Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1 | #!/bin/sh |
| 2 | |
| 3 | # Test various options that are not covered by compat.sh |
| 4 | # |
| 5 | # Here the goal is not to cover every ciphersuite/version, but |
| 6 | # rather specific options (max fragment length, truncated hmac, etc) |
| 7 | # or procedures (session resumption from cache or ticket, renego, etc). |
| 8 | # |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 9 | # Assumes a build with default options. |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 10 | |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 11 | set -u |
| 12 | |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 13 | # default values, can be overriden by the environment |
| 14 | : ${P_SRV:=../programs/ssl/ssl_server2} |
| 15 | : ${P_CLI:=../programs/ssl/ssl_client2} |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 16 | : ${P_PXY:=../programs/test/udp_proxy} |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 17 | : ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 18 | : ${GNUTLS_CLI:=gnutls-cli} |
| 19 | : ${GNUTLS_SERV:=gnutls-serv} |
Gilles Peskine | 39e2981 | 2017-05-16 17:53:03 +0200 | [diff] [blame] | 20 | : ${PERL:=perl} |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 21 | |
Manuel Pégourié-Gonnard | fa60f12 | 2014-09-26 16:07:29 +0200 | [diff] [blame] | 22 | O_SRV="$OPENSSL_CMD s_server -www -cert data_files/server5.crt -key data_files/server5.key" |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 23 | O_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_CMD s_client" |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 24 | G_SRV="$GNUTLS_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key" |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 25 | G_CLI="echo 'GET / HTTP/1.0' | $GNUTLS_CLI --x509cafile data_files/test-ca_cat12.crt" |
Gilles Peskine | 39e2981 | 2017-05-16 17:53:03 +0200 | [diff] [blame] | 26 | TCP_CLIENT="$PERL scripts/tcp_client.pl" |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 27 | |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 28 | TESTS=0 |
| 29 | FAILS=0 |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 30 | SKIPS=0 |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 31 | |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 32 | CONFIG_H='../include/mbedtls/config.h' |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 33 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 34 | MEMCHECK=0 |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 35 | FILTER='.*' |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 36 | EXCLUDE='^$' |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 37 | |
| 38 | print_usage() { |
| 39 | echo "Usage: $0 [options]" |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 40 | printf " -h|--help\tPrint this help.\n" |
| 41 | printf " -m|--memcheck\tCheck memory leaks and errors.\n" |
| 42 | printf " -f|--filter\tOnly matching tests are executed (default: '$FILTER')\n" |
| 43 | printf " -e|--exclude\tMatching tests are excluded (default: '$EXCLUDE')\n" |
Gilles Peskine | bb4aaf1 | 2017-11-30 15:56:20 +0100 | [diff] [blame] | 44 | printf " --seed\tInteger seed value to use for this test run (default: random)\n" |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 45 | } |
| 46 | |
| 47 | get_options() { |
| 48 | while [ $# -gt 0 ]; do |
| 49 | case "$1" in |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 50 | -f|--filter) |
| 51 | shift; FILTER=$1 |
| 52 | ;; |
| 53 | -e|--exclude) |
| 54 | shift; EXCLUDE=$1 |
| 55 | ;; |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 56 | -m|--memcheck) |
| 57 | MEMCHECK=1 |
| 58 | ;; |
Gilles Peskine | bb4aaf1 | 2017-11-30 15:56:20 +0100 | [diff] [blame] | 59 | --seed) |
| 60 | shift; SEED="$1" |
| 61 | ;; |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 62 | -h|--help) |
| 63 | print_usage |
| 64 | exit 0 |
| 65 | ;; |
| 66 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 67 | echo "Unknown argument: '$1'" |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 68 | print_usage |
| 69 | exit 1 |
| 70 | ;; |
| 71 | esac |
| 72 | shift |
| 73 | done |
| 74 | } |
| 75 | |
Manuel Pégourié-Gonnard | 988209f | 2015-03-24 10:43:55 +0100 | [diff] [blame] | 76 | # skip next test if the flag is not enabled in config.h |
| 77 | requires_config_enabled() { |
| 78 | if grep "^#define $1" $CONFIG_H > /dev/null; then :; else |
| 79 | SKIP_NEXT="YES" |
| 80 | fi |
| 81 | } |
| 82 | |
Manuel Pégourié-Gonnard | 5539366 | 2017-06-08 17:51:08 +0200 | [diff] [blame] | 83 | # skip next test if the flag is enabled in config.h |
| 84 | requires_config_disabled() { |
| 85 | if grep "^#define $1" $CONFIG_H > /dev/null; then |
| 86 | SKIP_NEXT="YES" |
| 87 | fi |
| 88 | } |
| 89 | |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 90 | # skip next test if OpenSSL doesn't support FALLBACK_SCSV |
| 91 | requires_openssl_with_fallback_scsv() { |
| 92 | if [ -z "${OPENSSL_HAS_FBSCSV:-}" ]; then |
| 93 | if $OPENSSL_CMD s_client -help 2>&1 | grep fallback_scsv >/dev/null |
| 94 | then |
| 95 | OPENSSL_HAS_FBSCSV="YES" |
| 96 | else |
| 97 | OPENSSL_HAS_FBSCSV="NO" |
| 98 | fi |
| 99 | fi |
| 100 | if [ "$OPENSSL_HAS_FBSCSV" = "NO" ]; then |
| 101 | SKIP_NEXT="YES" |
| 102 | fi |
| 103 | } |
| 104 | |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 105 | # skip next test if GnuTLS isn't available |
| 106 | requires_gnutls() { |
| 107 | if [ -z "${GNUTLS_AVAILABLE:-}" ]; then |
Manuel Pégourié-Gonnard | 03db6b0 | 2015-06-26 15:45:30 +0200 | [diff] [blame] | 108 | if ( which "$GNUTLS_CLI" && which "$GNUTLS_SERV" ) >/dev/null 2>&1; then |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 109 | GNUTLS_AVAILABLE="YES" |
| 110 | else |
| 111 | GNUTLS_AVAILABLE="NO" |
| 112 | fi |
| 113 | fi |
| 114 | if [ "$GNUTLS_AVAILABLE" = "NO" ]; then |
| 115 | SKIP_NEXT="YES" |
| 116 | fi |
| 117 | } |
| 118 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 119 | # skip next test if IPv6 isn't available on this host |
| 120 | requires_ipv6() { |
| 121 | if [ -z "${HAS_IPV6:-}" ]; then |
| 122 | $P_SRV server_addr='::1' > $SRV_OUT 2>&1 & |
| 123 | SRV_PID=$! |
| 124 | sleep 1 |
| 125 | kill $SRV_PID >/dev/null 2>&1 |
| 126 | if grep "NET - Binding of the socket failed" $SRV_OUT >/dev/null; then |
| 127 | HAS_IPV6="NO" |
| 128 | else |
| 129 | HAS_IPV6="YES" |
| 130 | fi |
| 131 | rm -r $SRV_OUT |
| 132 | fi |
| 133 | |
| 134 | if [ "$HAS_IPV6" = "NO" ]; then |
| 135 | SKIP_NEXT="YES" |
| 136 | fi |
| 137 | } |
| 138 | |
Manuel Pégourié-Gonnard | 76fe9e4 | 2014-09-24 15:17:31 +0200 | [diff] [blame] | 139 | # skip the next test if valgrind is in use |
| 140 | not_with_valgrind() { |
| 141 | if [ "$MEMCHECK" -gt 0 ]; then |
| 142 | SKIP_NEXT="YES" |
| 143 | fi |
| 144 | } |
| 145 | |
Paul Bakker | 3b224ff | 2016-05-13 10:33:25 +0100 | [diff] [blame] | 146 | # skip the next test if valgrind is NOT in use |
| 147 | only_with_valgrind() { |
| 148 | if [ "$MEMCHECK" -eq 0 ]; then |
| 149 | SKIP_NEXT="YES" |
| 150 | fi |
| 151 | } |
| 152 | |
Manuel Pégourié-Gonnard | a071972 | 2014-09-20 12:46:27 +0200 | [diff] [blame] | 153 | # multiply the client timeout delay by the given factor for the next test |
| 154 | needs_more_time() { |
| 155 | CLI_DELAY_FACTOR=$1 |
| 156 | } |
| 157 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 158 | # print_name <name> |
| 159 | print_name() { |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 160 | printf "$1 " |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 161 | LEN=$(( 72 - `echo "$1" | wc -c` )) |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 162 | for i in `seq 1 $LEN`; do printf '.'; done |
| 163 | printf ' ' |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 164 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 165 | TESTS=$(( $TESTS + 1 )) |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 166 | } |
| 167 | |
| 168 | # fail <message> |
| 169 | fail() { |
| 170 | echo "FAIL" |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 171 | echo " ! $1" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 172 | |
Manuel Pégourié-Gonnard | c2b0092 | 2014-08-31 16:46:04 +0200 | [diff] [blame] | 173 | mv $SRV_OUT o-srv-${TESTS}.log |
| 174 | mv $CLI_OUT o-cli-${TESTS}.log |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 175 | if [ -n "$PXY_CMD" ]; then |
| 176 | mv $PXY_OUT o-pxy-${TESTS}.log |
| 177 | fi |
| 178 | echo " ! outputs saved to o-XXX-${TESTS}.log" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 179 | |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 180 | if [ "X${USER:-}" = Xbuildbot -o "X${LOGNAME:-}" = Xbuildbot ]; then |
| 181 | echo " ! server output:" |
| 182 | cat o-srv-${TESTS}.log |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 183 | echo " ! ========================================================" |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 184 | echo " ! client output:" |
| 185 | cat o-cli-${TESTS}.log |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 186 | if [ -n "$PXY_CMD" ]; then |
| 187 | echo " ! ========================================================" |
| 188 | echo " ! proxy output:" |
| 189 | cat o-pxy-${TESTS}.log |
| 190 | fi |
| 191 | echo "" |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 192 | fi |
| 193 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 194 | FAILS=$(( $FAILS + 1 )) |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 195 | } |
| 196 | |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 197 | # is_polar <cmd_line> |
| 198 | is_polar() { |
| 199 | echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null |
| 200 | } |
| 201 | |
Manuel Pégourié-Gonnard | fa60f12 | 2014-09-26 16:07:29 +0200 | [diff] [blame] | 202 | # openssl s_server doesn't have -www with DTLS |
| 203 | check_osrv_dtls() { |
| 204 | if echo "$SRV_CMD" | grep 's_server.*-dtls' >/dev/null; then |
| 205 | NEEDS_INPUT=1 |
| 206 | SRV_CMD="$( echo $SRV_CMD | sed s/-www// )" |
| 207 | else |
| 208 | NEEDS_INPUT=0 |
| 209 | fi |
| 210 | } |
| 211 | |
| 212 | # provide input to commands that need it |
| 213 | provide_input() { |
| 214 | if [ $NEEDS_INPUT -eq 0 ]; then |
| 215 | return |
| 216 | fi |
| 217 | |
| 218 | while true; do |
| 219 | echo "HTTP/1.0 200 OK" |
| 220 | sleep 1 |
| 221 | done |
| 222 | } |
| 223 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 224 | # has_mem_err <log_file_name> |
| 225 | has_mem_err() { |
| 226 | if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" && |
| 227 | grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null |
| 228 | then |
| 229 | return 1 # false: does not have errors |
| 230 | else |
| 231 | return 0 # true: has errors |
| 232 | fi |
| 233 | } |
| 234 | |
Gilles Peskine | 684a517 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 235 | # Wait for process $2 to be listening on port $1 |
| 236 | if type lsof >/dev/null 2>/dev/null; then |
| 237 | wait_server_start() { |
| 238 | START_TIME=$(date +%s) |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 239 | if [ "$DTLS" -eq 1 ]; then |
Gilles Peskine | 684a517 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 240 | proto=UDP |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 241 | else |
Gilles Peskine | 684a517 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 242 | proto=TCP |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 243 | fi |
Gilles Peskine | 684a517 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 244 | # Make a tight loop, server normally takes less than 1s to start. |
| 245 | while ! lsof -a -n -b -i "$proto:$1" -p "$2" >/dev/null 2>/dev/null; do |
| 246 | if [ $(( $(date +%s) - $START_TIME )) -gt $DOG_DELAY ]; then |
| 247 | echo "SERVERSTART TIMEOUT" |
| 248 | echo "SERVERSTART TIMEOUT" >> $SRV_OUT |
| 249 | break |
| 250 | fi |
| 251 | # Linux and *BSD support decimal arguments to sleep. On other |
| 252 | # OSes this may be a tight loop. |
| 253 | sleep 0.1 2>/dev/null || true |
| 254 | done |
| 255 | } |
| 256 | else |
Gilles Peskine | 784f41c | 2018-01-08 12:38:15 +0100 | [diff] [blame^] | 257 | echo "Warning: lsof not available, wait_server_start = sleep $START_DELAY" |
Gilles Peskine | 684a517 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 258 | wait_server_start() { |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 259 | sleep "$START_DELAY" |
Gilles Peskine | 684a517 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 260 | } |
| 261 | fi |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 262 | |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 263 | # wait for client to terminate and set CLI_EXIT |
| 264 | # must be called right after starting the client |
| 265 | wait_client_done() { |
| 266 | CLI_PID=$! |
| 267 | |
Manuel Pégourié-Gonnard | a071972 | 2014-09-20 12:46:27 +0200 | [diff] [blame] | 268 | CLI_DELAY=$(( $DOG_DELAY * $CLI_DELAY_FACTOR )) |
| 269 | CLI_DELAY_FACTOR=1 |
| 270 | |
Manuel Pégourié-Gonnard | a365add | 2015-08-04 20:57:59 +0200 | [diff] [blame] | 271 | ( sleep $CLI_DELAY; echo "===CLIENT_TIMEOUT===" >> $CLI_OUT; kill $CLI_PID ) & |
Manuel Pégourié-Gonnard | a6189f0 | 2014-09-20 13:15:43 +0200 | [diff] [blame] | 272 | DOG_PID=$! |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 273 | |
| 274 | wait $CLI_PID |
| 275 | CLI_EXIT=$? |
| 276 | |
Manuel Pégourié-Gonnard | a6189f0 | 2014-09-20 13:15:43 +0200 | [diff] [blame] | 277 | kill $DOG_PID >/dev/null 2>&1 |
| 278 | wait $DOG_PID |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 279 | |
| 280 | echo "EXIT: $CLI_EXIT" >> $CLI_OUT |
| 281 | } |
| 282 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 283 | # check if the given command uses dtls and sets global variable DTLS |
| 284 | detect_dtls() { |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 285 | if echo "$1" | grep 'dtls=1\|-dtls1\|-u' >/dev/null; then |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 286 | DTLS=1 |
| 287 | else |
| 288 | DTLS=0 |
| 289 | fi |
| 290 | } |
| 291 | |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 292 | # Usage: run_test name [-p proxy_cmd] srv_cmd cli_cmd cli_exit [option [...]] |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 293 | # Options: -s pattern pattern that must be present in server output |
| 294 | # -c pattern pattern that must be present in client output |
Janos Follath | 6d3e338 | 2016-09-07 15:48:48 +0100 | [diff] [blame] | 295 | # -u pattern lines after pattern must be unique in client output |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 296 | # -S pattern pattern that must be absent in server output |
| 297 | # -C pattern pattern that must be absent in client output |
Janos Follath | 6d3e338 | 2016-09-07 15:48:48 +0100 | [diff] [blame] | 298 | # -U pattern lines after pattern must be unique in server output |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 299 | run_test() { |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 300 | NAME="$1" |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 301 | shift 1 |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 302 | |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 303 | if echo "$NAME" | grep "$FILTER" | grep -v "$EXCLUDE" >/dev/null; then : |
| 304 | else |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 305 | SKIP_NEXT="NO" |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 306 | return |
| 307 | fi |
| 308 | |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 309 | print_name "$NAME" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 310 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 311 | # should we skip? |
| 312 | if [ "X$SKIP_NEXT" = "XYES" ]; then |
| 313 | SKIP_NEXT="NO" |
| 314 | echo "SKIP" |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 315 | SKIPS=$(( $SKIPS + 1 )) |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 316 | return |
| 317 | fi |
| 318 | |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 319 | # does this test use a proxy? |
| 320 | if [ "X$1" = "X-p" ]; then |
| 321 | PXY_CMD="$2" |
| 322 | shift 2 |
| 323 | else |
| 324 | PXY_CMD="" |
| 325 | fi |
| 326 | |
| 327 | # get commands and client output |
| 328 | SRV_CMD="$1" |
| 329 | CLI_CMD="$2" |
| 330 | CLI_EXPECT="$3" |
| 331 | shift 3 |
| 332 | |
| 333 | # fix client port |
| 334 | if [ -n "$PXY_CMD" ]; then |
| 335 | CLI_CMD=$( echo "$CLI_CMD" | sed s/+SRV_PORT/$PXY_PORT/g ) |
| 336 | else |
| 337 | CLI_CMD=$( echo "$CLI_CMD" | sed s/+SRV_PORT/$SRV_PORT/g ) |
| 338 | fi |
| 339 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 340 | # update DTLS variable |
| 341 | detect_dtls "$SRV_CMD" |
| 342 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 343 | # prepend valgrind to our commands if active |
| 344 | if [ "$MEMCHECK" -gt 0 ]; then |
| 345 | if is_polar "$SRV_CMD"; then |
| 346 | SRV_CMD="valgrind --leak-check=full $SRV_CMD" |
| 347 | fi |
| 348 | if is_polar "$CLI_CMD"; then |
| 349 | CLI_CMD="valgrind --leak-check=full $CLI_CMD" |
| 350 | fi |
| 351 | fi |
| 352 | |
Manuel Pégourié-Gonnard | a365add | 2015-08-04 20:57:59 +0200 | [diff] [blame] | 353 | TIMES_LEFT=2 |
| 354 | while [ $TIMES_LEFT -gt 0 ]; do |
Manuel Pégourié-Gonnard | ab5f7b4 | 2015-08-04 21:01:37 +0200 | [diff] [blame] | 355 | TIMES_LEFT=$(( $TIMES_LEFT - 1 )) |
Manuel Pégourié-Gonnard | a365add | 2015-08-04 20:57:59 +0200 | [diff] [blame] | 356 | |
Manuel Pégourié-Gonnard | ab5f7b4 | 2015-08-04 21:01:37 +0200 | [diff] [blame] | 357 | # run the commands |
| 358 | if [ -n "$PXY_CMD" ]; then |
| 359 | echo "$PXY_CMD" > $PXY_OUT |
| 360 | $PXY_CMD >> $PXY_OUT 2>&1 & |
| 361 | PXY_PID=$! |
| 362 | # assume proxy starts faster than server |
| 363 | fi |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 364 | |
Manuel Pégourié-Gonnard | ab5f7b4 | 2015-08-04 21:01:37 +0200 | [diff] [blame] | 365 | check_osrv_dtls |
| 366 | echo "$SRV_CMD" > $SRV_OUT |
| 367 | provide_input | $SRV_CMD >> $SRV_OUT 2>&1 & |
| 368 | SRV_PID=$! |
Gilles Peskine | 684a517 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 369 | wait_server_start "$SRV_PORT" "$SRV_PID" |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 370 | |
Manuel Pégourié-Gonnard | ab5f7b4 | 2015-08-04 21:01:37 +0200 | [diff] [blame] | 371 | echo "$CLI_CMD" > $CLI_OUT |
| 372 | eval "$CLI_CMD" >> $CLI_OUT 2>&1 & |
| 373 | wait_client_done |
Manuel Pégourié-Gonnard | e01af4c | 2014-03-25 14:16:44 +0100 | [diff] [blame] | 374 | |
Manuel Pégourié-Gonnard | ab5f7b4 | 2015-08-04 21:01:37 +0200 | [diff] [blame] | 375 | # terminate the server (and the proxy) |
| 376 | kill $SRV_PID |
| 377 | wait $SRV_PID |
| 378 | if [ -n "$PXY_CMD" ]; then |
| 379 | kill $PXY_PID >/dev/null 2>&1 |
| 380 | wait $PXY_PID |
| 381 | fi |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 382 | |
Manuel Pégourié-Gonnard | ab5f7b4 | 2015-08-04 21:01:37 +0200 | [diff] [blame] | 383 | # retry only on timeouts |
| 384 | if grep '===CLIENT_TIMEOUT===' $CLI_OUT >/dev/null; then |
| 385 | printf "RETRY " |
| 386 | else |
| 387 | TIMES_LEFT=0 |
| 388 | fi |
Manuel Pégourié-Gonnard | a365add | 2015-08-04 20:57:59 +0200 | [diff] [blame] | 389 | done |
| 390 | |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 391 | # check if the client and server went at least to the handshake stage |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 392 | # (useful to avoid tests with only negative assertions and non-zero |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 393 | # expected client exit to incorrectly succeed in case of catastrophic |
| 394 | # failure) |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 395 | if is_polar "$SRV_CMD"; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 396 | if grep "Performing the SSL/TLS handshake" $SRV_OUT >/dev/null; then :; |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 397 | else |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 398 | fail "server or client failed to reach handshake stage" |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 399 | return |
| 400 | fi |
| 401 | fi |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 402 | if is_polar "$CLI_CMD"; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 403 | if grep "Performing the SSL/TLS handshake" $CLI_OUT >/dev/null; then :; |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 404 | else |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 405 | fail "server or client failed to reach handshake stage" |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 406 | return |
| 407 | fi |
| 408 | fi |
| 409 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 410 | # check server exit code |
| 411 | if [ $? != 0 ]; then |
| 412 | fail "server fail" |
| 413 | return |
| 414 | fi |
| 415 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 416 | # check client exit code |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 417 | if [ \( "$CLI_EXPECT" = 0 -a "$CLI_EXIT" != 0 \) -o \ |
| 418 | \( "$CLI_EXPECT" != 0 -a "$CLI_EXIT" = 0 \) ] |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 419 | then |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 420 | fail "bad client exit code (expected $CLI_EXPECT, got $CLI_EXIT)" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 421 | return |
| 422 | fi |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 423 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 424 | # check other assertions |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 425 | # lines beginning with == are added by valgrind, ignore them |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 426 | while [ $# -gt 0 ] |
| 427 | do |
| 428 | case $1 in |
| 429 | "-s") |
Janos Follath | 6d3e338 | 2016-09-07 15:48:48 +0100 | [diff] [blame] | 430 | if grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then :; else |
| 431 | fail "pattern '$2' MUST be present in the Server output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 432 | return |
| 433 | fi |
| 434 | ;; |
| 435 | |
| 436 | "-c") |
Janos Follath | 6d3e338 | 2016-09-07 15:48:48 +0100 | [diff] [blame] | 437 | if grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then :; else |
| 438 | fail "pattern '$2' MUST be present in the Client output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 439 | return |
| 440 | fi |
| 441 | ;; |
| 442 | |
| 443 | "-S") |
Janos Follath | 6d3e338 | 2016-09-07 15:48:48 +0100 | [diff] [blame] | 444 | if grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then |
| 445 | fail "pattern '$2' MUST NOT be present in the Server output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 446 | return |
| 447 | fi |
| 448 | ;; |
| 449 | |
| 450 | "-C") |
Janos Follath | 6d3e338 | 2016-09-07 15:48:48 +0100 | [diff] [blame] | 451 | if grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then |
| 452 | fail "pattern '$2' MUST NOT be present in the Client output" |
| 453 | return |
| 454 | fi |
| 455 | ;; |
| 456 | |
| 457 | # The filtering in the following two options (-u and -U) do the following |
| 458 | # - ignore valgrind output |
| 459 | # - filter out everything but lines right after the pattern occurances |
| 460 | # - keep one of each non-unique line |
| 461 | # - count how many lines remain |
| 462 | # A line with '--' will remain in the result from previous outputs, so the number of lines in the result will be 1 |
| 463 | # if there were no duplicates. |
| 464 | "-U") |
| 465 | if [ $(grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep -A1 "$2" | grep -v "$2" | sort | uniq -d | wc -l) -gt 1 ]; then |
| 466 | fail "lines following pattern '$2' must be unique in Server output" |
| 467 | return |
| 468 | fi |
| 469 | ;; |
| 470 | |
| 471 | "-u") |
| 472 | if [ $(grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep -A1 "$2" | grep -v "$2" | sort | uniq -d | wc -l) -gt 1 ]; then |
| 473 | fail "lines following pattern '$2' must be unique in Client output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 474 | return |
| 475 | fi |
| 476 | ;; |
| 477 | |
| 478 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 479 | echo "Unknown test: $1" >&2 |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 480 | exit 1 |
| 481 | esac |
| 482 | shift 2 |
| 483 | done |
| 484 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 485 | # check valgrind's results |
| 486 | if [ "$MEMCHECK" -gt 0 ]; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 487 | if is_polar "$SRV_CMD" && has_mem_err $SRV_OUT; then |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 488 | fail "Server has memory errors" |
| 489 | return |
| 490 | fi |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 491 | if is_polar "$CLI_CMD" && has_mem_err $CLI_OUT; then |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 492 | fail "Client has memory errors" |
| 493 | return |
| 494 | fi |
| 495 | fi |
| 496 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 497 | # if we're here, everything is ok |
| 498 | echo "PASS" |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 499 | rm -f $SRV_OUT $CLI_OUT $PXY_OUT |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 500 | } |
| 501 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 502 | cleanup() { |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 503 | rm -f $CLI_OUT $SRV_OUT $PXY_OUT $SESSION |
Manuel Pégourié-Gonnard | a6189f0 | 2014-09-20 13:15:43 +0200 | [diff] [blame] | 504 | test -n "${SRV_PID:-}" && kill $SRV_PID >/dev/null 2>&1 |
| 505 | test -n "${PXY_PID:-}" && kill $PXY_PID >/dev/null 2>&1 |
| 506 | test -n "${CLI_PID:-}" && kill $CLI_PID >/dev/null 2>&1 |
| 507 | test -n "${DOG_PID:-}" && kill $DOG_PID >/dev/null 2>&1 |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 508 | exit 1 |
| 509 | } |
| 510 | |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 511 | # |
| 512 | # MAIN |
| 513 | # |
| 514 | |
Manuel Pégourié-Gonnard | 19db8ea | 2015-03-10 13:41:04 +0000 | [diff] [blame] | 515 | if cd $( dirname $0 ); then :; else |
| 516 | echo "cd $( dirname $0 ) failed" >&2 |
| 517 | exit 1 |
| 518 | fi |
| 519 | |
Manuel Pégourié-Gonnard | 913030c | 2014-03-28 10:12:38 +0100 | [diff] [blame] | 520 | get_options "$@" |
| 521 | |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 522 | # sanity checks, avoid an avalanche of errors |
| 523 | if [ ! -x "$P_SRV" ]; then |
| 524 | echo "Command '$P_SRV' is not an executable file" |
| 525 | exit 1 |
| 526 | fi |
| 527 | if [ ! -x "$P_CLI" ]; then |
| 528 | echo "Command '$P_CLI' is not an executable file" |
| 529 | exit 1 |
| 530 | fi |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 531 | if [ ! -x "$P_PXY" ]; then |
| 532 | echo "Command '$P_PXY' is not an executable file" |
| 533 | exit 1 |
| 534 | fi |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 535 | if which $OPENSSL_CMD >/dev/null 2>&1; then :; else |
| 536 | echo "Command '$OPENSSL_CMD' not found" |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 537 | exit 1 |
| 538 | fi |
| 539 | |
Manuel Pégourié-Gonnard | 32f8f4d | 2014-05-29 11:31:20 +0200 | [diff] [blame] | 540 | # used by watchdog |
| 541 | MAIN_PID="$$" |
| 542 | |
Manuel Pégourié-Gonnard | 3f69e54 | 2018-01-22 10:22:09 +0100 | [diff] [blame] | 543 | # We use somewhat arbitrary delays for tests: |
| 544 | # - how long do we wait for the server to start (when lsof not available)? |
