1#! /usr/bin/env perl 2# Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved. 3# 4# Licensed under the Apache License 2.0 (the "License"). You may not use 5# this file except in compliance with the License. You can obtain a copy 6# in the file LICENSE in the source distribution or at 7# https://www.openssl.org/source/license.html 8 9 10use strict; 11use warnings; 12 13use POSIX; 14use File::Basename; 15use File::Copy; 16use OpenSSL::Test qw/:DEFAULT with bldtop_file bldtop_dir srctop_file srctop_dir cmdstr data_file/; 17use OpenSSL::Test::Utils; 18 19BEGIN { 20setup("test_ssl_old"); 21} 22 23use lib srctop_dir('Configurations'); 24use lib bldtop_dir('.'); 25 26my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0); 27my ($no_rsa, $no_dsa, $no_dh, $no_ec, $no_psk, 28 $no_ssl3, $no_tls1, $no_tls1_1, $no_tls1_2, $no_tls1_3, 29 $no_dtls, $no_dtls1, $no_dtls1_2, $no_ct) = 30 anydisabled qw/rsa dsa dh ec psk 31 ssl3 tls1 tls1_1 tls1_2 tls1_3 32 dtls dtls1 dtls1_2 ct/; 33#If ec and dh are disabled then don't use TLSv1.3 34$no_tls1_3 = 1 if (!$no_tls1_3 && $no_ec && $no_dh); 35my $no_anytls = alldisabled(available_protocols("tls")); 36my $no_anydtls = alldisabled(available_protocols("dtls")); 37 38plan skip_all => "No SSL/TLS/DTLS protocol is support by this OpenSSL build" 39 if $no_anytls && $no_anydtls; 40 41my $digest = "-sha1"; 42my @reqcmd = ("openssl", "req"); 43my @x509cmd = ("openssl", "x509", $digest); 44my @verifycmd = ("openssl", "verify"); 45my @genpkeycmd = ("openssl", "genpkey"); 46my $dummycnf = srctop_file("apps", "openssl.cnf"); 47 48my $cnf = srctop_file("test", "ca-and-certs.cnf"); 49my $CAkey = srctop_file("test", "certs", "ca-key.pem"); # "keyCA.ss" 50my $CAcert="certCA.ss"; 51my $CAserial="certCA.srl"; 52my $CAreq="reqCA.ss"; 53my $CAreq2="req2CA.ss"; # temp 54my $Ukey = srctop_file("test", "certs", "ee-key.pem"); # "keyU.ss"; 55my $Ureq="reqU.ss"; 56my $Ucert="certU.ss"; 57my $Dkey="keyD.ss"; 58my $Dreq="reqD.ss"; 59my $Dcert="certD.ss"; 60my $Ekey="keyE.ss"; 61my $Ereq="reqE.ss"; 62my $Ecert="certE.ss"; 63 64my $proxycnf=srctop_file("test", "proxy.cnf"); 65my $P1key= srctop_file("test", "certs", "alt1-key.pem"); # "keyP1.ss"; 66my $P1req="reqP1.ss"; 67my $P1cert="certP1.ss"; 68my $P1intermediate="tmp_intP1.ss"; 69my $P2key= srctop_file("test", "certs", "alt2-key.pem"); # "keyP2.ss"; 70my $P2req="reqP2.ss"; 71my $P2cert="certP2.ss"; 72my $P2intermediate="tmp_intP2.ss"; 73 74my $server_sess="server.ss"; 75my $client_sess="client.ss"; 76 77# ssl_old_test.c is deprecated in favour of the new framework in ssl_test.c 78# If you're adding tests here, you probably want to convert them to the 79# new format in ssl_test.c and add recipes to 80-test_ssl_new.t instead. 80plan tests => 81 ($no_fips ? 