Skip to content

Commit 41e07af

Browse files
rheniumrhenium
authored
Merge pull request #853 from rhenium/ky/ssl-test-cleanup-20250206
Cleanups in SSL tests
2 parents f09f920 + 4987688 commit 41e07af

File tree

3 files changed

+51
-65
lines changed

3 files changed

+51
-65
lines changed

‎test/openssl/test_ssl.rb‎

Lines changed: 43 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -348,27 +348,27 @@ def test_verify_mode_server_cert
348348
empty_store = OpenSSL::X509::Store.new
349349

350350
# Valid certificate, SSL_VERIFY_PEER
351+
ctx = OpenSSL::SSL::SSLContext.new
352+
ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER
353+
ctx.cert_store = populated_store
351354
assert_nothing_raised {
352-
ctx = OpenSSL::SSL::SSLContext.new
353-
ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER
354-
ctx.cert_store = populated_store
355355
server_connect(port, ctx) { |ssl| ssl.puts("abc"); ssl.gets }
356356
}
357357

358358
# Invalid certificate, SSL_VERIFY_NONE
359+
ctx = OpenSSL::SSL::SSLContext.new
360+
ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
361+
ctx.cert_store = empty_store
359362
assert_nothing_raised {
360-
ctx = OpenSSL::SSL::SSLContext.new
361-
ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
362-
ctx.cert_store = empty_store
363363
server_connect(port, ctx) { |ssl| ssl.puts("abc"); ssl.gets }
364364
}
365365

366366
# Invalid certificate, SSL_VERIFY_PEER
367-
assert_handshake_error {
368-
ctx = OpenSSL::SSL::SSLContext.new
369-
ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER
370-
ctx.cert_store = empty_store
371-
server_connect(port, ctx) { |ssl| ssl.puts("abc"); ssl.gets }
367+
ctx = OpenSSL::SSL::SSLContext.new
368+
ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER
369+
ctx.cert_store = empty_store
370+
assert_raise(OpenSSL::SSL::SSLError) {
371+
server_connect(port, ctx)
372372
}
373373
}
374374
end
@@ -645,15 +645,15 @@ def test_sslctx_set_params
645645

646646
def test_post_connect_check_with_anon_ciphers
647647
ctx_proc = -> ctx {
648-
ctx.ssl_version = :TLSv1_2
648+
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
649649
ctx.ciphers = "aNULL"
650650
ctx.tmp_dh = Fixtures.pkey("dh-1")
651651
ctx.security_level = 0
652652
}
653653

654654
start_server(ctx_proc: ctx_proc) { |port|
655655
ctx = OpenSSL::SSL::SSLContext.new
656-
ctx.ssl_version = :TLSv1_2
656+
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
657657
ctx.ciphers = "aNULL"
658658
ctx.security_level = 0
659659
server_connect(port, ctx) { |ssl|
@@ -1111,7 +1111,7 @@ def test_verify_hostname_on_connect
11111111
ssl.connect
11121112
ssl.puts "abc"; assert_equal "abc\n", ssl.gets
11131113
else
1114-
assert_handshake_error { ssl.connect }
1114+
assert_raise(OpenSSL::SSL::SSLError) { ssl.connect }
11151115
end
11161116
ensure
11171117
ssl.close if ssl
@@ -1149,7 +1149,7 @@ def test_verify_hostname_failure_error_code
11491149
sock = TCPSocket.new("127.0.0.1", port)
11501150
ssl = OpenSSL::SSL::SSLSocket.new(sock, ctx)
11511151
ssl.hostname = "b.example.com"
1152-
assert_handshake_error { ssl.connect }
1152+
assert_raise(OpenSSL::SSL::SSLError) { ssl.connect }
11531153
assert_equal false, verify_callback_ok
11541154
assert_equal OpenSSL::X509::V_ERR_HOSTNAME_MISMATCH, verify_callback_err
11551155
ensure
@@ -1250,7 +1250,7 @@ def test_set_params_min_version
12501250
start_server(ctx_proc: ctx_proc, ignore_listener_error: true) { |port|
12511251
ctx = OpenSSL::SSL::SSLContext.new
12521252
ctx.set_params(cert_store: store, verify_hostname: false)
1253-
assert_handshake_error { server_connect(port, ctx) { } }
1253+
assert_raise(OpenSSL::SSL::SSLError) { server_connect(port, ctx) }
12541254
}
12551255
end
12561256
end
@@ -1283,7 +1283,7 @@ def test_minmax_version
12831283
ssl.puts "abc"; assert_equal "abc\n", ssl.gets
12841284
}
12851285
else
1286-
assert_handshake_error { server_connect(port, ctx1) { } }
1286+
assert_raise(OpenSSL::SSL::SSLError) { server_connect(port, ctx1) }
12871287
end
12881288