| 545 | # - how long do we allow for the client to finish? |
| 546 | # (not to check performance, just to avoid waiting indefinitely) |
| 547 | # Things are slower with valgrind, so give extra time here. |
| 548 | # |
| 549 | # Note: without lsof, there is a trade-off between the running time of this |
| 550 | # script and the risk of spurious errors because we didn't wait long enough. |
| 551 | # The watchdog delay on the other hand doesn't affect normal running time of |
| 552 | # the script, only the case where a client or server gets stuck. |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 553 | if [ "$MEMCHECK" -gt 0 ]; then |
Manuel Pégourié-Gonnard | 3f69e54 | 2018-01-22 10:22:09 +0100 | [diff] [blame] | 554 | START_DELAY=6 |
| 555 | DOG_DELAY=60 |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 556 | else |
Manuel Pégourié-Gonnard | 3f69e54 | 2018-01-22 10:22:09 +0100 | [diff] [blame] | 557 | START_DELAY=2 |
| 558 | DOG_DELAY=20 |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 559 | fi |
Manuel Pégourié-Gonnard | 3f69e54 | 2018-01-22 10:22:09 +0100 | [diff] [blame] | 560 | |
| 561 | # some particular tests need more time: |
| 562 | # - for the client, we multiply the usual watchdog limit by a factor |
| 563 | # - for the server, we sleep for a number of seconds after the client exits |
| 564 | # see client_need_more_time() and server_needs_more_time() |
Manuel Pégourié-Gonnard | a071972 | 2014-09-20 12:46:27 +0200 | [diff] [blame] | 565 | CLI_DELAY_FACTOR=1 |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 566 | |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 567 | # Pick a "unique" server port in the range 10000-19999, and a proxy port |
| 568 | PORT_BASE="0000$$" |
Manuel Pégourié-Gonnard | 3a173f4 | 2015-01-22 13:30:33 +0000 | [diff] [blame] | 569 | PORT_BASE="$( printf $PORT_BASE | tail -c 4 )" |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 570 | SRV_PORT="1$PORT_BASE" |
| 571 | PXY_PORT="2$PORT_BASE" |
| 572 | unset PORT_BASE |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 573 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 574 | # fix commands to use this port, force IPv4 while at it |
Manuel Pégourié-Gonnard | 0af1ba3 | 2015-01-21 11:44:33 +0000 | [diff] [blame] | 575 | # +SRV_PORT will be replaced by either $SRV_PORT or $PXY_PORT later |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 576 | P_SRV="$P_SRV server_addr=127.0.0.1 server_port=$SRV_PORT" |
| 577 | P_CLI="$P_CLI server_addr=127.0.0.1 server_port=+SRV_PORT" |
Gilles Peskine | bb4aaf1 | 2017-11-30 15:56:20 +0100 | [diff] [blame] | 578 | P_PXY="$P_PXY server_addr=127.0.0.1 server_port=$SRV_PORT listen_addr=127.0.0.1 listen_port=$PXY_PORT ${SEED:+"seed=$SEED"}" |
Manuel Pégourié-Gonnard | 6195767 | 2015-06-18 17:54:58 +0200 | [diff] [blame] | 579 | O_SRV="$O_SRV -accept $SRV_PORT -dhparam data_files/dhparams.pem" |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 580 | O_CLI="$O_CLI -connect localhost:+SRV_PORT" |
| 581 | G_SRV="$G_SRV -p $SRV_PORT" |
Manuel Pégourié-Gonnard | 0af1ba3 | 2015-01-21 11:44:33 +0000 | [diff] [blame] | 582 | G_CLI="$G_CLI -p +SRV_PORT localhost" |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 583 | |
Gilles Peskine | 35db5ba | 2017-05-10 10:13:59 +0200 | [diff] [blame] | 584 | # Allow SHA-1, because many of our test certificates use it |
| 585 | P_SRV="$P_SRV allow_sha1=1" |
| 586 | P_CLI="$P_CLI allow_sha1=1" |
| 587 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 588 | # Also pick a unique name for intermediate files |
| 589 | SRV_OUT="srv_out.$$" |
| 590 | CLI_OUT="cli_out.$$" |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 591 | PXY_OUT="pxy_out.$$" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 592 | SESSION="session.$$" |
| 593 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 594 | SKIP_NEXT="NO" |
| 595 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 596 | trap cleanup INT TERM HUP |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 597 | |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 598 | # Basic test |
| 599 | |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 600 | # Checks that: |
| 601 | # - things work with all ciphersuites active (used with config-full in all.sh) |
| 602 | # - the expected (highest security) parameters are selected |
| 603 | # ("signature_algorithm ext: 6" means SHA-512 (highest common hash)) |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 604 | run_test "Default" \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 605 | "$P_SRV debug_level=3" \ |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 606 | "$P_CLI" \ |
| 607 | 0 \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 608 | -s "Protocol is TLSv1.2" \ |
| 609 | -s "Ciphersuite is TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ |
| 610 | -s "client hello v3, signature_algorithm ext: 6" \ |
| 611 | -s "ECDHE curve: secp521r1" \ |
| 612 | -S "error" \ |
| 613 | -C "error" |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 614 | |
Manuel Pégourié-Gonnard | 3bb0801 | 2015-01-22 13:34:21 +0000 | [diff] [blame] | 615 | run_test "Default, DTLS" \ |
| 616 | "$P_SRV dtls=1" \ |
| 617 | "$P_CLI dtls=1" \ |
| 618 | 0 \ |
| 619 | -s "Protocol is DTLSv1.2" \ |
| 620 | -s "Ciphersuite is TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" |
| 621 | |
Janos Follath | 6d3e338 | 2016-09-07 15:48:48 +0100 | [diff] [blame] | 622 | # Test for uniqueness of IVs in AEAD ciphersuites |
| 623 | run_test "Unique IV in GCM" \ |
| 624 | "$P_SRV exchanges=20 debug_level=4" \ |
| 625 | "$P_CLI exchanges=20 debug_level=4 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ |
| 626 | 0 \ |
| 627 | -u "IV used" \ |
| 628 | -U "IV used" |
| 629 | |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 630 | # Tests for rc4 option |
| 631 | |
Simon Butcher | 6eb066e | 2016-05-19 22:12:18 +0100 | [diff] [blame] | 632 | requires_config_enabled MBEDTLS_REMOVE_ARC4_CIPHERSUITES |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 633 | run_test "RC4: server disabled, client enabled" \ |
| 634 | "$P_SRV" \ |
| 635 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 636 | 1 \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 637 | -s "SSL - The server has no ciphersuites in common" |
| 638 | |
Simon Butcher | 6eb066e | 2016-05-19 22:12:18 +0100 | [diff] [blame] | 639 | requires_config_enabled MBEDTLS_REMOVE_ARC4_CIPHERSUITES |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 640 | run_test "RC4: server half, client enabled" \ |
| 641 | "$P_SRV arc4=1" \ |
| 642 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 643 | 1 \ |
| 644 | -s "SSL - The server has no ciphersuites in common" |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 645 | |
| 646 | run_test "RC4: server enabled, client disabled" \ |
| 647 | "$P_SRV force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 648 | "$P_CLI" \ |
| 649 | 1 \ |
| 650 | -s "SSL - The server has no ciphersuites in common" |
| 651 | |
| 652 | run_test "RC4: both enabled" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 653 | "$P_SRV force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 654 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 655 | 0 \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 656 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 657 | -S "SSL - The server has no ciphersuites in common" |
| 658 | |
Gilles Peskine | ae76599 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 659 | # Tests for SHA-1 support |
| 660 | |
Manuel Pégourié-Gonnard | 5539366 | 2017-06-08 17:51:08 +0200 | [diff] [blame] | 661 | requires_config_disabled MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES |
Gilles Peskine | ae76599 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 662 | run_test "SHA-1 forbidden by default in server certificate" \ |
| 663 | "$P_SRV key_file=data_files/server2.key crt_file=data_files/server2.crt" \ |
| 664 | "$P_CLI debug_level=2 allow_sha1=0" \ |
| 665 | 1 \ |
| 666 | -c "The certificate is signed with an unacceptable hash" |
| 667 | |
Manuel Pégourié-Gonnard | 5539366 | 2017-06-08 17:51:08 +0200 | [diff] [blame] | 668 | requires_config_enabled MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES |
| 669 | run_test "SHA-1 forbidden by default in server certificate" \ |
| 670 | "$P_SRV key_file=data_files/server2.key crt_file=data_files/server2.crt" \ |
| 671 | "$P_CLI debug_level=2 allow_sha1=0" \ |
| 672 | 0 |
| 673 | |
Gilles Peskine | ae76599 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 674 | run_test "SHA-1 explicitly allowed in server certificate" \ |
| 675 | "$P_SRV key_file=data_files/server2.key crt_file=data_files/server2.crt" \ |
| 676 | "$P_CLI allow_sha1=1" \ |
| 677 | 0 |
| 678 | |
| 679 | run_test "SHA-256 allowed by default in server certificate" \ |
| 680 | "$P_SRV key_file=data_files/server2.key crt_file=data_files/server2-sha256.crt" \ |
| 681 | "$P_CLI allow_sha1=0" \ |
| 682 | 0 |
| 683 | |
Manuel Pégourié-Gonnard | 5539366 | 2017-06-08 17:51:08 +0200 | [diff] [blame] | 684 | requires_config_disabled MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES |
Gilles Peskine | ae76599 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 685 | run_test "SHA-1 forbidden by default in client certificate" \ |
| 686 | "$P_SRV auth_mode=required allow_sha1=0" \ |
| 687 | "$P_CLI key_file=data_files/cli-rsa.key crt_file=data_files/cli-rsa-sha1.crt" \ |
| 688 | 1 \ |
| 689 | -s "The certificate is signed with an unacceptable hash" |
| 690 | |
Manuel Pégourié-Gonnard | 5539366 | 2017-06-08 17:51:08 +0200 | [diff] [blame] | 691 | requires_config_enabled MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES |
| 692 | run_test "SHA-1 forbidden by default in client certificate" \ |
| 693 | "$P_SRV auth_mode=required allow_sha1=0" \ |
| 694 | "$P_CLI key_file=data_files/cli-rsa.key crt_file=data_files/cli-rsa-sha1.crt" \ |
| 695 | 0 |
| 696 | |
Gilles Peskine | ae76599 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 697 | run_test "SHA-1 explicitly allowed in client certificate" \ |
| 698 | "$P_SRV auth_mode=required allow_sha1=1" \ |
| 699 | "$P_CLI key_file=data_files/cli-rsa.key crt_file=data_files/cli-rsa-sha1.crt" \ |
| 700 | 0 |
| 701 | |
| 702 | run_test "SHA-256 allowed by default in client certificate" \ |
| 703 | "$P_SRV auth_mode=required allow_sha1=0" \ |
| 704 | "$P_CLI key_file=data_files/cli-rsa.key crt_file=data_files/cli-rsa-sha256.crt" \ |
| 705 | 0 |
| 706 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 707 | # Tests for Truncated HMAC extension |
| 708 | |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 709 | run_test "Truncated HMAC: client default, server default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 710 | "$P_SRV debug_level=4" \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 711 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 712 | 0 \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 713 | -s "dumping 'computed mac' (20 bytes)" \ |
| 714 | -S "dumping 'computed mac' (10 bytes)" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 715 | |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 716 | run_test "Truncated HMAC: client disabled, server default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 717 | "$P_SRV debug_level=4" \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 718 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 719 | trunc_hmac=0" \ |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 720 | 0 \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 721 | -s "dumping 'computed mac' (20 bytes)" \ |
| 722 | -S "dumping 'computed mac' (10 bytes)" |
| 723 | |
| 724 | run_test "Truncated HMAC: client enabled, server default" \ |
| 725 | "$P_SRV debug_level=4" \ |
| 726 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 727 | trunc_hmac=1" \ |
| 728 | 0 \ |
Manuel Pégourié-Gonnard | 662c6e8 | 2015-05-06 17:39:23 +0100 | [diff] [blame] | 729 | -s "dumping 'computed mac' (20 bytes)" \ |
| 730 | -S "dumping 'computed mac' (10 bytes)" |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 731 | |
| 732 | run_test "Truncated HMAC: client enabled, server disabled" \ |
| 733 | "$P_SRV debug_level=4 trunc_hmac=0" \ |
| 734 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 735 | trunc_hmac=1" \ |
| 736 | 0 \ |
| 737 | -s "dumping 'computed mac' (20 bytes)" \ |
| 738 | -S "dumping 'computed mac' (10 bytes)" |
| 739 | |
| 740 | run_test "Truncated HMAC: client enabled, server enabled" \ |
| 741 | "$P_SRV debug_level=4 trunc_hmac=1" \ |
| 742 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 743 | trunc_hmac=1" \ |
| 744 | 0 \ |
| 745 | -S "dumping 'computed mac' (20 bytes)" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 746 | -s "dumping 'computed mac' (10 bytes)" |
| 747 | |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 748 | # Tests for Encrypt-then-MAC extension |
| 749 | |
| 750 | run_test "Encrypt then MAC: default" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 751 | "$P_SRV debug_level=3 \ |
| 752 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 753 | "$P_CLI debug_level=3" \ |
| 754 | 0 \ |
| 755 | -c "client hello, adding encrypt_then_mac extension" \ |
| 756 | -s "found encrypt then mac extension" \ |
| 757 | -s "server hello, adding encrypt then mac extension" \ |
| 758 | -c "found encrypt_then_mac extension" \ |
| 759 | -c "using encrypt then mac" \ |
| 760 | -s "using encrypt then mac" |
| 761 | |
| 762 | run_test "Encrypt then MAC: client enabled, server disabled" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 763 | "$P_SRV debug_level=3 etm=0 \ |
| 764 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 765 | "$P_CLI debug_level=3 etm=1" \ |
| 766 | 0 \ |
| 767 | -c "client hello, adding encrypt_then_mac extension" \ |
| 768 | -s "found encrypt then mac extension" \ |
| 769 | -S "server hello, adding encrypt then mac extension" \ |
| 770 | -C "found encrypt_then_mac extension" \ |
| 771 | -C "using encrypt then mac" \ |
| 772 | -S "using encrypt then mac" |
| 773 | |
Manuel Pégourié-Gonnard | 78e745f | 2014-11-04 15:44:06 +0100 | [diff] [blame] | 774 | run_test "Encrypt then MAC: client enabled, aead cipher" \ |
| 775 | "$P_SRV debug_level=3 etm=1 \ |
| 776 | force_ciphersuite=TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 777 | "$P_CLI debug_level=3 etm=1" \ |
| 778 | 0 \ |
| 779 | -c "client hello, adding encrypt_then_mac extension" \ |
| 780 | -s "found encrypt then mac extension" \ |
| 781 | -S "server hello, adding encrypt then mac extension" \ |
| 782 | -C "found encrypt_then_mac extension" \ |
| 783 | -C "using encrypt then mac" \ |
| 784 | -S "using encrypt then mac" |
| 785 | |
| 786 | run_test "Encrypt then MAC: client enabled, stream cipher" \ |
| 787 | "$P_SRV debug_level=3 etm=1 \ |
| 788 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 789 | "$P_CLI debug_level=3 etm=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 78e745f | 2014-11-04 15:44:06 +0100 | [diff] [blame] | 790 | 0 \ |
| 791 | -c "client hello, adding encrypt_then_mac extension" \ |
| 792 | -s "found encrypt then mac extension" \ |
| 793 | -S "server hello, adding encrypt then mac extension" \ |
| 794 | -C "found encrypt_then_mac extension" \ |
| 795 | -C "using encrypt then mac" \ |
| 796 | -S "using encrypt then mac" |
| 797 | |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 798 | run_test "Encrypt then MAC: client disabled, server enabled" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 799 | "$P_SRV debug_level=3 etm=1 \ |
| 800 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 801 | "$P_CLI debug_level=3 etm=0" \ |
| 802 | 0 \ |
| 803 | -C "client hello, adding encrypt_then_mac extension" \ |
| 804 | -S "found encrypt then mac extension" \ |
| 805 | -S "server hello, adding encrypt then mac extension" \ |
| 806 | -C "found encrypt_then_mac extension" \ |
| 807 | -C "using encrypt then mac" \ |
| 808 | -S "using encrypt then mac" |
| 809 | |
Janos Follath | 542ee5d | 2016-03-07 15:57:05 +0000 | [diff] [blame] | 810 | requires_config_enabled MBEDTLS_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 811 | run_test "Encrypt then MAC: client SSLv3, server enabled" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 812 | "$P_SRV debug_level=3 min_version=ssl3 \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 813 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 814 | "$P_CLI debug_level=3 force_version=ssl3" \ |
| 815 | 0 \ |
| 816 | -C "client hello, adding encrypt_then_mac extension" \ |
| 817 | -S "found encrypt then mac extension" \ |
| 818 | -S "server hello, adding encrypt then mac extension" \ |
| 819 | -C "found encrypt_then_mac extension" \ |
| 820 | -C "using encrypt then mac" \ |
| 821 | -S "using encrypt then mac" |
| 822 | |
Janos Follath | 542ee5d | 2016-03-07 15:57:05 +0000 | [diff] [blame] | 823 | requires_config_enabled MBEDTLS_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 824 | run_test "Encrypt then MAC: client enabled, server SSLv3" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 825 | "$P_SRV debug_level=3 force_version=ssl3 \ |
| 826 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 827 | "$P_CLI debug_level=3 min_version=ssl3" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 828 | 0 \ |
| 829 | -c "client hello, adding encrypt_then_mac extension" \ |
Janos Follath | b700c46 | 2016-05-06 13:48:23 +0100 | [diff] [blame] | 830 | -S "found encrypt then mac extension" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 831 | -S "server hello, adding encrypt then mac extension" \ |
| 832 | -C "found encrypt_then_mac extension" \ |
| 833 | -C "using encrypt then mac" \ |
| 834 | -S "using encrypt then mac" |
| 835 | |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 836 | # Tests for Extended Master Secret extension |
| 837 | |
| 838 | run_test "Extended Master Secret: default" \ |
| 839 | "$P_SRV debug_level=3" \ |
| 840 | "$P_CLI debug_level=3" \ |
| 841 | 0 \ |
| 842 | -c "client hello, adding extended_master_secret extension" \ |
| 843 | -s "found extended master secret extension" \ |
| 844 | -s "server hello, adding extended master secret extension" \ |
| 845 | -c "found extended_master_secret extension" \ |
| 846 | -c "using extended master secret" \ |
| 847 | -s "using extended master secret" |
| 848 | |
| 849 | run_test "Extended Master Secret: client enabled, server disabled" \ |
| 850 | "$P_SRV debug_level=3 extended_ms=0" \ |
| 851 | "$P_CLI debug_level=3 extended_ms=1" \ |
| 852 | 0 \ |
| 853 | -c "client hello, adding extended_master_secret extension" \ |
| 854 | -s "found extended master secret extension" \ |
| 855 | -S "server hello, adding extended master secret extension" \ |
| 856 | -C "found extended_master_secret extension" \ |
| 857 | -C "using extended master secret" \ |
| 858 | -S "using extended master secret" |
| 859 | |
| 860 | run_test "Extended Master Secret: client disabled, server enabled" \ |
| 861 | "$P_SRV debug_level=3 extended_ms=1" \ |
| 862 | "$P_CLI debug_level=3 extended_ms=0" \ |
| 863 | 0 \ |
| 864 | -C "client hello, adding extended_master_secret extension" \ |
| 865 | -S "found extended master secret extension" \ |
| 866 | -S "server hello, adding extended master secret extension" \ |
| 867 | -C "found extended_master_secret extension" \ |
| 868 | -C "using extended master secret" \ |
| 869 | -S "using extended master secret" |
| 870 | |
Janos Follath | 542ee5d | 2016-03-07 15:57:05 +0000 | [diff] [blame] | 871 | requires_config_enabled MBEDTLS_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 872 | run_test "Extended Master Secret: client SSLv3, server enabled" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 873 | "$P_SRV debug_level=3 min_version=ssl3" \ |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 874 | "$P_CLI debug_level=3 force_version=ssl3" \ |
| 875 | 0 \ |
| 876 | -C "client hello, adding extended_master_secret extension" \ |
| 877 | -S "found extended master secret extension" \ |
| 878 | -S "server hello, adding extended master secret extension" \ |
| 879 | -C "found extended_master_secret extension" \ |
| 880 | -C "using extended master secret" \ |
| 881 | -S "using extended master secret" |
| 882 | |
Janos Follath | 542ee5d | 2016-03-07 15:57:05 +0000 | [diff] [blame] | 883 | requires_config_enabled MBEDTLS_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 884 | run_test "Extended Master Secret: client enabled, server SSLv3" \ |
| 885 | "$P_SRV debug_level=3 force_version=ssl3" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 886 | "$P_CLI debug_level=3 min_version=ssl3" \ |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 887 | 0 \ |
| 888 | -c "client hello, adding extended_master_secret extension" \ |
Janos Follath | b700c46 | 2016-05-06 13:48:23 +0100 | [diff] [blame] | 889 | -S "found extended master secret extension" \ |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 890 | -S "server hello, adding extended master secret extension" \ |
| 891 | -C "found extended_master_secret extension" \ |
| 892 | -C "using extended master secret" \ |
| 893 | -S "using extended master secret" |
| 894 | |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 895 | # Tests for FALLBACK_SCSV |
| 896 | |
| 897 | run_test "Fallback SCSV: default" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 898 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 899 | "$P_CLI debug_level=3 force_version=tls1_1" \ |
| 900 | 0 \ |
| 901 | -C "adding FALLBACK_SCSV" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 902 | -S "received FALLBACK_SCSV" \ |
| 903 | -S "inapropriate fallback" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 904 | -C "is a fatal alert message (msg 86)" |
| 905 | |
| 906 | run_test "Fallback SCSV: explicitly disabled" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 907 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 908 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \ |
| 909 | 0 \ |
| 910 | -C "adding FALLBACK_SCSV" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 911 | -S "received FALLBACK_SCSV" \ |
| 912 | -S "inapropriate fallback" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 913 | -C "is a fatal alert message (msg 86)" |
| 914 | |
| 915 | run_test "Fallback SCSV: enabled" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 916 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 917 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 918 | 1 \ |
| 919 | -c "adding FALLBACK_SCSV" \ |
| 920 | -s "received FALLBACK_SCSV" \ |
| 921 | -s "inapropriate fallback" \ |
| 922 | -c "is a fatal alert message (msg 86)" |
| 923 | |
| 924 | run_test "Fallback SCSV: enabled, max version" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 925 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 926 | "$P_CLI debug_level=3 fallback=1" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 927 | 0 \ |
| 928 | -c "adding FALLBACK_SCSV" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 929 | -s "received FALLBACK_SCSV" \ |
| 930 | -S "inapropriate fallback" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 931 | -C "is a fatal alert message (msg 86)" |
| 932 | |
| 933 | requires_openssl_with_fallback_scsv |
| 934 | run_test "Fallback SCSV: default, openssl server" \ |
| 935 | "$O_SRV" \ |
| 936 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \ |
| 937 | 0 \ |
| 938 | -C "adding FALLBACK_SCSV" \ |
| 939 | -C "is a fatal alert message (msg 86)" |
| 940 | |
| 941 | requires_openssl_with_fallback_scsv |
| 942 | run_test "Fallback SCSV: enabled, openssl server" \ |
| 943 | "$O_SRV" \ |
| 944 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \ |
| 945 | 1 \ |
| 946 | -c "adding FALLBACK_SCSV" \ |
| 947 | -c "is a fatal alert message (msg 86)" |
| 948 | |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 949 | requires_openssl_with_fallback_scsv |
| 950 | run_test "Fallback SCSV: disabled, openssl client" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 951 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 952 | "$O_CLI -tls1_1" \ |
| 953 | 0 \ |
| 954 | -S "received FALLBACK_SCSV" \ |
| 955 | -S "inapropriate fallback" |
| 956 | |
| 957 | requires_openssl_with_fallback_scsv |
| 958 | run_test "Fallback SCSV: enabled, openssl client" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 959 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 960 | "$O_CLI -tls1_1 -fallback_scsv" \ |
| 961 | 1 \ |
| 962 | -s "received FALLBACK_SCSV" \ |
| 963 | -s "inapropriate fallback" |
| 964 | |
| 965 | requires_openssl_with_fallback_scsv |
| 966 | run_test "Fallback SCSV: enabled, max version, openssl client" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 967 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 968 | "$O_CLI -fallback_scsv" \ |
| 969 | 0 \ |
| 970 | -s "received FALLBACK_SCSV" \ |
| 971 | -S "inapropriate fallback" |
| 972 | |
Gilles Peskine | 39e2981 | 2017-05-16 17:53:03 +0200 | [diff] [blame] | 973 | ## ClientHello generated with |
| 974 | ## "openssl s_client -CAfile tests/data_files/test-ca.crt -tls1_1 -connect localhost:4433 -cipher ..." |
| 975 | ## then manually twiddling the ciphersuite list. |
| 976 | ## The ClientHello content is spelled out below as a hex string as |
| 977 | ## "prefix ciphersuite1 ciphersuite2 ciphersuite3 ciphersuite4 suffix". |
| 978 | ## The expected response is an inappropriate_fallback alert. |
| 979 | requires_openssl_with_fallback_scsv |
| 980 | run_test "Fallback SCSV: beginning of list" \ |
| 981 | "$P_SRV debug_level=2" \ |
| 982 | "$TCP_CLIENT localhost $SRV_PORT '160301003e0100003a03022aafb94308dc22ca1086c65acc00e414384d76b61ecab37df1633b1ae1034dbe000008 5600 0031 0032 0033 0100000900230000000f000101' '15030200020256'" \ |
| 983 | 0 \ |
| 984 | -s "received FALLBACK_SCSV" \ |
| 985 | -s "inapropriate fallback" |
| 986 | |
| 987 | requires_openssl_with_fallback_scsv |
| 988 | run_test "Fallback SCSV: end of list" \ |
| 989 | "$P_SRV debug_level=2" \ |
| 990 | "$TCP_CLIENT localhost $SRV_PORT '160301003e0100003a03022aafb94308dc22ca1086c65acc00e414384d76b61ecab37df1633b1ae1034dbe000008 0031 0032 0033 5600 0100000900230000000f000101' '15030200020256'" \ |
| 991 | 0 \ |
| 992 | -s "received FALLBACK_SCSV" \ |
| 993 | -s "inapropriate fallback" |
| 994 | |
| 995 | ## Here the expected response is a valid ServerHello prefix, up to the random. |
| 996 | requires_openssl_with_fallback_scsv |
| 997 | run_test "Fallback SCSV: not in list" \ |
| 998 | "$P_SRV debug_level=2" \ |
| 999 | "$TCP_CLIENT localhost $SRV_PORT '160301003e0100003a03022aafb94308dc22ca1086c65acc00e414384d76b61ecab37df1633b1ae1034dbe000008 0056 0031 0032 0033 0100000900230000000f000101' '16030200300200002c0302'" \ |
| 1000 | 0 \ |
| 1001 | -S "received FALLBACK_SCSV" \ |
| 1002 | -S "inapropriate fallback" |
| 1003 | |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 1004 | # Tests for CBC 1/n-1 record splitting |
| 1005 | |
| 1006 | run_test "CBC Record splitting: TLS 1.2, no splitting" \ |
| 1007 | "$P_SRV" \ |
| 1008 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 1009 | request_size=123 force_version=tls1_2" \ |
| 1010 | 0 \ |
| 1011 | -s "Read from client: 123 bytes read" \ |
