blob: a222021c97cd78dafc784802c6c59c1982759be0 [file] [log] [blame]
Adam Langley7fcfd3b2016-05-20 11:02:50 -07001// Copyright (c) 2016, Google Inc.
2//
3// Permission to use, copy, modify, and/or distribute this software for any
4// purpose with or without fee is hereby granted, provided that the above
5// copyright notice and this permission notice appear in all copies.
6//
7// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10// SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12// OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13// CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
Adam Langleydc7e9c42015-09-29 15:21:04 -070015package runner
Adam Langley95c29f32014-06-20 12:00:00 -070016
17import (
18 "bytes"
David Benjamina08e49d2014-08-24 01:46:07 -040019 "crypto/ecdsa"
20 "crypto/elliptic"
David Benjamin407a10c2014-07-16 12:58:59 -040021 "crypto/x509"
David Benjamin2561dc32014-08-24 01:25:27 -040022 "encoding/base64"
David Benjamina08e49d2014-08-24 01:46:07 -040023 "encoding/pem"
Adam Langley95c29f32014-06-20 12:00:00 -070024 "flag"
25 "fmt"
26 "io"
Kenny Root7fdeaf12014-08-05 15:23:37 -070027 "io/ioutil"
Adam Langleya7997f12015-05-14 17:38:50 -070028 "math/big"
Adam Langley95c29f32014-06-20 12:00:00 -070029 "net"
30 "os"
31 "os/exec"
David Benjamin884fdf12014-08-02 15:28:23 -040032 "path"
David Benjamin2bc8e6f2014-08-02 15:22:37 -040033 "runtime"
Adam Langley69a01602014-11-17 17:26:55 -080034 "strconv"
Adam Langley95c29f32014-06-20 12:00:00 -070035 "strings"
36 "sync"
37 "syscall"
David Benjamin83f90402015-01-27 01:09:43 -050038 "time"
Adam Langley95c29f32014-06-20 12:00:00 -070039)
40
Adam Langley69a01602014-11-17 17:26:55 -080041var (
David Benjamin5f237bc2015-02-11 17:14:15 -050042 useValgrind = flag.Bool("valgrind", false, "If true, run code under valgrind")
43 useGDB = flag.Bool("gdb", false, "If true, run BoringSSL code under gdb")
David Benjamind16bf342015-12-18 00:53:12 -050044 useLLDB = flag.Bool("lldb", false, "If true, run BoringSSL code under lldb")
David Benjamin5f237bc2015-02-11 17:14:15 -050045 flagDebug = flag.Bool("debug", false, "Hexdump the contents of the connection")
46 mallocTest = flag.Int64("malloc-test", -1, "If non-negative, run each test with each malloc in turn failing from the given number onwards.")
47 mallocTestDebug = flag.Bool("malloc-test-debug", false, "If true, ask bssl_shim to abort rather than fail a malloc. This can be used with a specific value for --malloc-test to identity the malloc failing that is causing problems.")
48 jsonOutput = flag.String("json-output", "", "The file to output JSON results to.")
49 pipe = flag.Bool("pipe", false, "If true, print status output suitable for piping into another program.")
Adam Langley7c803a62015-06-15 15:35:05 -070050 testToRun = flag.String("test", "", "The name of a test to run, or empty to run all tests")
51 numWorkers = flag.Int("num-workers", runtime.NumCPU(), "The number of workers to run in parallel.")
52 shimPath = flag.String("shim-path", "../../../build/ssl/test/bssl_shim", "The location of the shim binary.")
53 resourceDir = flag.String("resource-dir", ".", "The directory in which to find certificate and key files.")
David Benjaminf2b83632016-03-01 22:57:46 -050054 fuzzer = flag.Bool("fuzzer", false, "If true, tests against a BoringSSL built in fuzzer mode.")
David Benjamin9867b7d2016-03-01 23:25:48 -050055 transcriptDir = flag.String("transcript-dir", "", "The directory in which to write transcripts.")
David Benjamin01784b42016-06-07 18:00:52 -040056 idleTimeout = flag.Duration("idle-timeout", 15*time.Second, "The number of seconds to wait for a read or write to bssl_shim.")
David Benjamin2e045a92016-06-08 13:09:56 -040057 deterministic = flag.Bool("deterministic", false, "If true, uses a deterministic PRNG in the runner.")
Adam Langley69a01602014-11-17 17:26:55 -080058)
Adam Langley95c29f32014-06-20 12:00:00 -070059
David Benjamin33863262016-07-08 17:20:12 -070060type testCert int
61
David Benjamin025b3d32014-07-01 19:53:04 -040062const (
David Benjamin33863262016-07-08 17:20:12 -070063 testCertRSA testCert = iota
David Benjamin7944a9f2016-07-12 22:27:01 -040064 testCertRSA1024
David Benjamin33863262016-07-08 17:20:12 -070065 testCertECDSAP256
66 testCertECDSAP384
67 testCertECDSAP521
68)
69
70const (
71 rsaCertificateFile = "cert.pem"
David Benjamin7944a9f2016-07-12 22:27:01 -040072 rsa1024CertificateFile = "rsa_1024_cert.pem"
David Benjamin33863262016-07-08 17:20:12 -070073 ecdsaP256CertificateFile = "ecdsa_p256_cert.pem"
74 ecdsaP384CertificateFile = "ecdsa_p384_cert.pem"
75 ecdsaP521CertificateFile = "ecdsa_p521_cert.pem"
David Benjamin025b3d32014-07-01 19:53:04 -040076)
77
78const (
David Benjamina08e49d2014-08-24 01:46:07 -040079 rsaKeyFile = "key.pem"
David Benjamin7944a9f2016-07-12 22:27:01 -040080 rsa1024KeyFile = "rsa_1024_key.pem"
David Benjamin33863262016-07-08 17:20:12 -070081 ecdsaP256KeyFile = "ecdsa_p256_key.pem"
82 ecdsaP384KeyFile = "ecdsa_p384_key.pem"
83 ecdsaP521KeyFile = "ecdsa_p521_key.pem"
David Benjamina08e49d2014-08-24 01:46:07 -040084 channelIDKeyFile = "channel_id_key.pem"
David Benjamin025b3d32014-07-01 19:53:04 -040085)
86
David Benjamin7944a9f2016-07-12 22:27:01 -040087var (
88 rsaCertificate Certificate
89 rsa1024Certificate Certificate
90 ecdsaP256Certificate Certificate
91 ecdsaP384Certificate Certificate
92 ecdsaP521Certificate Certificate
93)
David Benjamin33863262016-07-08 17:20:12 -070094
95var testCerts = []struct {
96 id testCert
97 certFile, keyFile string
98 cert *Certificate
99}{
100 {
101 id: testCertRSA,
102 certFile: rsaCertificateFile,
103 keyFile: rsaKeyFile,
104 cert: &rsaCertificate,
105 },
106 {
David Benjamin7944a9f2016-07-12 22:27:01 -0400107 id: testCertRSA1024,
108 certFile: rsa1024CertificateFile,
109 keyFile: rsa1024KeyFile,
110 cert: &rsa1024Certificate,
111 },
112 {
David Benjamin33863262016-07-08 17:20:12 -0700113 id: testCertECDSAP256,
114 certFile: ecdsaP256CertificateFile,
115 keyFile: ecdsaP256KeyFile,
116 cert: &ecdsaP256Certificate,
117 },
118 {
119 id: testCertECDSAP384,
120 certFile: ecdsaP384CertificateFile,
121 keyFile: ecdsaP384KeyFile,
122 cert: &ecdsaP384Certificate,
123 },
124 {
125 id: testCertECDSAP521,
126 certFile: ecdsaP521CertificateFile,
127 keyFile: ecdsaP521KeyFile,
128 cert: &ecdsaP521Certificate,
129 },
130}
131
David Benjamina08e49d2014-08-24 01:46:07 -0400132var channelIDKey *ecdsa.PrivateKey
133var channelIDBytes []byte
Adam Langley95c29f32014-06-20 12:00:00 -0700134
David Benjamin61f95272014-11-25 01:55:35 -0500135var testOCSPResponse = []byte{1, 2, 3, 4}
136var testSCTList = []byte{5, 6, 7, 8}
137
Adam Langley95c29f32014-06-20 12:00:00 -0700138func initCertificates() {
David Benjamin33863262016-07-08 17:20:12 -0700139 for i := range testCerts {
140 cert, err := LoadX509KeyPair(path.Join(*resourceDir, testCerts[i].certFile), path.Join(*resourceDir, testCerts[i].keyFile))
141 if err != nil {
142 panic(err)
143 }
144 cert.OCSPStaple = testOCSPResponse
145 cert.SignedCertificateTimestampList = testSCTList
146 *testCerts[i].cert = cert
Adam Langley95c29f32014-06-20 12:00:00 -0700147 }
David Benjamina08e49d2014-08-24 01:46:07 -0400148
Adam Langley7c803a62015-06-15 15:35:05 -0700149 channelIDPEMBlock, err := ioutil.ReadFile(path.Join(*resourceDir, channelIDKeyFile))
David Benjamina08e49d2014-08-24 01:46:07 -0400150 if err != nil {
151 panic(err)
152 }
153 channelIDDERBlock, _ := pem.Decode(channelIDPEMBlock)
154 if channelIDDERBlock.Type != "EC PRIVATE KEY" {
155 panic("bad key type")
156 }
157 channelIDKey, err = x509.ParseECPrivateKey(channelIDDERBlock.Bytes)
158 if err != nil {
159 panic(err)
160 }
161 if channelIDKey.Curve != elliptic.P256() {
162 panic("bad curve")
163 }
164
165 channelIDBytes = make([]byte, 64)
166 writeIntPadded(channelIDBytes[:32], channelIDKey.X)
167 writeIntPadded(channelIDBytes[32:], channelIDKey.Y)
Adam Langley95c29f32014-06-20 12:00:00 -0700168}
169
David Benjamin33863262016-07-08 17:20:12 -0700170func getRunnerCertificate(t testCert) Certificate {
171 for _, cert := range testCerts {
172 if cert.id == t {
173 return *cert.cert
174 }
175 }
176 panic("Unknown test certificate")
Adam Langley95c29f32014-06-20 12:00:00 -0700177}
178
David Benjamin33863262016-07-08 17:20:12 -0700179func getShimCertificate(t testCert) string {
180 for _, cert := range testCerts {
181 if cert.id == t {
182 return cert.certFile
183 }
184 }
185 panic("Unknown test certificate")
186}
187
188func getShimKey(t testCert) string {
189 for _, cert := range testCerts {
190 if cert.id == t {
191 return cert.keyFile
192 }
193 }
194 panic("Unknown test certificate")
Adam Langley95c29f32014-06-20 12:00:00 -0700195}
196
David Benjamin025b3d32014-07-01 19:53:04 -0400197type testType int
198
199const (
200 clientTest testType = iota
201 serverTest
202)
203
David Benjamin6fd297b2014-08-11 18:43:38 -0400204type protocol int
205
206const (
207 tls protocol = iota
208 dtls
209)
210
David Benjaminfc7b0862014-09-06 13:21:53 -0400211const (
212 alpn = 1
213 npn = 2
214)
215
Adam Langley95c29f32014-06-20 12:00:00 -0700216type testCase struct {
David Benjamin025b3d32014-07-01 19:53:04 -0400217 testType testType
David Benjamin6fd297b2014-08-11 18:43:38 -0400218 protocol protocol
Adam Langley95c29f32014-06-20 12:00:00 -0700219 name string
220 config Config
221 shouldFail bool
222 expectedError string
Adam Langleyac61fa32014-06-23 12:03:11 -0700223 // expectedLocalError, if not empty, contains a substring that must be
224 // found in the local error.
225 expectedLocalError string
David Benjamin7e2e6cf2014-08-07 17:44:24 -0400226 // expectedVersion, if non-zero, specifies the TLS version that must be
227 // negotiated.
228 expectedVersion uint16
David Benjamin01fe8202014-09-24 15:21:44 -0400229 // expectedResumeVersion, if non-zero, specifies the TLS version that
230 // must be negotiated on resumption. If zero, expectedVersion is used.
231 expectedResumeVersion uint16
David Benjamin90da8c82015-04-20 14:57:57 -0400232 // expectedCipher, if non-zero, specifies the TLS cipher suite that
233 // should be negotiated.
234 expectedCipher uint16
David Benjamina08e49d2014-08-24 01:46:07 -0400235 // expectChannelID controls whether the connection should have
236 // negotiated a Channel ID with channelIDKey.
237 expectChannelID bool
David Benjaminae2888f2014-09-06 12:58:58 -0400238 // expectedNextProto controls whether the connection should
239 // negotiate a next protocol via NPN or ALPN.
240 expectedNextProto string
David Benjaminc7ce9772015-10-09 19:32:41 -0400241 // expectNoNextProto, if true, means that no next protocol should be
242 // negotiated.
243 expectNoNextProto bool
David Benjaminfc7b0862014-09-06 13:21:53 -0400244 // expectedNextProtoType, if non-zero, is the expected next
245 // protocol negotiation mechanism.
246 expectedNextProtoType int
David Benjaminca6c8262014-11-15 19:06:08 -0500247 // expectedSRTPProtectionProfile is the DTLS-SRTP profile that
248 // should be negotiated. If zero, none should be negotiated.
249 expectedSRTPProtectionProfile uint16
Paul Lietaraeeff2c2015-08-12 11:47:11 +0100250 // expectedOCSPResponse, if not nil, is the expected OCSP response to be received.
251 expectedOCSPResponse []uint8
Paul Lietar4fac72e2015-09-09 13:44:55 +0100252 // expectedSCTList, if not nil, is the expected SCT list to be received.
253 expectedSCTList []uint8
Nick Harper60edffd2016-06-21 15:19:24 -0700254 // expectedPeerSignatureAlgorithm, if not zero, is the signature
255 // algorithm that the peer should have used in the handshake.
256 expectedPeerSignatureAlgorithm signatureAlgorithm
Adam Langley80842bd2014-06-20 12:00:00 -0700257 // messageLen is the length, in bytes, of the test message that will be
258 // sent.
259 messageLen int
David Benjamin8e6db492015-07-25 18:29:23 -0400260 // messageCount is the number of test messages that will be sent.
261 messageCount int
David Benjamin025b3d32014-07-01 19:53:04 -0400262 // certFile is the path to the certificate to use for the server.
263 certFile string
264 // keyFile is the path to the private key to use for the server.
265 keyFile string
David Benjamin1d5c83e2014-07-22 19:20:02 -0400266 // resumeSession controls whether a second connection should be tested
David Benjamin01fe8202014-09-24 15:21:44 -0400267 // which attempts to resume the first session.
David Benjamin1d5c83e2014-07-22 19:20:02 -0400268 resumeSession bool
Adam Langleyb0eef0a2015-06-02 10:47:39 -0700269 // expectResumeRejected, if true, specifies that the attempted
270 // resumption must be rejected by the client. This is only valid for a
271 // serverTest.
272 expectResumeRejected bool
David Benjamin01fe8202014-09-24 15:21:44 -0400273 // resumeConfig, if not nil, points to a Config to be used on
David Benjaminfe8eb9a2014-11-17 03:19:02 -0500274 // resumption. Unless newSessionsOnResume is set,
275 // SessionTicketKey, ServerSessionCache, and
276 // ClientSessionCache are copied from the initial connection's
277 // config. If nil, the initial connection's config is used.
David Benjamin01fe8202014-09-24 15:21:44 -0400278 resumeConfig *Config
David Benjaminfe8eb9a2014-11-17 03:19:02 -0500279 // newSessionsOnResume, if true, will cause resumeConfig to
280 // use a different session resumption context.
281 newSessionsOnResume bool
David Benjaminba4594a2015-06-18 18:36:15 -0400282 // noSessionCache, if true, will cause the server to run without a
283 // session cache.
284 noSessionCache bool
David Benjamin98e882e2014-08-08 13:24:34 -0400285 // sendPrefix sends a prefix on the socket before actually performing a
286 // handshake.
287 sendPrefix string
David Benjamine58c4f52014-08-24 03:47:07 -0400288 // shimWritesFirst controls whether the shim sends an initial "hello"
289 // message before doing a roundtrip with the runner.
290 shimWritesFirst bool
David Benjamin30789da2015-08-29 22:56:45 -0400291 // shimShutsDown, if true, runs a test where the shim shuts down the
292 // connection immediately after the handshake rather than echoing
293 // messages from the runner.
294 shimShutsDown bool
David Benjamin1d5ef3b2015-10-12 19:54:18 -0400295 // renegotiate indicates the number of times the connection should be
296 // renegotiated during the exchange.
297 renegotiate int
Adam Langleycf2d4f42014-10-28 19:06:14 -0700298 // renegotiateCiphers is a list of ciphersuite ids that will be
299 // switched in just before renegotiation.
300 renegotiateCiphers []uint16
David Benjamin5e961c12014-11-07 01:48:35 -0500301 // replayWrites, if true, configures the underlying transport
302 // to replay every write it makes in DTLS tests.
303 replayWrites bool
David Benjamin5fa3eba2015-01-22 16:35:40 -0500304 // damageFirstWrite, if true, configures the underlying transport to
305 // damage the final byte of the first application data write.
306 damageFirstWrite bool
David Benjaminc565ebb2015-04-03 04:06:36 -0400307 // exportKeyingMaterial, if non-zero, configures the test to exchange
308 // keying material and verify they match.
309 exportKeyingMaterial int
310 exportLabel string
311 exportContext string
312 useExportContext bool
David Benjamin325b5c32014-07-01 19:40:31 -0400313 // flags, if not empty, contains a list of command-line flags that will
314 // be passed to the shim program.
315 flags []string
Adam Langleyaf0e32c2015-06-03 09:57:23 -0700316 // testTLSUnique, if true, causes the shim to send the tls-unique value
317 // which will be compared against the expected value.
318 testTLSUnique bool
David Benjamina8ebe222015-06-06 03:04:39 -0400319 // sendEmptyRecords is the number of consecutive empty records to send
320 // before and after the test message.
321 sendEmptyRecords int
David Benjamin24f346d2015-06-06 03:28:08 -0400322 // sendWarningAlerts is the number of consecutive warning alerts to send
323 // before and after the test message.
324 sendWarningAlerts int
David Benjamin4f75aaf2015-09-01 16:53:10 -0400325 // expectMessageDropped, if true, means the test message is expected to
326 // be dropped by the client rather than echoed back.
327 expectMessageDropped bool
Adam Langley95c29f32014-06-20 12:00:00 -0700328}
329
Adam Langley7c803a62015-06-15 15:35:05 -0700330var testCases []testCase
Adam Langley95c29f32014-06-20 12:00:00 -0700331
David Benjamin9867b7d2016-03-01 23:25:48 -0500332func writeTranscript(test *testCase, isResume bool, data []byte) {
333 if len(data) == 0 {
334 return
335 }
336
337 protocol := "tls"
338 if test.protocol == dtls {
339 protocol = "dtls"
340 }
341
342 side := "client"
343 if test.testType == serverTest {
344 side = "server"
345 }
346
347 dir := path.Join(*transcriptDir, protocol, side)
348 if err := os.MkdirAll(dir, 0755); err != nil {
349 fmt.Fprintf(os.Stderr, "Error making %s: %s\n", dir, err)
350 return
351 }
352
353 name := test.name
354 if isResume {
355 name += "-Resume"
356 } else {
357 name += "-Normal"
358 }
359
360 if err := ioutil.WriteFile(path.Join(dir, name), data, 0644); err != nil {
361 fmt.Fprintf(os.Stderr, "Error writing %s: %s\n", name, err)
362 }
363}
364
David Benjamin3ed59772016-03-08 12:50:21 -0500365// A timeoutConn implements an idle timeout on each Read and Write operation.
366type timeoutConn struct {
367 net.Conn
368 timeout time.Duration
369}
370
371func (t *timeoutConn) Read(b []byte) (int, error) {
372 if err := t.SetReadDeadline(time.Now().Add(t.timeout)); err != nil {
373 return 0, err
374 }
375 return t.Conn.Read(b)
376}
377
378func (t *timeoutConn) Write(b []byte) (int, error) {
379 if err := t.SetWriteDeadline(time.Now().Add(t.timeout)); err != nil {
380 return 0, err
381 }
382 return t.Conn.Write(b)
383}
384
David Benjamin8e6db492015-07-25 18:29:23 -0400385func doExchange(test *testCase, config *Config, conn net.Conn, isResume bool) error {
David Benjamin01784b42016-06-07 18:00:52 -0400386 conn = &timeoutConn{conn, *idleTimeout}
David Benjamin65ea8ff2014-11-23 03:01:00 -0500387
David Benjamin6fd297b2014-08-11 18:43:38 -0400388 if test.protocol == dtls {
David Benjamin83f90402015-01-27 01:09:43 -0500389 config.Bugs.PacketAdaptor = newPacketAdaptor(conn)
390 conn = config.Bugs.PacketAdaptor
David Benjaminebda9b32015-11-02 15:33:18 -0500391 }
392
David Benjamin9867b7d2016-03-01 23:25:48 -0500393 if *flagDebug || len(*transcriptDir) != 0 {
David Benjaminebda9b32015-11-02 15:33:18 -0500394 local, peer := "client", "server"
395 if test.testType == clientTest {
396 local, peer = peer, local
David Benjamin5e961c12014-11-07 01:48:35 -0500397 }
David Benjaminebda9b32015-11-02 15:33:18 -0500398 connDebug := &recordingConn{
399 Conn: conn,
400 isDatagram: test.protocol == dtls,
401 local: local,
402 peer: peer,
403 }
404 conn = connDebug
David Benjamin9867b7d2016-03-01 23:25:48 -0500405 if *flagDebug {
406 defer connDebug.WriteTo(os.Stdout)
407 }
408 if len(*transcriptDir) != 0 {
409 defer func() {
410 writeTranscript(test, isResume, connDebug.Transcript())
411 }()
412 }
David Benjaminebda9b32015-11-02 15:33:18 -0500413
414 if config.Bugs.PacketAdaptor != nil {
415 config.Bugs.PacketAdaptor.debug = connDebug
416 }
417 }
418
419 if test.replayWrites {
420 conn = newReplayAdaptor(conn)
David Benjamin6fd297b2014-08-11 18:43:38 -0400421 }
422
David Benjamin3ed59772016-03-08 12:50:21 -0500423 var connDamage *damageAdaptor
David Benjamin5fa3eba2015-01-22 16:35:40 -0500424 if test.damageFirstWrite {
425 connDamage = newDamageAdaptor(conn)
426 conn = connDamage
427 }
428
David Benjamin6fd297b2014-08-11 18:43:38 -0400429 if test.sendPrefix != "" {
430 if _, err := conn.Write([]byte(test.sendPrefix)); err != nil {
431 return err
432 }
David Benjamin98e882e2014-08-08 13:24:34 -0400433 }
434
David Benjamin1d5c83e2014-07-22 19:20:02 -0400435 var tlsConn *Conn
David Benjamin7e2e6cf2014-08-07 17:44:24 -0400436 if test.testType == clientTest {
David Benjamin6fd297b2014-08-11 18:43:38 -0400437 if test.protocol == dtls {
438 tlsConn = DTLSServer(conn, config)
439 } else {
440 tlsConn = Server(conn, config)
441 }
David Benjamin1d5c83e2014-07-22 19:20:02 -0400442 } else {
443 config.InsecureSkipVerify = true
David Benjamin6fd297b2014-08-11 18:43:38 -0400444 if test.protocol == dtls {
445 tlsConn = DTLSClient(conn, config)
446 } else {
447 tlsConn = Client(conn, config)
448 }
David Benjamin1d5c83e2014-07-22 19:20:02 -0400449 }
David Benjamin30789da2015-08-29 22:56:45 -0400450 defer tlsConn.Close()
David Benjamin1d5c83e2014-07-22 19:20:02 -0400451
Adam Langley95c29f32014-06-20 12:00:00 -0700452 if err := tlsConn.Handshake(); err != nil {
453 return err
454 }
Kenny Root7fdeaf12014-08-05 15:23:37 -0700455
David Benjamin01fe8202014-09-24 15:21:44 -0400456 // TODO(davidben): move all per-connection expectations into a dedicated
457 // expectations struct that can be specified separately for the two
458 // legs.
459 expectedVersion := test.expectedVersion
460 if isResume && test.expectedResumeVersion != 0 {
461 expectedVersion = test.expectedResumeVersion
462 }
Adam Langleyb0eef0a2015-06-02 10:47:39 -0700463 connState := tlsConn.ConnectionState()
464 if vers := connState.Version; expectedVersion != 0 && vers != expectedVersion {
David Benjamin01fe8202014-09-24 15:21:44 -0400465 return fmt.Errorf("got version %x, expected %x", vers, expectedVersion)
David Benjamin7e2e6cf2014-08-07 17:44:24 -0400466 }
467
Adam Langleyb0eef0a2015-06-02 10:47:39 -0700468 if cipher := connState.CipherSuite; test.expectedCipher != 0 && cipher != test.expectedCipher {
David Benjamin90da8c82015-04-20 14:57:57 -0400469 return fmt.Errorf("got cipher %x, expected %x", cipher, test.expectedCipher)
470 }
Adam Langleyb0eef0a2015-06-02 10:47:39 -0700471 if didResume := connState.DidResume; isResume && didResume == test.expectResumeRejected {
472 return fmt.Errorf("didResume is %t, but we expected the opposite", didResume)
473 }
David Benjamin90da8c82015-04-20 14:57:57 -0400474
David Benjamina08e49d2014-08-24 01:46:07 -0400475 if test.expectChannelID {
Adam Langleyb0eef0a2015-06-02 10:47:39 -0700476 channelID := connState.ChannelID
David Benjamina08e49d2014-08-24 01:46:07 -0400477 if channelID == nil {
478 return fmt.Errorf("no channel ID negotiated")
479 }
480 if channelID.Curve != channelIDKey.Curve ||
481 channelIDKey.X.Cmp(channelIDKey.X) != 0 ||
482 channelIDKey.Y.Cmp(channelIDKey.Y) != 0 {
483 return fmt.Errorf("incorrect channel ID")
484 }
485 }
486
David Benjaminae2888f2014-09-06 12:58:58 -0400487 if expected := test.expectedNextProto; expected != "" {
Adam Langleyb0eef0a2015-06-02 10:47:39 -0700488 if actual := connState.NegotiatedProtocol; actual != expected {
David Benjaminae2888f2014-09-06 12:58:58 -0400489 return fmt.Errorf("next proto mismatch: got %s, wanted %s", actual, expected)
490 }
491 }
492
David Benjaminc7ce9772015-10-09 19:32:41 -0400493 if test.expectNoNextProto {
494 if actual := connState.NegotiatedProtocol; actual != "" {
495 return fmt.Errorf("got unexpected next proto %s", actual)
496 }
497 }
498
David Benjaminfc7b0862014-09-06 13:21:53 -0400499 if test.expectedNextProtoType != 0 {
Adam Langleyb0eef0a2015-06-02 10:47:39 -0700500 if (test.expectedNextProtoType == alpn) != connState.NegotiatedProtocolFromALPN {
David Benjaminfc7b0862014-09-06 13:21:53 -0400501 return fmt.Errorf("next proto type mismatch")
502 }
503 }
504
Adam Langleyb0eef0a2015-06-02 10:47:39 -0700505 if p := connState.SRTPProtectionProfile; p != test.expectedSRTPProtectionProfile {
David Benjaminca6c8262014-11-15 19:06:08 -0500506 return fmt.Errorf("SRTP profile mismatch: got %d, wanted %d", p, test.expectedSRTPProtectionProfile)
507 }
508
Paul Lietaraeeff2c2015-08-12 11:47:11 +0100509 if test.expectedOCSPResponse != nil && !bytes.Equal(test.expectedOCSPResponse, tlsConn.OCSPResponse()) {
510 return fmt.Errorf("OCSP Response mismatch")
511 }
512
Paul Lietar4fac72e2015-09-09 13:44:55 +0100513 if test.expectedSCTList != nil && !bytes.Equal(test.expectedSCTList, connState.SCTList) {
514 return fmt.Errorf("SCT list mismatch")
515 }
516
Nick Harper60edffd2016-06-21 15:19:24 -0700517 if expected := test.expectedPeerSignatureAlgorithm; expected != 0 && expected != connState.PeerSignatureAlgorithm {
518 return fmt.Errorf("expected peer to use signature algorithm %04x, but got %04x", expected, connState.PeerSignatureAlgorithm)
Steven Valdez0d62f262015-09-04 12:41:04 -0400519 }
520
David Benjaminc565ebb2015-04-03 04:06:36 -0400521 if test.exportKeyingMaterial > 0 {
522 actual := make([]byte, test.exportKeyingMaterial)
523 if _, err := io.ReadFull(tlsConn, actual); err != nil {
524 return err
525 }
526 expected, err := tlsConn.ExportKeyingMaterial(test.exportKeyingMaterial, []byte(test.exportLabel), []byte(test.exportContext), test.useExportContext)
527 if err != nil {
528 return err
529 }
530 if !bytes.Equal(actual, expected) {
531 return fmt.Errorf("keying material mismatch")
532 }
533 }
534
Adam Langleyaf0e32c2015-06-03 09:57:23 -0700535 if test.testTLSUnique {
536 var peersValue [12]byte
537 if _, err := io.ReadFull(tlsConn, peersValue[:]); err != nil {
538 return err
539 }
540 expected := tlsConn.ConnectionState().TLSUnique
541 if !bytes.Equal(peersValue[:], expected) {
542 return fmt.Errorf("tls-unique mismatch: peer sent %x, but %x was expected", peersValue[:], expected)
543 }
544 }
545
David Benjamine58c4f52014-08-24 03:47:07 -0400546 if test.shimWritesFirst {
547 var buf [5]byte
548 _, err := io.ReadFull(tlsConn, buf[:])
549 if err != nil {
550 return err
551 }
552 if string(buf[:]) != "hello" {
553 return fmt.Errorf("bad initial message")
554 }
555 }
556
David Benjamina8ebe222015-06-06 03:04:39 -0400557 for i := 0; i < test.sendEmptyRecords; i++ {
558 tlsConn.Write(nil)
559 }
560
David Benjamin24f346d2015-06-06 03:28:08 -0400561 for i := 0; i < test.sendWarningAlerts; i++ {
562 tlsConn.SendAlert(alertLevelWarning, alertUnexpectedMessage)
563 }
564
David Benjamin1d5ef3b2015-10-12 19:54:18 -0400565 if test.renegotiate > 0 {
Adam Langleycf2d4f42014-10-28 19:06:14 -0700566 if test.renegotiateCiphers != nil {
567 config.CipherSuites = test.renegotiateCiphers
568 }
David Benjamin1d5ef3b2015-10-12 19:54:18 -0400569 for i := 0; i < test.renegotiate; i++ {
570 if err := tlsConn.Renegotiate(); err != nil {
571 return err
572 }
Adam Langleycf2d4f42014-10-28 19:06:14 -0700573 }
574 } else if test.renegotiateCiphers != nil {
575 panic("renegotiateCiphers without renegotiate")
576 }
577
David Benjamin5fa3eba2015-01-22 16:35:40 -0500578 if test.damageFirstWrite {
579 connDamage.setDamage(true)
580 tlsConn.Write([]byte("DAMAGED WRITE"))
581 connDamage.setDamage(false)
582 }
583
David Benjamin8e6db492015-07-25 18:29:23 -0400584 messageLen := test.messageLen
Kenny Root7fdeaf12014-08-05 15:23:37 -0700585 if messageLen < 0 {
David Benjamin6fd297b2014-08-11 18:43:38 -0400586 if test.protocol == dtls {
587 return fmt.Errorf("messageLen < 0 not supported for DTLS tests")
588 }
Kenny Root7fdeaf12014-08-05 15:23:37 -0700589 // Read until EOF.
590 _, err := io.Copy(ioutil.Discard, tlsConn)
591 return err
592 }
David Benjamin4417d052015-04-05 04:17:25 -0400593 if messageLen == 0 {
594 messageLen = 32
Adam Langley80842bd2014-06-20 12:00:00 -0700595 }
Adam Langley95c29f32014-06-20 12:00:00 -0700596
David Benjamin8e6db492015-07-25 18:29:23 -0400597 messageCount := test.messageCount
598 if messageCount == 0 {
599 messageCount = 1
David Benjamina8ebe222015-06-06 03:04:39 -0400600 }
601
David Benjamin8e6db492015-07-25 18:29:23 -0400602 for j := 0; j < messageCount; j++ {
603 testMessage := make([]byte, messageLen)
604 for i := range testMessage {
605 testMessage[i] = 0x42 ^ byte(j)
David Benjamin6fd297b2014-08-11 18:43:38 -0400606 }
David Benjamin8e6db492015-07-25 18:29:23 -0400607 tlsConn.Write(testMessage)
Adam Langley95c29f32014-06-20 12:00:00 -0700608
David Benjamin8e6db492015-07-25 18:29:23 -0400609 for i := 0; i < test.sendEmptyRecords; i++ {
610 tlsConn.Write(nil)
611 }
612
613 for i := 0; i < test.sendWarningAlerts; i++ {
614 tlsConn.SendAlert(alertLevelWarning, alertUnexpectedMessage)
615 }
616
David Benjamin4f75aaf2015-09-01 16:53:10 -0400617 if test.shimShutsDown || test.expectMessageDropped {
David Benjamin30789da2015-08-29 22:56:45 -0400618 // The shim will not respond.
619 continue
620 }
621
David Benjamin8e6db492015-07-25 18:29:23 -0400622 buf := make([]byte, len(testMessage))
623 if test.protocol == dtls {
624 bufTmp := make([]byte, len(buf)+1)
625 n, err := tlsConn.Read(bufTmp)
626 if err != nil {
627 return err
628 }
629 if n != len(buf) {
630 return fmt.Errorf("bad reply; length mismatch (%d vs %d)", n, len(buf))
631 }
632 copy(buf, bufTmp)
633 } else {
634 _, err := io.ReadFull(tlsConn, buf)
635 if err != nil {
636 return err
637 }
638 }
639
640 for i, v := range buf {
641 if v != testMessage[i]^0xff {
642 return fmt.Errorf("bad reply contents at byte %d", i)
643 }
Adam Langley95c29f32014-06-20 12:00:00 -0700644 }
645 }
646
647 return nil
648}
649
David Benjamin325b5c32014-07-01 19:40:31 -0400650func valgrindOf(dbAttach bool, path string, args ...string) *exec.Cmd {
651 valgrindArgs := []string{"--error-exitcode=99", "--track-origins=yes", "--leak-check=full"}
Adam Langley95c29f32014-06-20 12:00:00 -0700652 if dbAttach {
David Benjamin325b5c32014-07-01 19:40:31 -0400653 valgrindArgs = append(valgrindArgs, "--db-attach=yes", "--db-command=xterm -e gdb -nw %f %p")
Adam Langley95c29f32014-06-20 12:00:00 -0700654 }
David Benjamin325b5c32014-07-01 19:40:31 -0400655 valgrindArgs = append(valgrindArgs, path)
656 valgrindArgs = append(valgrindArgs, args...)
Adam Langley95c29f32014-06-20 12:00:00 -0700657
David Benjamin325b5c32014-07-01 19:40:31 -0400658 return exec.Command("valgrind", valgrindArgs...)
Adam Langley95c29f32014-06-20 12:00:00 -0700659}
660
David Benjamin325b5c32014-07-01 19:40:31 -0400661func gdbOf(path string, args ...string) *exec.Cmd {
662 xtermArgs := []string{"-e", "gdb", "--args"}
663 xtermArgs = append(xtermArgs, path)
664 xtermArgs = append(xtermArgs, args...)
Adam Langley95c29f32014-06-20 12:00:00 -0700665
David Benjamin325b5c32014-07-01 19:40:31 -0400666 return exec.Command("xterm", xtermArgs...)
Adam Langley95c29f32014-06-20 12:00:00 -0700667}
668
David Benjamind16bf342015-12-18 00:53:12 -0500669func lldbOf(path string, args ...string) *exec.Cmd {
670 xtermArgs := []string{"-e", "lldb", "--"}
671 xtermArgs = append(xtermArgs, path)
672 xtermArgs = append(xtermArgs, args...)
673
674 return exec.Command("xterm", xtermArgs...)
675}
676
Adam Langley69a01602014-11-17 17:26:55 -0800677type moreMallocsError struct{}
678
679func (moreMallocsError) Error() string {
680 return "child process did not exhaust all allocation calls"
681}
682
683var errMoreMallocs = moreMallocsError{}
684
David Benjamin87c8a642015-02-21 01:54:29 -0500685// accept accepts a connection from listener, unless waitChan signals a process
686// exit first.
