9 use OpenSSL::Test qw/:DEFAULT with top_file/;
14 my @reqcmd = ("openssl", "req");
15 my @x509cmd = ("openssl", "x509", $digest);
16 my @verifycmd = ("openssl", "verify");
17 my $dummycnf = top_file("apps", "openssl.cnf");
19 my $CAkey = "keyCA.ss";
20 my $CAcert="certCA.ss";
21 my $CAserial="certCA.srl";
23 my $CAconf=top_file("test","CAss.cnf");
24 my $CAreq2="req2CA.ss"; # temp
26 my $Uconf=top_file("test","Uss.cnf");
31 my $P1conf=top_file("test","P1ss.cnf");
34 my $P1cert="certP1.ss";
35 my $P1intermediate="tmp_intP1.ss";
37 my $P2conf=top_file("test","P2ss.cnf");
40 my $P2cert="certP2.ss";
41 my $P2intermediate="tmp_intP2.ss";
45 + 1 # For ssltest -test_cipherlist
46 + 8 # For the first testssl
47 + 8 * 4 * 4 # For the first testsslproxy (16 times testssl)
48 + 8 * 4 * 4 # For the second testsslproxy (16 times testssl)
51 subtest 'test_ss' => sub {
53 open OUT, ">", "intP1.ss";
54 copy($CAcert, \*OUT); copy($Ucert, \*OUT);
57 open OUT, ">", "intP2.ss";
58 copy($CAcert, \*OUT); copy($Ucert, \*OUT); copy($P1cert, \*OUT);
63 my $check = ok(run(test(["ssltest","-test_cipherlist"])), "running ssltest");
66 skip "ssltest ended with error, skipping the rest", 3
69 note('test_ssl -- key U');
70 testssl("keyU.ss", $Ucert, $CAcert);
72 note('test_ssl -- key P1');
73 testsslproxy("keyP1.ss", "certP1.ss", "intP1.ss");
75 note('test_ssl -- key P2');
76 testsslproxy("keyP2.ss", "certP2.ss", "intP2.ss");
82 open RND, ">>", ".rnd";
83 print RND "string to make the random number generator think it has entropy";
87 if (run(app(["openssl", "no-rsa"], stdout => undef))) {
88 @req_new = ("-newkey",
89 "dsa:".File::Spec->catfile("..", "apps", "dsa512.pem"));
97 skip 'failure', 14 unless
98 ok(run(app([@reqcmd, "-config", $CAconf,
99 "-out", $CAreq, "-keyout", $CAkey,
101 'make cert request');
103 skip 'failure', 13 unless
104 ok(run(app([@x509cmd, "-CAcreateserial", "-in", $CAreq, "-days", "30",
105 "-req", "-out", $CAcert, "-signkey", $CAkey,
106 "-extfile", $CAconf, "-extensions", "v3_ca"],
107 stdout => "err.ss")),
108 'convert request into self-signed cert');
110 skip 'failure', 12 unless
111 ok(run(app([@x509cmd, "-in", $CAcert,
112 "-x509toreq", "-signkey", $CAkey, "-out", $CAreq2],
113 stdout => "err.ss")),
114 'convert cert into a cert request');
116 skip 'failure', 11 unless
117 ok(run(app([@reqcmd, "-config", $dummycnf,
118 "-verify", "-in", $CAreq, "-noout"])),
122 skip 'failure', 10 unless
123 ok(run(app([@reqcmd, "-config", $dummycnf,
124 "-verify", "-in", $CAreq2, "-noout"])),
127 skip 'failure', 9 unless
128 ok(run(app([@verifycmd, "-CAfile", $CAcert, $CAcert])),
131 skip 'failure', 8 unless
132 ok(run(app([@reqcmd, "-config", $Uconf,
133 "-out", $Ureq, "-keyout", $Ukey, @req_new],
134 stdout => "err.ss")),
135 'make a user cert request');
137 skip 'failure', 7 unless
138 ok(run(app([@x509cmd, "-CAcreateserial", "-in", $Ureq, "-days", "30",
139 "-req", "-out", $Ucert,
140 "-CA", $CAcert, "-CAkey", $CAkey, "-CAserial", $CAserial,
141 "-extfile", $Uconf, "-extensions", "v3_ee"],
143 && run(app([@verifycmd, "-CAfile", $CAcert, $Ucert])),
144 'sign user cert request');
146 skip 'failure', 6 unless
147 ok(run(app([@x509cmd,
148 "-subject", "-issuer", "-startdate", "-enddate",
149 "-noout", "-in", $Ucert])),
150 'Certificate details');
153 skip 'failure', 5 unless
154 ok(run(app([@reqcmd, "-config", $P1conf,
155 "-out", $P1req, "-keyout", $P1key, @req_new],
156 stdout => "err.ss")),
157 'make a proxy cert request');
160 skip 'failure', 4 unless
161 ok(run(app([@x509cmd, "-CAcreateserial", "-in", $P1req, "-days", "30",
162 "-req", "-out", $P1cert,
163 "-CA", $Ucert, "-CAkey", $Ukey,
164 "-extfile", $P1conf, "-extensions", "v3_proxy"],
165 stdout => "err.ss")),
166 'sign proxy with user cert');
168 copy($Ucert, $P1intermediate);
