SSL test framework: port SNI tests

Observe that the old tests were partly ill-defined:
setting sn_server1 but not sn_server2 in ssltest_old.c does not enable
the SNI callback.

Fix this, and also explicitly test both flavours of SNI mismatch (ignore
/ fatal alert). Tests still pass.

Reviewed-by: Rich Salz <rsalz@openssl.org>

4 files changed, 259 insertions, 13 deletions

diff --git a/test/ssl-tests/05-sni.conf b/test/ssl-tests/05-sni.conf
index be219d519c..ef6db27ca1 100644
--- a/test/ssl-tests/05-sni.conf
+++ b/test/ssl-tests/05-sni.conf
@@ -1,35 +1,193 @@
 # Generated with generate_ssl_tests.pl
 
-num_tests = 1
+num_tests = 6
 
-test-0 = 0-SNI-default
+test-0 = 0-SNI-switch-context
+test-1 = 1-SNI-keep-context
+test-2 = 2-SNI-no-server-support
+test-3 = 3-SNI-no-client-support
+test-4 = 4-SNI-bad-sni-ignore-mismatch
+test-5 = 5-SNI-bad-sni-reject-mismatch
 # ===========================================================
 
-[0-SNI-default]
-ssl_conf = 0-SNI-default-ssl
+[0-SNI-switch-context]
+ssl_conf = 0-SNI-switch-context-ssl
 
-[0-SNI-default-ssl]
-server = 0-SNI-default-server
-server2 = 0-SNI-default-server2
-client = 0-SNI-default-client
+[0-SNI-switch-context-ssl]
+server = 0-SNI-switch-context-server
+server2 = 0-SNI-switch-context-server2
+client = 0-SNI-switch-context-client
 
-[0-SNI-default-server]
+[0-SNI-switch-context-server]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[0-SNI-default-server2]
+[0-SNI-switch-context-server2]
 Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
 CipherString = DEFAULT
 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
 
-[0-SNI-default-client]
+[0-SNI-switch-context-client]
 CipherString = DEFAULT
 VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
 VerifyMode = Peer
 
 [test-0]
 ExpectedResult = Success
+ExpectedServerName = server2
 ServerName = server2
+ServerNameCallback = IgnoreMismatch
+
+
+# ===========================================================
+
+[1-SNI-keep-context]
+ssl_conf = 1-SNI-keep-context-ssl
+
+[1-SNI-keep-context-ssl]
+server = 1-SNI-keep-context-server
+server2 = 1-SNI-keep-context-server2
+client = 1-SNI-keep-context-client
+
+[1-SNI-keep-context-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[1-SNI-keep-context-server2]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[1-SNI-keep-context-client]
+CipherString = DEFAULT
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-1]
+ExpectedResult = Success
+ExpectedServerName = server1
+ServerName = server1
+ServerNameCallback = IgnoreMismatch
+
+
+# ===========================================================
+
+[2-SNI-no-server-support]
+ssl_conf = 2-SNI-no-server-support-ssl
+
+[2-SNI-no-server-support-ssl]
+server = 2-SNI-no-server-support-server
+client = 2-SNI-no-server-support-client
+
+[2-SNI-no-server-support-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[2-SNI-no-server-support-client]
+CipherString = DEFAULT
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-2]
+ExpectedResult = Success
+ServerName = server1
+
+
+# ===========================================================
+
+[3-SNI-no-client-support]
+ssl_conf = 3-SNI-no-client-support-ssl
+
+[3-SNI-no-client-support-ssl]
+server = 3-SNI-no-client-support-server
+server2 = 3-SNI-no-client-support-server2
+client = 3-SNI-no-client-support-client
+
+[3-SNI-no-client-support-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[3-SNI-no-client-support-server2]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[3-SNI-no-client-support-client]
+CipherString = DEFAULT
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-3]
+ExpectedResult = Success
+ExpectedServerName = server1
+ServerNameCallback = IgnoreMismatch
+
+
+# ===========================================================
+
+[4-SNI-bad-sni-ignore-mismatch]
+ssl_conf = 4-SNI-bad-sni-ignore-mismatch-ssl
+
+[4-SNI-bad-sni-ignore-mismatch-ssl]
+server = 4-SNI-bad-sni-ignore-mismatch-server
+server2 = 4-SNI-bad-sni-ignore-mismatch-server2
+client = 4-SNI-bad-sni-ignore-mismatch-client
+
+[4-SNI-bad-sni-ignore-mismatch-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[4-SNI-bad-sni-ignore-mismatch-server2]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[4-SNI-bad-sni-ignore-mismatch-client]
+CipherString = DEFAULT
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-4]
+ExpectedResult = Success
+ExpectedServerName = server1
+ServerName = invalid
+ServerNameCallback = IgnoreMismatch
+
+
+# ===========================================================
+
+[5-SNI-bad-sni-reject-mismatch]
+ssl_conf = 5-SNI-bad-sni-reject-mismatch-ssl
+
+[5-SNI-bad-sni-reject-mismatch-ssl]
+server = 5-SNI-bad-sni-reject-mismatch-server
+server2 = 5-SNI-bad-sni-reject-mismatch-server2
+client = 5-SNI-bad-sni-reject-mismatch-client
+
+[5-SNI-bad-sni-reject-mismatch-server]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[5-SNI-bad-sni-reject-mismatch-server2]
+Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
+CipherString = DEFAULT
+PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
+
+[5-SNI-bad-sni-reject-mismatch-client]
+CipherString = DEFAULT
+VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
+VerifyMode = Peer
+
+[test-5]
+ExpectedResult = ServerFail
+ServerAlert = UnrecognizedName
+ServerName = invalid
+ServerNameCallback = RejectMismatch
 
