blob: 5165491d662fdb5075f19ee3fc6892b9b3f864bc [file] [log] [blame]
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +01001#!/bin/sh
2
3# Test various options that are not covered by compat.sh
4#
5# Here the goal is not to cover every ciphersuite/version, but
6# rather specific options (max fragment length, truncated hmac, etc)
7# or procedures (session resumption from cache or ticket, renego, etc).
8#
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02009# Assumes a build with default options.
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +010010
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +010011set -u
12
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +010013# default values, can be overriden by the environment
14: ${P_SRV:=../programs/ssl/ssl_server2}
15: ${P_CLI:=../programs/ssl/ssl_client2}
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +010016: ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +020017: ${GNUTLS_CLI:=gnutls-cli}
18: ${GNUTLS_SERV:=gnutls-serv}
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +010019
Manuel Pégourié-Gonnarda7756172014-08-31 18:37:01 +020020O_SRV="$OPENSSL_CMD s_server -cert data_files/server5.crt -key data_files/server5.key"
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +010021O_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_CMD s_client"
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +020022G_SRV="$GNUTLS_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key"
23G_CLI="$GNUTLS_CLI"
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +010024
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +010025TESTS=0
26FAILS=0
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020027SKIPS=0
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +010028
Manuel Pégourié-Gonnard83d8c732014-04-07 13:24:21 +020029CONFIG_H='../include/polarssl/config.h'
30
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010031MEMCHECK=0
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +010032FILTER='.*'
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020033EXCLUDE='^$'
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010034
35print_usage() {
36 echo "Usage: $0 [options]"
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +010037 echo -e " -h|--help\tPrint this help."
38 echo -e " -m|--memcheck\tCheck memory leaks and errors."
39 echo -e " -f|--filter\tOnly matching tests are executed (default: '$FILTER')"
40 echo -e " -e|--exclude\tMatching tests are excluded (default: '$EXCLUDE')"
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010041}
42
43get_options() {
44 while [ $# -gt 0 ]; do
45 case "$1" in
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +010046 -f|--filter)
47 shift; FILTER=$1
48 ;;
49 -e|--exclude)
50 shift; EXCLUDE=$1
51 ;;
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010052 -m|--memcheck)
53 MEMCHECK=1
54 ;;
55 -h|--help)
56 print_usage
57 exit 0
58 ;;
59 *)
Paul Bakker1ebc0c52014-05-22 15:47:58 +020060 echo "Unknown argument: '$1'"
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010061 print_usage
62 exit 1
63 ;;
64 esac
65 shift
66 done
67}
68
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020069# skip next test if OpenSSL can't send SSLv2 ClientHello
70requires_openssl_with_sslv2() {
71 if [ -z "${OPENSSL_HAS_SSL2:-}" ]; then
Manuel Pégourié-Gonnarda4afadf2014-08-30 22:09:36 +020072 if $OPENSSL_CMD ciphers -ssl2 >/dev/null 2>&1; then
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020073 OPENSSL_HAS_SSL2="YES"
74 else
75 OPENSSL_HAS_SSL2="NO"
76 fi
77 fi
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +020078
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020079 if [ "$OPENSSL_HAS_SSL2" = "NO" ]; then
80 SKIP_NEXT="YES"
81 fi
82}
83
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +020084# skip next test if GnuTLS isn't available
85requires_gnutls() {
86 if [ -z "${GNUTLS_AVAILABLE:-}" ]; then
87 if ( which "$GNUTLS_CLI" && which "$GNUTLS_SERV" ) >/dev/null; then
88 GNUTLS_AVAILABLE="YES"
89 else
90 GNUTLS_AVAILABLE="NO"
91 fi
92 fi
93 if [ "$GNUTLS_AVAILABLE" = "NO" ]; then
94 SKIP_NEXT="YES"
95 fi
96}
97
Manuel Pégourié-Gonnard77b0b8d2014-08-31 20:19:40 +020098# skip next test if valgrind is in use (temporary)
99not_with_valgrind() {
100 if [ $MEMCHECK -gt 0 ]; then
101 SKIP_NEXT="YES"
102 else
103 SKIP_NEXT="NO"
104 fi
105}
106
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +0200107# skip next test if IPv6 isn't available on this host
108requires_ipv6() {
109 if [ -z "${HAS_IPV6:-}" ]; then
110 $P_SRV server_addr='::1' > $SRV_OUT 2>&1 &
111 SRV_PID=$!
112 sleep 1
113 kill $SRV_PID >/dev/null 2>&1
114 if grep "NET - Binding of the socket failed" $SRV_OUT >/dev/null; then
115 HAS_IPV6="NO"
116 else
117 HAS_IPV6="YES"
118 fi
119 rm -r $SRV_OUT
120 fi
121
122 if [ "$HAS_IPV6" = "NO" ]; then
123 SKIP_NEXT="YES"
124 fi
125}
126
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100127# print_name <name>
128print_name() {
129 echo -n "$1 "
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200130 LEN=$(( 72 - `echo "$1" | wc -c` ))
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100131 for i in `seq 1 $LEN`; do echo -n '.'; done
132 echo -n ' '
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100133
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200134 TESTS=$(( $TESTS + 1 ))
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100135}
136
137# fail <message>
138fail() {
139 echo "FAIL"
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100140 echo " ! $1"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100141
Manuel Pégourié-Gonnardc2b00922014-08-31 16:46:04 +0200142 mv $SRV_OUT o-srv-${TESTS}.log
143 mv $CLI_OUT o-cli-${TESTS}.log
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100144 echo " ! outputs saved to o-srv-${TESTS}.log and o-cli-${TESTS}.log"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100145
Manuel Pégourié-Gonnard7fa67722014-08-31 17:42:53 +0200146 if [ "X${USER:-}" = Xbuildbot -o "X${LOGNAME:-}" = Xbuildbot ]; then
147 echo " ! server output:"
148 cat o-srv-${TESTS}.log
149 echo " ! ============================================================"
150 echo " ! client output:"
151 cat o-cli-${TESTS}.log
152 fi
153
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200154 FAILS=$(( $FAILS + 1 ))
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100155}
156
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100157# is_polar <cmd_line>
158is_polar() {
159 echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null
160}
161
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100162# has_mem_err <log_file_name>
163has_mem_err() {
164 if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" &&
165 grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null
166 then
167 return 1 # false: does not have errors
168 else
169 return 0 # true: has errors
170 fi
171}
172
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200173# wait for server to start: two versions depending on lsof availability
174wait_server_start() {
175 if which lsof >/dev/null; then
176 # make sure we don't loop forever
177 ( sleep "$DOG_DELAY"; echo "SERVERSTART TIMEOUT"; kill $MAIN_PID ) &
178 WATCHDOG_PID=$!
179
180 # make a tight loop, server usually takes less than 1 sec to start
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +0200181 if [ "$DTLS" -eq 1 ]; then
182 until lsof -nbi UDP:"$PORT" | grep UDP >/dev/null; do :; done
183 else
184 until lsof -nbi TCP:"$PORT" | grep LISTEN >/dev/null; do :; done
185 fi
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200186
187 kill $WATCHDOG_PID
188 wait $WATCHDOG_PID
189 else
190 sleep "$START_DELAY"
191 fi
192}
193
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200194# wait for client to terminate and set CLI_EXIT
195# must be called right after starting the client
196wait_client_done() {
197 CLI_PID=$!
198
199 ( sleep "$DOG_DELAY"; echo "TIMEOUT" >> $CLI_OUT; kill $CLI_PID ) &
200 WATCHDOG_PID=$!
201
202 wait $CLI_PID
203 CLI_EXIT=$?
204
205 kill $WATCHDOG_PID
206 wait $WATCHDOG_PID
207
208 echo "EXIT: $CLI_EXIT" >> $CLI_OUT
209}
210
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +0200211# check if the given command uses dtls and sets global variable DTLS
212detect_dtls() {
213 if echo "$1" | grep ' dtls=1 \| -dtls1\| -u ' >/dev/null; then
214 DTLS=1
215 else
216 DTLS=0
217 fi
218}
219
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100220# Usage: run_test name srv_cmd cli_cmd cli_exit [option [...]]
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100221# Options: -s pattern pattern that must be present in server output
222# -c pattern pattern that must be present in client output
223# -S pattern pattern that must be absent in server output
224# -C pattern pattern that must be absent in client output
225run_test() {
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100226 NAME="$1"
227 SRV_CMD="$2"
228 CLI_CMD="$3"
229 CLI_EXPECT="$4"
230 shift 4
231
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +0100232 if echo "$NAME" | grep "$FILTER" | grep -v "$EXCLUDE" >/dev/null; then :
233 else
234 return
235 fi
236
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100237 print_name "$NAME"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100238
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200239 # should we skip?
240 if [ "X$SKIP_NEXT" = "XYES" ]; then
241 SKIP_NEXT="NO"
242 echo "SKIP"
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200243 SKIPS=$(( $SKIPS + 1 ))
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200244 return
245 fi
246
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +0200247 # update DTLS variable
248 detect_dtls "$SRV_CMD"
249
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100250 # prepend valgrind to our commands if active
251 if [ "$MEMCHECK" -gt 0 ]; then
252 if is_polar "$SRV_CMD"; then
253 SRV_CMD="valgrind --leak-check=full $SRV_CMD"
254 fi
255 if is_polar "$CLI_CMD"; then
256 CLI_CMD="valgrind --leak-check=full $CLI_CMD"
257 fi
258 fi
259
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100260 # run the commands
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200261 echo "$SRV_CMD" > $SRV_OUT
Manuel Pégourié-Gonnarda7756172014-08-31 18:37:01 +0200262 # for servers without -www, eg openssl with DTLS
263 yes blabla | $SRV_CMD >> $SRV_OUT 2>&1 &
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100264 SRV_PID=$!
