Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1 | #!/bin/sh |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 2 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 3 | # compat.sh |
| 4 | # |
Bence Szépkúti | 1e14827 | 2020-08-07 13:07:28 +0200 | [diff] [blame] | 5 | # Copyright The Mbed TLS Contributors |
Bence Szépkúti | c7da1fe | 2020-05-26 01:54:15 +0200 | [diff] [blame] | 6 | # SPDX-License-Identifier: Apache-2.0 |
| 7 | # |
| 8 | # Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 9 | # not use this file except in compliance with the License. |
| 10 | # You may obtain a copy of the License at |
| 11 | # |
| 12 | # http://www.apache.org/licenses/LICENSE-2.0 |
| 13 | # |
| 14 | # Unless required by applicable law or agreed to in writing, software |
| 15 | # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 16 | # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 17 | # See the License for the specific language governing permissions and |
| 18 | # limitations under the License. |
| 19 | # |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 20 | # Purpose |
| 21 | # |
| 22 | # Test interoperbility with OpenSSL, GnuTLS as well as itself. |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 23 | # |
| 24 | # Check each common ciphersuite, with each version, both ways (client/server), |
| 25 | # with and without client authentication. |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 26 | |
Manuel Pégourié-Gonnard | 913030c | 2014-03-28 10:12:38 +0100 | [diff] [blame] | 27 | set -u |
| 28 | |
Jaeden Amero | 6e70eb2 | 2019-07-03 13:51:04 +0100 | [diff] [blame] | 29 | # Limit the size of each log to 10 GiB, in case of failures with this script |
| 30 | # where it may output seemingly unlimited length error logs. |
| 31 | ulimit -f 20971520 |
| 32 | |
Manuel Pégourié-Gonnard | a1a9f9a | 2014-03-25 18:04:59 +0100 | [diff] [blame] | 33 | # initialise counters |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 34 | TESTS=0 |
| 35 | FAILED=0 |
| 36 | SKIPPED=0 |
| 37 | SRVMEM=0 |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 38 | |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 39 | # default commands, can be overridden by the environment |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 40 | : ${M_SRV:=../programs/ssl/ssl_server2} |
| 41 | : ${M_CLI:=../programs/ssl/ssl_client2} |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 42 | : ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system |
| 43 | : ${GNUTLS_CLI:=gnutls-cli} |
| 44 | : ${GNUTLS_SERV:=gnutls-serv} |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 45 | |
Manuel Pégourié-Gonnard | 1287f11 | 2014-08-31 16:20:58 +0200 | [diff] [blame] | 46 | # do we have a recent enough GnuTLS? |
Manuel Pégourié-Gonnard | 03db6b0 | 2015-06-26 15:45:30 +0200 | [diff] [blame] | 47 | if ( which $GNUTLS_CLI && which $GNUTLS_SERV ) >/dev/null 2>&1; then |
Manuel Pégourié-Gonnard | dd45927 | 2014-10-24 12:57:37 +0200 | [diff] [blame] | 48 | G_VER="$( $GNUTLS_CLI --version | head -n1 )" |
| 49 | if echo "$G_VER" | grep '@VERSION@' > /dev/null; then # git version |
Manuel Pégourié-Gonnard | 1287f11 | 2014-08-31 16:20:58 +0200 | [diff] [blame] | 50 | PEER_GNUTLS=" GnuTLS" |
Manuel Pégourié-Gonnard | dd45927 | 2014-10-24 12:57:37 +0200 | [diff] [blame] | 51 | else |
| 52 | eval $( echo $G_VER | sed 's/.* \([0-9]*\)\.\([0-9]\)*\.\([0-9]*\)$/MAJOR="\1" MINOR="\2" PATCH="\3"/' ) |
| 53 | if [ $MAJOR -lt 3 -o \ |
| 54 | \( $MAJOR -eq 3 -a $MINOR -lt 2 \) -o \ |
| 55 | \( $MAJOR -eq 3 -a $MINOR -eq 2 -a $PATCH -lt 15 \) ] |
| 56 | then |
| 57 | PEER_GNUTLS="" |
| 58 | else |
| 59 | PEER_GNUTLS=" GnuTLS" |
Manuel Pégourié-Gonnard | c36b432 | 2018-06-14 13:14:29 +0200 | [diff] [blame] | 60 | if [ $MINOR -lt 4 ]; then |
| 61 | GNUTLS_MINOR_LT_FOUR='x' |
| 62 | fi |
Manuel Pégourié-Gonnard | dd45927 | 2014-10-24 12:57:37 +0200 | [diff] [blame] | 63 | fi |
Manuel Pégourié-Gonnard | 1287f11 | 2014-08-31 16:20:58 +0200 | [diff] [blame] | 64 | fi |
| 65 | else |
| 66 | PEER_GNUTLS="" |
| 67 | fi |
| 68 | |
Manuel Pégourié-Gonnard | a1a9f9a | 2014-03-25 18:04:59 +0100 | [diff] [blame] | 69 | # default values for options |
TRodziewicz | 0f82ec6 | 2021-05-12 17:49:18 +0200 | [diff] [blame^] | 70 | MODES="tls1_2 dtls1_2" |
Paul Bakker | 1eeceae | 2012-11-23 14:25:34 +0100 | [diff] [blame] | 71 | VERIFIES="NO YES" |
Manuel Pégourié-Gonnard | 7ebaf37 | 2013-08-27 21:03:33 +0200 | [diff] [blame] | 72 | TYPES="ECDSA RSA PSK" |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 73 | FILTER="" |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 74 | # exclude: |
| 75 | # - NULL: excluded from our default config |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 76 | # avoid plain DES but keep 3DES-EDE-CBC (mbedTLS), DES-CBC3 (OpenSSL) |
Manuel Pégourié-Gonnard | 2268b96 | 2018-02-27 12:22:36 +0100 | [diff] [blame] | 77 | # - ARIA: not in default config.h + requires OpenSSL >= 1.1.1 |
Manuel Pégourié-Gonnard | 9fece7e | 2018-06-18 11:38:22 +0200 | [diff] [blame] | 78 | # - ChachaPoly: requires OpenSSL >= 1.1.0 |
Andres Amaya Garcia | bdfba79 | 2019-02-11 21:47:30 +0000 | [diff] [blame] | 79 | # - 3DES: not in default config |
Mateusz Starzyk | 5224e29 | 2021-02-22 14:36:29 +0100 | [diff] [blame] | 80 | EXCLUDE='NULL\|DES\|ARIA\|CHACHA20-POLY1305' |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 81 | VERBOSE="" |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 82 | MEMCHECK=0 |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 83 | PEERS="OpenSSL$PEER_GNUTLS mbedTLS" |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 84 | |
Manuel Pégourié-Gonnard | 39e2ca9 | 2015-08-04 16:43:37 +0200 | [diff] [blame] | 85 | # hidden option: skip DTLS with OpenSSL |
| 86 | # (travis CI has a version that doesn't work for us) |
| 87 | : ${OSSL_NO_DTLS:=0} |
| 88 | |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 89 | print_usage() { |
| 90 | echo "Usage: $0" |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 91 | printf " -h|--help\tPrint this help.\n" |
Gilles Peskine | 231befa | 2020-08-26 20:05:11 +0200 | [diff] [blame] | 92 | printf " -f|--filter\tOnly matching ciphersuites are tested (Default: '%s')\n" "$FILTER" |
| 93 | printf " -e|--exclude\tMatching ciphersuites are excluded (Default: '%s')\n" "$EXCLUDE" |
| 94 | printf " -m|--modes\tWhich modes to perform (Default: '%s')\n" "$MODES" |
| 95 | printf " -t|--types\tWhich key exchange type to perform (Default: '%s')\n" "$TYPES" |
| 96 | printf " -V|--verify\tWhich verification modes to perform (Default: '%s')\n" "$VERIFIES" |
| 97 | printf " -p|--peers\tWhich peers to use (Default: '%s')\n" "$PEERS" |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 98 | printf " \tAlso available: GnuTLS (needs v3.2.15 or higher)\n" |
| 99 | printf " -M|--memcheck\tCheck memory leaks and errors.\n" |
| 100 | printf " -v|--verbose\tSet verbose output.\n" |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 101 | } |
| 102 | |
| 103 | get_options() { |
| 104 | while [ $# -gt 0 ]; do |
| 105 | case "$1" in |
| 106 | -f|--filter) |
| 107 | shift; FILTER=$1 |
| 108 | ;; |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 109 | -e|--exclude) |
| 110 | shift; EXCLUDE=$1 |
| 111 | ;; |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 112 | -m|--modes) |
| 113 | shift; MODES=$1 |
| 114 | ;; |
| 115 | -t|--types) |
| 116 | shift; TYPES=$1 |
| 117 | ;; |
| 118 | -V|--verify) |
| 119 | shift; VERIFIES=$1 |
| 120 | ;; |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 121 | -p|--peers) |
| 122 | shift; PEERS=$1 |
| 123 | ;; |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 124 | -v|--verbose) |
| 125 | VERBOSE=1 |
| 126 | ;; |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 127 | -M|--memcheck) |
| 128 | MEMCHECK=1 |
| 129 | ;; |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 130 | -h|--help) |
| 131 | print_usage |
| 132 | exit 0 |
| 133 | ;; |
| 134 | *) |
| 135 | echo "Unknown argument: '$1'" |
| 136 | print_usage |
| 137 | exit 1 |
| 138 | ;; |
| 139 | esac |
| 140 | shift |
| 141 | done |
Manuel Pégourié-Gonnard | 85a4178 | 2014-10-24 12:47:26 +0200 | [diff] [blame] | 142 | |
| 143 | # sanitize some options (modes checked later) |
| 144 | VERIFIES="$( echo $VERIFIES | tr [a-z] [A-Z] )" |
| 145 | TYPES="$( echo $TYPES | tr [a-z] [A-Z] )" |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 146 | } |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 147 | |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 148 | log() { |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 149 | if [ "X" != "X$VERBOSE" ]; then |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 150 | echo "" |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 151 | echo "$@" |
| 152 | fi |
| 153 | } |
Paul Bakker | 10cd225 | 2012-04-12 21:26:34 +0000 | [diff] [blame] | 154 | |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 155 | # is_dtls <mode> |
| 156 | is_dtls() |
| 157 | { |
| 158 | test "$1" = "dtls1" -o "$1" = "dtls1_2" |
| 159 | } |
| 160 | |
| 161 | # minor_ver <mode> |
| 162 | minor_ver() |
| 163 | { |
| 164 | case "$1" in |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 165 | tls1_2|dtls1_2) |
| 166 | echo 3 |
| 167 | ;; |
| 168 | *) |
| 169 | echo "error: invalid mode: $MODE" >&2 |
| 170 | # exiting is no good here, typically called in a subshell |
| 171 | echo -1 |
| 172 | esac |
| 173 | } |
| 174 | |
Manuel Pégourié-Gonnard | dfc8d5a | 2013-08-27 20:48:40 +0200 | [diff] [blame] | 175 | filter() |
| 176 | { |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 177 | LIST="$1" |
Manuel Pégourié-Gonnard | dfc8d5a | 2013-08-27 20:48:40 +0200 | [diff] [blame] | 178 | NEW_LIST="" |
| 179 | |
Mateusz Starzyk | 5224e29 | 2021-02-22 14:36:29 +0100 | [diff] [blame] | 180 | EXCLMODE="$EXCLUDE" |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 181 | |
Manuel Pégourié-Gonnard | dfc8d5a | 2013-08-27 20:48:40 +0200 | [diff] [blame] | 182 | for i in $LIST; |