 
diff --git a/test/ssl-tests/05-sni.conf.in b/test/ssl-tests/05-sni.conf.in
index de8dc77863..635ce9ae47 100644
--- a/test/ssl-tests/05-sni.conf.in
+++ b/test/ssl-tests/05-sni.conf.in
@@ -16,11 +16,64 @@ package ssltests;
 
 our @tests = (
     {
-        name => "SNI-default",
+        name => "SNI-switch-context",
         server => { },
         server2 => { },
         client => { },
         test   => { "ServerName" => "server2",
-		    "ExpectedResult" => "Success" },
+                    "ExpectedServerName" => "server2",
+                    "ServerNameCallback" => "IgnoreMismatch",
+                    "ExpectedResult" => "Success" },
+    },
+    {
+        name => "SNI-keep-context",
+        server => { },
+        server2 => { },
+        client => { },
+        test   => { "ServerName" => "server1",
+                    "ExpectedServerName" => "server1",
+                    "ServerNameCallback" => "IgnoreMismatch",
+                    "ExpectedResult" => "Success" },
+    },
+    {
+        name => "SNI-no-server-support",
+        server => { },
+        client => { },
+        test   => { "ServerName" => "server1",
+                    "ExpectedResult" => "Success" },
+    },
+    {
+        name => "SNI-no-client-support",
+        server => { },
+        server2 => { },
+        client => { },
+        test   => {
+            # We expect that the callback is still called
+            # to let the application decide whether they tolerate
+            # missing SNI (as our test callback does).
+            "ExpectedServerName" => "server1",
+            "ServerNameCallback" => "IgnoreMismatch",
+            "ExpectedResult" => "Success"
+        },
+    },
+    {
+        name => "SNI-bad-sni-ignore-mismatch",
+        server => { },
+        server2 => { },
+        client => { },
+        test   => { "ServerName" => "invalid",
+                    "ExpectedServerName" => "server1",
+                    "ServerNameCallback" => "IgnoreMismatch",
+                    "ExpectedResult" => "Success" },
+    },
+    {
+        name => "SNI-bad-sni-reject-mismatch",
+        server => { },
+        server2 => { },
+        client => { },
+        test   => { "ServerName" => "invalid",
+                    "ServerNameCallback" => "RejectMismatch",
+                    "ExpectedResult" => "ServerFail",
+                    "ServerAlert" => "UnrecognizedName"},
     },
 );
diff --git a/test/ssl-tests/06-sni-ticket.conf b/test/ssl-tests/06-sni-ticket.conf
index 99484ed4c8..b3bfda0b91 100644
--- a/test/ssl-tests/06-sni-ticket.conf
+++ b/test/ssl-tests/06-sni-ticket.conf
@@ -83,7 +83,9 @@ VerifyMode = Peer
 