12891289
# There is no version-specific SSL methods for TLS 1.3
@@ -1297,7 +1297,7 @@ def test_minmax_version
12971297
ssl.puts "abc"; assert_equal "abc\n", ssl.gets
12981298
}
12991299
else
1300-
assert_handshake_error { server_connect(port, ctx2) { } }
1300+
assert_raise(OpenSSL::SSL::SSLError) { server_connect(port, ctx2) }
13011301
end
13021302
end
13031303
end
@@ -1338,7 +1338,7 @@ def test_minmax_version
13381338
ssl.puts "abc"; assert_equal "abc\n", ssl.gets
13391339
}
13401340
else
1341-
assert_handshake_error { server_connect(port, ctx2) { } }
1341+
assert_raise(OpenSSL::SSL::SSLError) { server_connect(port, ctx2) }
13421342
end
13431343
end
13441344
}
@@ -1357,7 +1357,7 @@ def test_minmax_version
13571357
ssl.puts "abc"; assert_equal "abc\n", ssl.gets
13581358
}
13591359
else
1360-
assert_handshake_error { server_connect(port, ctx1) { } }
1360+
assert_raise(OpenSSL::SSL::SSLError) { server_connect(port, ctx1) }
13611361
end
13621362

13631363
# Client sets max_version
@@ -1489,7 +1489,7 @@ def test_options_disable_versions
14891489
# Client only supports TLS 1.2
14901490
ctx1 = OpenSSL::SSL::SSLContext.new
14911491
ctx1.min_version = ctx1.max_version = OpenSSL::SSL::TLS1_2_VERSION
1492-
assert_handshake_error { server_connect(port, ctx1) { } }
1492+
assert_raise(OpenSSL::SSL::SSLError) { server_connect(port, ctx1) }
14931493

14941494
# Client only supports TLS 1.3
14951495
ctx2 = OpenSSL::SSL::SSLContext.new
@@ -1505,7 +1505,7 @@ def test_options_disable_versions
15051505
# Client doesn't support TLS 1.2
15061506
ctx1 = OpenSSL::SSL::SSLContext.new
15071507
ctx1.options |= OpenSSL::SSL::OP_NO_TLSv1_2
1508-
assert_handshake_error { server_connect(port, ctx1) { } }
1508+
assert_raise(OpenSSL::SSL::SSLError) { server_connect(port, ctx1) }
15091509

15101510
# Client supports TLS 1.2 by default
15111511
ctx2 = OpenSSL::SSL::SSLContext.new
@@ -1529,7 +1529,7 @@ def test_renegotiation_cb
15291529
num_handshakes = 0
15301530
renegotiation_cb = Proc.new { |ssl| num_handshakes += 1 }
15311531
ctx_proc = Proc.new { |ctx| ctx.renegotiation_cb = renegotiation_cb }
1532-
start_server_version(:SSLv23, ctx_proc) { |port|
1532+
start_server(ctx_proc: ctx_proc) { |port|
15331533
server_connect(port) { |ssl|
15341534
assert_equal(1, num_handshakes)
15351535
ssl.puts "abc"; assert_equal "abc\n", ssl.gets
@@ -1545,7 +1545,7 @@ def test_alpn_protocol_selection_ary
15451545
}
15461546
ctx.alpn_protocols = advertised
15471547
}
1548-
start_server_version(:SSLv23, ctx_proc) { |port|
1548+
start_server(ctx_proc: ctx_proc) { |port|
15491549
ctx = OpenSSL::SSL::SSLContext.new
15501550
ctx.alpn_protocols = advertised
15511551
server_connect(port, ctx) { |ssl|
@@ -1587,9 +1587,10 @@ def test_npn_protocol_selection_ary
15871587

