Skip to content

T
Third Party Openssl

OpenHarmony / Third Party Openssl
1 年多 前同步成功

通知 10
Star 18
Fork 1
T
Third Party Openssl
提交 582a17d6 编写于 作者: M Matt Caswell
浏览文件
操作

Add the SSL_METHOD for TLSv1.3 and all other base changes required 

Includes addition of the various options to s_server/s_client. Also adds
one of the new TLS1.3 ciphersuites.

This isn't "real" TLS1.3!! It's identical to TLS1.2 apart from the protocol
and the ciphersuite...and the ciphersuite is just a renamed TLS1.2 one (not
a "real" TLS1.3 ciphersuite).
Reviewed-by: NRich Salz <rsalz@openssl.org>
上级 ffd3d0ef
显示空白变更内容
内联 并排
Showing with 11488 addition and 1459 deletion
apps/apps.h
浏览文件 @ 582a17d6
...@@ -210,7 +210,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate, ...@@ -210,7 +210,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate,
# define OPT_S_ENUM \ # define OPT_S_ENUM \
OPT_S__FIRST=3000, \ OPT_S__FIRST=3000, \
OPT_S_NOSSL3, OPT_S_NOTLS1, OPT_S_NOTLS1_1, OPT_S_NOTLS1_2, \ OPT_S_NOSSL3, OPT_S_NOTLS1, OPT_S_NOTLS1_1, OPT_S_NOTLS1_2, \
OPT_S_BUGS, OPT_S_NO_COMP, OPT_S_NOTICKET, \ OPT_S_NOTLS1_3, OPT_S_BUGS, OPT_S_NO_COMP, OPT_S_NOTICKET, \
OPT_S_SERVERPREF, OPT_S_LEGACYRENEG, OPT_S_LEGACYCONN, \ OPT_S_SERVERPREF, OPT_S_LEGACYRENEG, OPT_S_LEGACYCONN, \
OPT_S_ONRESUMP, OPT_S_NOLEGACYCONN, OPT_S_STRICT, OPT_S_SIGALGS, \ OPT_S_ONRESUMP, OPT_S_NOLEGACYCONN, OPT_S_STRICT, OPT_S_SIGALGS, \
OPT_S_CLIENTSIGALGS, OPT_S_CURVES, OPT_S_NAMEDCURVE, OPT_S_CIPHER, \ OPT_S_CLIENTSIGALGS, OPT_S_CURVES, OPT_S_NAMEDCURVE, OPT_S_CIPHER, \
...@@ -222,6 +222,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate, ...@@ -222,6 +222,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate,
{"no_tls1", OPT_S_NOTLS1, '-', "Just disable TLSv1"}, \ {"no_tls1", OPT_S_NOTLS1, '-', "Just disable TLSv1"}, \
{"no_tls1_1", OPT_S_NOTLS1_1, '-', "Just disable TLSv1.1" }, \ {"no_tls1_1", OPT_S_NOTLS1_1, '-', "Just disable TLSv1.1" }, \
{"no_tls1_2", OPT_S_NOTLS1_2, '-', "Just disable TLSv1.2"}, \ {"no_tls1_2", OPT_S_NOTLS1_2, '-', "Just disable TLSv1.2"}, \
{"no_tls1_3", OPT_S_NOTLS1_3, '-', "Just disable TLSv1.3"}, \
{"bugs", OPT_S_BUGS, '-', "Turn on SSL bug compatibility"}, \ {"bugs", OPT_S_BUGS, '-', "Turn on SSL bug compatibility"}, \
{"no_comp", OPT_S_NO_COMP, '-', "Disable SSL/TLS compression (default)" }, \ {"no_comp", OPT_S_NO_COMP, '-', "Disable SSL/TLS compression (default)" }, \
{"comp", OPT_S_COMP, '-', "Use SSL/TLS-level compression" }, \ {"comp", OPT_S_COMP, '-', "Use SSL/TLS-level compression" }, \
...@@ -259,6 +260,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate, ...@@ -259,6 +260,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate,
case OPT_S_NOTLS1: \ case OPT_S_NOTLS1: \
case OPT_S_NOTLS1_1: \ case OPT_S_NOTLS1_1: \
case OPT_S_NOTLS1_2: \ case OPT_S_NOTLS1_2: \
case OPT_S_NOTLS1_3: \
case OPT_S_BUGS: \ case OPT_S_BUGS: \
case OPT_S_NO_COMP: \ case OPT_S_NO_COMP: \
case OPT_S_COMP: \ case OPT_S_COMP: \
...@@ -279,7 +281,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate, ...@@ -279,7 +281,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate,
#define IS_NO_PROT_FLAG(o) \ #define IS_NO_PROT_FLAG(o) \
(o == OPT_S_NOSSL3 || o == OPT_S_NOTLS1 || o == OPT_S_NOTLS1_1 \ (o == OPT_S_NOSSL3 || o == OPT_S_NOTLS1 || o == OPT_S_NOTLS1_1 \
|| o == OPT_S_NOTLS1_2) || o == OPT_S_NOTLS1_2 || o == OPT_S_NOTLS1_3)
/* /*
* Option parsing. * Option parsing.
......
apps/ciphers.c
浏览文件 @ 582a17d6
...@@ -21,6 +21,7 @@ typedef enum OPTION_choice { ...@@ -21,6 +21,7 @@ typedef enum OPTION_choice {
OPT_TLS1, OPT_TLS1,
OPT_TLS1_1, OPT_TLS1_1,
OPT_TLS1_2, OPT_TLS1_2,
OPT_TLS1_3,
OPT_PSK, OPT_PSK,
OPT_SRP, OPT_SRP,
OPT_V, OPT_UPPER_V, OPT_S OPT_V, OPT_UPPER_V, OPT_S
...@@ -43,6 +44,9 @@ const OPTIONS ciphers_options[] = { ...@@ -43,6 +44,9 @@ const OPTIONS ciphers_options[] = {
#ifndef OPENSSL_NO_TLS1_2 #ifndef OPENSSL_NO_TLS1_2
{"tls1_2", OPT_TLS1_2, '-', "TLS1.2 mode"}, {"tls1_2", OPT_TLS1_2, '-', "TLS1.2 mode"},
#endif #endif
#ifndef OPENSSL_NO_TLS1_3
{"tls1_3", OPT_TLS1_3, '-', "TLS1.3 mode"},
#endif
#ifndef OPENSSL_NO_SSL_TRACE #ifndef OPENSSL_NO_SSL_TRACE
{"stdname", OPT_STDNAME, '-', "Show standard cipher names"}, {"stdname", OPT_STDNAME, '-', "Show standard cipher names"},
#endif #endif
...@@ -135,6 +139,10 @@ int ciphers_main(int argc, char **argv) ...@@ -135,6 +139,10 @@ int ciphers_main(int argc, char **argv)
min_version = TLS1_2_VERSION; min_version = TLS1_2_VERSION;
max_version = TLS1_2_VERSION; max_version = TLS1_2_VERSION;
break; break;
case OPT_TLS1_3:
min_version = TLS1_3_VERSION;
max_version = TLS1_3_VERSION;
break;
case OPT_PSK: case OPT_PSK:
#ifndef OPENSSL_NO_PSK #ifndef OPENSSL_NO_PSK
psk = 1; psk = 1;
......
apps/s_cb.c
浏览文件 @ 582a17d6
...@@ -453,6 +453,7 @@ static STRINT_PAIR ssl_versions[] = { ...@@ -453,6 +453,7 @@ static STRINT_PAIR ssl_versions[] = {
{"TLS 1.0", TLS1_VERSION}, {"TLS 1.0", TLS1_VERSION},
{"TLS 1.1", TLS1_1_VERSION}, {"TLS 1.1", TLS1_1_VERSION},
{"TLS 1.2", TLS1_2_VERSION}, {"TLS 1.2", TLS1_2_VERSION},
{"TLS 1.3", TLS1_3_VERSION},
{"DTLS 1.0", DTLS1_VERSION}, {"DTLS 1.0", DTLS1_VERSION},
{"DTLS 1.0 (bad)", DTLS1_BAD_VER}, {"DTLS 1.0 (bad)", DTLS1_BAD_VER},
{NULL} {NULL}
...@@ -522,6 +523,7 @@ void msg_cb(int write_p, int version, int content_type, const void *buf, ...@@ -522,6 +523,7 @@ void msg_cb(int write_p, int version, int content_type, const void *buf,
version == TLS1_VERSION || version == TLS1_VERSION ||
version == TLS1_1_VERSION || version == TLS1_1_VERSION ||
version == TLS1_2_VERSION || version == TLS1_2_VERSION ||
version == TLS1_3_VERSION ||
version == DTLS1_VERSION || version == DTLS1_BAD_VER) { version == DTLS1_VERSION || version == DTLS1_BAD_VER) {
switch (content_type) { switch (content_type) {
case 20: case 20:
......
apps/s_client.c
浏览文件 @ 582a17d6
...@@ -539,7 +539,7 @@ typedef enum OPTION_choice { ...@@ -539,7 +539,7 @@ typedef enum OPTION_choice {
OPT_SRP_MOREGROUPS, OPT_SRP_MOREGROUPS,
#endif #endif
OPT_SSL3, OPT_SSL_CONFIG, OPT_SSL3, OPT_SSL_CONFIG,
OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1, OPT_TLS1_3, OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1,
OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_KEYFORM, OPT_PASS, OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_KEYFORM, OPT_PASS,
OPT_CERT_CHAIN, OPT_CAPATH, OPT_NOCAPATH, OPT_CHAINCAPATH, OPT_CERT_CHAIN, OPT_CAPATH, OPT_NOCAPATH, OPT_CHAINCAPATH,
OPT_VERIFYCAPATH, OPT_VERIFYCAPATH,
...@@ -680,6 +680,9 @@ const OPTIONS s_client_options[] = { ...@@ -680,6 +680,9 @@ const OPTIONS s_client_options[] = {
#ifndef OPENSSL_NO_TLS1_2 #ifndef OPENSSL_NO_TLS1_2
{"tls1_2", OPT_TLS1_2, '-', "Just use TLSv1.2"}, {"tls1_2", OPT_TLS1_2, '-', "Just use TLSv1.2"},
#endif #endif
#ifndef OPENSSL_NO_TLS1_3
{"tls1_3", OPT_TLS1_3, '-', "Just use TLSv1.3"},
#endif
#ifndef OPENSSL_NO_DTLS #ifndef OPENSSL_NO_DTLS
{"dtls", OPT_DTLS, '-', "Use any version of DTLS"}, {"dtls", OPT_DTLS, '-', "Use any version of DTLS"},
{"timeout", OPT_TIMEOUT, '-', {"timeout", OPT_TIMEOUT, '-',
...@@ -762,7 +765,7 @@ static const OPT_PAIR services[] = { ...@@ -762,7 +765,7 @@ static const OPT_PAIR services[] = {
#define IS_PROT_FLAG(o) \ #define IS_PROT_FLAG(o) \
(o == OPT_SSL3 || o == OPT_TLS1 || o == OPT_TLS1_1 || o == OPT_TLS1_2 \ (o == OPT_SSL3 || o == OPT_TLS1 || o == OPT_TLS1_1 || o == OPT_TLS1_2 \
|| o == OPT_DTLS || o == OPT_DTLS1 || o == OPT_DTLS1_2) || o == OPT_TLS1_3 || o == OPT_DTLS || o == OPT_DTLS1 || o == OPT_DTLS1_2)
/* Free |*dest| and optionally set it to a copy of |source|. */ /* Free |*dest| and optionally set it to a copy of |source|. */
static void freeandcopy(char **dest, const char *source) static void freeandcopy(char **dest, const char *source)
...@@ -1156,6 +1159,10 @@ int s_client_main(int argc, char **argv) ...@@ -1156,6 +1159,10 @@ int s_client_main(int argc, char **argv)
min_version = SSL3_VERSION; min_version = SSL3_VERSION;
max_version = SSL3_VERSION; max_version = SSL3_VERSION;
break; break;
case OPT_TLS1_3:
min_version = TLS1_3_VERSION;
max_version = TLS1_3_VERSION;
break;
case OPT_TLS1_2: case OPT_TLS1_2:
min_version = TLS1_2_VERSION; min_version = TLS1_2_VERSION;
max_version = TLS1_2_VERSION; max_version = TLS1_2_VERSION;
......
