18-dtls-renegotiate.cnf.in 6.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192
  1. # -*- mode: perl; -*-
  2. # Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
  3. #
  4. # Licensed under the Apache License 2.0 (the "License"). You may not use
  5. # this file except in compliance with the License. You can obtain a copy
  6. # in the file LICENSE in the source distribution or at
  7. # https://www.openssl.org/source/license.html
  8. ## Test Renegotiation
  9. use strict;
  10. use warnings;
  11. package ssltests;
  12. use OpenSSL::Test::Utils;
  13. our @tests = ();
  14. foreach my $sctp ("No", "Yes")
  15. {
  16. next if disabled("sctp") && $sctp eq "Yes";
  17. my $suffix = ($sctp eq "No") ? "" : "-sctp";
  18. our @tests_basic = (
  19. {
  20. name => "renegotiate-client-no-resume".$suffix,
  21. server => {
  22. "Options" => "NoResumptionOnRenegotiation"
  23. },
  24. client => {},
  25. test => {
  26. "Method" => "DTLS",
  27. "UseSCTP" => $sctp,
  28. "HandshakeMode" => "RenegotiateClient",
  29. "ResumptionExpected" => "No",
  30. "ExpectedResult" => "Success"
  31. }
  32. },
  33. {
  34. name => "renegotiate-client-resume".$suffix,
  35. server => {},
  36. client => {},
  37. test => {
  38. "Method" => "DTLS",
  39. "UseSCTP" => $sctp,
  40. "HandshakeMode" => "RenegotiateClient",
  41. "ResumptionExpected" => "Yes",
  42. "ExpectedResult" => "Success"
  43. }
  44. },
  45. # Note: Unlike the TLS tests, we will never do resumption with server
  46. # initiated reneg. This is because an OpenSSL DTLS client will always do a full
  47. # handshake (i.e. it doesn't supply a session id) when it receives a
  48. # HelloRequest. This is different to the OpenSSL TLS implementation where an
  49. # OpenSSL client will always try an abbreviated handshake (i.e. it will supply
  50. # the session id). This goes all the way to commit 48ae85b6f when abbreviated
  51. # handshake support was first added. Neither behaviour is wrong, but the
  52. # discrepancy is strange. TODO: Should we harmonise the TLS and DTLS behaviour,
  53. # and if so, what to?
  54. {
  55. name => "renegotiate-server-resume".$suffix,
  56. server => {},
  57. client => {},
  58. test => {
  59. "Method" => "DTLS",
  60. "UseSCTP" => $sctp,
  61. "HandshakeMode" => "RenegotiateServer",
  62. "ResumptionExpected" => "No",
  63. "ExpectedResult" => "Success"
  64. }
  65. },
  66. {
  67. name => "renegotiate-client-auth-require".$suffix,
  68. server => {
  69. "VerifyCAFile" => test_pem("root-cert.pem"),
  70. "VerifyMode" => "Require",
  71. },
  72. client => {
  73. "Certificate" => test_pem("ee-client-chain.pem"),
  74. "PrivateKey" => test_pem("ee-key.pem"),
  75. },
  76. test => {
  77. "Method" => "DTLS",
  78. "UseSCTP" => $sctp,
  79. "HandshakeMode" => "RenegotiateServer",
  80. "ResumptionExpected" => "No",
  81. "ExpectedResult" => "Success"
  82. }
  83. },
  84. {
  85. name => "renegotiate-client-auth-once".$suffix,
  86. server => {
  87. "VerifyCAFile" => test_pem("root-cert.pem"),
  88. "VerifyMode" => "Once",
  89. },
  90. client => {
  91. "Certificate" => test_pem("ee-client-chain.pem"),
  92. "PrivateKey" => test_pem("ee-key.pem"),
  93. },
  94. test => {
  95. "Method" => "DTLS",
  96. "UseSCTP" => $sctp,
  97. "HandshakeMode" => "RenegotiateServer",
  98. "ResumptionExpected" => "No",
  99. "ExpectedResult" => "Success"
  100. }
  101. }
  102. );
  103. push @tests, @tests_basic;
  104. next if disabled("dtls1_2");
  105. our @tests_dtls1_2 = (
  106. {
  107. name => "renegotiate-aead-to-non-aead".$suffix,
  108. server => {
  109. "Options" => "NoResumptionOnRenegotiation"
  110. },
  111. client => {
  112. "CipherString" => "AES128-GCM-SHA256",
  113. extra => {
  114. "RenegotiateCiphers" => "AES128-SHA"
  115. }
  116. },
  117. test => {
  118. "Method" => "DTLS",
  119. "UseSCTP" => $sctp,
  120. "HandshakeMode" => "RenegotiateClient",
  121. "ResumptionExpected" => "No",
  122. "ExpectedResult" => "Success"
  123. }
  124. },
  125. {
  126. name => "renegotiate-non-aead-to-aead".$suffix,
  127. server => {
  128. "Options" => "NoResumptionOnRenegotiation"
  129. },
  130. client => {
  131. "CipherString" => "AES128-SHA",
  132. extra => {
  133. "RenegotiateCiphers" => "AES128-GCM-SHA256"
  134. }
  135. },
  136. test => {
  137. "Method" => "DTLS",
  138. "UseSCTP" => $sctp,
  139. "HandshakeMode" => "RenegotiateClient",
  140. "ResumptionExpected" => "No",
  141. "ExpectedResult" => "Success"
  142. }
  143. },
  144. {
  145. name => "renegotiate-non-aead-to-non-aead".$suffix,
  146. server => {
  147. "Options" => "NoResumptionOnRenegotiation"
  148. },
  149. client => {
  150. "CipherString" => "AES128-SHA",
  151. extra => {
  152. "RenegotiateCiphers" => "AES256-SHA"
  153. }
  154. },
  155. test => {
  156. "Method" => "DTLS",
  157. "UseSCTP" => $sctp,
  158. "HandshakeMode" => "RenegotiateClient",
  159. "ResumptionExpected" => "No",
  160. "ExpectedResult" => "Success"
  161. }
  162. },
  163. {
  164. name => "renegotiate-aead-to-aead".$suffix,
  165. server => {
  166. "Options" => "NoResumptionOnRenegotiation"
  167. },
  168. client => {
  169. "CipherString" => "AES128-GCM-SHA256",
  170. extra => {
  171. "RenegotiateCiphers" => "AES256-GCM-SHA384"
  172. }
  173. },
  174. test => {
  175. "Method" => "DTLS",
  176. "UseSCTP" => $sctp,
  177. "HandshakeMode" => "RenegotiateClient",
  178. "ResumptionExpected" => "No",
  179. "ExpectedResult" => "Success"
  180. }
  181. },
  182. );
  183. push @tests, @tests_dtls1_2;
  184. }