Add regress tests for max shared version code.

1 files changed, 133 insertions, 2 deletions

diff --git a/src/regress/lib/libssl/unit/ssl_versions.c b/src/regress/lib/libssl/unit/ssl_versions.c
index 32f7b3eea2..d4be40cbd8 100644
--- a/src/regress/lib/libssl/unit/ssl_versions.c
+++ b/src/regress/lib/libssl/unit/ssl_versions.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_versions.c,v 1.1 2016/12/30 16:58:12 jsing Exp $ */
+/* $OpenBSD: ssl_versions.c,v 1.2 2017/01/03 16:58:10 jsing Exp $ */
 /*
  * Copyright (c) 2016 Joel Sing <jsing@openbsd.org>
  *
@@ -18,6 +18,7 @@
 #include <openssl/ssl.h>
 
 int ssl_enabled_version_range(SSL *s, uint16_t *min_ver, uint16_t *max_ver);
+int ssl_max_shared_version(SSL *s, uint16_t peer_ver, uint16_t *max_ver);
 
 struct version_range_test {
         const long options;
@@ -101,7 +102,7 @@ test_ssl_enabled_version_range(void)
 
                 minver = maxver = 0xffff;
 
-                if (ssl_enabled_version_range(ssl, &minver, &maxver) == -1) {
+                if (ssl_enabled_version_range(ssl, &minver, &maxver) != 1) {
                         if (vrt->minver != 0 || vrt->maxver != 0) {
                                 fprintf(stderr, "FAIL: test %zu - failed but "
                                     "wanted non-zero versions\n", i);
@@ -128,6 +129,135 @@ test_ssl_enabled_version_range(void)
         return (failed);
 }
 
+struct shared_version_test {
+        const long options;
+        const uint16_t peerver;
+        const uint16_t maxver;
+};
+
+static struct shared_version_test shared_version_tests[] = {
+        {
+                .options = 0,
+                .peerver = SSL2_VERSION,
+                .maxver = 0,
+        },
+        {
+                .options = 0,
+                .peerver = SSL3_VERSION,
+                .maxver = 0,
+        },
+        {
+                .options = 0,
+                .peerver = TLS1_VERSION,
+                .maxver = TLS1_VERSION,
+        },
+        {
+                .options = 0,
+                .peerver = TLS1_1_VERSION,
+                .maxver = TLS1_1_VERSION,
+        },
+        {
+                .options = 0,
+                .peerver = TLS1_2_VERSION,
+                .maxver = TLS1_2_VERSION,
+        },
+        {
+                .options = 0,
+                .peerver = 0x7f12,
+                .maxver = TLS1_2_VERSION,
+        },
+        {
+                .options = SSL_OP_NO_TLSv1_2,
+                .peerver = TLS1_2_VERSION,
+                .maxver = TLS1_1_VERSION,
+        },
+        {
+                .options = SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2,
+                .peerver = TLS1_2_VERSION,
+                .maxver = TLS1_VERSION,
+        },
+        {
+                .options = SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2,
+                .peerver = TLS1_2_VERSION,
+                .maxver = 0,
+        },
+        {
+                .options = SSL_OP_NO_TLSv1,
+                .peerver = TLS1_1_VERSION,
+                .maxver = TLS1_1_VERSION,
+        },
+        {
+                .options = SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1,
+                .peerver = TLS1_1_VERSION,
+                .maxver = 0,
+        },
+        {
+                .options = SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2,
+                .peerver = TLS1_1_VERSION,
+                .maxver = TLS1_VERSION,
+        },
+        {
+                .options = SSL_OP_NO_TLSv1,
+                .peerver = TLS1_VERSION,
+                .maxver = 0,
+        },
+};
+
+#define N_SHARED_VERSION_TESTS \
+    (sizeof(shared_version_tests) / sizeof(*shared_version_tests))
+
+static int
+test_ssl_max_shared_version(void)
+{
+        struct shared_version_test *srt;
+        SSL_CTX *ssl_ctx = NULL;
+        SSL *ssl = NULL;
+        uint16_t maxver;
+        int failed = 1;
+        size_t i;
+
+        if ((ssl_ctx = SSL_CTX_new(TLS_method())) == NULL) { 
+                fprintf(stderr, "SSL_CTX_new() returned NULL\n");
+                goto failure;
+        }
+        if ((ssl = SSL_new(ssl_ctx)) == NULL) {
+                fprintf(stderr, "SSL_new() returned NULL\n");
+                goto failure;
+        }
+
+        failed = 0;
+
+        for (i = 0; i < N_SHARED_VERSION_TESTS; i++) {
+                srt = &shared_version_tests[i];
+
+                SSL_clear_options(ssl, SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 |
+                    SSL_OP_NO_TLSv1_2);
+                SSL_set_options(ssl, srt->options);
+
+                maxver = 0;
+
+                if (ssl_max_shared_version(ssl, srt->peerver, &maxver) != 1) {
+                        if (srt->maxver != 0) {
+                                fprintf(stderr, "FAIL: test %zu - failed but "
+                                    "wanted non-zero shared version\n", i);
+                                failed++;
+                        }
+                        continue;
+                }
+                if (maxver != srt->maxver) {
+                        fprintf(stderr, "FAIL: test %zu - got shared "
+                            "version %x, want %x\n", i, maxver, srt->maxver);
+                        failed++;
+                }
+        }
+
+ failure:
+        SSL_CTX_free(ssl_ctx);
+        SSL_free(ssl);
+
+        return (failed);
+}
+
 int
 main(int argc, char **argv)
 {
@@ -136,6 +266,7 @@ main(int argc, char **argv)
         SSL_library_init();
 
         failed |= test_ssl_enabled_version_range();
+        failed |= test_ssl_max_shared_version();
 
         if (failed == 0)
                 printf("PASS %s\n", __FILE__);