ssl: Run all test case combinations

Fix test case code to use keyAgreement for ECDH_ECDSA

4 files changed, 153 insertions, 59 deletions

diff --git a/lib/ssl/test/ssl_ECC.erl b/lib/ssl/test/ssl_ECC.erl
index 489a72e50e..2096cf8166 100644
--- a/lib/ssl/test/ssl_ECC.erl
+++ b/lib/ssl/test/ssl_ECC.erl
@@ -89,7 +89,7 @@ client_ecdhe_ecdsa_server_ecdhe_rsa(Config)  when is_list(Config) ->
 
 %% ECDH_ECDSA
 client_ecdh_ecdsa_server_ecdh_ecdsa(Config)  when is_list(Config) ->
-    Ext = x509_test:extensions([{key_usage, [keyEncipherment]}]),
+    Ext = x509_test:extensions([{key_usage, [keyAgreement]}]),
     {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, 
                                                         [[], [], [{extensions, Ext}]]},
                                                        {client_chain,
@@ -99,7 +99,7 @@ client_ecdh_ecdsa_server_ecdh_ecdsa(Config)  when is_list(Config) ->
                ssl_test_lib:ssl_options(SOpts, Config),
                [{check_keyex, ecdh_ecdsa} | proplists:delete(check_keyex, Config)]).
 client_ecdhe_rsa_server_ecdh_ecdsa(Config)  when is_list(Config) ->
-     Ext = x509_test:extensions([{key_usage, [keyEncipherment]}]),
+     Ext = x509_test:extensions([{key_usage, [keyAgreement]}]),
      {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, 
                                                          [[], [], [{extensions, Ext}]]},
                                                         {client_chain,
@@ -110,7 +110,7 @@ client_ecdhe_rsa_server_ecdh_ecdsa(Config)  when is_list(Config) ->
                [{check_keyex, ecdh_ecdsa} | proplists:delete(check_keyex, Config)]).
 
 client_ecdhe_ecdsa_server_ecdh_ecdsa(Config)  when is_list(Config) ->
-    Ext = x509_test:extensions([{key_usage, [keyEncipherment]}]),
+    Ext = x509_test:extensions([{key_usage, [keyAgreement]}]),
     {COpts, SOpts} = ssl_test_lib:make_ec_cert_chains([{server_chain, 
                                                         [[], [], [{extensions, Ext}]]},
                                                        {client_chain,
diff --git a/lib/ssl/test/ssl_ECC_openssl_SUITE.erl b/lib/ssl/test/ssl_ECC_openssl_SUITE.erl
index ba609aa0dc..280fa94ecb 100644
--- a/lib/ssl/test/ssl_ECC_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_ECC_openssl_SUITE.erl
@@ -33,39 +33,57 @@
 %%--------------------------------------------------------------------
 
 all() ->
-    [
-     {group, 'tlsv1.2'},
-     {group, 'tlsv1.1'},
-     {group, 'tlsv1'},
-     {group, 'dtlsv1.2'},
-     {group, 'dtlsv1'}
-    ].
+    case test_cases() of
+        [_|_] ->
+            all_groups();
+        [] ->
+            [skip]
+    end.
+
+all_groups() ->
+    case ssl_test_lib:openssl_sane_dtls() of 
+        true ->
+            [{group, 'tlsv1.2'},
+             {group, 'tlsv1.1'},
+             {group, 'tlsv1'},
+             {group, 'dtlsv1.2'},
+             {group, 'dtlsv1'}];
+        false ->
+            [{group, 'tlsv1.2'},
+             {group, 'tlsv1.1'},
+             {group, 'tlsv1'}]
+    end.
 
 groups() ->
-    [
-     {'tlsv1.2', [], test_cases()},
-     {'tlsv1.1', [], test_cases()},
-     {'tlsv1', [], test_cases()},
-     {'dtlsv1.2', [], test_cases()},
-     {'dtlsv1', [], test_cases()}     
-    ].
+    case ssl_test_lib:openssl_sane_dtls() of 
+        true ->
+            [{'tlsv1.2', [], test_cases()},
+             {'tlsv1.1', [], test_cases()},
+             {'tlsv1', [], test_cases()},
+             {'dtlsv1.2', [], test_cases()},
+             {'dtlsv1', [], test_cases()}];
+        false ->
+            [{'tlsv1.2', [], test_cases()},
+             {'tlsv1.1', [], test_cases()},
+             {'tlsv1', [], test_cases()}]
+    end.
 