| 1012 | -S "Read from client: 1 bytes read" \ |
| 1013 | -S "122 bytes read" |
| 1014 | |
| 1015 | run_test "CBC Record splitting: TLS 1.1, no splitting" \ |
| 1016 | "$P_SRV" \ |
| 1017 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 1018 | request_size=123 force_version=tls1_1" \ |
| 1019 | 0 \ |
| 1020 | -s "Read from client: 123 bytes read" \ |
| 1021 | -S "Read from client: 1 bytes read" \ |
| 1022 | -S "122 bytes read" |
| 1023 | |
| 1024 | run_test "CBC Record splitting: TLS 1.0, splitting" \ |
| 1025 | "$P_SRV" \ |
| 1026 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 1027 | request_size=123 force_version=tls1" \ |
| 1028 | 0 \ |
| 1029 | -S "Read from client: 123 bytes read" \ |
| 1030 | -s "Read from client: 1 bytes read" \ |
| 1031 | -s "122 bytes read" |
| 1032 | |
Janos Follath | 542ee5d | 2016-03-07 15:57:05 +0000 | [diff] [blame] | 1033 | requires_config_enabled MBEDTLS_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 1034 | run_test "CBC Record splitting: SSLv3, splitting" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 1035 | "$P_SRV min_version=ssl3" \ |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 1036 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 1037 | request_size=123 force_version=ssl3" \ |
| 1038 | 0 \ |
| 1039 | -S "Read from client: 123 bytes read" \ |
| 1040 | -s "Read from client: 1 bytes read" \ |
| 1041 | -s "122 bytes read" |
| 1042 | |
| 1043 | run_test "CBC Record splitting: TLS 1.0 RC4, no splitting" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 1044 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 1045 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 1046 | request_size=123 force_version=tls1" \ |
| 1047 | 0 \ |
| 1048 | -s "Read from client: 123 bytes read" \ |
| 1049 | -S "Read from client: 1 bytes read" \ |
| 1050 | -S "122 bytes read" |
| 1051 | |
| 1052 | run_test "CBC Record splitting: TLS 1.0, splitting disabled" \ |
| 1053 | "$P_SRV" \ |
| 1054 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 1055 | request_size=123 force_version=tls1 recsplit=0" \ |
| 1056 | 0 \ |
| 1057 | -s "Read from client: 123 bytes read" \ |
| 1058 | -S "Read from client: 1 bytes read" \ |
| 1059 | -S "122 bytes read" |
| 1060 | |
Manuel Pégourié-Gonnard | a852cf4 | 2015-01-13 20:56:15 +0100 | [diff] [blame] | 1061 | run_test "CBC Record splitting: TLS 1.0, splitting, nbio" \ |
| 1062 | "$P_SRV nbio=2" \ |
| 1063 | "$P_CLI nbio=2 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 1064 | request_size=123 force_version=tls1" \ |
| 1065 | 0 \ |
| 1066 | -S "Read from client: 123 bytes read" \ |
| 1067 | -s "Read from client: 1 bytes read" \ |
| 1068 | -s "122 bytes read" |
| 1069 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1070 | # Tests for Session Tickets |
| 1071 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1072 | run_test "Session resume using tickets: basic" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1073 | "$P_SRV debug_level=3 tickets=1" \ |
| 1074 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 1075 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1076 | -c "client hello, adding session ticket extension" \ |
| 1077 | -s "found session ticket extension" \ |
| 1078 | -s "server hello, adding session ticket extension" \ |
| 1079 | -c "found session_ticket extension" \ |
| 1080 | -c "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 1081 | -S "session successfully restored from cache" \ |
| 1082 | -s "session successfully restored from ticket" \ |
| 1083 | -s "a session has been resumed" \ |
| 1084 | -c "a session has been resumed" |
| 1085 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1086 | run_test "Session resume using tickets: cache disabled" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1087 | "$P_SRV debug_level=3 tickets=1 cache_max=0" \ |
| 1088 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 1089 | 0 \ |
| 1090 | -c "client hello, adding session ticket extension" \ |
| 1091 | -s "found session ticket extension" \ |
| 1092 | -s "server hello, adding session ticket extension" \ |
| 1093 | -c "found session_ticket extension" \ |
| 1094 | -c "parse new session ticket" \ |
| 1095 | -S "session successfully restored from cache" \ |
| 1096 | -s "session successfully restored from ticket" \ |
| 1097 | -s "a session has been resumed" \ |
| 1098 | -c "a session has been resumed" |
| 1099 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1100 | run_test "Session resume using tickets: timeout" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1101 | "$P_SRV debug_level=3 tickets=1 cache_max=0 ticket_timeout=1" \ |
| 1102 | "$P_CLI debug_level=3 tickets=1 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 1103 | 0 \ |
| 1104 | -c "client hello, adding session ticket extension" \ |
| 1105 | -s "found session ticket extension" \ |
| 1106 | -s "server hello, adding session ticket extension" \ |
| 1107 | -c "found session_ticket extension" \ |
| 1108 | -c "parse new session ticket" \ |
| 1109 | -S "session successfully restored from cache" \ |
| 1110 | -S "session successfully restored from ticket" \ |
| 1111 | -S "a session has been resumed" \ |
| 1112 | -C "a session has been resumed" |
| 1113 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1114 | run_test "Session resume using tickets: openssl server" \ |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1115 | "$O_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1116 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 1117 | 0 \ |
| 1118 | -c "client hello, adding session ticket extension" \ |
| 1119 | -c "found session_ticket extension" \ |
| 1120 | -c "parse new session ticket" \ |
| 1121 | -c "a session has been resumed" |
| 1122 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1123 | run_test "Session resume using tickets: openssl client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1124 | "$P_SRV debug_level=3 tickets=1" \ |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1125 | "( $O_CLI -sess_out $SESSION; \ |
| 1126 | $O_CLI -sess_in $SESSION; \ |
| 1127 | rm -f $SESSION )" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 1128 | 0 \ |
| 1129 | -s "found session ticket extension" \ |
| 1130 | -s "server hello, adding session ticket extension" \ |
| 1131 | -S "session successfully restored from cache" \ |
| 1132 | -s "session successfully restored from ticket" \ |
| 1133 | -s "a session has been resumed" |
| 1134 | |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1135 | # Tests for Session Resume based on session-ID and cache |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1136 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1137 | run_test "Session resume using cache: tickets enabled on client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1138 | "$P_SRV debug_level=3 tickets=0" \ |
| 1139 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 1140 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1141 | -c "client hello, adding session ticket extension" \ |
| 1142 | -s "found session ticket extension" \ |
| 1143 | -S "server hello, adding session ticket extension" \ |
| 1144 | -C "found session_ticket extension" \ |
| 1145 | -C "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 1146 | -s "session successfully restored from cache" \ |
| 1147 | -S "session successfully restored from ticket" \ |
| 1148 | -s "a session has been resumed" \ |
| 1149 | -c "a session has been resumed" |
| 1150 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1151 | run_test "Session resume using cache: tickets enabled on server" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1152 | "$P_SRV debug_level=3 tickets=1" \ |
| 1153 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 1154 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1155 | -C "client hello, adding session ticket extension" \ |
| 1156 | -S "found session ticket extension" \ |
| 1157 | -S "server hello, adding session ticket extension" \ |
| 1158 | -C "found session_ticket extension" \ |
| 1159 | -C "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 1160 | -s "session successfully restored from cache" \ |
| 1161 | -S "session successfully restored from ticket" \ |
| 1162 | -s "a session has been resumed" \ |
| 1163 | -c "a session has been resumed" |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 1164 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1165 | run_test "Session resume using cache: cache_max=0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1166 | "$P_SRV debug_level=3 tickets=0 cache_max=0" \ |
| 1167 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 1168 | 0 \ |
| 1169 | -S "session successfully restored from cache" \ |
| 1170 | -S "session successfully restored from ticket" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1171 | -S "a session has been resumed" \ |
| 1172 | -C "a session has been resumed" |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 1173 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1174 | run_test "Session resume using cache: cache_max=1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1175 | "$P_SRV debug_level=3 tickets=0 cache_max=1" \ |
| 1176 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1177 | 0 \ |
| 1178 | -s "session successfully restored from cache" \ |
| 1179 | -S "session successfully restored from ticket" \ |
| 1180 | -s "a session has been resumed" \ |
| 1181 | -c "a session has been resumed" |
| 1182 | |
Manuel Pégourié-Gonnard | 6df3196 | 2015-05-04 10:55:47 +0200 | [diff] [blame] | 1183 | run_test "Session resume using cache: timeout > delay" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1184 | "$P_SRV debug_level=3 tickets=0" \ |
| 1185 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=0" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1186 | 0 \ |
| 1187 | -s "session successfully restored from cache" \ |
| 1188 | -S "session successfully restored from ticket" \ |
| 1189 | -s "a session has been resumed" \ |
| 1190 | -c "a session has been resumed" |
| 1191 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1192 | run_test "Session resume using cache: timeout < delay" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1193 | "$P_SRV debug_level=3 tickets=0 cache_timeout=1" \ |
| 1194 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1195 | 0 \ |
| 1196 | -S "session successfully restored from cache" \ |
| 1197 | -S "session successfully restored from ticket" \ |
| 1198 | -S "a session has been resumed" \ |
| 1199 | -C "a session has been resumed" |
| 1200 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1201 | run_test "Session resume using cache: no timeout" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1202 | "$P_SRV debug_level=3 tickets=0 cache_timeout=0" \ |
| 1203 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 1204 | 0 \ |
| 1205 | -s "session successfully restored from cache" \ |
| 1206 | -S "session successfully restored from ticket" \ |
| 1207 | -s "a session has been resumed" \ |
| 1208 | -c "a session has been resumed" |
| 1209 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1210 | run_test "Session resume using cache: openssl client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1211 | "$P_SRV debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1212 | "( $O_CLI -sess_out $SESSION; \ |
| 1213 | $O_CLI -sess_in $SESSION; \ |
| 1214 | rm -f $SESSION )" \ |
Manuel Pégourié-Gonnard | db735f6 | 2014-02-25 17:57:59 +0100 | [diff] [blame] | 1215 | 0 \ |
| 1216 | -s "found session ticket extension" \ |
| 1217 | -S "server hello, adding session ticket extension" \ |
| 1218 | -s "session successfully restored from cache" \ |
| 1219 | -S "session successfully restored from ticket" \ |
| 1220 | -s "a session has been resumed" |
| 1221 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1222 | run_test "Session resume using cache: openssl server" \ |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1223 | "$O_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1224 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | db735f6 | 2014-02-25 17:57:59 +0100 | [diff] [blame] | 1225 | 0 \ |
| 1226 | -C "found session_ticket extension" \ |
| 1227 | -C "parse new session ticket" \ |
| 1228 | -c "a session has been resumed" |
| 1229 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1230 | # Tests for Max Fragment Length extension |
| 1231 | |
Hanno Becker | 64691dc | 2017-09-22 16:58:50 +0100 | [diff] [blame] | 1232 | MAX_CONTENT_LEN_EXPECT='16384' |
| 1233 | MAX_CONTENT_LEN_CONFIG=$( ../scripts/config.pl get MBEDTLS_SSL_MAX_CONTENT_LEN) |
| 1234 | |
| 1235 | if [ -n "$MAX_CONTENT_LEN_CONFIG" ] && [ "$MAX_CONTENT_LEN_CONFIG" -ne "$MAX_CONTENT_LEN_EXPECT" ]; then |
| 1236 | printf "The ${CONFIG_H} file contains a value for the configuration of\n" |
| 1237 | printf "MBEDTLS_SSL_MAX_CONTENT_LEN that is different from the script’s\n" |
| 1238 | printf "test value of ${MAX_CONTENT_LEN_EXPECT}. \n" |
| 1239 | printf "\n" |
| 1240 | printf "The tests assume this value and if it changes, the tests in this\n" |
| 1241 | printf "script should also be adjusted.\n" |
| 1242 | printf "\n" |
| 1243 | |
| 1244 | exit 1 |
| 1245 | fi |
| 1246 | |
Hanno Becker | 0560778 | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 1247 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Hanno Becker | 2fabe5f | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 1248 | run_test "Max fragment length: enabled, default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1249 | "$P_SRV debug_level=3" \ |
| 1250 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 1251 | 0 \ |
Manuel Pégourié-Gonnard | a2cda6b | 2015-08-31 18:30:52 +0200 | [diff] [blame] | 1252 | -c "Maximum fragment length is 16384" \ |
| 1253 | -s "Maximum fragment length is 16384" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 1254 | -C "client hello, adding max_fragment_length extension" \ |
| 1255 | -S "found max fragment length extension" \ |
| 1256 | -S "server hello, max_fragment_length extension" \ |
| 1257 | -C "found max_fragment_length extension" |
| 1258 | |
Hanno Becker | 0560778 | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 1259 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Hanno Becker | 2fabe5f | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 1260 | run_test "Max fragment length: enabled, default, larger message" \ |
| 1261 | "$P_SRV debug_level=3" \ |
Hanno Becker | 6ed76f7 | 2017-10-18 14:42:01 +0100 | [diff] [blame] | 1262 | "$P_CLI debug_level=3 request_size=16385" \ |
Hanno Becker | 2fabe5f | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 1263 | 0 \ |
| 1264 | -c "Maximum fragment length is 16384" \ |
| 1265 | -s "Maximum fragment length is 16384" \ |
| 1266 | -C "client hello, adding max_fragment_length extension" \ |
| 1267 | -S "found max fragment length extension" \ |
| 1268 | -S "server hello, max_fragment_length extension" \ |
| 1269 | -C "found max_fragment_length extension" \ |
Hanno Becker | 6ed76f7 | 2017-10-18 14:42:01 +0100 | [diff] [blame] | 1270 | -c "16385 bytes written in 2 fragments" \ |
Hanno Becker | 2fabe5f | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 1271 | -s "16384 bytes read" \ |
Hanno Becker | 6ed76f7 | 2017-10-18 14:42:01 +0100 | [diff] [blame] | 1272 | -s "1 bytes read" |
Hanno Becker | 2fabe5f | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 1273 | |
| 1274 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 1275 | run_test "Max fragment length, DTLS: enabled, default, larger message" \ |
| 1276 | "$P_SRV debug_level=3 dtls=1" \ |
Hanno Becker | 6ed76f7 | 2017-10-18 14:42:01 +0100 | [diff] [blame] | 1277 | "$P_CLI debug_level=3 dtls=1 request_size=16385" \ |
Hanno Becker | 2fabe5f | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 1278 | 1 \ |
| 1279 | -c "Maximum fragment length is 16384" \ |
| 1280 | -s "Maximum fragment length is 16384" \ |
| 1281 | -C "client hello, adding max_fragment_length extension" \ |
| 1282 | -S "found max fragment length extension" \ |
| 1283 | -S "server hello, max_fragment_length extension" \ |
| 1284 | -C "found max_fragment_length extension" \ |
| 1285 | -c "fragment larger than.*maximum " |
| 1286 | |
| 1287 | requires_config_disabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 1288 | run_test "Max fragment length: disabled, larger message" \ |
| 1289 | "$P_SRV debug_level=3" \ |
Hanno Becker | 6ed76f7 | 2017-10-18 14:42:01 +0100 | [diff] [blame] | 1290 | "$P_CLI debug_level=3 request_size=16385" \ |
Hanno Becker | 2fabe5f | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 1291 | 0 \ |
| 1292 | -C "Maximum fragment length is 16384" \ |
| 1293 | -S "Maximum fragment length is 16384" \ |
Hanno Becker | 6ed76f7 | 2017-10-18 14:42:01 +0100 | [diff] [blame] | 1294 | -c "16385 bytes written in 2 fragments" \ |
Hanno Becker | 2fabe5f | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 1295 | -s "16384 bytes read" \ |
Hanno Becker | 6ed76f7 | 2017-10-18 14:42:01 +0100 | [diff] [blame] | 1296 | -s "1 bytes read" |
Hanno Becker | 2fabe5f | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 1297 | |
| 1298 | requires_config_disabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 1299 | run_test "Max fragment length DTLS: disabled, larger message" \ |
| 1300 | "$P_SRV debug_level=3 dtls=1" \ |
Hanno Becker | 6ed76f7 | 2017-10-18 14:42:01 +0100 | [diff] [blame] | 1301 | "$P_CLI debug_level=3 dtls=1 request_size=16385" \ |
Hanno Becker | 2fabe5f | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 1302 | 1 \ |
| 1303 | -C "Maximum fragment length is 16384" \ |
| 1304 | -S "Maximum fragment length is 16384" \ |
| 1305 | -c "fragment larger than.*maximum " |
| 1306 | |
| 1307 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1308 | run_test "Max fragment length: used by client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1309 | "$P_SRV debug_level=3" \ |
| 1310 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 1311 | 0 \ |
Manuel Pégourié-Gonnard | a2cda6b | 2015-08-31 18:30:52 +0200 | [diff] [blame] | 1312 | -c "Maximum fragment length is 4096" \ |
| 1313 | -s "Maximum fragment length is 4096" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 1314 | -c "client hello, adding max_fragment_length extension" \ |
| 1315 | -s "found max fragment length extension" \ |
| 1316 | -s "server hello, max_fragment_length extension" \ |
| 1317 | -c "found max_fragment_length extension" |
| 1318 | |
Hanno Becker | 0560778 | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 1319 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1320 | run_test "Max fragment length: used by server" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1321 | "$P_SRV debug_level=3 max_frag_len=4096" \ |
| 1322 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 1323 | 0 \ |
Manuel Pégourié-Gonnard | a2cda6b | 2015-08-31 18:30:52 +0200 | [diff] [blame] | 1324 | -c "Maximum fragment length is 16384" \ |
| 1325 | -s "Maximum fragment length is 4096" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 1326 | -C "client hello, adding max_fragment_length extension" \ |
| 1327 | -S "found max fragment length extension" \ |
| 1328 | -S "server hello, max_fragment_length extension" \ |
| 1329 | -C "found max_fragment_length extension" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1330 | |
Hanno Becker | 0560778 | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 1331 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1332 | requires_gnutls |
| 1333 | run_test "Max fragment length: gnutls server" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 1334 | "$G_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1335 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 1336 | 0 \ |
Manuel Pégourié-Gonnard | a2cda6b | 2015-08-31 18:30:52 +0200 | [diff] [blame] | 1337 | -c "Maximum fragment length is 4096" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 1338 | -c "client hello, adding max_fragment_length extension" \ |
| 1339 | -c "found max_fragment_length extension" |
| 1340 | |
Hanno Becker | 0560778 | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 1341 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 1342 | run_test "Max fragment length: client, message just fits" \ |
| 1343 | "$P_SRV debug_level=3" \ |
| 1344 | "$P_CLI debug_level=3 max_frag_len=2048 request_size=2048" \ |
| 1345 | 0 \ |
Manuel Pégourié-Gonnard | a2cda6b | 2015-08-31 18:30:52 +0200 | [diff] [blame] | 1346 | -c "Maximum fragment length is 2048" \ |
| 1347 | -s "Maximum fragment length is 2048" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 1348 | -c "client hello, adding max_fragment_length extension" \ |
| 1349 | -s "found max fragment length extension" \ |
| 1350 | -s "server hello, max_fragment_length extension" \ |
| 1351 | -c "found max_fragment_length extension" \ |
| 1352 | -c "2048 bytes written in 1 fragments" \ |
| 1353 | -s "2048 bytes read" |
| 1354 | |
Hanno Becker | 0560778 | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 1355 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 1356 | run_test "Max fragment length: client, larger message" \ |
| 1357 | "$P_SRV debug_level=3" \ |
| 1358 | "$P_CLI debug_level=3 max_frag_len=2048 request_size=2345" \ |
| 1359 | 0 \ |
Manuel Pégourié-Gonnard | a2cda6b | 2015-08-31 18:30:52 +0200 | [diff] [blame] | 1360 | -c "Maximum fragment length is 2048" \ |
| 1361 | -s "Maximum fragment length is 2048" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 1362 | -c "client hello, adding max_fragment_length extension" \ |
| 1363 | -s "found max fragment length extension" \ |
| 1364 | -s "server hello, max_fragment_length extension" \ |
| 1365 | -c "found max_fragment_length extension" \ |
| 1366 | -c "2345 bytes written in 2 fragments" \ |
| 1367 | -s "2048 bytes read" \ |
| 1368 | -s "297 bytes read" |
| 1369 | |
Hanno Becker | 0560778 | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 1370 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 23eb74d | 2015-01-21 14:37:13 +0000 | [diff] [blame] | 1371 | run_test "Max fragment length: DTLS client, larger message" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 1372 | "$P_SRV debug_level=3 dtls=1" \ |
| 1373 | "$P_CLI debug_level=3 dtls=1 max_frag_len=2048 request_size=2345" \ |
| 1374 | 1 \ |
Manuel Pégourié-Gonnard | a2cda6b | 2015-08-31 18:30:52 +0200 | [diff] [blame] | 1375 | -c "Maximum fragment length is 2048" \ |
| 1376 | -s "Maximum fragment length is 2048" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 1377 | -c "client hello, adding max_fragment_length extension" \ |
| 1378 | -s "found max fragment length extension" \ |
| 1379 | -s "server hello, max_fragment_length extension" \ |
| 1380 | -c "found max_fragment_length extension" \ |
| 1381 | -c "fragment larger than.*maximum" |
| 1382 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1383 | # Tests for renegotiation |
| 1384 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1385 | run_test "Renegotiation: none, for reference" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1386 | "$P_SRV debug_level=3 exchanges=2 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1387 | "$P_CLI debug_level=3 exchanges=2" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1388 | 0 \ |
| 1389 | -C "client hello, adding renegotiation extension" \ |
| 1390 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1391 | -S "found renegotiation extension" \ |
| 1392 | -s "server hello, secure renegotiation extension" \ |
| 1393 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1394 | -C "=> renegotiate" \ |
| 1395 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1396 | -S "write hello request" |
| 1397 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1398 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1399 | run_test "Renegotiation: client-initiated" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1400 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1401 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1402 | 0 \ |
| 1403 | -c "client hello, adding renegotiation extension" \ |
| 1404 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1405 | -s "found renegotiation extension" \ |
| 1406 | -s "server hello, secure renegotiation extension" \ |
| 1407 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1408 | -c "=> renegotiate" \ |
| 1409 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1410 | -S "write hello request" |
| 1411 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1412 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1413 | run_test "Renegotiation: server-initiated" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1414 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1415 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1416 | 0 \ |
| 1417 | -c "client hello, adding renegotiation extension" \ |
| 1418 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1419 | -s "found renegotiation extension" \ |
| 1420 | -s "server hello, secure renegotiation extension" \ |
| 1421 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1422 | -c "=> renegotiate" \ |
| 1423 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1424 | -s "write hello request" |
| 1425 | |
Janos Follath | 5f1dd80 | 2017-10-05 12:29:42 +0100 | [diff] [blame] | 1426 | # Checks that no Signature Algorithm with SHA-1 gets negotiated. Negotiating SHA-1 would mean that |
| 1427 | # the server did not parse the Signature Algorithm extension. This test is valid only if an MD |
| 1428 | # algorithm stronger than SHA-1 is enabled in config.h |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1429 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Janos Follath | 5f1dd80 | 2017-10-05 12:29:42 +0100 | [diff] [blame] | 1430 | run_test "Renegotiation: Signature Algorithms parsing, client-initiated" \ |
| 1431 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional" \ |
| 1432 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 1433 | 0 \ |
| 1434 | -c "client hello, adding renegotiation extension" \ |
| 1435 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1436 | -s "found renegotiation extension" \ |
| 1437 | -s "server hello, secure renegotiation extension" \ |
| 1438 | -c "found renegotiation extension" \ |
| 1439 | -c "=> renegotiate" \ |
| 1440 | -s "=> renegotiate" \ |
| 1441 | -S "write hello request" \ |
| 1442 | -S "client hello v3, signature_algorithm ext: 2" # Is SHA-1 negotiated? |
| 1443 | |
| 1444 | # Checks that no Signature Algorithm with SHA-1 gets negotiated. Negotiating SHA-1 would mean that |
| 1445 | # the server did not parse the Signature Algorithm extension. This test is valid only if an MD |
| 1446 | # algorithm stronger than SHA-1 is enabled in config.h |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1447 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Janos Follath | 5f1dd80 | 2017-10-05 12:29:42 +0100 | [diff] [blame] | 1448 | run_test "Renegotiation: Signature Algorithms parsing, server-initiated" \ |
| 1449 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1" \ |
| 1450 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
| 1451 | 0 \ |
| 1452 | -c "client hello, adding renegotiation extension" \ |
