runner: Remove split handshake tests Split handshakes are soon to disappear. Start by unwinding some of the messier test support. Split handshakes are still tested a little in ssl_test (useful since there are some downstream unit tests that aren't *quite* yet unwound), but these are enough of a nuisance that we'd rather just unwind them now. Bug: 376969215 Change-Id: I8bacdd574d9bc3daa0e9abc84fd4fcf9c1713c60 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100187 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Lily Chen <chlily@google.com> Auto-Submit: David Benjamin <davidben@google.com> Commit-Queue: Lily Chen <chlily@google.com>
diff --git a/ssl/test/runner/hint_mismatch_tests.go b/ssl/test/runner/hint_mismatch_tests.go index 090b41a..1f78ce8 100644 --- a/ssl/test/runner/hint_mismatch_tests.go +++ b/ssl/test/runner/hint_mismatch_tests.go
@@ -17,23 +17,18 @@ import "strconv" func addHintMismatchTests() { - // Each of these tests skips split handshakes because split handshakes does - // not handle a mismatch between shim and handshaker. Handshake hints, - // however, are designed to tolerate the mismatch. - // - // Note also these tests do not specify -handshake-hints directly. Instead, - // we define normal tests, that run even without a handshaker, and rely on - // convertToSplitHandshakeTests to generate a handshaker hints variant. This + // These tests do not specify -handshake-hints directly. Instead, we define + // normal tests, that run even without a handshaker, and rely on + // convertToHandshakeHintTests to generate a handshaker hints variant. This // avoids repeating the -is-handshaker-supported and -handshaker-path logic. // (While not useful, the tests will still pass without a handshaker.) for _, protocol := range []protocol{tls, quic} { // If the signing payload is different, the handshake still completes // successfully. Different ALPN preferences will trigger a mismatch. testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-SignatureInput", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-SignatureInput", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS13, MaxVersion: VersionTLS13, @@ -52,10 +47,9 @@ // The shim and handshaker may have different curve preferences. testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-KeyShare", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-KeyShare", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS13, MaxVersion: VersionTLS13, @@ -74,10 +68,9 @@ }) if protocol != quic { testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-ECDHE-Group", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-ECDHE-Group", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS12, MaxVersion: VersionTLS12, @@ -97,10 +90,9 @@ // If the handshaker does HelloRetryRequest, it will omit most hints. // The shim should still work. testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-HandshakerHelloRetryRequest", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-HandshakerHelloRetryRequest", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS13, MaxVersion: VersionTLS13, @@ -120,10 +112,9 @@ // will be ignored. This is not reported as a mismatch because hints // would not have helped the shim anyway. testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-ShimHelloRetryRequest", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-ShimHelloRetryRequest", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS13, MaxVersion: VersionTLS13, @@ -141,10 +132,9 @@ // The shim and handshaker may have different signature algorithm // preferences. testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-SignatureAlgorithm-TLS13", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-SignatureAlgorithm-TLS13", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS13, MaxVersion: VersionTLS13, @@ -162,10 +152,9 @@ }) if protocol != quic { testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-SignatureAlgorithm-TLS12", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-SignatureAlgorithm-TLS12", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS12, MaxVersion: VersionTLS12, @@ -191,10 +180,9 @@ DNSNames: []string{"test"}, }).ToCredential() testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-Certificate-TLS13", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-Certificate-TLS13", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS13, MaxVersion: VersionTLS13, @@ -208,10 +196,9 @@ }) if protocol != quic { testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-Certificate-TLS12", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-Certificate-TLS12", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS12, MaxVersion: VersionTLS12, @@ -229,10 +216,9 @@ // We run the first connection with tickets enabled, so the client is // issued a ticket, then disable