blob: d184d856524e5da31665ffb09389fa0755e89e72 [file] [log] [blame]
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +01001#!/bin/sh
2
3# Test various options that are not covered by compat.sh
4#
5# Here the goal is not to cover every ciphersuite/version, but
6# rather specific options (max fragment length, truncated hmac, etc)
7# or procedures (session resumption from cache or ticket, renego, etc).
8#
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02009# Assumes a build with default options.
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +010010
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +010011set -u
12
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +010013# default values, can be overriden by the environment
14: ${P_SRV:=../programs/ssl/ssl_server2}
15: ${P_CLI:=../programs/ssl/ssl_client2}
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +020016: ${P_PXY:=../programs/test/udp_proxy}
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +010017: ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +020018: ${GNUTLS_CLI:=gnutls-cli}
19: ${GNUTLS_SERV:=gnutls-serv}
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +010020
Manuel Pégourié-Gonnardfa60f122014-09-26 16:07:29 +020021O_SRV="$OPENSSL_CMD s_server -www -cert data_files/server5.crt -key data_files/server5.key"
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +010022O_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_CMD s_client"
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +020023G_SRV="$GNUTLS_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key"
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +010024G_CLI="echo 'GET / HTTP/1.0' | $GNUTLS_CLI --x509cafile data_files/test-ca_cat12.crt"
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +010025
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +010026TESTS=0
27FAILS=0
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020028SKIPS=0
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +010029
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000030CONFIG_H='../include/mbedtls/config.h'
Manuel Pégourié-Gonnard83d8c732014-04-07 13:24:21 +020031
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010032MEMCHECK=0
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +010033FILTER='.*'
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020034EXCLUDE='^$'
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010035
36print_usage() {
37 echo "Usage: $0 [options]"
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +010038 printf " -h|--help\tPrint this help.\n"
39 printf " -m|--memcheck\tCheck memory leaks and errors.\n"
40 printf " -f|--filter\tOnly matching tests are executed (default: '$FILTER')\n"
41 printf " -e|--exclude\tMatching tests are excluded (default: '$EXCLUDE')\n"
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010042}
43
44get_options() {
45 while [ $# -gt 0 ]; do
46 case "$1" in
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +010047 -f|--filter)
48 shift; FILTER=$1
49 ;;
50 -e|--exclude)
51 shift; EXCLUDE=$1
52 ;;
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010053 -m|--memcheck)
54 MEMCHECK=1
55 ;;
56 -h|--help)
57 print_usage
58 exit 0
59 ;;
60 *)
Paul Bakker1ebc0c52014-05-22 15:47:58 +020061 echo "Unknown argument: '$1'"
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010062 print_usage
63 exit 1
64 ;;
65 esac
66 shift
67 done
68}
69
Manuel Pégourié-Gonnard988209f2015-03-24 10:43:55 +010070# skip next test if the flag is not enabled in config.h
71requires_config_enabled() {
72 if grep "^#define $1" $CONFIG_H > /dev/null; then :; else
73 SKIP_NEXT="YES"
74 fi
75}
76
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +020077# skip next test if OpenSSL doesn't support FALLBACK_SCSV
78requires_openssl_with_fallback_scsv() {
79 if [ -z "${OPENSSL_HAS_FBSCSV:-}" ]; then
80 if $OPENSSL_CMD s_client -help 2>&1 | grep fallback_scsv >/dev/null
81 then
82 OPENSSL_HAS_FBSCSV="YES"
83 else
84 OPENSSL_HAS_FBSCSV="NO"
85 fi
86 fi
87 if [ "$OPENSSL_HAS_FBSCSV" = "NO" ]; then
88 SKIP_NEXT="YES"
89 fi
90}
91
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +020092# skip next test if GnuTLS isn't available
93requires_gnutls() {
94 if [ -z "${GNUTLS_AVAILABLE:-}" ]; then
Manuel Pégourié-Gonnard03db6b02015-06-26 15:45:30 +020095 if ( which "$GNUTLS_CLI" && which "$GNUTLS_SERV" ) >/dev/null 2>&1; then
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +020096 GNUTLS_AVAILABLE="YES"
97 else
98 GNUTLS_AVAILABLE="NO"
99 fi
100 fi
101 if [ "$GNUTLS_AVAILABLE" = "NO" ]; then
102 SKIP_NEXT="YES"
103 fi
104}
105
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +0200106# skip next test if IPv6 isn't available on this host
107requires_ipv6() {
108 if [ -z "${HAS_IPV6:-}" ]; then
109 $P_SRV server_addr='::1' > $SRV_OUT 2>&1 &
110 SRV_PID=$!
111 sleep 1
112 kill $SRV_PID >/dev/null 2>&1
113 if grep "NET - Binding of the socket failed" $SRV_OUT >/dev/null; then
114 HAS_IPV6="NO"
115 else
116 HAS_IPV6="YES"
117 fi
118 rm -r $SRV_OUT
119 fi
120
121 if [ "$HAS_IPV6" = "NO" ]; then
122 SKIP_NEXT="YES"
123 fi
124}
125
Manuel Pégourié-Gonnard76fe9e42014-09-24 15:17:31 +0200126# skip the next test if valgrind is in use
127not_with_valgrind() {
128 if [ "$MEMCHECK" -gt 0 ]; then
129 SKIP_NEXT="YES"
130 fi
131}
132
Paul Bakker3b224ff2016-05-13 10:33:25 +0100133# skip the next test if valgrind is NOT in use
134only_with_valgrind() {
135 if [ "$MEMCHECK" -eq 0 ]; then
136 SKIP_NEXT="YES"
137 fi
138}
139
Manuel Pégourié-Gonnarda0719722014-09-20 12:46:27 +0200140# multiply the client timeout delay by the given factor for the next test
141needs_more_time() {
142 CLI_DELAY_FACTOR=$1
143}
144
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100145# print_name <name>
146print_name() {
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +0100147 printf "$1 "
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200148 LEN=$(( 72 - `echo "$1" | wc -c` ))
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +0100149 for i in `seq 1 $LEN`; do printf '.'; done
150 printf ' '
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100151
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200152 TESTS=$(( $TESTS + 1 ))
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100153}
154
155# fail <message>
156fail() {
157 echo "FAIL"
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100158 echo " ! $1"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100159
Manuel Pégourié-Gonnardc2b00922014-08-31 16:46:04 +0200160 mv $SRV_OUT o-srv-${TESTS}.log
161 mv $CLI_OUT o-cli-${TESTS}.log
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200162 if [ -n "$PXY_CMD" ]; then
163 mv $PXY_OUT o-pxy-${TESTS}.log
164 fi
165 echo " ! outputs saved to o-XXX-${TESTS}.log"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100166
Manuel Pégourié-Gonnard7fa67722014-08-31 17:42:53 +0200167 if [ "X${USER:-}" = Xbuildbot -o "X${LOGNAME:-}" = Xbuildbot ]; then
168 echo " ! server output:"
169 cat o-srv-${TESTS}.log
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200170 echo " ! ========================================================"
Manuel Pégourié-Gonnard7fa67722014-08-31 17:42:53 +0200171 echo " ! client output:"
172 cat o-cli-${TESTS}.log
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200173 if [ -n "$PXY_CMD" ]; then
174 echo " ! ========================================================"
175 echo " ! proxy output:"
176 cat o-pxy-${TESTS}.log
177 fi
178 echo ""
Manuel Pégourié-Gonnard7fa67722014-08-31 17:42:53 +0200179 fi
180
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200181 FAILS=$(( $FAILS + 1 ))
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100182}
183
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100184# is_polar <cmd_line>
185is_polar() {
186 echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null
187}
188
Manuel Pégourié-Gonnardfa60f122014-09-26 16:07:29 +0200189# openssl s_server doesn't have -www with DTLS
190check_osrv_dtls() {
191 if echo "$SRV_CMD" | grep 's_server.*-dtls' >/dev/null; then
192 NEEDS_INPUT=1
193 SRV_CMD="$( echo $SRV_CMD | sed s/-www// )"
194 else
195 NEEDS_INPUT=0
196 fi
197}
198
199# provide input to commands that need it
200provide_input() {
201 if [ $NEEDS_INPUT -eq 0 ]; then
202 return
203 fi
204
205 while true; do
206 echo "HTTP/1.0 200 OK"
207 sleep 1
208 done
209}
210
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100211# has_mem_err <log_file_name>
212has_mem_err() {
213 if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" &&
214 grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null
215 then
216 return 1 # false: does not have errors
217 else
218 return 0 # true: has errors
219 fi
220}
221
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200222# wait for server to start: two versions depending on lsof availability
223wait_server_start() {
Manuel Pégourié-Gonnard03db6b02015-06-26 15:45:30 +0200224 if which lsof >/dev/null 2>&1; then
Manuel Pégourié-Gonnard74681fa2015-08-04 20:34:39 +0200225 START_TIME=$( date +%s )
226 DONE=0
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200227
228 # make a tight loop, server usually takes less than 1 sec to start
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +0200229 if [ "$DTLS" -eq 1 ]; then
Manuel Pégourié-Gonnard74681fa2015-08-04 20:34:39 +0200230 while [ $DONE -eq 0 ]; do
231 if lsof -nbi UDP:"$SRV_PORT" 2>/dev/null | grep UDP >/dev/null
232 then
233 DONE=1
234 elif [ $(( $( date +%s ) - $START_TIME )) -gt $DOG_DELAY ]; then
235 echo "SERVERSTART TIMEOUT"
236 echo "SERVERSTART TIMEOUT" >> $SRV_OUT
237 DONE=1
238 fi
239 done
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +0200240 else
Manuel Pégourié-Gonnard74681fa2015-08-04 20:34:39 +0200241 while [ $DONE -eq 0 ]; do
242 if lsof -nbi TCP:"$SRV_PORT" 2>/dev/null | grep LISTEN >/dev/null
243 then
244 DONE=1
245 elif [ $(( $( date +%s ) - $START_TIME )) -gt $DOG_DELAY ]; then
246 echo "SERVERSTART TIMEOUT"
247 echo "SERVERSTART TIMEOUT" >> $SRV_OUT
248 DONE=1
249 fi
250 done
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +0200251 fi
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200252 else
253 sleep "$START_DELAY"
254 fi
255}
256
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200257# wait for client to terminate and set CLI_EXIT
258# must be called right after starting the client
259wait_client_done() {
260 CLI_PID=$!
261
Manuel Pégourié-Gonnarda0719722014-09-20 12:46:27 +0200262 CLI_DELAY=$(( $DOG_DELAY * $CLI_DELAY_FACTOR ))
263 CLI_DELAY_FACTOR=1
264
Manuel Pégourié-Gonnarda365add2015-08-04 20:57:59 +0200265 ( sleep $CLI_DELAY; echo "===CLIENT_TIMEOUT===" >> $CLI_OUT; kill $CLI_PID ) &
Manuel Pégourié-Gonnarda6189f02014-09-20 13:15:43 +0200266 DOG_PID=$!
