Overview
| Comment: | Fixed test cases to run under Windows and added TLS 1.3 support |
|---|---|
| Downloads: | Tarball | ZIP archive | SQL archive |
| Timelines: | family | ancestors | descendants | both | status_x509 |
| Files: | files | file ages | folders |
| SHA3-256: |
69314245a19ec172741fa70c2521898f |
| User & Date: | bohagan on 2023-05-24 23:26:40 |
| Other Links: | branch diff | manifest | tags |
Context
|
2023-05-26
| ||
| 22:43 | Added set security level option to set all relevant parameters including cipher suite, encryption algorithms, supported ECC curves, supported signature algorithms, DH parameter sizes, certificate key sizes and signature algorithms in one operation. check-in: 32ce5d6220 user: bohagan tags: status_x509 | |
|
2023-05-24
| ||
| 23:26 | Fixed test cases to run under Windows and added TLS 1.3 support check-in: 69314245a1 user: bohagan tags: status_x509 | |
| 02:40 | Added new option -ciphersuites to set ciphers suites for TLS 1.3. Addresses defect: https://core.tcl-lang.org/tcltls/tktview/d0518a5645 check-in: cd11c125e8 user: bohagan tags: status_x509 | |
Changes
Modified tests/tlsIO.test from [195a9115ab] to [9780f0c9a5].
| ︙ | ︙ | |||
164 165 166 167 168 169 170 |
set doTestsWithRemoteServer 0
} else {
set remoteServerIP 127.0.0.1
set remoteFile [file join [pwd] remote.tcl]
if {[catch {set remoteProcChan \
[open "|[list $::tcltest::tcltest $remoteFile \
-serverIsSilent -port $remoteServerPort \
| | | 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 |
set doTestsWithRemoteServer 0
} else {
set remoteServerIP 127.0.0.1
set remoteFile [file join [pwd] remote.tcl]
if {[catch {set remoteProcChan \
[open "|[list $::tcltest::tcltest $remoteFile \
-serverIsSilent -port $remoteServerPort \
-address $remoteServerIP]" w+]} msg] == 0} {
after 1000
if {[catch {set commandSocket [tls::socket -cafile $caCert \
-certfile $clientCert -keyfile $clientKey \
$remoteServerIP $remoteServerPort]} msg] == 0} {
fconfigure $commandSocket -translation crlf -buffering line
} else {
set noRemoteTestReason $msg
|
| ︙ | ︙ | |||
318 319 320 321 322 323 324 |
puts ready
vwait x
after cancel $timer
close $f
puts $x
}
close $f
| | | 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 |
puts ready
vwait x
after cancel $timer
close $f
puts $x
}
close $f
set f [open "|[list $::tcltest::tcltest script]" r]
gets $f x
if {[catch {tls::socket -certfile $clientCert -cafile $caCert \
-keyfile $clientKey 127.0.0.1 8828} msg]} {
set x $msg
} else {
lappend x [gets $f]
close $msg
|
| ︙ | ︙ | |||
360 361 362 363 364 365 366 |
}
puts ready
vwait x
after cancel $timer
close $f
}
close $f
| | | 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 |
}
puts ready
vwait x
after cancel $timer
close $f
}
close $f
set f [open "|[list $::tcltest::tcltest script]" r]
gets $f x
global port
if {[catch {tls::socket -myport $port \
-certfile $clientCert -cafile $caCert \
-keyfile $clientKey 127.0.0.1 8829} sock]} {
set x $sock
catch {close [tls::socket 127.0.0.1 8829]}
|
| ︙ | ︙ | |||
400 401 402 403 404 405 406 |
}
puts ready
vwait x
after cancel $timer
close $f
}
close $f
| | | 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 |
}
puts ready
vwait x
after cancel $timer
close $f
}
close $f
set f [open "|[list $::tcltest::tcltest script]" r]
gets $f x
if {[catch {tls::socket -myaddr 127.0.0.1 \
-certfile $clientCert -cafile $caCert \
-keyfile $clientKey 127.0.0.1 8830} sock]} {
set x $sock
} else {
puts $sock hello
|
| ︙ | ︙ | |||
438 439 440 441 442 443 444 |
}
puts ready
vwait x
after cancel $timer
close $f
}
close $f
| | | 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 |
}
puts ready
vwait x
after cancel $timer