tickets on the second connection. testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-NoTickets1-TLS13", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-NoTickets1-TLS13", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS13, MaxVersion: VersionTLS13, @@ -245,10 +231,9 @@ expectResumeRejected: true, }) testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-NoTickets2-TLS13", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-NoTickets2-TLS13", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS13, MaxVersion: VersionTLS13, @@ -261,10 +246,9 @@ }) if protocol != quic { testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-NoTickets1-TLS12", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-NoTickets1-TLS12", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS12, MaxVersion: VersionTLS12, @@ -277,10 +261,9 @@ expectResumeRejected: true, }) testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-NoTickets2-TLS12", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-NoTickets2-TLS12", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS12, MaxVersion: VersionTLS12, @@ -296,10 +279,9 @@ // The shim and handshaker may disagree on whether to request a client // certificate. testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-CertificateRequest", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-CertificateRequest", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS13, MaxVersion: VersionTLS13, @@ -314,10 +296,9 @@ // The shim and handshaker may negotiate different versions altogether. if protocol != quic { testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-Version1", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-Version1", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS12, MaxVersion: VersionTLS13, @@ -332,10 +313,9 @@ }, }) testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-Version2", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-Version2", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS12, MaxVersion: VersionTLS13, @@ -355,10 +335,9 @@ // algorithm, whether to enable certificate compression, or certificate // compression inputs. testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-CertificateCompression-ShimOnly", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-CertificateCompression-ShimOnly", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS13, MaxVersion: VersionTLS13, @@ -375,10 +354,9 @@ }, }) testCases = append(testCases, testCase{ - name: protocol.String() + "-HintMismatch-CertificateCompression-HandshakerOnly", - testType: serverTest, - protocol: protocol, - skipSplitHandshake: true, + name: protocol.String() + "-HintMismatch-CertificateCompression-HandshakerOnly", + testType: serverTest, + protocol: protocol, config: Config{ MinVersion: VersionTLS13, MaxVersion: VersionTLS13, @@ -395,10 +373,9 @@ }, }) testCases = append(testCases, testCase{ - testType: serverTest, - name: protocol.String() + "-HintMismatch-CertificateCompression-AlgorithmMismatch", - protocol: protocol, - skipSplitHandshake: true, + testType: serverTest, + name: protocol.String() + "-HintMismatch-CertificateCompression-AlgorithmMismatch", + protocol: protocol, config: Config{ MinVersion: VersionTLS13, MaxVersion: VersionTLS13, @@ -418,10 +395,9 @@ }, }) testCases = append(testCases, testCase{ - testType: serverTest, - name: protocol.String() + "-HintMismatch-CertificateCompression-InputMismatch", - protocol: protocol, - skipSplitHandshake: true, + testType: serverTest, + name: protocol.String() + "-HintMismatch-CertificateCompression-InputMismatch", + protocol: protocol, config: Config{ MinVersion: VersionTLS13, MaxVersion: VersionTLS13, @@ -451,10 +427,9 @@ // selects ECDHE_RSA (hints are useful). if protocol != quic { testCases = append(testCases, testCase{ - testType: serverTest, - name: protocol.String() + "-HintMismatch-CipherMismatch1", - protocol: protocol, - skipSplitHandshake: true, + testType: serverTest, + name: protocol.String() + "-HintMismatch-CipherMismatch1", + protocol: protocol, config: Config{ MinVersion: VersionTLS12, MaxVersion: VersionTLS12, @@ -469,10 +444,9 @@ }, }) testCases = append(testCases, testCase{ - testType: serverTest, - name: protocol.String() + "-HintMismatch-CipherMismatch2", - protocol: protocol, - skipSplitHandshake: true, + testType: serverTest, + name: protocol.String() + "-HintMismatch-CipherMismatch2", + protocol: protocol, config: Config{ MinVersion: VersionTLS12, MaxVersion: VersionTLS12,
diff --git a/ssl/test/runner/raw_public_key_tests.go b/ssl/test/runner/raw_public_key_tests.go index 3208b59..ff081b6 100644 --- a/ssl/test/runner/raw_public_key_tests.go +++ b/ssl/test/runner/raw_public_key_tests.go