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200265 wait_server_start
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200266
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200267 echo "$CLI_CMD" > $CLI_OUT
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200268 eval "$CLI_CMD" >> $CLI_OUT 2>&1 &
269 wait_client_done
Manuel Pégourié-Gonnarde01af4c2014-03-25 14:16:44 +0100270
Manuel Pégourié-Gonnard74b11702014-08-14 15:47:33 +0200271 # kill the server
272 kill $SRV_PID
273 wait $SRV_PID
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100274
275 # check if the client and server went at least to the handshake stage
Paul Bakker1ebc0c52014-05-22 15:47:58 +0200276 # (useful to avoid tests with only negative assertions and non-zero
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100277 # expected client exit to incorrectly succeed in case of catastrophic
278 # failure)
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100279 if is_polar "$SRV_CMD"; then
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200280 if grep "Performing the SSL/TLS handshake" $SRV_OUT >/dev/null; then :;
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100281 else
282 fail "server failed to start"
283 return
284 fi
285 fi
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100286 if is_polar "$CLI_CMD"; then
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200287 if grep "Performing the SSL/TLS handshake" $CLI_OUT >/dev/null; then :;
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100288 else
289 fail "client failed to start"
290 return
291 fi
292 fi
293
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100294 # check server exit code
295 if [ $? != 0 ]; then
296 fail "server fail"
297 return
298 fi
299
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100300 # check client exit code
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100301 if [ \( "$CLI_EXPECT" = 0 -a "$CLI_EXIT" != 0 \) -o \
302 \( "$CLI_EXPECT" != 0 -a "$CLI_EXIT" = 0 \) ]
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100303 then
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +0100304 fail "bad client exit code"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100305 return
306 fi
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100307
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100308 # check other assertions
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200309 # lines beginning with == are added by valgrind, ignore them
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100310 while [ $# -gt 0 ]
311 do
312 case $1 in
313 "-s")
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200314 if grep -v '^==' $SRV_OUT | grep "$2" >/dev/null; then :; else
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100315 fail "-s $2"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100316 return
317 fi
318 ;;
319
320 "-c")
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200321 if grep -v '^==' $CLI_OUT | grep "$2" >/dev/null; then :; else
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100322 fail "-c $2"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100323 return
324 fi
325 ;;
326
327 "-S")
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200328 if grep -v '^==' $SRV_OUT | grep "$2" >/dev/null; then
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100329 fail "-S $2"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100330 return
331 fi
332 ;;
333
334 "-C")
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200335 if grep -v '^==' $CLI_OUT | grep "$2" >/dev/null; then
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100336 fail "-C $2"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100337 return
338 fi
339 ;;
340
341 *)
Paul Bakker1ebc0c52014-05-22 15:47:58 +0200342 echo "Unknown test: $1" >&2
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100343 exit 1
344 esac
345 shift 2
346 done
347
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100348 # check valgrind's results
349 if [ "$MEMCHECK" -gt 0 ]; then
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200350 if is_polar "$SRV_CMD" && has_mem_err $SRV_OUT; then
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100351 fail "Server has memory errors"
352 return
353 fi
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200354 if is_polar "$CLI_CMD" && has_mem_err $CLI_OUT; then
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100355 fail "Client has memory errors"
356 return
357 fi
358 fi
359
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100360 # if we're here, everything is ok
361 echo "PASS"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200362 rm -f $SRV_OUT $CLI_OUT
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100363}
364
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100365cleanup() {
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200366 rm -f $CLI_OUT $SRV_OUT $SESSION
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200367 kill $SRV_PID >/dev/null 2>&1
368 kill $WATCHDOG_PID >/dev/null 2>&1
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100369 exit 1
370}
371
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100372#
373# MAIN
374#
375
Manuel Pégourié-Gonnard913030c2014-03-28 10:12:38 +0100376get_options "$@"
377
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100378# sanity checks, avoid an avalanche of errors
379if [ ! -x "$P_SRV" ]; then
380 echo "Command '$P_SRV' is not an executable file"
381 exit 1
382fi
383if [ ! -x "$P_CLI" ]; then
384 echo "Command '$P_CLI' is not an executable file"
385 exit 1
386fi
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +0100387if which $OPENSSL_CMD >/dev/null 2>&1; then :; else
388 echo "Command '$OPENSSL_CMD' not found"
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100389 exit 1
390fi
391
Manuel Pégourié-Gonnard32f8f4d2014-05-29 11:31:20 +0200392# used by watchdog
393MAIN_PID="$$"
394
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200395# be more patient with valgrind
396if [ "$MEMCHECK" -gt 0 ]; then
397 START_DELAY=3
398 DOG_DELAY=30
399else
400 START_DELAY=1
401 DOG_DELAY=10
402fi
403
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +0200404# Pick a "unique" port in the range 10000-19999.
405PORT="0000$$"
Manuel Pégourié-Gonnardfab2a3c2014-06-16 16:54:36 +0200406PORT="1$(echo $PORT | tail -c 5)"
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +0200407
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +0200408# fix commands to use this port, force IPv4 while at it
409P_SRV="$P_SRV server_addr=127.0.0.1 server_port=$PORT"
410P_CLI="$P_CLI server_addr=127.0.0.1 server_port=$PORT"
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +0200411O_SRV="$O_SRV -accept $PORT"
412O_CLI="$O_CLI -connect localhost:$PORT"
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +0200413G_SRV="$G_SRV -p $PORT"
414G_CLI="$G_CLI -p $PORT"
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +0200415
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200416# Also pick a unique name for intermediate files
417SRV_OUT="srv_out.$$"
418CLI_OUT="cli_out.$$"
419SESSION="session.$$"
420
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200421SKIP_NEXT="NO"
422
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100423trap cleanup INT TERM HUP
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100424
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200425# Basic test
426
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200427# Checks that:
428# - things work with all ciphersuites active (used with config-full in all.sh)
429# - the expected (highest security) parameters are selected
430# ("signature_algorithm ext: 6" means SHA-512 (highest common hash))
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200431run_test "Default" \
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200432 "$P_SRV debug_level=3" \
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200433 "$P_CLI" \
434 0 \
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200435 -s "Protocol is TLSv1.2" \
436 -s "Ciphersuite is TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \
437 -s "client hello v3, signature_algorithm ext: 6" \
438 -s "ECDHE curve: secp521r1" \
439 -S "error" \
440 -C "error"
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200441
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100442# Test for SSLv2 ClientHello
443
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200444requires_openssl_with_sslv2
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200445run_test "SSLv2 ClientHello: reference" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100446 "$P_SRV debug_level=3" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +0100447 "$O_CLI -no_ssl2" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100448 0 \
449 -S "parse client hello v2" \
450 -S "ssl_handshake returned"
451
452# Adding a SSL2-only suite makes OpenSSL client send SSLv2 ClientHello
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200453requires_openssl_with_sslv2
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200454run_test "SSLv2 ClientHello: actual test" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200455 "$P_SRV debug_level=2" \
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100456 "$O_CLI -cipher 'DES-CBC-MD5:ALL'" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100457 0 \
458 -s "parse client hello v2" \
459 -S "ssl_handshake returned"
460
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100461# Tests for Truncated HMAC extension
462
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200463run_test "Truncated HMAC: reference" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200464 "$P_SRV debug_level=4" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100465 "$P_CLI trunc_hmac=0 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100466 0 \
467 -s "dumping 'computed mac' (20 bytes)"
468
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200469run_test "Truncated HMAC: actual test" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200470 "$P_SRV debug_level=4" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100471 "$P_CLI trunc_hmac=1 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100472 0 \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100473 -s "dumping 'computed mac' (10 bytes)"
474
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100475# Tests for Session Tickets
476
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200477run_test "Session resume using tickets: basic" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200478 "$P_SRV debug_level=3 tickets=1" \
479 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100480 0 \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100481 -c "client hello, adding session ticket extension" \
482 -s "found session ticket extension" \
483 -s "server hello, adding session ticket extension" \
484 -c "found session_ticket extension" \
485 -c "parse new session ticket" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100486 -S "session successfully restored from cache" \
487 -s "session successfully restored from ticket" \
488 -s "a session has been resumed" \
489 -c "a session has been resumed"
490
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200491run_test "Session resume using tickets: cache disabled" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200492 "$P_SRV debug_level=3 tickets=1 cache_max=0" \
493 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnarddbe1ee12014-02-21 09:18:13 +0100494 0 \
495 -c "client hello, adding session ticket extension" \
496 -s "found session ticket extension" \
497 -s "server hello, adding session ticket extension" \
498 -c "found session_ticket extension" \
499 -c "parse new session ticket" \
500 -S "session successfully restored from cache" \
501 -s "session successfully restored from ticket" \
502 -s "a session has been resumed" \
503 -c "a session has been resumed"
504
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200505run_test "Session resume using tickets: timeout" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200506 "$P_SRV debug_level=3 tickets=1 cache_max=0 ticket_timeout=1" \
507 "$P_CLI debug_level=3 tickets=1 reconnect=1 reco_delay=2" \
Manuel Pégourié-Gonnarddbe1ee12014-02-21 09:18:13 +0100508 0 \
509 -c "client hello, adding session ticket extension" \
510 -s "found session ticket extension" \
511 -s "server hello, adding session ticket extension" \
512 -c "found session_ticket extension" \
513 -c "parse new session ticket" \
514 -S "session successfully restored from cache" \
515 -S "session successfully restored from ticket" \
516 -S "a session has been resumed" \
517 -C "a session has been resumed"
518
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200519run_test "Session resume using tickets: openssl server" \