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200267
268 wait $CLI_PID
269 CLI_EXIT=$?
270
Manuel Pégourié-Gonnarda6189f02014-09-20 13:15:43 +0200271 kill $DOG_PID >/dev/null 2>&1
272 wait $DOG_PID
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200273
274 echo "EXIT: $CLI_EXIT" >> $CLI_OUT
275}
276
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +0200277# check if the given command uses dtls and sets global variable DTLS
278detect_dtls() {
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200279 if echo "$1" | grep 'dtls=1\|-dtls1\|-u' >/dev/null; then
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +0200280 DTLS=1
281 else
282 DTLS=0
283 fi
284}
285
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200286# Usage: run_test name [-p proxy_cmd] srv_cmd cli_cmd cli_exit [option [...]]
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100287# Options: -s pattern pattern that must be present in server output
288# -c pattern pattern that must be present in client output
289# -S pattern pattern that must be absent in server output
290# -C pattern pattern that must be absent in client output
291run_test() {
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100292 NAME="$1"
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200293 shift 1
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100294
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +0100295 if echo "$NAME" | grep "$FILTER" | grep -v "$EXCLUDE" >/dev/null; then :
296 else
Manuel Pégourié-Gonnard74a13782014-10-14 22:34:08 +0200297 SKIP_NEXT="NO"
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +0100298 return
299 fi
300
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100301 print_name "$NAME"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100302
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200303 # should we skip?
304 if [ "X$SKIP_NEXT" = "XYES" ]; then
305 SKIP_NEXT="NO"
306 echo "SKIP"
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200307 SKIPS=$(( $SKIPS + 1 ))
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200308 return
309 fi
310
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200311 # does this test use a proxy?
312 if [ "X$1" = "X-p" ]; then
313 PXY_CMD="$2"
314 shift 2
315 else
316 PXY_CMD=""
317 fi
318
319 # get commands and client output
320 SRV_CMD="$1"
321 CLI_CMD="$2"
322 CLI_EXPECT="$3"
323 shift 3
324
325 # fix client port
326 if [ -n "$PXY_CMD" ]; then
327 CLI_CMD=$( echo "$CLI_CMD" | sed s/+SRV_PORT/$PXY_PORT/g )
328 else
329 CLI_CMD=$( echo "$CLI_CMD" | sed s/+SRV_PORT/$SRV_PORT/g )
330 fi
331
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +0200332 # update DTLS variable
333 detect_dtls "$SRV_CMD"
334
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100335 # prepend valgrind to our commands if active
336 if [ "$MEMCHECK" -gt 0 ]; then
337 if is_polar "$SRV_CMD"; then
338 SRV_CMD="valgrind --leak-check=full $SRV_CMD"
339 fi
340 if is_polar "$CLI_CMD"; then
341 CLI_CMD="valgrind --leak-check=full $CLI_CMD"
342 fi
343 fi
344
Manuel Pégourié-Gonnarda365add2015-08-04 20:57:59 +0200345 TIMES_LEFT=2
346 while [ $TIMES_LEFT -gt 0 ]; do
Manuel Pégourié-Gonnardab5f7b42015-08-04 21:01:37 +0200347 TIMES_LEFT=$(( $TIMES_LEFT - 1 ))
Manuel Pégourié-Gonnarda365add2015-08-04 20:57:59 +0200348
Manuel Pégourié-Gonnardab5f7b42015-08-04 21:01:37 +0200349 # run the commands
350 if [ -n "$PXY_CMD" ]; then
351 echo "$PXY_CMD" > $PXY_OUT
352 $PXY_CMD >> $PXY_OUT 2>&1 &
353 PXY_PID=$!
354 # assume proxy starts faster than server
355 fi
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200356
Manuel Pégourié-Gonnardab5f7b42015-08-04 21:01:37 +0200357 check_osrv_dtls
358 echo "$SRV_CMD" > $SRV_OUT
359 provide_input | $SRV_CMD >> $SRV_OUT 2>&1 &
360 SRV_PID=$!
361 wait_server_start
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200362
Manuel Pégourié-Gonnardab5f7b42015-08-04 21:01:37 +0200363 echo "$CLI_CMD" > $CLI_OUT
364 eval "$CLI_CMD" >> $CLI_OUT 2>&1 &
365 wait_client_done
Manuel Pégourié-Gonnarde01af4c2014-03-25 14:16:44 +0100366
Manuel Pégourié-Gonnardab5f7b42015-08-04 21:01:37 +0200367 # terminate the server (and the proxy)
368 kill $SRV_PID
369 wait $SRV_PID
370 if [ -n "$PXY_CMD" ]; then
371 kill $PXY_PID >/dev/null 2>&1
372 wait $PXY_PID
373 fi
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100374
Manuel Pégourié-Gonnardab5f7b42015-08-04 21:01:37 +0200375 # retry only on timeouts
376 if grep '===CLIENT_TIMEOUT===' $CLI_OUT >/dev/null; then
377 printf "RETRY "
378 else
379 TIMES_LEFT=0
380 fi
Manuel Pégourié-Gonnarda365add2015-08-04 20:57:59 +0200381 done
382
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100383 # check if the client and server went at least to the handshake stage
Paul Bakker1ebc0c52014-05-22 15:47:58 +0200384 # (useful to avoid tests with only negative assertions and non-zero
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100385 # expected client exit to incorrectly succeed in case of catastrophic
386 # failure)
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100387 if is_polar "$SRV_CMD"; then
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200388 if grep "Performing the SSL/TLS handshake" $SRV_OUT >/dev/null; then :;
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100389 else
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100390 fail "server or client failed to reach handshake stage"
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100391 return
392 fi
393 fi
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100394 if is_polar "$CLI_CMD"; then
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200395 if grep "Performing the SSL/TLS handshake" $CLI_OUT >/dev/null; then :;
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100396 else
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100397 fail "server or client failed to reach handshake stage"
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100398 return
399 fi
400 fi
401
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100402 # check server exit code
403 if [ $? != 0 ]; then
404 fail "server fail"
405 return
406 fi
407
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100408 # check client exit code
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100409 if [ \( "$CLI_EXPECT" = 0 -a "$CLI_EXIT" != 0 \) -o \
410 \( "$CLI_EXPECT" != 0 -a "$CLI_EXIT" = 0 \) ]
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100411 then
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200412 fail "bad client exit code (expected $CLI_EXPECT, got $CLI_EXIT)"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100413 return
414 fi
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100415
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100416 # check other assertions
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200417 # lines beginning with == are added by valgrind, ignore them
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100418 while [ $# -gt 0 ]
419 do
420 case $1 in
421 "-s")
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200422 if grep -v '^==' $SRV_OUT | grep "$2" >/dev/null; then :; else
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100423 fail "-s $2"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100424 return
425 fi
426 ;;
427
428 "-c")
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200429 if grep -v '^==' $CLI_OUT | grep "$2" >/dev/null; then :; else
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100430 fail "-c $2"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100431 return
432 fi
433 ;;
434
435 "-S")
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200436 if grep -v '^==' $SRV_OUT | grep "$2" >/dev/null; then
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100437 fail "-S $2"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100438 return
439 fi
440 ;;
441
442 "-C")
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200443 if grep -v '^==' $CLI_OUT | grep "$2" >/dev/null; then
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100444 fail "-C $2"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100445 return
446 fi
447 ;;
448
449 *)
Paul Bakker1ebc0c52014-05-22 15:47:58 +0200450 echo "Unknown test: $1" >&2
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100451 exit 1
452 esac
453 shift 2
454 done
455
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100456 # check valgrind's results
457 if [ "$MEMCHECK" -gt 0 ]; then
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200458 if is_polar "$SRV_CMD" && has_mem_err $SRV_OUT; then
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100459 fail "Server has memory errors"
460 return
461 fi
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200462 if is_polar "$CLI_CMD" && has_mem_err $CLI_OUT; then
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100463 fail "Client has memory errors"
464 return
465 fi
466 fi
467
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100468 # if we're here, everything is ok
469 echo "PASS"
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200470 rm -f $SRV_OUT $CLI_OUT $PXY_OUT
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100471}
472
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100473cleanup() {
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200474 rm -f $CLI_OUT $SRV_OUT $PXY_OUT $SESSION
Manuel Pégourié-Gonnarda6189f02014-09-20 13:15:43 +0200475 test -n "${SRV_PID:-}" && kill $SRV_PID >/dev/null 2>&1
476 test -n "${PXY_PID:-}" && kill $PXY_PID >/dev/null 2>&1
477 test -n "${CLI_PID:-}" && kill $CLI_PID >/dev/null 2>&1
478 test -n "${DOG_PID:-}" && kill $DOG_PID >/dev/null 2>&1
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100479 exit 1
480}
481
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100482#
483# MAIN
484#
485
Manuel Pégourié-Gonnard19db8ea2015-03-10 13:41:04 +0000486if cd $( dirname $0 ); then :; else
487 echo "cd $( dirname $0 ) failed" >&2
488 exit 1
489fi
490
Manuel Pégourié-Gonnard913030c2014-03-28 10:12:38 +0100491get_options "$@"
492
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100493# sanity checks, avoid an avalanche of errors
494if [ ! -x "$P_SRV" ]; then
495 echo "Command '$P_SRV' is not an executable file"
496 exit 1
497fi
498if [ ! -x "$P_CLI" ]; then
499 echo "Command '$P_CLI' is not an executable file"
500 exit 1
501fi
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200502if [ ! -x "$P_PXY" ]; then
503 echo "Command '$P_PXY' is not an executable file"
504 exit 1
505fi
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +0100506if which $OPENSSL_CMD >/dev/null 2>&1; then :; else
507 echo "Command '$OPENSSL_CMD' not found"
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100508 exit 1
509fi
510
Manuel Pégourié-Gonnard32f8f4d2014-05-29 11:31:20 +0200511# used by watchdog
512MAIN_PID="$$"
513
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200514# be more patient with valgrind
515if [ "$MEMCHECK" -gt 0 ]; then
516 START_DELAY=3
517 DOG_DELAY=30
518else
519 START_DELAY=1
520 DOG_DELAY=10
521fi
Manuel Pégourié-Gonnarda0719722014-09-20 12:46:27 +0200522CLI_DELAY_FACTOR=1
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200523
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200524# Pick a "unique" server port in the range 10000-19999, and a proxy port
525PORT_BASE="0000$$"
Manuel Pégourié-Gonnard3a173f42015-01-22 13:30:33 +0000526PORT_BASE="$( printf $PORT_BASE | tail -c 4 )"
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200527SRV_PORT="1$PORT_BASE"
528PXY_PORT="2$PORT_BASE"
529unset PORT_BASE
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +0200530