169 run(app([@verifycmd, "-CAfile", $CAcert,
170 "-untrusted", $P1intermediate, $P1cert]));
171 ok(run(app([@x509cmd,
172 "-subject", "-issuer", "-startdate", "-enddate",
173 "-noout", "-in", $P1cert])),
174 'Certificate details');
176 skip 'failure', 2 unless
177 ok(run(app([@reqcmd, "-config", $P2conf,
178 "-out", $P2req, "-keyout", $P2key,
180 stdout => "err.ss")),
181 'make another proxy cert request');
184 skip 'failure', 1 unless
185 ok(run(app([@x509cmd, "-CAcreateserial", "-in", $P2req, "-days", "30",
186 "-req", "-out", $P2cert,
187 "-CA", $P1cert, "-CAkey", $P1key,
188 "-extfile", $P2conf, "-extensions", "v3_proxy"],
189 stdout => "err.ss")),
190 'sign second proxy cert request with the first proxy cert');
193 open OUT, ">", $P2intermediate;
194 copy($Ucert, \*OUT); copy($P1cert, \*OUT);
196 run(app([@verifycmd, "-CAfile", $CAcert,
197 "-untrusted", $P2intermediate, $P2cert]));
198 ok(run(app([@x509cmd,
199 "-subject", "-issuer", "-startdate", "-enddate",
200 "-noout", "-in", $P2cert])),
201 'Certificate details');
206 my $key = shift || top_file("apps","server.pem");
207 my $cert = shift || top_file("apps","server.pem");
209 my @CA = $CAtmp ? ("-CAfile", $CAtmp) : ("-CApath", top_dir("certs"));
212 my @ssltest = ("ssltest",
213 "-key", $key, "-cert", $cert,
214 "-c_key", $key, "-c_cert", $cert);
216 my $serverinfo = top_file("test","serverinfo.pem");
219 if (grep /DSA Public Key/, run(app(["openssl", "x509", "-in", $cert,
220 "-text", "-noout"]), capture => 1)) {
227 subtest 'standard SSL tests' => sub {
228 ######################################################################
231 ok(run(test([@ssltest, "-ssl3", @extra])),
233 ok(run(test([@ssltest, "-ssl3", "-server_auth", @CA, @extra])),
234 'test sslv3 with server authentication');
235 ok(run(test([@ssltest, "-ssl3", "-client_auth", @CA, @extra])),
236 'test sslv3 with client authentication');
237 ok(run(test([@ssltest, "-ssl3", "-server_auth", "-client_auth", @CA, @extra])),
238 'test sslv3 with both server and client authentication');
239 ok(run(test([@ssltest, @extra])),
241 ok(run(test([@ssltest, "-server_auth", @CA, @extra])),
242 'test sslv2/sslv3 with server authentication');
243 ok(run(test([@ssltest, "-client_auth", @CA, @extra])),
244 'test sslv2/sslv3 with client authentication');
245 ok(run(test([@ssltest, "-server_auth", "-client_auth", @CA, @extra])),
246 'test sslv2/sslv3 with both server and client authentication');
247 ok(run(test([@ssltest, "-bio_pair", "-ssl3", @extra])),
248 'test sslv3 via BIO pair');
249 ok(run(test([@ssltest, "-bio_pair", "-ssl3", "-server_auth", @CA, @extra])),
250 'test sslv3 with server authentication via BIO pair');
251 ok(run(test([@ssltest, "-bio_pair", "-ssl3", "-client_auth", @CA, @extra])),
252 'test sslv3 with client authentication via BIO pair');
253 ok(run(test([@ssltest, "-bio_pair", "-ssl3", "-server_auth", "-client_auth", @CA, @extra])),
254 'test sslv3 with both server and client authentication via BIO pair');
255 ok(run(test([@ssltest, "-bio_pair", @extra])),
256 'test sslv2/sslv3 via BIO pair');
257 ok(run(test([@ssltest, "-dtls1", @extra])),
259 ok(run(test([@ssltest, "-dtls1", "-server_auth", @CA, @extra])),
260 'test dtlsv1 with server authentication');
261 ok(run(test([@ssltest, "-dtls1", "-client_auth", @CA, @extra])),
262 'test dtlsv1 with client authentication');
263 ok(run(test([@ssltest, "-dtls1", "-server_auth", "-client_auth", @CA, @extra])),
264 'test dtlsv1 with both server and client authentication');
265 ok(run(test([@ssltest, "-dtls12", @extra])),
267 ok(run(test([@ssltest, "-dtls12", "-server_auth", @CA, @extra])),
268 'test dtlsv1.2 with server authentication');
269 ok(run(test([@ssltest, "-dtls12", "-client_auth", @CA, @extra])),
270 'test dtlsv1.2 with client authentication');
