Skip to content

Commit c516faf

Browse files
samuel40791765samuel40791765
committed
add more ssl runner tests
1 parent 9b323d5 commit c516faf

File tree

4 files changed

+147
-16
lines changed

4 files changed

+147
-16
lines changed

‎ssl/test/runner/runner.go‎

Lines changed: 126 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -19618,17 +19618,31 @@ var testMultipleCertSlotsAlgorithms = []struct {
1961819618
{"ECDSA", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, 0, testCertECDSAP256, CurveP256},
1961919619
}
1962019620

19621-
// TODO: Add more failure test cases.
1962219621
func addMultipleCertSlotTests() {
1962319622
var allAlgorithms []signatureAlgorithm
1962419623
for _, alg := range testMultipleCertSlotsAlgorithms {
1962519624
if alg.id != 0 {
1962619625
allAlgorithms = append(allAlgorithms, alg.id)
1962719626
}
1962819627
}
19628+
multipleCertsFlag := "-multiple-certs-slot"
19629+
rsaCertSlot := []string{
19630+
multipleCertsFlag, path.Join(*resourceDir, getShimCertificate(testCertRSA)) + "," + path.Join(*resourceDir, getShimKey(testCertRSA)),
19631+
}
19632+
ecdsaCertSlot := []string{
19633+
multipleCertsFlag, path.Join(*resourceDir, getShimCertificate(testCertECDSAP256)) + "," + path.Join(*resourceDir, getShimKey(testCertECDSAP256)),
19634+
}
19635+
ed25519CertSlot := []string{
19636+
multipleCertsFlag, path.Join(*resourceDir, getShimCertificate(testCertEd25519)) + "," + path.Join(*resourceDir, getShimKey(testCertEd25519)),
19637+
}
19638+
certificateSlotFlags := []string{
19639+
rsaCertSlot[0], rsaCertSlot[1],
19640+
ecdsaCertSlot[0], ecdsaCertSlot[1],
19641+
ed25519CertSlot[0], ed25519CertSlot[1],
19642+
}
1962919643

19630-
// TODO: add client tests to verify we don't support multiple certs on the client end.
19631-
prefix := "Server-"
19644+
signError := ":NO_COMMON_SIGNATURE_ALGORITHMS:"
19645+
signLocalError := "remote error: handshake failure"
1963219646

1963319647
// Make sure each signature algorithm works.
1963419648
for _, alg := range testMultipleCertSlotsAlgorithms {
@@ -19637,6 +19651,7 @@ func addMultipleCertSlotTests() {
1963719651
continue
1963819652
}
1963919653

19654+
prefix := "Server-"
1964019655
var shouldFail bool
1964119656
// ecdsa_sha1 does not exist in TLS 1.3.
1964219657
if ver.version >= VersionTLS13 && alg.id == signatureECDSAWithSHA1 {
@@ -19672,17 +19687,14 @@ func addMultipleCertSlotTests() {
1967219687
VerifySignatureAlgorithms: allAlgorithms,
1967319688
},
1967419689
flags: append(
19675-
[]string{
19676-
"-multiple-certs-slot", path.Join(*resourceDir, getShimCertificate(testCertRSA)) + "," + path.Join(*resourceDir, getShimKey(testCertRSA)),
19677-
"-multiple-certs-slot", path.Join(*resourceDir, getShimCertificate(testCertECDSAP256)) + "," + path.Join(*resourceDir, getShimKey(testCertECDSAP256)),
19678-
"-multiple-certs-slot", path.Join(*resourceDir, getShimCertificate(testCertEd25519)) + "," + path.Join(*resourceDir, getShimKey(testCertEd25519)),
19679-
},
19690+
certificateSlotFlags,
1968019691
curveFlags...,
1968119692
),
1968219693
expectations: connectionExpectations{
1968319694
peerSignatureAlgorithm: alg.id,
1968419695
},
1968519696
}
19697+
1968619698
if alg.id != 0 {
1968719699
strictAlgTest.flags = append(strictAlgTest.flags, "-signing-prefs", strconv.Itoa(int(alg.id)))
1968819700
}
@@ -19692,8 +19704,41 @@ func addMultipleCertSlotTests() {
1969219704
strictAlgTest.config.CipherSuites = []uint16{alg.cipher}
1969319705
}
1969419706

