1#! /usr/bin/env perl
2# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
3#
4# Licensed under the Apache License 2.0 (the "License").  You may not use
5# this file except in compliance with the License.  You can obtain a copy
6# in the file LICENSE in the source distribution or at
7# https://www.openssl.org/source/license.html
8
9
10use strict;
11use warnings;
12
13use File::Basename;
14use File::Compare qw/compare_text/;
15use OpenSSL::Glob;
16use OpenSSL::Test qw/:DEFAULT srctop_dir srctop_file bldtop_file bldtop_dir/;
17use OpenSSL::Test::Utils qw/disabled alldisabled available_protocols/;
18
19BEGIN {
20setup("test_ssl_new");
21}
22
23use lib srctop_dir('Configurations');
24use lib bldtop_dir('.');
25
26my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
27
28$ENV{TEST_CERTS_DIR} = srctop_dir("test", "certs");
29
30my @conf_srcs =  glob(srctop_file("test", "ssl-tests", "*.cnf.in"));
31map { s/;.*// } @conf_srcs if $^O eq "VMS";
32my @conf_files = map { basename($_, ".in") } @conf_srcs;
33map { s/\^// } @conf_files if $^O eq "VMS";
34
35# We hard-code the number of tests to double-check that the globbing above
36# finds all files as expected.
37plan tests => 30;
38
39# Some test results depend on the configuration of enabled protocols. We only
40# verify generated sources in the default configuration.
41my $is_default_tls = (disabled("ssl3") && !disabled("tls1") &&
42                      !disabled("tls1_1") && !disabled("tls1_2") &&
43                      !disabled("tls1_3") && (!disabled("ec") || !disabled("dh")));
44
45my $is_default_dtls = (!disabled("dtls1") && !disabled("dtls1_2"));
46
47my @all_pre_tls1_3 = ("ssl3", "tls1", "tls1_1", "tls1_2");
48my $no_tls = alldisabled(available_protocols("tls"));
49my $no_tls_below1_3 = $no_tls || (disabled("tls1_2") && !disabled("tls1_3"));
50if (!$no_tls && $no_tls_below1_3 && disabled("ec") && disabled("dh")) {
51  $no_tls = 1;
52}
53my $no_pre_tls1_3 = alldisabled(@all_pre_tls1_3);
54my $no_dtls = alldisabled(available_protocols("dtls"));
55my $no_npn = disabled("nextprotoneg");
56my $no_ct = disabled("ct");
57my $no_ec = disabled("ec");
58my $no_dh = disabled("dh");
59my $no_dsa = disabled("dsa");
60my $no_ec2m = disabled("ec2m");
61my $no_ocsp = disabled("ocsp");
62
63# Add your test here if the test conf.in generates test cases and/or
64# expectations dynamically based on the OpenSSL compile-time config.
65my %conf_dependent_tests = (
66  "02-protocol-version.cnf" => !$is_default_tls,
67  "04-client_auth.cnf" => !$is_default_tls || !$is_default_dtls
68                           || !disabled("sctp"),
69  "05-sni.cnf" => disabled("tls1_1"),
70  "07-dtls-protocol-version.cnf" => !$is_default_dtls || !disabled("sctp"),
71  "10-resumption.cnf" => !$is_default_tls || $no_ec,
72  "11-dtls_resumption.cnf" => !$is_default_dtls || !disabled("sctp"),
73  "16-dtls-certstatus.cnf" => !$is_default_dtls || !disabled("sctp"),
74  "17-renegotiate.cnf" => disabled("tls1_2"),
75  "18-dtls-renegotiate.cnf" => disabled("dtls1_2") || !disabled("sctp"),
76  "19-mac-then-encrypt.cnf" => !$is_default_tls,
77  "20-cert-select.cnf" => !$is_default_tls || $no_dh || $no_dsa,
78  "22-compression.cnf" => !$is_default_tls,
79  "25-cipher.cnf" => disabled("poly1305") || disabled("chacha"),
80  "27-ticket-appdata.cnf" => !$is_default_tls,
81  "28-seclevel.cnf" => disabled("tls1_2") || $no_ec,
82  "30-extended-master-secret.cnf" => disabled("tls1_2"),
83);
84
85# Add your test here if it should be skipped for some compile-time
86# configurations. Default is $no_tls but some tests have different skip
87# conditions.