687func acceptOrWait(listener net.Listener, waitChan chan error) (net.Conn, error) {
688 type connOrError struct {
689 conn net.Conn
690 err error
691 }
692 connChan := make(chan connOrError, 1)
693 go func() {
694 conn, err := listener.Accept()
695 connChan <- connOrError{conn, err}
696 close(connChan)
697 }()
698 select {
699 case result := <-connChan:
700 return result.conn, result.err
701 case childErr := <-waitChan:
702 waitChan <- childErr
703 return nil, fmt.Errorf("child exited early: %s", childErr)
704 }
705}
706
Adam Langley7c803a62015-06-15 15:35:05 -0700707func runTest(test *testCase, shimPath string, mallocNumToFail int64) error {
Adam Langley38311732014-10-16 19:04:35 -0700708 if !test.shouldFail && (len(test.expectedError) > 0 || len(test.expectedLocalError) > 0) {
709 panic("Error expected without shouldFail in " + test.name)
710 }
711
Adam Langleyb0eef0a2015-06-02 10:47:39 -0700712 if test.expectResumeRejected && !test.resumeSession {
713 panic("expectResumeRejected without resumeSession in " + test.name)
714 }
715
David Benjamin87c8a642015-02-21 01:54:29 -0500716 listener, err := net.ListenTCP("tcp4", &net.TCPAddr{IP: net.IP{127, 0, 0, 1}})
717 if err != nil {
718 panic(err)
719 }
720 defer func() {
721 if listener != nil {
722 listener.Close()
723 }
724 }()
Adam Langley95c29f32014-06-20 12:00:00 -0700725
David Benjamin87c8a642015-02-21 01:54:29 -0500726 flags := []string{"-port", strconv.Itoa(listener.Addr().(*net.TCPAddr).Port)}
David Benjamin1d5c83e2014-07-22 19:20:02 -0400727 if test.testType == serverTest {
David Benjamin5a593af2014-08-11 19:51:50 -0400728 flags = append(flags, "-server")
729
David Benjamin025b3d32014-07-01 19:53:04 -0400730 flags = append(flags, "-key-file")
731 if test.keyFile == "" {
Adam Langley7c803a62015-06-15 15:35:05 -0700732 flags = append(flags, path.Join(*resourceDir, rsaKeyFile))
David Benjamin025b3d32014-07-01 19:53:04 -0400733 } else {
Adam Langley7c803a62015-06-15 15:35:05 -0700734 flags = append(flags, path.Join(*resourceDir, test.keyFile))
David Benjamin025b3d32014-07-01 19:53:04 -0400735 }
736
737 flags = append(flags, "-cert-file")
738 if test.certFile == "" {
Adam Langley7c803a62015-06-15 15:35:05 -0700739 flags = append(flags, path.Join(*resourceDir, rsaCertificateFile))
David Benjamin025b3d32014-07-01 19:53:04 -0400740 } else {
Adam Langley7c803a62015-06-15 15:35:05 -0700741 flags = append(flags, path.Join(*resourceDir, test.certFile))
David Benjamin025b3d32014-07-01 19:53:04 -0400742 }
743 }
David Benjamin5a593af2014-08-11 19:51:50 -0400744
David Benjamin6fd297b2014-08-11 18:43:38 -0400745 if test.protocol == dtls {
746 flags = append(flags, "-dtls")
747 }
748
David Benjamin5a593af2014-08-11 19:51:50 -0400749 if test.resumeSession {
750 flags = append(flags, "-resume")
751 }
752
David Benjamine58c4f52014-08-24 03:47:07 -0400753 if test.shimWritesFirst {
754 flags = append(flags, "-shim-writes-first")
755 }
756
David Benjamin30789da2015-08-29 22:56:45 -0400757 if test.shimShutsDown {
758 flags = append(flags, "-shim-shuts-down")
759 }
760
David Benjaminc565ebb2015-04-03 04:06:36 -0400761 if test.exportKeyingMaterial > 0 {
762 flags = append(flags, "-export-keying-material", strconv.Itoa(test.exportKeyingMaterial))
763 flags = append(flags, "-export-label", test.exportLabel)
764 flags = append(flags, "-export-context", test.exportContext)
765 if test.useExportContext {
766 flags = append(flags, "-use-export-context")
767 }
768 }
Adam Langleyb0eef0a2015-06-02 10:47:39 -0700769 if test.expectResumeRejected {
770 flags = append(flags, "-expect-session-miss")
771 }
David Benjaminc565ebb2015-04-03 04:06:36 -0400772
Adam Langleyaf0e32c2015-06-03 09:57:23 -0700773 if test.testTLSUnique {
774 flags = append(flags, "-tls-unique")
775 }
776
David Benjamin025b3d32014-07-01 19:53:04 -0400777 flags = append(flags, test.flags...)
778
779 var shim *exec.Cmd
780 if *useValgrind {
Adam Langley7c803a62015-06-15 15:35:05 -0700781 shim = valgrindOf(false, shimPath, flags...)
Adam Langley75712922014-10-10 16:23:43 -0700782 } else if *useGDB {
Adam Langley7c803a62015-06-15 15:35:05 -0700783 shim = gdbOf(shimPath, flags...)
David Benjamind16bf342015-12-18 00:53:12 -0500784 } else if *useLLDB {
785 shim = lldbOf(shimPath, flags...)
David Benjamin025b3d32014-07-01 19:53:04 -0400786 } else {
Adam Langley7c803a62015-06-15 15:35:05 -0700787 shim = exec.Command(shimPath, flags...)
David Benjamin025b3d32014-07-01 19:53:04 -0400788 }
David Benjamin025b3d32014-07-01 19:53:04 -0400789 shim.Stdin = os.Stdin
790 var stdoutBuf, stderrBuf bytes.Buffer
791 shim.Stdout = &stdoutBuf
792 shim.Stderr = &stderrBuf
Adam Langley69a01602014-11-17 17:26:55 -0800793 if mallocNumToFail >= 0 {
David Benjamin9e128b02015-02-09 13:13:09 -0500794 shim.Env = os.Environ()
795 shim.Env = append(shim.Env, "MALLOC_NUMBER_TO_FAIL="+strconv.FormatInt(mallocNumToFail, 10))
Adam Langley69a01602014-11-17 17:26:55 -0800796 if *mallocTestDebug {
David Benjamin184494d2015-06-12 18:23:47 -0400797 shim.Env = append(shim.Env, "MALLOC_BREAK_ON_FAIL=1")
Adam Langley69a01602014-11-17 17:26:55 -0800798 }
799 shim.Env = append(shim.Env, "_MALLOC_CHECK=1")
800 }
David Benjamin025b3d32014-07-01 19:53:04 -0400801
802 if err := shim.Start(); err != nil {
Adam Langley95c29f32014-06-20 12:00:00 -0700803 panic(err)
804 }
David Benjamin87c8a642015-02-21 01:54:29 -0500805 waitChan := make(chan error, 1)
806 go func() { waitChan <- shim.Wait() }()
Adam Langley95c29f32014-06-20 12:00:00 -0700807
808 config := test.config
David Benjaminba4594a2015-06-18 18:36:15 -0400809 if !test.noSessionCache {
810 config.ClientSessionCache = NewLRUClientSessionCache(1)
811 config.ServerSessionCache = NewLRUServerSessionCache(1)
812 }
David Benjamin025b3d32014-07-01 19:53:04 -0400813 if test.testType == clientTest {
814 if len(config.Certificates) == 0 {
David Benjamin33863262016-07-08 17:20:12 -0700815 config.Certificates = []Certificate{rsaCertificate}
David Benjamin025b3d32014-07-01 19:53:04 -0400816 }
David Benjamin87c8a642015-02-21 01:54:29 -0500817 } else {
818 // Supply a ServerName to ensure a constant session cache key,
819 // rather than falling back to net.Conn.RemoteAddr.
820 if len(config.ServerName) == 0 {
821 config.ServerName = "test"
822 }
David Benjamin025b3d32014-07-01 19:53:04 -0400823 }
David Benjaminf2b83632016-03-01 22:57:46 -0500824 if *fuzzer {
825 config.Bugs.NullAllCiphers = true
826 }
David Benjamin2e045a92016-06-08 13:09:56 -0400827 if *deterministic {
828 config.Rand = &deterministicRand{}
829 }
Adam Langley95c29f32014-06-20 12:00:00 -0700830
David Benjamin87c8a642015-02-21 01:54:29 -0500831 conn, err := acceptOrWait(listener, waitChan)
832 if err == nil {
David Benjamin8e6db492015-07-25 18:29:23 -0400833 err = doExchange(test, &config, conn, false /* not a resumption */)
David Benjamin87c8a642015-02-21 01:54:29 -0500834 conn.Close()
835 }
David Benjamin65ea8ff2014-11-23 03:01:00 -0500836
David Benjamin1d5c83e2014-07-22 19:20:02 -0400837 if err == nil && test.resumeSession {
David Benjamin01fe8202014-09-24 15:21:44 -0400838 var resumeConfig Config
839 if test.resumeConfig != nil {
840 resumeConfig = *test.resumeConfig
David Benjamin87c8a642015-02-21 01:54:29 -0500841 if len(resumeConfig.ServerName) == 0 {
842 resumeConfig.ServerName = config.ServerName
843 }
David Benjamin01fe8202014-09-24 15:21:44 -0400844 if len(resumeConfig.Certificates) == 0 {
David Benjamin33863262016-07-08 17:20:12 -0700845 resumeConfig.Certificates = []Certificate{rsaCertificate}
David Benjamin01fe8202014-09-24 15:21:44 -0400846 }
David Benjaminba4594a2015-06-18 18:36:15 -0400847 if test.newSessionsOnResume {
848 if !test.noSessionCache {
849 resumeConfig.ClientSessionCache = NewLRUClientSessionCache(1)
850 resumeConfig.ServerSessionCache = NewLRUServerSessionCache(1)
851 }
852 } else {
David Benjaminfe8eb9a2014-11-17 03:19:02 -0500853 resumeConfig.SessionTicketKey = config.SessionTicketKey
854 resumeConfig.ClientSessionCache = config.ClientSessionCache
855 resumeConfig.ServerSessionCache = config.ServerSessionCache
856 }
David Benjaminf2b83632016-03-01 22:57:46 -0500857 if *fuzzer {
858 resumeConfig.Bugs.NullAllCiphers = true
859 }
David Benjamin2e045a92016-06-08 13:09:56 -0400860 resumeConfig.Rand = config.Rand
David Benjamin01fe8202014-09-24 15:21:44 -0400861 } else {
862 resumeConfig = config
863 }
David Benjamin87c8a642015-02-21 01:54:29 -0500864 var connResume net.Conn
865 connResume, err = acceptOrWait(listener, waitChan)
866 if err == nil {
David Benjamin8e6db492015-07-25 18:29:23 -0400867 err = doExchange(test, &resumeConfig, connResume, true /* resumption */)
David Benjamin87c8a642015-02-21 01:54:29 -0500868 connResume.Close()
869 }
David Benjamin1d5c83e2014-07-22 19:20:02 -0400870 }
871
David Benjamin87c8a642015-02-21 01:54:29 -0500872 // Close the listener now. This is to avoid hangs should the shim try to
873 // open more connections than expected.
874 listener.Close()
875 listener = nil
876
877 childErr := <-waitChan
Adam Langley69a01602014-11-17 17:26:55 -0800878 if exitError, ok := childErr.(*exec.ExitError); ok {
879 if exitError.Sys().(syscall.WaitStatus).ExitStatus() == 88 {
880 return errMoreMallocs
881 }
882 }
Adam Langley95c29f32014-06-20 12:00:00 -0700883
David Benjamin9bea3492016-03-02 10:59:16 -0500884 // Account for Windows line endings.
885 stdout := strings.Replace(string(stdoutBuf.Bytes()), "\r\n", "\n", -1)
886 stderr := strings.Replace(string(stderrBuf.Bytes()), "\r\n", "\n", -1)
David Benjaminff3a1492016-03-02 10:12:06 -0500887
888 // Separate the errors from the shim and those from tools like
889 // AddressSanitizer.
890 var extraStderr string
891 if stderrParts := strings.SplitN(stderr, "--- DONE ---\n", 2); len(stderrParts) == 2 {
892 stderr = stderrParts[0]
893 extraStderr = stderrParts[1]
894 }
895
Adam Langley95c29f32014-06-20 12:00:00 -0700896 failed := err != nil || childErr != nil
David Benjaminc565ebb2015-04-03 04:06:36 -0400897 correctFailure := len(test.expectedError) == 0 || strings.Contains(stderr, test.expectedError)
Adam Langleyac61fa32014-06-23 12:03:11 -0700898 localError := "none"
899 if err != nil {
900 localError = err.Error()
901 }
902 if len(test.expectedLocalError) != 0 {
903 correctFailure = correctFailure && strings.Contains(localError, test.expectedLocalError)
904 }
Adam Langley95c29f32014-06-20 12:00:00 -0700905
906 if failed != test.shouldFail || failed && !correctFailure {
Adam Langley95c29f32014-06-20 12:00:00 -0700907 childError := "none"
Adam Langley95c29f32014-06-20 12:00:00 -0700908 if childErr != nil {
909 childError = childErr.Error()
910 }
911
912 var msg string
913 switch {
914 case failed && !test.shouldFail:
915 msg = "unexpected failure"
916 case !failed && test.shouldFail:
917 msg = "unexpected success"
918 case failed && !correctFailure:
Adam Langleyac61fa32014-06-23 12:03:11 -0700919 msg = "bad error (wanted '" + test.expectedError + "' / '" + test.expectedLocalError + "')"
Adam Langley95c29f32014-06-20 12:00:00 -0700920 default:
921 panic("internal error")
922 }
923
David Benjaminc565ebb2015-04-03 04:06:36 -0400924 return fmt.Errorf("%s: local error '%s', child error '%s', stdout:\n%s\nstderr:\n%s", msg, localError, childError, stdout, stderr)
Adam Langley95c29f32014-06-20 12:00:00 -0700925 }
926
David Benjaminff3a1492016-03-02 10:12:06 -0500927 if !*useValgrind && (len(extraStderr) > 0 || (!failed && len(stderr) > 0)) {
928 return fmt.Errorf("unexpected error output:\n%s\n%s", stderr, extraStderr)
Adam Langley95c29f32014-06-20 12:00:00 -0700929 }
930
931 return nil
932}
933
934var tlsVersions = []struct {
935 name string
936 version uint16
David Benjamin7e2e6cf2014-08-07 17:44:24 -0400937 flag string
David Benjamin8b8c0062014-11-23 02:47:52 -0500938 hasDTLS bool
Adam Langley95c29f32014-06-20 12:00:00 -0700939}{
David Benjamin8b8c0062014-11-23 02:47:52 -0500940 {"SSL3", VersionSSL30, "-no-ssl3", false},
941 {"TLS1", VersionTLS10, "-no-tls1", true},
942 {"TLS11", VersionTLS11, "-no-tls11", false},
943 {"TLS12", VersionTLS12, "-no-tls12", true},
Nick Harper1fd39d82016-06-14 18:14:35 -0700944 // TODO(nharper): Once we have a real implementation of TLS 1.3, update the name here.
945 {"FakeTLS13", VersionTLS13, "-no-tls13", false},
Adam Langley95c29f32014-06-20 12:00:00 -0700946}
947
948var testCipherSuites = []struct {
949 name string
950 id uint16
951}{
952 {"3DES-SHA", TLS_RSA_WITH_3DES_EDE_CBC_SHA},
David Benjaminf4e5c4e2014-08-02 17:35:45 -0400953 {"AES128-GCM", TLS_RSA_WITH_AES_128_GCM_SHA256},
Adam Langley95c29f32014-06-20 12:00:00 -0700954 {"AES128-SHA", TLS_RSA_WITH_AES_128_CBC_SHA},
David Benjaminf7768e42014-08-31 02:06:47 -0400955 {"AES128-SHA256", TLS_RSA_WITH_AES_128_CBC_SHA256},
David Benjaminf4e5c4e2014-08-02 17:35:45 -0400956 {"AES256-GCM", TLS_RSA_WITH_AES_256_GCM_SHA384},
Adam Langley95c29f32014-06-20 12:00:00 -0700957 {"AES256-SHA", TLS_RSA_WITH_AES_256_CBC_SHA},
David Benjaminf7768e42014-08-31 02:06:47 -0400958 {"AES256-SHA256", TLS_RSA_WITH_AES_256_CBC_SHA256},
David Benjaminf4e5c4e2014-08-02 17:35:45 -0400959 {"DHE-RSA-AES128-GCM", TLS_DHE_RSA_WITH_AES_128_GCM_SHA256},
960 {"DHE-RSA-AES128-SHA", TLS_DHE_RSA_WITH_AES_128_CBC_SHA},
David Benjaminf7768e42014-08-31 02:06:47 -0400961 {"DHE-RSA-AES128-SHA256", TLS_DHE_RSA_WITH_AES_128_CBC_SHA256},
David Benjaminf4e5c4e2014-08-02 17:35:45 -0400962 {"DHE-RSA-AES256-GCM", TLS_DHE_RSA_WITH_AES_256_GCM_SHA384},
963 {"DHE-RSA-AES256-SHA", TLS_DHE_RSA_WITH_AES_256_CBC_SHA},
David Benjaminf7768e42014-08-31 02:06:47 -0400964 {"DHE-RSA-AES256-SHA256", TLS_DHE_RSA_WITH_AES_256_CBC_SHA256},
Adam Langley95c29f32014-06-20 12:00:00 -0700965 {"ECDHE-ECDSA-AES128-GCM", TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
966 {"ECDHE-ECDSA-AES128-SHA", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA},
David Benjaminf7768e42014-08-31 02:06:47 -0400967 {"ECDHE-ECDSA-AES128-SHA256", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256},
968 {"ECDHE-ECDSA-AES256-GCM", TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384},
Adam Langley95c29f32014-06-20 12:00:00 -0700969 {"ECDHE-ECDSA-AES256-SHA", TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA},
David Benjaminf7768e42014-08-31 02:06:47 -0400970 {"ECDHE-ECDSA-AES256-SHA384", TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384},
David Benjamin13414b32015-12-09 23:02:39 -0500971 {"ECDHE-ECDSA-CHACHA20-POLY1305", TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256},
David Benjamine3203922015-12-09 21:21:31 -0500972 {"ECDHE-ECDSA-CHACHA20-POLY1305-OLD", TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256_OLD},
Adam Langley95c29f32014-06-20 12:00:00 -0700973 {"ECDHE-ECDSA-RC4-SHA", TLS_ECDHE_ECDSA_WITH_RC4_128_SHA},
Adam Langley95c29f32014-06-20 12:00:00 -0700974 {"ECDHE-RSA-AES128-GCM", TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
Adam Langley95c29f32014-06-20 12:00:00 -0700975 {"ECDHE-RSA-AES128-SHA", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA},
David Benjaminf7768e42014-08-31 02:06:47 -0400976 {"ECDHE-RSA-AES128-SHA256", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256},
David Benjaminf4e5c4e2014-08-02 17:35:45 -0400977 {"ECDHE-RSA-AES256-GCM", TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384},
Adam Langley95c29f32014-06-20 12:00:00 -0700978 {"ECDHE-RSA-AES256-SHA", TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA},
David Benjaminf7768e42014-08-31 02:06:47 -0400979 {"ECDHE-RSA-AES256-SHA384", TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384},
David Benjamin13414b32015-12-09 23:02:39 -0500980 {"ECDHE-RSA-CHACHA20-POLY1305", TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256},
David Benjamine3203922015-12-09 21:21:31 -0500981 {"ECDHE-RSA-CHACHA20-POLY1305-OLD", TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256_OLD},
Adam Langley95c29f32014-06-20 12:00:00 -0700982 {"ECDHE-RSA-RC4-SHA", TLS_ECDHE_RSA_WITH_RC4_128_SHA},
Matt Braithwaite053931e2016-05-25 12:06:05 -0700983 {"CECPQ1-RSA-CHACHA20-POLY1305-SHA256", TLS_CECPQ1_RSA_WITH_CHACHA20_POLY1305_SHA256},
984 {"CECPQ1-ECDSA-CHACHA20-POLY1305-SHA256", TLS_CECPQ1_ECDSA_WITH_CHACHA20_POLY1305_SHA256},
985 {"CECPQ1-RSA-AES256-GCM-SHA384", TLS_CECPQ1_RSA_WITH_AES_256_GCM_SHA384},
986 {"CECPQ1-ECDSA-AES256-GCM-SHA384", TLS_CECPQ1_ECDSA_WITH_AES_256_GCM_SHA384},
David Benjamin48cae082014-10-27 01:06:24 -0400987 {"PSK-AES128-CBC-SHA", TLS_PSK_WITH_AES_128_CBC_SHA},
988 {"PSK-AES256-CBC-SHA", TLS_PSK_WITH_AES_256_CBC_SHA},
Adam Langley85bc5602015-06-09 09:54:04 -0700989 {"ECDHE-PSK-AES128-CBC-SHA", TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA},
990 {"ECDHE-PSK-AES256-CBC-SHA", TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA},
David Benjamin13414b32015-12-09 23:02:39 -0500991 {"ECDHE-PSK-CHACHA20-POLY1305", TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256},
Steven Valdez3084e7b2016-06-02 12:07:20 -0400992 {"ECDHE-PSK-AES128-GCM-SHA256", TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256},
993 {"ECDHE-PSK-AES256-GCM-SHA384", TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384},
David Benjamin48cae082014-10-27 01:06:24 -0400994 {"PSK-RC4-SHA", TLS_PSK_WITH_RC4_128_SHA},
Adam Langley95c29f32014-06-20 12:00:00 -0700995 {"RC4-MD5", TLS_RSA_WITH_RC4_128_MD5},
David Benjaminf4e5c4e2014-08-02 17:35:45 -0400996 {"RC4-SHA", TLS_RSA_WITH_RC4_128_SHA},
Matt Braithwaiteaf096752015-09-02 19:48:16 -0700997 {"NULL-SHA", TLS_RSA_WITH_NULL_SHA},
Adam Langley95c29f32014-06-20 12:00:00 -0700998}
999
David Benjamin8b8c0062014-11-23 02:47:52 -05001000func hasComponent(suiteName, component string) bool {
1001 return strings.Contains("-"+suiteName+"-", "-"+component+"-")
1002}
1003
David Benjaminf7768e42014-08-31 02:06:47 -04001004func isTLS12Only(suiteName string) bool {
David Benjamin8b8c0062014-11-23 02:47:52 -05001005 return hasComponent(suiteName, "GCM") ||
1006 hasComponent(suiteName, "SHA256") ||
David Benjamine9a80ff2015-04-07 00:46:46 -04001007 hasComponent(suiteName, "SHA384") ||
1008 hasComponent(suiteName, "POLY1305")
David Benjamin8b8c0062014-11-23 02:47:52 -05001009}
1010
Nick Harper1fd39d82016-06-14 18:14:35 -07001011func isTLS13Suite(suiteName string) bool {
David Benjamin54c217c2016-07-13 12:35:25 -04001012 // Only AEADs.
1013 if !hasComponent(suiteName, "GCM") && !hasComponent(suiteName, "POLY1305") {
1014 return false
1015 }
1016 // No old CHACHA20_POLY1305.
1017 if hasComponent(suiteName, "CHACHA20-POLY1305-OLD") {
1018 return false
1019 }
1020 // Must have ECDHE.
1021 // TODO(davidben,svaldez): Add pure PSK support.
1022 if !hasComponent(suiteName, "ECDHE") {
1023 return false
1024 }
1025 // TODO(davidben,svaldez): Add PSK support.
1026 if hasComponent(suiteName, "PSK") {
1027 return false
1028 }
1029 return true
Nick Harper1fd39d82016-06-14 18:14:35 -07001030}
1031
David Benjamin8b8c0062014-11-23 02:47:52 -05001032func isDTLSCipher(suiteName string) bool {
Matt Braithwaiteaf096752015-09-02 19:48:16 -07001033 return !hasComponent(suiteName, "RC4") && !hasComponent(suiteName, "NULL")
David Benjaminf7768e42014-08-31 02:06:47 -04001034}
1035
Adam Langleya7997f12015-05-14 17:38:50 -07001036func bigFromHex(hex string) *big.Int {
1037 ret, ok := new(big.Int).SetString(hex, 16)
1038 if !ok {
1039 panic("failed to parse hex number 0x" + hex)
1040 }
1041 return ret
1042}
1043
Adam Langley7c803a62015-06-15 15:35:05 -07001044func addBasicTests() {
1045 basicTests := []testCase{
1046 {
Adam Langley7c803a62015-06-15 15:35:05 -07001047 name: "NoFallbackSCSV",
1048 config: Config{
1049 Bugs: ProtocolBugs{
1050 FailIfNotFallbackSCSV: true,
1051 },
1052 },
1053 shouldFail: true,
1054 expectedLocalError: "no fallback SCSV found",
1055 },
1056 {
1057 name: "SendFallbackSCSV",
1058 config: Config{
1059 Bugs: ProtocolBugs{
1060 FailIfNotFallbackSCSV: true,
1061 },
1062 },
1063 flags: []string{"-fallback-scsv"},
1064 },
1065 {
1066 name: "ClientCertificateTypes",
1067 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001068 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001069 ClientAuth: RequestClientCert,
1070 ClientCertificateTypes: []byte{
1071 CertTypeDSSSign,
1072 CertTypeRSASign,
1073 CertTypeECDSASign,
1074 },
1075 },
1076 flags: []string{
1077 "-expect-certificate-types",
1078 base64.StdEncoding.EncodeToString([]byte{
1079 CertTypeDSSSign,
1080 CertTypeRSASign,
1081 CertTypeECDSASign,
1082 }),
1083 },
1084 },
1085 {
Adam Langley7c803a62015-06-15 15:35:05 -07001086 name: "UnauthenticatedECDH",
1087 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001088 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001089 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
1090 Bugs: ProtocolBugs{
1091 UnauthenticatedECDH: true,
1092 },
1093 },
1094 shouldFail: true,
1095 expectedError: ":UNEXPECTED_MESSAGE:",
1096 },
1097 {
1098 name: "SkipCertificateStatus",
1099 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001100 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001101 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
1102 Bugs: ProtocolBugs{
1103 SkipCertificateStatus: true,
1104 },
1105 },
1106 flags: []string{
1107 "-enable-ocsp-stapling",
1108 },
1109 },
1110 {
1111 name: "SkipServerKeyExchange",
1112 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001113 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001114 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
1115 Bugs: ProtocolBugs{
1116 SkipServerKeyExchange: true,
1117 },
1118 },
1119 shouldFail: true,
1120 expectedError: ":UNEXPECTED_MESSAGE:",
1121 },
1122 {
Adam Langley7c803a62015-06-15 15:35:05 -07001123 testType: serverTest,
1124 name: "Alert",
1125 config: Config{
1126 Bugs: ProtocolBugs{
1127 SendSpuriousAlert: alertRecordOverflow,
1128 },
1129 },
1130 shouldFail: true,
1131 expectedError: ":TLSV1_ALERT_RECORD_OVERFLOW:",
1132 },
1133 {
1134 protocol: dtls,
1135 testType: serverTest,
1136 name: "Alert-DTLS",
1137 config: Config{
1138 Bugs: ProtocolBugs{
1139 SendSpuriousAlert: alertRecordOverflow,
1140 },
1141 },
1142 shouldFail: true,
1143 expectedError: ":TLSV1_ALERT_RECORD_OVERFLOW:",
1144 },
1145 {
1146 testType: serverTest,
1147 name: "FragmentAlert",
1148 config: Config{
1149 Bugs: ProtocolBugs{
1150 FragmentAlert: true,
1151 SendSpuriousAlert: alertRecordOverflow,
1152 },
1153 },
1154 shouldFail: true,
1155 expectedError: ":BAD_ALERT:",
1156 },
1157 {
1158 protocol: dtls,
1159 testType: serverTest,
1160 name: "FragmentAlert-DTLS",
1161 config: Config{
1162 Bugs: ProtocolBugs{
1163 FragmentAlert: true,
1164 SendSpuriousAlert: alertRecordOverflow,
1165 },
1166 },
1167 shouldFail: true,
1168 expectedError: ":BAD_ALERT:",
1169 },
1170 {
1171 testType: serverTest,
David Benjamin0d3a8c62016-03-11 22:25:18 -05001172 name: "DoubleAlert",
1173 config: Config{
1174 Bugs: ProtocolBugs{
1175 DoubleAlert: true,
1176 SendSpuriousAlert: alertRecordOverflow,
1177 },
1178 },
1179 shouldFail: true,
1180 expectedError: ":BAD_ALERT:",
1181 },
1182 {
1183 protocol: dtls,
1184 testType: serverTest,
1185 name: "DoubleAlert-DTLS",
1186 config: Config{
1187 Bugs: ProtocolBugs{
1188 DoubleAlert: true,
1189 SendSpuriousAlert: alertRecordOverflow,
1190 },
1191 },
1192 shouldFail: true,
1193 expectedError: ":BAD_ALERT:",
1194 },
1195 {
Adam Langley7c803a62015-06-15 15:35:05 -07001196 name: "SkipNewSessionTicket",
1197 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001198 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001199 Bugs: ProtocolBugs{
1200 SkipNewSessionTicket: true,
1201 },
1202 },
1203 shouldFail: true,
David Benjamina41280d2015-11-26 02:16:49 -05001204 expectedError: ":UNEXPECTED_RECORD:",
Adam Langley7c803a62015-06-15 15:35:05 -07001205 },
1206 {
1207 testType: serverTest,
1208 name: "FallbackSCSV",
1209 config: Config{
1210 MaxVersion: VersionTLS11,
1211 Bugs: ProtocolBugs{
1212 SendFallbackSCSV: true,
1213 },
1214 },
1215 shouldFail: true,
1216 expectedError: ":INAPPROPRIATE_FALLBACK:",
1217 },
1218 {
1219 testType: serverTest,
1220 name: "FallbackSCSV-VersionMatch",
1221 config: Config{
1222 Bugs: ProtocolBugs{
1223 SendFallbackSCSV: true,
1224 },
1225 },
1226 },
1227 {
1228 testType: serverTest,
David Benjamin4c3ddf72016-06-29 18:13:53 -04001229 name: "FallbackSCSV-VersionMatch-TLS12",
1230 config: Config{
1231 MaxVersion: VersionTLS12,
1232 Bugs: ProtocolBugs{
1233 SendFallbackSCSV: true,
1234 },
1235 },
1236 flags: []string{"-max-version", strconv.Itoa(VersionTLS12)},
1237 },
1238 {
1239 testType: serverTest,
Adam Langley7c803a62015-06-15 15:35:05 -07001240 name: "FragmentedClientVersion",
1241 config: Config{
1242 Bugs: ProtocolBugs{
1243 MaxHandshakeRecordLength: 1,
1244 FragmentClientVersion: true,
1245 },
1246 },
Nick Harper1fd39d82016-06-14 18:14:35 -07001247 expectedVersion: VersionTLS13,
Adam Langley7c803a62015-06-15 15:35:05 -07001248 },
1249 {
Adam Langley7c803a62015-06-15 15:35:05 -07001250 testType: serverTest,
1251 name: "HttpGET",
1252 sendPrefix: "GET / HTTP/1.0\n",
1253 shouldFail: true,
1254 expectedError: ":HTTP_REQUEST:",
1255 },
1256 {
1257 testType: serverTest,
1258 name: "HttpPOST",
1259 sendPrefix: "POST / HTTP/1.0\n",
1260 shouldFail: true,
1261 expectedError: ":HTTP_REQUEST:",
1262 },
1263 {
1264 testType: serverTest,
1265 name: "HttpHEAD",
1266 sendPrefix: "HEAD / HTTP/1.0\n",
1267 shouldFail: true,
1268 expectedError: ":HTTP_REQUEST:",
1269 },
1270 {
1271 testType: serverTest,
1272 name: "HttpPUT",
1273 sendPrefix: "PUT / HTTP/1.0\n",
1274 shouldFail: true,
1275 expectedError: ":HTTP_REQUEST:",
1276 },
1277 {
1278 testType: serverTest,
1279 name: "HttpCONNECT",
1280 sendPrefix: "CONNECT www.google.com:443 HTTP/1.0\n",
1281 shouldFail: true,
1282 expectedError: ":HTTPS_PROXY_REQUEST:",
1283 },
1284 {
1285 testType: serverTest,
1286 name: "Garbage",
1287 sendPrefix: "blah",
1288 shouldFail: true,
David Benjamin97760d52015-07-24 23:02:49 -04001289 expectedError: ":WRONG_VERSION_NUMBER:",
Adam Langley7c803a62015-06-15 15:35:05 -07001290 },
1291 {
Adam Langley7c803a62015-06-15 15:35:05 -07001292 name: "RSAEphemeralKey",
1293 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07001294 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001295 CipherSuites: []uint16{TLS_RSA_WITH_AES_128_CBC_SHA},
1296 Bugs: ProtocolBugs{
1297 RSAEphemeralKey: true,
1298 },
1299 },
1300 shouldFail: true,
1301 expectedError: ":UNEXPECTED_MESSAGE:",
1302 },
1303 {
1304 name: "DisableEverything",
Steven Valdez4f94b1c2016-05-24 12:31:07 -04001305 flags: []string{"-no-tls13", "-no-tls12", "-no-tls11", "-no-tls1", "-no-ssl3"},
Adam Langley7c803a62015-06-15 15:35:05 -07001306 shouldFail: true,
1307 expectedError: ":WRONG_SSL_VERSION:",
1308 },
1309 {
1310 protocol: dtls,
1311 name: "DisableEverything-DTLS",
1312 flags: []string{"-no-tls12", "-no-tls1"},
1313 shouldFail: true,
1314 expectedError: ":WRONG_SSL_VERSION:",
1315 },
1316 {
Adam Langley7c803a62015-06-15 15:35:05 -07001317 protocol: dtls,
1318 testType: serverTest,
1319 name: "MTU",
1320 config: Config{
1321 Bugs: ProtocolBugs{
1322 MaxPacketLength: 256,
1323 },
1324 },
1325 flags: []string{"-mtu", "256"},
1326 },
1327 {
1328 protocol: dtls,
1329 testType: serverTest,
1330 name: "MTUExceeded",
1331 config: Config{
1332 Bugs: ProtocolBugs{
1333 MaxPacketLength: 255,
1334 },
1335 },
1336 flags: []string{"-mtu", "256"},
1337 shouldFail: true,
1338 expectedLocalError: "dtls: exceeded maximum packet length",
1339 },
1340 {
1341 name: "CertMismatchRSA",
1342 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001343 // TODO(davidben): Add a TLS 1.3 version of this test.
1344 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001345 CipherSuites: []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
David Benjamin33863262016-07-08 17:20:12 -07001346 Certificates: []Certificate{ecdsaP256Certificate},
Adam Langley7c803a62015-06-15 15:35:05 -07001347 Bugs: ProtocolBugs{
1348 SendCipherSuite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
1349 },
1350 },
1351 shouldFail: true,
1352 expectedError: ":WRONG_CERTIFICATE_TYPE:",
1353 },
1354 {
1355 name: "CertMismatchECDSA",
1356 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001357 // TODO(davidben): Add a TLS 1.3 version of this test.
1358 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001359 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
David Benjamin33863262016-07-08 17:20:12 -07001360 Certificates: []Certificate{rsaCertificate},
Adam Langley7c803a62015-06-15 15:35:05 -07001361 Bugs: ProtocolBugs{
1362 SendCipherSuite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
1363 },
1364 },
1365 shouldFail: true,
1366 expectedError: ":WRONG_CERTIFICATE_TYPE:",
1367 },
1368 {
1369 name: "EmptyCertificateList",
1370 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001371 // TODO(davidben): Add a TLS 1.3 version of this test.
1372 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001373 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
1374 Bugs: ProtocolBugs{
1375 EmptyCertificateList: true,
1376 },
1377 },
1378 shouldFail: true,
1379 expectedError: ":DECODE_ERROR:",
1380 },
1381 {
David Benjamin9ec1c752016-07-14 12:45:01 -04001382 name: "EmptyCertificateList-TLS13",
1383 config: Config{
1384 MaxVersion: VersionTLS13,
1385 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
1386 Bugs: ProtocolBugs{
1387 EmptyCertificateList: true,
1388 },
1389 },
1390 shouldFail: true,
1391 expectedError: ":DECODE_ERROR:",
1392 },
1393 {
Adam Langley7c803a62015-06-15 15:35:05 -07001394 name: "TLSFatalBadPackets",
1395 damageFirstWrite: true,
1396 shouldFail: true,
1397 expectedError: ":DECRYPTION_FAILED_OR_BAD_RECORD_MAC:",
1398 },
1399 {
1400 protocol: dtls,
1401 name: "DTLSIgnoreBadPackets",
1402 damageFirstWrite: true,
1403 },
1404 {
1405 protocol: dtls,
1406 name: "DTLSIgnoreBadPackets-Async",
1407 damageFirstWrite: true,
1408 flags: []string{"-async"},
1409 },
1410 {
David Benjamin4cf369b2015-08-22 01:35:43 -04001411 name: "AppDataBeforeHandshake",
1412 config: Config{
1413 Bugs: ProtocolBugs{
1414 AppDataBeforeHandshake: []byte("TEST MESSAGE"),
1415 },
1416 },
1417 shouldFail: true,
1418 expectedError: ":UNEXPECTED_RECORD:",
1419 },
1420 {
1421 name: "AppDataBeforeHandshake-Empty",
1422 config: Config{
1423 Bugs: ProtocolBugs{
1424 AppDataBeforeHandshake: []byte{},
1425 },
1426 },
1427 shouldFail: true,
1428 expectedError: ":UNEXPECTED_RECORD:",
1429 },
1430 {
1431 protocol: dtls,
1432 name: "AppDataBeforeHandshake-DTLS",
1433 config: Config{
1434 Bugs: ProtocolBugs{
1435 AppDataBeforeHandshake: []byte("TEST MESSAGE"),
1436 },
1437 },
1438 shouldFail: true,
1439 expectedError: ":UNEXPECTED_RECORD:",
1440 },
1441 {
1442 protocol: dtls,
1443 name: "AppDataBeforeHandshake-DTLS-Empty",
1444 config: Config{
1445 Bugs: ProtocolBugs{
1446 AppDataBeforeHandshake: []byte{},
1447 },
1448 },
1449 shouldFail: true,
1450 expectedError: ":UNEXPECTED_RECORD:",
1451 },
1452 {
Adam Langley7c803a62015-06-15 15:35:05 -07001453 name: "AppDataAfterChangeCipherSpec",
1454 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001455 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001456 Bugs: ProtocolBugs{
1457 AppDataAfterChangeCipherSpec: []byte("TEST MESSAGE"),
1458 },
1459 },
1460 shouldFail: true,
David Benjamina41280d2015-11-26 02:16:49 -05001461 expectedError: ":UNEXPECTED_RECORD:",
Adam Langley7c803a62015-06-15 15:35:05 -07001462 },
1463 {
David Benjamin4cf369b2015-08-22 01:35:43 -04001464 name: "AppDataAfterChangeCipherSpec-Empty",
1465 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001466 MaxVersion: VersionTLS12,
David Benjamin4cf369b2015-08-22 01:35:43 -04001467 Bugs: ProtocolBugs{
1468 AppDataAfterChangeCipherSpec: []byte{},
1469 },
1470 },
1471 shouldFail: true,
David Benjamina41280d2015-11-26 02:16:49 -05001472 expectedError: ":UNEXPECTED_RECORD:",
David Benjamin4cf369b2015-08-22 01:35:43 -04001473 },
1474 {
Adam Langley7c803a62015-06-15 15:35:05 -07001475 protocol: dtls,
1476 name: "AppDataAfterChangeCipherSpec-DTLS",
1477 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001478 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001479 Bugs: ProtocolBugs{
1480 AppDataAfterChangeCipherSpec: []byte("TEST MESSAGE"),
1481 },
1482 },
1483 // BoringSSL's DTLS implementation will drop the out-of-order
1484 // application data.