| 183 | do |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 184 | NEW_LIST="$NEW_LIST $( echo "$i" | grep "$FILTER" | grep -v "$EXCLMODE" )" |
Manuel Pégourié-Gonnard | dfc8d5a | 2013-08-27 20:48:40 +0200 | [diff] [blame] | 185 | done |
| 186 | |
Manuel Pégourié-Gonnard | 911622d | 2014-02-27 11:50:40 +0100 | [diff] [blame] | 187 | # normalize whitespace |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 188 | echo "$NEW_LIST" | sed -e 's/[[:space:]][[:space:]]*/ /g' -e 's/^ //' -e 's/ $//' |
Manuel Pégourié-Gonnard | dfc8d5a | 2013-08-27 20:48:40 +0200 | [diff] [blame] | 189 | } |
| 190 | |
Manuel Pégourié-Gonnard | 53aef81 | 2014-07-11 17:41:24 +0200 | [diff] [blame] | 191 | # OpenSSL 1.0.1h with -Verify wants a ClientCertificate message even for |
| 192 | # PSK ciphersuites with DTLS, which is incorrect, so disable them for now |
| 193 | check_openssl_server_bug() |
| 194 | { |
| 195 | if test "X$VERIFY" = "XYES" && is_dtls "$MODE" && \ |
| 196 | echo "$1" | grep "^TLS-PSK" >/dev/null; |
| 197 | then |
| 198 | SKIP_NEXT="YES" |
| 199 | fi |
| 200 | } |
| 201 | |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 202 | filter_ciphersuites() |
| 203 | { |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 204 | if [ "X" != "X$FILTER" -o "X" != "X$EXCLUDE" ]; |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 205 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 206 | # Ciphersuite for mbed TLS |
| 207 | M_CIPHERS=$( filter "$M_CIPHERS" ) |
| 208 | |
| 209 | # Ciphersuite for OpenSSL |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 210 | O_CIPHERS=$( filter "$O_CIPHERS" ) |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 211 | |
| 212 | # Ciphersuite for GnuTLS |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 213 | G_CIPHERS=$( filter "$G_CIPHERS" ) |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 214 | fi |
Manuel Pégourié-Gonnard | 29980b1 | 2014-07-10 20:12:56 +0200 | [diff] [blame] | 215 | |
Gilles Peskine | 6eece5b | 2019-08-10 17:38:34 +0200 | [diff] [blame] | 216 | # OpenSSL <1.0.2 doesn't support DTLS 1.2. Check what OpenSSL |
| 217 | # supports from the s_server help. (The s_client help isn't |
| 218 | # accurate as of 1.0.2g: it supports DTLS 1.2 but doesn't list it. |
| 219 | # But the s_server help seems to be accurate.) |
| 220 | if ! $OPENSSL_CMD s_server -help 2>&1 | grep -q "^ *-$MODE "; then |
| 221 | M_CIPHERS="" |
Manuel Pégourié-Gonnard | 29980b1 | 2014-07-10 20:12:56 +0200 | [diff] [blame] | 222 | O_CIPHERS="" |
| 223 | fi |
| 224 | |
Manuel Pégourié-Gonnard | dba564b | 2015-01-23 11:33:38 +0000 | [diff] [blame] | 225 | # For GnuTLS client -> mbed TLS server, |
Manuel Pégourié-Gonnard | d1af102 | 2014-07-11 17:01:06 +0200 | [diff] [blame] | 226 | # we need to force IPv4 by connecting to 127.0.0.1 but then auth fails |
Manuel Pégourié-Gonnard | 29980b1 | 2014-07-10 20:12:56 +0200 | [diff] [blame] | 227 | if [ "X$VERIFY" = "XYES" ] && is_dtls "$MODE"; then |
| 228 | G_CIPHERS="" |
| 229 | fi |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 230 | } |
| 231 | |
| 232 | reset_ciphersuites() |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 233 | { |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 234 | M_CIPHERS="" |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 235 | O_CIPHERS="" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 236 | G_CIPHERS="" |
| 237 | } |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 238 | |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 239 | # Ciphersuites that can be used with all peers. |
| 240 | # Since we currently have three possible peers, each ciphersuite should appear |
| 241 | # three times: in each peer's list (with the name that this peer uses). |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 242 | add_common_ciphersuites() |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 243 | { |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 244 | case $TYPE in |
| 245 | |
| 246 | "ECDSA") |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 247 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 248 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 249 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 250 | TLS-ECDHE-ECDSA-WITH-NULL-SHA \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 251 | TLS-ECDHE-ECDSA-WITH-3DES-EDE-CBC-SHA \ |
| 252 | TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA \ |
| 253 | TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 254 | " |
| 255 | G_CIPHERS="$G_CIPHERS \ |
| 256 | +ECDHE-ECDSA:+NULL:+SHA1 \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 257 | +ECDHE-ECDSA:+3DES-CBC:+SHA1 \ |
| 258 | +ECDHE-ECDSA:+AES-128-CBC:+SHA1 \ |
| 259 | +ECDHE-ECDSA:+AES-256-CBC:+SHA1 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 260 | " |
| 261 | O_CIPHERS="$O_CIPHERS \ |
| 262 | ECDHE-ECDSA-NULL-SHA \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 263 | ECDHE-ECDSA-DES-CBC3-SHA \ |
| 264 | ECDHE-ECDSA-AES128-SHA \ |
| 265 | ECDHE-ECDSA-AES256-SHA \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 266 | " |
| 267 | fi |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 268 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 269 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 270 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 271 | TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 \ |
| 272 | TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384 \ |
| 273 | TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 274 | TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 275 | " |
| 276 | G_CIPHERS="$G_CIPHERS \ |
| 277 | +ECDHE-ECDSA:+AES-128-CBC:+SHA256 \ |
| 278 | +ECDHE-ECDSA:+AES-256-CBC:+SHA384 \ |
| 279 | +ECDHE-ECDSA:+AES-128-GCM:+AEAD \ |
| 280 | +ECDHE-ECDSA:+AES-256-GCM:+AEAD \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 281 | " |
| 282 | O_CIPHERS="$O_CIPHERS \ |
| 283 | ECDHE-ECDSA-AES128-SHA256 \ |
| 284 | ECDHE-ECDSA-AES256-SHA384 \ |
| 285 | ECDHE-ECDSA-AES128-GCM-SHA256 \ |
| 286 | ECDHE-ECDSA-AES256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 287 | " |
| 288 | fi |
| 289 | ;; |
| 290 | |
| 291 | "RSA") |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 292 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 293 | TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 294 | TLS-DHE-RSA-WITH-AES-256-CBC-SHA \ |
| 295 | TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA \ |
| 296 | TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA \ |
| 297 | TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA \ |
| 298 | TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 299 | TLS-RSA-WITH-CAMELLIA-256-CBC-SHA \ |
| 300 | TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 301 | TLS-RSA-WITH-CAMELLIA-128-CBC-SHA \ |
| 302 | TLS-RSA-WITH-3DES-EDE-CBC-SHA \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 303 | TLS-RSA-WITH-NULL-MD5 \ |
| 304 | TLS-RSA-WITH-NULL-SHA \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 305 | " |
| 306 | G_CIPHERS="$G_CIPHERS \ |
| 307 | +DHE-RSA:+AES-128-CBC:+SHA1 \ |
| 308 | +DHE-RSA:+AES-256-CBC:+SHA1 \ |
| 309 | +DHE-RSA:+CAMELLIA-128-CBC:+SHA1 \ |
| 310 | +DHE-RSA:+CAMELLIA-256-CBC:+SHA1 \ |
| 311 | +DHE-RSA:+3DES-CBC:+SHA1 \ |
| 312 | +RSA:+AES-256-CBC:+SHA1 \ |
| 313 | +RSA:+CAMELLIA-256-CBC:+SHA1 \ |
| 314 | +RSA:+AES-128-CBC:+SHA1 \ |
| 315 | +RSA:+CAMELLIA-128-CBC:+SHA1 \ |
| 316 | +RSA:+3DES-CBC:+SHA1 \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 317 | +RSA:+NULL:+MD5 \ |
| 318 | +RSA:+NULL:+SHA1 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 319 | " |
| 320 | O_CIPHERS="$O_CIPHERS \ |
| 321 | DHE-RSA-AES128-SHA \ |
| 322 | DHE-RSA-AES256-SHA \ |
| 323 | DHE-RSA-CAMELLIA128-SHA \ |
| 324 | DHE-RSA-CAMELLIA256-SHA \ |
| 325 | EDH-RSA-DES-CBC3-SHA \ |
| 326 | AES256-SHA \ |
| 327 | CAMELLIA256-SHA \ |
| 328 | AES128-SHA \ |
| 329 | CAMELLIA128-SHA \ |
| 330 | DES-CBC3-SHA \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 331 | NULL-MD5 \ |
| 332 | NULL-SHA \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 333 | " |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 334 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 335 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 336 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 337 | TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA \ |
| 338 | TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA \ |
| 339 | TLS-ECDHE-RSA-WITH-3DES-EDE-CBC-SHA \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 340 | TLS-ECDHE-RSA-WITH-NULL-SHA \ |
| 341 | " |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 342 | G_CIPHERS="$G_CIPHERS \ |
| 343 | +ECDHE-RSA:+AES-128-CBC:+SHA1 \ |
| 344 | +ECDHE-RSA:+AES-256-CBC:+SHA1 \ |
| 345 | +ECDHE-RSA:+3DES-CBC:+SHA1 \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 346 | +ECDHE-RSA:+NULL:+SHA1 \ |
| 347 | " |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 348 | O_CIPHERS="$O_CIPHERS \ |
| 349 | ECDHE-RSA-AES256-SHA \ |
| 350 | ECDHE-RSA-AES128-SHA \ |
| 351 | ECDHE-RSA-DES-CBC3-SHA \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 352 | ECDHE-RSA-NULL-SHA \ |
| 353 | " |
| 354 | fi |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 355 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 356 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 357 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 358 | TLS-RSA-WITH-AES-128-CBC-SHA256 \ |
| 359 | TLS-DHE-RSA-WITH-AES-128-CBC-SHA256 \ |
| 360 | TLS-RSA-WITH-AES-256-CBC-SHA256 \ |
| 361 | TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 \ |
| 362 | TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256 \ |
| 363 | TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384 \ |
| 364 | TLS-RSA-WITH-AES-128-GCM-SHA256 \ |
| 365 | TLS-RSA-WITH-AES-256-GCM-SHA384 \ |
| 366 | TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 \ |
| 367 | TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 \ |