0 : 5) # testssl with fips provider 82 + 1 # For testss 83 + 5 # For the testssl with default provider 84 ; 85 86subtest 'test_ss' => sub { 87 if (testss()) { 88 open OUT, ">", "intP1.ss"; 89 copy($CAcert, \*OUT); copy($Ucert, \*OUT); 90 close OUT; 91 92 open OUT, ">", "intP2.ss"; 93 copy($CAcert, \*OUT); copy($Ucert, \*OUT); copy($P1cert, \*OUT); 94 close OUT; 95 } 96}; 97 98note('test_ssl_old -- key U'); 99my $configfile = srctop_file("test","default-and-legacy.cnf"); 100if (disabled("legacy")) { 101 $configfile = srctop_file("test","default.cnf"); 102} 103 104testssl($Ukey, $Ucert, $CAcert, "default", $configfile); 105unless ($no_fips) { 106 testssl($Ukey, $Ucert, $CAcert, "fips", 107 srctop_file("test","fips-and-base.cnf")); 108} 109 110# ----------- 111# subtest functions 112sub testss { 113 my @req_dsa = ("-newkey", 114 "dsa:".data_file("dsa2048.pem")); 115 my $dsaparams = data_file("dsa2048.pem"); 116 my @req_new; 117 if ($no_rsa) { 118 @req_new = @req_dsa; 119 } else { 120 @req_new = ("-new"); 121 } 122 123 plan tests => 17; 124 125 SKIP: { 126 skip 'failure', 16 unless 127 ok(run(app([@reqcmd, "-config", $cnf, 128 "-out", $CAreq, "-key", $CAkey, 129 @req_new])), 130 'make cert request'); 131 132 skip 'failure', 15 unless 133 ok(run(app([@x509cmd, "-CAcreateserial", "-in", $CAreq, "-days", "30", 134 "-req", "-out", $CAcert, "-signkey", $CAkey, 135 "-extfile", $cnf, "-extensions", "v3_ca"], 136 stdout => "err.ss")), 137 'convert request into self-signed cert'); 138 139 skip 'failure', 14 unless 140 ok(run(app([@x509cmd, "-in", $CAcert, 141 "-x509toreq", "-signkey", $CAkey, "-out", $CAreq2], 142 stdout => "err.ss")), 143 'convert cert into a cert request'); 144 145 skip 'failure', 13 unless 146 ok(run(app([@reqcmd, "-config", $dummycnf, 147 "-verify", "-in", $CAreq, "-noout"])), 148 'verify request 1'); 149 150 151 skip 'failure', 12 unless 152 ok(run(app([@reqcmd, "-config", $dummycnf, 153 "-verify", "-in", $CAreq2, "-noout"])), 154 'verify request 2'); 155 156 skip 'failure', 11 unless 157 ok(run(app([@verifycmd, "-CAfile", $CAcert, $CAcert])), 158 'verify signature'); 159 160 skip 'failure', 10 unless 161 ok(run(app([@reqcmd, "-config", $cnf, "-section", "userreq", 162 "-out", $Ureq, "-key", $Ukey, @req_new], 163 stdout => "err.ss")), 164 'make a user cert request'); 165 166 skip 'failure', 9 unless 167 ok(run(app([@x509cmd, "-CAcreateserial", "-in", $Ureq, "-days", "30", 168 "-req", "-out", $Ucert, 169 "-CA", $CAcert, "-CAkey", $CAkey, "-CAserial", $CAserial, 170 "-extfile", $cnf, "-extensions", "v3_ee"], 171 stdout => "err.ss")) 172 && run(app([@verifycmd, "-CAfile", $CAcert, $Ucert])), 173 'sign user cert request'); 174 175 skip 'failure', 8 unless 176 ok(run(app([@x509cmd, 177 "-subject", "-issuer", "-startdate", "-enddate", 178 "-noout", "-in", $Ucert])), 179 'Certificate details'); 180 181 skip 'failure', 7 unless 182 subtest 'DSA certificate creation' => sub { 183 plan skip_all => "skipping DSA certificate creation" 184 if $no_dsa; 185 186 plan tests => 5; 187 188 SKIP: { 189 $ENV{CN2} = "DSA Certificate"; 190 skip 'failure', 4 unless 191 ok(run(app([@genpkeycmd, "-out", $Dkey, 192 "-paramfile", $dsaparams], 193 stdout => "err.ss")), 194 "make a DSA key"); 195 skip 'failure', 3 unless 