1485 },
1486 {
David Benjamin4cf369b2015-08-22 01:35:43 -04001487 protocol: dtls,
1488 name: "AppDataAfterChangeCipherSpec-DTLS-Empty",
1489 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001490 MaxVersion: VersionTLS12,
David Benjamin4cf369b2015-08-22 01:35:43 -04001491 Bugs: ProtocolBugs{
1492 AppDataAfterChangeCipherSpec: []byte{},
1493 },
1494 },
1495 // BoringSSL's DTLS implementation will drop the out-of-order
1496 // application data.
1497 },
1498 {
Adam Langley7c803a62015-06-15 15:35:05 -07001499 name: "AlertAfterChangeCipherSpec",
1500 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001501 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001502 Bugs: ProtocolBugs{
1503 AlertAfterChangeCipherSpec: alertRecordOverflow,
1504 },
1505 },
1506 shouldFail: true,
1507 expectedError: ":TLSV1_ALERT_RECORD_OVERFLOW:",
1508 },
1509 {
1510 protocol: dtls,
1511 name: "AlertAfterChangeCipherSpec-DTLS",
1512 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001513 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001514 Bugs: ProtocolBugs{
1515 AlertAfterChangeCipherSpec: alertRecordOverflow,
1516 },
1517 },
1518 shouldFail: true,
1519 expectedError: ":TLSV1_ALERT_RECORD_OVERFLOW:",
1520 },
1521 {
1522 protocol: dtls,
1523 name: "ReorderHandshakeFragments-Small-DTLS",
1524 config: Config{
1525 Bugs: ProtocolBugs{
1526 ReorderHandshakeFragments: true,
1527 // Small enough that every handshake message is
1528 // fragmented.
1529 MaxHandshakeRecordLength: 2,
1530 },
1531 },
1532 },
1533 {
1534 protocol: dtls,
1535 name: "ReorderHandshakeFragments-Large-DTLS",
1536 config: Config{
1537 Bugs: ProtocolBugs{
1538 ReorderHandshakeFragments: true,
1539 // Large enough that no handshake message is
1540 // fragmented.
1541 MaxHandshakeRecordLength: 2048,
1542 },
1543 },
1544 },
1545 {
1546 protocol: dtls,
1547 name: "MixCompleteMessageWithFragments-DTLS",
1548 config: Config{
1549 Bugs: ProtocolBugs{
1550 ReorderHandshakeFragments: true,
1551 MixCompleteMessageWithFragments: true,
1552 MaxHandshakeRecordLength: 2,
1553 },
1554 },
1555 },
1556 {
1557 name: "SendInvalidRecordType",
1558 config: Config{
1559 Bugs: ProtocolBugs{
1560 SendInvalidRecordType: true,
1561 },
1562 },
1563 shouldFail: true,
1564 expectedError: ":UNEXPECTED_RECORD:",
1565 },
1566 {
1567 protocol: dtls,
1568 name: "SendInvalidRecordType-DTLS",
1569 config: Config{
1570 Bugs: ProtocolBugs{
1571 SendInvalidRecordType: true,
1572 },
1573 },
1574 shouldFail: true,
1575 expectedError: ":UNEXPECTED_RECORD:",
1576 },
1577 {
1578 name: "FalseStart-SkipServerSecondLeg",
1579 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07001580 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001581 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
1582 NextProtos: []string{"foo"},
1583 Bugs: ProtocolBugs{
1584 SkipNewSessionTicket: true,
1585 SkipChangeCipherSpec: true,
1586 SkipFinished: true,
1587 ExpectFalseStart: true,
1588 },
1589 },
1590 flags: []string{
1591 "-false-start",
1592 "-handshake-never-done",
1593 "-advertise-alpn", "\x03foo",
1594 },
1595 shimWritesFirst: true,
1596 shouldFail: true,
1597 expectedError: ":UNEXPECTED_RECORD:",
1598 },
1599 {
1600 name: "FalseStart-SkipServerSecondLeg-Implicit",
1601 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07001602 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001603 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
1604 NextProtos: []string{"foo"},
1605 Bugs: ProtocolBugs{
1606 SkipNewSessionTicket: true,
1607 SkipChangeCipherSpec: true,
1608 SkipFinished: true,
1609 },
1610 },
1611 flags: []string{
1612 "-implicit-handshake",
1613 "-false-start",
1614 "-handshake-never-done",
1615 "-advertise-alpn", "\x03foo",
1616 },
1617 shouldFail: true,
1618 expectedError: ":UNEXPECTED_RECORD:",
1619 },
1620 {
1621 testType: serverTest,
1622 name: "FailEarlyCallback",
1623 flags: []string{"-fail-early-callback"},
1624 shouldFail: true,
1625 expectedError: ":CONNECTION_REJECTED:",
1626 expectedLocalError: "remote error: access denied",
1627 },
1628 {
1629 name: "WrongMessageType",
1630 config: Config{
David Benjamin1edae6b2016-07-13 16:58:23 -04001631 MaxVersion: VersionTLS12,
1632 Bugs: ProtocolBugs{
1633 WrongCertificateMessageType: true,
1634 },
1635 },
1636 shouldFail: true,
1637 expectedError: ":UNEXPECTED_MESSAGE:",
1638 expectedLocalError: "remote error: unexpected message",
1639 },
1640 {
1641 name: "WrongMessageType-TLS13",
1642 config: Config{
Adam Langley7c803a62015-06-15 15:35:05 -07001643 Bugs: ProtocolBugs{
1644 WrongCertificateMessageType: true,
1645 },
1646 },
1647 shouldFail: true,
1648 expectedError: ":UNEXPECTED_MESSAGE:",
1649 expectedLocalError: "remote error: unexpected message",
1650 },
1651 {
1652 protocol: dtls,
1653 name: "WrongMessageType-DTLS",
1654 config: Config{
1655 Bugs: ProtocolBugs{
1656 WrongCertificateMessageType: true,
1657 },
1658 },
1659 shouldFail: true,
1660 expectedError: ":UNEXPECTED_MESSAGE:",
1661 expectedLocalError: "remote error: unexpected message",
1662 },
1663 {
1664 protocol: dtls,
1665 name: "FragmentMessageTypeMismatch-DTLS",
1666 config: Config{
1667 Bugs: ProtocolBugs{
1668 MaxHandshakeRecordLength: 2,
1669 FragmentMessageTypeMismatch: true,
1670 },
1671 },
1672 shouldFail: true,
1673 expectedError: ":FRAGMENT_MISMATCH:",
1674 },
1675 {
1676 protocol: dtls,
1677 name: "FragmentMessageLengthMismatch-DTLS",
1678 config: Config{
1679 Bugs: ProtocolBugs{
1680 MaxHandshakeRecordLength: 2,
1681 FragmentMessageLengthMismatch: true,
1682 },
1683 },
1684 shouldFail: true,
1685 expectedError: ":FRAGMENT_MISMATCH:",
1686 },
1687 {
1688 protocol: dtls,
1689 name: "SplitFragments-Header-DTLS",
1690 config: Config{
1691 Bugs: ProtocolBugs{
1692 SplitFragments: 2,
1693 },
1694 },
1695 shouldFail: true,
David Benjaminc6604172016-06-02 16:38:35 -04001696 expectedError: ":BAD_HANDSHAKE_RECORD:",
Adam Langley7c803a62015-06-15 15:35:05 -07001697 },
1698 {
1699 protocol: dtls,
1700 name: "SplitFragments-Boundary-DTLS",
1701 config: Config{
1702 Bugs: ProtocolBugs{
1703 SplitFragments: dtlsRecordHeaderLen,
1704 },
1705 },
1706 shouldFail: true,
David Benjaminc6604172016-06-02 16:38:35 -04001707 expectedError: ":BAD_HANDSHAKE_RECORD:",
Adam Langley7c803a62015-06-15 15:35:05 -07001708 },
1709 {
1710 protocol: dtls,
1711 name: "SplitFragments-Body-DTLS",
1712 config: Config{
1713 Bugs: ProtocolBugs{
1714 SplitFragments: dtlsRecordHeaderLen + 1,
1715 },
1716 },
1717 shouldFail: true,
David Benjaminc6604172016-06-02 16:38:35 -04001718 expectedError: ":BAD_HANDSHAKE_RECORD:",
Adam Langley7c803a62015-06-15 15:35:05 -07001719 },
1720 {
1721 protocol: dtls,
1722 name: "SendEmptyFragments-DTLS",
1723 config: Config{
1724 Bugs: ProtocolBugs{
1725 SendEmptyFragments: true,
1726 },
1727 },
1728 },
1729 {
David Benjaminbf82aed2016-03-01 22:57:40 -05001730 name: "BadFinished-Client",
1731 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001732 // TODO(davidben): Add a TLS 1.3 version of this.
1733 MaxVersion: VersionTLS12,
David Benjaminbf82aed2016-03-01 22:57:40 -05001734 Bugs: ProtocolBugs{
1735 BadFinished: true,
1736 },
1737 },
1738 shouldFail: true,
1739 expectedError: ":DIGEST_CHECK_FAILED:",
1740 },
1741 {
1742 testType: serverTest,
1743 name: "BadFinished-Server",
Adam Langley7c803a62015-06-15 15:35:05 -07001744 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001745 // TODO(davidben): Add a TLS 1.3 version of this.
1746 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001747 Bugs: ProtocolBugs{
1748 BadFinished: true,
1749 },
1750 },
1751 shouldFail: true,
1752 expectedError: ":DIGEST_CHECK_FAILED:",
1753 },
1754 {
1755 name: "FalseStart-BadFinished",
1756 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07001757 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001758 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
1759 NextProtos: []string{"foo"},
1760 Bugs: ProtocolBugs{
1761 BadFinished: true,
1762 ExpectFalseStart: true,
1763 },
1764 },
1765 flags: []string{
1766 "-false-start",
1767 "-handshake-never-done",
1768 "-advertise-alpn", "\x03foo",
1769 },
1770 shimWritesFirst: true,
1771 shouldFail: true,
1772 expectedError: ":DIGEST_CHECK_FAILED:",
1773 },
1774 {
1775 name: "NoFalseStart-NoALPN",
1776 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07001777 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001778 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
1779 Bugs: ProtocolBugs{
1780 ExpectFalseStart: true,
1781 AlertBeforeFalseStartTest: alertAccessDenied,
1782 },
1783 },
1784 flags: []string{
1785 "-false-start",
1786 },
1787 shimWritesFirst: true,
1788 shouldFail: true,
1789 expectedError: ":TLSV1_ALERT_ACCESS_DENIED:",
1790 expectedLocalError: "tls: peer did not false start: EOF",
1791 },
1792 {
1793 name: "NoFalseStart-NoAEAD",
1794 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07001795 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001796 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA},
1797 NextProtos: []string{"foo"},
1798 Bugs: ProtocolBugs{
1799 ExpectFalseStart: true,
1800 AlertBeforeFalseStartTest: alertAccessDenied,
1801 },
1802 },
1803 flags: []string{
1804 "-false-start",
1805 "-advertise-alpn", "\x03foo",
1806 },
1807 shimWritesFirst: true,
1808 shouldFail: true,
1809 expectedError: ":TLSV1_ALERT_ACCESS_DENIED:",
1810 expectedLocalError: "tls: peer did not false start: EOF",
1811 },
1812 {
1813 name: "NoFalseStart-RSA",
1814 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07001815 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001816 CipherSuites: []uint16{TLS_RSA_WITH_AES_128_GCM_SHA256},
1817 NextProtos: []string{"foo"},
1818 Bugs: ProtocolBugs{
1819 ExpectFalseStart: true,
1820 AlertBeforeFalseStartTest: alertAccessDenied,
1821 },
1822 },
1823 flags: []string{
1824 "-false-start",
1825 "-advertise-alpn", "\x03foo",
1826 },
1827 shimWritesFirst: true,
1828 shouldFail: true,
1829 expectedError: ":TLSV1_ALERT_ACCESS_DENIED:",
1830 expectedLocalError: "tls: peer did not false start: EOF",
1831 },
1832 {
1833 name: "NoFalseStart-DHE_RSA",
1834 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07001835 MaxVersion: VersionTLS12,
Adam Langley7c803a62015-06-15 15:35:05 -07001836 CipherSuites: []uint16{TLS_DHE_RSA_WITH_AES_128_GCM_SHA256},
1837 NextProtos: []string{"foo"},
1838 Bugs: ProtocolBugs{
1839 ExpectFalseStart: true,
1840 AlertBeforeFalseStartTest: alertAccessDenied,
1841 },
1842 },
1843 flags: []string{
1844 "-false-start",
1845 "-advertise-alpn", "\x03foo",
1846 },
1847 shimWritesFirst: true,
1848 shouldFail: true,
1849 expectedError: ":TLSV1_ALERT_ACCESS_DENIED:",
1850 expectedLocalError: "tls: peer did not false start: EOF",
1851 },
1852 {
Adam Langley7c803a62015-06-15 15:35:05 -07001853 protocol: dtls,
1854 name: "SendSplitAlert-Sync",
1855 config: Config{
1856 Bugs: ProtocolBugs{
1857 SendSplitAlert: true,
1858 },
1859 },
1860 },
1861 {
1862 protocol: dtls,
1863 name: "SendSplitAlert-Async",
1864 config: Config{
1865 Bugs: ProtocolBugs{
1866 SendSplitAlert: true,
1867 },
1868 },
1869 flags: []string{"-async"},
1870 },
1871 {
1872 protocol: dtls,
1873 name: "PackDTLSHandshake",
1874 config: Config{
1875 Bugs: ProtocolBugs{
1876 MaxHandshakeRecordLength: 2,
1877 PackHandshakeFragments: 20,
1878 PackHandshakeRecords: 200,
1879 },
1880 },
1881 },
1882 {
Adam Langley7c803a62015-06-15 15:35:05 -07001883 name: "SendEmptyRecords-Pass",
1884 sendEmptyRecords: 32,
1885 },
1886 {
1887 name: "SendEmptyRecords",
1888 sendEmptyRecords: 33,
1889 shouldFail: true,
1890 expectedError: ":TOO_MANY_EMPTY_FRAGMENTS:",
1891 },
1892 {
1893 name: "SendEmptyRecords-Async",
1894 sendEmptyRecords: 33,
1895 flags: []string{"-async"},
1896 shouldFail: true,
1897 expectedError: ":TOO_MANY_EMPTY_FRAGMENTS:",
1898 },
1899 {
1900 name: "SendWarningAlerts-Pass",
1901 sendWarningAlerts: 4,
1902 },
1903 {
1904 protocol: dtls,
1905 name: "SendWarningAlerts-DTLS-Pass",
1906 sendWarningAlerts: 4,
1907 },
1908 {
1909 name: "SendWarningAlerts",
1910 sendWarningAlerts: 5,
1911 shouldFail: true,
1912 expectedError: ":TOO_MANY_WARNING_ALERTS:",
1913 },
1914 {
1915 name: "SendWarningAlerts-Async",
1916 sendWarningAlerts: 5,
1917 flags: []string{"-async"},
1918 shouldFail: true,
1919 expectedError: ":TOO_MANY_WARNING_ALERTS:",
1920 },
David Benjaminba4594a2015-06-18 18:36:15 -04001921 {
1922 name: "EmptySessionID",
1923 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04001924 MaxVersion: VersionTLS12,
David Benjaminba4594a2015-06-18 18:36:15 -04001925 SessionTicketsDisabled: true,
1926 },
1927 noSessionCache: true,
1928 flags: []string{"-expect-no-session"},
1929 },
David Benjamin30789da2015-08-29 22:56:45 -04001930 {
1931 name: "Unclean-Shutdown",
1932 config: Config{
1933 Bugs: ProtocolBugs{
1934 NoCloseNotify: true,
1935 ExpectCloseNotify: true,
1936 },
1937 },
1938 shimShutsDown: true,
1939 flags: []string{"-check-close-notify"},
1940 shouldFail: true,
1941 expectedError: "Unexpected SSL_shutdown result: -1 != 1",
1942 },
1943 {
1944 name: "Unclean-Shutdown-Ignored",
1945 config: Config{
1946 Bugs: ProtocolBugs{
1947 NoCloseNotify: true,
1948 },
1949 },
1950 shimShutsDown: true,
1951 },
David Benjamin4f75aaf2015-09-01 16:53:10 -04001952 {
David Benjaminfa214e42016-05-10 17:03:10 -04001953 name: "Unclean-Shutdown-Alert",
1954 config: Config{
1955 Bugs: ProtocolBugs{
1956 SendAlertOnShutdown: alertDecompressionFailure,
1957 ExpectCloseNotify: true,
1958 },
1959 },
1960 shimShutsDown: true,
1961 flags: []string{"-check-close-notify"},
1962 shouldFail: true,
1963 expectedError: ":SSLV3_ALERT_DECOMPRESSION_FAILURE:",
1964 },
1965 {
David Benjamin4f75aaf2015-09-01 16:53:10 -04001966 name: "LargePlaintext",
1967 config: Config{
1968 Bugs: ProtocolBugs{
1969 SendLargeRecords: true,
1970 },
1971 },
1972 messageLen: maxPlaintext + 1,
1973 shouldFail: true,
1974 expectedError: ":DATA_LENGTH_TOO_LONG:",
1975 },
1976 {
1977 protocol: dtls,
1978 name: "LargePlaintext-DTLS",
1979 config: Config{
1980 Bugs: ProtocolBugs{
1981 SendLargeRecords: true,
1982 },
1983 },
1984 messageLen: maxPlaintext + 1,
1985 shouldFail: true,
1986 expectedError: ":DATA_LENGTH_TOO_LONG:",
1987 },
1988 {
1989 name: "LargeCiphertext",
1990 config: Config{
1991 Bugs: ProtocolBugs{
1992 SendLargeRecords: true,
1993 },
1994 },
1995 messageLen: maxPlaintext * 2,
1996 shouldFail: true,
1997 expectedError: ":ENCRYPTED_LENGTH_TOO_LONG:",
1998 },
1999 {
2000 protocol: dtls,
2001 name: "LargeCiphertext-DTLS",
2002 config: Config{
2003 Bugs: ProtocolBugs{
2004 SendLargeRecords: true,
2005 },
2006 },
2007 messageLen: maxPlaintext * 2,
2008 // Unlike the other four cases, DTLS drops records which
2009 // are invalid before authentication, so the connection
2010 // does not fail.
2011 expectMessageDropped: true,
2012 },
David Benjamindd6fed92015-10-23 17:41:12 -04002013 {
David Benjamin4c3ddf72016-06-29 18:13:53 -04002014 // In TLS 1.2 and below, empty NewSessionTicket messages
2015 // mean the server changed its mind on sending a ticket.
David Benjamindd6fed92015-10-23 17:41:12 -04002016 name: "SendEmptySessionTicket",
2017 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002018 MaxVersion: VersionTLS12,
David Benjamindd6fed92015-10-23 17:41:12 -04002019 Bugs: ProtocolBugs{
2020 SendEmptySessionTicket: true,
2021 FailIfSessionOffered: true,
2022 },
2023 },
2024 flags: []string{"-expect-no-session"},
2025 resumeSession: true,
2026 expectResumeRejected: true,
2027 },
David Benjamin99fdfb92015-11-02 12:11:35 -05002028 {
David Benjaminef5dfd22015-12-06 13:17:07 -05002029 name: "BadHelloRequest-1",
2030 renegotiate: 1,
2031 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002032 MaxVersion: VersionTLS12,
David Benjaminef5dfd22015-12-06 13:17:07 -05002033 Bugs: ProtocolBugs{
2034 BadHelloRequest: []byte{typeHelloRequest, 0, 0, 1, 1},
2035 },
2036 },
2037 flags: []string{
2038 "-renegotiate-freely",
2039 "-expect-total-renegotiations", "1",
2040 },
2041 shouldFail: true,
2042 expectedError: ":BAD_HELLO_REQUEST:",
2043 },
2044 {
2045 name: "BadHelloRequest-2",
2046 renegotiate: 1,
2047 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002048 MaxVersion: VersionTLS12,
David Benjaminef5dfd22015-12-06 13:17:07 -05002049 Bugs: ProtocolBugs{
2050 BadHelloRequest: []byte{typeServerKeyExchange, 0, 0, 0},
2051 },
2052 },
2053 flags: []string{
2054 "-renegotiate-freely",
2055 "-expect-total-renegotiations", "1",
2056 },
2057 shouldFail: true,
2058 expectedError: ":BAD_HELLO_REQUEST:",
2059 },
David Benjaminef1b0092015-11-21 14:05:44 -05002060 {
2061 testType: serverTest,
2062 name: "SupportTicketsWithSessionID",
2063 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002064 MaxVersion: VersionTLS12,
David Benjaminef1b0092015-11-21 14:05:44 -05002065 SessionTicketsDisabled: true,
2066 },
David Benjamin4c3ddf72016-06-29 18:13:53 -04002067 resumeConfig: &Config{
2068 MaxVersion: VersionTLS12,
2069 },
David Benjaminef1b0092015-11-21 14:05:44 -05002070 resumeSession: true,
2071 },
Adam Langley7c803a62015-06-15 15:35:05 -07002072 }
Adam Langley7c803a62015-06-15 15:35:05 -07002073 testCases = append(testCases, basicTests...)
2074}
2075
Adam Langley95c29f32014-06-20 12:00:00 -07002076func addCipherSuiteTests() {
2077 for _, suite := range testCipherSuites {
David Benjamin48cae082014-10-27 01:06:24 -04002078 const psk = "12345"
2079 const pskIdentity = "luggage combo"
2080
Adam Langley95c29f32014-06-20 12:00:00 -07002081 var cert Certificate
David Benjamin025b3d32014-07-01 19:53:04 -04002082 var certFile string
2083 var keyFile string
David Benjamin8b8c0062014-11-23 02:47:52 -05002084 if hasComponent(suite.name, "ECDSA") {
David Benjamin33863262016-07-08 17:20:12 -07002085 cert = ecdsaP256Certificate
2086 certFile = ecdsaP256CertificateFile
2087 keyFile = ecdsaP256KeyFile
Adam Langley95c29f32014-06-20 12:00:00 -07002088 } else {
David Benjamin33863262016-07-08 17:20:12 -07002089 cert = rsaCertificate
David Benjamin025b3d32014-07-01 19:53:04 -04002090 certFile = rsaCertificateFile
2091 keyFile = rsaKeyFile
Adam Langley95c29f32014-06-20 12:00:00 -07002092 }
2093
David Benjamin48cae082014-10-27 01:06:24 -04002094 var flags []string
David Benjamin8b8c0062014-11-23 02:47:52 -05002095 if hasComponent(suite.name, "PSK") {
David Benjamin48cae082014-10-27 01:06:24 -04002096 flags = append(flags,
2097 "-psk", psk,
2098 "-psk-identity", pskIdentity)
2099 }
Matt Braithwaiteaf096752015-09-02 19:48:16 -07002100 if hasComponent(suite.name, "NULL") {
2101 // NULL ciphers must be explicitly enabled.
2102 flags = append(flags, "-cipher", "DEFAULT:NULL-SHA")
2103 }
Matt Braithwaite053931e2016-05-25 12:06:05 -07002104 if hasComponent(suite.name, "CECPQ1") {
2105 // CECPQ1 ciphers must be explicitly enabled.
2106 flags = append(flags, "-cipher", "DEFAULT:kCECPQ1")
2107 }
David Benjamin48cae082014-10-27 01:06:24 -04002108
Adam Langley95c29f32014-06-20 12:00:00 -07002109 for _, ver := range tlsVersions {
David Benjamin0407e762016-06-17 16:41:18 -04002110 for _, protocol := range []protocol{tls, dtls} {
2111 var prefix string
2112 if protocol == dtls {
2113 if !ver.hasDTLS {
2114 continue
2115 }
2116 prefix = "D"
2117 }
Adam Langley95c29f32014-06-20 12:00:00 -07002118
David Benjamin0407e762016-06-17 16:41:18 -04002119 var shouldServerFail, shouldClientFail bool
2120 if hasComponent(suite.name, "ECDHE") && ver.version == VersionSSL30 {
2121 // BoringSSL clients accept ECDHE on SSLv3, but
2122 // a BoringSSL server will never select it
2123 // because the extension is missing.
2124 shouldServerFail = true
2125 }
2126 if isTLS12Only(suite.name) && ver.version < VersionTLS12 {
2127 shouldClientFail = true
2128 shouldServerFail = true
2129 }
David Benjamin54c217c2016-07-13 12:35:25 -04002130 if !isTLS13Suite(suite.name) && ver.version >= VersionTLS13 {
Nick Harper1fd39d82016-06-14 18:14:35 -07002131 shouldClientFail = true
2132 shouldServerFail = true
2133 }
David Benjamin0407e762016-06-17 16:41:18 -04002134 if !isDTLSCipher(suite.name) && protocol == dtls {
2135 shouldClientFail = true
2136 shouldServerFail = true
2137 }
David Benjamin4298d772015-12-19 00:18:25 -05002138
David Benjamin0407e762016-06-17 16:41:18 -04002139 var expectedServerError, expectedClientError string
2140 if shouldServerFail {
2141 expectedServerError = ":NO_SHARED_CIPHER:"
2142 }
2143 if shouldClientFail {
2144 expectedClientError = ":WRONG_CIPHER_RETURNED:"
2145 }
David Benjamin025b3d32014-07-01 19:53:04 -04002146
David Benjamin9deb1172016-07-13 17:13:49 -04002147 // TODO(davidben,svaldez): Implement resumption for TLS 1.3.
2148 resumeSession := ver.version < VersionTLS13
2149
David Benjamin6fd297b2014-08-11 18:43:38 -04002150 testCases = append(testCases, testCase{
2151 testType: serverTest,
David Benjamin0407e762016-06-17 16:41:18 -04002152 protocol: protocol,
2153
2154 name: prefix + ver.name + "-" + suite.name + "-server",
David Benjamin6fd297b2014-08-11 18:43:38 -04002155 config: Config{
David Benjamin48cae082014-10-27 01:06:24 -04002156 MinVersion: ver.version,
2157 MaxVersion: ver.version,
2158 CipherSuites: []uint16{suite.id},
2159 Certificates: []Certificate{cert},
2160 PreSharedKey: []byte(psk),
2161 PreSharedKeyIdentity: pskIdentity,
David Benjamin0407e762016-06-17 16:41:18 -04002162 Bugs: ProtocolBugs{
David Benjamin9acf0ca2016-06-25 00:01:28 -04002163 EnableAllCiphers: shouldServerFail,
2164 IgnorePeerCipherPreferences: shouldServerFail,
David Benjamin0407e762016-06-17 16:41:18 -04002165 },
David Benjamin6fd297b2014-08-11 18:43:38 -04002166 },
2167 certFile: certFile,
2168 keyFile: keyFile,
David Benjamin48cae082014-10-27 01:06:24 -04002169 flags: flags,
David Benjamin9deb1172016-07-13 17:13:49 -04002170 resumeSession: resumeSession,
David Benjamin0407e762016-06-17 16:41:18 -04002171 shouldFail: shouldServerFail,
2172 expectedError: expectedServerError,
2173 })
2174
2175 testCases = append(testCases, testCase{
2176 testType: clientTest,
2177 protocol: protocol,
2178 name: prefix + ver.name + "-" + suite.name + "-client",
2179 config: Config{
2180 MinVersion: ver.version,
2181 MaxVersion: ver.version,
2182 CipherSuites: []uint16{suite.id},
2183 Certificates: []Certificate{cert},
2184 PreSharedKey: []byte(psk),
2185 PreSharedKeyIdentity: pskIdentity,
2186 Bugs: ProtocolBugs{
David Benjamin9acf0ca2016-06-25 00:01:28 -04002187 EnableAllCiphers: shouldClientFail,
2188 IgnorePeerCipherPreferences: shouldClientFail,
David Benjamin0407e762016-06-17 16:41:18 -04002189 },
2190 },
2191 flags: flags,
David Benjamin9deb1172016-07-13 17:13:49 -04002192 resumeSession: resumeSession,
David Benjamin0407e762016-06-17 16:41:18 -04002193 shouldFail: shouldClientFail,
2194 expectedError: expectedClientError,
David Benjamin6fd297b2014-08-11 18:43:38 -04002195 })
David Benjamin2c99d282015-09-01 10:23:00 -04002196
Nick Harper1fd39d82016-06-14 18:14:35 -07002197 if !shouldClientFail {
2198 // Ensure the maximum record size is accepted.
2199 testCases = append(testCases, testCase{
2200 name: prefix + ver.name + "-" + suite.name + "-LargeRecord",
2201 config: Config{
2202 MinVersion: ver.version,
2203 MaxVersion: ver.version,
2204 CipherSuites: []uint16{suite.id},
2205 Certificates: []Certificate{cert},
2206 PreSharedKey: []byte(psk),
2207 PreSharedKeyIdentity: pskIdentity,
2208 },
2209 flags: flags,
2210 messageLen: maxPlaintext,
2211 })
2212 }
2213 }
David Benjamin2c99d282015-09-01 10:23:00 -04002214 }
Adam Langley95c29f32014-06-20 12:00:00 -07002215 }
Adam Langleya7997f12015-05-14 17:38:50 -07002216
2217 testCases = append(testCases, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002218 name: "NoSharedCipher",
2219 config: Config{
2220 // TODO(davidben): Add a TLS 1.3 version of this test.
2221 MaxVersion: VersionTLS12,
2222 CipherSuites: []uint16{},
2223 },
2224 shouldFail: true,
2225 expectedError: ":HANDSHAKE_FAILURE_ON_CLIENT_HELLO:",
2226 })
2227
2228 testCases = append(testCases, testCase{
2229 name: "UnsupportedCipherSuite",
2230 config: Config{
2231 MaxVersion: VersionTLS12,
2232 CipherSuites: []uint16{TLS_RSA_WITH_RC4_128_SHA},
2233 Bugs: ProtocolBugs{
2234 IgnorePeerCipherPreferences: true,
2235 },
2236 },
2237 flags: []string{"-cipher", "DEFAULT:!RC4"},
2238 shouldFail: true,
2239 expectedError: ":WRONG_CIPHER_RETURNED:",
2240 })
2241
2242 testCases = append(testCases, testCase{
Adam Langleya7997f12015-05-14 17:38:50 -07002243 name: "WeakDH",
2244 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07002245 MaxVersion: VersionTLS12,
Adam Langleya7997f12015-05-14 17:38:50 -07002246 CipherSuites: []uint16{TLS_DHE_RSA_WITH_AES_128_GCM_SHA256},
2247 Bugs: ProtocolBugs{
2248 // This is a 1023-bit prime number, generated
2249 // with:
2250 // openssl gendh 1023 | openssl asn1parse -i
2251 DHGroupPrime: bigFromHex("518E9B7930CE61C6E445C8360584E5FC78D9137C0FFDC880B495D5338ADF7689951A6821C17A76B3ACB8E0156AEA607B7EC406EBEDBB84D8376EB8FE8F8BA1433488BEE0C3EDDFD3A32DBB9481980A7AF6C96BFCF490A094CFFB2B8192C1BB5510B77B658436E27C2D4D023FE3718222AB0CA1273995B51F6D625A4944D0DD4B"),
2252 },
2253 },
2254 shouldFail: true,
David Benjamincd24a392015-11-11 13:23:05 -08002255 expectedError: ":BAD_DH_P_LENGTH:",
Adam Langleya7997f12015-05-14 17:38:50 -07002256 })
Adam Langleycef75832015-09-03 14:51:12 -07002257
David Benjamincd24a392015-11-11 13:23:05 -08002258 testCases = append(testCases, testCase{
2259 name: "SillyDH",
2260 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07002261 MaxVersion: VersionTLS12,
David Benjamincd24a392015-11-11 13:23:05 -08002262 CipherSuites: []uint16{TLS_DHE_RSA_WITH_AES_128_GCM_SHA256},
2263 Bugs: ProtocolBugs{
2264 // This is a 4097-bit prime number, generated
2265 // with:
2266 // openssl gendh 4097 | openssl asn1parse -i
2267 DHGroupPrime: bigFromHex("01D366FA64A47419B0CD4A45918E8D8C8430F674621956A9F52B0CA592BC104C6E38D60C58F2CA66792A2B7EBDC6F8FFE75AB7D6862C261F34E96A2AEEF53AB7C21365C2E8FB0582F71EB57B1C227C0E55AE859E9904A25EFECD7B435C4D4357BD840B03649D4A1F8037D89EA4E1967DBEEF1CC17A6111C48F12E9615FFF336D3F07064CB17C0B765A012C850B9E3AA7A6984B96D8C867DDC6D0F4AB52042572244796B7ECFF681CD3B3E2E29AAECA391A775BEE94E502FB15881B0F4AC60314EA947C0C82541C3D16FD8C0E09BB7F8F786582032859D9C13187CE6C0CB6F2D3EE6C3C9727C15F14B21D3CD2E02BDB9D119959B0E03DC9E5A91E2578762300B1517D2352FC1D0BB934A4C3E1B20CE9327DB102E89A6C64A8C3148EDFC5A94913933853442FA84451B31FD21E492F92DD5488E0D871AEBFE335A4B92431DEC69591548010E76A5B365D346786E9A2D3E589867D796AA5E25211201D757560D318A87DFB27F3E625BC373DB48BF94A63161C674C3D4265CB737418441B7650EABC209CF675A439BEB3E9D1AA1B79F67198A40CEFD1C89144F7D8BAF61D6AD36F466DA546B4174A0E0CAF5BD788C8243C7C2DDDCC3DB6FC89F12F17D19FBD9B0BC76FE92891CD6BA07BEA3B66EF12D0D85E788FD58675C1B0FBD16029DCC4D34E7A1A41471BDEDF78BF591A8B4E96D88BEC8EDC093E616292BFC096E69A916E8D624B"),
2268 },
2269 },
2270 shouldFail: true,
2271 expectedError: ":DH_P_TOO_LONG:",
2272 })
2273
Adam Langleyc4f25ce2015-11-26 16:39:08 -08002274 // This test ensures that Diffie-Hellman public values are padded with
2275 // zeros so that they're the same length as the prime. This is to avoid
2276 // hitting a bug in yaSSL.
2277 testCases = append(testCases, testCase{
2278 testType: serverTest,
2279 name: "DHPublicValuePadded",
2280 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07002281 MaxVersion: VersionTLS12,
Adam Langleyc4f25ce2015-11-26 16:39:08 -08002282 CipherSuites: []uint16{TLS_DHE_RSA_WITH_AES_128_GCM_SHA256},
2283 Bugs: ProtocolBugs{
2284 RequireDHPublicValueLen: (1025 + 7) / 8,
2285 },
2286 },
2287 flags: []string{"-use-sparse-dh-prime"},
2288 })
David Benjamincd24a392015-11-11 13:23:05 -08002289
David Benjamin241ae832016-01-15 03:04:54 -05002290 // The server must be tolerant to bogus ciphers.
2291 const bogusCipher = 0x1234
2292 testCases = append(testCases, testCase{
2293 testType: serverTest,
2294 name: "UnknownCipher",
2295 config: Config{
2296 CipherSuites: []uint16{bogusCipher, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
2297 },
2298 })
2299
Adam Langleycef75832015-09-03 14:51:12 -07002300 // versionSpecificCiphersTest specifies a test for the TLS 1.0 and TLS
2301 // 1.1 specific cipher suite settings. A server is setup with the given
2302 // cipher lists and then a connection is made for each member of
2303 // expectations. The cipher suite that the server selects must match
2304 // the specified one.
2305 var versionSpecificCiphersTest = []struct {
2306 ciphersDefault, ciphersTLS10, ciphersTLS11 string
2307 // expectations is a map from TLS version to cipher suite id.
2308 expectations map[uint16]uint16
2309 }{
2310 {
2311 // Test that the null case (where no version-specific ciphers are set)
2312 // works as expected.
2313 "RC4-SHA:AES128-SHA", // default ciphers
2314 "", // no ciphers specifically for TLS ≥ 1.0
2315 "", // no ciphers specifically for TLS ≥ 1.1
2316 map[uint16]uint16{
2317 VersionSSL30: TLS_RSA_WITH_RC4_128_SHA,
2318 VersionTLS10: TLS_RSA_WITH_RC4_128_SHA,
2319 VersionTLS11: TLS_RSA_WITH_RC4_128_SHA,
2320 VersionTLS12: TLS_RSA_WITH_RC4_128_SHA,
2321 },
2322 },
2323 {
2324 // With ciphers_tls10 set, TLS 1.0, 1.1 and 1.2 should get a different
2325 // cipher.
2326 "RC4-SHA:AES128-SHA", // default
2327 "AES128-SHA", // these ciphers for TLS ≥ 1.0
2328 "", // no ciphers specifically for TLS ≥ 1.1
2329 map[uint16]uint16{
2330 VersionSSL30: TLS_RSA_WITH_RC4_128_SHA,
2331 VersionTLS10: TLS_RSA_WITH_AES_128_CBC_SHA,
2332 VersionTLS11: TLS_RSA_WITH_AES_128_CBC_SHA,
2333 VersionTLS12: TLS_RSA_WITH_AES_128_CBC_SHA,
2334 },
2335 },
2336 {
2337 // With ciphers_tls11 set, TLS 1.1 and 1.2 should get a different
2338 // cipher.
2339 "RC4-SHA:AES128-SHA", // default
2340 "", // no ciphers specifically for TLS ≥ 1.0
2341 "AES128-SHA", // these ciphers for TLS ≥ 1.1
2342 map[uint16]uint16{
2343 VersionSSL30: TLS_RSA_WITH_RC4_128_SHA,
2344 VersionTLS10: TLS_RSA_WITH_RC4_128_SHA,
2345 VersionTLS11: TLS_RSA_WITH_AES_128_CBC_SHA,
2346 VersionTLS12: TLS_RSA_WITH_AES_128_CBC_SHA,
2347 },
2348 },
2349 {
2350 // With both ciphers_tls10 and ciphers_tls11 set, ciphers_tls11 should
2351 // mask ciphers_tls10 for TLS 1.1 and 1.2.
