openssl/README.ssltest.md at master - GitHub

SSL tests. SSL testcases are configured in the ssl-tests directory. Each ssl_*.cnf.in file contains a number of test configurations. Skiptocontent {{message}} openssl / openssl Public Notifications Star 16.9k Fork 7.4k Code Issues 1.3k Pullrequests 218 Actions Projects 2 Wiki Security Insights More Code Issues Pullrequests Actions Projects Wiki Security Insights Permalink master Branches Tags Couldnotloadbranches Nothingtoshow Loading {{refName}} default Couldnotloadtags Nothingtoshow {{refName}} default Loading openssl/test/README.ssltest.md Gotofile Gotofile T Gotoline L Copypath Copypermalink     Cannotretrievecontributorsatthistime SSLtests Configuringthetest Testmode Testexpectations Configuringtheclientandserver Configuringcallbacksandadditionaloptions Supportedclient-sideoptions Supportedserver-sideoptions Mutuallysupportedoptions Defaultserverandclientconfigurations Addingatesttothetestharness Runningthetestswiththetestharness Runningatestmanually 285lines(205sloc) 10.4KB Raw Blame OpenwithDesktop Viewraw Viewblame SSLtests SSLtestcasesareconfiguredinthessl-testsdirectory. Eachssl_*.cnf.infilecontainsanumberoftestconfigurations.Thesefiles areusedtogeneratetestcasesintheOpenSSLCONFformat. Theprecisetestoutputcanbedependentonthelibraryconfiguration.Thetest harnessgeneratestheoutputfilesonthefly. However,forverification,wealsoincludechecked-inconfigurationoutputs correspondingtothedefaultconfiguration.Thesetestcaseslivein test/ssl-tests/*.cnffiles. Formoredetails,seessl-tests/01-simple.cnf.inforanexample. Configuringthetest First,giveyourtestaname.Thenamesdonothavetobeunique. Anexampletestinputlookslikethis: { name=>"test-default", server=>{"CipherString"=>"DEFAULT"}, client=>{"CipherString"=>"DEFAULT"}, test=>{"ExpectedResult"=>"Success"}, } Thetestsectionsupportsthefollowingoptions Testmode Method-themethodtotest.OneofDTLSorTLS. HandshakeMode-whichhandshakeflavourtotest: Simple-plainhandshake(default) Resume-testresumption RenegotiateServer-testserverinitiatedrenegotiation RenegotiateClient-testclientinitiatedrenegotiation WhenHandshakeModeisResumeorRenegotiate,theoriginalhandshakeisexpected tosucceed.Allconfiguredtestexpectationsareverifiedagainstthesecond handshake. ApplicationData-amountofapplicationdatabytestosend(integer,defaults to256bytes).Appliestobothclientandserver.Applicationdataissentin 64kBchunks(butlimitedbyMaxFragmentSizeandavailableparallelization,see below). MaxFragmentSize-maximumsendfragmentsize(integer,defaultsto512in tests-seeSSL_CTX_set_max_send_fragmentfordocumentation).Appliesto bothclientandserver.Loweringthefragmentsizewillsplithandshakeand applicationdataupbetweenmoreSSL_writecalls,thusallowingtoexercise differentcodepaths.Inparticular,ifthebuffersize(64kB)isatleast fourtimesaslargeasthemaximumfragment,interleavedmulti-buffercrypto implementationsmaybeusedonsomeplatforms. Testexpectations ExpectedResult-expectedhandshakeoutcome.Oneof Success-handshakesuccess ServerFail-serversidehandshakefailure ClientFail-clientsidehandshakefailure InternalError-someothererror ExpectedClientAlert,ExpectedServerAlert-expectedalert.See test/helpers/ssl_test_ctx.cforknownvalues.Note:theexpectedalertiscurrently matchedagainstthelastreceivedalert(i.e.,afatalalertora close_notify).Warningalertexpectationsarenotyetsupported.