From c055938f4ba6da868f2e61c8935c197bae7c295f Mon Sep 17 00:00:00 2001 From: Kazuki Yamaguchi Date: Tue, 4 Aug 2020 23:14:44 +0900 Subject: require OpenSSL >= 1.0.2 and LibreSSL >= 3.1 Clean up old version guards in preparation for the upcoming OpenSSL 3.0 support. OpenSSL 1.0.1 reached its EOL on 2016-12-31. At that time, we decided to keep 1.0.1 support because many major Linux distributions were still shipped with 1.0.1. Now, nearly 4 years later, most Linux distributions are reaching their EOL and it should be safe to assume nobody uses them anymore. Major ones that were using 1.0.1: - Ubuntu 14.04 is EOL since 2019-04-30 - RHEL 6 will reach EOL on 2020-11-30 LibreSSL 3.0 and older versions are no longer supported by the LibreSSL team as of October 2020. Note that OpenSSL 1.0.2 also reached EOL on 2019-12-31 and 1.1.0 also did on 2018-08-31. --- test/openssl/test_asn1.rb | 7 ++-- test/openssl/test_ocsp.rb | 9 +---- test/openssl/test_ssl.rb | 88 ++++++++++++++--------------------------------- 3 files changed, 30 insertions(+), 74 deletions(-) (limited to 'test') diff --git a/test/openssl/test_asn1.rb b/test/openssl/test_asn1.rb index af069cad..6bd84780 100644 --- a/test/openssl/test_asn1.rb +++ b/test/openssl/test_asn1.rb @@ -265,10 +265,9 @@ class OpenSSL::TestASN1 < OpenSSL::TestCase assert_raise(OpenSSL::ASN1::ASN1Error) { OpenSSL::ASN1.decode(B(%w{ 03 00 })) } - # OpenSSL < OpenSSL_1_0_1k and LibreSSL ignore the error - # assert_raise(OpenSSL::ASN1::ASN1Error) { - # OpenSSL::ASN1.decode(B(%w{ 03 03 08 FF 00 })) - # } + assert_raise(OpenSSL::ASN1::ASN1Error) { + OpenSSL::ASN1.decode(B(%w{ 03 03 08 FF 00 })) + } # OpenSSL does not seem to prohibit this, though X.690 8.6.2.3 (15/08) does # assert_raise(OpenSSL::ASN1::ASN1Error) { # OpenSSL::ASN1.decode(B(%w{ 03 01 04 })) diff --git a/test/openssl/test_ocsp.rb b/test/openssl/test_ocsp.rb index b3c4caf5..ef7321ab 100644 --- a/test/openssl/test_ocsp.rb +++ b/test/openssl/test_ocsp.rb @@ -123,14 +123,7 @@ class OpenSSL::TestOCSP < OpenSSL::TestCase assert_equal true, req.verify([@cert], store, OpenSSL::OCSP::NOINTERN) ret = req.verify([@cert], store) - if ret || openssl?(1, 0, 2) - assert_equal true, ret - else - # RT2560; OCSP_request_verify() does not find signer cert from 'certs' when - # OCSP_NOINTERN is not specified. - # fixed by OpenSSL 1.0.1j, 1.0.2 - pend "RT2560: ocsp_req_find_signer" - end + assert_equal true, ret # not signed req = OpenSSL::OCSP::Request.new.add_certid(cid) diff --git a/test/openssl/test_ssl.rb b/test/openssl/test_ssl.rb index 50a16029..f24aabe7 100644 --- a/test/openssl/test_ssl.rb +++ b/test/openssl/test_ssl.rb @@ -127,21 +127,13 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase pend "EC is not supported" unless defined?(OpenSSL::PKey::EC) pend "TLS 1.2 is not supported" unless tls12_supported? - # SSL_CTX_set0_chain() is needed for setting multiple certificate chains - add0_chain_supported = openssl?(1, 0, 2) - - if add0_chain_supported - ca2_key = Fixtures.pkey("rsa-3") - ca2_exts = [ - ["basicConstraints", "CA:TRUE", true], - ["keyUsage", "cRLSign, keyCertSign", true], - ] - ca2_dn = OpenSSL::X509::Name.parse_rfc2253("CN=CA2") - ca2_cert = issue_cert(ca2_dn, ca2_key, 123, ca2_exts, nil, nil) - else - # Use the same CA as @svr_cert - ca2_key = @ca_key; ca2_cert = @ca_cert - end + ca2_key = Fixtures.pkey("rsa-3") + ca2_exts = [ + ["basicConstraints", "CA:TRUE", true], + ["keyUsage", "cRLSign, keyCertSign", true], + ] + ca2_dn = OpenSSL::X509::Name.parse_rfc2253("CN=CA2") + ca2_cert = issue_cert(ca2_dn, ca2_key, 123, ca2_exts, nil, nil) ecdsa_key = Fixtures.pkey("p256") exts = [ @@ -150,23 +142,11 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase ecdsa_dn = OpenSSL::X509::Name.parse_rfc2253("CN=localhost2") ecdsa_cert = issue_cert(ecdsa_dn, ecdsa_key, 456, exts, ca2_cert, ca2_key) - if !add0_chain_supported - # Testing the warning emitted when 'extra' chain is replaced - tctx = OpenSSL::SSL::SSLContext.new - tctx.add_certificate(@svr_cert, @svr_key, [@ca_cert]) - assert_warning(/set0_chain/) { - tctx.add_certificate(ecdsa_cert, ecdsa_key, [ca2_cert]) - } - end - ctx_proc = -> ctx { # Unset values set by start_server ctx.cert = ctx.key = ctx.extra_chain_cert = nil - ctx.ecdh_curves = "P-256" unless openssl?