| 368 | TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256 \ |
| 369 | TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 \ |
| 370 | " |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 371 | G_CIPHERS="$G_CIPHERS \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 372 | +RSA:+AES-128-CBC:+SHA256 \ |
| 373 | +DHE-RSA:+AES-128-CBC:+SHA256 \ |
| 374 | +RSA:+AES-256-CBC:+SHA256 \ |
| 375 | +DHE-RSA:+AES-256-CBC:+SHA256 \ |
| 376 | +ECDHE-RSA:+AES-128-CBC:+SHA256 \ |
| 377 | +ECDHE-RSA:+AES-256-CBC:+SHA384 \ |
| 378 | +RSA:+AES-128-GCM:+AEAD \ |
| 379 | +RSA:+AES-256-GCM:+AEAD \ |
| 380 | +DHE-RSA:+AES-128-GCM:+AEAD \ |
| 381 | +DHE-RSA:+AES-256-GCM:+AEAD \ |
| 382 | +ECDHE-RSA:+AES-128-GCM:+AEAD \ |
| 383 | +ECDHE-RSA:+AES-256-GCM:+AEAD \ |
| 384 | " |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 385 | O_CIPHERS="$O_CIPHERS \ |
| 386 | NULL-SHA256 \ |
| 387 | AES128-SHA256 \ |
| 388 | DHE-RSA-AES128-SHA256 \ |
| 389 | AES256-SHA256 \ |
| 390 | DHE-RSA-AES256-SHA256 \ |
| 391 | ECDHE-RSA-AES128-SHA256 \ |
| 392 | ECDHE-RSA-AES256-SHA384 \ |
| 393 | AES128-GCM-SHA256 \ |
| 394 | DHE-RSA-AES128-GCM-SHA256 \ |
| 395 | AES256-GCM-SHA384 \ |
| 396 | DHE-RSA-AES256-GCM-SHA384 \ |
| 397 | ECDHE-RSA-AES128-GCM-SHA256 \ |
| 398 | ECDHE-RSA-AES256-GCM-SHA384 \ |
| 399 | " |
| 400 | fi |
| 401 | ;; |
| 402 | |
| 403 | "PSK") |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 404 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 405 | TLS-PSK-WITH-3DES-EDE-CBC-SHA \ |
| 406 | TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 407 | TLS-PSK-WITH-AES-256-CBC-SHA \ |
| 408 | " |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 409 | G_CIPHERS="$G_CIPHERS \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 410 | +PSK:+3DES-CBC:+SHA1 \ |
| 411 | +PSK:+AES-128-CBC:+SHA1 \ |
| 412 | +PSK:+AES-256-CBC:+SHA1 \ |
| 413 | " |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 414 | O_CIPHERS="$O_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 415 | PSK-3DES-EDE-CBC-SHA \ |
| 416 | PSK-AES128-CBC-SHA \ |
| 417 | PSK-AES256-CBC-SHA \ |
| 418 | " |
| 419 | ;; |
| 420 | esac |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 421 | } |
| 422 | |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 423 | # Ciphersuites usable only with Mbed TLS and OpenSSL |
| 424 | # Each ciphersuite should appear two times, once with its OpenSSL name, once |
| 425 | # with its Mbed TLS name. |
| 426 | # |
| 427 | # NOTE: for some reason RSA-PSK doesn't work with OpenSSL, |
Manuel Pégourié-Gonnard | ce5673c | 2018-03-06 09:54:10 +0100 | [diff] [blame] | 428 | # so RSA-PSK ciphersuites need to go in other sections, see |
| 429 | # https://github.com/ARMmbed/mbedtls/issues/1419 |
Manuel Pégourié-Gonnard | 9fece7e | 2018-06-18 11:38:22 +0200 | [diff] [blame] | 430 | # |
| 431 | # ChachaPoly suites are here rather than in "common", as they were added in |
| 432 | # GnuTLS in 3.5.0 and the CI only has 3.4.x so far. |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 433 | add_openssl_ciphersuites() |
| 434 | { |
| 435 | case $TYPE in |
| 436 | |
| 437 | "ECDSA") |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 438 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 439 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 440 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 441 | TLS-ECDH-ECDSA-WITH-NULL-SHA \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 442 | TLS-ECDH-ECDSA-WITH-3DES-EDE-CBC-SHA \ |
| 443 | TLS-ECDH-ECDSA-WITH-AES-128-CBC-SHA \ |
| 444 | TLS-ECDH-ECDSA-WITH-AES-256-CBC-SHA \ |
| 445 | " |
| 446 | O_CIPHERS="$O_CIPHERS \ |
| 447 | ECDH-ECDSA-NULL-SHA \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 448 | ECDH-ECDSA-DES-CBC3-SHA \ |
| 449 | ECDH-ECDSA-AES128-SHA \ |
| 450 | ECDH-ECDSA-AES256-SHA \ |
| 451 | " |
| 452 | fi |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 453 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 454 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 455 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 456 | TLS-ECDH-ECDSA-WITH-AES-128-CBC-SHA256 \ |
| 457 | TLS-ECDH-ECDSA-WITH-AES-256-CBC-SHA384 \ |
| 458 | TLS-ECDH-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 459 | TLS-ECDH-ECDSA-WITH-AES-256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 460 | TLS-ECDHE-ECDSA-WITH-ARIA-256-GCM-SHA384 \ |
| 461 | TLS-ECDHE-ECDSA-WITH-ARIA-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 9fece7e | 2018-06-18 11:38:22 +0200 | [diff] [blame] | 462 | TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256 \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 463 | " |
| 464 | O_CIPHERS="$O_CIPHERS \ |
| 465 | ECDH-ECDSA-AES128-SHA256 \ |
| 466 | ECDH-ECDSA-AES256-SHA384 \ |
| 467 | ECDH-ECDSA-AES128-GCM-SHA256 \ |
| 468 | ECDH-ECDSA-AES256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 469 | ECDHE-ECDSA-ARIA256-GCM-SHA384 \ |
| 470 | ECDHE-ECDSA-ARIA128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 9fece7e | 2018-06-18 11:38:22 +0200 | [diff] [blame] | 471 | ECDHE-ECDSA-CHACHA20-POLY1305 \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 472 | " |
| 473 | fi |
| 474 | ;; |
| 475 | |
| 476 | "RSA") |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 477 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 478 | TLS-RSA-WITH-DES-CBC-SHA \ |
| 479 | TLS-DHE-RSA-WITH-DES-CBC-SHA \ |
| 480 | " |
| 481 | O_CIPHERS="$O_CIPHERS \ |
| 482 | DES-CBC-SHA \ |
| 483 | EDH-RSA-DES-CBC-SHA \ |
| 484 | " |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 485 | if [ `minor_ver "$MODE"` -ge 3 ] |
| 486 | then |
| 487 | M_CIPHERS="$M_CIPHERS \ |
| 488 | TLS-ECDHE-RSA-WITH-ARIA-256-GCM-SHA384 \ |
| 489 | TLS-DHE-RSA-WITH-ARIA-256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | bba6406 | 2018-02-20 11:58:44 +0100 | [diff] [blame] | 490 | TLS-RSA-WITH-ARIA-256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 491 | TLS-ECDHE-RSA-WITH-ARIA-128-GCM-SHA256 \ |
| 492 | TLS-DHE-RSA-WITH-ARIA-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | bba6406 | 2018-02-20 11:58:44 +0100 | [diff] [blame] | 493 | TLS-RSA-WITH-ARIA-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 9fece7e | 2018-06-18 11:38:22 +0200 | [diff] [blame] | 494 | TLS-DHE-RSA-WITH-CHACHA20-POLY1305-SHA256 \ |
| 495 | TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256 \ |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 496 | " |
| 497 | O_CIPHERS="$O_CIPHERS \ |
| 498 | ECDHE-ARIA256-GCM-SHA384 \ |
| 499 | DHE-RSA-ARIA256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | bba6406 | 2018-02-20 11:58:44 +0100 | [diff] [blame] | 500 | ARIA256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 501 | ECDHE-ARIA128-GCM-SHA256 \ |
| 502 | DHE-RSA-ARIA128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | bba6406 | 2018-02-20 11:58:44 +0100 | [diff] [blame] | 503 | ARIA128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 9fece7e | 2018-06-18 11:38:22 +0200 | [diff] [blame] | 504 | DHE-RSA-CHACHA20-POLY1305 \ |
| 505 | ECDHE-RSA-CHACHA20-POLY1305 \ |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 506 | " |
| 507 | fi |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 508 | ;; |
| 509 | |
| 510 | "PSK") |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 511 | if [ `minor_ver "$MODE"` -ge 3 ] |
| 512 | then |
| 513 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | bba6406 | 2018-02-20 11:58:44 +0100 | [diff] [blame] | 514 | TLS-DHE-PSK-WITH-ARIA-256-GCM-SHA384 \ |
| 515 | TLS-DHE-PSK-WITH-ARIA-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 516 | TLS-PSK-WITH-ARIA-256-GCM-SHA384 \ |
| 517 | TLS-PSK-WITH-ARIA-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 9fece7e | 2018-06-18 11:38:22 +0200 | [diff] [blame] | 518 | TLS-PSK-WITH-CHACHA20-POLY1305-SHA256 \ |
| 519 | TLS-ECDHE-PSK-WITH-CHACHA20-POLY1305-SHA256 \ |
| 520 | TLS-DHE-PSK-WITH-CHACHA20-POLY1305-SHA256 \ |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 521 | " |
| 522 | O_CIPHERS="$O_CIPHERS \ |
Manuel Pégourié-Gonnard | bba6406 | 2018-02-20 11:58:44 +0100 | [diff] [blame] | 523 | DHE-PSK-ARIA256-GCM-SHA384 \ |
| 524 | DHE-PSK-ARIA128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 525 | PSK-ARIA256-GCM-SHA384 \ |
| 526 | PSK-ARIA128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 9fece7e | 2018-06-18 11:38:22 +0200 | [diff] [blame] | 527 | DHE-PSK-CHACHA20-POLY1305 \ |
| 528 | ECDHE-PSK-CHACHA20-POLY1305 \ |
| 529 | PSK-CHACHA20-POLY1305 \ |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 530 | " |
| 531 | fi |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 532 | ;; |
| 533 | esac |
| 534 | } |
| 535 | |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 536 | # Ciphersuites usable only with Mbed TLS and GnuTLS |
| 537 | # Each ciphersuite should appear two times, once with its GnuTLS name, once |
| 538 | # with its Mbed TLS name. |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 539 | add_gnutls_ciphersuites() |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 540 | { |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 541 | case $TYPE in |
| 542 | |
| 543 | "ECDSA") |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 544 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 545 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 546 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 547 | TLS-ECDHE-ECDSA-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 548 | TLS-ECDHE-ECDSA-WITH-CAMELLIA-256-CBC-SHA384 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 549 | TLS-ECDHE-ECDSA-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 550 | TLS-ECDHE-ECDSA-WITH-CAMELLIA-256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | c36b432 | 2018-06-14 13:14:29 +0200 | [diff] [blame] | 551 | TLS-ECDHE-ECDSA-WITH-AES-128-CCM \ |
| 552 | TLS-ECDHE-ECDSA-WITH-AES-256-CCM \ |
| 553 | TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8 \ |
| 554 | TLS-ECDHE-ECDSA-WITH-AES-256-CCM-8 \ |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 555 | " |