 [test-1]
 ExpectedResult = Success
+ExpectedServerName = server1
 ServerName = server1
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = Yes
 
 
@@ -117,7 +119,9 @@ VerifyMode = Peer
 
 [test-2]
 ExpectedResult = Success
+ExpectedServerName = server2
 ServerName = server2
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = Yes
 
 
@@ -151,7 +155,9 @@ VerifyMode = Peer
 
 [test-3]
 ExpectedResult = Success
+ExpectedServerName = server1
 ServerName = server1
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = Yes
 
 
@@ -185,7 +191,9 @@ VerifyMode = Peer
 
 [test-4]
 ExpectedResult = Success
+ExpectedServerName = server2
 ServerName = server2
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = No
 
 
@@ -219,7 +227,9 @@ VerifyMode = Peer
 
 [test-5]
 ExpectedResult = Success
+ExpectedServerName = server1
 ServerName = server1
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = No
 
 
@@ -253,7 +263,9 @@ VerifyMode = Peer
 
 [test-6]
 ExpectedResult = Success
+ExpectedServerName = server2
 ServerName = server2
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = No
 
 
@@ -287,7 +299,9 @@ VerifyMode = Peer
 
 [test-7]
 ExpectedResult = Success
+ExpectedServerName = server1
 ServerName = server1
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = No
 
 
@@ -321,7 +335,9 @@ VerifyMode = Peer
 
 [test-8]
 ExpectedResult = Success
+ExpectedServerName = server2
 ServerName = server2
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = No
 
 
@@ -355,7 +371,9 @@ VerifyMode = Peer
 
 [test-9]
 ExpectedResult = Success
+ExpectedServerName = server1
 ServerName = server1
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = No
 
 
@@ -389,7 +407,9 @@ VerifyMode = Peer
 
 [test-10]
 ExpectedResult = Success
+ExpectedServerName = server2
 ServerName = server2
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = No
 
 
@@ -423,7 +443,9 @@ VerifyMode = Peer
 
 [test-11]
 ExpectedResult = Success
+ExpectedServerName = server1
 ServerName = server1
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = No
 
 
@@ -457,7 +479,9 @@ VerifyMode = Peer
 
 [test-12]
 ExpectedResult = Success
+ExpectedServerName = server2
 ServerName = server2
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = No
 
 
@@ -491,7 +515,9 @@ VerifyMode = Peer
 
 [test-13]
 ExpectedResult = Success
+ExpectedServerName = server1
 ServerName = server1
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = No
 
 
@@ -525,7 +551,9 @@ VerifyMode = Peer
 
 [test-14]
 ExpectedResult = Success
+ExpectedServerName = server2
 ServerName = server2
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = No
 
 
@@ -559,7 +587,9 @@ VerifyMode = Peer
 
 [test-15]
 ExpectedResult = Success
+ExpectedServerName = server1
 ServerName = server1
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = No
 
 
@@ -593,7 +623,9 @@ VerifyMode = Peer
 
 [test-16]
 ExpectedResult = Success
+ExpectedServerName = server2
 ServerName = server2
+ServerNameCallback = IgnoreMismatch
 SessionTicketExpected = No
 
 
diff --git a/test/ssl-tests/06-sni-ticket.conf.in b/test/ssl-tests/06-sni-ticket.conf.in
index 6cd57b61ad..8c95827a52 100644
--- a/test/ssl-tests/06-sni-ticket.conf.in
+++ b/test/ssl-tests/06-sni-ticket.conf.in
@@ -36,6 +36,9 @@ sub generate_tests() {
 			},
                         "test" => {
                             "ServerName" => $n,
+                            "ExpectedServerName" => $n,
+                            # We don't test mismatch here.
+                            "ServerNameCallback" => "IgnoreMismatch",
                             "ExpectedResult" => "Success",
 			    "SessionTicketExpected" => $result,
                         }