1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
|
# Commands covered: tls::ciphers
#
# This file contains a collection of tests for one or more of the Tcl
# built-in commands. Sourcing this file into Tcl runs the tests and
# generates output for errors. No output means no errors were found.
#
# All rights reserved.
#
# See the file "license.terms" for information on usage and redistribution
# of this file, and for a DISCLAIMER OF ALL WARRANTIES.
#
package require tcltest
namespace import ::tcltest::*
# The build dir is added as the first element of $PATH
# One of these should == 1, depending on what type of ssl library
# tls was compiled against. (RSA BSAFE SSL-C or OpenSSL).
#
set ::tcltest::testConstraints(rsabsafe) 0
set ::tcltest::testConstraints(openssl) [string match "OpenSSL*" [tls::version]]
set ::EXPECTEDCIPHERS(rsabsafe) {
EDH-DSS-RC4-SHA
EDH-RSA-DES-CBC3-SHA
EDH-DSS-DES-CBC3-SHA
DES-CBC3-SHA
RC4-SHA
RC4-MD5
EDH-RSA-DES-CBC-SHA
EDH-DSS-DES-CBC-SHA
DES-CBC-SHA
EXP-EDH-DSS-DES-56-SHA
EXP-EDH-DSS-RC4-56-SHA
EXP-DES-56-SHA
EXP-RC4-56-SHA
EXP-EDH-RSA-DES-CBC-SHA
EXP-EDH-DSS-DES-CBC-SHA
EXP-DES-CBC-SHA
EXP-RC2-CBC-MD5
EXP-RC4-MD5
}
set ::EXPECTEDCIPHERS(openssl) {
ECDHE-RSA-AES256-SHA
DHE-PSK-AES256-CCM
DHE-PSK-AES128-GCM-SHA256
ECDHE-RSA-AES128-SHA256
DHE-PSK-AES256-GCM-SHA384
AES256-SHA256
ECDHE-PSK-CHACHA20-POLY1305
ECDHE-ECDSA-AES128-SHA256
AES256-CCM
ECDHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES256-SHA
ECDHE-ECDSA-AES128-GCM-SHA256
PSK-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-SHA
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-PSK-AES256-CBC-SHA
ECDHE-ECDSA-AES256-GCM-SHA384
AES128-SHA
PSK-AES256-GCM-SHA384
PSK-AES128-CBC-SHA
ECDHE-RSA-AES128-SHA
AES128-GCM-SHA256
ECDHE-PSK-AES128-CBC-SHA256
AES256-GCM-SHA384
TLS_AES_128_GCM_SHA256
DHE-RSA-AES128-SHA256
DHE-PSK-CHACHA20-POLY1305
DHE-PSK-AES128-CCM
TLS_AES_256_GCM_SHA384
DHE-RSA-AES256-CCM
DHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-CCM
PSK-AES256-CCM
DHE-RSA-AES256-GCM-SHA384
AES128-CCM
ECDHE-RSA-CHACHA20-POLY1305
DHE-PSK-AES256-CBC-SHA
DHE-RSA-AES128-SHA
ECDHE-ECDSA-CHACHA20-POLY1305
PSK-CHACHA20-POLY1305
DHE-PSK-AES128-CBC-SHA256
ECDHE-ECDSA-AES128-SHA
ECDHE-PSK-AES128-CBC-SHA
AES128-SHA256
PSK-AES128-CBC-SHA256
DHE-RSA-CHACHA20-POLY1305
DHE-RSA-AES128-CCM
DHE-RSA-AES256-SHA256
ECDHE-ECDSA-AES128-CCM
PSK-AES128-CCM
TLS_CHACHA20_POLY1305_SHA256
DHE-PSK-AES128-CBC-SHA
AES256-SHA
PSK-AES256-CBC-SHA
}
set ::EXPECTEDCIPHERS(openssl0.9.8) {
DHE-RSA-AES256-SHA
DHE-DSS-AES256-SHA
AES256-SHA
EDH-RSA-DES-CBC3-SHA
EDH-DSS-DES-CBC3-SHA
DES-CBC3-SHA
DHE-RSA-AES128-SHA
DHE-DSS-AES128-SHA
AES128-SHA
IDEA-CBC-SHA
RC4-SHA
RC4-MD5
EDH-RSA-DES-CBC-SHA
EDH-DSS-DES-CBC-SHA
DES-CBC-SHA
EXP-EDH-RSA-DES-CBC-SHA
EXP-EDH-DSS-DES-CBC-SHA
EXP-DES-CBC-SHA
EXP-RC2-CBC-MD5
EXP-RC4-MD5
}
set version ""
if {[string match "OpenSSL*" [tls::version]]} {
regexp {OpenSSL ([\d\.]+)} [tls::version] -> version
}
if {![info exists ::EXPECTEDCIPHERS(openssl$version)]} {
set version ""
}
proc listcompare {wants haves} {
array set want {}
array set have {}
foreach item $wants { set want($item) 1 }
foreach item $haves { set have($item) 1 }
foreach item [lsort -dictionary [array names have]] {
if {[info exists want($item)]} {
unset want($item) have($item)
}
}
if {[array size want] || [array size have]} {
return [list MISSING [array names want] UNEXPECTED [array names have]]