| 556 | G_CIPHERS="$G_CIPHERS \ |
| 557 | +ECDHE-ECDSA:+CAMELLIA-128-CBC:+SHA256 \ |
| 558 | +ECDHE-ECDSA:+CAMELLIA-256-CBC:+SHA384 \ |
| 559 | +ECDHE-ECDSA:+CAMELLIA-128-GCM:+AEAD \ |
| 560 | +ECDHE-ECDSA:+CAMELLIA-256-GCM:+AEAD \ |
Manuel Pégourié-Gonnard | c36b432 | 2018-06-14 13:14:29 +0200 | [diff] [blame] | 561 | +ECDHE-ECDSA:+AES-128-CCM:+AEAD \ |
| 562 | +ECDHE-ECDSA:+AES-256-CCM:+AEAD \ |
| 563 | +ECDHE-ECDSA:+AES-128-CCM-8:+AEAD \ |
| 564 | +ECDHE-ECDSA:+AES-256-CCM-8:+AEAD \ |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 565 | " |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 566 | fi |
| 567 | ;; |
| 568 | |
| 569 | "RSA") |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 570 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 7457cb3 | 2014-07-13 13:57:24 +0200 | [diff] [blame] | 571 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 572 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 7457cb3 | 2014-07-13 13:57:24 +0200 | [diff] [blame] | 573 | TLS-RSA-WITH-NULL-SHA256 \ |
| 574 | " |
| 575 | G_CIPHERS="$G_CIPHERS \ |
| 576 | +RSA:+NULL:+SHA256 \ |
| 577 | " |
| 578 | fi |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 579 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 580 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 581 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 582 | TLS-ECDHE-RSA-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 583 | TLS-ECDHE-RSA-WITH-CAMELLIA-256-CBC-SHA384 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 584 | TLS-RSA-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 585 | TLS-RSA-WITH-CAMELLIA-256-CBC-SHA256 \ |
| 586 | TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 587 | TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA256 \ |
| 588 | TLS-ECDHE-RSA-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 589 | TLS-ECDHE-RSA-WITH-CAMELLIA-256-GCM-SHA384 \ |
| 590 | TLS-DHE-RSA-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 591 | TLS-DHE-RSA-WITH-CAMELLIA-256-GCM-SHA384 \ |
| 592 | TLS-RSA-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 593 | TLS-RSA-WITH-CAMELLIA-256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | c36b432 | 2018-06-14 13:14:29 +0200 | [diff] [blame] | 594 | TLS-RSA-WITH-AES-128-CCM \ |
| 595 | TLS-RSA-WITH-AES-256-CCM \ |
| 596 | TLS-DHE-RSA-WITH-AES-128-CCM \ |
| 597 | TLS-DHE-RSA-WITH-AES-256-CCM \ |
| 598 | TLS-RSA-WITH-AES-128-CCM-8 \ |
| 599 | TLS-RSA-WITH-AES-256-CCM-8 \ |
| 600 | TLS-DHE-RSA-WITH-AES-128-CCM-8 \ |
| 601 | TLS-DHE-RSA-WITH-AES-256-CCM-8 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 602 | " |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 603 | G_CIPHERS="$G_CIPHERS \ |
| 604 | +ECDHE-RSA:+CAMELLIA-128-CBC:+SHA256 \ |
| 605 | +ECDHE-RSA:+CAMELLIA-256-CBC:+SHA384 \ |
| 606 | +RSA:+CAMELLIA-128-CBC:+SHA256 \ |
| 607 | +RSA:+CAMELLIA-256-CBC:+SHA256 \ |
| 608 | +DHE-RSA:+CAMELLIA-128-CBC:+SHA256 \ |
| 609 | +DHE-RSA:+CAMELLIA-256-CBC:+SHA256 \ |
| 610 | +ECDHE-RSA:+CAMELLIA-128-GCM:+AEAD \ |
| 611 | +ECDHE-RSA:+CAMELLIA-256-GCM:+AEAD \ |
| 612 | +DHE-RSA:+CAMELLIA-128-GCM:+AEAD \ |
| 613 | +DHE-RSA:+CAMELLIA-256-GCM:+AEAD \ |
| 614 | +RSA:+CAMELLIA-128-GCM:+AEAD \ |
| 615 | +RSA:+CAMELLIA-256-GCM:+AEAD \ |
Manuel Pégourié-Gonnard | c36b432 | 2018-06-14 13:14:29 +0200 | [diff] [blame] | 616 | +RSA:+AES-128-CCM:+AEAD \ |
| 617 | +RSA:+AES-256-CCM:+AEAD \ |
| 618 | +RSA:+AES-128-CCM-8:+AEAD \ |
| 619 | +RSA:+AES-256-CCM-8:+AEAD \ |
| 620 | +DHE-RSA:+AES-128-CCM:+AEAD \ |
| 621 | +DHE-RSA:+AES-256-CCM:+AEAD \ |
| 622 | +DHE-RSA:+AES-128-CCM-8:+AEAD \ |
| 623 | +DHE-RSA:+AES-256-CCM-8:+AEAD \ |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 624 | " |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 625 | fi |
| 626 | ;; |
| 627 | |
| 628 | "PSK") |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 629 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | e46aa5e | 2014-07-13 15:44:19 +0200 | [diff] [blame] | 630 | TLS-DHE-PSK-WITH-3DES-EDE-CBC-SHA \ |
| 631 | TLS-DHE-PSK-WITH-AES-128-CBC-SHA \ |
| 632 | TLS-DHE-PSK-WITH-AES-256-CBC-SHA \ |
Manuel Pégourié-Gonnard | e46aa5e | 2014-07-13 15:44:19 +0200 | [diff] [blame] | 633 | " |
| 634 | G_CIPHERS="$G_CIPHERS \ |
| 635 | +DHE-PSK:+3DES-CBC:+SHA1 \ |
| 636 | +DHE-PSK:+AES-128-CBC:+SHA1 \ |
| 637 | +DHE-PSK:+AES-256-CBC:+SHA1 \ |
Manuel Pégourié-Gonnard | e46aa5e | 2014-07-13 15:44:19 +0200 | [diff] [blame] | 638 | " |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 639 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 640 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 641 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 642 | TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA \ |
| 643 | TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA \ |
| 644 | TLS-ECDHE-PSK-WITH-3DES-EDE-CBC-SHA \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 645 | TLS-RSA-PSK-WITH-3DES-EDE-CBC-SHA \ |
| 646 | TLS-RSA-PSK-WITH-AES-256-CBC-SHA \ |
| 647 | TLS-RSA-PSK-WITH-AES-128-CBC-SHA \ |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 648 | " |
| 649 | G_CIPHERS="$G_CIPHERS \ |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 650 | +ECDHE-PSK:+3DES-CBC:+SHA1 \ |
Manuel Pégourié-Gonnard | e46aa5e | 2014-07-13 15:44:19 +0200 | [diff] [blame] | 651 | +ECDHE-PSK:+AES-128-CBC:+SHA1 \ |
| 652 | +ECDHE-PSK:+AES-256-CBC:+SHA1 \ |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 653 | +RSA-PSK:+3DES-CBC:+SHA1 \ |
| 654 | +RSA-PSK:+AES-256-CBC:+SHA1 \ |
| 655 | +RSA-PSK:+AES-128-CBC:+SHA1 \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 656 | " |
| 657 | fi |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 658 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 659 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 660 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 661 | TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 662 | TLS-ECDHE-PSK-WITH-CAMELLIA-256-CBC-SHA384 \ |
| 663 | TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 \ |
| 664 | TLS-ECDHE-PSK-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 665 | TLS-ECDHE-PSK-WITH-NULL-SHA384 \ |
| 666 | TLS-ECDHE-PSK-WITH-NULL-SHA256 \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 667 | TLS-PSK-WITH-AES-128-CBC-SHA256 \ |
| 668 | TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
| 669 | TLS-DHE-PSK-WITH-AES-128-CBC-SHA256 \ |
| 670 | TLS-DHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 671 | TLS-PSK-WITH-NULL-SHA256 \ |
| 672 | TLS-PSK-WITH-NULL-SHA384 \ |
| 673 | TLS-DHE-PSK-WITH-NULL-SHA256 \ |
| 674 | TLS-DHE-PSK-WITH-NULL-SHA384 \ |
| 675 | TLS-RSA-PSK-WITH-AES-256-CBC-SHA384 \ |
| 676 | TLS-RSA-PSK-WITH-AES-128-CBC-SHA256 \ |
| 677 | TLS-RSA-PSK-WITH-NULL-SHA256 \ |
| 678 | TLS-RSA-PSK-WITH-NULL-SHA384 \ |
| 679 | TLS-DHE-PSK-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 680 | TLS-DHE-PSK-WITH-CAMELLIA-256-CBC-SHA384 \ |
| 681 | TLS-PSK-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 682 | TLS-PSK-WITH-CAMELLIA-256-CBC-SHA384 \ |
| 683 | TLS-RSA-PSK-WITH-CAMELLIA-256-CBC-SHA384 \ |
| 684 | TLS-RSA-PSK-WITH-CAMELLIA-128-CBC-SHA256 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 685 | TLS-PSK-WITH-AES-128-GCM-SHA256 \ |
| 686 | TLS-PSK-WITH-AES-256-GCM-SHA384 \ |
| 687 | TLS-DHE-PSK-WITH-AES-128-GCM-SHA256 \ |
| 688 | TLS-DHE-PSK-WITH-AES-256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | c36b432 | 2018-06-14 13:14:29 +0200 | [diff] [blame] | 689 | TLS-PSK-WITH-AES-128-CCM \ |
| 690 | TLS-PSK-WITH-AES-256-CCM \ |
| 691 | TLS-DHE-PSK-WITH-AES-128-CCM \ |
| 692 | TLS-DHE-PSK-WITH-AES-256-CCM \ |
| 693 | TLS-PSK-WITH-AES-128-CCM-8 \ |
| 694 | TLS-PSK-WITH-AES-256-CCM-8 \ |
| 695 | TLS-DHE-PSK-WITH-AES-128-CCM-8 \ |
| 696 | TLS-DHE-PSK-WITH-AES-256-CCM-8 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 697 | TLS-RSA-PSK-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 698 | TLS-RSA-PSK-WITH-CAMELLIA-256-GCM-SHA384 \ |
| 699 | TLS-PSK-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 700 | TLS-PSK-WITH-CAMELLIA-256-GCM-SHA384 \ |
| 701 | TLS-DHE-PSK-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 702 | TLS-DHE-PSK-WITH-CAMELLIA-256-GCM-SHA384 \ |
| 703 | TLS-RSA-PSK-WITH-AES-256-GCM-SHA384 \ |
| 704 | TLS-RSA-PSK-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 705 | " |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 706 | G_CIPHERS="$G_CIPHERS \ |
| 707 | +ECDHE-PSK:+AES-256-CBC:+SHA384 \ |
| 708 | +ECDHE-PSK:+CAMELLIA-256-CBC:+SHA384 \ |
| 709 | +ECDHE-PSK:+AES-128-CBC:+SHA256 \ |
| 710 | +ECDHE-PSK:+CAMELLIA-128-CBC:+SHA256 \ |
| 711 | +PSK:+AES-128-CBC:+SHA256 \ |
| 712 | +PSK:+AES-256-CBC:+SHA384 \ |
| 713 | +DHE-PSK:+AES-128-CBC:+SHA256 \ |
| 714 | +DHE-PSK:+AES-256-CBC:+SHA384 \ |
| 715 | +RSA-PSK:+AES-256-CBC:+SHA384 \ |
| 716 | +RSA-PSK:+AES-128-CBC:+SHA256 \ |
| 717 | +DHE-PSK:+CAMELLIA-128-CBC:+SHA256 \ |
| 718 | +DHE-PSK:+CAMELLIA-256-CBC:+SHA384 \ |
| 719 | +PSK:+CAMELLIA-128-CBC:+SHA256 \ |
| 720 | +PSK:+CAMELLIA-256-CBC:+SHA384 \ |
| 721 | +RSA-PSK:+CAMELLIA-256-CBC:+SHA384 \ |
| 722 | +RSA-PSK:+CAMELLIA-128-CBC:+SHA256 \ |
| 723 | +PSK:+AES-128-GCM:+AEAD \ |
| 724 | +PSK:+AES-256-GCM:+AEAD \ |
| 725 | +DHE-PSK:+AES-128-GCM:+AEAD \ |
| 726 | +DHE-PSK:+AES-256-GCM:+AEAD \ |
Manuel Pégourié-Gonnard | c36b432 | 2018-06-14 13:14:29 +0200 | [diff] [blame] | 727 | +PSK:+AES-128-CCM:+AEAD \ |
| 728 | +PSK:+AES-256-CCM:+AEAD \ |
| 729 | +DHE-PSK:+AES-128-CCM:+AEAD \ |
| 730 | +DHE-PSK:+AES-256-CCM:+AEAD \ |
| 731 | +PSK:+AES-128-CCM-8:+AEAD \ |
| 732 | +PSK:+AES-256-CCM-8:+AEAD \ |
| 733 | +DHE-PSK:+AES-128-CCM-8:+AEAD \ |
| 734 | +DHE-PSK:+AES-256-CCM-8:+AEAD \ |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 735 | +RSA-PSK:+CAMELLIA-128-GCM:+AEAD \ |
| 736 | +RSA-PSK:+CAMELLIA-256-GCM:+AEAD \ |
| 737 | +PSK:+CAMELLIA-128-GCM:+AEAD \ |
| 738 | +PSK:+CAMELLIA-256-GCM:+AEAD \ |
| 739 | +DHE-PSK:+CAMELLIA-128-GCM:+AEAD \ |
| 740 | +DHE-PSK:+CAMELLIA-256-GCM:+AEAD \ |
