kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
efb42fbb60
boringssl/ssl/test/test_config.h

108 lines
3.5 KiB
C
Raw Normal View History

Move configuration into a dedicated TestConfig struct. This removes some duplicate code in parsing command-line flags and, more importantly, makes configuration available when constructing the SSL_CTX and avoids a number of globals. Change-Id: I26e2d2285b732f855a2c82752bc8e0db480c3b30 Reviewed-on: https://boringssl-review.googlesource.com/1502 Reviewed-by: Adam Langley <agl@google.com>
2014-08-12 00:51:50 +01:00
/* Copyright (c) 2014, Google Inc.
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
#ifndef HEADER_TEST_CONFIG
#define HEADER_TEST_CONFIG
#include <string>
struct TestConfig {
Use C++11 inline initialization. Google C++ style allows these. It's also considerably less tedious and error-prone than defining an out-of-line constructor. Change-Id: Ib76ccf6079be383722433046ac5c5d796dd1f525 Reviewed-on: https://boringssl-review.googlesource.com/4111 Reviewed-by: Adam Langley <agl@google.com>
2015-03-23 22:46:05 +00:00
int port = 0;
bool is_server = false;
bool is_dtls = false;
bool resume = false;
bool fallback_scsv = false;
Adding more options for signing digest fallback. Allow configuring digest preferences for the private key. Some smartcards have limited support for signing digests, notably Windows CAPI keys and old Estonian smartcards. Chromium used the supports_digest hook in SSL_PRIVATE_KEY_METHOD to limit such keys to SHA1. However, detecting those keys was a heuristic, so some SHA256-capable keys authenticating to SHA256-only servers regressed in the switch to BoringSSL. Replace this mechanism with an API to configure digest preference order. This way heuristically-detected SHA1-only keys may be configured by Chromium as SHA1-preferring rather than SHA1-requiring. In doing so, clean up the shared_sigalgs machinery somewhat. BUG=468076 Change-Id: I996a2df213ae4d8b4062f0ab85b15262ca26f3c6 Reviewed-on: https://boringssl-review.googlesource.com/5755 Reviewed-by: Adam Langley <agl@google.com>
2015-09-04 17:41:04 +01:00
std::string digest_prefs;
Move configuration into a dedicated TestConfig struct. This removes some duplicate code in parsing command-line flags and, more importantly, makes configuration available when constructing the SSL_CTX and avoids a number of globals. Change-Id: I26e2d2285b732f855a2c82752bc8e0db480c3b30 Reviewed-on: https://boringssl-review.googlesource.com/1502 Reviewed-by: Adam Langley <agl@google.com>
2014-08-12 00:51:50 +01:00
std::string key_file;
std::string cert_file;
std::string expected_server_name;
std::string expected_certificate_types;
Use C++11 inline initialization. Google C++ style allows these. It's also considerably less tedious and error-prone than defining an out-of-line constructor. Change-Id: Ib76ccf6079be383722433046ac5c5d796dd1f525 Reviewed-on: https://boringssl-review.googlesource.com/4111 Reviewed-by: Adam Langley <agl@google.com>
2015-03-23 22:46:05 +00:00
bool require_any_client_certificate = false;
Move configuration into a dedicated TestConfig struct. This removes some duplicate code in parsing command-line flags and, more importantly, makes configuration available when constructing the SSL_CTX and avoids a number of globals. Change-Id: I26e2d2285b732f855a2c82752bc8e0db480c3b30 Reviewed-on: https://boringssl-review.googlesource.com/1502 Reviewed-by: Adam Langley <agl@google.com>
2014-08-12 00:51:50 +01:00
std::string advertise_npn;
std::string expected_next_proto;
Use C++11 inline initialization. Google C++ style allows these. It's also considerably less tedious and error-prone than defining an out-of-line constructor. Change-Id: Ib76ccf6079be383722433046ac5c5d796dd1f525 Reviewed-on: https://boringssl-review.googlesource.com/4111 Reviewed-by: Adam Langley <agl@google.com>