apps/s_server.c
浏览文件 @ 582a17d6
...@@ -669,7 +669,7 @@ typedef enum OPTION_choice { ...@@ -669,7 +669,7 @@ typedef enum OPTION_choice {
OPT_NO_RESUME_EPHEMERAL, OPT_PSK_HINT, OPT_PSK, OPT_SRPVFILE, OPT_NO_RESUME_EPHEMERAL, OPT_PSK_HINT, OPT_PSK, OPT_SRPVFILE,
OPT_SRPUSERSEED, OPT_REV, OPT_WWW, OPT_UPPER_WWW, OPT_HTTP, OPT_ASYNC, OPT_SRPUSERSEED, OPT_REV, OPT_WWW, OPT_UPPER_WWW, OPT_HTTP, OPT_ASYNC,
OPT_SSL_CONFIG, OPT_SPLIT_SEND_FRAG, OPT_MAX_PIPELINES, OPT_READ_BUF, OPT_SSL_CONFIG, OPT_SPLIT_SEND_FRAG, OPT_MAX_PIPELINES, OPT_READ_BUF,
OPT_SSL3, OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1, OPT_SSL3, OPT_TLS1_3, OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1,
OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_LISTEN, OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_LISTEN,
OPT_ID_PREFIX, OPT_RAND, OPT_SERVERNAME, OPT_SERVERNAME_FATAL, OPT_ID_PREFIX, OPT_RAND, OPT_SERVERNAME, OPT_SERVERNAME_FATAL,
OPT_CERT2, OPT_KEY2, OPT_NEXTPROTONEG, OPT_ALPN, OPT_CERT2, OPT_KEY2, OPT_NEXTPROTONEG, OPT_ALPN,
...@@ -834,6 +834,9 @@ const OPTIONS s_server_options[] = { ...@@ -834,6 +834,9 @@ const OPTIONS s_server_options[] = {
#ifndef OPENSSL_NO_TLS1_2 #ifndef OPENSSL_NO_TLS1_2
{"tls1_2", OPT_TLS1_2, '-', "just talk TLSv1.2"}, {"tls1_2", OPT_TLS1_2, '-', "just talk TLSv1.2"},
#endif #endif
#ifndef OPENSSL_NO_TLS1_3
{"tls1_3", OPT_TLS1_3, '-', "just talk TLSv1.3"},
#endif
#ifndef OPENSSL_NO_DTLS #ifndef OPENSSL_NO_DTLS
{"dtls", OPT_DTLS, '-', "Use any DTLS version"}, {"dtls", OPT_DTLS, '-', "Use any DTLS version"},
{"timeout", OPT_TIMEOUT, '-', "Enable timeouts"}, {"timeout", OPT_TIMEOUT, '-', "Enable timeouts"},
...@@ -868,7 +871,7 @@ const OPTIONS s_server_options[] = { ...@@ -868,7 +871,7 @@ const OPTIONS s_server_options[] = {
#define IS_PROT_FLAG(o) \ #define IS_PROT_FLAG(o) \
(o == OPT_SSL3 || o == OPT_TLS1 || o == OPT_TLS1_1 || o == OPT_TLS1_2 \ (o == OPT_SSL3 || o == OPT_TLS1 || o == OPT_TLS1_1 || o == OPT_TLS1_2 \
|| o == OPT_DTLS || o == OPT_DTLS1 || o == OPT_DTLS1_2) || o == OPT_TLS1_3 || o == OPT_DTLS || o == OPT_DTLS1 || o == OPT_DTLS1_2)
int s_server_main(int argc, char *argv[]) int s_server_main(int argc, char *argv[])
{ {
...@@ -1321,6 +1324,10 @@ int s_server_main(int argc, char *argv[]) ...@@ -1321,6 +1324,10 @@ int s_server_main(int argc, char *argv[])
min_version = SSL3_VERSION; min_version = SSL3_VERSION;
max_version = SSL3_VERSION; max_version = SSL3_VERSION;
break; break;
case OPT_TLS1_3:
min_version = TLS1_3_VERSION;
max_version = TLS1_3_VERSION;
break;
case OPT_TLS1_2: case OPT_TLS1_2:
min_version = TLS1_2_VERSION; min_version = TLS1_2_VERSION;
max_version = TLS1_2_VERSION; max_version = TLS1_2_VERSION;
......
doc/man1/ciphers.pod
浏览文件 @ 582a17d6
...@@ -15,6 +15,7 @@ B<openssl> B<ciphers> ...@@ -15,6 +15,7 @@ B<openssl> B<ciphers>
[B<-tls1>] [B<-tls1>]
[B<-tls1_1>] [B<-tls1_1>]
[B<-tls1_2>] [B<-tls1_2>]
[B<-tls1_3>]
[B<-s>] [B<-s>]
[B<-psk>] [B<-psk>]
[B<-srp>] [B<-srp>]
...@@ -69,6 +70,11 @@ L<SSL_CIPHER_description(3)>. ...@@ -69,6 +70,11 @@ L<SSL_CIPHER_description(3)>.
Like B<-v>, but include the official cipher suite values in hex. Like B<-v>, but include the official cipher suite values in hex.
=item B<-tls1_3>
In combination with the B<-s> option, list the ciphers which would be used if
TLSv1.3 were negotiated.
=item B<-tls1_2> =item B<-tls1_2>
In combination with the B<-s> option, list the ciphers which would be used if In combination with the B<-s> option, list the ciphers which would be used if
......
doc/man1/s_client.pod
浏览文件 @ 582a17d6
...@@ -68,10 +68,12 @@ B<openssl> B<s_client> ...@@ -68,10 +68,12 @@ B<openssl> B<s_client>
[B<-tls1>] [B<-tls1>]
[B<-tls1_1>] [B<-tls1_1>]
[B<-tls1_2>] [B<-tls1_2>]
[B<-tls1_3>]
[B<-no_ssl3>] [B<-no_ssl3>]
[B<-no_tls1>] [B<-no_tls1>]
[B<-no_tls1_1>] [B<-no_tls1_1>]
[B<-no_tls1_2>] [B<-no_tls1_2>]
[B<-no_tls1_3>]
[B<-dtls>] [B<-dtls>]
[B<-dtls1>] [B<-dtls1>]
[B<-dtls1_2>] [B<-dtls1_2>]
...@@ -336,7 +338,7 @@ Use the PSK key B<key> when using a PSK cipher suite. The key is ...@@ -336,7 +338,7 @@ Use the PSK key B<key> when using a PSK cipher suite. The key is
given as a hexadecimal number without leading 0x, for example -psk given as a hexadecimal number without leading 0x, for example -psk
1a2b3c4d. 1a2b3c4d.
=item B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2> =item B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-tls1_3>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>, B<-no_tls1_3>
These options require or disable the use of the specified SSL or TLS protocols. These options require or disable the use of the specified SSL or TLS protocols.
By default B<s_client> will negotiate the highest mutually supported protocol By default B<s_client> will negotiate the highest mutually supported protocol
......
doc/man1/s_server.pod
浏览文件 @ 582a17d6
...@@ -69,6 +69,9 @@ B<openssl> B<s_server> ...@@ -69,6 +69,9 @@ B<openssl> B<s_server>
[B<-quiet>] [B<-quiet>]
[B<-ssl3>] [B<-ssl3>]
[B<-tls1>] [B<-tls1>]
[B<-tls1_1>]
[B<-tls1_2>]
[B<-tls1_3>]
[B<-dtls>] [B<-dtls>]
[B<-dtls1>] [B<-dtls1>]
[B<-dtls1_2>] [B<-dtls1_2>]
...@@ -81,6 +84,7 @@ B<openssl> B<s_server> ...@@ -81,6 +84,7 @@ B<openssl> B<s_server>
[B<-no_tls1>] [B<-no_tls1>]
[B<-no_tls1_1>] [B<-no_tls1_1>]
[B<-no_tls1_2>] [B<-no_tls1_2>]
[B<-no_tls1_3>]
[B<-no_dhe>] [B<-no_dhe>]
[B<-bugs>] [B<-bugs>]
[B<-comp>] [B<-comp>]
...@@ -295,7 +299,7 @@ Use the PSK key B<key> when using a PSK cipher suite. The key is ...@@ -295,7 +299,7 @@ Use the PSK key B<key> when using a PSK cipher suite. The key is
given as a hexadecimal number without leading 0x, for example -psk given as a hexadecimal number without leading 0x, for example -psk
1a2b3c4d. 1a2b3c4d.
=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2> =item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-tls1_3>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>, B<-no_tls1_3>
These options require or disable the use of the specified SSL or TLS protocols. These options require or disable the use of the specified SSL or TLS protocols.
By default B<s_server> will negotiate the highest mutually supported protocol By default B<s_server> will negotiate the highest mutually supported protocol
......
doc/man3/SSL_CONF_cmd.pod
浏览文件 @ 582a17d6
...@@ -121,12 +121,13 @@ if specified. ...@@ -121,12 +121,13 @@ if specified.
To restrict the supported protocol versions use these commands rather To restrict the supported protocol versions use these commands rather
than the deprecated alternative commands below. than the deprecated alternative commands below.
=item B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2> =item B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>, B<-no_tls1_3>
Disables protocol support for SSLv3, TLSv1.0, TLSv1.1 or TLSv1.2 by setting the Disables protocol support for SSLv3, TLSv1.0, TLSv1.1, TLSv1.2 or TLSv1.3 by
corresponding options B<SSL_OP_NO_SSLv3>, B<SSL_OP_NO_TLSv1>, B<SSL_OP_NO_TLSv1_1> setting the corresponding options B<SSL_OP_NO_SSLv3>, B<SSL_OP_NO_TLSv1>,
and B<SSL_OP_NO_TLSv1_2> respectively. B<SSL_OP_NO_TLSv1_1>, B<SSL_OP_NO_TLSv1_2> and B<SSL_OP_NO_TLSv1_3>
These options are deprecated, instead use B<-min_protocol> and B<-max_protocol>. respectively. These options are deprecated, instead use B<-min_protocol> and
B<-max_protocol>.
=item B<-bugs> =item B<-bugs>
......
doc/man3/SSL_CTX_new.pod
浏览文件 @ 582a17d6
...@@ -156,12 +156,12 @@ and be able to negotiate with all possible clients, but to only ...@@ -156,12 +156,12 @@ and be able to negotiate with all possible clients, but to only
allow newer protocols like TLS 1.0, TLS 1.1 or TLS 1.2. allow newer protocols like TLS 1.0, TLS 1.1 or TLS 1.2.
The list of protocols available can also be limited using the The list of protocols available can also be limited using the
B<SSL_OP_NO_SSLv3>, B<SSL_OP_NO_TLSv1>, B<SSL_OP_NO_TLSv1_1> and B<SSL_OP_NO_SSLv3>, B<SSL_OP_NO_TLSv1>, B<SSL_OP_NO_TLSv1_1>,
B<SSL_OP_NO_TLSv1_2> options of the L<SSL_CTX_set_options(3)> or B<SSL_OP_NO_TLSv1_3> and B<SSL_OP_NO_TLSv1_2> options of the
L<SSL_set_options(3)> functions, but this approach is not recommended. L<SSL_CTX_set_options(3)> or L<SSL_set_options(3)> functions, but this approach
Clients should avoid creating "holes" in the set of protocols they support. is not recommended. Clients should avoid creating "holes" in the set of
When disabling a protocol, make sure that you also disable either all previous protocols they support. When disabling a protocol, make sure that you also
or all subsequent protocol versions. disable either all previous or all subsequent protocol versions.
In clients, when a protocol version is disabled without disabling I<all> In clients, when a protocol version is disabled without disabling I<all>
previous protocol versions, the effect is to also disable all subsequent previous protocol versions, the effect is to also disable all subsequent
protocol versions. protocol versions.
......
doc/man3/SSL_CTX_set_min_proto_version.pod
浏览文件 @ 582a17d6
...@@ -29,8 +29,8 @@ versions down to the lowest version, or up to the highest version ...@@ -29,8 +29,8 @@ versions down to the lowest version, or up to the highest version
supported by the library, respectively. supported by the library, respectively.
Currently supported versions are B<SSL3_VERSION>, B<TLS1_VERSION>, Currently supported versions are B<SSL3_VERSION>, B<TLS1_VERSION>,
B<TLS1_1_VERSION>, B<TLS1_2_VERSION> for TLS and B<DTLS1_VERSION>, B<TLS1_1_VERSION>, B<TLS1_2_VERSION>, B<TLS1_3_VERSION> for TLS and
B<DTLS1_2_VERSION> for DTLS. B<DTLS1_VERSION>, B<DTLS1_2_VERSION> for DTLS.
=head1 RETURN VALUES =head1 RETURN VALUES
......
doc/man3/SSL_CTX_set_options.pod
浏览文件 @ 582a17d6
...@@ -155,9 +155,9 @@ own preferences. ...@@ -155,9 +155,9 @@ own preferences.
=item SSL_OP_NO_SSLv3, SSL_OP_NO_TLSv1, SSL_OP_NO_TLSv1_1, =item SSL_OP_NO_SSLv3, SSL_OP_NO_TLSv1, SSL_OP_NO_TLSv1_1,
SSL_OP_NO_TLSv1_2, SSL_OP_NO_DTLSv1, SSL_OP_NO_DTLSv1_2 SSL_OP_NO_TLSv1_2, SSL_OP_NO_TLSv1_3, SSL_OP_NO_DTLSv1, SSL_OP_NO_DTLSv1_2
These options turn off the SSLv3, TLSv1, TLSv1.1 or TLSv1.2 protocol These options turn off the SSLv3, TLSv1, TLSv1.1, TLSv1.2 or TLSv1.3 protocol
versions with TLS or the DTLSv1, DTLSv1.2 versions with DTLS, versions with TLS or the DTLSv1, DTLSv1.2 versions with DTLS,
respectively. respectively.