| 741 | +RSA-PSK:+AES-256-GCM:+AEAD \ |
| 742 | +RSA-PSK:+AES-128-GCM:+AEAD \ |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 743 | +ECDHE-PSK:+NULL:+SHA384 \ |
| 744 | +ECDHE-PSK:+NULL:+SHA256 \ |
| 745 | +PSK:+NULL:+SHA256 \ |
| 746 | +PSK:+NULL:+SHA384 \ |
| 747 | +DHE-PSK:+NULL:+SHA256 \ |
| 748 | +DHE-PSK:+NULL:+SHA384 \ |
| 749 | +RSA-PSK:+NULL:+SHA256 \ |
| 750 | +RSA-PSK:+NULL:+SHA384 \ |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 751 | " |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 752 | fi |
| 753 | ;; |
| 754 | esac |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 755 | } |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 756 | |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 757 | # Ciphersuites usable only with Mbed TLS (not currently supported by another |
| 758 | # peer usable in this script). This provide only very rudimentaty testing, as |
| 759 | # this is not interop testing, but it's better than nothing. |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 760 | add_mbedtls_ciphersuites() |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 761 | { |
| 762 | case $TYPE in |
| 763 | |
| 764 | "ECDSA") |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 765 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 766 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 767 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 768 | TLS-ECDH-ECDSA-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 769 | TLS-ECDH-ECDSA-WITH-CAMELLIA-256-CBC-SHA384 \ |
| 770 | " |
| 771 | fi |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 772 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 773 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 774 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 775 | TLS-ECDH-ECDSA-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 776 | TLS-ECDH-ECDSA-WITH-CAMELLIA-256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | a0e4708 | 2018-02-15 11:07:58 +0100 | [diff] [blame] | 777 | TLS-ECDHE-ECDSA-WITH-ARIA-256-CBC-SHA384 \ |
Manuel Pégourié-Gonnard | a0e4708 | 2018-02-15 11:07:58 +0100 | [diff] [blame] | 778 | TLS-ECDHE-ECDSA-WITH-ARIA-128-CBC-SHA256 \ |
Manuel Pégourié-Gonnard | bba6406 | 2018-02-20 11:58:44 +0100 | [diff] [blame] | 779 | TLS-ECDH-ECDSA-WITH-ARIA-256-GCM-SHA384 \ |
| 780 | TLS-ECDH-ECDSA-WITH-ARIA-128-GCM-SHA256 \ |
| 781 | TLS-ECDH-ECDSA-WITH-ARIA-256-CBC-SHA384 \ |
| 782 | TLS-ECDH-ECDSA-WITH-ARIA-128-CBC-SHA256 \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 783 | " |
| 784 | fi |
| 785 | ;; |
| 786 | |
| 787 | "RSA") |
Manuel Pégourié-Gonnard | 392c2d2 | 2018-02-15 11:06:14 +0100 | [diff] [blame] | 788 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 2594859 | 2014-05-22 14:36:02 +0200 | [diff] [blame] | 789 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 790 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | a0e4708 | 2018-02-15 11:07:58 +0100 | [diff] [blame] | 791 | TLS-ECDHE-RSA-WITH-ARIA-256-CBC-SHA384 \ |
| 792 | TLS-DHE-RSA-WITH-ARIA-256-CBC-SHA384 \ |
Manuel Pégourié-Gonnard | a0e4708 | 2018-02-15 11:07:58 +0100 | [diff] [blame] | 793 | TLS-ECDHE-RSA-WITH-ARIA-128-CBC-SHA256 \ |
| 794 | TLS-DHE-RSA-WITH-ARIA-128-CBC-SHA256 \ |
Manuel Pégourié-Gonnard | bba6406 | 2018-02-20 11:58:44 +0100 | [diff] [blame] | 795 | TLS-RSA-WITH-ARIA-256-CBC-SHA384 \ |
| 796 | TLS-RSA-WITH-ARIA-128-CBC-SHA256 \ |
Manuel Pégourié-Gonnard | 2594859 | 2014-05-22 14:36:02 +0200 | [diff] [blame] | 797 | " |
| 798 | fi |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 799 | ;; |
| 800 | |
| 801 | "PSK") |
Manuel Pégourié-Gonnard | 7eb58cb | 2015-07-07 11:54:14 +0200 | [diff] [blame] | 802 | # *PSK-NULL-SHA suites supported by GnuTLS 3.3.5 but not 3.2.15 |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 803 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 804 | TLS-PSK-WITH-NULL-SHA \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 805 | TLS-DHE-PSK-WITH-NULL-SHA \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 806 | " |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 807 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 808 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 809 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 810 | TLS-ECDHE-PSK-WITH-NULL-SHA \ |
Manuel Pégourié-Gonnard | e46aa5e | 2014-07-13 15:44:19 +0200 | [diff] [blame] | 811 | TLS-RSA-PSK-WITH-NULL-SHA \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 812 | " |
| 813 | fi |
Manuel Pégourié-Gonnard | 392c2d2 | 2018-02-15 11:06:14 +0100 | [diff] [blame] | 814 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 2594859 | 2014-05-22 14:36:02 +0200 | [diff] [blame] | 815 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 816 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | a0e4708 | 2018-02-15 11:07:58 +0100 | [diff] [blame] | 817 | TLS-RSA-PSK-WITH-ARIA-256-CBC-SHA384 \ |
Manuel Pégourié-Gonnard | a0e4708 | 2018-02-15 11:07:58 +0100 | [diff] [blame] | 818 | TLS-RSA-PSK-WITH-ARIA-128-CBC-SHA256 \ |
Manuel Pégourié-Gonnard | a0e4708 | 2018-02-15 11:07:58 +0100 | [diff] [blame] | 819 | TLS-PSK-WITH-ARIA-256-CBC-SHA384 \ |
Manuel Pégourié-Gonnard | a0e4708 | 2018-02-15 11:07:58 +0100 | [diff] [blame] | 820 | TLS-PSK-WITH-ARIA-128-CBC-SHA256 \ |
Manuel Pégourié-Gonnard | 7299dfd | 2018-02-15 11:43:55 +0100 | [diff] [blame] | 821 | TLS-RSA-PSK-WITH-ARIA-256-GCM-SHA384 \ |
| 822 | TLS-RSA-PSK-WITH-ARIA-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | bba6406 | 2018-02-20 11:58:44 +0100 | [diff] [blame] | 823 | TLS-ECDHE-PSK-WITH-ARIA-256-CBC-SHA384 \ |
| 824 | TLS-ECDHE-PSK-WITH-ARIA-128-CBC-SHA256 \ |
| 825 | TLS-DHE-PSK-WITH-ARIA-256-CBC-SHA384 \ |
| 826 | TLS-DHE-PSK-WITH-ARIA-128-CBC-SHA256 \ |
Manuel Pégourié-Gonnard | 9fece7e | 2018-06-18 11:38:22 +0200 | [diff] [blame] | 827 | TLS-RSA-PSK-WITH-CHACHA20-POLY1305-SHA256 \ |
Manuel Pégourié-Gonnard | 2594859 | 2014-05-22 14:36:02 +0200 | [diff] [blame] | 828 | " |
| 829 | fi |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 830 | ;; |
| 831 | esac |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 832 | } |
| 833 | |
Manuel Pégourié-Gonnard | d941a79 | 2014-02-19 13:35:52 +0100 | [diff] [blame] | 834 | setup_arguments() |
| 835 | { |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 836 | G_MODE="" |
| 837 | case "$MODE" in |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 838 | "tls1_2") |
| 839 | G_PRIO_MODE="+VERS-TLS1.2" |
Manuel Pégourié-Gonnard | 9ada01a | 2014-02-19 14:24:24 +0100 | [diff] [blame] | 840 | ;; |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 841 | "dtls1_2") |
| 842 | G_PRIO_MODE="+VERS-DTLS1.2" |
Manuel Pégourié-Gonnard | 3679519 | 2014-09-26 16:33:45 +0200 | [diff] [blame] | 843 | G_MODE="-u" |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 844 | ;; |
Manuel Pégourié-Gonnard | 9ada01a | 2014-02-19 14:24:24 +0100 | [diff] [blame] | 845 | *) |
| 846 | echo "error: invalid mode: $MODE" >&2 |
| 847 | exit 1; |
| 848 | esac |
| 849 | |
Manuel Pégourié-Gonnard | c36b432 | 2018-06-14 13:14:29 +0200 | [diff] [blame] | 850 | # GnuTLS < 3.4 will choke if we try to allow CCM-8 |
| 851 | if [ -z "${GNUTLS_MINOR_LT_FOUR-}" ]; then |
| 852 | G_PRIO_CCM="+AES-256-CCM-8:+AES-128-CCM-8:" |
| 853 | else |
| 854 | G_PRIO_CCM="" |
| 855 | fi |
| 856 | |
Mateusz Starzyk | 5224e29 | 2021-02-22 14:36:29 +0100 | [diff] [blame] | 857 | M_SERVER_ARGS="server_port=$PORT server_addr=0.0.0.0 force_version=$MODE" |
Gilles Peskine | 96f5bae | 2021-04-01 14:00:11 +0200 | [diff] [blame] | 858 | O_SERVER_ARGS="-accept $PORT -cipher NULL,ALL -$MODE" |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 859 | G_SERVER_ARGS="-p $PORT --http $G_MODE" |
Mateusz Starzyk | 5224e29 | 2021-02-22 14:36:29 +0100 | [diff] [blame] | 860 | G_SERVER_PRIO="NORMAL:${G_PRIO_CCM}+NULL:+MD5:+PSK:+DHE-PSK:+ECDHE-PSK:+SHA256:+SHA384:+RSA-PSK:-VERS-TLS-ALL:$G_PRIO_MODE" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 861 | |
Gilles Peskine | 96f5bae | 2021-04-01 14:00:11 +0200 | [diff] [blame] | 862 | # The default prime for `openssl s_server` depends on the version: |
| 863 | # * OpenSSL <= 1.0.2a: 512-bit |
| 864 | # * OpenSSL 1.0.2b to 1.1.1b: 1024-bit |
| 865 | # * OpenSSL >= 1.1.1c: 2048-bit |
| 866 | # Mbed TLS wants >=1024, so force that for older versions. Don't force |
| 867 | # it for newer versions, which reject a 1024-bit prime. Indifferently |
| 868 | # force it or not for intermediate versions. |
| 869 | case $($OPENSSL_CMD version) in |
| 870 | "OpenSSL 1.0"*) |
| 871 | O_SERVER_ARGS="$O_SERVER_ARGS -dhparam data_files/dhparams.pem" |
| 872 | ;; |
| 873 | esac |
| 874 | |
Manuel Pégourié-Gonnard | d1af102 | 2014-07-11 17:01:06 +0200 | [diff] [blame] | 875 | # with OpenSSL 1.0.1h, -www, -WWW and -HTTP break DTLS handshakes |
| 876 | if is_dtls "$MODE"; then |
Manuel Pégourié-Gonnard | 3679519 | 2014-09-26 16:33:45 +0200 | [diff] [blame] | 877 | O_SERVER_ARGS="$O_SERVER_ARGS" |
Manuel Pégourié-Gonnard | d1af102 | 2014-07-11 17:01:06 +0200 | [diff] [blame] | 878 | else |
| 879 | O_SERVER_ARGS="$O_SERVER_ARGS -www" |
| 880 | fi |
| 881 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 882 | M_CLIENT_ARGS="server_port=$PORT server_addr=127.0.0.1 force_version=$MODE" |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 883 | O_CLIENT_ARGS="-connect localhost:$PORT -$MODE" |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 884 | G_CLIENT_ARGS="-p $PORT --debug 3 $G_MODE" |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 885 | G_CLIENT_PRIO="NONE:$G_PRIO_MODE:+COMP-NULL:+CURVE-ALL:+SIGN-ALL" |
Manuel Pégourié-Gonnard | 9ada01a | 2014-02-19 14:24:24 +0100 | [diff] [blame] | 886 | |
Manuel Pégourié-Gonnard | d941a79 | 2014-02-19 13:35:52 +0100 | [diff] [blame] | 887 | if [ "X$VERIFY" = "XYES" ]; |
| 888 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 889 | M_SERVER_ARGS="$M_SERVER_ARGS ca_file=data_files/test-ca_cat12.crt auth_mode=required" |
