1#! /usr/bin/env perl
2# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
3#
4# Licensed under the Apache License 2.0 (the "License").  You may not use
5# this file except in compliance with the License.  You can obtain a copy
6# in the file LICENSE in the source distribution or at
7# https://www.openssl.org/source/license.html
8
9
10use strict;
11use warnings;
12
13use POSIX;
14use File::Basename;
15use File::Copy;
16use OpenSSL::Test qw/:DEFAULT with bldtop_file bldtop_dir srctop_file srctop_dir cmdstr data_file/;
17use OpenSSL::Test::Utils;
18
19BEGIN {
20setup("test_ssl_old");
21}
22
23use lib srctop_dir('Configurations');
24use lib bldtop_dir('.');
25
26my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
27my ($no_rsa, $no_dsa, $no_dh, $no_ec, $no_psk,
28    $no_ssl3, $no_tls1, $no_tls1_1, $no_tls1_2, $no_tls1_3,
29    $no_dtls, $no_dtls1, $no_dtls1_2, $no_ct) =
30    anydisabled qw/rsa dsa dh ec psk
31                   ssl3 tls1 tls1_1 tls1_2 tls1_3
32                   dtls dtls1 dtls1_2 ct/;
33#If ec and dh are disabled then don't use TLSv1.3
34$no_tls1_3 = 1 if (!$no_tls1_3 && $no_ec && $no_dh);
35my $no_anytls = alldisabled(available_protocols("tls"));
36my $no_anydtls = alldisabled(available_protocols("dtls"));
37
38plan skip_all => "No SSL/TLS/DTLS protocol is support by this OpenSSL build"
39    if $no_anytls && $no_anydtls;
40
41my $digest = "-sha1";
42my @reqcmd = ("openssl", "req");
43my @x509cmd = ("openssl", "x509", $digest);
44my @verifycmd = ("openssl", "verify");
45my @genpkeycmd = ("openssl", "genpkey");
46my $dummycnf = srctop_file("apps", "openssl.cnf");
47
48my $cnf = srctop_file("test", "ca-and-certs.cnf");
49my $CAkey = srctop_file("test", "certs", "ca-key.pem"); # "keyCA.ss"
50my $CAcert="certCA.ss";
51my $CAserial="certCA.srl";
52my $CAreq="reqCA.ss";
53my $CAreq2="req2CA.ss"; # temp
54my $Ukey = srctop_file("test", "certs", "ee-key.pem"); # "keyU.ss";
55my $Ureq="reqU.ss";
56my $Ucert="certU.ss";
57my $Dkey="keyD.ss";
58my $Dreq="reqD.ss";
59my $Dcert="certD.ss";
60my $Ekey="keyE.ss";
61my $Ereq="reqE.ss";
62my $Ecert="certE.ss";
63
64my $proxycnf=srctop_file("test", "proxy.cnf");
65my $P1key= srctop_file("test", "certs", "alt1-key.pem"); # "keyP1.ss";
66my $P1req="reqP1.ss";
67my $P1cert="certP1.ss";
68my $P1intermediate="tmp_intP1.ss";
69my $P2key= srctop_file("test", "certs", "alt2-key.pem"); # "keyP2.ss";
70my $P2req="reqP2.ss";
71my $P2cert="certP2.ss";
72my $P2intermediate="tmp_intP2.ss";
73
74my $server_sess="server.ss";
75my $client_sess="client.ss";
76
77# ssl_old_test.c is deprecated in favour of the new framework in ssl_test.c
78# If you're adding tests here, you probably want to convert them to the
79# new format in ssl_test.c and add recipes to 80-test_ssl_new.t instead.