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +0200531# fix commands to use this port, force IPv4 while at it
Manuel Pégourié-Gonnard0af1ba32015-01-21 11:44:33 +0000532# +SRV_PORT will be replaced by either $SRV_PORT or $PXY_PORT later
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200533P_SRV="$P_SRV server_addr=127.0.0.1 server_port=$SRV_PORT"
534P_CLI="$P_CLI server_addr=127.0.0.1 server_port=+SRV_PORT"
535P_PXY="$P_PXY server_addr=127.0.0.1 server_port=$SRV_PORT listen_addr=127.0.0.1 listen_port=$PXY_PORT"
Manuel Pégourié-Gonnard61957672015-06-18 17:54:58 +0200536O_SRV="$O_SRV -accept $SRV_PORT -dhparam data_files/dhparams.pem"
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200537O_CLI="$O_CLI -connect localhost:+SRV_PORT"
538G_SRV="$G_SRV -p $SRV_PORT"
Manuel Pégourié-Gonnard0af1ba32015-01-21 11:44:33 +0000539G_CLI="$G_CLI -p +SRV_PORT localhost"
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +0200540
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200541# Also pick a unique name for intermediate files
542SRV_OUT="srv_out.$$"
543CLI_OUT="cli_out.$$"
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +0200544PXY_OUT="pxy_out.$$"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200545SESSION="session.$$"
546
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200547SKIP_NEXT="NO"
548
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100549trap cleanup INT TERM HUP
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100550
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200551# Basic test
552
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200553# Checks that:
554# - things work with all ciphersuites active (used with config-full in all.sh)
555# - the expected (highest security) parameters are selected
556# ("signature_algorithm ext: 6" means SHA-512 (highest common hash))
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200557run_test "Default" \
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200558 "$P_SRV debug_level=3" \
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200559 "$P_CLI" \
560 0 \
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200561 -s "Protocol is TLSv1.2" \
562 -s "Ciphersuite is TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \
563 -s "client hello v3, signature_algorithm ext: 6" \
564 -s "ECDHE curve: secp521r1" \
565 -S "error" \
566 -C "error"
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200567
Manuel Pégourié-Gonnard3bb08012015-01-22 13:34:21 +0000568run_test "Default, DTLS" \
569 "$P_SRV dtls=1" \
570 "$P_CLI dtls=1" \
571 0 \
572 -s "Protocol is DTLSv1.2" \
573 -s "Ciphersuite is TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384"
574
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100575# Tests for rc4 option
576
Simon Butcher6eb066e2016-05-19 22:12:18 +0100577requires_config_enabled MBEDTLS_REMOVE_ARC4_CIPHERSUITES
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100578run_test "RC4: server disabled, client enabled" \
579 "$P_SRV" \
580 "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
581 1 \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +0100582 -s "SSL - The server has no ciphersuites in common"
583
Simon Butcher6eb066e2016-05-19 22:12:18 +0100584requires_config_enabled MBEDTLS_REMOVE_ARC4_CIPHERSUITES
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +0100585run_test "RC4: server half, client enabled" \
586 "$P_SRV arc4=1" \
587 "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
588 1 \
589 -s "SSL - The server has no ciphersuites in common"
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100590
591run_test "RC4: server enabled, client disabled" \
592 "$P_SRV force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
593 "$P_CLI" \
594 1 \
595 -s "SSL - The server has no ciphersuites in common"
596
597run_test "RC4: both enabled" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +0100598 "$P_SRV force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100599 "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
600 0 \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100601 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100602 -S "SSL - The server has no ciphersuites in common"
603
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100604# Tests for Truncated HMAC extension
605
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100606run_test "Truncated HMAC: client default, server default" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200607 "$P_SRV debug_level=4" \
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100608 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100609 0 \
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100610 -s "dumping 'computed mac' (20 bytes)" \
611 -S "dumping 'computed mac' (10 bytes)"
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100612
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100613run_test "Truncated HMAC: client disabled, server default" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200614 "$P_SRV debug_level=4" \
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100615 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
616 trunc_hmac=0" \
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100617 0 \
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100618 -s "dumping 'computed mac' (20 bytes)" \
619 -S "dumping 'computed mac' (10 bytes)"
620
621run_test "Truncated HMAC: client enabled, server default" \
622 "$P_SRV debug_level=4" \
623 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
624 trunc_hmac=1" \
625 0 \
Manuel Pégourié-Gonnard662c6e82015-05-06 17:39:23 +0100626 -s "dumping 'computed mac' (20 bytes)" \
627 -S "dumping 'computed mac' (10 bytes)"
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100628
629run_test "Truncated HMAC: client enabled, server disabled" \
630 "$P_SRV debug_level=4 trunc_hmac=0" \
631 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
632 trunc_hmac=1" \
633 0 \
634 -s "dumping 'computed mac' (20 bytes)" \
635 -S "dumping 'computed mac' (10 bytes)"
636
637run_test "Truncated HMAC: client enabled, server enabled" \
638 "$P_SRV debug_level=4 trunc_hmac=1" \
639 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
640 trunc_hmac=1" \
641 0 \
642 -S "dumping 'computed mac' (20 bytes)" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100643 -s "dumping 'computed mac' (10 bytes)"
644
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100645# Tests for Encrypt-then-MAC extension
646
647run_test "Encrypt then MAC: default" \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100648 "$P_SRV debug_level=3 \
649 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100650 "$P_CLI debug_level=3" \
651 0 \
652 -c "client hello, adding encrypt_then_mac extension" \
653 -s "found encrypt then mac extension" \
654 -s "server hello, adding encrypt then mac extension" \
655 -c "found encrypt_then_mac extension" \
656 -c "using encrypt then mac" \
657 -s "using encrypt then mac"
658
659run_test "Encrypt then MAC: client enabled, server disabled" \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100660 "$P_SRV debug_level=3 etm=0 \
661 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100662 "$P_CLI debug_level=3 etm=1" \
663 0 \
664 -c "client hello, adding encrypt_then_mac extension" \
665 -s "found encrypt then mac extension" \
666 -S "server hello, adding encrypt then mac extension" \
667 -C "found encrypt_then_mac extension" \
668 -C "using encrypt then mac" \
669 -S "using encrypt then mac"
670
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +0100671run_test "Encrypt then MAC: client enabled, aead cipher" \
672 "$P_SRV debug_level=3 etm=1 \
673 force_ciphersuite=TLS-RSA-WITH-AES-128-GCM-SHA256" \
674 "$P_CLI debug_level=3 etm=1" \
675 0 \
676 -c "client hello, adding encrypt_then_mac extension" \
677 -s "found encrypt then mac extension" \
678 -S "server hello, adding encrypt then mac extension" \
679 -C "found encrypt_then_mac extension" \
680 -C "using encrypt then mac" \
681 -S "using encrypt then mac"
682
683run_test "Encrypt then MAC: client enabled, stream cipher" \
684 "$P_SRV debug_level=3 etm=1 \
685 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +0100686 "$P_CLI debug_level=3 etm=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +0100687 0 \
688 -c "client hello, adding encrypt_then_mac extension" \
689 -s "found encrypt then mac extension" \
690 -S "server hello, adding encrypt then mac extension" \
691 -C "found encrypt_then_mac extension" \
692 -C "using encrypt then mac" \
693 -S "using encrypt then mac"
694
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100695run_test "Encrypt then MAC: client disabled, server enabled" \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100696 "$P_SRV debug_level=3 etm=1 \
697 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100698 "$P_CLI debug_level=3 etm=0" \
699 0 \
700 -C "client hello, adding encrypt_then_mac extension" \
701 -S "found encrypt then mac extension" \
702 -S "server hello, adding encrypt then mac extension" \
703 -C "found encrypt_then_mac extension" \
704 -C "using encrypt then mac" \
705 -S "using encrypt then mac"
706
Janos Follath542ee5d2016-03-07 15:57:05 +0000707requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100708run_test "Encrypt then MAC: client SSLv3, server enabled" \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100709 "$P_SRV debug_level=3 min_version=ssl3 \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100710 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100711 "$P_CLI debug_level=3 force_version=ssl3" \
712 0 \
713 -C "client hello, adding encrypt_then_mac extension" \
714 -S "found encrypt then mac extension" \
715 -S "server hello, adding encrypt then mac extension" \
716 -C "found encrypt_then_mac extension" \
717 -C "using encrypt then mac" \
718 -S "using encrypt then mac"
719
Janos Follath542ee5d2016-03-07 15:57:05 +0000720requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100721run_test "Encrypt then MAC: client enabled, server SSLv3" \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100722 "$P_SRV debug_level=3 force_version=ssl3 \
723 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100724 "$P_CLI debug_level=3 min_version=ssl3" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100725 0 \
726 -c "client hello, adding encrypt_then_mac extension" \
Janos Follathb700c462016-05-06 13:48:23 +0100727 -S "found encrypt then mac extension" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100728 -S "server hello, adding encrypt then mac extension" \
729 -C "found encrypt_then_mac extension" \
730 -C "using encrypt then mac" \
731 -S "using encrypt then mac"
732
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200733# Tests for Extended Master Secret extension
734
735run_test "Extended Master Secret: default" \
736 "$P_SRV debug_level=3" \
737 "$P_CLI debug_level=3" \
738 0 \
739 -c "client hello, adding extended_master_secret extension" \
740 -s "found extended master secret extension" \
741 -s "server hello, adding extended master secret extension" \
742 -c "found extended_master_secret extension" \
743 -c "using extended master secret" \
744 -s "using extended master secret"
745
746run_test "Extended Master Secret: client enabled, server disabled" \
747 "$P_SRV debug_level=3 extended_ms=0" \
748 "$P_CLI debug_level=3 extended_ms=1" \
749 0 \
750 -c "client hello, adding extended_master_secret extension" \
751 -s "found extended master secret extension" \
752 -S "server hello, adding extended master secret extension" \