 test_cases()->
-   %% cert_combinations().
-    server_ecdh_rsa(). 
+   cert_combinations().
+  
 cert_combinations() ->
-     lists:append(lists:filtermap(fun({Name, Suites}) -> 
-                             case ssl_test_lib:openssl_filter(Name) of
-                                [] ->
-                                     false;
-                                [_|_] ->
-                                     {true, Suites}
-                             end
-                    end, [{"ECDH-RSA", server_ecdh_rsa()},
-                           {"ECDHE-RSA", server_ecdhe_rsa()},
-                          {"ECDH-ECDSA", server_ecdh_ecdsa()},
-                          {"ECDHE-ECDSA", server_ecdhe_ecdsa()}
-                         ])).
+    lists:append(lists:map(fun({Name, Suites}) -> 
+                                   case ssl_test_lib:openssl_filter(Name) of
+                                       [] ->
+                                           [];
+                                       [_|_] ->
+                                           Suites
+                                   end
+                           end, [{"ECDH-ECDSA", server_ecdh_ecdsa()},
+                                 {"ECDH-RSA", server_ecdh_rsa()},
+                                 {"ECDHE-RSA", server_ecdhe_rsa()},
+                                 {"ECDHE-ECDSA", server_ecdhe_ecdsa()}
+                                ])).
 server_ecdh_rsa() ->
     [client_ecdh_rsa_server_ecdh_rsa,
      client_ecdhe_rsa_server_ecdh_rsa,     
@@ -91,11 +109,11 @@ init_per_suite(Config0) ->
     end_per_suite(Config0),
     try crypto:start() of
 	ok ->
-            case ssl_test_lib:sufficient_crypto_support(cipher_ec) of
+            case  ssl_test_lib:sufficient_crypto_support(cipher_ec) of
                 true ->
                     Config0;
                 false ->
-                    {skip, "Crypto does not support ECC"}
+                    {skip, "Openssl does not support ECC"}
             end
     catch _:_ ->
             {skip, "Crypto did not start"}
@@ -131,7 +149,8 @@ end_per_group(GroupName, Config0) ->
   end.
 
 %%--------------------------------------------------------------------
-
+init_per_testcase(skip, Config) ->
+    Config;
 init_per_testcase(TestCase, Config) ->
     ssl_test_lib:ct_log_supported_protocol_versions(Config),
     Version = proplists:get_value(tls_version, Config),
@@ -149,6 +168,9 @@ end_per_testcase(_TestCase, Config) ->
 %% Test Cases --------------------------------------------------------
 %%--------------------------------------------------------------------
 
+skip(Config) when is_list(Config) ->
+    {skip, openssl_does_not_support_ECC}.
+
 %% Test diffrent certificate chain types, note that it is the servers
 %% chain that affect what cipher suit that will be choosen
 
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index 3a7e844cf8..a45249b75e 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -1567,12 +1567,60 @@ openssl_dsa_support() ->
             true
     end.
 
+%% Acctual support is tested elsewhere, this is to exclude some LibreSSL and OpenSSL versions
+openssl_sane_dtls() -> 
+    case os:cmd("openssl version") of
+        "OpenSSL 0." ++ _ ->
+            false;
+        "OpenSSL 1.0.1s-freebsd" ++ _ ->
+            false;
+        "OpenSSL 1.0.2k-freebsd" ++ _ ->
+            false;
+        "OpenSSL 1.0.2d" ++ _ ->
+            false;
+        "OpenSSL 1.0.2n" ++ _ ->
+            false;
+        "OpenSSL 1.0.0" ++ _ ->
+            false;
+        "OpenSSL" ++ _ ->
+            true;
+        "LibreSSL 2.7" ++ _ ->
+            true;
+        _ ->
+            false
+        end.
+openssl_sane_client_cert() -> 
+    case os:cmd("openssl version") of
+        "LibreSSL 2.5.2" ++ _ ->
+            true;
+        "LibreSSL 2.4" ++ _ ->
+            false;
+        "LibreSSL 2.3" ++ _ ->
+            false; 
+         "LibreSSL 2.1" ++ _ ->
+            false; 
+         "LibreSSL 2.0" ++ _ ->
+            false; 
+         "LibreSSL 2.0" ++ _ ->
+            false; 
+        "OpenSSL 1.0.1s-freebsd" ->
+            false;
+        "OpenSSL 1.0.0" ++ _ ->
+            false; 
+        _ ->
+            true
+    end.
+
 check_sane_openssl_version(Version) ->
     case supports_ssl_tls_version(Version) of 
 	true ->
 	    case {Version, os:cmd("openssl version")} of
                 {'sslv3', "OpenSSL 1.0.2" ++ _} ->
                     false;
+                {'dtlsv1', _} ->
+		    not is_fips(openssl);
+		{'dtlsv1.2', _} ->
+		    not is_fips(openssl);
 		{_, "OpenSSL 1.0.2" ++ _} ->
 		    true;
 		{_, "OpenSSL 1.0.1" ++ _} ->
@@ -1581,7 +1629,7 @@ check_sane_openssl_version(Version) ->
 		    false;
 		{'tlsv1.1', "OpenSSL 1.0.0" ++ _} ->
 		    false;
-                {'dtlsv1.2', "OpenSSL 1.0.0" ++ _} ->
+                {'dtlsv1.2', "OpenSSL 1.0.2" ++ _} ->
 		    false;
 		{'dtlsv1',  "OpenSSL 1.0.0" ++ _} ->
 		    false;
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index 5ae4309b99..a2e8ef8be0 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -37,26 +37,43 @@
 %%--------------------------------------------------------------------
 