close $f
}
close $f
set f [open "|[list $::tcltest::tcltest script]" r]
gets $f x
if {[catch {tls::socket -certfile $clientCert -cafile $caCert \
-keyfile $clientKey localhost 8831} sock]} {
set x $sock
} else {
puts $sock hello
flush $sock
|
| ︙ | ︙ | |||
475 476 477 478 479 480 481 |
}
puts ready
vwait x
after cancel $timer
close $f
}
close $f
| | | 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 |
}
puts ready
vwait x
after cancel $timer
close $f
}
close $f
set f [open "|[list $::tcltest::tcltest script]" r]
gets $f x
if {[catch {tls::socket -certfile $clientCert -cafile $caCert \
-keyfile $clientKey 127.0.0.1 8832} sock]} {
set x $sock
} else {
puts $sock hello
flush $sock
|
| ︙ | ︙ | |||
531 532 533 534 535 536 537 |
puts ready
vwait x
after cancel $timer
close $f
puts done
}
close $f
| | | 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 |
puts ready
vwait x
after cancel $timer
close $f
puts done
}
close $f
set f [open "|[list $::tcltest::tcltest script]" r]
gets $f
set s [tls::socket -certfile $clientCert -cafile $caCert \
-keyfile $clientKey 127.0.0.1 8834]
fconfigure $s -buffering line -translation lf
puts $s "hello abcdefghijklmnop"
after 1000
set x [gets $s]
|
| ︙ | ︙ | |||
578 579 580 581 582 583 584 |
set timer [after 20000 "set x done"]
vwait x
after cancel $timer
close $f
puts "done $i"
}
close $f
| | | 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 |
set timer [after 20000 "set x done"]
vwait x
after cancel $timer
close $f
puts "done $i"
}
close $f
set f [open "|[list $::tcltest::tcltest script]" r]
gets $f
set s [tls::socket -certfile $clientCert -cafile $caCert \
-keyfile $clientKey 127.0.0.1 8835]
fconfigure $s -buffering line
catch {
for {set x 0} {$x < 50} {incr x} {
puts $s "hello abcdefghijklmnop"
|
| ︙ | ︙ | |||
703 704 705 706 707 708 709 |
puts ready
vwait x
after cancel $timer
close $f
puts $x
}
close $f
| | | 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 |
puts ready
vwait x
after cancel $timer
close $f
puts $x
}
close $f
set f [open "|[list $::tcltest::tcltest script]" r]
gets $f x
if {[catch {tls::socket 127.0.0.1 8828} msg]} {
set x $msg
} else {
lappend x [gets $f]
close $msg
}
|
| ︙ | ︙ | |||
730 731 732 733 734 735 736 |
puts $f "set f \[tls::socket -server accept -certfile $serverCert -cafile $caCert -keyfile $serverKey 8828 \]"
puts $f {
puts ready
gets stdin
close $f
}
close $f
| | | 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 |
puts $f "set f \[tls::socket -server accept -certfile $serverCert -cafile $caCert -keyfile $serverKey 8828 \]"
puts $f {
puts ready
gets stdin
close $f
}
close $f
set f [open "|[list $::tcltest::tcltest script]" r+]
gets $f
set x [list [catch {tls::socket \
-certfile $clientCert -cafile $caCert -keyfile $clientKey \
-server accept 8828} msg] \
$msg]
puts $f bye
close $f
|
| ︙ | ︙ | |||
779 780 781 782 783 784 785 |
after cancel $t2
vwait x
after cancel $t3
close $s
puts $x
}
close $f
| | | 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 |
after cancel $t2
vwait x
after cancel $t3
close $s
puts $x
}
close $f
set f [open "|[list $::tcltest::tcltest script]" r+]
set x [gets $f]
set s1 [tls::socket \
-certfile $clientCert -cafile $caCert -keyfile $clientKey \
127.0.0.1 8828]
fconfigure $s1 -buffering line
set s2 [tls::socket \
-certfile $clientCert -cafile $caCert -keyfile $clientKey \
|
| ︙ | ︙ | |||
830 831 832 833 834 835 836 |
gets $s
}
close $s
puts bye
gets stdin
}
close $f
| | | | | 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 |
gets $s
}
close $s
puts bye
gets stdin
}
close $f
set p1 [open "|[list $::tcltest::tcltest script]" r+]
fconfigure $p1 -buffering line
set p2 [open "|[list $::tcltest::tcltest script]" r+]