753 -C "found extended_master_secret extension" \
754 -C "using extended master secret" \
755 -S "using extended master secret"
756
757run_test "Extended Master Secret: client disabled, server enabled" \
758 "$P_SRV debug_level=3 extended_ms=1" \
759 "$P_CLI debug_level=3 extended_ms=0" \
760 0 \
761 -C "client hello, adding extended_master_secret extension" \
762 -S "found extended master secret extension" \
763 -S "server hello, adding extended master secret extension" \
764 -C "found extended_master_secret extension" \
765 -C "using extended master secret" \
766 -S "using extended master secret"
767
Janos Follath542ee5d2016-03-07 15:57:05 +0000768requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200769run_test "Extended Master Secret: client SSLv3, server enabled" \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100770 "$P_SRV debug_level=3 min_version=ssl3" \
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200771 "$P_CLI debug_level=3 force_version=ssl3" \
772 0 \
773 -C "client hello, adding extended_master_secret extension" \
774 -S "found extended master secret extension" \
775 -S "server hello, adding extended master secret extension" \
776 -C "found extended_master_secret extension" \
777 -C "using extended master secret" \
778 -S "using extended master secret"
779
Janos Follath542ee5d2016-03-07 15:57:05 +0000780requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200781run_test "Extended Master Secret: client enabled, server SSLv3" \
782 "$P_SRV debug_level=3 force_version=ssl3" \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100783 "$P_CLI debug_level=3 min_version=ssl3" \
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200784 0 \
785 -c "client hello, adding extended_master_secret extension" \
Janos Follathb700c462016-05-06 13:48:23 +0100786 -S "found extended master secret extension" \
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200787 -S "server hello, adding extended master secret extension" \
788 -C "found extended_master_secret extension" \
789 -C "using extended master secret" \
790 -S "using extended master secret"
791
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200792# Tests for FALLBACK_SCSV
793
794run_test "Fallback SCSV: default" \
Manuel Pégourié-Gonnard4268ae02015-08-04 12:44:10 +0200795 "$P_SRV debug_level=2" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200796 "$P_CLI debug_level=3 force_version=tls1_1" \
797 0 \
798 -C "adding FALLBACK_SCSV" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200799 -S "received FALLBACK_SCSV" \
800 -S "inapropriate fallback" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200801 -C "is a fatal alert message (msg 86)"
802
803run_test "Fallback SCSV: explicitly disabled" \
Manuel Pégourié-Gonnard4268ae02015-08-04 12:44:10 +0200804 "$P_SRV debug_level=2" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200805 "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \
806 0 \
807 -C "adding FALLBACK_SCSV" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200808 -S "received FALLBACK_SCSV" \
809 -S "inapropriate fallback" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200810 -C "is a fatal alert message (msg 86)"
811
812run_test "Fallback SCSV: enabled" \
Manuel Pégourié-Gonnard4268ae02015-08-04 12:44:10 +0200813 "$P_SRV debug_level=2" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200814 "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200815 1 \
816 -c "adding FALLBACK_SCSV" \
817 -s "received FALLBACK_SCSV" \
818 -s "inapropriate fallback" \
819 -c "is a fatal alert message (msg 86)"
820
821run_test "Fallback SCSV: enabled, max version" \
Manuel Pégourié-Gonnard4268ae02015-08-04 12:44:10 +0200822 "$P_SRV debug_level=2" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200823 "$P_CLI debug_level=3 fallback=1" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200824 0 \
825 -c "adding FALLBACK_SCSV" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200826 -s "received FALLBACK_SCSV" \
827 -S "inapropriate fallback" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200828 -C "is a fatal alert message (msg 86)"
829
830requires_openssl_with_fallback_scsv
831run_test "Fallback SCSV: default, openssl server" \
832 "$O_SRV" \
833 "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \
834 0 \
835 -C "adding FALLBACK_SCSV" \
836 -C "is a fatal alert message (msg 86)"
837
838requires_openssl_with_fallback_scsv
839run_test "Fallback SCSV: enabled, openssl server" \
840 "$O_SRV" \
841 "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \
842 1 \
843 -c "adding FALLBACK_SCSV" \
844 -c "is a fatal alert message (msg 86)"
845
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200846requires_openssl_with_fallback_scsv
847run_test "Fallback SCSV: disabled, openssl client" \
Manuel Pégourié-Gonnard4268ae02015-08-04 12:44:10 +0200848 "$P_SRV debug_level=2" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200849 "$O_CLI -tls1_1" \
850 0 \
851 -S "received FALLBACK_SCSV" \
852 -S "inapropriate fallback"
853
854requires_openssl_with_fallback_scsv
855run_test "Fallback SCSV: enabled, openssl client" \
Manuel Pégourié-Gonnard4268ae02015-08-04 12:44:10 +0200856 "$P_SRV debug_level=2" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200857 "$O_CLI -tls1_1 -fallback_scsv" \
858 1 \
859 -s "received FALLBACK_SCSV" \
860 -s "inapropriate fallback"
861
862requires_openssl_with_fallback_scsv
863run_test "Fallback SCSV: enabled, max version, openssl client" \
Manuel Pégourié-Gonnard4268ae02015-08-04 12:44:10 +0200864 "$P_SRV debug_level=2" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200865 "$O_CLI -fallback_scsv" \
866 0 \
867 -s "received FALLBACK_SCSV" \
868 -S "inapropriate fallback"
869
Manuel Pégourié-Gonnard3ff78232015-01-08 11:15:09 +0100870# Tests for CBC 1/n-1 record splitting
871
872run_test "CBC Record splitting: TLS 1.2, no splitting" \
873 "$P_SRV" \
874 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
875 request_size=123 force_version=tls1_2" \
876 0 \
877 -s "Read from client: 123 bytes read" \
878 -S "Read from client: 1 bytes read" \
879 -S "122 bytes read"
880
881run_test "CBC Record splitting: TLS 1.1, no splitting" \
882 "$P_SRV" \
883 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
884 request_size=123 force_version=tls1_1" \
885 0 \
886 -s "Read from client: 123 bytes read" \
887 -S "Read from client: 1 bytes read" \
888 -S "122 bytes read"
889
890run_test "CBC Record splitting: TLS 1.0, splitting" \
891 "$P_SRV" \
892 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
893 request_size=123 force_version=tls1" \
894 0 \
895 -S "Read from client: 123 bytes read" \
896 -s "Read from client: 1 bytes read" \
897 -s "122 bytes read"
898
Janos Follath542ee5d2016-03-07 15:57:05 +0000899requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard3ff78232015-01-08 11:15:09 +0100900run_test "CBC Record splitting: SSLv3, splitting" \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100901 "$P_SRV min_version=ssl3" \
Manuel Pégourié-Gonnard3ff78232015-01-08 11:15:09 +0100902 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
903 request_size=123 force_version=ssl3" \
904 0 \
905 -S "Read from client: 123 bytes read" \
906 -s "Read from client: 1 bytes read" \
907 -s "122 bytes read"
908
909run_test "CBC Record splitting: TLS 1.0 RC4, no splitting" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +0100910 "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnard3ff78232015-01-08 11:15:09 +0100911 "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
912 request_size=123 force_version=tls1" \
913 0 \
914 -s "Read from client: 123 bytes read" \
915 -S "Read from client: 1 bytes read" \
916 -S "122 bytes read"
917
918run_test "CBC Record splitting: TLS 1.0, splitting disabled" \
919 "$P_SRV" \
920 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
921 request_size=123 force_version=tls1 recsplit=0" \
922 0 \
923 -s "Read from client: 123 bytes read" \
924 -S "Read from client: 1 bytes read" \
925 -S "122 bytes read"
926
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +0100927run_test "CBC Record splitting: TLS 1.0, splitting, nbio" \
928 "$P_SRV nbio=2" \
929 "$P_CLI nbio=2 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
930 request_size=123 force_version=tls1" \
931 0 \
932 -S "Read from client: 123 bytes read" \
933 -s "Read from client: 1 bytes read" \
934 -s "122 bytes read"
935
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100936# Tests for Session Tickets
937
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200938run_test "Session resume using tickets: basic" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200939 "$P_SRV debug_level=3 tickets=1" \
940 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100941 0 \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100942 -c "client hello, adding session ticket extension" \
943 -s "found session ticket extension" \
944 -s "server hello, adding session ticket extension" \
945 -c "found session_ticket extension" \
946 -c "parse new session ticket" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100947 -S "session successfully restored from cache" \
948 -s "session successfully restored from ticket" \
949 -s "a session has been resumed" \
950 -c "a session has been resumed"
951
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200952run_test "Session resume using tickets: cache disabled" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200953 "$P_SRV debug_level=3 tickets=1 cache_max=0" \
954 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnarddbe1ee12014-02-21 09:18:13 +0100955 0 \
956 -c "client hello, adding session ticket extension" \
957 -s "found session ticket extension" \
958 -s "server hello, adding session ticket extension" \
959 -c "found session_ticket extension" \
960 -c "parse new session ticket" \
961 -S "session successfully restored from cache" \
962 -s "session successfully restored from ticket" \
963 -s "a session has been resumed" \
964 -c "a session has been resumed"
965
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200966run_test "Session resume using tickets: timeout" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200967 "$P_SRV debug_level=3 tickets=1 cache_max=0 ticket_timeout=1" \
968 "$P_CLI debug_level=3 tickets=1 reconnect=1 reco_delay=2" \
Manuel Pégourié-Gonnarddbe1ee12014-02-21 09:18:13 +0100969 0 \
970 -c "client hello, adding session ticket extension" \
971 -s "found session ticket extension" \
972 -s "server hello, adding session ticket extension" \
973 -c "found session_ticket extension" \
974 -c "parse new session ticket" \
975 -S "session successfully restored from cache" \
976 -S "session successfully restored from ticket" \
977 -S "a session has been resumed" \
978 -C "a session has been resumed"
979
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200980run_test "Session resume using tickets: openssl server" \
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100981 "$O_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200982 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100983 0 \
984 -c "client hello, adding session ticket extension" \
985 -c "found session_ticket extension" \
986 -c "parse new session ticket" \
987 -c "a session has been resumed"
988
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200989run_test "Session resume using tickets: openssl client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200990 "$P_SRV debug_level=3 tickets=1" \
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200991 "( $O_CLI -sess_out $SESSION; \
