217F241607DC30618C236D2C09C1B9EA8FDADEE2E8
Output = 3046022100AB1DB64DE7C40EDBDE6651C9B8EBDB804673DB836E5D5C7FE15DCF9ED2725037022100EBA714451FF69B0BB930B379E192E7CD5FA6E3C41C7FBD8303B799AB54A54621
Decrypt = SM2_key1
Input = 30818A0220466BE2EF5C11782EC77864A0055417F407A5AFC11D653C6BCE69E417BB1D05B6022062B572E21FF0DDF5C726BD3F9FF2EAE56E6294713A607E9B9525628965F62CC804203C1B5713B5DB2728EB7BF775E44F4689FC32668BDC564F52EA45B09E8DF2A5F40422084A9D0CC2997092B7D3C404FCE95956EB604D732B2307A8E5B8900ED6608CA5B197
Output = "The floofy bunnies hop at midnight"
# This is a "fake" test as it does only verify that the SM2 EVP_PKEY interface
# is capable of creating a signature without failing, but it does not say
# anything about the generated signature being valid, nor does it test the
# correct implementation of the cryptosystem.
Sign = SM2_key1
Ctrl = digest:SM3
Input = D7AD397F6FFA5D4F7F11E7217F241607DC30618C236D2C09C1B9EA8FDADEE2E8
Output = 3045022100f11bf36e75bb304f094fb42a4ca22377d0cc768637c5011cd59fb9ed4b130c98022035545ffe2c2efb3abee4fee661468946d886004fae8ea5311593e48f7fe21b91
Result = KEYOP_MISMATCH
test/recipes/70-test_renegotiation.t
+29 -1
View File
@@ -38,7 +38,7 @@ my $proxy = TLSProxy::Proxy->new(
$proxy->clientflags("-no_tls1_3");
$proxy->reneg(1);
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 2;
plan tests => 3;
ok(TLSProxy::Message->success(), "Basic renegotiation");
#Test 2: Client does not send the Reneg SCSV. Reneg should fail
@@ -49,6 +49,34 @@ $proxy->reneg(1);
$proxy->start();
ok(TLSProxy::Message->fail(), "No client SCSV");
SKIP: {
skip "TLSv1.2 or TLSv1.1 disabled", 1
if disabled("tls1_2") || disabled("tls1_1");
#Test 3: Check that the ClientHello version remains the same in the reneg
# handshake
$proxy->clear();
$proxy->filter(undef);
$proxy->clientflags("-no_tls1_3");
$proxy->serverflags("-no_tls1_3 -no_tls1_2");
$proxy->reneg(1);
$proxy->start();
my $chversion;
my $chmatch = 0;
foreach my $message (@{$proxy->message_list}) {
if ($message->mt == TLSProxy::Message::MT_CLIENT_HELLO) {
if (!defined $chversion) {
$chversion = $message->client_version;
} else {
if ($chversion == $message->client_version) {
$chmatch = 1;
}
}
}
}
ok(TLSProxy::Message->success() && $chmatch,
"Check ClientHello version is the same");
}
sub reneg_filter
{
my $proxy = shift;
test/recipes/70-test_sslcbcpadding.t
+25 -6
View File
@@ -7,6 +7,8 @@
# https://www.openssl.org/source/license.html
use strict;
use feature 'state';
use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/;
use OpenSSL::Test::Utils;
use TLSProxy::Proxy;
@@ -41,26 +43,31 @@ my @test_offsets = (0, 128, 254, 255);
# Test that maximally-padded records are accepted.
my $bad_padding_offset = -1;
$proxy->serverflags("-tls1_2");
$proxy->serverconnects(1 + scalar(@test_offsets));
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 1 + scalar(@test_offsets);
ok(TLSProxy::Message->success(), "Maximally-padded record test");
# Test that invalid padding is rejected.
my $fatal_alert; # set by add_maximal_padding_filter on client's fatal alert
foreach my $offset (@test_offsets) {
$proxy->clear();
$proxy->serverflags("-tls1_2");
$bad_padding_offset = $offset;
$proxy->start();
ok(TLSProxy::Message->fail(), "Invalid padding byte $bad_padding_offset");
$fatal_alert = 0;
$proxy->clearClient();
$proxy->clientstart();
ok($fatal_alert, "Invalid padding byte $bad_padding_offset");
}
sub add_maximal_padding_filter
{
my $proxy = shift;
my $messages = $proxy->message_list;
state $sent_corrupted_payload;
if ($proxy->flight == 0) {
# Disable Encrypt-then-MAC.
foreach my $message (@{$proxy->message_list}) {
foreach my $message (@{$messages}) {
if ($message->mt != TLSProxy::Message::MT_CLIENT_HELLO) {
next;
}
@@ -69,9 +76,16 @@ sub add_maximal_padding_filter
$message->process_extensions();
$message->repack();
}
$sent_corrupted_payload = 0;
return;
}
if ($proxy->flight == 3) {
my $last_message = @{$messages}[-1];
if (defined($last_message)
&& $last_message->server
&& $last_message->mt == TLSProxy::Message::MT_FINISHED
&& !@{$last_message->records}[0]->{sent}) {
# Insert a maximally-padded record. Assume a block size of 16 (AES) and
# a MAC length of 20 (SHA-1).
my $block_size = 16;
@@ -88,6 +102,7 @@ sub add_maximal_padding_filter
# Add padding.
for (my $i = 0; $i < 256; $i++) {
if ($i == $bad_padding_offset) {
$sent_corrupted_payload = 1;
$data .= "\xfe";
} else {
$data .= "\xff";
