80-test_ssl_old.t 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571
  1. #! /usr/bin/env perl
  2. # Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
  3. #
  4. # Licensed under the Apache License 2.0 (the "License"). You may not use
  5. # this file except in compliance with the License. You can obtain a copy
  6. # in the file LICENSE in the source distribution or at
  7. # https://www.openssl.org/source/license.html
  8. use strict;
  9. use warnings;
  10. use POSIX;
  11. use File::Basename;
  12. use File::Copy;
  13. use OpenSSL::Test qw/:DEFAULT with bldtop_file bldtop_dir srctop_file srctop_dir cmdstr/;
  14. use OpenSSL::Test::Utils;
  15. BEGIN {
  16. setup("test_ssl");
  17. }
  18. use lib srctop_dir('Configurations');
  19. use lib bldtop_dir('.');
  20. use platform;
  21. my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
  22. my $infile = bldtop_file('providers', platform->dso('fips'));
  23. my ($no_rsa, $no_dsa, $no_dh, $no_ec, $no_psk,
  24. $no_ssl3, $no_tls1, $no_tls1_1, $no_tls1_2, $no_tls1_3,
  25. $no_dtls, $no_dtls1, $no_dtls1_2, $no_ct) =
  26. anydisabled qw/rsa dsa dh ec psk
  27. ssl3 tls1 tls1_1 tls1_2 tls1_3
  28. dtls dtls1 dtls1_2 ct/;
  29. my $no_anytls = alldisabled(available_protocols("tls"));
  30. my $no_anydtls = alldisabled(available_protocols("dtls"));
  31. plan skip_all => "No SSL/TLS/DTLS protocol is support by this OpenSSL build"
  32. if $no_anytls && $no_anydtls;
  33. my $digest = "-sha1";
  34. my @reqcmd = ("openssl", "req");
  35. my @x509cmd = ("openssl", "x509", $digest);
  36. my @verifycmd = ("openssl", "verify");
  37. my @genpkeycmd = ("openssl", "genpkey");
  38. my $dummycnf = srctop_file("apps", "openssl.cnf");
  39. my $cnf = srctop_file("test", "ca-and-certs.cnf");
  40. my $CAkey = "keyCA.ss";
  41. my $CAcert="certCA.ss";
  42. my $CAserial="certCA.srl";
  43. my $CAreq="reqCA.ss";
  44. my $CAreq2="req2CA.ss"; # temp
  45. my $Ukey="keyU.ss";
  46. my $Ureq="reqU.ss";
  47. my $Ucert="certU.ss";
  48. my $Dkey="keyD.ss";
  49. my $Dreq="reqD.ss";
  50. my $Dcert="certD.ss";
  51. my $Ekey="keyE.ss";
  52. my $Ereq="reqE.ss";
  53. my $Ecert="certE.ss";
  54. my $proxycnf=srctop_file("test", "proxy.cnf");
  55. my $P1key="keyP1.ss";
  56. my $P1req="reqP1.ss";
  57. my $P1cert="certP1.ss";
  58. my $P1intermediate="tmp_intP1.ss";
  59. my $P2key="keyP2.ss";
  60. my $P2req="reqP2.ss";
  61. my $P2cert="certP2.ss";
  62. my $P2intermediate="tmp_intP2.ss";
  63. my $server_sess="server.ss";
  64. my $client_sess="client.ss";
  65. # ssltest_old.c is deprecated in favour of the new framework in ssl_test.c
  66. # If you're adding tests here, you probably want to convert them to the
  67. # new format in ssl_test.c and add recipes to 80-test_ssl_new.t instead.