As of OpenSSL 1.1.0, these options are deprecated, use As of OpenSSL 1.1.0, these options are deprecated, use
......
include/openssl/ssl.h
浏览文件 @ 582a17d6
...@@ -343,12 +343,13 @@ typedef int (*custom_ext_parse_cb) (SSL *s, unsigned int ext_type, ...@@ -343,12 +343,13 @@ typedef int (*custom_ext_parse_cb) (SSL *s, unsigned int ext_type,
# define SSL_OP_NO_TLSv1 0x04000000U # define SSL_OP_NO_TLSv1 0x04000000U
# define SSL_OP_NO_TLSv1_2 0x08000000U # define SSL_OP_NO_TLSv1_2 0x08000000U
# define SSL_OP_NO_TLSv1_1 0x10000000U # define SSL_OP_NO_TLSv1_1 0x10000000U
# define SSL_OP_NO_TLSv1_3 0x20000000U
# define SSL_OP_NO_DTLSv1 0x04000000U # define SSL_OP_NO_DTLSv1 0x04000000U
# define SSL_OP_NO_DTLSv1_2 0x08000000U # define SSL_OP_NO_DTLSv1_2 0x08000000U
# define SSL_OP_NO_SSL_MASK (SSL_OP_NO_SSLv3|\ # define SSL_OP_NO_SSL_MASK (SSL_OP_NO_SSLv3|\
SSL_OP_NO_TLSv1|SSL_OP_NO_TLSv1_1|SSL_OP_NO_TLSv1_2) SSL_OP_NO_TLSv1|SSL_OP_NO_TLSv1_1|SSL_OP_NO_TLSv1_2|SSL_OP_NO_TLSv1_3)
# define SSL_OP_NO_DTLS_MASK (SSL_OP_NO_DTLSv1|SSL_OP_NO_DTLSv1_2) # define SSL_OP_NO_DTLS_MASK (SSL_OP_NO_DTLSv1|SSL_OP_NO_DTLSv1_2)
......
include/openssl/tls1.h
浏览文件 @ 582a17d6
...@@ -65,7 +65,8 @@ extern "C" { ...@@ -65,7 +65,8 @@ extern "C" {
# define TLS1_VERSION 0x0301 # define TLS1_VERSION 0x0301
# define TLS1_1_VERSION 0x0302 # define TLS1_1_VERSION 0x0302
# define TLS1_2_VERSION 0x0303 # define TLS1_2_VERSION 0x0303
# define TLS_MAX_VERSION TLS1_2_VERSION # define TLS1_3_VERSION 0x0304
# define TLS_MAX_VERSION TLS1_3_VERSION
/* Special value for method supporting multiple versions */ /* Special value for method supporting multiple versions */
# define TLS_ANY_VERSION 0x10000 # define TLS_ANY_VERSION 0x10000
...@@ -599,6 +600,9 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb) ...@@ -599,6 +600,9 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
# define TLS1_CK_DHE_PSK_WITH_CHACHA20_POLY1305 0x0300CCAD # define TLS1_CK_DHE_PSK_WITH_CHACHA20_POLY1305 0x0300CCAD
# define TLS1_CK_RSA_PSK_WITH_CHACHA20_POLY1305 0x0300CCAE # define TLS1_CK_RSA_PSK_WITH_CHACHA20_POLY1305 0x0300CCAE
/* TLS v1.3 ciphersuites */
# define TLS1_3_CK_AES_128_GCM_SHA256 0x03000D01
/* /*
* XXX Backward compatibility alert: Older versions of OpenSSL gave some DHE * XXX Backward compatibility alert: Older versions of OpenSSL gave some DHE
* ciphers names with "EDH" instead of "DHE". Going forward, we should be * ciphers names with "EDH" instead of "DHE". Going forward, we should be
...@@ -868,6 +872,13 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb) ...@@ -868,6 +872,13 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
# define TLS1_TXT_DHE_PSK_WITH_CHACHA20_POLY1305 "DHE-PSK-CHACHA20-POLY1305" # define TLS1_TXT_DHE_PSK_WITH_CHACHA20_POLY1305 "DHE-PSK-CHACHA20-POLY1305"
# define TLS1_TXT_RSA_PSK_WITH_CHACHA20_POLY1305 "RSA-PSK-CHACHA20-POLY1305" # define TLS1_TXT_RSA_PSK_WITH_CHACHA20_POLY1305 "RSA-PSK-CHACHA20-POLY1305"
/* TLSv1.3 ciphersuites */
/*
* TODO(TLS1.3): Review the naming scheme for TLSv1.3 ciphers and also the
* cipherstring selection process for these ciphers
*/
# define TLS1_3_TXT_AES_128_GCM_SHA256 "TLS13-AES-128-GCM-SHA256"
# define TLS_CT_RSA_SIGN 1 # define TLS_CT_RSA_SIGN 1
# define TLS_CT_DSS_SIGN 2 # define TLS_CT_DSS_SIGN 2
# define TLS_CT_RSA_FIXED_DH 3 # define TLS_CT_RSA_FIXED_DH 3
......
ssl/methods.c
浏览文件 @ 582a17d6
...@@ -19,6 +19,12 @@ IMPLEMENT_tls_meth_func(TLS_ANY_VERSION, 0, 0, ...@@ -19,6 +19,12 @@ IMPLEMENT_tls_meth_func(TLS_ANY_VERSION, 0, 0,
TLS_method, TLS_method,
ossl_statem_accept, ossl_statem_accept,
ossl_statem_connect, TLSv1_2_enc_data) ossl_statem_connect, TLSv1_2_enc_data)
#ifndef OPENSSL_NO_TLS1_3_METHOD
IMPLEMENT_tls_meth_func(TLS1_3_VERSION, 0, SSL_OP_NO_TLSv1_3,
tlsv1_3_method,
ossl_statem_accept,
ossl_statem_connect, TLSv1_3_enc_data)
#endif
#ifndef OPENSSL_NO_TLS1_2_METHOD #ifndef OPENSSL_NO_TLS1_2_METHOD
IMPLEMENT_tls_meth_func(TLS1_2_VERSION, 0, SSL_OP_NO_TLSv1_2, IMPLEMENT_tls_meth_func(TLS1_2_VERSION, 0, SSL_OP_NO_TLSv1_2,
tlsv1_2_method, tlsv1_2_method,
...@@ -46,6 +52,12 @@ IMPLEMENT_tls_meth_func(TLS_ANY_VERSION, 0, 0, ...@@ -46,6 +52,12 @@ IMPLEMENT_tls_meth_func(TLS_ANY_VERSION, 0, 0,
TLS_server_method, TLS_server_method,
ossl_statem_accept, ossl_statem_accept,
ssl_undefined_function, TLSv1_2_enc_data) ssl_undefined_function, TLSv1_2_enc_data)
#ifndef OPENSSL_NO_TLS1_3_METHOD
IMPLEMENT_tls_meth_func(TLS1_3_VERSION, 0, SSL_OP_NO_TLSv1_3,
tlsv1_3_server_method,
ossl_statem_accept,
ssl_undefined_function, TLSv1_3_enc_data)
#endif
#ifndef OPENSSL_NO_TLS1_2_METHOD #ifndef OPENSSL_NO_TLS1_2_METHOD
IMPLEMENT_tls_meth_func(TLS1_2_VERSION, 0, SSL_OP_NO_TLSv1_2, IMPLEMENT_tls_meth_func(TLS1_2_VERSION, 0, SSL_OP_NO_TLSv1_2,
tlsv1_2_server_method, tlsv1_2_server_method,
...@@ -75,6 +87,12 @@ IMPLEMENT_tls_meth_func(TLS_ANY_VERSION, 0, 0, ...@@ -75,6 +87,12 @@ IMPLEMENT_tls_meth_func(TLS_ANY_VERSION, 0, 0,
TLS_client_method, TLS_client_method,
ssl_undefined_function, ssl_undefined_function,
ossl_statem_connect, TLSv1_2_enc_data) ossl_statem_connect, TLSv1_2_enc_data)
#ifndef OPENSSL_NO_TLS1_3_METHOD
IMPLEMENT_tls_meth_func(TLS1_3_VERSION, 0, SSL_OP_NO_TLSv1_3,
tlsv1_3_client_method,
ssl_undefined_function,
ossl_statem_connect, TLSv1_3_enc_data)
#endif
#ifndef OPENSSL_NO_TLS1_2_METHOD #ifndef OPENSSL_NO_TLS1_2_METHOD
IMPLEMENT_tls_meth_func(TLS1_2_VERSION, 0, SSL_OP_NO_TLSv1_2, IMPLEMENT_tls_meth_func(TLS1_2_VERSION, 0, SSL_OP_NO_TLSv1_2,
tlsv1_2_client_method, tlsv1_2_client_method,
......
ssl/s3_lib.c
浏览文件 @ 582a17d6
...@@ -834,6 +834,21 @@ static SSL_CIPHER ssl3_ciphers[] = { ...@@ -834,6 +834,21 @@ static SSL_CIPHER ssl3_ciphers[] = {
256, 256,
256, 256,
}, },
{
1,
TLS1_3_TXT_AES_128_GCM_SHA256,
TLS1_3_CK_AES_128_GCM_SHA256,
SSL_kRSA,
SSL_aRSA,
SSL_AES128GCM,
SSL_AEAD,
TLS1_3_VERSION, TLS1_3_VERSION,
0, 0,
SSL_HIGH,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
128,
128,
},
#ifndef OPENSSL_NO_EC #ifndef OPENSSL_NO_EC
{ {
......
ssl/ssl_conf.c
浏览文件 @ 582a17d6
...@@ -257,6 +257,7 @@ static int cmd_Protocol(SSL_CONF_CTX *cctx, const char *value) ...@@ -257,6 +257,7 @@ static int cmd_Protocol(SSL_CONF_CTX *cctx, const char *value)
SSL_FLAG_TBL_INV("TLSv1", SSL_OP_NO_TLSv1), SSL_FLAG_TBL_INV("TLSv1", SSL_OP_NO_TLSv1),
SSL_FLAG_TBL_INV("TLSv1.1", SSL_OP_NO_TLSv1_1), SSL_FLAG_TBL_INV("TLSv1.1", SSL_OP_NO_TLSv1_1),
SSL_FLAG_TBL_INV("TLSv1.2", SSL_OP_NO_TLSv1_2), SSL_FLAG_TBL_INV("TLSv1.2", SSL_OP_NO_TLSv1_2),
SSL_FLAG_TBL_INV("TLSv1.3", SSL_OP_NO_TLSv1_3),
SSL_FLAG_TBL_INV("DTLSv1", SSL_OP_NO_DTLSv1), SSL_FLAG_TBL_INV("DTLSv1", SSL_OP_NO_DTLSv1),
SSL_FLAG_TBL_INV("DTLSv1.2", SSL_OP_NO_DTLSv1_2) SSL_FLAG_TBL_INV("DTLSv1.2", SSL_OP_NO_DTLSv1_2)
}; };
...@@ -282,6 +283,7 @@ static int protocol_from_string(const char *value) ...@@ -282,6 +283,7 @@ static int protocol_from_string(const char *value)
{"TLSv1", TLS1_VERSION}, {"TLSv1", TLS1_VERSION},
{"TLSv1.1", TLS1_1_VERSION}, {"TLSv1.1", TLS1_1_VERSION},
{"TLSv1.2", TLS1_2_VERSION}, {"TLSv1.2", TLS1_2_VERSION},
{"TLSv1.3", TLS1_3_VERSION},
{"DTLSv1", DTLS1_VERSION}, {"DTLSv1", DTLS1_VERSION},
{"DTLSv1.2", DTLS1_2_VERSION} {"DTLSv1.2", DTLS1_2_VERSION}
}; };
...@@ -526,6 +528,7 @@ static const ssl_conf_cmd_tbl ssl_conf_cmds[] = { ...@@ -526,6 +528,7 @@ static const ssl_conf_cmd_tbl ssl_conf_cmds[] = {
SSL_CONF_CMD_SWITCH("no_tls1", 0), SSL_CONF_CMD_SWITCH("no_tls1", 0),
SSL_CONF_CMD_SWITCH("no_tls1_1", 0), SSL_CONF_CMD_SWITCH("no_tls1_1", 0),
SSL_CONF_CMD_SWITCH("no_tls1_2", 0), SSL_CONF_CMD_SWITCH("no_tls1_2", 0),
SSL_CONF_CMD_SWITCH("no_tls1_3", 0),
SSL_CONF_CMD_SWITCH("bugs", 0), SSL_CONF_CMD_SWITCH("bugs", 0),
SSL_CONF_CMD_SWITCH("no_comp", 0), SSL_CONF_CMD_SWITCH("no_comp", 0),
SSL_CONF_CMD_SWITCH("comp", 0), SSL_CONF_CMD_SWITCH("comp", 0),
...@@ -583,6 +586,7 @@ static const ssl_switch_tbl ssl_cmd_switches[] = { ...@@ -583,6 +586,7 @@ static const ssl_switch_tbl ssl_cmd_switches[] = {
{SSL_OP_NO_TLSv1, 0}, /* no_tls1 */ {SSL_OP_NO_TLSv1, 0}, /* no_tls1 */
{SSL_OP_NO_TLSv1_1, 0}, /* no_tls1_1 */ {SSL_OP_NO_TLSv1_1, 0}, /* no_tls1_1 */
{SSL_OP_NO_TLSv1_2, 0}, /* no_tls1_2 */ {SSL_OP_NO_TLSv1_2, 0}, /* no_tls1_2 */
{SSL_OP_NO_TLSv1_3, 0}, /* no_tls1_3 */
{SSL_OP_ALL, 0}, /* bugs */ {SSL_OP_ALL, 0}, /* bugs */
{SSL_OP_NO_COMPRESSION, 0}, /* no_comp */ {SSL_OP_NO_COMPRESSION, 0}, /* no_comp */
{SSL_OP_NO_COMPRESSION, SSL_TFLAG_INV}, /* comp */ {SSL_OP_NO_COMPRESSION, SSL_TFLAG_INV}, /* comp */
......
