mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-12-21 06:09:35 +08:00
Code Issues Packages Projects Releases Wiki Activity
6bba373ec3
openssl/test/ssl_test.tmpl

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

127 lines
4.3 KiB
Cheetah
Raw Normal View History

New SSL test framework Currently, SSL tests are configured via command-line switches to ssltest.c. This results in a lot of duplication between ssltest.c and apps, and a complex setup. ssltest.c is also simply old and needs maintenance. Instead, we already have a way to configure SSL servers and clients, so we leverage that. SSL tests can now be configured from a configuration file. Test servers and clients are configured using the standard ssl_conf module. Additional test settings are configured via a test configuration. Moreover, since the CONF language involves unnecessary boilerplate, the test conf itself is generated from a shorter Perl syntax. The generated testcase files are checked in to the repo to make it easier to verify that the intended test cases are in fact run; and to simplify debugging failures. To demonstrate the approach, min/max protocol tests are converted to the new format. This change also fixes MinProtocol and MaxProtocol handling. It was previously requested that an SSL_CTX have both the server and client flags set for these commands; this clearly can never work. Guide to this PR: - test/ssl_test.c - test framework - test/ssl_test_ctx.* - test configuration structure - test/handshake_helper.* - new SSL test handshaking code - test/ssl-tests/ - test configurations - test/generate_ssl_tests.pl - script for generating CONF-style test configurations from perl inputs Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-17 22:14:30 +08:00
[{-$testname-}]
ssl_conf = {-$testname-}-ssl
[{-$testname-}-ssl]
SSL tests: compress generated output a little Don't emit duplicate server/client sections when they are identical. Instead, just point to the same section. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-22 01:19:07 +08:00
server = {-$testname-}-server
client = {-$testname-}-client{-
SSL test framework: port resumption tests Systematically test every server-side version downgrade or upgrade. Client version upgrade or downgrade could be tested analogously but will be done in a later change. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-06 01:06:23 +08:00
# The following sections are optional.
SSL test: only write out server2 when testing SNI The SNI tests introduced a redundant "server2" section into every test configuration. Copy this automatically from "server" unless testing SNI, to reduce noise in the generated confs. Also remove duplicate SSL_TEST_CTX_create (merge conflict error). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-13 23:46:12 +08:00
$OUT = "";
if (%server2) {
$OUT .= "\nserver2 = $testname-server2";
SSL tests: compress generated output a little Don't emit duplicate server/client sections when they are identical. Instead, just point to the same section. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-22 01:19:07 +08:00
} elsif ($reuse_server2) {
$OUT .= "\nserver2 = $testname-server";
SSL test: only write out server2 when testing SNI The SNI tests introduced a redundant "server2" section into every test configuration. Copy this automatically from "server" unless testing SNI, to reduce noise in the generated confs. Also remove duplicate SSL_TEST_CTX_create (merge conflict error). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-13 23:46:12 +08:00
}
SSL test framework: port resumption tests Systematically test every server-side version downgrade or upgrade. Client version upgrade or downgrade could be tested analogously but will be done in a later change. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-06 01:06:23 +08:00
if (%resume_server) {
$OUT .= "\nresume-server = $testname-resume-server";
SSL tests: compress generated output a little Don't emit duplicate server/client sections when they are identical. Instead, just point to the same section. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-22 01:19:07 +08:00
} elsif ($reuse_resume_server) {
$OUT .= "\nresume-server = $testname-server";
SSL test framework: port resumption tests Systematically test every server-side version downgrade or upgrade. Client version upgrade or downgrade could be tested analogously but will be done in a later change. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-06 01:06:23 +08:00
}
Test client-side resumption Add tests for resuming with a different client version. This happens in reality when clients persist sessions on disk through upgrades. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-21 20:04:00 +08:00