(Awarning alertwillnotbecorrectlymatched,iffollowedbyaclose_notifyor anotheralert.) ExpectedProtocol-expectednegotiatedprotocol.Oneof SSLv3,TLSv1,TLSv1.1,TLSv1.2. SessionTicketExpected-whetherornotasessionticketisexpected Ignore-donotcheckforasessionticket(default) Yes-asessionticketisexpected No-asessionticketisnotexpected SessionIdExpected-whetherornotasessionidisexpected Ignore-donotcheckforasessionid(default) Yes-asessionidisexpected No-asessionidisnotexpected ResumptionExpected-whetherornotresumptionisexpected(Resumemodeonly) Yes-resumedhandshake No-fullhandshake(default) ExpectedNPNProtocol,ExpectedALPNProtocol-NPNandALPNexpectations. ExpectedTmpKeyType-theexpectedalgorithmorcurveofservertempkey ExpectedServerCertType,ExpectedClientCertType-theexpectedalgorithmor curveofserverorclientcertificate ExpectedServerSignHash,ExpectedClientSignHash-theexpected signinghashusedbyserverorclientcertificate ExpectedServerSignType,ExpectedClientSignType-theexpected signaturetypeusedbyserverorclientwhensigningmessages ExpectedClientCANames-forclientauthlistofCAnamestheservermust send.Ifthisis"empty"thelistisexpectedtobeemptyotherwiseit isafileofcertificateswhosesubjectnamesformthelist. ExpectedServerCANames-listofCAnamestheclientmustsend,TLS1.3only. Ifthisis"empty"thelistisexpectedtobeemptyotherwiseitisafile ofcertificateswhosesubjectnamesformthelist. Configuringtheclientandserver TheclientandserverconfigurationscanbeanyvalidSSL_CTX configurations.Fordetails,seethemanpagesforSSL_CONF_cmd. GiveyourconfigurationsasadictionaryofCONFcommands,e.g. server=>{ "CipherString"=>"DEFAULT", "MinProtocol"=>"TLSv1", } Thefollowingsectionsmayoptionallybedefined: server2-thissectionconfiguresasecondarycontextthatisselectedviathe ServerNametestoption.ThiscontextisusedwheneveraServerNameCallbackis specified.Iftheserver2sectionisnotpresent,thentheconfiguration matchesserver. resume_server-thissectionconfigurestheclienttoresumeitssession againstadifferentserver.ThiscontextisusedwheneverHandshakeModeis Resume.Iftheresume_serversectionisnotpresent,thentheconfiguration matchesserver. resume_client-thissectionconfigurestheclienttoresumeitssessionwith adifferentconfiguration.Inpracticethismayoccurwhen,forexample, upgradedclientsreusesessionspersistedondisk.Thiscontextisused wheneverHandshakeModeisResume.Iftheresume_clientsectionisnotpresent, thentheconfigurationmatchesclient. Configuringcallbacksandadditionaloptions Additionalhandshakesettingscanbeconfiguredintheextrasectionofeach clientandserver: client=>{ "CipherString"=>"DEFAULT", extra=>{ "ServerName"=>"server2", } } Supportedclient-sideoptions ClientVerifyCallback-theclient'scustomcertificateverifycallback. Usedtotestcallbackbehaviour.Oneof None-nocustomcallback(default) AcceptAll-acceptsallcertificates. RejectAll-rejectsallcertificates. ServerName-theservertheclientshouldattempttoconnectto.Oneof None-donotuseSNI(default) server1-theinitialcontext server2-thesecondarycontext invalid-anunknowncontext CTValidation-CertificateTransparencyvalidationstrategy.Oneof None-novalidation(default) Permissive-SSL_CT_VALIDATION_PERMISSIVE Strict-SSL_CT_VALIDATION_STRICT Supportedserver-sideoptions ServerNameCallback-theSNIswitchingcallbacktouse