Manuel Pégourié-Gonnard | 9ada01a | 2014-02-19 14:24:24 +0100 | [diff] [blame] | 890 | O_SERVER_ARGS="$O_SERVER_ARGS -CAfile data_files/test-ca_cat12.crt -Verify 10" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 891 | G_SERVER_ARGS="$G_SERVER_ARGS --x509cafile data_files/test-ca_cat12.crt --require-client-cert" |
| 892 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 893 | M_CLIENT_ARGS="$M_CLIENT_ARGS ca_file=data_files/test-ca_cat12.crt auth_mode=required" |
Manuel Pégourié-Gonnard | da782c9 | 2014-02-21 10:10:20 +0100 | [diff] [blame] | 894 | O_CLIENT_ARGS="$O_CLIENT_ARGS -CAfile data_files/test-ca_cat12.crt -verify 10" |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 895 | G_CLIENT_ARGS="$G_CLIENT_ARGS --x509cafile data_files/test-ca_cat12.crt" |
Manuel Pégourié-Gonnard | da782c9 | 2014-02-21 10:10:20 +0100 | [diff] [blame] | 896 | else |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 897 | # don't request a client cert at all |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 898 | M_SERVER_ARGS="$M_SERVER_ARGS ca_file=none auth_mode=none" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 899 | G_SERVER_ARGS="$G_SERVER_ARGS --disable-client-cert" |
| 900 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 901 | M_CLIENT_ARGS="$M_CLIENT_ARGS ca_file=none auth_mode=none" |
Manuel Pégourié-Gonnard | 5de31ec | 2014-03-19 17:34:52 +0100 | [diff] [blame] | 902 | O_CLIENT_ARGS="$O_CLIENT_ARGS" |
| 903 | G_CLIENT_ARGS="$G_CLIENT_ARGS --insecure" |
Manuel Pégourié-Gonnard | d941a79 | 2014-02-19 13:35:52 +0100 | [diff] [blame] | 904 | fi |
| 905 | |
| 906 | case $TYPE in |
| 907 | "ECDSA") |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 908 | M_SERVER_ARGS="$M_SERVER_ARGS crt_file=data_files/server5.crt key_file=data_files/server5.key" |
Manuel Pégourié-Gonnard | 9ada01a | 2014-02-19 14:24:24 +0100 | [diff] [blame] | 909 | O_SERVER_ARGS="$O_SERVER_ARGS -cert data_files/server5.crt -key data_files/server5.key" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 910 | G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key" |
| 911 | |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 912 | if [ "X$VERIFY" = "XYES" ]; then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 913 | M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=data_files/server6.crt key_file=data_files/server6.key" |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 914 | O_CLIENT_ARGS="$O_CLIENT_ARGS -cert data_files/server6.crt -key data_files/server6.key" |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 915 | G_CLIENT_ARGS="$G_CLIENT_ARGS --x509certfile data_files/server6.crt --x509keyfile data_files/server6.key" |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 916 | else |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 917 | M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=none key_file=none" |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 918 | fi |
Manuel Pégourié-Gonnard | d941a79 | 2014-02-19 13:35:52 +0100 | [diff] [blame] | 919 | ;; |
| 920 | |
| 921 | "RSA") |
Manuel Pégourié-Gonnard | 499bf4c | 2020-08-21 12:24:32 +0200 | [diff] [blame] | 922 | M_SERVER_ARGS="$M_SERVER_ARGS crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key" |
| 923 | O_SERVER_ARGS="$O_SERVER_ARGS -cert data_files/server2-sha256.crt -key data_files/server2.key" |
| 924 | G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 925 | |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 926 | if [ "X$VERIFY" = "XYES" ]; then |
Manuel Pégourié-Gonnard | 499bf4c | 2020-08-21 12:24:32 +0200 | [diff] [blame] | 927 | M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=data_files/cert_sha256.crt key_file=data_files/server1.key" |
| 928 | O_CLIENT_ARGS="$O_CLIENT_ARGS -cert data_files/cert_sha256.crt -key data_files/server1.key" |
| 929 | G_CLIENT_ARGS="$G_CLIENT_ARGS --x509certfile data_files/cert_sha256.crt --x509keyfile data_files/server1.key" |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 930 | else |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 931 | M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=none key_file=none" |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 932 | fi |
Manuel Pégourié-Gonnard | d941a79 | 2014-02-19 13:35:52 +0100 | [diff] [blame] | 933 | ;; |
| 934 | |
| 935 | "PSK") |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 936 | # give RSA-PSK-capable server a RSA cert |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 937 | # (should be a separate type, but harder to close with openssl) |
Manuel Pégourié-Gonnard | 499bf4c | 2020-08-21 12:24:32 +0200 | [diff] [blame] | 938 | M_SERVER_ARGS="$M_SERVER_ARGS psk=6162636465666768696a6b6c6d6e6f70 ca_file=none crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key" |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 939 | O_SERVER_ARGS="$O_SERVER_ARGS -psk 6162636465666768696a6b6c6d6e6f70 -nocert" |
Manuel Pégourié-Gonnard | 499bf4c | 2020-08-21 12:24:32 +0200 | [diff] [blame] | 940 | G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --pskpasswd data_files/passwd.psk" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 941 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 942 | M_CLIENT_ARGS="$M_CLIENT_ARGS psk=6162636465666768696a6b6c6d6e6f70 crt_file=none key_file=none" |
Manuel Pégourié-Gonnard | 9ada01a | 2014-02-19 14:24:24 +0100 | [diff] [blame] | 943 | O_CLIENT_ARGS="$O_CLIENT_ARGS -psk 6162636465666768696a6b6c6d6e6f70" |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 944 | G_CLIENT_ARGS="$G_CLIENT_ARGS --pskusername Client_identity --pskkey=6162636465666768696a6b6c6d6e6f70" |
Manuel Pégourié-Gonnard | d941a79 | 2014-02-19 13:35:52 +0100 | [diff] [blame] | 945 | ;; |
| 946 | esac |
| 947 | } |
| 948 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 949 | # is_mbedtls <cmd_line> |
| 950 | is_mbedtls() { |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 951 | echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null |
| 952 | } |
| 953 | |
| 954 | # has_mem_err <log_file_name> |
| 955 | has_mem_err() { |
| 956 | if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" && |
| 957 | grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null |
| 958 | then |
| 959 | return 1 # false: does not have errors |
| 960 | else |
| 961 | return 0 # true: has errors |
| 962 | fi |
| 963 | } |
| 964 | |
Gilles Peskine | 12c49c7 | 2017-12-14 19:02:00 +0100 | [diff] [blame] | 965 | # Wait for process $2 to be listening on port $1 |
| 966 | if type lsof >/dev/null 2>/dev/null; then |
| 967 | wait_server_start() { |
| 968 | START_TIME=$(date +%s) |
| 969 | if is_dtls "$MODE"; then |
| 970 | proto=UDP |
| 971 | else |
| 972 | proto=TCP |
| 973 | fi |
| 974 | while ! lsof -a -n -b -i "$proto:$1" -p "$2" >/dev/null 2>/dev/null; do |
| 975 | if [ $(( $(date +%s) - $START_TIME )) -gt $DOG_DELAY ]; then |
| 976 | echo "SERVERSTART TIMEOUT" |
| 977 | echo "SERVERSTART TIMEOUT" >> $SRV_OUT |
| 978 | break |
| 979 | fi |
| 980 | # Linux and *BSD support decimal arguments to sleep. On other |
| 981 | # OSes this may be a tight loop. |
| 982 | sleep 0.1 2>/dev/null || true |
| 983 | done |
| 984 | } |
| 985 | else |
Gilles Peskine | 3c9e2b5 | 2018-01-08 12:38:15 +0100 | [diff] [blame] | 986 | echo "Warning: lsof not available, wait_server_start = sleep" |
Gilles Peskine | 12c49c7 | 2017-12-14 19:02:00 +0100 | [diff] [blame] | 987 | wait_server_start() { |
Manuel Pégourié-Gonnard | 0d225da | 2018-01-22 10:22:09 +0100 | [diff] [blame] | 988 | sleep 2 |
Gilles Peskine | 12c49c7 | 2017-12-14 19:02:00 +0100 | [diff] [blame] | 989 | } |
| 990 | fi |
| 991 | |
| 992 | |
Manuel Pégourié-Gonnard | 304beef | 2014-02-19 14:45:00 +0100 | [diff] [blame] | 993 | # start_server <name> |
| 994 | # also saves name and command |
| 995 | start_server() { |
Manuel Pégourié-Gonnard | 304beef | 2014-02-19 14:45:00 +0100 | [diff] [blame] | 996 | case $1 in |
| 997 | [Oo]pen*) |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 998 | SERVER_CMD="$OPENSSL_CMD s_server $O_SERVER_ARGS" |
Manuel Pégourié-Gonnard | 304beef | 2014-02-19 14:45:00 +0100 | [diff] [blame] | 999 | ;; |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 1000 | [Gg]nu*) |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 1001 | SERVER_CMD="$GNUTLS_SERV $G_SERVER_ARGS --priority $G_SERVER_PRIO" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 1002 | ;; |
Manuel Pégourié-Gonnard | a8f3b75 | 2015-01-22 17:05:05 +0000 | [diff] [blame] | 1003 | mbed*) |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1004 | SERVER_CMD="$M_SRV $M_SERVER_ARGS" |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 1005 | if [ "$MEMCHECK" -gt 0 ]; then |
| 1006 | SERVER_CMD="valgrind --leak-check=full $SERVER_CMD" |
| 1007 | fi |
Manuel Pégourié-Gonnard | 304beef | 2014-02-19 14:45:00 +0100 | [diff] [blame] | 1008 | ;; |
| 1009 | *) |
| 1010 | echo "error: invalid server name: $1" >&2 |
| 1011 | exit 1 |
| 1012 | ;; |
| 1013 | esac |
| 1014 | SERVER_NAME=$1 |
| 1015 | |
| 1016 | log "$SERVER_CMD" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1017 | echo "$SERVER_CMD" > $SRV_OUT |
Manuel Pégourié-Gonnard | d1af102 | 2014-07-11 17:01:06 +0200 | [diff] [blame] | 1018 | # for servers without -www or equivalent |
Manuel Pégourié-Gonnard | 82cf0a1 | 2015-02-09 13:05:54 +0000 | [diff] [blame] | 1019 | while :; do echo bla; sleep 1; done | $SERVER_CMD >> $SRV_OUT 2>&1 & |
Manuel Pégourié-Gonnard | 304beef | 2014-02-19 14:45:00 +0100 | [diff] [blame] | 1020 | PROCESS_ID=$! |
| 1021 | |
Gilles Peskine | 12c49c7 | 2017-12-14 19:02:00 +0100 | [diff] [blame] | 1022 | wait_server_start "$PORT" "$PROCESS_ID" |
Manuel Pégourié-Gonnard | 304beef | 2014-02-19 14:45:00 +0100 | [diff] [blame] | 1023 | } |
| 1024 | |
Manuel Pégourié-Gonnard | 1649449 | 2014-08-31 10:37:14 +0200 | [diff] [blame] | 1025 | # terminate the running server |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 1026 | stop_server() { |
Manuel Pégourié-Gonnard | 74b1170 | 2014-08-14 15:47:33 +0200 | [diff] [blame] | 1027 | kill $PROCESS_ID 2>/dev/null |