2352 "RC4-SHA:AES128-SHA", // default
2353 "AES128-SHA", // these ciphers for TLS ≥ 1.0
2354 "AES256-SHA", // these ciphers for TLS ≥ 1.1
2355 map[uint16]uint16{
2356 VersionSSL30: TLS_RSA_WITH_RC4_128_SHA,
2357 VersionTLS10: TLS_RSA_WITH_AES_128_CBC_SHA,
2358 VersionTLS11: TLS_RSA_WITH_AES_256_CBC_SHA,
2359 VersionTLS12: TLS_RSA_WITH_AES_256_CBC_SHA,
2360 },
2361 },
2362 }
2363
2364 for i, test := range versionSpecificCiphersTest {
2365 for version, expectedCipherSuite := range test.expectations {
2366 flags := []string{"-cipher", test.ciphersDefault}
2367 if len(test.ciphersTLS10) > 0 {
2368 flags = append(flags, "-cipher-tls10", test.ciphersTLS10)
2369 }
2370 if len(test.ciphersTLS11) > 0 {
2371 flags = append(flags, "-cipher-tls11", test.ciphersTLS11)
2372 }
2373
2374 testCases = append(testCases, testCase{
2375 testType: serverTest,
2376 name: fmt.Sprintf("VersionSpecificCiphersTest-%d-%x", i, version),
2377 config: Config{
2378 MaxVersion: version,
2379 MinVersion: version,
2380 CipherSuites: []uint16{TLS_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA},
2381 },
2382 flags: flags,
2383 expectedCipher: expectedCipherSuite,
2384 })
2385 }
2386 }
Adam Langley95c29f32014-06-20 12:00:00 -07002387}
2388
2389func addBadECDSASignatureTests() {
2390 for badR := BadValue(1); badR < NumBadValues; badR++ {
2391 for badS := BadValue(1); badS < NumBadValues; badS++ {
David Benjamin025b3d32014-07-01 19:53:04 -04002392 testCases = append(testCases, testCase{
Adam Langley95c29f32014-06-20 12:00:00 -07002393 name: fmt.Sprintf("BadECDSA-%d-%d", badR, badS),
2394 config: Config{
2395 CipherSuites: []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
David Benjamin33863262016-07-08 17:20:12 -07002396 Certificates: []Certificate{ecdsaP256Certificate},
Adam Langley95c29f32014-06-20 12:00:00 -07002397 Bugs: ProtocolBugs{
2398 BadECDSAR: badR,
2399 BadECDSAS: badS,
2400 },
2401 },
2402 shouldFail: true,
David Benjamin11d50f92016-03-10 15:55:45 -05002403 expectedError: ":BAD_SIGNATURE:",
Adam Langley95c29f32014-06-20 12:00:00 -07002404 })
2405 }
2406 }
2407}
2408
Adam Langley80842bd2014-06-20 12:00:00 -07002409func addCBCPaddingTests() {
David Benjamin025b3d32014-07-01 19:53:04 -04002410 testCases = append(testCases, testCase{
Adam Langley80842bd2014-06-20 12:00:00 -07002411 name: "MaxCBCPadding",
2412 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07002413 MaxVersion: VersionTLS12,
Adam Langley80842bd2014-06-20 12:00:00 -07002414 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA},
2415 Bugs: ProtocolBugs{
2416 MaxPadding: true,
2417 },
2418 },
2419 messageLen: 12, // 20 bytes of SHA-1 + 12 == 0 % block size
2420 })
David Benjamin025b3d32014-07-01 19:53:04 -04002421 testCases = append(testCases, testCase{
Adam Langley80842bd2014-06-20 12:00:00 -07002422 name: "BadCBCPadding",
2423 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07002424 MaxVersion: VersionTLS12,
Adam Langley80842bd2014-06-20 12:00:00 -07002425 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA},
2426 Bugs: ProtocolBugs{
2427 PaddingFirstByteBad: true,
2428 },
2429 },
2430 shouldFail: true,
David Benjamin11d50f92016-03-10 15:55:45 -05002431 expectedError: ":DECRYPTION_FAILED_OR_BAD_RECORD_MAC:",
Adam Langley80842bd2014-06-20 12:00:00 -07002432 })
2433 // OpenSSL previously had an issue where the first byte of padding in
2434 // 255 bytes of padding wasn't checked.
David Benjamin025b3d32014-07-01 19:53:04 -04002435 testCases = append(testCases, testCase{
Adam Langley80842bd2014-06-20 12:00:00 -07002436 name: "BadCBCPadding255",
2437 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07002438 MaxVersion: VersionTLS12,
Adam Langley80842bd2014-06-20 12:00:00 -07002439 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA},
2440 Bugs: ProtocolBugs{
2441 MaxPadding: true,
2442 PaddingFirstByteBadIf255: true,
2443 },
2444 },
2445 messageLen: 12, // 20 bytes of SHA-1 + 12 == 0 % block size
2446 shouldFail: true,
David Benjamin11d50f92016-03-10 15:55:45 -05002447 expectedError: ":DECRYPTION_FAILED_OR_BAD_RECORD_MAC:",
Adam Langley80842bd2014-06-20 12:00:00 -07002448 })
2449}
2450
Kenny Root7fdeaf12014-08-05 15:23:37 -07002451func addCBCSplittingTests() {
2452 testCases = append(testCases, testCase{
2453 name: "CBCRecordSplitting",
2454 config: Config{
2455 MaxVersion: VersionTLS10,
2456 MinVersion: VersionTLS10,
2457 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA},
2458 },
David Benjaminac8302a2015-09-01 17:18:15 -04002459 messageLen: -1, // read until EOF
2460 resumeSession: true,
Kenny Root7fdeaf12014-08-05 15:23:37 -07002461 flags: []string{
2462 "-async",
2463 "-write-different-record-sizes",
2464 "-cbc-record-splitting",
2465 },
David Benjamina8e3e0e2014-08-06 22:11:10 -04002466 })
2467 testCases = append(testCases, testCase{
Kenny Root7fdeaf12014-08-05 15:23:37 -07002468 name: "CBCRecordSplittingPartialWrite",
2469 config: Config{
2470 MaxVersion: VersionTLS10,
2471 MinVersion: VersionTLS10,
2472 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA},
2473 },
2474 messageLen: -1, // read until EOF
2475 flags: []string{
2476 "-async",
2477 "-write-different-record-sizes",
2478 "-cbc-record-splitting",
2479 "-partial-write",
2480 },
2481 })
2482}
2483
David Benjamin636293b2014-07-08 17:59:18 -04002484func addClientAuthTests() {
David Benjamin407a10c2014-07-16 12:58:59 -04002485 // Add a dummy cert pool to stress certificate authority parsing.
2486 // TODO(davidben): Add tests that those values parse out correctly.
2487 certPool := x509.NewCertPool()
2488 cert, err := x509.ParseCertificate(rsaCertificate.Certificate[0])
2489 if err != nil {
2490 panic(err)
2491 }
2492 certPool.AddCert(cert)
2493
David Benjamin636293b2014-07-08 17:59:18 -04002494 for _, ver := range tlsVersions {
David Benjamin636293b2014-07-08 17:59:18 -04002495 testCases = append(testCases, testCase{
2496 testType: clientTest,
David Benjamin67666e72014-07-12 15:47:52 -04002497 name: ver.name + "-Client-ClientAuth-RSA",
David Benjamin636293b2014-07-08 17:59:18 -04002498 config: Config{
David Benjamine098ec22014-08-27 23:13:20 -04002499 MinVersion: ver.version,
2500 MaxVersion: ver.version,
2501 ClientAuth: RequireAnyClientCert,
2502 ClientCAs: certPool,
David Benjamin636293b2014-07-08 17:59:18 -04002503 },
2504 flags: []string{
Adam Langley7c803a62015-06-15 15:35:05 -07002505 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
2506 "-key-file", path.Join(*resourceDir, rsaKeyFile),
David Benjamin636293b2014-07-08 17:59:18 -04002507 },
2508 })
2509 testCases = append(testCases, testCase{
David Benjamin67666e72014-07-12 15:47:52 -04002510 testType: serverTest,
2511 name: ver.name + "-Server-ClientAuth-RSA",
2512 config: Config{
David Benjamine098ec22014-08-27 23:13:20 -04002513 MinVersion: ver.version,
2514 MaxVersion: ver.version,
David Benjamin67666e72014-07-12 15:47:52 -04002515 Certificates: []Certificate{rsaCertificate},
2516 },
2517 flags: []string{"-require-any-client-certificate"},
2518 })
David Benjamine098ec22014-08-27 23:13:20 -04002519 if ver.version != VersionSSL30 {
2520 testCases = append(testCases, testCase{
2521 testType: serverTest,
2522 name: ver.name + "-Server-ClientAuth-ECDSA",
2523 config: Config{
2524 MinVersion: ver.version,
2525 MaxVersion: ver.version,
David Benjamin33863262016-07-08 17:20:12 -07002526 Certificates: []Certificate{ecdsaP256Certificate},
David Benjamine098ec22014-08-27 23:13:20 -04002527 },
2528 flags: []string{"-require-any-client-certificate"},
2529 })
2530 testCases = append(testCases, testCase{
2531 testType: clientTest,
2532 name: ver.name + "-Client-ClientAuth-ECDSA",
2533 config: Config{
2534 MinVersion: ver.version,
2535 MaxVersion: ver.version,
2536 ClientAuth: RequireAnyClientCert,
2537 ClientCAs: certPool,
2538 },
2539 flags: []string{
David Benjamin33863262016-07-08 17:20:12 -07002540 "-cert-file", path.Join(*resourceDir, ecdsaP256CertificateFile),
2541 "-key-file", path.Join(*resourceDir, ecdsaP256KeyFile),
David Benjamine098ec22014-08-27 23:13:20 -04002542 },
2543 })
2544 }
David Benjamin636293b2014-07-08 17:59:18 -04002545 }
David Benjamin0b7ca7d2016-03-10 15:44:22 -05002546
Nick Harper1fd39d82016-06-14 18:14:35 -07002547 // TODO(davidben): These tests will need TLS 1.3 versions when the
2548 // handshake is separate.
2549
David Benjamin0b7ca7d2016-03-10 15:44:22 -05002550 testCases = append(testCases, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002551 name: "NoClientCertificate",
2552 config: Config{
2553 MaxVersion: VersionTLS12,
2554 ClientAuth: RequireAnyClientCert,
2555 },
2556 shouldFail: true,
2557 expectedLocalError: "client didn't provide a certificate",
2558 })
2559
2560 testCases = append(testCases, testCase{
Nick Harper1fd39d82016-06-14 18:14:35 -07002561 testType: serverTest,
2562 name: "RequireAnyClientCertificate",
2563 config: Config{
2564 MaxVersion: VersionTLS12,
2565 },
David Benjamin0b7ca7d2016-03-10 15:44:22 -05002566 flags: []string{"-require-any-client-certificate"},
2567 shouldFail: true,
2568 expectedError: ":PEER_DID_NOT_RETURN_A_CERTIFICATE:",
2569 })
2570
2571 testCases = append(testCases, testCase{
2572 testType: serverTest,
David Benjamindf28c3a2016-03-10 16:11:51 -05002573 name: "RequireAnyClientCertificate-SSL3",
2574 config: Config{
2575 MaxVersion: VersionSSL30,
2576 },
2577 flags: []string{"-require-any-client-certificate"},
2578 shouldFail: true,
2579 expectedError: ":PEER_DID_NOT_RETURN_A_CERTIFICATE:",
2580 })
2581
2582 testCases = append(testCases, testCase{
2583 testType: serverTest,
David Benjamin0b7ca7d2016-03-10 15:44:22 -05002584 name: "SkipClientCertificate",
2585 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07002586 MaxVersion: VersionTLS12,
David Benjamin0b7ca7d2016-03-10 15:44:22 -05002587 Bugs: ProtocolBugs{
2588 SkipClientCertificate: true,
2589 },
2590 },
2591 // Setting SSL_VERIFY_PEER allows anonymous clients.
2592 flags: []string{"-verify-peer"},
2593 shouldFail: true,
David Benjamindf28c3a2016-03-10 16:11:51 -05002594 expectedError: ":UNEXPECTED_MESSAGE:",
David Benjamin0b7ca7d2016-03-10 15:44:22 -05002595 })
David Benjaminc032dfa2016-05-12 14:54:57 -04002596
2597 // Client auth is only legal in certificate-based ciphers.
2598 testCases = append(testCases, testCase{
2599 testType: clientTest,
2600 name: "ClientAuth-PSK",
2601 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07002602 MaxVersion: VersionTLS12,
David Benjaminc032dfa2016-05-12 14:54:57 -04002603 CipherSuites: []uint16{TLS_PSK_WITH_AES_128_CBC_SHA},
2604 PreSharedKey: []byte("secret"),
2605 ClientAuth: RequireAnyClientCert,
2606 },
2607 flags: []string{
2608 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
2609 "-key-file", path.Join(*resourceDir, rsaKeyFile),
2610 "-psk", "secret",
2611 },
2612 shouldFail: true,
2613 expectedError: ":UNEXPECTED_MESSAGE:",
2614 })
2615 testCases = append(testCases, testCase{
2616 testType: clientTest,
2617 name: "ClientAuth-ECDHE_PSK",
2618 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07002619 MaxVersion: VersionTLS12,
David Benjaminc032dfa2016-05-12 14:54:57 -04002620 CipherSuites: []uint16{TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA},
2621 PreSharedKey: []byte("secret"),
2622 ClientAuth: RequireAnyClientCert,
2623 },
2624 flags: []string{
2625 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
2626 "-key-file", path.Join(*resourceDir, rsaKeyFile),
2627 "-psk", "secret",
2628 },
2629 shouldFail: true,
2630 expectedError: ":UNEXPECTED_MESSAGE:",
2631 })
David Benjamin2f8935d2016-07-13 19:47:39 -04002632
2633 // Regression test for a bug where the client CA list, if explicitly
2634 // set to NULL, was mis-encoded.
2635 testCases = append(testCases, testCase{
2636 testType: serverTest,
2637 name: "Null-Client-CA-List",
2638 config: Config{
2639 MaxVersion: VersionTLS12,
2640 Certificates: []Certificate{rsaCertificate},
2641 },
2642 flags: []string{
2643 "-require-any-client-certificate",
2644 "-use-null-client-ca-list",
2645 },
2646 })
David Benjamin636293b2014-07-08 17:59:18 -04002647}
2648
Adam Langley75712922014-10-10 16:23:43 -07002649func addExtendedMasterSecretTests() {
2650 const expectEMSFlag = "-expect-extended-master-secret"
2651
2652 for _, with := range []bool{false, true} {
2653 prefix := "No"
2654 var flags []string
2655 if with {
2656 prefix = ""
2657 flags = []string{expectEMSFlag}
2658 }
2659
2660 for _, isClient := range []bool{false, true} {
2661 suffix := "-Server"
2662 testType := serverTest
2663 if isClient {
2664 suffix = "-Client"
2665 testType = clientTest
2666 }
2667
David Benjamin4c3ddf72016-06-29 18:13:53 -04002668 // TODO(davidben): Once the new TLS 1.3 handshake is in,
2669 // test that the extension is irrelevant, but the API
2670 // acts as if it is enabled.
Adam Langley75712922014-10-10 16:23:43 -07002671 for _, ver := range tlsVersions {
2672 test := testCase{
2673 testType: testType,
2674 name: prefix + "ExtendedMasterSecret-" + ver.name + suffix,
2675 config: Config{
2676 MinVersion: ver.version,
2677 MaxVersion: ver.version,
2678 Bugs: ProtocolBugs{
2679 NoExtendedMasterSecret: !with,
2680 RequireExtendedMasterSecret: with,
2681 },
2682 },
David Benjamin48cae082014-10-27 01:06:24 -04002683 flags: flags,
2684 shouldFail: ver.version == VersionSSL30 && with,
Adam Langley75712922014-10-10 16:23:43 -07002685 }
2686 if test.shouldFail {
2687 test.expectedLocalError = "extended master secret required but not supported by peer"
2688 }
2689 testCases = append(testCases, test)
2690 }
2691 }
2692 }
2693
Adam Langleyba5934b2015-06-02 10:50:35 -07002694 for _, isClient := range []bool{false, true} {
2695 for _, supportedInFirstConnection := range []bool{false, true} {
2696 for _, supportedInResumeConnection := range []bool{false, true} {
2697 boolToWord := func(b bool) string {
2698 if b {
2699 return "Yes"
2700 }
2701 return "No"
2702 }
2703 suffix := boolToWord(supportedInFirstConnection) + "To" + boolToWord(supportedInResumeConnection) + "-"
2704 if isClient {
2705 suffix += "Client"
2706 } else {
2707 suffix += "Server"
2708 }
2709
2710 supportedConfig := Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002711 MaxVersion: VersionTLS12,
Adam Langleyba5934b2015-06-02 10:50:35 -07002712 Bugs: ProtocolBugs{
2713 RequireExtendedMasterSecret: true,
2714 },
2715 }
2716
2717 noSupportConfig := Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002718 MaxVersion: VersionTLS12,
Adam Langleyba5934b2015-06-02 10:50:35 -07002719 Bugs: ProtocolBugs{
2720 NoExtendedMasterSecret: true,
2721 },
2722 }
2723
2724 test := testCase{
2725 name: "ExtendedMasterSecret-" + suffix,
2726 resumeSession: true,
2727 }
2728
2729 if !isClient {
2730 test.testType = serverTest
2731 }
2732
2733 if supportedInFirstConnection {
2734 test.config = supportedConfig
2735 } else {
2736 test.config = noSupportConfig
2737 }
2738
2739 if supportedInResumeConnection {
2740 test.resumeConfig = &supportedConfig
2741 } else {
2742 test.resumeConfig = &noSupportConfig
2743 }
2744
2745 switch suffix {
2746 case "YesToYes-Client", "YesToYes-Server":
2747 // When a session is resumed, it should
2748 // still be aware that its master
2749 // secret was generated via EMS and
2750 // thus it's safe to use tls-unique.
2751 test.flags = []string{expectEMSFlag}
2752 case "NoToYes-Server":
2753 // If an original connection did not
2754 // contain EMS, but a resumption
2755 // handshake does, then a server should
2756 // not resume the session.
2757 test.expectResumeRejected = true
2758 case "YesToNo-Server":
2759 // Resuming an EMS session without the
2760 // EMS extension should cause the
2761 // server to abort the connection.
2762 test.shouldFail = true
2763 test.expectedError = ":RESUMED_EMS_SESSION_WITHOUT_EMS_EXTENSION:"
2764 case "NoToYes-Client":
2765 // A client should abort a connection
2766 // where the server resumed a non-EMS
2767 // session but echoed the EMS
2768 // extension.
2769 test.shouldFail = true
2770 test.expectedError = ":RESUMED_NON_EMS_SESSION_WITH_EMS_EXTENSION:"
2771 case "YesToNo-Client":
2772 // A client should abort a connection
2773 // where the server didn't echo EMS
2774 // when the session used it.
2775 test.shouldFail = true
2776 test.expectedError = ":RESUMED_EMS_SESSION_WITHOUT_EMS_EXTENSION:"
2777 }
2778
2779 testCases = append(testCases, test)
2780 }
2781 }
2782 }
Adam Langley75712922014-10-10 16:23:43 -07002783}
2784
David Benjamin582ba042016-07-07 12:33:25 -07002785type stateMachineTestConfig struct {
2786 protocol protocol
2787 async bool
2788 splitHandshake, packHandshakeFlight bool
2789}
2790
David Benjamin43ec06f2014-08-05 02:28:57 -04002791// Adds tests that try to cover the range of the handshake state machine, under
2792// various conditions. Some of these are redundant with other tests, but they
2793// only cover the synchronous case.
David Benjamin582ba042016-07-07 12:33:25 -07002794func addAllStateMachineCoverageTests() {
2795 for _, async := range []bool{false, true} {
2796 for _, protocol := range []protocol{tls, dtls} {
2797 addStateMachineCoverageTests(stateMachineTestConfig{
2798 protocol: protocol,
2799 async: async,
2800 })
2801 addStateMachineCoverageTests(stateMachineTestConfig{
2802 protocol: protocol,
2803 async: async,
2804 splitHandshake: true,
2805 })
2806 if protocol == tls {
2807 addStateMachineCoverageTests(stateMachineTestConfig{
2808 protocol: protocol,
2809 async: async,
2810 packHandshakeFlight: true,
2811 })
2812 }
2813 }
2814 }
2815}
2816
2817func addStateMachineCoverageTests(config stateMachineTestConfig) {
David Benjamin760b1dd2015-05-15 23:33:48 -04002818 var tests []testCase
2819
2820 // Basic handshake, with resumption. Client and server,
2821 // session ID and session ticket.
David Benjamin4c3ddf72016-06-29 18:13:53 -04002822 //
2823 // TODO(davidben): Add TLS 1.3 tests for all of its different handshake
2824 // shapes.
David Benjamin760b1dd2015-05-15 23:33:48 -04002825 tests = append(tests, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002826 name: "Basic-Client",
2827 config: Config{
2828 MaxVersion: VersionTLS12,
2829 },
David Benjamin760b1dd2015-05-15 23:33:48 -04002830 resumeSession: true,
David Benjaminef1b0092015-11-21 14:05:44 -05002831 // Ensure session tickets are used, not session IDs.
2832 noSessionCache: true,
David Benjamin760b1dd2015-05-15 23:33:48 -04002833 })
2834 tests = append(tests, testCase{
2835 name: "Basic-Client-RenewTicket",
2836 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002837 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04002838 Bugs: ProtocolBugs{
2839 RenewTicketOnResume: true,
2840 },
2841 },
David Benjaminba4594a2015-06-18 18:36:15 -04002842 flags: []string{"-expect-ticket-renewal"},
David Benjamin760b1dd2015-05-15 23:33:48 -04002843 resumeSession: true,
2844 })
2845 tests = append(tests, testCase{
2846 name: "Basic-Client-NoTicket",
2847 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002848 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04002849 SessionTicketsDisabled: true,
2850 },
2851 resumeSession: true,
2852 })
2853 tests = append(tests, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002854 name: "Basic-Client-Implicit",
2855 config: Config{
2856 MaxVersion: VersionTLS12,
2857 },
David Benjamin760b1dd2015-05-15 23:33:48 -04002858 flags: []string{"-implicit-handshake"},
2859 resumeSession: true,
2860 })
2861 tests = append(tests, testCase{
David Benjaminef1b0092015-11-21 14:05:44 -05002862 testType: serverTest,
2863 name: "Basic-Server",
2864 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002865 MaxVersion: VersionTLS12,
David Benjaminef1b0092015-11-21 14:05:44 -05002866 Bugs: ProtocolBugs{
2867 RequireSessionTickets: true,
2868 },
2869 },
David Benjamin760b1dd2015-05-15 23:33:48 -04002870 resumeSession: true,
2871 })
2872 tests = append(tests, testCase{
2873 testType: serverTest,
2874 name: "Basic-Server-NoTickets",
2875 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002876 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04002877 SessionTicketsDisabled: true,
2878 },
2879 resumeSession: true,
2880 })
2881 tests = append(tests, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002882 testType: serverTest,
2883 name: "Basic-Server-Implicit",
2884 config: Config{
2885 MaxVersion: VersionTLS12,
2886 },
David Benjamin760b1dd2015-05-15 23:33:48 -04002887 flags: []string{"-implicit-handshake"},
2888 resumeSession: true,
2889 })
2890 tests = append(tests, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002891 testType: serverTest,
2892 name: "Basic-Server-EarlyCallback",
2893 config: Config{
2894 MaxVersion: VersionTLS12,
2895 },
David Benjamin760b1dd2015-05-15 23:33:48 -04002896 flags: []string{"-use-early-callback"},
2897 resumeSession: true,
2898 })
2899
2900 // TLS client auth.
David Benjamin4c3ddf72016-06-29 18:13:53 -04002901 //
2902 // TODO(davidben): Add TLS 1.3 client auth tests.
David Benjamin760b1dd2015-05-15 23:33:48 -04002903 tests = append(tests, testCase{
2904 testType: clientTest,
David Benjamin0b7ca7d2016-03-10 15:44:22 -05002905 name: "ClientAuth-NoCertificate-Client",
David Benjaminacb6dcc2016-03-10 09:15:01 -05002906 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002907 MaxVersion: VersionTLS12,
David Benjaminacb6dcc2016-03-10 09:15:01 -05002908 ClientAuth: RequestClientCert,
2909 },
2910 })
2911 tests = append(tests, testCase{
David Benjamin0b7ca7d2016-03-10 15:44:22 -05002912 testType: serverTest,
2913 name: "ClientAuth-NoCertificate-Server",
David Benjamin4c3ddf72016-06-29 18:13:53 -04002914 config: Config{
2915 MaxVersion: VersionTLS12,
2916 },
David Benjamin0b7ca7d2016-03-10 15:44:22 -05002917 // Setting SSL_VERIFY_PEER allows anonymous clients.
2918 flags: []string{"-verify-peer"},
2919 })
David Benjamin582ba042016-07-07 12:33:25 -07002920 if config.protocol == tls {
David Benjamin0b7ca7d2016-03-10 15:44:22 -05002921 tests = append(tests, testCase{
2922 testType: clientTest,
2923 name: "ClientAuth-NoCertificate-Client-SSL3",
2924 config: Config{
2925 MaxVersion: VersionSSL30,
2926 ClientAuth: RequestClientCert,
2927 },
2928 })
2929 tests = append(tests, testCase{
2930 testType: serverTest,
2931 name: "ClientAuth-NoCertificate-Server-SSL3",
2932 config: Config{
2933 MaxVersion: VersionSSL30,
2934 },
2935 // Setting SSL_VERIFY_PEER allows anonymous clients.
2936 flags: []string{"-verify-peer"},
2937 })
2938 }
2939 tests = append(tests, testCase{
David Benjaminacb6dcc2016-03-10 09:15:01 -05002940 testType: clientTest,
nagendra modadugu3398dbf2015-08-07 14:07:52 -07002941 name: "ClientAuth-RSA-Client",
David Benjamin760b1dd2015-05-15 23:33:48 -04002942 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002943 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04002944 ClientAuth: RequireAnyClientCert,
2945 },
2946 flags: []string{
Adam Langley7c803a62015-06-15 15:35:05 -07002947 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
2948 "-key-file", path.Join(*resourceDir, rsaKeyFile),
David Benjamin760b1dd2015-05-15 23:33:48 -04002949 },
2950 })
nagendra modadugu3398dbf2015-08-07 14:07:52 -07002951 tests = append(tests, testCase{
2952 testType: clientTest,
2953 name: "ClientAuth-ECDSA-Client",
2954 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002955 MaxVersion: VersionTLS12,
nagendra modadugu3398dbf2015-08-07 14:07:52 -07002956 ClientAuth: RequireAnyClientCert,
2957 },
2958 flags: []string{
David Benjamin33863262016-07-08 17:20:12 -07002959 "-cert-file", path.Join(*resourceDir, ecdsaP256CertificateFile),
2960 "-key-file", path.Join(*resourceDir, ecdsaP256KeyFile),
nagendra modadugu3398dbf2015-08-07 14:07:52 -07002961 },
2962 })
David Benjaminacb6dcc2016-03-10 09:15:01 -05002963 tests = append(tests, testCase{
2964 testType: clientTest,
David Benjamin4c3ddf72016-06-29 18:13:53 -04002965 name: "ClientAuth-NoCertificate-OldCallback",
2966 config: Config{
2967 MaxVersion: VersionTLS12,
2968 ClientAuth: RequestClientCert,
2969 },
2970 flags: []string{"-use-old-client-cert-callback"},
2971 })
2972 tests = append(tests, testCase{
2973 testType: clientTest,
David Benjaminacb6dcc2016-03-10 09:15:01 -05002974 name: "ClientAuth-OldCallback",
2975 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002976 MaxVersion: VersionTLS12,
David Benjaminacb6dcc2016-03-10 09:15:01 -05002977 ClientAuth: RequireAnyClientCert,
2978 },
2979 flags: []string{
2980 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
2981 "-key-file", path.Join(*resourceDir, rsaKeyFile),
2982 "-use-old-client-cert-callback",
2983 },
2984 })
David Benjamin760b1dd2015-05-15 23:33:48 -04002985 tests = append(tests, testCase{
2986 testType: serverTest,
2987 name: "ClientAuth-Server",
2988 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04002989 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04002990 Certificates: []Certificate{rsaCertificate},
2991 },
2992 flags: []string{"-require-any-client-certificate"},
2993 })
2994
David Benjamin4c3ddf72016-06-29 18:13:53 -04002995 // Test each key exchange on the server side for async keys.
2996 //
2997 // TODO(davidben): Add TLS 1.3 versions of these.
2998 tests = append(tests, testCase{
2999 testType: serverTest,
3000 name: "Basic-Server-RSA",
3001 config: Config{
3002 MaxVersion: VersionTLS12,
3003 CipherSuites: []uint16{TLS_RSA_WITH_AES_128_GCM_SHA256},
3004 },
3005 flags: []string{
3006 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
3007 "-key-file", path.Join(*resourceDir, rsaKeyFile),
3008 },
3009 })
3010 tests = append(tests, testCase{
3011 testType: serverTest,
3012 name: "Basic-Server-ECDHE-RSA",
3013 config: Config{
3014 MaxVersion: VersionTLS12,
3015 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
3016 },
3017 flags: []string{
3018 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
3019 "-key-file", path.Join(*resourceDir, rsaKeyFile),
3020 },
3021 })
3022 tests = append(tests, testCase{
3023 testType: serverTest,
3024 name: "Basic-Server-ECDHE-ECDSA",
3025 config: Config{
3026 MaxVersion: VersionTLS12,
3027 CipherSuites: []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
3028 },
3029 flags: []string{
David Benjamin33863262016-07-08 17:20:12 -07003030 "-cert-file", path.Join(*resourceDir, ecdsaP256CertificateFile),
3031 "-key-file", path.Join(*resourceDir, ecdsaP256KeyFile),
David Benjamin4c3ddf72016-06-29 18:13:53 -04003032 },
3033 })
3034
David Benjamin760b1dd2015-05-15 23:33:48 -04003035 // No session ticket support; server doesn't send NewSessionTicket.
3036 tests = append(tests, testCase{
3037 name: "SessionTicketsDisabled-Client",
3038 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04003039 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04003040 SessionTicketsDisabled: true,
3041 },
3042 })
3043 tests = append(tests, testCase{
3044 testType: serverTest,
3045 name: "SessionTicketsDisabled-Server",
3046 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04003047 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04003048 SessionTicketsDisabled: true,
3049 },
3050 })
3051
3052 // Skip ServerKeyExchange in PSK key exchange if there's no
3053 // identity hint.
3054 tests = append(tests, testCase{
3055 name: "EmptyPSKHint-Client",
3056 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07003057 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04003058 CipherSuites: []uint16{TLS_PSK_WITH_AES_128_CBC_SHA},
3059 PreSharedKey: []byte("secret"),
3060 },
3061 flags: []string{"-psk", "secret"},
3062 })
3063 tests = append(tests, testCase{
3064 testType: serverTest,
3065 name: "EmptyPSKHint-Server",
3066 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07003067 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04003068 CipherSuites: []uint16{TLS_PSK_WITH_AES_128_CBC_SHA},
3069 PreSharedKey: []byte("secret"),
3070 },
3071 flags: []string{"-psk", "secret"},
3072 })
3073
David Benjamin4c3ddf72016-06-29 18:13:53 -04003074 // OCSP stapling tests.
3075 //
3076 // TODO(davidben): Test the TLS 1.3 version of OCSP stapling.
Paul Lietaraeeff2c2015-08-12 11:47:11 +01003077 tests = append(tests, testCase{
3078 testType: clientTest,
3079 name: "OCSPStapling-Client",
David Benjamin4c3ddf72016-06-29 18:13:53 -04003080 config: Config{
3081 MaxVersion: VersionTLS12,
3082 },
Paul Lietaraeeff2c2015-08-12 11:47:11 +01003083 flags: []string{
3084 "-enable-ocsp-stapling",
3085 "-expect-ocsp-response",
3086 base64.StdEncoding.EncodeToString(testOCSPResponse),
Paul Lietar8f1c2682015-08-18 12:21:54 +01003087 "-verify-peer",
Paul Lietaraeeff2c2015-08-12 11:47:11 +01003088 },
Paul Lietar62be8ac2015-09-16 10:03:30 +01003089 resumeSession: true,
Paul Lietaraeeff2c2015-08-12 11:47:11 +01003090 })
Paul Lietaraeeff2c2015-08-12 11:47:11 +01003091 tests = append(tests, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04003092 testType: serverTest,
3093 name: "OCSPStapling-Server",
3094 config: Config{
3095 MaxVersion: VersionTLS12,
3096 },
Paul Lietaraeeff2c2015-08-12 11:47:11 +01003097 expectedOCSPResponse: testOCSPResponse,
3098 flags: []string{
3099 "-ocsp-response",
3100 base64.StdEncoding.EncodeToString(testOCSPResponse),
3101 },
Paul Lietar62be8ac2015-09-16 10:03:30 +01003102 resumeSession: true,
Paul Lietaraeeff2c2015-08-12 11:47:11 +01003103 })
3104
David Benjamin4c3ddf72016-06-29 18:13:53 -04003105 // Certificate verification tests.
3106 //
3107 // TODO(davidben): Test the TLS 1.3 version.
Paul Lietar8f1c2682015-08-18 12:21:54 +01003108 tests = append(tests, testCase{
3109 testType: clientTest,
3110 name: "CertificateVerificationSucceed",
David Benjamin4c3ddf72016-06-29 18:13:53 -04003111 config: Config{
3112 MaxVersion: VersionTLS12,
3113 },
Paul Lietar8f1c2682015-08-18 12:21:54 +01003114 flags: []string{
3115 "-verify-peer",
3116 },
3117 })
Paul Lietar8f1c2682015-08-18 12:21:54 +01003118 tests = append(tests, testCase{
3119 testType: clientTest,
3120 name: "CertificateVerificationFail",
David Benjamin4c3ddf72016-06-29 18:13:53 -04003121 config: Config{
3122 MaxVersion: VersionTLS12,
3123 },
Paul Lietar8f1c2682015-08-18 12:21:54 +01003124 flags: []string{
3125 "-verify-fail",
3126 "-verify-peer",
3127 },
3128 shouldFail: true,
3129 expectedError: ":CERTIFICATE_VERIFY_FAILED:",
3130 })
Paul Lietar8f1c2682015-08-18 12:21:54 +01003131 tests = append(tests, testCase{
3132 testType: clientTest,
3133 name: "CertificateVerificationSoftFail",
David Benjamin4c3ddf72016-06-29 18:13:53 -04003134 config: Config{
3135 MaxVersion: VersionTLS12,
3136 },
Paul Lietar8f1c2682015-08-18 12:21:54 +01003137 flags: []string{
3138 "-verify-fail",
3139 "-expect-verify-result",
3140 },
3141 })
3142
David Benjamin582ba042016-07-07 12:33:25 -07003143 if config.protocol == tls {
David Benjamin760b1dd2015-05-15 23:33:48 -04003144 tests = append(tests, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04003145 name: "Renegotiate-Client",
3146 config: Config{
3147 MaxVersion: VersionTLS12,
3148 },
David Benjamin1d5ef3b2015-10-12 19:54:18 -04003149 renegotiate: 1,
3150 flags: []string{
3151 "-renegotiate-freely",
3152 "-expect-total-renegotiations", "1",
3153 },
David Benjamin760b1dd2015-05-15 23:33:48 -04003154 })
David Benjamin4c3ddf72016-06-29 18:13:53 -04003155
David Benjamin760b1dd2015-05-15 23:33:48 -04003156 // NPN on client and server; results in post-handshake message.
3157 tests = append(tests, testCase{
3158 name: "NPN-Client",
3159 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04003160 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04003161 NextProtos: []string{"foo"},
3162 },
3163 flags: []string{"-select-next-proto", "foo"},
David Benjaminf8fcdf32016-06-08 15:56:13 -04003164 resumeSession: true,
David Benjamin760b1dd2015-05-15 23:33:48 -04003165 expectedNextProto: "foo",
3166 expectedNextProtoType: npn,
3167 })
3168 tests = append(tests, testCase{
3169 testType: serverTest,
3170 name: "NPN-Server",
3171 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04003172 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04003173 NextProtos: []string{"bar"},
3174 },
3175 flags: []string{
3176 "-advertise-npn", "\x03foo\x03bar\x03baz",
3177 "-expect-next-proto", "bar",
3178 },
David Benjaminf8fcdf32016-06-08 15:56:13 -04003179 resumeSession: true,
David Benjamin760b1dd2015-05-15 23:33:48 -04003180 expectedNextProto: "bar",
3181 expectedNextProtoType: npn,
3182 })
3183
3184 // TODO(davidben): Add tests for when False Start doesn't trigger.
3185
3186 // Client does False Start and negotiates NPN.
3187 tests = append(tests, testCase{
3188 name: "FalseStart",
3189 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07003190 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04003191 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
3192 NextProtos: []string{"foo"},
3193 Bugs: ProtocolBugs{
3194 ExpectFalseStart: true,
3195 },
3196 },
3197 flags: []string{
3198 "-false-start",
3199 "-select-next-proto", "foo",
3200 },
3201 shimWritesFirst: true,
3202 resumeSession: true,
3203 })
3204
3205 // Client does False Start and negotiates ALPN.
3206 tests = append(tests, testCase{
3207 name: "FalseStart-ALPN",
3208 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07003209 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04003210 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
3211 NextProtos: []string{"foo"},
3212 Bugs: ProtocolBugs{
3213 ExpectFalseStart: true,
3214 },
3215 },
3216 flags: []string{
3217 "-false-start",
3218 "-advertise-alpn", "\x03foo",
3219 },
3220 shimWritesFirst: true,
3221 resumeSession: true,
3222 })
3223
3224 // Client does False Start but doesn't explicitly call
3225 // SSL_connect.
3226 tests = append(tests, testCase{
3227 name: "FalseStart-Implicit",
3228 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07003229 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04003230 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
3231 NextProtos: []string{"foo"},
3232 },
3233 flags: []string{
3234 "-implicit-handshake",
3235 "-false-start",
3236 "-advertise-alpn", "\x03foo",
3237 },
3238 })
3239
3240 // False Start without session tickets.