fconfigure $p2 -buffering line
set p3 [open "|[list $::tcltest::tcltest script]" r+]
fconfigure $p3 -buffering line
proc accept {s a p} {
fconfigure $s -buffering line
fileevent $s readable [list echo $s]
}
proc echo {s} {
global x
|
| ︙ | ︙ | |||
928 929 930 931 932 933 934 |
puts $f [list set auto_path $auto_path]
puts $f {
package require tls
gets stdin
}
puts $f [list tls::socket -cafile $caCert 127.0.0.1 8848]
close $f
| | | 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 |
puts $f [list set auto_path $auto_path]
puts $f {
package require tls
gets stdin
}
puts $f [list tls::socket -cafile $caCert 127.0.0.1 8848]
close $f
set f [open "|[list $::tcltest::tcltest script]" r+]
proc bgerror args {
global x
set x $args
}
proc accept {s a p} {expr 10 / 0}
set s [tls::socket -server accept \
-certfile $serverCert -cafile $caCert -keyfile $serverKey 8848]
|
| ︙ | ︙ | |||
966 967 968 969 970 971 972 |
}
puts ready
set timer [after 10000 "set x timed_out"]
vwait x
after cancel $timer
}
close $f
| | | 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 |
}
puts ready
set timer [after 10000 "set x timed_out"]
vwait x
after cancel $timer
}
close $f
set f [open "|[list $::tcltest::tcltest script]" r]
gets $f
set s [tls::socket \
-certfile $clientCert -cafile $caCert -keyfile $clientKey \
127.0.0.1 8820]
set p [fconfigure $s -peername]
close $s
close $f
|
| ︙ | ︙ | |||
999 1000 1001 1002 1003 1004 1005 |
}
puts ready
set timer [after 10000 "set x timed_out"]
vwait x
after cancel $timer
}
close $f
| | | 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 |
}
puts ready
set timer [after 10000 "set x timed_out"]
vwait x
after cancel $timer
}
close $f
set f [open "|[list $::tcltest::tcltest script]" r]
gets $f
set s [tls::socket \
-certfile $clientCert -cafile $caCert -keyfile $clientKey \
127.0.0.1 8821]
set p [fconfigure $s -sockname]
close $s
close $f
|
| ︙ | ︙ | |||
2010 2011 2012 2013 2014 2015 2016 |
}
}
proc accept {s a p} {
fconfigure $s -blocking 0
fileevent $s readable [list do_handshake $s readable readlittle \
-buffering none]
}
| < | < | | 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 |
}
}
proc accept {s a p} {
fconfigure $s -blocking 0
fileevent $s readable [list do_handshake $s readable readlittle \
-buffering none]
}
set s [tls::socket -certfile $serverCert -cafile $caCert -keyfile $serverKey \
-server accept 8831]
set c [tls::socket -certfile $clientCert -cafile $caCert -keyfile $clientKey \
localhost 8831]
# only the client gets tls::import
set res [tls::unimport $c]
list $res [catch {close $c} err] $err \
[catch {close $s} err] $err
} {{} 0 {} 0 {}}
|
| ︙ | ︙ | |||
2039 2040 2041 2042 2043 2044 2045 |
set ::done $msg
}
# NOTE: when doing an in-process client/server test, both sides need
# to be non-blocking for the TLS handshake
# Server - Only accept TLS 1.2
set s [tls::socket \
| | | | | < | < | 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 |
set ::done $msg
}
# NOTE: when doing an in-process client/server test, both sides need
# to be non-blocking for the TLS handshake
# Server - Only accept TLS 1.2
set s [tls::socket \
-certfile $serverCert -cafile $caCert -keyfile $serverKey -request 0 \
-require 0 -ssl2 0 -ssl3 0 -tls1 0 -tls1.1 0 -tls1.2 1 -tls1.3 0 \
-server Accept 8831]
# Client - Only propose TLS1.0
set c [tls::socket -async -cafile $caCert -request 0 -require 0 \
-ssl2 0 -ssl3 0 -tls1 1 -tls1.1 0 -tls1.2 0 -tls1.3 0 localhost 8831]
fconfigure $c -blocking 0
puts $c a ; flush $c
after 5000 [list set ::done timeout]
vwait ::done
switch -exact -- $::done {
"handshake failed: wrong ssl version" -
"handshake failed: unsupported protocol" {
|
| ︙ | ︙ |