1#! /usr/bin/env perl 2# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved. 3# 4# Licensed under the Apache License 2.0 (the "License"). You may not use 5# this file except in compliance with the License. You can obtain a copy 6# in the file LICENSE in the source distribution or at 7# https://www.openssl.org/source/license.html 8 9 10use strict; 11use warnings; 12 13use File::Basename; 14use File::Compare qw/compare_text/; 15use OpenSSL::Glob; 16use OpenSSL::Test qw/:DEFAULT srctop_dir srctop_file bldtop_file bldtop_dir/; 17use OpenSSL::Test::Utils qw/disabled alldisabled available_protocols/; 18 19BEGIN { 20setup("test_ssl_new"); 21} 22 23use lib srctop_dir('Configurations'); 24use lib bldtop_dir('.'); 25 26my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0); 27 28$ENV{TEST_CERTS_DIR} = srctop_dir("test", "certs"); 29 30my @conf_srcs = glob(srctop_file("test", "ssl-tests", "*.cnf.in")); 31map { s/;.*// } @conf_srcs if $^O eq "VMS"; 32my @conf_files = map { basename($_, ".in") } @conf_srcs; 33map { s/\^// } @conf_files if $^O eq "VMS"; 34 35# We hard-code the number of tests to double-check that the globbing above 36# finds all files as expected. 37plan tests => 30; 38 39# Some test results depend on the configuration of enabled protocols. We only 40# verify generated sources in the default configuration. 41my $is_default_tls = (disabled("ssl3") && !disabled("tls1") && 42 !disabled("tls1_1") && !disabled("tls1_2") && 43 !disabled("tls1_3") && (!disabled("ec") || !disabled("dh"))); 44 45my $is_default_dtls = (!disabled("dtls1") && !disabled("dtls1_2")); 46 47my @all_pre_tls1_3 = ("ssl3", "tls1", "tls1_1", "tls1_2"); 48my $no_tls = alldisabled(available_protocols("tls")); 49my $no_tls_below1_3 = $no_tls || (disabled("tls1_2") && !disabled("tls1_3")); 50if (!$no_tls && $no_tls_below1_3 && disabled("ec") && disabled("dh")) { 51 $no_tls = 1; 52} 53my $no_pre_tls1_3 = alldisabled(@all_pre_tls1_3); 54my $no_dtls = alldisabled(available_protocols("dtls")); 55my $no_npn = disabled("nextprotoneg"); 56my $no_ct = disabled("ct"); 57my $no_ec = disabled("ec"); 58my $no_dh = disabled("dh"); 59my $no_dsa = disabled("dsa"); 60my $no_ec2m = disabled("ec2m"); 61my $no_ocsp = disabled("ocsp"); 62 63# Add your test here if the test conf.in generates test cases and/or 64# expectations dynamically based on the OpenSSL compile-time config. 65my %conf_dependent_tests = ( 66 "02-protocol-version.cnf" => !$is_default_tls, 67 "04-client_auth.cnf" => !$is_default_tls || !$is_default_dtls 68 || !disabled("sctp"), 69 "05-sni.cnf" => disabled("tls1_1"), 70 "07-dtls-protocol-version.cnf" => !$is_default_dtls || !disabled("sctp"), 71 "10-resumption.cnf" => !$is_default_tls || $no_ec, 72 "11-dtls_resumption.cnf" => !$is_default_dtls || !disabled("sctp"), 73 "16-dtls-certstatus.cnf" => !$is_default_dtls || !disabled("sctp"), 74 "17-renegotiate.cnf" => disabled("tls1_2"), 75 "18-dtls-renegotiate.cnf" => disabled("dtls1_2") || !disabled("sctp"), 76 "19-mac-then-encrypt.cnf" => !$is_default_tls, 77 "20-cert-select.cnf" => !$is_default_tls || $no_dh || $no_dsa, 78 "22-compression.cnf" => !$is_default_tls, 79 "25-cipher.cnf" => disabled("poly1305") || disabled("chacha"), 80 "27-ticket-appdata.cnf" => !$is_default_tls, 81 "28-seclevel.cnf" => disabled("tls1_2") || $no_ec, 82 "30-extended-master-secret.cnf" => disabled("tls1_2"), 83); 84 85# Add your test here if it should be skipped for some compile-time 86# configurations. Default is $no_tls but some tests have different skip 87# conditions. 