# -*- mode: perl; -*-
# Copyright 2016-2016 The OpenSSL Project Authors. All Rights Reserved.
#
-# Licensed under the OpenSSL license (the "License"). You may not use
+# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
use warnings;
package ssltests;
+use OpenSSL::Test::Utils;
-my $dir_sep = $^O ne "VMS" ? "/" : "";
+our @tests = ();
-our @tests = (
- {
- name => "renegotiate-client-no-resume",
- server => {
- "Options" => "NoResumptionOnRenegotiation"
- },
- client => {},
- test => {
- "Method" => "DTLS",
- "HandshakeMode" => "RenegotiateClient",
- "ResumptionExpected" => "No",
- "ExpectedResult" => "Success"
- }
- },
- {
- name => "renegotiate-client-resume",
- server => {},
- client => {},
- test => {
- "Method" => "DTLS",
- "HandshakeMode" => "RenegotiateClient",
- "ResumptionExpected" => "Yes",
- "ExpectedResult" => "Success"
- }
- },
-# Note: Unlike the TLS tests, we will never do resumption with server
-# initiated reneg. This is because an OpenSSL DTLS client will always do a full
-# handshake (i.e. it doesn't supply a session id) when it receives a
-# HelloRequest. This is different to the OpenSSL TLS implementation where an
-# OpenSSL client will always try an abbreviated handshake (i.e. it will supply
-# the session id). This goes all the way to commit 48ae85b6f when abbreviated
-# handshake support was first added. Neither behaviour is wrong, but the
-# discrepancy is strange. TODO: Should we harmonise the TLS and DTLS behaviour,
-# and if so, what to?
- {
- name => "renegotiate-server-resume",
- server => {},
- client => {},
- test => {
- "Method" => "DTLS",
- "HandshakeMode" => "RenegotiateServer",
- "ResumptionExpected" => "No",
- "ExpectedResult" => "Success"
- }
- },
- {
- name => "renegotiate-client-auth-require",
- server => {
- "VerifyCAFile" => "\${ENV::TEST_CERTS_DIR}${dir_sep}root-cert.pem",
- "VerifyMode" => "Require",
- },
- client => {
- "Certificate" => "\${ENV::TEST_CERTS_DIR}${dir_sep}ee-client-chain.pem",
- "PrivateKey" => "\${ENV::TEST_CERTS_DIR}${dir_sep}ee-key.pem"
- },
- test => {
- "Method" => "DTLS",
- "HandshakeMode" => "RenegotiateServer",
- "ResumptionExpected" => "No",
- "ExpectedResult" => "Success"
- }
- },
- {
- name => "renegotiate-client-auth-once",
- server => {
- "VerifyCAFile" => "\${ENV::TEST_CERTS_DIR}${dir_sep}root-cert.pem",
- "VerifyMode" => "Once",
- },
- client => {
- "Certificate" => "\${ENV::TEST_CERTS_DIR}${dir_sep}ee-client-chain.pem",
- "PrivateKey" => "\${ENV::TEST_CERTS_DIR}${dir_sep}ee-key.pem"
- },
- test => {
- "Method" => "DTLS",
- "HandshakeMode" => "RenegotiateServer",
- "ResumptionExpected" => "No",
- "ExpectedResult" => "Success"
- }
- },
- {
- name => "renegotiate-aead-to-non-aead",
- server => {
- "Options" => "NoResumptionOnRenegotiation"
+foreach my $sctp ("No", "Yes")
+{
+ next if disabled("sctp") && $sctp eq "Yes";
+
+ my $suffix = ($sctp eq "No") ? "" : "-sctp";
+ our @tests_basic = (
+ {
+ name => "renegotiate-client-no-resume".$suffix,
+ server => {
+ "Options" => "NoResumptionOnRenegotiation"
+ },
+ client => {},
+ test => {
+ "Method" => "DTLS",
+ "UseSCTP" => $sctp,
+ "HandshakeMode" => "RenegotiateClient",
+ "ResumptionExpected" => "No",
+ "ExpectedResult" => "Success"
+ }
},
- client => {
- "CipherString" => "AES128-GCM-SHA256",
- extra => {
- "RenegotiateCiphers" => "AES128-SHA"
+ {
+ name => "renegotiate-client-resume".$suffix,
+ server => {},
+ client => {},
+ test => {
+ "Method" => "DTLS",
+ "UseSCTP" => $sctp,
+ "HandshakeMode" => "RenegotiateClient",
+ "ResumptionExpected" => "Yes",
+ "ExpectedResult" => "Success"
}
},
- test => {
- "Method" => "DTLS",
- "HandshakeMode" => "RenegotiateClient",
- "ResumptionExpected" => "No",
- "ExpectedResult" => "Success"
- }
- },
- {
- name => "renegotiate-non-aead-to-aead",
- server => {
- "Options" => "NoResumptionOnRenegotiation"
+ # Note: Unlike the TLS tests, we will never do resumption with server
+ # initiated reneg. This is because an OpenSSL DTLS client will always do a full
+ # handshake (i.e. it doesn't supply a session id) when it receives a
+ # HelloRequest. This is different to the OpenSSL TLS implementation where an
+ # OpenSSL client will always try an abbreviated handshake (i.e. it will supply
+ # the session id). This goes all the way to commit 48ae85b6f when abbreviated
+ # handshake support was first added. Neither behaviour is wrong, but the
+ # discrepancy is strange. TODO: Should we harmonise the TLS and DTLS behaviour,
+ # and if so, what to?
