summaryrefslogtreecommitdiff
path: root/src/ssl/test/runner/runner.go
diff options
context:
space:
mode:
Diffstat (limited to 'src/ssl/test/runner/runner.go')
-rw-r--r--src/ssl/test/runner/runner.go223
1 files changed, 190 insertions, 33 deletions
diff --git a/src/ssl/test/runner/runner.go b/src/ssl/test/runner/runner.go
index 7e64fe5f..56814d38 100644
--- a/src/ssl/test/runner/runner.go
+++ b/src/ssl/test/runner/runner.go
@@ -199,7 +199,9 @@ var channelIDKey *ecdsa.PrivateKey
var channelIDBytes []byte
var testOCSPResponse = []byte{1, 2, 3, 4}
+var testOCSPResponse2 = []byte{5, 6, 7, 8}
var testSCTList = []byte{0, 6, 0, 4, 5, 6, 7, 8}
+var testSCTList2 = []byte{0, 6, 0, 4, 1, 2, 3, 4}
var testOCSPExtension = append([]byte{byte(extensionStatusRequest) >> 8, byte(extensionStatusRequest), 0, 8, statusTypeOCSP, 0, 0, 4}, testOCSPResponse...)
var testSCTExtension = append([]byte{byte(extensionSignedCertificateTimestamp) >> 8, byte(extensionSignedCertificateTimestamp), 0, byte(len(testSCTList))}, testSCTList...)
@@ -6473,10 +6475,6 @@ func addExtensionTests() {
expectedError: ":UNEXPECTED_EXTENSION:",
})
- var differentSCTList []byte
- differentSCTList = append(differentSCTList, testSCTList...)
- differentSCTList[len(differentSCTList)-1] ^= 1
-
// Test that extensions on intermediates are allowed but ignored.
testCases = append(testCases, testCase{
name: "IgnoreExtensionsOnIntermediates-TLS13",
@@ -6487,8 +6485,8 @@ func addExtensionTests() {
// Send different values on the intermediate. This tests
// the intermediate's extensions do not override the
// leaf's.
- SendOCSPOnIntermediates: []byte{1, 3, 3, 7},
- SendSCTOnIntermediates: differentSCTList,
+ SendOCSPOnIntermediates: testOCSPResponse2,
+ SendSCTOnIntermediates: testSCTList2,
},
},
flags: []string{
@@ -7543,6 +7541,34 @@ func addRenegotiationTests() {
shouldFail: true,
expectedError: ":UNEXPECTED_EXTENSION:",
})
+
+ // The server may send different stapled OCSP responses or SCT lists on
+ // renegotiation, but BoringSSL ignores this and reports the old values.
+ // Also test that non-fatal verify results are preserved.
+ testCases = append(testCases, testCase{
+ testType: clientTest,
+ name: "Renegotiation-ChangeAuthProperties",
+ config: Config{
+ MaxVersion: VersionTLS12,
+ Bugs: ProtocolBugs{
+ SendOCSPResponseOnRenegotiation: testOCSPResponse2,
+ SendSCTListOnRenegotiation: testSCTList2,
+ },
+ },
+ renegotiate: 1,
+ flags: []string{
+ "-renegotiate-freely",
+ "-expect-total-renegotiations", "1",
+ "-enable-ocsp-stapling",
+ "-expect-ocsp-response",
+ base64.StdEncoding.EncodeToString(testOCSPResponse),
+ "-enable-signed-cert-timestamps",
+ "-expect-signed-cert-timestamps",
+ base64.StdEncoding.EncodeToString(testSCTList),
+ "-verify-fail",
+ "-expect-verify-result",
+ },
+ })
}
func addDTLSReplayTests() {
@@ -8782,6 +8808,38 @@ func addDTLSRetransmitTests() {
"-initial-timeout-duration-ms", "250",
},
})
+
+ // If the shim sends the last Finished (server full or client resume
+ // handshakes), it must retransmit that Finished when it sees a
+ // post-handshake penultimate Finished from the runner. The above tests
+ // cover this. Conversely, if the shim sends the penultimate Finished
+ // (client full or server resume), test that it does not retransmit.