| 1453 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1454 | -s "found renegotiation extension" \ |
| 1455 | -s "server hello, secure renegotiation extension" \ |
| 1456 | -c "found renegotiation extension" \ |
| 1457 | -c "=> renegotiate" \ |
| 1458 | -s "=> renegotiate" \ |
| 1459 | -s "write hello request" \ |
| 1460 | -S "client hello v3, signature_algorithm ext: 2" # Is SHA-1 negotiated? |
| 1461 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1462 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1463 | run_test "Renegotiation: double" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1464 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1465 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1466 | 0 \ |
| 1467 | -c "client hello, adding renegotiation extension" \ |
| 1468 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1469 | -s "found renegotiation extension" \ |
| 1470 | -s "server hello, secure renegotiation extension" \ |
| 1471 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1472 | -c "=> renegotiate" \ |
| 1473 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1474 | -s "write hello request" |
| 1475 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1476 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1477 | run_test "Renegotiation: client-initiated, server-rejected" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1478 | "$P_SRV debug_level=3 exchanges=2 renegotiation=0 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1479 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1480 | 1 \ |
| 1481 | -c "client hello, adding renegotiation extension" \ |
| 1482 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1483 | -S "found renegotiation extension" \ |
| 1484 | -s "server hello, secure renegotiation extension" \ |
| 1485 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1486 | -c "=> renegotiate" \ |
| 1487 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1488 | -S "write hello request" \ |
Manuel Pégourié-Gonnard | 6591962 | 2014-08-19 12:50:30 +0200 | [diff] [blame] | 1489 | -c "SSL - Unexpected message at ServerHello in renegotiation" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1490 | -c "failed" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1491 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1492 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1493 | run_test "Renegotiation: server-initiated, client-rejected, default" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1494 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1495 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1496 | 0 \ |
| 1497 | -C "client hello, adding renegotiation extension" \ |
| 1498 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1499 | -S "found renegotiation extension" \ |
| 1500 | -s "server hello, secure renegotiation extension" \ |
| 1501 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1502 | -C "=> renegotiate" \ |
| 1503 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1504 | -s "write hello request" \ |
Manuel Pégourié-Gonnard | a9964db | 2014-07-03 19:29:16 +0200 | [diff] [blame] | 1505 | -S "SSL - An unexpected message was received from our peer" \ |
| 1506 | -S "failed" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 1507 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1508 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1509 | run_test "Renegotiation: server-initiated, client-rejected, not enforced" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1510 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1511 | renego_delay=-1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1512 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1513 | 0 \ |
| 1514 | -C "client hello, adding renegotiation extension" \ |
| 1515 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1516 | -S "found renegotiation extension" \ |
| 1517 | -s "server hello, secure renegotiation extension" \ |
| 1518 | -c "found renegotiation extension" \ |
| 1519 | -C "=> renegotiate" \ |
| 1520 | -S "=> renegotiate" \ |
| 1521 | -s "write hello request" \ |
| 1522 | -S "SSL - An unexpected message was received from our peer" \ |
| 1523 | -S "failed" |
| 1524 | |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 1525 | # delay 2 for 1 alert record + 1 application data record |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1526 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1527 | run_test "Renegotiation: server-initiated, client-rejected, delay 2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1528 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1529 | renego_delay=2 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1530 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1531 | 0 \ |
| 1532 | -C "client hello, adding renegotiation extension" \ |
| 1533 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1534 | -S "found renegotiation extension" \ |
| 1535 | -s "server hello, secure renegotiation extension" \ |
| 1536 | -c "found renegotiation extension" \ |
| 1537 | -C "=> renegotiate" \ |
| 1538 | -S "=> renegotiate" \ |
| 1539 | -s "write hello request" \ |
| 1540 | -S "SSL - An unexpected message was received from our peer" \ |
| 1541 | -S "failed" |
| 1542 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1543 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1544 | run_test "Renegotiation: server-initiated, client-rejected, delay 0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1545 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1546 | renego_delay=0 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1547 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1548 | 0 \ |
| 1549 | -C "client hello, adding renegotiation extension" \ |
| 1550 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1551 | -S "found renegotiation extension" \ |
| 1552 | -s "server hello, secure renegotiation extension" \ |
| 1553 | -c "found renegotiation extension" \ |
| 1554 | -C "=> renegotiate" \ |
| 1555 | -S "=> renegotiate" \ |
| 1556 | -s "write hello request" \ |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 1557 | -s "SSL - An unexpected message was received from our peer" |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1558 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1559 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1560 | run_test "Renegotiation: server-initiated, client-accepted, delay 0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1561 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1562 | renego_delay=0 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1563 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1564 | 0 \ |
| 1565 | -c "client hello, adding renegotiation extension" \ |
| 1566 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1567 | -s "found renegotiation extension" \ |
| 1568 | -s "server hello, secure renegotiation extension" \ |
| 1569 | -c "found renegotiation extension" \ |
| 1570 | -c "=> renegotiate" \ |
| 1571 | -s "=> renegotiate" \ |
| 1572 | -s "write hello request" \ |
| 1573 | -S "SSL - An unexpected message was received from our peer" \ |
| 1574 | -S "failed" |
| 1575 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1576 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1577 | run_test "Renegotiation: periodic, just below period" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1578 | "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1579 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
| 1580 | 0 \ |
| 1581 | -C "client hello, adding renegotiation extension" \ |
| 1582 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1583 | -S "found renegotiation extension" \ |
| 1584 | -s "server hello, secure renegotiation extension" \ |
| 1585 | -c "found renegotiation extension" \ |
| 1586 | -S "record counter limit reached: renegotiate" \ |
| 1587 | -C "=> renegotiate" \ |
| 1588 | -S "=> renegotiate" \ |
| 1589 | -S "write hello request" \ |
| 1590 | -S "SSL - An unexpected message was received from our peer" \ |
| 1591 | -S "failed" |
| 1592 | |
Manuel Pégourié-Gonnard | 9835bc0 | 2015-01-14 14:41:58 +0100 | [diff] [blame] | 1593 | # one extra exchange to be able to complete renego |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1594 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1595 | run_test "Renegotiation: periodic, just above period" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1596 | "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 9835bc0 | 2015-01-14 14:41:58 +0100 | [diff] [blame] | 1597 | "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1598 | 0 \ |
| 1599 | -c "client hello, adding renegotiation extension" \ |
| 1600 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1601 | -s "found renegotiation extension" \ |
| 1602 | -s "server hello, secure renegotiation extension" \ |
| 1603 | -c "found renegotiation extension" \ |
| 1604 | -s "record counter limit reached: renegotiate" \ |
| 1605 | -c "=> renegotiate" \ |
| 1606 | -s "=> renegotiate" \ |
| 1607 | -s "write hello request" \ |
| 1608 | -S "SSL - An unexpected message was received from our peer" \ |
| 1609 | -S "failed" |
| 1610 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1611 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1612 | run_test "Renegotiation: periodic, two times period" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1613 | "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 9835bc0 | 2015-01-14 14:41:58 +0100 | [diff] [blame] | 1614 | "$P_CLI debug_level=3 exchanges=7 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1615 | 0 \ |
| 1616 | -c "client hello, adding renegotiation extension" \ |
| 1617 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1618 | -s "found renegotiation extension" \ |
| 1619 | -s "server hello, secure renegotiation extension" \ |
| 1620 | -c "found renegotiation extension" \ |
| 1621 | -s "record counter limit reached: renegotiate" \ |
| 1622 | -c "=> renegotiate" \ |
| 1623 | -s "=> renegotiate" \ |
| 1624 | -s "write hello request" \ |
| 1625 | -S "SSL - An unexpected message was received from our peer" \ |
| 1626 | -S "failed" |
| 1627 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1628 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1629 | run_test "Renegotiation: periodic, above period, disabled" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1630 | "$P_SRV debug_level=3 exchanges=9 renegotiation=0 renego_period=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1631 | "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \ |
| 1632 | 0 \ |
| 1633 | -C "client hello, adding renegotiation extension" \ |
| 1634 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1635 | -S "found renegotiation extension" \ |
| 1636 | -s "server hello, secure renegotiation extension" \ |
| 1637 | -c "found renegotiation extension" \ |
| 1638 | -S "record counter limit reached: renegotiate" \ |
| 1639 | -C "=> renegotiate" \ |
| 1640 | -S "=> renegotiate" \ |
| 1641 | -S "write hello request" \ |
| 1642 | -S "SSL - An unexpected message was received from our peer" \ |
| 1643 | -S "failed" |
| 1644 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1645 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1646 | run_test "Renegotiation: nbio, client-initiated" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1647 | "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1648 | "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | f07f421 | 2014-08-15 19:04:47 +0200 | [diff] [blame] | 1649 | 0 \ |
| 1650 | -c "client hello, adding renegotiation extension" \ |
| 1651 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1652 | -s "found renegotiation extension" \ |
| 1653 | -s "server hello, secure renegotiation extension" \ |
| 1654 | -c "found renegotiation extension" \ |
| 1655 | -c "=> renegotiate" \ |
| 1656 | -s "=> renegotiate" \ |
| 1657 | -S "write hello request" |
| 1658 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1659 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1660 | run_test "Renegotiation: nbio, server-initiated" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 1661 | "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1662 | "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | f07f421 | 2014-08-15 19:04:47 +0200 | [diff] [blame] | 1663 | 0 \ |
| 1664 | -c "client hello, adding renegotiation extension" \ |
| 1665 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1666 | -s "found renegotiation extension" \ |
| 1667 | -s "server hello, secure renegotiation extension" \ |
| 1668 | -c "found renegotiation extension" \ |
| 1669 | -c "=> renegotiate" \ |
| 1670 | -s "=> renegotiate" \ |
| 1671 | -s "write hello request" |
| 1672 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1673 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1674 | run_test "Renegotiation: openssl server, client-initiated" \ |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 1675 | "$O_SRV -www" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1676 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 1677 | 0 \ |
| 1678 | -c "client hello, adding renegotiation extension" \ |
| 1679 | -c "found renegotiation extension" \ |
| 1680 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1681 | -C "ssl_hanshake() returned" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 1682 | -C "error" \ |
| 1683 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 1684 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1685 | requires_gnutls |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1686 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1687 | run_test "Renegotiation: gnutls server strict, client-initiated" \ |
| 1688 | "$G_SRV --priority=NORMAL:%SAFE_RENEGOTIATION" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1689 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 1690 | 0 \ |
| 1691 | -c "client hello, adding renegotiation extension" \ |
| 1692 | -c "found renegotiation extension" \ |
| 1693 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1694 | -C "ssl_hanshake() returned" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 1695 | -C "error" \ |
| 1696 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 1697 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1698 | requires_gnutls |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1699 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1700 | run_test "Renegotiation: gnutls server unsafe, client-initiated default" \ |
| 1701 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1702 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
| 1703 | 1 \ |
| 1704 | -c "client hello, adding renegotiation extension" \ |
| 1705 | -C "found renegotiation extension" \ |
| 1706 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1707 | -c "mbedtls_ssl_handshake() returned" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1708 | -c "error" \ |
| 1709 | -C "HTTP/1.0 200 [Oo][Kk]" |
| 1710 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1711 | requires_gnutls |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1712 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1713 | run_test "Renegotiation: gnutls server unsafe, client-inititated no legacy" \ |
| 1714 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1715 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \ |
| 1716 | allow_legacy=0" \ |
| 1717 | 1 \ |
| 1718 | -c "client hello, adding renegotiation extension" \ |
| 1719 | -C "found renegotiation extension" \ |
| 1720 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1721 | -c "mbedtls_ssl_handshake() returned" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1722 | -c "error" \ |
| 1723 | -C "HTTP/1.0 200 [Oo][Kk]" |
| 1724 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1725 | requires_gnutls |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1726 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1727 | run_test "Renegotiation: gnutls server unsafe, client-inititated legacy" \ |
| 1728 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1729 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \ |
| 1730 | allow_legacy=1" \ |
| 1731 | 0 \ |
| 1732 | -c "client hello, adding renegotiation extension" \ |
| 1733 | -C "found renegotiation extension" \ |
| 1734 | -c "=> renegotiate" \ |
| 1735 | -C "ssl_hanshake() returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1736 | -C "error" \ |
| 1737 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 1738 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1739 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 30d16eb | 2014-08-19 17:43:50 +0200 | [diff] [blame] | 1740 | run_test "Renegotiation: DTLS, client-initiated" \ |
| 1741 | "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1" \ |
| 1742 | "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 1743 | 0 \ |
| 1744 | -c "client hello, adding renegotiation extension" \ |
| 1745 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1746 | -s "found renegotiation extension" \ |
| 1747 | -s "server hello, secure renegotiation extension" \ |
| 1748 | -c "found renegotiation extension" \ |
| 1749 | -c "=> renegotiate" \ |
| 1750 | -s "=> renegotiate" \ |
| 1751 | -S "write hello request" |
| 1752 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1753 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | c392b24 | 2014-08-19 17:53:11 +0200 | [diff] [blame] | 1754 | run_test "Renegotiation: DTLS, server-initiated" \ |
| 1755 | "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | df9a0a8 | 2014-10-02 14:17:18 +0200 | [diff] [blame] | 1756 | "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1 \ |
| 1757 | read_timeout=1000 max_resend=2" \ |
Manuel Pégourié-Gonnard | c392b24 | 2014-08-19 17:53:11 +0200 | [diff] [blame] | 1758 | 0 \ |
| 1759 | -c "client hello, adding renegotiation extension" \ |
| 1760 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1761 | -s "found renegotiation extension" \ |
| 1762 | -s "server hello, secure renegotiation extension" \ |
| 1763 | -c "found renegotiation extension" \ |
| 1764 | -c "=> renegotiate" \ |
| 1765 | -s "=> renegotiate" \ |
| 1766 | -s "write hello request" |
| 1767 | |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1768 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Andres AG | 9b1927b | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 1769 | run_test "Renegotiation: DTLS, renego_period overflow" \ |
| 1770 | "$P_SRV debug_level=3 dtls=1 exchanges=4 renegotiation=1 renego_period=18446462598732840962 auth_mode=optional" \ |
| 1771 | "$P_CLI debug_level=3 dtls=1 exchanges=4 renegotiation=1" \ |
| 1772 | 0 \ |
| 1773 | -c "client hello, adding renegotiation extension" \ |
| 1774 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1775 | -s "found renegotiation extension" \ |
| 1776 | -s "server hello, secure renegotiation extension" \ |
| 1777 | -s "record counter limit reached: renegotiate" \ |
| 1778 | -c "=> renegotiate" \ |
| 1779 | -s "=> renegotiate" \ |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1780 | -s "write hello request" |
Andres AG | 9b1927b | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 1781 | |
Manuel Pégourié-Gonnard | 9699996 | 2015-02-17 16:02:37 +0000 | [diff] [blame] | 1782 | requires_gnutls |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 1783 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | f1499f6 | 2014-08-31 17:13:13 +0200 | [diff] [blame] | 1784 | run_test "Renegotiation: DTLS, gnutls server, client-initiated" \ |
| 1785 | "$G_SRV -u --mtu 4096" \ |
| 1786 | "$P_CLI debug_level=3 dtls=1 exchanges=1 renegotiation=1 renegotiate=1" \ |
| 1787 | 0 \ |
| 1788 | -c "client hello, adding renegotiation extension" \ |
| 1789 | -c "found renegotiation extension" \ |
| 1790 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1791 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | f1499f6 | 2014-08-31 17:13:13 +0200 | [diff] [blame] | 1792 | -C "error" \ |
| 1793 | -s "Extra-header:" |
| 1794 | |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1795 | # Test for the "secure renegotation" extension only (no actual renegotiation) |
| 1796 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1797 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1798 | run_test "Renego ext: gnutls server strict, client default" \ |
| 1799 | "$G_SRV --priority=NORMAL:%SAFE_RENEGOTIATION" \ |
| 1800 | "$P_CLI debug_level=3" \ |
| 1801 | 0 \ |
| 1802 | -c "found renegotiation extension" \ |
| 1803 | -C "error" \ |
| 1804 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 1805 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1806 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1807 | run_test "Renego ext: gnutls server unsafe, client default" \ |
| 1808 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1809 | "$P_CLI debug_level=3" \ |
| 1810 | 0 \ |
| 1811 | -C "found renegotiation extension" \ |
| 1812 | -C "error" \ |
| 1813 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 1814 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1815 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1816 | run_test "Renego ext: gnutls server unsafe, client break legacy" \ |
| 1817 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1818 | "$P_CLI debug_level=3 allow_legacy=-1" \ |
| 1819 | 1 \ |
| 1820 | -C "found renegotiation extension" \ |
| 1821 | -c "error" \ |
| 1822 | -C "HTTP/1.0 200 [Oo][Kk]" |
| 1823 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1824 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1825 | run_test "Renego ext: gnutls client strict, server default" \ |
| 1826 | "$P_SRV debug_level=3" \ |
| 1827 | "$G_CLI --priority=NORMAL:%SAFE_RENEGOTIATION" \ |
| 1828 | 0 \ |
| 1829 | -s "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ |
| 1830 | -s "server hello, secure renegotiation extension" |
| 1831 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1832 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1833 | run_test "Renego ext: gnutls client unsafe, server default" \ |
| 1834 | "$P_SRV debug_level=3" \ |
| 1835 | "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1836 | 0 \ |
| 1837 | -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ |
| 1838 | -S "server hello, secure renegotiation extension" |
| 1839 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1840 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1841 | run_test "Renego ext: gnutls client unsafe, server break legacy" \ |
| 1842 | "$P_SRV debug_level=3 allow_legacy=-1" \ |
| 1843 | "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1844 | 1 \ |
| 1845 | -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ |
| 1846 | -S "server hello, secure renegotiation extension" |
| 1847 | |
Janos Follath | 365b226 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 1848 | # Tests for silently dropping trailing extra bytes in .der certificates |
| 1849 | |
| 1850 | requires_gnutls |
| 1851 | run_test "DER format: no trailing bytes" \ |
| 1852 | "$P_SRV crt_file=data_files/server5-der0.crt \ |
| 1853 | key_file=data_files/server5.key" \ |
| 1854 | "$G_CLI " \ |
| 1855 | 0 \ |
| 1856 | -c "Handshake was completed" \ |
| 1857 | |
| 1858 | requires_gnutls |
| 1859 | run_test "DER format: with a trailing zero byte" \ |
| 1860 | "$P_SRV crt_file=data_files/server5-der1a.crt \ |
| 1861 | key_file=data_files/server5.key" \ |
| 1862 | "$G_CLI " \ |
| 1863 | 0 \ |
| 1864 | -c "Handshake was completed" \ |
| 1865 | |
| 1866 | requires_gnutls |
| 1867 | run_test "DER format: with a trailing random byte" \ |
| 1868 | "$P_SRV crt_file=data_files/server5-der1b.crt \ |
| 1869 | key_file=data_files/server5.key" \ |
| 1870 | "$G_CLI " \ |
| 1871 | 0 \ |
| 1872 | -c "Handshake was completed" \ |
| 1873 | |
| 1874 | requires_gnutls |
| 1875 | run_test "DER format: with 2 trailing random bytes" \ |
| 1876 | "$P_SRV crt_file=data_files/server5-der2.crt \ |
| 1877 | key_file=data_files/server5.key" \ |
| 1878 | "$G_CLI " \ |
| 1879 | 0 \ |
| 1880 | -c "Handshake was completed" \ |
| 1881 | |
| 1882 | requires_gnutls |
| 1883 | run_test "DER format: with 4 trailing random bytes" \ |
| 1884 | "$P_SRV crt_file=data_files/server5-der4.crt \ |
| 1885 | key_file=data_files/server5.key" \ |
| 1886 | "$G_CLI " \ |
| 1887 | 0 \ |
| 1888 | -c "Handshake was completed" \ |
| 1889 | |
| 1890 | requires_gnutls |
| 1891 | run_test "DER format: with 8 trailing random bytes" \ |
| 1892 | "$P_SRV crt_file=data_files/server5-der8.crt \ |
| 1893 | key_file=data_files/server5.key" \ |
| 1894 | "$G_CLI " \ |
| 1895 | 0 \ |
| 1896 | -c "Handshake was completed" \ |
| 1897 | |
| 1898 | requires_gnutls |
| 1899 | run_test "DER format: with 9 trailing random bytes" \ |
| 1900 | "$P_SRV crt_file=data_files/server5-der9.crt \ |
| 1901 | key_file=data_files/server5.key" \ |
| 1902 | "$G_CLI " \ |
| 1903 | 0 \ |
| 1904 | -c "Handshake was completed" \ |
| 1905 | |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1906 | # Tests for auth_mode |
| 1907 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1908 | run_test "Authentication: server badcert, client required" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1909 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
| 1910 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1911 | "$P_CLI debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1912 | 1 \ |
| 1913 | -c "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 1914 | -c "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1915 | -c "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1916 | -c "X509 - Certificate verification failed" |
| 1917 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1918 | run_test "Authentication: server badcert, client optional" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1919 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
| 1920 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1921 | "$P_CLI debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1922 | 0 \ |
| 1923 | -c "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 1924 | -c "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1925 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1926 | -C "X509 - Certificate verification failed" |
| 1927 | |
Hanno Becker | 61c0c70 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 1928 | run_test "Authentication: server goodcert, client optional, no trusted CA" \ |
| 1929 | "$P_SRV" \ |
| 1930 | "$P_CLI debug_level=3 auth_mode=optional ca_file=none ca_path=none" \ |
| 1931 | 0 \ |
| 1932 | -c "x509_verify_cert() returned" \ |
| 1933 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 1934 | -c "! Certificate verification flags"\ |
| 1935 | -C "! mbedtls_ssl_handshake returned" \ |
| 1936 | -C "X509 - Certificate verification failed" \ |
| 1937 | -C "SSL - No CA Chain is set, but required to operate" |
| 1938 | |
| 1939 | run_test "Authentication: server goodcert, client required, no trusted CA" \ |
| 1940 | "$P_SRV" \ |
| 1941 | "$P_CLI debug_level=3 auth_mode=required ca_file=none ca_path=none" \ |
| 1942 | 1 \ |
| 1943 | -c "x509_verify_cert() returned" \ |
| 1944 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 1945 | -c "! Certificate verification flags"\ |