196 ok(run(app([@reqcmd, "-new", "-config", $cnf, 197 "-section", "userreq", 198 "-out", $Dreq, "-key", $Dkey], 199 stdout => "err.ss")), 200 "make a DSA user cert request"); 201 skip 'failure', 2 unless 202 ok(run(app([@x509cmd, "-CAcreateserial", 203 "-in", $Dreq, 204 "-days", "30", 205 "-req", 206 "-out", $Dcert, 207 "-CA", $CAcert, "-CAkey", $CAkey, 208 "-CAserial", $CAserial, 209 "-extfile", $cnf, 210 "-extensions", "v3_ee_dsa"], 211 stdout => "err.ss")), 212 "sign DSA user cert request"); 213 skip 'failure', 1 unless 214 ok(run(app([@verifycmd, "-CAfile", $CAcert, $Dcert])), 215 "verify DSA user cert"); 216 skip 'failure', 0 unless 217 ok(run(app([@x509cmd, 218 "-subject", "-issuer", 219 "-startdate", "-enddate", "-noout", 220 "-in", $Dcert])), 221 "DSA Certificate details"); 222 } 223 }; 224 225 skip 'failure', 6 unless 226 subtest 'ECDSA/ECDH certificate creation' => sub { 227 plan skip_all => "skipping ECDSA/ECDH certificate creation" 228 if $no_ec; 229 230 plan tests => 5; 231 232 SKIP: { 233 $ENV{CN2} = "ECDSA Certificate"; 234 skip 'failure', 4 unless 235 ok(run(app(["openssl", "genpkey", "-genparam", 236 "-algorithm", "EC", 237 "-pkeyopt", "ec_paramgen_curve:P-256", 238 "-pkeyopt", "ec_param_enc:named_curve", 239 "-out", "ecp.ss"])), 240 "make EC parameters"); 241 skip 'failure', 3 unless 242 ok(run(app([@reqcmd, "-config", $cnf, 243 "-section", "userreq", 244 "-out", $Ereq, "-keyout", $Ekey, 245 "-newkey", "ec:ecp.ss"], 246 stdout => "err.ss")), 247 "make a ECDSA/ECDH user cert request"); 248 skip 'failure', 2 unless 249 ok(run(app([@x509cmd, "-CAcreateserial", 250 "-in", $Ereq, 251 "-days", "30", 252 "-req", 253 "-out", $Ecert, 254 "-CA", $CAcert, "-CAkey", $CAkey, 255 "-CAserial", $CAserial, 256 "-extfile", $cnf, 257 "-extensions", "v3_ee_ec"], 258 stdout => "err.ss")), 259 "sign ECDSA/ECDH user cert request"); 260 skip 'failure', 1 unless 261 ok(run(app([@verifycmd, "-CAfile", $CAcert, $Ecert])), 262 "verify ECDSA/ECDH user cert"); 263 skip 'failure', 0 unless 264 ok(run(app([@x509cmd, 265 "-subject", "-issuer", 266 "-startdate", "-enddate", "-noout", 267 "-in", $Ecert])), 268 "ECDSA Certificate details"); 269 } 270 }; 271 272 skip 'failure', 5 unless 273 ok(run(app([@reqcmd, "-config", $proxycnf, 274 "-out", $P1req, "-key", $P1key, @req_new], 275 stdout => "err.ss")), 276 'make a proxy cert request'); 277 278 279 skip 'failure', 4 unless 280 ok(run(app([@x509cmd, "-CAcreateserial", "-in", $P1req, "-days", "30", 281 "-req", "-out", $P1cert, 282 "-CA", $Ucert, "-CAkey", $Ukey, 283 "-extfile", $proxycnf, "-extensions", "proxy"], 284 stdout => "err.ss")), 285 'sign proxy with user cert'); 286 287 copy($Ucert, $P1intermediate); 288 run(app([@verifycmd, "-CAfile", $CAcert, 289 "-untrusted", $P1intermediate, $P1cert])); 290 ok(run(app([@x509cmd, 291 "-subject", "-issuer", "-startdate", "-enddate", 292 "-noout", "-in", $P1cert])), 293 'Certificate details'); 294 295 skip 'failure', 2 unless 296 ok(run(app([@reqcmd, "-config", $proxycnf, "-section", "proxy2_req", 