kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
4b1510c71e
boringssl/ssl/test/test_config.h

82 lines
2.3 KiB
C
Raw Normal View History

Move configuration into a dedicated TestConfig struct. This removes some duplicate code in parsing command-line flags and, more importantly, makes configuration available when constructing the SSL_CTX and avoids a number of globals. Change-Id: I26e2d2285b732f855a2c82752bc8e0db480c3b30 Reviewed-on: https://boringssl-review.googlesource.com/1502 Reviewed-by: Adam Langley <agl@google.com>
2014-08-12 00:51:50 +01:00
/* Copyright (c) 2014, Google Inc.
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
#ifndef HEADER_TEST_CONFIG
#define HEADER_TEST_CONFIG
#include <string>
struct TestConfig {
TestConfig();
Use TCP sockets rather than socketpairs in the SSL tests. This involves more synchronization with child exits as the kernel no longer closes the pre-created pipes for free, but it works on Windows. As long as TCP_NODELAY is set, the performance seems comparable. Though it does involve dealing with graceful socket shutdown. I couldn't get that to work on Windows without draining the socket; not even SO_LINGER worked. Current (untested) theory is that Windows refuses to gracefully shutdown a socket if the peer sends data after we've stopped reading. cmd.ExtraFiles doesn't work on Windows; it doesn't use fds natively, so you can't pass fds 4 and 5. (stdin/stdout/stderr are special slots in CreateProcess.) We can instead use the syscall module directly and mark handles as inheritable (and then pass the numerical values out-of-band), but that requires synchronizing all of our shim.Start() calls and assuming no other thread is spawning a process. PROC_THREAD_ATTRIBUTE_HANDLE_LIST fixes threading problems, but requires wrapping more syscalls. exec.Cmd also doesn't let us launch the process ourselves. Plus it still requires every handle in the list be marked inheritable, so it doesn't help if some other thread is launching a process with bInheritHandles TRUE but NOT using PROC_THREAD_ATTRIBUTE_HANDLE_LIST. (Like Go, though we can take syscall.ForkLock there.) http://blogs.msdn.com/b/oldnewthing/archive/2011/12/16/10248328.aspx The more natively Windows option seems to be named pipes, but that too requires wrapping more system calls. (To be fair, that isn't too painful.) They also involve a listening server, so we'd still have to synchronize with shim.Wait() a la net.TCPListener. Then there's DuplicateHandle, but then we need an out-of-band signal. All in all, one cross-platform implementation with a TCP sockets seems simplest. Change-Id: I38233e309a0fa6814baf61e806732138902347c0 Reviewed-on: https://boringssl-review.googlesource.com/3563 Reviewed-by: Adam Langley <agl@google.com>
2015-02-21 06:54:29 +00:00
int port;
Move configuration into a dedicated TestConfig struct. This removes some duplicate code in parsing command-line flags and, more importantly, makes configuration available when constructing the SSL_CTX and avoids a number of globals. Change-Id: I26e2d2285b732f855a2c82752bc8e0db480c3b30 Reviewed-on: https://boringssl-review.googlesource.com/1502 Reviewed-by: Adam Langley <agl@google.com>
2014-08-12 00:51:50 +01:00
bool is_server;
Add initial DTLS tests. Change-Id: I7407261bdb2d788c879f2e67e617a615d9ff8f8b Reviewed-on: https://boringssl-review.googlesource.com/1505 Reviewed-by: Adam Langley <agl@google.com>
2014-08-11 23:43:38 +01:00
bool is_dtls;
Move configuration into a dedicated TestConfig struct. This removes some duplicate code in parsing command-line flags and, more importantly, makes configuration available when constructing the SSL_CTX and avoids a number of globals. Change-Id: I26e2d2285b732f855a2c82752bc8e0db480c3b30 Reviewed-on: https://boringssl-review.googlesource.com/1502 Reviewed-by: Adam Langley <agl@google.com>
2014-08-12 00:51:50 +01:00
bool resume;
bool fallback_scsv;
std::string key_file;
std::string cert_file;
std::string expected_server_name;
std::string expected_certificate_types;
bool require_any_client_certificate;
std::string advertise_npn;
std::string expected_next_proto;
bool false_start;
std::string select_next_proto;
bool async;
bool write_different_record_sizes;
bool cbc_record_splitting;
bool partial_write;
bool no_tls12;
