Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 11 additions & 19 deletions bindings/rust/extended/s2n-tls/src/testing.rs
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ use crate::{
error, security,
};
use alloc::{collections::VecDeque, sync::Arc};
use crate::error::Error as S2NError;

use core::{
sync::atomic::{AtomicUsize, Ordering},
Expand All @@ -26,14 +27,11 @@ pub mod client_hello;
pub mod resumption;
pub mod s2n_tls;

type Error = Box<dyn std::error::Error>;
type Result<T, E = Error> = core::result::Result<T, E>;

pub fn test_error(msg: &str) -> crate::error::Error {
pub fn test_error(msg: &str) -> S2NError {
crate::error::Error::application(msg.into())
}

pub fn assert_test_error(input: crate::error::Error, expected_message: &str) {
pub fn assert_test_error(input: S2NError, expected_message: &str) {
let error_msg = input
.application_error()
.expect("unexpected error type")
Expand Down Expand Up @@ -181,26 +179,20 @@ impl VerifyHostNameCallback for RejectAllCertificatesHandler {
}
}

pub fn build_config(cipher_prefs: &security::Policy) -> Result<crate::config::Config, Error> {
pub fn build_config(cipher_prefs: &security::Policy) -> Result<crate::config::Config, S2NError> {
let builder = config_builder(cipher_prefs)?;
Ok(builder.build().expect("Unable to build server config"))
Ok(builder.build()?)
}

pub fn config_builder(cipher_prefs: &security::Policy) -> Result<crate::config::Builder, Error> {
pub fn config_builder(cipher_prefs: &security::Policy) -> Result<crate::config::Builder, S2NError> {
let mut builder = Builder::new();
let keypair = CertKeyPair::default();
// Build a config
builder
.set_security_policy(cipher_prefs)
.expect("Unable to set config cipher preferences");
builder
.load_pem(keypair.cert(), keypair.key())
.expect("Unable to load cert/pem");
builder
.set_verify_host_callback(InsecureAcceptAllCertificatesHandler {})
.expect("Unable to set a host verify callback.");
builder.with_system_certs(false).unwrap();
builder.trust_pem(keypair.cert()).expect("load cert pem");
.set_security_policy(cipher_prefs)?
.set_verify_host_callback(InsecureAcceptAllCertificatesHandler {})?
.load_pem(keypair.cert(), keypair.key())?
.with_system_certs(false)?
.trust_pem(keypair.cert())?;
Ok(builder)
}

Expand Down
52 changes: 26 additions & 26 deletions bindings/rust/extended/s2n-tls/src/testing/s2n_tls.rs
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ mod tests {
callbacks::{ClientHelloCallback, ConnectionFuture, ConnectionFutureResult},
enums::ClientAuthType,
error::ErrorType,
testing::{self, client_hello::*, Error, Result, *},
testing::{self, client_hello::*, *},
};
use alloc::sync::Arc;
use core::sync::atomic::Ordering;
Expand All @@ -28,7 +28,7 @@ mod tests {
}

#[test]
fn kem_group_name_retrieval() -> Result<(), Error> {
fn kem_group_name_retrieval() -> Result<(), S2NError> {
// PQ isn't supported
{
let policy = Policy::from_version("20240501")?;
Expand Down Expand Up @@ -60,7 +60,7 @@ mod tests {
}

#[test]
fn default_config_and_clone_interaction() -> Result<(), Error> {
fn default_config_and_clone_interaction() -> Result<(), S2NError> {
let config = build_config(&security::DEFAULT_TLS13)?;
assert_eq!(config.test_get_refcount()?, 1);
{
Expand Down Expand Up @@ -99,7 +99,7 @@ mod tests {
}

#[test]
fn set_config_multiple_times() -> Result<(), Error> {
fn set_config_multiple_times() -> Result<(), S2NError> {
let config = build_config(&security::DEFAULT_TLS13)?;
assert_eq!(config.test_get_refcount()?, 1);

