3 ## SSL test configurations
11 use OpenSSL::Test::Utils qw(anydisabled disabled);
12 setup("no_test_here");
14 # We test version-flexible negotiation (undef) and each protocol version.
15 my @protocols = (undef, "SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", "DTLSv1", "DTLSv1.2");
17 my @is_disabled = (0);
18 push @is_disabled, anydisabled("ssl3", "tls1", "tls1_1", "tls1_2", "dtls1", "dtls1_2");
22 sub generate_tests() {
23 foreach (0..$#protocols) {
24 my $protocol = $protocols[$_];
25 my $protocol_name = $protocol || "flex";
29 if (!$is_disabled[$_]) {
30 if ($protocol_name eq "SSLv3") {
31 $caalert = "BadCertificate";
33 $caalert = "UnknownCA";
35 if ($protocol_name =~ m/^DTLS/) {
37 $sctpenabled = 1 if !disabled("sctp");
42 # TODO(TLS1.3) add TLSv1.3 versions
43 if ($protocol_name eq "TLSv1.2") {
46 $clisigalgs = "SHA256+RSA";
48 for (my $sctp = 0; $sctp <= $sctpenabled; $sctp++) {
49 # Sanity-check simple handshake.
51 name => "server-auth-${protocol_name}"
52 .($sctp ? "-sctp" : ""),
54 "MinProtocol" => $protocol,
55 "MaxProtocol" => $protocol
58 "MinProtocol" => $protocol,
59 "MaxProtocol" => $protocol
62 "ExpectedResult" => "Success",
66 $tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
68 # Handshake with client cert requested but not required or received.
70 name => "client-auth-${protocol_name}-request"
71 .($sctp ? "-sctp" : ""),
73 "MinProtocol" => $protocol,
74 "MaxProtocol" => $protocol,
75 "VerifyMode" => "Request"
78 "MinProtocol" => $protocol,
79 "MaxProtocol" => $protocol
82 "ExpectedResult" => "Success",
86 $tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
88 # Handshake with client cert required but not present.
90 name => "client-auth-${protocol_name}-require-fail"
91 .($sctp ? "-sctp" : ""),
93 "MinProtocol" => $protocol,
94 "MaxProtocol" => $protocol,
95 "VerifyCAFile" => test_pem("root-cert.pem"),
96 "VerifyMode" => "Require",
99 "MinProtocol" => $protocol,
100 "MaxProtocol" => $protocol
103 "ExpectedResult" => "ServerFail",
104 "ExpectedServerAlert" =>
105 ($protocol_name eq "flex" && !disabled("tls1_3"))
106 ? "CertificateRequired" : "HandshakeFailure",
110 $tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
112 # Successful handshake with client authentication.
114 name => "client-auth-${protocol_name}-require"
115 .($sctp ? "-sctp" : ""),
117 "MinProtocol" => $protocol,
118 "MaxProtocol" => $protocol,
119 "ClientSignatureAlgorithms" => $clisigalgs,
120 "VerifyCAFile" => test_pem("root-cert.pem"),
121 "VerifyMode" => "Request",
124 "MinProtocol" => $protocol,
125 "MaxProtocol" => $protocol,
126 "Certificate" => test_pem("ee-client-chain.pem"),
127 "PrivateKey" => test_pem("ee-key.pem"),
130 "ExpectedResult" => "Success",
131 "ExpectedClientCertType" => "RSA",
132 "ExpectedClientSignType" => $clisigtype,
133 "ExpectedClientSignHash" => $clihash,
134 "ExpectedClientCANames" => "empty",
138 $tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
140 # Successful handshake with client authentication non-empty names
142 name => "client-auth-${protocol_name}-require-non-empty-names"
143 .($sctp ? "-sctp" : ""),
145 "MinProtocol" => $protocol,
146 "MaxProtocol" => $protocol,
147 "ClientSignatureAlgorithms" => $clisigalgs,
148 "ClientCAFile" => test_pem("root-cert.pem"),
149 "VerifyCAFile" => test_pem("root-cert.pem"),
150 "VerifyMode" => "Request",
153 "MinProtocol" => $protocol,
154 "MaxProtocol" => $protocol,
155 "Certificate" => test_pem("ee-client-chain.pem"),
156 "PrivateKey" => test_pem("ee-key.pem"),
159 "ExpectedResult" => "Success",
160 "ExpectedClientCertType" => "RSA",
161 "ExpectedClientSignType" => $clisigtype,
162 "ExpectedClientSignHash" => $clihash,
163 "ExpectedClientCANames" => test_pem("root-cert.pem"),
167 $tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;
169 # Handshake with client authentication but without the root certificate.
171 name => "client-auth-${protocol_name}-noroot"
172 .($sctp ? "-sctp" : ""),
174 "MinProtocol" => $protocol,
175 "MaxProtocol" => $protocol,
176 "VerifyMode" => "Require",
179 "MinProtocol" => $protocol,
180 "MaxProtocol" => $protocol,
181 "Certificate" => test_pem("ee-client-chain.pem"),
182 "PrivateKey" => test_pem("ee-key.pem"),
185 "ExpectedResult" => "ServerFail",
186 "ExpectedServerAlert" => $caalert,
190 $tests[-1]{"test"}{"UseSCTP"} = "Yes" if $sctp;