992 $O_CLI -sess_in $SESSION; \
993 rm -f $SESSION )" \
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100994 0 \
995 -s "found session ticket extension" \
996 -s "server hello, adding session ticket extension" \
997 -S "session successfully restored from cache" \
998 -s "session successfully restored from ticket" \
999 -s "a session has been resumed"
1000
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +01001001# Tests for Session Resume based on session-ID and cache
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001002
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001003run_test "Session resume using cache: tickets enabled on client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001004 "$P_SRV debug_level=3 tickets=0" \
1005 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +01001006 0 \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +01001007 -c "client hello, adding session ticket extension" \
1008 -s "found session ticket extension" \
1009 -S "server hello, adding session ticket extension" \
1010 -C "found session_ticket extension" \
1011 -C "parse new session ticket" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +01001012 -s "session successfully restored from cache" \
1013 -S "session successfully restored from ticket" \
1014 -s "a session has been resumed" \
1015 -c "a session has been resumed"
1016
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001017run_test "Session resume using cache: tickets enabled on server" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001018 "$P_SRV debug_level=3 tickets=1" \
1019 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +01001020 0 \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +01001021 -C "client hello, adding session ticket extension" \
1022 -S "found session ticket extension" \
1023 -S "server hello, adding session ticket extension" \
1024 -C "found session_ticket extension" \
1025 -C "parse new session ticket" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +01001026 -s "session successfully restored from cache" \
1027 -S "session successfully restored from ticket" \
1028 -s "a session has been resumed" \
1029 -c "a session has been resumed"
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +01001030
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001031run_test "Session resume using cache: cache_max=0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001032 "$P_SRV debug_level=3 tickets=0 cache_max=0" \
1033 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +01001034 0 \
1035 -S "session successfully restored from cache" \
1036 -S "session successfully restored from ticket" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +01001037 -S "a session has been resumed" \
1038 -C "a session has been resumed"
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +01001039
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001040run_test "Session resume using cache: cache_max=1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001041 "$P_SRV debug_level=3 tickets=0 cache_max=1" \
1042 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +01001043 0 \
1044 -s "session successfully restored from cache" \
1045 -S "session successfully restored from ticket" \
1046 -s "a session has been resumed" \
1047 -c "a session has been resumed"
1048
Manuel Pégourié-Gonnard6df31962015-05-04 10:55:47 +02001049run_test "Session resume using cache: timeout > delay" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001050 "$P_SRV debug_level=3 tickets=0" \
1051 "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=0" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +01001052 0 \
1053 -s "session successfully restored from cache" \
1054 -S "session successfully restored from ticket" \
1055 -s "a session has been resumed" \
1056 -c "a session has been resumed"
1057
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001058run_test "Session resume using cache: timeout < delay" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001059 "$P_SRV debug_level=3 tickets=0 cache_timeout=1" \
1060 "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +01001061 0 \
1062 -S "session successfully restored from cache" \
1063 -S "session successfully restored from ticket" \
1064 -S "a session has been resumed" \
1065 -C "a session has been resumed"
1066
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001067run_test "Session resume using cache: no timeout" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001068 "$P_SRV debug_level=3 tickets=0 cache_timeout=0" \
1069 "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +01001070 0 \
1071 -s "session successfully restored from cache" \
1072 -S "session successfully restored from ticket" \
1073 -s "a session has been resumed" \
1074 -c "a session has been resumed"
1075
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001076run_test "Session resume using cache: openssl client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001077 "$P_SRV debug_level=3 tickets=0" \
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001078 "( $O_CLI -sess_out $SESSION; \
1079 $O_CLI -sess_in $SESSION; \
1080 rm -f $SESSION )" \
Manuel Pégourié-Gonnarddb735f62014-02-25 17:57:59 +01001081 0 \
1082 -s "found session ticket extension" \
1083 -S "server hello, adding session ticket extension" \
1084 -s "session successfully restored from cache" \
1085 -S "session successfully restored from ticket" \
1086 -s "a session has been resumed"
1087
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001088run_test "Session resume using cache: openssl server" \
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +01001089 "$O_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001090 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnarddb735f62014-02-25 17:57:59 +01001091 0 \
1092 -C "found session_ticket extension" \
1093 -C "parse new session ticket" \
1094 -c "a session has been resumed"
1095
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001096# Tests for Max Fragment Length extension
1097
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001098run_test "Max fragment length: not used, reference" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001099 "$P_SRV debug_level=3" \
1100 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +01001101 0 \
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02001102 -c "Maximum fragment length is 16384" \
1103 -s "Maximum fragment length is 16384" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +01001104 -C "client hello, adding max_fragment_length extension" \
1105 -S "found max fragment length extension" \
1106 -S "server hello, max_fragment_length extension" \
1107 -C "found max_fragment_length extension"
1108
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001109run_test "Max fragment length: used by client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001110 "$P_SRV debug_level=3" \
1111 "$P_CLI debug_level=3 max_frag_len=4096" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +01001112 0 \
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02001113 -c "Maximum fragment length is 4096" \
1114 -s "Maximum fragment length is 4096" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +01001115 -c "client hello, adding max_fragment_length extension" \
1116 -s "found max fragment length extension" \
1117 -s "server hello, max_fragment_length extension" \
1118 -c "found max_fragment_length extension"
1119
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001120run_test "Max fragment length: used by server" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001121 "$P_SRV debug_level=3 max_frag_len=4096" \
1122 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +01001123 0 \
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02001124 -c "Maximum fragment length is 16384" \
1125 -s "Maximum fragment length is 4096" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +01001126 -C "client hello, adding max_fragment_length extension" \
1127 -S "found max fragment length extension" \
1128 -S "server hello, max_fragment_length extension" \
1129 -C "found max_fragment_length extension"
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001130
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001131requires_gnutls
1132run_test "Max fragment length: gnutls server" \
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +02001133 "$G_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001134 "$P_CLI debug_level=3 max_frag_len=4096" \
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +02001135 0 \
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02001136 -c "Maximum fragment length is 4096" \
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +02001137 -c "client hello, adding max_fragment_length extension" \
1138 -c "found max_fragment_length extension"
1139
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02001140run_test "Max fragment length: client, message just fits" \
1141 "$P_SRV debug_level=3" \
1142 "$P_CLI debug_level=3 max_frag_len=2048 request_size=2048" \
1143 0 \
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02001144 -c "Maximum fragment length is 2048" \
1145 -s "Maximum fragment length is 2048" \
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02001146 -c "client hello, adding max_fragment_length extension" \
1147 -s "found max fragment length extension" \
1148 -s "server hello, max_fragment_length extension" \
1149 -c "found max_fragment_length extension" \
1150 -c "2048 bytes written in 1 fragments" \
1151 -s "2048 bytes read"
1152
1153run_test "Max fragment length: client, larger message" \
1154 "$P_SRV debug_level=3" \
1155 "$P_CLI debug_level=3 max_frag_len=2048 request_size=2345" \
1156 0 \
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02001157 -c "Maximum fragment length is 2048" \
1158 -s "Maximum fragment length is 2048" \
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02001159 -c "client hello, adding max_fragment_length extension" \
1160 -s "found max fragment length extension" \
1161 -s "server hello, max_fragment_length extension" \
1162 -c "found max_fragment_length extension" \
1163 -c "2345 bytes written in 2 fragments" \
1164 -s "2048 bytes read" \
1165 -s "297 bytes read"
1166
Manuel Pégourié-Gonnard23eb74d2015-01-21 14:37:13 +00001167run_test "Max fragment length: DTLS client, larger message" \
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02001168 "$P_SRV debug_level=3 dtls=1" \
1169 "$P_CLI debug_level=3 dtls=1 max_frag_len=2048 request_size=2345" \
1170 1 \
Manuel Pégourié-Gonnarda2cda6b2015-08-31 18:30:52 +02001171 -c "Maximum fragment length is 2048" \
1172 -s "Maximum fragment length is 2048" \
Manuel Pégourié-Gonnard37e08e12014-10-13 17:55:52 +02001173 -c "client hello, adding max_fragment_length extension" \
1174 -s "found max fragment length extension" \
1175 -s "server hello, max_fragment_length extension" \
1176 -c "found max_fragment_length extension" \
1177 -c "fragment larger than.*maximum"
1178
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001179# Tests for renegotiation
1180
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001181run_test "Renegotiation: none, for reference" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001182 "$P_SRV debug_level=3 exchanges=2 auth_mode=optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001183 "$P_CLI debug_level=3 exchanges=2" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001184 0 \
1185 -C "client hello, adding renegotiation extension" \
1186 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1187 -S "found renegotiation extension" \
