mirror of
https://github.com/openssl/openssl.git
synced 2024-12-27 06:21:43 +08:00
336d92eb20
Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17989)
278 lines
12 KiB
Perl
278 lines
12 KiB
Perl
# -*- mode: perl; -*-
|
|
|
|
## SSL test configurations
|
|
|
|
package ssltests;
|
|
|
|
use strict;
|
|
use warnings;
|
|
|
|
use OpenSSL::Test;
|
|
use OpenSSL::Test::Utils qw(anydisabled disabled);
|
|
setup("no_test_here");
|
|
|
|
our $fips_mode;
|
|
|
|
my @protocols;
|
|
my @is_disabled = (0);
|
|
|
|
# We test version-flexible negotiation (undef) and each protocol version.
|
|
if ($fips_mode) {
|
|
@protocols = (undef, "TLSv1.2", "DTLSv1.2");
|
|
push @is_disabled, anydisabled("tls1_2", "dtls1_2");
|
|
} else {
|
|
@protocols = (undef, "SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", "DTLSv1", "DTLSv1.2");
|
|
push @is_disabled, anydisabled("ssl3", "tls1", "tls1_1", "tls1_2", "dtls1", "dtls1_2");
|
|
}
|
|
|
|
our @tests = ();
|
|
|
|
sub generate_tests() {
|
|
foreach (0..$#protocols) {
|
|
my $protocol = $protocols[$_];
|
|
my $protocol_name = $protocol || "flex";
|
|
my $caalert;
|
|
my $method;
|
|
my $sctpenabled = 0;
|
|
if (!$is_disabled[$_]) {
|
|
if ($protocol_name eq "SSLv3") {
|
|
$caalert = "BadCertificate";
|
|
} else {
|
|
$caalert = "UnknownCA";
|
|
}
|
|
if ($protocol_name =~ m/^DTLS/) {
|
|
$method = "DTLS";
|
|
$sctpenabled = 1 if !disabled("sctp");
|
|
}
|
|
my $clihash;
|
|
my $clisigtype;
|
|
my $clisigalgs;
|
|
# TODO(TLS1.3) add TLSv1.3 versions
|
|
if ($protocol_name eq "TLSv1.2") {
|
|
$clihash = "SHA256";
|
|
$clisigtype = "RSA";
|
|
$clisigalgs = "SHA256+RSA";
|
|
}
|
|
for (my $sctp = 0; $sctp <= $sctpenabled; $sctp++) {
|
|
# Sanity-check simple handshake.
|
|
push @tests, {
|
|
name => "server-auth-${protocol_name}"
|
|
.($sctp ? "-sctp" : ""),
|
|
server => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol
|
|
},
|
|
client => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol
|
|
},
|
|
test => {
|
|
"ExpectedResult" => "Success",
|
|
"Method" => $method,
|
|
},
|
|
};
|
|
$tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
|
|
|
|
# Handshake with client cert requested but not required or received.
|
|
push @tests, {
|
|
name => "client-auth-${protocol_name}-request"
|
|
.($sctp ? "-sctp" : ""),
|
|
server => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol,
|
|
"VerifyMode" => "Request"
|
|
},
|
|
client => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol
|
|
},
|
|
test => {
|
|
"ExpectedResult" => "Success",
|
|
"Method" => $method,
|
|
},
|
|
};
|
|
$tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
|
|
|
|
# Handshake with client cert required but not present.
|
|
push @tests, {
|
|
name => "client-auth-${protocol_name}-require-fail"
|
|
.($sctp ? "-sctp" : ""),
|
|
server => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol,
|
|
"VerifyCAFile" => test_pem("root-cert.pem"),
|
|
"VerifyMode" => "Require",
|
|
},
|
|
client => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol
|
|
},
|
|
test => {
|
|
"ExpectedResult" => "ServerFail",
|
|
"ExpectedServerAlert" =>
|
|
($protocol_name eq "flex"
|
|
&& !disabled("tls1_3")
|
|
&& (!disabled("ec") || !disabled("dh")))
|
|
? "CertificateRequired" : "HandshakeFailure",
|
|
"Method" => $method,
|
|
},
|
|
};