19707+
// Extend the original test, but force it to use the early certificate callback instead.
19708+
// Expected behavior should be the same.
19709+
strictAlgCallbackTest := strictAlgTest
19710+
strictAlgCallbackTest.name = prefix + "Multiple-Cert-Strict-Alg-Callback" + suffix
19711+
strictAlgCallbackTest.flags = append(strictAlgCallbackTest.flags, "-use-early-callback")
19712+
19713+
// Verify that we don't support multiple certificate slots on the client side. The client should be
19714+
// configured with the last certificate set (ED25519 in this case).
19715+
prefix = "Client-"
19716+
strictAlgClientTest := testCase{
19717+
testType: clientTest,
19718+
name: prefix + "Multiple-Cert-Strict-Alg" + suffix,
19719+
config: Config{
19720+
MaxVersion: ver.version,
19721+
VerifySignatureAlgorithms: []signatureAlgorithm{alg.id},
19722+
ClientAuth: RequireAnyClientCert,
19723+
Certificates: []Certificate{rsaCertificate, ecdsaP256Certificate, ed25519Certificate},
19724+
},
19725+
flags: append(
19726+
certificateSlotFlags,
19727+
curveFlags...,
19728+
),
19729+
}
19730+
if alg.id != signatureEd25519 {
19731+
// ED25519 is the last certificate set in |certificateSlotFlags|. We don't support multiple certificate
19732+
// slots on the client side, so the client should only be configured to use ED25519.
19733+
strictAlgClientTest.shouldFail = true
19734+
strictAlgClientTest.expectedError = signError
19735+
strictAlgClientTest.expectedLocalError = signLocalError
19736+
}
19737+
1969519738
if !shouldFail {
1969619739
testCases = append(testCases, strictAlgTest)
19740+
testCases = append(testCases, strictAlgCallbackTest)
19741+
testCases = append(testCases, strictAlgClientTest)
1969719742
}
1969819743
}
1969919744
}
@@ -19704,27 +19749,94 @@ func addMultipleCertSlotTests() {
1970419749
// ED25519 signature algorithm should be prioritized if supported.
1970519750
ed25519PriorityTest := testCase{
1970619751
testType: serverTest,
19707-
name: prefix + "Multiple-Cert-ED25519-Priority" + suffix,
19752+
name: "Server-Multiple-Cert-ED25519-Priority" + suffix,
1970819753
config: Config{
1970919754
MaxVersion: ver.version,
1971019755
VerifySignatureAlgorithms: allAlgorithms,
1971119756
},
1971219757
flags: append(
19713-
[]string{
19714-
"-multiple-certs-slot", path.Join(*resourceDir, getShimCertificate(testCertRSA)) + "," + path.Join(*resourceDir, getShimKey(testCertRSA)),
19715-
"-multiple-certs-slot", path.Join(*resourceDir, getShimCertificate(testCertECDSAP256)) + "," + path.Join(*resourceDir, getShimKey(testCertECDSAP256)),
19716-
"-multiple-certs-slot", path.Join(*resourceDir, getShimCertificate(testCertEd25519)) + "," + path.Join(*resourceDir, getShimKey(testCertEd25519)),
19717-
},
19758+
certificateSlotFlags,
1971819759
flagInts("-curves", []int{int(CurveX25519), int(CurveP256)})...,
1971919760
),
1972019761
expectations: connectionExpectations{
1972119762
peerSignatureAlgorithm: signatureEd25519,
1972219763
},
1972319764
}
1972419765

19766+
// Below tests verify that multiple certificates only works because we have a valid cert.
19767+
19768+
// Connection shouldn't be accepted without RSA cert.
19769+
noRSACertTest := testCase{
19770+
testType: serverTest,
19771+
name: "Server-Multiple-Cert-No-RSA" + suffix,
19772+
config: Config{
19773+
MaxVersion: ver.version,
19774+
VerifySignatureAlgorithms: allAlgorithms,
19775+
},
19776+
flags: []string{
19777+
ecdsaCertSlot[0], ecdsaCertSlot[1],
19778+
ed25519CertSlot[0], ed25519CertSlot[1],
19779+
"-signing-prefs", strconv.Itoa(int(signatureRSAPKCS1WithSHA256)),
19780+
},
19781+
shouldFail: true,
19782+
expectedError: signError,
19783+
expectedLocalError: signLocalError,
19784+
}
19785+
// RSA support in TLS1.2 and lower is indicated with |mask_k| in |ssl_get_compatible_server_ciphers|.
19786+
// We do not have a valid public or private RSA key set up, so this fails early.
19787+
if ver.version <= VersionTLS12 {
19788+
noRSACertTest.expectedError = ":NO_SHARED_CIPHER:"
19789+
}
19790+
19791+
// Connection shouldn't be accepted without ECDSA cert.
19792+
noECDSACertTest := testCase{
19793+
testType: serverTest,
19794+
name: "Server-Multiple-Cert-No-ECDSA" + suffix,
19795+
config: Config{
19796+
MaxVersion: ver.version,
19797+
VerifySignatureAlgorithms: allAlgorithms,
19798+
},
19799+
flags: []string{
19800+
rsaCertSlot[0], rsaCertSlot[1],
19801+
ed25519CertSlot[0], ed25519CertSlot[1],
19802+
"-signing-prefs", strconv.Itoa(int(signatureECDSAWithP256AndSHA256)),
19803+
},
19804+
shouldFail: true,
19805+
expectedError: signError,
19806+
expectedLocalError: signLocalError,
19807+
}
19808+
19809+
// Connection shouldn't be accepted without ED25519 cert.
19810+
noED25519CertTest := testCase{
19811+
testType: serverTest,
19812+
name: "Server-Multiple-Cert-No-ED25519" + suffix,
19813+
config: Config{
19814+
MaxVersion: ver.version,
19815+
VerifySignatureAlgorithms: allAlgorithms,
19816+
},
19817+
flags: []string{
19818+
rsaCertSlot[0], rsaCertSlot[1],
19819+
ecdsaCertSlot[0], ecdsaCertSlot[1],
19820+
"-signing-prefs", strconv.Itoa(int(signatureEd25519)),
19821+
},
19822+
shouldFail: true,
19823+
expectedError: signError,
19824+
expectedLocalError: signLocalError,
19825+
}
19826+
19827+
if ver.version <= VersionTLS12 {
19828+
noRSACertTest.config.CipherSuites = []uint16{TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA}
19829+
noECDSACertTest.config.CipherSuites = []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA}
19830+
noED25519CertTest.config.CipherSuites = []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256}
19831+
}
19832+
19833+
// ED25519 is only supported in TLS1.2 and above.
1972519834
if ver.version >= VersionTLS12 {
1972619835
testCases = append(testCases, ed25519PriorityTest)
19836+
testCases = append(testCases, noED25519CertTest)
1972719837
}
19838+
testCases = append(testCases, noRSACertTest)
19839+
testCases = append(testCases, noECDSACertTest)
1972819840
}
1972919841
}
1973019842