  68. plan tests =>
  69. ($no_fips ? 0 : 1 + 5) # For fipsinstall + testssl with fips provider
  70. + 1 # For testss
  71. + 5 # For the testssl with default provider
  72. ;
  73. unless ($no_fips) {
  74. ok(run(app(['openssl', 'fipsinstall',
  75. '-out', bldtop_file('providers', 'fipsmodule.cnf'),
  76. '-module', $infile])),
  77. "fipsinstall");
  78. }
  79. subtest 'test_ss' => sub {
  80. if (testss()) {
  81. open OUT, ">", "intP1.ss";
  82. copy($CAcert, \*OUT); copy($Ucert, \*OUT);
  83. close OUT;
  84. open OUT, ">", "intP2.ss";
  85. copy($CAcert, \*OUT); copy($Ucert, \*OUT); copy($P1cert, \*OUT);
  86. close OUT;
  87. }
  88. };
  89. note('test_ssl -- key U');
  90. testssl("keyU.ss", $Ucert, $CAcert, "default", srctop_file("test","default.cnf"));
  91. unless ($no_fips) {
  92. testssl("keyU.ss", $Ucert, $CAcert, "fips", srctop_file("test","fips.cnf"));
  93. }
  94. # -----------
  95. # subtest functions
  96. sub testss {
  97. my @req_dsa = ("-newkey",
  98. "dsa:".srctop_file("apps", "dsa1024.pem"));
  99. my $dsaparams = srctop_file("apps", "dsa1024.pem");
  100. my @req_new;
  101. if ($no_rsa) {
  102. @req_new = @req_dsa;
  103. } else {
  104. @req_new = ("-new");
  105. }
  106. plan tests => 17;
  107. SKIP: {
  108. skip 'failure', 16 unless
  109. ok(run(app([@reqcmd, "-config", $cnf,
  110. "-out", $CAreq, "-keyout", $CAkey,
  111. @req_new])),
  112. 'make cert request');
  113. skip 'failure', 15 unless
  114. ok(run(app([@x509cmd, "-CAcreateserial", "-in", $CAreq, "-days", "30",
  115. "-req", "-out", $CAcert, "-signkey", $CAkey,
  116. "-extfile", $cnf, "-extensions", "v3_ca"],
  117. stdout => "err.ss")),
  118. 'convert request into self-signed cert');
  119. skip 'failure', 14 unless
  120. ok(run(app([@x509cmd, "-in", $CAcert,
  121. "-x509toreq", "-signkey", $CAkey, "-out", $CAreq2],
  122. stdout => "err.ss")),
  123. 'convert cert into a cert request');
  124. skip 'failure', 13 unless
  125. ok(run(app([@reqcmd, "-config", $dummycnf,
  126. "-verify", "-in", $CAreq, "-noout"])),
  127. 'verify request 1');
  128. skip 'failure', 12 unless
  129. ok(run(app([@reqcmd, "-config", $dummycnf,
  130. "-verify", "-in", $CAreq2, "-noout"])),
  131. 'verify request 2');
  132. skip 'failure', 11 unless
  133. ok(run(app([@verifycmd, "-CAfile", $CAcert, $CAcert])),
  134. 'verify signature');
  135. skip 'failure', 10 unless
  136. ok(run(app([@reqcmd, "-config", $cnf, "-section", "userreq",
  137. "-out", $Ureq, "-keyout", $Ukey, @req_new],
  138. stdout => "err.ss")),
  139. 'make a user cert request');
  140. skip 'failure', 9 unless
  141. ok(run(app([@x509cmd, "-CAcreateserial", "-in", $Ureq, "-days", "30",
  142. "-req", "-out", $Ucert,
  143. "-CA", $CAcert, "-CAkey", $CAkey, "-CAserial", $CAserial,
  144. "-extfile", $cnf, "-extensions", "v3_ee"],
  145. stdout => "err.ss"))
  146. && run(app([@verifycmd, "-CAfile", $CAcert, $Ucert])),
  147. 'sign user cert request');
  148. skip 'failure', 8 unless
  149. ok(run(app([@x509cmd,
  150. "-subject", "-issuer", "-startdate", "-enddate",
  151. "-noout", "-in", $Ucert])),
  152. 'Certificate details');
  153. skip 'failure', 7 unless
  154. subtest 'DSA certificate creation' => sub {
  155. plan skip_all => "skipping DSA certificate creation"
  156. if $no_dsa;
  157. plan tests => 5;