| 1946 | -c "! mbedtls_ssl_handshake returned" \ |
| 1947 | -c "SSL - No CA Chain is set, but required to operate" |
| 1948 | |
| 1949 | # The purpose of the next two tests is to test the client's behaviour when receiving a server |
| 1950 | # certificate with an unsupported elliptic curve. This should usually not happen because |
| 1951 | # the client informs the server about the supported curves - it does, though, in the |
| 1952 | # corner case of a static ECDH suite, because the server doesn't check the curve on that |
| 1953 | # occasion (to be fixed). If that bug's fixed, the test needs to be altered to use a |
| 1954 | # different means to have the server ignoring the client's supported curve list. |
| 1955 | |
| 1956 | requires_config_enabled MBEDTLS_ECP_C |
| 1957 | run_test "Authentication: server ECDH p256v1, client required, p256v1 unsupported" \ |
| 1958 | "$P_SRV debug_level=1 key_file=data_files/server5.key \ |
| 1959 | crt_file=data_files/server5.ku-ka.crt" \ |
| 1960 | "$P_CLI debug_level=3 auth_mode=required curves=secp521r1" \ |
| 1961 | 1 \ |
| 1962 | -c "bad certificate (EC key curve)"\ |
| 1963 | -c "! Certificate verification flags"\ |
| 1964 | -C "bad server certificate (ECDH curve)" # Expect failure at earlier verification stage |
| 1965 | |
| 1966 | requires_config_enabled MBEDTLS_ECP_C |
| 1967 | run_test "Authentication: server ECDH p256v1, client optional, p256v1 unsupported" \ |
| 1968 | "$P_SRV debug_level=1 key_file=data_files/server5.key \ |
| 1969 | crt_file=data_files/server5.ku-ka.crt" \ |
| 1970 | "$P_CLI debug_level=3 auth_mode=optional curves=secp521r1" \ |
| 1971 | 1 \ |
| 1972 | -c "bad certificate (EC key curve)"\ |
| 1973 | -c "! Certificate verification flags"\ |
| 1974 | -c "bad server certificate (ECDH curve)" # Expect failure only at ECDH params check |
| 1975 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1976 | run_test "Authentication: server badcert, client none" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1977 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1978 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1979 | "$P_CLI debug_level=1 auth_mode=none" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1980 | 0 \ |
| 1981 | -C "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 1982 | -C "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1983 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1984 | -C "X509 - Certificate verification failed" |
| 1985 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1986 | run_test "Authentication: client badcert, server required" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1987 | "$P_SRV debug_level=3 auth_mode=required" \ |
| 1988 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1989 | key_file=data_files/server5.key" \ |
| 1990 | 1 \ |
| 1991 | -S "skip write certificate request" \ |
| 1992 | -C "skip parse certificate request" \ |
| 1993 | -c "got a certificate request" \ |
| 1994 | -C "skip write certificate" \ |
| 1995 | -C "skip write certificate verify" \ |
| 1996 | -S "skip parse certificate verify" \ |
| 1997 | -s "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 1998 | -s "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1999 | -s "! mbedtls_ssl_handshake returned" \ |
| 2000 | -c "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 2001 | -s "X509 - Certificate verification failed" |
| 2002 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2003 | run_test "Authentication: client badcert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2004 | "$P_SRV debug_level=3 auth_mode=optional" \ |
| 2005 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 2006 | key_file=data_files/server5.key" \ |
| 2007 | 0 \ |
| 2008 | -S "skip write certificate request" \ |
| 2009 | -C "skip parse certificate request" \ |
| 2010 | -c "got a certificate request" \ |
| 2011 | -C "skip write certificate" \ |
| 2012 | -C "skip write certificate verify" \ |
| 2013 | -S "skip parse certificate verify" \ |
| 2014 | -s "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 2015 | -s "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2016 | -S "! mbedtls_ssl_handshake returned" \ |
| 2017 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 2018 | -S "X509 - Certificate verification failed" |
| 2019 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2020 | run_test "Authentication: client badcert, server none" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2021 | "$P_SRV debug_level=3 auth_mode=none" \ |
| 2022 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 2023 | key_file=data_files/server5.key" \ |
| 2024 | 0 \ |
| 2025 | -s "skip write certificate request" \ |
| 2026 | -C "skip parse certificate request" \ |
| 2027 | -c "got no certificate request" \ |
| 2028 | -c "skip write certificate" \ |
| 2029 | -c "skip write certificate verify" \ |
| 2030 | -s "skip parse certificate verify" \ |
| 2031 | -S "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 2032 | -S "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2033 | -S "! mbedtls_ssl_handshake returned" \ |
| 2034 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 2035 | -S "X509 - Certificate verification failed" |
| 2036 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2037 | run_test "Authentication: client no cert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2038 | "$P_SRV debug_level=3 auth_mode=optional" \ |
| 2039 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 2040 | 0 \ |
| 2041 | -S "skip write certificate request" \ |
| 2042 | -C "skip parse certificate request" \ |
| 2043 | -c "got a certificate request" \ |
| 2044 | -C "skip write certificate$" \ |
| 2045 | -C "got no certificate to send" \ |
| 2046 | -S "SSLv3 client has no certificate" \ |
| 2047 | -c "skip write certificate verify" \ |
| 2048 | -s "skip parse certificate verify" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 2049 | -s "! Certificate was missing" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2050 | -S "! mbedtls_ssl_handshake returned" \ |
| 2051 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 2052 | -S "X509 - Certificate verification failed" |
| 2053 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2054 | run_test "Authentication: openssl client no cert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2055 | "$P_SRV debug_level=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 2056 | "$O_CLI" \ |
| 2057 | 0 \ |
| 2058 | -S "skip write certificate request" \ |
| 2059 | -s "skip parse certificate verify" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 2060 | -s "! Certificate was missing" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2061 | -S "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 2062 | -S "X509 - Certificate verification failed" |
| 2063 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2064 | run_test "Authentication: client no cert, openssl server optional" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 2065 | "$O_SRV -verify 10" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2066 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 2067 | 0 \ |
| 2068 | -C "skip parse certificate request" \ |
| 2069 | -c "got a certificate request" \ |
| 2070 | -C "skip write certificate$" \ |
| 2071 | -c "skip write certificate verify" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2072 | -C "! mbedtls_ssl_handshake returned" |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 2073 | |
Janos Follath | 542ee5d | 2016-03-07 15:57:05 +0000 | [diff] [blame] | 2074 | requires_config_enabled MBEDTLS_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2075 | run_test "Authentication: client no cert, ssl3" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2076 | "$P_SRV debug_level=3 auth_mode=optional force_version=ssl3" \ |
Manuel Pégourié-Gonnard | 448ea50 | 2015-01-12 11:40:14 +0100 | [diff] [blame] | 2077 | "$P_CLI debug_level=3 crt_file=none key_file=none min_version=ssl3" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 2078 | 0 \ |
| 2079 | -S "skip write certificate request" \ |
| 2080 | -C "skip parse certificate request" \ |
| 2081 | -c "got a certificate request" \ |
| 2082 | -C "skip write certificate$" \ |
| 2083 | -c "skip write certificate verify" \ |
| 2084 | -c "got no certificate to send" \ |
| 2085 | -s "SSLv3 client has no certificate" \ |
| 2086 | -s "skip parse certificate verify" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 2087 | -s "! Certificate was missing" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2088 | -S "! mbedtls_ssl_handshake returned" \ |
| 2089 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 2090 | -S "X509 - Certificate verification failed" |
| 2091 | |
Manuel Pégourié-Gonnard | 591035d | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 2092 | run_test "Authentication: server max_int chain, client default" \ |
| 2093 | "$P_SRV crt_file=data_files/dir-maxpath/c09.pem \ |
| 2094 | key_file=data_files/dir-maxpath/09.key" \ |
| 2095 | "$P_CLI server_name=CA09 ca_file=data_files/dir-maxpath/00.crt" \ |
| 2096 | 0 \ |
| 2097 | -C "X509 - A fatal error occured" |
| 2098 | |
| 2099 | run_test "Authentication: server max_int+1 chain, client default" \ |
| 2100 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 2101 | key_file=data_files/dir-maxpath/10.key" \ |
| 2102 | "$P_CLI server_name=CA10 ca_file=data_files/dir-maxpath/00.crt" \ |
| 2103 | 1 \ |
| 2104 | -c "X509 - A fatal error occured" |
| 2105 | |
| 2106 | run_test "Authentication: server max_int+1 chain, client optional" \ |
| 2107 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 2108 | key_file=data_files/dir-maxpath/10.key" \ |
| 2109 | "$P_CLI server_name=CA10 ca_file=data_files/dir-maxpath/00.crt \ |
| 2110 | auth_mode=optional" \ |
| 2111 | 1 \ |
| 2112 | -c "X509 - A fatal error occured" |
| 2113 | |
| 2114 | run_test "Authentication: server max_int+1 chain, client none" \ |
| 2115 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 2116 | key_file=data_files/dir-maxpath/10.key" \ |
| 2117 | "$P_CLI server_name=CA10 ca_file=data_files/dir-maxpath/00.crt \ |
| 2118 | auth_mode=none" \ |
| 2119 | 0 \ |
| 2120 | -C "X509 - A fatal error occured" |
| 2121 | |
| 2122 | run_test "Authentication: client max_int+1 chain, server default" \ |
| 2123 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt" \ |
| 2124 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 2125 | key_file=data_files/dir-maxpath/10.key" \ |
| 2126 | 0 \ |
| 2127 | -S "X509 - A fatal error occured" |
| 2128 | |
| 2129 | run_test "Authentication: client max_int+1 chain, server optional" \ |
| 2130 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=optional" \ |
| 2131 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 2132 | key_file=data_files/dir-maxpath/10.key" \ |
| 2133 | 1 \ |
| 2134 | -s "X509 - A fatal error occured" |
| 2135 | |
| 2136 | run_test "Authentication: client max_int+1 chain, server required" \ |
| 2137 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \ |
| 2138 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 2139 | key_file=data_files/dir-maxpath/10.key" \ |
| 2140 | 1 \ |
| 2141 | -s "X509 - A fatal error occured" |
| 2142 | |
| 2143 | run_test "Authentication: client max_int chain, server required" \ |
| 2144 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \ |
| 2145 | "$P_CLI crt_file=data_files/dir-maxpath/c09.pem \ |
| 2146 | key_file=data_files/dir-maxpath/09.key" \ |
| 2147 | 0 \ |
| 2148 | -S "X509 - A fatal error occured" |
| 2149 | |
Manuel Pégourié-Gonnard | df331a5 | 2015-01-08 16:43:07 +0100 | [diff] [blame] | 2150 | # Tests for certificate selection based on SHA verson |
| 2151 | |
| 2152 | run_test "Certificate hash: client TLS 1.2 -> SHA-2" \ |
| 2153 | "$P_SRV crt_file=data_files/server5.crt \ |
| 2154 | key_file=data_files/server5.key \ |
| 2155 | crt_file2=data_files/server5-sha1.crt \ |
| 2156 | key_file2=data_files/server5.key" \ |
| 2157 | "$P_CLI force_version=tls1_2" \ |
| 2158 | 0 \ |
| 2159 | -c "signed using.*ECDSA with SHA256" \ |
| 2160 | -C "signed using.*ECDSA with SHA1" |
| 2161 | |
| 2162 | run_test "Certificate hash: client TLS 1.1 -> SHA-1" \ |
| 2163 | "$P_SRV crt_file=data_files/server5.crt \ |
| 2164 | key_file=data_files/server5.key \ |
| 2165 | crt_file2=data_files/server5-sha1.crt \ |
| 2166 | key_file2=data_files/server5.key" \ |
| 2167 | "$P_CLI force_version=tls1_1" \ |
| 2168 | 0 \ |
| 2169 | -C "signed using.*ECDSA with SHA256" \ |
| 2170 | -c "signed using.*ECDSA with SHA1" |
| 2171 | |
| 2172 | run_test "Certificate hash: client TLS 1.0 -> SHA-1" \ |
| 2173 | "$P_SRV crt_file=data_files/server5.crt \ |
| 2174 | key_file=data_files/server5.key \ |
| 2175 | crt_file2=data_files/server5-sha1.crt \ |
| 2176 | key_file2=data_files/server5.key" \ |
| 2177 | "$P_CLI force_version=tls1" \ |
| 2178 | 0 \ |
| 2179 | -C "signed using.*ECDSA with SHA256" \ |
| 2180 | -c "signed using.*ECDSA with SHA1" |
| 2181 | |
| 2182 | run_test "Certificate hash: client TLS 1.1, no SHA-1 -> SHA-2 (order 1)" \ |
| 2183 | "$P_SRV crt_file=data_files/server5.crt \ |
| 2184 | key_file=data_files/server5.key \ |
| 2185 | crt_file2=data_files/server6.crt \ |
| 2186 | key_file2=data_files/server6.key" \ |
| 2187 | "$P_CLI force_version=tls1_1" \ |
| 2188 | 0 \ |
| 2189 | -c "serial number.*09" \ |
| 2190 | -c "signed using.*ECDSA with SHA256" \ |
| 2191 | -C "signed using.*ECDSA with SHA1" |
| 2192 | |
| 2193 | run_test "Certificate hash: client TLS 1.1, no SHA-1 -> SHA-2 (order 2)" \ |
| 2194 | "$P_SRV crt_file=data_files/server6.crt \ |
| 2195 | key_file=data_files/server6.key \ |
| 2196 | crt_file2=data_files/server5.crt \ |
| 2197 | key_file2=data_files/server5.key" \ |
| 2198 | "$P_CLI force_version=tls1_1" \ |
| 2199 | 0 \ |
| 2200 | -c "serial number.*0A" \ |
| 2201 | -c "signed using.*ECDSA with SHA256" \ |
| 2202 | -C "signed using.*ECDSA with SHA1" |
| 2203 | |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 2204 | # tests for SNI |
| 2205 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2206 | run_test "SNI: no SNI callback" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 2207 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 2208 | crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 2209 | "$P_CLI server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 2210 | 0 \ |
| 2211 | -S "parse ServerName extension" \ |
| 2212 | -c "issuer name *: C=NL, O=PolarSSL, CN=Polarssl Test EC CA" \ |
| 2213 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 2214 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2215 | run_test "SNI: matching cert 1" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 2216 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 2217 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 2218 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 2219 | "$P_CLI server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 2220 | 0 \ |
| 2221 | -s "parse ServerName extension" \ |
| 2222 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 2223 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 2224 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2225 | run_test "SNI: matching cert 2" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 2226 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 2227 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 2228 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 2229 | "$P_CLI server_name=polarssl.example" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 2230 | 0 \ |
| 2231 | -s "parse ServerName extension" \ |
| 2232 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 2233 | -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 2234 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2235 | run_test "SNI: no matching cert" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 2236 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 2237 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 2238 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 2239 | "$P_CLI server_name=nonesuch.example" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 2240 | 1 \ |
| 2241 | -s "parse ServerName extension" \ |
| 2242 | -s "ssl_sni_wrapper() returned" \ |
| 2243 | -s "mbedtls_ssl_handshake returned" \ |
| 2244 | -c "mbedtls_ssl_handshake returned" \ |
| 2245 | -c "SSL - A fatal alert message was received from our peer" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 2246 | |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 2247 | run_test "SNI: client auth no override: optional" \ |
| 2248 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 2249 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 2250 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-" \ |
| 2251 | "$P_CLI debug_level=3 server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 2252 | 0 \ |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 2253 | -S "skip write certificate request" \ |
| 2254 | -C "skip parse certificate request" \ |
| 2255 | -c "got a certificate request" \ |
| 2256 | -C "skip write certificate" \ |
| 2257 | -C "skip write certificate verify" \ |
| 2258 | -S "skip parse certificate verify" |
| 2259 | |
| 2260 | run_test "SNI: client auth override: none -> optional" \ |
| 2261 | "$P_SRV debug_level=3 auth_mode=none \ |
| 2262 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 2263 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,optional" \ |
| 2264 | "$P_CLI debug_level=3 server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 2265 | 0 \ |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 2266 | -S "skip write certificate request" \ |
| 2267 | -C "skip parse certificate request" \ |
| 2268 | -c "got a certificate request" \ |
| 2269 | -C "skip write certificate" \ |
| 2270 | -C "skip write certificate verify" \ |
| 2271 | -S "skip parse certificate verify" |
| 2272 | |
| 2273 | run_test "SNI: client auth override: optional -> none" \ |
| 2274 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 2275 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 2276 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,none" \ |
| 2277 | "$P_CLI debug_level=3 server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 2278 | 0 \ |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 2279 | -s "skip write certificate request" \ |
| 2280 | -C "skip parse certificate request" \ |
| 2281 | -c "got no certificate request" \ |
| 2282 | -c "skip write certificate" \ |
| 2283 | -c "skip write certificate verify" \ |
| 2284 | -s "skip parse certificate verify" |
| 2285 | |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 2286 | run_test "SNI: CA no override" \ |
| 2287 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 2288 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 2289 | ca_file=data_files/test-ca.crt \ |
| 2290 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,required" \ |
| 2291 | "$P_CLI debug_level=3 server_name=localhost \ |
| 2292 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 2293 | 1 \ |
| 2294 | -S "skip write certificate request" \ |
| 2295 | -C "skip parse certificate request" \ |
| 2296 | -c "got a certificate request" \ |
| 2297 | -C "skip write certificate" \ |
| 2298 | -C "skip write certificate verify" \ |
| 2299 | -S "skip parse certificate verify" \ |
| 2300 | -s "x509_verify_cert() returned" \ |
| 2301 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 2302 | -S "The certificate has been revoked (is on a CRL)" |
| 2303 | |
| 2304 | run_test "SNI: CA override" \ |
| 2305 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 2306 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 2307 | ca_file=data_files/test-ca.crt \ |
| 2308 | sni=localhost,data_files/server2.crt,data_files/server2.key,data_files/test-ca2.crt,-,required" \ |
| 2309 | "$P_CLI debug_level=3 server_name=localhost \ |
| 2310 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 2311 | 0 \ |
| 2312 | -S "skip write certificate request" \ |
| 2313 | -C "skip parse certificate request" \ |
| 2314 | -c "got a certificate request" \ |
| 2315 | -C "skip write certificate" \ |
| 2316 | -C "skip write certificate verify" \ |
| 2317 | -S "skip parse certificate verify" \ |
| 2318 | -S "x509_verify_cert() returned" \ |
| 2319 | -S "! The certificate is not correctly signed by the trusted CA" \ |
| 2320 | -S "The certificate has been revoked (is on a CRL)" |
| 2321 | |
| 2322 | run_test "SNI: CA override with CRL" \ |
| 2323 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 2324 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 2325 | ca_file=data_files/test-ca.crt \ |
| 2326 | sni=localhost,data_files/server2.crt,data_files/server2.key,data_files/test-ca2.crt,data_files/crl-ec-sha256.pem,required" \ |
| 2327 | "$P_CLI debug_level=3 server_name=localhost \ |
| 2328 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 2329 | 1 \ |
| 2330 | -S "skip write certificate request" \ |
| 2331 | -C "skip parse certificate request" \ |
| 2332 | -c "got a certificate request" \ |
| 2333 | -C "skip write certificate" \ |
| 2334 | -C "skip write certificate verify" \ |
| 2335 | -S "skip parse certificate verify" \ |
| 2336 | -s "x509_verify_cert() returned" \ |
| 2337 | -S "! The certificate is not correctly signed by the trusted CA" \ |
| 2338 | -s "The certificate has been revoked (is on a CRL)" |
| 2339 | |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2340 | # Tests for non-blocking I/O: exercise a variety of handshake flows |
| 2341 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2342 | run_test "Non-blocking I/O: basic handshake" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2343 | "$P_SRV nbio=2 tickets=0 auth_mode=none" \ |
| 2344 | "$P_CLI nbio=2 tickets=0" \ |
| 2345 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2346 | -S "mbedtls_ssl_handshake returned" \ |
| 2347 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2348 | -c "Read from server: .* bytes read" |
| 2349 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2350 | run_test "Non-blocking I/O: client auth" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2351 | "$P_SRV nbio=2 tickets=0 auth_mode=required" \ |
| 2352 | "$P_CLI nbio=2 tickets=0" \ |
| 2353 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2354 | -S "mbedtls_ssl_handshake returned" \ |
| 2355 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2356 | -c "Read from server: .* bytes read" |
| 2357 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2358 | run_test "Non-blocking I/O: ticket" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2359 | "$P_SRV nbio=2 tickets=1 auth_mode=none" \ |
| 2360 | "$P_CLI nbio=2 tickets=1" \ |
| 2361 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2362 | -S "mbedtls_ssl_handshake returned" \ |
| 2363 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2364 | -c "Read from server: .* bytes read" |
| 2365 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2366 | run_test "Non-blocking I/O: ticket + client auth" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2367 | "$P_SRV nbio=2 tickets=1 auth_mode=required" \ |
| 2368 | "$P_CLI nbio=2 tickets=1" \ |
| 2369 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2370 | -S "mbedtls_ssl_handshake returned" \ |
| 2371 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2372 | -c "Read from server: .* bytes read" |
| 2373 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2374 | run_test "Non-blocking I/O: ticket + client auth + resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2375 | "$P_SRV nbio=2 tickets=1 auth_mode=required" \ |
| 2376 | "$P_CLI nbio=2 tickets=1 reconnect=1" \ |
| 2377 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2378 | -S "mbedtls_ssl_handshake returned" \ |
| 2379 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2380 | -c "Read from server: .* bytes read" |
| 2381 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2382 | run_test "Non-blocking I/O: ticket + resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2383 | "$P_SRV nbio=2 tickets=1 auth_mode=none" \ |
| 2384 | "$P_CLI nbio=2 tickets=1 reconnect=1" \ |
| 2385 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2386 | -S "mbedtls_ssl_handshake returned" \ |
| 2387 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2388 | -c "Read from server: .* bytes read" |
| 2389 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2390 | run_test "Non-blocking I/O: session-id resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2391 | "$P_SRV nbio=2 tickets=0 auth_mode=none" \ |
| 2392 | "$P_CLI nbio=2 tickets=0 reconnect=1" \ |
| 2393 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2394 | -S "mbedtls_ssl_handshake returned" \ |
| 2395 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 2396 | -c "Read from server: .* bytes read" |
| 2397 | |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 2398 | # Tests for version negotiation |
| 2399 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2400 | run_test "Version check: all -> 1.2" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2401 | "$P_SRV" \ |
| 2402 | "$P_CLI" \ |
| 2403 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2404 | -S "mbedtls_ssl_handshake returned" \ |
| 2405 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2406 | -s "Protocol is TLSv1.2" \ |
| 2407 | -c "Protocol is TLSv1.2" |
| 2408 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2409 | run_test "Version check: cli max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2410 | "$P_SRV" \ |
| 2411 | "$P_CLI max_version=tls1_1" \ |
| 2412 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2413 | -S "mbedtls_ssl_handshake returned" \ |
| 2414 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2415 | -s "Protocol is TLSv1.1" \ |
| 2416 | -c "Protocol is TLSv1.1" |
| 2417 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2418 | run_test "Version check: srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2419 | "$P_SRV max_version=tls1_1" \ |
| 2420 | "$P_CLI" \ |
| 2421 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2422 | -S "mbedtls_ssl_handshake returned" \ |
| 2423 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2424 | -s "Protocol is TLSv1.1" \ |
| 2425 | -c "Protocol is TLSv1.1" |
| 2426 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2427 | run_test "Version check: cli+srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2428 | "$P_SRV max_version=tls1_1" \ |
| 2429 | "$P_CLI max_version=tls1_1" \ |
| 2430 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2431 | -S "mbedtls_ssl_handshake returned" \ |
| 2432 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2433 | -s "Protocol is TLSv1.1" \ |
| 2434 | -c "Protocol is TLSv1.1" |
| 2435 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2436 | run_test "Version check: cli max 1.1, srv min 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2437 | "$P_SRV min_version=tls1_1" \ |
| 2438 | "$P_CLI max_version=tls1_1" \ |
| 2439 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2440 | -S "mbedtls_ssl_handshake returned" \ |
| 2441 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2442 | -s "Protocol is TLSv1.1" \ |
