GitHub/libevent
1
0
Fork 0
mirror of https://github.com/libevent/libevent.git synced 2025-01-31 09:12:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

OpenSSL 3 fixes: Disable TLS 1.3 when testing renegotiation support

Browse Source 
TLS 1.3 does not support renegotation - it has been removed from the
protocol. Disable TLS 1.3 when testing this, so we negotiate an older
protocol version
This commit is contained in:
Peter Edwards 2022-06-27 22:41:47 +01:00
parent e563c9b206
commit 187f6b913b
2 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
test/regress_openssl.c
View File

@ -122,12 +122,26 @@ get_ssl_ctx(void)
the_ssl_ctx = SSL_CTX_new(SSLv23_method());
if (!the_ssl_ctx)
return NULL;
#ifdef SSL_OP_ALLOW_CLIENT_RENEGOTIATION
/*
* OpenSSL 3 disables client renegotiation by default. Enable it if
* the option is defined.
*/
SSL_CTX_set_options(the_ssl_ctx, SSL_OP_ALLOW_CLIENT_RENEGOTIATION);
#endif
if (disable_tls_11_and_12) {
#ifdef SSL_OP_NO_TLSv1_2
SSL_CTX_set_options(the_ssl_ctx, SSL_OP_NO_TLSv1_2);
#endif
#ifdef SSL_OP_NO_TLSv1_1
SSL_CTX_set_options(the_ssl_ctx, SSL_OP_NO_TLSv1_1);
#endif
}
if (disable_tls_13) {
#ifdef SSL_OP_NO_TLSv1_3
SSL_CTX_set_options(the_ssl_ctx, SSL_OP_NO_TLSv1_3);
#endif
}
return the_ssl_ctx;
@ -163,7 +177,7 @@ ssl_test_setup(const struct testcase_t *testcase)
the_cert = ssl_getcert(the_key);
EVUTIL_ASSERT(the_cert);
disable_tls_11_and_12 = 0;
disable_tls_11_and_12 = disable_tls_13 = 0;
return basic_test_setup(testcase);
}

7
test/regress_ssl.c
View File

@ -93,6 +93,7 @@ static const char KEY[] =
"-----END RSA PRIVATE KEY-----\n";
static int disable_tls_11_and_12 = 0;
static int disable_tls_13 = 0;
static int test_is_done;
static int n_connected;
static int got_close;
@ -323,6 +324,12 @@ regress_bufferevent_openssl(void *arg)
type = (enum regress_openssl_type)data->setup_data;
if (type & REGRESS_OPENSSL_RENEGOTIATE) {
/*
* Disable TLS 1.3, so we negotiate something older to test
* renegotiation - renegotiation is not supported by the
* protocol any more.
*/
disable_tls_13 = 1;
if (OPENSSL_VERSION_NUMBER >= 0x10001000 &&
OPENSSL_VERSION_NUMBER < 0x1000104f) {
/* 1.0.1 up to 1.0.1c has a bug where TLS1.1 and 1.2