| 1028 | wait $PROCESS_ID 2>/dev/null |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 1029 | |
| 1030 | if [ "$MEMCHECK" -gt 0 ]; then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1031 | if is_mbedtls "$SERVER_CMD" && has_mem_err $SRV_OUT; then |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 1032 | echo " ! Server had memory errors" |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1033 | SRVMEM=$(( $SRVMEM + 1 )) |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 1034 | return |
| 1035 | fi |
| 1036 | fi |
| 1037 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1038 | rm -f $SRV_OUT |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 1039 | } |
| 1040 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 1041 | # kill the running server (used when killed by signal) |
| 1042 | cleanup() { |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1043 | rm -f $SRV_OUT $CLI_OUT |
Manuel Pégourié-Gonnard | 1649449 | 2014-08-31 10:37:14 +0200 | [diff] [blame] | 1044 | kill $PROCESS_ID >/dev/null 2>&1 |
| 1045 | kill $WATCHDOG_PID >/dev/null 2>&1 |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 1046 | exit 1 |
| 1047 | } |
| 1048 | |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1049 | # wait for client to terminate and set EXIT |
| 1050 | # must be called right after starting the client |
| 1051 | wait_client_done() { |
| 1052 | CLI_PID=$! |
| 1053 | |
| 1054 | ( sleep "$DOG_DELAY"; echo "TIMEOUT" >> $CLI_OUT; kill $CLI_PID ) & |
| 1055 | WATCHDOG_PID=$! |
| 1056 | |
| 1057 | wait $CLI_PID |
| 1058 | EXIT=$? |
| 1059 | |
| 1060 | kill $WATCHDOG_PID |
| 1061 | wait $WATCHDOG_PID |
| 1062 | |
| 1063 | echo "EXIT: $EXIT" >> $CLI_OUT |
| 1064 | } |
| 1065 | |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1066 | # run_client <name> <cipher> |
| 1067 | run_client() { |
Manuel Pégourié-Gonnard | 87ae303 | 2014-02-27 11:12:30 +0100 | [diff] [blame] | 1068 | # announce what we're going to do |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1069 | TESTS=$(( $TESTS + 1 )) |
Manuel Pégourié-Gonnard | 87ae303 | 2014-02-27 11:12:30 +0100 | [diff] [blame] | 1070 | VERIF=$(echo $VERIFY | tr '[:upper:]' '[:lower:]') |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1071 | TITLE="`echo $1 | head -c1`->`echo $SERVER_NAME | head -c1`" |
| 1072 | TITLE="$TITLE $MODE,$VERIF $2" |
Gilles Peskine | 231befa | 2020-08-26 20:05:11 +0200 | [diff] [blame] | 1073 | printf "%s " "$TITLE" |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1074 | LEN=$(( 72 - `echo "$TITLE" | wc -c` )) |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 1075 | for i in `seq 1 $LEN`; do printf '.'; done; printf ' ' |
Manuel Pégourié-Gonnard | 87ae303 | 2014-02-27 11:12:30 +0100 | [diff] [blame] | 1076 | |
Manuel Pégourié-Gonnard | 53aef81 | 2014-07-11 17:41:24 +0200 | [diff] [blame] | 1077 | # should we skip? |
| 1078 | if [ "X$SKIP_NEXT" = "XYES" ]; then |
| 1079 | SKIP_NEXT="NO" |
| 1080 | echo "SKIP" |
| 1081 | SKIPPED=$(( $SKIPPED + 1 )) |
| 1082 | return |
| 1083 | fi |
| 1084 | |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1085 | # run the command and interpret result |
| 1086 | case $1 in |
| 1087 | [Oo]pen*) |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 1088 | CLIENT_CMD="$OPENSSL_CMD s_client $O_CLIENT_ARGS -cipher $2" |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1089 | log "$CLIENT_CMD" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1090 | echo "$CLIENT_CMD" > $CLI_OUT |
Manuel Pégourié-Gonnard | 9afdc83 | 2015-08-04 17:15:13 +0200 | [diff] [blame] | 1091 | printf 'GET HTTP/1.0\r\n\r\n' | $CLIENT_CMD >> $CLI_OUT 2>&1 & |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1092 | wait_client_done |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1093 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1094 | if [ $EXIT -eq 0 ]; then |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1095 | RESULT=0 |
| 1096 | else |
Darryl Green | 11999bb | 2018-03-13 15:22:58 +0000 | [diff] [blame] | 1097 | # If the cipher isn't supported... |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1098 | if grep 'Cipher is (NONE)' $CLI_OUT >/dev/null; then |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1099 | RESULT=1 |
| 1100 | else |
| 1101 | RESULT=2 |
| 1102 | fi |
| 1103 | fi |
| 1104 | ;; |
| 1105 | |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 1106 | [Gg]nu*) |
Manuel Pégourié-Gonnard | 29980b1 | 2014-07-10 20:12:56 +0200 | [diff] [blame] | 1107 | # need to force IPv4 with UDP, but keep localhost for auth |
| 1108 | if is_dtls "$MODE"; then |
| 1109 | G_HOST="127.0.0.1" |
| 1110 | else |
| 1111 | G_HOST="localhost" |
| 1112 | fi |
| 1113 | CLIENT_CMD="$GNUTLS_CLI $G_CLIENT_ARGS --priority $G_PRIO_MODE:$2 $G_HOST" |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 1114 | log "$CLIENT_CMD" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1115 | echo "$CLIENT_CMD" > $CLI_OUT |
Manuel Pégourié-Gonnard | 9afdc83 | 2015-08-04 17:15:13 +0200 | [diff] [blame] | 1116 | printf 'GET HTTP/1.0\r\n\r\n' | $CLIENT_CMD >> $CLI_OUT 2>&1 & |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1117 | wait_client_done |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 1118 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1119 | if [ $EXIT -eq 0 ]; then |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 1120 | RESULT=0 |
| 1121 | else |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1122 | RESULT=2 |
| 1123 | # interpret early failure, with a handshake_failure alert |
| 1124 | # before the server hello, as "no ciphersuite in common" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1125 | if grep -F 'Received alert [40]: Handshake failed' $CLI_OUT; then |
| 1126 | if grep -i 'SERVER HELLO .* was received' $CLI_OUT; then : |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1127 | else |
| 1128 | RESULT=1 |
| 1129 | fi |
| 1130 | fi >/dev/null |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 1131 | fi |
| 1132 | ;; |
| 1133 | |
Manuel Pégourié-Gonnard | a8f3b75 | 2015-01-22 17:05:05 +0000 | [diff] [blame] | 1134 | mbed*) |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1135 | CLIENT_CMD="$M_CLI $M_CLIENT_ARGS force_ciphersuite=$2" |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 1136 | if [ "$MEMCHECK" -gt 0 ]; then |
| 1137 | CLIENT_CMD="valgrind --leak-check=full $CLIENT_CMD" |
| 1138 | fi |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1139 | log "$CLIENT_CMD" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1140 | echo "$CLIENT_CMD" > $CLI_OUT |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1141 | $CLIENT_CMD >> $CLI_OUT 2>&1 & |
| 1142 | wait_client_done |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1143 | |
| 1144 | case $EXIT in |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1145 | # Success |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1146 | "0") RESULT=0 ;; |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1147 | |
| 1148 | # Ciphersuite not supported |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1149 | "2") RESULT=1 ;; |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1150 | |
| 1151 | # Error |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1152 | *) RESULT=2 ;; |
| 1153 | esac |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 1154 | |
| 1155 | if [ "$MEMCHECK" -gt 0 ]; then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1156 | if is_mbedtls "$CLIENT_CMD" && has_mem_err $CLI_OUT; then |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 1157 | RESULT=2 |
| 1158 | fi |
| 1159 | fi |
| 1160 | |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1161 | ;; |
| 1162 | |
| 1163 | *) |
| 1164 | echo "error: invalid client name: $1" >&2 |
| 1165 | exit 1 |
| 1166 | ;; |
| 1167 | esac |
| 1168 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1169 | echo "EXIT: $EXIT" >> $CLI_OUT |
Manuel Pégourié-Gonnard | e01af4c | 2014-03-25 14:16:44 +0100 | [diff] [blame] | 1170 | |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1171 | # report and count result |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1172 | case $RESULT in |
| 1173 | "0") |
Manuel Pégourié-Gonnard | 4145b89 | 2014-02-24 13:20:14 +0100 | [diff] [blame] | 1174 | echo PASS |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1175 | ;; |
| 1176 | "1") |
Manuel Pégourié-Gonnard | 4145b89 | 2014-02-24 13:20:14 +0100 | [diff] [blame] | 1177 | echo SKIP |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1178 | SKIPPED=$(( $SKIPPED + 1 )) |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1179 | ;; |
| 1180 | "2") |
Manuel Pégourié-Gonnard | 4145b89 | 2014-02-24 13:20:14 +0100 | [diff] [blame] | 1181 | echo FAIL |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1182 | cp $SRV_OUT c-srv-${TESTS}.log |
| 1183 | cp $CLI_OUT c-cli-${TESTS}.log |
| 1184 | echo " ! outputs saved to c-srv-${TESTS}.log, c-cli-${TESTS}.log" |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 1185 | |
Manuel Pégourié-Gonnard | 882148e | 2020-07-27 09:46:53 +0200 | [diff] [blame] | 1186 | if [ "${LOG_FAILURE_ON_STDOUT:-0}" != 0 ]; then |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 1187 | echo " ! server output:" |
| 1188 | cat c-srv-${TESTS}.log |
| 1189 | echo " ! ===================================================" |
| 1190 | echo " ! client output:" |
| 1191 | cat c-cli-${TESTS}.log |
| 1192 | fi |
| 1193 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1194 | FAILED=$(( $FAILED + 1 )) |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1195 | ;; |
| 1196 | esac |
Manuel Pégourié-Gonnard | 87ae303 | 2014-02-27 11:12:30 +0100 | [diff] [blame] | 1197 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1198 | rm -f $CLI_OUT |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1199 | } |
| 1200 | |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 1201 | # |
| 1202 | # MAIN |
| 1203 | # |
| 1204 | |
Manuel Pégourié-Gonnard | 19db8ea | 2015-03-10 13:41:04 +0000 | [diff] [blame] | 1205 | if cd $( dirname $0 ); then :; else |