ssl/ssl_lib.c
浏览文件 @ 582a17d6
...@@ -3072,7 +3072,9 @@ const SSL_METHOD *ssl_bad_method(int ver) ...@@ -3072,7 +3072,9 @@ const SSL_METHOD *ssl_bad_method(int ver)
const char *ssl_protocol_to_string(int version) const char *ssl_protocol_to_string(int version)
{ {
if (version == TLS1_2_VERSION) if (version == TLS1_3_VERSION)
return "TLSv1.3";
else if (version == TLS1_2_VERSION)
return "TLSv1.2"; return "TLSv1.2";
else if (version == TLS1_1_VERSION) else if (version == TLS1_1_VERSION)
return "TLSv1.1"; return "TLSv1.1";
......
ssl/ssl_locl.h
浏览文件 @ 582a17d6
...@@ -1641,6 +1641,9 @@ __owur const SSL_METHOD *tlsv1_1_client_method(void); ...@@ -1641,6 +1641,9 @@ __owur const SSL_METHOD *tlsv1_1_client_method(void);
__owur const SSL_METHOD *tlsv1_2_method(void); __owur const SSL_METHOD *tlsv1_2_method(void);
__owur const SSL_METHOD *tlsv1_2_server_method(void); __owur const SSL_METHOD *tlsv1_2_server_method(void);
__owur const SSL_METHOD *tlsv1_2_client_method(void); __owur const SSL_METHOD *tlsv1_2_client_method(void);
__owur const SSL_METHOD *tlsv1_3_method(void);
__owur const SSL_METHOD *tlsv1_3_server_method(void);
__owur const SSL_METHOD *tlsv1_3_client_method(void);
__owur const SSL_METHOD *dtlsv1_method(void); __owur const SSL_METHOD *dtlsv1_method(void);
__owur const SSL_METHOD *dtlsv1_server_method(void); __owur const SSL_METHOD *dtlsv1_server_method(void);
__owur const SSL_METHOD *dtlsv1_client_method(void); __owur const SSL_METHOD *dtlsv1_client_method(void);
...@@ -1652,6 +1655,7 @@ __owur const SSL_METHOD *dtlsv1_2_client_method(void); ...@@ -1652,6 +1655,7 @@ __owur const SSL_METHOD *dtlsv1_2_client_method(void);
extern const SSL3_ENC_METHOD TLSv1_enc_data; extern const SSL3_ENC_METHOD TLSv1_enc_data;
extern const SSL3_ENC_METHOD TLSv1_1_enc_data; extern const SSL3_ENC_METHOD TLSv1_1_enc_data;
extern const SSL3_ENC_METHOD TLSv1_2_enc_data; extern const SSL3_ENC_METHOD TLSv1_2_enc_data;
extern const SSL3_ENC_METHOD TLSv1_3_enc_data;
extern const SSL3_ENC_METHOD SSLv3_enc_data; extern const SSL3_ENC_METHOD SSLv3_enc_data;
extern const SSL3_ENC_METHOD DTLSv1_enc_data; extern const SSL3_ENC_METHOD DTLSv1_enc_data;
extern const SSL3_ENC_METHOD DTLSv1_2_enc_data; extern const SSL3_ENC_METHOD DTLSv1_2_enc_data;
......
ssl/ssl_sess.c
浏览文件 @ 582a17d6
...@@ -320,6 +320,9 @@ int ssl_get_new_session(SSL *s, int session) ...@@ -320,6 +320,9 @@ int ssl_get_new_session(SSL *s, int session)
} else if (s->version == TLS1_2_VERSION) { } else if (s->version == TLS1_2_VERSION) {
ss->ssl_version = TLS1_2_VERSION; ss->ssl_version = TLS1_2_VERSION;
ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH; ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
} else if (s->version == TLS1_3_VERSION) {
ss->ssl_version = TLS1_3_VERSION;
ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
} else if (s->version == DTLS1_BAD_VER) { } else if (s->version == DTLS1_BAD_VER) {
ss->ssl_version = DTLS1_BAD_VER; ss->ssl_version = DTLS1_BAD_VER;
ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH; ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
......
ssl/statem/statem_lib.c
浏览文件 @ 582a17d6
...@@ -647,11 +647,16 @@ typedef struct { ...@@ -647,11 +647,16 @@ typedef struct {
const SSL_METHOD *(*smeth) (void); const SSL_METHOD *(*smeth) (void);
} version_info; } version_info;
#if TLS_MAX_VERSION != TLS1_2_VERSION #if TLS_MAX_VERSION != TLS1_3_VERSION
# error Code needs update for TLS_method() support beyond TLS1_2_VERSION. # error Code needs update for TLS_method() support beyond TLS1_3_VERSION.
#endif #endif
static const version_info tls_version_table[] = { static const version_info tls_version_table[] = {
#ifndef OPENSSL_NO_TLS1_3
{TLS1_3_VERSION, tlsv1_3_client_method, tlsv1_3_server_method},
#else
{TLS1_3_VERSION, NULL, NULL},
#endif
#ifndef OPENSSL_NO_TLS1_2 #ifndef OPENSSL_NO_TLS1_2
{TLS1_2_VERSION, tlsv1_2_client_method, tlsv1_2_server_method}, {TLS1_2_VERSION, tlsv1_2_client_method, tlsv1_2_server_method},
#else #else
......
ssl/t1_lib.c
浏览文件 @ 582a17d6
...@@ -84,6 +84,26 @@ SSL3_ENC_METHOD const TLSv1_2_enc_data = { ...@@ -84,6 +84,26 @@ SSL3_ENC_METHOD const TLSv1_2_enc_data = {
ssl3_handshake_write ssl3_handshake_write
}; };
SSL3_ENC_METHOD const TLSv1_3_enc_data = {
tls1_enc,
tls1_mac,
tls1_setup_key_block,
tls1_generate_master_secret,
tls1_change_cipher_state,
tls1_final_finish_mac,
TLS1_FINISH_MAC_LENGTH,
TLS_MD_CLIENT_FINISH_CONST, TLS_MD_CLIENT_FINISH_CONST_SIZE,
TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
tls1_alert_code,
tls1_export_keying_material,
SSL_ENC_FLAG_EXPLICIT_IV | SSL_ENC_FLAG_SIGALGS | SSL_ENC_FLAG_SHA256_PRF
| SSL_ENC_FLAG_TLS1_2_CIPHERS,
SSL3_HM_HEADER_LENGTH,
ssl3_set_handshake_header,
tls_close_construct_packet,
ssl3_handshake_write
};
long tls1_default_timeout(void) long tls1_default_timeout(void)
{ {
/* /*
......
ssl/t1_trce.c
浏览文件 @ 582a17d6
...@@ -61,6 +61,7 @@ static ssl_trace_tbl ssl_version_tbl[] = { ...@@ -61,6 +61,7 @@ static ssl_trace_tbl ssl_version_tbl[] = {
{TLS1_VERSION, "TLS 1.0"}, {TLS1_VERSION, "TLS 1.0"},
{TLS1_1_VERSION, "TLS 1.1"}, {TLS1_1_VERSION, "TLS 1.1"},
{TLS1_2_VERSION, "TLS 1.2"}, {TLS1_2_VERSION, "TLS 1.2"},
{TLS1_3_VERSION, "TLS 1.3"},
{DTLS1_VERSION, "DTLS 1.0"}, {DTLS1_VERSION, "DTLS 1.0"},
{DTLS1_2_VERSION, "DTLS 1.2"}, {DTLS1_2_VERSION, "DTLS 1.2"},
{DTLS1_BAD_VER, "DTLS 1.0 (bad)"} {DTLS1_BAD_VER, "DTLS 1.0 (bad)"}
...@@ -422,6 +423,7 @@ static ssl_trace_tbl ssl_ciphers_tbl[] = { ...@@ -422,6 +423,7 @@ static ssl_trace_tbl ssl_ciphers_tbl[] = {
{0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305"}, {0xCCAC, "TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305"},
{0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305"}, {0xCCAD, "TLS_DHE_PSK_WITH_CHACHA20_POLY1305"},
{0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305"}, {0xCCAE, "TLS_RSA_PSK_WITH_CHACHA20_POLY1305"},
{0x0D01, "TLS_AES_128_GCM_SHA256"},
{0xFEFE, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"}, {0xFEFE, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
{0xFEFF, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA"}, {0xFEFF, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA"},
}; };
......
test/cipherlist_test.c
浏览文件 @ 582a17d6
...@@ -107,10 +107,14 @@ static const uint32_t default_ciphers_in_order[] = { ...@@ -107,10 +107,14 @@ static const uint32_t default_ciphers_in_order[] = {
#ifndef OPENSSL_NO_TLS1_2 #ifndef OPENSSL_NO_TLS1_2
TLS1_CK_RSA_WITH_AES_256_GCM_SHA384, TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
TLS1_CK_RSA_WITH_AES_128_GCM_SHA256, TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
#endif
#ifndef OPENSSL_NO_TLS1_3
TLS1_3_CK_AES_128_GCM_SHA256,
#endif
#ifndef OPENSSL_NO_TLS1_2
TLS1_CK_RSA_WITH_AES_256_SHA256, TLS1_CK_RSA_WITH_AES_256_SHA256,
TLS1_CK_RSA_WITH_AES_128_SHA256, TLS1_CK_RSA_WITH_AES_128_SHA256,
#endif #endif
TLS1_CK_RSA_WITH_AES_256_SHA, TLS1_CK_RSA_WITH_AES_256_SHA,
TLS1_CK_RSA_WITH_AES_128_SHA, TLS1_CK_RSA_WITH_AES_128_SHA,
}; };
......
test/recipes/80-test_ssl_old.t
浏览文件 @ 582a17d6
...@@ -21,10 +21,10 @@ setup("test_ssl"); ...@@ -21,10 +21,10 @@ setup("test_ssl");
$ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf"); $ENV{CTLOG_FILE} = srctop_file("test", "ct", "log_list.conf");
my ($no_rsa, $no_dsa, $no_dh, $no_ec, $no_srp, $no_psk, my ($no_rsa, $no_dsa, $no_dh, $no_ec, $no_srp, $no_psk,
$no_ssl3, $no_tls1, $no_tls1_1, $no_tls1_2, $no_ssl3, $no_tls1, $no_tls1_1, $no_tls1_2, $no_tls1_3,
$no_dtls, $no_dtls1, $no_dtls1_2, $no_ct) = $no_dtls, $no_dtls1, $no_dtls1_2, $no_ct) =
anydisabled qw/rsa dsa dh ec srp psk anydisabled qw/rsa dsa dh ec srp psk
ssl3 tls1 tls1_1 tls1_2 ssl3 tls1 tls1_1 tls1_2 tls1_3
dtls dtls1 dtls1_2 ct/; dtls dtls1 dtls1_2 ct/;
my $no_anytls = alldisabled(available_protocols("tls")); my $no_anytls = alldisabled(available_protocols("tls"));
my $no_anydtls = alldisabled(available_protocols("dtls")); my $no_anydtls = alldisabled(available_protocols("dtls"));
...@@ -446,6 +446,7 @@ sub testssl { ...@@ -446,6 +446,7 @@ sub testssl {
my @protocols = (); my @protocols = ();
# FIXME: I feel unsure about the following line, is that really just TLSv1.2, or is it all of the SSLv3/TLS protocols? # FIXME: I feel unsure about the following line, is that really just TLSv1.2, or is it all of the SSLv3/TLS protocols?
