wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
openssl/test/ssl-tests/04-client_auth.conf.in

179 lines
6.4 KiB
Text
Raw Normal View History

Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
# -*- mode: perl; -*-
## SSL test configurations
package ssltests;
use strict;
use warnings;
use OpenSSL::Test;
use OpenSSL::Test::Utils qw(anydisabled);
setup("no_test_here");
# We test version-flexible negotiation (undef) and each protocol version.
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 13:56:22 +00:00
my @protocols = (undef, "SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", "DTLSv1", "DTLSv1.2");
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
my @is_disabled = (0);
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 13:56:22 +00:00
push @is_disabled, anydisabled("ssl3", "tls1", "tls1_1", "tls1_2", "dtls1", "dtls1_2");
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
our @tests = ();
sub generate_tests() {
foreach (0..$#protocols) {
my $protocol = $protocols[$_];
my $protocol_name = $protocol || "flex";
Fix SSLv3 ClientAuth alert checking In TLS during ClientAuth if the CA is not recognised you should get an UnknownCA alert. In SSLv3 this does not exist and you should get a BadCertificate alert. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 18:41:03 +00:00
my $caalert;
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 13:56:22 +00:00
my $method;
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
if (!$is_disabled[$_]) {
Fix SSLv3 ClientAuth alert checking In TLS during ClientAuth if the CA is not recognised you should get an UnknownCA alert. In SSLv3 this does not exist and you should get a BadCertificate alert. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 18:41:03 +00:00
if ($protocol_name eq "SSLv3") {
$caalert = "BadCertificate";
} else {
$caalert = "UnknownCA";
}
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 13:56:22 +00:00
if ($protocol_name =~ m/^DTLS/) {
$method = "DTLS";
}
Add signing hash tests Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2235)
2017-01-15 15:59:48 +00:00
my $clihash;
Add tests for client and server signature type Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2301)
2017-01-27 15:56:47 +00:00
my $clisigtype;
Add signing hash tests Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2235)
2017-01-15 15:59:48 +00:00
my $clisigalgs;
Add tests for client and server signature type Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2301)
2017-01-27 15:56:47 +00:00
# TODO(TLS1.3) add TLSv1.3 versions
Add signing hash tests Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2235)
2017-01-15 15:59:48 +00:00
if ($protocol_name eq "TLSv1.2") {
$clihash = "SHA256";
Add tests for client and server signature type Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2301)
2017-01-27 15:56:47 +00:00
$clisigtype = "RSA";
Add signing hash tests Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2235)
2017-01-15 15:59:48 +00:00
$clisigalgs = "SHA256+RSA";
}
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
# Sanity-check simple handshake.
push @tests, {
name => "server-auth-${protocol_name}",
server => {
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 15:34:26 +00:00
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
},
client => {
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 15:34:26 +00:00
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
},
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 13:56:22 +00:00
test => {
"ExpectedResult" => "Success",
"Method" => $method,
},
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
};
# Handshake with client cert requested but not required or received.
push @tests, {
name => "client-auth-${protocol_name}-request",
server => {
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 15:34:26 +00:00
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"VerifyMode" => "Request"
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
},
client => {
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 15:34:26 +00:00
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
},
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 13:56:22 +00:00
test => {
"ExpectedResult" => "Success",
"Method" => $method,
},
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
};
# Handshake with client cert required but not present.
push @tests, {
name => "client-auth-${protocol_name}-require-fail",
server => {
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 15:34:26 +00:00
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
Add and use function test_pem to work out test filenames. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2667)
2017-02-16 15:27:49 +00:00
"VerifyCAFile" => test_pem("root-cert.pem"),
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
"VerifyMode" => "Require",
},
client => {
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 15:34:26 +00:00
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
},
test => {
"ExpectedResult" => "ServerFail",
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 14:29:48 +00:00
"ExpectedServerAlert" => "HandshakeFailure",
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 13:56:22 +00:00
"Method" => $method,
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
},
};