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100520 "$O_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200521 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100522 0 \
523 -c "client hello, adding session ticket extension" \
524 -c "found session_ticket extension" \
525 -c "parse new session ticket" \
526 -c "a session has been resumed"
527
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200528run_test "Session resume using tickets: openssl client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200529 "$P_SRV debug_level=3 tickets=1" \
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200530 "( $O_CLI -sess_out $SESSION; \
531 $O_CLI -sess_in $SESSION; \
532 rm -f $SESSION )" \
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100533 0 \
534 -s "found session ticket extension" \
535 -s "server hello, adding session ticket extension" \
536 -S "session successfully restored from cache" \
537 -s "session successfully restored from ticket" \
538 -s "a session has been resumed"
539
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100540# Tests for Session Resume based on session-ID and cache
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100541
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200542run_test "Session resume using cache: tickets enabled on client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200543 "$P_SRV debug_level=3 tickets=0" \
544 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100545 0 \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100546 -c "client hello, adding session ticket extension" \
547 -s "found session ticket extension" \
548 -S "server hello, adding session ticket extension" \
549 -C "found session_ticket extension" \
550 -C "parse new session ticket" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100551 -s "session successfully restored from cache" \
552 -S "session successfully restored from ticket" \
553 -s "a session has been resumed" \
554 -c "a session has been resumed"
555
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200556run_test "Session resume using cache: tickets enabled on server" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200557 "$P_SRV debug_level=3 tickets=1" \
558 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100559 0 \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100560 -C "client hello, adding session ticket extension" \
561 -S "found session ticket extension" \
562 -S "server hello, adding session ticket extension" \
563 -C "found session_ticket extension" \
564 -C "parse new session ticket" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100565 -s "session successfully restored from cache" \
566 -S "session successfully restored from ticket" \
567 -s "a session has been resumed" \
568 -c "a session has been resumed"
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +0100569
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200570run_test "Session resume using cache: cache_max=0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200571 "$P_SRV debug_level=3 tickets=0 cache_max=0" \
572 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100573 0 \
574 -S "session successfully restored from cache" \
575 -S "session successfully restored from ticket" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100576 -S "a session has been resumed" \
577 -C "a session has been resumed"
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100578
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200579run_test "Session resume using cache: cache_max=1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200580 "$P_SRV debug_level=3 tickets=0 cache_max=1" \
581 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100582 0 \
583 -s "session successfully restored from cache" \
584 -S "session successfully restored from ticket" \
585 -s "a session has been resumed" \
586 -c "a session has been resumed"
587
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200588run_test "Session resume using cache: timemout > delay" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200589 "$P_SRV debug_level=3 tickets=0" \
590 "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=0" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100591 0 \
592 -s "session successfully restored from cache" \
593 -S "session successfully restored from ticket" \
594 -s "a session has been resumed" \
595 -c "a session has been resumed"
596
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200597run_test "Session resume using cache: timeout < delay" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200598 "$P_SRV debug_level=3 tickets=0 cache_timeout=1" \
599 "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100600 0 \
601 -S "session successfully restored from cache" \
602 -S "session successfully restored from ticket" \
603 -S "a session has been resumed" \
604 -C "a session has been resumed"
605
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200606run_test "Session resume using cache: no timeout" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200607 "$P_SRV debug_level=3 tickets=0 cache_timeout=0" \
608 "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100609 0 \
610 -s "session successfully restored from cache" \
611 -S "session successfully restored from ticket" \
612 -s "a session has been resumed" \
613 -c "a session has been resumed"
614
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200615run_test "Session resume using cache: openssl client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200616 "$P_SRV debug_level=3 tickets=0" \
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200617 "( $O_CLI -sess_out $SESSION; \
618 $O_CLI -sess_in $SESSION; \
619 rm -f $SESSION )" \
Manuel Pégourié-Gonnarddb735f62014-02-25 17:57:59 +0100620 0 \
621 -s "found session ticket extension" \
622 -S "server hello, adding session ticket extension" \
623 -s "session successfully restored from cache" \
624 -S "session successfully restored from ticket" \
625 -s "a session has been resumed"
626
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200627run_test "Session resume using cache: openssl server" \
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100628 "$O_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200629 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnarddb735f62014-02-25 17:57:59 +0100630 0 \
631 -C "found session_ticket extension" \
632 -C "parse new session ticket" \
633 -c "a session has been resumed"
634
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100635# Tests for Max Fragment Length extension
636
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200637run_test "Max fragment length: not used, reference" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200638 "$P_SRV debug_level=3" \
639 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +0100640 0 \
641 -C "client hello, adding max_fragment_length extension" \
642 -S "found max fragment length extension" \
643 -S "server hello, max_fragment_length extension" \
644 -C "found max_fragment_length extension"
645
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200646run_test "Max fragment length: used by client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200647 "$P_SRV debug_level=3" \
648 "$P_CLI debug_level=3 max_frag_len=4096" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +0100649 0 \
650 -c "client hello, adding max_fragment_length extension" \
651 -s "found max fragment length extension" \
652 -s "server hello, max_fragment_length extension" \
653 -c "found max_fragment_length extension"
654
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200655run_test "Max fragment length: used by server" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200656 "$P_SRV debug_level=3 max_frag_len=4096" \
657 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +0100658 0 \
659 -C "client hello, adding max_fragment_length extension" \
660 -S "found max fragment length extension" \
661 -S "server hello, max_fragment_length extension" \
662 -C "found max_fragment_length extension"
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100663
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200664requires_gnutls
665run_test "Max fragment length: gnutls server" \
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +0200666 "$G_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200667 "$P_CLI debug_level=3 max_frag_len=4096" \
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +0200668 0 \
669 -c "client hello, adding max_fragment_length extension" \
670 -c "found max_fragment_length extension"
671
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100672# Tests for renegotiation
673
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200674run_test "Renegotiation: none, for reference" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200675 "$P_SRV debug_level=3 exchanges=2" \
676 "$P_CLI debug_level=3 exchanges=2" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100677 0 \
678 -C "client hello, adding renegotiation extension" \
679 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
680 -S "found renegotiation extension" \
681 -s "server hello, secure renegotiation extension" \
682 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100683 -C "=> renegotiate" \
684 -S "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100685 -S "write hello request"
686
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200687run_test "Renegotiation: client-initiated" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200688 "$P_SRV debug_level=3 exchanges=2 renegotiation=1" \
689 "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100690 0 \
691 -c "client hello, adding renegotiation extension" \
692 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
693 -s "found renegotiation extension" \
694 -s "server hello, secure renegotiation extension" \
695 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100696 -c "=> renegotiate" \
697 -s "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100698 -S "write hello request"
699
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200700run_test "Renegotiation: server-initiated" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200701 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
702 "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100703 0 \
704 -c "client hello, adding renegotiation extension" \
705 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
706 -s "found renegotiation extension" \
707 -s "server hello, secure renegotiation extension" \
708 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100709 -c "=> renegotiate" \
710 -s "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100711 -s "write hello request"
712
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200713run_test "Renegotiation: double" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200714 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
715 "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100716 0 \
717 -c "client hello, adding renegotiation extension" \
718 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
719 -s "found renegotiation extension" \
720 -s "server hello, secure renegotiation extension" \
721 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100722 -c "=> renegotiate" \
723 -s "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100724 -s "write hello request"
725
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200726run_test "Renegotiation: client-initiated, server-rejected" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200727 "$P_SRV debug_level=3 exchanges=2 renegotiation=0" \
728 "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100729 1 \
730 -c "client hello, adding renegotiation extension" \
731 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
732 -S "found renegotiation extension" \
733 -s "server hello, secure renegotiation extension" \
734 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100735 -c "=> renegotiate" \
736 -S "=> renegotiate" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200737 -S "write hello request" \
Manuel Pégourié-Gonnard65919622014-08-19 12:50:30 +0200738 -c "SSL - Unexpected message at ServerHello in renegotiation" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200739 -c "failed"
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100740
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200741run_test "Renegotiation: server-initiated, client-rejected, default" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200742 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
743 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100744 0 \
745 -C "client hello, adding renegotiation extension" \