297 "-out", $P2req, "-key", $P2key, 298 @req_new], 299 stdout => "err.ss")), 300 'make another proxy cert request'); 301 302 303 skip 'failure', 1 unless 304 ok(run(app([@x509cmd, "-CAcreateserial", "-in", $P2req, "-days", "30", 305 "-req", "-out", $P2cert, 306 "-CA", $P1cert, "-CAkey", $P1key, 307 "-extfile", $proxycnf, "-extensions", "proxy_2"], 308 stdout => "err.ss")), 309 'sign second proxy cert request with the first proxy cert'); 310 311 312 open OUT, ">", $P2intermediate; 313 copy($Ucert, \*OUT); copy($P1cert, \*OUT); 314 close OUT; 315 run(app([@verifycmd, "-CAfile", $CAcert, 316 "-untrusted", $P2intermediate, $P2cert])); 317 ok(run(app([@x509cmd, 318 "-subject", "-issuer", "-startdate", "-enddate", 319 "-noout", "-in", $P2cert])), 320 'Certificate details'); 321 } 322} 323 324sub testssl { 325 my ($key, $cert, $CAtmp, $provider, $configfile) = @_; 326 my @CA = $CAtmp ? ("-CAfile", $CAtmp) : ("-CApath", bldtop_dir("certs")); 327 my @providerflags = ("-provider", $provider); 328 329 if ($provider eq "default" && !disabled("legacy")) { 330 push @providerflags, "-provider", "legacy"; 331 } 332 333 my @ssltest = ("ssl_old_test", 334 "-s_key", $key, "-s_cert", $cert, 335 "-c_key", $key, "-c_cert", $cert, 336 "-config", $configfile, 337 @providerflags); 338 339 340 my $serverinfo = srctop_file("test","serverinfo.pem"); 341 342 my $dsa_cert = 0; 343 if (grep /DSA Public Key/, run(app(["openssl", "x509", "-in", $cert, 344 "-text", "-noout"]), capture => 1)) { 345 $dsa_cert = 1; 346 } 347 348 349 subtest 'standard SSL tests' => sub { 350 ###################################################################### 351 plan tests => 19; 352 353 SKIP: { 354 skip "SSLv3 is not supported by this OpenSSL build", 4 355 if disabled("ssl3"); 356 357 skip "SSLv3 is not supported by the FIPS provider", 4 358 if $provider eq "fips"; 359 360 ok(run(test([@ssltest, "-bio_pair", "-ssl3"])), 361 'test sslv3 via BIO pair'); 362 ok(run(test([@ssltest, "-bio_pair", "-ssl3", "-server_auth", @CA])), 363 'test sslv3 with server authentication via BIO pair'); 364 ok(run(test([@ssltest, "-bio_pair", "-ssl3", "-client_auth", @CA])), 365 'test sslv3 with client authentication via BIO pair'); 366 ok(run(test([@ssltest, "-bio_pair", "-ssl3", "-server_auth", "-client_auth", @CA])), 367 'test sslv3 with both server and client authentication via BIO pair'); 368 } 369 370 SKIP: { 371 skip "Neither SSLv3 nor any TLS version are supported by this OpenSSL build", 1 372 if $no_anytls; 373 374 ok(run(test([@ssltest, "-bio_pair"])), 375 'test sslv2/sslv3 via BIO pair'); 376 } 377 378 SKIP: { 379 skip "Neither SSLv3 nor any TLS version are supported by this OpenSSL build", 14 380 if $no_anytls; 381 382 SKIP: { 383 skip "skipping test of sslv2/sslv3 w/o (EC)DHE test", 1 if $dsa_cert; 384 385 ok(run(test([@ssltest, "-bio_pair", "-no_dhe", "-no_ecdhe"])), 386 'test sslv2/sslv3 w/o (EC)DHE via BIO pair'); 387 } 388 389 SKIP: { 390 skip "skipping dhe1024dsa test", 1 391 if ($no_dh); 392 