  158. SKIP: {
  159. $ENV{CN2} = "DSA Certificate";
  160. skip 'failure', 4 unless
  161. ok(run(app([@genpkeycmd, "-out", $Dkey,
  162. "-paramfile", $dsaparams],
  163. stdout => "err.ss")),
  164. "make a DSA key");
  165. skip 'failure', 3 unless
  166. ok(run(app([@reqcmd, "-new", "-config", $cnf,
  167. "-section", "userreq",
  168. "-out", $Dreq, "-key", $Dkey],
  169. stdout => "err.ss")),
  170. "make a DSA user cert request");
  171. skip 'failure', 2 unless
  172. ok(run(app([@x509cmd, "-CAcreateserial",
  173. "-in", $Dreq,
  174. "-days", "30",
  175. "-req",
  176. "-out", $Dcert,
  177. "-CA", $CAcert, "-CAkey", $CAkey,
  178. "-CAserial", $CAserial,
  179. "-extfile", $cnf,
  180. "-extensions", "v3_ee_dsa"],
  181. stdout => "err.ss")),
  182. "sign DSA user cert request");
  183. skip 'failure', 1 unless
  184. ok(run(app([@verifycmd, "-CAfile", $CAcert, $Dcert])),
  185. "verify DSA user cert");
  186. skip 'failure', 0 unless
  187. ok(run(app([@x509cmd,
  188. "-subject", "-issuer",
  189. "-startdate", "-enddate", "-noout",
  190. "-in", $Dcert])),
  191. "DSA Certificate details");
  192. }
  193. };
  194. skip 'failure', 6 unless
  195. subtest 'ECDSA/ECDH certificate creation' => sub {
  196. plan skip_all => "skipping ECDSA/ECDH certificate creation"
  197. if $no_ec;
  198. plan tests => 5;
  199. SKIP: {
  200. $ENV{CN2} = "ECDSA Certificate";
  201. skip 'failure', 4 unless
  202. ok(run(app(["openssl", "genpkey", "-genparam",
  203. "-algorithm", "EC",
  204. "-pkeyopt", "ec_paramgen_curve:P-256",
  205. "-pkeyopt", "ec_param_enc:named_curve",
  206. "-out", "ecp.ss"])),
  207. "make EC parameters");
  208. skip 'failure', 3 unless
  209. ok(run(app([@reqcmd, "-config", $cnf,
  210. "-section", "userreq",
  211. "-out", $Ereq, "-keyout", $Ekey,
  212. "-newkey", "ec:ecp.ss"],
  213. stdout => "err.ss")),
  214. "make a ECDSA/ECDH user cert request");
  215. skip 'failure', 2 unless
  216. ok(run(app([@x509cmd, "-CAcreateserial",
  217. "-in", $Ereq,
  218. "-days", "30",
  219. "-req",
  220. "-out", $Ecert,
  221. "-CA", $CAcert, "-CAkey", $CAkey,
  222. "-CAserial", $CAserial,
  223. "-extfile", $cnf,
  224. "-extensions", "v3_ee_ec"],
  225. stdout => "err.ss")),
  226. "sign ECDSA/ECDH user cert request");
  227. skip 'failure', 1 unless
  228. ok(run(app([@verifycmd, "-CAfile", $CAcert, $Ecert])),
  229. "verify ECDSA/ECDH user cert");
  230. skip 'failure', 0 unless
  231. ok(run(app([@x509cmd,
  232. "-subject", "-issuer",
  233. "-startdate", "-enddate", "-noout",
  234. "-in", $Ecert])),
  235. "ECDSA Certificate details");
  236. }
  237. };
  238. skip 'failure', 5 unless
  239. ok(run(app([@reqcmd, "-config", $proxycnf,
  240. "-out", $P1req, "-keyout", $P1key, @req_new],
  241. stdout => "err.ss")),
  242. 'make a proxy cert request');
  243. skip 'failure', 4 unless
  244. ok(run(app([@x509cmd, "-CAcreateserial", "-in", $P1req, "-days", "30",
  245. "-req", "-out", $P1cert,
  246. "-CA", $Ucert, "-CAkey", $Ukey,
  247. "-extfile", $proxycnf, "-extensions", "proxy"],
  248. stdout => "err.ss")),
  249. 'sign proxy with user cert');
  250. copy($Ucert, $P1intermediate);
  251. run(app([@verifycmd, "-CAfile", $CAcert,
  252. "-untrusted", $P1intermediate, $P1cert]));
  253. ok(run(app([@x509cmd,