@@ -108,5 +123,9 @@ sub add_maximal_padding_filter
# Send the record immediately after the server Finished.
push @{$proxy->record_list}, $record;
} elsif ($sent_corrupted_payload) {
# Check for bad_record_mac from client
my $last_record = @{$proxy->record_list}[-1];
$fatal_alert = 1 if $last_record->is_fatal_alert(0) == 20;
}
}
test/recipes/70-test_sslextension.t
+38 -11
View File
@@ -7,6 +7,8 @@
# https://www.openssl.org/source/license.html
use strict;
use feature 'state';
use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/;
use OpenSSL::Test::Utils;
use TLSProxy::Proxy;
@@ -37,6 +39,7 @@ use constant {
};
my $testtype;
my $fatal_alert = 0; # set by filter on fatal alert
$ENV{OPENSSL_ia32cap} = '~0x200000200000000';
my $proxy = TLSProxy::Proxy->new(
@@ -98,11 +101,13 @@ sub inject_duplicate_extension_clienthello
my $proxy = shift;
# We're only interested in the initial ClientHello
if ($proxy->flight != 0) {
if ($proxy->flight == 0) {
inject_duplicate_extension($proxy, TLSProxy::Message::MT_CLIENT_HELLO);
return;
}
inject_duplicate_extension($proxy, TLSProxy::Message::MT_CLIENT_HELLO);
my $last_record = @{$proxy->{record_list}}[-1];
$fatal_alert = 1 if $last_record->is_fatal_alert(1);
}
sub inject_duplicate_extension_serverhello
@@ -110,26 +115,43 @@ sub inject_duplicate_extension_serverhello
my $proxy = shift;
# We're only interested in the initial ServerHello
if ($proxy->flight != 1) {
if ($proxy->flight == 0) {
return;
} elsif ($proxy->flight == 1) {
inject_duplicate_extension($proxy, TLSProxy::Message::MT_SERVER_HELLO);
return;
}
inject_duplicate_extension($proxy, TLSProxy::Message::MT_SERVER_HELLO);
my $last_record = @{$proxy->{record_list}}[-1];
$fatal_alert = 1 if $last_record->is_fatal_alert(0);
}
sub inject_unsolicited_extension
{
my $proxy = shift;
my $message;
state $sent_unsolisited_extension;
if ($proxy->flight == 0) {
$sent_unsolisited_extension = 0;
return;
}
# We're only interested in the initial ServerHello/EncryptedExtensions
if ($proxy->flight != 1) {
if ($sent_unsolisited_extension) {
my $last_record = @{$proxy->record_list}[-1];
$fatal_alert = 1 if $last_record->is_fatal_alert(0);
}
return;
}
if ($testtype == UNSOLICITED_SERVER_NAME_TLS13) {
$message = ${$proxy->message_list}[2];
die "Expecting EE message ".($message->mt).", ".${$proxy->message_list}[1]->mt.", ".${$proxy->message_list}[3]->mt if $message->mt != TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS;
return if (!defined($message = ${$proxy->message_list}[2]));
die "Expecting EE message ".($message->mt).","
.${$proxy->message_list}[1]->mt.", "
.${$proxy->message_list}[3]->mt
if $message->mt != TLSProxy::Message::MT_ENCRYPTED_EXTENSIONS;
} else {
$message = ${$proxy->message_list}[1];
}
@@ -148,17 +170,19 @@ sub inject_unsolicited_extension
}
$message->set_extension($type, $ext);
$message->repack();
$sent_unsolisited_extension = 1;
}
# Test 1-2: Sending a duplicate extension should fail.
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 7;
ok(TLSProxy::Message->fail(), "Duplicate ClientHello extension");
ok($fatal_alert, "Duplicate ClientHello extension");
$fatal_alert = 0;
$proxy->clear();
$proxy->filter(\&inject_duplicate_extension_serverhello);
$proxy->start();
ok(TLSProxy::Message->fail(), "Duplicate ServerHello extension");
ok($fatal_alert, "Duplicate ServerHello extension");
SKIP: {
skip "TLS <= 1.2 disabled", 3 if $no_below_tls13;
@@ -170,12 +194,13 @@ SKIP: {
ok(TLSProxy::Message->success, "Zero extension length test");
#Test 4: Inject an unsolicited extension (<= TLSv1.2)
$fatal_alert = 0;
$proxy->clear();
$proxy->filter(\&inject_unsolicited_extension);
$testtype = UNSOLICITED_SERVER_NAME;
$proxy->clientflags("-no_tls1_3 -noservername");
$proxy->start();
ok(TLSProxy::Message->fail(), "Unsolicited server name extension");
ok($fatal_alert, "Unsolicited server name extension");
#Test 5: Inject a noncompliant supported_groups extension (<= TLSv1.2)
$proxy->clear();
@@ -190,20 +215,22 @@ SKIP: {
skip "TLS <= 1.2 or CT disabled", 1
if $no_below_tls13 || disabled("ct");
#Test 6: Same as above for the SCT extension which has special handling
$fatal_alert = 0;
$proxy->clear();
$testtype = UNSOLICITED_SCT;
$proxy->clientflags("-no_tls1_3");
$proxy->start();
ok(TLSProxy::Message->fail(), "Unsolicited sct extension");
ok($fatal_alert, "Unsolicited sct extension");
}
SKIP: {
skip "TLS 1.3 disabled", 1 if disabled("tls1_3");
#Test 7: Inject an unsolicited extension (TLSv1.3)
$fatal_alert = 0;
$proxy->clear();
$proxy->filter(\&inject_unsolicited_extension);
$testtype = UNSOLICITED_SERVER_NAME_TLS13;
$proxy->clientflags("-noservername");
$proxy->start();
ok(TLSProxy::Message->fail(), "Unsolicited server name extension (TLSv1.3)");
ok($fatal_alert, "Unsolicited server name extension (TLSv1.3)");
}
test/recipes/70-test_sslrecords.t
+89 -43
View File
@@ -7,6 +7,8 @@
# https://www.openssl.org/source/license.html
use strict;
