subtest 'RSA/(EC)DHE/PSK tests' => sub {
######################################################################
- plan tests => 6;
+ plan tests => 10;
SKIP: {
skip "TLSv1.0 is not supported by this OpenSSL build", 6
ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "PSK", "-psk", "abc123"])),
'test tls1 with PSK via BIO pair');
- }
+ }
SKIP: {
skip "skipping auto DH PSK tests", 1
}
}
+ SKIP: {
+ skip "TLSv1.1 is not supported by this OpenSSL build", 4
+ if $no_tls1_1;
+
+ SKIP: {
+ skip "skipping auto DHE PSK test at SECLEVEL 3", 1
+ if ($no_dh || $no_psk);
+
+ ok(run(test(['ssl_old_test', '-tls1_1', '-dhe4096', '-psk', '0102030405', '-cipher', '@SECLEVEL=3:DHE-PSK-AES256-CBC-SHA384'])),
+ 'test auto DHE PSK meets security strength');
+ }
+
+ SKIP: {
+ skip "skipping auto ECDHE PSK test at SECLEVEL 3", 1
+ if ($no_ec || $no_psk);
+
+ ok(run(test(['ssl_old_test', '-tls1_1', '-no_dhe', '-psk', '0102030405', '-cipher', '@SECLEVEL=3:ECDHE-PSK-AES256-CBC-SHA384'])),
+ 'test auto ECDHE PSK meets security strength');
+ }
+
+ SKIP: {
+ skip "skipping no RSA PSK at SECLEVEL 3 test", 1
+ if ($no_rsa || $no_psk);
+
+ ok(!run(test(['ssl_old_test', '-tls1_1', '-no_dhe', '-psk', '0102030405', '-cipher', '@SECLEVEL=3:RSA-PSK-AES256-CBC-SHA384'])),
+ 'test auto RSA PSK does not meet security level 3 requirements (PFS)');
+ }
+
+ SKIP: {
+ skip "skipping no PSK at SECLEVEL 3 test", 1
+ if ($no_psk);
+
+ ok(!run(test(['ssl_old_test', '-tls1_1', '-no_dhe', '-psk', '0102030405', '-cipher', '@SECLEVEL=3:PSK-AES256-CBC-SHA384'])),
+ 'test auto PSK does not meet security level 3 requirements (PFS)');
+ }
+ }
+
};
subtest 'Custom Extension tests' => sub {
#ifndef OPENSSL_NO_DH
fprintf(stderr,
" -dhe512 - use 512 bit key for DHE (to test failure)\n");
- fprintf(stderr,
- " -dhe1024 - use 1024 bit key (safe prime) for DHE (default, no-op)\n");
fprintf(stderr,
" -dhe1024dsa - use 1024 bit key (with 160-bit subprime) for DHE\n");
+ fprintf(stderr,
+ " -dhe2048 - use 2048 bit key (safe prime) for DHE (default, no-op)\n");
+ fprintf(stderr,
+ " -dhe4096 - use 4096 bit key (safe prime) for DHE\n");
#endif
fprintf(stderr, " -no_dhe - disable DHE\n");
#ifndef OPENSSL_NO_EC
#ifndef OPENSSL_NO_TLS1
fprintf(stderr, " -tls1 - use TLSv1\n");
#endif
+#ifndef OPENSSL_NO_TLS1_1
+ fprintf(stderr, " -tls1_1 - use TLSv1.1\n");
+#endif
+#ifndef OPENSSL_NO_TLS1_2
+ fprintf(stderr, " -tls1_2 - use TLSv1.2\n");
+#endif
#ifndef OPENSSL_NO_DTLS
fprintf(stderr, " -dtls - use DTLS\n");
#ifndef OPENSSL_NO_DTLS1
int badop = 0;
enum { BIO_MEM, BIO_PAIR, BIO_IPV4, BIO_IPV6 } bio_type = BIO_MEM;
int force = 0;
- int dtls1 = 0, dtls12 = 0, dtls = 0, tls1 = 0, tls1_2 = 0, ssl3 = 0;
+ int dtls1 = 0, dtls12 = 0, dtls = 0, tls1 = 0, tls1_1 = 0, tls1_2 = 0, ssl3 = 0;
int ret = EXIT_FAILURE;
int client_auth = 0;
int server_auth = 0, i;
long bytes = 256L;
#ifndef OPENSSL_NO_DH
EVP_PKEY *dhpkey;
- int dhe512 = 0, dhe1024dsa = 0;
+ int dhe512 = 0, dhe1024dsa = 0, dhe4096 = 0;
int no_dhe = 0;
#endif
int no_psk = 0;
dhe512 = 1;
else if (strcmp(*argv, "-dhe1024dsa") == 0)
dhe1024dsa = 1;
+ else if (strcmp(*argv, "-dhe4096") == 0)
+ dhe4096 = 1;
#endif
else if (strcmp(*argv, "-no_ecdhe") == 0)
/* obsolete */;
}
else if (strcmp(*argv, "-tls1_2") == 0) {
tls1_2 = 1;
+ } else if (strcmp(*argv, "-tls1_1") == 0) {
+ tls1_1 = 1;
} else if (strcmp(*argv, "-tls1") == 0) {
tls1 = 1;
} else if (strcmp(*argv, "-ssl3") == 0) {
goto end;
}
- if (ssl3 + tls1 + tls1_2 + dtls + dtls1 + dtls12 > 1) {
- fprintf(stderr, "At most one of -ssl3, -tls1, -tls1_2, -dtls, -dtls1 or -dtls12 should "
+ if (ssl3 + tls1 + tls1_1 + tls1_2 + dtls + dtls1 + dtls12 > 1) {
+ fprintf(stderr, "At most one of -ssl3, -tls1, -tls1_1, -tls1_2, -dtls, -dtls1 or -dtls12 should "
"be requested.\n");
EXIT(1);
}
no_protocol = 1;
else
#endif
+#ifdef OPENSSL_NO_TLS1_1
+ if (tls1_1)
+ no_protocol = 1;
+ else
+#endif
#ifdef OPENSSL_NO_TLS1_2
if (tls1_2)
no_protocol = 1;
goto end;
}
- if (!ssl3 && !tls1 && !tls1_2 && !dtls && !dtls1 && !dtls12 && number > 1
+ if (!ssl3 && !tls1 && !tls1_1 && !tls1_2 && !dtls && !dtls1 && !dtls12 && number > 1
&& !reuse && !force) {
fprintf(stderr, "This case cannot work. Use -f to perform "
"the test anyway (and\n-d to see what happens), "
- "or add one of -ssl3, -tls1, -tls1_2, -dtls, -dtls1, -dtls12, -reuse\n"
+ "or add one of -ssl3, -tls1, -tls1_1, -tls1_2, -dtls, -dtls1, -dtls12, -reuse\n"
"to avoid protocol mismatch.\n");
EXIT(1);
}
} else if (tls1) {
min_version = TLS1_VERSION;
max_version = TLS1_VERSION;
+ } else if (tls1_1) {
+ min_version = TLS1_1_VERSION;
+ max_version = TLS1_1_VERSION;
} else if (tls1_2) {
min_version = TLS1_2_VERSION;
max_version = TLS1_2_VERSION;
dhpkey = get_dh1024dsa(libctx);
else if (dhe512)
dhpkey = get_dh512(libctx);
+ else if (dhe4096)
+ dhpkey = get_dh4096(libctx);
else
dhpkey = get_dh2048(libctx);