3241 tests = append(tests, testCase{
3242 name: "FalseStart-SessionTicketsDisabled",
3243 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07003244 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04003245 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
3246 NextProtos: []string{"foo"},
3247 SessionTicketsDisabled: true,
3248 Bugs: ProtocolBugs{
3249 ExpectFalseStart: true,
3250 },
3251 },
3252 flags: []string{
3253 "-false-start",
3254 "-select-next-proto", "foo",
3255 },
3256 shimWritesFirst: true,
3257 })
3258
Adam Langleydf759b52016-07-11 15:24:37 -07003259 tests = append(tests, testCase{
3260 name: "FalseStart-CECPQ1",
3261 config: Config{
3262 MaxVersion: VersionTLS12,
3263 CipherSuites: []uint16{TLS_CECPQ1_RSA_WITH_AES_256_GCM_SHA384},
3264 NextProtos: []string{"foo"},
3265 Bugs: ProtocolBugs{
3266 ExpectFalseStart: true,
3267 },
3268 },
3269 flags: []string{
3270 "-false-start",
3271 "-cipher", "DEFAULT:kCECPQ1",
3272 "-select-next-proto", "foo",
3273 },
3274 shimWritesFirst: true,
3275 resumeSession: true,
3276 })
3277
David Benjamin760b1dd2015-05-15 23:33:48 -04003278 // Server parses a V2ClientHello.
3279 tests = append(tests, testCase{
3280 testType: serverTest,
3281 name: "SendV2ClientHello",
3282 config: Config{
3283 // Choose a cipher suite that does not involve
3284 // elliptic curves, so no extensions are
3285 // involved.
Nick Harper1fd39d82016-06-14 18:14:35 -07003286 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04003287 CipherSuites: []uint16{TLS_RSA_WITH_RC4_128_SHA},
3288 Bugs: ProtocolBugs{
3289 SendV2ClientHello: true,
3290 },
3291 },
3292 })
3293
3294 // Client sends a Channel ID.
3295 tests = append(tests, testCase{
3296 name: "ChannelID-Client",
3297 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04003298 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04003299 RequestChannelID: true,
3300 },
Adam Langley7c803a62015-06-15 15:35:05 -07003301 flags: []string{"-send-channel-id", path.Join(*resourceDir, channelIDKeyFile)},
David Benjamin760b1dd2015-05-15 23:33:48 -04003302 resumeSession: true,
3303 expectChannelID: true,
3304 })
3305
3306 // Server accepts a Channel ID.
3307 tests = append(tests, testCase{
3308 testType: serverTest,
3309 name: "ChannelID-Server",
3310 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04003311 MaxVersion: VersionTLS12,
3312 ChannelID: channelIDKey,
David Benjamin760b1dd2015-05-15 23:33:48 -04003313 },
3314 flags: []string{
3315 "-expect-channel-id",
3316 base64.StdEncoding.EncodeToString(channelIDBytes),
3317 },
3318 resumeSession: true,
3319 expectChannelID: true,
3320 })
David Benjamin30789da2015-08-29 22:56:45 -04003321
David Benjaminf8fcdf32016-06-08 15:56:13 -04003322 // Channel ID and NPN at the same time, to ensure their relative
3323 // ordering is correct.
3324 tests = append(tests, testCase{
3325 name: "ChannelID-NPN-Client",
3326 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04003327 MaxVersion: VersionTLS12,
David Benjaminf8fcdf32016-06-08 15:56:13 -04003328 RequestChannelID: true,
3329 NextProtos: []string{"foo"},
3330 },
3331 flags: []string{
3332 "-send-channel-id", path.Join(*resourceDir, channelIDKeyFile),
3333 "-select-next-proto", "foo",
3334 },
3335 resumeSession: true,
3336 expectChannelID: true,
3337 expectedNextProto: "foo",
3338 expectedNextProtoType: npn,
3339 })
3340 tests = append(tests, testCase{
3341 testType: serverTest,
3342 name: "ChannelID-NPN-Server",
3343 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04003344 MaxVersion: VersionTLS12,
David Benjaminf8fcdf32016-06-08 15:56:13 -04003345 ChannelID: channelIDKey,
3346 NextProtos: []string{"bar"},
3347 },
3348 flags: []string{
3349 "-expect-channel-id",
3350 base64.StdEncoding.EncodeToString(channelIDBytes),
3351 "-advertise-npn", "\x03foo\x03bar\x03baz",
3352 "-expect-next-proto", "bar",
3353 },
3354 resumeSession: true,
3355 expectChannelID: true,
3356 expectedNextProto: "bar",
3357 expectedNextProtoType: npn,
3358 })
3359
David Benjamin30789da2015-08-29 22:56:45 -04003360 // Bidirectional shutdown with the runner initiating.
3361 tests = append(tests, testCase{
3362 name: "Shutdown-Runner",
3363 config: Config{
3364 Bugs: ProtocolBugs{
3365 ExpectCloseNotify: true,
3366 },
3367 },
3368 flags: []string{"-check-close-notify"},
3369 })
3370
3371 // Bidirectional shutdown with the shim initiating. The runner,
3372 // in the meantime, sends garbage before the close_notify which
3373 // the shim must ignore.
3374 tests = append(tests, testCase{
3375 name: "Shutdown-Shim",
3376 config: Config{
3377 Bugs: ProtocolBugs{
3378 ExpectCloseNotify: true,
3379 },
3380 },
3381 shimShutsDown: true,
3382 sendEmptyRecords: 1,
3383 sendWarningAlerts: 1,
3384 flags: []string{"-check-close-notify"},
3385 })
David Benjamin760b1dd2015-05-15 23:33:48 -04003386 } else {
David Benjamin4c3ddf72016-06-29 18:13:53 -04003387 // TODO(davidben): DTLS 1.3 will want a similar thing for
3388 // HelloRetryRequest.
David Benjamin760b1dd2015-05-15 23:33:48 -04003389 tests = append(tests, testCase{
3390 name: "SkipHelloVerifyRequest",
3391 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04003392 MaxVersion: VersionTLS12,
David Benjamin760b1dd2015-05-15 23:33:48 -04003393 Bugs: ProtocolBugs{
3394 SkipHelloVerifyRequest: true,
3395 },
3396 },
3397 })
3398 }
3399
David Benjamin760b1dd2015-05-15 23:33:48 -04003400 for _, test := range tests {
David Benjamin582ba042016-07-07 12:33:25 -07003401 test.protocol = config.protocol
3402 if config.protocol == dtls {
David Benjamin16285ea2015-11-03 15:39:45 -05003403 test.name += "-DTLS"
3404 }
David Benjamin582ba042016-07-07 12:33:25 -07003405 if config.async {
David Benjamin16285ea2015-11-03 15:39:45 -05003406 test.name += "-Async"
3407 test.flags = append(test.flags, "-async")
3408 } else {
3409 test.name += "-Sync"
3410 }
David Benjamin582ba042016-07-07 12:33:25 -07003411 if config.splitHandshake {
David Benjamin16285ea2015-11-03 15:39:45 -05003412 test.name += "-SplitHandshakeRecords"
3413 test.config.Bugs.MaxHandshakeRecordLength = 1
David Benjamin582ba042016-07-07 12:33:25 -07003414 if config.protocol == dtls {
David Benjamin16285ea2015-11-03 15:39:45 -05003415 test.config.Bugs.MaxPacketLength = 256
3416 test.flags = append(test.flags, "-mtu", "256")
3417 }
3418 }
David Benjamin582ba042016-07-07 12:33:25 -07003419 if config.packHandshakeFlight {
3420 test.name += "-PackHandshakeFlight"
3421 test.config.Bugs.PackHandshakeFlight = true
3422 }
David Benjamin760b1dd2015-05-15 23:33:48 -04003423 testCases = append(testCases, test)
David Benjamin6fd297b2014-08-11 18:43:38 -04003424 }
David Benjamin43ec06f2014-08-05 02:28:57 -04003425}
3426
Adam Langley524e7172015-02-20 16:04:00 -08003427func addDDoSCallbackTests() {
3428 // DDoS callback.
3429
3430 for _, resume := range []bool{false, true} {
3431 suffix := "Resume"
3432 if resume {
3433 suffix = "No" + suffix
3434 }
3435
David Benjamin4c3ddf72016-06-29 18:13:53 -04003436 // TODO(davidben): Test TLS 1.3's version of the DDoS callback.
3437
Adam Langley524e7172015-02-20 16:04:00 -08003438 testCases = append(testCases, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04003439 testType: serverTest,
3440 name: "Server-DDoS-OK-" + suffix,
3441 config: Config{
3442 MaxVersion: VersionTLS12,
3443 },
Adam Langley524e7172015-02-20 16:04:00 -08003444 flags: []string{"-install-ddos-callback"},
3445 resumeSession: resume,
3446 })
3447
3448 failFlag := "-fail-ddos-callback"
3449 if resume {
3450 failFlag = "-fail-second-ddos-callback"
3451 }
3452 testCases = append(testCases, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04003453 testType: serverTest,
3454 name: "Server-DDoS-Reject-" + suffix,
3455 config: Config{
3456 MaxVersion: VersionTLS12,
3457 },
Adam Langley524e7172015-02-20 16:04:00 -08003458 flags: []string{"-install-ddos-callback", failFlag},
3459 resumeSession: resume,
3460 shouldFail: true,
3461 expectedError: ":CONNECTION_REJECTED:",
3462 })
3463 }
3464}
3465
David Benjamin7e2e6cf2014-08-07 17:44:24 -04003466func addVersionNegotiationTests() {
3467 for i, shimVers := range tlsVersions {
3468 // Assemble flags to disable all newer versions on the shim.
3469 var flags []string
3470 for _, vers := range tlsVersions[i+1:] {
3471 flags = append(flags, vers.flag)
3472 }
3473
3474 for _, runnerVers := range tlsVersions {
David Benjamin8b8c0062014-11-23 02:47:52 -05003475 protocols := []protocol{tls}
3476 if runnerVers.hasDTLS && shimVers.hasDTLS {
3477 protocols = append(protocols, dtls)
David Benjamin7e2e6cf2014-08-07 17:44:24 -04003478 }
David Benjamin8b8c0062014-11-23 02:47:52 -05003479 for _, protocol := range protocols {
3480 expectedVersion := shimVers.version
3481 if runnerVers.version < shimVers.version {
3482 expectedVersion = runnerVers.version
3483 }
David Benjamin7e2e6cf2014-08-07 17:44:24 -04003484
David Benjamin8b8c0062014-11-23 02:47:52 -05003485 suffix := shimVers.name + "-" + runnerVers.name
3486 if protocol == dtls {
3487 suffix += "-DTLS"
3488 }
David Benjamin7e2e6cf2014-08-07 17:44:24 -04003489
David Benjamin1eb367c2014-12-12 18:17:51 -05003490 shimVersFlag := strconv.Itoa(int(versionToWire(shimVers.version, protocol == dtls)))
3491
David Benjamin1e29a6b2014-12-10 02:27:24 -05003492 clientVers := shimVers.version
3493 if clientVers > VersionTLS10 {
3494 clientVers = VersionTLS10
3495 }
Nick Harper1fd39d82016-06-14 18:14:35 -07003496 serverVers := expectedVersion
3497 if expectedVersion >= VersionTLS13 {
3498 serverVers = VersionTLS10
3499 }
David Benjamin8b8c0062014-11-23 02:47:52 -05003500 testCases = append(testCases, testCase{
3501 protocol: protocol,
3502 testType: clientTest,
3503 name: "VersionNegotiation-Client-" + suffix,
3504 config: Config{
3505 MaxVersion: runnerVers.version,
David Benjamin1e29a6b2014-12-10 02:27:24 -05003506 Bugs: ProtocolBugs{
3507 ExpectInitialRecordVersion: clientVers,
3508 },
David Benjamin8b8c0062014-11-23 02:47:52 -05003509 },
3510 flags: flags,
3511 expectedVersion: expectedVersion,
3512 })
David Benjamin1eb367c2014-12-12 18:17:51 -05003513 testCases = append(testCases, testCase{
3514 protocol: protocol,
3515 testType: clientTest,
3516 name: "VersionNegotiation-Client2-" + suffix,
3517 config: Config{
3518 MaxVersion: runnerVers.version,
3519 Bugs: ProtocolBugs{
3520 ExpectInitialRecordVersion: clientVers,
3521 },
3522 },
3523 flags: []string{"-max-version", shimVersFlag},
3524 expectedVersion: expectedVersion,
3525 })
David Benjamin8b8c0062014-11-23 02:47:52 -05003526
3527 testCases = append(testCases, testCase{
3528 protocol: protocol,
3529 testType: serverTest,
3530 name: "VersionNegotiation-Server-" + suffix,
3531 config: Config{
3532 MaxVersion: runnerVers.version,
David Benjamin1e29a6b2014-12-10 02:27:24 -05003533 Bugs: ProtocolBugs{
Nick Harper1fd39d82016-06-14 18:14:35 -07003534 ExpectInitialRecordVersion: serverVers,
David Benjamin1e29a6b2014-12-10 02:27:24 -05003535 },
David Benjamin8b8c0062014-11-23 02:47:52 -05003536 },
3537 flags: flags,
3538 expectedVersion: expectedVersion,
3539 })
David Benjamin1eb367c2014-12-12 18:17:51 -05003540 testCases = append(testCases, testCase{
3541 protocol: protocol,
3542 testType: serverTest,
3543 name: "VersionNegotiation-Server2-" + suffix,
3544 config: Config{
3545 MaxVersion: runnerVers.version,
3546 Bugs: ProtocolBugs{
Nick Harper1fd39d82016-06-14 18:14:35 -07003547 ExpectInitialRecordVersion: serverVers,
David Benjamin1eb367c2014-12-12 18:17:51 -05003548 },
3549 },
3550 flags: []string{"-max-version", shimVersFlag},
3551 expectedVersion: expectedVersion,
3552 })
David Benjamin8b8c0062014-11-23 02:47:52 -05003553 }
David Benjamin7e2e6cf2014-08-07 17:44:24 -04003554 }
3555 }
David Benjamin95c69562016-06-29 18:15:03 -04003556
3557 // Test for version tolerance.
3558 testCases = append(testCases, testCase{
3559 testType: serverTest,
3560 name: "MinorVersionTolerance",
3561 config: Config{
3562 Bugs: ProtocolBugs{
3563 SendClientVersion: 0x03ff,
3564 },
3565 },
3566 expectedVersion: VersionTLS13,
3567 })
3568 testCases = append(testCases, testCase{
3569 testType: serverTest,
3570 name: "MajorVersionTolerance",
3571 config: Config{
3572 Bugs: ProtocolBugs{
3573 SendClientVersion: 0x0400,
3574 },
3575 },
3576 expectedVersion: VersionTLS13,
3577 })
3578 testCases = append(testCases, testCase{
3579 protocol: dtls,
3580 testType: serverTest,
3581 name: "MinorVersionTolerance-DTLS",
3582 config: Config{
3583 Bugs: ProtocolBugs{
3584 SendClientVersion: 0x03ff,
3585 },
3586 },
3587 expectedVersion: VersionTLS12,
3588 })
3589 testCases = append(testCases, testCase{
3590 protocol: dtls,
3591 testType: serverTest,
3592 name: "MajorVersionTolerance-DTLS",
3593 config: Config{
3594 Bugs: ProtocolBugs{
3595 SendClientVersion: 0x0400,
3596 },
3597 },
3598 expectedVersion: VersionTLS12,
3599 })
3600
3601 // Test that versions below 3.0 are rejected.
3602 testCases = append(testCases, testCase{
3603 testType: serverTest,
3604 name: "VersionTooLow",
3605 config: Config{
3606 Bugs: ProtocolBugs{
3607 SendClientVersion: 0x0200,
3608 },
3609 },
3610 shouldFail: true,
3611 expectedError: ":UNSUPPORTED_PROTOCOL:",
3612 })
3613 testCases = append(testCases, testCase{
3614 protocol: dtls,
3615 testType: serverTest,
3616 name: "VersionTooLow-DTLS",
3617 config: Config{
3618 Bugs: ProtocolBugs{
3619 // 0x0201 is the lowest version expressable in
3620 // DTLS.
3621 SendClientVersion: 0x0201,
3622 },
3623 },
3624 shouldFail: true,
3625 expectedError: ":UNSUPPORTED_PROTOCOL:",
3626 })
David Benjamin1f61f0d2016-07-10 12:20:35 -04003627
3628 // Test TLS 1.3's downgrade signal.
3629 testCases = append(testCases, testCase{
3630 name: "Downgrade-TLS12-Client",
3631 config: Config{
3632 Bugs: ProtocolBugs{
3633 NegotiateVersion: VersionTLS12,
3634 },
3635 },
3636 shouldFail: true,
3637 expectedError: ":DOWNGRADE_DETECTED:",
3638 })
3639 testCases = append(testCases, testCase{
3640 testType: serverTest,
3641 name: "Downgrade-TLS12-Server",
3642 config: Config{
3643 Bugs: ProtocolBugs{
3644 SendClientVersion: VersionTLS12,
3645 },
3646 },
3647 shouldFail: true,
3648 expectedLocalError: "tls: downgrade from TLS 1.3 detected",
3649 })
David Benjamin7e2e6cf2014-08-07 17:44:24 -04003650}
3651
David Benjaminaccb4542014-12-12 23:44:33 -05003652func addMinimumVersionTests() {
3653 for i, shimVers := range tlsVersions {
3654 // Assemble flags to disable all older versions on the shim.
3655 var flags []string
3656 for _, vers := range tlsVersions[:i] {
3657 flags = append(flags, vers.flag)
3658 }
3659
3660 for _, runnerVers := range tlsVersions {
3661 protocols := []protocol{tls}
3662 if runnerVers.hasDTLS && shimVers.hasDTLS {
3663 protocols = append(protocols, dtls)
3664 }
3665 for _, protocol := range protocols {
3666 suffix := shimVers.name + "-" + runnerVers.name
3667 if protocol == dtls {
3668 suffix += "-DTLS"
3669 }
3670 shimVersFlag := strconv.Itoa(int(versionToWire(shimVers.version, protocol == dtls)))
3671
David Benjaminaccb4542014-12-12 23:44:33 -05003672 var expectedVersion uint16
3673 var shouldFail bool
David Benjamin929d4ee2016-06-24 23:55:58 -04003674 var expectedClientError, expectedServerError string
3675 var expectedClientLocalError, expectedServerLocalError string
David Benjaminaccb4542014-12-12 23:44:33 -05003676 if runnerVers.version >= shimVers.version {
3677 expectedVersion = runnerVers.version
3678 } else {
3679 shouldFail = true
David Benjamin929d4ee2016-06-24 23:55:58 -04003680 expectedServerError = ":UNSUPPORTED_PROTOCOL:"
3681 expectedServerLocalError = "remote error: protocol version not supported"
3682 if shimVers.version >= VersionTLS13 && runnerVers.version <= VersionTLS11 {
3683 // If the client's minimum version is TLS 1.3 and the runner's
3684 // maximum is below TLS 1.2, the runner will fail to select a
3685 // cipher before the shim rejects the selected version.
3686 expectedClientError = ":SSLV3_ALERT_HANDSHAKE_FAILURE:"
3687 expectedClientLocalError = "tls: no cipher suite supported by both client and server"
3688 } else {
3689 expectedClientError = expectedServerError
3690 expectedClientLocalError = expectedServerLocalError
3691 }
David Benjaminaccb4542014-12-12 23:44:33 -05003692 }
3693
3694 testCases = append(testCases, testCase{
3695 protocol: protocol,
3696 testType: clientTest,
3697 name: "MinimumVersion-Client-" + suffix,
3698 config: Config{
3699 MaxVersion: runnerVers.version,
3700 },
David Benjamin87909c02014-12-13 01:55:01 -05003701 flags: flags,
3702 expectedVersion: expectedVersion,
3703 shouldFail: shouldFail,
David Benjamin929d4ee2016-06-24 23:55:58 -04003704 expectedError: expectedClientError,
3705 expectedLocalError: expectedClientLocalError,
David Benjaminaccb4542014-12-12 23:44:33 -05003706 })
3707 testCases = append(testCases, testCase{
3708 protocol: protocol,
3709 testType: clientTest,
3710 name: "MinimumVersion-Client2-" + suffix,
3711 config: Config{
3712 MaxVersion: runnerVers.version,
3713 },
David Benjamin87909c02014-12-13 01:55:01 -05003714 flags: []string{"-min-version", shimVersFlag},
3715 expectedVersion: expectedVersion,
3716 shouldFail: shouldFail,
David Benjamin929d4ee2016-06-24 23:55:58 -04003717 expectedError: expectedClientError,
3718 expectedLocalError: expectedClientLocalError,
David Benjaminaccb4542014-12-12 23:44:33 -05003719 })
3720
3721 testCases = append(testCases, testCase{
3722 protocol: protocol,
3723 testType: serverTest,
3724 name: "MinimumVersion-Server-" + suffix,
3725 config: Config{
3726 MaxVersion: runnerVers.version,
3727 },
David Benjamin87909c02014-12-13 01:55:01 -05003728 flags: flags,
3729 expectedVersion: expectedVersion,
3730 shouldFail: shouldFail,
David Benjamin929d4ee2016-06-24 23:55:58 -04003731 expectedError: expectedServerError,
3732 expectedLocalError: expectedServerLocalError,
David Benjaminaccb4542014-12-12 23:44:33 -05003733 })
3734 testCases = append(testCases, testCase{
3735 protocol: protocol,
3736 testType: serverTest,
3737 name: "MinimumVersion-Server2-" + suffix,
3738 config: Config{
3739 MaxVersion: runnerVers.version,
3740 },
David Benjamin87909c02014-12-13 01:55:01 -05003741 flags: []string{"-min-version", shimVersFlag},
3742 expectedVersion: expectedVersion,
3743 shouldFail: shouldFail,
David Benjamin929d4ee2016-06-24 23:55:58 -04003744 expectedError: expectedServerError,
3745 expectedLocalError: expectedServerLocalError,
David Benjaminaccb4542014-12-12 23:44:33 -05003746 })
3747 }
3748 }
3749 }
3750}
3751
David Benjamine78bfde2014-09-06 12:45:15 -04003752func addExtensionTests() {
David Benjamin4c3ddf72016-06-29 18:13:53 -04003753 // TODO(davidben): Extensions, where applicable, all move their server
3754 // halves to EncryptedExtensions in TLS 1.3. Duplicate each of these
3755 // tests for both. Also test interaction with 0-RTT when implemented.
3756
David Benjamin97d17d92016-07-14 16:12:00 -04003757 // Repeat extensions tests all versions except SSL 3.0.
3758 for _, ver := range tlsVersions {
3759 if ver.version == VersionSSL30 {
3760 continue
3761 }
3762
3763 // TODO(davidben): Implement resumption in TLS 1.3.
3764 resumeSession := ver.version < VersionTLS13
3765
3766 // Test that duplicate extensions are rejected.
3767 testCases = append(testCases, testCase{
3768 testType: clientTest,
3769 name: "DuplicateExtensionClient-" + ver.name,
3770 config: Config{
3771 MaxVersion: ver.version,
3772 Bugs: ProtocolBugs{
3773 DuplicateExtension: true,
3774 },
David Benjamine78bfde2014-09-06 12:45:15 -04003775 },
David Benjamin97d17d92016-07-14 16:12:00 -04003776 shouldFail: true,
3777 expectedLocalError: "remote error: error decoding message",
3778 })
3779 testCases = append(testCases, testCase{
3780 testType: serverTest,
3781 name: "DuplicateExtensionServer-" + ver.name,
3782 config: Config{
3783 MaxVersion: ver.version,
3784 Bugs: ProtocolBugs{
3785 DuplicateExtension: true,
3786 },
David Benjamine78bfde2014-09-06 12:45:15 -04003787 },
David Benjamin97d17d92016-07-14 16:12:00 -04003788 shouldFail: true,
3789 expectedLocalError: "remote error: error decoding message",
3790 })
3791
3792 // Test SNI.
3793 testCases = append(testCases, testCase{
3794 testType: clientTest,
3795 name: "ServerNameExtensionClient-" + ver.name,
3796 config: Config{
3797 MaxVersion: ver.version,
3798 Bugs: ProtocolBugs{
3799 ExpectServerName: "example.com",
3800 },
David Benjamine78bfde2014-09-06 12:45:15 -04003801 },
David Benjamin97d17d92016-07-14 16:12:00 -04003802 flags: []string{"-host-name", "example.com"},
3803 })
3804 testCases = append(testCases, testCase{
3805 testType: clientTest,
3806 name: "ServerNameExtensionClientMismatch-" + ver.name,
3807 config: Config{
3808 MaxVersion: ver.version,
3809 Bugs: ProtocolBugs{
3810 ExpectServerName: "mismatch.com",
3811 },
David Benjamine78bfde2014-09-06 12:45:15 -04003812 },
David Benjamin97d17d92016-07-14 16:12:00 -04003813 flags: []string{"-host-name", "example.com"},
3814 shouldFail: true,
3815 expectedLocalError: "tls: unexpected server name",
3816 })
3817 testCases = append(testCases, testCase{
3818 testType: clientTest,
3819 name: "ServerNameExtensionClientMissing-" + ver.name,
3820 config: Config{
3821 MaxVersion: ver.version,
3822 Bugs: ProtocolBugs{
3823 ExpectServerName: "missing.com",
3824 },
David Benjamine78bfde2014-09-06 12:45:15 -04003825 },
David Benjamin97d17d92016-07-14 16:12:00 -04003826 shouldFail: true,
3827 expectedLocalError: "tls: unexpected server name",
3828 })
3829 testCases = append(testCases, testCase{
3830 testType: serverTest,
3831 name: "ServerNameExtensionServer-" + ver.name,
3832 config: Config{
3833 MaxVersion: ver.version,
3834 ServerName: "example.com",
David Benjaminfc7b0862014-09-06 13:21:53 -04003835 },
David Benjamin97d17d92016-07-14 16:12:00 -04003836 flags: []string{"-expect-server-name", "example.com"},
3837 resumeSession: resumeSession,
3838 })
3839
3840 // Test ALPN.
3841 testCases = append(testCases, testCase{
3842 testType: clientTest,
3843 name: "ALPNClient-" + ver.name,
3844 config: Config{
3845 MaxVersion: ver.version,
3846 NextProtos: []string{"foo"},
3847 },
3848 flags: []string{
3849 "-advertise-alpn", "\x03foo\x03bar\x03baz",
3850 "-expect-alpn", "foo",
3851 },
3852 expectedNextProto: "foo",
3853 expectedNextProtoType: alpn,
3854 resumeSession: resumeSession,
3855 })
3856 testCases = append(testCases, testCase{
3857 testType: serverTest,
3858 name: "ALPNServer-" + ver.name,
3859 config: Config{
3860 MaxVersion: ver.version,
3861 NextProtos: []string{"foo", "bar", "baz"},
3862 },
3863 flags: []string{
3864 "-expect-advertised-alpn", "\x03foo\x03bar\x03baz",
3865 "-select-alpn", "foo",
3866 },
3867 expectedNextProto: "foo",
3868 expectedNextProtoType: alpn,
3869 resumeSession: resumeSession,
3870 })
3871 testCases = append(testCases, testCase{
3872 testType: serverTest,
3873 name: "ALPNServer-Decline-" + ver.name,
3874 config: Config{
3875 MaxVersion: ver.version,
3876 NextProtos: []string{"foo", "bar", "baz"},
3877 },
3878 flags: []string{"-decline-alpn"},
3879 expectNoNextProto: true,
3880 resumeSession: resumeSession,
3881 })
3882
3883 var emptyString string
3884 testCases = append(testCases, testCase{
3885 testType: clientTest,
3886 name: "ALPNClient-EmptyProtocolName-" + ver.name,
3887 config: Config{
3888 MaxVersion: ver.version,
3889 NextProtos: []string{""},
3890 Bugs: ProtocolBugs{
3891 // A server returning an empty ALPN protocol
3892 // should be rejected.
3893 ALPNProtocol: &emptyString,
3894 },
3895 },
3896 flags: []string{
3897 "-advertise-alpn", "\x03foo",
3898 },
3899 shouldFail: true,
3900 expectedError: ":PARSE_TLSEXT:",
3901 })
3902 testCases = append(testCases, testCase{
3903 testType: serverTest,
3904 name: "ALPNServer-EmptyProtocolName-" + ver.name,
3905 config: Config{
3906 MaxVersion: ver.version,
3907 // A ClientHello containing an empty ALPN protocol
Adam Langleyefb0e162015-07-09 11:35:04 -07003908 // should be rejected.
David Benjamin97d17d92016-07-14 16:12:00 -04003909 NextProtos: []string{"foo", "", "baz"},
Adam Langleyefb0e162015-07-09 11:35:04 -07003910 },
David Benjamin97d17d92016-07-14 16:12:00 -04003911 flags: []string{
3912 "-select-alpn", "foo",
David Benjamin76c2efc2015-08-31 14:24:29 -04003913 },
David Benjamin97d17d92016-07-14 16:12:00 -04003914 shouldFail: true,
3915 expectedError: ":PARSE_TLSEXT:",
3916 })
3917
3918 // Test NPN and the interaction with ALPN.
3919 if ver.version < VersionTLS13 {
3920 // Test that the server prefers ALPN over NPN.
3921 testCases = append(testCases, testCase{
3922 testType: serverTest,
3923 name: "ALPNServer-Preferred-" + ver.name,
3924 config: Config{
3925 MaxVersion: ver.version,
3926 NextProtos: []string{"foo", "bar", "baz"},
3927 },
3928 flags: []string{
3929 "-expect-advertised-alpn", "\x03foo\x03bar\x03baz",
3930 "-select-alpn", "foo",
3931 "-advertise-npn", "\x03foo\x03bar\x03baz",
3932 },
3933 expectedNextProto: "foo",
3934 expectedNextProtoType: alpn,
3935 resumeSession: resumeSession,
3936 })
3937 testCases = append(testCases, testCase{
3938 testType: serverTest,
3939 name: "ALPNServer-Preferred-Swapped-" + ver.name,
3940 config: Config{
3941 MaxVersion: ver.version,
3942 NextProtos: []string{"foo", "bar", "baz"},
3943 Bugs: ProtocolBugs{
3944 SwapNPNAndALPN: true,
3945 },
3946 },
3947 flags: []string{
3948 "-expect-advertised-alpn", "\x03foo\x03bar\x03baz",
3949 "-select-alpn", "foo",
3950 "-advertise-npn", "\x03foo\x03bar\x03baz",
3951 },
3952 expectedNextProto: "foo",
3953 expectedNextProtoType: alpn,
3954 resumeSession: resumeSession,
3955 })
3956
3957 // Test that negotiating both NPN and ALPN is forbidden.
3958 testCases = append(testCases, testCase{
3959 name: "NegotiateALPNAndNPN-" + ver.name,
3960 config: Config{
3961 MaxVersion: ver.version,
3962 NextProtos: []string{"foo", "bar", "baz"},
3963 Bugs: ProtocolBugs{
3964 NegotiateALPNAndNPN: true,
3965 },
3966 },
3967 flags: []string{
3968 "-advertise-alpn", "\x03foo",
3969 "-select-next-proto", "foo",
3970 },
3971 shouldFail: true,
3972 expectedError: ":NEGOTIATED_BOTH_NPN_AND_ALPN:",
3973 })
3974 testCases = append(testCases, testCase{
3975 name: "NegotiateALPNAndNPN-Swapped-" + ver.name,
3976 config: Config{
3977 MaxVersion: ver.version,
3978 NextProtos: []string{"foo", "bar", "baz"},
3979 Bugs: ProtocolBugs{
3980 NegotiateALPNAndNPN: true,
3981 SwapNPNAndALPN: true,
3982 },
3983 },
3984 flags: []string{
3985 "-advertise-alpn", "\x03foo",
3986 "-select-next-proto", "foo",
3987 },
3988 shouldFail: true,
3989 expectedError: ":NEGOTIATED_BOTH_NPN_AND_ALPN:",
3990 })
3991
3992 // Test that NPN can be disabled with SSL_OP_DISABLE_NPN.
3993 testCases = append(testCases, testCase{
3994 name: "DisableNPN-" + ver.name,
3995 config: Config{
3996 MaxVersion: ver.version,
3997 NextProtos: []string{"foo"},
3998 },
3999 flags: []string{
4000 "-select-next-proto", "foo",
4001 "-disable-npn",
4002 },
4003 expectNoNextProto: true,
4004 })
4005 }
4006
4007 // Test ticket behavior.
4008 //
4009 // TODO(davidben): Add TLS 1.3 versions of these.
4010 if ver.version < VersionTLS13 {
4011 // Resume with a corrupt ticket.
4012 testCases = append(testCases, testCase{
4013 testType: serverTest,
4014 name: "CorruptTicket-" + ver.name,
4015 config: Config{
4016 MaxVersion: ver.version,
4017 Bugs: ProtocolBugs{
4018 CorruptTicket: true,
4019 },
4020 },
4021 resumeSession: true,
4022 expectResumeRejected: true,
4023 })
4024 // Test the ticket callback, with and without renewal.
4025 testCases = append(testCases, testCase{
4026 testType: serverTest,
4027 name: "TicketCallback-" + ver.name,
4028 config: Config{
4029 MaxVersion: ver.version,
4030 },
4031 resumeSession: true,
4032 flags: []string{"-use-ticket-callback"},
4033 })
4034 testCases = append(testCases, testCase{
4035 testType: serverTest,
4036 name: "TicketCallback-Renew-" + ver.name,
4037 config: Config{
4038 MaxVersion: ver.version,
4039 Bugs: ProtocolBugs{
4040 ExpectNewTicket: true,
4041 },
4042 },
4043 flags: []string{"-use-ticket-callback", "-renew-ticket"},
4044 resumeSession: true,
4045 })
4046
4047 // Resume with an oversized session id.
4048 testCases = append(testCases, testCase{
4049 testType: serverTest,
4050 name: "OversizedSessionId-" + ver.name,
4051 config: Config{
4052 MaxVersion: ver.version,
4053 Bugs: ProtocolBugs{
4054 OversizedSessionId: true,
4055 },
4056 },
4057 resumeSession: true,
4058 shouldFail: true,
4059 expectedError: ":DECODE_ERROR:",
4060 })
4061 }
4062
4063 // Basic DTLS-SRTP tests. Include fake profiles to ensure they
4064 // are ignored.
4065 if ver.hasDTLS {
4066 testCases = append(testCases, testCase{
4067 protocol: dtls,
4068 name: "SRTP-Client-" + ver.name,
4069 config: Config{
4070 MaxVersion: ver.version,
4071 SRTPProtectionProfiles: []uint16{40, SRTP_AES128_CM_HMAC_SHA1_80, 42},
4072 },
4073 flags: []string{
4074 "-srtp-profiles",
4075 "SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32",
4076 },
4077 expectedSRTPProtectionProfile: SRTP_AES128_CM_HMAC_SHA1_80,
4078 })
4079 testCases = append(testCases, testCase{
4080 protocol: dtls,
4081 testType: serverTest,
4082 name: "SRTP-Server-" + ver.name,
4083 config: Config{
4084 MaxVersion: ver.version,
4085 SRTPProtectionProfiles: []uint16{40, SRTP_AES128_CM_HMAC_SHA1_80, 42},
4086 },
4087 flags: []string{
4088 "-srtp-profiles",
4089 "SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32",
4090 },
4091 expectedSRTPProtectionProfile: SRTP_AES128_CM_HMAC_SHA1_80,
4092 })
4093 // Test that the MKI is ignored.
4094 testCases = append(testCases, testCase{
4095 protocol: dtls,
4096 testType: serverTest,
4097 name: "SRTP-Server-IgnoreMKI-" + ver.name,
4098 config: Config{
4099 MaxVersion: ver.version,
4100 SRTPProtectionProfiles: []uint16{SRTP_AES128_CM_HMAC_SHA1_80},
4101 Bugs: ProtocolBugs{
4102 SRTPMasterKeyIdentifer: "bogus",
4103 },
4104 },
4105 flags: []string{
4106 "-srtp-profiles",
4107 "SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32",
4108 },
4109 expectedSRTPProtectionProfile: SRTP_AES128_CM_HMAC_SHA1_80,
4110 })
4111 // Test that SRTP isn't negotiated on the server if there were
4112 // no matching profiles.
4113 testCases = append(testCases, testCase{
4114 protocol: dtls,
4115 testType: serverTest,
4116 name: "SRTP-Server-NoMatch-" + ver.name,
4117 config: Config{
4118 MaxVersion: ver.version,
4119 SRTPProtectionProfiles: []uint16{100, 101, 102},
4120 },
4121 flags: []string{
4122 "-srtp-profiles",
4123 "SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32",
4124 },
4125 expectedSRTPProtectionProfile: 0,
4126 })
4127 // Test that the server returning an invalid SRTP profile is
4128 // flagged as an error by the client.
4129 testCases = append(testCases, testCase{
4130 protocol: dtls,
4131 name: "SRTP-Client-NoMatch-" + ver.name,
4132 config: Config{
4133 MaxVersion: ver.version,
4134 Bugs: ProtocolBugs{
4135 SendSRTPProtectionProfile: SRTP_AES128_CM_HMAC_SHA1_32,
4136 },
4137 },
4138 flags: []string{
4139 "-srtp-profiles",
4140 "SRTP_AES128_CM_SHA1_80",
4141 },
4142 shouldFail: true,
4143 expectedError: ":BAD_SRTP_PROTECTION_PROFILE_LIST:",
4144 })
4145 }
4146
4147 // Test SCT list.
