From 3ea763e068fbedf7b7b33b73ca294952543e7930 Mon Sep 17 00:00:00 2001 From: Thomas Date: Tue, 5 Mar 2024 21:30:29 +0900 Subject: [PATCH] Enable all tests on opensslv3 --- lib/cpp/test/SecurityFromBufferTest.cpp | 11 +++++------ lib/cpp/test/SecurityTest.cpp | 11 +++++------ 2 files changed, 10 insertions(+), 12 deletions(-) diff --git a/lib/cpp/test/SecurityFromBufferTest.cpp b/lib/cpp/test/SecurityFromBufferTest.cpp index c4f5c8ed020..32f2378d38b 100644 --- a/lib/cpp/test/SecurityFromBufferTest.cpp +++ b/lib/cpp/test/SecurityFromBufferTest.cpp @@ -109,7 +109,7 @@ struct SecurityFromBufferFixture { shared_ptr pServerSocket; pServerSocketFactory.reset(new TSSLSocketFactory(static_cast(protocol))); - #if OPENSSL_VERSION_NUMBER >= 0x10100000L && OPENSSL_VERSION_NUMBER < 0x30000000L + #if OPENSSL_VERSION_NUMBER >= 0x10100000L // OpenSSL 1.1.0 introduced @SECLEVEL. Modern distributions limit TLS 1.0/1.1 // to @SECLEVEL=0 or 1, so specify it to test all combinations. pServerSocketFactory->ciphers("ALL:!ADH:!LOW:!EXP:!MD5:@SECLEVEL=0"); @@ -161,7 +161,7 @@ struct SecurityFromBufferFixture { try { pClientSocketFactory.reset(new TSSLSocketFactory(static_cast(protocol))); pClientSocketFactory->authenticate(true); - #if OPENSSL_VERSION_NUMBER >= 0x10100000L && OPENSSL_VERSION_NUMBER < 0x30000000L + #if OPENSSL_VERSION_NUMBER >= 0x10100000L // OpenSSL 1.1.0 introduced @SECLEVEL. Modern distributions limit TLS 1.0/1.1 // to @SECLEVEL=0 or 1, so specify it to test all combinations. pClientSocketFactory->ciphers("ALL:!ADH:!LOW:!EXP:!MD5:@SECLEVEL=0"); @@ -210,16 +210,15 @@ BOOST_AUTO_TEST_CASE(ssl_security_matrix) { try { // matrix of connection success between client and server with different SSLProtocol selections static_assert(apache::thrift::transport::LATEST == 5, "Mismatch in assumed number of ssl protocols"); - bool ossl1x = (OPENSSL_VERSION_NUMBER < 0x30000000L); bool matrix[apache::thrift::transport::LATEST + 1][apache::thrift::transport::LATEST + 1] = { // server = SSLTLS SSLv2 SSLv3 TLSv1_0 TLSv1_1 TLSv1_2 // client - /* SSLTLS */ { true, false, false, ossl1x, ossl1x, true }, + /* SSLTLS */ { true, false, false, true, true, true }, /* SSLv2 */ { false, false, false, false, false, false }, /* SSLv3 */ { false, false, true, false, false, false }, - /* TLSv1_0 */ { ossl1x, false, false, ossl1x, false, false }, - /* TLSv1_1 */ { ossl1x, false, false, false, ossl1x, false }, + /* TLSv1_0 */ { true, false, false, true, false, false }, + /* TLSv1_1 */ { true, false, false, false, true, false }, /* TLSv1_2 */ { true, false, false, false, false, true } }; diff --git a/lib/cpp/test/SecurityTest.cpp b/lib/cpp/test/SecurityTest.cpp index 4c6c732671f..cc71f04793d 100644 --- a/lib/cpp/test/SecurityTest.cpp +++ b/lib/cpp/test/SecurityTest.cpp @@ -108,7 +108,7 @@ struct SecurityFixture shared_ptr pServerSocket; pServerSocketFactory.reset(new TSSLSocketFactory(static_cast(protocol))); - #if OPENSSL_VERSION_NUMBER >= 0x10100000L && OPENSSL_VERSION_NUMBER < 0x30000000L + #if OPENSSL_VERSION_NUMBER >= 0x10100000L // OpenSSL 1.1.0 introduced @SECLEVEL. Modern distributions limit TLS 1.0/1.1 // to @SECLEVEL=0 or 1, so specify it to test all combinations. pServerSocketFactory->ciphers("ALL:!ADH:!LOW:!EXP:!MD5:@SECLEVEL=0:@STRENGTH"); @@ -168,7 +168,7 @@ struct SecurityFixture { pClientSocketFactory.reset(new TSSLSocketFactory(static_cast(protocol))); pClientSocketFactory->authenticate(true); - #if OPENSSL_VERSION_NUMBER >= 0x10100000L && OPENSSL_VERSION_NUMBER < 0x30000000L + #if OPENSSL_VERSION_NUMBER >= 0x10100000L // OpenSSL 1.1.0 introduced @SECLEVEL. Modern distributions limit TLS 1.0/1.1 // to @SECLEVEL=0 or 1, so specify it to test all combinations. pClientSocketFactory->ciphers("ALL:!ADH:!LOW:!EXP:!MD5:@SECLEVEL=0"); @@ -232,16 +232,15 @@ BOOST_AUTO_TEST_CASE(ssl_security_matrix) { // matrix of connection success between client and server with different SSLProtocol selections static_assert(apache::thrift::transport::LATEST == 5, "Mismatch in assumed number of ssl protocols"); - bool ossl1x = (OPENSSL_VERSION_NUMBER < 0x30000000L); bool matrix[apache::thrift::transport::LATEST + 1][apache::thrift::transport::LATEST + 1] = { // server = SSLTLS SSLv2 SSLv3 TLSv1_0 TLSv1_1 TLSv1_2 // client - /* SSLTLS */ { true, false, false, ossl1x, ossl1x, true }, + /* SSLTLS */ { true, false, false, true, true, true }, /* SSLv2 */ { false, false, false, false, false, false }, /* SSLv3 */ { false, false, true, false, false, false }, - /* TLSv1_0 */ { ossl1x, false, false, ossl1x, false, false }, - /* TLSv1_1 */ { ossl1x, false, false, false, ossl1x, false }, + /* TLSv1_0 */ { true, false, false, true, false, false }, + /* TLSv1_1 */ { true, false, false, false, true, false }, /* TLSv1_2 */ { true, false, false, false, false, true } };