393 ok(run(test([@ssltest, "-bio_pair", "-dhe1024dsa", "-v"])), 394 'test sslv2/sslv3 with 1024bit DHE via BIO pair'); 395 } 396 397 ok(run(test([@ssltest, "-bio_pair", "-server_auth", @CA])), 398 'test sslv2/sslv3 with server authentication'); 399 ok(run(test([@ssltest, "-bio_pair", "-client_auth", @CA])), 400 'test sslv2/sslv3 with client authentication via BIO pair'); 401 ok(run(test([@ssltest, "-bio_pair", "-server_auth", "-client_auth", @CA])), 402 'test sslv2/sslv3 with both client and server authentication via BIO pair'); 403 ok(run(test([@ssltest, "-bio_pair", "-server_auth", "-client_auth", "-app_verify", @CA])), 404 'test sslv2/sslv3 with both client and server authentication via BIO pair and app verify'); 405 406 SKIP: { 407 skip "No IPv4 available on this machine", 4 408 unless !disabled("sock") && have_IPv4(); 409 ok(run(test([@ssltest, "-ipv4"])), 410 'test TLS via IPv4'); 411 ok(run(test([@ssltest, "-ipv4", "-client_ktls"])), 412 'test TLS via IPv4 + ktls(client)'); 413 ok(run(test([@ssltest, "-ipv4", "-server_ktls"])), 414 'test TLS via IPv4 + ktls(server)'); 415 ok(run(test([@ssltest, "-ipv4", "-client_ktls", "-server_ktls"])), 416 'test TLS via IPv4 + ktls'); 417 } 418 419 SKIP: { 420 skip "No IPv6 available on this machine", 4 421 unless !disabled("sock") && have_IPv6(); 422 ok(run(test([@ssltest, "-ipv6"])), 423 'test TLS via IPv6'); 424 ok(run(test([@ssltest, "-ipv6", "-client_ktls"])), 425 'test TLS via IPv6 + ktls(client)'); 426 ok(run(test([@ssltest, "-ipv6", "-server_ktls"])), 427 'test TLS via IPv6 + ktls(client)'); 428 ok(run(test([@ssltest, "-ipv6", "-client_ktls", "-server_ktls"])), 429 'test TLS via IPv6 + ktls'); 430 } 431 } 432 }; 433 434 subtest "Testing ciphersuites" => sub { 435 436 my @exkeys = (); 437 my $ciphers = '-PSK:-SRP:@SECLEVEL=0'; 438 439 if (!$no_dsa) { 440 push @exkeys, "-s_cert", "certD.ss", "-s_key", $Dkey; 441 } 442 443 if (!$no_ec) { 444 push @exkeys, "-s_cert", "certE.ss", "-s_key", $Ekey; 445 } 446 447 my @protocols = (); 448 # We only use the flags that ssl_old_test understands 449 push @protocols, "-tls1_3" unless $no_tls1_3; 450 push @protocols, "-tls1_2" unless $no_tls1_2; 451 push @protocols, "-tls1" unless $no_tls1 || $provider eq "fips"; 452 push @protocols, "-ssl3" unless $no_ssl3 || $provider eq "fips"; 453 my $protocolciphersuitecount = 0; 454 my %ciphersuites = (); 455 my %ciphersstatus = (); 456 #There's no "-config" option to the ciphers command so we set the 457 #environment variable instead 458 my $opensslconf = $ENV{OPENSSL_CONF}; 459 $ENV{OPENSSL_CONF} = $configfile; 460 foreach my $protocol (@protocols) { 461 my $ciphersstatus = undef; 462 my @ciphers = run(app(["openssl", "ciphers", "-s", $protocol, 463 @providerflags, 464 "ALL:$ciphers"]), 465 capture => 1, statusvar => \$ciphersstatus); 466 $ciphersstatus{$protocol} = $ciphersstatus; 467 if ($ciphersstatus) { 468 $ciphersuites{$protocol} = [ map { s|\R||; split(/:/, $_) } 469 @ciphers ]; 470 $protocolciphersuitecount += scalar @{$ciphersuites{$protocol}}; 471 } 472 } 473 $ENV{OPENSSL_CONF} = $opensslconf; 474 475 plan skip_all => "None of the ciphersuites to test are available in this OpenSSL build" 476 if $protocolciphersuitecount + scalar(keys %ciphersuites) == 0; 477 478 # The count of protocols is because in addition to the ciphersuites 479 # we got above, we're running a weak DH test for each protocol (except 480 # TLSv1.3) 481 my $testcount = scalar(@protocols) + $protocolciphersuitecount 482 + scalar(keys %ciphersuites); 483 $testcount-- unless $no_tls1_3; 484 plan tests => $testcount; 485 486 foreach my $protocol (@protocols) { 487 ok($ciphersstatus{$protocol}, "Getting ciphers for $protocol"); 488 } 489 490 foreach my $protocol (sort keys %ciphersuites) { 491 note "Testing ciphersuites for $protocol"; 492 # ssl_old_test doesn't know -tls1_3, but that's fine, since that's 493 # the default choice if TLSv1.3 enabled 494 my $flag = $protocol eq "-tls1_3" ? "" : $protocol; 495 my $ciphersuites = ""; 496 foreach my $cipher (@{$ciphersuites{$protocol}}) { 497 if ($protocol eq "-ssl3" && $cipher =~ /ECDH/ ) { 498 note "*****SKIPPING $protocol $cipher"; 499 ok(1); 500 } else { 501 if ($protocol eq "-tls1_3") { 502 $ciphersuites = $cipher; 503 $cipher = ""; 504 } else { 505 $cipher = $cipher.':@SECLEVEL=0'; 506 } 507 ok(run(test([@ssltest, @exkeys, "-cipher", 508 $cipher, 509 "-ciphersuites", $ciphersuites, 510 $flag || ()])), 511 "Testing $cipher"); 512 } 513 } 514 next if $protocol eq "-tls1_3"; 515 516 SKIP: { 517 skip "skipping dhe512 test", 1 518 if ($no_dh); 519 520 is(run(test([@ssltest, 521 "-s_cipher", "EDH", 522 "-c_cipher", 'EDH:@SECLEVEL=1', 523 "-dhe512", 524 $protocol])), 0, 525 "testing connection with weak DH, expecting failure"); 526 } 527 } 528 }; 529 530 subtest 'RSA/(EC)DHE/PSK tests' => sub { 531 ###################################################################### 532 533 plan tests => 10; 534 535 SKIP: { 536 skip "TLSv1.0 is not supported by this OpenSSL build", 6 537 if $no_tls1 || $provider eq "fips"; 538 539 SKIP: { 540 skip "skipping anonymous DH tests", 1 541 if ($no_dh); 542 543 ok(run(test([@ssltest, "-v", "-bio_pair", "-tls1", "-cipher", "ADH", "-dhe1024dsa", "-num", "10", "-f", "-time"])), 544 'test tlsv1 with 1024bit anonymous DH, multiple handshakes'); 545 } 546 547 SKIP: { 548 skip "skipping RSA tests", 2 549 if $no_rsa; 550 551 ok(run(test(["ssl_old_test", "-provider", "default", "-v", "-bio_pair", "-tls1", "-s_cert", srctop_file("apps","server2.pem"), "-no_dhe", "-no_ecdhe", "-num", "10", "-f", "-time"])), 552 'test tlsv1 with 1024bit RSA, no (EC)DHE, multiple handshakes'); 553 554 skip "skipping RSA+DHE tests", 1 555 if $no_dh; 556 557 ok(run(test(["ssl_old_test", "-provider", "default", "-v", "-bio_pair", "-tls1", "-s_cert", srctop_file("apps","server2.pem"), "-dhe1024dsa", "-num", "10", "-f", "-time"])), 558 'test tlsv1 with 1024bit RSA, 1024bit DHE, multiple handshakes'); 559 } 560 561 SKIP: { 562 skip "skipping PSK tests", 2 563 if ($no_psk); 