use feature 'state';
use OpenSSL::Test qw/:DEFAULT cmdstr srctop_file bldtop_dir/;
use OpenSSL::Test::Utils;
use TLSProxy::Proxy;
@@ -35,6 +37,7 @@ my $proxy = TLSProxy::Proxy->new(
);
my $boundary_test_type;
my $fatal_alert = 0; # set by filters at expected fatal alerts
#Test 1: Injecting out of context empty records should fail
my $content_type = TLSProxy::Record::RT_APPLICATION_DATA;
@@ -42,7 +45,7 @@ my $inject_recs_num = 1;
$proxy->serverflags("-tls1_2");
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
plan tests => 18;
ok(TLSProxy::Message->fail(), "Out of context empty records test");
ok($fatal_alert, "Out of context empty records test");
#Test 2: Injecting in context empty records should succeed
$proxy->clear();
@@ -52,21 +55,23 @@ $proxy->start();
ok(TLSProxy::Message->success(), "In context empty records test");
#Test 3: Injecting too many in context empty records should fail
$fatal_alert = 0;
$proxy->clear();
#We allow 32 consecutive in context empty records
$inject_recs_num = 33;
$proxy->serverflags("-tls1_2");
$proxy->start();
ok(TLSProxy::Message->fail(), "Too many in context empty records test");
ok($fatal_alert, "Too many in context empty records test");
#Test 4: Injecting a fragmented fatal alert should fail. We expect the server to
# send back an alert of its own because it cannot handle fragmented
# alerts
$fatal_alert = 0;
$proxy->clear();
$proxy->filter(\&add_frag_alert_filter);
$proxy->serverflags("-tls1_2");
$proxy->start();
ok(TLSProxy::Message->fail(), "Fragmented alert records test");
ok($fatal_alert, "Fragmented alert records test");
#Run some SSLv2 ClientHello tests
@@ -122,51 +127,56 @@ ok(TLSProxy::Message->fail(), "Alert before SSLv2 ClientHello test");
#Unrecognised record type tests
#Test 10: Sending an unrecognised record type in TLS1.2 should fail
$fatal_alert = 0;
$proxy->clear();
$proxy->serverflags("-tls1_2");
$proxy->filter(\&add_unknown_record_type);
$proxy->start();
ok(TLSProxy::Message->fail(), "Unrecognised record type in TLS1.2");
ok($fatal_alert, "Unrecognised record type in TLS1.2");
SKIP: {
skip "TLSv1.1 disabled", 1 if disabled("tls1_1");
#Test 11: Sending an unrecognised record type in TLS1.1 should fail
$fatal_alert = 0;
$proxy->clear();
$proxy->clientflags("-tls1_1");
$proxy->start();
ok(TLSProxy::Message->fail(), "Unrecognised record type in TLS1.1");
ok($fatal_alert, "Unrecognised record type in TLS1.1");
}
#Test 12: Sending a different record version in TLS1.2 should fail
$fatal_alert = 0;
$proxy->clear();
$proxy->clientflags("-tls1_2");
$proxy->filter(\&change_version);
$proxy->start();
ok(TLSProxy::Message->fail(), "Changed record version in TLS1.2");
ok($fatal_alert, "Changed record version in TLS1.2");
#TLS1.3 specific tests
SKIP: {
skip "TLSv1.3 disabled", 6 if disabled("tls1_3");
#Test 13: Sending a different record version in TLS1.3 should succeed
#Test 13: Sending a different record version in TLS1.3 should fail
$proxy->clear();
$proxy->filter(\&change_version);
$proxy->start();
ok(TLSProxy::Message->success(), "Changed record version in TLS1.3");
ok(TLSProxy::Message->fail(), "Changed record version in TLS1.3");
#Test 14: Sending an unrecognised record type in TLS1.3 should fail
$fatal_alert = 0;
$proxy->clear();
$proxy->filter(\&add_unknown_record_type);
$proxy->start();
ok(TLSProxy::Message->fail(), "Unrecognised record type in TLS1.3");
ok($fatal_alert, "Unrecognised record type in TLS1.3");
#Test 15: Sending an outer record type other than app data once encrypted
#should fail
$fatal_alert = 0;
$proxy->clear();
$proxy->filter(\&change_outer_record_type);
$proxy->start();
ok(TLSProxy::Message->fail(), "Wrong outer record type in TLS1.3");
ok($fatal_alert, "Wrong outer record type in TLS1.3");
use constant {
DATA_AFTER_SERVER_HELLO => 0,
@@ -176,36 +186,41 @@ SKIP: {
#Test 16: Sending a ServerHello which doesn't end on a record boundary
# should fail
$fatal_alert = 0;
$proxy->clear();
$boundary_test_type = DATA_AFTER_SERVER_HELLO;
$proxy->filter(\&not_on_record_boundary);
$proxy->start();
ok(TLSProxy::Message->fail(), "Record not on boundary in TLS1.3 (ServerHello)");
ok($fatal_alert, "Record not on boundary in TLS1.3 (ServerHello)");
#Test 17: Sending a Finished which doesn't end on a record boundary
# should fail
$fatal_alert = 0;
$proxy->clear();
$boundary_test_type = DATA_AFTER_FINISHED;
$proxy->filter(\&not_on_record_boundary);
$proxy->start();
ok(TLSProxy::Message->fail(), "Record not on boundary in TLS1.3 (Finished)");
ok($fatal_alert, "Record not on boundary in TLS1.3 (Finished)");
#Test 18: Sending a KeyUpdate which doesn't end on a record boundary
# should fail
$fatal_alert = 0;
$proxy->clear();
$boundary_test_type = DATA_AFTER_KEY_UPDATE;
$proxy->filter(\&not_on_record_boundary);
$proxy->start();
ok(TLSProxy::Message->fail(), "Record not on boundary in TLS1.3 (KeyUpdate)");
ok($fatal_alert, "Record not on boundary in TLS1.3 (KeyUpdate)");