| 1206 | echo "cd $( dirname $0 ) failed" >&2 |
| 1207 | exit 1 |
| 1208 | fi |
| 1209 | |
Manuel Pégourié-Gonnard | 3947d04 | 2014-03-14 18:13:53 +0100 | [diff] [blame] | 1210 | get_options "$@" |
| 1211 | |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1212 | # sanity checks, avoid an avalanche of errors |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1213 | if [ ! -x "$M_SRV" ]; then |
| 1214 | echo "Command '$M_SRV' is not an executable file" >&2 |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1215 | exit 1 |
| 1216 | fi |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1217 | if [ ! -x "$M_CLI" ]; then |
| 1218 | echo "Command '$M_CLI' is not an executable file" >&2 |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1219 | exit 1 |
| 1220 | fi |
Manuel Pégourié-Gonnard | 3947d04 | 2014-03-14 18:13:53 +0100 | [diff] [blame] | 1221 | |
| 1222 | if echo "$PEERS" | grep -i openssl > /dev/null; then |
| 1223 | if which "$OPENSSL_CMD" >/dev/null 2>&1; then :; else |
| 1224 | echo "Command '$OPENSSL_CMD' not found" >&2 |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 1225 | exit 1 |
| 1226 | fi |
Manuel Pégourié-Gonnard | 3947d04 | 2014-03-14 18:13:53 +0100 | [diff] [blame] | 1227 | fi |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1228 | |
Manuel Pégourié-Gonnard | 3947d04 | 2014-03-14 18:13:53 +0100 | [diff] [blame] | 1229 | if echo "$PEERS" | grep -i gnutls > /dev/null; then |
| 1230 | for CMD in "$GNUTLS_CLI" "$GNUTLS_SERV"; do |
| 1231 | if which "$CMD" >/dev/null 2>&1; then :; else |
| 1232 | echo "Command '$CMD' not found" >&2 |
| 1233 | exit 1 |
| 1234 | fi |
| 1235 | done |
| 1236 | fi |
| 1237 | |
| 1238 | for PEER in $PEERS; do |
| 1239 | case "$PEER" in |
Manuel Pégourié-Gonnard | a8f3b75 | 2015-01-22 17:05:05 +0000 | [diff] [blame] | 1240 | mbed*|[Oo]pen*|[Gg]nu*) |
Manuel Pégourié-Gonnard | 3947d04 | 2014-03-14 18:13:53 +0100 | [diff] [blame] | 1241 | ;; |
| 1242 | *) |
| 1243 | echo "Unknown peers: $PEER" >&2 |
| 1244 | exit 1 |
| 1245 | esac |
| 1246 | done |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 1247 | |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 1248 | # Pick a "unique" port in the range 10000-19999. |
| 1249 | PORT="0000$$" |
Manuel Pégourié-Gonnard | fab2a3c | 2014-06-16 16:54:36 +0200 | [diff] [blame] | 1250 | PORT="1$(echo $PORT | tail -c 5)" |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 1251 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1252 | # Also pick a unique name for intermediate files |
| 1253 | SRV_OUT="srv_out.$$" |
| 1254 | CLI_OUT="cli_out.$$" |
| 1255 | |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1256 | # client timeout delay: be more patient with valgrind |
| 1257 | if [ "$MEMCHECK" -gt 0 ]; then |
| 1258 | DOG_DELAY=30 |
| 1259 | else |
| 1260 | DOG_DELAY=10 |
| 1261 | fi |
| 1262 | |
Manuel Pégourié-Gonnard | 53aef81 | 2014-07-11 17:41:24 +0200 | [diff] [blame] | 1263 | SKIP_NEXT="NO" |
| 1264 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 1265 | trap cleanup INT TERM HUP |
| 1266 | |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 1267 | for VERIFY in $VERIFIES; do |
| 1268 | for MODE in $MODES; do |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 1269 | for TYPE in $TYPES; do |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1270 | for PEER in $PEERS; do |
Paul Bakker | 7e5e7ca | 2013-04-17 19:27:58 +0200 | [diff] [blame] | 1271 | |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 1272 | setup_arguments |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 1273 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1274 | case "$PEER" in |
Manuel Pégourié-Gonnard | d331319 | 2013-09-13 19:20:37 +0200 | [diff] [blame] | 1275 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1276 | [Oo]pen*) |
Paul Bakker | 398cb51 | 2012-04-10 08:22:31 +0000 | [diff] [blame] | 1277 | |
Manuel Pégourié-Gonnard | 39e2ca9 | 2015-08-04 16:43:37 +0200 | [diff] [blame] | 1278 | if test "$OSSL_NO_DTLS" -gt 0 && is_dtls "$MODE"; then |
| 1279 | continue; |
| 1280 | fi |
| 1281 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1282 | reset_ciphersuites |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 1283 | add_common_ciphersuites |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1284 | add_openssl_ciphersuites |
| 1285 | filter_ciphersuites |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1286 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1287 | if [ "X" != "X$M_CIPHERS" ]; then |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1288 | start_server "OpenSSL" |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1289 | for i in $M_CIPHERS; do |
Manuel Pégourié-Gonnard | 53aef81 | 2014-07-11 17:41:24 +0200 | [diff] [blame] | 1290 | check_openssl_server_bug $i |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 1291 | run_client mbedTLS $i |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1292 | done |
| 1293 | stop_server |
| 1294 | fi |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 1295 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1296 | if [ "X" != "X$O_CIPHERS" ]; then |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 1297 | start_server "mbedTLS" |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1298 | for i in $O_CIPHERS; do |
| 1299 | run_client OpenSSL $i |
| 1300 | done |
| 1301 | stop_server |
| 1302 | fi |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 1303 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1304 | ;; |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 1305 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1306 | [Gg]nu*) |
Paul Bakker | fab5c82 | 2012-02-06 16:45:10 +0000 | [diff] [blame] | 1307 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1308 | reset_ciphersuites |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 1309 | add_common_ciphersuites |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1310 | add_gnutls_ciphersuites |
| 1311 | filter_ciphersuites |
Paul Bakker | fab5c82 | 2012-02-06 16:45:10 +0000 | [diff] [blame] | 1312 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1313 | if [ "X" != "X$M_CIPHERS" ]; then |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1314 | start_server "GnuTLS" |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1315 | for i in $M_CIPHERS; do |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 1316 | run_client mbedTLS $i |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1317 | done |
| 1318 | stop_server |
| 1319 | fi |
| 1320 | |
| 1321 | if [ "X" != "X$G_CIPHERS" ]; then |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 1322 | start_server "mbedTLS" |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1323 | for i in $G_CIPHERS; do |
| 1324 | run_client GnuTLS $i |
| 1325 | done |
| 1326 | stop_server |
| 1327 | fi |
| 1328 | |
| 1329 | ;; |
| 1330 | |
Manuel Pégourié-Gonnard | a8f3b75 | 2015-01-22 17:05:05 +0000 | [diff] [blame] | 1331 | mbed*) |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1332 | |
| 1333 | reset_ciphersuites |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 1334 | add_common_ciphersuites |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1335 | add_openssl_ciphersuites |
| 1336 | add_gnutls_ciphersuites |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1337 | add_mbedtls_ciphersuites |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1338 | filter_ciphersuites |
| 1339 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1340 | if [ "X" != "X$M_CIPHERS" ]; then |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 1341 | start_server "mbedTLS" |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1342 | for i in $M_CIPHERS; do |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 1343 | run_client mbedTLS $i |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1344 | done |
| 1345 | stop_server |
| 1346 | fi |
| 1347 | |
| 1348 | ;; |
| 1349 | |
Manuel Pégourié-Gonnard | a1a9f9a | 2014-03-25 18:04:59 +0100 | [diff] [blame] | 1350 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 1351 | echo "Unknown peer: $PEER" >&2 |
Manuel Pégourié-Gonnard | a1a9f9a | 2014-03-25 18:04:59 +0100 | [diff] [blame] | 1352 | exit 1 |
| 1353 | ;; |
| 1354 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1355 | esac |
| 1356 | |
| 1357 | done |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 1358 | done |
| 1359 | done |
Manuel Pégourié-Gonnard | 9791a40 | 2013-08-27 19:57:15 +0200 | [diff] [blame] | 1360 | done |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 1361 | |
Manuel Pégourié-Gonnard | 4145b89 | 2014-02-24 13:20:14 +0100 | [diff] [blame] | 1362 | echo "------------------------------------------------------------------------" |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 1363 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1364 | if [ $FAILED -ne 0 -o $SRVMEM -ne 0 ]; |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 1365 | then |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 1366 | printf "FAILED" |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 1367 | else |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 1368 | printf "PASSED" |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 1369 | fi |
| 1370 | |
Manuel Pégourié-Gonnard | ba0b844 | 2014-03-13 17:57:45 +0100 | [diff] [blame] | 1371 | if [ "$MEMCHECK" -gt 0 ]; then |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1372 | MEMREPORT=", $SRVMEM server memory errors" |
Manuel Pégourié-Gonnard | ba0b844 | 2014-03-13 17:57:45 +0100 | [diff] [blame] | 1373 | else |
| 1374 | MEMREPORT="" |
| 1375 | fi |
| 1376 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1377 | PASSED=$(( $TESTS - $FAILED )) |
| 1378 | echo " ($PASSED / $TESTS tests ($SKIPPED skipped$MEMREPORT))" |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 1379 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1380 | FAILED=$(( $FAILED + $SRVMEM )) |
| 1381 | exit $FAILED |