maskit commented on code in PR #13723:
URL: https://github.com/apache/trafficserver/pull/13723#discussion_r4085651679
##########
tests/gold_tests/tls/tls_sni_groups.test.py:
##########
@@ -20,7 +20,9 @@
Test SNI configuration server_groups_list
'''
# The groups function was added in OpenSSL 1.1.1
-Test.SkipUnless(Condition.HasOpenSSLVersion("1.1.1"))
+Test.SkipUnless(
+ Condition.HasOpenSSLVersion("1.1.1"),
+ Condition.HasProgram("openssl", "openssl needs to be installed and in PATH
for this test"))
Review Comment:
This is the same point as the thread on the X25519MLKEM768 run. The x25519
run only uses `s_client` flags and output that 1.1.1 already has, so the
version gap is limited to the hybrid run and is covered there.
##########
tests/gold_tests/tls/tls_sni_groups.test.py:
##########
@@ -74,16 +76,17 @@
tr = Test.AddTestRun("Test 0: x25519")
tr.Processes.Default.StartBefore(server)
tr.Processes.Default.StartBefore(Test.Processes.ts)
-tr.MakeCurlCommand(
- "-v --ciphers ECDHE-RSA-AES256-GCM-SHA384 --resolve
'bbb.com:{0}:127.0.0.1' -k https://bbb.com:{0}".format(
- ts.Variables.ssl_port),
- ts=ts)
+tr.Processes.Default.Command = (
+ 'printf "GET / HTTP/1.1\\r\\nHost: bbb.com\\r\\nConnection:
close\\r\\n\\r\\n" | '
+ 'openssl s_client -connect 127.0.0.1:{0} -servername bbb.com -tls1_2 '
+ '-cipher ECDHE-RSA-AES256-GCM-SHA384
-ign_eof'.format(ts.Variables.ssl_port))
Review Comment:
AuTest runs `Command` through a shell, and other gold tests already pipe
`printf` into `openssl s_client` the same way, e.g.
`tls/tls_session_reuse.test.py`.
##########
tests/gold_tests/tls/tls_sni_groups.test.py:
##########
@@ -74,16 +76,17 @@
tr = Test.AddTestRun("Test 0: x25519")
tr.Processes.Default.StartBefore(server)
tr.Processes.Default.StartBefore(Test.Processes.ts)
-tr.MakeCurlCommand(
- "-v --ciphers ECDHE-RSA-AES256-GCM-SHA384 --resolve
'bbb.com:{0}:127.0.0.1' -k https://bbb.com:{0}".format(
- ts.Variables.ssl_port),
- ts=ts)
+tr.Processes.Default.Command = (
+ 'printf "GET / HTTP/1.1\\r\\nHost: bbb.com\\r\\nConnection:
close\\r\\n\\r\\n" | '
+ 'openssl s_client -connect 127.0.0.1:{0} -servername bbb.com -tls1_2 '
+ '-cipher ECDHE-RSA-AES256-GCM-SHA384
-ign_eof'.format(ts.Variables.ssl_port))
tr.ReturnCode = 0
tr.StillRunningAfter = ts
ts.Disk.traffic_out.Content += Testers.ContainsExpression(
"Setting groups list from server_groups_list to x25519", "Should log
setting the server groups")
+# OpenSSL renamed this line from "Server Temp Key" to "Peer Temp Key" in 3.5.
tr.Processes.Default.Streams.All = Testers.IncludesExpression(
- f"SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 / x25519",
"Curl should log using x25519 in the SSL connection")
+ r"(Server|Peer) Temp Key: X25519", "the key exchange should use the x25519
group this SNI pins")
Review Comment:
`s_client` only adds `ECDH, <curve>` for `EVP_PKEY_EC` keys. An X25519 key
takes the default branch in `ssl_print_tmp_key()` (`X25519, 253 bits` in 1.1.1
and 3.0) or, from 3.5, the keymgmt branch (`X25519`). There is no `ECDH,
X25519` form to allow for.
##########
tests/gold_tests/tls/tls_sni_groups.test.py:
##########
@@ -100,14 +103,16 @@
# Hybrid ECDH PQ key exchange TLS groups were added in OpenSSL 3.5
if Condition.HasOpenSSLVersion("3.5.0"):
tr = Test.AddTestRun("Test 2: X25519MLKEM768")
- tr.MakeCurlCommand(
- "-v --tls13-ciphers TLS_AES_256_GCM_SHA384 --resolve
'aaa.com:{0}:127.0.0.1' -k https://aaa.com:{0}".format(
- ts.Variables.ssl_port),
- ts=ts)
+ tr.Processes.Default.Command = (
+ 'printf "GET / HTTP/1.1\\r\\nHost: aaa.com\\r\\nConnection:
close\\r\\n\\r\\n" | '
+ 'openssl s_client -connect 127.0.0.1:{0} -servername aaa.com -tls1_3 '
+ '-ciphersuites TLS_AES_256_GCM_SHA384
-ign_eof'.format(ts.Variables.ssl_port))
Review Comment:
The two runs differ in host, TLS version and cipher flag (`-cipher` vs
`-ciphersuites`), so a helper would save little over two explicit commands. I'd
rather keep them readable inline.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