1188 -s "server hello, secure renegotiation extension" \
1189 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +01001190 -C "=> renegotiate" \
1191 -S "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001192 -S "write hello request"
1193
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001194run_test "Renegotiation: client-initiated" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001195 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001196 "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001197 0 \
1198 -c "client hello, adding renegotiation extension" \
1199 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1200 -s "found renegotiation extension" \
1201 -s "server hello, secure renegotiation extension" \
1202 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +01001203 -c "=> renegotiate" \
1204 -s "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001205 -S "write hello request"
1206
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001207run_test "Renegotiation: server-initiated" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001208 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001209 "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001210 0 \
1211 -c "client hello, adding renegotiation extension" \
1212 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1213 -s "found renegotiation extension" \
1214 -s "server hello, secure renegotiation extension" \
1215 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +01001216 -c "=> renegotiate" \
1217 -s "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001218 -s "write hello request"
1219
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001220run_test "Renegotiation: double" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001221 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001222 "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001223 0 \
1224 -c "client hello, adding renegotiation extension" \
1225 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1226 -s "found renegotiation extension" \
1227 -s "server hello, secure renegotiation extension" \
1228 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +01001229 -c "=> renegotiate" \
1230 -s "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001231 -s "write hello request"
1232
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001233run_test "Renegotiation: client-initiated, server-rejected" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001234 "$P_SRV debug_level=3 exchanges=2 renegotiation=0 auth_mode=optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001235 "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001236 1 \
1237 -c "client hello, adding renegotiation extension" \
1238 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1239 -S "found renegotiation extension" \
1240 -s "server hello, secure renegotiation extension" \
1241 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +01001242 -c "=> renegotiate" \
1243 -S "=> renegotiate" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001244 -S "write hello request" \
Manuel Pégourié-Gonnard65919622014-08-19 12:50:30 +02001245 -c "SSL - Unexpected message at ServerHello in renegotiation" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001246 -c "failed"
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001247
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001248run_test "Renegotiation: server-initiated, client-rejected, default" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001249 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 auth_mode=optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001250 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001251 0 \
1252 -C "client hello, adding renegotiation extension" \
1253 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1254 -S "found renegotiation extension" \
1255 -s "server hello, secure renegotiation extension" \
1256 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +01001257 -C "=> renegotiate" \
1258 -S "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001259 -s "write hello request" \
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02001260 -S "SSL - An unexpected message was received from our peer" \
1261 -S "failed"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01001262
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001263run_test "Renegotiation: server-initiated, client-rejected, not enforced" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001264 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001265 renego_delay=-1 auth_mode=optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001266 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001267 0 \
1268 -C "client hello, adding renegotiation extension" \
1269 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1270 -S "found renegotiation extension" \
1271 -s "server hello, secure renegotiation extension" \
1272 -c "found renegotiation extension" \
1273 -C "=> renegotiate" \
1274 -S "=> renegotiate" \
1275 -s "write hello request" \
1276 -S "SSL - An unexpected message was received from our peer" \
1277 -S "failed"
1278
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02001279# delay 2 for 1 alert record + 1 application data record
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001280run_test "Renegotiation: server-initiated, client-rejected, delay 2" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001281 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001282 renego_delay=2 auth_mode=optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001283 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001284 0 \
1285 -C "client hello, adding renegotiation extension" \
1286 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1287 -S "found renegotiation extension" \
1288 -s "server hello, secure renegotiation extension" \
1289 -c "found renegotiation extension" \
1290 -C "=> renegotiate" \
1291 -S "=> renegotiate" \
1292 -s "write hello request" \
1293 -S "SSL - An unexpected message was received from our peer" \
1294 -S "failed"
1295
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001296run_test "Renegotiation: server-initiated, client-rejected, delay 0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001297 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001298 renego_delay=0 auth_mode=optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001299 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001300 0 \
1301 -C "client hello, adding renegotiation extension" \
1302 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1303 -S "found renegotiation extension" \
1304 -s "server hello, secure renegotiation extension" \
1305 -c "found renegotiation extension" \
1306 -C "=> renegotiate" \
1307 -S "=> renegotiate" \
1308 -s "write hello request" \
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02001309 -s "SSL - An unexpected message was received from our peer"
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001310
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001311run_test "Renegotiation: server-initiated, client-accepted, delay 0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001312 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001313 renego_delay=0 auth_mode=optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001314 "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001315 0 \
1316 -c "client hello, adding renegotiation extension" \
1317 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1318 -s "found renegotiation extension" \
1319 -s "server hello, secure renegotiation extension" \
1320 -c "found renegotiation extension" \
1321 -c "=> renegotiate" \
1322 -s "=> renegotiate" \
1323 -s "write hello request" \
1324 -S "SSL - An unexpected message was received from our peer" \
1325 -S "failed"
1326
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +01001327run_test "Renegotiation: periodic, just below period" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001328 "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +01001329 "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \
1330 0 \
1331 -C "client hello, adding renegotiation extension" \
1332 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1333 -S "found renegotiation extension" \
1334 -s "server hello, secure renegotiation extension" \
1335 -c "found renegotiation extension" \
1336 -S "record counter limit reached: renegotiate" \
1337 -C "=> renegotiate" \
1338 -S "=> renegotiate" \
1339 -S "write hello request" \
1340 -S "SSL - An unexpected message was received from our peer" \
1341 -S "failed"
1342
Manuel Pégourié-Gonnard9835bc02015-01-14 14:41:58 +01001343# one extra exchange to be able to complete renego
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +01001344run_test "Renegotiation: periodic, just above period" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001345 "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \
Manuel Pégourié-Gonnard9835bc02015-01-14 14:41:58 +01001346 "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +01001347 0 \
1348 -c "client hello, adding renegotiation extension" \
1349 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1350 -s "found renegotiation extension" \
1351 -s "server hello, secure renegotiation extension" \
1352 -c "found renegotiation extension" \
1353 -s "record counter limit reached: renegotiate" \
1354 -c "=> renegotiate" \
1355 -s "=> renegotiate" \
1356 -s "write hello request" \
1357 -S "SSL - An unexpected message was received from our peer" \
1358 -S "failed"
1359
1360run_test "Renegotiation: periodic, two times period" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001361 "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \
Manuel Pégourié-Gonnard9835bc02015-01-14 14:41:58 +01001362 "$P_CLI debug_level=3 exchanges=7 renegotiation=1" \
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +01001363 0 \
1364 -c "client hello, adding renegotiation extension" \
1365 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1366 -s "found renegotiation extension" \
1367 -s "server hello, secure renegotiation extension" \
1368 -c "found renegotiation extension" \
1369 -s "record counter limit reached: renegotiate" \
1370 -c "=> renegotiate" \
1371 -s "=> renegotiate" \
1372 -s "write hello request" \
1373 -S "SSL - An unexpected message was received from our peer" \
1374 -S "failed"
1375
1376run_test "Renegotiation: periodic, above period, disabled" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001377 "$P_SRV debug_level=3 exchanges=9 renegotiation=0 renego_period=3 auth_mode=optional" \
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +01001378 "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \
1379 0 \
1380 -C "client hello, adding renegotiation extension" \
1381 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1382 -S "found renegotiation extension" \
1383 -s "server hello, secure renegotiation extension" \
1384 -c "found renegotiation extension" \
1385 -S "record counter limit reached: renegotiate" \
1386 -C "=> renegotiate" \
1387 -S "=> renegotiate" \
1388 -S "write hello request" \
1389 -S "SSL - An unexpected message was received from our peer" \
1390 -S "failed"
1391
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001392run_test "Renegotiation: nbio, client-initiated" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001393 "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 auth_mode=optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001394 "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02001395 0 \
