Skip to content

Commit ea59abe

Browse files
brainybrainy
committed
Make SSL tests pass with LibreSSL.
* test/test_ssl.c (test_ssl_handshake, test_ssl_certificate_chain_all_from_server, test_ssl_expired_server_cert, test_ssl_future_server_cert, test_setup_ssltunnel, test_ssl_renegotiate, test_ssl_ocsp_response_error_and_override, test_ssl_server_cert_with_cn_nul_byte, test_ssl_server_cert_with_san_nul_byt, test_ssl_server_cert_with_cnsan_nul_byte, test_ssl_alpn_negotiate): Tweak expected results if the symbol LIBRESSL_VERSION_NUMBER is defined. git-svn-id: https://svn.apache.org/repos/asf/serf/trunk@1931219 13f79535-47bb-0310-9956-ffa450edef68
1 parent 9a7e6a3 commit ea59abe

1 file changed

Lines changed: 61 additions & 3 deletions

File tree

‎test/test_ssl.c‎

Lines changed: 61 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -618,7 +618,11 @@ static void test_ssl_handshake(CuTest *tc)
618618
and X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE. The second one means that
619619
the chain has only the server cert. A good candidate for its own failure
620620
code. */
621-
#if OPENSSL_VERSION_NUMBER >= 0x1010109fL /* >= 1.1.1i */
621+
#ifdef LIBRESSL_VERSION_NUMBER /* LibreSSL */
622+
CuAssertStrEquals(tc,
623+
"cert_cb: failures = CERT_UNKNOWNCA, cert = (CN=localhost, depth=0)\n",
624+
tb->user_baton);
625+
#elif OPENSSL_VERSION_NUMBER >= 0x1010109fL /* >= 1.1.1i */
622626
CuAssertStrEquals(tc,
623627
"cert_cb: failures = CERT_UNKNOWNCA, cert = (CN=localhost, depth=0)\n"
624628
"cert_cb: failures = CERT_UNKNOWNCA, cert = (CN=localhost, depth=0)\n"
@@ -943,10 +947,16 @@ static void test_ssl_certificate_chain_all_from_server(CuTest *tc)
943947
run_client_and_mock_servers_loops_expect_ok(tc, tb, num_requests,
944948
handler_ctx, tb->pool);
945949

950+
#ifdef LIBRESSL_VERSION_NUMBER /* LibreSSL */
951+
CuAssertStrEquals(tc,
952+
"cert_cb: failures = CERT_SELF_SIGNED, cert = (CN=localhost, depth=2)\n",
953+
tb->user_baton);
954+
#else
946955
CuAssertStrEquals(tc,
947956
"cert_cb: failures = CERT_SELF_SIGNED, cert = (CN=Serf Root CA, depth=2)\n"
948957
"cert_cb: failures = NONE, cert = (CN=localhost, depth=0)\n",
949958
tb->user_baton);
959+
#endif
950960
CuAssertTrue(tc, tb->result_flags & TEST_RESULT_SERVERCERTCHAINCB_CALLED);
951961
}
952962

@@ -1289,11 +1299,17 @@ static void test_ssl_expired_server_cert(CuTest *tc)
12891299

12901300
run_client_and_mock_servers_loops_expect_ok(tc, tb, num_requests,
12911301
handler_ctx, tb->pool);
1302+
#ifdef LIBRESSL_VERSION_NUMBER /* LibreSSL */
1303+
CuAssertStrEquals(tc,
1304+
"cert_cb: failures = CERT_EXPIRED|CERT_SELF_SIGNED, cert = (CN=localhost, depth=2)\n",
1305+
tb->user_baton);
1306+
#else
12921307
CuAssertStrEquals(tc,
12931308
"cert_cb: failures = CERT_SELF_SIGNED, cert = (CN=Serf Root CA, depth=2)\n"
12941309
"cert_cb: failures = CERT_EXPIRED, cert = (CN=localhost, depth=0)\n"
12951310
"cert_cb: failures = CERT_EXPIRED, cert = (CN=localhost, depth=0)\n",
12961311
tb->user_baton);
1312+
#endif
12971313
}
12981314