Expand Down Expand Up @@ -139,7 +139,7 @@ mod tests {
}

#[test]
fn failing_client_hello_callback_sync() -> Result<(), Error> {
fn failing_client_hello_callback_sync() -> Result<(), S2NError> {
let (waker, wake_count) = new_count_waker();
let config = {
let mut config = config_builder(&security::DEFAULT_TLS13)?;
Expand All @@ -164,7 +164,7 @@ mod tests {
}

#[test]
fn failing_client_hello_callback_async() -> Result<(), Error> {
fn failing_client_hello_callback_async() -> Result<(), S2NError> {
let (waker, wake_count) = new_count_waker();
let config = {
let mut config = config_builder(&security::DEFAULT_TLS13)?;
Expand All @@ -190,7 +190,7 @@ mod tests {
}

#[test]
fn client_hello_callback_async() -> Result<(), Error> {
fn client_hello_callback_async() -> Result<(), S2NError> {
let (waker, wake_count) = new_count_waker();
let require_pending_count = 10;
let handle = MockClientHelloHandler::new(require_pending_count);
Expand Down Expand Up @@ -218,7 +218,7 @@ mod tests {
}

#[test]
fn client_hello_callback_sync() -> Result<(), Error> {
fn client_hello_callback_sync() -> Result<(), S2NError> {
let (waker, wake_count) = new_count_waker();
#[derive(Clone)]
struct ClientHelloSyncCallback(Arc<AtomicUsize>);
Expand Down Expand Up @@ -270,7 +270,7 @@ mod tests {
}

#[test]
fn new_security_policy() -> Result<(), Error> {
fn new_security_policy() -> Result<(), S2NError> {
use crate::security::Policy;

let policy = Policy::from_version("default")?;
Expand All @@ -279,7 +279,7 @@ mod tests {
}

#[test]
fn trust_location() -> Result<(), Error> {
fn trust_location() -> Result<(), S2NError> {
let pem_dir = Path::new(concat!(env!("CARGO_MANIFEST_DIR"), "/../certs"));
let mut cert = pem_dir.to_path_buf();
cert.push("cert.pem");
Expand All @@ -289,7 +289,7 @@ mod tests {
let mut builder = crate::config::Builder::new();
builder.set_security_policy(&security::DEFAULT_TLS13)?;
builder.set_verify_host_callback(InsecureAcceptAllCertificatesHandler {})?;
builder.load_pem(&fs::read(&cert)?, &fs::read(&key)?)?;
builder.load_pem(&fs::read(&cert).unwrap(), &fs::read(&key).unwrap())?;
builder.trust_location(Some(&cert), None)?;

TestPair::handshake_with_config(&builder.build()?)?;
Expand All @@ -301,7 +301,7 @@ mod tests {
/// this test verifies that `trust_location()` does not turn on OCSP. It also verifies that turning
/// on OCSP explicitly still works when `trust_location()` is called.
#[test]
fn trust_location_does_not_change_ocsp_status() -> Result<(), Error> {
fn trust_location_does_not_change_ocsp_status() -> Result<(), S2NError> {
let pem_dir = Path::new(concat!(env!("CARGO_MANIFEST_DIR"), "/../certs"));
let mut cert = pem_dir.to_path_buf();
cert.push("cert.pem");
Expand All @@ -325,7 +325,7 @@ mod tests {
extension_iana: OCSP_IANA_EXTENSION_ID,
extension_expected: enable_ocsp,
})?;
config.load_pem(&fs::read(&cert)?, &fs::read(&key)?)?;
config.load_pem(&fs::read(&cert).unwrap(), &fs::read(&key).unwrap())?;
config.trust_location(Some(&cert), None)?;
config.build()?
};
Expand All @@ -338,7 +338,7 @@ mod tests {
}

#[test]
fn connection_level_verify_host_callback() -> Result<(), Error> {
fn connection_level_verify_host_callback() -> Result<(), S2NError> {
let reject_config = {
let keypair = CertKeyPair::default();
let mut config = crate::config::Builder::new();
Expand Down Expand Up @@ -368,7 +368,7 @@ mod tests {
}