  254. "-subject", "-issuer", "-startdate", "-enddate",
  255. "-noout", "-in", $P1cert])),
  256. 'Certificate details');
  257. skip 'failure', 2 unless
  258. ok(run(app([@reqcmd, "-config", $proxycnf, "-section", "proxy2_req",
  259. "-out", $P2req, "-keyout", $P2key,
  260. @req_new],
  261. stdout => "err.ss")),
  262. 'make another proxy cert request');
  263. skip 'failure', 1 unless
  264. ok(run(app([@x509cmd, "-CAcreateserial", "-in", $P2req, "-days", "30",
  265. "-req", "-out", $P2cert,
  266. "-CA", $P1cert, "-CAkey", $P1key,
  267. "-extfile", $proxycnf, "-extensions", "proxy_2"],
  268. stdout => "err.ss")),
  269. 'sign second proxy cert request with the first proxy cert');
  270. open OUT, ">", $P2intermediate;
  271. copy($Ucert, \*OUT); copy($P1cert, \*OUT);
  272. close OUT;
  273. run(app([@verifycmd, "-CAfile", $CAcert,
  274. "-untrusted", $P2intermediate, $P2cert]));
  275. ok(run(app([@x509cmd,
  276. "-subject", "-issuer", "-startdate", "-enddate",
  277. "-noout", "-in", $P2cert])),
  278. 'Certificate details');
  279. }
  280. }
  281. sub testssl {
  282. my ($key, $cert, $CAtmp, $provider, $configfile) = @_;
  283. my @CA = $CAtmp ? ("-CAfile", $CAtmp) : ("-CApath", bldtop_dir("certs"));
  284. my @ssltest = ("ssltest_old",
  285. "-s_key", $key, "-s_cert", $cert,
  286. "-c_key", $key, "-c_cert", $cert,
  287. "-provider", $provider,
  288. "-config", $configfile);
  289. my $serverinfo = srctop_file("test","serverinfo.pem");
  290. my $dsa_cert = 0;
  291. if (grep /DSA Public Key/, run(app(["openssl", "x509", "-in", $cert,
  292. "-text", "-noout"]), capture => 1)) {
  293. $dsa_cert = 1;
  294. }
  295. # plan tests => 11;
  296. subtest 'standard SSL tests' => sub {
  297. ######################################################################
  298. plan tests => 13;
  299. SKIP: {
  300. skip "SSLv3 is not supported by this OpenSSL build", 4
  301. if disabled("ssl3");
  302. skip "SSLv3 is not supported by the FIPS provider", 4
  303. if $provider eq "fips";
  304. ok(run(test([@ssltest, "-bio_pair", "-ssl3"])),
  305. 'test sslv3 via BIO pair');
  306. ok(run(test([@ssltest, "-bio_pair", "-ssl3", "-server_auth", @CA])),
  307. 'test sslv3 with server authentication via BIO pair');
  308. ok(run(test([@ssltest, "-bio_pair", "-ssl3", "-client_auth", @CA])),
  309. 'test sslv3 with client authentication via BIO pair');
  310. ok(run(test([@ssltest, "-bio_pair", "-ssl3", "-server_auth", "-client_auth", @CA])),
  311. 'test sslv3 with both server and client authentication via BIO pair');
  312. }
  313. SKIP: {
  314. skip "Neither SSLv3 nor any TLS version are supported by this OpenSSL build", 1
  315. if $no_anytls;
  316. ok(run(test([@ssltest, "-bio_pair"])),
  317. 'test sslv2/sslv3 via BIO pair');
  318. }
  319. SKIP: {
  320. skip "Neither SSLv3 nor any TLS version are supported by this OpenSSL build", 8
  321. if $no_anytls;
  322. SKIP: {
  323. skip "skipping test of sslv2/sslv3 w/o (EC)DHE test", 1 if $dsa_cert;
  324. ok(run(test([@ssltest, "-bio_pair", "-no_dhe", "-no_ecdhe"])),
  325. 'test sslv2/sslv3 w/o (EC)DHE via BIO pair');
  326. }
  327. ok(run(test([@ssltest, "-bio_pair", "-dhe1024dsa", "-v"])),
  328. 'test sslv2/sslv3 with 1024bit DHE via BIO pair');
  329. ok(run(test([@ssltest, "-bio_pair", "-server_auth", @CA])),