2015-03-23 22:46:05 +00:00
bool false_start = false;
Move configuration into a dedicated TestConfig struct. This removes some duplicate code in parsing command-line flags and, more importantly, makes configuration available when constructing the SSL_CTX and avoids a number of globals. Change-Id: I26e2d2285b732f855a2c82752bc8e0db480c3b30 Reviewed-on: https://boringssl-review.googlesource.com/1502 Reviewed-by: Adam Langley <agl@google.com>
2014-08-12 00:51:50 +01:00
std::string select_next_proto;
Use C++11 inline initialization. Google C++ style allows these. It's also considerably less tedious and error-prone than defining an out-of-line constructor. Change-Id: Ib76ccf6079be383722433046ac5c5d796dd1f525 Reviewed-on: https://boringssl-review.googlesource.com/4111 Reviewed-by: Adam Langley <agl@google.com>
2015-03-23 22:46:05 +00:00
bool async = false;
bool write_different_record_sizes = false;
bool cbc_record_splitting = false;
bool partial_write = false;
bool no_tls12 = false;
bool no_tls11 = false;
bool no_tls1 = false;
bool no_ssl3 = false;
Add basic TLS Channel ID tests. Change-Id: I7ccf2b8282dfa8f3985775e8b67edcf3c2949752 Reviewed-on: https://boringssl-review.googlesource.com/1606 Reviewed-by: Adam Langley <agl@google.com>
2014-08-24 06:46:07 +01:00
std::string expected_channel_id;
std::string send_channel_id;
Use C++11 inline initialization. Google C++ style allows these. It's also considerably less tedious and error-prone than defining an out-of-line constructor. Change-Id: Ib76ccf6079be383722433046ac5c5d796dd1f525 Reviewed-on: https://boringssl-review.googlesource.com/4111 Reviewed-by: Adam Langley <agl@google.com>
2015-03-23 22:46:05 +00:00
bool shim_writes_first = false;
bool tls_d5_bug = false;
Improve test coverage for server_name extension. Notably, this would have caught ed8270a55c3845abbc85dfeed358597fef059ea9 (although, apart from staring at code coverage, knowing to set resumeSession on the server test isn't exactly obvious). Perhaps we should systematically set it on all extension server tests; ClientHello extension parsing happens after resumption has been determined and is often sensitive to it. Change-Id: Ie83f294a26881a6a41969e9dbd102d0a93cb68b5 Reviewed-on: https://boringssl-review.googlesource.com/1750 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 17:45:15 +01:00
std::string host_name;
Add tests for ALPN support. Both as client and as server. Also tests that ALPN causes False Start to kick in. Change-Id: Ib570346f3c511834152cd2df2ef29541946d3ab4 Reviewed-on: https://boringssl-review.googlesource.com/1753 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 17:58:58 +01:00
std::string advertise_alpn;
std::string expected_alpn;
std::string expected_advertised_alpn;
std::string select_alpn;
Use C++11 inline initialization. Google C++ style allows these. It's also considerably less tedious and error-prone than defining an out-of-line constructor. Change-Id: Ib76ccf6079be383722433046ac5c5d796dd1f525 Reviewed-on: https://boringssl-review.googlesource.com/4111 Reviewed-by: Adam Langley <agl@google.com>
2015-03-23 22:46:05 +00:00
bool expect_session_miss = false;
bool expect_extended_master_secret = false;
Add tests for PSK cipher suites. Only the three plain PSK suites for now. ECDHE_PSK_WITH_AES_128_GCM_SHA256 will be in a follow-up. Change-Id: Iafc116a5b2798c61d90c139b461cf98897ae23b3 Reviewed-on: https://boringssl-review.googlesource.com/2051 Reviewed-by: Adam Langley <agl@google.com>
2014-10-27 05:06:24 +00:00
std::string psk;
std::string psk_identity;
Add DTLS-SRTP tests. Just the negotiation portion as everything else is external. This feature is used in WebRTC. Change-Id: Iccc3983ea99e7d054b59010182f9a56a8099e116 Reviewed-on: https://boringssl-review.googlesource.com/2310 Reviewed-by: Adam Langley <agl@google.com>