if (%resume_client) {
$OUT .= "\nresume-client = $testname-resume-client";
SSL tests: compress generated output a little Don't emit duplicate server/client sections when they are identical. Instead, just point to the same section. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-22 01:19:07 +08:00
} elsif ($reuse_resume_client) {
$OUT .= "\nresume-client = $testname-client";
Test client-side resumption Add tests for resuming with a different client version. This happens in reality when clients persist sessions on disk through upgrades. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-21 20:04:00 +08:00
}
SSL test: only write out server2 when testing SNI The SNI tests introduced a redundant "server2" section into every test configuration. Copy this automatically from "server" unless testing SNI, to reduce noise in the generated confs. Also remove duplicate SSL_TEST_CTX_create (merge conflict error). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-13 23:46:12 +08:00
-}
New SSL test framework Currently, SSL tests are configured via command-line switches to ssltest.c. This results in a lot of duplication between ssltest.c and apps, and a complex setup. ssltest.c is also simply old and needs maintenance. Instead, we already have a way to configure SSL servers and clients, so we leverage that. SSL tests can now be configured from a configuration file. Test servers and clients are configured using the standard ssl_conf module. Additional test settings are configured via a test configuration. Moreover, since the CONF language involves unnecessary boilerplate, the test conf itself is generated from a shorter Perl syntax. The generated testcase files are checked in to the repo to make it easier to verify that the intended test cases are in fact run; and to simplify debugging failures. To demonstrate the approach, min/max protocol tests are converted to the new format. This change also fixes MinProtocol and MaxProtocol handling. It was previously requested that an SSL_CTX have both the server and client flags set for these commands; this clearly can never work. Guide to this PR: - test/ssl_test.c - test framework - test/ssl_test_ctx.* - test configuration structure - test/handshake_helper.* - new SSL test handshaking code - test/ssl-tests/ - test configurations - test/generate_ssl_tests.pl - script for generating CONF-style test configurations from perl inputs Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-17 22:14:30 +08:00
[{-$testname-}-server]
{-
foreach my $key (sort keys %server) {
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
# Emitted in the test section.
next if ($key eq "extra");
New SSL test framework Currently, SSL tests are configured via command-line switches to ssltest.c. This results in a lot of duplication between ssltest.c and apps, and a complex setup. ssltest.c is also simply old and needs maintenance. Instead, we already have a way to configure SSL servers and clients, so we leverage that. SSL tests can now be configured from a configuration file. Test servers and clients are configured using the standard ssl_conf module. Additional test settings are configured via a test configuration. Moreover, since the CONF language involves unnecessary boilerplate, the test conf itself is generated from a shorter Perl syntax. The generated testcase files are checked in to the repo to make it easier to verify that the intended test cases are in fact run; and to simplify debugging failures. To demonstrate the approach, min/max protocol tests are converted to the new format. This change also fixes MinProtocol and MaxProtocol handling. It was previously requested that an SSL_CTX have both the server and client flags set for these commands; this clearly can never work. Guide to this PR: - test/ssl_test.c - test framework - test/ssl_test_ctx.* - test configuration structure - test/handshake_helper.* - new SSL test handshaking code - test/ssl-tests/ - test configurations - test/generate_ssl_tests.pl - script for generating CONF-style test configurations from perl inputs Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-17 22:14:30 +08:00
$OUT .= qq{$key} . " = " . qq{$server{$key}\n} if defined $server{$key};
}
SSL test: only write out server2 when testing SNI The SNI tests introduced a redundant "server2" section into every test configuration. Copy this automatically from "server" unless testing SNI, to reduce noise in the generated confs. Also remove duplicate SSL_TEST_CTX_create (merge conflict error). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-13 23:46:12 +08:00
if (%server2) {
$OUT .= "\n[$testname-server2]\n";
foreach my $key (sort keys %server2) {
