# -*- mode: perl; -*-
# Copyright 2016-2016 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the OpenSSL license (the "License").  You may not use
# this file except in compliance with the License.  You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html


## Test Renegotiation

use strict;
use warnings;

package ssltests;

my $dir_sep = $^O ne "VMS" ? "/" : "";

our @tests = (
    {
        name => "renegotiate-client-no-resume",
        server => {
            "Options" => "NoResumptionOnRenegotiation"
        },
        client => {},
        test => {
            "Method" => "DTLS",
            "HandshakeMode" => "RenegotiateClient",
            "ResumptionExpected" => "No",
            "ExpectedResult" => "Success"
        }
    },
    {
        name => "renegotiate-client-resume",
        server => {},
        client => {},
        test => {
            "Method" => "DTLS",
            "HandshakeMode" => "RenegotiateClient",
            "ResumptionExpected" => "Yes",
            "ExpectedResult" => "Success"
        }
    },
# Note: Unlike the TLS tests, we will never do resumption with server
# initiated reneg. This is because an OpenSSL DTLS client will always do a full
# handshake (i.e. it doesn't supply a session id) when it receives a
# HelloRequest. This is different to the OpenSSL TLS implementation where an
# OpenSSL client will always try an abbreviated handshake (i.e. it will supply
# the session id). This goes all the way to commit 48ae85b6f when abbreviated
# handshake support was first added. Neither behaviour is wrong, but the
# discrepancy is strange. TODO: Should we harmonise the TLS and DTLS behaviour,
# and if so, what to?
    {
        name => "renegotiate-server-resume",
        server => {},
        client => {},
        test => {
            "Method" => "DTLS",
            "HandshakeMode" => "RenegotiateServer",
            "ResumptionExpected" => "No",
            "ExpectedResult" => "Success"
        }
    },
    {
        name => "renegotiate-client-auth-require",
        server => {
            "VerifyCAFile" => "\${ENV::TEST_CERTS_DIR}${dir_sep}root-cert.pem",
            "VerifyMode" => "Require",
        },
        client => {
            "Certificate" => "\${ENV::TEST_CERTS_DIR}${dir_sep}ee-client-chain.pem",
            "PrivateKey"  => "\${ENV::TEST_CERTS_DIR}${dir_sep}ee-key.pem"
        },
        test => {
            "Method" => "DTLS",
            "HandshakeMode" => "RenegotiateServer",
            "ResumptionExpected" => "No",
            "ExpectedResult" => "Success"
        }
    },
    {
        name => "renegotiate-client-auth-once",
        server => {
            "VerifyCAFile" => "\${ENV::TEST_CERTS_DIR}${dir_sep}root-cert.pem",
            "VerifyMode" => "Once",
        },
        client => {
            "Certificate" => "\${ENV::TEST_CERTS_DIR}${dir_sep}ee-client-chain.pem",
            "PrivateKey"  => "\${ENV::TEST_CERTS_DIR}${dir_sep}ee-key.pem"
        },
        test => {
            "Method" => "DTLS",
            "HandshakeMode" => "RenegotiateServer",
            "ResumptionExpected" => "No",
            "ExpectedResult" => "Success"
        }
    },
    {
        name => "renegotiate-aead-to-non-aead",
        server => {
            "Options" => "NoResumptionOnRenegotiation"
        },
        client => {
            "CipherString" => "AES128-GCM-SHA256",
            extra => {
                "RenegotiateCiphers" => "AES128-SHA"
            }
        },
        test => {
            "Method" => "DTLS",
            "HandshakeMode" => "RenegotiateClient",
            "ResumptionExpected" => "No",
            "ExpectedResult" => "Success"
        }
    },
    {
        name => "renegotiate-non-aead-to-aead",
        server => {
            "Options" => "NoResumptionOnRenegotiation"
        },
        client => {
            "CipherString" => "AES128-SHA",
            extra => {
                "RenegotiateCiphers" => "AES128-GCM-SHA256"
            }
        },
        test => {
            "Method" => "DTLS",
            "HandshakeMode" => "RenegotiateClient",
            "ResumptionExpected" => "No",
            "ExpectedResult" => "Success"
        }
    },
    {
        name => "renegotiate-non-aead-to-non-aead",
        server => {
            "Options" => "NoResumptionOnRenegotiation"
        },
        client => {
            "CipherString" => "AES128-SHA",
            extra => {
                "RenegotiateCiphers" => "AES256-SHA"
            }
        },
        test => {
            "Method" => "DTLS",
            "HandshakeMode" => "RenegotiateClient",
            "ResumptionExpected" => "No",
            "ExpectedResult" => "Success"
        }
    },
    {
        name => "renegotiate-aead-to-aead",
        server => {
            "Options" => "NoResumptionOnRenegotiation"
        },
        client => {
            "CipherString" => "AES128-GCM-SHA256",
            extra => {
                "RenegotiateCiphers" => "AES256-GCM-SHA384"
            }
        },
        test => {
            "Method" => "DTLS",
            "HandshakeMode" => "RenegotiateClient",
            "ResumptionExpected" => "No",
            "ExpectedResult" => "Success"
        }
    },
);