| 2443 | -c "Protocol is TLSv1.1" |
| 2444 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2445 | run_test "Version check: cli min 1.1, srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2446 | "$P_SRV max_version=tls1_1" \ |
| 2447 | "$P_CLI min_version=tls1_1" \ |
| 2448 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2449 | -S "mbedtls_ssl_handshake returned" \ |
| 2450 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2451 | -s "Protocol is TLSv1.1" \ |
| 2452 | -c "Protocol is TLSv1.1" |
| 2453 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2454 | run_test "Version check: cli min 1.2, srv max 1.1 -> fail" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2455 | "$P_SRV max_version=tls1_1" \ |
| 2456 | "$P_CLI min_version=tls1_2" \ |
| 2457 | 1 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2458 | -s "mbedtls_ssl_handshake returned" \ |
| 2459 | -c "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2460 | -c "SSL - Handshake protocol not within min/max boundaries" |
| 2461 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2462 | run_test "Version check: srv min 1.2, cli max 1.1 -> fail" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2463 | "$P_SRV min_version=tls1_2" \ |
| 2464 | "$P_CLI max_version=tls1_1" \ |
| 2465 | 1 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2466 | -s "mbedtls_ssl_handshake returned" \ |
| 2467 | -c "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 2468 | -s "SSL - Handshake protocol not within min/max boundaries" |
| 2469 | |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 2470 | # Tests for ALPN extension |
| 2471 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2472 | run_test "ALPN: none" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2473 | "$P_SRV debug_level=3" \ |
| 2474 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 2475 | 0 \ |
| 2476 | -C "client hello, adding alpn extension" \ |
| 2477 | -S "found alpn extension" \ |
| 2478 | -C "got an alert message, type: \\[2:120]" \ |
| 2479 | -S "server hello, adding alpn extension" \ |
| 2480 | -C "found alpn extension " \ |
| 2481 | -C "Application Layer Protocol is" \ |
| 2482 | -S "Application Layer Protocol is" |
| 2483 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2484 | run_test "ALPN: client only" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2485 | "$P_SRV debug_level=3" \ |
| 2486 | "$P_CLI debug_level=3 alpn=abc,1234" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 2487 | 0 \ |
| 2488 | -c "client hello, adding alpn extension" \ |
| 2489 | -s "found alpn extension" \ |
| 2490 | -C "got an alert message, type: \\[2:120]" \ |
| 2491 | -S "server hello, adding alpn extension" \ |
| 2492 | -C "found alpn extension " \ |
| 2493 | -c "Application Layer Protocol is (none)" \ |
| 2494 | -S "Application Layer Protocol is" |
| 2495 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2496 | run_test "ALPN: server only" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2497 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 2498 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 2499 | 0 \ |
| 2500 | -C "client hello, adding alpn extension" \ |
| 2501 | -S "found alpn extension" \ |
| 2502 | -C "got an alert message, type: \\[2:120]" \ |
| 2503 | -S "server hello, adding alpn extension" \ |
| 2504 | -C "found alpn extension " \ |
| 2505 | -C "Application Layer Protocol is" \ |
| 2506 | -s "Application Layer Protocol is (none)" |
| 2507 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2508 | run_test "ALPN: both, common cli1-srv1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2509 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 2510 | "$P_CLI debug_level=3 alpn=abc,1234" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 2511 | 0 \ |
| 2512 | -c "client hello, adding alpn extension" \ |
| 2513 | -s "found alpn extension" \ |
| 2514 | -C "got an alert message, type: \\[2:120]" \ |
| 2515 | -s "server hello, adding alpn extension" \ |
| 2516 | -c "found alpn extension" \ |
| 2517 | -c "Application Layer Protocol is abc" \ |
| 2518 | -s "Application Layer Protocol is abc" |
| 2519 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2520 | run_test "ALPN: both, common cli2-srv1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2521 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 2522 | "$P_CLI debug_level=3 alpn=1234,abc" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 2523 | 0 \ |
| 2524 | -c "client hello, adding alpn extension" \ |
| 2525 | -s "found alpn extension" \ |
| 2526 | -C "got an alert message, type: \\[2:120]" \ |
| 2527 | -s "server hello, adding alpn extension" \ |
| 2528 | -c "found alpn extension" \ |
| 2529 | -c "Application Layer Protocol is abc" \ |
| 2530 | -s "Application Layer Protocol is abc" |
| 2531 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2532 | run_test "ALPN: both, common cli1-srv2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2533 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 2534 | "$P_CLI debug_level=3 alpn=1234,abcde" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 2535 | 0 \ |
| 2536 | -c "client hello, adding alpn extension" \ |
| 2537 | -s "found alpn extension" \ |
| 2538 | -C "got an alert message, type: \\[2:120]" \ |
| 2539 | -s "server hello, adding alpn extension" \ |
| 2540 | -c "found alpn extension" \ |
| 2541 | -c "Application Layer Protocol is 1234" \ |
| 2542 | -s "Application Layer Protocol is 1234" |
| 2543 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2544 | run_test "ALPN: both, no common" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2545 | "$P_SRV debug_level=3 alpn=abc,123" \ |
| 2546 | "$P_CLI debug_level=3 alpn=1234,abcde" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 2547 | 1 \ |
| 2548 | -c "client hello, adding alpn extension" \ |
| 2549 | -s "found alpn extension" \ |
| 2550 | -c "got an alert message, type: \\[2:120]" \ |
| 2551 | -S "server hello, adding alpn extension" \ |
| 2552 | -C "found alpn extension" \ |
| 2553 | -C "Application Layer Protocol is 1234" \ |
| 2554 | -S "Application Layer Protocol is 1234" |
| 2555 | |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 2556 | |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2557 | # Tests for keyUsage in leaf certificates, part 1: |
| 2558 | # server-side certificate/suite selection |
| 2559 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2560 | run_test "keyUsage srv: RSA, digitalSignature -> (EC)DHE-RSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2561 | "$P_SRV key_file=data_files/server2.key \ |
| 2562 | crt_file=data_files/server2.ku-ds.crt" \ |
| 2563 | "$P_CLI" \ |
| 2564 | 0 \ |
Manuel Pégourié-Gonnard | 17cde5f | 2014-05-22 14:42:39 +0200 | [diff] [blame] | 2565 | -c "Ciphersuite is TLS-[EC]*DHE-RSA-WITH-" |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2566 | |
| 2567 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2568 | run_test "keyUsage srv: RSA, keyEncipherment -> RSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2569 | "$P_SRV key_file=data_files/server2.key \ |
| 2570 | crt_file=data_files/server2.ku-ke.crt" \ |
| 2571 | "$P_CLI" \ |
| 2572 | 0 \ |
| 2573 | -c "Ciphersuite is TLS-RSA-WITH-" |
| 2574 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2575 | run_test "keyUsage srv: RSA, keyAgreement -> fail" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 2576 | "$P_SRV key_file=data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2577 | crt_file=data_files/server2.ku-ka.crt" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 2578 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2579 | 1 \ |
| 2580 | -C "Ciphersuite is " |
| 2581 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2582 | run_test "keyUsage srv: ECDSA, digitalSignature -> ECDHE-ECDSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2583 | "$P_SRV key_file=data_files/server5.key \ |
| 2584 | crt_file=data_files/server5.ku-ds.crt" \ |
| 2585 | "$P_CLI" \ |
| 2586 | 0 \ |
| 2587 | -c "Ciphersuite is TLS-ECDHE-ECDSA-WITH-" |
| 2588 | |
| 2589 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2590 | run_test "keyUsage srv: ECDSA, keyAgreement -> ECDH-" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2591 | "$P_SRV key_file=data_files/server5.key \ |
| 2592 | crt_file=data_files/server5.ku-ka.crt" \ |
| 2593 | "$P_CLI" \ |
| 2594 | 0 \ |
| 2595 | -c "Ciphersuite is TLS-ECDH-" |
| 2596 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2597 | run_test "keyUsage srv: ECDSA, keyEncipherment -> fail" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 2598 | "$P_SRV key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2599 | crt_file=data_files/server5.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 2600 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2601 | 1 \ |
| 2602 | -C "Ciphersuite is " |
| 2603 | |
| 2604 | # Tests for keyUsage in leaf certificates, part 2: |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2605 | # client-side checking of server cert |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2606 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2607 | run_test "keyUsage cli: DigitalSignature+KeyEncipherment, RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2608 | "$O_SRV -key data_files/server2.key \ |
| 2609 | -cert data_files/server2.ku-ds_ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2610 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2611 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 2612 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2613 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2614 | -C "Processing of the Certificate handshake message failed" \ |
| 2615 | -c "Ciphersuite is TLS-" |
| 2616 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2617 | run_test "keyUsage cli: DigitalSignature+KeyEncipherment, DHE-RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2618 | "$O_SRV -key data_files/server2.key \ |
| 2619 | -cert data_files/server2.ku-ds_ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2620 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2621 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 2622 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2623 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2624 | -C "Processing of the Certificate handshake message failed" \ |
| 2625 | -c "Ciphersuite is TLS-" |
| 2626 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2627 | run_test "keyUsage cli: KeyEncipherment, RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2628 | "$O_SRV -key data_files/server2.key \ |
| 2629 | -cert data_files/server2.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2630 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2631 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 2632 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2633 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2634 | -C "Processing of the Certificate handshake message failed" \ |
| 2635 | -c "Ciphersuite is TLS-" |
| 2636 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2637 | run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2638 | "$O_SRV -key data_files/server2.key \ |
| 2639 | -cert data_files/server2.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2640 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2641 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 2642 | 1 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2643 | -c "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2644 | -c "Processing of the Certificate handshake message failed" \ |
| 2645 | -C "Ciphersuite is TLS-" |
| 2646 | |
Manuel Pégourié-Gonnard | e6efa6f | 2015-04-20 11:01:48 +0100 | [diff] [blame] | 2647 | run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail, soft" \ |
| 2648 | "$O_SRV -key data_files/server2.key \ |
| 2649 | -cert data_files/server2.ku-ke.crt" \ |
| 2650 | "$P_CLI debug_level=1 auth_mode=optional \ |
| 2651 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 2652 | 0 \ |
| 2653 | -c "bad certificate (usage extensions)" \ |
| 2654 | -C "Processing of the Certificate handshake message failed" \ |
| 2655 | -c "Ciphersuite is TLS-" \ |
| 2656 | -c "! Usage does not match the keyUsage extension" |
| 2657 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2658 | run_test "keyUsage cli: DigitalSignature, DHE-RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2659 | "$O_SRV -key data_files/server2.key \ |
| 2660 | -cert data_files/server2.ku-ds.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2661 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2662 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 2663 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2664 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2665 | -C "Processing of the Certificate handshake message failed" \ |
| 2666 | -c "Ciphersuite is TLS-" |
| 2667 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2668 | run_test "keyUsage cli: DigitalSignature, RSA: fail" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2669 | "$O_SRV -key data_files/server2.key \ |
| 2670 | -cert data_files/server2.ku-ds.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2671 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2672 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 2673 | 1 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2674 | -c "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2675 | -c "Processing of the Certificate handshake message failed" \ |
| 2676 | -C "Ciphersuite is TLS-" |
| 2677 | |
Manuel Pégourié-Gonnard | e6efa6f | 2015-04-20 11:01:48 +0100 | [diff] [blame] | 2678 | run_test "keyUsage cli: DigitalSignature, RSA: fail, soft" \ |
| 2679 | "$O_SRV -key data_files/server2.key \ |
| 2680 | -cert data_files/server2.ku-ds.crt" \ |
| 2681 | "$P_CLI debug_level=1 auth_mode=optional \ |
| 2682 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 2683 | 0 \ |
| 2684 | -c "bad certificate (usage extensions)" \ |
| 2685 | -C "Processing of the Certificate handshake message failed" \ |
| 2686 | -c "Ciphersuite is TLS-" \ |
| 2687 | -c "! Usage does not match the keyUsage extension" |
| 2688 | |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2689 | # Tests for keyUsage in leaf certificates, part 3: |
| 2690 | # server-side checking of client cert |
| 2691 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2692 | run_test "keyUsage cli-auth: RSA, DigitalSignature: OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2693 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2694 | "$O_CLI -key data_files/server2.key \ |
| 2695 | -cert data_files/server2.ku-ds.crt" \ |
| 2696 | 0 \ |
| 2697 | -S "bad certificate (usage extensions)" \ |
| 2698 | -S "Processing of the Certificate handshake message failed" |
| 2699 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2700 | run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2701 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2702 | "$O_CLI -key data_files/server2.key \ |
| 2703 | -cert data_files/server2.ku-ke.crt" \ |
| 2704 | 0 \ |
| 2705 | -s "bad certificate (usage extensions)" \ |
| 2706 | -S "Processing of the Certificate handshake message failed" |
| 2707 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2708 | run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (hard)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2709 | "$P_SRV debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2710 | "$O_CLI -key data_files/server2.key \ |
| 2711 | -cert data_files/server2.ku-ke.crt" \ |
| 2712 | 1 \ |
| 2713 | -s "bad certificate (usage extensions)" \ |
| 2714 | -s "Processing of the Certificate handshake message failed" |
| 2715 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2716 | run_test "keyUsage cli-auth: ECDSA, DigitalSignature: OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2717 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2718 | "$O_CLI -key data_files/server5.key \ |
| 2719 | -cert data_files/server5.ku-ds.crt" \ |
| 2720 | 0 \ |
| 2721 | -S "bad certificate (usage extensions)" \ |
| 2722 | -S "Processing of the Certificate handshake message failed" |
| 2723 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2724 | run_test "keyUsage cli-auth: ECDSA, KeyAgreement: fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2725 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2726 | "$O_CLI -key data_files/server5.key \ |
| 2727 | -cert data_files/server5.ku-ka.crt" \ |
| 2728 | 0 \ |
| 2729 | -s "bad certificate (usage extensions)" \ |
| 2730 | -S "Processing of the Certificate handshake message failed" |
| 2731 | |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2732 | # Tests for extendedKeyUsage, part 1: server-side certificate/suite selection |
| 2733 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2734 | run_test "extKeyUsage srv: serverAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2735 | "$P_SRV key_file=data_files/server5.key \ |
| 2736 | crt_file=data_files/server5.eku-srv.crt" \ |
| 2737 | "$P_CLI" \ |
| 2738 | 0 |
| 2739 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2740 | run_test "extKeyUsage srv: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2741 | "$P_SRV key_file=data_files/server5.key \ |
| 2742 | crt_file=data_files/server5.eku-srv.crt" \ |
| 2743 | "$P_CLI" \ |
| 2744 | 0 |
| 2745 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2746 | run_test "extKeyUsage srv: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2747 | "$P_SRV key_file=data_files/server5.key \ |
| 2748 | crt_file=data_files/server5.eku-cs_any.crt" \ |
| 2749 | "$P_CLI" \ |
| 2750 | 0 |
| 2751 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2752 | run_test "extKeyUsage srv: codeSign -> fail" \ |
Manuel Pégourié-Gonnard | 7eb58cb | 2015-07-07 11:54:14 +0200 | [diff] [blame] | 2753 | "$P_SRV key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2754 | crt_file=data_files/server5.eku-cli.crt" \ |
Manuel Pégourié-Gonnard | 7eb58cb | 2015-07-07 11:54:14 +0200 | [diff] [blame] | 2755 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2756 | 1 |
| 2757 | |
| 2758 | # Tests for extendedKeyUsage, part 2: client-side checking of server cert |
| 2759 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2760 | run_test "extKeyUsage cli: serverAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2761 | "$O_SRV -key data_files/server5.key \ |
| 2762 | -cert data_files/server5.eku-srv.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2763 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2764 | 0 \ |
| 2765 | -C "bad certificate (usage extensions)" \ |
| 2766 | -C "Processing of the Certificate handshake message failed" \ |
| 2767 | -c "Ciphersuite is TLS-" |
| 2768 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2769 | run_test "extKeyUsage cli: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2770 | "$O_SRV -key data_files/server5.key \ |
| 2771 | -cert data_files/server5.eku-srv_cli.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2772 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2773 | 0 \ |
| 2774 | -C "bad certificate (usage extensions)" \ |
| 2775 | -C "Processing of the Certificate handshake message failed" \ |
| 2776 | -c "Ciphersuite is TLS-" |
| 2777 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2778 | run_test "extKeyUsage cli: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2779 | "$O_SRV -key data_files/server5.key \ |
| 2780 | -cert data_files/server5.eku-cs_any.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2781 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2782 | 0 \ |
| 2783 | -C "bad certificate (usage extensions)" \ |
| 2784 | -C "Processing of the Certificate handshake message failed" \ |
| 2785 | -c "Ciphersuite is TLS-" |
| 2786 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2787 | run_test "extKeyUsage cli: codeSign -> fail" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2788 | "$O_SRV -key data_files/server5.key \ |
| 2789 | -cert data_files/server5.eku-cs.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2790 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2791 | 1 \ |
| 2792 | -c "bad certificate (usage extensions)" \ |
| 2793 | -c "Processing of the Certificate handshake message failed" \ |
| 2794 | -C "Ciphersuite is TLS-" |
| 2795 | |
| 2796 | # Tests for extendedKeyUsage, part 3: server-side checking of client cert |
| 2797 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2798 | run_test "extKeyUsage cli-auth: clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2799 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2800 | "$O_CLI -key data_files/server5.key \ |
| 2801 | -cert data_files/server5.eku-cli.crt" \ |
| 2802 | 0 \ |
| 2803 | -S "bad certificate (usage extensions)" \ |
| 2804 | -S "Processing of the Certificate handshake message failed" |
| 2805 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2806 | run_test "extKeyUsage cli-auth: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2807 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2808 | "$O_CLI -key data_files/server5.key \ |
| 2809 | -cert data_files/server5.eku-srv_cli.crt" \ |
| 2810 | 0 \ |
| 2811 | -S "bad certificate (usage extensions)" \ |
| 2812 | -S "Processing of the Certificate handshake message failed" |
| 2813 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2814 | run_test "extKeyUsage cli-auth: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2815 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2816 | "$O_CLI -key data_files/server5.key \ |
| 2817 | -cert data_files/server5.eku-cs_any.crt" \ |
| 2818 | 0 \ |
| 2819 | -S "bad certificate (usage extensions)" \ |
| 2820 | -S "Processing of the Certificate handshake message failed" |
| 2821 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2822 | run_test "extKeyUsage cli-auth: codeSign -> fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2823 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2824 | "$O_CLI -key data_files/server5.key \ |
| 2825 | -cert data_files/server5.eku-cs.crt" \ |
| 2826 | 0 \ |
| 2827 | -s "bad certificate (usage extensions)" \ |
| 2828 | -S "Processing of the Certificate handshake message failed" |
| 2829 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2830 | run_test "extKeyUsage cli-auth: codeSign -> fail (hard)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2831 | "$P_SRV debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2832 | "$O_CLI -key data_files/server5.key \ |
| 2833 | -cert data_files/server5.eku-cs.crt" \ |
| 2834 | 1 \ |
| 2835 | -s "bad certificate (usage extensions)" \ |
| 2836 | -s "Processing of the Certificate handshake message failed" |
| 2837 | |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 2838 | # Tests for DHM parameters loading |
| 2839 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2840 | run_test "DHM parameters: reference" \ |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 2841 | "$P_SRV" \ |
| 2842 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 2843 | debug_level=3" \ |
| 2844 | 0 \ |
| 2845 | -c "value of 'DHM: P ' (2048 bits)" \ |
| 2846 | -c "value of 'DHM: G ' (2048 bits)" |
| 2847 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2848 | run_test "DHM parameters: other parameters" \ |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 2849 | "$P_SRV dhm_file=data_files/dhparams.pem" \ |
| 2850 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 2851 | debug_level=3" \ |
| 2852 | 0 \ |
| 2853 | -c "value of 'DHM: P ' (1024 bits)" \ |
| 2854 | -c "value of 'DHM: G ' (2 bits)" |
| 2855 | |
Manuel Pégourié-Gonnard | 7a010aa | 2015-06-12 11:19:10 +0200 | [diff] [blame] | 2856 | # Tests for DHM client-side size checking |
| 2857 | |
| 2858 | run_test "DHM size: server default, client default, OK" \ |
| 2859 | "$P_SRV" \ |
| 2860 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 2861 | debug_level=1" \ |
| 2862 | 0 \ |
| 2863 | -C "DHM prime too short:" |
| 2864 | |
| 2865 | run_test "DHM size: server default, client 2048, OK" \ |
| 2866 | "$P_SRV" \ |
| 2867 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 2868 | debug_level=1 dhmlen=2048" \ |
| 2869 | 0 \ |
| 2870 | -C "DHM prime too short:" |
| 2871 | |
| 2872 | run_test "DHM size: server 1024, client default, OK" \ |
| 2873 | "$P_SRV dhm_file=data_files/dhparams.pem" \ |
| 2874 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 2875 | debug_level=1" \ |
| 2876 | 0 \ |
| 2877 | -C "DHM prime too short:" |
| 2878 | |
| 2879 | run_test "DHM size: server 1000, client default, rejected" \ |
| 2880 | "$P_SRV dhm_file=data_files/dh.1000.pem" \ |
| 2881 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 2882 | debug_level=1" \ |
| 2883 | 1 \ |
| 2884 | -c "DHM prime too short:" |
| 2885 | |
| 2886 | run_test "DHM size: server default, client 2049, rejected" \ |
| 2887 | "$P_SRV" \ |
| 2888 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 2889 | debug_level=1 dhmlen=2049" \ |
| 2890 | 1 \ |
| 2891 | -c "DHM prime too short:" |
| 2892 | |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2893 | # Tests for PSK callback |
| 2894 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2895 | run_test "PSK callback: psk, no callback" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2896 | "$P_SRV psk=abc123 psk_identity=foo" \ |
| 2897 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2898 | psk_identity=foo psk=abc123" \ |
| 2899 | 0 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2900 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 2901 | -S "SSL - Unknown identity received" \ |
| 2902 | -S "SSL - Verification of the message MAC failed" |
| 2903 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2904 | run_test "PSK callback: no psk, no callback" \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 2905 | "$P_SRV" \ |
| 2906 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2907 | psk_identity=foo psk=abc123" \ |
| 2908 | 1 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2909 | -s "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2910 | -S "SSL - Unknown identity received" \ |
| 2911 | -S "SSL - Verification of the message MAC failed" |
| 2912 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2913 | run_test "PSK callback: callback overrides other settings" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2914 | "$P_SRV psk=abc123 psk_identity=foo psk_list=abc,dead,def,beef" \ |
| 2915 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2916 | psk_identity=foo psk=abc123" \ |
| 2917 | 1 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2918 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2919 | -s "SSL - Unknown identity received" \ |
| 2920 | -S "SSL - Verification of the message MAC failed" |
| 2921 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2922 | run_test "PSK callback: first id matches" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2923 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 2924 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2925 | psk_identity=abc psk=dead" \ |
| 2926 | 0 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2927 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2928 | -S "SSL - Unknown identity received" \ |