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
next if ($key eq "extra");
SSL test: only write out server2 when testing SNI The SNI tests introduced a redundant "server2" section into every test configuration. Copy this automatically from "server" unless testing SNI, to reduce noise in the generated confs. Also remove duplicate SSL_TEST_CTX_create (merge conflict error). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-13 23:46:12 +08:00
$OUT .= qq{$key} . " = " . qq{$server2{$key}\n} if defined $server2{$key};
}
Fix session ticket and SNI When session tickets are used, it's possible that SNI might swtich the SSL_CTX on an SSL. Normally, this is not a problem, because the initial_ctx/session_ctx are used for all session ticket/id processes. However, when the SNI callback occurs, it's possible that the callback may update the options in the SSL from the SSL_CTX, and this could cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things can happen: 1. The session ticket TLSEXT may not be written when the ticket expected flag is set. The state machine transistions to writing the ticket, and the client responds with an error as its not expecting a ticket. 2. When creating the session ticket, if the ticket key cb returns 0 the crypto/hmac contexts are not initialized, and the code crashes when trying to encrypt the session ticket. To fix 1, if the ticket TLSEXT is not written out, clear the expected ticket flag. To fix 2, consider a return of 0 from the ticket key cb a recoverable error, and write a 0 length ticket and continue. The client-side code can explicitly handle this case. Fix these two cases, and add unit test code to validate ticket behavior. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-13 06:16:52 +08:00
}
SSL test framework: port resumption tests Systematically test every server-side version downgrade or upgrade. Client version upgrade or downgrade could be tested analogously but will be done in a later change. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-06 01:06:23 +08:00
if (%resume_server) {
$OUT .= "\n[$testname-resume-server]\n";
foreach my $key (sort keys %resume_server) {
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
next if ($key eq "extra");
SSL test framework: port resumption tests Systematically test every server-side version downgrade or upgrade. Client version upgrade or downgrade could be tested analogously but will be done in a later change. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-07-06 01:06:23 +08:00
$OUT .= qq{$key} . " = " . qq{$resume_server{$key}\n} if defined $resume_server{$key};
}
}
Fix session ticket and SNI When session tickets are used, it's possible that SNI might swtich the SSL_CTX on an SSL. Normally, this is not a problem, because the initial_ctx/session_ctx are used for all session ticket/id processes. However, when the SNI callback occurs, it's possible that the callback may update the options in the SSL from the SSL_CTX, and this could cause SSL_OP_NO_TICKET to be set. If this occurs, then two bad things can happen: 1. The session ticket TLSEXT may not be written when the ticket expected flag is set. The state machine transistions to writing the ticket, and the client responds with an error as its not expecting a ticket. 2. When creating the session ticket, if the ticket key cb returns 0 the crypto/hmac contexts are not initialized, and the code crashes when trying to encrypt the session ticket. To fix 1, if the ticket TLSEXT is not written out, clear the expected ticket flag. To fix 2, consider a return of 0 from the ticket key cb a recoverable error, and write a 0 length ticket and continue. The client-side code can explicitly handle this case. Fix these two cases, and add unit test code to validate ticket behavior. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1098)
2016-05-13 06:16:52 +08:00
-}
New SSL test framework Currently, SSL tests are configured via command-line switches to ssltest.c. This results in a lot of duplication between ssltest.c and apps, and a complex setup. ssltest.c is also simply old and needs maintenance. Instead, we already have a way to configure SSL servers and clients, so we leverage that. SSL tests can now be configured from a configuration file. Test servers and clients are configured using the standard ssl_conf module. Additional test settings are configured via a test configuration. Moreover, since the CONF language involves unnecessary boilerplate, the test conf itself is generated from a shorter Perl syntax. The generated testcase files are checked in to the repo to make it easier to verify that the intended test cases are in fact run; and to simplify debugging failures. To demonstrate the approach, min/max protocol tests are converted to the new format. This change also fixes MinProtocol and MaxProtocol handling. It was previously requested that an SSL_CTX have both the server and client flags set for these commands; this clearly can never work. Guide to this PR: - test/ssl_test.c - test framework - test/ssl_test_ctx.* - test configuration structure - test/handshake_helper.* - new SSL test handshaking code - test/ssl-tests/ - test configurations - test/generate_ssl_tests.pl - script for generating CONF-style test configurations from perl inputs Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-17 22:14:30 +08:00
[{-$testname-}-client]
{-
foreach my $key (sort keys %client) {
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
next if ($key eq "extra");
New SSL test framework Currently, SSL tests are configured via command-line switches to ssltest.c. This results in a lot of duplication between ssltest.c and apps, and a complex setup. ssltest.c is also simply old and needs maintenance. Instead, we already have a way to configure SSL servers and clients, so we leverage that. SSL tests can now be configured from a configuration file. Test servers and clients are configured using the standard ssl_conf module. Additional test settings are configured via a test configuration. Moreover, since the CONF language involves unnecessary boilerplate, the test conf itself is generated from a shorter Perl syntax. The generated testcase files are checked in to the repo to make it easier to verify that the intended test cases are in fact run; and to simplify debugging failures. To demonstrate the approach, min/max protocol tests are converted to the new format. This change also fixes MinProtocol and MaxProtocol handling. It was previously requested that an SSL_CTX have both the server and client flags set for these commands; this clearly can never work. Guide to this PR: - test/ssl_test.c - test framework - test/ssl_test_ctx.* - test configuration structure - test/handshake_helper.* - new SSL test handshaking code - test/ssl-tests/ - test configurations - test/generate_ssl_tests.pl - script for generating CONF-style test configurations from perl inputs Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-17 22:14:30 +08:00
$OUT .= qq{$key} . " = " . qq{$client{$key}\n} if defined $client{$key};
}
Test client-side resumption Add tests for resuming with a different client version. This happens in reality when clients persist sessions on disk through upgrades. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-21 20:04:00 +08:00
if (%resume_client) {
$OUT .= "\n[$testname-resume-client]\n";
foreach my $key (sort keys %resume_client) {
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
next if ($key eq "extra");
Test client-side resumption Add tests for resuming with a different client version. This happens in reality when clients persist sessions on disk through upgrades. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-21 20:04:00 +08:00
$OUT .= qq{$key} . " = " . qq{$resume_client{$key}\n} if defined $resume_client{$key};
}
}
New SSL test framework Currently, SSL tests are configured via command-line switches to ssltest.c. This results in a lot of duplication between ssltest.c and apps, and a complex setup. ssltest.c is also simply old and needs maintenance. Instead, we already have a way to configure SSL servers and clients, so we leverage that. SSL tests can now be configured from a configuration file. Test servers and clients are configured using the standard ssl_conf module. Additional test settings are configured via a test configuration. Moreover, since the CONF language involves unnecessary boilerplate, the test conf itself is generated from a shorter Perl syntax. The generated testcase files are checked in to the repo to make it easier to verify that the intended test cases are in fact run; and to simplify debugging failures. To demonstrate the approach, min/max protocol tests are converted to the new format. This change also fixes MinProtocol and MaxProtocol handling. It was previously requested that an SSL_CTX have both the server and client flags set for these commands; this clearly can never work. Guide to this PR: - test/ssl_test.c - test framework - test/ssl_test_ctx.* - test configuration structure - test/handshake_helper.* - new SSL test handshaking code - test/ssl-tests/ - test configurations - test/generate_ssl_tests.pl - script for generating CONF-style test configurations from perl inputs Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-17 22:14:30 +08:00
-}
[test-{-$idx-}]
{-
foreach my $key (sort keys %test) {
$OUT .= qq{$key} ." = " . qq{$test{$key}\n} if defined $test{$key};