  330. 'test sslv2/sslv3 with server authentication');
  331. ok(run(test([@ssltest, "-bio_pair", "-client_auth", @CA])),
  332. 'test sslv2/sslv3 with client authentication via BIO pair');
  333. ok(run(test([@ssltest, "-bio_pair", "-server_auth", "-client_auth", @CA])),
  334. 'test sslv2/sslv3 with both client and server authentication via BIO pair');
  335. ok(run(test([@ssltest, "-bio_pair", "-server_auth", "-client_auth", "-app_verify", @CA])),
  336. 'test sslv2/sslv3 with both client and server authentication via BIO pair and app verify');
  337. SKIP: {
  338. skip "No IPv4 available on this machine", 1
  339. unless !disabled("sock") && have_IPv4();
  340. ok(run(test([@ssltest, "-ipv4"])),
  341. 'test TLS via IPv4');
  342. }
  343. SKIP: {
  344. skip "No IPv6 available on this machine", 1
  345. unless !disabled("sock") && have_IPv6();
  346. ok(run(test([@ssltest, "-ipv6"])),
  347. 'test TLS via IPv6');
  348. }
  349. }
  350. };
  351. subtest "Testing ciphersuites" => sub {
  352. my @exkeys = ();
  353. my $ciphers = "-PSK:-SRP";
  354. if (!$no_dsa) {
  355. push @exkeys, "-s_cert", "certD.ss", "-s_key", "keyD.ss";
  356. }
  357. if (!$no_ec) {
  358. push @exkeys, "-s_cert", "certE.ss", "-s_key", "keyE.ss";
  359. }
  360. my @protocols = ();
  361. # We only use the flags that ssltest_old understands
  362. push @protocols, "-tls1_3" unless $no_tls1_3;
  363. push @protocols, "-tls1_2" unless $no_tls1_2;
  364. push @protocols, "-tls1" unless $no_tls1 || $provider eq "fips";
  365. push @protocols, "-ssl3" unless $no_ssl3 || $provider eq "fips";
  366. my $protocolciphersuitecount = 0;
  367. my %ciphersuites = ();
  368. my %ciphersstatus = ();
  369. foreach my $protocol (@protocols) {
  370. my $ciphersstatus = undef;
  371. my @ciphers = run(app(["openssl", "ciphers", "-s", $protocol,
  372. "ALL:$ciphers"]),
  373. capture => 1, statusvar => \$ciphersstatus);
  374. @ciphers = grep {!/CAMELLIA|ARIA|CHACHA/} @ciphers;
  375. $ciphersstatus{$protocol} = $ciphersstatus;
  376. if ($ciphersstatus) {
  377. $ciphersuites{$protocol} = [ map { s|\R||; split(/:/, $_) }
  378. @ciphers ];
  379. $protocolciphersuitecount += scalar @{$ciphersuites{$protocol}};
  380. }
  381. }
  382. plan skip_all => "None of the ciphersuites to test are available in this OpenSSL build"
  383. if $protocolciphersuitecount + scalar(keys %ciphersuites) == 0;
  384. # The count of protocols is because in addition to the ciphersuites
  385. # we got above, we're running a weak DH test for each protocol (except
  386. # TLSv1.3)
  387. my $testcount = scalar(@protocols) + $protocolciphersuitecount
  388. + scalar(keys %ciphersuites);
  389. $testcount-- unless $no_tls1_3;
  390. plan tests => $testcount;
  391. foreach my $protocol (@protocols) {
  392. ok($ciphersstatus{$protocol}, "Getting ciphers for $protocol");
  393. }
  394. foreach my $protocol (sort keys %ciphersuites) {
  395. note "Testing ciphersuites for $protocol";
  396. # ssltest_old doesn't know -tls1_3, but that's fine, since that's
  397. # the default choice if TLSv1.3 enabled
  398. my $flag = $protocol eq "-tls1_3" ? "" : $protocol;
  399. my $ciphersuites = "";
  400. foreach my $cipher (@{$ciphersuites{$protocol}}) {
  401. if ($protocol eq "-ssl3" && $cipher =~ /ECDH/ ) {
  402. note "*****SKIPPING $protocol $cipher";