| 2929 | -S "SSL - Verification of the message MAC failed" |
| 2930 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2931 | run_test "PSK callback: second id matches" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2932 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 2933 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2934 | psk_identity=def psk=beef" \ |
| 2935 | 0 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2936 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2937 | -S "SSL - Unknown identity received" \ |
| 2938 | -S "SSL - Verification of the message MAC failed" |
| 2939 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2940 | run_test "PSK callback: no match" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2941 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 2942 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2943 | psk_identity=ghi psk=beef" \ |
| 2944 | 1 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2945 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2946 | -s "SSL - Unknown identity received" \ |
| 2947 | -S "SSL - Verification of the message MAC failed" |
| 2948 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2949 | run_test "PSK callback: wrong key" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2950 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 2951 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2952 | psk_identity=abc psk=beef" \ |
| 2953 | 1 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2954 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2955 | -S "SSL - Unknown identity received" \ |
| 2956 | -s "SSL - Verification of the message MAC failed" |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 2957 | |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 2958 | # Tests for ciphersuites per version |
| 2959 | |
Janos Follath | 542ee5d | 2016-03-07 15:57:05 +0000 | [diff] [blame] | 2960 | requires_config_enabled MBEDTLS_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2961 | run_test "Per-version suites: SSL3" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 2962 | "$P_SRV min_version=ssl3 version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-AES-256-CBC-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 2963 | "$P_CLI force_version=ssl3" \ |
| 2964 | 0 \ |
| 2965 | -c "Ciphersuite is TLS-RSA-WITH-3DES-EDE-CBC-SHA" |
| 2966 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2967 | run_test "Per-version suites: TLS 1.0" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 2968 | "$P_SRV arc4=1 version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-AES-256-CBC-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2969 | "$P_CLI force_version=tls1 arc4=1" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 2970 | 0 \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 2971 | -c "Ciphersuite is TLS-RSA-WITH-AES-256-CBC-SHA" |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 2972 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2973 | run_test "Per-version suites: TLS 1.1" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 2974 | "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-AES-256-CBC-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 2975 | "$P_CLI force_version=tls1_1" \ |
| 2976 | 0 \ |
| 2977 | -c "Ciphersuite is TLS-RSA-WITH-AES-128-CBC-SHA" |
| 2978 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2979 | run_test "Per-version suites: TLS 1.2" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 2980 | "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-AES-256-CBC-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 2981 | "$P_CLI force_version=tls1_2" \ |
| 2982 | 0 \ |
| 2983 | -c "Ciphersuite is TLS-RSA-WITH-AES-128-GCM-SHA256" |
| 2984 | |
Manuel Pégourié-Gonnard | 4cc8c63 | 2015-07-23 12:24:03 +0200 | [diff] [blame] | 2985 | # Test for ClientHello without extensions |
| 2986 | |
Manuel Pégourié-Gonnard | d55bc20 | 2015-08-04 16:22:30 +0200 | [diff] [blame] | 2987 | requires_gnutls |
Gilles Peskine | 7344e1b | 2017-05-12 13:16:40 +0200 | [diff] [blame] | 2988 | run_test "ClientHello without extensions, SHA-1 allowed" \ |
Manuel Pégourié-Gonnard | 4cc8c63 | 2015-07-23 12:24:03 +0200 | [diff] [blame] | 2989 | "$P_SRV debug_level=3" \ |
| 2990 | "$G_CLI --priority=NORMAL:%NO_EXTENSIONS:%DISABLE_SAFE_RENEGOTIATION" \ |
| 2991 | 0 \ |
| 2992 | -s "dumping 'client hello extensions' (0 bytes)" |
| 2993 | |
Gilles Peskine | 7344e1b | 2017-05-12 13:16:40 +0200 | [diff] [blame] | 2994 | requires_gnutls |
| 2995 | run_test "ClientHello without extensions, SHA-1 forbidden in certificates on server" \ |
| 2996 | "$P_SRV debug_level=3 key_file=data_files/server2.key crt_file=data_files/server2.crt allow_sha1=0" \ |
| 2997 | "$G_CLI --priority=NORMAL:%NO_EXTENSIONS:%DISABLE_SAFE_RENEGOTIATION" \ |
| 2998 | 0 \ |
| 2999 | -s "dumping 'client hello extensions' (0 bytes)" |
| 3000 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3001 | # Tests for mbedtls_ssl_get_bytes_avail() |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 3002 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3003 | run_test "mbedtls_ssl_get_bytes_avail: no extra data" \ |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 3004 | "$P_SRV" \ |
| 3005 | "$P_CLI request_size=100" \ |
| 3006 | 0 \ |
| 3007 | -s "Read from client: 100 bytes read$" |
| 3008 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3009 | run_test "mbedtls_ssl_get_bytes_avail: extra data" \ |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 3010 | "$P_SRV" \ |
| 3011 | "$P_CLI request_size=500" \ |
| 3012 | 0 \ |
| 3013 | -s "Read from client: 500 bytes read (.*+.*)" |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 3014 | |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3015 | # Tests for small packets |
| 3016 | |
Janos Follath | 542ee5d | 2016-03-07 15:57:05 +0000 | [diff] [blame] | 3017 | requires_config_enabled MBEDTLS_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3018 | run_test "Small packet SSLv3 BlockCipher" \ |
Manuel Pégourié-Gonnard | 448ea50 | 2015-01-12 11:40:14 +0100 | [diff] [blame] | 3019 | "$P_SRV min_version=ssl3" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3020 | "$P_CLI request_size=1 force_version=ssl3 \ |
| 3021 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 3022 | 0 \ |
| 3023 | -s "Read from client: 1 bytes read" |
| 3024 | |
Janos Follath | 542ee5d | 2016-03-07 15:57:05 +0000 | [diff] [blame] | 3025 | requires_config_enabled MBEDTLS_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3026 | run_test "Small packet SSLv3 StreamCipher" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 3027 | "$P_SRV min_version=ssl3 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3028 | "$P_CLI request_size=1 force_version=ssl3 \ |
| 3029 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 3030 | 0 \ |
| 3031 | -s "Read from client: 1 bytes read" |
| 3032 | |
| 3033 | run_test "Small packet TLS 1.0 BlockCipher" \ |
| 3034 | "$P_SRV" \ |
| 3035 | "$P_CLI request_size=1 force_version=tls1 \ |
| 3036 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 3037 | 0 \ |
| 3038 | -s "Read from client: 1 bytes read" |
| 3039 | |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 3040 | run_test "Small packet TLS 1.0 BlockCipher without EtM" \ |
| 3041 | "$P_SRV" \ |
| 3042 | "$P_CLI request_size=1 force_version=tls1 etm=0 \ |
| 3043 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 3044 | 0 \ |
| 3045 | -s "Read from client: 1 bytes read" |
| 3046 | |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3047 | run_test "Small packet TLS 1.0 BlockCipher truncated MAC" \ |
| 3048 | "$P_SRV" \ |
| 3049 | "$P_CLI request_size=1 force_version=tls1 \ |
| 3050 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 3051 | trunc_hmac=1" \ |
| 3052 | 0 \ |
| 3053 | -s "Read from client: 1 bytes read" |
| 3054 | |
| 3055 | run_test "Small packet TLS 1.0 StreamCipher truncated MAC" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 3056 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3057 | "$P_CLI request_size=1 force_version=tls1 \ |
| 3058 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 3059 | trunc_hmac=1" \ |
| 3060 | 0 \ |
| 3061 | -s "Read from client: 1 bytes read" |
| 3062 | |
| 3063 | run_test "Small packet TLS 1.1 BlockCipher" \ |
| 3064 | "$P_SRV" \ |
| 3065 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 3066 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 3067 | 0 \ |
| 3068 | -s "Read from client: 1 bytes read" |
| 3069 | |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 3070 | run_test "Small packet TLS 1.1 BlockCipher without EtM" \ |
| 3071 | "$P_SRV" \ |
| 3072 | "$P_CLI request_size=1 force_version=tls1_1 etm=0 \ |
| 3073 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 3074 | 0 \ |
| 3075 | -s "Read from client: 1 bytes read" |
| 3076 | |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3077 | run_test "Small packet TLS 1.1 StreamCipher" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 3078 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3079 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 3080 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 3081 | 0 \ |
| 3082 | -s "Read from client: 1 bytes read" |
| 3083 | |
| 3084 | run_test "Small packet TLS 1.1 BlockCipher truncated MAC" \ |
| 3085 | "$P_SRV" \ |
| 3086 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 3087 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 3088 | trunc_hmac=1" \ |
| 3089 | 0 \ |
| 3090 | -s "Read from client: 1 bytes read" |
| 3091 | |
| 3092 | run_test "Small packet TLS 1.1 StreamCipher truncated MAC" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 3093 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3094 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 3095 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 3096 | trunc_hmac=1" \ |
| 3097 | 0 \ |
| 3098 | -s "Read from client: 1 bytes read" |
| 3099 | |
| 3100 | run_test "Small packet TLS 1.2 BlockCipher" \ |
| 3101 | "$P_SRV" \ |
| 3102 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 3103 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 3104 | 0 \ |
| 3105 | -s "Read from client: 1 bytes read" |
| 3106 | |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 3107 | run_test "Small packet TLS 1.2 BlockCipher without EtM" \ |
| 3108 | "$P_SRV" \ |
| 3109 | "$P_CLI request_size=1 force_version=tls1_2 etm=0 \ |
| 3110 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 3111 | 0 \ |
| 3112 | -s "Read from client: 1 bytes read" |
| 3113 | |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3114 | run_test "Small packet TLS 1.2 BlockCipher larger MAC" \ |
| 3115 | "$P_SRV" \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 3116 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 3117 | force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3118 | 0 \ |
| 3119 | -s "Read from client: 1 bytes read" |
| 3120 | |
| 3121 | run_test "Small packet TLS 1.2 BlockCipher truncated MAC" \ |
| 3122 | "$P_SRV" \ |
| 3123 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 3124 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 3125 | trunc_hmac=1" \ |
| 3126 | 0 \ |
| 3127 | -s "Read from client: 1 bytes read" |
| 3128 | |
| 3129 | run_test "Small packet TLS 1.2 StreamCipher" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 3130 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3131 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 3132 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 3133 | 0 \ |
| 3134 | -s "Read from client: 1 bytes read" |
| 3135 | |
| 3136 | run_test "Small packet TLS 1.2 StreamCipher truncated MAC" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 3137 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 3138 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 3139 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 3140 | trunc_hmac=1" \ |
| 3141 | 0 \ |
| 3142 | -s "Read from client: 1 bytes read" |
| 3143 | |
| 3144 | run_test "Small packet TLS 1.2 AEAD" \ |
| 3145 | "$P_SRV" \ |
| 3146 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 3147 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 3148 | 0 \ |
| 3149 | -s "Read from client: 1 bytes read" |
| 3150 | |
| 3151 | run_test "Small packet TLS 1.2 AEAD shorter tag" \ |
| 3152 | "$P_SRV" \ |
| 3153 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 3154 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 3155 | 0 \ |
| 3156 | -s "Read from client: 1 bytes read" |
| 3157 | |
Janos Follath | b700c46 | 2016-05-06 13:48:23 +0100 | [diff] [blame] | 3158 | # A test for extensions in SSLv3 |
| 3159 | |
| 3160 | requires_config_enabled MBEDTLS_SSL_PROTO_SSL3 |
| 3161 | run_test "SSLv3 with extensions, server side" \ |
| 3162 | "$P_SRV min_version=ssl3 debug_level=3" \ |
| 3163 | "$P_CLI force_version=ssl3 tickets=1 max_frag_len=4096 alpn=abc,1234" \ |
| 3164 | 0 \ |
| 3165 | -S "dumping 'client hello extensions'" \ |
| 3166 | -S "server hello, total extension length:" |
| 3167 | |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3168 | # Test for large packets |
| 3169 | |
Janos Follath | 542ee5d | 2016-03-07 15:57:05 +0000 | [diff] [blame] | 3170 | requires_config_enabled MBEDTLS_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3171 | run_test "Large packet SSLv3 BlockCipher" \ |
Manuel Pégourié-Gonnard | 448ea50 | 2015-01-12 11:40:14 +0100 | [diff] [blame] | 3172 | "$P_SRV min_version=ssl3" \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 3173 | "$P_CLI request_size=16384 force_version=ssl3 recsplit=0 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3174 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 3175 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3176 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3177 | -s "Read from client: 16384 bytes read" |
| 3178 | |
Janos Follath | 542ee5d | 2016-03-07 15:57:05 +0000 | [diff] [blame] | 3179 | requires_config_enabled MBEDTLS_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3180 | run_test "Large packet SSLv3 StreamCipher" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 3181 | "$P_SRV min_version=ssl3 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3182 | "$P_CLI request_size=16384 force_version=ssl3 \ |
| 3183 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 3184 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3185 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3186 | -s "Read from client: 16384 bytes read" |
| 3187 | |
| 3188 | run_test "Large packet TLS 1.0 BlockCipher" \ |
| 3189 | "$P_SRV" \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 3190 | "$P_CLI request_size=16384 force_version=tls1 recsplit=0 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3191 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 3192 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3193 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3194 | -s "Read from client: 16384 bytes read" |
| 3195 | |
| 3196 | run_test "Large packet TLS 1.0 BlockCipher truncated MAC" \ |
| 3197 | "$P_SRV" \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 3198 | "$P_CLI request_size=16384 force_version=tls1 recsplit=0 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3199 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 3200 | trunc_hmac=1" \ |
| 3201 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3202 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3203 | -s "Read from client: 16384 bytes read" |
| 3204 | |
| 3205 | run_test "Large packet TLS 1.0 StreamCipher truncated MAC" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 3206 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3207 | "$P_CLI request_size=16384 force_version=tls1 \ |
| 3208 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 3209 | trunc_hmac=1" \ |
| 3210 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3211 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3212 | -s "Read from client: 16384 bytes read" |
| 3213 | |
| 3214 | run_test "Large packet TLS 1.1 BlockCipher" \ |
| 3215 | "$P_SRV" \ |
| 3216 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 3217 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 3218 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3219 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3220 | -s "Read from client: 16384 bytes read" |
| 3221 | |
| 3222 | run_test "Large packet TLS 1.1 StreamCipher" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 3223 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3224 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 3225 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 3226 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3227 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3228 | -s "Read from client: 16384 bytes read" |
| 3229 | |
| 3230 | run_test "Large packet TLS 1.1 BlockCipher truncated MAC" \ |
| 3231 | "$P_SRV" \ |
| 3232 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 3233 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 3234 | trunc_hmac=1" \ |
| 3235 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3236 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3237 | -s "Read from client: 16384 bytes read" |
| 3238 | |
| 3239 | run_test "Large packet TLS 1.1 StreamCipher truncated MAC" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 3240 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3241 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 3242 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 3243 | trunc_hmac=1" \ |
| 3244 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3245 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3246 | -s "Read from client: 16384 bytes read" |
| 3247 | |
| 3248 | run_test "Large packet TLS 1.2 BlockCipher" \ |
| 3249 | "$P_SRV" \ |
| 3250 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 3251 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 3252 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3253 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3254 | -s "Read from client: 16384 bytes read" |
| 3255 | |
| 3256 | run_test "Large packet TLS 1.2 BlockCipher larger MAC" \ |
| 3257 | "$P_SRV" \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 3258 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 3259 | force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3260 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3261 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3262 | -s "Read from client: 16384 bytes read" |
| 3263 | |
| 3264 | run_test "Large packet TLS 1.2 BlockCipher truncated MAC" \ |
| 3265 | "$P_SRV" \ |
| 3266 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 3267 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 3268 | trunc_hmac=1" \ |
| 3269 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3270 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3271 | -s "Read from client: 16384 bytes read" |
| 3272 | |
| 3273 | run_test "Large packet TLS 1.2 StreamCipher" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 3274 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3275 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 3276 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 3277 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3278 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3279 | -s "Read from client: 16384 bytes read" |
| 3280 | |
| 3281 | run_test "Large packet TLS 1.2 StreamCipher truncated MAC" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 3282 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3283 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 3284 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 3285 | trunc_hmac=1" \ |
| 3286 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3287 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3288 | -s "Read from client: 16384 bytes read" |
| 3289 | |
| 3290 | run_test "Large packet TLS 1.2 AEAD" \ |
| 3291 | "$P_SRV" \ |
| 3292 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 3293 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 3294 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3295 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3296 | -s "Read from client: 16384 bytes read" |
| 3297 | |
| 3298 | run_test "Large packet TLS 1.2 AEAD shorter tag" \ |
| 3299 | "$P_SRV" \ |
| 3300 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 3301 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 3302 | 0 \ |
Hanno Becker | 0d885d3 | 2017-09-18 15:04:19 +0100 | [diff] [blame] | 3303 | -c "16384 bytes written in 1 fragments" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 3304 | -s "Read from client: 16384 bytes read" |
| 3305 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 3306 | # Tests for DTLS HelloVerifyRequest |
| 3307 | |
| 3308 | run_test "DTLS cookie: enabled" \ |
| 3309 | "$P_SRV dtls=1 debug_level=2" \ |
| 3310 | "$P_CLI dtls=1 debug_level=2" \ |
| 3311 | 0 \ |
| 3312 | -s "cookie verification failed" \ |
| 3313 | -s "cookie verification passed" \ |
| 3314 | -S "cookie verification skipped" \ |
| 3315 | -c "received hello verify request" \ |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 3316 | -s "hello verification requested" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 3317 | -S "SSL - The requested feature is not available" |
| 3318 | |
| 3319 | run_test "DTLS cookie: disabled" \ |
| 3320 | "$P_SRV dtls=1 debug_level=2 cookies=0" \ |
| 3321 | "$P_CLI dtls=1 debug_level=2" \ |
| 3322 | 0 \ |
| 3323 | -S "cookie verification failed" \ |
| 3324 | -S "cookie verification passed" \ |
| 3325 | -s "cookie verification skipped" \ |
| 3326 | -C "received hello verify request" \ |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 3327 | -S "hello verification requested" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 3328 | -S "SSL - The requested feature is not available" |
| 3329 | |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 3330 | run_test "DTLS cookie: default (failing)" \ |
| 3331 | "$P_SRV dtls=1 debug_level=2 cookies=-1" \ |
| 3332 | "$P_CLI dtls=1 debug_level=2 hs_timeout=100-400" \ |
| 3333 | 1 \ |
| 3334 | -s "cookie verification failed" \ |
| 3335 | -S "cookie verification passed" \ |
| 3336 | -S "cookie verification skipped" \ |
| 3337 | -C "received hello verify request" \ |
| 3338 | -S "hello verification requested" \ |
| 3339 | -s "SSL - The requested feature is not available" |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 3340 | |
| 3341 | requires_ipv6 |
| 3342 | run_test "DTLS cookie: enabled, IPv6" \ |
| 3343 | "$P_SRV dtls=1 debug_level=2 server_addr=::1" \ |
| 3344 | "$P_CLI dtls=1 debug_level=2 server_addr=::1" \ |
| 3345 | 0 \ |
| 3346 | -s "cookie verification failed" \ |
| 3347 | -s "cookie verification passed" \ |
| 3348 | -S "cookie verification skipped" \ |
| 3349 | -c "received hello verify request" \ |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 3350 | -s "hello verification requested" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 3351 | -S "SSL - The requested feature is not available" |
| 3352 | |
Manuel Pégourié-Gonnard | 579950c | 2014-09-29 17:47:33 +0200 | [diff] [blame] | 3353 | run_test "DTLS cookie: enabled, nbio" \ |
| 3354 | "$P_SRV dtls=1 nbio=2 debug_level=2" \ |
| 3355 | "$P_CLI dtls=1 nbio=2 debug_level=2" \ |
| 3356 | 0 \ |
| 3357 | -s "cookie verification failed" \ |
| 3358 | -s "cookie verification passed" \ |
| 3359 | -S "cookie verification skipped" \ |
| 3360 | -c "received hello verify request" \ |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 3361 | -s "hello verification requested" \ |
Manuel Pégourié-Gonnard | 579950c | 2014-09-29 17:47:33 +0200 | [diff] [blame] | 3362 | -S "SSL - The requested feature is not available" |
| 3363 | |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 3364 | # Tests for client reconnecting from the same port with DTLS |
| 3365 | |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 3366 | not_with_valgrind # spurious resend |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 3367 | run_test "DTLS client reconnect from same port: reference" \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 3368 | "$P_SRV dtls=1 exchanges=2 read_timeout=1000" \ |
| 3369 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=500-1000" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 3370 | 0 \ |
| 3371 | -C "resend" \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 3372 | -S "The operation timed out" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 3373 | -S "Client initiated reconnection from same port" |
| 3374 | |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 3375 | not_with_valgrind # spurious resend |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 3376 | run_test "DTLS client reconnect from same port: reconnect" \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 3377 | "$P_SRV dtls=1 exchanges=2 read_timeout=1000" \ |
| 3378 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=500-1000 reconnect_hard=1" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 3379 | 0 \ |
| 3380 | -C "resend" \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 3381 | -S "The operation timed out" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 3382 | -s "Client initiated reconnection from same port" |
| 3383 | |
Paul Bakker | 3b224ff | 2016-05-13 10:33:25 +0100 | [diff] [blame] | 3384 | not_with_valgrind # server/client too slow to respond in time (next test has higher timeouts) |
| 3385 | run_test "DTLS client reconnect from same port: reconnect, nbio, no valgrind" \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 3386 | "$P_SRV dtls=1 exchanges=2 read_timeout=1000 nbio=2" \ |
| 3387 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=500-1000 reconnect_hard=1" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 3388 | 0 \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 3389 | -S "The operation timed out" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 3390 | -s "Client initiated reconnection from same port" |
| 3391 | |
Paul Bakker | 3b224ff | 2016-05-13 10:33:25 +0100 | [diff] [blame] | 3392 | only_with_valgrind # Only with valgrind, do previous test but with higher read_timeout and hs_timeout |
| 3393 | run_test "DTLS client reconnect from same port: reconnect, nbio, valgrind" \ |
| 3394 | "$P_SRV dtls=1 exchanges=2 read_timeout=2000 nbio=2 hs_timeout=1500-6000" \ |
| 3395 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=1500-3000 reconnect_hard=1" \ |
| 3396 | 0 \ |
| 3397 | -S "The operation timed out" \ |
| 3398 | -s "Client initiated reconnection from same port" |
| 3399 | |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 3400 | run_test "DTLS client reconnect from same port: no cookies" \ |
| 3401 | "$P_SRV dtls=1 exchanges=2 read_timeout=1000 cookies=0" \ |
Manuel Pégourié-Gonnard | 6ad23b9 | 2015-09-15 12:57:46 +0200 | [diff] [blame] | 3402 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=500-8000 reconnect_hard=1" \ |
| 3403 | 0 \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 3404 | -s "The operation timed out" \ |