}
sub add_empty_recs_filter
{
my $proxy = shift;
my $records = $proxy->record_list;
# We're only interested in the initial ClientHello
if ($proxy->flight != 0) {
$fatal_alert = 1 if @{$records}[-1]->is_fatal_alert(1) == 10;
return;
}
@@ -221,18 +236,19 @@ sub add_empty_recs_filter
"",
""
);
push @{$proxy->record_list}, $record;
push @{$records}, $record;
}
}
sub add_frag_alert_filter
{
my $proxy = shift;
my $records = $proxy->record_list;
my $byte;
# We're only interested in the initial ClientHello
if ($proxy->flight != 0) {
$fatal_alert = 1 if @{$records}[-1]->is_fatal_alert(1) == 10;
return;
}
@@ -262,7 +278,7 @@ sub add_frag_alert_filter
$byte,
$byte
);
push @{$proxy->record_list}, $record;
push @{$records}, $record;
# And finally the description (Unexpected message) in a third record
$byte = pack('C', TLSProxy::Message::AL_DESC_UNEXPECTED_MESSAGE);
@@ -277,7 +293,7 @@ sub add_frag_alert_filter
$byte,
$byte
);
push @{$proxy->record_list}, $record;
push @{$records}, $record;
}
sub add_sslv2_filter
@@ -430,17 +446,22 @@ sub add_sslv2_filter
sub add_unknown_record_type
{
my $proxy = shift;
my $records = $proxy->record_list;
state $added_record;
# We'll change a record after the initial version neg has taken place
if ($proxy->flight != 1) {
if ($proxy->flight == 0) {
$added_record = 0;
return;
} elsif ($proxy->flight != 1 || $added_record) {
$fatal_alert = 1 if @{$records}[-1]->is_fatal_alert(0) == 10;
return;
}
my $lastrec = ${$proxy->record_list}[-1];
my $record = TLSProxy::Record->new(
1,
TLSProxy::Record::RT_UNKNOWN,
$lastrec->version(),
@{$records}[-1]->version(),
1,
0,
1,
@@ -457,64 +478,86 @@ sub add_unknown_record_type
$i++;
splice @{$proxy->record_list}, $i, 0, $record;
$added_record = 1;
}
sub change_version
{
my $proxy = shift;
my $records = $proxy->record_list;
# We'll change a version after the initial version neg has taken place
if ($proxy->flight != 2) {
if ($proxy->flight != 1) {
$fatal_alert = 1 if @{$records}[-1]->is_fatal_alert(0) == 70;
return;
}
(${$proxy->record_list}[-1])->version(TLSProxy::Record::VERS_TLS_1_1);
if ($#{$records} > 1) {
# ... typically in ServerHelloDone
@{$records}[-1]->version(TLSProxy::Record::VERS_TLS_1_1);
}
}
sub change_outer_record_type
{
my $proxy = shift;
my $records = $proxy->record_list;
# We'll change a record after the initial version neg has taken place
if ($proxy->flight != 1) {
$fatal_alert = 1 if @{$records}[-1]->is_fatal_alert(0) == 10;
return;
}
#Find ServerHello record and change record after that
my $i;
for ($i = 0; ${$proxy->record_list}[$i]->flight() < 1; $i++) {
next;
# Find CCS record and change record after that
my $i = 0;
foreach my $record (@{$records}) {
last if $record->content_type == TLSProxy::Record::RT_CCS;
$i++;
}
if (defined(${$records}[++$i])) {
${$records}[$i]->outer_content_type(TLSProxy::Record::RT_HANDSHAKE);
}
#Skip CCS and ServerHello
$i += 2;
${$proxy->record_list}[$i]->outer_content_type(TLSProxy::Record::RT_HANDSHAKE);
}
sub not_on_record_boundary
{
my $proxy = shift;
my $records = $proxy->record_list;
my $data;
#Find server's first flight
if ($proxy->flight != 1) {
$fatal_alert = 1 if @{$records}[-1]->is_fatal_alert(0) == 10;
return;
}
if ($boundary_test_type == DATA_AFTER_SERVER_HELLO) {
#Merge the ServerHello and EncryptedExtensions records into one
my $i;
for ($i = 0; ${$proxy->record_list}[$i]->flight() < 1; $i++) {
next;
my $i = 0;
foreach my $record (@{$records}) {
if ($record->content_type == TLSProxy::Record::RT_HANDSHAKE) {
$record->{sent} = 1; # pretend it's sent already
last;
}
$i++;
}
$data = ${$proxy->record_list}[$i]->data();
$data .= ${$proxy->record_list}[$i + 1]->decrypt_data();
${$proxy->record_list}[$i]->data($data);
${$proxy->record_list}[$i]->len(length $data);
#Delete the old EncryptedExtensions record
splice @{$proxy->record_list}, $i + 1, 1;
if (defined(${$records}[$i+1])) {
$data = ${$records}[$i]->data();
$data .= ${$records}[$i+1]->decrypt_data();
${$records}[$i+1]->data($data);
${$records}[$i+1]->len(length $data);
#Delete the old ServerHello record
splice @{$records}, $i, 1;
}
} elsif ($boundary_test_type == DATA_AFTER_FINISHED) {
$data = ${$proxy->record_list}[-1]->decrypt_data;
return if @{$proxy->{message_list}}[-1]->{mt}
!= TLSProxy::Message::MT_FINISHED;
my $last_record = @{$records}[-1];
$data = $last_record->decrypt_data;
#Add a KeyUpdate message onto the end of the Finished record
my $keyupdate = pack "C5",
@@ -528,15 +571,18 @@ sub not_on_record_boundary
$data .= pack("C", TLSProxy::Record::RT_HANDSHAKE).("\0"x16);
#Update the record
${$proxy->record_list}[-1]->data($data);
${$proxy->record_list}[-1]->len(length $data);
$last_record->data($data);
$last_record->len(length $data);
} else {
return if @{$proxy->{message_list}}[-1]->{mt}
!= TLSProxy::Message::MT_FINISHED;
#KeyUpdates must end on a record boundary
my $record = TLSProxy::Record->new(
1,