@@ -402,9 +402,8 @@ expectations: connectionExpectations{ peerCertificate: expectedServerCredential, }, - shimCredentials: test.serverCredentialsConfigured, - resumeSession: true, - skipSplitHandshake: true, + shimCredentials: test.serverCredentialsConfigured, + resumeSession: true, } // Test that the server can defer configuring credentials to the cert // callback. @@ -926,7 +925,6 @@ expectedError: test.expectedError, expectedLocalError: test.expectedLocalError, resumeSession: test.expectedError == "" && test.expectedLocalError == "", - skipSplitHandshake: true, }) } } @@ -952,10 +950,9 @@ ExpectClientCertificateTypes: certTypesListRPKOnly, }, }, - flags: shimFlags, - skipSplitHandshake: true, - shouldFail: true, - expectedError: expectedError, + flags: shimFlags, + shouldFail: true, + expectedError: expectedError, }) shimFlags = append([]string{"-verify-peer"}, flagCertTypes("-accepted-peer-cert-types", certTypesListRPKOnly)...) @@ -976,8 +973,7 @@ SkipCertificateVerify: true, }, }, - flags: shimFlags, - skipSplitHandshake: true, + flags: shimFlags, }) if ver.version >= VersionTLS13 { // If the client sends an otherwise valid Certificate message with an RPK, @@ -999,7 +995,6 @@ flags: shimFlags, shouldFail: true, expectedLocalError: "remote error: unexpected message", - skipSplitHandshake: true, }) } // Test that RPK client cert verification fails if we force it to fail. @@ -1017,10 +1012,9 @@ ExpectClientCertificateTypes: certTypesListRPKOnly, }, }, - flags: shimFlags, - shouldFail: true, - expectedError: ":CERTIFICATE_VERIFY_FAILED:", - skipSplitHandshake: true, + flags: shimFlags, + shouldFail: true, + expectedError: ":CERTIFICATE_VERIFY_FAILED:", }) } }
diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go index 4f0c8bb..384b4cc 100644 --- a/ssl/test/runner/runner.go +++ b/ssl/test/runner/runner.go
@@ -687,9 +687,6 @@ // should retry for early rejection. In a server test, this is whether the // test expects the shim to reject early data. expectEarlyDataRejected bool - // skipSplitHandshake, if true, will skip the generation of a split - // handshake copy of the test. - skipSplitHandshake bool // skipHints, if true, will skip the generation of a handshake hints copy of // the test. skipHints bool @@ -2069,7 +2066,7 @@ return ret } -func convertToSplitHandshakeTests(tests []testCase) (splitHandshakeTests []testCase, err error) { +func convertToHandshakeHintTests(tests []testCase) (handshakeHintTests []testCase, err error) { var stdout bytes.Buffer var flags []string if len(*shimExtraFlags) > 0 { @@ -2082,7 +2079,7 @@ return nil, err } - switch strings.TrimSpace(string(stdout.Bytes())) { + switch strings.TrimSpace(stdout.String()) { case "No": return case "Yes": @@ -2096,32 +2093,6 @@ allowHintMismatchPattern = strings.Split(*allowHintMismatch, ";") } -NextTest: - for _, test := range tests { - if test.protocol != tls || - test.testType != serverTest || - len(test.shimCredentials) != 0 || - len(test.resumeShimCredentials) != 0 || - strings.Contains(test.name, "ECH-Server") || - test.skipSplitHandshake { - continue - } - - for _, flag := range test.flags { - if flag == "-implicit-handshake" { - continue NextTest - } - } - - shTest := test - shTest.name += "-Split" - shTest.flags = make([]string, len(test.flags), len(test.flags)+3) - copy(shTest.flags, test.flags) - shTest.flags = append(shTest.flags, "-handoff", "-handshaker-path", *handshakerPath) - - splitHandshakeTests = append(splitHandshakeTests, shTest) - } - for _, test := range tests { if test.protocol == dtls || test.testType != serverTest || @@ -2137,19 +2108,19 @@ } } - shTest := test - shTest.name += "-Hints" - shTest.flags = make([]string, len(test.flags), len(test.flags)+3) - copy(shTest.flags, test.flags) - shTest.flags = append(shTest.flags, "-handshake-hints", "-handshaker-path", *handshakerPath) + hintTest := test + hintTest.name += "-Hints" + hintTest.flags = make([]string, len(test.flags), len(test.flags)+3) + copy(hintTest.flags, test.flags) + hintTest.flags = append(hintTest.flags, "-handshake-hints", "-handshaker-path", *handshakerPath) if matched { - shTest.flags = append(shTest.flags, "-allow-hint-mismatch") + hintTest.flags = append(hintTest.flags, "-allow-hint-mismatch") } - splitHandshakeTests = append(splitHandshakeTests, shTest) + handshakeHintTests = append(handshakeHintTests, hintTest) } - return splitHandshakeTests, nil + return handshakeHintTests, nil } func worker(dispatcher *shimDispatcher, statusChan chan statusMsg, c chan *testCase, shimPath string, wg *sync.WaitGroup) { @@ -2405,9 +2376,9 @@ addRawPublicKeyTests() addServerPaddingTests() - toAppend, err := convertToSplitHandshakeTests(testCases) + toAppend, err := convertToHandshakeHintTests(testCases) if err != nil { - fmt.Fprintf(os.Stderr, "Error making split handshake tests: %s", err) + fmt.Fprintf(os.Stderr, "Error making handshake hint tests: %s", err) os.Exit(1) } testCases = append(testCases, toAppend...)