push(@protocols, "TLSv1.3") unless $no_tls1_3;
push(@protocols, "TLSv1.2") unless $no_tls1_2; push(@protocols, "TLSv1.2") unless $no_tls1_2;
push(@protocols, "SSLv3") unless $no_ssl3; push(@protocols, "SSLv3") unless $no_ssl3;
my $protocolciphersuitcount = 0; my $protocolciphersuitcount = 0;
...@@ -467,9 +468,14 @@ sub testssl { ...@@ -467,9 +468,14 @@ sub testssl {
foreach my $protocol (@protocols) { foreach my $protocol (@protocols) {
note "Testing ciphersuites for $protocol"; note "Testing ciphersuites for $protocol";
my $flag = "";
if ($protocol eq "SSLv3") {
$flag = "-ssl3";
} elsif ($protocol eq "TLSv1.2") {
$flag = "-tls1_2";
}
foreach my $cipher (@{$ciphersuites{$protocol}}) { foreach my $cipher (@{$ciphersuites{$protocol}}) {
ok(run(test([@ssltest, @exkeys, "-cipher", $cipher, ok(run(test([@ssltest, @exkeys, "-cipher", $cipher, $flag])),
$protocol eq "SSLv3" ? ("-ssl3") : ()])),
"Testing $cipher"); "Testing $cipher");
} }
is(run(test([@ssltest, is(run(test([@ssltest,
......
test/ssl-tests/02-protocol-version.conf
浏览文件 @ 582a17d6
因为 它太大了无法显示 source diff 。你可以改为 查看blob。
test/ssl-tests/10-resumption.conf
浏览文件 @ 582a17d6
# Generated with generate_ssl_tests.pl # Generated with generate_ssl_tests.pl
num_tests = 36 num_tests = 64
test-0 = 0-resumption test-0 = 0-resumption
test-1 = 1-resumption test-1 = 1-resumption
...@@ -38,6 +38,34 @@ test-32 = 32-resumption ...@@ -38,6 +38,34 @@ test-32 = 32-resumption
test-33 = 33-resumption test-33 = 33-resumption
test-34 = 34-resumption test-34 = 34-resumption
test-35 = 35-resumption test-35 = 35-resumption
test-36 = 36-resumption
test-37 = 37-resumption
test-38 = 38-resumption
test-39 = 39-resumption
test-40 = 40-resumption
test-41 = 41-resumption
test-42 = 42-resumption
test-43 = 43-resumption
test-44 = 44-resumption
test-45 = 45-resumption
test-46 = 46-resumption
test-47 = 47-resumption
test-48 = 48-resumption
test-49 = 49-resumption
test-50 = 50-resumption
test-51 = 51-resumption
test-52 = 52-resumption
test-53 = 53-resumption
test-54 = 54-resumption
test-55 = 55-resumption
test-56 = 56-resumption
test-57 = 57-resumption
test-58 = 58-resumption
test-59 = 59-resumption
test-60 = 60-resumption
test-61 = 61-resumption
test-62 = 62-resumption
test-63 = 63-resumption
# =========================================================== # ===========================================================
[0-resumption] [0-resumption]
...@@ -268,15 +296,15 @@ resume-client = 6-resumption-client ...@@ -268,15 +296,15 @@ resume-client = 6-resumption-client
[6-resumption-server] [6-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1
MinProtocol = TLSv1.1 MinProtocol = TLSv1
Options = SessionTicket Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-resumption-resume-server] [6-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1 MaxProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-resumption-client] [6-resumption-client]
...@@ -285,7 +313,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem ...@@ -285,7 +313,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-6] [test-6]
ExpectedProtocol = TLSv1 ExpectedProtocol = TLSv1.3
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = No
...@@ -304,15 +332,15 @@ resume-client = 7-resumption-client ...@@ -304,15 +332,15 @@ resume-client = 7-resumption-client
[7-resumption-server] [7-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1
MinProtocol = TLSv1.1 MinProtocol = TLSv1
Options = -SessionTicket Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-resumption-resume-server] [7-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1 MaxProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-resumption-client] [7-resumption-client]
...@@ -321,7 +349,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem ...@@ -321,7 +349,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-7] [test-7]
ExpectedProtocol = TLSv1 ExpectedProtocol = TLSv1.3
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = No
...@@ -348,7 +376,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -348,7 +376,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-resumption-resume-server] [8-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-resumption-client] [8-resumption-client]
...@@ -357,9 +385,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem ...@@ -357,9 +385,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-8] [test-8]
ExpectedProtocol = TLSv1.1 ExpectedProtocol = TLSv1
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = Yes ResumptionExpected = No
# =========================================================== # ===========================================================
...@@ -384,7 +412,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -384,7 +412,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[9-resumption-resume-server] [9-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[9-resumption-client] [9-resumption-client]
...@@ -393,9 +421,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem ...@@ -393,9 +421,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-9] [test-9]
ExpectedProtocol = TLSv1.1 ExpectedProtocol = TLSv1
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = Yes ResumptionExpected = No
# =========================================================== # ===========================================================
...@@ -420,7 +448,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -420,7 +448,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-resumption-resume-server] [10-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-resumption-client] [10-resumption-client]
...@@ -429,9 +457,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem ...@@ -429,9 +457,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-10] [test-10]
ExpectedProtocol = TLSv1.2 ExpectedProtocol = TLSv1.1
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = Yes
# =========================================================== # ===========================================================
...@@ -456,7 +484,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -456,7 +484,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-resumption-resume-server] [11-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1.1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-resumption-client] [11-resumption-client]
...@@ -465,9 +493,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem ...@@ -465,9 +493,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-11] [test-11]
ExpectedProtocol = TLSv1.2 ExpectedProtocol = TLSv1.1
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = Yes
# =========================================================== # ===========================================================
...@@ -484,15 +512,15 @@ resume-client = 12-resumption-client ...@@ -484,15 +512,15 @@ resume-client = 12-resumption-client
[12-resumption-server] [12-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1.1
MinProtocol = TLSv1.2 MinProtocol = TLSv1.1
Options = SessionTicket Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-resumption-resume-server] [12-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1 MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-resumption-client] [12-resumption-client]
...@@ -501,7 +529,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem ...@@ -501,7 +529,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-12] [test-12]
ExpectedProtocol = TLSv1 ExpectedProtocol = TLSv1.2
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = No
...@@ -520,15 +548,15 @@ resume-client = 13-resumption-client ...@@ -520,15 +548,15 @@ resume-client = 13-resumption-client
[13-resumption-server] [13-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1.1
MinProtocol = TLSv1.2 MinProtocol = TLSv1.1
Options = -SessionTicket Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-resumption-resume-server] [13-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1 MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-resumption-client] [13-resumption-client]
...@@ -537,7 +565,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem ...@@ -537,7 +565,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-13] [test-13]
ExpectedProtocol = TLSv1 ExpectedProtocol = TLSv1.2
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = No
...@@ -556,15 +584,15 @@ resume-client = 14-resumption-client ...@@ -556,15 +584,15 @@ resume-client = 14-resumption-client
[14-resumption-server] [14-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1.1
MinProtocol = TLSv1.2 MinProtocol = TLSv1.1
Options = SessionTicket Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-resumption-resume-server] [14-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-resumption-client] [14-resumption-client]
...@@ -573,7 +601,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem ...@@ -573,7 +601,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-14] [test-14]
ExpectedProtocol = TLSv1.1 ExpectedProtocol = TLSv1.3
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = No
...@@ -592,15 +620,15 @@ resume-client = 15-resumption-client ...@@ -592,15 +620,15 @@ resume-client = 15-resumption-client
[15-resumption-server] [15-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1.1
MinProtocol = TLSv1.2 MinProtocol = TLSv1.1
Options = -SessionTicket Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-resumption-resume-server] [15-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1.3
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-resumption-client] [15-resumption-client]
...@@ -609,7 +637,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem ...@@ -609,7 +637,7 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-15] [test-15]
ExpectedProtocol = TLSv1.1 ExpectedProtocol = TLSv1.3
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = No
...@@ -636,7 +664,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -636,7 +664,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[16-resumption-resume-server] [16-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[16-resumption-client] [16-resumption-client]
...@@ -645,9 +673,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem ...@@ -645,9 +673,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-16] [test-16]
ExpectedProtocol = TLSv1.2 ExpectedProtocol = TLSv1
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = Yes ResumptionExpected = No
# =========================================================== # ===========================================================
...@@ -672,7 +700,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -672,7 +700,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[17-resumption-resume-server] [17-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[17-resumption-client] [17-resumption-client]
...@@ -681,9 +709,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem ...@@ -681,9 +709,9 @@ VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-17] [test-17]
ExpectedProtocol = TLSv1.2 ExpectedProtocol = TLSv1
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = Yes ResumptionExpected = No
# =========================================================== # ===========================================================
...@@ -694,32 +722,32 @@ ssl_conf = 18-resumption-ssl ...@@ -694,32 +722,32 @@ ssl_conf = 18-resumption-ssl
[18-resumption-ssl] [18-resumption-ssl]
server = 18-resumption-server server = 18-resumption-server
client = 18-resumption-client client = 18-resumption-client
resume-server = 18-resumption-server resume-server = 18-resumption-resume-server
resume-client = 18-resumption-resume-client resume-client = 18-resumption-client
[18-resumption-server] [18-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Options = SessionTicket Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[18-resumption-client] [18-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1 MaxProtocol = TLSv1.1
MinProtocol = TLSv1 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[18-resumption-resume-client] [18-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-18] [test-18]
ExpectedProtocol = TLSv1 ExpectedProtocol = TLSv1.1
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = Yes ResumptionExpected = No
# =========================================================== # ===========================================================
...@@ -730,32 +758,32 @@ ssl_conf = 19-resumption-ssl ...@@ -730,32 +758,32 @@ ssl_conf = 19-resumption-ssl
[19-resumption-ssl] [19-resumption-ssl]
server = 19-resumption-server server = 19-resumption-server
client = 19-resumption-client client = 19-resumption-client
resume-server = 19-resumption-server resume-server = 19-resumption-resume-server
resume-client = 19-resumption-resume-client resume-client = 19-resumption-client
[19-resumption-server] [19-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Options = -SessionTicket Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[19-resumption-client] [19-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1 MaxProtocol = TLSv1.1
MinProtocol = TLSv1 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[19-resumption-resume-client] [19-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-19] [test-19]
ExpectedProtocol = TLSv1 ExpectedProtocol = TLSv1.1
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = Yes ResumptionExpected = No
# =========================================================== # ===========================================================
...@@ -766,32 +794,32 @@ ssl_conf = 20-resumption-ssl ...@@ -766,32 +794,32 @@ ssl_conf = 20-resumption-ssl
[20-resumption-ssl] [20-resumption-ssl]
server = 20-resumption-server server = 20-resumption-server
client = 20-resumption-client client = 20-resumption-client
resume-server = 20-resumption-server resume-server = 20-resumption-resume-server
resume-client = 20-resumption-resume-client resume-client = 20-resumption-client
[20-resumption-server] [20-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Options = SessionTicket Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[20-resumption-client] [20-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1 MaxProtocol = TLSv1.2
MinProtocol = TLSv1 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[20-resumption-resume-client] [20-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-20] [test-20]
ExpectedProtocol = TLSv1.1 ExpectedProtocol = TLSv1.2
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = Yes
# =========================================================== # ===========================================================
...@@ -802,32 +830,32 @@ ssl_conf = 21-resumption-ssl ...@@ -802,32 +830,32 @@ ssl_conf = 21-resumption-ssl
[21-resumption-ssl] [21-resumption-ssl]
server = 21-resumption-server server = 21-resumption-server
client = 21-resumption-client client = 21-resumption-client
resume-server = 21-resumption-server resume-server = 21-resumption-resume-server
resume-client = 21-resumption-resume-client resume-client = 21-resumption-client
[21-resumption-server] [21-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Options = -SessionTicket Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[21-resumption-client] [21-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1 MaxProtocol = TLSv1.2
MinProtocol = TLSv1 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[21-resumption-resume-client] [21-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-21] [test-21]
ExpectedProtocol = TLSv1.1 ExpectedProtocol = TLSv1.2
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = Yes
# =========================================================== # ===========================================================
...@@ -838,30 +866,30 @@ ssl_conf = 22-resumption-ssl ...@@ -838,30 +866,30 @@ ssl_conf = 22-resumption-ssl
[22-resumption-ssl] [22-resumption-ssl]
server = 22-resumption-server server = 22-resumption-server
client = 22-resumption-client client = 22-resumption-client
resume-server = 22-resumption-server resume-server = 22-resumption-resume-server
resume-client = 22-resumption-resume-client resume-client = 22-resumption-client
[22-resumption-server] [22-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Options = SessionTicket Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[22-resumption-client] [22-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1 MaxProtocol = TLSv1.3
MinProtocol = TLSv1 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[22-resumption-resume-client] [22-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-22] [test-22]
ExpectedProtocol = TLSv1.2 ExpectedProtocol = TLSv1.3
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = No
...@@ -874,30 +902,30 @@ ssl_conf = 23-resumption-ssl ...@@ -874,30 +902,30 @@ ssl_conf = 23-resumption-ssl
[23-resumption-ssl] [23-resumption-ssl]
server = 23-resumption-server server = 23-resumption-server
client = 23-resumption-client client = 23-resumption-client
resume-server = 23-resumption-server resume-server = 23-resumption-resume-server
resume-client = 23-resumption-resume-client resume-client = 23-resumption-client
[23-resumption-server] [23-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
Options = -SessionTicket Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[23-resumption-client] [23-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1 MaxProtocol = TLSv1.3
MinProtocol = TLSv1 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[23-resumption-resume-client] [23-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-23] [test-23]
ExpectedProtocol = TLSv1.2 ExpectedProtocol = TLSv1.3
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = No
...@@ -910,25 +938,25 @@ ssl_conf = 24-resumption-ssl ...@@ -910,25 +938,25 @@ ssl_conf = 24-resumption-ssl
[24-resumption-ssl] [24-resumption-ssl]
server = 24-resumption-server server = 24-resumption-server
client = 24-resumption-client client = 24-resumption-client
resume-server = 24-resumption-server resume-server = 24-resumption-resume-server
resume-client = 24-resumption-resume-client resume-client = 24-resumption-client