2014-11-16 00:06:08 +00:00
std::string srtp_profiles;
Use C++11 inline initialization. Google C++ style allows these. It's also considerably less tedious and error-prone than defining an out-of-line constructor. Change-Id: Ib76ccf6079be383722433046ac5c5d796dd1f525 Reviewed-on: https://boringssl-review.googlesource.com/4111 Reviewed-by: Adam Langley <agl@google.com>
2015-03-23 22:46:05 +00:00
bool enable_ocsp_stapling = false;
Add tests for OCSP stapling and SCT lists. We forgot to add those when we implemented the features. (Also relevant because they will provide test coverage later for configuring features when using the generic method tables rather than *_client_method.) Change-Id: Ie08b27de893095e01a05a7084775676616459807 Reviewed-on: https://boringssl-review.googlesource.com/2410 Reviewed-by: Adam Langley <agl@google.com>
2014-11-25 06:55:35 +00:00
std::string expected_ocsp_response;
Use C++11 inline initialization. Google C++ style allows these. It's also considerably less tedious and error-prone than defining an out-of-line constructor. Change-Id: Ib76ccf6079be383722433046ac5c5d796dd1f525 Reviewed-on: https://boringssl-review.googlesource.com/4111 Reviewed-by: Adam Langley <agl@google.com>
2015-03-23 22:46:05 +00:00
bool enable_signed_cert_timestamps = false;
Add tests for OCSP stapling and SCT lists. We forgot to add those when we implemented the features. (Also relevant because they will provide test coverage later for configuring features when using the generic method tables rather than *_client_method.) Change-Id: Ie08b27de893095e01a05a7084775676616459807 Reviewed-on: https://boringssl-review.googlesource.com/2410 Reviewed-by: Adam Langley <agl@google.com>
2014-11-25 06:55:35 +00:00
std::string expected_signed_cert_timestamps;
Use C++11 inline initialization. Google C++ style allows these. It's also considerably less tedious and error-prone than defining an out-of-line constructor. Change-Id: Ib76ccf6079be383722433046ac5c5d796dd1f525 Reviewed-on: https://boringssl-review.googlesource.com/4111 Reviewed-by: Adam Langley <agl@google.com>
2015-03-23 22:46:05 +00:00
int min_version = 0;
int max_version = 0;
int mtu = 0;
bool implicit_handshake = false;
bool use_early_callback = false;
bool fail_early_callback = false;
bool install_ddos_callback = false;
bool fail_ddos_callback = false;
bool fail_second_ddos_callback = false;
Test that client cipher preferences are enforced. Change-Id: I6e760cfd785c0c5688da6f7d3d3092a8add40409 Reviewed-on: https://boringssl-review.googlesource.com/4070 Reviewed-by: Adam Langley <agl@google.com>
2015-03-16 19:16:23 +00:00
std::string cipher;
Add cipher suite settings for TLS ≥ 1.0. This change adds the ability to configure ciphers specifically for TLS ≥ 1.0. This compliments the existing ability to specify ciphers for TLS ≥ 1.1. This is useful because TLS 1.0 is the first version not to suffer from POODLE. (Assuming that it's implemented correctly[1].) Thus one might wish to reserve RC4 solely for SSLv3. [1] https://www.imperialviolet.org/2014/12/08/poodleagain.html Change-Id: I774d5336fead48f03d8a0a3cf80c369692ee60df Reviewed-on: https://boringssl-review.googlesource.com/5793 Reviewed-by: Adam Langley <agl@google.com>
2015-09-03 22:51:12 +01:00
std::string cipher_tls10;
std::string cipher_tls11;
Test the interaction of SSL_CB_HANDSHAKE_DONE and False Start. Based on whether -false-start is passed, we expect SSL_CB_HANDSHAKE_DONE to or not to fire. Also add a flag that asserts SSL_CB_HANDSHAKE_DONE does *not* fire in any False Start test where the handshake fails after SSL_connect returns. Change-Id: I6c5b960fff15e297531e15b16abe0b98be95bec8 Reviewed-on: https://boringssl-review.googlesource.com/4212 Reviewed-by: Adam Langley <agl@google.com>