80plan tests =>
81   ($no_fips ? 0 : 5)     # testssl with fips provider
82    + 1                   # For testss
83    + 5                   # For the testssl with default provider
84    ;
85
86subtest 'test_ss' => sub {
87    if (testss()) {
88        open OUT, ">", "intP1.ss";
89        copy($CAcert, \*OUT); copy($Ucert, \*OUT);
90        close OUT;
91
92        open OUT, ">", "intP2.ss";
93        copy($CAcert, \*OUT); copy($Ucert, \*OUT); copy($P1cert, \*OUT);
94        close OUT;
95    }
96};
97
98note('test_ssl_old -- key U');
99my $configfile = srctop_file("test","default-and-legacy.cnf");
100if (disabled("legacy")) {
101    $configfile = srctop_file("test","default.cnf");
102}
103
104testssl($Ukey, $Ucert, $CAcert, "default", $configfile);
105unless ($no_fips) {
106    testssl($Ukey, $Ucert, $CAcert, "fips",
107            srctop_file("test","fips-and-base.cnf"));
108}
109
110# -----------
111# subtest functions
112sub testss {
113    my @req_dsa = ("-newkey",
114                   "dsa:".data_file("dsa2048.pem"));
115    my $dsaparams = data_file("dsa2048.pem");
116    my @req_new;
117    if ($no_rsa) {
118        @req_new = @req_dsa;
119    } else {
120        @req_new = ("-new");
121    }
122
123    plan tests => 17;
124
125  SKIP: {
126      skip 'failure', 16 unless
127          ok(run(app([@reqcmd, "-config", $cnf,
128                      "-out", $CAreq, "-key", $CAkey,
129                      @req_new])),
130             'make cert request');
131
132      skip 'failure', 15 unless
133          ok(run(app([@x509cmd, "-CAcreateserial", "-in", $CAreq, "-days", "30",
134                      "-req", "-out", $CAcert, "-signkey", $CAkey,
135                      "-extfile", $cnf, "-extensions", "v3_ca"],
136                     stdout => "err.ss")),
137             'convert request into self-signed cert');
138
139      skip 'failure', 14 unless
140          ok(run(app([@x509cmd, "-in", $CAcert,
141                      "-x509toreq", "-signkey", $CAkey, "-out", $CAreq2],
142                     stdout => "err.ss")),
143             'convert cert into a cert request');
144
145      skip 'failure', 13 unless
146          ok(run(app([@reqcmd, "-config", $dummycnf,
147                      "-verify", "-in", $CAreq, "-noout"])),
148             'verify request 1');
149
150
151      skip 'failure', 12 unless
152          ok(run(app([@reqcmd, "-config", $dummycnf,
153                      "-verify", "-in", $CAreq2, "-noout"])),
154             'verify request 2');
155
156      skip 'failure', 11 unless
157          ok(run(app([@verifycmd, "-CAfile", $CAcert, $CAcert])),
158             'verify signature');
159
160      skip 'failure', 10 unless
161          ok(run(app([@reqcmd, "-config", $cnf, "-section", "userreq",
162                      "-out", $Ureq, "-key", $Ukey, @req_new],
163                     stdout => "err.ss")),
164             'make a user cert request');
165
166      skip 'failure', 9 unless
167          ok(run(app([@x509cmd, "-CAcreateserial", "-in", $Ureq, "-days", "30",
168                      "-req", "-out", $Ucert,
169                      "-CA", $CAcert, "-CAkey", $CAkey, "-CAserial", $CAserial,
170                      "-extfile", $cnf, "-extensions", "v3_ee"],
171                     stdout => "err.ss"))
172             && run(app([@verifycmd, "-CAfile", $CAcert, $Ucert])),
173             'sign user cert request');
174
175      skip 'failure', 8 unless
176          ok(run(app([@x509cmd,
177                      "-subject", "-issuer", "-startdate", "-enddate",
178                      "-noout", "-in", $Ucert])),
179             'Certificate details');
180
181      skip 'failure', 7 unless
182          subtest 'DSA certificate creation' => sub {
183              plan skip_all => "skipping DSA certificate creation"
184                  if $no_dsa;
185
186              plan tests => 5;
187
188            SKIP: {
189                $ENV{CN2} = "DSA Certificate";
190                skip 'failure', 4 unless
191                    ok(run(app([@genpkeycmd, "-out", $Dkey,
192                                "-paramfile", $dsaparams],
193                               stdout => "err.ss")),
194                       "make a DSA key");
195                skip 'failure', 3 unless
196                    ok(run(app([@reqcmd, "-new", "-config", $cnf,
197                                "-section", "userreq",