TLSProxy::Record::RT_APPLICATION_DATA,
TLSProxy::Record::VERS_TLS_1_0,
TLSProxy::Record::VERS_TLS_1_2,
0,
0,
0,
@@ -558,6 +604,6 @@ sub not_on_record_boundary
$record->data($data);
$record->len(length $data);
push @{$proxy->record_list}, $record;
push @{$records}, $record;
}
}
test/recipes/70-test_sslsigalgs.t
+9 -9
View File
@@ -116,7 +116,7 @@ SKIP: {
# should succeed
$proxy->clear();
$proxy->serverflags("-no_tls1_3");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->filter(undef);
$proxy->start();
ok(TLSProxy::Message->success, "TLSv1.3 client TLSv1.2 server");
@@ -131,7 +131,7 @@ SKIP: {
$proxy->clear();
$testtype = NO_SIG_ALGS_EXT;
$proxy->clientflags("-no_tls1_3");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->success, "No TLSv1.2 sigalgs");
@@ -139,7 +139,7 @@ SKIP: {
$proxy->clear();
$testtype = EMPTY_SIG_ALGS_EXT;
$proxy->clientflags("-no_tls1_3");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->fail, "Empty TLSv1.2 sigalgs");
@@ -147,7 +147,7 @@ SKIP: {
$proxy->clear();
$testtype = NO_KNOWN_SIG_ALGS;
$proxy->clientflags("-no_tls1_3");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->fail, "No known TLSv1.3 sigalgs");
@@ -156,7 +156,7 @@ SKIP: {
$proxy->clear();
$testtype = NO_PSS_SIG_ALGS;
$proxy->clientflags("-no_tls1_3");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->success, "No PSS TLSv1.2 sigalgs");
@@ -164,7 +164,7 @@ SKIP: {
$proxy->clear();
$testtype = PSS_ONLY_SIG_ALGS;
$proxy->serverflags("-no_tls1_3");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->success, "PSS only sigalgs in TLSv1.2");
@@ -175,7 +175,7 @@ SKIP: {
$proxy->clear();
$testtype = PSS_ONLY_SIG_ALGS;
$proxy->clientflags("-no_tls1_3 -sigalgs RSA+SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->fail, "Sigalg we did not send in TLSv1.2");
@@ -183,7 +183,7 @@ SKIP: {
# matches the certificate should fail in TLSv1.2
$proxy->clear();
$proxy->clientflags("-no_tls1_3 -sigalgs ECDSA+SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-RSA-AES128-SHA");
$proxy->filter(undef);
$proxy->start();
ok(TLSProxy::Message->fail, "No matching TLSv1.2 sigalgs");
@@ -197,7 +197,7 @@ SKIP: {
"server-ecdsa-cert.pem") .
" -key " . srctop_file("test", "certs",
"server-ecdsa-key.pem")),
$proxy->ciphers("ECDHE-ECDSA-AES128-SHA:TLS13-AES-128-GCM-SHA256");
$proxy->ciphers("ECDHE-ECDSA-AES128-SHA");
$proxy->start();
ok(TLSProxy::Message->success, "No TLSv1.2 sigalgs, ECDSA");
}
test/recipes/70-test_sslversions.t
+4 -3
View File
@@ -138,7 +138,8 @@ sub modify_supported_versions_filter
$ext = pack "C5",
0x04, # Length
0x03, 0x03, #TLSv1.2
0x03, 0x04; #TLSv1.3
#TODO(TLS1.3): Fix before release
0x7f, 0x1c; #TLSv1.3 (draft 28)
} elsif ($testtype == UNRECOGNISED_VERSIONS) {
$ext = pack "C5",
0x04, # Length
@@ -152,8 +153,8 @@ sub modify_supported_versions_filter
} elsif ($testtype == WITH_TLS1_4) {
$ext = pack "C5",
0x04, # Length
0x03, 0x05, #TLSv1.4
0x03, 0x04; #TLSv1.3
#TODO(TLS1.3): Fix before release
0x7f, 0x1c; #TLSv1.3 (draft 28)
}
if ($testtype == REVERSE_ORDER_VERSIONS
|| $testtype == UNRECOGNISED_VERSIONS
test/recipes/70-test_tls13hrr.t
+2 -3
View File
@@ -53,7 +53,7 @@ ok(TLSProxy::Message->fail(), "Server ciphersuite changes");
# we end up selecting a different ciphersuite between HRR and the SH
$proxy->clear();
$proxy->serverflags("-curves P-256");
$proxy->ciphers("TLS13-AES-128-GCM-SHA256:TLS13-AES-256-GCM-SHA384");
$proxy->ciphersuitess("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384");
$testtype = CHANGE_CH1_CIPHERSUITE;
$proxy->start();
ok(TLSProxy::Message->fail(), "Client ciphersuite changes");
@@ -85,8 +85,7 @@ sub hrr_filter
my $ch1 = ${$proxy->message_list}[0];
# The server prefers TLS13-AES-256-GCM-SHA384 so it will pick that next
# time around
# The server will always pick TLS_AES_256_GCM_SHA384
my @ciphersuites = (TLSProxy::Message::CIPHER_TLS13_AES_128_GCM_SHA256);
$ch1->ciphersuite_len(2 * scalar @ciphersuites);
$ch1->ciphersuites(\@ciphersuites);
test/recipes/70-test_tls13psk.t
+4 -4
View File
@@ -63,7 +63,7 @@ $proxy->start();
ok(TLSProxy::Message->fail(), "PSK not last");
#Test 3: Attempt a resume after an HRR where PSK hash matches selected
# ciperhsuite. Should see PSK on second ClientHello
# ciphersuite. Should see PSK on second ClientHello
$proxy->clear();
$proxy->clientflags("-sess_in ".$session);
$proxy->serverflags("-curves P-256");
@@ -82,10 +82,10 @@ $proxy->clear();
$proxy->clientflags("-sess_in ".$session);
$proxy->filter(\&modify_psk_filter);
$proxy->serverflags("-curves P-256");
$proxy->cipherc("TLS13-AES-128-GCM-SHA256:TLS13-AES-256-GCM-SHA384");
$proxy->ciphers("TLS13-AES-256-GCM-SHA384");
$proxy->ciphersuitesc("TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384");
$proxy->ciphersuitess("TLS_AES_256_GCM_SHA384");
#We force an early failure because TLS Proxy doesn't actually support
#TLS13-AES-256-GCM-SHA384. That doesn't matter for this test though.