4148 testCases = append(testCases, testCase{
4149 name: "SignedCertificateTimestampList-Client-" + ver.name,
4150 testType: clientTest,
4151 config: Config{
4152 MaxVersion: ver.version,
David Benjamin76c2efc2015-08-31 14:24:29 -04004153 },
David Benjamin97d17d92016-07-14 16:12:00 -04004154 flags: []string{
4155 "-enable-signed-cert-timestamps",
4156 "-expect-signed-cert-timestamps",
4157 base64.StdEncoding.EncodeToString(testSCTList),
Adam Langley38311732014-10-16 19:04:35 -07004158 },
David Benjamin97d17d92016-07-14 16:12:00 -04004159 resumeSession: resumeSession,
4160 })
4161 testCases = append(testCases, testCase{
4162 name: "SendSCTListOnResume-" + ver.name,
4163 config: Config{
4164 MaxVersion: ver.version,
4165 Bugs: ProtocolBugs{
4166 SendSCTListOnResume: []byte("bogus"),
4167 },
David Benjamind98452d2015-06-16 14:16:23 -04004168 },
David Benjamin97d17d92016-07-14 16:12:00 -04004169 flags: []string{
4170 "-enable-signed-cert-timestamps",
4171 "-expect-signed-cert-timestamps",
4172 base64.StdEncoding.EncodeToString(testSCTList),
Adam Langley38311732014-10-16 19:04:35 -07004173 },
David Benjamin97d17d92016-07-14 16:12:00 -04004174 resumeSession: resumeSession,
4175 })
4176 testCases = append(testCases, testCase{
4177 name: "SignedCertificateTimestampList-Server-" + ver.name,
4178 testType: serverTest,
4179 config: Config{
4180 MaxVersion: ver.version,
David Benjaminca6c8262014-11-15 19:06:08 -05004181 },
David Benjamin97d17d92016-07-14 16:12:00 -04004182 flags: []string{
4183 "-signed-cert-timestamps",
4184 base64.StdEncoding.EncodeToString(testSCTList),
David Benjaminca6c8262014-11-15 19:06:08 -05004185 },
David Benjamin97d17d92016-07-14 16:12:00 -04004186 expectedSCTList: testSCTList,
4187 resumeSession: resumeSession,
4188 })
4189 }
David Benjamin4c3ddf72016-06-29 18:13:53 -04004190
Paul Lietar4fac72e2015-09-09 13:44:55 +01004191 testCases = append(testCases, testCase{
Adam Langley33ad2b52015-07-20 17:43:53 -07004192 testType: clientTest,
4193 name: "ClientHelloPadding",
4194 config: Config{
4195 Bugs: ProtocolBugs{
4196 RequireClientHelloSize: 512,
4197 },
4198 },
4199 // This hostname just needs to be long enough to push the
4200 // ClientHello into F5's danger zone between 256 and 511 bytes
4201 // long.
4202 flags: []string{"-host-name", "01234567890123456789012345678901234567890123456789012345678901234567890123456789.com"},
4203 })
David Benjaminc7ce9772015-10-09 19:32:41 -04004204
4205 // Extensions should not function in SSL 3.0.
4206 testCases = append(testCases, testCase{
4207 testType: serverTest,
4208 name: "SSLv3Extensions-NoALPN",
4209 config: Config{
4210 MaxVersion: VersionSSL30,
4211 NextProtos: []string{"foo", "bar", "baz"},
4212 },
4213 flags: []string{
4214 "-select-alpn", "foo",
4215 },
4216 expectNoNextProto: true,
4217 })
4218
4219 // Test session tickets separately as they follow a different codepath.
4220 testCases = append(testCases, testCase{
4221 testType: serverTest,
4222 name: "SSLv3Extensions-NoTickets",
4223 config: Config{
4224 MaxVersion: VersionSSL30,
4225 Bugs: ProtocolBugs{
4226 // Historically, session tickets in SSL 3.0
4227 // failed in different ways depending on whether
4228 // the client supported renegotiation_info.
4229 NoRenegotiationInfo: true,
4230 },
4231 },
4232 resumeSession: true,
4233 })
4234 testCases = append(testCases, testCase{
4235 testType: serverTest,
4236 name: "SSLv3Extensions-NoTickets2",
4237 config: Config{
4238 MaxVersion: VersionSSL30,
4239 },
4240 resumeSession: true,
4241 })
4242
4243 // But SSL 3.0 does send and process renegotiation_info.
4244 testCases = append(testCases, testCase{
4245 testType: serverTest,
4246 name: "SSLv3Extensions-RenegotiationInfo",
4247 config: Config{
4248 MaxVersion: VersionSSL30,
4249 Bugs: ProtocolBugs{
4250 RequireRenegotiationInfo: true,
4251 },
4252 },
4253 })
4254 testCases = append(testCases, testCase{
4255 testType: serverTest,
4256 name: "SSLv3Extensions-RenegotiationInfo-SCSV",
4257 config: Config{
4258 MaxVersion: VersionSSL30,
4259 Bugs: ProtocolBugs{
4260 NoRenegotiationInfo: true,
4261 SendRenegotiationSCSV: true,
4262 RequireRenegotiationInfo: true,
4263 },
4264 },
4265 })
David Benjamine78bfde2014-09-06 12:45:15 -04004266}
4267
David Benjamin01fe8202014-09-24 15:21:44 -04004268func addResumptionVersionTests() {
David Benjamin01fe8202014-09-24 15:21:44 -04004269 for _, sessionVers := range tlsVersions {
David Benjamin6e6abe12016-07-13 20:57:22 -04004270 // TODO(davidben,svaldez): Implement resumption in TLS 1.3.
4271 if sessionVers.version >= VersionTLS13 {
4272 continue
4273 }
David Benjamin01fe8202014-09-24 15:21:44 -04004274 for _, resumeVers := range tlsVersions {
David Benjamin6e6abe12016-07-13 20:57:22 -04004275 if resumeVers.version >= VersionTLS13 {
4276 continue
4277 }
Nick Harper1fd39d82016-06-14 18:14:35 -07004278 cipher := TLS_RSA_WITH_AES_128_CBC_SHA
4279 if sessionVers.version >= VersionTLS13 || resumeVers.version >= VersionTLS13 {
4280 // TLS 1.3 only shares ciphers with TLS 1.2, so
4281 // we skip certain combinations and use a
4282 // different cipher to test with.
4283 cipher = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
4284 if sessionVers.version < VersionTLS12 || resumeVers.version < VersionTLS12 {
4285 continue
4286 }
4287 }
4288
David Benjamin8b8c0062014-11-23 02:47:52 -05004289 protocols := []protocol{tls}
4290 if sessionVers.hasDTLS && resumeVers.hasDTLS {
4291 protocols = append(protocols, dtls)
David Benjaminbdf5e722014-11-11 00:52:15 -05004292 }
David Benjamin8b8c0062014-11-23 02:47:52 -05004293 for _, protocol := range protocols {
4294 suffix := "-" + sessionVers.name + "-" + resumeVers.name
4295 if protocol == dtls {
4296 suffix += "-DTLS"
4297 }
4298
David Benjaminece3de92015-03-16 18:02:20 -04004299 if sessionVers.version == resumeVers.version {
4300 testCases = append(testCases, testCase{
4301 protocol: protocol,
4302 name: "Resume-Client" + suffix,
4303 resumeSession: true,
4304 config: Config{
4305 MaxVersion: sessionVers.version,
Nick Harper1fd39d82016-06-14 18:14:35 -07004306 CipherSuites: []uint16{cipher},
David Benjamin8b8c0062014-11-23 02:47:52 -05004307 },
David Benjaminece3de92015-03-16 18:02:20 -04004308 expectedVersion: sessionVers.version,
4309 expectedResumeVersion: resumeVers.version,
4310 })
4311 } else {
4312 testCases = append(testCases, testCase{
4313 protocol: protocol,
4314 name: "Resume-Client-Mismatch" + suffix,
4315 resumeSession: true,
4316 config: Config{
4317 MaxVersion: sessionVers.version,
Nick Harper1fd39d82016-06-14 18:14:35 -07004318 CipherSuites: []uint16{cipher},
David Benjamin8b8c0062014-11-23 02:47:52 -05004319 },
David Benjaminece3de92015-03-16 18:02:20 -04004320 expectedVersion: sessionVers.version,
4321 resumeConfig: &Config{
4322 MaxVersion: resumeVers.version,
Nick Harper1fd39d82016-06-14 18:14:35 -07004323 CipherSuites: []uint16{cipher},
David Benjaminece3de92015-03-16 18:02:20 -04004324 Bugs: ProtocolBugs{
4325 AllowSessionVersionMismatch: true,
4326 },
4327 },
4328 expectedResumeVersion: resumeVers.version,
4329 shouldFail: true,
4330 expectedError: ":OLD_SESSION_VERSION_NOT_RETURNED:",
4331 })
4332 }
David Benjamin8b8c0062014-11-23 02:47:52 -05004333
4334 testCases = append(testCases, testCase{
4335 protocol: protocol,
4336 name: "Resume-Client-NoResume" + suffix,
David Benjamin8b8c0062014-11-23 02:47:52 -05004337 resumeSession: true,
4338 config: Config{
4339 MaxVersion: sessionVers.version,
Nick Harper1fd39d82016-06-14 18:14:35 -07004340 CipherSuites: []uint16{cipher},
David Benjamin8b8c0062014-11-23 02:47:52 -05004341 },
4342 expectedVersion: sessionVers.version,
4343 resumeConfig: &Config{
4344 MaxVersion: resumeVers.version,
Nick Harper1fd39d82016-06-14 18:14:35 -07004345 CipherSuites: []uint16{cipher},
David Benjamin8b8c0062014-11-23 02:47:52 -05004346 },
4347 newSessionsOnResume: true,
Adam Langleyb0eef0a2015-06-02 10:47:39 -07004348 expectResumeRejected: true,
David Benjamin8b8c0062014-11-23 02:47:52 -05004349 expectedResumeVersion: resumeVers.version,
4350 })
4351
David Benjamin8b8c0062014-11-23 02:47:52 -05004352 testCases = append(testCases, testCase{
4353 protocol: protocol,
4354 testType: serverTest,
4355 name: "Resume-Server" + suffix,
David Benjamin8b8c0062014-11-23 02:47:52 -05004356 resumeSession: true,
4357 config: Config{
4358 MaxVersion: sessionVers.version,
Nick Harper1fd39d82016-06-14 18:14:35 -07004359 CipherSuites: []uint16{cipher},
David Benjamin8b8c0062014-11-23 02:47:52 -05004360 },
Adam Langleyb0eef0a2015-06-02 10:47:39 -07004361 expectedVersion: sessionVers.version,
4362 expectResumeRejected: sessionVers.version != resumeVers.version,
David Benjamin8b8c0062014-11-23 02:47:52 -05004363 resumeConfig: &Config{
4364 MaxVersion: resumeVers.version,
Nick Harper1fd39d82016-06-14 18:14:35 -07004365 CipherSuites: []uint16{cipher},
David Benjamin8b8c0062014-11-23 02:47:52 -05004366 },
4367 expectedResumeVersion: resumeVers.version,
4368 })
4369 }
David Benjamin01fe8202014-09-24 15:21:44 -04004370 }
4371 }
David Benjaminece3de92015-03-16 18:02:20 -04004372
Nick Harper1fd39d82016-06-14 18:14:35 -07004373 // TODO(davidben): This test should have a TLS 1.3 variant later.
David Benjaminece3de92015-03-16 18:02:20 -04004374 testCases = append(testCases, testCase{
4375 name: "Resume-Client-CipherMismatch",
4376 resumeSession: true,
4377 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07004378 MaxVersion: VersionTLS12,
David Benjaminece3de92015-03-16 18:02:20 -04004379 CipherSuites: []uint16{TLS_RSA_WITH_AES_128_GCM_SHA256},
4380 },
4381 resumeConfig: &Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07004382 MaxVersion: VersionTLS12,
David Benjaminece3de92015-03-16 18:02:20 -04004383 CipherSuites: []uint16{TLS_RSA_WITH_AES_128_GCM_SHA256},
4384 Bugs: ProtocolBugs{
4385 SendCipherSuite: TLS_RSA_WITH_AES_128_CBC_SHA,
4386 },
4387 },
4388 shouldFail: true,
4389 expectedError: ":OLD_SESSION_CIPHER_NOT_RETURNED:",
4390 })
David Benjamin01fe8202014-09-24 15:21:44 -04004391}
4392
Adam Langley2ae77d22014-10-28 17:29:33 -07004393func addRenegotiationTests() {
David Benjamin44d3eed2015-05-21 01:29:55 -04004394 // Servers cannot renegotiate.
David Benjaminb16346b2015-04-08 19:16:58 -04004395 testCases = append(testCases, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004396 testType: serverTest,
4397 name: "Renegotiate-Server-Forbidden",
4398 config: Config{
4399 MaxVersion: VersionTLS12,
4400 },
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004401 renegotiate: 1,
David Benjaminb16346b2015-04-08 19:16:58 -04004402 shouldFail: true,
4403 expectedError: ":NO_RENEGOTIATION:",
4404 expectedLocalError: "remote error: no renegotiation",
4405 })
Adam Langley5021b222015-06-12 18:27:58 -07004406 // The server shouldn't echo the renegotiation extension unless
4407 // requested by the client.
4408 testCases = append(testCases, testCase{
4409 testType: serverTest,
4410 name: "Renegotiate-Server-NoExt",
4411 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004412 MaxVersion: VersionTLS12,
Adam Langley5021b222015-06-12 18:27:58 -07004413 Bugs: ProtocolBugs{
4414 NoRenegotiationInfo: true,
4415 RequireRenegotiationInfo: true,
4416 },
4417 },
4418 shouldFail: true,
4419 expectedLocalError: "renegotiation extension missing",
4420 })
4421 // The renegotiation SCSV should be sufficient for the server to echo
4422 // the extension.
4423 testCases = append(testCases, testCase{
4424 testType: serverTest,
4425 name: "Renegotiate-Server-NoExt-SCSV",
4426 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004427 MaxVersion: VersionTLS12,
Adam Langley5021b222015-06-12 18:27:58 -07004428 Bugs: ProtocolBugs{
4429 NoRenegotiationInfo: true,
4430 SendRenegotiationSCSV: true,
4431 RequireRenegotiationInfo: true,
4432 },
4433 },
4434 })
Adam Langleycf2d4f42014-10-28 19:06:14 -07004435 testCases = append(testCases, testCase{
David Benjamin4b27d9f2015-05-12 22:42:52 -04004436 name: "Renegotiate-Client",
David Benjamincdea40c2015-03-19 14:09:43 -04004437 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004438 MaxVersion: VersionTLS12,
David Benjamincdea40c2015-03-19 14:09:43 -04004439 Bugs: ProtocolBugs{
David Benjamin4b27d9f2015-05-12 22:42:52 -04004440 FailIfResumeOnRenego: true,
David Benjamincdea40c2015-03-19 14:09:43 -04004441 },
4442 },
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004443 renegotiate: 1,
4444 flags: []string{
4445 "-renegotiate-freely",
4446 "-expect-total-renegotiations", "1",
4447 },
David Benjamincdea40c2015-03-19 14:09:43 -04004448 })
4449 testCases = append(testCases, testCase{
Adam Langleycf2d4f42014-10-28 19:06:14 -07004450 name: "Renegotiate-Client-EmptyExt",
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004451 renegotiate: 1,
Adam Langleycf2d4f42014-10-28 19:06:14 -07004452 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004453 MaxVersion: VersionTLS12,
Adam Langleycf2d4f42014-10-28 19:06:14 -07004454 Bugs: ProtocolBugs{
4455 EmptyRenegotiationInfo: true,
4456 },
4457 },
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004458 flags: []string{"-renegotiate-freely"},
Adam Langleycf2d4f42014-10-28 19:06:14 -07004459 shouldFail: true,
4460 expectedError: ":RENEGOTIATION_MISMATCH:",
4461 })
4462 testCases = append(testCases, testCase{
4463 name: "Renegotiate-Client-BadExt",
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004464 renegotiate: 1,
Adam Langleycf2d4f42014-10-28 19:06:14 -07004465 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004466 MaxVersion: VersionTLS12,
Adam Langleycf2d4f42014-10-28 19:06:14 -07004467 Bugs: ProtocolBugs{
4468 BadRenegotiationInfo: true,
4469 },
4470 },
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004471 flags: []string{"-renegotiate-freely"},
Adam Langleycf2d4f42014-10-28 19:06:14 -07004472 shouldFail: true,
4473 expectedError: ":RENEGOTIATION_MISMATCH:",
4474 })
4475 testCases = append(testCases, testCase{
David Benjamin3e052de2015-11-25 20:10:31 -05004476 name: "Renegotiate-Client-Downgrade",
4477 renegotiate: 1,
4478 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004479 MaxVersion: VersionTLS12,
David Benjamin3e052de2015-11-25 20:10:31 -05004480 Bugs: ProtocolBugs{
4481 NoRenegotiationInfoAfterInitial: true,
4482 },
4483 },
4484 flags: []string{"-renegotiate-freely"},
4485 shouldFail: true,
4486 expectedError: ":RENEGOTIATION_MISMATCH:",
4487 })
4488 testCases = append(testCases, testCase{
4489 name: "Renegotiate-Client-Upgrade",
4490 renegotiate: 1,
4491 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004492 MaxVersion: VersionTLS12,
David Benjamin3e052de2015-11-25 20:10:31 -05004493 Bugs: ProtocolBugs{
4494 NoRenegotiationInfoInInitial: true,
4495 },
4496 },
4497 flags: []string{"-renegotiate-freely"},
4498 shouldFail: true,
4499 expectedError: ":RENEGOTIATION_MISMATCH:",
4500 })
4501 testCases = append(testCases, testCase{
David Benjamincff0b902015-05-15 23:09:47 -04004502 name: "Renegotiate-Client-NoExt-Allowed",
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004503 renegotiate: 1,
David Benjamincff0b902015-05-15 23:09:47 -04004504 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004505 MaxVersion: VersionTLS12,
David Benjamincff0b902015-05-15 23:09:47 -04004506 Bugs: ProtocolBugs{
4507 NoRenegotiationInfo: true,
4508 },
4509 },
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004510 flags: []string{
4511 "-renegotiate-freely",
4512 "-expect-total-renegotiations", "1",
4513 },
David Benjamincff0b902015-05-15 23:09:47 -04004514 })
4515 testCases = append(testCases, testCase{
Adam Langleycf2d4f42014-10-28 19:06:14 -07004516 name: "Renegotiate-Client-SwitchCiphers",
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004517 renegotiate: 1,
Adam Langleycf2d4f42014-10-28 19:06:14 -07004518 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07004519 MaxVersion: VersionTLS12,
Adam Langleycf2d4f42014-10-28 19:06:14 -07004520 CipherSuites: []uint16{TLS_RSA_WITH_RC4_128_SHA},
4521 },
4522 renegotiateCiphers: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004523 flags: []string{
4524 "-renegotiate-freely",
4525 "-expect-total-renegotiations", "1",
4526 },
Adam Langleycf2d4f42014-10-28 19:06:14 -07004527 })
4528 testCases = append(testCases, testCase{
4529 name: "Renegotiate-Client-SwitchCiphers2",
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004530 renegotiate: 1,
Adam Langleycf2d4f42014-10-28 19:06:14 -07004531 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07004532 MaxVersion: VersionTLS12,
Adam Langleycf2d4f42014-10-28 19:06:14 -07004533 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
4534 },
4535 renegotiateCiphers: []uint16{TLS_RSA_WITH_RC4_128_SHA},
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004536 flags: []string{
4537 "-renegotiate-freely",
4538 "-expect-total-renegotiations", "1",
4539 },
David Benjaminb16346b2015-04-08 19:16:58 -04004540 })
4541 testCases = append(testCases, testCase{
David Benjaminc44b1df2014-11-23 12:11:01 -05004542 name: "Renegotiate-SameClientVersion",
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004543 renegotiate: 1,
David Benjaminc44b1df2014-11-23 12:11:01 -05004544 config: Config{
4545 MaxVersion: VersionTLS10,
4546 Bugs: ProtocolBugs{
4547 RequireSameRenegoClientVersion: true,
4548 },
4549 },
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004550 flags: []string{
4551 "-renegotiate-freely",
4552 "-expect-total-renegotiations", "1",
4553 },
David Benjaminc44b1df2014-11-23 12:11:01 -05004554 })
Adam Langleyb558c4c2015-07-08 12:16:38 -07004555 testCases = append(testCases, testCase{
4556 name: "Renegotiate-FalseStart",
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004557 renegotiate: 1,
Adam Langleyb558c4c2015-07-08 12:16:38 -07004558 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07004559 MaxVersion: VersionTLS12,
Adam Langleyb558c4c2015-07-08 12:16:38 -07004560 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
4561 NextProtos: []string{"foo"},
4562 },
4563 flags: []string{
4564 "-false-start",
4565 "-select-next-proto", "foo",
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004566 "-renegotiate-freely",
David Benjamin324dce42015-10-12 19:49:00 -04004567 "-expect-total-renegotiations", "1",
Adam Langleyb558c4c2015-07-08 12:16:38 -07004568 },
4569 shimWritesFirst: true,
4570 })
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004571
4572 // Client-side renegotiation controls.
4573 testCases = append(testCases, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004574 name: "Renegotiate-Client-Forbidden-1",
4575 config: Config{
4576 MaxVersion: VersionTLS12,
4577 },
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004578 renegotiate: 1,
4579 shouldFail: true,
4580 expectedError: ":NO_RENEGOTIATION:",
4581 expectedLocalError: "remote error: no renegotiation",
4582 })
4583 testCases = append(testCases, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004584 name: "Renegotiate-Client-Once-1",
4585 config: Config{
4586 MaxVersion: VersionTLS12,
4587 },
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004588 renegotiate: 1,
4589 flags: []string{
4590 "-renegotiate-once",
4591 "-expect-total-renegotiations", "1",
4592 },
4593 })
4594 testCases = append(testCases, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004595 name: "Renegotiate-Client-Freely-1",
4596 config: Config{
4597 MaxVersion: VersionTLS12,
4598 },
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004599 renegotiate: 1,
4600 flags: []string{
4601 "-renegotiate-freely",
4602 "-expect-total-renegotiations", "1",
4603 },
4604 })
4605 testCases = append(testCases, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004606 name: "Renegotiate-Client-Once-2",
4607 config: Config{
4608 MaxVersion: VersionTLS12,
4609 },
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004610 renegotiate: 2,
4611 flags: []string{"-renegotiate-once"},
4612 shouldFail: true,
4613 expectedError: ":NO_RENEGOTIATION:",
4614 expectedLocalError: "remote error: no renegotiation",
4615 })
4616 testCases = append(testCases, testCase{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004617 name: "Renegotiate-Client-Freely-2",
4618 config: Config{
4619 MaxVersion: VersionTLS12,
4620 },
David Benjamin1d5ef3b2015-10-12 19:54:18 -04004621 renegotiate: 2,
4622 flags: []string{
4623 "-renegotiate-freely",
4624 "-expect-total-renegotiations", "2",
4625 },
4626 })
Adam Langley27a0d082015-11-03 13:34:10 -08004627 testCases = append(testCases, testCase{
4628 name: "Renegotiate-Client-NoIgnore",
4629 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004630 MaxVersion: VersionTLS12,
Adam Langley27a0d082015-11-03 13:34:10 -08004631 Bugs: ProtocolBugs{
4632 SendHelloRequestBeforeEveryAppDataRecord: true,
4633 },
4634 },
4635 shouldFail: true,
4636 expectedError: ":NO_RENEGOTIATION:",
4637 })
4638 testCases = append(testCases, testCase{
4639 name: "Renegotiate-Client-Ignore",
4640 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04004641 MaxVersion: VersionTLS12,
Adam Langley27a0d082015-11-03 13:34:10 -08004642 Bugs: ProtocolBugs{
4643 SendHelloRequestBeforeEveryAppDataRecord: true,
4644 },
4645 },
4646 flags: []string{
4647 "-renegotiate-ignore",
4648 "-expect-total-renegotiations", "0",
4649 },
4650 })
David Benjamin4c3ddf72016-06-29 18:13:53 -04004651
David Benjamin397c8e62016-07-08 14:14:36 -07004652 // Stray HelloRequests during the handshake are ignored in TLS 1.2.
David Benjamin71dd6662016-07-08 14:10:48 -07004653 testCases = append(testCases, testCase{
4654 name: "StrayHelloRequest",
4655 config: Config{
4656 MaxVersion: VersionTLS12,
4657 Bugs: ProtocolBugs{
4658 SendHelloRequestBeforeEveryHandshakeMessage: true,
4659 },
4660 },
4661 })
4662 testCases = append(testCases, testCase{
4663 name: "StrayHelloRequest-Packed",
4664 config: Config{
4665 MaxVersion: VersionTLS12,
4666 Bugs: ProtocolBugs{
4667 PackHandshakeFlight: true,
4668 SendHelloRequestBeforeEveryHandshakeMessage: true,
4669 },
4670 },
4671 })
4672
David Benjamin397c8e62016-07-08 14:14:36 -07004673 // Renegotiation is forbidden in TLS 1.3.
4674 testCases = append(testCases, testCase{
4675 name: "Renegotiate-Client-TLS13",
4676 config: Config{
4677 MaxVersion: VersionTLS13,
4678 },
4679 renegotiate: 1,
4680 flags: []string{
4681 "-renegotiate-freely",
4682 },
4683 shouldFail: true,
4684 expectedError: ":NO_RENEGOTIATION:",
4685 })
4686
4687 // Stray HelloRequests during the handshake are forbidden in TLS 1.3.
4688 testCases = append(testCases, testCase{
4689 name: "StrayHelloRequest-TLS13",
4690 config: Config{
4691 MaxVersion: VersionTLS13,
4692 Bugs: ProtocolBugs{
4693 SendHelloRequestBeforeEveryHandshakeMessage: true,
4694 },
4695 },
4696 shouldFail: true,
4697 expectedError: ":UNEXPECTED_MESSAGE:",
4698 })
Adam Langley2ae77d22014-10-28 17:29:33 -07004699}
4700
David Benjamin5e961c12014-11-07 01:48:35 -05004701func addDTLSReplayTests() {
4702 // Test that sequence number replays are detected.
4703 testCases = append(testCases, testCase{
4704 protocol: dtls,
4705 name: "DTLS-Replay",
David Benjamin8e6db492015-07-25 18:29:23 -04004706 messageCount: 200,
David Benjamin5e961c12014-11-07 01:48:35 -05004707 replayWrites: true,
4708 })
4709
David Benjamin8e6db492015-07-25 18:29:23 -04004710 // Test the incoming sequence number skipping by values larger
David Benjamin5e961c12014-11-07 01:48:35 -05004711 // than the retransmit window.
4712 testCases = append(testCases, testCase{
4713 protocol: dtls,
4714 name: "DTLS-Replay-LargeGaps",
4715 config: Config{
4716 Bugs: ProtocolBugs{
David Benjamin8e6db492015-07-25 18:29:23 -04004717 SequenceNumberMapping: func(in uint64) uint64 {
4718 return in * 127
4719 },
David Benjamin5e961c12014-11-07 01:48:35 -05004720 },
4721 },
David Benjamin8e6db492015-07-25 18:29:23 -04004722 messageCount: 200,
4723 replayWrites: true,
4724 })
4725
4726 // Test the incoming sequence number changing non-monotonically.
4727 testCases = append(testCases, testCase{
4728 protocol: dtls,
4729 name: "DTLS-Replay-NonMonotonic",
4730 config: Config{
4731 Bugs: ProtocolBugs{
4732 SequenceNumberMapping: func(in uint64) uint64 {
4733 return in ^ 31
4734 },
4735 },
4736 },
4737 messageCount: 200,
David Benjamin5e961c12014-11-07 01:48:35 -05004738 replayWrites: true,
4739 })
4740}
4741
Nick Harper60edffd2016-06-21 15:19:24 -07004742var testSignatureAlgorithms = []struct {
David Benjamin000800a2014-11-14 01:43:59 -05004743 name string
Nick Harper60edffd2016-06-21 15:19:24 -07004744 id signatureAlgorithm
4745 cert testCert
David Benjamin000800a2014-11-14 01:43:59 -05004746}{
Nick Harper60edffd2016-06-21 15:19:24 -07004747 {"RSA-PKCS1-SHA1", signatureRSAPKCS1WithSHA1, testCertRSA},
4748 {"RSA-PKCS1-SHA256", signatureRSAPKCS1WithSHA256, testCertRSA},
4749 {"RSA-PKCS1-SHA384", signatureRSAPKCS1WithSHA384, testCertRSA},
4750 {"RSA-PKCS1-SHA512", signatureRSAPKCS1WithSHA512, testCertRSA},
David Benjamin33863262016-07-08 17:20:12 -07004751 {"ECDSA-SHA1", signatureECDSAWithSHA1, testCertECDSAP256},
David Benjamin33863262016-07-08 17:20:12 -07004752 {"ECDSA-P256-SHA256", signatureECDSAWithP256AndSHA256, testCertECDSAP256},
4753 {"ECDSA-P384-SHA384", signatureECDSAWithP384AndSHA384, testCertECDSAP384},
4754 {"ECDSA-P521-SHA512", signatureECDSAWithP521AndSHA512, testCertECDSAP521},
Steven Valdezeff1e8d2016-07-06 14:24:47 -04004755 {"RSA-PSS-SHA256", signatureRSAPSSWithSHA256, testCertRSA},
4756 {"RSA-PSS-SHA384", signatureRSAPSSWithSHA384, testCertRSA},
4757 {"RSA-PSS-SHA512", signatureRSAPSSWithSHA512, testCertRSA},
David Benjamin5208fd42016-07-13 21:43:25 -04004758 // Tests for key types prior to TLS 1.2.
4759 {"RSA", 0, testCertRSA},
4760 {"ECDSA", 0, testCertECDSAP256},
David Benjamin000800a2014-11-14 01:43:59 -05004761}
4762
Nick Harper60edffd2016-06-21 15:19:24 -07004763const fakeSigAlg1 signatureAlgorithm = 0x2a01
4764const fakeSigAlg2 signatureAlgorithm = 0xff01
4765
4766func addSignatureAlgorithmTests() {
David Benjamin5208fd42016-07-13 21:43:25 -04004767 // Not all ciphers involve a signature. Advertise a list which gives all
4768 // versions a signing cipher.
4769 signingCiphers := []uint16{
4770 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
4771 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
4772 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
4773 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
4774 TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
4775 }
4776
David Benjaminca3d5452016-07-14 12:51:01 -04004777 var allAlgorithms []signatureAlgorithm
4778 for _, alg := range testSignatureAlgorithms {
4779 if alg.id != 0 {
4780 allAlgorithms = append(allAlgorithms, alg.id)
4781 }
4782 }
4783
Nick Harper60edffd2016-06-21 15:19:24 -07004784 // Make sure each signature algorithm works. Include some fake values in
4785 // the list and ensure they're ignored.
4786 for _, alg := range testSignatureAlgorithms {
David Benjamin1fb125c2016-07-08 18:52:12 -07004787 for _, ver := range tlsVersions {
David Benjamin5208fd42016-07-13 21:43:25 -04004788 if (ver.version < VersionTLS12) != (alg.id == 0) {
4789 continue
4790 }
4791
4792 // TODO(davidben): Support ECDSA in SSL 3.0 in Go for testing
4793 // or remove it in C.
4794 if ver.version == VersionSSL30 && alg.cert != testCertRSA {
David Benjamin1fb125c2016-07-08 18:52:12 -07004795 continue
4796 }
Nick Harper60edffd2016-06-21 15:19:24 -07004797
Steven Valdezeff1e8d2016-07-06 14:24:47 -04004798 var shouldFail bool
David Benjamin1fb125c2016-07-08 18:52:12 -07004799 // ecdsa_sha1 does not exist in TLS 1.3.
Steven Valdezeff1e8d2016-07-06 14:24:47 -04004800 if ver.version >= VersionTLS13 && alg.id == signatureECDSAWithSHA1 {
4801 shouldFail = true
4802 }
4803 // RSA-PSS does not exist in TLS 1.2.
4804 if ver.version == VersionTLS12 && hasComponent(alg.name, "PSS") {
4805 shouldFail = true
4806 }
4807
4808 var signError, verifyError string
4809 if shouldFail {
4810 signError = ":NO_COMMON_SIGNATURE_ALGORITHMS:"
4811 verifyError = ":WRONG_SIGNATURE_TYPE:"
David Benjamin1fb125c2016-07-08 18:52:12 -07004812 }
David Benjamin000800a2014-11-14 01:43:59 -05004813
David Benjamin1fb125c2016-07-08 18:52:12 -07004814 suffix := "-" + alg.name + "-" + ver.name
David Benjamin6e807652015-11-02 12:02:20 -05004815
David Benjamin7a41d372016-07-09 11:21:54 -07004816 testCases = append(testCases, testCase{
David Benjaminbbfff7c2016-07-13 21:08:33 -04004817 name: "ClientAuth-Sign" + suffix,
David Benjamin7a41d372016-07-09 11:21:54 -07004818 config: Config{
4819 MaxVersion: ver.version,
4820 ClientAuth: RequireAnyClientCert,
4821 VerifySignatureAlgorithms: []signatureAlgorithm{
4822 fakeSigAlg1,
4823 alg.id,
4824 fakeSigAlg2,
David Benjamin1fb125c2016-07-08 18:52:12 -07004825 },
David Benjamin7a41d372016-07-09 11:21:54 -07004826 },
4827 flags: []string{
4828 "-cert-file", path.Join(*resourceDir, getShimCertificate(alg.cert)),
4829 "-key-file", path.Join(*resourceDir, getShimKey(alg.cert)),
4830 "-enable-all-curves",
4831 },
4832 shouldFail: shouldFail,
4833 expectedError: signError,
4834 expectedPeerSignatureAlgorithm: alg.id,
4835 })
Steven Valdezeff1e8d2016-07-06 14:24:47 -04004836
David Benjamin7a41d372016-07-09 11:21:54 -07004837 testCases = append(testCases, testCase{
4838 testType: serverTest,
David Benjaminbbfff7c2016-07-13 21:08:33 -04004839 name: "ClientAuth-Verify" + suffix,
David Benjamin7a41d372016-07-09 11:21:54 -07004840 config: Config{
4841 MaxVersion: ver.version,
4842 Certificates: []Certificate{getRunnerCertificate(alg.cert)},
4843 SignSignatureAlgorithms: []signatureAlgorithm{
4844 alg.id,
Steven Valdezeff1e8d2016-07-06 14:24:47 -04004845 },
David Benjamin7a41d372016-07-09 11:21:54 -07004846 Bugs: ProtocolBugs{
4847 SkipECDSACurveCheck: shouldFail,
4848 IgnoreSignatureVersionChecks: shouldFail,
4849 // The client won't advertise 1.3-only algorithms after
4850 // version negotiation.
4851 IgnorePeerSignatureAlgorithmPreferences: shouldFail,
Steven Valdezeff1e8d2016-07-06 14:24:47 -04004852 },
David Benjamin7a41d372016-07-09 11:21:54 -07004853 },
4854 flags: []string{
4855 "-require-any-client-certificate",
4856 "-expect-peer-signature-algorithm", strconv.Itoa(int(alg.id)),
4857 "-enable-all-curves",
4858 },
4859 shouldFail: shouldFail,
4860 expectedError: verifyError,
4861 })
David Benjamin1fb125c2016-07-08 18:52:12 -07004862
4863 testCases = append(testCases, testCase{
4864 testType: serverTest,
David Benjaminbbfff7c2016-07-13 21:08:33 -04004865 name: "ServerAuth-Sign" + suffix,
David Benjamin1fb125c2016-07-08 18:52:12 -07004866 config: Config{
David Benjamin5208fd42016-07-13 21:43:25 -04004867 MaxVersion: ver.version,
4868 CipherSuites: signingCiphers,
David Benjamin7a41d372016-07-09 11:21:54 -07004869 VerifySignatureAlgorithms: []signatureAlgorithm{
David Benjamin1fb125c2016-07-08 18:52:12 -07004870 fakeSigAlg1,
4871 alg.id,
4872 fakeSigAlg2,
4873 },
4874 },
4875 flags: []string{
4876 "-cert-file", path.Join(*resourceDir, getShimCertificate(alg.cert)),
4877 "-key-file", path.Join(*resourceDir, getShimKey(alg.cert)),
4878 "-enable-all-curves",
4879 },
Steven Valdezeff1e8d2016-07-06 14:24:47 -04004880 shouldFail: shouldFail,
4881 expectedError: signError,
David Benjamin1fb125c2016-07-08 18:52:12 -07004882 expectedPeerSignatureAlgorithm: alg.id,
4883 })
4884
4885 testCases = append(testCases, testCase{
David Benjaminbbfff7c2016-07-13 21:08:33 -04004886 name: "ServerAuth-Verify" + suffix,
David Benjamin1fb125c2016-07-08 18:52:12 -07004887 config: Config{
4888 MaxVersion: ver.version,
4889 Certificates: []Certificate{getRunnerCertificate(alg.cert)},
David Benjamin5208fd42016-07-13 21:43:25 -04004890 CipherSuites: signingCiphers,
David Benjamin7a41d372016-07-09 11:21:54 -07004891 SignSignatureAlgorithms: []signatureAlgorithm{
David Benjamin1fb125c2016-07-08 18:52:12 -07004892 alg.id,
4893 },
Steven Valdezeff1e8d2016-07-06 14:24:47 -04004894 Bugs: ProtocolBugs{
4895 SkipECDSACurveCheck: shouldFail,
4896 IgnoreSignatureVersionChecks: shouldFail,
4897 },
David Benjamin1fb125c2016-07-08 18:52:12 -07004898 },
4899 flags: []string{
4900 "-expect-peer-signature-algorithm", strconv.Itoa(int(alg.id)),
4901 "-enable-all-curves",
4902 },
Steven Valdezeff1e8d2016-07-06 14:24:47 -04004903 shouldFail: shouldFail,
4904 expectedError: verifyError,
David Benjamin1fb125c2016-07-08 18:52:12 -07004905 })
David Benjamin5208fd42016-07-13 21:43:25 -04004906
4907 if !shouldFail {
4908 testCases = append(testCases, testCase{
4909 testType: serverTest,
4910 name: "ClientAuth-InvalidSignature" + suffix,
4911 config: Config{
4912 MaxVersion: ver.version,
4913 Certificates: []Certificate{getRunnerCertificate(alg.cert)},
4914 SignSignatureAlgorithms: []signatureAlgorithm{
4915 alg.id,
4916 },
4917 Bugs: ProtocolBugs{
4918 InvalidSignature: true,
4919 },
4920 },
4921 flags: []string{
4922 "-require-any-client-certificate",
4923 "-enable-all-curves",
4924 },
4925 shouldFail: true,
4926 expectedError: ":BAD_SIGNATURE:",
4927 })
4928
4929 testCases = append(testCases, testCase{
4930 name: "ServerAuth-InvalidSignature" + suffix,
4931 config: Config{
4932 MaxVersion: ver.version,
4933 Certificates: []Certificate{getRunnerCertificate(alg.cert)},
4934 CipherSuites: signingCiphers,
4935 SignSignatureAlgorithms: []signatureAlgorithm{
4936 alg.id,
4937 },
4938 Bugs: ProtocolBugs{
4939 InvalidSignature: true,
4940 },
4941 },
4942 flags: []string{"-enable-all-curves"},
4943 shouldFail: true,
4944 expectedError: ":BAD_SIGNATURE:",
4945 })
4946 }
David Benjaminca3d5452016-07-14 12:51:01 -04004947
4948 if ver.version >= VersionTLS12 && !shouldFail {
4949 testCases = append(testCases, testCase{
4950 name: "ClientAuth-Sign-Negotiate" + suffix,
4951 config: Config{
4952 MaxVersion: ver.version,
4953 ClientAuth: RequireAnyClientCert,
4954 VerifySignatureAlgorithms: allAlgorithms,
4955 },
4956 flags: []string{
4957 "-cert-file", path.Join(*resourceDir, getShimCertificate(alg.cert)),
4958 "-key-file", path.Join(*resourceDir, getShimKey(alg.cert)),
4959 "-enable-all-curves",
4960 "-signing-prefs", strconv.Itoa(int(alg.id)),
4961 },
4962 expectedPeerSignatureAlgorithm: alg.id,
4963 })
4964
4965 testCases = append(testCases, testCase{
4966 testType: serverTest,
4967 name: "ServerAuth-Sign-Negotiate" + suffix,
4968 config: Config{
4969 MaxVersion: ver.version,
4970 CipherSuites: signingCiphers,
4971 VerifySignatureAlgorithms: allAlgorithms,
4972 },
4973 flags: []string{
4974 "-cert-file", path.Join(*resourceDir, getShimCertificate(alg.cert)),
4975 "-key-file", path.Join(*resourceDir, getShimKey(alg.cert)),
4976 "-enable-all-curves",
4977 "-signing-prefs", strconv.Itoa(int(alg.id)),
4978 },
4979 expectedPeerSignatureAlgorithm: alg.id,
4980 })
4981 }
David Benjamin1fb125c2016-07-08 18:52:12 -07004982 }
David Benjamin000800a2014-11-14 01:43:59 -05004983 }
4984
Nick Harper60edffd2016-06-21 15:19:24 -07004985 // Test that algorithm selection takes the key type into account.
