Skip to content

Latest commit

 

History

History
47 lines (40 loc) · 2.32 KB

README.md

File metadata and controls

47 lines (40 loc) · 2.32 KB
Raw

General info

This project consists of:

  • ssl-tests - does SSL/TLS testing, see lower
  • certgen - generates keys/certificates/keystores (required by SSLSocketTest)
  • SSLContextInfo - lists available SSLContexts
  • SSLSocketInfo - lists default/supported ciphers for SSLSocket/SSLServerSocket (default SSLContext).

To use specific JDK use JAVA_HOME env. variable:

export JAVA_HOME=/usr/lib/jvm/java-1.8.0-openjdk

ssl-tests

It iterates over all providers/algorithm/protocol/cipher combinations and tests them one by one. It creates basic client+server scenario, where server just echos (repeats) everything client sends. Both server and client sockets are configured to have only one protocol and one cipher enabled at a time (these ones to be tested). Test then checks that no exeptions are thrown and that data sent and received match.

run by:

make ssl-tests

makefile variables:

  • SSLTESTS_IGNORE_PROTOCOLS=... - protocols matching this pattern will be ignored
  • SSLTESTS_IGNORE_CIPHERS=... - ciphers matching this pattern will be ignored
  • SSLTESTS_SSL_CONFIG_FILTER=?,?,?,? - only specified combination of provider,algorithm,protocol,cipher will be tested
  • SSLTESTS_USE_OPENSSL_CLIENT=1 - use openssl client instead of default SSLSocketClient written in java for testing
  • SSLTESTS_USE_GNUTLS_CLIENT=1 - use gnutls client instead of default SSLSocketClient written in java for testing
  • SSLTESTS_USE_NSS_CLIENT=1 - use nss client instead of default SSLSocketClient written in java for testing

IGNORED combinations:

Currently, tested combination may show up as IGNORED for following reasons:

  • SSLv2Hello protocol is used, having this enabled as only protocol does not make sense as far as I know
  • TLS_EMPTY_RENEGOTIATION_INFO_SCSV cipher is used, as this in not really a ciper
  • "No appropriate protocol" exception is thrown, as it is caused by invalid protocol/algorithm combination (thrown by handshaker)
  • protocol starts with DTLS - tests currently does not support DTLS
  • ciphers starting with TLS_KRB5 - tests currently does not support these
  • it is explicitly ignored (see higher)

Other utilities

run by:

make SSLContextInfo
make SSLSocketInfo