bool no_tls11;
bool no_tls1;
bool no_ssl3;
Add basic TLS Channel ID tests. Change-Id: I7ccf2b8282dfa8f3985775e8b67edcf3c2949752 Reviewed-on: https://boringssl-review.googlesource.com/1606 Reviewed-by: Adam Langley <agl@google.com>
2014-08-24 06:46:07 +01:00
std::string expected_channel_id;
std::string send_channel_id;
Add a test to ensure False Start occurs. This adds the missing test coverage for 7e3305eebd7fb06d57e7f25b3bbf9c10d526f7d5. Change-Id: I8c9f1dc998afa9bb1f6fb2a7872a651037bb4844 Reviewed-on: https://boringssl-review.googlesource.com/1610 Reviewed-by: Adam Langley <agl@google.com>
2014-08-24 08:47:07 +01:00
bool shim_writes_first;
Add a test for SSL_OP_TLS_D5_BUG. If this is part of SSL_OP_ALL, we should have a test for it. Change-Id: Ia72422beb2da6434726e78e174f3416f90f7c897 Reviewed-on: https://boringssl-review.googlesource.com/1695 Reviewed-by: Adam Langley <agl@google.com>
2014-08-31 05:59:27 +01:00
bool tls_d5_bug;
Improve test coverage for server_name extension. Notably, this would have caught ed8270a55c3845abbc85dfeed358597fef059ea9 (although, apart from staring at code coverage, knowing to set resumeSession on the server test isn't exactly obvious). Perhaps we should systematically set it on all extension server tests; ClientHello extension parsing happens after resumption has been determined and is often sensitive to it. Change-Id: Ie83f294a26881a6a41969e9dbd102d0a93cb68b5 Reviewed-on: https://boringssl-review.googlesource.com/1750 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 17:45:15 +01:00
std::string host_name;
Add tests for ALPN support. Both as client and as server. Also tests that ALPN causes False Start to kick in. Change-Id: Ib570346f3c511834152cd2df2ef29541946d3ab4 Reviewed-on: https://boringssl-review.googlesource.com/1753 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 17:58:58 +01:00
std::string advertise_alpn;
std::string expected_alpn;
std::string expected_advertised_alpn;
std::string select_alpn;
Add tests for client version negotiation and session resumption. BUG=chromium:417134 Change-Id: If5914be98026d899000fde267b2d329861ca3136 Reviewed-on: https://boringssl-review.googlesource.com/1822 Reviewed-by: Adam Langley <agl@google.com>
2014-09-24 20:21:44 +01:00
bool expect_session_miss;
Extended master secret support. This change implements support for the extended master secret. See https://tools.ietf.org/html/draft-ietf-tls-session-hash-01 https://secure-resumption.com/ Change-Id: Ifc7327763149ab0894b4f1d48cdc35e0f1093b93 Reviewed-on: https://boringssl-review.googlesource.com/1930 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2014-10-11 00:23:43 +01:00
bool expect_extended_master_secret;
Add tests for PSK cipher suites. Only the three plain PSK suites for now. ECDHE_PSK_WITH_AES_128_GCM_SHA256 will be in a follow-up. Change-Id: Iafc116a5b2798c61d90c139b461cf98897ae23b3 Reviewed-on: https://boringssl-review.googlesource.com/2051 Reviewed-by: Adam Langley <agl@google.com>
2014-10-27 05:06:24 +00:00
std::string psk;
std::string psk_identity;
Test server-side renegotiation. This change adds support to the Go code for renegotiation as a client, meaning that we can test BoringSSL's renegotiation as a server. Change-Id: Iaa9fb1a6022c51023bce36c47d4ef7abee74344b Reviewed-on: https://boringssl-review.googlesource.com/2082 Reviewed-by: Adam Langley <agl@google.com>
2014-10-29 00:29:33 +00:00
bool renegotiate;
Add tests for client-initiated renegotiation. These'll get removed once most of renego support is gone, but this is to prove removing the warning alert from the previous commit still prevents legacy renegotiations. Change-Id: I7d9d95e1d4c5d23d3b6d170938a5499a65f2d5ea Reviewed-on: https://boringssl-review.googlesource.com/2236 Reviewed-by: Adam Langley <agl@google.com>
2014-11-08 17:31:52 +00:00
bool allow_unsafe_legacy_renegotiation;
Add DTLS-SRTP tests. Just the negotiation portion as everything else is external. This feature is used in WebRTC. Change-Id: Iccc3983ea99e7d054b59010182f9a56a8099e116 Reviewed-on: https://boringssl-review.googlesource.com/2310 Reviewed-by: Adam Langley <agl@google.com>
2014-11-16 00:06:08 +00:00
std::string srtp_profiles;
Add tests for OCSP stapling and SCT lists. We forgot to add those when we implemented the features. (Also relevant because they will provide test coverage later for configuring features when using the generic method tables rather than *_client_method.) Change-Id: Ie08b27de893095e01a05a7084775676616459807 Reviewed-on: https://boringssl-review.googlesource.com/2410 Reviewed-by: Adam Langley <agl@google.com>
2014-11-25 06:55:35 +00:00
bool enable_ocsp_stapling;
std::string expected_ocsp_response;
bool enable_signed_cert_timestamps;
std::string expected_signed_cert_timestamps;
ClientHello Padding for Fast Radio Opening in 3G. The ClientHello record is padded to 1024 bytes when fastradio_padding is enabled. As a result, the 3G cellular radio is fast forwarded to DCH (high data rate) state. This mechanism leads to a substantial redunction in terms of TLS handshake latency, and benefits mobile apps that are running on top of TLS. Change-Id: I3d55197b6d601761c94c0f22871774b5a3dad614
2014-11-22 06:47:56 +00:00
bool fastradio_padding;
Add min_version and max_version APIs. Amend the version negotiation tests to test this new spelling of max_version. min_version will be tested in a follow-up. Change-Id: Ic4bfcd43bc4e5f951140966f64bb5fd3e2472b01 Reviewed-on: https://boringssl-review.googlesource.com/2583 Reviewed-by: Adam Langley <agl@google.com>
2014-12-12 23:17:51 +00:00
int min_version;
int max_version;
Add a basic MTU test. The minimum MTU (not consistently enforced) is just under 256, so it's difficult to test everything, but this is a basic test. (E.g., without renego, the only handshake message with encryption is Finished which fits in the MTU.) It tests the server side because the Certificate message is large enough to require fragmentation. Change-Id: Ida11f1057cebae2b800ad13696f98bb3a7fbbc5e Reviewed-on: https://boringssl-review.googlesource.com/2824 Reviewed-by: Adam Langley <agl@google.com>
2015-01-11 21:29:36 +00:00
int mtu;
Initialize the record buffers after the handshake check. The new V2ClientHello sniff asserts, for safety, that nothing else has initialized the record layer before it runs. However, OpenSSL allows you to avoid explicitly calling SSL_connect/SSL_accept and instead let SSL_read/SSL_write implicitly handshake for you. This check happens at a fairly low-level in the ssl3_read_bytes function, at which point the record layer has already been initialized. Add some tests to ensure this mode works. (Later we'll lift the handshake check to a higher-level which is probably simpler.) Change-Id: Ibeb7fb78e5eb75af5411ba15799248d94f12820b Reviewed-on: https://boringssl-review.googlesource.com/3334 Reviewed-by: Adam Langley <agl@google.com>
2015-02-09 00:33:25 +00:00
bool implicit_handshake;
Add tests for installing the certificate on the early callback. Test both asynchronous and synchronous versions. This callback is somewhat different from others. It's NOT called a second time when the handshake is resumed. This appears to be intentional and not a mismerge from the internal patch. The caller is expected to set up any state before resuming the handshake state machine. Also test the early callback returning an error. Change-Id: If5e6eddd7007ea5cdd7533b4238e456106b95cbd Reviewed-on: https://boringssl-review.googlesource.com/3590 Reviewed-by: Adam Langley <agl@google.com>
2015-02-24 06:23:21 +00:00
bool use_early_callback;
bool fail_early_callback;
Add a callback for DDoS protection. This callback receives information about the ClientHello and can decide whether or not to allow the handshake to continue. Change-Id: I21be28335fa74fedb5b73a310ee24310670fc923 Reviewed-on: https://boringssl-review.googlesource.com/3721 Reviewed-by: Adam Langley <agl@google.com>
2015-02-21 00:04:00 +00:00
bool install_ddos_callback;
bool fail_ddos_callback;
bool fail_second_ddos_callback;
Move configuration into a dedicated TestConfig struct. This removes some duplicate code in parsing command-line flags and, more importantly, makes configuration available when constructing the SSL_CTX and avoids a number of globals. Change-Id: I26e2d2285b732f855a2c82752bc8e0db480c3b30 Reviewed-on: https://boringssl-review.googlesource.com/1502 Reviewed-by: Adam Langley <agl@google.com>
2014-08-12 00:51:50 +01:00
};
bool ParseConfig(int argc, char **argv, TestConfig *out_config);
#endif // HEADER_TEST_CONFIG
Reference in New Issue Copy Permalink