Add a self test for each SSL library by connecting client with

server.  Check that the highest available TLS version is selected.
LibreSSL TLS 1.3 check is disabled until the feature becomes
available.

5 files changed, 88 insertions, 23 deletions

diff --git a/src/regress/lib/libssl/interop/Makefile.inc b/src/regress/lib/libssl/interop/Makefile.inc
index f209bdbd91..1a1ef30ca6 100644
--- a/src/regress/lib/libssl/interop/Makefile.inc
+++ b/src/regress/lib/libssl/interop/Makefile.inc
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile.inc,v 1.2 2018/11/07 06:29:26 bluhm Exp $
+# $OpenBSD: Makefile.inc,v 1.3 2018/11/07 20:46:28 bluhm Exp $
 
 .PATH:                  ${.CURDIR}/..
 
@@ -18,43 +18,72 @@ ldd-$p.out: $p
 
 # run netcat server and connect with test client
 
-CLEANFILES +=           client.out netcat-l.out netcat-l.fstat
+CLEANFILES +=           nc-client.out netcat-l.out netcat-l.fstat
 REGRESS_TARGETS +=      run-client
-client.out run-client: client 127.0.0.1.crt
+nc-client.out run-client: client 127.0.0.1.crt
         @echo '\n======== $@ ========'
         echo "greeting" | nc -l -c -C 127.0.0.1.crt -K 127.0.0.1.key \
             127.0.0.1 0 >netcat-l.out & \
             sleep 1; fstat -p $$! >netcat-l.fstat
         LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ./client \
             `sed -n 's/.* stream tcp .*:/127.0.0.1 /p' netcat-l.fstat` \
-            >client.out
+            >nc-client.out
         # check that the client run successfully to the end
-        grep -q '^success$$' client.out
+        grep -q '^success$$' nc-client.out
         # client must have read server greeting
-        grep -q '^<<< greeting$$' client.out
+        grep -q '^<<< greeting$$' nc-client.out
         # netstat server must have read client hello
         grep -q '^hello$$' netcat-l.out
 
 # run test server and connect with netcat client
 
-CLEANFILES +=           server.out netcat.out
+CLEANFILES +=           nc-server.out netcat.out
 REGRESS_TARGETS +=      run-server
-server.out run-server: server 127.0.0.1.crt
+nc-server.out run-server: server 127.0.0.1.crt
         @echo '\n======== $@ ========'
-        LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ./server 127.0.0.1 0 >server.out
+        LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ./server 127.0.0.1 0 \
+            >nc-server.out
         echo "hello" | nc -c -T noverify \
-            `sed -n 's/listen sock: //p' server.out` \
+            `sed -n 's/listen sock: //p' nc-server.out` \
             >netcat.out
         # check that the server child run successfully to the end
-        grep -q '^success$$' server.out
+        grep -q '^success$$' nc-server.out
         # server must have read client hello
-        grep -q '^<<< hello$$' server.out
+        grep -q '^<<< hello$$' nc-server.out
         # client must have read server greeting
         grep -q '^greeting$$' netcat.out
 
-# check that programs have used correct runtime library
+# run test server and with test client, self test the ssl library
 
-REGRESS_TARGETS +=      ${PROGS:S/^/run-version-/}
+CLEANFILES +=           self-client.out self-server.out
+REGRESS_TARGETS +=      run-self
+self-client.out self-server.out run-self: client server 127.0.0.1.crt
+        @echo '\n======== $@ ========'
+        LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ./server 127.0.0.1 0 \
+            >self-server.out
+        LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ./client \
+            `sed -n 's/listen sock: //p' self-server.out` \
+            >self-client.out
+        # check that the client run successfully to the end
+        grep -q '^success$$' self-client.out
+        # client must have read server greeting
+        grep -q '^<<< greeting$$' self-client.out
+        # check that the server child run successfully to the end
+        grep -q '^success$$' self-server.out
+        # server must have read client hello
+        grep -q '^<<< hello$$' self-server.out
+
+.for o in nc-client nc-server self-client self-server
+
+# check that client and server have used correct runtime library
+
+REGRESS_TARGETS +=      run-version-$o
+
+# check that client and server have used correct TLS protocol
+
+REGRESS_TARGETS +=      run-protocol-$o
+
+.endfor
 
 # create certificates for TLS
 
diff --git a/src/regress/lib/libssl/interop/README b/src/regress/lib/libssl/interop/README
index d8847e5ef5..1bd418c9cc 100644
--- a/src/regress/lib/libssl/interop/README
+++ b/src/regress/lib/libssl/interop/README
@@ -5,6 +5,10 @@ by linking them with LibreSSL or OpenSSL 1.0.2 or OpenSSL 1.1.  This
 way API compatibility is tested.  Connect and accept with netcat
 to test protocol compatibility with libtls.
 