+ testCases = append(testCases, testCase{
+ protocol: dtls,
+ testType: clientTest,
+ name: "DTLS-StrayRetransmitFinished-ClientFull",
+ config: Config{
+ MaxVersion: VersionTLS12,
+ Bugs: ProtocolBugs{
+ RetransmitFinished: true,
+ },
+ },
+ })
+ testCases = append(testCases, testCase{
+ protocol: dtls,
+ testType: serverTest,
+ name: "DTLS-StrayRetransmitFinished-ServerResume",
+ config: Config{
+ MaxVersion: VersionTLS12,
+ },
+ resumeConfig: &Config{
+ MaxVersion: VersionTLS12,
+ Bugs: ProtocolBugs{
+ RetransmitFinished: true,
+ },
+ },
+ resumeSession: true,
+ })
}
func addExportKeyingMaterialTests() {
@@ -8980,22 +9038,6 @@ func addCustomExtensionTests() {
flags: []string{flag},
})
- // 0-RTT is not currently supported with Custom Extensions.
- testCases = append(testCases, testCase{
- testType: testType,
- name: "CustomExtensions-" + suffix + "-EarlyData",
- config: Config{
- MaxVersion: VersionTLS13,
- Bugs: ProtocolBugs{
- CustomExtension: expectedContents,
- ExpectedCustomExtension: &expectedContents,
- },
- },
- shouldFail: true,
- expectedError: ":CUSTOM_EXTENSION_ERROR:",
- flags: []string{flag, "-enable-early-data"},
- })
-
// If the parse callback fails, the handshake should also fail.
testCases = append(testCases, testCase{
testType: testType,
@@ -9090,6 +9132,121 @@ func addCustomExtensionTests() {
})
}
+ // If the client sends both early data and custom extension, the handshake
+ // should succeed as long as both the extensions aren't returned by the
+ // server.
+ testCases = append(testCases, testCase{
+ testType: clientTest,
+ name: "CustomExtensions-Client-EarlyData-None",
+ config: Config{
+ MaxVersion: VersionTLS13,
+ MaxEarlyDataSize: 16384,
+ Bugs: ProtocolBugs{
+ ExpectedCustomExtension: &expectedContents,
+ AlwaysRejectEarlyData: true,
+ },
+ },
+ resumeSession: true,
+ flags: []string{
+ "-enable-client-custom-extension",
+ "-enable-early-data",
+ "-expect-early-data-info",
+ "-expect-reject-early-data",
+ },
+ })
+
+ testCases = append(testCases, testCase{
+ testType: clientTest,
+ name: "CustomExtensions-Client-EarlyData-EarlyDataAccepted",
+ config: Config{
+ MaxVersion: VersionTLS13,
+ MaxEarlyDataSize: 16384,
+ Bugs: ProtocolBugs{
+ ExpectedCustomExtension: &expectedContents,
+ },
+ },
+ resumeSession: true,
+ flags: []string{
+ "-enable-client-custom-extension",
+ "-enable-early-data",
+ "-expect-early-data-info",
+ "-expect-accept-early-data",
+ },
+ })
+
+ testCases = append(testCases, testCase{
+ testType: clientTest,
+ name: "CustomExtensions-Client-EarlyData-CustomExtensionAccepted",
+ config: Config{
+ MaxVersion: VersionTLS13,
+ MaxEarlyDataSize: 16384,
+ Bugs: ProtocolBugs{
+ AlwaysRejectEarlyData: true,
+ CustomExtension: expectedContents,
+ ExpectedCustomExtension: &expectedContents,
+ },
+ },
+ resumeSession: true,
+ flags: []string{
+ "-enable-client-custom-extension",
+ "-enable-early-data",
+ "-expect-early-data-info",
+ "-expect-reject-early-data",
+ },
+ })
+
+ testCases = append(testCases, testCase{
+ testType: clientTest,
+ name: "CustomExtensions-Client-EarlyDataAndCustomExtensions",
+ config: Config{
+ MaxVersion: VersionTLS13,
+ MaxEarlyDataSize: 16384,
+ Bugs: ProtocolBugs{
+ CustomExtension: expectedContents,
+ ExpectedCustomExtension: &expectedContents,
+ },
+ },
+ resumeConfig: &Config{
+ MaxVersion: VersionTLS13,
+ MaxEarlyDataSize: 16384,
+ Bugs: ProtocolBugs{
+ CustomExtension: expectedContents,
+ ExpectedCustomExtension: &expectedContents,
+ SendEarlyDataExtension: true,
+ },
+ },
+ resumeSession: true,
+ shouldFail: true,
+ expectedError: ":UNEXPECTED_EXTENSION_ON_EARLY_DATA:",
+ flags: []string{
+ "-enable-client-custom-extension",
+ "-enable-early-data",
+ "-expect-early-data-info",
+ },
+ })
+
+ // If the server receives both early data and custom extension, only the
+ // custom extension should be accepted.