2015-04-03 00:57:35 +01:00
bool handshake_never_done = false;
Add tests for SSL_export_keying_material. Change-Id: Ic4d3ade08aa648ce70ada9981e894b6c1c4197c6 Reviewed-on: https://boringssl-review.googlesource.com/4215 Reviewed-by: Adam Langley <agl@google.com>
2015-04-03 09:06:36 +01:00
int export_keying_material = 0;
std::string export_label;
std::string export_context;
bool use_export_context = false;
Add client-side tests for renegotiation_info enforcement. Since we hope to eventually lose server-side renegotiation support altogether, get the client-side version of those tests. We should have had those anyway to test that the default is to allow it. BUG=429450 Change-Id: I4a18f339b55f3f07d77e22e823141e10a12bc9ff Reviewed-on: https://boringssl-review.googlesource.com/4780 Reviewed-by: Adam Langley <agl@google.com>
2015-05-16 04:09:47 +01:00
bool no_legacy_server_connect = false;
Add SSL_get_tls_unique. SSL_get_tls_unique returns the tls-unique channel-binding value as defined in https://tools.ietf.org/html/rfc5929#section-3.1. Change-Id: Id9644328a7db8a91cf3ff0deee9dd6ce0d3e00ba Reviewed-on: https://boringssl-review.googlesource.com/4984 Reviewed-by: Adam Langley <agl@google.com>
2015-06-03 17:57:23 +01:00
bool tls_unique = false;
Don't put sessions from renegotiations in the cache. Rather than rely on Chromium to query SSL_initial_handshake_complete in the callback (which didn't work anyway because the callback is called afterwards), move the logic into BoringSSL. BoringSSL already enforces that clients never offer resumptions on renegotiation (it wouldn't work well anyway as client session cache lookup is external), so it's reasonable to also implement in-library that sessions established on a renegotiation are not cached. Add a bunch of tests that new_session_cb is called when expected. BUG=501418 Change-Id: I42d44c82b043af72b60a0f8fdb57799e20f13ed5 Reviewed-on: https://boringssl-review.googlesource.com/5171 Reviewed-by: Adam Langley <agl@google.com>
2015-06-18 23:36:15 +01:00
bool expect_ticket_renewal = false;
bool expect_no_session = false;
Add a test for the ticket callback. Change-Id: I7b2a4f617bd8d49c86fdaaf45bf67e0170bbd44f Reviewed-on: https://boringssl-review.googlesource.com/5230 Reviewed-by: Adam Langley <agl@google.com>
2015-06-16 19:16:23 +01:00
bool use_ticket_callback = false;
bool renew_ticket = false;
Implement custom extensions. This change mirrors upstream's custom extension API because we have some internal users that depend on it. Change-Id: I408e442de0a55df7b05c872c953ff048cd406513 Reviewed-on: https://boringssl-review.googlesource.com/5471 Reviewed-by: Adam Langley <agl@google.com>
2015-07-31 02:10:13 +01:00
bool enable_client_custom_extension = false;
bool enable_server_custom_extension = false;
bool custom_extension_skip = false;
bool custom_extension_fail_add = false;
Server-side OCSP stapling support. This is a simpler implementation than OpenSSL's, lacking responder IDs and request extensions support. This mirrors the client implementation already present. Change-Id: I54592b60e0a708bfb003d491c9250401403c9e69 Reviewed-on: https://boringssl-review.googlesource.com/5700 Reviewed-by: Adam Langley <agl@google.com>
2015-08-12 11:47:11 +01:00
std::string ocsp_response;
Add tests for bidirectional shutdown. Now that it even works at all (type = 0 bug aside), add tests for it. Test both close_notify being received before and after SSL_shutdown is called. In the latter case, have the peer send some junk to be ignored to test that works. Also test that SSL_shutdown fails on unclean shutdown and that quiet shutdowns ignore it. BUG=526437 Change-Id: Iff13b08feb03e82f21ecab0c66d5f85aec256137 Reviewed-on: https://boringssl-review.googlesource.com/5769 Reviewed-by: Adam Langley <agl@google.com>