746 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
747 -S "found renegotiation extension" \
748 -s "server hello, secure renegotiation extension" \
749 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100750 -C "=> renegotiate" \
751 -S "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100752 -s "write hello request" \
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +0200753 -S "SSL - An unexpected message was received from our peer" \
754 -S "failed"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100755
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200756run_test "Renegotiation: server-initiated, client-rejected, not enforced" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200757 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200758 renego_delay=-1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200759 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200760 0 \
761 -C "client hello, adding renegotiation extension" \
762 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
763 -S "found renegotiation extension" \
764 -s "server hello, secure renegotiation extension" \
765 -c "found renegotiation extension" \
766 -C "=> renegotiate" \
767 -S "=> renegotiate" \
768 -s "write hello request" \
769 -S "SSL - An unexpected message was received from our peer" \
770 -S "failed"
771
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +0200772# delay 2 for 1 alert record + 1 application data record
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200773run_test "Renegotiation: server-initiated, client-rejected, delay 2" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200774 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +0200775 renego_delay=2" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200776 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200777 0 \
778 -C "client hello, adding renegotiation extension" \
779 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
780 -S "found renegotiation extension" \
781 -s "server hello, secure renegotiation extension" \
782 -c "found renegotiation extension" \
783 -C "=> renegotiate" \
784 -S "=> renegotiate" \
785 -s "write hello request" \
786 -S "SSL - An unexpected message was received from our peer" \
787 -S "failed"
788
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200789run_test "Renegotiation: server-initiated, client-rejected, delay 0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200790 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200791 renego_delay=0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200792 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200793 0 \
794 -C "client hello, adding renegotiation extension" \
795 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
796 -S "found renegotiation extension" \
797 -s "server hello, secure renegotiation extension" \
798 -c "found renegotiation extension" \
799 -C "=> renegotiate" \
800 -S "=> renegotiate" \
801 -s "write hello request" \
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +0200802 -s "SSL - An unexpected message was received from our peer"
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200803
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200804run_test "Renegotiation: server-initiated, client-accepted, delay 0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200805 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200806 renego_delay=0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200807 "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200808 0 \
809 -c "client hello, adding renegotiation extension" \
810 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
811 -s "found renegotiation extension" \
812 -s "server hello, secure renegotiation extension" \
813 -c "found renegotiation extension" \
814 -c "=> renegotiate" \
815 -s "=> renegotiate" \
816 -s "write hello request" \
817 -S "SSL - An unexpected message was received from our peer" \
818 -S "failed"
819
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200820run_test "Renegotiation: nbio, client-initiated" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200821 "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1" \
822 "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +0200823 0 \
824 -c "client hello, adding renegotiation extension" \
825 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
826 -s "found renegotiation extension" \
827 -s "server hello, secure renegotiation extension" \
828 -c "found renegotiation extension" \
829 -c "=> renegotiate" \
830 -s "=> renegotiate" \
831 -S "write hello request"
832
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200833run_test "Renegotiation: nbio, server-initiated" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200834 "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \
835 "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1" \
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +0200836 0 \
837 -c "client hello, adding renegotiation extension" \
838 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
839 -s "found renegotiation extension" \
840 -s "server hello, secure renegotiation extension" \
841 -c "found renegotiation extension" \
842 -c "=> renegotiate" \
843 -s "=> renegotiate" \
844 -s "write hello request"
845
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200846run_test "Renegotiation: openssl server, client-initiated" \
Manuel Pégourié-Gonnarda7756172014-08-31 18:37:01 +0200847 "$O_SRV -www" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200848 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +0200849 0 \
850 -c "client hello, adding renegotiation extension" \
851 -c "found renegotiation extension" \
852 -c "=> renegotiate" \
853 -C "ssl_handshake returned" \
854 -C "error" \
855 -c "HTTP/1.0 200 [Oo][Kk]"
856
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200857run_test "Renegotiation: gnutls server, client-initiated" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +0200858 "$G_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200859 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +0200860 0 \
861 -c "client hello, adding renegotiation extension" \
862 -c "found renegotiation extension" \
863 -c "=> renegotiate" \
864 -C "ssl_handshake returned" \
865 -C "error" \
866 -c "HTTP/1.0 200 [Oo][Kk]"
867
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +0200868run_test "Renegotiation: DTLS, client-initiated" \
869 "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1" \
870 "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \
871 0 \
872 -c "client hello, adding renegotiation extension" \
873 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
874 -s "found renegotiation extension" \
875 -s "server hello, secure renegotiation extension" \
876 -c "found renegotiation extension" \
877 -c "=> renegotiate" \
878 -s "=> renegotiate" \
879 -S "write hello request"
880
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +0200881run_test "Renegotiation: DTLS, server-initiated" \
882 "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \
883 "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1" \
884 0 \
885 -c "client hello, adding renegotiation extension" \
886 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
887 -s "found renegotiation extension" \
888 -s "server hello, secure renegotiation extension" \
889 -c "found renegotiation extension" \
890 -c "=> renegotiate" \
891 -s "=> renegotiate" \
892 -s "write hello request"
893
Manuel Pégourié-Gonnardf1499f62014-08-31 17:13:13 +0200894not_with_valgrind
895run_test "Renegotiation: DTLS, gnutls server, client-initiated" \
896 "$G_SRV -u --mtu 4096" \
897 "$P_CLI debug_level=3 dtls=1 exchanges=1 renegotiation=1 renegotiate=1" \
898 0 \
899 -c "client hello, adding renegotiation extension" \
900 -c "found renegotiation extension" \
901 -c "=> renegotiate" \
902 -C "ssl_handshake returned" \
903 -C "error" \
904 -s "Extra-header:"
905
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +0100906# Tests for auth_mode
907
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200908run_test "Authentication: server badcert, client required" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100909 "$P_SRV crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +0100910 key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200911 "$P_CLI debug_level=1 auth_mode=required" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +0100912 1 \
913 -c "x509_verify_cert() returned" \
914 -c "! self-signed or not signed by a trusted CA" \
915 -c "! ssl_handshake returned" \
916 -c "X509 - Certificate verification failed"
917
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200918run_test "Authentication: server badcert, client optional" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100919 "$P_SRV crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +0100920 key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200921 "$P_CLI debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +0100922 0 \
923 -c "x509_verify_cert() returned" \
924 -c "! self-signed or not signed by a trusted CA" \
925 -C "! ssl_handshake returned" \
926 -C "X509 - Certificate verification failed"
927
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200928run_test "Authentication: server badcert, client none" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100929 "$P_SRV crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +0100930 key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200931 "$P_CLI debug_level=1 auth_mode=none" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +0100932 0 \
933 -C "x509_verify_cert() returned" \
934 -C "! self-signed or not signed by a trusted CA" \
935 -C "! ssl_handshake returned" \
936 -C "X509 - Certificate verification failed"
937
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200938run_test "Authentication: client badcert, server required" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200939 "$P_SRV debug_level=3 auth_mode=required" \
940 "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +0100941 key_file=data_files/server5.key" \
942 1 \
943 -S "skip write certificate request" \
944 -C "skip parse certificate request" \
945 -c "got a certificate request" \
946 -C "skip write certificate" \
947 -C "skip write certificate verify" \
948 -S "skip parse certificate verify" \
949 -s "x509_verify_cert() returned" \
950 -S "! self-signed or not signed by a trusted CA" \
951 -s "! ssl_handshake returned" \
952 -c "! ssl_handshake returned" \
953 -s "X509 - Certificate verification failed"
954
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200955run_test "Authentication: client badcert, server optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200956 "$P_SRV debug_level=3 auth_mode=optional" \
957 "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +0100958 key_file=data_files/server5.key" \
959 0 \
960 -S "skip write certificate request" \
961 -C "skip parse certificate request" \
962 -c "got a certificate request" \
963 -C "skip write certificate" \
964 -C "skip write certificate verify" \
965 -S "skip parse certificate verify" \
966 -s "x509_verify_cert() returned" \
967 -s "! self-signed or not signed by a trusted CA" \
968 -S "! ssl_handshake returned" \
969 -C "! ssl_handshake returned" \
970 -S "X509 - Certificate verification failed"
971
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200972run_test "Authentication: client badcert, server none" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200973 "$P_SRV debug_level=3 auth_mode=none" \
974 "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +0100975 key_file=data_files/server5.key" \
976 0 \
977 -s "skip write certificate request" \
978 -C "skip parse certificate request" \
979 -c "got no certificate request" \
980 -c "skip write certificate" \
981 -c "skip write certificate verify" \
982 -s "skip parse certificate verify" \
983 -S "x509_verify_cert() returned" \
984 -S "! self-signed or not signed by a trusted CA" \
985 -S "! ssl_handshake returned" \
986 -C "! ssl_handshake returned" \
987 -S "X509 - Certificate verification failed"
988
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200989run_test "Authentication: client no cert, server optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200990 "$P_SRV debug_level=3 auth_mode=optional" \
991 "$P_CLI debug_level=3 crt_file=none key_file=none" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +0100992 0 \
993 -S "skip write certificate request" \
994 -C "skip parse certificate request" \
995 -c "got a certificate request" \
996 -C "skip write certificate$" \
997 -C "got no certificate to send" \
998 -S "SSLv3 client has no certificate" \
999 -c "skip write certificate verify" \
1000 -s "skip parse certificate verify" \
1001 -s "! no client certificate sent" \
