ssl: Simplify and refactor tests

Tests in ECC_SUITE did not always use the certs implied by the
name. Variable naming also confused the intent.

ssl_certificate_verify_SUITE did not clean up properly and tests could
fail due to cache problems.

1 files changed, 35 insertions, 25 deletions

diff --git a/lib/ssl/test/ssl_ECC_SUITE.erl b/lib/ssl/test/ssl_ECC_SUITE.erl
index b8a03f578d..69ac9908fa 100644
--- a/lib/ssl/test/ssl_ECC_SUITE.erl
+++ b/lib/ssl/test/ssl_ECC_SUITE.erl
@@ -159,42 +159,42 @@ end_per_testcase(_TestCase, Config) ->
 
 client_ecdh_server_ecdh(Config) when is_list(Config) ->
     COpts =  proplists:get_value(client_ecdh_rsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdh_rsa_verify_opts, Config),
+    SOpts = proplists:get_value(server_ecdh_rsa_opts, Config),
     basic_test(COpts, SOpts, Config).
     
 client_ecdh_server_rsa(Config)  when is_list(Config) ->
     COpts =  proplists:get_value(client_ecdh_rsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdh_rsa_verify_opts, Config),
+    SOpts = proplists:get_value(server_opts, Config),
     basic_test(COpts, SOpts, Config).
   
 client_rsa_server_ecdh(Config)  when is_list(Config) ->
-    COpts =  proplists:get_value(client_ecdh_rsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdh_rsa_verify_opts, Config),
+    COpts =  proplists:get_value(client_opts, Config),
+    SOpts = proplists:get_value(server_ecdh_rsa_opts, Config),
     basic_test(COpts, SOpts, Config).
    
 client_rsa_server_rsa(Config)  when is_list(Config) ->
-    COpts =  proplists:get_value(client_verification_opts, Config),
-    SOpts = proplists:get_value(server_verification_opts, Config),
+    COpts =  proplists:get_value(client_opts, Config),
+    SOpts = proplists:get_value(server_opts, Config),
     basic_test(COpts, SOpts, Config).
    
 client_ecdsa_server_ecdsa(Config)  when is_list(Config) ->
     COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_verify_opts, Config),
+    SOpts = proplists:get_value(server_ecdsa_opts, Config),
     basic_test(COpts, SOpts, Config).
 
 client_ecdsa_server_rsa(Config)  when is_list(Config) ->
     COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_verify_opts, Config),
+    SOpts = proplists:get_value(server_opts, Config),
     basic_test(COpts, SOpts, Config).
 
 client_rsa_server_ecdsa(Config)  when is_list(Config) ->
-    COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_verify_opts, Config),
+    COpts =  proplists:get_value(client_opts, Config),
+    SOpts = proplists:get_value(server_ecdsa_opts, Config),
     basic_test(COpts, SOpts, Config).
 
 client_ecdsa_server_ecdsa_with_raw_key(Config)  when is_list(Config) ->
     COpts =  proplists:get_value(client_ecdsa_opts, Config),
-    SOpts = proplists:get_value(server_ecdsa_verify_opts, Config),
+    SOpts = proplists:get_value(server_ecdsa_opts, Config),
     ServerCert = proplists:get_value(certfile, SOpts),
     ServerKeyFile = proplists:get_value(keyfile, SOpts),
     {ok, PemBin} = file:read_file(ServerKeyFile),
@@ -244,20 +244,20 @@ basic_test(ClientCert, ClientKey, ClientCA, ServerCert, ServerKey, ServerCA, Con
     check_result(Server, SType, Client, CType),
     close(Server, Client).    
 