[24-resumption-server] [24-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = SessionTicket Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[24-resumption-client] [24-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1
MinProtocol = TLSv1.1 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[24-resumption-resume-client] [24-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
...@@ -946,25 +974,25 @@ ssl_conf = 25-resumption-ssl ...@@ -946,25 +974,25 @@ ssl_conf = 25-resumption-ssl
[25-resumption-ssl] [25-resumption-ssl]
server = 25-resumption-server server = 25-resumption-server
client = 25-resumption-client client = 25-resumption-client
resume-server = 25-resumption-server resume-server = 25-resumption-resume-server
resume-client = 25-resumption-resume-client resume-client = 25-resumption-client
[25-resumption-server] [25-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = -SessionTicket Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[25-resumption-client] [25-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1
MinProtocol = TLSv1.1 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[25-resumption-resume-client] [25-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
...@@ -982,32 +1010,32 @@ ssl_conf = 26-resumption-ssl ...@@ -982,32 +1010,32 @@ ssl_conf = 26-resumption-ssl
[26-resumption-ssl] [26-resumption-ssl]
server = 26-resumption-server server = 26-resumption-server
client = 26-resumption-client client = 26-resumption-client
resume-server = 26-resumption-server resume-server = 26-resumption-resume-server
resume-client = 26-resumption-resume-client resume-client = 26-resumption-client
[26-resumption-server] [26-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = SessionTicket Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[26-resumption-client] [26-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[26-resumption-resume-client] [26-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-26] [test-26]
ExpectedProtocol = TLSv1.1 ExpectedProtocol = TLSv1.1
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = Yes ResumptionExpected = No
# =========================================================== # ===========================================================
...@@ -1018,32 +1046,32 @@ ssl_conf = 27-resumption-ssl ...@@ -1018,32 +1046,32 @@ ssl_conf = 27-resumption-ssl
[27-resumption-ssl] [27-resumption-ssl]
server = 27-resumption-server server = 27-resumption-server
client = 27-resumption-client client = 27-resumption-client
resume-server = 27-resumption-server resume-server = 27-resumption-resume-server
resume-client = 27-resumption-resume-client resume-client = 27-resumption-client
[27-resumption-server] [27-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = -SessionTicket Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[27-resumption-client] [27-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[27-resumption-resume-client] [27-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-27] [test-27]
ExpectedProtocol = TLSv1.1 ExpectedProtocol = TLSv1.1
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = Yes ResumptionExpected = No
# =========================================================== # ===========================================================
...@@ -1054,25 +1082,25 @@ ssl_conf = 28-resumption-ssl ...@@ -1054,25 +1082,25 @@ ssl_conf = 28-resumption-ssl
[28-resumption-ssl] [28-resumption-ssl]
server = 28-resumption-server server = 28-resumption-server
client = 28-resumption-client client = 28-resumption-client
resume-server = 28-resumption-server resume-server = 28-resumption-resume-server
resume-client = 28-resumption-resume-client resume-client = 28-resumption-client
[28-resumption-server] [28-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = SessionTicket Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[28-resumption-client] [28-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1.2
MinProtocol = TLSv1.1 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[28-resumption-resume-client] [28-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
...@@ -1090,25 +1118,25 @@ ssl_conf = 29-resumption-ssl ...@@ -1090,25 +1118,25 @@ ssl_conf = 29-resumption-ssl
[29-resumption-ssl] [29-resumption-ssl]
server = 29-resumption-server server = 29-resumption-server
client = 29-resumption-client client = 29-resumption-client
resume-server = 29-resumption-server resume-server = 29-resumption-resume-server
resume-client = 29-resumption-resume-client resume-client = 29-resumption-client
[29-resumption-server] [29-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = -SessionTicket Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[29-resumption-client] [29-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1.2
MinProtocol = TLSv1.1 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[29-resumption-resume-client] [29-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
...@@ -1126,32 +1154,32 @@ ssl_conf = 30-resumption-ssl ...@@ -1126,32 +1154,32 @@ ssl_conf = 30-resumption-ssl
[30-resumption-ssl] [30-resumption-ssl]
server = 30-resumption-server server = 30-resumption-server
client = 30-resumption-client client = 30-resumption-client
resume-server = 30-resumption-server resume-server = 30-resumption-resume-server
resume-client = 30-resumption-resume-client resume-client = 30-resumption-client
[30-resumption-server] [30-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = SessionTicket Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[30-resumption-client] [30-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1.3
MinProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[30-resumption-resume-client] [30-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-30] [test-30]
ExpectedProtocol = TLSv1 ExpectedProtocol = TLSv1.3
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = Yes
# =========================================================== # ===========================================================
...@@ -1162,32 +1190,32 @@ ssl_conf = 31-resumption-ssl ...@@ -1162,32 +1190,32 @@ ssl_conf = 31-resumption-ssl
[31-resumption-ssl] [31-resumption-ssl]
server = 31-resumption-server server = 31-resumption-server
client = 31-resumption-client client = 31-resumption-client
resume-server = 31-resumption-server resume-server = 31-resumption-resume-server
resume-client = 31-resumption-resume-client resume-client = 31-resumption-client
[31-resumption-server] [31-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
Options = -SessionTicket Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[31-resumption-client] [31-resumption-resume-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1.3
MinProtocol = TLSv1.2 PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[31-resumption-resume-client] [31-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-31] [test-31]
ExpectedProtocol = TLSv1 ExpectedProtocol = TLSv1.3
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = Yes
# =========================================================== # ===========================================================
...@@ -1209,21 +1237,21 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -1209,21 +1237,21 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[32-resumption-client] [32-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1
MinProtocol = TLSv1.2 MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[32-resumption-resume-client] [32-resumption-resume-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-32] [test-32]
ExpectedProtocol = TLSv1.1 ExpectedProtocol = TLSv1
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = Yes
# =========================================================== # ===========================================================
...@@ -1245,21 +1273,21 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -1245,21 +1273,21 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[33-resumption-client] [33-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1
MinProtocol = TLSv1.2 MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[33-resumption-resume-client] [33-resumption-resume-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.1 MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-33] [test-33]
ExpectedProtocol = TLSv1.1 ExpectedProtocol = TLSv1
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No ResumptionExpected = Yes
# =========================================================== # ===========================================================
...@@ -1281,21 +1309,21 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -1281,21 +1309,21 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[34-resumption-client] [34-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1
MinProtocol = TLSv1.2 MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[34-resumption-resume-client] [34-resumption-resume-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-34] [test-34]
ExpectedProtocol = TLSv1.2 ExpectedProtocol = TLSv1.1
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = Yes ResumptionExpected = No
# =========================================================== # ===========================================================
...@@ -1317,20 +1345,1028 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -1317,20 +1345,1028 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[35-resumption-client] [35-resumption-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1
MinProtocol = TLSv1.2 MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[35-resumption-resume-client] [35-resumption-resume-client]
CipherString = DEFAULT CipherString = DEFAULT
MaxProtocol = TLSv1.2 MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
[test-35] [test-35]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[36-resumption]
ssl_conf = 36-resumption-ssl
[36-resumption-ssl]
server = 36-resumption-server
client = 36-resumption-client
resume-server = 36-resumption-server
resume-client = 36-resumption-resume-client
[36-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[36-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[36-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-36]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[37-resumption]
ssl_conf = 37-resumption-ssl
[37-resumption-ssl]
server = 37-resumption-server
client = 37-resumption-client
resume-server = 37-resumption-server
resume-client = 37-resumption-resume-client
[37-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[37-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[37-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-37]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[38-resumption]
ssl_conf = 38-resumption-ssl
[38-resumption-ssl]
server = 38-resumption-server
client = 38-resumption-client
resume-server = 38-resumption-server
resume-client = 38-resumption-resume-client
[38-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[38-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[38-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-38]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[39-resumption]
ssl_conf = 39-resumption-ssl
[39-resumption-ssl]
server = 39-resumption-server
client = 39-resumption-client
resume-server = 39-resumption-server
resume-client = 39-resumption-resume-client
[39-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[39-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
MinProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[39-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-39]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[40-resumption]
ssl_conf = 40-resumption-ssl
[40-resumption-ssl]
server = 40-resumption-server
client = 40-resumption-client
resume-server = 40-resumption-server
resume-client = 40-resumption-resume-client
[40-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[40-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[40-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-40]
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[41-resumption]
ssl_conf = 41-resumption-ssl
[41-resumption-ssl]
server = 41-resumption-server
client = 41-resumption-client
resume-server = 41-resumption-server
resume-client = 41-resumption-resume-client
[41-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[41-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[41-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-41]
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[42-resumption]
ssl_conf = 42-resumption-ssl
[42-resumption-ssl]
server = 42-resumption-server
client = 42-resumption-client
resume-server = 42-resumption-server
resume-client = 42-resumption-resume-client
[42-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[42-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[42-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-42]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = Yes
# ===========================================================
[43-resumption]
ssl_conf = 43-resumption-ssl
[43-resumption-ssl]
server = 43-resumption-server
client = 43-resumption-client
resume-server = 43-resumption-server
resume-client = 43-resumption-resume-client
[43-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[43-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[43-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-43]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = Yes
# ===========================================================
[44-resumption]
ssl_conf = 44-resumption-ssl
[44-resumption-ssl]
server = 44-resumption-server
client = 44-resumption-client
resume-server = 44-resumption-server
resume-client = 44-resumption-resume-client
[44-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[44-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[44-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-44]
ExpectedProtocol = TLSv1.2 ExpectedProtocol = TLSv1.2
HandshakeMode = Resume HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[45-resumption]
ssl_conf = 45-resumption-ssl
[45-resumption-ssl]
server = 45-resumption-server
client = 45-resumption-client
resume-server = 45-resumption-server
resume-client = 45-resumption-resume-client
[45-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[45-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[45-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-45]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[46-resumption]
ssl_conf = 46-resumption-ssl
[46-resumption-ssl]
server = 46-resumption-server
client = 46-resumption-client
resume-server = 46-resumption-server
resume-client = 46-resumption-resume-client
[46-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[46-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[46-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-46]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[47-resumption]
ssl_conf = 47-resumption-ssl
[47-resumption-ssl]
server = 47-resumption-server
client = 47-resumption-client
resume-server = 47-resumption-server
resume-client = 47-resumption-resume-client
[47-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[47-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
MinProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[47-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-47]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[48-resumption]
ssl_conf = 48-resumption-ssl
[48-resumption-ssl]
server = 48-resumption-server
client = 48-resumption-client
resume-server = 48-resumption-server
resume-client = 48-resumption-resume-client
[48-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[48-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[48-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-48]
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[49-resumption]
ssl_conf = 49-resumption-ssl
[49-resumption-ssl]
server = 49-resumption-server
client = 49-resumption-client
resume-server = 49-resumption-server
resume-client = 49-resumption-resume-client
[49-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[49-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[49-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-49]
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[50-resumption]
ssl_conf = 50-resumption-ssl
[50-resumption-ssl]
server = 50-resumption-server
client = 50-resumption-client
resume-server = 50-resumption-server
resume-client = 50-resumption-resume-client
[50-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[50-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[50-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-50]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[51-resumption]
ssl_conf = 51-resumption-ssl
[51-resumption-ssl]
server = 51-resumption-server
client = 51-resumption-client
resume-server = 51-resumption-server
resume-client = 51-resumption-resume-client
[51-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[51-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[51-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-51]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[52-resumption]
ssl_conf = 52-resumption-ssl
[52-resumption-ssl]
server = 52-resumption-server
client = 52-resumption-client
resume-server = 52-resumption-server
resume-client = 52-resumption-resume-client
[52-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[52-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[52-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-52]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = Yes
# ===========================================================
[53-resumption]
ssl_conf = 53-resumption-ssl
[53-resumption-ssl]
server = 53-resumption-server
client = 53-resumption-client
resume-server = 53-resumption-server
resume-client = 53-resumption-resume-client
[53-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[53-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[53-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-53]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = Yes
# ===========================================================
[54-resumption]
ssl_conf = 54-resumption-ssl