1002 -S "! ssl_handshake returned" \
1003 -C "! ssl_handshake returned" \
1004 -S "X509 - Certificate verification failed"
1005
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001006run_test "Authentication: openssl client no cert, server optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001007 "$P_SRV debug_level=3 auth_mode=optional" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001008 "$O_CLI" \
1009 0 \
1010 -S "skip write certificate request" \
1011 -s "skip parse certificate verify" \
1012 -s "! no client certificate sent" \
1013 -S "! ssl_handshake returned" \
1014 -S "X509 - Certificate verification failed"
1015
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001016run_test "Authentication: client no cert, openssl server optional" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001017 "$O_SRV -verify 10" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001018 "$P_CLI debug_level=3 crt_file=none key_file=none" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001019 0 \
1020 -C "skip parse certificate request" \
1021 -c "got a certificate request" \
1022 -C "skip write certificate$" \
1023 -c "skip write certificate verify" \
1024 -C "! ssl_handshake returned"
1025
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001026run_test "Authentication: client no cert, ssl3" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001027 "$P_SRV debug_level=3 auth_mode=optional force_version=ssl3" \
1028 "$P_CLI debug_level=3 crt_file=none key_file=none" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001029 0 \
1030 -S "skip write certificate request" \
1031 -C "skip parse certificate request" \
1032 -c "got a certificate request" \
1033 -C "skip write certificate$" \
1034 -c "skip write certificate verify" \
1035 -c "got no certificate to send" \
1036 -s "SSLv3 client has no certificate" \
1037 -s "skip parse certificate verify" \
1038 -s "! no client certificate sent" \
1039 -S "! ssl_handshake returned" \
1040 -C "! ssl_handshake returned" \
1041 -S "X509 - Certificate verification failed"
1042
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001043# tests for SNI
1044
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001045run_test "SNI: no SNI callback" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001046 "$P_SRV debug_level=3 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001047 crt_file=data_files/server5.crt key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001048 "$P_CLI server_name=localhost" \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001049 0 \
1050 -S "parse ServerName extension" \
1051 -c "issuer name *: C=NL, O=PolarSSL, CN=Polarssl Test EC CA" \
1052 -c "subject name *: C=NL, O=PolarSSL, CN=localhost"
1053
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001054run_test "SNI: matching cert 1" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001055 "$P_SRV debug_level=3 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001056 crt_file=data_files/server5.crt key_file=data_files/server5.key \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001057 sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001058 "$P_CLI server_name=localhost" \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001059 0 \
1060 -s "parse ServerName extension" \
1061 -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \
1062 -c "subject name *: C=NL, O=PolarSSL, CN=localhost"
1063
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001064run_test "SNI: matching cert 2" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001065 "$P_SRV debug_level=3 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001066 crt_file=data_files/server5.crt key_file=data_files/server5.key \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001067 sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001068 "$P_CLI server_name=polarssl.example" \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001069 0 \
1070 -s "parse ServerName extension" \
1071 -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001072 -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example"
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001073
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001074run_test "SNI: no matching cert" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001075 "$P_SRV debug_level=3 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001076 crt_file=data_files/server5.crt key_file=data_files/server5.key \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001077 sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001078 "$P_CLI server_name=nonesuch.example" \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001079 1 \
1080 -s "parse ServerName extension" \
1081 -s "ssl_sni_wrapper() returned" \
1082 -s "ssl_handshake returned" \
1083 -c "ssl_handshake returned" \
1084 -c "SSL - A fatal alert message was received from our peer"
1085
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001086# Tests for non-blocking I/O: exercise a variety of handshake flows
1087
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001088run_test "Non-blocking I/O: basic handshake" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001089 "$P_SRV nbio=2 tickets=0 auth_mode=none" \
1090 "$P_CLI nbio=2 tickets=0" \
1091 0 \
1092 -S "ssl_handshake returned" \
1093 -C "ssl_handshake returned" \
1094 -c "Read from server: .* bytes read"
1095
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001096run_test "Non-blocking I/O: client auth" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001097 "$P_SRV nbio=2 tickets=0 auth_mode=required" \
1098 "$P_CLI nbio=2 tickets=0" \
1099 0 \
1100 -S "ssl_handshake returned" \
1101 -C "ssl_handshake returned" \
1102 -c "Read from server: .* bytes read"
1103
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001104run_test "Non-blocking I/O: ticket" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001105 "$P_SRV nbio=2 tickets=1 auth_mode=none" \
1106 "$P_CLI nbio=2 tickets=1" \
1107 0 \
1108 -S "ssl_handshake returned" \
1109 -C "ssl_handshake returned" \
1110 -c "Read from server: .* bytes read"
1111
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001112run_test "Non-blocking I/O: ticket + client auth" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001113 "$P_SRV nbio=2 tickets=1 auth_mode=required" \
1114 "$P_CLI nbio=2 tickets=1" \
1115 0 \
1116 -S "ssl_handshake returned" \
1117 -C "ssl_handshake returned" \
1118 -c "Read from server: .* bytes read"
1119
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001120run_test "Non-blocking I/O: ticket + client auth + resume" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001121 "$P_SRV nbio=2 tickets=1 auth_mode=required" \
1122 "$P_CLI nbio=2 tickets=1 reconnect=1" \
1123 0 \
1124 -S "ssl_handshake returned" \
1125 -C "ssl_handshake returned" \
1126 -c "Read from server: .* bytes read"
1127
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001128run_test "Non-blocking I/O: ticket + resume" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001129 "$P_SRV nbio=2 tickets=1 auth_mode=none" \
1130 "$P_CLI nbio=2 tickets=1 reconnect=1" \
1131 0 \
1132 -S "ssl_handshake returned" \
1133 -C "ssl_handshake returned" \
1134 -c "Read from server: .* bytes read"
1135
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001136run_test "Non-blocking I/O: session-id resume" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001137 "$P_SRV nbio=2 tickets=0 auth_mode=none" \
1138 "$P_CLI nbio=2 tickets=0 reconnect=1" \
1139 0 \
1140 -S "ssl_handshake returned" \
1141 -C "ssl_handshake returned" \
1142 -c "Read from server: .* bytes read"
1143
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001144# Tests for version negotiation
1145
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001146run_test "Version check: all -> 1.2" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001147 "$P_SRV" \
1148 "$P_CLI" \
1149 0 \
1150 -S "ssl_handshake returned" \
1151 -C "ssl_handshake returned" \
1152 -s "Protocol is TLSv1.2" \
1153 -c "Protocol is TLSv1.2"
1154
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001155run_test "Version check: cli max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001156 "$P_SRV" \
1157 "$P_CLI max_version=tls1_1" \
1158 0 \
1159 -S "ssl_handshake returned" \
1160 -C "ssl_handshake returned" \
1161 -s "Protocol is TLSv1.1" \
1162 -c "Protocol is TLSv1.1"
1163
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001164run_test "Version check: srv max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001165 "$P_SRV max_version=tls1_1" \
1166 "$P_CLI" \
1167 0 \
1168 -S "ssl_handshake returned" \
1169 -C "ssl_handshake returned" \
1170 -s "Protocol is TLSv1.1" \
1171 -c "Protocol is TLSv1.1"
1172
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001173run_test "Version check: cli+srv max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001174 "$P_SRV max_version=tls1_1" \
1175 "$P_CLI max_version=tls1_1" \
1176 0 \
1177 -S "ssl_handshake returned" \
1178 -C "ssl_handshake returned" \
1179 -s "Protocol is TLSv1.1" \
1180 -c "Protocol is TLSv1.1"
1181
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001182run_test "Version check: cli max 1.1, srv min 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001183 "$P_SRV min_version=tls1_1" \
1184 "$P_CLI max_version=tls1_1" \
1185 0 \
1186 -S "ssl_handshake returned" \
1187 -C "ssl_handshake returned" \
1188 -s "Protocol is TLSv1.1" \
1189 -c "Protocol is TLSv1.1"
1190
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001191run_test "Version check: cli min 1.1, srv max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001192 "$P_SRV max_version=tls1_1" \
1193 "$P_CLI min_version=tls1_1" \
1194 0 \
1195 -S "ssl_handshake returned" \
1196 -C "ssl_handshake returned" \
1197 -s "Protocol is TLSv1.1" \
1198 -c "Protocol is TLSv1.1"
1199
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001200run_test "Version check: cli min 1.2, srv max 1.1 -> fail" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001201 "$P_SRV max_version=tls1_1" \
1202 "$P_CLI min_version=tls1_2" \
1203 1 \
1204 -s "ssl_handshake returned" \
1205 -c "ssl_handshake returned" \
1206 -c "SSL - Handshake protocol not within min/max boundaries"
1207
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001208run_test "Version check: srv min 1.2, cli max 1.1 -> fail" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001209 "$P_SRV min_version=tls1_2" \
1210 "$P_CLI max_version=tls1_1" \
1211 1 \
1212 -s "ssl_handshake returned" \
1213 -c "ssl_handshake returned" \
1214 -s "SSL - Handshake protocol not within min/max boundaries"
1215
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001216# Tests for ALPN extension
1217
Manuel Pégourié-Gonnard83d8c732014-04-07 13:24:21 +02001218if grep '^#define POLARSSL_SSL_ALPN' $CONFIG_H >/dev/null; then
1219
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001220run_test "ALPN: none" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001221 "$P_SRV debug_level=3" \
1222 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001223 0 \
1224 -C "client hello, adding alpn extension" \
1225 -S "found alpn extension" \
1226 -C "got an alert message, type: \\[2:120]" \
1227 -S "server hello, adding alpn extension" \
1228 -C "found alpn extension " \
1229 -C "Application Layer Protocol is" \
1230 -S "Application Layer Protocol is"
1231
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001232run_test "ALPN: client only" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001233 "$P_SRV debug_level=3" \
1234 "$P_CLI debug_level=3 alpn=abc,1234" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001235 0 \
1236 -c "client hello, adding alpn extension" \
1237 -s "found alpn extension" \
1238 -C "got an alert message, type: \\[2:120]" \
1239 -S "server hello, adding alpn extension" \
1240 -C "found alpn extension " \
1241 -c "Application Layer Protocol is (none)" \
1242 -S "Application Layer Protocol is"
1243
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001244run_test "ALPN: server only" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001245 "$P_SRV debug_level=3 alpn=abc,1234" \
1246 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001247 0 \
1248 -C "client hello, adding alpn extension" \
1249 -S "found alpn extension" \
1250 -C "got an alert message, type: \\[2:120]" \
1251 -S "server hello, adding alpn extension" \
1252 -C "found alpn extension " \
1253 -C "Application Layer Protocol is" \
1254 -s "Application Layer Protocol is (none)"
1255
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001256run_test "ALPN: both, common cli1-srv1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001257 "$P_SRV debug_level=3 alpn=abc,1234" \
1258 "$P_CLI debug_level=3 alpn=abc,1234" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001259 0 \