#TLS_AES_256_GCM_SHA384. That doesn't matter for this test though.
$testtype = ILLEGAL_EXT_SECOND_CH;
$proxy->start();
#Check if the PSK is present in the second ClientHello
test/recipes/80-test_cipherlist.t
+7 -2
View File
@@ -1,6 +1,6 @@
#! /usr/bin/perl
#
# Copyright 2016-2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -12,11 +12,16 @@ use strict;
use warnings;
use OpenSSL::Test::Simple;
use OpenSSL::Test;
use OpenSSL::Test qw(:DEFAULT openssl_versions);
use OpenSSL::Test::Utils qw(alldisabled available_protocols);
setup("test_cipherlist");
my ($build_version, $library_version) = openssl_versions();
plan skip_all =>
"This test recipe isn't supported when doing regression testing"
if $build_version != $library_version;
my $no_anytls = alldisabled(available_protocols("tls"));
# If we have no protocols, then we also have no supported ciphers.
test/recipes/80-test_cmsapi.t
+21
View File
@@ -0,0 +1,21 @@
#! /usr/bin/env perl
# Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
use OpenSSL::Test::Utils;
use OpenSSL::Test qw/:DEFAULT srctop_file/;
setup("test_cmsapi");
plan skip_all => "CMS is disabled in this build" if disabled("cms");
plan tests => 1;
ok(run(test(["cmsapitest", srctop_file("test", "certs", "servercert.pem"),
srctop_file("test", "certs", "serverkey.pem")])),
"running cmsapitest");
test/recipes/80-test_ssl_new.t
+1
View File
@@ -68,6 +68,7 @@ my %conf_dependent_tests = (
"20-cert-select.conf" => !$is_default_tls || $no_dh || $no_dsa,
"22-compression.conf" => !$is_default_tls,
"25-cipher.conf" => disabled("poly1305") || disabled("chacha"),
"27-ticket-appdata.conf" => !$is_default_tls,
);
# Add your test here if it should be skipped for some compile-time
test/recipes/80-test_ssl_old.t
+15 -6
View File
@@ -432,9 +432,12 @@ sub testssl {
if $protocolciphersuitecount + scalar(keys %ciphersuites) == 0;
# The count of protocols is because in addition to the ciphersuites
# we got above, we're running a weak DH test for each protocol
plan tests => scalar(@protocols) + $protocolciphersuitecount
+ scalar(keys %ciphersuites);
# we got above, we're running a weak DH test for each protocol (except
# TLSv1.3)
my $testcount = scalar(@protocols) + $protocolciphersuitecount
+ scalar(keys %ciphersuites);
$testcount-- unless $no_tls1_3;
plan tests => $testcount;
foreach my $protocol (@protocols) {
ok($ciphersstatus{$protocol}, "Getting ciphers for $protocol");
@@ -445,21 +448,27 @@ sub testssl {
# ssltest_old doesn't know -tls1_3, but that's fine, since that's
# the default choice if TLSv1.3 enabled
my $flag = $protocol eq "-tls1_3" ? "" : $protocol;
my $ciphersuites = "";
foreach my $cipher (@{$ciphersuites{$protocol}}) {
if ($protocol eq "-ssl3" && $cipher =~ /ECDH/ ) {
note "*****SKIPPING $protocol $cipher";
ok(1);
} else {
if ($protocol eq "-tls1_3") {
$ciphersuites = $cipher;
$cipher = "";
}
ok(run(test([@ssltest, @exkeys, "-cipher", $cipher,
$flag || ()])),
"Testing $cipher");
"-ciphersuites", $ciphersuites, $flag || ()])),
"Testing $cipher");
}
}
next if $protocol eq "-tls1_3";
is(run(test([@ssltest,
"-s_cipher", "EDH",
"-c_cipher", 'EDH:@SECLEVEL=1',
"-dhe512",
$protocol eq "SSLv3" ? ("-ssl3") : ()])), 0,
$protocol])), 0,
"testing connection with weak DH, expecting failure");
}
};
test/recipes/90-test_shlibload.t
+4 -2
View File
@@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -20,7 +20,7 @@ use configdata;
plan skip_all => "Test only supported in a shared build" if disabled("shared");
plan tests => 3;
plan tests => 4;
my $libcrypto_idx = $unified_info{rename}->{libcrypto} // "libcrypto";
my $libssl_idx = $unified_info{rename}->{libssl} // "libssl";
@@ -35,4 +35,6 @@ ok(run(test(["shlibloadtest", "-ssl_first", $libcrypto, $libssl])),
"running shlibloadtest -ssl_first");
ok(run(test(["shlibloadtest", "-just_crypto", $libcrypto, $libssl])),
"running shlibloadtest -just_crypto");
ok(run(test(["shlibloadtest", "-dso_ref", $libcrypto, $libssl])),
"running shlibloadtest -dso_ref");
test/recipes/90-test_sslapi.t
+10 -2
View File
@@ -1,5 +1,5 @@
#! /usr/bin/env perl
# Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -9,6 +9,7 @@
use OpenSSL::Test::Utils;
use OpenSSL::Test qw/:DEFAULT srctop_file/;
use File::Temp qw(tempfile);
setup("test_sslapi");