+To self test each SSL library, connect client with server.  Check
+that the highest available TLS version is selected.  LibreSSL TLS
+1.3 check has to be enabled when the feature becomes available.
+
 Currently OpenSSL 1.0.2p and OpenSSL 1.1.1 from ports are used.  As
 soon as LibreSSL supports TLS 1.3, it should be used automatically
 when netcat is communicating with OpenSSL 1.1.
diff --git a/src/regress/lib/libssl/interop/libressl/Makefile b/src/regress/lib/libssl/interop/libressl/Makefile
index 5fce6c5c22..19557ffbc1 100644
--- a/src/regress/lib/libssl/interop/libressl/Makefile
+++ b/src/regress/lib/libssl/interop/libressl/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.2 2018/11/07 06:29:26 bluhm Exp $
+# $OpenBSD: Makefile,v 1.3 2018/11/07 20:46:28 bluhm Exp $
 
 PROGS =                 client server
 CPPFLAGS =
@@ -7,6 +7,12 @@ LDADD =			-lssl -lcrypto
 DPADD =                 ${LIBSSL} ${LIBCRYPTO}
 LD_LIBRARY_PATH =
 
+run-protocol-self-client run-protocol-self-server \
+run-protocol-nc-client run-protocol-nc-server:
+        @echo '\n======== $@ ========'
+        # LibreSSL does not support TLS 1.3 yet
+        @echo DISABLED
+
 .for p in ${PROGS}
 run-ldd-$p: ldd-$p.out
         @echo '\n======== $@ ========'
@@ -15,11 +21,18 @@ run-ldd-$p: ldd-$p.out
         grep -q /usr/lib/libssl.so ldd-$p.out
         # check that $p is not linked with OpenSSL
         ! grep /usr/local/lib/ ldd-$p.out
+.endfor
 
-run-version-$p: $p.out
+.for o in nc-client nc-server self-client self-server
+run-version-$o: $o.out
         @echo '\n======== $@ ========'
         # check that runtime version is LibreSSL
-        grep 'SSLEAY_VERSION: LibreSSL' $p.out
+        grep 'SSLEAY_VERSION: LibreSSL' $o.out
+
+run-protocol-$o: $o.out
+        @echo '\n======== $@ ========'
+        # check that protocol version is TLS 1.3
+        grep 'Protocol *: TLSv1.3' $o.out
 .endfor
 
 .include <bsd.regress.mk>
diff --git a/src/regress/lib/libssl/interop/openssl/Makefile b/src/regress/lib/libssl/interop/openssl/Makefile
index 9661767d7b..ad0c7288ca 100644
--- a/src/regress/lib/libssl/interop/openssl/Makefile
+++ b/src/regress/lib/libssl/interop/openssl/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.2 2018/11/07 06:29:26 bluhm Exp $
+# $OpenBSD: Makefile,v 1.3 2018/11/07 20:46:28 bluhm Exp $
 
 .if ! exists(/usr/local/bin/eopenssl)
 regress:
@@ -22,11 +22,18 @@ run-ldd-$p: ldd-$p.out
         grep -q /usr/local/lib/eopenssl/libssl.so ldd-$p.out
         # check that $p is not linked with LibreSSL
         ! grep -v libc.so ldd-$p.out | grep /usr/lib/
+.endfor
 
-run-version-$p: $p.out
+.for o in nc-client nc-server self-client self-server
+run-version-$o: $o.out
         @echo '\n======== $@ ========'
         # check that runtime version is OpenSSL 1.0
-        grep 'SSLEAY_VERSION: OpenSSL 1.0' $p.out
+        grep 'SSLEAY_VERSION: OpenSSL 1.0' $o.out
+
+run-protocol-$o: $o.out
+        @echo '\n======== $@ ========'
+        # check that protocol version is TLS 1.2
+        grep 'Protocol *: TLSv1.2' $o.out
 .endfor
 
 .include <bsd.regress.mk>
diff --git a/src/regress/lib/libssl/interop/openssl11/Makefile b/src/regress/lib/libssl/interop/openssl11/Makefile
index b11e08488a..e7257a3976 100644
--- a/src/regress/lib/libssl/interop/openssl11/Makefile
+++ b/src/regress/lib/libssl/interop/openssl11/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.1 2018/11/07 19:09:01 bluhm Exp $
+# $OpenBSD: Makefile,v 1.2 2018/11/07 20:46:28 bluhm Exp $
 
 .if ! exists(/usr/local/bin/eopenssl11)
 regress:
@@ -14,6 +14,11 @@ DPADD =			/usr/local/lib/eopenssl11/libssl.a \
                         /usr/local/lib/eopenssl11/libcrypto.a
 LD_LIBRARY_PATH =       /usr/local/lib/eopenssl11
 
+run-protocol-nc-client run-protocol-nc-server:
+        @echo '\n======== $@ ========'
+        # LibreSSL does not support TLS 1.3 yet
+        @echo DISABLED
+
 .for p in ${PROGS}
 run-ldd-$p: ldd-$p.out
         @echo '\n======== $@ ========'
@@ -22,11 +27,18 @@ run-ldd-$p: ldd-$p.out
         grep -q /usr/local/lib/eopenssl11/libssl.so ldd-$p.out
         # check that $p is not linked with LibreSSL
         ! grep -v libc.so ldd-$p.out | grep /usr/lib/
+.endfor
 
-run-version-$p: $p.out
+.for o in nc-client nc-server self-client self-server
+run-version-$o: $o.out
         @echo '\n======== $@ ========'
         # check that runtime version is OpenSSL 1.1
-        grep 'SSLEAY_VERSION: OpenSSL 1.1' $p.out
+        grep 'SSLEAY_VERSION: OpenSSL 1.1' $o.out
+
+run-protocol-$o: $o.out
+        @echo '\n======== $@ ========'
+        # check that protocol version is TLS 1.3
+        grep 'Protocol *: TLSv1.3' $o.out
 .endfor
 
 .include <bsd.regress.mk>