Diff

Differences From Artifact [cef4d88462]:

To Artifact [dc4d964ab4]:


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

19
20
21
22
23

24


25

26
27
28
29
30
31


32

33
34
35
36
37
38
39

40
41
42
43
44
45
46

47
48
49
50
51
52
53
54
55
56
57
58
59
60



61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104



105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127



128
129

130
131

132
133
134

135
136

137
138
139



140
141
142
143
144
145



146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177



178
179
180
181
# Commands covered:  tls::ciphers
#
# This file contains a collection of tests for one or more of the Tcl
# built-in commands.  Sourcing this file into Tcl runs the tests and
# generates output for errors.  No output means no errors were found.
#

# All rights reserved.
#
# See the file "license.terms" for information on usage and redistribution
# of this file, and for a DISCLAIMER OF ALL WARRANTIES.
#

if {[lsearch [namespace children] ::tcltest] == -1} {
    package require tcltest
    namespace import ::tcltest::*
}


# The build dir is added as the first element of $PATH
package require tls

# One of these should == 1, depending on what type of ssl library
# tls was compiled against. (RSA BSAFE SSL-C or OpenSSL).

#


set ::tcltest::testConstraints(rsabsafe) 0

set ::tcltest::testConstraints(openssl) [string match "OpenSSL*" [tls::version]]

set ::EXPECTEDCIPHERS(rsabsafe) {
    EDH-DSS-RC4-SHA
    EDH-RSA-DES-CBC3-SHA
    EDH-DSS-DES-CBC3-SHA


    DES-CBC3-SHA

    RC4-SHA
    RC4-MD5
    EDH-RSA-DES-CBC-SHA
    EDH-DSS-DES-CBC-SHA
    DES-CBC-SHA
    EXP-EDH-DSS-DES-56-SHA
    EXP-EDH-DSS-RC4-56-SHA

    EXP-DES-56-SHA
    EXP-RC4-56-SHA
    EXP-EDH-RSA-DES-CBC-SHA
    EXP-EDH-DSS-DES-CBC-SHA
    EXP-DES-CBC-SHA
    EXP-RC2-CBC-MD5
    EXP-RC4-MD5

}

set ::EXPECTEDCIPHERS(openssl) {
    ECDHE-RSA-AES256-SHA
    DHE-PSK-AES256-CCM
    DHE-PSK-AES128-GCM-SHA256
    ECDHE-RSA-AES128-SHA256
    DHE-PSK-AES256-GCM-SHA384
    AES256-SHA256
    ECDHE-PSK-CHACHA20-POLY1305
    ECDHE-ECDSA-AES128-SHA256
    AES256-CCM
    ECDHE-RSA-AES128-GCM-SHA256
    DHE-RSA-AES256-SHA



    ECDHE-ECDSA-AES128-GCM-SHA256
    PSK-AES128-GCM-SHA256
    ECDHE-ECDSA-AES256-SHA
    ECDHE-RSA-AES256-GCM-SHA384
    ECDHE-PSK-AES256-CBC-SHA
    ECDHE-ECDSA-AES256-GCM-SHA384
    AES128-SHA
    PSK-AES256-GCM-SHA384
    PSK-AES128-CBC-SHA
    ECDHE-RSA-AES128-SHA
    AES128-GCM-SHA256
    ECDHE-PSK-AES128-CBC-SHA256
    AES256-GCM-SHA384
    TLS_AES_128_GCM_SHA256
    DHE-RSA-AES128-SHA256
    DHE-PSK-CHACHA20-POLY1305
    DHE-PSK-AES128-CCM
    TLS_AES_256_GCM_SHA384
    DHE-RSA-AES256-CCM
    DHE-RSA-AES128-GCM-SHA256
    ECDHE-ECDSA-AES256-CCM
    PSK-AES256-CCM
    DHE-RSA-AES256-GCM-SHA384
    AES128-CCM
    ECDHE-RSA-CHACHA20-POLY1305

    DHE-PSK-AES256-CBC-SHA
    DHE-RSA-AES128-SHA
    ECDHE-ECDSA-CHACHA20-POLY1305
    PSK-CHACHA20-POLY1305
    DHE-PSK-AES128-CBC-SHA256
    ECDHE-ECDSA-AES128-SHA
    ECDHE-PSK-AES128-CBC-SHA
    AES128-SHA256
    PSK-AES128-CBC-SHA256
    DHE-RSA-CHACHA20-POLY1305
    DHE-RSA-AES128-CCM
    DHE-RSA-AES256-SHA256
    ECDHE-ECDSA-AES128-CCM
    PSK-AES128-CCM
    TLS_CHACHA20_POLY1305_SHA256
    DHE-PSK-AES128-CBC-SHA
    AES256-SHA
    PSK-AES256-CBC-SHA
}




set ::EXPECTEDCIPHERS(openssl0.9.8) {
    DHE-RSA-AES256-SHA
    DHE-DSS-AES256-SHA
    AES256-SHA
    EDH-RSA-DES-CBC3-SHA
    EDH-DSS-DES-CBC3-SHA
    DES-CBC3-SHA
    DHE-RSA-AES128-SHA
    DHE-DSS-AES128-SHA
    AES128-SHA
    IDEA-CBC-SHA
    RC4-SHA
    RC4-MD5
    EDH-RSA-DES-CBC-SHA
    EDH-DSS-DES-CBC-SHA
    DES-CBC-SHA
    EXP-EDH-RSA-DES-CBC-SHA
    EXP-EDH-DSS-DES-CBC-SHA
    EXP-DES-CBC-SHA
    EXP-RC2-CBC-MD5
    EXP-RC4-MD5
}




set version ""

if {[string match "OpenSSL*" [tls::version]]} {
   regexp {OpenSSL ([\d\.]+)} [tls::version] -> version

