Function runTlsTest

flow/TLSTest.cpp:112–243

};

void runTlsTest(int serverChainLen, int clientChainLen) {
	log("==== BEGIN TESTCASE ====");
	auto clientSsl = ssl::context(ssl::context::tls);
	auto serverSsl = ssl::context(ssl::context::tls);
	auto const expectHandshakeOk = clientChainLen >= 0 && serverChainLen > 0;
	auto const expectTrusted = clientChainLen != 0;
	log("cert chain length: server {}, client {}", serverChainLen, clientChainLen);
	auto arena = Arena();
	auto serverChain = mkcert::CertChainRef{};
	auto clientChain = mkcert::CertChainRef{};
	if (serverChainLen) {
		auto tmpArena = Arena();
		auto specs = mkcert::makeCertChainSpec(tmpArena, std::labs(serverChainLen), mkcert::ESide::Server);
		if (serverChainLen < 0) {
			specs[0].offsetNotBefore = -60l * 60 * 24 * 365;
			specs[0].offsetNotAfter = -10l; // cert that expired 10 seconds ago
		}
		serverChain = mkcert::makeCertChain(arena, specs, {} /* create root CA cert from spec*/);
	}
	if (clientChainLen) {
		auto tmpArena = Arena();
		auto specs = mkcert::makeCertChainSpec(tmpArena, std::labs(clientChainLen), mkcert::ESide::Client);
		if (clientChainLen < 0) {
			specs[0].offsetNotBefore = -60l * 60 * 24 * 365;
			specs[0].offsetNotAfter = -10l; // cert that expired 10 seconds ago
		}
		clientChain = mkcert::makeCertChain(arena, specs, {} /* create root CA cert from spec*/);
	}
	initSslContext(clientSsl, clientChain, serverChain, mkcert::ESide::Client);
	log("client SSL contexts initialized");
	initSslContext(serverSsl, serverChain, clientChain, mkcert::ESide::Server);
	log("server SSL contexts initialized");
	auto io = io_context();
	auto serverWorkGuard = work_guard_type(io.get_executor());
	auto clientWorkGuard = work_guard_type(io.get_executor());
	auto const ip = ip::address::from_string("127.0.0.1");
	auto acceptor = tcp::acceptor(io, tcp::endpoint(ip, 0));
	auto const serverAddr = acceptor.local_endpoint();
	logs("server listening at {}", serverAddr);
	auto serverSock = tcp::socket(io);
	auto serverSslSock = socket_type(serverSock, serverSsl);
	enum class ESockState { AssumedUntrusted, Trusted };
	auto serverSockState = ESockState::AssumedUntrusted;
	auto clientSockState = ESockState::AssumedUntrusted;
	auto handshakeOk = true;
	serverSslSock.set_verify_callback([&serverSockState, &handshakeOk](bool preverify, ssl::verify_context&) {
		logs("client preverify: {}", preverify);
		switch (serverSockState) {
		case ESockState::AssumedUntrusted:
			if (!preverify)
				return handshakeOk = false;
			serverSockState = ESockState::Trusted;
			break;
		case ESockState::Trusted:
			if (!preverify)
				return handshakeOk = false;
			break;
		default: