| 207 | BOOST_FIXTURE_TEST_SUITE(BOOST_TEST_MODULE, SecurityFromBufferFixture) |
| 208 | |
| 209 | BOOST_AUTO_TEST_CASE(ssl_security_matrix) { |
| 210 | try { |
| 211 | // matrix of connection success between client and server with different SSLProtocol selections |
| 212 | static_assert(apache::thrift::transport::LATEST == 5, "Mismatch in assumed number of ssl protocols"); |
| 213 | bool matrix[apache::thrift::transport::LATEST + 1][apache::thrift::transport::LATEST + 1] = |
| 214 | { |
| 215 | // server = SSLTLS SSLv2 SSLv3 TLSv1_0 TLSv1_1 TLSv1_2 |
| 216 | // client |
| 217 | /* SSLTLS */ { true, false, false, true, true, true }, |
| 218 | /* SSLv2 */ { false, false, false, false, false, false }, |
| 219 | /* SSLv3 */ { false, false, true, false, false, false }, |
| 220 | /* TLSv1_0 */ { true, false, false, true, false, false }, |
| 221 | /* TLSv1_1 */ { true, false, false, false, true, false }, |
| 222 | /* TLSv1_2 */ { true, false, false, false, false, true } |
| 223 | }; |
| 224 | |
| 225 | for (size_t si = 0; si <= apache::thrift::transport::LATEST; ++si) { |
| 226 | for (size_t ci = 0; ci <= apache::thrift::transport::LATEST; ++ci) { |
| 227 | if (si == 1 || ci == 1) { |
| 228 | // Skip all SSLv2 cases - protocol not supported |
| 229 | continue; |
| 230 | } |
| 231 | |
| 232 | #ifdef OPENSSL_NO_SSL3 |
| 233 | if (si == 2 || ci == 2) { |
| 234 | // Skip all SSLv3 cases - protocol not supported |
| 235 | continue; |
| 236 | } |
| 237 | #endif |
| 238 | |
| 239 | boost::mutex::scoped_lock lock(mMutex); |
| 240 | |
| 241 | BOOST_TEST_MESSAGE(boost::format("TEST: Server = %1%, Client = %2%") % protocol2str(si) |
| 242 | % protocol2str(ci)); |
| 243 | |
| 244 | mConnected = false; |
| 245 | // thread_group manages the thread lifetime - ignore the return value of create_thread |
| 246 | boost::thread_group threads; |
| 247 | (void)threads.create_thread(bind(&SecurityFromBufferFixture::server, this, |
| 248 | static_cast<apache::thrift::transport::SSLProtocol>(si))); |
| 249 | mCVar.wait(lock); // wait for listen() to succeed |
| 250 | lock.unlock(); |
| 251 | (void)threads.create_thread(bind(&SecurityFromBufferFixture::client, this, |
| 252 | static_cast<apache::thrift::transport::SSLProtocol>(ci))); |
| 253 | threads.join_all(); |
| 254 | |
| 255 | BOOST_CHECK_MESSAGE(mConnected == matrix[ci][si], |
| 256 | boost::format(" Server = %1%, Client = %2% expected mConnected == %3% but was %4%") |
| 257 | % protocol2str(si) % protocol2str(ci) % matrix[ci][si] % mConnected); |
| 258 | } |
| 259 | } |
| 260 | } catch (std::exception& ex) { |
| 261 | BOOST_FAIL(boost::format("%1%: %2%") % typeid(ex).name() % ex.what()); |
| 262 | } |
| 263 | } |
| 264 | |
| 265 | BOOST_AUTO_TEST_SUITE_END() |