min
/
boring2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Clean up ECH tests

This commit is contained in:
Rushil Mehra 2025-02-12 10:11:06 -08:00 committed by Kornel
parent 5af82912df
commit 24003a04e8
1 changed files with 14 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
boring/src/ssl/test/ech.rs
View File

@ -1,6 +1,6 @@
use crate::hpke::HpkeKey; use crate::hpke::HpkeKey;
use crate::ssl::ech::SslEchKeys; use crate::ssl::ech::SslEchKeys;
use crate::ssl::test::Server; use crate::ssl::test::server::{ClientSslBuilder, Server};
use crate::ssl::HandshakeError; use crate::ssl::HandshakeError;
// For future reference, these configs are generated by building the bssl tool (the binary is built // For future reference, these configs are generated by building the bssl tool (the binary is built
@ -15,12 +15,11 @@ static ECH_KEY: &[u8] = include_bytes!("../../../test/echkey");
static ECH_CONFIG_2: &[u8] = include_bytes!("../../../test/echconfig-2"); static ECH_CONFIG_2: &[u8] = include_bytes!("../../../test/echconfig-2");
static ECH_KEY_2: &[u8] = include_bytes!("../../../test/echkey-2"); static ECH_KEY_2: &[u8] = include_bytes!("../../../test/echkey-2");
#[test] fn bootstrap_ech(config: &[u8], key: &[u8], list: &[u8]) -> (Server, ClientSslBuilder) {
fn ech() {
let server = { let server = {
let key = HpkeKey::dhkem_p256_sha256(ECH_KEY).unwrap(); let key = HpkeKey::dhkem_p256_sha256(key).unwrap();
let mut ech_keys = SslEchKeys::new().unwrap(); let mut ech_keys = SslEchKeys::new().unwrap();
ech_keys.add_key(true, ECH_CONFIG, key).unwrap(); ech_keys.add_key(true, config, key).unwrap();
let mut builder = Server::builder(); let mut builder = Server::builder();
builder.ctx().set_ech_keys(ech_keys).unwrap(); builder.ctx().set_ech_keys(ech_keys).unwrap();
@ -29,35 +28,29 @@ fn ech() {
}; };
let mut client = server.client_with_root_ca().build().builder(); let mut client = server.client_with_root_ca().build().builder();
client.ssl().set_ech_config_list(ECH_CONFIG_LIST).unwrap(); client.ssl().set_ech_config_list(list).unwrap();
client.ssl().set_hostname("foobar.com").unwrap(); client.ssl().set_hostname("foobar.com").unwrap();
(server, client)
}
#[test]
fn ech() {
let (_server, client) = bootstrap_ech(ECH_CONFIG, ECH_KEY, ECH_CONFIG_LIST);
let ssl_stream = client.connect(); let ssl_stream = client.connect();
assert!(ssl_stream.ssl().ech_accepted()) assert!(ssl_stream.ssl().ech_accepted())
} }
#[test] #[test]
fn ech_rejection() { fn ech_rejection() {
let server = {
let key = HpkeKey::dhkem_p256_sha256(ECH_KEY_2).unwrap();
let mut ech_keys = SslEchKeys::new().unwrap();
ech_keys.add_key(true, ECH_CONFIG_2, key).unwrap();
let mut builder = Server::builder();
builder.ctx().set_ech_keys(ech_keys).unwrap();
builder.build()
};
let mut client = server.client_with_root_ca().build().builder();
// Server is initialized using `ECH_CONFIG_2`, so using `ECH_CONFIG_LIST` instead of // Server is initialized using `ECH_CONFIG_2`, so using `ECH_CONFIG_LIST` instead of
// `ECH_CONFIG_LIST_2` should trigger rejection. // `ECH_CONFIG_LIST_2` should trigger rejection.
client.ssl().set_ech_config_list(ECH_CONFIG_LIST).unwrap(); let (_server, client) = bootstrap_ech(ECH_CONFIG_2, ECH_KEY_2, ECH_CONFIG_LIST);
client.ssl().set_hostname("foobar.com").unwrap();
let HandshakeError::Failure(failed_ssl_stream) = client.connect_err() else { let HandshakeError::Failure(failed_ssl_stream) = client.connect_err() else {
panic!("wrong HandshakeError failure variant!"); panic!("wrong HandshakeError failure variant!");
}; };
assert_eq!( assert_eq!(
failed_ssl_stream.ssl().get_ech_name_override(), failed_ssl_stream.ssl().get_ech_name_override(),
Some(b"ech.com".to_vec().as_ref()) Some(b"ech.com".to_vec().as_ref())