[54-resumption-ssl]
server = 54-resumption-server
client = 54-resumption-client
resume-server = 54-resumption-server
resume-client = 54-resumption-resume-client
[54-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[54-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[54-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-54]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[55-resumption]
ssl_conf = 55-resumption-ssl
[55-resumption-ssl]
server = 55-resumption-server
client = 55-resumption-client
resume-server = 55-resumption-server
resume-client = 55-resumption-resume-client
[55-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[55-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
MinProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[55-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-55]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[56-resumption]
ssl_conf = 56-resumption-ssl
[56-resumption-ssl]
server = 56-resumption-server
client = 56-resumption-client
resume-server = 56-resumption-server
resume-client = 56-resumption-resume-client
[56-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[56-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[56-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-56]
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[57-resumption]
ssl_conf = 57-resumption-ssl
[57-resumption-ssl]
server = 57-resumption-server
client = 57-resumption-client
resume-server = 57-resumption-server
resume-client = 57-resumption-resume-client
[57-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[57-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[57-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-57]
ExpectedProtocol = TLSv1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[58-resumption]
ssl_conf = 58-resumption-ssl
[58-resumption-ssl]
server = 58-resumption-server
client = 58-resumption-client
resume-server = 58-resumption-server
resume-client = 58-resumption-resume-client
[58-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[58-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[58-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-58]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[59-resumption]
ssl_conf = 59-resumption-ssl
[59-resumption-ssl]
server = 59-resumption-server
client = 59-resumption-client
resume-server = 59-resumption-server
resume-client = 59-resumption-resume-client
[59-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[59-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[59-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.1
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-59]
ExpectedProtocol = TLSv1.1
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[60-resumption]
ssl_conf = 60-resumption-ssl
[60-resumption-ssl]
server = 60-resumption-server
client = 60-resumption-client
resume-server = 60-resumption-server
resume-client = 60-resumption-resume-client
[60-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[60-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[60-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-60]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[61-resumption]
ssl_conf = 61-resumption-ssl
[61-resumption-ssl]
server = 61-resumption-server
client = 61-resumption-client
resume-server = 61-resumption-server
resume-client = 61-resumption-resume-client
[61-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[61-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[61-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-61]
ExpectedProtocol = TLSv1.2
HandshakeMode = Resume
ResumptionExpected = No
# ===========================================================
[62-resumption]
ssl_conf = 62-resumption-ssl
[62-resumption-ssl]
server = 62-resumption-server
client = 62-resumption-client
resume-server = 62-resumption-server
resume-client = 62-resumption-resume-client
[62-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[62-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[62-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-62]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = Yes
# ===========================================================
[63-resumption]
ssl_conf = 63-resumption-ssl
[63-resumption-ssl]
server = 63-resumption-server
client = 63-resumption-client
resume-server = 63-resumption-server
resume-client = 63-resumption-resume-client
[63-resumption-server]
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT
Options = -SessionTicket
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[63-resumption-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
MinProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[63-resumption-resume-client]
CipherString = DEFAULT
MaxProtocol = TLSv1.3
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer
[test-63]
ExpectedProtocol = TLSv1.3
HandshakeMode = Resume
ResumptionExpected = Yes ResumptionExpected = Yes
test/ssl-tests/13-fragmentation.conf
浏览文件 @ 582a17d6
...@@ -267,6 +267,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -267,6 +267,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-large-app-data-aes-sha1-multibuffer-client] [10-large-app-data-aes-sha1-multibuffer-client]
CipherString = AES128-SHA CipherString = AES128-SHA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
...@@ -291,6 +292,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -291,6 +292,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-large-app-data-aes-sha2-multibuffer-client] [11-large-app-data-aes-sha2-multibuffer-client]
CipherString = AES128-SHA256 CipherString = AES128-SHA256
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
...@@ -315,6 +317,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -315,6 +317,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-large-app-data-aes-sha1-multibuffer-odd-fragment-client] [12-large-app-data-aes-sha1-multibuffer-odd-fragment-client]
CipherString = AES128-SHA CipherString = AES128-SHA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
...@@ -339,6 +342,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -339,6 +342,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-large-app-data-aes-sha2-multibuffer-odd-fragment-client] [13-large-app-data-aes-sha2-multibuffer-odd-fragment-client]
CipherString = AES128-SHA256 CipherString = AES128-SHA256
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
...@@ -363,6 +367,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -363,6 +367,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-small-app-data-aes-sha1-multibuffer-client] [14-small-app-data-aes-sha1-multibuffer-client]
CipherString = AES128-SHA CipherString = AES128-SHA
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
...@@ -387,6 +392,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem ...@@ -387,6 +392,7 @@ PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-small-app-data-aes-sha2-multibuffer-client] [15-small-app-data-aes-sha2-multibuffer-client]
CipherString = AES128-SHA256 CipherString = AES128-SHA256
MaxProtocol = TLSv1.2
VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem VerifyCAFile = ${ENV::TEST_CERTS_DIR}/rootcert.pem
VerifyMode = Peer VerifyMode = Peer
......
test/ssl-tests/13-fragmentation.conf.in
浏览文件 @ 582a17d6
...@@ -114,6 +114,7 @@ our @tests = ( ...@@ -114,6 +114,7 @@ our @tests = (
server => { }, server => { },
client => { client => {
CipherString => "AES128-SHA", CipherString => "AES128-SHA",
MaxProtocol => "TLSv1.2"
}, },
test => { test => {
ApplicationData => 1024 * 1024, ApplicationData => 1024 * 1024,
...@@ -125,6 +126,7 @@ our @tests = ( ...@@ -125,6 +126,7 @@ our @tests = (
server => { }, server => { },
client => { client => {
CipherString => "AES128-SHA256", CipherString => "AES128-SHA256",
MaxProtocol => "TLSv1.2"
}, },
test => { test => {
ApplicationData => 1024 * 1024, ApplicationData => 1024 * 1024,
...@@ -136,6 +138,7 @@ our @tests = ( ...@@ -136,6 +138,7 @@ our @tests = (
server => { }, server => { },
client => { client => {
CipherString => "AES128-SHA", CipherString => "AES128-SHA",
MaxProtocol => "TLSv1.2"
}, },
test => { test => {
ApplicationData => 1024 * 1024 + 3, ApplicationData => 1024 * 1024 + 3,
...@@ -147,6 +150,7 @@ our @tests = ( ...@@ -147,6 +150,7 @@ our @tests = (
server => { }, server => { },
client => { client => {
CipherString => "AES128-SHA256", CipherString => "AES128-SHA256",
MaxProtocol => "TLSv1.2"
}, },
test => { test => {
ApplicationData => 1024 * 1024 - 3, ApplicationData => 1024 * 1024 - 3,
...@@ -161,6 +165,7 @@ our @tests = ( ...@@ -161,6 +165,7 @@ our @tests = (
server => { }, server => { },
client => { client => {
CipherString => "AES128-SHA", CipherString => "AES128-SHA",
MaxProtocol => "TLSv1.2"
}, },
test => { test => {
ApplicationData => 4 * 1024, ApplicationData => 4 * 1024,
...@@ -172,6 +177,7 @@ our @tests = ( ...@@ -172,6 +177,7 @@ our @tests = (
server => { }, server => { },
client => { client => {
CipherString => "AES128-SHA256", CipherString => "AES128-SHA256",
MaxProtocol => "TLSv1.2"
}, },
test => { test => {
ApplicationData => 4 * 1024, ApplicationData => 4 * 1024,
......
test/ssl-tests/14-curves.conf
浏览文件 @ 582a17d6
...@@ -44,6 +44,7 @@ client = 0-curve-sect163k1-client ...@@ -44,6 +44,7 @@ client = 0-curve-sect163k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect163k1 Curves = sect163k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[0-curve-sect163k1-client] [0-curve-sect163k1-client]
...@@ -69,6 +70,7 @@ client = 1-curve-sect163r1-client ...@@ -69,6 +70,7 @@ client = 1-curve-sect163r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect163r1 Curves = sect163r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[1-curve-sect163r1-client] [1-curve-sect163r1-client]
...@@ -94,6 +96,7 @@ client = 2-curve-sect163r2-client ...@@ -94,6 +96,7 @@ client = 2-curve-sect163r2-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect163r2 Curves = sect163r2
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[2-curve-sect163r2-client] [2-curve-sect163r2-client]
...@@ -119,6 +122,7 @@ client = 3-curve-sect193r1-client ...@@ -119,6 +122,7 @@ client = 3-curve-sect193r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect193r1 Curves = sect193r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[3-curve-sect193r1-client] [3-curve-sect193r1-client]
...@@ -144,6 +148,7 @@ client = 4-curve-sect193r2-client ...@@ -144,6 +148,7 @@ client = 4-curve-sect193r2-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect193r2 Curves = sect193r2
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[4-curve-sect193r2-client] [4-curve-sect193r2-client]
...@@ -169,6 +174,7 @@ client = 5-curve-sect233k1-client ...@@ -169,6 +174,7 @@ client = 5-curve-sect233k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect233k1 Curves = sect233k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[5-curve-sect233k1-client] [5-curve-sect233k1-client]
...@@ -194,6 +200,7 @@ client = 6-curve-sect233r1-client ...@@ -194,6 +200,7 @@ client = 6-curve-sect233r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect233r1 Curves = sect233r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[6-curve-sect233r1-client] [6-curve-sect233r1-client]
...@@ -219,6 +226,7 @@ client = 7-curve-sect239k1-client ...@@ -219,6 +226,7 @@ client = 7-curve-sect239k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect239k1 Curves = sect239k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[7-curve-sect239k1-client] [7-curve-sect239k1-client]
...@@ -244,6 +252,7 @@ client = 8-curve-sect283k1-client ...@@ -244,6 +252,7 @@ client = 8-curve-sect283k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect283k1 Curves = sect283k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[8-curve-sect283k1-client] [8-curve-sect283k1-client]
...@@ -269,6 +278,7 @@ client = 9-curve-sect283r1-client ...@@ -269,6 +278,7 @@ client = 9-curve-sect283r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect283r1 Curves = sect283r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[9-curve-sect283r1-client] [9-curve-sect283r1-client]
...@@ -294,6 +304,7 @@ client = 10-curve-sect409k1-client ...@@ -294,6 +304,7 @@ client = 10-curve-sect409k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect409k1 Curves = sect409k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[10-curve-sect409k1-client] [10-curve-sect409k1-client]
...@@ -319,6 +330,7 @@ client = 11-curve-sect409r1-client ...@@ -319,6 +330,7 @@ client = 11-curve-sect409r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect409r1 Curves = sect409r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[11-curve-sect409r1-client] [11-curve-sect409r1-client]
...@@ -344,6 +356,7 @@ client = 12-curve-sect571k1-client ...@@ -344,6 +356,7 @@ client = 12-curve-sect571k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect571k1 Curves = sect571k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[12-curve-sect571k1-client] [12-curve-sect571k1-client]
...@@ -369,6 +382,7 @@ client = 13-curve-sect571r1-client ...@@ -369,6 +382,7 @@ client = 13-curve-sect571r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = sect571r1 Curves = sect571r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[13-curve-sect571r1-client] [13-curve-sect571r1-client]
...@@ -394,6 +408,7 @@ client = 14-curve-secp160k1-client ...@@ -394,6 +408,7 @@ client = 14-curve-secp160k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = secp160k1 Curves = secp160k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[14-curve-secp160k1-client] [14-curve-secp160k1-client]
...@@ -419,6 +434,7 @@ client = 15-curve-secp160r1-client ...@@ -419,6 +434,7 @@ client = 15-curve-secp160r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = secp160r1 Curves = secp160r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[15-curve-secp160r1-client] [15-curve-secp160r1-client]
...@@ -444,6 +460,7 @@ client = 16-curve-secp160r2-client ...@@ -444,6 +460,7 @@ client = 16-curve-secp160r2-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = secp160r2 Curves = secp160r2
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[16-curve-secp160r2-client] [16-curve-secp160r2-client]
...@@ -469,6 +486,7 @@ client = 17-curve-secp192k1-client ...@@ -469,6 +486,7 @@ client = 17-curve-secp192k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = secp192k1 Curves = secp192k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[17-curve-secp192k1-client] [17-curve-secp192k1-client]
...@@ -494,6 +512,7 @@ client = 18-curve-prime192v1-client ...@@ -494,6 +512,7 @@ client = 18-curve-prime192v1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = prime192v1 Curves = prime192v1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[18-curve-prime192v1-client] [18-curve-prime192v1-client]
...@@ -519,6 +538,7 @@ client = 19-curve-secp224k1-client ...@@ -519,6 +538,7 @@ client = 19-curve-secp224k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = secp224k1 Curves = secp224k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[19-curve-secp224k1-client] [19-curve-secp224k1-client]
...@@ -544,6 +564,7 @@ client = 20-curve-secp224r1-client ...@@ -544,6 +564,7 @@ client = 20-curve-secp224r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = secp224r1 Curves = secp224r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[20-curve-secp224r1-client] [20-curve-secp224r1-client]
...@@ -569,6 +590,7 @@ client = 21-curve-secp256k1-client ...@@ -569,6 +590,7 @@ client = 21-curve-secp256k1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = secp256k1 Curves = secp256k1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[21-curve-secp256k1-client] [21-curve-secp256k1-client]
...@@ -594,6 +616,7 @@ client = 22-curve-prime256v1-client ...@@ -594,6 +616,7 @@ client = 22-curve-prime256v1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = prime256v1 Curves = prime256v1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[22-curve-prime256v1-client] [22-curve-prime256v1-client]
...@@ -619,6 +642,7 @@ client = 23-curve-secp384r1-client ...@@ -619,6 +642,7 @@ client = 23-curve-secp384r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = secp384r1 Curves = secp384r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[23-curve-secp384r1-client] [23-curve-secp384r1-client]
...@@ -644,6 +668,7 @@ client = 24-curve-secp521r1-client ...@@ -644,6 +668,7 @@ client = 24-curve-secp521r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = secp521r1 Curves = secp521r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[24-curve-secp521r1-client] [24-curve-secp521r1-client]
...@@ -669,6 +694,7 @@ client = 25-curve-brainpoolP256r1-client ...@@ -669,6 +694,7 @@ client = 25-curve-brainpoolP256r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = brainpoolP256r1 Curves = brainpoolP256r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[25-curve-brainpoolP256r1-client] [25-curve-brainpoolP256r1-client]
...@@ -694,6 +720,7 @@ client = 26-curve-brainpoolP384r1-client ...@@ -694,6 +720,7 @@ client = 26-curve-brainpoolP384r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = brainpoolP384r1 Curves = brainpoolP384r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[26-curve-brainpoolP384r1-client] [26-curve-brainpoolP384r1-client]
...@@ -719,6 +746,7 @@ client = 27-curve-brainpoolP512r1-client ...@@ -719,6 +746,7 @@ client = 27-curve-brainpoolP512r1-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = brainpoolP512r1 Curves = brainpoolP512r1
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[27-curve-brainpoolP512r1-client] [27-curve-brainpoolP512r1-client]
...@@ -744,6 +772,7 @@ client = 28-curve-X25519-client ...@@ -744,6 +772,7 @@ client = 28-curve-X25519-client
Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem Certificate = ${ENV::TEST_CERTS_DIR}/servercert.pem
CipherString = DEFAULT CipherString = DEFAULT
Curves = X25519 Curves = X25519
MaxProtocol = TLSv1.2
PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem PrivateKey = ${ENV::TEST_CERTS_DIR}/serverkey.pem
[28-curve-X25519-client] [28-curve-X25519-client]
......