564 565 ok(run(test([@ssltest, "-tls1", "-cipher", "PSK", "-psk", "abc123"])), 566 'test tls1 with PSK'); 567 568 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "PSK", "-psk", "abc123"])), 569 'test tls1 with PSK via BIO pair'); 570 } 571 572 SKIP: { 573 skip "skipping auto DH PSK tests", 1 574 if ($no_dh || $no_psk); 575 576 ok(run(test(['ssl_old_test', '-psk', '0102030405', '-cipher', '@SECLEVEL=2:DHE-PSK-AES128-CCM'])), 577 'test auto DH meets security strength'); 578 } 579 } 580 581 SKIP: { 582 skip "TLSv1.1 is not supported by this OpenSSL build", 4 583 if $no_tls1_1; 584 585 SKIP: { 586 skip "skipping auto DHE PSK test at SECLEVEL 3", 1 587 if ($no_dh || $no_psk); 588 589 ok(run(test(['ssl_old_test', '-tls1_1', '-dhe4096', '-psk', '0102030405', '-cipher', '@SECLEVEL=3:DHE-PSK-AES256-CBC-SHA384'])), 590 'test auto DHE PSK meets security strength'); 591 } 592 593 SKIP: { 594 skip "skipping auto ECDHE PSK test at SECLEVEL 3", 1 595 if ($no_ec || $no_psk); 596 597 ok(run(test(['ssl_old_test', '-tls1_1', '-no_dhe', '-psk', '0102030405', '-cipher', '@SECLEVEL=3:ECDHE-PSK-AES256-CBC-SHA384'])), 598 'test auto ECDHE PSK meets security strength'); 599 } 600 601 SKIP: { 602 skip "skipping no RSA PSK at SECLEVEL 3 test", 1 603 if ($no_rsa || $no_psk); 604 605 ok(!run(test(['ssl_old_test', '-tls1_1', '-no_dhe', '-psk', '0102030405', '-cipher', '@SECLEVEL=3:RSA-PSK-AES256-CBC-SHA384'])), 606 'test auto RSA PSK does not meet security level 3 requirements (PFS)'); 607 } 608 609 SKIP: { 610 skip "skipping no PSK at SECLEVEL 3 test", 1 611 if ($no_psk); 612 613 ok(!run(test(['ssl_old_test', '-tls1_1', '-no_dhe', '-psk', '0102030405', '-cipher', '@SECLEVEL=3:PSK-AES256-CBC-SHA384'])), 614 'test auto PSK does not meet security level 3 requirements (PFS)'); 615 } 616 } 617 618 }; 619 620 subtest 'Custom Extension tests' => sub { 621 ###################################################################### 622 623 plan tests => 1; 624 625 SKIP: { 626 skip "TLSv1.0 is not supported by this OpenSSL build", 1 627 if $no_tls1 || $provider eq "fips"; 628 629 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-custom_ext"])), 630 'test tls1 with custom extensions'); 631 } 632 }; 633 634 subtest 'Serverinfo tests' => sub { 635 ###################################################################### 636 637 plan tests => 5; 638 639 SKIP: { 640 skip "TLSv1.0 is not supported by this OpenSSL build", 5 641 if $no_tls1 || $provider eq "fips"; 642 643 note('echo test tls1 with serverinfo'); 644 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo]))); 645 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo, "-serverinfo_sct"]))); 646 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo, "-serverinfo_tack"]))); 647 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo, "-serverinfo_sct", "-serverinfo_tack"]))); 648 ok(run(test([@ssltest, "-bio_pair", "-tls1", "-custom_ext", "-serverinfo_file", $serverinfo, "-serverinfo_sct", "-serverinfo_tack"]))); 649 } 650 }; 651} 652