Suppress CT warnings in test_ssl

[openssl.git] / test / recipes / 80-test_ssl.t

diff --git a/test/recipes/80-test_ssl.t b/test/recipes/80-test_ssl.t
index bcab4b5f786f3e3bae5d79414e65f686aedbb6e4..ba57695b22f32314ce00955764365993dd9f0704 100644 (file)
--- a/test/recipes/80-test_ssl.t
+++ b/test/recipes/80-test_ssl.t
@@ -11,12 +11,14 @@ use OpenSSL::Test::Utils;
 
 setup("test_ssl");
 
+$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
+
 my ($no_rsa, $no_dsa, $no_dh, $no_ec, $no_srp, $no_psk,
     $no_ssl3, $no_tls1, $no_tls1_1, $no_tls1_2,
-    $no_dtls, $no_dtls1, $no_dtls1_2) =
+    $no_dtls, $no_dtls1, $no_dtls1_2, $no_ct) =
     anydisabled qw/rsa dsa dh ec srp psk
                    ssl3 tls1 tls1_1 tls1_2
-                   dtls dtls1 dtls1_2/;
+                   dtls dtls1 dtls1_2 ct/;
 my $no_anytls = alldisabled(available_protocols("tls"));
 my $no_anydtls = alldisabled(available_protocols("dtls"));
 
@@ -64,7 +66,7 @@ my $P2intermediate="tmp_intP2.ss";
 plan tests =>
     1                          # For testss
     + 1                                # For ssltest -test_cipherlist
-    + 10                       # For the first testssl
+    + 13                       # For the first testssl
     + 16                       # For the first testsslproxy
     + 16                       # For the second testsslproxy
     ;
@@ -325,7 +327,7 @@ sub testssl {
     }
 
 
-    # plan tests => 10;
+    # plan tests => 11;
 
     subtest 'standard SSL tests' => sub {
        ######################################################################
@@ -603,10 +605,29 @@ sub testssl {
        }
     };
 
+    subtest 'SNI tests' => sub {
+
+       plan tests => 7;
+
+      SKIP: {
+         skip "TLSv1.x is not supported by this OpenSSL build", 7
+             if $no_tls1 && $no_tls1_1 && $no_tls1_2;
+
+         ok(run(test([@ssltest, "-bio_pair", "-sn_client", "foo"])));
+         ok(run(test([@ssltest, "-bio_pair", "-sn_server1", "foo"])));
+         ok(run(test([@ssltest, "-bio_pair", "-sn_client", "foo", "-sn_server1", "foo", "-sn_expect1"])));
+         ok(run(test([@ssltest, "-bio_pair", "-sn_client", "foo", "-sn_server1", "bar", "-sn_expect1"])));
+         ok(run(test([@ssltest, "-bio_pair", "-sn_client", "foo", "-sn_server1", "foo", "-sn_server2", "bar", "-sn_expect1"])));
+         ok(run(test([@ssltest, "-bio_pair", "-sn_client", "bar", "-sn_server1", "foo", "-sn_server2", "bar", "-sn_expect2"])));
+         # Negative test - make sure it doesn't crash, and doesn't switch contexts
+         ok(run(test([@ssltest, "-bio_pair", "-sn_client", "foobar", "-sn_server1", "foo", "-sn_server2", "bar", "-sn_expect1"])));
+       }
+    };
+
     subtest 'ALPN tests' => sub {
        ######################################################################
 
-       plan tests => 14;
+       plan tests => 12;
 
       SKIP: {
          skip "TLSv1.0 is not supported by this OpenSSL build", 12
@@ -626,22 +647,39 @@ sub testssl {
          is(run(test([@ssltest, "-bio_pair", "-tls1", "-alpn_client", "baz", "-alpn_server", "bar,foo"])), 0,
              "Testing ALPN with protocol mismatch, expecting failure");
 
-       SKIP: {
-           skip "skipping SRP tests", 4
-               if $no_srp;
+         # ALPN + SNI
+         ok(run(test([@ssltest, "-bio_pair",
+                      "-alpn_client", "foo,bar", "-sn_client", "alice",
+                      "-alpn_server1", "foo,123", "-sn_server1", "alice",
+                      "-alpn_server2", "bar,456", "-sn_server2", "bob",
+                      "-alpn_expected", "foo"])));
+         ok(run(test([@ssltest, "-bio_pair",
+                      "-alpn_client", "foo,bar", "-sn_client", "bob",
+                      "-alpn_server1", "foo,123", "-sn_server1", "alice",
+                      "-alpn_server2", "bar,456", "-sn_server2", "bob",
+                      "-alpn_expected", "bar"])));
+       }
+    };
 
-           ok(run(test([@ssltest, "-tls1", "-cipher", "SRP", "-srpuser", "test", "-srppass", "abc123"])),
-              'test tls1 with SRP');
+    subtest 'SRP tests' => sub {
 
-           ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "SRP", "-srpuser", "test", "-srppass", "abc123"])),
-              'test tls1 with SRP via BIO pair');
+       plan tests => 4;
 
-           ok(run(test([@ssltest, "-tls1", "-cipher", "aSRP", "-srpuser", "test", "-srppass", "abc123"])),
-                'test tls1 with SRP auth');
+      SKIP: {
+         skip "skipping SRP tests", 4
+             if $no_srp;
 
-           ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "aSRP", "-srpuser", "test", "-srppass", "abc123"])),
-              'test tls1 with SRP auth via BIO pair');
-         }
+         ok(run(test([@ssltest, "-tls1", "-cipher", "SRP", "-srpuser", "test", "-srppass", "abc123"])),
+            'test tls1 with SRP');
+
+         ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "SRP", "-srpuser", "test", "-srppass", "abc123"])),
+            'test tls1 with SRP via BIO pair');
+
+         ok(run(test([@ssltest, "-tls1", "-cipher", "aSRP", "-srpuser", "test", "-srppass", "abc123"])),
+            'test tls1 with SRP auth');
+
+         ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "aSRP", "-srpuser", "test", "-srppass", "abc123"])),
+            'test tls1 with SRP auth via BIO pair');
        }
     };
 
@@ -762,6 +800,27 @@ sub testssl {
             ok($ok);
         }}}}}
     };
+
+    subtest 'Certificate Transparency tests' => sub {
+       ######################################################################
+
+       plan tests => 3;
+
+      SKIP: {
+         skip "Certificate Transparency is not supported by this OpenSSL build", 3
+             if $no_ct;
+         skip "TLSv1.0 is not supported by this OpenSSL build", 3
+             if $no_tls1;
+
+    $ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
+         ok(run(test([@ssltest, "-bio_pair", "-tls1", "-noct"])));
+         ok(run(test([@ssltest, "-bio_pair", "-tls1", "-requestct"])));
+         # No SCTs provided, so this should fail.
+         ok(run(test([@ssltest, "-bio_pair", "-tls1", "-requirect",
+                      "-should_negotiate", "fail-client"])));
+       }
+    };
+
 }
 
 sub testsslproxy {