1396 -c "client hello, adding renegotiation extension" \
1397 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1398 -s "found renegotiation extension" \
1399 -s "server hello, secure renegotiation extension" \
1400 -c "found renegotiation extension" \
1401 -c "=> renegotiate" \
1402 -s "=> renegotiate" \
1403 -S "write hello request"
1404
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001405run_test "Renegotiation: nbio, server-initiated" \
Manuel Pégourié-Gonnardfa44f202015-03-27 17:52:25 +01001406 "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1 auth_mode=optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001407 "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1" \
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02001408 0 \
1409 -c "client hello, adding renegotiation extension" \
1410 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1411 -s "found renegotiation extension" \
1412 -s "server hello, secure renegotiation extension" \
1413 -c "found renegotiation extension" \
1414 -c "=> renegotiate" \
1415 -s "=> renegotiate" \
1416 -s "write hello request"
1417
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001418run_test "Renegotiation: openssl server, client-initiated" \
Manuel Pégourié-Gonnarda7756172014-08-31 18:37:01 +02001419 "$O_SRV -www" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001420 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +02001421 0 \
1422 -c "client hello, adding renegotiation extension" \
1423 -c "found renegotiation extension" \
1424 -c "=> renegotiate" \
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001425 -C "ssl_hanshake() returned" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +02001426 -C "error" \
1427 -c "HTTP/1.0 200 [Oo][Kk]"
1428
Paul Bakker539d9722015-02-08 16:18:35 +01001429requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001430run_test "Renegotiation: gnutls server strict, client-initiated" \
1431 "$G_SRV --priority=NORMAL:%SAFE_RENEGOTIATION" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001432 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +02001433 0 \
1434 -c "client hello, adding renegotiation extension" \
1435 -c "found renegotiation extension" \
1436 -c "=> renegotiate" \
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001437 -C "ssl_hanshake() returned" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +02001438 -C "error" \
1439 -c "HTTP/1.0 200 [Oo][Kk]"
1440
Paul Bakker539d9722015-02-08 16:18:35 +01001441requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001442run_test "Renegotiation: gnutls server unsafe, client-initiated default" \
1443 "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1444 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \
1445 1 \
1446 -c "client hello, adding renegotiation extension" \
1447 -C "found renegotiation extension" \
1448 -c "=> renegotiate" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001449 -c "mbedtls_ssl_handshake() returned" \
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001450 -c "error" \
1451 -C "HTTP/1.0 200 [Oo][Kk]"
1452
Paul Bakker539d9722015-02-08 16:18:35 +01001453requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001454run_test "Renegotiation: gnutls server unsafe, client-inititated no legacy" \
1455 "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1456 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \
1457 allow_legacy=0" \
1458 1 \
1459 -c "client hello, adding renegotiation extension" \
1460 -C "found renegotiation extension" \
1461 -c "=> renegotiate" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001462 -c "mbedtls_ssl_handshake() returned" \
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001463 -c "error" \
1464 -C "HTTP/1.0 200 [Oo][Kk]"
1465
Paul Bakker539d9722015-02-08 16:18:35 +01001466requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001467run_test "Renegotiation: gnutls server unsafe, client-inititated legacy" \
1468 "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1469 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \
1470 allow_legacy=1" \
1471 0 \
1472 -c "client hello, adding renegotiation extension" \
1473 -C "found renegotiation extension" \
1474 -c "=> renegotiate" \
1475 -C "ssl_hanshake() returned" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001476 -C "error" \
1477 -c "HTTP/1.0 200 [Oo][Kk]"
1478
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001479run_test "Renegotiation: DTLS, client-initiated" \
1480 "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1" \
1481 "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \
1482 0 \
1483 -c "client hello, adding renegotiation extension" \
1484 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1485 -s "found renegotiation extension" \
1486 -s "server hello, secure renegotiation extension" \
1487 -c "found renegotiation extension" \
1488 -c "=> renegotiate" \
1489 -s "=> renegotiate" \
1490 -S "write hello request"
1491
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02001492run_test "Renegotiation: DTLS, server-initiated" \
1493 "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnarddf9a0a82014-10-02 14:17:18 +02001494 "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1 \
1495 read_timeout=1000 max_resend=2" \
Manuel Pégourié-Gonnardc392b242014-08-19 17:53:11 +02001496 0 \
1497 -c "client hello, adding renegotiation extension" \
1498 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1499 -s "found renegotiation extension" \
1500 -s "server hello, secure renegotiation extension" \
1501 -c "found renegotiation extension" \
1502 -c "=> renegotiate" \
1503 -s "=> renegotiate" \
1504 -s "write hello request"
1505
Manuel Pégourié-Gonnard96999962015-02-17 16:02:37 +00001506requires_gnutls
Manuel Pégourié-Gonnardf1499f62014-08-31 17:13:13 +02001507run_test "Renegotiation: DTLS, gnutls server, client-initiated" \
1508 "$G_SRV -u --mtu 4096" \
1509 "$P_CLI debug_level=3 dtls=1 exchanges=1 renegotiation=1 renegotiate=1" \
1510 0 \
1511 -c "client hello, adding renegotiation extension" \
1512 -c "found renegotiation extension" \
1513 -c "=> renegotiate" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001514 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnardf1499f62014-08-31 17:13:13 +02001515 -C "error" \
1516 -s "Extra-header:"
1517
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001518# Test for the "secure renegotation" extension only (no actual renegotiation)
1519
Paul Bakker539d9722015-02-08 16:18:35 +01001520requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001521run_test "Renego ext: gnutls server strict, client default" \
1522 "$G_SRV --priority=NORMAL:%SAFE_RENEGOTIATION" \
1523 "$P_CLI debug_level=3" \
1524 0 \
1525 -c "found renegotiation extension" \
1526 -C "error" \
1527 -c "HTTP/1.0 200 [Oo][Kk]"
1528
Paul Bakker539d9722015-02-08 16:18:35 +01001529requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001530run_test "Renego ext: gnutls server unsafe, client default" \
1531 "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1532 "$P_CLI debug_level=3" \
1533 0 \
1534 -C "found renegotiation extension" \
1535 -C "error" \
1536 -c "HTTP/1.0 200 [Oo][Kk]"
1537
Paul Bakker539d9722015-02-08 16:18:35 +01001538requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001539run_test "Renego ext: gnutls server unsafe, client break legacy" \
1540 "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1541 "$P_CLI debug_level=3 allow_legacy=-1" \
1542 1 \
1543 -C "found renegotiation extension" \
1544 -c "error" \
1545 -C "HTTP/1.0 200 [Oo][Kk]"
1546
Paul Bakker539d9722015-02-08 16:18:35 +01001547requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001548run_test "Renego ext: gnutls client strict, server default" \
1549 "$P_SRV debug_level=3" \
1550 "$G_CLI --priority=NORMAL:%SAFE_RENEGOTIATION" \
1551 0 \
1552 -s "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \
1553 -s "server hello, secure renegotiation extension"
1554
Paul Bakker539d9722015-02-08 16:18:35 +01001555requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001556run_test "Renego ext: gnutls client unsafe, server default" \
1557 "$P_SRV debug_level=3" \
1558 "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1559 0 \
1560 -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \
1561 -S "server hello, secure renegotiation extension"
1562
Paul Bakker539d9722015-02-08 16:18:35 +01001563requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001564run_test "Renego ext: gnutls client unsafe, server break legacy" \
1565 "$P_SRV debug_level=3 allow_legacy=-1" \
1566 "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1567 1 \
1568 -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \
1569 -S "server hello, secure renegotiation extension"
1570
Janos Follath365b2262016-02-17 10:11:21 +00001571# Tests for silently dropping trailing extra bytes in .der certificates
1572
1573requires_gnutls
1574run_test "DER format: no trailing bytes" \
1575 "$P_SRV crt_file=data_files/server5-der0.crt \
1576 key_file=data_files/server5.key" \
1577 "$G_CLI " \
1578 0 \
1579 -c "Handshake was completed" \
1580
1581requires_gnutls
1582run_test "DER format: with a trailing zero byte" \
1583 "$P_SRV crt_file=data_files/server5-der1a.crt \
1584 key_file=data_files/server5.key" \
1585 "$G_CLI " \
1586 0 \
1587 -c "Handshake was completed" \
1588
1589requires_gnutls
1590run_test "DER format: with a trailing random byte" \
1591 "$P_SRV crt_file=data_files/server5-der1b.crt \
1592 key_file=data_files/server5.key" \
1593 "$G_CLI " \
1594 0 \
1595 -c "Handshake was completed" \
1596
1597requires_gnutls
1598run_test "DER format: with 2 trailing random bytes" \
1599 "$P_SRV crt_file=data_files/server5-der2.crt \
1600 key_file=data_files/server5.key" \
1601 "$G_CLI " \
1602 0 \
1603 -c "Handshake was completed" \
1604
1605requires_gnutls
1606run_test "DER format: with 4 trailing random bytes" \
1607 "$P_SRV crt_file=data_files/server5-der4.crt \
1608 key_file=data_files/server5.key" \
1609 "$G_CLI " \
1610 0 \
1611 -c "Handshake was completed" \
1612
1613requires_gnutls
1614run_test "DER format: with 8 trailing random bytes" \
1615 "$P_SRV crt_file=data_files/server5-der8.crt \
1616 key_file=data_files/server5.key" \
1617 "$G_CLI " \
1618 0 \
1619 -c "Handshake was completed" \
1620
1621requires_gnutls
1622run_test "DER format: with 9 trailing random bytes" \
1623 "$P_SRV crt_file=data_files/server5-der9.crt \
1624 key_file=data_files/server5.key" \
1625 "$G_CLI " \
1626 0 \
1627 -c "Handshake was completed" \
1628
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001629# Tests for auth_mode
1630
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001631run_test "Authentication: server badcert, client required" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001632 "$P_SRV crt_file=data_files/server5-badsign.crt \
1633 key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001634 "$P_CLI debug_level=1 auth_mode=required" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001635 1 \
1636 -c "x509_verify_cert() returned" \
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +01001637 -c "! The certificate is not correctly signed by the trusted CA" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001638 -c "! mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001639 -c "X509 - Certificate verification failed"
1640
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001641run_test "Authentication: server badcert, client optional" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001642 "$P_SRV crt_file=data_files/server5-badsign.crt \