271 ok(run(test([@ssltest, "-dtls12", "-server_auth", "-client_auth", @CA, @extra])),
272 'test dtlsv1.2 with both server and client authentication');
275 skip "skipping test of sslv2/sslv3 w/o (EC)DHE test", 1 if $dsa_cert;
277 ok(run(test([@ssltest, "-bio_pair", "-no_dhe", "-no_ecdhe", @extra])),
278 'test sslv2/sslv3 w/o (EC)DHE via BIO pair');
281 ok(run(test([@ssltest, "-bio_pair", "-dhe1024dsa", "-v", @extra])),
282 'test sslv2/sslv3 with 1024bit DHE via BIO pair');
283 ok(run(test([@ssltest, "-bio_pair", "-server_auth", @CA, @extra])),
284 'test sslv2/sslv3 with server authentication');
285 ok(run(test([@ssltest, "-bio_pair", "-client_auth", @CA, @extra])),
286 'test sslv2/sslv3 with client authentication via BIO pair');
287 ok(run(test([@ssltest, "-bio_pair", "-server_auth", "-client_auth", @CA, @extra])),
288 'test sslv2/sslv3 with both client and server authentication via BIO pair');
289 ok(run(test([@ssltest, "-bio_pair", "-server_auth", "-client_auth", "-app_verify", @CA, @extra])),
290 'test sslv2/sslv3 with both client and server authentication via BIO pair and app verify');
293 subtest "Testing ciphersuites" => sub {
295 my $no_dh = run(app(["openssl", "no-dhparam"], stdout => undef));
296 my $no_ec = run(app(["openssl", "no-ec"], stdout => undef));
298 my @protocols = ("TLSv1.2", "SSLv3");
299 my $protocolciphersuitcount = 0;
302 map { split(/:/, $_) }
303 map { run(app(["openssl",
308 $no_dh ? () : "EDH+aRSA+$_:-EXP",
309 $no_ec ? () : "EECDH+aRSA+$_:-EXP" );
311 $protocolciphersuitcount += scalar @c;
312 $_ => [ @c ] } @protocols;
314 plan tests => $protocolciphersuitcount + ($no_dh ? 0 : 2);
316 foreach my $protocol (@protocols) {
317 note "Testing ciphersuites for $protocol";
318 foreach my $cipher (@{$ciphersuites{$protocol}}) {
319 ok(run(test([@ssltest, "-cipher", $cipher,
320 $protocol eq "SSLv3" ? ("-ssl3") : ()])),
324 is(run(test([@ssltest,
326 "-c_cipher", 'EDH:@SECLEVEL=1',
328 $protocol eq "SSLv3" ? ("-ssl3") : ()])), 0,
329 "testing connection with weak DH, expecting failure");
334 subtest 'RSA/(EC)DHE/PSK tests' => sub {
335 ######################################################################
341 skip "skipping anonymous DH tests", 1
342 if (run(app(["openssl", "no-dhparam"], stdout => undef)));
344 ok(run(test([@ssltest, "-v", "-bio_pair", "-tls1", "-cipher", "ADH", "-dhe1024dsa", "-num", "10", "-f", "-time", @extra])),
345 'test tlsv1 with 1024bit anonymous DH, multiple handshakes');
351 skip "skipping RSA tests", 2
352 if (run(app(["openssl", "no-rsa"], stdout => undef)));
354 ok(run(test(["ssltest", "-v", "-bio_pair", "-tls1", "-cert", top_file("apps","server2.pem"), "-no_dhe", "-no_ecdhe", "-num", "10", "-f", "-time", @extra])),
355 'test tlsv1 with 1024bit RSA, no (EC)DHE, multiple handshakes');
357 skip "skipping RSA+DHE tests", 1
358 if (run(app(["openssl", "no-dhparam"], stdout => undef)));
360 ok(run(test(["ssltest", "-v", "-bio_pair", "-tls1", "-cert", top_file("apps","server2.pem"), "-dhe1024dsa", "-num", "10", "-f", "-time", @extra])),
361 'test tlsv1 with 1024bit RSA, 1024bit DHE, multiple handshakes');
364 ok(run(test([@ssltest, "-tls1", "-cipher", "PSK", "-psk", "abc123", @extra])),
365 'test tls1 with PSK');
367 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "PSK", "-psk", "abc123", @extra])),
368 'test tls1 with PSK via BIO pair');
371 subtest 'Next Protocol Negotiation Tests' => sub {
372 ######################################################################
376 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-npn_client"])));
377 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-npn_server"])));
378 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-npn_server_reject"])));
379 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-npn_client", "-npn_server_reject"])));