12991315
/* Validate that the expired certificate is reported as failure in the
@@ -1331,11 +1347,17 @@ static void test_ssl_future_server_cert(CuTest *tc)
13311347

13321348
run_client_and_mock_servers_loops_expect_ok(tc, tb, num_requests,
13331349
handler_ctx, tb->pool);
1350+
#ifdef LIBRESSL_VERSION_NUMBER /* LibreSSL */
1351+
CuAssertStrEquals(tc,
1352+
"cert_cb: failures = CERT_NOTYETVALID|CERT_SELF_SIGNED, cert = (CN=localhost, depth=2)\n",
1353+
tb->user_baton);
1354+
#else
13341355
CuAssertStrEquals(tc,
13351356
"cert_cb: failures = CERT_SELF_SIGNED, cert = (CN=Serf Root CA, depth=2)\n"
13361357
"cert_cb: failures = CERT_NOTYETVALID, cert = (CN=localhost, depth=0)\n"
13371358
"cert_cb: failures = CERT_NOTYETVALID, cert = (CN=localhost, depth=0)\n",
13381359
tb->user_baton);
1360+
#endif
13391361
}
13401362

13411363

@@ -1466,10 +1488,16 @@ static void test_setup_ssltunnel(CuTest *tc)
14661488
CuAssertIntEquals(tc, i + 1, req_nr);
14671489
}
14681490

1491+
#ifdef LIBRESSL_VERSION_NUMBER /* LibreSSL */
1492+
CuAssertStrEquals(tc,
1493+
"cert_cb: failures = CERT_SELF_SIGNED, cert = (CN=localhost, depth=2)\n",
1494+
tb->user_baton);
1495+
#else
14691496
CuAssertStrEquals(tc,
14701497
"cert_cb: failures = CERT_SELF_SIGNED, cert = (CN=Serf Root CA, depth=2)\n"
14711498
"cert_cb: failures = NONE, cert = (CN=localhost, depth=0)\n",
14721499
tb->user_baton);
1500+
#endif
14731501
}
14741502

14751503
/* Test error if no creds callback */
@@ -2024,7 +2052,8 @@ static void test_ssl_renegotiate(CuTest *tc)
20242052
/* There is some historical difference in certificate verification behavior
20252053
between OpenSSL 1.0.2 and OpenSSL 1.1.0. Unfortunately, the true reasons
20262054
for the difference are unknown. */
2027-
#if OPENSSL_VERSION_NUMBER >= 0x10100000L /* >= 1.1.0 */
2055+
#if OPENSSL_VERSION_NUMBER >= 0x10100000L /* >= 1.1.0 */ \
2056+
&& !defined(LIBRESSL_VERSION_NUMBER) /* LibreSSL */
20282057
CuAssertStrEquals(tc,
20292058
"cert_cb: failures = NONE, cert = (CN=localhost, depth=0)\n",
20302059
tb->user_baton);
@@ -2180,11 +2209,18 @@ static void test_ssl_ocsp_response_error_and_override(CuTest *tc)
21802209
handler_ctx, tb->pool);
21812210

21822211
#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_OCSP)
2212+
#ifdef LIBRESSL_VERSION_NUMBER /* LibreSSL */
2213+
CuAssertStrEquals(tc,
2214+
"cert_cb: failures = CERT_SELF_SIGNED, cert = (CN=localhost, depth=2)\n"
2215+
"cert_cb: failures = OCSP_RESPONDER_ERROR, cert = (null)\n",
2216+
tb->user_baton);
2217+
#else
21832218
CuAssertStrEquals(tc,
21842219
"cert_cb: failures = CERT_SELF_SIGNED, cert = (CN=Serf Root CA, depth=2)\n"
21852220
"cert_cb: failures = NONE, cert = (CN=localhost, depth=0)\n"
21862221
"cert_cb: failures = OCSP_RESPONDER_ERROR, cert = (null)\n",
21872222
tb->user_baton);
2223+
#endif
21882224
#else
21892225
CuAssertStrEquals(tc,
21902226
"cert_cb: failures = CERT_SELF_SIGNED, cert = (CN=Serf Root CA, depth=2)\n"
@@ -2228,10 +2264,16 @@ static void test_ssl_server_cert_with_cn_nul_byte(CuTest *tc)
22282264