| 3405 | -S "Client initiated reconnection from same port" |
| 3406 | |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 3407 | # Tests for various cases of client authentication with DTLS |
| 3408 | # (focused on handshake flows and message parsing) |
| 3409 | |
| 3410 | run_test "DTLS client auth: required" \ |
| 3411 | "$P_SRV dtls=1 auth_mode=required" \ |
| 3412 | "$P_CLI dtls=1" \ |
| 3413 | 0 \ |
| 3414 | -s "Verifying peer X.509 certificate... ok" |
| 3415 | |
| 3416 | run_test "DTLS client auth: optional, client has no cert" \ |
| 3417 | "$P_SRV dtls=1 auth_mode=optional" \ |
| 3418 | "$P_CLI dtls=1 crt_file=none key_file=none" \ |
| 3419 | 0 \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 3420 | -s "! Certificate was missing" |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 3421 | |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 3422 | run_test "DTLS client auth: none, client has no cert" \ |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 3423 | "$P_SRV dtls=1 auth_mode=none" \ |
| 3424 | "$P_CLI dtls=1 crt_file=none key_file=none debug_level=2" \ |
| 3425 | 0 \ |
| 3426 | -c "skip write certificate$" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 3427 | -s "! Certificate verification was skipped" |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 3428 | |
Manuel Pégourié-Gonnard | 0a88574 | 2015-08-04 12:08:35 +0200 | [diff] [blame] | 3429 | run_test "DTLS wrong PSK: badmac alert" \ |
| 3430 | "$P_SRV dtls=1 psk=abc123 force_ciphersuite=TLS-PSK-WITH-AES-128-GCM-SHA256" \ |
| 3431 | "$P_CLI dtls=1 psk=abc124" \ |
| 3432 | 1 \ |
| 3433 | -s "SSL - Verification of the message MAC failed" \ |
| 3434 | -c "SSL - A fatal alert message was received from our peer" |
| 3435 | |
Manuel Pégourié-Gonnard | 502bf30 | 2014-08-20 13:12:58 +0200 | [diff] [blame] | 3436 | # Tests for receiving fragmented handshake messages with DTLS |
| 3437 | |
| 3438 | requires_gnutls |
| 3439 | run_test "DTLS reassembly: no fragmentation (gnutls server)" \ |
| 3440 | "$G_SRV -u --mtu 2048 -a" \ |
| 3441 | "$P_CLI dtls=1 debug_level=2" \ |
| 3442 | 0 \ |
| 3443 | -C "found fragmented DTLS handshake message" \ |
| 3444 | -C "error" |
| 3445 | |
| 3446 | requires_gnutls |
| 3447 | run_test "DTLS reassembly: some fragmentation (gnutls server)" \ |
| 3448 | "$G_SRV -u --mtu 512" \ |
| 3449 | "$P_CLI dtls=1 debug_level=2" \ |
| 3450 | 0 \ |
| 3451 | -c "found fragmented DTLS handshake message" \ |
| 3452 | -C "error" |
| 3453 | |
| 3454 | requires_gnutls |
| 3455 | run_test "DTLS reassembly: more fragmentation (gnutls server)" \ |
| 3456 | "$G_SRV -u --mtu 128" \ |
| 3457 | "$P_CLI dtls=1 debug_level=2" \ |
| 3458 | 0 \ |
| 3459 | -c "found fragmented DTLS handshake message" \ |
| 3460 | -C "error" |
| 3461 | |
| 3462 | requires_gnutls |
| 3463 | run_test "DTLS reassembly: more fragmentation, nbio (gnutls server)" \ |
| 3464 | "$G_SRV -u --mtu 128" \ |
| 3465 | "$P_CLI dtls=1 nbio=2 debug_level=2" \ |
| 3466 | 0 \ |
| 3467 | -c "found fragmented DTLS handshake message" \ |
| 3468 | -C "error" |
| 3469 | |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 3470 | requires_gnutls |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 3471 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 3472 | run_test "DTLS reassembly: fragmentation, renego (gnutls server)" \ |
| 3473 | "$G_SRV -u --mtu 256" \ |
| 3474 | "$P_CLI debug_level=3 dtls=1 renegotiation=1 renegotiate=1" \ |
| 3475 | 0 \ |
| 3476 | -c "found fragmented DTLS handshake message" \ |
| 3477 | -c "client hello, adding renegotiation extension" \ |
| 3478 | -c "found renegotiation extension" \ |
| 3479 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3480 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 3481 | -C "error" \ |
| 3482 | -s "Extra-header:" |
| 3483 | |
| 3484 | requires_gnutls |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 3485 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 3486 | run_test "DTLS reassembly: fragmentation, nbio, renego (gnutls server)" \ |
| 3487 | "$G_SRV -u --mtu 256" \ |
| 3488 | "$P_CLI debug_level=3 nbio=2 dtls=1 renegotiation=1 renegotiate=1" \ |
| 3489 | 0 \ |
| 3490 | -c "found fragmented DTLS handshake message" \ |
| 3491 | -c "client hello, adding renegotiation extension" \ |
| 3492 | -c "found renegotiation extension" \ |
| 3493 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3494 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 3495 | -C "error" \ |
| 3496 | -s "Extra-header:" |
| 3497 | |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 3498 | run_test "DTLS reassembly: no fragmentation (openssl server)" \ |
| 3499 | "$O_SRV -dtls1 -mtu 2048" \ |
| 3500 | "$P_CLI dtls=1 debug_level=2" \ |
| 3501 | 0 \ |
| 3502 | -C "found fragmented DTLS handshake message" \ |
| 3503 | -C "error" |
| 3504 | |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 3505 | run_test "DTLS reassembly: some fragmentation (openssl server)" \ |
| 3506 | "$O_SRV -dtls1 -mtu 768" \ |
Manuel Pégourié-Gonnard | 64dffc5 | 2014-09-02 13:39:16 +0200 | [diff] [blame] | 3507 | "$P_CLI dtls=1 debug_level=2" \ |
| 3508 | 0 \ |
| 3509 | -c "found fragmented DTLS handshake message" \ |
| 3510 | -C "error" |
| 3511 | |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 3512 | run_test "DTLS reassembly: more fragmentation (openssl server)" \ |
Manuel Pégourié-Gonnard | 64dffc5 | 2014-09-02 13:39:16 +0200 | [diff] [blame] | 3513 | "$O_SRV -dtls1 -mtu 256" \ |
| 3514 | "$P_CLI dtls=1 debug_level=2" \ |
| 3515 | 0 \ |
| 3516 | -c "found fragmented DTLS handshake message" \ |
| 3517 | -C "error" |
| 3518 | |
| 3519 | run_test "DTLS reassembly: fragmentation, nbio (openssl server)" \ |
| 3520 | "$O_SRV -dtls1 -mtu 256" \ |
| 3521 | "$P_CLI dtls=1 nbio=2 debug_level=2" \ |
| 3522 | 0 \ |
| 3523 | -c "found fragmented DTLS handshake message" \ |
| 3524 | -C "error" |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 3525 | |
Manuel Pégourié-Gonnard | 7a66cbc | 2014-09-26 16:31:46 +0200 | [diff] [blame] | 3526 | # Tests for specific things with "unreliable" UDP connection |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 3527 | |
Manuel Pégourié-Gonnard | 76fe9e4 | 2014-09-24 15:17:31 +0200 | [diff] [blame] | 3528 | not_with_valgrind # spurious resend due to timeout |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 3529 | run_test "DTLS proxy: reference" \ |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 3530 | -p "$P_PXY" \ |
Manuel Pégourié-Gonnard | 76fe9e4 | 2014-09-24 15:17:31 +0200 | [diff] [blame] | 3531 | "$P_SRV dtls=1 debug_level=2" \ |
| 3532 | "$P_CLI dtls=1 debug_level=2" \ |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 3533 | 0 \ |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 3534 | -C "replayed record" \ |
| 3535 | -S "replayed record" \ |
| 3536 | -C "record from another epoch" \ |
| 3537 | -S "record from another epoch" \ |
| 3538 | -C "discarding invalid record" \ |
| 3539 | -S "discarding invalid record" \ |
Manuel Pégourié-Gonnard | 76fe9e4 | 2014-09-24 15:17:31 +0200 | [diff] [blame] | 3540 | -S "resend" \ |
Manuel Pégourié-Gonnard | 63eca93 | 2014-09-08 16:39:08 +0200 | [diff] [blame] | 3541 | -s "Extra-header:" \ |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 3542 | -c "HTTP/1.0 200 OK" |
| 3543 | |
Manuel Pégourié-Gonnard | 76fe9e4 | 2014-09-24 15:17:31 +0200 | [diff] [blame] | 3544 | not_with_valgrind # spurious resend due to timeout |
Manuel Pégourié-Gonnard | b47368a | 2014-09-24 13:29:58 +0200 | [diff] [blame] | 3545 | run_test "DTLS proxy: duplicate every packet" \ |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 3546 | -p "$P_PXY duplicate=1" \ |
Manuel Pégourié-Gonnard | 76fe9e4 | 2014-09-24 15:17:31 +0200 | [diff] [blame] | 3547 | "$P_SRV dtls=1 debug_level=2" \ |
| 3548 | "$P_CLI dtls=1 debug_level=2" \ |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 3549 | 0 \ |
Manuel Pégourié-Gonnard | b47368a | 2014-09-24 13:29:58 +0200 | [diff] [blame] | 3550 | -c "replayed record" \ |
| 3551 | -s "replayed record" \ |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 3552 | -c "discarding invalid record" \ |
| 3553 | -s "discarding invalid record" \ |
Manuel Pégourié-Gonnard | 76fe9e4 | 2014-09-24 15:17:31 +0200 | [diff] [blame] | 3554 | -S "resend" \ |
Manuel Pégourié-Gonnard | 63eca93 | 2014-09-08 16:39:08 +0200 | [diff] [blame] | 3555 | -s "Extra-header:" \ |
| 3556 | -c "HTTP/1.0 200 OK" |
| 3557 | |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 3558 | run_test "DTLS proxy: duplicate every packet, server anti-replay off" \ |
| 3559 | -p "$P_PXY duplicate=1" \ |
Manuel Pégourié-Gonnard | 76fe9e4 | 2014-09-24 15:17:31 +0200 | [diff] [blame] | 3560 | "$P_SRV dtls=1 debug_level=2 anti_replay=0" \ |
| 3561 | "$P_CLI dtls=1 debug_level=2" \ |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 3562 | 0 \ |
| 3563 | -c "replayed record" \ |
| 3564 | -S "replayed record" \ |
| 3565 | -c "discarding invalid record" \ |
| 3566 | -s "discarding invalid record" \ |
Manuel Pégourié-Gonnard | 76fe9e4 | 2014-09-24 15:17:31 +0200 | [diff] [blame] | 3567 | -c "resend" \ |
| 3568 | -s "resend" \ |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 3569 | -s "Extra-header:" \ |
| 3570 | -c "HTTP/1.0 200 OK" |
| 3571 | |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 3572 | run_test "DTLS proxy: inject invalid AD record, default badmac_limit" \ |
Manuel Pégourié-Gonnard | 63eca93 | 2014-09-08 16:39:08 +0200 | [diff] [blame] | 3573 | -p "$P_PXY bad_ad=1" \ |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 3574 | "$P_SRV dtls=1 debug_level=1" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 3575 | "$P_CLI dtls=1 debug_level=1 read_timeout=100" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 3576 | 0 \ |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 3577 | -c "discarding invalid record (mac)" \ |
| 3578 | -s "discarding invalid record (mac)" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 3579 | -s "Extra-header:" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 3580 | -c "HTTP/1.0 200 OK" \ |
| 3581 | -S "too many records with bad MAC" \ |
| 3582 | -S "Verification of the message MAC failed" |
| 3583 | |
| 3584 | run_test "DTLS proxy: inject invalid AD record, badmac_limit 1" \ |
| 3585 | -p "$P_PXY bad_ad=1" \ |
| 3586 | "$P_SRV dtls=1 debug_level=1 badmac_limit=1" \ |
| 3587 | "$P_CLI dtls=1 debug_level=1 read_timeout=100" \ |
| 3588 | 1 \ |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 3589 | -C "discarding invalid record (mac)" \ |
| 3590 | -S "discarding invalid record (mac)" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 3591 | -S "Extra-header:" \ |
| 3592 | -C "HTTP/1.0 200 OK" \ |
| 3593 | -s "too many records with bad MAC" \ |
| 3594 | -s "Verification of the message MAC failed" |
| 3595 | |
| 3596 | run_test "DTLS proxy: inject invalid AD record, badmac_limit 2" \ |
| 3597 | -p "$P_PXY bad_ad=1" \ |
| 3598 | "$P_SRV dtls=1 debug_level=1 badmac_limit=2" \ |
| 3599 | "$P_CLI dtls=1 debug_level=1 read_timeout=100" \ |
| 3600 | 0 \ |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 3601 | -c "discarding invalid record (mac)" \ |
| 3602 | -s "discarding invalid record (mac)" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 3603 | -s "Extra-header:" \ |
| 3604 | -c "HTTP/1.0 200 OK" \ |
| 3605 | -S "too many records with bad MAC" \ |
| 3606 | -S "Verification of the message MAC failed" |
| 3607 | |
| 3608 | run_test "DTLS proxy: inject invalid AD record, badmac_limit 2, exchanges 2"\ |
| 3609 | -p "$P_PXY bad_ad=1" \ |
| 3610 | "$P_SRV dtls=1 debug_level=1 badmac_limit=2 exchanges=2" \ |
| 3611 | "$P_CLI dtls=1 debug_level=1 read_timeout=100 exchanges=2" \ |
| 3612 | 1 \ |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 3613 | -c "discarding invalid record (mac)" \ |
| 3614 | -s "discarding invalid record (mac)" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 3615 | -s "Extra-header:" \ |
| 3616 | -c "HTTP/1.0 200 OK" \ |
| 3617 | -s "too many records with bad MAC" \ |
| 3618 | -s "Verification of the message MAC failed" |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 3619 | |
| 3620 | run_test "DTLS proxy: delay ChangeCipherSpec" \ |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 3621 | -p "$P_PXY delay_ccs=1" \ |
| 3622 | "$P_SRV dtls=1 debug_level=1" \ |
| 3623 | "$P_CLI dtls=1 debug_level=1" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 3624 | 0 \ |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 3625 | -c "record from another epoch" \ |
| 3626 | -s "record from another epoch" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 3627 | -c "discarding invalid record" \ |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 3628 | -s "discarding invalid record" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 3629 | -s "Extra-header:" \ |
| 3630 | -c "HTTP/1.0 200 OK" |
| 3631 | |
Manuel Pégourié-Gonnard | 7a66cbc | 2014-09-26 16:31:46 +0200 | [diff] [blame] | 3632 | # Tests for "randomly unreliable connection": try a variety of flows and peers |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 3633 | |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 3634 | needs_more_time 2 |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 3635 | run_test "DTLS proxy: 3d (drop, delay, duplicate), \"short\" PSK handshake" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 3636 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 3637 | "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \ |
| 3638 | psk=abc123" \ |
| 3639 | "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 3640 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 3641 | 0 \ |
| 3642 | -s "Extra-header:" \ |
| 3643 | -c "HTTP/1.0 200 OK" |
| 3644 | |
| 3645 | needs_more_time 2 |
| 3646 | run_test "DTLS proxy: 3d, \"short\" RSA handshake" \ |
| 3647 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 3648 | "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none" \ |
| 3649 | "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 3650 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 3651 | 0 \ |
| 3652 | -s "Extra-header:" \ |
| 3653 | -c "HTTP/1.0 200 OK" |
| 3654 | |
| 3655 | needs_more_time 2 |
| 3656 | run_test "DTLS proxy: 3d, \"short\" (no ticket, no cli_auth) FS handshake" \ |
| 3657 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 3658 | "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none" \ |
| 3659 | "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0" \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 3660 | 0 \ |
| 3661 | -s "Extra-header:" \ |
| 3662 | -c "HTTP/1.0 200 OK" |
| 3663 | |
| 3664 | needs_more_time 2 |
| 3665 | run_test "DTLS proxy: 3d, FS, client auth" \ |
| 3666 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 3667 | "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=required" \ |
| 3668 | "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0" \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 3669 | 0 \ |
| 3670 | -s "Extra-header:" \ |
| 3671 | -c "HTTP/1.0 200 OK" |
| 3672 | |
| 3673 | needs_more_time 2 |
| 3674 | run_test "DTLS proxy: 3d, FS, ticket" \ |
| 3675 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 3676 | "$P_SRV dtls=1 hs_timeout=250-10000 tickets=1 auth_mode=none" \ |
| 3677 | "$P_CLI dtls=1 hs_timeout=250-10000 tickets=1" \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 3678 | 0 \ |
| 3679 | -s "Extra-header:" \ |
| 3680 | -c "HTTP/1.0 200 OK" |
| 3681 | |
| 3682 | needs_more_time 2 |
| 3683 | run_test "DTLS proxy: 3d, max handshake (FS, ticket + client auth)" \ |
| 3684 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 3685 | "$P_SRV dtls=1 hs_timeout=250-10000 tickets=1 auth_mode=required" \ |
| 3686 | "$P_CLI dtls=1 hs_timeout=250-10000 tickets=1" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 3687 | 0 \ |
| 3688 | -s "Extra-header:" \ |
| 3689 | -c "HTTP/1.0 200 OK" |
| 3690 | |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 3691 | needs_more_time 2 |
| 3692 | run_test "DTLS proxy: 3d, max handshake, nbio" \ |
| 3693 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 3694 | "$P_SRV dtls=1 hs_timeout=250-10000 nbio=2 tickets=1 \ |
| 3695 | auth_mode=required" \ |
| 3696 | "$P_CLI dtls=1 hs_timeout=250-10000 nbio=2 tickets=1" \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 3697 | 0 \ |
| 3698 | -s "Extra-header:" \ |
| 3699 | -c "HTTP/1.0 200 OK" |
| 3700 | |
Manuel Pégourié-Gonnard | 1b753f1 | 2014-09-25 16:09:36 +0200 | [diff] [blame] | 3701 | needs_more_time 4 |
Manuel Pégourié-Gonnard | 7a26d73 | 2014-10-02 14:50:46 +0200 | [diff] [blame] | 3702 | run_test "DTLS proxy: 3d, min handshake, resumption" \ |
| 3703 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
| 3704 | "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \ |
| 3705 | psk=abc123 debug_level=3" \ |
| 3706 | "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \ |
| 3707 | debug_level=3 reconnect=1 read_timeout=1000 max_resend=10 \ |
| 3708 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 3709 | 0 \ |
| 3710 | -s "a session has been resumed" \ |
| 3711 | -c "a session has been resumed" \ |
| 3712 | -s "Extra-header:" \ |
| 3713 | -c "HTTP/1.0 200 OK" |
| 3714 | |
| 3715 | needs_more_time 4 |
Manuel Pégourié-Gonnard | 85beb30 | 2014-10-02 17:59:19 +0200 | [diff] [blame] | 3716 | run_test "DTLS proxy: 3d, min handshake, resumption, nbio" \ |
| 3717 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
| 3718 | "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \ |
| 3719 | psk=abc123 debug_level=3 nbio=2" \ |
| 3720 | "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \ |
| 3721 | debug_level=3 reconnect=1 read_timeout=1000 max_resend=10 \ |
| 3722 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8 nbio=2" \ |
| 3723 | 0 \ |
| 3724 | -s "a session has been resumed" \ |
| 3725 | -c "a session has been resumed" \ |
| 3726 | -s "Extra-header:" \ |
| 3727 | -c "HTTP/1.0 200 OK" |
| 3728 | |
| 3729 | needs_more_time 4 |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 3730 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 3731 | run_test "DTLS proxy: 3d, min handshake, client-initiated renego" \ |
Manuel Pégourié-Gonnard | 1b753f1 | 2014-09-25 16:09:36 +0200 | [diff] [blame] | 3732 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 3733 | "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \ |
| 3734 | psk=abc123 renegotiation=1 debug_level=2" \ |
| 3735 | "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \ |
| 3736 | renegotiate=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 1b753f1 | 2014-09-25 16:09:36 +0200 | [diff] [blame] | 3737 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 3738 | 0 \ |
| 3739 | -c "=> renegotiate" \ |
| 3740 | -s "=> renegotiate" \ |
| 3741 | -s "Extra-header:" \ |
| 3742 | -c "HTTP/1.0 200 OK" |
| 3743 | |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 3744 | needs_more_time 4 |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 3745 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 3746 | run_test "DTLS proxy: 3d, min handshake, client-initiated renego, nbio" \ |
| 3747 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 3748 | "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \ |
| 3749 | psk=abc123 renegotiation=1 debug_level=2" \ |
| 3750 | "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \ |
| 3751 | renegotiate=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 3752 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 3753 | 0 \ |
| 3754 | -c "=> renegotiate" \ |
| 3755 | -s "=> renegotiate" \ |
| 3756 | -s "Extra-header:" \ |
| 3757 | -c "HTTP/1.0 200 OK" |
| 3758 | |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 3759 | needs_more_time 4 |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 3760 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 3761 | run_test "DTLS proxy: 3d, min handshake, server-initiated renego" \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 3762 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 3763 | "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 3764 | psk=abc123 renegotiate=1 renegotiation=1 exchanges=4 \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 3765 | debug_level=2" \ |
| 3766 | "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 3767 | renegotiation=1 exchanges=4 debug_level=2 \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 3768 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 3769 | 0 \ |
| 3770 | -c "=> renegotiate" \ |
| 3771 | -s "=> renegotiate" \ |
| 3772 | -s "Extra-header:" \ |
| 3773 | -c "HTTP/1.0 200 OK" |
| 3774 | |
| 3775 | needs_more_time 4 |
Hanno Becker | 7889113 | 2017-10-24 11:54:55 +0100 | [diff] [blame] | 3776 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 3777 | run_test "DTLS proxy: 3d, min handshake, server-initiated renego, nbio" \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 3778 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 3779 | "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 3780 | psk=abc123 renegotiate=1 renegotiation=1 exchanges=4 \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 3781 | debug_level=2 nbio=2" \ |
| 3782 | "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 3783 | renegotiation=1 exchanges=4 debug_level=2 nbio=2 \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 3784 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 3785 | 0 \ |
| 3786 | -c "=> renegotiate" \ |
| 3787 | -s "=> renegotiate" \ |
| 3788 | -s "Extra-header:" \ |
| 3789 | -c "HTTP/1.0 200 OK" |
| 3790 | |
Manuel Pégourié-Gonnard | 127ab88 | 2014-10-09 17:59:32 +0200 | [diff] [blame] | 3791 | needs_more_time 6 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 3792 | not_with_valgrind # risk of non-mbedtls peer timing out |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 3793 | run_test "DTLS proxy: 3d, openssl server" \ |
Manuel Pégourié-Gonnard | d0fd1da | 2014-09-25 17:00:27 +0200 | [diff] [blame] | 3794 | -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \ |
| 3795 | "$O_SRV -dtls1 -mtu 2048" \ |
Manuel Pégourié-Gonnard | 8fe411e | 2015-03-09 16:09:53 +0000 | [diff] [blame] | 3796 | "$P_CLI dtls=1 hs_timeout=250-60000 tickets=0" \ |
Manuel Pégourié-Gonnard | d0fd1da | 2014-09-25 17:00:27 +0200 | [diff] [blame] | 3797 | 0 \ |
Manuel Pégourié-Gonnard | d0fd1da | 2014-09-25 17:00:27 +0200 | [diff] [blame] | 3798 | -c "HTTP/1.0 200 OK" |
| 3799 | |
Manuel Pégourié-Gonnard | 2240486 | 2015-05-14 12:11:45 +0200 | [diff] [blame] | 3800 | needs_more_time 8 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 3801 | not_with_valgrind # risk of non-mbedtls peer timing out |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 3802 | run_test "DTLS proxy: 3d, openssl server, fragmentation" \ |
| 3803 | -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \ |
| 3804 | "$O_SRV -dtls1 -mtu 768" \ |
Manuel Pégourié-Gonnard | 8fe411e | 2015-03-09 16:09:53 +0000 | [diff] [blame] | 3805 | "$P_CLI dtls=1 hs_timeout=250-60000 tickets=0" \ |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 3806 | 0 \ |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 3807 | -c "HTTP/1.0 200 OK" |
| 3808 | |
Manuel Pégourié-Gonnard | 2240486 | 2015-05-14 12:11:45 +0200 | [diff] [blame] | 3809 | needs_more_time 8 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 3810 | not_with_valgrind # risk of non-mbedtls peer timing out |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 3811 | run_test "DTLS proxy: 3d, openssl server, fragmentation, nbio" \ |
| 3812 | -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \ |
| 3813 | "$O_SRV -dtls1 -mtu 768" \ |
Manuel Pégourié-Gonnard | 8fe411e | 2015-03-09 16:09:53 +0000 | [diff] [blame] | 3814 | "$P_CLI dtls=1 hs_timeout=250-60000 nbio=2 tickets=0" \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 3815 | 0 \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 3816 | -c "HTTP/1.0 200 OK" |
| 3817 | |
Manuel Pégourié-Gonnard | 9699996 | 2015-02-17 16:02:37 +0000 | [diff] [blame] | 3818 | requires_gnutls |
Manuel Pégourié-Gonnard | 127ab88 | 2014-10-09 17:59:32 +0200 | [diff] [blame] | 3819 | needs_more_time 6 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 3820 | not_with_valgrind # risk of non-mbedtls peer timing out |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 3821 | run_test "DTLS proxy: 3d, gnutls server" \ |
| 3822 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
| 3823 | "$G_SRV -u --mtu 2048 -a" \ |
Manuel Pégourié-Gonnard | f138447 | 2014-10-14 22:57:46 +0200 | [diff] [blame] | 3824 | "$P_CLI dtls=1 hs_timeout=250-60000" \ |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 3825 | 0 \ |
| 3826 | -s "Extra-header:" \ |
| 3827 | -c "Extra-header:" |
| 3828 | |
Manuel Pégourié-Gonnard | 9699996 | 2015-02-17 16:02:37 +0000 | [diff] [blame] | 3829 | requires_gnutls |
Manuel Pégourié-Gonnard | 2240486 | 2015-05-14 12:11:45 +0200 | [diff] [blame] | 3830 | needs_more_time 8 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 3831 | not_with_valgrind # risk of non-mbedtls peer timing out |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 3832 | run_test "DTLS proxy: 3d, gnutls server, fragmentation" \ |
| 3833 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
| 3834 | "$G_SRV -u --mtu 512" \ |
Manuel Pégourié-Gonnard | f138447 | 2014-10-14 22:57:46 +0200 | [diff] [blame] | 3835 | "$P_CLI dtls=1 hs_timeout=250-60000" \ |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 3836 | 0 \ |
| 3837 | -s "Extra-header:" \ |
| 3838 | -c "Extra-header:" |
| 3839 | |
Manuel Pégourié-Gonnard | 9699996 | 2015-02-17 16:02:37 +0000 | [diff] [blame] | 3840 | requires_gnutls |
Manuel Pégourié-Gonnard | 2240486 | 2015-05-14 12:11:45 +0200 | [diff] [blame] | 3841 | needs_more_time 8 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 3842 | not_with_valgrind # risk of non-mbedtls peer timing out |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 3843 | run_test "DTLS proxy: 3d, gnutls server, fragmentation, nbio" \ |
| 3844 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
| 3845 | "$G_SRV -u --mtu 512" \ |
Manuel Pégourié-Gonnard | f138447 | 2014-10-14 22:57:46 +0200 | [diff] [blame] | 3846 | "$P_CLI dtls=1 hs_timeout=250-60000 nbio=2" \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 3847 | 0 \ |
| 3848 | -s "Extra-header:" \ |
| 3849 | -c "Extra-header:" |
| 3850 | |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 3851 | # Final report |
| 3852 | |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 3853 | echo "------------------------------------------------------------------------" |
| 3854 | |
| 3855 | if [ $FAILS = 0 ]; then |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 3856 | printf "PASSED" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 3857 | else |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 3858 | printf "FAILED" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 3859 | fi |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 3860 | PASSES=$(( $TESTS - $FAILS )) |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 3861 | echo " ($PASSES / $TESTS tests ($SKIPS skipped))" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 3862 | |
| 3863 | exit $FAILS |