198                                "-out", $Dreq, "-key", $Dkey],
199                               stdout => "err.ss")),
200                       "make a DSA user cert request");
201                skip 'failure', 2 unless
202                    ok(run(app([@x509cmd, "-CAcreateserial",
203                                "-in", $Dreq,
204                                "-days", "30",
205                                "-req",
206                                "-out", $Dcert,
207                                "-CA", $CAcert, "-CAkey", $CAkey,
208                                "-CAserial", $CAserial,
209                                "-extfile", $cnf,
210                                "-extensions", "v3_ee_dsa"],
211                               stdout => "err.ss")),
212                       "sign DSA user cert request");
213                skip 'failure', 1 unless
214                    ok(run(app([@verifycmd, "-CAfile", $CAcert, $Dcert])),
215                       "verify DSA user cert");
216                skip 'failure', 0 unless
217                    ok(run(app([@x509cmd,
218                                "-subject", "-issuer",
219                                "-startdate", "-enddate", "-noout",
220                                "-in", $Dcert])),
221                       "DSA Certificate details");
222              }
223      };
224
225      skip 'failure', 6 unless
226          subtest 'ECDSA/ECDH certificate creation' => sub {
227              plan skip_all => "skipping ECDSA/ECDH certificate creation"
228                  if $no_ec;
229
230              plan tests => 5;
231
232            SKIP: {
233                $ENV{CN2} = "ECDSA Certificate";
234                skip 'failure', 4 unless
235                    ok(run(app(["openssl", "genpkey", "-genparam",
236                                "-algorithm", "EC",
237                                "-pkeyopt", "ec_paramgen_curve:P-256",
238                                "-pkeyopt", "ec_param_enc:named_curve",
239                                "-out", "ecp.ss"])),
240                       "make EC parameters");
241                skip 'failure', 3 unless
242                    ok(run(app([@reqcmd, "-config", $cnf,
243                                "-section", "userreq",
244                                "-out", $Ereq, "-keyout", $Ekey,
245                                "-newkey", "ec:ecp.ss"],
246                               stdout => "err.ss")),
247                       "make a ECDSA/ECDH user cert request");
248                skip 'failure', 2 unless
249                    ok(run(app([@x509cmd, "-CAcreateserial",
250                                "-in", $Ereq,
251                                "-days", "30",
252                                "-req",
253                                "-out", $Ecert,
254                                "-CA", $CAcert, "-CAkey", $CAkey,
255                                "-CAserial", $CAserial,
256                                "-extfile", $cnf,
257                                "-extensions", "v3_ee_ec"],
258                               stdout => "err.ss")),
259                       "sign ECDSA/ECDH user cert request");
260                skip 'failure', 1 unless
261                    ok(run(app([@verifycmd, "-CAfile", $CAcert, $Ecert])),
262                       "verify ECDSA/ECDH user cert");
263                skip 'failure', 0 unless
264                    ok(run(app([@x509cmd,
265                                "-subject", "-issuer",
266                                "-startdate", "-enddate", "-noout",
267                                "-in", $Ecert])),
268                       "ECDSA Certificate details");
269              }
270      };
271
272      skip 'failure', 5 unless
273          ok(run(app([@reqcmd, "-config", $proxycnf,
274                      "-out", $P1req, "-key", $P1key, @req_new],
275                     stdout => "err.ss")),
276             'make a proxy cert request');
277
278
279      skip 'failure', 4 unless
280          ok(run(app([@x509cmd, "-CAcreateserial", "-in", $P1req, "-days", "30",
281                      "-req", "-out", $P1cert,
282                      "-CA", $Ucert, "-CAkey", $Ukey,
283                      "-extfile", $proxycnf, "-extensions", "proxy"],
284                     stdout => "err.ss")),
285             'sign proxy with user cert');
286
287      copy($Ucert, $P1intermediate);
288      run(app([@verifycmd, "-CAfile", $CAcert,
289               "-untrusted", $P1intermediate, $P1cert]));
290      ok(run(app([@x509cmd,
291                  "-subject", "-issuer", "-startdate", "-enddate",
292                  "-noout", "-in", $P1cert])),
293         'Certificate details');
294
295      skip 'failure', 2 unless
296          ok(run(app([@reqcmd, "-config", $proxycnf, "-section", "proxy2_req",
297                      "-out", $P2req, "-key", $P2key,
298                      @req_new],
299                     stdout => "err.ss")),
300             'make another proxy cert request');
301
302
303      skip 'failure', 1 unless
304          ok(run(app([@x509cmd, "-CAcreateserial", "-in", $P2req, "-days", "30",
305                      "-req", "-out", $P2cert,
306                      "-CA", $P1cert, "-CAkey", $P1key,
307                      "-extfile", $proxycnf, "-extensions", "proxy_2"],
308                     stdout => "err.ss")),
309             'sign second proxy cert request with the first proxy cert');
310
311
312      open OUT, ">", $P2intermediate;
313      copy($Ucert, \*OUT); copy($P1cert, \*OUT);
314      close OUT;
315      run(app([@verifycmd, "-CAfile", $CAcert,
316               "-untrusted", $P2intermediate, $P2cert]));
317      ok(run(app([@x509cmd,
318                  "-subject", "-issuer", "-startdate", "-enddate",
319                  "-noout", "-in", $P2cert])),
320         'Certificate details');
321    }
322}
323
324sub testssl {
325    my ($key, $cert, $CAtmp, $provider, $configfile) = @_;
326    my @CA = $CAtmp ? ("-CAfile", $CAtmp) : ("-CApath", bldtop_dir("certs"));
327    my @providerflags = ("-provider", $provider);
328
329    if ($provider eq "default" && !disabled("legacy")) {
330        push @providerflags, "-provider", "legacy";
331    }
332
333    my @ssltest = ("ssl_old_test",
334                   "-s_key", $key, "-s_cert", $cert,
335                   "-c_key", $key, "-c_cert", $cert,
336                   "-config", $configfile,
337                   @providerflags);
338
339
340    my $serverinfo = srctop_file("test","serverinfo.pem");
341
342    my $dsa_cert = 0;
343    if (grep /DSA Public Key/, run(app(["openssl", "x509", "-in", $cert,
344                                        "-text", "-noout"]), capture => 1)) {
345        $dsa_cert = 1;
346    }
347
348
349    # plan tests => 11;
350
351    subtest 'standard SSL tests' => sub {
352        ######################################################################
353        plan tests => 13;
354
355      SKIP: {
356          skip "SSLv3 is not supported by this OpenSSL build", 4
357              if disabled("ssl3");
358
359          skip "SSLv3 is not supported by the FIPS provider", 4
360              if $provider eq "fips";
361
362          ok(run(test([@ssltest, "-bio_pair", "-ssl3"])),
363             'test sslv3 via BIO pair');
364          ok(run(test([@ssltest, "-bio_pair", "-ssl3", "-server_auth", @CA])),
365             'test sslv3 with server authentication via BIO pair');
366          ok(run(test([@ssltest, "-bio_pair", "-ssl3", "-client_auth", @CA])),
367             'test sslv3 with client authentication via BIO pair');
368          ok(run(test([@ssltest, "-bio_pair", "-ssl3", "-server_auth", "-client_auth", @CA])),
369             'test sslv3 with both server and client authentication via BIO pair');
370        }
371
372      SKIP: {
373          skip "Neither SSLv3 nor any TLS version are supported by this OpenSSL build", 1
374              if $no_anytls;
375
376          ok(run(test([@ssltest, "-bio_pair"])),
377             'test sslv2/sslv3 via BIO pair');
378        }
379
380      SKIP: {
381          skip "Neither SSLv3 nor any TLS version are supported by this OpenSSL build", 8
382              if $no_anytls;
383
384        SKIP: {
385            skip "skipping test of sslv2/sslv3 w/o (EC)DHE test", 1 if $dsa_cert;
386
387            ok(run(test([@ssltest, "-bio_pair", "-no_dhe", "-no_ecdhe"])),
388               'test sslv2/sslv3 w/o (EC)DHE via BIO pair');
389          }
390
391        SKIP: {
392            skip "skipping dhe1024dsa test", 1
393                if ($no_dh);
394
395            ok(run(test([@ssltest, "-bio_pair", "-dhe1024dsa", "-v"])),
396               'test sslv2/sslv3 with 1024bit DHE via BIO pair');
397          }
398
399          ok(run(test([@ssltest, "-bio_pair", "-server_auth", @CA])),