David Benjamin4c3ddf72016-06-29 18:13:53 -04004986 //
4987 // TODO(davidben): Test this in TLS 1.3.
David Benjamin000800a2014-11-14 01:43:59 -05004988 testCases = append(testCases, testCase{
David Benjaminbbfff7c2016-07-13 21:08:33 -04004989 name: "ClientAuth-SignatureType",
David Benjamin000800a2014-11-14 01:43:59 -05004990 config: Config{
4991 ClientAuth: RequireAnyClientCert,
David Benjamin4c3ddf72016-06-29 18:13:53 -04004992 MaxVersion: VersionTLS12,
David Benjamin7a41d372016-07-09 11:21:54 -07004993 VerifySignatureAlgorithms: []signatureAlgorithm{
Nick Harper60edffd2016-06-21 15:19:24 -07004994 signatureECDSAWithP521AndSHA512,
4995 signatureRSAPKCS1WithSHA384,
4996 signatureECDSAWithSHA1,
David Benjamin000800a2014-11-14 01:43:59 -05004997 },
4998 },
4999 flags: []string{
Adam Langley7c803a62015-06-15 15:35:05 -07005000 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
5001 "-key-file", path.Join(*resourceDir, rsaKeyFile),
David Benjamin000800a2014-11-14 01:43:59 -05005002 },
Nick Harper60edffd2016-06-21 15:19:24 -07005003 expectedPeerSignatureAlgorithm: signatureRSAPKCS1WithSHA384,
David Benjamin000800a2014-11-14 01:43:59 -05005004 })
5005
5006 testCases = append(testCases, testCase{
5007 testType: serverTest,
David Benjaminbbfff7c2016-07-13 21:08:33 -04005008 name: "ServerAuth-SignatureType",
David Benjamin000800a2014-11-14 01:43:59 -05005009 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005010 MaxVersion: VersionTLS12,
David Benjamin000800a2014-11-14 01:43:59 -05005011 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
David Benjamin7a41d372016-07-09 11:21:54 -07005012 VerifySignatureAlgorithms: []signatureAlgorithm{
Nick Harper60edffd2016-06-21 15:19:24 -07005013 signatureECDSAWithP521AndSHA512,
5014 signatureRSAPKCS1WithSHA384,
5015 signatureECDSAWithSHA1,
David Benjamin000800a2014-11-14 01:43:59 -05005016 },
5017 },
Nick Harper60edffd2016-06-21 15:19:24 -07005018 expectedPeerSignatureAlgorithm: signatureRSAPKCS1WithSHA384,
David Benjamin000800a2014-11-14 01:43:59 -05005019 })
5020
David Benjamina95e9f32016-07-08 16:28:04 -07005021 // Test that signature verification takes the key type into account.
5022 //
5023 // TODO(davidben): Test this in TLS 1.3.
5024 testCases = append(testCases, testCase{
5025 testType: serverTest,
5026 name: "Verify-ClientAuth-SignatureType",
5027 config: Config{
5028 MaxVersion: VersionTLS12,
5029 Certificates: []Certificate{rsaCertificate},
David Benjamin7a41d372016-07-09 11:21:54 -07005030 SignSignatureAlgorithms: []signatureAlgorithm{
David Benjamina95e9f32016-07-08 16:28:04 -07005031 signatureRSAPKCS1WithSHA256,
5032 },
5033 Bugs: ProtocolBugs{
5034 SendSignatureAlgorithm: signatureECDSAWithP256AndSHA256,
5035 },
5036 },
5037 flags: []string{
5038 "-require-any-client-certificate",
5039 },
5040 shouldFail: true,
5041 expectedError: ":WRONG_SIGNATURE_TYPE:",
5042 })
5043
5044 testCases = append(testCases, testCase{
David Benjaminbbfff7c2016-07-13 21:08:33 -04005045 name: "Verify-ServerAuth-SignatureType",
David Benjamina95e9f32016-07-08 16:28:04 -07005046 config: Config{
5047 MaxVersion: VersionTLS12,
5048 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
David Benjamin7a41d372016-07-09 11:21:54 -07005049 SignSignatureAlgorithms: []signatureAlgorithm{
David Benjamina95e9f32016-07-08 16:28:04 -07005050 signatureRSAPKCS1WithSHA256,
5051 },
5052 Bugs: ProtocolBugs{
5053 SendSignatureAlgorithm: signatureECDSAWithP256AndSHA256,
5054 },
5055 },
5056 shouldFail: true,
5057 expectedError: ":WRONG_SIGNATURE_TYPE:",
5058 })
5059
David Benjamin51dd7d62016-07-08 16:07:01 -07005060 // Test that, if the list is missing, the peer falls back to SHA-1 in
5061 // TLS 1.2, but not TLS 1.3.
David Benjamin000800a2014-11-14 01:43:59 -05005062 testCases = append(testCases, testCase{
David Benjaminbbfff7c2016-07-13 21:08:33 -04005063 name: "ClientAuth-SHA1-Fallback",
David Benjamin000800a2014-11-14 01:43:59 -05005064 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005065 MaxVersion: VersionTLS12,
David Benjamin000800a2014-11-14 01:43:59 -05005066 ClientAuth: RequireAnyClientCert,
David Benjamin7a41d372016-07-09 11:21:54 -07005067 VerifySignatureAlgorithms: []signatureAlgorithm{
Nick Harper60edffd2016-06-21 15:19:24 -07005068 signatureRSAPKCS1WithSHA1,
David Benjamin000800a2014-11-14 01:43:59 -05005069 },
5070 Bugs: ProtocolBugs{
Nick Harper60edffd2016-06-21 15:19:24 -07005071 NoSignatureAlgorithms: true,
David Benjamin000800a2014-11-14 01:43:59 -05005072 },
5073 },
5074 flags: []string{
Adam Langley7c803a62015-06-15 15:35:05 -07005075 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
5076 "-key-file", path.Join(*resourceDir, rsaKeyFile),
David Benjamin000800a2014-11-14 01:43:59 -05005077 },
5078 })
5079
5080 testCases = append(testCases, testCase{
5081 testType: serverTest,
David Benjaminbbfff7c2016-07-13 21:08:33 -04005082 name: "ServerAuth-SHA1-Fallback",
David Benjamin000800a2014-11-14 01:43:59 -05005083 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005084 MaxVersion: VersionTLS12,
David Benjamin000800a2014-11-14 01:43:59 -05005085 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
David Benjamin7a41d372016-07-09 11:21:54 -07005086 VerifySignatureAlgorithms: []signatureAlgorithm{
Nick Harper60edffd2016-06-21 15:19:24 -07005087 signatureRSAPKCS1WithSHA1,
David Benjamin000800a2014-11-14 01:43:59 -05005088 },
5089 Bugs: ProtocolBugs{
Nick Harper60edffd2016-06-21 15:19:24 -07005090 NoSignatureAlgorithms: true,
David Benjamin000800a2014-11-14 01:43:59 -05005091 },
5092 },
5093 })
David Benjamin72dc7832015-03-16 17:49:43 -04005094
David Benjamin51dd7d62016-07-08 16:07:01 -07005095 testCases = append(testCases, testCase{
David Benjaminbbfff7c2016-07-13 21:08:33 -04005096 name: "ClientAuth-NoFallback-TLS13",
David Benjamin51dd7d62016-07-08 16:07:01 -07005097 config: Config{
5098 MaxVersion: VersionTLS13,
5099 ClientAuth: RequireAnyClientCert,
David Benjamin7a41d372016-07-09 11:21:54 -07005100 VerifySignatureAlgorithms: []signatureAlgorithm{
David Benjamin51dd7d62016-07-08 16:07:01 -07005101 signatureRSAPKCS1WithSHA1,
5102 },
5103 Bugs: ProtocolBugs{
5104 NoSignatureAlgorithms: true,
5105 },
5106 },
5107 flags: []string{
5108 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
5109 "-key-file", path.Join(*resourceDir, rsaKeyFile),
5110 },
5111 shouldFail: true,
5112 expectedError: ":NO_COMMON_SIGNATURE_ALGORITHMS:",
5113 })
5114
5115 testCases = append(testCases, testCase{
5116 testType: serverTest,
David Benjaminbbfff7c2016-07-13 21:08:33 -04005117 name: "ServerAuth-NoFallback-TLS13",
David Benjamin51dd7d62016-07-08 16:07:01 -07005118 config: Config{
5119 MaxVersion: VersionTLS13,
5120 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
David Benjamin7a41d372016-07-09 11:21:54 -07005121 VerifySignatureAlgorithms: []signatureAlgorithm{
David Benjamin51dd7d62016-07-08 16:07:01 -07005122 signatureRSAPKCS1WithSHA1,
5123 },
5124 Bugs: ProtocolBugs{
5125 NoSignatureAlgorithms: true,
5126 },
5127 },
5128 shouldFail: true,
5129 expectedError: ":NO_COMMON_SIGNATURE_ALGORITHMS:",
5130 })
5131
David Benjamin72dc7832015-03-16 17:49:43 -04005132 // Test that hash preferences are enforced. BoringSSL defaults to
5133 // rejecting MD5 signatures.
5134 testCases = append(testCases, testCase{
5135 testType: serverTest,
David Benjaminbbfff7c2016-07-13 21:08:33 -04005136 name: "ClientAuth-Enforced",
David Benjamin72dc7832015-03-16 17:49:43 -04005137 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005138 MaxVersion: VersionTLS12,
David Benjamin72dc7832015-03-16 17:49:43 -04005139 Certificates: []Certificate{rsaCertificate},
David Benjamin7a41d372016-07-09 11:21:54 -07005140 SignSignatureAlgorithms: []signatureAlgorithm{
Nick Harper60edffd2016-06-21 15:19:24 -07005141 signatureRSAPKCS1WithMD5,
David Benjamin72dc7832015-03-16 17:49:43 -04005142 // Advertise SHA-1 so the handshake will
5143 // proceed, but the shim's preferences will be
5144 // ignored in CertificateVerify generation, so
5145 // MD5 will be chosen.
Nick Harper60edffd2016-06-21 15:19:24 -07005146 signatureRSAPKCS1WithSHA1,
David Benjamin72dc7832015-03-16 17:49:43 -04005147 },
5148 Bugs: ProtocolBugs{
5149 IgnorePeerSignatureAlgorithmPreferences: true,
5150 },
5151 },
5152 flags: []string{"-require-any-client-certificate"},
5153 shouldFail: true,
5154 expectedError: ":WRONG_SIGNATURE_TYPE:",
5155 })
5156
5157 testCases = append(testCases, testCase{
David Benjaminbbfff7c2016-07-13 21:08:33 -04005158 name: "ServerAuth-Enforced",
David Benjamin72dc7832015-03-16 17:49:43 -04005159 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005160 MaxVersion: VersionTLS12,
David Benjamin72dc7832015-03-16 17:49:43 -04005161 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
David Benjamin7a41d372016-07-09 11:21:54 -07005162 SignSignatureAlgorithms: []signatureAlgorithm{
Nick Harper60edffd2016-06-21 15:19:24 -07005163 signatureRSAPKCS1WithMD5,
David Benjamin72dc7832015-03-16 17:49:43 -04005164 },
5165 Bugs: ProtocolBugs{
5166 IgnorePeerSignatureAlgorithmPreferences: true,
5167 },
5168 },
5169 shouldFail: true,
5170 expectedError: ":WRONG_SIGNATURE_TYPE:",
5171 })
Steven Valdez0d62f262015-09-04 12:41:04 -04005172
5173 // Test that the agreed upon digest respects the client preferences and
5174 // the server digests.
David Benjamin4c3ddf72016-06-29 18:13:53 -04005175 //
5176 // TODO(davidben): Add TLS 1.3 versions of these.
Steven Valdez0d62f262015-09-04 12:41:04 -04005177 testCases = append(testCases, testCase{
David Benjaminca3d5452016-07-14 12:51:01 -04005178 name: "NoCommonAlgorithms-Digests",
5179 config: Config{
5180 MaxVersion: VersionTLS12,
5181 ClientAuth: RequireAnyClientCert,
5182 VerifySignatureAlgorithms: []signatureAlgorithm{
5183 signatureRSAPKCS1WithSHA512,
5184 signatureRSAPKCS1WithSHA1,
5185 },
5186 },
5187 flags: []string{
5188 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
5189 "-key-file", path.Join(*resourceDir, rsaKeyFile),
5190 "-digest-prefs", "SHA256",
5191 },
5192 shouldFail: true,
5193 expectedError: ":NO_COMMON_SIGNATURE_ALGORITHMS:",
5194 })
5195 testCases = append(testCases, testCase{
David Benjaminea9a0d52016-07-08 15:52:59 -07005196 name: "NoCommonAlgorithms",
Steven Valdez0d62f262015-09-04 12:41:04 -04005197 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005198 MaxVersion: VersionTLS12,
Steven Valdez0d62f262015-09-04 12:41:04 -04005199 ClientAuth: RequireAnyClientCert,
David Benjamin7a41d372016-07-09 11:21:54 -07005200 VerifySignatureAlgorithms: []signatureAlgorithm{
Nick Harper60edffd2016-06-21 15:19:24 -07005201 signatureRSAPKCS1WithSHA512,
5202 signatureRSAPKCS1WithSHA1,
Steven Valdez0d62f262015-09-04 12:41:04 -04005203 },
5204 },
5205 flags: []string{
5206 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
5207 "-key-file", path.Join(*resourceDir, rsaKeyFile),
David Benjaminca3d5452016-07-14 12:51:01 -04005208 "-signing-prefs", strconv.Itoa(int(signatureRSAPKCS1WithSHA256)),
Steven Valdez0d62f262015-09-04 12:41:04 -04005209 },
David Benjaminca3d5452016-07-14 12:51:01 -04005210 shouldFail: true,
5211 expectedError: ":NO_COMMON_SIGNATURE_ALGORITHMS:",
5212 })
5213 testCases = append(testCases, testCase{
5214 name: "NoCommonAlgorithms-TLS13",
5215 config: Config{
5216 MaxVersion: VersionTLS13,
5217 ClientAuth: RequireAnyClientCert,
5218 VerifySignatureAlgorithms: []signatureAlgorithm{
5219 signatureRSAPSSWithSHA512,
5220 signatureRSAPSSWithSHA384,
5221 },
5222 },
5223 flags: []string{
5224 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
5225 "-key-file", path.Join(*resourceDir, rsaKeyFile),
5226 "-signing-prefs", strconv.Itoa(int(signatureRSAPSSWithSHA256)),
5227 },
David Benjaminea9a0d52016-07-08 15:52:59 -07005228 shouldFail: true,
5229 expectedError: ":NO_COMMON_SIGNATURE_ALGORITHMS:",
Steven Valdez0d62f262015-09-04 12:41:04 -04005230 })
5231 testCases = append(testCases, testCase{
5232 name: "Agree-Digest-SHA256",
5233 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005234 MaxVersion: VersionTLS12,
Steven Valdez0d62f262015-09-04 12:41:04 -04005235 ClientAuth: RequireAnyClientCert,
David Benjamin7a41d372016-07-09 11:21:54 -07005236 VerifySignatureAlgorithms: []signatureAlgorithm{
Nick Harper60edffd2016-06-21 15:19:24 -07005237 signatureRSAPKCS1WithSHA1,
5238 signatureRSAPKCS1WithSHA256,
Steven Valdez0d62f262015-09-04 12:41:04 -04005239 },
5240 },
5241 flags: []string{
5242 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
5243 "-key-file", path.Join(*resourceDir, rsaKeyFile),
David Benjaminca3d5452016-07-14 12:51:01 -04005244 "-digest-prefs", "SHA256,SHA1",
Steven Valdez0d62f262015-09-04 12:41:04 -04005245 },
Nick Harper60edffd2016-06-21 15:19:24 -07005246 expectedPeerSignatureAlgorithm: signatureRSAPKCS1WithSHA256,
Steven Valdez0d62f262015-09-04 12:41:04 -04005247 })
5248 testCases = append(testCases, testCase{
5249 name: "Agree-Digest-SHA1",
5250 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005251 MaxVersion: VersionTLS12,
Steven Valdez0d62f262015-09-04 12:41:04 -04005252 ClientAuth: RequireAnyClientCert,
David Benjamin7a41d372016-07-09 11:21:54 -07005253 VerifySignatureAlgorithms: []signatureAlgorithm{
Nick Harper60edffd2016-06-21 15:19:24 -07005254 signatureRSAPKCS1WithSHA1,
Steven Valdez0d62f262015-09-04 12:41:04 -04005255 },
5256 },
5257 flags: []string{
5258 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
5259 "-key-file", path.Join(*resourceDir, rsaKeyFile),
David Benjaminca3d5452016-07-14 12:51:01 -04005260 "-digest-prefs", "SHA512,SHA256,SHA1",
Steven Valdez0d62f262015-09-04 12:41:04 -04005261 },
Nick Harper60edffd2016-06-21 15:19:24 -07005262 expectedPeerSignatureAlgorithm: signatureRSAPKCS1WithSHA1,
Steven Valdez0d62f262015-09-04 12:41:04 -04005263 })
5264 testCases = append(testCases, testCase{
5265 name: "Agree-Digest-Default",
5266 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005267 MaxVersion: VersionTLS12,
Steven Valdez0d62f262015-09-04 12:41:04 -04005268 ClientAuth: RequireAnyClientCert,
David Benjamin7a41d372016-07-09 11:21:54 -07005269 VerifySignatureAlgorithms: []signatureAlgorithm{
Nick Harper60edffd2016-06-21 15:19:24 -07005270 signatureRSAPKCS1WithSHA256,
5271 signatureECDSAWithP256AndSHA256,
5272 signatureRSAPKCS1WithSHA1,
5273 signatureECDSAWithSHA1,
Steven Valdez0d62f262015-09-04 12:41:04 -04005274 },
5275 },
5276 flags: []string{
5277 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
5278 "-key-file", path.Join(*resourceDir, rsaKeyFile),
5279 },
Nick Harper60edffd2016-06-21 15:19:24 -07005280 expectedPeerSignatureAlgorithm: signatureRSAPKCS1WithSHA256,
Steven Valdez0d62f262015-09-04 12:41:04 -04005281 })
David Benjamin4c3ddf72016-06-29 18:13:53 -04005282
David Benjaminca3d5452016-07-14 12:51:01 -04005283 // Test that the signing preference list may include extra algorithms
5284 // without negotiation problems.
5285 testCases = append(testCases, testCase{
5286 testType: serverTest,
5287 name: "FilterExtraAlgorithms",
5288 config: Config{
5289 MaxVersion: VersionTLS12,
5290 VerifySignatureAlgorithms: []signatureAlgorithm{
5291 signatureRSAPKCS1WithSHA256,
5292 },
5293 },
5294 flags: []string{
5295 "-cert-file", path.Join(*resourceDir, rsaCertificateFile),
5296 "-key-file", path.Join(*resourceDir, rsaKeyFile),
5297 "-signing-prefs", strconv.Itoa(int(fakeSigAlg1)),
5298 "-signing-prefs", strconv.Itoa(int(signatureECDSAWithP256AndSHA256)),
5299 "-signing-prefs", strconv.Itoa(int(signatureRSAPKCS1WithSHA256)),
5300 "-signing-prefs", strconv.Itoa(int(fakeSigAlg2)),
5301 },
5302 expectedPeerSignatureAlgorithm: signatureRSAPKCS1WithSHA256,
5303 })
5304
David Benjamin4c3ddf72016-06-29 18:13:53 -04005305 // In TLS 1.2 and below, ECDSA uses the curve list rather than the
5306 // signature algorithms.
David Benjamin4c3ddf72016-06-29 18:13:53 -04005307 testCases = append(testCases, testCase{
5308 name: "CheckLeafCurve",
5309 config: Config{
5310 MaxVersion: VersionTLS12,
5311 CipherSuites: []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
David Benjamin33863262016-07-08 17:20:12 -07005312 Certificates: []Certificate{ecdsaP256Certificate},
David Benjamin4c3ddf72016-06-29 18:13:53 -04005313 },
5314 flags: []string{"-p384-only"},
5315 shouldFail: true,
5316 expectedError: ":BAD_ECC_CERT:",
5317 })
David Benjamin75ea5bb2016-07-08 17:43:29 -07005318
5319 // In TLS 1.3, ECDSA does not use the ECDHE curve list.
5320 testCases = append(testCases, testCase{
5321 name: "CheckLeafCurve-TLS13",
5322 config: Config{
5323 MaxVersion: VersionTLS13,
5324 CipherSuites: []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
5325 Certificates: []Certificate{ecdsaP256Certificate},
5326 },
5327 flags: []string{"-p384-only"},
5328 })
David Benjamin1fb125c2016-07-08 18:52:12 -07005329
5330 // In TLS 1.2, the ECDSA curve is not in the signature algorithm.
5331 testCases = append(testCases, testCase{
5332 name: "ECDSACurveMismatch-Verify-TLS12",
5333 config: Config{
5334 MaxVersion: VersionTLS12,
5335 CipherSuites: []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
5336 Certificates: []Certificate{ecdsaP256Certificate},
David Benjamin7a41d372016-07-09 11:21:54 -07005337 SignSignatureAlgorithms: []signatureAlgorithm{
David Benjamin1fb125c2016-07-08 18:52:12 -07005338 signatureECDSAWithP384AndSHA384,
5339 },
5340 },
5341 })
5342
5343 // In TLS 1.3, the ECDSA curve comes from the signature algorithm.
5344 testCases = append(testCases, testCase{
5345 name: "ECDSACurveMismatch-Verify-TLS13",
5346 config: Config{
5347 MaxVersion: VersionTLS13,
5348 CipherSuites: []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
5349 Certificates: []Certificate{ecdsaP256Certificate},
David Benjamin7a41d372016-07-09 11:21:54 -07005350 SignSignatureAlgorithms: []signatureAlgorithm{
David Benjamin1fb125c2016-07-08 18:52:12 -07005351 signatureECDSAWithP384AndSHA384,
5352 },
5353 Bugs: ProtocolBugs{
5354 SkipECDSACurveCheck: true,
5355 },
5356 },
5357 shouldFail: true,
5358 expectedError: ":WRONG_SIGNATURE_TYPE:",
5359 })
5360
5361 // Signature algorithm selection in TLS 1.3 should take the curve into
5362 // account.
5363 testCases = append(testCases, testCase{
5364 testType: serverTest,
5365 name: "ECDSACurveMismatch-Sign-TLS13",
5366 config: Config{
5367 MaxVersion: VersionTLS13,
5368 CipherSuites: []uint16{TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
David Benjamin7a41d372016-07-09 11:21:54 -07005369 VerifySignatureAlgorithms: []signatureAlgorithm{
David Benjamin1fb125c2016-07-08 18:52:12 -07005370 signatureECDSAWithP384AndSHA384,
5371 signatureECDSAWithP256AndSHA256,
5372 },
5373 },
5374 flags: []string{
5375 "-cert-file", path.Join(*resourceDir, ecdsaP256CertificateFile),
5376 "-key-file", path.Join(*resourceDir, ecdsaP256KeyFile),
5377 },
5378 expectedPeerSignatureAlgorithm: signatureECDSAWithP256AndSHA256,
5379 })
David Benjamin7944a9f2016-07-12 22:27:01 -04005380
5381 // RSASSA-PSS with SHA-512 is too large for 1024-bit RSA. Test that the
5382 // server does not attempt to sign in that case.
5383 testCases = append(testCases, testCase{
5384 testType: serverTest,
5385 name: "RSA-PSS-Large",
5386 config: Config{
5387 MaxVersion: VersionTLS13,
5388 VerifySignatureAlgorithms: []signatureAlgorithm{
5389 signatureRSAPSSWithSHA512,
5390 },
5391 },
5392 flags: []string{
5393 "-cert-file", path.Join(*resourceDir, rsa1024CertificateFile),
5394 "-key-file", path.Join(*resourceDir, rsa1024KeyFile),
5395 },
5396 shouldFail: true,
5397 expectedError: ":NO_COMMON_SIGNATURE_ALGORITHMS:",
5398 })
David Benjamin000800a2014-11-14 01:43:59 -05005399}
5400
David Benjamin83f90402015-01-27 01:09:43 -05005401// timeouts is the retransmit schedule for BoringSSL. It doubles and
5402// caps at 60 seconds. On the 13th timeout, it gives up.
5403var timeouts = []time.Duration{
5404 1 * time.Second,
5405 2 * time.Second,
5406 4 * time.Second,
5407 8 * time.Second,
5408 16 * time.Second,
5409 32 * time.Second,
5410 60 * time.Second,
5411 60 * time.Second,
5412 60 * time.Second,
5413 60 * time.Second,
5414 60 * time.Second,
5415 60 * time.Second,
5416 60 * time.Second,
5417}
5418
Taylor Brandstetter376a0fe2016-05-10 19:30:28 -07005419// shortTimeouts is an alternate set of timeouts which would occur if the
5420// initial timeout duration was set to 250ms.
5421var shortTimeouts = []time.Duration{
5422 250 * time.Millisecond,
5423 500 * time.Millisecond,
5424 1 * time.Second,
5425 2 * time.Second,
5426 4 * time.Second,
5427 8 * time.Second,
5428 16 * time.Second,
5429 32 * time.Second,
5430 60 * time.Second,
5431 60 * time.Second,
5432 60 * time.Second,
5433 60 * time.Second,
5434 60 * time.Second,
5435}
5436
David Benjamin83f90402015-01-27 01:09:43 -05005437func addDTLSRetransmitTests() {
David Benjamin585d7a42016-06-02 14:58:00 -04005438 // These tests work by coordinating some behavior on both the shim and
5439 // the runner.
5440 //
5441 // TimeoutSchedule configures the runner to send a series of timeout
5442 // opcodes to the shim (see packetAdaptor) immediately before reading
5443 // each peer handshake flight N. The timeout opcode both simulates a
5444 // timeout in the shim and acts as a synchronization point to help the
5445 // runner bracket each handshake flight.
5446 //
5447 // We assume the shim does not read from the channel eagerly. It must
5448 // first wait until it has sent flight N and is ready to receive
5449 // handshake flight N+1. At this point, it will process the timeout
5450 // opcode. It must then immediately respond with a timeout ACK and act
5451 // as if the shim was idle for the specified amount of time.
5452 //
5453 // The runner then drops all packets received before the ACK and
5454 // continues waiting for flight N. This ordering results in one attempt
5455 // at sending flight N to be dropped. For the test to complete, the
5456 // shim must send flight N again, testing that the shim implements DTLS
5457 // retransmit on a timeout.
5458
David Benjamin4c3ddf72016-06-29 18:13:53 -04005459 // TODO(davidben): Add TLS 1.3 versions of these tests. There will
5460 // likely be more epochs to cross and the final message's retransmit may
5461 // be more complex.
5462
David Benjamin585d7a42016-06-02 14:58:00 -04005463 for _, async := range []bool{true, false} {
5464 var tests []testCase
5465
5466 // Test that this is indeed the timeout schedule. Stress all
5467 // four patterns of handshake.
5468 for i := 1; i < len(timeouts); i++ {
5469 number := strconv.Itoa(i)
5470 tests = append(tests, testCase{
5471 protocol: dtls,
5472 name: "DTLS-Retransmit-Client-" + number,
5473 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005474 MaxVersion: VersionTLS12,
David Benjamin585d7a42016-06-02 14:58:00 -04005475 Bugs: ProtocolBugs{
5476 TimeoutSchedule: timeouts[:i],
5477 },
5478 },
5479 resumeSession: true,
5480 })
5481 tests = append(tests, testCase{
5482 protocol: dtls,
5483 testType: serverTest,
5484 name: "DTLS-Retransmit-Server-" + number,
5485 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005486 MaxVersion: VersionTLS12,
David Benjamin585d7a42016-06-02 14:58:00 -04005487 Bugs: ProtocolBugs{
5488 TimeoutSchedule: timeouts[:i],
5489 },
5490 },
5491 resumeSession: true,
5492 })
5493 }
5494
5495 // Test that exceeding the timeout schedule hits a read
5496 // timeout.
5497 tests = append(tests, testCase{
David Benjamin83f90402015-01-27 01:09:43 -05005498 protocol: dtls,
David Benjamin585d7a42016-06-02 14:58:00 -04005499 name: "DTLS-Retransmit-Timeout",
David Benjamin83f90402015-01-27 01:09:43 -05005500 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005501 MaxVersion: VersionTLS12,
David Benjamin83f90402015-01-27 01:09:43 -05005502 Bugs: ProtocolBugs{
David Benjamin585d7a42016-06-02 14:58:00 -04005503 TimeoutSchedule: timeouts,
David Benjamin83f90402015-01-27 01:09:43 -05005504 },
5505 },
5506 resumeSession: true,
David Benjamin585d7a42016-06-02 14:58:00 -04005507 shouldFail: true,
5508 expectedError: ":READ_TIMEOUT_EXPIRED:",
David Benjamin83f90402015-01-27 01:09:43 -05005509 })
David Benjamin585d7a42016-06-02 14:58:00 -04005510
5511 if async {
5512 // Test that timeout handling has a fudge factor, due to API
5513 // problems.
5514 tests = append(tests, testCase{
5515 protocol: dtls,
5516 name: "DTLS-Retransmit-Fudge",
5517 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005518 MaxVersion: VersionTLS12,
David Benjamin585d7a42016-06-02 14:58:00 -04005519 Bugs: ProtocolBugs{
5520 TimeoutSchedule: []time.Duration{
5521 timeouts[0] - 10*time.Millisecond,
5522 },
5523 },
5524 },
5525 resumeSession: true,
5526 })
5527 }
5528
5529 // Test that the final Finished retransmitting isn't
5530 // duplicated if the peer badly fragments everything.
5531 tests = append(tests, testCase{
5532 testType: serverTest,
5533 protocol: dtls,
5534 name: "DTLS-Retransmit-Fragmented",
5535 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005536 MaxVersion: VersionTLS12,
David Benjamin585d7a42016-06-02 14:58:00 -04005537 Bugs: ProtocolBugs{
5538 TimeoutSchedule: []time.Duration{timeouts[0]},
5539 MaxHandshakeRecordLength: 2,
5540 },
5541 },
5542 })
5543
5544 // Test the timeout schedule when a shorter initial timeout duration is set.
5545 tests = append(tests, testCase{
5546 protocol: dtls,
5547 name: "DTLS-Retransmit-Short-Client",
5548 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005549 MaxVersion: VersionTLS12,
David Benjamin585d7a42016-06-02 14:58:00 -04005550 Bugs: ProtocolBugs{
5551 TimeoutSchedule: shortTimeouts[:len(shortTimeouts)-1],
5552 },
5553 },
5554 resumeSession: true,
5555 flags: []string{"-initial-timeout-duration-ms", "250"},
5556 })
5557 tests = append(tests, testCase{
David Benjamin83f90402015-01-27 01:09:43 -05005558 protocol: dtls,
5559 testType: serverTest,
David Benjamin585d7a42016-06-02 14:58:00 -04005560 name: "DTLS-Retransmit-Short-Server",
David Benjamin83f90402015-01-27 01:09:43 -05005561 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005562 MaxVersion: VersionTLS12,
David Benjamin83f90402015-01-27 01:09:43 -05005563 Bugs: ProtocolBugs{
David Benjamin585d7a42016-06-02 14:58:00 -04005564 TimeoutSchedule: shortTimeouts[:len(shortTimeouts)-1],
David Benjamin83f90402015-01-27 01:09:43 -05005565 },
5566 },
5567 resumeSession: true,
David Benjamin585d7a42016-06-02 14:58:00 -04005568 flags: []string{"-initial-timeout-duration-ms", "250"},
David Benjamin83f90402015-01-27 01:09:43 -05005569 })
David Benjamin585d7a42016-06-02 14:58:00 -04005570
5571 for _, test := range tests {
5572 if async {
5573 test.name += "-Async"
5574 test.flags = append(test.flags, "-async")
5575 }
5576
5577 testCases = append(testCases, test)
5578 }
David Benjamin83f90402015-01-27 01:09:43 -05005579 }
David Benjamin83f90402015-01-27 01:09:43 -05005580}
5581
David Benjaminc565ebb2015-04-03 04:06:36 -04005582func addExportKeyingMaterialTests() {
5583 for _, vers := range tlsVersions {
5584 if vers.version == VersionSSL30 {
5585 continue
5586 }
5587 testCases = append(testCases, testCase{
5588 name: "ExportKeyingMaterial-" + vers.name,
5589 config: Config{
5590 MaxVersion: vers.version,
5591 },
5592 exportKeyingMaterial: 1024,
5593 exportLabel: "label",
5594 exportContext: "context",
5595 useExportContext: true,
5596 })
5597 testCases = append(testCases, testCase{
5598 name: "ExportKeyingMaterial-NoContext-" + vers.name,
5599 config: Config{
5600 MaxVersion: vers.version,
5601 },
5602 exportKeyingMaterial: 1024,
5603 })
5604 testCases = append(testCases, testCase{
5605 name: "ExportKeyingMaterial-EmptyContext-" + vers.name,
5606 config: Config{
5607 MaxVersion: vers.version,
5608 },
5609 exportKeyingMaterial: 1024,
5610 useExportContext: true,
5611 })
5612 testCases = append(testCases, testCase{
5613 name: "ExportKeyingMaterial-Small-" + vers.name,
5614 config: Config{
5615 MaxVersion: vers.version,
5616 },
5617 exportKeyingMaterial: 1,
5618 exportLabel: "label",
5619 exportContext: "context",
5620 useExportContext: true,
5621 })
5622 }
5623 testCases = append(testCases, testCase{
5624 name: "ExportKeyingMaterial-SSL3",
5625 config: Config{
5626 MaxVersion: VersionSSL30,
5627 },
5628 exportKeyingMaterial: 1024,
5629 exportLabel: "label",
5630 exportContext: "context",
5631 useExportContext: true,
5632 shouldFail: true,
5633 expectedError: "failed to export keying material",
5634 })
5635}
5636
Adam Langleyaf0e32c2015-06-03 09:57:23 -07005637func addTLSUniqueTests() {
5638 for _, isClient := range []bool{false, true} {
5639 for _, isResumption := range []bool{false, true} {
5640 for _, hasEMS := range []bool{false, true} {
5641 var suffix string
5642 if isResumption {
5643 suffix = "Resume-"
5644 } else {
5645 suffix = "Full-"
5646 }
5647
5648 if hasEMS {
5649 suffix += "EMS-"
5650 } else {
5651 suffix += "NoEMS-"
5652 }
5653
5654 if isClient {
5655 suffix += "Client"
5656 } else {
5657 suffix += "Server"
5658 }
5659
5660 test := testCase{
5661 name: "TLSUnique-" + suffix,
5662 testTLSUnique: true,
5663 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005664 MaxVersion: VersionTLS12,
Adam Langleyaf0e32c2015-06-03 09:57:23 -07005665 Bugs: ProtocolBugs{
5666 NoExtendedMasterSecret: !hasEMS,
5667 },
5668 },
5669 }
5670
5671 if isResumption {
5672 test.resumeSession = true
5673 test.resumeConfig = &Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005674 MaxVersion: VersionTLS12,
Adam Langleyaf0e32c2015-06-03 09:57:23 -07005675 Bugs: ProtocolBugs{
5676 NoExtendedMasterSecret: !hasEMS,
5677 },
5678 }
5679 }
5680
5681 if isResumption && !hasEMS {
5682 test.shouldFail = true
5683 test.expectedError = "failed to get tls-unique"
5684 }
5685
5686 testCases = append(testCases, test)
5687 }
5688 }
5689 }
5690}
5691
Adam Langley09505632015-07-30 18:10:13 -07005692func addCustomExtensionTests() {
5693 expectedContents := "custom extension"
5694 emptyString := ""
5695
David Benjamin4c3ddf72016-06-29 18:13:53 -04005696 // TODO(davidben): Add TLS 1.3 versions of these tests.