15881588
advertised = ["http/1.1", "spdy/2"]
15891589
ctx_proc = proc { |ctx| ctx.npn_protocols = advertised }
1590-
start_server_version(:TLSv1_2, ctx_proc) { |port|
1590+
start_server(ctx_proc: ctx_proc) { |port|
15911591
selector = lambda { |which|
15921592
ctx = OpenSSL::SSL::SSLContext.new
1593+
ctx.max_version = :TLS1_2
15931594
ctx.npn_select_cb = -> (protocols) { protocols.send(which) }
15941595
server_connect(port, ctx) { |ssl|
15951596
assert_equal(advertised.send(which), ssl.npn_protocol)
@@ -1609,9 +1610,10 @@ def advertised.each
16091610
yield "spdy/2"
16101611
end
16111612
ctx_proc = Proc.new { |ctx| ctx.npn_protocols = advertised }
1612-
start_server_version(:TLSv1_2, ctx_proc) { |port|
1613+
start_server(ctx_proc: ctx_proc) { |port|
16131614
selector = lambda { |selected, which|
16141615
ctx = OpenSSL::SSL::SSLContext.new
1616+
ctx.max_version = :TLS1_2
16151617
ctx.npn_select_cb = -> (protocols) { protocols.to_a.send(which) }
16161618
server_connect(port, ctx) { |ssl|
16171619
assert_equal(selected, ssl.npn_protocol)
@@ -1626,8 +1628,9 @@ def test_npn_protocol_selection_cancel
16261628
return unless OpenSSL::SSL::SSLContext.method_defined?(:npn_select_cb)
16271629

16281630
ctx_proc = Proc.new { |ctx| ctx.npn_protocols = ["http/1.1"] }
1629-
start_server_version(:TLSv1_2, ctx_proc) { |port|
1631+
start_server(ctx_proc: ctx_proc, ignore_listener_error: true) { |port|
16301632
ctx = OpenSSL::SSL::SSLContext.new
1633+
ctx.max_version = :TLS1_2
16311634
ctx.npn_select_cb = -> (protocols) { raise RuntimeError.new }
16321635
assert_raise(RuntimeError) { server_connect(port, ctx) }
16331636
}
@@ -1636,22 +1639,22 @@ def test_npn_protocol_selection_cancel
16361639
def test_npn_advertised_protocol_too_long
16371640
return unless OpenSSL::SSL::SSLContext.method_defined?(:npn_select_cb)
16381641

1639-
ctx_proc = Proc.new { |ctx| ctx.npn_protocols = ["a" * 256] }
1640-
start_server_version(:TLSv1_2, ctx_proc) { |port|
1641-
ctx = OpenSSL::SSL::SSLContext.new
1642-
ctx.npn_select_cb = -> (protocols) { protocols.first }
1643-
assert_handshake_error { server_connect(port, ctx) }
1644-
}
1642+
ctx = OpenSSL::SSL::SSLContext.new
1643+
assert_raise(OpenSSL::SSL::SSLError) do
1644+
ctx.npn_protocols = ["a" * 256]
1645+
ctx.setup
1646+
end
16451647
end
16461648

16471649
def test_npn_selected_protocol_too_long
16481650
return unless OpenSSL::SSL::SSLContext.method_defined?(:npn_select_cb)
16491651

16501652
ctx_proc = Proc.new { |ctx| ctx.npn_protocols = ["http/1.1"] }
1651-
start_server_version(:TLSv1_2, ctx_proc) { |port|
1653+
start_server(ctx_proc: ctx_proc, ignore_listener_error: true) { |port|
16521654
ctx = OpenSSL::SSL::SSLContext.new
1655+
ctx.max_version = :TLS1_2
16531656
ctx.npn_select_cb = -> (protocols) { "a" * 256 }
1654-
assert_handshake_error { server_connect(port, ctx) }
1657+
assert_raise(OpenSSL::SSL::SSLError) { server_connect(port, ctx) }
16551658
}
16561659
end
16571660

@@ -1685,12 +1688,12 @@ def test_sync_close_without_connect
16851688
def test_get_ephemeral_key
16861689
# kRSA
16871690
ctx_proc1 = proc { |ctx|
1688-
ctx.ssl_version = :TLSv1_2
1691+
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
16891692
ctx.ciphers = "kRSA"
16901693
}
16911694
start_server(ctx_proc: ctx_proc1, ignore_listener_error: true) do |port|
16921695
ctx = OpenSSL::SSL::SSLContext.new
1693-
ctx.ssl_version = :TLSv1_2
1696+
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
16941697
ctx.ciphers = "kRSA"
16951698
begin
16961699
server_connect(port, ctx) { |ssl| assert_nil ssl.tmp_key }
@@ -1701,15 +1704,15 @@ def test_get_ephemeral_key
17011704
end
17021705