}
if {![info exists ::EXPECTEDCIPHERS(openssl$version)]} {
    set version ""

}


proc listcompare {wants haves} {
    array set want {}
    array set have {}



    foreach item $wants { set want($item) 1 }
    foreach item $haves { set have($item) 1 }
    foreach item [lsort -dictionary [array names have]] {
	if {[info exists want($item)]} {
	    unset want($item) have($item)
	}



    }
    if {[array size want] || [array size have]} {
	return [list MISSING [array names want] UNEXPECTED [array names have]]
    }
}

test ciphers-1.1 {Tls::ciphers for ssl3} {rsabsafe} {
    # This will fail if you compiled against OpenSSL.
    # Change the constraint setting above.
    listcompare $::EXPECTEDCIPHERS(rsabsafe) [tls::ciphers ssl3]
} {}

test ciphers-1.2 {Tls::ciphers for tls1} {rsabsafe} {
    # This will fail if you compiled against OpenSSL.
    # Change the constraint setting above.
    listcompare $::EXPECTEDCIPHERS(rsabsafe) [tls::ciphers tls1]
} {}

test ciphers-1.3 {Tls::ciphers for ssl3} -constraints openssl -body {
    tls::ciphers ssl3
} -returnCodes 1 -result {ssl3: protocol not supported}

# This version of the test is correct for OpenSSL only.
# An equivalent test for the RSA BSAFE SSL-C is earlier in this file.

test ciphers-1.4 {Tls::ciphers for tls1} {openssl} {
    # This will fail if you compiled against RSA bsafe or with a
    # different set of defines than the default.
    # Change the constraint setting in all.tcl
    listcompare $::EXPECTEDCIPHERS(openssl$version) [tls::ciphers tls1]
} {}





# cleanup
::tcltest::cleanupTests
return
<
<
<
<
<
<
|
<
|
<
<
<
|

|
|


>
|


<
|
>
|
>
>
|
>
|

<
<
<
|
>
>
|
>
|
|
<
<
<
|
<
>
|
|
<
<
<
<
<
>
|

<
<
<
<
<
<
<
<
<
<
<
<
>
>
>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<
<
<
<
|
|
|
|
|
>
|
|
<
|
|
|
|
|
|
|
<
<
<
<
<
<
<
<
|
>
>
>

|
|
|
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
|
>
>
>

<
>
|
<
>
|
<
<
>
|

>
|
|
|
>
>
>
<
<
<
<
<
|
>
>
>
|
<
<
<
<
|
<
<
<
|
|

<
<
|
|
|

|
|
|

|
|

|
<
<
<
|
|

>
>
>

|








1

2



3
4
5
6
7
8
9
10
11
12

13
14
15
16
17
18
19
20
21



22
23
24
25
26
27
28



29

30
31
32





33
34
35












36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54




55
56
57
58
59
60
61
62

63
64
65
66
67
68
69








70
71
72
73
74
75
76
77


















78
79
80
81
82

83
84

85
86


87
88
89
90
91
92
93
94
95
96





97
98
99
100
101




102



103
104
105


106
107
108
109
110
111
112
113
114
115
116
117



118
119
120
121
122
123
124
125
126
127






# Auto generated test cases for ciphers.csv





# Load Tcl Test package
if {[lsearch [namespace children] ::tcltest] == -1} {
	package require tcltest
	namespace import ::tcltest::*
}

set auto_path [concat [list [file dirname [file dirname [info script]]]] $auto_path]

package require tls


# Make sure path includes location of OpenSSL executable
if {[info exists ::env(OPENSSL)]} {set ::env(path) [string cat [file join $::env(OPENSSL) bin] ";" $::env(path)}

# Constraints
set protocols [list ssl2 ssl3 tls1 tls1.1 tls1.2 tls1.3]
foreach protocol $protocols {::tcltest::testConstraint $protocol 0}
foreach protocol [::tls::protocols] {::tcltest::testConstraint $protocol 1}
::tcltest::testConstraint OpenSSL [string match "OpenSSL*" [::tls::version]]




# Helper functions
proc lcompare {list1 list2} {set m "";set u "";foreach i $list1 {if {$i ni $list2} {lappend m $i}};foreach i $list2 {if {$i ni $list1} {lappend u $i}};return [list "missing" $m "unexpected" $u]}
proc exec_get {delim args} {return [split [exec openssl {*}$args] $delim]}