22292265
run_client_and_mock_servers_loops_expect_ok(tc, tb, num_requests,
22302266
handler_ctx, tb->pool);
2267+
#ifdef LIBRESSL_VERSION_NUMBER /* LibreSSL */
2268+
CuAssertStrEquals(tc,
2269+
"cert_cb: failures = CERT_SELF_SIGNED, cert = (CN=(null), depth=1)\n",
2270+
tb->user_baton);
2271+
#else
22312272
CuAssertStrEquals(tc,
22322273
"cert_cb: failures = CERT_SELF_SIGNED, cert = (CN=(null), depth=1)\n"
22332274
"cert_cb: failures = CERT_INVALID_HOST, cert = (CN=www.example.net\\00.example.com, depth=0)\n",
22342275
tb->user_baton);
2276+
#endif
22352277
}
22362278

22372279
/* Validate that the subject's SAN containing a '\0' byte is reported as failure
@@ -2269,10 +2311,16 @@ static void test_ssl_server_cert_with_san_nul_byte(CuTest *tc)
22692311

22702312
run_client_and_mock_servers_loops_expect_ok(tc, tb, num_requests,
22712313
handler_ctx, tb->pool);
2314+
#ifdef LIBRESSL_VERSION_NUMBER /* LibreSSL */
2315+
CuAssertStrEquals(tc,
2316+
"cert_cb: failures = CERT_SELF_SIGNED|CERT_INVALID_HOST, cert = (CN=www.example.com, depth=1)\n",
2317+
tb->user_baton);
2318+
#else
22722319
CuAssertStrEquals(tc,
22732320
"cert_cb: failures = CERT_SELF_SIGNED, cert = (CN=(null), depth=1)\n"
22742321
"cert_cb: failures = CERT_INVALID_HOST, cert = (CN=www.example.com, depth=0)\n",
22752322
tb->user_baton);
2323+
#endif
22762324
}
22772325

22782326
/* Validate that the subject's CN and SAN containing a '\0' byte is reported
@@ -2310,10 +2358,16 @@ static void test_ssl_server_cert_with_cnsan_nul_byte(CuTest *tc)
23102358

23112359
run_client_and_mock_servers_loops_expect_ok(tc, tb, num_requests,
23122360
handler_ctx, tb->pool);
2361+
#ifdef LIBRESSL_VERSION_NUMBER /* LibreSSL */
2362+
CuAssertStrEquals(tc,
2363+
"cert_cb: failures = CERT_SELF_SIGNED|CERT_INVALID_HOST, cert = (CN=(null), depth=1)\n",
2364+
tb->user_baton);
2365+
#else
23132366
CuAssertStrEquals(tc,
23142367
"cert_cb: failures = CERT_SELF_SIGNED, cert = (CN=(null), depth=1)\n"
23152368
"cert_cb: failures = CERT_INVALID_HOST, cert = (CN=www.example.net\\00.example.com, depth=0)\n",
23162369
tb->user_baton);
2370+
#endif
23172371
}
23182372

23192373
/* Validate a certificate with subjectAltName a DNS entry, but no CN. */
@@ -2447,7 +2501,11 @@ static void test_ssl_alpn_negotiate(CuTest *tc)
24472501
and X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE. The second one means that
24482502
the chain has only the server cert. A good candidate for its own failure
24492503
code. */
2450-
#if OPENSSL_VERSION_NUMBER >= 0x1010109fL /* >= 1.1.1i */
2504+
#ifdef LIBRESSL_VERSION_NUMBER /* LibreSSL */
2505+
CuAssertStrEquals(tc,
2506+
"cert_cb: failures = CERT_UNKNOWNCA, cert = (CN=localhost, depth=0)\n",
2507+
tb->user_baton);
2508+
#elif OPENSSL_VERSION_NUMBER >= 0x1010109fL /* >= 1.1.1i */
24512509
CuAssertStrEquals(tc,
24522510
"cert_cb: failures = CERT_UNKNOWNCA, cert = (CN=localhost, depth=0)\n"
24532511
"cert_cb: failures = CERT_UNKNOWNCA, cert = (CN=localhost, depth=0)\n"

0 commit comments

Comments
 (0)