test/ssl-tests/14-curves.conf.in
浏览文件 @ 582a17d6
...@@ -27,7 +27,9 @@ sub generate_tests() { ...@@ -27,7 +27,9 @@ sub generate_tests() {
push @tests, { push @tests, {
name => "curve-${curve}", name => "curve-${curve}",
server => { server => {
"Curves" => $curve "Curves" => $curve,
# TODO(TLS1.3): Can we get this to work for TLSv1.3?
"MaxProtocol" => "TLSv1.2"
}, },
client => { client => {
"CipherString" => "ECDHE", "CipherString" => "ECDHE",
......
test/ssl-tests/protocol_version.pm
浏览文件 @ 582a17d6
...@@ -20,12 +20,12 @@ use OpenSSL::Test; ...@@ -20,12 +20,12 @@ use OpenSSL::Test;
use OpenSSL::Test::Utils qw/anydisabled alldisabled/; use OpenSSL::Test::Utils qw/anydisabled alldisabled/;
setup("no_test_here"); setup("no_test_here");
my @tls_protocols = ("SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2"); my @tls_protocols = ("SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3");
# undef stands for "no limit". # undef stands for "no limit".
my @min_tls_protocols = (undef, "SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2"); my @min_tls_protocols = (undef, "SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3");
my @max_tls_protocols = ("SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", undef); my @max_tls_protocols = ("SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3", undef);
my @is_tls_disabled = anydisabled("ssl3", "tls1", "tls1_1", "tls1_2"); my @is_tls_disabled = anydisabled("ssl3", "tls1", "tls1_1", "tls1_2", "tls1_3");
my $min_tls_enabled; my $max_tls_enabled; my $min_tls_enabled; my $max_tls_enabled;
...@@ -74,7 +74,7 @@ foreach my $i (0..$#dtls_protocols) { ...@@ -74,7 +74,7 @@ foreach my $i (0..$#dtls_protocols) {
sub no_tests { sub no_tests {
my ($dtls) = @_; my ($dtls) = @_;
return $dtls ? alldisabled("dtls1", "dtls1_2") : return $dtls ? alldisabled("dtls1", "dtls1_2") :
alldisabled("ssl3", "tls1", "tls1_1", "tls1_2"); alldisabled("ssl3", "tls1", "tls1_1", "tls1_2", "tls1_3");
} }
sub generate_version_tests { sub generate_version_tests {
...@@ -234,9 +234,15 @@ sub expected_result { ...@@ -234,9 +234,15 @@ sub expected_result {
# Server doesn't support the client range. # Server doesn't support the client range.
return ("ServerFail", undef); return ("ServerFail", undef);
} elsif ($c_min > $s_max) { } elsif ($c_min > $s_max) {
my @prots = @$protocols;
if ($prots[$c_min] eq "TLSv1.3") {
# Client won't have sent any ciphersuite the server recognises
return ("ServerFail", undef);
} else {
# Server will try with a version that is lower than the lowest # Server will try with a version that is lower than the lowest
# supported client version. # supported client version.
return ("ClientFail", undef); return ("ClientFail", undef);
}
} else { } else {
# Server and client ranges overlap. # Server and client ranges overlap.
my $max_common = $s_max < $c_max ? $s_max : $c_max; my $max_common = $s_max < $c_max ? $s_max : $c_max;
......
test/ssl_test_ctx.c
浏览文件 @ 582a17d6
...@@ -152,6 +152,7 @@ const char *ssl_alert_name(int alert) ...@@ -152,6 +152,7 @@ const char *ssl_alert_name(int alert)
/********************/ /********************/
static const test_enum ssl_protocols[] = { static const test_enum ssl_protocols[] = {
{"TLSv1.3", TLS1_3_VERSION},
{"TLSv1.2", TLS1_2_VERSION}, {"TLSv1.2", TLS1_2_VERSION},
{"TLSv1.1", TLS1_1_VERSION}, {"TLSv1.1", TLS1_1_VERSION},
{"TLSv1", TLS1_VERSION}, {"TLSv1", TLS1_VERSION},
......
test/ssltest_old.c
浏览文件 @ 582a17d6
...@@ -886,6 +886,7 @@ static int protocol_from_string(const char *value) ...@@ -886,6 +886,7 @@ static int protocol_from_string(const char *value)
{"tls1", TLS1_VERSION}, {"tls1", TLS1_VERSION},
{"tls1.1", TLS1_1_VERSION}, {"tls1.1", TLS1_1_VERSION},
{"tls1.2", TLS1_2_VERSION}, {"tls1.2", TLS1_2_VERSION},
{"tls1.3", TLS1_3_VERSION},
{"dtls1", DTLS1_VERSION}, {"dtls1", DTLS1_VERSION},
{"dtls1.2", DTLS1_2_VERSION}}; {"dtls1.2", DTLS1_2_VERSION}};
size_t i; size_t i;
...@@ -958,7 +959,7 @@ int main(int argc, char *argv[]) ...@@ -958,7 +959,7 @@ int main(int argc, char *argv[])
int badop = 0; int badop = 0;
enum { BIO_MEM, BIO_PAIR, BIO_IPV4, BIO_IPV6 } bio_type = BIO_MEM; enum { BIO_MEM, BIO_PAIR, BIO_IPV4, BIO_IPV6 } bio_type = BIO_MEM;
int force = 0; int force = 0;
int dtls1 = 0, dtls12 = 0, dtls = 0, tls1 = 0, ssl3 = 0, ret = 1; int dtls1 = 0, dtls12 = 0, dtls = 0, tls1 = 0, tls1_2 = 0, ssl3 = 0, ret = 1;
int client_auth = 0; int client_auth = 0;
int server_auth = 0, i; int server_auth = 0, i;
struct app_verify_arg app_verify_arg = struct app_verify_arg app_verify_arg =
...@@ -1123,7 +1124,9 @@ int main(int argc, char *argv[]) ...@@ -1123,7 +1124,9 @@ int main(int argc, char *argv[])
min_version = TLS1_VERSION; min_version = TLS1_VERSION;
} }
#endif #endif
else if (strcmp(*argv, "-tls1") == 0) { else if (strcmp(*argv, "-tls1_2") == 0) {
tls1_2 = 1;
} else if (strcmp(*argv, "-tls1") == 0) {
tls1 = 1; tls1 = 1;
} else if (strcmp(*argv, "-ssl3") == 0) { } else if (strcmp(*argv, "-ssl3") == 0) {
ssl3 = 1; ssl3 = 1;
...@@ -1329,8 +1332,8 @@ int main(int argc, char *argv[]) ...@@ -1329,8 +1332,8 @@ int main(int argc, char *argv[])
goto end; goto end;
} }
if (ssl3 + tls1 + dtls + dtls1 + dtls12 > 1) { if (ssl3 + tls1 + tls1_2 + dtls + dtls1 + dtls12 > 1) {
fprintf(stderr, "At most one of -ssl3, -tls1, -dtls, -dtls1 or -dtls12 should " fprintf(stderr, "At most one of -ssl3, -tls1, -tls1_2, -dtls, -dtls1 or -dtls12 should "
"be requested.\n"); "be requested.\n");
EXIT(1); EXIT(1);
} }
...@@ -1345,6 +1348,11 @@ int main(int argc, char *argv[]) ...@@ -1345,6 +1348,11 @@ int main(int argc, char *argv[])
no_protocol = 1; no_protocol = 1;
else else
#endif #endif
#ifdef OPENSSL_NO_TLS1_2
if (tls1_2)
no_protocol = 1;
else
#endif
#if defined(OPENSSL_NO_DTLS) || defined(OPENSSL_NO_DTLS1) #if defined(OPENSSL_NO_DTLS) || defined(OPENSSL_NO_DTLS1)
if (dtls1) if (dtls1)
no_protocol = 1; no_protocol = 1;
...@@ -1369,10 +1377,11 @@ int main(int argc, char *argv[]) ...@@ -1369,10 +1377,11 @@ int main(int argc, char *argv[])
goto end; goto end;
} }
if (!ssl3 && !tls1 && !dtls && !dtls1 && !dtls12 && number > 1 && !reuse && !force) { if (!ssl3 && !tls1 && !tls1_2 && !dtls && !dtls1 && !dtls12 && number > 1
&& !reuse && !force) {
fprintf(stderr, "This case cannot work. Use -f to perform " fprintf(stderr, "This case cannot work. Use -f to perform "
"the test anyway (and\n-d to see what happens), " "the test anyway (and\n-d to see what happens), "
"or add one of -ssl3, -tls1, -dtls, -dtls1, -dtls12, -reuse\n" "or add one of -ssl3, -tls1, -tls1_2, -dtls, -dtls1, -dtls12, -reuse\n"
"to avoid protocol mismatch.\n"); "to avoid protocol mismatch.\n");
EXIT(1); EXIT(1);
} }
...@@ -1435,6 +1444,9 @@ int main(int argc, char *argv[]) ...@@ -1435,6 +1444,9 @@ int main(int argc, char *argv[])
} else if (tls1) { } else if (tls1) {
min_version = TLS1_VERSION; min_version = TLS1_VERSION;
max_version = TLS1_VERSION; max_version = TLS1_VERSION;
} else if (tls1_2) {
min_version = TLS1_2_VERSION;
max_version = TLS1_2_VERSION;
} }
#endif #endif
#ifndef OPENSSL_NO_DTLS #ifndef OPENSSL_NO_DTLS
......
util/TLSProxy/Proxy.pm
浏览文件 @ 582a17d6
...@@ -147,8 +147,10 @@ sub start ...@@ -147,8 +147,10 @@ sub start
or die "Failed to redirect stdout: $!"; or die "Failed to redirect stdout: $!";
open(STDERR, ">&STDOUT"); open(STDERR, ">&STDOUT");
} }
# TODO(TLS1.3): Temporarily disabled for TLS1.3...no shared cipher
# because the TLS1.3 ciphersuites are not compatible with ossltest
my $execcmd = $self->execute my $execcmd = $self->execute
." s_server -no_comp -rev -engine ossltest -accept " ." s_server -no_tls1_3 -no_comp -rev -engine ossltest -accept "
.($self->server_port) .($self->server_port)
." -cert ".$self->cert." -naccept ".$self->serverconnects; ." -cert ".$self->cert." -naccept ".$self->serverconnects;
if ($self->ciphers ne "") { if ($self->ciphers ne "") {
......
Markdown is supported
0% 或 .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑！
想要评论请 注册 或