+ testCases = append(testCases, testCase{
+ testType: serverTest,
+ name: "CustomExtensions-Server-EarlyDataAccepted",
+ config: Config{
+ MaxVersion: VersionTLS13,
+ MaxEarlyDataSize: 16384,
+ Bugs: ProtocolBugs{
+ CustomExtension: expectedContents,
+ ExpectedCustomExtension: &expectedContents,
+ ExpectEarlyDataAccepted: false,
+ },
+ },
+ resumeSession: true,
+ flags: []string{
+ "-enable-server-custom-extension",
+ "-enable-early-data",
+ "-expect-early-data-info",
+ },
+ })
+
// The custom extension add callback should not be called if the client
// doesn't send the extension.
testCases = append(testCases, testCase{
@@ -11661,7 +11818,7 @@ func addTLS13HandshakeTests() {
resumeSession: true,
expectChannelID: true,
shouldFail: true,
- expectedError: ":CHANNEL_ID_ON_EARLY_DATA:",
+ expectedError: ":UNEXPECTED_EXTENSION_ON_EARLY_DATA:",
flags: []string{
"-enable-early-data",
"-expect-early-data-info",
@@ -12139,8 +12296,8 @@ func addRetainOnlySHA256ClientCertTests() {
},
tls13Variant: ver.tls13Variant,
flags: []string{
- "-retain-only-sha256-client-cert-initial",
- "-retain-only-sha256-client-cert-resume",
+ "-on-initial-retain-only-sha256-client-cert",
+ "-on-resume-retain-only-sha256-client-cert",
},
resumeSession: true,
})
@@ -12158,10 +12315,10 @@ func addRetainOnlySHA256ClientCertTests() {
tls13Variant: ver.tls13Variant,
flags: []string{
"-verify-peer",
- "-retain-only-sha256-client-cert-initial",
- "-retain-only-sha256-client-cert-resume",
- "-expect-sha256-client-cert-initial",
- "-expect-sha256-client-cert-resume",
+ "-on-initial-retain-only-sha256-client-cert",
+ "-on-resume-retain-only-sha256-client-cert",
+ "-on-initial-expect-sha256-client-cert",
+ "-on-resume-expect-sha256-client-cert",
},
resumeSession: true,
})
@@ -12180,8 +12337,8 @@ func addRetainOnlySHA256ClientCertTests() {
tls13Variant: ver.tls13Variant,
flags: []string{
"-verify-peer",
- "-retain-only-sha256-client-cert-initial",
- "-expect-sha256-client-cert-initial",
+ "-on-initial-retain-only-sha256-client-cert",
+ "-on-initial-expect-sha256-client-cert",
},
resumeSession: true,
expectResumeRejected: true,
@@ -12201,8 +12358,8 @@ func addRetainOnlySHA256ClientCertTests() {
tls13Variant: ver.tls13Variant,
flags: []string{
"-verify-peer",
- "-retain-only-sha256-client-cert-resume",
- "-expect-sha256-client-cert-resume",
+ "-on-resume-retain-only-sha256-client-cert",
+ "-on-resume-expect-sha256-client-cert",
},
resumeSession: true,
expectResumeRejected: true,
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-25 05:28:31 +0000