(1, 0, 2) ctx.add_certificate(@svr_cert, @svr_key, [@ca_cert]) # RSA - EnvUtil.suppress_warning do # !add0_chain_supported - ctx.add_certificate(ecdsa_cert, ecdsa_key, [ca2_cert]) - end + ctx.add_certificate(ecdsa_cert, ecdsa_key, [ca2_cert]) } start_server(ctx_proc: ctx_proc) do |port| ctx = OpenSSL::SSL::SSLContext.new @@ -997,10 +977,7 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase ssl.hostname = "b.example.com" assert_handshake_error { ssl.connect } assert_equal false, verify_callback_ok - code_expected = openssl?(1, 0, 2) || defined?(OpenSSL::X509::V_ERR_HOSTNAME_MISMATCH) ? - OpenSSL::X509::V_ERR_HOSTNAME_MISMATCH : - OpenSSL::X509::V_ERR_CERT_REJECTED - assert_equal code_expected, verify_callback_err + assert_equal OpenSSL::X509::V_ERR_HOSTNAME_MISMATCH, verify_callback_err ensure sock&.close end @@ -1290,7 +1267,6 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase } end -if openssl?(1, 0, 2) || libressl? def test_alpn_protocol_selection_ary advertised = ["http/1.1", "spdy/2"] ctx_proc = Proc.new { |ctx| @@ -1336,7 +1312,6 @@ if openssl?(1, 0, 2) || libressl? t&.kill t&.join end -end def test_npn_protocol_selection_ary pend "TLS 1.2 is not supported" unless tls12_supported? @@ -1454,11 +1429,6 @@ end end def test_get_ephemeral_key - # OpenSSL >= 1.0.2 - unless OpenSSL::SSL::SSLSocket.method_defined?(:tmp_key) - pend "SSL_get_server_tmp_key() is not supported" - end - if tls12_supported? # kRSA ctx_proc1 = proc { |ctx| @@ -1589,9 +1559,7 @@ end start_server(ctx_proc: ctx_proc) do |port| server_connect(port) { |ssl| assert called, "dh callback should be called" - if ssl.respond_to?(:tmp_key) - assert_equal dh.to_der, ssl.tmp_key.to_der - end + assert_equal dh.to_der, ssl.tmp_key.to_der } end end @@ -1623,34 +1591,30 @@ end ctx.ecdh_curves = "P-384:P-521" } start_server(ctx_proc: ctx_proc, ignore_listener_error: true) do |port| + # Test 1: Client=P-256:P-384, Server=P-384:P-521 --> P-384 ctx = OpenSSL::SSL::SSLContext.new - ctx.ecdh_curves = "P-256:P-384" # disable P-521 for OpenSSL >= 1.0.2 - + ctx.ecdh_curves = "P-256:P-384" server_connect(port, ctx) { |ssl| cs = ssl.cipher[0] assert_match (/\AECDH/), cs - if ssl.respond_to?(:tmp_key) - assert_equal "secp384r1", ssl.tmp_key.group.curve_name - end + assert_equal "secp384r1", ssl.tmp_key.group.curve_name ssl.puts "abc"; assert_equal "abc\n", ssl.gets } - if openssl?(1, 0, 2) || libressl?(2, 5, 1) - ctx = OpenSSL::SSL::SSLContext.new - ctx.ecdh_curves = "P-256" - - assert_raise(OpenSSL::SSL::SSLError) { - server_connect(port, ctx) { } - } - - ctx = OpenSSL::SSL::SSLContext.new - ctx.ecdh_curves = "P-521:P-384" + # Test 2: Client=P-256, Server=P-521:P-384 --> Fail + ctx = OpenSSL::SSL::SSLContext.new + ctx.ecdh_curves = "P-256" + assert_raise(OpenSSL::SSL::SSLError) { + server_connect(port, ctx) { } + } - server_connect(port, ctx) { |ssl| - assert_equal "secp521r1", ssl.tmp_key.group.curve_name - ssl.puts "abc"; assert_equal "abc\n", ssl.gets - } - end + # Test 3: Client=P-521:P-384, Server=P-521:P-384 --> P-521 + ctx = OpenSSL::SSL::SSLContext.new + ctx.ecdh_curves = "P-521:P-384" + server_connect(port, ctx) { |ssl| + assert_equal "secp521r1", ssl.tmp_key.group.curve_name + ssl.puts "abc"; assert_equal "abc\n", ssl.gets + } end end -- cgit v1.2.3