crypto/tls: add support for cipher flags to bogo_shim_test
The existing implementation of bogo_shim_test does not support test
flags that check the tls cipher. This change allows bogo_shim_test
to receive and enforce the flags -expect-cipher-aes,
-expect-cipher-no-aes, -on-initial-expect-cipher,
-on-resume-expect-cipher, and -on-retry-expect-cipher.
Updates #51434
diff --git a/src/crypto/tls/bogo_shim_test.go b/src/crypto/tls/bogo_shim_test.go
index f481a5a..473971e 100644
--- a/src/crypto/tls/bogo_shim_test.go
+++ b/src/crypto/tls/bogo_shim_test.go
@@ -48,6 +48,12 @@
curves = flagStringSlice("curves", "")
expectedCurve = flag.String("expect-curve-id", "", "")
+ expectCipherAes = flag.Int("expect-cipher-aes", 0, "")
+ expectCipherNoAes = flag.Int("expect-cipher-no-aes", 0, "")
+ onInitialExpectCipher = flag.Int("on-initial-expect-cipher", 0, "")
+ onResumeExpectCipher = flag.Int("on-resume-expect-cipher", 0, "")
+ onRetryExpectCipher = flag.Int("on-retry-expect-cipher", 0, "")
+
shimID = flag.Uint64("shim-id", 0, "")
_ = flag.Bool("ipv6", false, "")
@@ -261,6 +267,21 @@
cs := tlsConn.ConnectionState()
if cs.HandshakeComplete {
+ if i == 0 && *onInitialExpectCipher != 0 && uint16(*onInitialExpectCipher) != cs.CipherSuite {
+ log.Fatalf("expected initial cipher %#v but got %#v", uint16(*onInitialExpectCipher), cs.CipherSuite)
+ }
+ if i == 0 && *onResumeExpectCipher != 0 && uint16(*onResumeExpectCipher) == cs.CipherSuite {
+ log.Fatalf("expected on resume cipher %#v but got %#v", uint16(*onResumeExpectCipher), cs.CipherSuite)
+ }
+ if i == 1 && *onRetryExpectCipher != 0 && uint16(*onRetryExpectCipher) != cs.CipherSuite {
+ log.Fatalf("expected on retry cipher %#v but got %#v", uint16(*onRetryExpectCipher), cs.CipherSuite)
+ }
+ if *expectCipherAes != 0 && uint16(*expectCipherAes) != cs.CipherSuite {
+ log.Fatalf("expected aes cipher %v but got %v", expectCipherAes, cs.CipherSuite)
+ }
+ if *expectCipherNoAes != 0 && uint16(*expectCipherAes) != cs.CipherSuite {
+ log.Fatalf("expected non-aes cipher %v but got %v", expectCipherNoAes, cs.CipherSuite)
+ }
if *expectALPN != "" && cs.NegotiatedProtocol != *expectALPN {
log.Fatalf("unexpected protocol negotiated: want %q, got %q", *expectALPN, cs.NegotiatedProtocol)
}
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
if i == 0 && *onResumeExpectCipher != 0 && uint16(*onResumeExpectCipher) == cs.CipherSuite {I'm surprised this is i == 0, given that i is counting up to resumeCount. Should it be > 0?
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
if i == 0 && *onResumeExpectCipher != 0 && uint16(*onResumeExpectCipher) == cs.CipherSuite {I'm surprised this is i == 0, given that i is counting up to resumeCount. Should it be > 0?
Yes, I think you are right. I have also fixed some other issues with the logic in this CL.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
if i == 0 && *onResumeExpectCipher != 0 && uint16(*onResumeExpectCipher) == cs.CipherSuite {Clide StefaniI'm surprised this is i == 0, given that i is counting up to resumeCount. Should it be > 0?
Yes, I think you are right. I have also fixed some other issues with the logic in this CL.
Done
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Code-Review | +1 |
log.Fatalf("expected initial cipher %v but got %v", CipherSuiteName(uint16(*onInitialExpectCipher)), CipherSuiteName(cs.CipherSuite))Optional: Pull this out as a cipherSuiteName variable.
if *onInitialExpectCipher != 0 && i == 0 && uint16(*onInitialExpectCipher) != cs.CipherSuite {
log.Fatalf("expected initial cipher %v but got %v", CipherSuiteName(uint16(*onInitialExpectCipher)), CipherSuiteName(cs.CipherSuite))
} else if *onResumeExpectCipher != 0 && cs.DidResume && uint16(*onResumeExpectCipher) != cs.CipherSuite {
log.Fatalf("expected on resume cipher %v but got %v", CipherSuiteName(uint16(*onResumeExpectCipher)), CipherSuiteName(cs.CipherSuite))
} else if *onRetryExpectCipher != 0 && cs.testingOnlyDidHRR && uint16(*onRetryExpectCipher) != cs.CipherSuite {
log.Fatalf("expected on retry cipher %v but got %v", CipherSuiteName(uint16(*onRetryExpectCipher)), CipherSuiteName(cs.CipherSuite))
}In a subsequent CL, I'd like to see all of the "only check this for initial", "only check this for resume", "only check this for retry" checks pulled into three blocks.
if *expectVersion != 0 && cs.Version != uint16(*expectVersion) {
log.Fatalf("expected ssl version %q, got %q", uint16(*expectVersion), cs.Version)
}Optional: Hold off on making this change to help clarify that it's not related to the broader purpose of this CL.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
log.Fatalf("expected initial cipher %v but got %v", CipherSuiteName(uint16(*onInitialExpectCipher)), CipherSuiteName(cs.CipherSuite))Optional: Pull this out as a cipherSuiteName variable.
Acknowledged
if *onInitialExpectCipher != 0 && i == 0 && uint16(*onInitialExpectCipher) != cs.CipherSuite {
log.Fatalf("expected initial cipher %v but got %v", CipherSuiteName(uint16(*onInitialExpectCipher)), CipherSuiteName(cs.CipherSuite))
} else if *onResumeExpectCipher != 0 && cs.DidResume && uint16(*onResumeExpectCipher) != cs.CipherSuite {
log.Fatalf("expected on resume cipher %v but got %v", CipherSuiteName(uint16(*onResumeExpectCipher)), CipherSuiteName(cs.CipherSuite))
} else if *onRetryExpectCipher != 0 && cs.testingOnlyDidHRR && uint16(*onRetryExpectCipher) != cs.CipherSuite {
log.Fatalf("expected on retry cipher %v but got %v", CipherSuiteName(uint16(*onRetryExpectCipher)), CipherSuiteName(cs.CipherSuite))
}In a subsequent CL, I'd like to see all of the "only check this for initial", "only check this for resume", "only check this for retry" checks pulled into three blocks.
Yes, that makes sense. I think when there are more checks that rely on on checking the type of connection, it might make reading easier if they are blocked this way. I think that it makes more sense to to this in a later organizational CL.
if *expectVersion != 0 && cs.Version != uint16(*expectVersion) {
log.Fatalf("expected ssl version %q, got %q", uint16(*expectVersion), cs.Version)
}Optional: Hold off on making this change to help clarify that it's not related to the broader purpose of this CL.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Code-Review | +1 |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Updates #51434 if *onInitialExpectCipher != 0 && i == 0 && uint16(*onInitialExpectCipher) != cs.CipherSuite {I had tried to revive this CR as well (and then lost track of it, oops) and @rol...@golang.org left some feedback that I think might also apply here. See https://go-review.googlesource.com/c/go/+/650738
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |