Re: [TLS] BoringSSL's TLS test suite

Have you noticed that BoringSSL seems to abort handshakes with an 
illegal_parameter alert, if the server certificate uses the standard 
compliant (albeit highly unusual) DER encoding of NULL OPTIONAL as the 
empty string, instead of the non-standard but ubiquitous 0x05 0x00 encoding?

Is this just a regression bug in BoringSSL, or is it an intentional 
restriction of the TLS protocol that should be propagated to other 
implementations as well?

On 2016-08-16 20:08, David Benjamin wrote:
> Hi folks,
>
> BoringSSL has developed a test harness[1] that consists of a fork of
> Go’s crypto/tls package (recently dubbed “BoGo" at the Berlin hackathon)
> plus a test runner that allows BoGo to be run against the TLS stack
> under test. BoGo can be configured to behave in a number of unexpected
> ways that violate the TLS standard, thus enabling the testing of many
> scenarios that would be otherwise difficult to obtain with a standard
> stack. We (David Benjamin and Eric Rescorla) have been getting it to
> work with NSS and wanted to let others know in case they might find it
> useful.
>
> This system was initially designed to work with BoringSSL, but in
> principle can be used with any stack. The portability is still a little
> rough, and we'll likely make changes as we get more experience here, but
> it has already been used to test NSS[2] and OpenSSL[3]. We've written up
> some notes at [4].
>
> The test suite should be fairly extensive for DTLS and TLS 1.2 (giving
> around 75% line coverage in BoringSSL’s TLS code at last count). It
> tests TLS 1.3 as well, though those tests are still in progress. They
> track BoringSSL’s in-progress TLS 1.3 implementation.
>
> David and Eric
>
> [1] https://boringssl.googlesource.com/boringssl/+/master/ssl/test/
> [2] https://hg.mozilla.org/projects/nss/file/tip/external_tests/nss_bogo_shim
> [3] https://github.com/google/openssl-tests
> [4] https://boringssl.googlesource.com/boringssl/+/master/ssl/test/PORTING.md
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>