88my %skip = (
89  "06-sni-ticket.cnf" => $no_tls_below1_3,
90  "07-dtls-protocol-version.cnf" => $no_dtls,
91  "08-npn.cnf" => (disabled("tls1") && disabled("tls1_1")
92                    && disabled("tls1_2")) || $no_npn,
93  "10-resumption.cnf" => disabled("tls1_1") || disabled("tls1_2"),
94  "11-dtls_resumption.cnf" => disabled("dtls1") || disabled("dtls1_2"),
95  "12-ct.cnf" => $no_tls || $no_ct || $no_ec,
96  # We could run some of these tests without TLS 1.2 if we had a per-test
97  # disable instruction but that's a bizarre configuration not worth
98  # special-casing for.
99  # TODO(TLS 1.3): We should review this once we have TLS 1.3.
100  "13-fragmentation.cnf" => disabled("tls1_2"),
101  "14-curves.cnf" => disabled("tls1_2") || disabled("tls1_3")
102                     || $no_ec || $no_ec2m,
103  "15-certstatus.cnf" => $no_tls || $no_ocsp,
104  "16-dtls-certstatus.cnf" => $no_dtls || $no_ocsp,
105  "17-renegotiate.cnf" => $no_tls_below1_3,
106  "18-dtls-renegotiate.cnf" => $no_dtls,
107  "19-mac-then-encrypt.cnf" => $no_pre_tls1_3,
108  "20-cert-select.cnf" => disabled("tls1_2") || $no_ec,
109  "21-key-update.cnf" => disabled("tls1_3") || ($no_ec && $no_dh),
110  "22-compression.cnf" => disabled("zlib") || $no_tls,
111  "23-srp.cnf" => (disabled("tls1") && disabled ("tls1_1")
112                    && disabled("tls1_2")) || disabled("srp"),
113  "24-padding.cnf" => disabled("tls1_3") || ($no_ec && $no_dh),
114  "25-cipher.cnf" => disabled("ec") || disabled("tls1_2"),
115  "26-tls13_client_auth.cnf" => disabled("tls1_3") || ($no_ec && $no_dh),
116  "29-dtls-sctp-label-bug.cnf" => disabled("sctp") || disabled("sock"),
117);
118
119foreach my $conf (@conf_files) {
120    subtest "Test configuration $conf" => sub {
121        plan tests => 6 + ($no_fips ? 0 : 3);
122        test_conf($conf,
123                  $conf_dependent_tests{$conf} || $^O eq "VMS" ?  0 : 1,
124                  defined($skip{$conf}) ? $skip{$conf} : $no_tls,
125                  "none");
126        test_conf($conf,
127                  0,
128                  defined($skip{$conf}) ? $skip{$conf} : $no_tls,
129                  "default");
130        test_conf($conf,
131                  0,
132                  defined($skip{$conf}) ? $skip{$conf} : $no_tls,
133                  "fips") unless $no_fips;
134    }
135}
136
137sub test_conf {
138    my ($conf, $check_source, $skip, $provider) = @_;
139
140    my $conf_file = srctop_file("test", "ssl-tests", $conf);
141    my $input_file = $conf_file . ".in";
142    my $output_file = $conf . "." . $provider;
143    my $run_test = 1;
144
145  SKIP: {
146      # "Test" 1. Generate the source.
147      skip 'failure', 2 unless
148        ok(run(perltest(["generate_ssl_tests.pl", $input_file, $provider],
149                        interpreter_args => [ "-I", srctop_dir("util", "perl")],
150                        stdout => $output_file)),
151           "Getting output from generate_ssl_tests.pl.");
152
153    SKIP: {
154        # Test 2. Compare against existing output in test/ssl-tests/
155        skip "Skipping generated source test for $conf", 1
156          if !$check_source;
157
158        $run_test = is(cmp_text($output_file, $conf_file), 0,
159                       "Comparing generated $output_file with $conf_file.");
160      }
161
162      # Test 3. Run the test.
163      skip "No tests available; skipping tests", 1 if $skip;
164      skip "Stale sources; skipping tests", 1 if !$run_test;
165
166      if ($provider eq "fips") {
167          ok(run(test(["ssl_test", $output_file, $provider,
168                       srctop_file("test", "fips-and-base.cnf")])),
169             "running ssl_test $conf");
170      } else {
171          ok(run(test(["ssl_test", $output_file, $provider])),
172             "running ssl_test $conf");
173      }
174    }
175}
176
177sub cmp_text {
178    return compare_text(@_, sub {
179        $_[0] =~ s/\R//g;
180        $_[1] =~ s/\R//g;
181        return $_[0] ne $_[1];
182    });
183}
184