‎ssl/test/runner/ssl_transfer/test_case_names.txt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -519,6 +519,22 @@ Server-JDK11-TLS12-8
519519
Server-JDK11-TLS12-9
520520
Server-Multiple-Cert-ED25519-Priority-TLS12
521521
Server-Multiple-Cert-ED25519-Priority-TLS13
522+
Server-Multiple-Cert-Strict-Alg-Callback-ECDSA_P224_SHA256-TLS12
523+
Server-Multiple-Cert-Strict-Alg-Callback-ECDSA_P256_SHA256-TLS12
524+
Server-Multiple-Cert-Strict-Alg-Callback-ECDSA_P256_SHA256-TLS13
525+
Server-Multiple-Cert-Strict-Alg-Callback-ECDSA_SHA1-TLS12
526+
Server-Multiple-Cert-Strict-Alg-Callback-Ed25519-TLS12
527+
Server-Multiple-Cert-Strict-Alg-Callback-Ed25519-TLS13
528+
Server-Multiple-Cert-Strict-Alg-Callback-RSA_PKCS1_SHA1-TLS12
529+
Server-Multiple-Cert-Strict-Alg-Callback-RSA_PKCS1_SHA256-TLS12
530+
Server-Multiple-Cert-Strict-Alg-Callback-RSA_PKCS1_SHA384-TLS12
531+
Server-Multiple-Cert-Strict-Alg-Callback-RSA_PKCS1_SHA512-TLS12
532+
Server-Multiple-Cert-Strict-Alg-Callback-RSA_PSS_SHA256-TLS12
533+
Server-Multiple-Cert-Strict-Alg-Callback-RSA_PSS_SHA256-TLS13
534+
Server-Multiple-Cert-Strict-Alg-Callback-RSA_PSS_SHA384-TLS12
535+
Server-Multiple-Cert-Strict-Alg-Callback-RSA_PSS_SHA384-TLS13
536+
Server-Multiple-Cert-Strict-Alg-Callback-RSA_PSS_SHA512-TLS12
537+
Server-Multiple-Cert-Strict-Alg-Callback-RSA_PSS_SHA512-TLS13
522538
Server-Multiple-Cert-Strict-Alg-ECDSA_P224_SHA256-TLS12
523539
Server-Multiple-Cert-Strict-Alg-ECDSA_P256_SHA256-TLS12
524540
Server-Multiple-Cert-Strict-Alg-ECDSA_P256_SHA256-TLS13

‎ssl/test/test_config.cc‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1398,7 +1398,9 @@ static enum ssl_select_cert_result_t SelectCertificateCallback(
13981398
return ssl_select_cert_error;
13991399
}
14001400

1401-
if (config->use_early_callback && !InstallCertificate(ssl)) {
1401+
if (config->use_early_callback &&
1402+
!InstallMultipleCertificates(ssl) &&
1403+
!InstallCertificate(ssl)) {
14021404
return ssl_select_cert_error;
14031405
}
14041406

@@ -1824,7 +1826,6 @@ bssl::UniquePtr<SSL> TestConfig::NewSSL(
18241826
return nullptr;
18251827
}
18261828
// Install the certificate synchronously if nothing else will handle it.
1827-
// Multiple Certificates is only tested synchronously as of now.
18281829
if (!use_early_callback && !use_old_client_cert_callback && !async &&
18291830
!InstallMultipleCertificates(ssl.get()) &&
18301831
!InstallCertificate(ssl.get())) {

‎ssl/test/test_config.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,8 @@ struct TestConfig {
211211
// multiple_certs_slot is used to associate the server with the multiple
212212
// certificate/private key slot configuration. The certificate comes first,
213213
// then the private key.
214+
// When |multiple_certs_slot| is defined, the certificates defined are
215+
// prioritized over certs defined with |cert_file| and |key_file|.
214216
std::vector<std::pair<std::string, std::string>> multiple_certs_slot;
215217

216218
int argc;

0 commit comments

Comments
 (0)