380 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-npn_client", "-npn_server"])));
381 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-npn_client", "-npn_server", "-num", "2"])));
382 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-npn_client", "-npn_server", "-num", "2", "-reuse"])));
385 subtest 'Custom Extension tests' => sub {
386 ######################################################################
390 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-custom_ext"])),
391 'test tls1 with custom extensions');
394 subtest 'Serverinfo tests' => sub {
395 ######################################################################
399 note('echo test tls1 with serverinfo');
400 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo])));
401 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo, "-serverinfo_sct"])));
402 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo, "-serverinfo_tack"])));
403 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo, "-serverinfo_sct", "-serverinfo_tack"])));
404 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-custom_ext", "-serverinfo_file", $serverinfo, "-serverinfo_sct", "-serverinfo_tack"])));
407 subtest 'ALPN tests' => sub {
408 ######################################################################
412 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-alpn_client", "foo", "-alpn_server", "bar"])));
413 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-alpn_client", "foo", "-alpn_server", "foo", "-alpn_expected", "foo"])));
414 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-alpn_client", "foo,bar", "-alpn_server", "foo", "-alpn_expected", "foo"])));
415 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-alpn_client", "bar,foo", "-alpn_server", "foo", "-alpn_expected", "foo"])));
416 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-alpn_client", "bar,foo", "-alpn_server", "foo,bar", "-alpn_expected", "foo"])));
417 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-alpn_client", "bar,foo", "-alpn_server", "bar,foo", "-alpn_expected", "bar"])));
418 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-alpn_client", "foo,bar", "-alpn_server", "bar,foo", "-alpn_expected", "bar"])));
419 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-alpn_client", "baz", "-alpn_server", "bar,foo"])));
423 skip "skipping SRP tests", 4
424 if run(app(["openssl", "no-srp"], stdout => undef));
426 ok(run(test([@ssltest, "-tls1", "-cipher", "SRP", "-srpuser", "test", "-srppass", "abc123"])),
427 'test tls1 with SRP');
429 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "SRP", "-srpuser", "test", "-srppass", "abc123"])),
430 'test tls1 with SRP via BIO pair');
432 ok(run(test([@ssltest, "-tls1", "-cipher", "aSRP", "-srpuser", "test", "-srppass", "abc123"])),
433 'test tls1 with SRP auth');
435 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "aSRP", "-srpuser", "test", "-srppass", "abc123"])),
436 'test tls1 with SRP auth via BIO pair');
441 subtest 'Multi-buffer tests' => sub {
442 ######################################################################
448 skip "skipping multi-buffer tests", 2
449 if @extra || (POSIX::uname())[4] ne "x86_64";
450 ok(run(test([@ssltest, "-cipher", "AES128-SHA", "-bytes", "8m"])));
451 ok(run(test([@ssltest, "-cipher", "AES128-SHA256", "-bytes", "8m"])));
458 my ($a1, $a2, $a3, @rest) = @_;
462 note('Testing a lot of proxy conditions.');
463 note('Some of them may turn out being invalid, which is fine.');
464 foreach my $auth (('A', 'B', 'C', 'BC')) {
465 foreach my $cond (('A', 'B', 'C', 'A|B&!C')) {
466 # Exit code 3 is when ssltest couldn't parse the condition
467 with({ exit_checker => sub { return shift == 3 ? 0 : 1; } },
469 testssl($a1, $a2, $a3,
470 "-proxy", "-proxy_auth", $auth,
471 "-proxy_cond", $cond);