}
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
# The extra server/client configuration sections.
if ($server{"extra"}) {
$OUT .= "server = $testname-server-extra\n";
}
if (%server2 && $server2{"extra"}) {
$OUT .= "server2 = $testname-server2-extra\n";
} elsif ($reuse_server2 && $server{"extra"}) {
$OUT .= "server2 = $testname-server-extra\n";
}
if (%resume_server && $resume_server{"extra"}) {
$OUT .= "resume-server = $testname-resume-server-extra\n";
} elsif ($reuse_resume_server && $server{"extra"}) {
$OUT .= "resume-server = $testname-server-extra\n";
}
if ($client{"extra"}) {
$OUT .= "client = $testname-client-extra\n";
}
if (%resume_client && $resume_client{"extra"}) {
$OUT .= "resume-client = $testname-resume-client-extra\n";
} elsif ($reuse_resume_client && $client{"extra"}) {
NPN and ALPN: test resumption In NPN and ALPN, the protocol is renegotiated upon resumption. Test that resumption picks up changes to the extension. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-08 20:42:08 +08:00
$OUT .= "resume-client = $testname-client-extra\n";
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
}
if ($server{"extra"}) {
$OUT .= "\n[$testname-server-extra]\n";
test/ssl_test.tmpl: make it work with elderly perl. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-12 22:25:33 +08:00
foreach my $key (sort keys %{$server{"extra"}}) {
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
$OUT .= qq{$key} . " = " . qq{$server{"extra"}{$key}\n}
if defined $server{"extra"}{$key};
}
}
if (%server2 && $server2{"extra"}) {
$OUT .= "\n[$testname-server2-extra]\n";
test/ssl_test.tmpl: make it work with elderly perl. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-12 22:25:33 +08:00
foreach my $key (sort keys %{$server2{"extra"}}) {
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
$OUT .= qq{$key} . " = " . qq{$server2{"extra"}{$key}\n}
if defined $server2{"extra"}{$key};
}
}
if (%resume_server && $resume_server{"extra"}) {
$OUT .= "\n[$testname-resume-server-extra]\n";
test/ssl_test.tmpl: make it work with elderly perl. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-12 22:25:33 +08:00
foreach my $key (sort keys %{$resume_server{"extra"}}) {
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
$OUT .= qq{$key} . " = " . qq{$resume_server{"extra"}{$key}\n}
if defined $resume_server{"extra"}{$key};
}
}
if ($client{"extra"}) {
$OUT .= "\n[$testname-client-extra]\n";
test/ssl_test.tmpl: make it work with elderly perl. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-12 22:25:33 +08:00
foreach my $key (sort keys %{$client{"extra"}}) {
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
$OUT .= qq{$key} . " = " . qq{$client{"extra"}{$key}\n}
if defined $client{"extra"}{$key};
}
}
if (%resume_client && $resume_client{"extra"}) {
$OUT .= "\n[$testname-resume-client-extra]\n";
test/ssl_test.tmpl: make it work with elderly perl. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-12 22:25:33 +08:00
foreach my $key (sort keys %{$resume_client{"extra"}}) {
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 22:29:48 +08:00
$OUT .= qq{$key} . " = " . qq{$resume_client{"extra"}{$key}\n}
if defined $resume_client{"extra"}{$key};
}
}
New SSL test framework Currently, SSL tests are configured via command-line switches to ssltest.c. This results in a lot of duplication between ssltest.c and apps, and a complex setup. ssltest.c is also simply old and needs maintenance. Instead, we already have a way to configure SSL servers and clients, so we leverage that. SSL tests can now be configured from a configuration file. Test servers and clients are configured using the standard ssl_conf module. Additional test settings are configured via a test configuration. Moreover, since the CONF language involves unnecessary boilerplate, the test conf itself is generated from a shorter Perl syntax. The generated testcase files are checked in to the repo to make it easier to verify that the intended test cases are in fact run; and to simplify debugging failures. To demonstrate the approach, min/max protocol tests are converted to the new format. This change also fixes MinProtocol and MaxProtocol handling. It was previously requested that an SSL_CTX have both the server and client flags set for these commands; this clearly can never work. Guide to this PR: - test/ssl_test.c - test framework - test/ssl_test_ctx.* - test configuration structure - test/handshake_helper.* - new SSL test handshaking code - test/ssl-tests/ - test configurations - test/generate_ssl_tests.pl - script for generating CONF-style test configurations from perl inputs Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-17 22:14:30 +08:00
-}
Reference in New Issue Copy Permalink