annotate quic_ciphers.t @ 1912:f61d1b4ac638

Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled. Although CCM ciphers are disabled in a stock OpenSSL as rarely used, "to reduce ClientHello bloat", AEAD_AES_128_CCM is apparently turned back in certain distributions such as RHEL. Previously, this caused testing connections to fail as the CCM cipher being negotiated isn't supported yet in nginx. Now the test is skipped instead on failure. While here, fixed nearby style.
author Sergey Kandaurov <pluknet@nginx.com>
date Wed, 14 Jun 2023 16:57:01 +0400
parents 2c5ae1e75db4
children 6ab08c255dd3
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1911
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1 #!/usr/bin/perl
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
3 # (C) Sergey Kandaurov
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
4 # (C) Nginx, Inc.
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
5
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
6 # Tests for various TLSv1.3 ciphers in QUIC.
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
7
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
8 ###############################################################################
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
9
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
10 use warnings;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
11 use strict;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
12
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
13 use Test::More;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
14
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
15 BEGIN { use FindBin; chdir($FindBin::Bin); }
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
16
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
17 use lib 'lib';
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
18 use Test::Nginx;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
19 use Test::Nginx::HTTP3;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
20
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
21 ###############################################################################
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
22
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
23 select STDERR; $| = 1;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
24 select STDOUT; $| = 1;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
25
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
26 my $t = Test::Nginx->new()->has(qw/http http_v3 cryptx/)
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
27 ->has_daemon('openssl')->plan(5);
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
28
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
29 $t->write_file_expand('nginx.conf', <<'EOF');
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
30
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
31 %%TEST_GLOBALS%%
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
32
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
33 daemon off;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
34
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
35 events {
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
36 }
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
37
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
38 http {
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
39 %%TEST_GLOBALS_HTTP%%
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
40
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
41 ssl_certificate_key localhost.key;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
42 ssl_certificate localhost.crt;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
43
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
44 server {
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
45 listen 127.0.0.1:%%PORT_8980_UDP%% quic;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
46 server_name localhost;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
47
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
48 location / {
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
49 add_header x-cipher $ssl_cipher;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
50 add_header x-ciphers $ssl_ciphers;
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
51 }
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
52 }
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
53 }
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
54
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
55 EOF
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
56
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
57 $t->write_file('openssl.conf', <<EOF);
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
58 [ req ]
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
59 default_bits = 2048
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
60 encrypt_key = no
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
61 distinguished_name = req_distinguished_name
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
62 [ req_distinguished_name ]
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
63 EOF
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
64
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
65 my $d = $t->testdir();
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
66
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
67 foreach my $name ('localhost') {
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
68 system('openssl req -x509 -new '
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
69 . "-config $d/openssl.conf -subj /CN=$name/ "
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
70 . "-out $d/$name.crt -keyout $d/$name.key "
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
71 . ">>$d/openssl.out 2>&1") == 0
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
72 or die "Can't create certificate for $name: $!\n";
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
73 }
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
74
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
75 $t->write_file('index.html', '');
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
76 $t->run();
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
77
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
78 ###############################################################################
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
79
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
80 is(get("\x13\x01"), 'TLS_AES_128_GCM_SHA256', 'TLS_AES_128_GCM_SHA256');
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
81 is(get("\x13\x02"), 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
82 is(get("\x13\x03"), 'TLS_CHACHA20_POLY1305_SHA256',
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
83 'TLS_CHACHA20_POLY1305_SHA256');
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
84
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
85 # TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
86
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
87 is(get("\x13\x02\x13\x01"), 'TLS_AES_256_GCM_SHA384', 'ciphers many');
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
88
1912
f61d1b4ac638 Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1911
diff changeset
89 # prefer TLS_AES_128_CCM_SHA256 and fail gracefully as we are not there yet,
f61d1b4ac638 Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1911
diff changeset
90 # the cipher might be patched to be enabled by default in certain distributions
f61d1b4ac638 Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1911
diff changeset
91
f61d1b4ac638 Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1911
diff changeset
92 my $s = Test::Nginx::HTTP3->new(8980, ciphers => "\x13\x04\x13\x01");
f61d1b4ac638 Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1911
diff changeset
93
1911
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
94 TODO: {
1912
f61d1b4ac638 Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1911
diff changeset
95 todo_skip 'not yet', 1 unless $s;
1911
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
96
1912
f61d1b4ac638 Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1911
diff changeset
97 like(get("\x13\x04\x13\x01", $s), qr/TLS_AES_128_[GC]CM_SHA256/,
f61d1b4ac638 Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1911
diff changeset
98 'TLS_AES_128_CCM_SHA256');
1911
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
99
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
100 }
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
101
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
102 ###############################################################################
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
103
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
104 sub get {
1912
f61d1b4ac638 Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1911
diff changeset
105 my ($ciphers, $sock) = @_;
f61d1b4ac638 Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1911
diff changeset
106 my $s = Test::Nginx::HTTP3->new(8980, ciphers => $ciphers,
f61d1b4ac638 Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1911
diff changeset
107 socket => $sock) or return;
1911
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
108 my $frames = $s->read(all => [{ sid => $s->new_stream(), fin => 1 }]);
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
109
1912
f61d1b4ac638 Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1911
diff changeset
110 my ($frame) = grep { $_->{type} eq "HEADERS" } @$frames;
1911
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
111 return $frame->{headers}->{'x-cipher'};
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
112 }
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
113
2c5ae1e75db4 Tests: tests for TLSv1.3 ciphers in QUIC connections.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
114 ###############################################################################