+ {
+ name => "renegotiate-server-resume".$suffix,
+ server => {},
+ client => {},
+ test => {
+ "Method" => "DTLS",
+ "UseSCTP" => $sctp,
+ "HandshakeMode" => "RenegotiateServer",
+ "ResumptionExpected" => "No",
+ "ExpectedResult" => "Success"
+ }
},
- client => {
- "CipherString" => "AES128-SHA",
- extra => {
- "RenegotiateCiphers" => "AES128-GCM-SHA256"
+ {
+ name => "renegotiate-client-auth-require".$suffix,
+ server => {
+ "VerifyCAFile" => test_pem("root-cert.pem"),
+ "VerifyMode" => "Require",
+ },
+ client => {
+ "Certificate" => test_pem("ee-client-chain.pem"),
+ "PrivateKey" => test_pem("ee-key.pem"),
+ },
+ test => {
+ "Method" => "DTLS",
+ "UseSCTP" => $sctp,
+ "HandshakeMode" => "RenegotiateServer",
+ "ResumptionExpected" => "No",
+ "ExpectedResult" => "Success"
}
},
- test => {
- "Method" => "DTLS",
- "HandshakeMode" => "RenegotiateClient",
- "ResumptionExpected" => "No",
- "ExpectedResult" => "Success"
+ {
+ name => "renegotiate-client-auth-once".$suffix,
+ server => {
+ "VerifyCAFile" => test_pem("root-cert.pem"),
+ "VerifyMode" => "Once",
+ },
+ client => {
+ "Certificate" => test_pem("ee-client-chain.pem"),
+ "PrivateKey" => test_pem("ee-key.pem"),
+ },
+ test => {
+ "Method" => "DTLS",
+ "UseSCTP" => $sctp,
+ "HandshakeMode" => "RenegotiateServer",
+ "ResumptionExpected" => "No",
+ "ExpectedResult" => "Success"
+ }
}
- },
- {
- name => "renegotiate-non-aead-to-non-aead",
- server => {
- "Options" => "NoResumptionOnRenegotiation"
+ );
+ push @tests, @tests_basic;
+
+ next if disabled("dtls1_2");
+ our @tests_dtls1_2 = (
+ {
+ name => "renegotiate-aead-to-non-aead".$suffix,
+ server => {
+ "Options" => "NoResumptionOnRenegotiation"
+ },
+ client => {
+ "CipherString" => "AES128-GCM-SHA256",
+ extra => {
+ "RenegotiateCiphers" => "AES128-SHA"
+ }
+ },
+ test => {
+ "Method" => "DTLS",
+ "UseSCTP" => $sctp,
+ "HandshakeMode" => "RenegotiateClient",
+ "ResumptionExpected" => "No",
+ "ExpectedResult" => "Success"
+ }
},
- client => {
- "CipherString" => "AES128-SHA",
- extra => {
- "RenegotiateCiphers" => "AES256-SHA"
+ {
+ name => "renegotiate-non-aead-to-aead".$suffix,
+ server => {
+ "Options" => "NoResumptionOnRenegotiation"
+ },
+ client => {
+ "CipherString" => "AES128-SHA",
+ extra => {
+ "RenegotiateCiphers" => "AES128-GCM-SHA256"
+ }
+ },
+ test => {
+ "Method" => "DTLS",
+ "UseSCTP" => $sctp,
+ "HandshakeMode" => "RenegotiateClient",
+ "ResumptionExpected" => "No",
+ "ExpectedResult" => "Success"
}
},
- test => {
- "Method" => "DTLS",
- "HandshakeMode" => "RenegotiateClient",
- "ResumptionExpected" => "No",
- "ExpectedResult" => "Success"
- }
- },
- {
- name => "renegotiate-aead-to-aead",
- server => {
- "Options" => "NoResumptionOnRenegotiation"
+ {
+ name => "renegotiate-non-aead-to-non-aead".$suffix,
+ server => {
+ "Options" => "NoResumptionOnRenegotiation"
+ },
+ client => {
+ "CipherString" => "AES128-SHA",
+ extra => {
+ "RenegotiateCiphers" => "AES256-SHA"
+ }
+ },
+ test => {
+ "Method" => "DTLS",
+ "UseSCTP" => $sctp,
+ "HandshakeMode" => "RenegotiateClient",
+ "ResumptionExpected" => "No",
+ "ExpectedResult" => "Success"
+ }
},
- client => {
- "CipherString" => "AES128-GCM-SHA256",
- extra => {
- "RenegotiateCiphers" => "AES256-GCM-SHA384"
+ {
+ name => "renegotiate-aead-to-aead".$suffix,
+ server => {
+ "Options" => "NoResumptionOnRenegotiation"
+ },
+ client => {
+ "CipherString" => "AES128-GCM-SHA256",
+ extra => {
+ "RenegotiateCiphers" => "AES256-GCM-SHA384"
+ }
+ },
+ test => {
+ "Method" => "DTLS",
+ "UseSCTP" => $sctp,
+ "HandshakeMode" => "RenegotiateClient",
+ "ResumptionExpected" => "No",
+ "ExpectedResult" => "Success"
}
},
- test => {
- "Method" => "DTLS",
- "HandshakeMode" => "RenegotiateClient",
- "ResumptionExpected" => "No",
- "ExpectedResult" => "Success"
- }
- },
-);
+ );
+ push @tests, @tests_dtls1_2;
+}
projects / openssl.git / blobdiff