@@ -17,5 +18,12 @@ plan skip_all => "No TLS/SSL protocols are supported by this OpenSSL build"
plan tests => 1;
(undef, my $tmpfilename) = tempfile();
ok(run(test(["sslapitest", srctop_file("apps", "server.pem"),
srctop_file("apps", "server.pem")])), "running sslapitest");
srctop_file("apps", "server.pem"),
srctop_file("test", "recipes", "90-test_sslapi_data",
"passwd.txt"), $tmpfilename])),
"running sslapitest");
unlink $tmpfilename;
test/recipes/90-test_sslapi_data/passwd.txt
+1
View File
@@ -0,0 +1 @@
V 1auIY/NQXwKWVeWaYg.YV0AaU.mpHSsZw8PWfrYT0oMTPYekTqGXu6ElyTN64DmK03V3P2yVRdhN0UBxMBujLnTauROkuEep/vp7S5xhW1VK8zg1gtJslTqOp4l.GTJF9x0WYmS6VNRnj5AVi3mgfVJ3nmzlMJUMm7niQxm5awLZZ8xykox1j6MFRa80y02Ub87A88DwqA5wrIM/Uojx9VBxUhTHC.353aBA/rL4O/179rgIBbhID08RA6uLv7pIJQVl5OjYsRu/XzQsgFFW6Wog7PaB.AATqArzXZieZxs/teOiFKPSgKI.76vvVEMQIifSj3hRuVK/immK.9hBCTHYjAv96MUmitb0ErPYJRl2MeBC8M6aHJ8FaMmak.Qv.bwyiqpEjlX1a9KjdBAKIaAswECjeP6G0Gk5v1g5D7ZmP5JUK7Wp/X9sKuZZYOsDwEGfXNmmJG6Y3TETx105HT2QMJ5ti5QCbrd71VWABmVWpHJc03YLUExw6WtYdUW0YHTbRKVntgVe2hOQD.XPtFPn2SwxbGonq1bwEvdCp22uTb5HFSC3I7amCUTZteVmMgqJAcx.x.2yfliESVvpmG.dnDFkp6vsQxch6Q1dV5rDmR4GGSy8FoPSFXc7NS0kCSs.qsTqLSmHN1XMzwrwYuVbItXBwetwxcIcdi.sFG6OLuwRUGaNOXiMwhlDHyQtVfEm3L/KIjPpzLlYRAJWF9M40FIcNsI6xiMNhvUGNO7LaBHKSV3oHlwUWWUnL7Uo/ePH8lBpGadYPxObXZ1/wOcWdJ1Rb5dB9orSSTSvoNrZyALKO.swl7pP7beYq6bUx8qtBJLaqI2zQzr1tnmJi8azVicuFtsDs363ntCRtd1LLT3CX3EBVXMbEy6xgAKWI2GL3HO6v8k3Gv96UeGFN/w5yAz61mbajDrSeJekUaKgfucV8h9tgHNlTA1kGowd2Yn/EQdVc/qSETddySqNC0mXlPW1tgb2ixV6sWbYrb5TLBUdztdw5L2D62Aal.9IjpTEKc4F/gMjYsazIX6nzpXZtWnYP7dIOpSi4c.48B2RIeDrZVMzUF.9QOF9Dk1fy5Z2X91z8J2I0GuqIWKKfwnx4xA3RbGUds1Cv2XvUA1tP7eqtvs/mTsC8KWApNSpL6K.U.Pt0ee6F76CV.ZcBXTbXl9zJZ0H1peiehzZpbuIPLZPtzIHClRQovjqdrlEUzS5VdSgCfNhEUr3ZOpG3cCKO4Lk25jZuQtoFmyxUuRAIXejLizCd727hO7rHZoD.GGm4HiNaH2jgZaftoFhfSBXvPRGYfcj.ZkiLyurNlumMXTduHImB1ZMkZ1af5dggKaQG4bJe9WbF6KYxmeRwV 1oFJIzMwXA0RFKXCGcSV0nAToL5 test 8192 A test user
test/recipes/90-test_store.t
+38 -33
View File
@@ -89,84 +89,89 @@ indir "store_$$" => sub {
foreach (@noexist_files) {
my $file = srctop_file($_);
ok(!run(app(["openssl", "storeutl", $file])));
ok(!run(app(["openssl", "storeutl", to_abs_file($file)])));
ok(!run(app(["openssl", "storeutl", "-noout", $file])));
ok(!run(app(["openssl", "storeutl", "-noout",
to_abs_file($file)])));
{
local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
ok(!run(app(["openssl", "storeutl", to_abs_file_uri($file)])));
ok(!run(app(["openssl", "storeutl", "-noout",
to_abs_file_uri($file)])));
}
}
foreach (@src_files) {
my $file = srctop_file($_);
ok(run(app(["openssl", "storeutl", $file])));
ok(run(app(["openssl", "storeutl", to_abs_file($file)])));
ok(run(app(["openssl", "storeutl", "-noout", $file])));
ok(run(app(["openssl", "storeutl", "-noout", to_abs_file($file)])));
{
local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
ok(run(app(["openssl", "storeutl", to_abs_file_uri($file)])));
ok(run(app(["openssl", "storeutl",
ok(run(app(["openssl", "storeutl", "-noout",
to_abs_file_uri($file)])));
ok(run(app(["openssl", "storeutl", "-noout",
to_abs_file_uri($file, 0, "")])));
ok(run(app(["openssl", "storeutl",
ok(run(app(["openssl", "storeutl", "-noout",
to_abs_file_uri($file, 0, "localhost")])));
ok(!run(app(["openssl", "storeutl",
ok(!run(app(["openssl", "storeutl", "-noout",
to_abs_file_uri($file, 0, "dummy")])));
}
}
foreach (@generated_files) {
ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
$_])));
ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
to_abs_file($_)])));
ok(run(app(["openssl", "storeutl", "-noout", "-passin",
"pass:password", $_])));
ok(run(app(["openssl", "storeutl", "-noout", "-passin",
"pass:password", to_abs_file($_)])));
{
local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
to_abs_file_uri($_)])));
ok(!run(app(["openssl", "storeutl", "-passin", "pass:password",
to_file_uri($_)])));
ok(run(app(["openssl", "storeutl", "-noout", "-passin",
"pass:password", to_abs_file_uri($_)])));
ok(!run(app(["openssl", "storeutl", "-noout", "-passin",
"pass:password", to_file_uri($_)])));
}
}
foreach (values %generated_file_files) {
local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
ok(run(app(["openssl", "storeutl", $_])));
ok(run(app(["openssl", "storeutl", "-noout", $_])));