-start_client(openssl, Port, CA, OwnCa, Cert, Key, Config) ->
-    PrivDir = proplists:get_value(priv_dir, Config),
-    NewCA = new_ca(filename:join(PrivDir, "new_ca.pem"), CA, OwnCa),
+start_client(openssl, Port, PeerCA, OwnCa, Cert, Key, _Config) ->
+    CA = new_openssl_ca("openssl_client_ca", PeerCA, OwnCa),
     Version = tls_record:protocol_version(tls_record:highest_protocol_version([])),
     Exe = "openssl",
     Args = ["s_client", "-verify", "2", "-port", integer_to_list(Port),
 	    ssl_test_lib:version_flag(Version),
-	    "-cert", Cert, "-CAfile", NewCA,
+	    "-cert", Cert, "-CAfile", CA,
 	    "-key", Key, "-host","localhost", "-msg", "-debug"],
 
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args), 
     true = port_command(OpenSslPort, "Hello world"),
     OpenSslPort;
-start_client(erlang, Port, CA, _, Cert, Key, Config) ->
+start_client(erlang, Port, PeerCA, OwnCa, Cert, Key, Config) ->
+    CA = new_ca("erlang_client_ca", PeerCA, OwnCa),
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
     ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 			       {host, Hostname},
@@ -267,20 +267,19 @@ start_client(erlang, Port, CA, _, Cert, Key, Config) ->
 					  {cacertfile, CA},
 					  {certfile, Cert}, {keyfile, Key}]}]).
 
-start_server(openssl, CA, OwnCa, Cert, Key, Config) ->
-    PrivDir = proplists:get_value(priv_dir, Config),
-    NewCA = new_ca(filename:join(PrivDir, "new_ca.pem"), CA, OwnCa),
-
+start_server(openssl, PeerCA, OwnCa, Cert, Key, _Config) ->
+    CA = new_openssl_ca("openssl_server_ca", PeerCA, OwnCa),
     Port = ssl_test_lib:inet_port(node()),
     Version = tls_record:protocol_version(tls_record:highest_protocol_version([])),
     Exe = "openssl",
     Args = ["s_server", "-accept", integer_to_list(Port), ssl_test_lib:version_flag(Version),
-	    "-verify", "2", "-cert", Cert, "-CAfile", NewCA,
+	    "-verify", "2", "-cert", Cert, "-CAfile", CA,
 	    "-key", Key, "-msg", "-debug"],
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args),
     true = port_command(OpenSslPort, "Hello world"),
     {OpenSslPort, Port};
-start_server(erlang, CA, _, Cert, Key, Config) ->
+start_server(erlang, PeerCA, OwnCa, Cert, Key, Config) ->
+    CA = new_ca("erlang_server_ca", PeerCA, OwnCa),
     {_, ServerNode, _} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 			       {from, self()},
@@ -291,7 +290,8 @@ start_server(erlang, CA, _, Cert, Key, Config) ->
 				[{verify, verify_peer}, {cacertfile, CA},
 				 {certfile, Cert}, {keyfile, Key}]}]),
     {Server, ssl_test_lib:inet_port(Server)}.
-start_server_with_raw_key(erlang, CA, _, Cert, Key, Config) ->
+start_server_with_raw_key(erlang, PeerCA, OwnCa, Cert, Key, Config) ->
+     CA = new_ca("erlang_server_ca", PeerCA, OwnCa),
     {_, ServerNode, _} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
 			       {from, self()},
@@ -336,17 +336,27 @@ close(Client, Server)  ->
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
 
-%% Work around OpenSSL bug, apparently the same bug as we had fixed in
-%% 11629690ba61f8e0c93ef9b2b6102fd279825977
 new_ca(FileName, CA, OwnCa) ->
     {ok, P1} = file:read_file(CA),
     E1 = public_key:pem_decode(P1),
     {ok, P2} = file:read_file(OwnCa),
     E2 = public_key:pem_decode(P2),
+    Pem = public_key:pem_encode(E1 ++E2),
+    file:write_file(FileName,  Pem),
+    FileName.
+
+new_openssl_ca(FileName, CA, OwnCa) ->
+    {ok, P1} = file:read_file(CA),
+    E1 = public_key:pem_decode(P1),
+    {ok, P2} = file:read_file(OwnCa),
+    E2 = public_key:pem_decode(P2),
     case os:cmd("openssl version") of 
 	"OpenSSL 1.0.1p-freebsd" ++ _ ->
 	    Pem = public_key:pem_encode(E1 ++E2),
 	    file:write_file(FileName,  Pem);
+	"LibreSSL" ++ _ ->
+	    Pem = public_key:pem_encode(E1 ++E2),
+	    file:write_file(FileName,  Pem);
 	_ ->
 	    Pem = public_key:pem_encode(E2 ++E1),
 	    file:write_file(FileName,  Pem)