#[test]
fn no_client_auth() -> Result<(), Error> {
fn no_client_auth() -> Result<(), S2NError> {
use crate::enums::ClientAuthType;

let config = {
Expand All @@ -394,7 +394,7 @@ mod tests {
}

#[test]
fn client_auth() -> Result<(), Error> {
fn client_auth() -> Result<(), S2NError> {
use crate::enums::ClientAuthType;

let config = {
Expand Down Expand Up @@ -422,7 +422,7 @@ mod tests {
}

#[test]
fn system_certs_loaded_by_default() -> Result<(), Error> {
fn system_certs_loaded_by_default() -> Result<(), S2NError> {
let keypair = CertKeyPair::default();

// Load the server certificate into the trust store by overriding the OpenSSL default
Expand All @@ -441,7 +441,7 @@ mod tests {
}

#[test]
fn disable_loading_system_certs() -> Result<(), Error> {
fn disable_loading_system_certs() -> Result<(), S2NError> {
let keypair = CertKeyPair::default();

// Load the server certificate into the trust store by overriding the OpenSSL default
Expand Down Expand Up @@ -477,7 +477,7 @@ mod tests {
}

#[test]
fn peer_chain() -> Result<(), Error> {
fn peer_chain() -> Result<(), S2NError> {
use crate::enums::ClientAuthType;

let config = {
Expand All @@ -503,7 +503,7 @@ mod tests {
}

#[test]
fn selected_cert() -> Result<(), Error> {
fn selected_cert() -> Result<(), S2NError> {
use crate::enums::ClientAuthType;

let config = {
Expand Down Expand Up @@ -553,7 +553,7 @@ mod tests {
}

#[test]
fn master_secret_success() -> Result<(), Error> {
fn master_secret_success() -> Result<(), S2NError> {
let policy = security::Policy::from_version("test_all_tls12")?;
let config = config_builder(&policy)?.build()?;
let mut pair = TestPair::from_config(&config);
Expand All @@ -567,7 +567,7 @@ mod tests {
}

#[test]
fn master_secret_failure() -> Result<(), Error> {
fn master_secret_failure() -> Result<(), S2NError> {
// TLS1.3 does not support getting the master secret
let mut pair = TestPair::from_config(&build_config(&security::DEFAULT_TLS13)?);
pair.handshake()?;
Expand Down Expand Up @@ -673,7 +673,7 @@ mod tests {
}

#[test]
fn no_application_protocol() -> Result<(), Error> {
fn no_application_protocol() -> Result<(), S2NError> {
let config = config_builder(&security::DEFAULT)?.build()?;
let mut pair = TestPair::from_config(&config);
pair.handshake()?;
Expand All @@ -682,7 +682,7 @@ mod tests {
}

#[test]
fn application_protocol() -> Result<(), Error> {
fn application_protocol() -> Result<(), S2NError> {
let config = config_builder(&security::DEFAULT)?.build()?;
let mut pair = TestPair::from_config(&config);
pair.server
Expand All @@ -695,7 +695,7 @@ mod tests {
}

#[test]
fn client_hello_sslv2_negative() -> Result<(), testing::Error> {
fn client_hello_sslv2_negative() -> Result<(), S2NError> {
let config = testing::build_config(&security::DEFAULT_TLS13)?;
let mut pair = TestPair::from_config(&config);
pair.handshake()?;
Expand All @@ -704,7 +704,7 @@ mod tests {
}

#[test]
fn client_hello_sslv2_positive() -> Result<(), testing::Error> {
fn client_hello_sslv2_positive() -> Result<(), Box<dyn std::error::Error>> {
// copy-pasted from s2n-tls/tests/testlib/s2n_sslv2_client_hello.h
// by concatenating these fields together, a valid SSLv2 formatted client hello
// can be assembled
Expand Down
Loading