# Test protocols





test Protocols-1.1 {All} -body {

	lcompare $protocols [::tls::protocols]
    } -result {missing {ssl2 ssl3} unexpected {}}






# Test ciphers














test CiphersAll-2.1 {SSL2} -constraints {ssl2} -body {
	lcompare [exec_get ":" ciphers -ssl2] [::tls::ciphers ssl2]
    } -result {missing {} unexpected {}}

test CiphersAll-2.2 {SSL3} -constraints {ssl3} -body {
	lcompare [exec_get ":" ciphers -ssl3] [::tls::ciphers ssl3]
    } -result {missing {} unexpected {}}

test CiphersAll-2.3 {TLS1} -constraints {tls1} -body {
	lcompare [exec_get ":" ciphers -tls1] [::tls::ciphers tls1]
    } -result {missing {} unexpected {}}

test CiphersAll-2.4 {TLS1.1} -constraints {tls1.1} -body {
	lcompare [exec_get ":" ciphers -tls1_1] [::tls::ciphers tls1.1]
    } -result {missing {} unexpected {}}

test CiphersAll-2.5 {TLS1.2} -constraints {tls1.2} -body {
	lcompare [exec_get ":" ciphers -tls1_2] [::tls::ciphers tls1.2]
    } -result {missing {} unexpected {}}





test CiphersAll-2.6 {TLS1.3} -constraints {tls1.3} -body {
	lcompare [exec_get ":" ciphers -tls1_3] [::tls::ciphers tls1.3]
    } -result {missing {} unexpected {}}

# Test cipher descriptions



test CiphersDesc-3.1 {SSL2} -constraints {ssl2} -body {
	lcompare [exec_get "\r\n" ciphers -ssl2 -v] [split [string trim [::tls::ciphers ssl2 1]] \n]
    } -result {missing {} unexpected {}}

test CiphersDesc-3.2 {SSL3} -constraints {ssl3} -body {
	lcompare [exec_get "\r\n" ciphers -ssl3 -v] [split [string trim [::tls::ciphers ssl3 1]] \n]
    } -result {missing {} unexpected {}}









test CiphersDesc-3.3 {TLS1} -constraints {tls1} -body {
	lcompare [exec_get "\r\n" ciphers -tls1 -v] [split [string trim [::tls::ciphers tls1 1]] \n]
    } -result {missing {} unexpected {}}

test CiphersDesc-3.4 {TLS1.1} -constraints {tls1.1} -body {
	lcompare [exec_get "\r\n" ciphers -tls1_1 -v] [split [string trim [::tls::ciphers tls1.1 1]] \n]
    } -result {missing {} unexpected {}}



















test CiphersDesc-3.5 {TLS1.2} -constraints {tls1.2} -body {
	lcompare [exec_get "\r\n" ciphers -tls1_2 -v] [split [string trim [::tls::ciphers tls1.2 1]] \n]
    } -result {missing {} unexpected {}}


test CiphersDesc-3.6 {TLS1.3} -constraints {tls1.3} -body {
	lcompare [exec_get "\r\n" ciphers -tls1_3 -v] [split [string trim [::tls::ciphers tls1.3 1]] \n]

    } -result {missing {} unexpected {}}



# Test protocol specific ciphers


test CiphersSpecific-4.1 {SSL2} -constraints {ssl2} -body {
	lcompare [exec_get ":" ciphers -ssl2 -s] [::tls::ciphers ssl2 0 1]
    } -result {missing {} unexpected {}}

test CiphersSpecific-4.2 {SSL3} -constraints {ssl3} -body {
	lcompare [exec_get ":" ciphers -ssl3 -s] [::tls::ciphers ssl3 0 1]
    } -result {missing {} unexpected {}}






test CiphersSpecific-4.3 {TLS1} -constraints {tls1} -body {
	lcompare [exec_get ":" ciphers -tls1 -s] [::tls::ciphers tls1 0 1]
    } -result {missing {} unexpected {}}





test CiphersSpecific-4.4 {TLS1.1} -constraints {tls1.1} -body {



	lcompare [exec_get ":" ciphers -tls1_1 -s] [::tls::ciphers tls1.1 0 1]
    } -result {missing {} unexpected {}}



test CiphersSpecific-4.5 {TLS1.2} -constraints {tls1.2} -body {
	lcompare [exec_get ":" ciphers -tls1_2 -s] [::tls::ciphers tls1.2 0 1]
    } -result {missing {} unexpected {}}

test CiphersSpecific-4.6 {TLS1.3} -constraints {tls1.3} -body {
	lcompare [exec_get ":" ciphers -tls1_3 -s] [::tls::ciphers tls1.3 0 1]
    } -result {missing {} unexpected {}}

# Test version


test Version-5.1 {All} -body {



	::tls::version
    } -match {glob} -result {*}

test Version-5.2 {OpenSSL} -constraints {OpenSSL} -body {
	::tls::version
    } -match {glob} -result {OpenSSL*}

# Cleanup
::tcltest::cleanupTests
return