}
foreach (@noexist_file_files) {
local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
ok(!run(app(["openssl", "storeutl", $_])));
ok(!run(app(["openssl", "storeutl", "-noout", $_])));
}
{
my $dir = srctop_dir("test", "certs");
ok(run(app(["openssl", "storeutl", $dir])));
ok(run(app(["openssl", "storeutl", to_abs_file($dir, 1)])));
ok(run(app(["openssl", "storeutl", "-noout", $dir])));
ok(run(app(["openssl", "storeutl", "-noout",
to_abs_file($dir, 1)])));
{
local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
ok(run(app(["openssl", "storeutl", to_abs_file_uri($dir, 1)])));
ok(run(app(["openssl", "storeutl", "-noout",
to_abs_file_uri($dir, 1)])));
}
}
ok(!run(app(['openssl', 'storeutl',
ok(!run(app(['openssl', 'storeutl', '-noout',
'-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
srctop_file('test', 'testx509.pem')])),
"Checking that -subject can't be used with a single file");
ok(run(app(['openssl', 'storeutl', '-certs',
ok(run(app(['openssl', 'storeutl', '-certs', '-noout',
srctop_file('test', 'testx509.pem')])),
"Checking that -certs returns 1 object on a certificate file");
ok(run(app(['openssl', 'storeutl', '-certs',
ok(run(app(['openssl', 'storeutl', '-certs', '-noout',
srctop_file('test', 'testcrl.pem')])),
"Checking that -certs returns 0 objects on a CRL file");
ok(run(app(['openssl', 'storeutl', '-crls',
ok(run(app(['openssl', 'storeutl', '-crls', '-noout',
srctop_file('test', 'testx509.pem')])),
"Checking that -crls returns 0 objects on a certificate file");
ok(run(app(['openssl', 'storeutl', '-crls',
ok(run(app(['openssl', 'storeutl', '-crls', '-noout',
srctop_file('test', 'testcrl.pem')])),
"Checking that -crls returns 1 object on a CRL file");
@@ -177,24 +182,24 @@ indir "store_$$" => sub {
# '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert'
# issuer from testcrl.pem:
# '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority'
ok(run(app(['openssl', 'storeutl',
ok(run(app(['openssl', 'storeutl', '-noout',
'-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
catdir(curdir(), 'rehash')])));
ok(run(app(['openssl', 'storeutl',
ok(run(app(['openssl', 'storeutl', '-noout',
'-subject',
'/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
catdir(curdir(), 'rehash')])));
ok(run(app(['openssl', 'storeutl', '-certs',
ok(run(app(['openssl', 'storeutl', '-noout', '-certs',
'-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
catdir(curdir(), 'rehash')])));
ok(run(app(['openssl', 'storeutl', '-crls',
ok(run(app(['openssl', 'storeutl', '-noout', '-crls',
'-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
catdir(curdir(), 'rehash')])));
ok(run(app(['openssl', 'storeutl', '-certs',
ok(run(app(['openssl', 'storeutl', '-noout', '-certs',
'-subject',
'/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
catdir(curdir(), 'rehash')])));
ok(run(app(['openssl', 'storeutl', '-crls',
ok(run(app(['openssl', 'storeutl', '-noout', '-crls',
'-subject',
'/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
catdir(curdir(), 'rehash')])));
test/recipes/90-test_sysdefault.t
+23
View File
@@ -0,0 +1,23 @@
#! /usr/bin/env perl
# Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
use OpenSSL::Test::Utils;
use OpenSSL::Test qw/:DEFAULT srctop_file/;
my $test_name = "test_sysdefault";
setup($test_name);
plan skip_all => "$test_name is not supported in this build"
if disabled("tls1_2") || disabled("rsa");
plan tests => 1;
$ENV{OPENSSL_CONF} = srctop_file("test", "sysdefault.cnf");
ok(run(test(["sysdefaulttest"])), "sysdefaulttest");
test/recipes/99-test_fuzz.t
+6 -6
View File
@@ -1,5 +1,5 @@
#!/usr/bin/env perl
# Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
@@ -26,14 +26,14 @@ plan tests => scalar @fuzzers;
foreach my $f (@fuzzers) {
subtest "Fuzzing $f" => sub {
my @files = glob(srctop_file('fuzz', 'corpora', $f, '*'));
push @files, glob(srctop_file('fuzz', 'corpora', "$f-*", '*'));
my @dirs = glob(srctop_file('fuzz', 'corpora', $f));
push @dirs, glob(srctop_file('fuzz', 'corpora', "$f-*"));
plan skip_all => "No corpora for $f-test" unless @files;
plan skip_all => "No corpora for $f-test" unless @dirs;
plan tests => scalar @files;
plan tests => scalar @dirs;
foreach (@files) {
foreach (@dirs) {
ok(run(fuzz(["$f-test", $_])));
}
}