88my %skip = ( 89 "06-sni-ticket.cnf" => $no_tls_below1_3, 90 "07-dtls-protocol-version.cnf" => $no_dtls, 91 "08-npn.cnf" => (disabled("tls1") && disabled("tls1_1") 92 && disabled("tls1_2")) || $no_npn, 93 "10-resumption.cnf" => disabled("tls1_1") || disabled("tls1_2"), 94 "11-dtls_resumption.cnf" => disabled("dtls1") || disabled("dtls1_2"), 95 "12-ct.cnf" => $no_tls || $no_ct || $no_ec, 96 # We could run some of these tests without TLS 1.2 if we had a per-test 97 # disable instruction but that's a bizarre configuration not worth 98 # special-casing for. 99 # TODO(TLS 1.3): We should review this once we have TLS 1.3. 100 "13-fragmentation.cnf" => disabled("tls1_2"), 101 "14-curves.cnf" => disabled("tls1_2") || disabled("tls1_3") 102 || $no_ec || $no_ec2m, 103 "15-certstatus.cnf" => $no_tls || $no_ocsp, 104 "16-dtls-certstatus.cnf" => $no_dtls || $no_ocsp, 105 "17-renegotiate.cnf" => $no_tls_below1_3, 106 "18-dtls-renegotiate.cnf" => $no_dtls, 107 "19-mac-then-encrypt.cnf" => $no_pre_tls1_3, 108 "20-cert-select.cnf" => disabled("tls1_2") || $no_ec, 109 "21-key-update.cnf" => disabled("tls1_3") || ($no_ec && $no_dh), 110 "22-compression.cnf" => disabled("zlib") || $no_tls, 111 "23-srp.cnf" => (disabled("tls1") && disabled ("tls1_1") 112 && disabled("tls1_2")) || disabled("srp"), 113 "24-padding.cnf" => disabled("tls1_3") || ($no_ec && $no_dh), 114 "25-cipher.cnf" => disabled("ec") || disabled("tls1_2"), 115 "26-tls13_client_auth.cnf" => disabled("tls1_3") || ($no_ec && $no_dh), 116 "29-dtls-sctp-label-bug.cnf" => disabled("sctp") || disabled("sock"), 117); 118 119foreach my $conf (@conf_files) { 120 subtest "Test configuration $conf" => sub { 121 plan tests => 6 + ($no_fips ? 0 : 3); 122 test_conf($conf, 123 $conf_dependent_tests{$conf} || $^O eq "VMS" ? 0 : 1, 124 defined($skip{$conf}) ? $skip{$conf} : $no_tls, 125 "none"); 126 test_conf($conf, 127 0, 128 defined($skip{$conf}) ? $skip{$conf} : $no_tls, 129 "default"); 130 test_conf($conf, 131 0, 132 defined($skip{$conf}) ? $skip{$conf} : $no_tls, 133 "fips") unless $no_fips; 134 } 135} 136 137sub test_conf { 138 my ($conf, $check_source, $skip, $provider) = @_; 139 140 my $conf_file = srctop_file("test", "ssl-tests", $conf); 141 my $input_file = $conf_file . ".in"; 142 my $output_file = $conf . "." . $provider; 143 my $run_test = 1; 144 145 SKIP: { 146 # "Test" 1. Generate the source. 147 skip 'failure', 2 unless 148 ok(run(perltest(["generate_ssl_tests.pl", $input_file, $provider], 149 interpreter_args => [ "-I", srctop_dir("util", "perl")], 150 stdout => $output_file)), 151 "Getting output from generate_ssl_tests.pl."); 152 153 SKIP: { 154 # Test 2. Compare against existing output in test/ssl-tests/ 155 skip "Skipping generated source test for $conf", 1 156 if !$check_source; 157 158 $run_test = is(cmp_text($output_file, $conf_file), 0, 159 "Comparing generated $output_file with $conf_file."); 160 } 161 162 # Test 3. Run the test. 163 skip "No tests available; skipping tests", 1 if $skip; 164 skip "Stale sources; skipping tests", 1 if !$run_test; 165 166 if ($provider eq "fips") { 167 ok(run(test(["ssl_test", $output_file, $provider, 168 srctop_file("test", "fips-and-base.cnf")])), 169 "running ssl_test $conf"); 170 } else { 171 ok(run(test(["ssl_test", $output_file, $provider])), 172 "running ssl_test $conf"); 173 } 174 } 175} 176 177sub cmp_text { 178 return compare_text(@_, sub { 179 $_[0] =~ s/\R//g; 180 $_[1] =~ s/\R//g; 181 return $_[0] ne $_[1]; 182 }); 183} 184