400             'test sslv2/sslv3 with server authentication');
401          ok(run(test([@ssltest, "-bio_pair", "-client_auth", @CA])),
402             'test sslv2/sslv3 with client authentication via BIO pair');
403          ok(run(test([@ssltest, "-bio_pair", "-server_auth", "-client_auth", @CA])),
404             'test sslv2/sslv3 with both client and server authentication via BIO pair');
405          ok(run(test([@ssltest, "-bio_pair", "-server_auth", "-client_auth", "-app_verify", @CA])),
406             'test sslv2/sslv3 with both client and server authentication via BIO pair and app verify');
407
408        SKIP: {
409            skip "No IPv4 available on this machine", 1
410                unless !disabled("sock") && have_IPv4();
411            ok(run(test([@ssltest, "-ipv4"])),
412               'test TLS via IPv4');
413          }
414
415        SKIP: {
416            skip "No IPv6 available on this machine", 1
417                unless !disabled("sock") && have_IPv6();
418            ok(run(test([@ssltest, "-ipv6"])),
419               'test TLS via IPv6');
420          }
421        }
422    };
423
424    subtest "Testing ciphersuites" => sub {
425
426        my @exkeys = ();
427        my $ciphers = '-PSK:-SRP:@SECLEVEL=0';
428
429        if (!$no_dsa) {
430            push @exkeys, "-s_cert", "certD.ss", "-s_key", $Dkey;
431        }
432
433        if (!$no_ec) {
434            push @exkeys, "-s_cert", "certE.ss", "-s_key", $Ekey;
435        }
436
437        my @protocols = ();
438        # We only use the flags that ssl_old_test understands
439        push @protocols, "-tls1_3" unless $no_tls1_3;
440        push @protocols, "-tls1_2" unless $no_tls1_2;
441        push @protocols, "-tls1" unless $no_tls1 || $provider eq "fips";
442        push @protocols, "-ssl3" unless $no_ssl3 || $provider eq "fips";
443        my $protocolciphersuitecount = 0;
444        my %ciphersuites = ();
445        my %ciphersstatus = ();
446        #There's no "-config" option to the ciphers command so we set the
447        #environment variable instead
448        my $opensslconf = $ENV{OPENSSL_CONF};
449        $ENV{OPENSSL_CONF} = $configfile;
450        foreach my $protocol (@protocols) {
451            my $ciphersstatus = undef;
452            my @ciphers = run(app(["openssl", "ciphers", "-s", $protocol,
453                                   @providerflags,
454                                   "ALL:$ciphers"]),
455                                   capture => 1, statusvar => \$ciphersstatus);
456            $ciphersstatus{$protocol} = $ciphersstatus;
457            if ($ciphersstatus) {
458                $ciphersuites{$protocol} = [ map { s|\R||; split(/:/, $_) }
459                                    @ciphers ];
460                $protocolciphersuitecount += scalar @{$ciphersuites{$protocol}};
461            }
462        }
463        $ENV{OPENSSL_CONF} = $opensslconf;
464
465        plan skip_all => "None of the ciphersuites to test are available in this OpenSSL build"
466            if $protocolciphersuitecount + scalar(keys %ciphersuites) == 0;
467
468        # The count of protocols is because in addition to the ciphersuites
469        # we got above, we're running a weak DH test for each protocol (except
470        # TLSv1.3)
471        my $testcount = scalar(@protocols) + $protocolciphersuitecount
472                        + scalar(keys %ciphersuites);
473        $testcount-- unless $no_tls1_3;
474        plan tests => $testcount;
475
476        foreach my $protocol (@protocols) {
477            ok($ciphersstatus{$protocol}, "Getting ciphers for $protocol");
478        }
479
480        foreach my $protocol (sort keys %ciphersuites) {
481            note "Testing ciphersuites for $protocol";
482            # ssl_old_test doesn't know -tls1_3, but that's fine, since that's
483            # the default choice if TLSv1.3 enabled
484            my $flag = $protocol eq "-tls1_3" ? "" : $protocol;
485            my $ciphersuites = "";
486            foreach my $cipher (@{$ciphersuites{$protocol}}) {
487                if ($protocol eq "-ssl3" && $cipher =~ /ECDH/ ) {
488                    note "*****SKIPPING $protocol $cipher";
489                    ok(1);
490                } else {
491                    if ($protocol eq "-tls1_3") {
492                        $ciphersuites = $cipher;
493                        $cipher = "";
494                    } else {
