diff options
author | Benjamin Kaduk <bkaduk@akamai.com> | 2017-01-31 16:06:30 -0600 |
---|---|---|
committer | Richard Levitte <levitte@openssl.org> | 2017-02-23 19:40:26 +0100 |
commit | 80de0c5947cf29ef04227714f3cae5c615012449 (patch) | |
tree | 8753246d8ee071bb924e7972631f058f785ba8f9 /test/ssl-tests | |
parent | 6b1bb98fad044a6f6b1aec9daee95d6cb450210e (diff) |
Tests for SSL early callback
Plumb things through in the same place as the SNI callback, since
we recommend that the early callback replace (and supplement) the
SNI callback, and add a few test cases.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2279)
Diffstat (limited to 'test/ssl-tests')
-rw-r--r-- | test/ssl-tests/05-sni.conf | 107 | ||||
-rw-r--r-- | test/ssl-tests/05-sni.conf.in | 57 |
2 files changed, 163 insertions, 1 deletions
diff --git a/test/ssl-tests/05-sni.conf b/test/ssl-tests/05-sni.conf index e1fb3d9d89..d5d350e399 100644 --- a/test/ssl-tests/05-sni.conf +++ b/test/ssl-tests/05-sni.conf @@ -1,6 +1,6 @@ # Generated with generate_ssl_tests.pl -num_tests = 6 +num_tests = 9 test-0 = 0-SNI-switch-context test-1 = 1-SNI-keep-context @@ -8,6 +8,9 @@ test-2 = 2-SNI-no-server-support test-3 = 3-SNI-no-client-support test-4 = 4-SNI-bad-sni-ignore-mismatch test-5 = 5-SNI-bad-sni-reject-mismatch +test-6 = 6-SNI-bad-early-sni-ignore-mismatch +test-7 = 7-SNI-bad-early-sni-reject-mismatch +test-8 = 8-SNI-early-disable-v12 # =========================================================== [0-SNI-switch-context] @@ -201,3 +204,105 @@ ServerNameCallback = RejectMismatch ServerName = invalid +# =========================================================== + +[6-SNI-bad-early-sni-ignore-mismatch] +ssl_conf = 6-SNI-bad-early-sni-ignore-mismatch-ssl + +[6-SNI-bad-early-sni-ignore-mismatch-ssl] +server = 6-SNI-bad-early-sni-ignore-mismatch-server +client = 6-SNI-bad-early-sni-ignore-mismatch-client +server2 = 6-SNI-bad-early-sni-ignore-mismatch-server + +[6-SNI-bad-early-sni-ignore-mismatch-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[6-SNI-bad-early-sni-ignore-mismatch-client] +CipherString = DEFAULT +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-6] +ExpectedResult = Success +ExpectedServerName = server1 +server = 6-SNI-bad-early-sni-ignore-mismatch-server-extra +server2 = 6-SNI-bad-early-sni-ignore-mismatch-server-extra +client = 6-SNI-bad-early-sni-ignore-mismatch-client-extra + +[6-SNI-bad-early-sni-ignore-mismatch-server-extra] +ServerNameCallback = EarlyIgnoreMismatch + +[6-SNI-bad-early-sni-ignore-mismatch-client-extra] +ServerName = invalid + + +# =========================================================== + +[7-SNI-bad-early-sni-reject-mismatch] +ssl_conf = 7-SNI-bad-early-sni-reject-mismatch-ssl + +[7-SNI-bad-early-sni-reject-mismatch-ssl] +server = 7-SNI-bad-early-sni-reject-mismatch-server +client = 7-SNI-bad-early-sni-reject-mismatch-client +server2 = 7-SNI-bad-early-sni-reject-mismatch-server + +[7-SNI-bad-early-sni-reject-mismatch-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[7-SNI-bad-early-sni-reject-mismatch-client] +CipherString = DEFAULT +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-7] +ExpectedResult = ServerFail +ExpectedServerAlert = UnrecognizedName +server = 7-SNI-bad-early-sni-reject-mismatch-server-extra +server2 = 7-SNI-bad-early-sni-reject-mismatch-server-extra +client = 7-SNI-bad-early-sni-reject-mismatch-client-extra + +[7-SNI-bad-early-sni-reject-mismatch-server-extra] +ServerNameCallback = EarlyRejectMismatch + +[7-SNI-bad-early-sni-reject-mismatch-client-extra] +ServerName = invalid + + +# =========================================================== + +[8-SNI-early-disable-v12] +ssl_conf = 8-SNI-early-disable-v12-ssl + +[8-SNI-early-disable-v12-ssl] +server = 8-SNI-early-disable-v12-server +client = 8-SNI-early-disable-v12-client +server2 = 8-SNI-early-disable-v12-server + +[8-SNI-early-disable-v12-server] +Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem +CipherString = DEFAULT +PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem + +[8-SNI-early-disable-v12-client] +CipherString = DEFAULT +VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem +VerifyMode = Peer + +[test-8] +ExpectedProtocol = TLSv1.1 +ExpectedServerName = server2 +server = 8-SNI-early-disable-v12-server-extra +server2 = 8-SNI-early-disable-v12-server-extra +client = 8-SNI-early-disable-v12-client-extra + +[8-SNI-early-disable-v12-server-extra] +ServerNameCallback = EarlyNoV12 + +[8-SNI-early-disable-v12-client-extra] +ServerName = server2 + + diff --git a/test/ssl-tests/05-sni.conf.in b/test/ssl-tests/05-sni.conf.in index 76003e7623..63b295dac8 100644 --- a/test/ssl-tests/05-sni.conf.in +++ b/test/ssl-tests/05-sni.conf.in @@ -13,6 +13,7 @@ use strict; use warnings; package ssltests; +use OpenSSL::Test::Utils; our @tests = ( { @@ -109,4 +110,60 @@ our @tests = ( "ExpectedServerAlert" => "UnrecognizedName" }, }, + { + name => "SNI-bad-early-sni-ignore-mismatch", + server => { + extra => { + "ServerNameCallback" => "EarlyIgnoreMismatch", + }, + }, + client => { + extra => { + "ServerName" => "invalid", + }, + }, + test => { + "ExpectedServerName" => "server1", + "ExpectedResult" => "Success" + }, + }, + { + name => "SNI-bad-early-sni-reject-mismatch", + server => { + extra => { + "ServerNameCallback" => "EarlyRejectMismatch", + }, + }, + client => { + extra => { + "ServerName" => "invalid", + }, + }, + test => { + "ExpectedResult" => "ServerFail", + "ExpectedServerAlert" => "UnrecognizedName" + }, + }, ); + +our @tests_tls_1_1 = ( + { + name => "SNI-early-disable-v12", + server => { + extra => { + "ServerNameCallback" => "EarlyNoV12", + }, + }, + client => { + extra => { + "ServerName" => "server2", + }, + }, + test => { + "ExpectedProtocol" => "TLSv1.1", + "ExpectedServerName" => "server2", + }, + }, +); + +push @tests, @tests_tls_1_1 unless disabled("tls1_1"); |