Adam Langley09505632015-07-30 18:10:13 -07005697 for _, isClient := range []bool{false, true} {
5698 suffix := "Server"
5699 flag := "-enable-server-custom-extension"
5700 testType := serverTest
5701 if isClient {
5702 suffix = "Client"
5703 flag = "-enable-client-custom-extension"
5704 testType = clientTest
5705 }
5706
5707 testCases = append(testCases, testCase{
5708 testType: testType,
David Benjamin399e7c92015-07-30 23:01:27 -04005709 name: "CustomExtensions-" + suffix,
Adam Langley09505632015-07-30 18:10:13 -07005710 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005711 MaxVersion: VersionTLS12,
David Benjamin399e7c92015-07-30 23:01:27 -04005712 Bugs: ProtocolBugs{
5713 CustomExtension: expectedContents,
Adam Langley09505632015-07-30 18:10:13 -07005714 ExpectedCustomExtension: &expectedContents,
5715 },
5716 },
5717 flags: []string{flag},
5718 })
5719
5720 // If the parse callback fails, the handshake should also fail.
5721 testCases = append(testCases, testCase{
5722 testType: testType,
David Benjamin399e7c92015-07-30 23:01:27 -04005723 name: "CustomExtensions-ParseError-" + suffix,
Adam Langley09505632015-07-30 18:10:13 -07005724 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005725 MaxVersion: VersionTLS12,
David Benjamin399e7c92015-07-30 23:01:27 -04005726 Bugs: ProtocolBugs{
5727 CustomExtension: expectedContents + "foo",
Adam Langley09505632015-07-30 18:10:13 -07005728 ExpectedCustomExtension: &expectedContents,
5729 },
5730 },
David Benjamin399e7c92015-07-30 23:01:27 -04005731 flags: []string{flag},
5732 shouldFail: true,
Adam Langley09505632015-07-30 18:10:13 -07005733 expectedError: ":CUSTOM_EXTENSION_ERROR:",
5734 })
5735
5736 // If the add callback fails, the handshake should also fail.
5737 testCases = append(testCases, testCase{
5738 testType: testType,
David Benjamin399e7c92015-07-30 23:01:27 -04005739 name: "CustomExtensions-FailAdd-" + suffix,
Adam Langley09505632015-07-30 18:10:13 -07005740 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005741 MaxVersion: VersionTLS12,
David Benjamin399e7c92015-07-30 23:01:27 -04005742 Bugs: ProtocolBugs{
5743 CustomExtension: expectedContents,
Adam Langley09505632015-07-30 18:10:13 -07005744 ExpectedCustomExtension: &expectedContents,
5745 },
5746 },
David Benjamin399e7c92015-07-30 23:01:27 -04005747 flags: []string{flag, "-custom-extension-fail-add"},
5748 shouldFail: true,
Adam Langley09505632015-07-30 18:10:13 -07005749 expectedError: ":CUSTOM_EXTENSION_ERROR:",
5750 })
5751
5752 // If the add callback returns zero, no extension should be
5753 // added.
5754 skipCustomExtension := expectedContents
5755 if isClient {
5756 // For the case where the client skips sending the
5757 // custom extension, the server must not “echo” it.
5758 skipCustomExtension = ""
5759 }
5760 testCases = append(testCases, testCase{
5761 testType: testType,
David Benjamin399e7c92015-07-30 23:01:27 -04005762 name: "CustomExtensions-Skip-" + suffix,
Adam Langley09505632015-07-30 18:10:13 -07005763 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005764 MaxVersion: VersionTLS12,
David Benjamin399e7c92015-07-30 23:01:27 -04005765 Bugs: ProtocolBugs{
5766 CustomExtension: skipCustomExtension,
Adam Langley09505632015-07-30 18:10:13 -07005767 ExpectedCustomExtension: &emptyString,
5768 },
5769 },
5770 flags: []string{flag, "-custom-extension-skip"},
5771 })
5772 }
5773
5774 // The custom extension add callback should not be called if the client
5775 // doesn't send the extension.
5776 testCases = append(testCases, testCase{
5777 testType: serverTest,
David Benjamin399e7c92015-07-30 23:01:27 -04005778 name: "CustomExtensions-NotCalled-Server",
Adam Langley09505632015-07-30 18:10:13 -07005779 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005780 MaxVersion: VersionTLS12,
David Benjamin399e7c92015-07-30 23:01:27 -04005781 Bugs: ProtocolBugs{
Adam Langley09505632015-07-30 18:10:13 -07005782 ExpectedCustomExtension: &emptyString,
5783 },
5784 },
5785 flags: []string{"-enable-server-custom-extension", "-custom-extension-fail-add"},
5786 })
Adam Langley2deb9842015-08-07 11:15:37 -07005787
5788 // Test an unknown extension from the server.
5789 testCases = append(testCases, testCase{
5790 testType: clientTest,
5791 name: "UnknownExtension-Client",
5792 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005793 MaxVersion: VersionTLS12,
Adam Langley2deb9842015-08-07 11:15:37 -07005794 Bugs: ProtocolBugs{
5795 CustomExtension: expectedContents,
5796 },
5797 },
5798 shouldFail: true,
5799 expectedError: ":UNEXPECTED_EXTENSION:",
5800 })
Adam Langley09505632015-07-30 18:10:13 -07005801}
5802
David Benjaminb36a3952015-12-01 18:53:13 -05005803func addRSAClientKeyExchangeTests() {
5804 for bad := RSABadValue(1); bad < NumRSABadValues; bad++ {
5805 testCases = append(testCases, testCase{
5806 testType: serverTest,
5807 name: fmt.Sprintf("BadRSAClientKeyExchange-%d", bad),
5808 config: Config{
5809 // Ensure the ClientHello version and final
5810 // version are different, to detect if the
5811 // server uses the wrong one.
5812 MaxVersion: VersionTLS11,
5813 CipherSuites: []uint16{TLS_RSA_WITH_RC4_128_SHA},
5814 Bugs: ProtocolBugs{
5815 BadRSAClientKeyExchange: bad,
5816 },
5817 },
5818 shouldFail: true,
5819 expectedError: ":DECRYPTION_FAILED_OR_BAD_RECORD_MAC:",
5820 })
5821 }
5822}
5823
David Benjamin8c2b3bf2015-12-18 20:55:44 -05005824var testCurves = []struct {
5825 name string
5826 id CurveID
5827}{
David Benjamin8c2b3bf2015-12-18 20:55:44 -05005828 {"P-256", CurveP256},
5829 {"P-384", CurveP384},
5830 {"P-521", CurveP521},
David Benjamin4298d772015-12-19 00:18:25 -05005831 {"X25519", CurveX25519},
David Benjamin8c2b3bf2015-12-18 20:55:44 -05005832}
5833
5834func addCurveTests() {
David Benjamin4c3ddf72016-06-29 18:13:53 -04005835 // TODO(davidben): Add a TLS 1.3 versions of these tests.
David Benjamin8c2b3bf2015-12-18 20:55:44 -05005836 for _, curve := range testCurves {
5837 testCases = append(testCases, testCase{
5838 name: "CurveTest-Client-" + curve.name,
5839 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005840 MaxVersion: VersionTLS12,
David Benjamin8c2b3bf2015-12-18 20:55:44 -05005841 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
5842 CurvePreferences: []CurveID{curve.id},
5843 },
5844 flags: []string{"-enable-all-curves"},
5845 })
5846 testCases = append(testCases, testCase{
5847 testType: serverTest,
5848 name: "CurveTest-Server-" + curve.name,
5849 config: Config{
David Benjamin4c3ddf72016-06-29 18:13:53 -04005850 MaxVersion: VersionTLS12,
David Benjamin8c2b3bf2015-12-18 20:55:44 -05005851 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
5852 CurvePreferences: []CurveID{curve.id},
5853 },
5854 flags: []string{"-enable-all-curves"},
5855 })
5856 }
David Benjamin241ae832016-01-15 03:04:54 -05005857
5858 // The server must be tolerant to bogus curves.
5859 const bogusCurve = 0x1234
5860 testCases = append(testCases, testCase{
5861 testType: serverTest,
5862 name: "UnknownCurve",
5863 config: Config{
5864 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
5865 CurvePreferences: []CurveID{bogusCurve, CurveP256},
5866 },
5867 })
David Benjamin4c3ddf72016-06-29 18:13:53 -04005868
5869 // The server must not consider ECDHE ciphers when there are no
5870 // supported curves.
5871 testCases = append(testCases, testCase{
5872 testType: serverTest,
5873 name: "NoSupportedCurves",
5874 config: Config{
5875 // TODO(davidben): Add a TLS 1.3 version of this.
5876 MaxVersion: VersionTLS12,
5877 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
5878 Bugs: ProtocolBugs{
5879 NoSupportedCurves: true,
5880 },
5881 },
5882 shouldFail: true,
5883 expectedError: ":NO_SHARED_CIPHER:",
5884 })
5885
5886 // The server must fall back to another cipher when there are no
5887 // supported curves.
5888 testCases = append(testCases, testCase{
5889 testType: serverTest,
5890 name: "NoCommonCurves",
5891 config: Config{
5892 MaxVersion: VersionTLS12,
5893 CipherSuites: []uint16{
5894 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
5895 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
5896 },
5897 CurvePreferences: []CurveID{CurveP224},
5898 },
5899 expectedCipher: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
5900 })
5901
5902 // The client must reject bogus curves and disabled curves.
5903 testCases = append(testCases, testCase{
5904 name: "BadECDHECurve",
5905 config: Config{
5906 // TODO(davidben): Add a TLS 1.3 version of this.
5907 MaxVersion: VersionTLS12,
5908 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
5909 Bugs: ProtocolBugs{
5910 SendCurve: bogusCurve,
5911 },
5912 },
5913 shouldFail: true,
5914 expectedError: ":WRONG_CURVE:",
5915 })
5916
5917 testCases = append(testCases, testCase{
5918 name: "UnsupportedCurve",
5919 config: Config{
5920 // TODO(davidben): Add a TLS 1.3 version of this.
5921 MaxVersion: VersionTLS12,
5922 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
5923 CurvePreferences: []CurveID{CurveP256},
5924 Bugs: ProtocolBugs{
5925 IgnorePeerCurvePreferences: true,
5926 },
5927 },
5928 flags: []string{"-p384-only"},
5929 shouldFail: true,
5930 expectedError: ":WRONG_CURVE:",
5931 })
5932
5933 // Test invalid curve points.
5934 testCases = append(testCases, testCase{
5935 name: "InvalidECDHPoint-Client",
5936 config: Config{
5937 // TODO(davidben): Add a TLS 1.3 version of this test.
5938 MaxVersion: VersionTLS12,
5939 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
5940 CurvePreferences: []CurveID{CurveP256},
5941 Bugs: ProtocolBugs{
5942 InvalidECDHPoint: true,
5943 },
5944 },
5945 shouldFail: true,
5946 expectedError: ":INVALID_ENCODING:",
5947 })
5948 testCases = append(testCases, testCase{
5949 testType: serverTest,
5950 name: "InvalidECDHPoint-Server",
5951 config: Config{
5952 // TODO(davidben): Add a TLS 1.3 version of this test.
5953 MaxVersion: VersionTLS12,
5954 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
5955 CurvePreferences: []CurveID{CurveP256},
5956 Bugs: ProtocolBugs{
5957 InvalidECDHPoint: true,
5958 },
5959 },
5960 shouldFail: true,
5961 expectedError: ":INVALID_ENCODING:",
5962 })
David Benjamin8c2b3bf2015-12-18 20:55:44 -05005963}
5964
Matt Braithwaite54217e42016-06-13 13:03:47 -07005965func addCECPQ1Tests() {
5966 testCases = append(testCases, testCase{
5967 testType: clientTest,
5968 name: "CECPQ1-Client-BadX25519Part",
5969 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07005970 MaxVersion: VersionTLS12,
Matt Braithwaite54217e42016-06-13 13:03:47 -07005971 MinVersion: VersionTLS12,
5972 CipherSuites: []uint16{TLS_CECPQ1_RSA_WITH_AES_256_GCM_SHA384},
5973 Bugs: ProtocolBugs{
5974 CECPQ1BadX25519Part: true,
5975 },
5976 },
5977 flags: []string{"-cipher", "kCECPQ1"},
5978 shouldFail: true,
5979 expectedLocalError: "local error: bad record MAC",
5980 })
5981 testCases = append(testCases, testCase{
5982 testType: clientTest,
5983 name: "CECPQ1-Client-BadNewhopePart",
5984 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07005985 MaxVersion: VersionTLS12,
Matt Braithwaite54217e42016-06-13 13:03:47 -07005986 MinVersion: VersionTLS12,
5987 CipherSuites: []uint16{TLS_CECPQ1_RSA_WITH_AES_256_GCM_SHA384},
5988 Bugs: ProtocolBugs{
5989 CECPQ1BadNewhopePart: true,
5990 },
5991 },
5992 flags: []string{"-cipher", "kCECPQ1"},
5993 shouldFail: true,
5994 expectedLocalError: "local error: bad record MAC",
5995 })
5996 testCases = append(testCases, testCase{
5997 testType: serverTest,
5998 name: "CECPQ1-Server-BadX25519Part",
5999 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07006000 MaxVersion: VersionTLS12,
Matt Braithwaite54217e42016-06-13 13:03:47 -07006001 MinVersion: VersionTLS12,
6002 CipherSuites: []uint16{TLS_CECPQ1_RSA_WITH_AES_256_GCM_SHA384},
6003 Bugs: ProtocolBugs{
6004 CECPQ1BadX25519Part: true,
6005 },
6006 },
6007 flags: []string{"-cipher", "kCECPQ1"},
6008 shouldFail: true,
6009 expectedError: ":DECRYPTION_FAILED_OR_BAD_RECORD_MAC:",
6010 })
6011 testCases = append(testCases, testCase{
6012 testType: serverTest,
6013 name: "CECPQ1-Server-BadNewhopePart",
6014 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07006015 MaxVersion: VersionTLS12,
Matt Braithwaite54217e42016-06-13 13:03:47 -07006016 MinVersion: VersionTLS12,
6017 CipherSuites: []uint16{TLS_CECPQ1_RSA_WITH_AES_256_GCM_SHA384},
6018 Bugs: ProtocolBugs{
6019 CECPQ1BadNewhopePart: true,
6020 },
6021 },
6022 flags: []string{"-cipher", "kCECPQ1"},
6023 shouldFail: true,
6024 expectedError: ":DECRYPTION_FAILED_OR_BAD_RECORD_MAC:",
6025 })
6026}
6027
David Benjamin4cc36ad2015-12-19 14:23:26 -05006028func addKeyExchangeInfoTests() {
6029 testCases = append(testCases, testCase{
David Benjamin4cc36ad2015-12-19 14:23:26 -05006030 name: "KeyExchangeInfo-DHE-Client",
6031 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07006032 MaxVersion: VersionTLS12,
David Benjamin4cc36ad2015-12-19 14:23:26 -05006033 CipherSuites: []uint16{TLS_DHE_RSA_WITH_AES_128_GCM_SHA256},
6034 Bugs: ProtocolBugs{
6035 // This is a 1234-bit prime number, generated
6036 // with:
6037 // openssl gendh 1234 | openssl asn1parse -i
6038 DHGroupPrime: bigFromHex("0215C589A86BE450D1255A86D7A08877A70E124C11F0C75E476BA6A2186B1C830D4A132555973F2D5881D5F737BB800B7F417C01EC5960AEBF79478F8E0BBB6A021269BD10590C64C57F50AD8169D5488B56EE38DC5E02DA1A16ED3B5F41FEB2AD184B78A31F3A5B2BEC8441928343DA35DE3D4F89F0D4CEDE0034045084A0D1E6182E5EF7FCA325DD33CE81BE7FA87D43613E8FA7A1457099AB53"),
6039 },
6040 },
David Benjamin9e68f192016-06-30 14:55:33 -04006041 flags: []string{"-expect-dhe-group-size", "1234"},
David Benjamin4cc36ad2015-12-19 14:23:26 -05006042 })
6043 testCases = append(testCases, testCase{
6044 testType: serverTest,
6045 name: "KeyExchangeInfo-DHE-Server",
6046 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07006047 MaxVersion: VersionTLS12,
David Benjamin4cc36ad2015-12-19 14:23:26 -05006048 CipherSuites: []uint16{TLS_DHE_RSA_WITH_AES_128_GCM_SHA256},
6049 },
6050 // bssl_shim as a server configures a 2048-bit DHE group.
David Benjamin9e68f192016-06-30 14:55:33 -04006051 flags: []string{"-expect-dhe-group-size", "2048"},
David Benjamin4cc36ad2015-12-19 14:23:26 -05006052 })
6053
Nick Harper1fd39d82016-06-14 18:14:35 -07006054 // TODO(davidben): Add TLS 1.3 versions of these tests once the
6055 // handshake is separate.
6056
David Benjamin4cc36ad2015-12-19 14:23:26 -05006057 testCases = append(testCases, testCase{
6058 name: "KeyExchangeInfo-ECDHE-Client",
6059 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07006060 MaxVersion: VersionTLS12,
David Benjamin4cc36ad2015-12-19 14:23:26 -05006061 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
6062 CurvePreferences: []CurveID{CurveX25519},
6063 },
David Benjamin9e68f192016-06-30 14:55:33 -04006064 flags: []string{"-expect-curve-id", "29", "-enable-all-curves"},
David Benjamin4cc36ad2015-12-19 14:23:26 -05006065 })
6066 testCases = append(testCases, testCase{
6067 testType: serverTest,
6068 name: "KeyExchangeInfo-ECDHE-Server",
6069 config: Config{
Nick Harper1fd39d82016-06-14 18:14:35 -07006070 MaxVersion: VersionTLS12,
David Benjamin4cc36ad2015-12-19 14:23:26 -05006071 CipherSuites: []uint16{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
6072 CurvePreferences: []CurveID{CurveX25519},
6073 },
David Benjamin9e68f192016-06-30 14:55:33 -04006074 flags: []string{"-expect-curve-id", "29", "-enable-all-curves"},
David Benjamin4cc36ad2015-12-19 14:23:26 -05006075 })
6076}
6077
David Benjaminc9ae27c2016-06-24 22:56:37 -04006078func addTLS13RecordTests() {
6079 testCases = append(testCases, testCase{
6080 name: "TLS13-RecordPadding",
6081 config: Config{
6082 MaxVersion: VersionTLS13,
6083 MinVersion: VersionTLS13,
6084 Bugs: ProtocolBugs{
6085 RecordPadding: 10,
6086 },
6087 },
6088 })
6089
6090 testCases = append(testCases, testCase{
6091 name: "TLS13-EmptyRecords",
6092 config: Config{
6093 MaxVersion: VersionTLS13,
6094 MinVersion: VersionTLS13,
6095 Bugs: ProtocolBugs{
6096 OmitRecordContents: true,
6097 },
6098 },
6099 shouldFail: true,
6100 expectedError: ":DECRYPTION_FAILED_OR_BAD_RECORD_MAC:",
6101 })
6102
6103 testCases = append(testCases, testCase{
6104 name: "TLS13-OnlyPadding",
6105 config: Config{
6106 MaxVersion: VersionTLS13,
6107 MinVersion: VersionTLS13,
6108 Bugs: ProtocolBugs{
6109 OmitRecordContents: true,
6110 RecordPadding: 10,
6111 },
6112 },
6113 shouldFail: true,
6114 expectedError: ":DECRYPTION_FAILED_OR_BAD_RECORD_MAC:",
6115 })
6116
6117 testCases = append(testCases, testCase{
6118 name: "TLS13-WrongOuterRecord",
6119 config: Config{
6120 MaxVersion: VersionTLS13,
6121 MinVersion: VersionTLS13,
6122 Bugs: ProtocolBugs{
6123 OuterRecordType: recordTypeHandshake,
6124 },
6125 },
6126 shouldFail: true,
6127 expectedError: ":INVALID_OUTER_RECORD_TYPE:",
6128 })
6129}
6130
David Benjamin82261be2016-07-07 14:32:50 -07006131func addChangeCipherSpecTests() {
6132 // Test missing ChangeCipherSpecs.
6133 testCases = append(testCases, testCase{
6134 name: "SkipChangeCipherSpec-Client",
6135 config: Config{
6136 MaxVersion: VersionTLS12,
6137 Bugs: ProtocolBugs{
6138 SkipChangeCipherSpec: true,
6139 },
6140 },
6141 shouldFail: true,
6142 expectedError: ":UNEXPECTED_RECORD:",
6143 })
6144 testCases = append(testCases, testCase{
6145 testType: serverTest,
6146 name: "SkipChangeCipherSpec-Server",
6147 config: Config{
6148 MaxVersion: VersionTLS12,
6149 Bugs: ProtocolBugs{
6150 SkipChangeCipherSpec: true,
6151 },
6152 },
6153 shouldFail: true,
6154 expectedError: ":UNEXPECTED_RECORD:",
6155 })
6156 testCases = append(testCases, testCase{
6157 testType: serverTest,
6158 name: "SkipChangeCipherSpec-Server-NPN",
6159 config: Config{
6160 MaxVersion: VersionTLS12,
6161 NextProtos: []string{"bar"},
6162 Bugs: ProtocolBugs{
6163 SkipChangeCipherSpec: true,
6164 },
6165 },
6166 flags: []string{
6167 "-advertise-npn", "\x03foo\x03bar\x03baz",
6168 },
6169 shouldFail: true,
6170 expectedError: ":UNEXPECTED_RECORD:",
6171 })
6172
6173 // Test synchronization between the handshake and ChangeCipherSpec.
6174 // Partial post-CCS handshake messages before ChangeCipherSpec should be
6175 // rejected. Test both with and without handshake packing to handle both
6176 // when the partial post-CCS message is in its own record and when it is
6177 // attached to the pre-CCS message.
David Benjamin82261be2016-07-07 14:32:50 -07006178 for _, packed := range []bool{false, true} {
6179 var suffix string
6180 if packed {
6181 suffix = "-Packed"
6182 }
6183
6184 testCases = append(testCases, testCase{
6185 name: "FragmentAcrossChangeCipherSpec-Client" + suffix,
6186 config: Config{
6187 MaxVersion: VersionTLS12,
6188 Bugs: ProtocolBugs{
6189 FragmentAcrossChangeCipherSpec: true,
6190 PackHandshakeFlight: packed,
6191 },
6192 },
6193 shouldFail: true,
6194 expectedError: ":UNEXPECTED_RECORD:",
6195 })
6196 testCases = append(testCases, testCase{
6197 name: "FragmentAcrossChangeCipherSpec-Client-Resume" + suffix,
6198 config: Config{
6199 MaxVersion: VersionTLS12,
6200 },
6201 resumeSession: true,
6202 resumeConfig: &Config{
6203 MaxVersion: VersionTLS12,
6204 Bugs: ProtocolBugs{
6205 FragmentAcrossChangeCipherSpec: true,
6206 PackHandshakeFlight: packed,
6207 },
6208 },
6209 shouldFail: true,
6210 expectedError: ":UNEXPECTED_RECORD:",
6211 })
6212 testCases = append(testCases, testCase{
6213 testType: serverTest,
6214 name: "FragmentAcrossChangeCipherSpec-Server" + suffix,
6215 config: Config{
6216 MaxVersion: VersionTLS12,
6217 Bugs: ProtocolBugs{
6218 FragmentAcrossChangeCipherSpec: true,
6219 PackHandshakeFlight: packed,
6220 },
6221 },
6222 shouldFail: true,
6223 expectedError: ":UNEXPECTED_RECORD:",
6224 })
6225 testCases = append(testCases, testCase{
6226 testType: serverTest,
6227 name: "FragmentAcrossChangeCipherSpec-Server-Resume" + suffix,
6228 config: Config{
6229 MaxVersion: VersionTLS12,
6230 },
6231 resumeSession: true,
6232 resumeConfig: &Config{
6233 MaxVersion: VersionTLS12,
6234 Bugs: ProtocolBugs{
6235 FragmentAcrossChangeCipherSpec: true,
6236 PackHandshakeFlight: packed,
6237 },
6238 },
6239 shouldFail: true,
6240 expectedError: ":UNEXPECTED_RECORD:",
6241 })
6242 testCases = append(testCases, testCase{
6243 testType: serverTest,
6244 name: "FragmentAcrossChangeCipherSpec-Server-NPN" + suffix,
6245 config: Config{
6246 MaxVersion: VersionTLS12,
6247 NextProtos: []string{"bar"},
6248 Bugs: ProtocolBugs{
6249 FragmentAcrossChangeCipherSpec: true,
6250 PackHandshakeFlight: packed,
6251 },
6252 },
6253 flags: []string{
6254 "-advertise-npn", "\x03foo\x03bar\x03baz",
6255 },
6256 shouldFail: true,
6257 expectedError: ":UNEXPECTED_RECORD:",
6258 })
6259 }
6260
David Benjamin61672812016-07-14 23:10:43 -04006261 // Test that, in DTLS, ChangeCipherSpec is not allowed when there are
6262 // messages in the handshake queue. Do this by testing the server
6263 // reading the client Finished, reversing the flight so Finished comes
6264 // first.
6265 testCases = append(testCases, testCase{
6266 protocol: dtls,
6267 testType: serverTest,
6268 name: "SendUnencryptedFinished-DTLS",
6269 config: Config{
6270 MaxVersion: VersionTLS12,
6271 Bugs: ProtocolBugs{
6272 SendUnencryptedFinished: true,
6273 ReverseHandshakeFragments: true,
6274 },
6275 },
6276 shouldFail: true,
6277 expectedError: ":BUFFERED_MESSAGES_ON_CIPHER_CHANGE:",
6278 })
6279
David Benjamin82261be2016-07-07 14:32:50 -07006280 // Test that early ChangeCipherSpecs are handled correctly.
6281 testCases = append(testCases, testCase{
6282 testType: serverTest,
6283 name: "EarlyChangeCipherSpec-server-1",
6284 config: Config{
6285 MaxVersion: VersionTLS12,
6286 Bugs: ProtocolBugs{
6287 EarlyChangeCipherSpec: 1,
6288 },
6289 },
6290 shouldFail: true,
6291 expectedError: ":UNEXPECTED_RECORD:",
6292 })
6293 testCases = append(testCases, testCase{
6294 testType: serverTest,
6295 name: "EarlyChangeCipherSpec-server-2",
6296 config: Config{
6297 MaxVersion: VersionTLS12,
6298 Bugs: ProtocolBugs{
6299 EarlyChangeCipherSpec: 2,
6300 },
6301 },
6302 shouldFail: true,
6303 expectedError: ":UNEXPECTED_RECORD:",
6304 })
6305 testCases = append(testCases, testCase{
6306 protocol: dtls,
6307 name: "StrayChangeCipherSpec",
6308 config: Config{
6309 // TODO(davidben): Once DTLS 1.3 exists, test
6310 // that stray ChangeCipherSpec messages are
6311 // rejected.
6312 MaxVersion: VersionTLS12,
6313 Bugs: ProtocolBugs{
6314 StrayChangeCipherSpec: true,
6315 },
6316 },
6317 })
6318
6319 // Test that the contents of ChangeCipherSpec are checked.
6320 testCases = append(testCases, testCase{
6321 name: "BadChangeCipherSpec-1",
6322 config: Config{
6323 MaxVersion: VersionTLS12,
6324 Bugs: ProtocolBugs{
6325 BadChangeCipherSpec: []byte{2},
6326 },
6327 },
6328 shouldFail: true,
6329 expectedError: ":BAD_CHANGE_CIPHER_SPEC:",
6330 })
6331 testCases = append(testCases, testCase{
6332 name: "BadChangeCipherSpec-2",
6333 config: Config{
6334 MaxVersion: VersionTLS12,
6335 Bugs: ProtocolBugs{
6336 BadChangeCipherSpec: []byte{1, 1},
6337 },
6338 },
6339 shouldFail: true,
6340 expectedError: ":BAD_CHANGE_CIPHER_SPEC:",
6341 })
6342 testCases = append(testCases, testCase{
6343 protocol: dtls,
6344 name: "BadChangeCipherSpec-DTLS-1",
6345 config: Config{
6346 MaxVersion: VersionTLS12,
6347 Bugs: ProtocolBugs{
6348 BadChangeCipherSpec: []byte{2},
6349 },
6350 },
6351 shouldFail: true,
6352 expectedError: ":BAD_CHANGE_CIPHER_SPEC:",
6353 })
6354 testCases = append(testCases, testCase{
6355 protocol: dtls,
6356 name: "BadChangeCipherSpec-DTLS-2",
6357 config: Config{
6358 MaxVersion: VersionTLS12,
6359 Bugs: ProtocolBugs{
6360 BadChangeCipherSpec: []byte{1, 1},
6361 },
6362 },
6363 shouldFail: true,
6364 expectedError: ":BAD_CHANGE_CIPHER_SPEC:",
6365 })
6366}
6367
Adam Langley7c803a62015-06-15 15:35:05 -07006368func worker(statusChan chan statusMsg, c chan *testCase, shimPath string, wg *sync.WaitGroup) {
Adam Langley95c29f32014-06-20 12:00:00 -07006369 defer wg.Done()
6370
6371 for test := range c {
Adam Langley69a01602014-11-17 17:26:55 -08006372 var err error
6373
6374 if *mallocTest < 0 {
6375 statusChan <- statusMsg{test: test, started: true}
Adam Langley7c803a62015-06-15 15:35:05 -07006376 err = runTest(test, shimPath, -1)
Adam Langley69a01602014-11-17 17:26:55 -08006377 } else {
6378 for mallocNumToFail := int64(*mallocTest); ; mallocNumToFail++ {
6379 statusChan <- statusMsg{test: test, started: true}
Adam Langley7c803a62015-06-15 15:35:05 -07006380 if err = runTest(test, shimPath, mallocNumToFail); err != errMoreMallocs {
Adam Langley69a01602014-11-17 17:26:55 -08006381 if err != nil {
6382 fmt.Printf("\n\nmalloc test failed at %d: %s\n", mallocNumToFail, err)
6383 }
6384 break
6385 }
6386 }
6387 }
Adam Langley95c29f32014-06-20 12:00:00 -07006388 statusChan <- statusMsg{test: test, err: err}
6389 }
6390}
6391
6392type statusMsg struct {
6393 test *testCase
6394 started bool
6395 err error
6396}
6397
David Benjamin5f237bc2015-02-11 17:14:15 -05006398func statusPrinter(doneChan chan *testOutput, statusChan chan statusMsg, total int) {
Adam Langley95c29f32014-06-20 12:00:00 -07006399 var started, done, failed, lineLen int
Adam Langley95c29f32014-06-20 12:00:00 -07006400
David Benjamin5f237bc2015-02-11 17:14:15 -05006401 testOutput := newTestOutput()
Adam Langley95c29f32014-06-20 12:00:00 -07006402 for msg := range statusChan {
David Benjamin5f237bc2015-02-11 17:14:15 -05006403 if !*pipe {
6404 // Erase the previous status line.
David Benjamin87c8a642015-02-21 01:54:29 -05006405 var erase string
6406 for i := 0; i < lineLen; i++ {
6407 erase += "\b \b"
6408 }
6409 fmt.Print(erase)
David Benjamin5f237bc2015-02-11 17:14:15 -05006410 }
6411
Adam Langley95c29f32014-06-20 12:00:00 -07006412 if msg.started {
6413 started++
6414 } else {
6415 done++
David Benjamin5f237bc2015-02-11 17:14:15 -05006416
6417 if msg.err != nil {
6418 fmt.Printf("FAILED (%s)\n%s\n", msg.test.name, msg.err)
6419 failed++
6420 testOutput.addResult(msg.test.name, "FAIL")
6421 } else {
6422 if *pipe {
6423 // Print each test instead of a status line.
6424 fmt.Printf("PASSED (%s)\n", msg.test.name)
6425 }
6426 testOutput.addResult(msg.test.name, "PASS")
6427 }
Adam Langley95c29f32014-06-20 12:00:00 -07006428 }
6429
David Benjamin5f237bc2015-02-11 17:14:15 -05006430 if !*pipe {
6431 // Print a new status line.
6432 line := fmt.Sprintf("%d/%d/%d/%d", failed, done, started, total)
6433 lineLen = len(line)
6434 os.Stdout.WriteString(line)
Adam Langley95c29f32014-06-20 12:00:00 -07006435 }
Adam Langley95c29f32014-06-20 12:00:00 -07006436 }
David Benjamin5f237bc2015-02-11 17:14:15 -05006437
6438 doneChan <- testOutput
Adam Langley95c29f32014-06-20 12:00:00 -07006439}
6440
6441func main() {
Adam Langley95c29f32014-06-20 12:00:00 -07006442 flag.Parse()
Adam Langley7c803a62015-06-15 15:35:05 -07006443 *resourceDir = path.Clean(*resourceDir)
David Benjamin33863262016-07-08 17:20:12 -07006444 initCertificates()
Adam Langley95c29f32014-06-20 12:00:00 -07006445
Adam Langley7c803a62015-06-15 15:35:05 -07006446 addBasicTests()
Adam Langley95c29f32014-06-20 12:00:00 -07006447 addCipherSuiteTests()
6448 addBadECDSASignatureTests()
Adam Langley80842bd2014-06-20 12:00:00 -07006449 addCBCPaddingTests()
Kenny Root7fdeaf12014-08-05 15:23:37 -07006450 addCBCSplittingTests()
David Benjamin636293b2014-07-08 17:59:18 -04006451 addClientAuthTests()
Adam Langley524e7172015-02-20 16:04:00 -08006452 addDDoSCallbackTests()
David Benjamin7e2e6cf2014-08-07 17:44:24 -04006453 addVersionNegotiationTests()
David Benjaminaccb4542014-12-12 23:44:33 -05006454 addMinimumVersionTests()
David Benjamine78bfde2014-09-06 12:45:15 -04006455 addExtensionTests()
David Benjamin01fe8202014-09-24 15:21:44 -04006456 addResumptionVersionTests()
Adam Langley75712922014-10-10 16:23:43 -07006457 addExtendedMasterSecretTests()
Adam Langley2ae77d22014-10-28 17:29:33 -07006458 addRenegotiationTests()
David Benjamin5e961c12014-11-07 01:48:35 -05006459 addDTLSReplayTests()
Nick Harper60edffd2016-06-21 15:19:24 -07006460 addSignatureAlgorithmTests()
David Benjamin83f90402015-01-27 01:09:43 -05006461 addDTLSRetransmitTests()
David Benjaminc565ebb2015-04-03 04:06:36 -04006462 addExportKeyingMaterialTests()
Adam Langleyaf0e32c2015-06-03 09:57:23 -07006463 addTLSUniqueTests()
Adam Langley09505632015-07-30 18:10:13 -07006464 addCustomExtensionTests()
David Benjaminb36a3952015-12-01 18:53:13 -05006465 addRSAClientKeyExchangeTests()
David Benjamin8c2b3bf2015-12-18 20:55:44 -05006466 addCurveTests()
Matt Braithwaite54217e42016-06-13 13:03:47 -07006467 addCECPQ1Tests()
David Benjamin4cc36ad2015-12-19 14:23:26 -05006468 addKeyExchangeInfoTests()
David Benjaminc9ae27c2016-06-24 22:56:37 -04006469 addTLS13RecordTests()
David Benjamin582ba042016-07-07 12:33:25 -07006470 addAllStateMachineCoverageTests()
David Benjamin82261be2016-07-07 14:32:50 -07006471 addChangeCipherSpecTests()
Adam Langley95c29f32014-06-20 12:00:00 -07006472
6473 var wg sync.WaitGroup
6474
Adam Langley7c803a62015-06-15 15:35:05 -07006475 statusChan := make(chan statusMsg, *numWorkers)
6476 testChan := make(chan *testCase, *numWorkers)
David Benjamin5f237bc2015-02-11 17:14:15 -05006477 doneChan := make(chan *testOutput)
Adam Langley95c29f32014-06-20 12:00:00 -07006478
David Benjamin025b3d32014-07-01 19:53:04 -04006479 go statusPrinter(doneChan, statusChan, len(testCases))
Adam Langley95c29f32014-06-20 12:00:00 -07006480
Adam Langley7c803a62015-06-15 15:35:05 -07006481 for i := 0; i < *numWorkers; i++ {
Adam Langley95c29f32014-06-20 12:00:00 -07006482 wg.Add(1)
Adam Langley7c803a62015-06-15 15:35:05 -07006483 go worker(statusChan, testChan, *shimPath, &wg)
Adam Langley95c29f32014-06-20 12:00:00 -07006484 }
6485
David Benjamin270f0a72016-03-17 14:41:36 -04006486 var foundTest bool
David Benjamin025b3d32014-07-01 19:53:04 -04006487 for i := range testCases {
Adam Langley7c803a62015-06-15 15:35:05 -07006488 if len(*testToRun) == 0 || *testToRun == testCases[i].name {
David Benjamin270f0a72016-03-17 14:41:36 -04006489 foundTest = true
David Benjamin025b3d32014-07-01 19:53:04 -04006490 testChan <- &testCases[i]
Adam Langley95c29f32014-06-20 12:00:00 -07006491 }
6492 }
David Benjamin270f0a72016-03-17 14:41:36 -04006493 if !foundTest {
6494 fmt.Fprintf(os.Stderr, "No test named '%s'\n", *testToRun)
6495 os.Exit(1)
6496 }
Adam Langley95c29f32014-06-20 12:00:00 -07006497
6498 close(testChan)
6499 wg.Wait()
6500 close(statusChan)
David Benjamin5f237bc2015-02-11 17:14:15 -05006501 testOutput := <-doneChan
Adam Langley95c29f32014-06-20 12:00:00 -07006502
6503 fmt.Printf("\n")
David Benjamin5f237bc2015-02-11 17:14:15 -05006504
6505 if *jsonOutput != "" {
6506 if err := testOutput.writeTo(*jsonOutput); err != nil {
6507 fmt.Fprintf(os.Stderr, "Error: %s\n", err)
6508 }
6509 }
David Benjamin2ab7a862015-04-04 17:02:18 -04006510
6511 if !testOutput.allPassed {
6512 os.Exit(1)
6513 }
Adam Langley95c29f32014-06-20 12:00:00 -07006514}