[TLSProxy::Message::MT_CERTIFICATE,
checkhandshake::ALL_HANDSHAKES
& ~checkhandshake::RESUME_HANDSHAKE],
+ (disabled("ec") ? () :
+ [TLSProxy::Message::MT_SERVER_KEY_EXCHANGE,
+ checkhandshake::EC_HANDSHAKE]),
[TLSProxy::Message::MT_CERTIFICATE_STATUS,
checkhandshake::OCSP_HANDSHAKE],
#ServerKeyExchange handshakes not currently supported by TLSProxy
checkhandshake::SERVER_NAME_CLI_EXTENSION],
[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_STATUS_REQUEST,
checkhandshake::STATUS_REQUEST_CLI_EXTENSION],
- [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SUPPORTED_GROUPS,
- checkhandshake::DEFAULT_EXTENSIONS],
- [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
- checkhandshake::DEFAULT_EXTENSIONS],
- [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
- checkhandshake::DEFAULT_EXTENSIONS],
+ (disabled("ec") ? () :
+ [TLSProxy::Message::MT_CLIENT_HELLO,
+ TLSProxy::Message::EXT_SUPPORTED_GROUPS,
+ checkhandshake::DEFAULT_EXTENSIONS]),
+ (disabled("ec") ? () :
+ [TLSProxy::Message::MT_CLIENT_HELLO,
+ TLSProxy::Message::EXT_EC_POINT_FORMATS,
+ checkhandshake::DEFAULT_EXTENSIONS]),
+ (disabled("tls1_2") ? () :
+ [TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SIG_ALGS,
+ checkhandshake::DEFAULT_EXTENSIONS]),
[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_ALPN,
checkhandshake::ALPN_CLI_EXTENSION],
[TLSProxy::Message::MT_CLIENT_HELLO, TLSProxy::Message::EXT_SCT,
checkhandshake::SCT_SRV_EXTENSION],
[TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_NPN,
checkhandshake::NPN_SRV_EXTENSION],
+ [TLSProxy::Message::MT_SERVER_HELLO, TLSProxy::Message::EXT_EC_POINT_FORMATS,
+ checkhandshake::EC_POINT_FORMAT_SRV_EXTENSION],
[0,0,0]
);
$proxy->serverconnects(2);
$proxy->clientflags("-no_tls1_3 -sess_out ".$session);
$proxy->start() or plan skip_all => "Unable to start up Proxy for tests";
-plan tests => 20;
+plan tests => 21;
checkhandshake($proxy, checkhandshake::DEFAULT_HANDSHAKE,
checkhandshake::DEFAULT_EXTENSIONS,
"Default handshake test");
| checkhandshake::ALPN_SRV_EXTENSION,
"ALPN handshake test");
-#Test 14: SCT handshake (client request only)
-$proxy->clear();
-#Note: -ct also sends status_request
-$proxy->clientflags("-no_tls1_3 -ct");
-$proxy->serverflags("-status_file "
- .srctop_file("test", "recipes", "ocsp-response.der"));
-$proxy->start();
-checkhandshake($proxy, checkhandshake::OCSP_HANDSHAKE,
- checkhandshake::DEFAULT_EXTENSIONS
- | checkhandshake::SCT_CLI_EXTENSION
- | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
- | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
- "SCT handshake test (client)");
+SKIP: {
+ skip "No CT and/or EC support in this OpenSSL build", 1
+ if disabled("ct") || disabled("ec");
+
+ #Test 14: SCT handshake (client request only)
+ $proxy->clear();
+ #Note: -ct also sends status_request
+ $proxy->clientflags("-no_tls1_3 -ct");
+ $proxy->serverflags("-status_file "
+ .srctop_file("test", "recipes", "ocsp-response.der"));
+ $proxy->start();
+ checkhandshake($proxy, checkhandshake::OCSP_HANDSHAKE,
+ checkhandshake::DEFAULT_EXTENSIONS
+ | checkhandshake::SCT_CLI_EXTENSION
+ | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
+ | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
+ "SCT handshake test (client)");
+}
#Test 15: SCT handshake (server support only)
$proxy->clear();
checkhandshake::DEFAULT_EXTENSIONS,
"SCT handshake test (server)");
-#Test 16: SCT handshake (client and server)
-#There is no built-in server side support for this so we are actually also
-#testing custom extensions here
-$proxy->clear();
-#Note: -ct also sends status_request
-$proxy->clientflags("-no_tls1_3 -ct");
-$proxy->serverflags("-status_file "
- .srctop_file("test", "recipes", "ocsp-response.der")
- ." -serverinfo ".srctop_file("test", "serverinfo.pem"));
-$proxy->start();
-checkhandshake($proxy, checkhandshake::OCSP_HANDSHAKE,
- checkhandshake::DEFAULT_EXTENSIONS
- | checkhandshake::SCT_CLI_EXTENSION
- | checkhandshake::SCT_SRV_EXTENSION
- | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
- | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
- "SCT handshake test");
+SKIP: {
+ skip "No CT and/or EC support in this OpenSSL build", 1
+ if disabled("ct") || disabled("ec");
+
+ #Test 16: SCT handshake (client and server)
+ #There is no built-in server side support for this so we are actually also
+ #testing custom extensions here
+ $proxy->clear();
+ #Note: -ct also sends status_request
+ $proxy->clientflags("-no_tls1_3 -ct");
+ $proxy->serverflags("-status_file "
+ .srctop_file("test", "recipes", "ocsp-response.der")
+ ." -serverinfo ".srctop_file("test", "serverinfo.pem"));
+ $proxy->start();
+ checkhandshake($proxy, checkhandshake::OCSP_HANDSHAKE,
+ checkhandshake::DEFAULT_EXTENSIONS
+ | checkhandshake::SCT_CLI_EXTENSION
+ | checkhandshake::SCT_SRV_EXTENSION
+ | checkhandshake::STATUS_REQUEST_CLI_EXTENSION
+ | checkhandshake::STATUS_REQUEST_SRV_EXTENSION,
+ "SCT handshake test");
+}
#Test 17: NPN handshake (client request only)
checkhandshake::DEFAULT_EXTENSIONS
| checkhandshake::SRP_CLI_EXTENSION,
"SRP extension test");
+
+#Test 21: EC handshake
+SKIP: {
+ skip "No EC support in this OpenSSL build", 1 if disabled("ec");
+ $proxy->clear();
+ $proxy->clientflags("-no_tls1_3");
+ $proxy->ciphers("ECDHE-RSA-AES128-SHA");
+ $proxy->start();
+ checkhandshake($proxy, checkhandshake::EC_HANDSHAKE,
+ checkhandshake::DEFAULT_EXTENSIONS
+ | checkhandshake::EC_POINT_FORMAT_SRV_EXTENSION,
+ "EC handshake test");
+}