summaryrefslogtreecommitdiffstats
path: root/util/TLSProxy
AgeCommit message (Collapse)Author
2017-05-31Wait longer for the server in TLSProxy to startMatt Caswell
In a recent PR (#3566) it seems that TLSProxy gave up trying to connect to the server process too quickly. This meant the test failed even though the server *did* eventually start. Currently we try 3 times to connect with a 0.1 second pause between each attempt. That is probably too aggressive. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3587)
2017-05-26Fix a Proxy race conditionMatt Caswell
Issue #3562 describes a problem where a race condition can occur in the Proxy such that a test "ok" line can appear in the middle of other text causing the test harness to miss it. The issue is that we do not wait for the client process to finish after the test is complete, so that process may continue to write data to stdout/stderr at the same time that the test harness does. This commit fixes TLSProxy so that we always wait for the client process to finish before continuing. Fixes #3562 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3567)
2017-05-09Add test for no change following an HRRMatt Caswell
Verify that we fail if we receive an HRR but no change will result in ClientHello2. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3414)
2017-05-03Update the TLSv1.3 version indicator for draft-20Matt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3371)
2017-04-28TLSProxy: When in debug mode, show the exact subprocess commandsRichard Levitte
When you want to debug a test that goes wrong, it's useful to know exactly what subprocess commands are run. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3342)
2017-03-29More typo fixesFdaSilvaYY
Fix some comments too [skip ci] Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3069)
2017-03-16Add some HRR testsMatt Caswell
Check that we handle changes of ciphersuite between HRR and ServerHello correctly. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2895)
2017-03-16HelloRetryRequest updates for draft-19Matt Caswell
Draft-19 changes the HRR transcript hash so that the initial ClientHello is replaced in the transcript with a special synthetic message_hash message that just contains a hash of ClientHello1 as its message body. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2895)
2017-03-16Update the TLSv1.3 version indicator for draft-19Matt Caswell
This change will mean we will lose interoperability with draft-18 implementations. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2895)
2017-03-15Fix a hang in tests that use sessionfileMatt Caswell
The logic for testing whether the sessionfile has been created or not was faulty and could result in race conditions. If you "lose" the tests hang waiting for a session file that's never going to arrive. Fixes #2950 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2955)
2017-03-10Add a test to check that if a PSK extension is not last then we failMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2896)
2017-03-04Add a test for TLSv1.3 cookiesMatt Caswell
We just check that if we insert a cookie into an HRR it gets echoed back in the subsequent ClientHello. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2839)
2017-02-14Update TLSProxy to know about HelloRetryRequest messagesMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2341)
2017-02-14Update the key_share tests for HelloRetryRequestMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2341)
2017-01-30Add a capability for TLSProxy to wait for a session before killing s_clientMatt Caswell
TLSProxy normally fires off s_client, which creates a connection to the server. TLSProxy also pipes some data to send to the process and s_client automatically exits when the pipe hits eof. Unfortunately this means that it sends the data and closes before it has processed the NewSessionTicket returned from the server in TLSv1.3. This commits adds an option for s_client to stay loaded until the sesion has been processed. A side effect of this is that s_client never sends a close_notify in this mode, so we count success as seeing that data has been transferred. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-30Add support for the psk_key_exchange_modes extensionMatt Caswell
This is required for the later addition of resumption support. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-23Check the exit code from the server processBernd Edlinger
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2205)
2017-01-10Teach TLSProxy how to re-encrypt a TLSv1.3 message after changesMatt Caswell
This enables us to make changes to in-flight TLSv1.3 messages that appear after the ServerHello. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2157)
2017-01-10Extend ServerKeyExchange parsing to work with a signatureMatt Caswell
Previously SKE in TLSProxy only knew about one anonymous ciphersuite so there was never a signature. Extend that to include a ciphersuite that is not anonymous. This also fixes a bug where the existing SKE processing was checking against the wrong anon ciphersuite value. This has a knock on impact on the sslskewith0p test. The bug meant the test was working...but entirely by accident! Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2157)
2017-01-10Teach TLSProxy about the CertificateVerify messageMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2157)
2017-01-06Create Certificate messages in TLS1.3 formatMatt Caswell
Also updates TLSProxy to be able to understand the format and parse the contained extensions. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2020)
2016-12-29Add a test to check the EC point formats extension appears when we expectMatt Caswell
The previous commit fixed a bug where the EC point formats extensions did not appear in the ServerHello. This should have been caught by 70-test_sslmessages but that test never tries an EC ciphersuite. This updates the test to do that. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2153)
2016-12-08Fix various indentationMatt Caswell
The indentation was a bit off in some of the perl files following the extensions refactor. Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Remove some spurious whitespaceMatt Caswell
Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Fix a bug in TLSProxy where zero length messages were not being recordedMatt Caswell
Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Support renegotiation in TLSProxyMatt Caswell
Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Add tests for new extension codeMatt Caswell
Extend test_tls13messages to additionally check the expected extensions under different options given to s_client/s_server. Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Avoid repeatedly scanning the list of extensionsMatt Caswell
Because extensions were keyed by type which is sparse, we were continually scanning the list to find the one we wanted. The way we stored them also had the side effect that we were running initialisers/finalisers in a different oder to the parsers. In this commit we change things so that we instead key on an index value for each extension. Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Add EncryptedExtensions messageMatt Caswell
At this stage the message is just empty. We need to fill it in with extension data. Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-08Send and Receive a TLSv1.3 format ServerHelloMatt Caswell
There are some minor differences in the format of a ServerHello in TLSv1.3. Perl changes reviewed by Richard Levitte. Non-perl changes reviewed by Rich Salz Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-12-05Add more TLS1.3 record testsMatt Caswell
Add some tests for the new record construction Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-12-05Update the record layer to use TLSv1.3 style record constructionMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-29Use the TLSv1.3 nonce constructionMatt Caswell
This updates the record layer to use the TLSv1.3 style nonce construciton. It also updates TLSProxy and ossltest to be able to recognise the new layout. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-23Fix some TLSProxy warningsMatt Caswell
After the client processes the server's initial flight in TLS1.3 it may respond with either an encrypted, or an unencrypted alert. We needed to teach TLSProxy about this so that it didn't issue spurious warnings. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-23Fix the tests following the state machine changes for TLSv1.3Matt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-16Add some tests for the key_share extensionMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Add a test for the supported_versions extensionMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-09Add server side support for supported_versions extensionMatt Caswell
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-07Add a test for the wrong version number in a recordMatt Caswell
Prior to TLS1.3 we check that the received record version number is correct. In TLS1.3 we need to ignore the record version number. This adds a test to make sure we do it correctly. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-02Add a test for unrecognised record typesMatt Caswell
We should fail if we receive an unrecognised record type Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-11-02Enable TLSProxy to talk TLS1.3Matt Caswell
Now that ossltest knows about a TLS1.3 cipher we can now do TLS1.3 in TLSProxy Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-02Add the SSL_METHOD for TLSv1.3 and all other base changes requiredMatt Caswell
Includes addition of the various options to s_server/s_client. Also adds one of the new TLS1.3 ciphersuites. This isn't "real" TLS1.3!! It's identical to TLS1.2 apart from the protocol and the ciphersuite...and the ciphersuite is just a renamed TLS1.2 one (not a "real" TLS1.3 ciphersuite). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-26Test CBC mode padding.David Benjamin
This is a regression test for https://github.com/openssl/openssl/pull/1431. It tests a maximally-padded record with each possible invalid offset. This required fixing a bug in Message.pm where the client sending a fatal alert followed by close_notify was still treated as success. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-15Add some SSLv2 ClientHello testsMatt Caswell
Test that we handle a TLS ClientHello in an SSLv2 record correctly. Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-06-27Add a test for fragmented alertsMatt Caswell
The previous commit fixed a problem where fragmented alerts would cause an infinite loop. This commit adds a test for these fragmented alerts. Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-06-16Skip the TLSProxy tests if environmental problems are an issueMatt Caswell
On some platforms we can't startup the TLSProxy due to environmental problems (e.g. network set up on the build machine). These aren't OpenSSL problems so we shouldn't treat them as test failures. Just visibly indicate that we are skipping the test. We only skip the first time we attempt to start up the proxy. If that works then everything else should do...if not we should probably investigate and so report as a failure. This also removes test_networking...there is a danger that this turns into a test of user's environmental set up rather than OpenSSL. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-16Workaround an IO::Socket::IP bugMatt Caswell
Workaround an apparent IO:Socket::IP bug where a seemingly valid server socket is being returned even though a valid connection does not exist. This causes the tests to intermittently hang. We additionally check that the peerport looks ok to verify that the returned socket looks usable. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-11Fix TLSProxy race by adding missing evalViktor Dukhovni
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-20Copyright consolidation; .pm and ConfigureRich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-15Fix a TLSProxy race conditionMatt Caswell
TLSProxy starts s_server and specifies the number of client connects it should expect. After that s_server is supposed to close down automatically. However, if another test is then run then TLSProxy will start a new instance of s_server. If the previous instance hasn't closed down yet then the new instance can fail to bind to the socket. Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-10 16:44:40 +0000