}
}
test ciphers-1.1 {Tls::ciphers for ssl3} {rsabsafe} {
# This will fail if you compiled against OpenSSL.
# Change the constraint setting above.
listcompare $::EXPECTEDCIPHERS(rsabsafe) [tls::ciphers ssl3]
} {}
test ciphers-1.2 {Tls::ciphers for tls1} {rsabsafe} {
# This will fail if you compiled against OpenSSL.
# Change the constraint setting above.
listcompare $::EXPECTEDCIPHERS(rsabsafe) [tls::ciphers tls1]
} {}
test ciphers-1.3 {Tls::ciphers for ssl3} -constraints openssl -body {
tls::ciphers ssl3
} -returnCodes 1 -result {ssl3: protocol not supported}
# This version of the test is correct for OpenSSL only.
# An equivalent test for the RSA BSAFE SSL-C is earlier in this file.
test ciphers-1.4 {Tls::ciphers for tls1} {openssl} {
# This will fail if you compiled against RSA bsafe or with a
# different set of defines than the default.
# Change the constraint setting in all.tcl
listcompare $::EXPECTEDCIPHERS(openssl$version) [tls::ciphers tls1]
} {}
# cleanup
::tcltest::cleanupTests
return
|
<
<
<
<
<
<
|
<
|
<
<
<
|
|
|
>
|
<
|
>
|
>
>
|
>
|
<
<
<
|
>
>
|
>
|
|
<
<
<
|
<
>
|
|
<
<
<
<
<
>
|
<
<
<
<
<
<
<
<
<
<
<
<
>
>
>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<
<
<
<
|
|
|
|
|
>
|
|
<
|
|
|
|
|
|
|
<
<
<
<
<
<
<
<
|
>
>
>
|
|
|
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
|
>
>
>
<
>
|
<
>
|
<
<
>
|
>
|
|
|
>
>
>
<
<
<
<
<
|
>
>
>
|
<
<
<
<
|
<
<
<
|
|
<
<
|
|
|
|
|
|
|
|
|
<
<
<
|
|
>
>
>
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
# Auto generated test cases for ciphers.csv
# Load Tcl Test package
if {[lsearch [namespace children] ::tcltest] == -1} {
package require tcltest
namespace import ::tcltest::*
}
set auto_path [concat [list [file dirname [file dirname [info script]]]] $auto_path]
package require tls
# Make sure path includes location of OpenSSL executable
if {[info exists ::env(OPENSSL)]} {set ::env(path) [string cat [file join $::env(OPENSSL) bin] ";" $::env(path)}
# Constraints
set protocols [list ssl2 ssl3 tls1 tls1.1 tls1.2 tls1.3]
foreach protocol $protocols {::tcltest::testConstraint $protocol 0}
foreach protocol [::tls::protocols] {::tcltest::testConstraint $protocol 1}
::tcltest::testConstraint OpenSSL [string match "OpenSSL*" [::tls::version]]
# Helper functions
proc lcompare {list1 list2} {set m "";set u "";foreach i $list1 {if {$i ni $list2} {lappend m $i}};foreach i $list2 {if {$i ni $list1} {lappend u $i}};return [list "missing" $m "unexpected" $u]}
proc exec_get {delim args} {return [split [exec openssl {*}$args] $delim]}
# Test protocols
test Protocols-1.1 {All} -body {
lcompare $protocols [::tls::protocols]
} -result {missing {ssl2 ssl3} unexpected {}}
# Test ciphers
test CiphersAll-2.1 {SSL2} -constraints {ssl2} -body {
lcompare [exec_get ":" ciphers -ssl2] [::tls::ciphers ssl2]
} -result {missing {} unexpected {}}
test CiphersAll-2.2 {SSL3} -constraints {ssl3} -body {
lcompare [exec_get ":" ciphers -ssl3] [::tls::ciphers ssl3]
} -result {missing {} unexpected {}}
test CiphersAll-2.3 {TLS1} -constraints {tls1} -body {