1260 -c "client hello, adding alpn extension" \
1261 -s "found alpn extension" \
1262 -C "got an alert message, type: \\[2:120]" \
1263 -s "server hello, adding alpn extension" \
1264 -c "found alpn extension" \
1265 -c "Application Layer Protocol is abc" \
1266 -s "Application Layer Protocol is abc"
1267
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001268run_test "ALPN: both, common cli2-srv1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001269 "$P_SRV debug_level=3 alpn=abc,1234" \
1270 "$P_CLI debug_level=3 alpn=1234,abc" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001271 0 \
1272 -c "client hello, adding alpn extension" \
1273 -s "found alpn extension" \
1274 -C "got an alert message, type: \\[2:120]" \
1275 -s "server hello, adding alpn extension" \
1276 -c "found alpn extension" \
1277 -c "Application Layer Protocol is abc" \
1278 -s "Application Layer Protocol is abc"
1279
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001280run_test "ALPN: both, common cli1-srv2" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001281 "$P_SRV debug_level=3 alpn=abc,1234" \
1282 "$P_CLI debug_level=3 alpn=1234,abcde" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001283 0 \
1284 -c "client hello, adding alpn extension" \
1285 -s "found alpn extension" \
1286 -C "got an alert message, type: \\[2:120]" \
1287 -s "server hello, adding alpn extension" \
1288 -c "found alpn extension" \
1289 -c "Application Layer Protocol is 1234" \
1290 -s "Application Layer Protocol is 1234"
1291
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001292run_test "ALPN: both, no common" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001293 "$P_SRV debug_level=3 alpn=abc,123" \
1294 "$P_CLI debug_level=3 alpn=1234,abcde" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001295 1 \
1296 -c "client hello, adding alpn extension" \
1297 -s "found alpn extension" \
1298 -c "got an alert message, type: \\[2:120]" \
1299 -S "server hello, adding alpn extension" \
1300 -C "found alpn extension" \
1301 -C "Application Layer Protocol is 1234" \
1302 -S "Application Layer Protocol is 1234"
1303
Manuel Pégourié-Gonnard83d8c732014-04-07 13:24:21 +02001304fi
1305
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001306# Tests for keyUsage in leaf certificates, part 1:
1307# server-side certificate/suite selection
1308
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001309run_test "keyUsage srv: RSA, digitalSignature -> (EC)DHE-RSA" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001310 "$P_SRV key_file=data_files/server2.key \
1311 crt_file=data_files/server2.ku-ds.crt" \
1312 "$P_CLI" \
1313 0 \
Manuel Pégourié-Gonnard17cde5f2014-05-22 14:42:39 +02001314 -c "Ciphersuite is TLS-[EC]*DHE-RSA-WITH-"
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001315
1316
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001317run_test "keyUsage srv: RSA, keyEncipherment -> RSA" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001318 "$P_SRV key_file=data_files/server2.key \
1319 crt_file=data_files/server2.ku-ke.crt" \
1320 "$P_CLI" \
1321 0 \
1322 -c "Ciphersuite is TLS-RSA-WITH-"
1323
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001324run_test "keyUsage srv: RSA, keyAgreement -> fail" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02001325 "$P_SRV key_file=data_files/server2.key \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001326 crt_file=data_files/server2.ku-ka.crt" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02001327 "$P_CLI" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001328 1 \
1329 -C "Ciphersuite is "
1330
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001331run_test "keyUsage srv: ECDSA, digitalSignature -> ECDHE-ECDSA" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001332 "$P_SRV key_file=data_files/server5.key \
1333 crt_file=data_files/server5.ku-ds.crt" \
1334 "$P_CLI" \
1335 0 \
1336 -c "Ciphersuite is TLS-ECDHE-ECDSA-WITH-"
1337
1338
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001339run_test "keyUsage srv: ECDSA, keyAgreement -> ECDH-" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001340 "$P_SRV key_file=data_files/server5.key \
1341 crt_file=data_files/server5.ku-ka.crt" \
1342 "$P_CLI" \
1343 0 \
1344 -c "Ciphersuite is TLS-ECDH-"
1345
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001346run_test "keyUsage srv: ECDSA, keyEncipherment -> fail" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02001347 "$P_SRV key_file=data_files/server5.key \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001348 crt_file=data_files/server5.ku-ke.crt" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02001349 "$P_CLI" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001350 1 \
1351 -C "Ciphersuite is "
1352
1353# Tests for keyUsage in leaf certificates, part 2:
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001354# client-side checking of server cert
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001355
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001356run_test "keyUsage cli: DigitalSignature+KeyEncipherment, RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001357 "$O_SRV -key data_files/server2.key \
1358 -cert data_files/server2.ku-ds_ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001359 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001360 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
1361 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001362 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001363 -C "Processing of the Certificate handshake message failed" \
1364 -c "Ciphersuite is TLS-"
1365
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001366run_test "keyUsage cli: DigitalSignature+KeyEncipherment, DHE-RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001367 "$O_SRV -key data_files/server2.key \
1368 -cert data_files/server2.ku-ds_ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001369 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001370 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
1371 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001372 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001373 -C "Processing of the Certificate handshake message failed" \
1374 -c "Ciphersuite is TLS-"
1375
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001376run_test "keyUsage cli: KeyEncipherment, RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001377 "$O_SRV -key data_files/server2.key \
1378 -cert data_files/server2.ku-ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001379 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001380 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
1381 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001382 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001383 -C "Processing of the Certificate handshake message failed" \
1384 -c "Ciphersuite is TLS-"
1385
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001386run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001387 "$O_SRV -key data_files/server2.key \
1388 -cert data_files/server2.ku-ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001389 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001390 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
1391 1 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001392 -c "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001393 -c "Processing of the Certificate handshake message failed" \
1394 -C "Ciphersuite is TLS-"
1395
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001396run_test "keyUsage cli: DigitalSignature, DHE-RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001397 "$O_SRV -key data_files/server2.key \
1398 -cert data_files/server2.ku-ds.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001399 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001400 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
1401 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001402 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001403 -C "Processing of the Certificate handshake message failed" \
1404 -c "Ciphersuite is TLS-"
1405
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001406run_test "keyUsage cli: DigitalSignature, RSA: fail" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001407 "$O_SRV -key data_files/server2.key \
1408 -cert data_files/server2.ku-ds.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001409 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001410 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
1411 1 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001412 -c "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001413 -c "Processing of the Certificate handshake message failed" \
1414 -C "Ciphersuite is TLS-"
1415
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001416# Tests for keyUsage in leaf certificates, part 3:
1417# server-side checking of client cert
1418
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001419run_test "keyUsage cli-auth: RSA, DigitalSignature: OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001420 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001421 "$O_CLI -key data_files/server2.key \
1422 -cert data_files/server2.ku-ds.crt" \
1423 0 \
1424 -S "bad certificate (usage extensions)" \
1425 -S "Processing of the Certificate handshake message failed"
1426
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001427run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (soft)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001428 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001429 "$O_CLI -key data_files/server2.key \
1430 -cert data_files/server2.ku-ke.crt" \
1431 0 \
1432 -s "bad certificate (usage extensions)" \
1433 -S "Processing of the Certificate handshake message failed"
1434
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001435run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (hard)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001436 "$P_SRV debug_level=1 auth_mode=required" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001437 "$O_CLI -key data_files/server2.key \
1438 -cert data_files/server2.ku-ke.crt" \
1439 1 \
1440 -s "bad certificate (usage extensions)" \
1441 -s "Processing of the Certificate handshake message failed"
1442
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001443run_test "keyUsage cli-auth: ECDSA, DigitalSignature: OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001444 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001445 "$O_CLI -key data_files/server5.key \
1446 -cert data_files/server5.ku-ds.crt" \
1447 0 \
1448 -S "bad certificate (usage extensions)" \
1449 -S "Processing of the Certificate handshake message failed"
1450
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001451run_test "keyUsage cli-auth: ECDSA, KeyAgreement: fail (soft)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001452 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001453 "$O_CLI -key data_files/server5.key \
1454 -cert data_files/server5.ku-ka.crt" \
1455 0 \
1456 -s "bad certificate (usage extensions)" \
1457 -S "Processing of the Certificate handshake message failed"
1458
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001459# Tests for extendedKeyUsage, part 1: server-side certificate/suite selection
1460
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001461run_test "extKeyUsage srv: serverAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001462 "$P_SRV key_file=data_files/server5.key \
1463 crt_file=data_files/server5.eku-srv.crt" \
1464 "$P_CLI" \
1465 0
1466
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001467run_test "extKeyUsage srv: serverAuth,clientAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001468 "$P_SRV key_file=data_files/server5.key \
1469 crt_file=data_files/server5.eku-srv.crt" \
1470 "$P_CLI" \
1471 0
1472
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001473run_test "extKeyUsage srv: codeSign,anyEKU -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001474 "$P_SRV key_file=data_files/server5.key \
1475 crt_file=data_files/server5.eku-cs_any.crt" \
1476 "$P_CLI" \
1477 0
1478
1479# add psk to leave an option for client to send SERVERQUIT
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001480run_test "extKeyUsage srv: codeSign -> fail" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001481 "$P_SRV psk=abc123 key_file=data_files/server5.key \
1482 crt_file=data_files/server5.eku-cli.crt" \
1483 "$P_CLI psk=badbad" \
1484 1
1485
1486# Tests for extendedKeyUsage, part 2: client-side checking of server cert
1487
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001488run_test "extKeyUsage cli: serverAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001489 "$O_SRV -key data_files/server5.key \
