| 227 | BOOST_FIXTURE_TEST_SUITE(BOOST_TEST_MODULE, SecurityFixture) |
| 228 | |
| 229 | BOOST_AUTO_TEST_CASE(ssl_security_matrix) |
| 230 | { |
| 231 | try |
| 232 | { |
| 233 | // matrix of connection success between client and server with different SSLProtocol selections |
| 234 | static_assert(apache::thrift::transport::LATEST == 5, "Mismatch in assumed number of ssl protocols"); |
| 235 | bool matrix[apache::thrift::transport::LATEST + 1][apache::thrift::transport::LATEST + 1] = |
| 236 | { |
| 237 | // server = SSLTLS SSLv2 SSLv3 TLSv1_0 TLSv1_1 TLSv1_2 |
| 238 | // client |
| 239 | /* SSLTLS */ { true, false, false, true, true, true }, |
| 240 | /* SSLv2 */ { false, false, false, false, false, false }, |
| 241 | /* SSLv3 */ { false, false, true, false, false, false }, |
| 242 | /* TLSv1_0 */ { true, false, false, true, false, false }, |
| 243 | /* TLSv1_1 */ { true, false, false, false, true, false }, |
| 244 | /* TLSv1_2 */ { true, false, false, false, false, true } |
| 245 | }; |
| 246 | |
| 247 | for (size_t si = 0; si <= apache::thrift::transport::LATEST; ++si) |
| 248 | { |
| 249 | for (size_t ci = 0; ci <= apache::thrift::transport::LATEST; ++ci) |
| 250 | { |
| 251 | if (si == 1 || ci == 1) |
| 252 | { |
| 253 | // Skip all SSLv2 cases - protocol not supported |
| 254 | continue; |
| 255 | } |
| 256 | |
| 257 | #ifdef OPENSSL_NO_SSL3 |
| 258 | if (si == 2 || ci == 2) |
| 259 | { |
| 260 | // Skip all SSLv3 cases - protocol not supported |
| 261 | continue; |
| 262 | } |
| 263 | #endif |
| 264 | |
| 265 | boost::mutex::scoped_lock lock(mMutex); |
| 266 | |
| 267 | BOOST_TEST_MESSAGE(boost::format("TEST: Server = %1%, Client = %2%") |
| 268 | % protocol2str(si) % protocol2str(ci)); |
| 269 | |
| 270 | mConnected = false; |
| 271 | // thread_group manages the thread lifetime - ignore the return value of create_thread |
| 272 | boost::thread_group threads; |
| 273 | (void)threads.create_thread(bind(&SecurityFixture::server, this, static_cast<apache::thrift::transport::SSLProtocol>(si))); |
| 274 | mCVar.wait(lock); // wait for listen() to succeed |
| 275 | lock.unlock(); |
| 276 | (void)threads.create_thread(bind(&SecurityFixture::client, this, static_cast<apache::thrift::transport::SSLProtocol>(ci))); |
| 277 | threads.join_all(); |
| 278 | |
| 279 | BOOST_CHECK_MESSAGE(mConnected == matrix[ci][si], |
| 280 | boost::format(" Server = %1%, Client = %2% expected mConnected == %3% but was %4%") |
| 281 | % protocol2str(si) % protocol2str(ci) % matrix[ci][si] % mConnected); |
| 282 | } |
| 283 | } |
| 284 | } |
| 285 | catch (std::exception& ex) |
| 286 | { |