  403. ok(1);
  404. } else {
  405. if ($protocol eq "-tls1_3") {
  406. $ciphersuites = $cipher;
  407. $cipher = "";
  408. }
  409. ok(run(test([@ssltest, @exkeys, "-cipher", $cipher,
  410. "-ciphersuites", $ciphersuites, $flag || ()])),
  411. "Testing $cipher");
  412. }
  413. }
  414. next if $protocol eq "-tls1_3";
  415. is(run(test([@ssltest,
  416. "-s_cipher", "EDH",
  417. "-c_cipher", 'EDH:@SECLEVEL=1',
  418. "-dhe512",
  419. $protocol])), 0,
  420. "testing connection with weak DH, expecting failure");
  421. }
  422. };
  423. subtest 'RSA/(EC)DHE/PSK tests' => sub {
  424. ######################################################################
  425. plan tests => 5;
  426. SKIP: {
  427. skip "TLSv1.0 is not supported by this OpenSSL build", 5
  428. if $no_tls1 || $provider eq "fips";
  429. SKIP: {
  430. skip "skipping anonymous DH tests", 1
  431. if ($no_dh);
  432. ok(run(test([@ssltest, "-v", "-bio_pair", "-tls1", "-cipher", "ADH", "-dhe1024dsa", "-num", "10", "-f", "-time"])),
  433. 'test tlsv1 with 1024bit anonymous DH, multiple handshakes');
  434. }
  435. SKIP: {
  436. skip "skipping RSA tests", 2
  437. if $no_rsa;
  438. ok(run(test(["ssltest_old", "-provider", "default", "-v", "-bio_pair", "-tls1", "-s_cert", srctop_file("apps","server2.pem"), "-no_dhe", "-no_ecdhe", "-num", "10", "-f", "-time"])),
  439. 'test tlsv1 with 1024bit RSA, no (EC)DHE, multiple handshakes');
  440. skip "skipping RSA+DHE tests", 1
  441. if $no_dh;
  442. ok(run(test(["ssltest_old", "-provider", "default", "-v", "-bio_pair", "-tls1", "-s_cert", srctop_file("apps","server2.pem"), "-dhe1024dsa", "-num", "10", "-f", "-time"])),
  443. 'test tlsv1 with 1024bit RSA, 1024bit DHE, multiple handshakes');
  444. }
  445. SKIP: {
  446. skip "skipping PSK tests", 2
  447. if ($no_psk);
  448. ok(run(test([@ssltest, "-tls1", "-cipher", "PSK", "-psk", "abc123"])),
  449. 'test tls1 with PSK');
  450. ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "PSK", "-psk", "abc123"])),
  451. 'test tls1 with PSK via BIO pair');
  452. }
  453. }
  454. };
  455. subtest 'Custom Extension tests' => sub {
  456. ######################################################################
  457. plan tests => 1;
  458. SKIP: {
  459. skip "TLSv1.0 is not supported by this OpenSSL build", 1
  460. if $no_tls1 || $provider eq "fips";
  461. ok(run(test([@ssltest, "-bio_pair", "-tls1", "-custom_ext"])),
  462. 'test tls1 with custom extensions');
  463. }
  464. };
  465. subtest 'Serverinfo tests' => sub {
  466. ######################################################################
  467. plan tests => 5;
  468. SKIP: {
  469. skip "TLSv1.0 is not supported by this OpenSSL build", 5
  470. if $no_tls1 || $provider eq "fips";
  471. note('echo test tls1 with serverinfo');
  472. ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo])));
  473. ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo, "-serverinfo_sct"])));
  474. ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo, "-serverinfo_tack"])));
  475. ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo, "-serverinfo_sct", "-serverinfo_tack"])));
  476. ok(run(test([@ssltest, "-bio_pair", "-tls1", "-custom_ext", "-serverinfo_file", $serverinfo, "-serverinfo_sct", "-serverinfo_tack"])));
  477. }
  478. };
  479. }