1490 -cert data_files/server5.eku-srv.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001491 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001492 0 \
1493 -C "bad certificate (usage extensions)" \
1494 -C "Processing of the Certificate handshake message failed" \
1495 -c "Ciphersuite is TLS-"
1496
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001497run_test "extKeyUsage cli: serverAuth,clientAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001498 "$O_SRV -key data_files/server5.key \
1499 -cert data_files/server5.eku-srv_cli.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001500 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001501 0 \
1502 -C "bad certificate (usage extensions)" \
1503 -C "Processing of the Certificate handshake message failed" \
1504 -c "Ciphersuite is TLS-"
1505
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001506run_test "extKeyUsage cli: codeSign,anyEKU -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001507 "$O_SRV -key data_files/server5.key \
1508 -cert data_files/server5.eku-cs_any.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001509 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001510 0 \
1511 -C "bad certificate (usage extensions)" \
1512 -C "Processing of the Certificate handshake message failed" \
1513 -c "Ciphersuite is TLS-"
1514
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001515run_test "extKeyUsage cli: codeSign -> fail" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001516 "$O_SRV -key data_files/server5.key \
1517 -cert data_files/server5.eku-cs.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001518 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001519 1 \
1520 -c "bad certificate (usage extensions)" \
1521 -c "Processing of the Certificate handshake message failed" \
1522 -C "Ciphersuite is TLS-"
1523
1524# Tests for extendedKeyUsage, part 3: server-side checking of client cert
1525
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001526run_test "extKeyUsage cli-auth: clientAuth -> OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001527 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001528 "$O_CLI -key data_files/server5.key \
1529 -cert data_files/server5.eku-cli.crt" \
1530 0 \
1531 -S "bad certificate (usage extensions)" \
1532 -S "Processing of the Certificate handshake message failed"
1533
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001534run_test "extKeyUsage cli-auth: serverAuth,clientAuth -> OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001535 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001536 "$O_CLI -key data_files/server5.key \
1537 -cert data_files/server5.eku-srv_cli.crt" \
1538 0 \
1539 -S "bad certificate (usage extensions)" \
1540 -S "Processing of the Certificate handshake message failed"
1541
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001542run_test "extKeyUsage cli-auth: codeSign,anyEKU -> OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001543 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001544 "$O_CLI -key data_files/server5.key \
1545 -cert data_files/server5.eku-cs_any.crt" \
1546 0 \
1547 -S "bad certificate (usage extensions)" \
1548 -S "Processing of the Certificate handshake message failed"
1549
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001550run_test "extKeyUsage cli-auth: codeSign -> fail (soft)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001551 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001552 "$O_CLI -key data_files/server5.key \
1553 -cert data_files/server5.eku-cs.crt" \
1554 0 \
1555 -s "bad certificate (usage extensions)" \
1556 -S "Processing of the Certificate handshake message failed"
1557
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001558run_test "extKeyUsage cli-auth: codeSign -> fail (hard)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001559 "$P_SRV debug_level=1 auth_mode=required" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001560 "$O_CLI -key data_files/server5.key \
1561 -cert data_files/server5.eku-cs.crt" \
1562 1 \
1563 -s "bad certificate (usage extensions)" \
1564 -s "Processing of the Certificate handshake message failed"
1565
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02001566# Tests for DHM parameters loading
1567
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001568run_test "DHM parameters: reference" \
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02001569 "$P_SRV" \
1570 "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
1571 debug_level=3" \
1572 0 \
1573 -c "value of 'DHM: P ' (2048 bits)" \
1574 -c "value of 'DHM: G ' (2048 bits)"
1575
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001576run_test "DHM parameters: other parameters" \
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02001577 "$P_SRV dhm_file=data_files/dhparams.pem" \
1578 "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
1579 debug_level=3" \
1580 0 \
1581 -c "value of 'DHM: P ' (1024 bits)" \
1582 -c "value of 'DHM: G ' (2 bits)"
1583
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001584# Tests for PSK callback
1585
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001586run_test "PSK callback: psk, no callback" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001587 "$P_SRV psk=abc123 psk_identity=foo" \
1588 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1589 psk_identity=foo psk=abc123" \
1590 0 \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001591 -S "SSL - The server has no ciphersuites in common" \
1592 -S "SSL - Unknown identity received" \
1593 -S "SSL - Verification of the message MAC failed"
1594
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001595run_test "PSK callback: no psk, no callback" \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001596 "$P_SRV" \
1597 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1598 psk_identity=foo psk=abc123" \
1599 1 \
1600 -s "SSL - The server has no ciphersuites in common" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001601 -S "SSL - Unknown identity received" \
1602 -S "SSL - Verification of the message MAC failed"
1603
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001604run_test "PSK callback: callback overrides other settings" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001605 "$P_SRV psk=abc123 psk_identity=foo psk_list=abc,dead,def,beef" \
1606 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1607 psk_identity=foo psk=abc123" \
1608 1 \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001609 -S "SSL - The server has no ciphersuites in common" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001610 -s "SSL - Unknown identity received" \
1611 -S "SSL - Verification of the message MAC failed"
1612
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001613run_test "PSK callback: first id matches" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001614 "$P_SRV psk_list=abc,dead,def,beef" \
1615 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1616 psk_identity=abc psk=dead" \
1617 0 \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001618 -S "SSL - The server has no ciphersuites in common" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001619 -S "SSL - Unknown identity received" \
1620 -S "SSL - Verification of the message MAC failed"
1621
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001622run_test "PSK callback: second id matches" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001623 "$P_SRV psk_list=abc,dead,def,beef" \
1624 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1625 psk_identity=def psk=beef" \
1626 0 \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001627 -S "SSL - The server has no ciphersuites in common" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001628 -S "SSL - Unknown identity received" \
1629 -S "SSL - Verification of the message MAC failed"
1630
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001631run_test "PSK callback: no match" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001632 "$P_SRV psk_list=abc,dead,def,beef" \
1633 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1634 psk_identity=ghi psk=beef" \
1635 1 \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001636 -S "SSL - The server has no ciphersuites in common" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001637 -s "SSL - Unknown identity received" \
1638 -S "SSL - Verification of the message MAC failed"
1639
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001640run_test "PSK callback: wrong key" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001641 "$P_SRV psk_list=abc,dead,def,beef" \
1642 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1643 psk_identity=abc psk=beef" \
1644 1 \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001645 -S "SSL - The server has no ciphersuites in common" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001646 -S "SSL - Unknown identity received" \
1647 -s "SSL - Verification of the message MAC failed"
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02001648
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02001649# Tests for ciphersuites per version
1650
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001651run_test "Per-version suites: SSL3" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02001652 "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
1653 "$P_CLI force_version=ssl3" \
1654 0 \
1655 -c "Ciphersuite is TLS-RSA-WITH-3DES-EDE-CBC-SHA"
1656
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001657run_test "Per-version suites: TLS 1.0" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02001658 "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
1659 "$P_CLI force_version=tls1" \
1660 0 \
1661 -c "Ciphersuite is TLS-RSA-WITH-RC4-128-SHA"
1662
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001663run_test "Per-version suites: TLS 1.1" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02001664 "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
1665 "$P_CLI force_version=tls1_1" \
1666 0 \
1667 -c "Ciphersuite is TLS-RSA-WITH-AES-128-CBC-SHA"
1668
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001669run_test "Per-version suites: TLS 1.2" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02001670 "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
1671 "$P_CLI force_version=tls1_2" \
1672 0 \
1673 -c "Ciphersuite is TLS-RSA-WITH-AES-128-GCM-SHA256"
1674
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +02001675# Tests for ssl_get_bytes_avail()
1676
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001677run_test "ssl_get_bytes_avail: no extra data" \
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +02001678 "$P_SRV" \
1679 "$P_CLI request_size=100" \
1680 0 \
1681 -s "Read from client: 100 bytes read$"
1682
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001683run_test "ssl_get_bytes_avail: extra data" \
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +02001684 "$P_SRV" \
1685 "$P_CLI request_size=500" \
1686 0 \
1687 -s "Read from client: 500 bytes read (.*+.*)"
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02001688
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02001689# Tests for small packets
1690
1691run_test "Small packet SSLv3 BlockCipher" \
1692 "$P_SRV" \
1693 "$P_CLI request_size=1 force_version=ssl3 \
1694 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1695 0 \
1696 -s "Read from client: 1 bytes read"
1697
1698run_test "Small packet SSLv3 StreamCipher" \
1699 "$P_SRV" \
1700 "$P_CLI request_size=1 force_version=ssl3 \
1701 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
1702 0 \
1703 -s "Read from client: 1 bytes read"
1704
1705run_test "Small packet TLS 1.0 BlockCipher" \
1706 "$P_SRV" \
1707 "$P_CLI request_size=1 force_version=tls1 \
1708 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1709 0 \
1710 -s "Read from client: 1 bytes read"
1711
1712run_test "Small packet TLS 1.0 BlockCipher truncated MAC" \
1713 "$P_SRV" \
1714 "$P_CLI request_size=1 force_version=tls1 \
1715 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
1716 trunc_hmac=1" \
1717 0 \
1718 -s "Read from client: 1 bytes read"
1719
1720run_test "Small packet TLS 1.0 StreamCipher truncated MAC" \
1721 "$P_SRV" \
1722 "$P_CLI request_size=1 force_version=tls1 \
1723 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
1724 trunc_hmac=1" \
1725 0 \
1726 -s "Read from client: 1 bytes read"
1727
1728run_test "Small packet TLS 1.1 BlockCipher" \
1729 "$P_SRV" \
1730 "$P_CLI request_size=1 force_version=tls1_1 \
1731 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1732 0 \
1733 -s "Read from client: 1 bytes read"
1734
1735run_test "Small packet TLS 1.1 StreamCipher" \
1736 "$P_SRV" \
1737 "$P_CLI request_size=1 force_version=tls1_1 \