17031706
# DHE
1704-
# TODO: How to test this with TLS 1.3?
1707+
# TODO: SSL_CTX_set1_groups() is required for testing this with TLS 1.3
17051708
ctx_proc2 = proc { |ctx|
1706-
ctx.ssl_version = :TLSv1_2
1709+
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
17071710
ctx.ciphers = "EDH"
17081711
ctx.tmp_dh = Fixtures.pkey("dh-1")
17091712
}
17101713
start_server(ctx_proc: ctx_proc2) do |port|
17111714
ctx = OpenSSL::SSL::SSLContext.new
1712-
ctx.ssl_version = :TLSv1_2
1715+
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
17131716
ctx.ciphers = "EDH"
17141717
server_connect(port, ctx) { |ssl|
17151718
assert_instance_of OpenSSL::PKey::DH, ssl.tmp_key
@@ -1881,10 +1884,6 @@ def test_ciphers_method_frozen_object
18811884
end
18821885

18831886
def test_ciphers_method_bogus_csuite
1884-
omit "Old #{OpenSSL::OPENSSL_LIBRARY_VERSION}" if
1885-
year = OpenSSL::OPENSSL_LIBRARY_VERSION[/\A OpenSSL\s+[01]\..*\s\K\d+\z/x] and
1886-
year.to_i <= 2018
1887-
18881887
ssl_ctx = OpenSSL::SSL::SSLContext.new
18891888

18901889
assert_raise_with_message(
@@ -2057,20 +2056,6 @@ def test_export_keying_material
20572056

20582057
private
20592058

2060-
def start_server_version(version, ctx_proc = nil,
2061-
server_proc = method(:readwrite_loop), &blk)
2062-
ctx_wrap = Proc.new { |ctx|
2063-
ctx.ssl_version = version
2064-
ctx_proc.call(ctx) if ctx_proc
2065-
}
2066-
start_server(
2067-
ctx_proc: ctx_wrap,
2068-
server_proc: server_proc,
2069-
ignore_listener_error: true,
2070-
&blk
2071-
)
2072-
end
2073-
20742059
def server_connect(port, ctx = nil)
20752060
sock = TCPSocket.new("127.0.0.1", port)
20762061
ssl = ctx ? OpenSSL::SSL::SSLSocket.new(sock, ctx) : OpenSSL::SSL::SSLSocket.new(sock)

‎test/openssl/test_ssl_session.rb‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@
55

66
class OpenSSL::TestSSLSession < OpenSSL::SSLTestCase
77
def test_session
8-
ctx_proc = proc { |ctx| ctx.ssl_version = :TLSv1_2 }
8+
ctx_proc = proc { |ctx|
9+
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
10+
}
911
start_server(ctx_proc: ctx_proc) do |port|
1012
server_connect_with_session(port, nil, nil) { |ssl|
1113
session = ssl.session
@@ -143,7 +145,7 @@ def test_resumption
143145

144146
def test_server_session_cache
145147
ctx_proc = Proc.new do |ctx|
146-
ctx.ssl_version = :TLSv1_2
148+
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
147149
ctx.options |= OpenSSL::SSL::OP_NO_TICKET
148150
end
149151

@@ -197,7 +199,7 @@ def test_server_session_cache
197199
10.times do |i|
198200
connections = i
199201
cctx = OpenSSL::SSL::SSLContext.new
200-
cctx.ssl_version = :TLSv1_2
202+
cctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
201203
server_connect_with_session(port, cctx, first_session) { |ssl|
202204
ssl.puts("abc"); assert_equal "abc\n", ssl.gets
203205
first_session ||= ssl.session
@@ -299,11 +301,11 @@ def test_ctx_server_session_cb
299301
connections = nil
300302
called = {}
301303
cctx = OpenSSL::SSL::SSLContext.new
302-
cctx.ssl_version = :TLSv1_2
304+
cctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
303305
sctx = nil
304306
ctx_proc = Proc.new { |ctx|
305307
sctx = ctx
306-
ctx.ssl_version = :TLSv1_2
308+
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
307309
ctx.options |= OpenSSL::SSL::OP_NO_TICKET
308310

309311
# get_cb is called whenever a client proposed to resume a session but

‎test/openssl/utils.rb‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ def readwrite_loop(ctx, ssl)
192192
end
193193
end
194194

195-
def start_server(verify_mode: OpenSSL::SSL::VERIFY_NONE, start_immediately: true,
195+
def start_server(verify_mode: OpenSSL::SSL::VERIFY_NONE,
196196
ctx_proc: nil, server_proc: method(:readwrite_loop),
197197
accept_proc: proc{},
198198
ignore_listener_error: false, &block)
@@ -212,7 +212,6 @@ def start_server(verify_mode: OpenSSL::SSL::VERIFY_NONE, start_immediately: true
212212
port = tcps.connect_address.ip_port
213213

214214
ssls = OpenSSL::SSL::SSLServer.new(tcps, ctx)
215-
ssls.start_immediately = start_immediately
216215

217216
threads = []
218217
begin

0 commit comments

Comments
 (0)