|
|
$tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
|
|
|
|
# Successful handshake with client authentication.
|
|
push @tests, {
|
|
name => "client-auth-${protocol_name}-require"
|
|
.($sctp ? "-sctp" : ""),
|
|
server => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol,
|
|
"ClientSignatureAlgorithms" => $clisigalgs,
|
|
"VerifyCAFile" => test_pem("root-cert.pem"),
|
|
"VerifyMode" => "Request",
|
|
},
|
|
client => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol,
|
|
"Certificate" => test_pem("ee-client-chain.pem"),
|
|
"PrivateKey" => test_pem("ee-key.pem"),
|
|
},
|
|
test => {
|
|
"ExpectedResult" => "Success",
|
|
"ExpectedClientCertType" => "RSA",
|
|
"ExpectedClientSignType" => $clisigtype,
|
|
"ExpectedClientSignHash" => $clihash,
|
|
"ExpectedClientCANames" => "empty",
|
|
"Method" => $method,
|
|
},
|
|
};
|
|
$tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
|
|
|
|
# Successful handshake with client RSA-PSS cert, StrictCertCheck
|
|
push @tests, {
|
|
name => "client-auth-${protocol_name}-rsa-pss"
|
|
.($sctp ? "-sctp" : ""),
|
|
server => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol,
|
|
"ClientCAFile" => test_pem("rootcert.pem"),
|
|
"VerifyCAFile" => test_pem("rootcert.pem"),
|
|
"VerifyMode" => "Require",
|
|
},
|
|
client => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol,
|
|
"Certificate" => test_pem("client-pss-restrict-cert.pem"),
|
|
"PrivateKey" => test_pem("client-pss-restrict-key.pem"),
|
|
"Options" => "StrictCertCheck",
|
|
},
|
|
test => {
|
|
"ExpectedResult" => "Success",
|
|
"ExpectedClientCertType" => "RSA-PSS",
|
|
"ExpectedClientCANames" => test_pem("rootcert.pem"),
|
|
"Method" => $method,
|
|
},
|
|
} if $protocol_name eq "TLSv1.2" || $protocol_name eq "flex";
|
|
|
|
# Failed handshake with client RSA-PSS cert, StrictCertCheck, bad CA
|
|
push @tests, {
|
|
name => "client-auth-${protocol_name}-rsa-pss-bad"
|
|
.($sctp ? "-sctp" : ""),
|
|
server => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol,
|
|
"ClientCAFile" => test_pem("rootCA.pem"),
|
|
"VerifyCAFile" => test_pem("rootCA.pem"),
|
|
"VerifyMode" => "Require",
|
|
},
|
|
client => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol,
|
|
"Certificate" => test_pem("client-pss-restrict-cert.pem"),
|
|
"PrivateKey" => test_pem("client-pss-restrict-key.pem"),
|
|
"Options" => "StrictCertCheck",
|
|
},
|
|
test => {
|
|
"ExpectedResult" => "ServerFail",
|
|
"ExpectedServerAlert" =>
|
|
($protocol_name eq "flex"
|
|
&& !disabled("tls1_3")
|
|
&& (!disabled("ec") || !disabled("dh")))
|
|
? "CertificateRequired" : "HandshakeFailure",
|
|
"Method" => $method,
|
|
},
|
|
} if $protocol_name eq "TLSv1.2" || $protocol_name eq "flex";
|
|
|
|
# Successful handshake with client authentication non-empty names
|
|
push @tests, {
|
|
name => "client-auth-${protocol_name}-require-non-empty-names"
|
|
.($sctp ? "-sctp" : ""),
|
|
server => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol,
|
|
"ClientSignatureAlgorithms" => $clisigalgs,
|
|
"ClientCAFile" => test_pem("root-cert.pem"),
|
|
"VerifyCAFile" => test_pem("root-cert.pem"),
|
|
"VerifyMode" => "Request",
|
|
},
|
|
client => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol,
|
|
"Certificate" => test_pem("ee-client-chain.pem"),
|
|
"PrivateKey" => test_pem("ee-key.pem"),
|
|
},
|
|
test => {
|
|
"ExpectedResult" => "Success",
|
|
"ExpectedClientCertType" => "RSA",
|
|
"ExpectedClientSignType" => $clisigtype,
|
|
"ExpectedClientSignHash" => $clihash,
|
|
"ExpectedClientCANames" => test_pem("root-cert.pem"),
|
|
"Method" => $method,
|
|
},
|
|
};
|
|
$tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
|
|
|
|
# Handshake with client authentication but without the root certificate.
|
|
push @tests, {
|
|
name => "client-auth-${protocol_name}-noroot"
|
|
.($sctp ? "-sctp" : ""),
|
|
server => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol,
|
|
"VerifyMode" => "Require",
|
|
},
|
|
client => {
|
|
"CipherString" => "DEFAULT:\@SECLEVEL=0",
|
|
"MinProtocol" => $protocol,
|
|
"MaxProtocol" => $protocol,
|
|
"Certificate" => test_pem("ee-client-chain.pem"),
|
|
"PrivateKey" => test_pem("ee-key.pem"),
|
|
},
|
|
test => {
|
|
"ExpectedResult" => "ServerFail",
|
|
"ExpectedServerAlert" => $caalert,
|
|
"Method" => $method,
|
|
},
|
|
};
|
|
$tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
generate_tests();
|