lcompare [exec_get ":" ciphers -tls1] [::tls::ciphers tls1]
} -result {missing {} unexpected {}}
test CiphersAll-2.4 {TLS1.1} -constraints {tls1.1} -body {
lcompare [exec_get ":" ciphers -tls1_1] [::tls::ciphers tls1.1]
} -result {missing {} unexpected {}}
test CiphersAll-2.5 {TLS1.2} -constraints {tls1.2} -body {
lcompare [exec_get ":" ciphers -tls1_2] [::tls::ciphers tls1.2]
} -result {missing {} unexpected {}}
test CiphersAll-2.6 {TLS1.3} -constraints {tls1.3} -body {
lcompare [exec_get ":" ciphers -tls1_3] [::tls::ciphers tls1.3]
} -result {missing {} unexpected {}}
# Test cipher descriptions
test CiphersDesc-3.1 {SSL2} -constraints {ssl2} -body {
lcompare [exec_get "\r\n" ciphers -ssl2 -v] [split [string trim [::tls::ciphers ssl2 1]] \n]
} -result {missing {} unexpected {}}
test CiphersDesc-3.2 {SSL3} -constraints {ssl3} -body {
lcompare [exec_get "\r\n" ciphers -ssl3 -v] [split [string trim [::tls::ciphers ssl3 1]] \n]
} -result {missing {} unexpected {}}
test CiphersDesc-3.3 {TLS1} -constraints {tls1} -body {
lcompare [exec_get "\r\n" ciphers -tls1 -v] [split [string trim [::tls::ciphers tls1 1]] \n]
} -result {missing {} unexpected {}}
test CiphersDesc-3.4 {TLS1.1} -constraints {tls1.1} -body {
lcompare [exec_get "\r\n" ciphers -tls1_1 -v] [split [string trim [::tls::ciphers tls1.1 1]] \n]
} -result {missing {} unexpected {}}
test CiphersDesc-3.5 {TLS1.2} -constraints {tls1.2} -body {
lcompare [exec_get "\r\n" ciphers -tls1_2 -v] [split [string trim [::tls::ciphers tls1.2 1]] \n]
} -result {missing {} unexpected {}}
test CiphersDesc-3.6 {TLS1.3} -constraints {tls1.3} -body {
lcompare [exec_get "\r\n" ciphers -tls1_3 -v] [split [string trim [::tls::ciphers tls1.3 1]] \n]
} -result {missing {} unexpected {}}
# Test protocol specific ciphers
test CiphersSpecific-4.1 {SSL2} -constraints {ssl2} -body {
lcompare [exec_get ":" ciphers -ssl2 -s] [::tls::ciphers ssl2 0 1]
} -result {missing {} unexpected {}}
test CiphersSpecific-4.2 {SSL3} -constraints {ssl3} -body {
lcompare [exec_get ":" ciphers -ssl3 -s] [::tls::ciphers ssl3 0 1]
} -result {missing {} unexpected {}}
test CiphersSpecific-4.3 {TLS1} -constraints {tls1} -body {
lcompare [exec_get ":" ciphers -tls1 -s] [::tls::ciphers tls1 0 1]
} -result {missing {} unexpected {}}
test CiphersSpecific-4.4 {TLS1.1} -constraints {tls1.1} -body {
lcompare [exec_get ":" ciphers -tls1_1 -s] [::tls::ciphers tls1.1 0 1]
} -result {missing {} unexpected {}}
test CiphersSpecific-4.5 {TLS1.2} -constraints {tls1.2} -body {
lcompare [exec_get ":" ciphers -tls1_2 -s] [::tls::ciphers tls1.2 0 1]
} -result {missing {} unexpected {}}
test CiphersSpecific-4.6 {TLS1.3} -constraints {tls1.3} -body {
lcompare [exec_get ":" ciphers -tls1_3 -s] [::tls::ciphers tls1.3 0 1]
} -result {missing {} unexpected {}}
# Test version
test Version-5.1 {All} -body {
::tls::version
} -match {glob} -result {*}
test Version-5.2 {OpenSSL} -constraints {OpenSSL} -body {
::tls::version
} -match {glob} -result {OpenSSL*}
# Cleanup
::tcltest::cleanupTests
return
|