 all() -> 
-    [
-     {group, basic},
-     {group, 'tlsv1.2'},
-     {group, 'tlsv1.1'},
-     {group, 'tlsv1'},
-     {group, 'sslv3'},
-     {group, 'dtlsv1.2'},
-     {group, 'dtlsv1'}
-    ].
+    case ssl_test_lib:openssl_sane_dtls() of 
+        true ->
+            [{group, basic},
+             {group, 'tlsv1.2'},
+             {group, 'tlsv1.1'},
+             {group, 'tlsv1'},
+             {group, 'sslv3'},
+             {group, 'dtlsv1.2'},
+             {group, 'dtlsv1'}];
+        false ->
+            [{group, basic},
+             {group, 'tlsv1.2'},
+             {group, 'tlsv1.1'},
+             {group, 'tlsv1'},
+             {group, 'sslv3'}]
+    end.
 
 groups() ->
-    [{basic, [], basic_tests()},
-     {'tlsv1.2', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
-     {'tlsv1.1', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
-      {'tlsv1', [], all_versions_tests()++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
-      {'sslv3', [], all_versions_tests()},
-      {'dtlsv1.2', [], dtls_all_versions_tests()},
-      {'dtlsv1', [], dtls_all_versions_tests()}
-     ].
-
+     case ssl_test_lib:openssl_sane_dtls() of 
+         true ->
+             [{basic, [], basic_tests()},
+              {'tlsv1.2', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+              {'tlsv1.1', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+              {'tlsv1', [], all_versions_tests()++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+              {'sslv3', [], all_versions_tests()},
+              {'dtlsv1.2', [], dtls_all_versions_tests()},
+              {'dtlsv1', [], dtls_all_versions_tests()}
+             ];
+        false ->
+             [{basic, [], basic_tests()},
+              {'tlsv1.2', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+              {'tlsv1.1', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+              {'tlsv1', [], all_versions_tests()++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+              {'sslv3', [], all_versions_tests()}
+           ]
+     end.
+  
 basic_tests() ->
     [basic_erlang_client_openssl_server,
      basic_erlang_server_openssl_client,
@@ -85,9 +102,20 @@ all_versions_tests() ->
      expired_session,
      ssl2_erlang_server_openssl_client
     ].
+
 dtls_all_versions_tests() ->
-    [
-     erlang_client_openssl_server,
+   case ssl_test_lib:openssl_sane_client_cert() of
+       true ->
+           [erlang_server_openssl_client_client_cert,
+            erlang_client_openssl_server_no_server_ca_cert,
+            erlang_client_openssl_server_client_cert
+            | dtls_all_versions_tests_2()];
+       false ->
+          dtls_all_versions_tests_2()
+   end. 
+  
+dtls_all_versions_tests_2() ->
+    [erlang_client_openssl_server,
      erlang_server_openssl_client,
      erlang_client_openssl_server_dsa_cert,
      erlang_server_openssl_client_dsa_cert,
@@ -98,12 +126,8 @@ dtls_all_versions_tests() ->
      erlang_client_openssl_server_renegotiate,
      erlang_client_openssl_server_nowrap_seqnum,
      erlang_server_openssl_client_nowrap_seqnum,
-     erlang_client_openssl_server_no_server_ca_cert,
-     erlang_client_openssl_server_client_cert,
-     erlang_server_openssl_client_client_cert,
      ciphers_rsa_signed_certs,
      ciphers_dsa_signed_certs
-     %%erlang_client_bad_openssl_server,
      %%expired_session
     ].