None-nocallback(default) IgnoreMismatch-continuethehandshakeonSNImismatch RejectMismatch-abortthehandshakeonSNImismatch BrokenSessionTicket-aspecialtestcasewherethesessionticketcallback doesnotinitializecrypto. No(default) Yes Mutuallysupportedoptions NPNProtocols,ALPNProtocols-NPNandALPNsettings.Serverandclient protocolscanbespecifiedasacomma-separatedlist,andacallbackwiththe recommendedbehaviourwillbeinstalledautomatically. SRPUser,SRPPassword-SRPsettings.Forclient,thisistheSRPuserto connectas;forserver,thisisaknownSRPuser. Defaultserverandclientconfigurations ThedefaultservercertificateandCAfilesareaddedtotheconfigurations automatically.Servercertificateverificationisrequestedbydefault. Youcanoverridetheseoptionsbyredefiningthem: client=>{ "VerifyCAFile"=>"/path/to/custom/file" } orbydeletingthem client=>{ "VerifyCAFile"=>undef } Addingatesttothetestharness Addanewtestconfigurationtotest/ssl-tests,followingtheexamplesof existing*.cnf.infiles(forexample,01-simple.cnf.in). Generatethegenerated*.cnftestinputfile.Youcandosobyrunning generate_ssl_tests.pl: $./config $cdtest $TOP=..perl-I../util/perl/generate_ssl_tests.pl ssl-tests/my.cnf.indefault>ssl-tests/my.cnf wheremy.cnf.inisyourtestinputfileanddefaultistheprovidertouse. Forallthepre-generatedtestfilesyoushouldusethedefaultprovider. Forexample,togeneratethetestcasesinssl-tests/01-simple.cnf.in,do $TOP=..perl-I../util/perl/generate_ssl_tests.pl\ ssl-tests/01-simple.cnf.indefault>ssl-tests/01-simple.cnf Alternatively(hackishbutsimple),youcancommentout unlinkglob$tmp_file; intest/recipes/80-test_ssl_new.tandrun $makeTESTS=test_ssl_newtest Thiswillsavethegeneratedoutputina*.tmpfileinthebuilddirectory. Updatethenumberoftestsplannedintest/recipes/80-test_ssl_new.t.If thetestsuitehasanyskipconditions,updatethosetoo(see test/recipes/80-test_ssl_new.tfordetails). Runningthetestswiththetestharness HARNESS_VERBOSE=yesmakeTESTS=test_ssl_newtest Runningatestmanually Thesestepsareonlyneededduringdevelopment.Endusersshouldrunmaketest orfollowtheinstructionsabovetoruntheSSLtestsuite. TorunanSSLtestmanuallyfromthecommandline,theTEST_CERTS_DIR environmentvariabletopointtothelocationofthecerts.E.g.,fromtheroot OpenSSLdirectory,do $CTLOG_FILE=test/ct/log_list.cnfTEST_CERTS_DIR=test/certstest/ssl_test\ test/ssl-tests/01-simple.cnfdefault orforsharedbuilds $CTLOG_FILE=test/ct/log_list.cnfTEST_CERTS_DIR=test/certs\ util/wrap.pltest/ssl_testtest/ssl-tests/01-simple.cnfdefault Intheaboveexamples,defaultistheprovidertouse. NotethatthetestexpectationssometimesdependontheConfiguresettings.For example,thenegotiatedprotocoldependsonthesetofavailable(enabled) protocols:abuildwithenable-ssl3hasdifferenttestexpectationsthana buildwithno-ssl3. ThePerltestharnessautomaticallygeneratesexpectedoutputs,souserswho justrunmaketestdonotneedanyextrasteps. However,whenrunningatestmanually,keepinmindthattherepositoryversion ofthegeneratedtest/ssl-tests/*.cnfcorrespondtoexpectedoutputsinwith thedefaultConfigureoptions.Torunssl_testmanuallyfromthecommandline inabuildwithadifferentconfiguration,youmayneedtogeneratetheright *.cnffilefromthe*.cnf.ininputfirst. Go Youcan’tperformthatactionatthistime. Yousignedinwithanothertaborwindow.Reloadtorefreshyoursession. Yousignedoutinanothertaborwindow.Reloadtorefreshyoursession.