1738 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
1739 0 \
1740 -s "Read from client: 1 bytes read"
1741
1742run_test "Small packet TLS 1.1 BlockCipher truncated MAC" \
1743 "$P_SRV" \
1744 "$P_CLI request_size=1 force_version=tls1_1 \
1745 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
1746 trunc_hmac=1" \
1747 0 \
1748 -s "Read from client: 1 bytes read"
1749
1750run_test "Small packet TLS 1.1 StreamCipher truncated MAC" \
1751 "$P_SRV" \
1752 "$P_CLI request_size=1 force_version=tls1_1 \
1753 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
1754 trunc_hmac=1" \
1755 0 \
1756 -s "Read from client: 1 bytes read"
1757
1758run_test "Small packet TLS 1.2 BlockCipher" \
1759 "$P_SRV" \
1760 "$P_CLI request_size=1 force_version=tls1_2 \
1761 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1762 0 \
1763 -s "Read from client: 1 bytes read"
1764
1765run_test "Small packet TLS 1.2 BlockCipher larger MAC" \
1766 "$P_SRV" \
1767 "$P_CLI request_size=1 force_version=tls1_2 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \
1768 0 \
1769 -s "Read from client: 1 bytes read"
1770
1771run_test "Small packet TLS 1.2 BlockCipher truncated MAC" \
1772 "$P_SRV" \
1773 "$P_CLI request_size=1 force_version=tls1_2 \
1774 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
1775 trunc_hmac=1" \
1776 0 \
1777 -s "Read from client: 1 bytes read"
1778
1779run_test "Small packet TLS 1.2 StreamCipher" \
1780 "$P_SRV" \
1781 "$P_CLI request_size=1 force_version=tls1_2 \
1782 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
1783 0 \
1784 -s "Read from client: 1 bytes read"
1785
1786run_test "Small packet TLS 1.2 StreamCipher truncated MAC" \
1787 "$P_SRV" \
1788 "$P_CLI request_size=1 force_version=tls1_2 \
1789 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
1790 trunc_hmac=1" \
1791 0 \
1792 -s "Read from client: 1 bytes read"
1793
1794run_test "Small packet TLS 1.2 AEAD" \
1795 "$P_SRV" \
1796 "$P_CLI request_size=1 force_version=tls1_2 \
1797 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \
1798 0 \
1799 -s "Read from client: 1 bytes read"
1800
1801run_test "Small packet TLS 1.2 AEAD shorter tag" \
1802 "$P_SRV" \
1803 "$P_CLI request_size=1 force_version=tls1_2 \
1804 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \
1805 0 \
1806 -s "Read from client: 1 bytes read"
1807
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02001808# Test for large packets
1809
1810run_test "Large packet SSLv3 BlockCipher" \
1811 "$P_SRV" \
1812 "$P_CLI request_size=16384 force_version=ssl3 \
1813 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1814 0 \
1815 -s "Read from client: 16384 bytes read"
1816
1817run_test "Large packet SSLv3 StreamCipher" \
1818 "$P_SRV" \
1819 "$P_CLI request_size=16384 force_version=ssl3 \
1820 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
1821 0 \
1822 -s "Read from client: 16384 bytes read"
1823
1824run_test "Large packet TLS 1.0 BlockCipher" \
1825 "$P_SRV" \
1826 "$P_CLI request_size=16384 force_version=tls1 \
1827 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1828 0 \
1829 -s "Read from client: 16384 bytes read"
1830
1831run_test "Large packet TLS 1.0 BlockCipher truncated MAC" \
1832 "$P_SRV" \
1833 "$P_CLI request_size=16384 force_version=tls1 \
1834 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
1835 trunc_hmac=1" \
1836 0 \
1837 -s "Read from client: 16384 bytes read"
1838
1839run_test "Large packet TLS 1.0 StreamCipher truncated MAC" \
1840 "$P_SRV" \
1841 "$P_CLI request_size=16384 force_version=tls1 \
1842 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
1843 trunc_hmac=1" \
1844 0 \
1845 -s "Read from client: 16384 bytes read"
1846
1847run_test "Large packet TLS 1.1 BlockCipher" \
1848 "$P_SRV" \
1849 "$P_CLI request_size=16384 force_version=tls1_1 \
1850 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1851 0 \
1852 -s "Read from client: 16384 bytes read"
1853
1854run_test "Large packet TLS 1.1 StreamCipher" \
1855 "$P_SRV" \
1856 "$P_CLI request_size=16384 force_version=tls1_1 \
1857 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
1858 0 \
1859 -s "Read from client: 16384 bytes read"
1860
1861run_test "Large packet TLS 1.1 BlockCipher truncated MAC" \
1862 "$P_SRV" \
1863 "$P_CLI request_size=16384 force_version=tls1_1 \
1864 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
1865 trunc_hmac=1" \
1866 0 \
1867 -s "Read from client: 16384 bytes read"
1868
1869run_test "Large packet TLS 1.1 StreamCipher truncated MAC" \
1870 "$P_SRV" \
1871 "$P_CLI request_size=16384 force_version=tls1_1 \
1872 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
1873 trunc_hmac=1" \
1874 0 \
1875 -s "Read from client: 16384 bytes read"
1876
1877run_test "Large packet TLS 1.2 BlockCipher" \
1878 "$P_SRV" \
1879 "$P_CLI request_size=16384 force_version=tls1_2 \
1880 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1881 0 \
1882 -s "Read from client: 16384 bytes read"
1883
1884run_test "Large packet TLS 1.2 BlockCipher larger MAC" \
1885 "$P_SRV" \
1886 "$P_CLI request_size=16384 force_version=tls1_2 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \
1887 0 \
1888 -s "Read from client: 16384 bytes read"
1889
1890run_test "Large packet TLS 1.2 BlockCipher truncated MAC" \
1891 "$P_SRV" \
1892 "$P_CLI request_size=16384 force_version=tls1_2 \
1893 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
1894 trunc_hmac=1" \
1895 0 \
1896 -s "Read from client: 16384 bytes read"
1897
1898run_test "Large packet TLS 1.2 StreamCipher" \
1899 "$P_SRV" \
1900 "$P_CLI request_size=16384 force_version=tls1_2 \
1901 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
1902 0 \
1903 -s "Read from client: 16384 bytes read"
1904
1905run_test "Large packet TLS 1.2 StreamCipher truncated MAC" \
1906 "$P_SRV" \
1907 "$P_CLI request_size=16384 force_version=tls1_2 \
1908 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
1909 trunc_hmac=1" \
1910 0 \
1911 -s "Read from client: 16384 bytes read"
1912
1913run_test "Large packet TLS 1.2 AEAD" \
1914 "$P_SRV" \
1915 "$P_CLI request_size=16384 force_version=tls1_2 \
1916 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \
1917 0 \
1918 -s "Read from client: 16384 bytes read"
1919
1920run_test "Large packet TLS 1.2 AEAD shorter tag" \
1921 "$P_SRV" \
1922 "$P_CLI request_size=16384 force_version=tls1_2 \
1923 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \
1924 0 \
1925 -s "Read from client: 16384 bytes read"
1926
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001927# Tests for DTLS HelloVerifyRequest
1928
1929run_test "DTLS cookie: enabled" \
1930 "$P_SRV dtls=1 debug_level=2" \
1931 "$P_CLI dtls=1 debug_level=2" \
1932 0 \
1933 -s "cookie verification failed" \
1934 -s "cookie verification passed" \
1935 -S "cookie verification skipped" \
1936 -c "received hello verify request" \
1937 -S "SSL - The requested feature is not available"
1938
1939run_test "DTLS cookie: disabled" \
1940 "$P_SRV dtls=1 debug_level=2 cookies=0" \
1941 "$P_CLI dtls=1 debug_level=2" \
1942 0 \
1943 -S "cookie verification failed" \
1944 -S "cookie verification passed" \
1945 -s "cookie verification skipped" \
1946 -C "received hello verify request" \
1947 -S "SSL - The requested feature is not available"
1948
1949# wait for client having a timeout, or server sending an alert
1950#run_test "DTLS cookie: default (failing)" \
1951# "$P_SRV dtls=1 debug_level=2 cookies=-1" \
1952# "$P_CLI dtls=1 debug_level=2" \
1953# 0 \
1954# -S "cookie verification failed" \
1955# -S "cookie verification passed" \
1956# -S "cookie verification skipped" \
1957# -C "received hello verify request" \
1958# -s "SSL - The requested feature is not available"
1959
1960requires_ipv6
1961run_test "DTLS cookie: enabled, IPv6" \
1962 "$P_SRV dtls=1 debug_level=2 server_addr=::1" \
1963 "$P_CLI dtls=1 debug_level=2 server_addr=::1" \
1964 0 \
1965 -s "cookie verification failed" \
1966 -s "cookie verification passed" \
1967 -S "cookie verification skipped" \
1968 -c "received hello verify request" \
1969 -S "SSL - The requested feature is not available"
1970
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02001971# Tests for receiving fragmented handshake messages with DTLS
1972
1973requires_gnutls
Manuel Pégourié-Gonnard77b0b8d2014-08-31 20:19:40 +02001974not_with_valgrind
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02001975run_test "DTLS reassembly: no fragmentation (gnutls server)" \
1976 "$G_SRV -u --mtu 2048 -a" \
1977 "$P_CLI dtls=1 debug_level=2" \
1978 0 \
1979 -C "found fragmented DTLS handshake message" \
1980 -C "error"
1981
1982requires_gnutls
Manuel Pégourié-Gonnard77b0b8d2014-08-31 20:19:40 +02001983not_with_valgrind
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02001984run_test "DTLS reassembly: some fragmentation (gnutls server)" \
1985 "$G_SRV -u --mtu 512" \
1986 "$P_CLI dtls=1 debug_level=2" \
1987 0 \
1988 -c "found fragmented DTLS handshake message" \
1989 -C "error"
1990
1991requires_gnutls
Manuel Pégourié-Gonnard77b0b8d2014-08-31 20:19:40 +02001992not_with_valgrind
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02001993run_test "DTLS reassembly: more fragmentation (gnutls server)" \
1994 "$G_SRV -u --mtu 128" \
1995 "$P_CLI dtls=1 debug_level=2" \
1996 0 \
1997 -c "found fragmented DTLS handshake message" \
1998 -C "error"
1999
2000requires_gnutls
Manuel Pégourié-Gonnard77b0b8d2014-08-31 20:19:40 +02002001not_with_valgrind
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02002002run_test "DTLS reassembly: more fragmentation, nbio (gnutls server)" \
2003 "$G_SRV -u --mtu 128" \
2004 "$P_CLI dtls=1 nbio=2 debug_level=2" \
2005 0 \
2006 -c "found fragmented DTLS handshake message" \
2007 -C "error"
2008
Manuel Pégourié-Gonnard0c4cbc72014-09-02 14:47:31 +02002009requires_gnutls
2010not_with_valgrind
2011run_test "DTLS reassembly: fragmentation, renego (gnutls server)" \
2012 "$G_SRV -u --mtu 256" \
2013 "$P_CLI debug_level=3 dtls=1 renegotiation=1 renegotiate=1" \
2014 0 \
2015 -c "found fragmented DTLS handshake message" \
2016 -c "client hello, adding renegotiation extension" \
2017 -c "found renegotiation extension" \
2018 -c "=> renegotiate" \
2019 -C "ssl_handshake returned" \
2020 -C "error" \
2021 -s "Extra-header:"
2022
2023requires_gnutls
2024not_with_valgrind
2025run_test "DTLS reassembly: fragmentation, nbio, renego (gnutls server)" \
2026 "$G_SRV -u --mtu 256" \
2027 "$P_CLI debug_level=3 nbio=2 dtls=1 renegotiation=1 renegotiate=1" \
2028 0 \
2029 -c "found fragmented DTLS handshake message" \
2030 -c "client hello, adding renegotiation extension" \
2031 -c "found renegotiation extension" \
2032 -c "=> renegotiate" \
2033 -C "ssl_handshake returned" \
2034 -C "error" \
2035 -s "Extra-header:"
2036
Manuel Pégourié-Gonnard77b0b8d2014-08-31 20:19:40 +02002037not_with_valgrind
Manuel Pégourié-Gonnarda7756172014-08-31 18:37:01 +02002038run_test "DTLS reassembly: no fragmentation (openssl server)" \
2039 "$O_SRV -dtls1 -mtu 2048" \
2040 "$P_CLI dtls=1 debug_level=2" \
2041 0 \
2042 -C "found fragmented DTLS handshake message" \
2043 -C "error"
2044
Manuel Pégourié-Gonnard77b0b8d2014-08-31 20:19:40 +02002045not_with_valgrind
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02002046run_test "DTLS reassembly: fragmentation (openssl server)" \
2047 "$O_SRV -dtls1 -mtu 256" \
2048 "$P_CLI dtls=1 debug_level=2" \
2049 0 \
2050 -c "found fragmented DTLS handshake message" \
2051 -C "error"
2052
Manuel Pégourié-Gonnard77b0b8d2014-08-31 20:19:40 +02002053not_with_valgrind
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02002054run_test "DTLS reassembly: fragmentation (openssl server)" \
2055 "$O_SRV -dtls1 -mtu 256" \
2056 "$P_CLI dtls=1 debug_level=2" \
2057 0 \
2058 -c "found fragmented DTLS handshake message" \
2059 -C "error"
2060
Manuel Pégourié-Gonnard77b0b8d2014-08-31 20:19:40 +02002061not_with_valgrind
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02002062run_test "DTLS reassembly: fragmentation, nbio (openssl server)" \
2063 "$O_SRV -dtls1 -mtu 256" \
2064 "$P_CLI dtls=1 nbio=2 debug_level=2" \
2065 0 \
2066 -c "found fragmented DTLS handshake message" \
2067 -C "error"
Manuel Pégourié-Gonnarda7756172014-08-31 18:37:01 +02002068
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01002069# Final report
2070
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01002071echo "------------------------------------------------------------------------"
2072
2073if [ $FAILS = 0 ]; then
2074 echo -n "PASSED"
2075else
2076 echo -n "FAILED"
2077fi
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02002078PASSES=$(( $TESTS - $FAILS ))
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +02002079echo " ($PASSES / $TESTS tests ($SKIPS skipped))"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01002080
2081exit $FAILS