diff options
| author | Roland Shoemaker <bracewell@google.com> | 2023-08-21 09:45:18 -0700 |
|---|---|---|
| committer | Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> | 2024-02-28 18:04:35 +0000 |
| commit | df3b58ea74c50ff785ab902be3b007ff008d3e3c (patch) | |
| tree | e87b42c56fbc1fcd290454b333d4f6230fd8d483 /util | |
| parent | a9a3ca49444bb1efac115e64d3ab469c54bec984 (diff) | |
| download | boringssl-df3b58ea74c50ff785ab902be3b007ff008d3e3c.zip boringssl-df3b58ea74c50ff785ab902be3b007ff008d3e3c.tar.gz boringssl-df3b58ea74c50ff785ab902be3b007ff008d3e3c.tar.bz2 | |
Generate certs on the fly in runner, pass trusted cert to shim
Rather than using the pre-generated certificates, generate them on the
fly. This allows TLS stacks for which certificate validation and
verification are coupled to work as expected. Certificates and keys are
written to temporary files which are then passed to the shim, and
cleaned up on exit. This requires reworking how testCase passes
certs/keys by adding a new field, sendCertificate, rather than manually
setting the -cert-file and -key-file flags. Incidentally the
rsaChainCertificate is removed, since it was essentially unused, and all
tests that used it also work with rsaCertificate. Finally, include a
single SAN ("test") in all certificates, which fixes some TLS stacks
which require this to operate (such as rustls, which currently
regenerates all the certificates currently in the tree to add a SAN).
Additionally, add a new flag, -trust-cert, which tells the the shim
which certificates it should trust. Shims for TLS stacks which
can completely decouple validation and verification of X509 certificates
(like BoringSSL) can ignore this flag, but for stacks where this
functionality is somewhat more intertwined (like Go), this allows the
shim to properly process the sent certificates.
Change-Id: Ic5c63e18fb2b852cc693aacb3b06cfe7993bc90c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/62565
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Diffstat (limited to 'util')
| -rw-r--r-- | util/run_android_tests.go | 11 |
1 files changed, 1 insertions, 10 deletions
diff --git a/util/run_android_tests.go b/util/run_android_tests.go index 6c793d2..acc5c6b 100644 --- a/util/run_android_tests.go +++ b/util/run_android_tests.go @@ -354,23 +354,14 @@ func main() { binaries = append(binaries, "ssl/test/bssl_shim") files = append(files, "BUILDING.md", - "ssl/test/runner/cert.pem", "ssl/test/runner/channel_id_key.pem", - "ssl/test/runner/ecdsa_p224_cert.pem", "ssl/test/runner/ecdsa_p224_key.pem", - "ssl/test/runner/ecdsa_p256_cert.pem", "ssl/test/runner/ecdsa_p256_key.pem", - "ssl/test/runner/ecdsa_p384_cert.pem", "ssl/test/runner/ecdsa_p384_key.pem", - "ssl/test/runner/ecdsa_p521_cert.pem", "ssl/test/runner/ecdsa_p521_key.pem", - "ssl/test/runner/ed25519_cert.pem", "ssl/test/runner/ed25519_key.pem", - "ssl/test/runner/key.pem", - "ssl/test/runner/rsa_1024_cert.pem", + "ssl/test/runner/rsa_2048_key.pem", "ssl/test/runner/rsa_1024_key.pem", - "ssl/test/runner/rsa_chain_cert.pem", - "ssl/test/runner/rsa_chain_key.pem", "util/all_tests.json", ) |