2015-08-30 03:56:45 +01:00
bool check_close_notify = false;
bool shim_shuts_down = false;
Fix buffer size computation. The maximum buffer size computation wasn't quite done right in ssl_buffer.c, so we were failing with BUFFER_TOO_SMALL for sufficiently large records. Fix this and, as penance, add 103 tests. (Test that we can receive maximum-size records in all cipher suites. Also test SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER while I'm here.) BUG=526998 Change-Id: I714c16dda2ed13f49d8e6cd1b48adc5a8491f43c Reviewed-on: https://boringssl-review.googlesource.com/5785 Reviewed-by: Adam Langley <agl@google.com>
2015-09-01 15:23:00 +01:00
bool microsoft_big_sslv3_buffer = false;
Wait for CertificateStatus message to verify certificate. Applications may require the stapled OCSP response in order to verify the certificate within the verification callback. Change-Id: I8002e527f90c3ce7b6a66e3203c0a68371aac5ec Reviewed-on: https://boringssl-review.googlesource.com/5730 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2015-08-18 12:21:54 +01:00
bool verify_fail = false;
bool verify_peer = false;
bool expect_verify_result = false;
Add server-side support for Signed Certificate Timestamps. Change-Id: Ifa44fef160fc9d67771eed165f8fc277f28a0222 Reviewed-on: https://boringssl-review.googlesource.com/5840 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2015-09-09 13:44:55 +01:00
std::string signed_cert_timestamps;
Unbreak SSL_total_renegotiations. The logic to update that got removed in https://boringssl-review.googlesource.com/4825. Add tests. Change-Id: Idc550e8fa3ce6f69a76fa65d7651adde281edba6 Reviewed-on: https://boringssl-review.googlesource.com/6220 Reviewed-by: Matt Braithwaite <mab@google.com> Reviewed-by: Adam Langley <alangley@gmail.com> Reviewed-by: Adam Langley <agl@google.com>
2015-10-13 00:49:00 +01:00
int expect_total_renegotiations = 0;
Add SSL_set_renegotiate_mode. Add a slightly richer API. Notably, one can configure ssl_renegotiate_once to only accept the first renego. Also, this API doesn't repeat the mistake I made with SSL_set_reject_peer_renegotiations which is super-confusing with the negation. Change-Id: I7eb5d534e3e6c553b641793f4677fe5a56451c71 Reviewed-on: https://boringssl-review.googlesource.com/6221 Reviewed-by: Adam Langley <agl@google.com>
2015-10-13 00:54:18 +01:00
bool renegotiate_once = false;
bool renegotiate_freely = false;
Add an option to disable NPN on a per-SSL basis. Right whether NPN is advertised can only be configured globally on the SSL_CTX. Rather than adding two pointers to each SSL*, add an options bit to disable it so we may plumb in a field trial to disable NPN. Chromium wants to be able to route a bit in to disable NPN, but it uses SSL_CTX incorrectly and has a global one, so it can't disconnect the callback. (That really needs to get fixed. Although it's not clear this necessarily wants to be lifted up to SSL_CTX as far as Chromium's SSLClientSocket is concerned since NPN doesn't interact with the session cache.) BUG=526713 Change-Id: I49c86828b963eb341c6ea6a442557b7dfa190ed3 Reviewed-on: https://boringssl-review.googlesource.com/6351 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-26 17:33:21 +00:00
bool disable_npn = false;
Move configuration into a dedicated TestConfig struct. This removes some duplicate code in parsing command-line flags and, more importantly, makes configuration available when constructing the SSL_CTX and avoids a number of globals. Change-Id: I26e2d2285b732f855a2c82752bc8e0db480c3b30 Reviewed-on: https://boringssl-review.googlesource.com/1502 Reviewed-by: Adam Langley <agl@google.com>
2014-08-12 00:51:50 +01:00
};
bool ParseConfig(int argc, char **argv, TestConfig *out_config);
#endif // HEADER_TEST_CONFIG
Reference in New Issue Copy Permalink