495                        $cipher = $cipher.':@SECLEVEL=0';
496                    }
497                    ok(run(test([@ssltest, @exkeys, "-cipher",
498                                 $cipher,
499                                 "-ciphersuites", $ciphersuites,
500                                 $flag || ()])),
501                       "Testing $cipher");
502                }
503            }
504            next if $protocol eq "-tls1_3";
505
506          SKIP: {
507              skip "skipping dhe512 test", 1
508                  if ($no_dh);
509
510              is(run(test([@ssltest,
511                           "-s_cipher", "EDH",
512                           "-c_cipher", 'EDH:@SECLEVEL=1',
513                           "-dhe512",
514                           $protocol])), 0,
515                 "testing connection with weak DH, expecting failure");
516            }
517        }
518    };
519
520    subtest 'RSA/(EC)DHE/PSK tests' => sub {
521        ######################################################################
522
523        plan tests => 6;
524
525      SKIP: {
526            skip "TLSv1.0 is not supported by this OpenSSL build", 6
527                if $no_tls1 || $provider eq "fips";
528
529        SKIP: {
530            skip "skipping anonymous DH tests", 1
531                if ($no_dh);
532
533            ok(run(test([@ssltest, "-v", "-bio_pair", "-tls1", "-cipher", "ADH", "-dhe1024dsa", "-num", "10", "-f", "-time"])),
534               'test tlsv1 with 1024bit anonymous DH, multiple handshakes');
535          }
536
537        SKIP: {
538            skip "skipping RSA tests", 2
539                if $no_rsa;
540
541            ok(run(test(["ssl_old_test", "-provider", "default", "-v", "-bio_pair", "-tls1", "-s_cert", srctop_file("apps","server2.pem"), "-no_dhe", "-no_ecdhe", "-num", "10", "-f", "-time"])),
542               'test tlsv1 with 1024bit RSA, no (EC)DHE, multiple handshakes');
543
544            skip "skipping RSA+DHE tests", 1
545                if $no_dh;
546
547            ok(run(test(["ssl_old_test", "-provider", "default", "-v", "-bio_pair", "-tls1", "-s_cert", srctop_file("apps","server2.pem"), "-dhe1024dsa", "-num", "10", "-f", "-time"])),
548               'test tlsv1 with 1024bit RSA, 1024bit DHE, multiple handshakes');
549          }
550
551        SKIP: {
552            skip "skipping PSK tests", 2
553                if ($no_psk);
554
555            ok(run(test([@ssltest, "-tls1", "-cipher", "PSK", "-psk", "abc123"])),
556               'test tls1 with PSK');
557
558            ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "PSK", "-psk", "abc123"])),
559               'test tls1 with PSK via BIO pair');
560	  }
561
562        SKIP: {
563            skip "skipping auto DH PSK tests", 1
564                if ($no_dh || $no_psk);
565
566            ok(run(test(['ssl_old_test', '-psk', '0102030405', '-cipher', '@SECLEVEL=2:DHE-PSK-AES128-CCM'])),
567               'test auto DH meets security strength');
568          }
569	}
570
571    };
572
573    subtest 'Custom Extension tests' => sub {
574        ######################################################################
575
576        plan tests => 1;
577
578      SKIP: {
579          skip "TLSv1.0 is not supported by this OpenSSL build", 1
580              if $no_tls1 || $provider eq "fips";
581
582          ok(run(test([@ssltest, "-bio_pair", "-tls1", "-custom_ext"])),
583             'test tls1 with custom extensions');
584        }
585    };
586
587    subtest 'Serverinfo tests' => sub {
588        ######################################################################
589
590        plan tests => 5;
591
592      SKIP: {
593          skip "TLSv1.0 is not supported by this OpenSSL build", 5
594              if $no_tls1 || $provider eq "fips";
595
596          note('echo test tls1 with serverinfo');
597          ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo])));
598          ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo, "-serverinfo_sct"])));
599          ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo, "-serverinfo_tack"])));
600          ok(run(test([@ssltest, "-bio_pair", "-tls1", "-serverinfo_file", $serverinfo, "-serverinfo_sct", "-serverinfo_tack"])));
601          ok(run(test([@ssltest, "-bio_pair", "-tls1", "-custom_ext", "-serverinfo_file", $serverinfo, "-serverinfo_sct", "-serverinfo_tack"])));
602        }
603    };
604}
605