# Successful handshake with client authentication.
push @tests, {
name => "client-auth-${protocol_name}-require",
server => {
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 15:34:26 +00:00
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
Add signing hash tests Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2235)
2017-01-15 15:59:48 +00:00
"ClientSignatureAlgorithms" => $clisigalgs,
Add and use function test_pem to work out test filenames. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2667)
2017-02-16 15:27:49 +00:00
"VerifyCAFile" => test_pem("root-cert.pem"),
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
"VerifyMode" => "Request",
},
client => {
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 15:34:26 +00:00
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
Add and use function test_pem to work out test filenames. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2667)
2017-02-16 15:27:49 +00:00
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
},
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 13:56:22 +00:00
test => {
"ExpectedResult" => "Success",
"ExpectedClientCertType" => "RSA",
"ExpectedClientSignType" => $clisigtype,
"ExpectedClientSignHash" => $clihash,
Add Client CA names tests Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2969)
2017-03-15 17:26:05 +00:00
"ExpectedClientCANames" => "empty",
"Method" => $method,
},
};
# Successful handshake with client authentication non-empty names
push @tests, {
name => "client-auth-${protocol_name}-require-non-empty-names",
server => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"ClientSignatureAlgorithms" => $clisigalgs,
"ClientCAFile" => test_pem("root-cert.pem"),
"VerifyCAFile" => test_pem("root-cert.pem"),
"VerifyMode" => "Request",
},
client => {
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
},
test => {
"ExpectedResult" => "Success",
"ExpectedClientCertType" => "RSA",
"ExpectedClientSignType" => $clisigtype,
"ExpectedClientSignHash" => $clihash,
"ExpectedClientCANames" => test_pem("root-cert.pem"),
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 13:56:22 +00:00
"Method" => $method,
Add client cert type tests Reviewed-by: Emilia Käsper <emilia@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2224)
2017-01-13 17:41:48 +00:00
},
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
};
# Handshake with client authentication but without the root certificate.
push @tests, {
name => "client-auth-${protocol_name}-noroot",
server => {
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 15:34:26 +00:00
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
"VerifyMode" => "Require",
},
client => {
Fix Client Auth tests The Client Auth tests were not correctly setting the Protocol, so that this aspect had no effect. It was testing the same thing lots of times for TLSv1.2 every time. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-22 15:34:26 +00:00
"MinProtocol" => $protocol,
"MaxProtocol" => $protocol,
Add and use function test_pem to work out test filenames. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2667)
2017-02-16 15:27:49 +00:00
"Certificate" => test_pem("ee-client-chain.pem"),
"PrivateKey" => test_pem("ee-key.pem"),
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
},
test => {
"ExpectedResult" => "ServerFail",
Reorganize SSL test structures Move custom server and client options from the test dictionary to an "extra" section of each server/client. Rename test expectations to say "Expected". This is a big but straightforward change. Primarily, this allows us to specify multiple server and client contexts without redefining the custom options for each of them. For example, instead of "ServerNPNProtocols", "Server2NPNProtocols", "ResumeServerNPNProtocols", we now have, "NPNProtocols". This simplifies writing resumption and SNI tests. The first application will be resumption tests for NPN and ALPN. Regrouping the options also makes it clearer which options apply to the server, which apply to the client, which configure the test, and which are test expectations. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-21 14:29:48 +00:00
"ExpectedServerAlert" => $caalert,
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 13:56:22 +00:00
"Method" => $method,
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
},
};
}
}
}
Port remaining old DTLS tests We already test DTLS protocol versions. For good measure, add some DTLS tests with client auth to the new test framework, so that we can remove the old tests without losing coverage. Reviewed-by: Richard Levitte <levitte@openssl.org>
2017-03-14 13:56:22 +00:00
Update client authentication tests Port client auth tests to the new framework, add coverage. The old tests were only testing success, and only for some protocol versions; the new tests add all protocol versions and various failure modes. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-05-31 14:42:58 +00:00
generate_tests();
Reference in a new issue Copy permalink