1643 key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001644 "$P_CLI debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001645 0 \
1646 -c "x509_verify_cert() returned" \
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +01001647 -c "! The certificate is not correctly signed by the trusted CA" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001648 -C "! mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001649 -C "X509 - Certificate verification failed"
1650
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001651run_test "Authentication: server badcert, client none" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001652 "$P_SRV crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001653 key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001654 "$P_CLI debug_level=1 auth_mode=none" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001655 0 \
1656 -C "x509_verify_cert() returned" \
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +01001657 -C "! The certificate is not correctly signed by the trusted CA" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001658 -C "! mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001659 -C "X509 - Certificate verification failed"
1660
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001661run_test "Authentication: client badcert, server required" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001662 "$P_SRV debug_level=3 auth_mode=required" \
1663 "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001664 key_file=data_files/server5.key" \
1665 1 \
1666 -S "skip write certificate request" \
1667 -C "skip parse certificate request" \
1668 -c "got a certificate request" \
1669 -C "skip write certificate" \
1670 -C "skip write certificate verify" \
1671 -S "skip parse certificate verify" \
1672 -s "x509_verify_cert() returned" \
Manuel Pégourié-Gonnard6ea831d2015-06-22 16:50:52 +02001673 -s "! The certificate is not correctly signed by the trusted CA" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001674 -s "! mbedtls_ssl_handshake returned" \
1675 -c "! mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001676 -s "X509 - Certificate verification failed"
1677
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001678run_test "Authentication: client badcert, server optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001679 "$P_SRV debug_level=3 auth_mode=optional" \
1680 "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001681 key_file=data_files/server5.key" \
1682 0 \
1683 -S "skip write certificate request" \
1684 -C "skip parse certificate request" \
1685 -c "got a certificate request" \
1686 -C "skip write certificate" \
1687 -C "skip write certificate verify" \
1688 -S "skip parse certificate verify" \
1689 -s "x509_verify_cert() returned" \
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +01001690 -s "! The certificate is not correctly signed by the trusted CA" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001691 -S "! mbedtls_ssl_handshake returned" \
1692 -C "! mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001693 -S "X509 - Certificate verification failed"
1694
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001695run_test "Authentication: client badcert, server none" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001696 "$P_SRV debug_level=3 auth_mode=none" \
1697 "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001698 key_file=data_files/server5.key" \
1699 0 \
1700 -s "skip write certificate request" \
1701 -C "skip parse certificate request" \
1702 -c "got no certificate request" \
1703 -c "skip write certificate" \
1704 -c "skip write certificate verify" \
1705 -s "skip parse certificate verify" \
1706 -S "x509_verify_cert() returned" \
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +01001707 -S "! The certificate is not correctly signed by the trusted CA" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001708 -S "! mbedtls_ssl_handshake returned" \
1709 -C "! mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001710 -S "X509 - Certificate verification failed"
1711
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001712run_test "Authentication: client no cert, server optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001713 "$P_SRV debug_level=3 auth_mode=optional" \
1714 "$P_CLI debug_level=3 crt_file=none key_file=none" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001715 0 \
1716 -S "skip write certificate request" \
1717 -C "skip parse certificate request" \
1718 -c "got a certificate request" \
1719 -C "skip write certificate$" \
1720 -C "got no certificate to send" \
1721 -S "SSLv3 client has no certificate" \
1722 -c "skip write certificate verify" \
1723 -s "skip parse certificate verify" \
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +01001724 -s "! Certificate was missing" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001725 -S "! mbedtls_ssl_handshake returned" \
1726 -C "! mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001727 -S "X509 - Certificate verification failed"
1728
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001729run_test "Authentication: openssl client no cert, server optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001730 "$P_SRV debug_level=3 auth_mode=optional" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001731 "$O_CLI" \
1732 0 \
1733 -S "skip write certificate request" \
1734 -s "skip parse certificate verify" \
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +01001735 -s "! Certificate was missing" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001736 -S "! mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001737 -S "X509 - Certificate verification failed"
1738
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001739run_test "Authentication: client no cert, openssl server optional" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001740 "$O_SRV -verify 10" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001741 "$P_CLI debug_level=3 crt_file=none key_file=none" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001742 0 \
1743 -C "skip parse certificate request" \
1744 -c "got a certificate request" \
1745 -C "skip write certificate$" \
1746 -c "skip write certificate verify" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001747 -C "! mbedtls_ssl_handshake returned"
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001748
Janos Follath542ee5d2016-03-07 15:57:05 +00001749requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001750run_test "Authentication: client no cert, ssl3" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001751 "$P_SRV debug_level=3 auth_mode=optional force_version=ssl3" \
Manuel Pégourié-Gonnard448ea502015-01-12 11:40:14 +01001752 "$P_CLI debug_level=3 crt_file=none key_file=none min_version=ssl3" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001753 0 \
1754 -S "skip write certificate request" \
1755 -C "skip parse certificate request" \
1756 -c "got a certificate request" \
1757 -C "skip write certificate$" \
1758 -c "skip write certificate verify" \
1759 -c "got no certificate to send" \
1760 -s "SSLv3 client has no certificate" \
1761 -s "skip parse certificate verify" \
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +01001762 -s "! Certificate was missing" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001763 -S "! mbedtls_ssl_handshake returned" \
1764 -C "! mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001765 -S "X509 - Certificate verification failed"
1766
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +01001767# Tests for certificate selection based on SHA verson
1768
1769run_test "Certificate hash: client TLS 1.2 -> SHA-2" \
1770 "$P_SRV crt_file=data_files/server5.crt \
1771 key_file=data_files/server5.key \
1772 crt_file2=data_files/server5-sha1.crt \
1773 key_file2=data_files/server5.key" \
1774 "$P_CLI force_version=tls1_2" \
1775 0 \
1776 -c "signed using.*ECDSA with SHA256" \
1777 -C "signed using.*ECDSA with SHA1"
1778
1779run_test "Certificate hash: client TLS 1.1 -> SHA-1" \
1780 "$P_SRV crt_file=data_files/server5.crt \
1781 key_file=data_files/server5.key \
1782 crt_file2=data_files/server5-sha1.crt \
1783 key_file2=data_files/server5.key" \
1784 "$P_CLI force_version=tls1_1" \
1785 0 \
1786 -C "signed using.*ECDSA with SHA256" \
1787 -c "signed using.*ECDSA with SHA1"
1788
1789run_test "Certificate hash: client TLS 1.0 -> SHA-1" \
1790 "$P_SRV crt_file=data_files/server5.crt \
1791 key_file=data_files/server5.key \
1792 crt_file2=data_files/server5-sha1.crt \
1793 key_file2=data_files/server5.key" \
1794 "$P_CLI force_version=tls1" \
1795 0 \
1796 -C "signed using.*ECDSA with SHA256" \
1797 -c "signed using.*ECDSA with SHA1"
1798
1799run_test "Certificate hash: client TLS 1.1, no SHA-1 -> SHA-2 (order 1)" \
1800 "$P_SRV crt_file=data_files/server5.crt \
1801 key_file=data_files/server5.key \
1802 crt_file2=data_files/server6.crt \
1803 key_file2=data_files/server6.key" \
1804 "$P_CLI force_version=tls1_1" \
1805 0 \
1806 -c "serial number.*09" \
1807 -c "signed using.*ECDSA with SHA256" \
1808 -C "signed using.*ECDSA with SHA1"
1809
1810run_test "Certificate hash: client TLS 1.1, no SHA-1 -> SHA-2 (order 2)" \
1811 "$P_SRV crt_file=data_files/server6.crt \
1812 key_file=data_files/server6.key \
1813 crt_file2=data_files/server5.crt \
1814 key_file2=data_files/server5.key" \
1815 "$P_CLI force_version=tls1_1" \
1816 0 \
1817 -c "serial number.*0A" \
1818 -c "signed using.*ECDSA with SHA256" \
1819 -C "signed using.*ECDSA with SHA1"
1820
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001821# tests for SNI
1822
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001823run_test "SNI: no SNI callback" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001824 "$P_SRV debug_level=3 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001825 crt_file=data_files/server5.crt key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001826 "$P_CLI server_name=localhost" \
Manuel Pégourié-Gonnard6ea831d2015-06-22 16:50:52 +02001827 0 \
1828 -S "parse ServerName extension" \
1829 -c "issuer name *: C=NL, O=PolarSSL, CN=Polarssl Test EC CA" \
1830 -c "subject name *: C=NL, O=PolarSSL, CN=localhost"
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001831
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001832run_test "SNI: matching cert 1" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001833 "$P_SRV debug_level=3 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001834 crt_file=data_files/server5.crt key_file=data_files/server5.key \
Manuel Pégourié-Gonnard4d6f1782015-06-19 14:40:39 +02001835 sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001836 "$P_CLI server_name=localhost" \
Manuel Pégourié-Gonnard6ea831d2015-06-22 16:50:52 +02001837 0 \
1838 -s "parse ServerName extension" \
1839 -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \
1840 -c "subject name *: C=NL, O=PolarSSL, CN=localhost"
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001841
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001842run_test "SNI: matching cert 2" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001843 "$P_SRV debug_level=3 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001844 crt_file=data_files/server5.crt key_file=data_files/server5.key \
Manuel Pégourié-Gonnard4d6f1782015-06-19 14:40:39 +02001845 sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001846 "$P_CLI server_name=polarssl.example" \
Manuel Pégourié-Gonnard6ea831d2015-06-22 16:50:52 +02001847 0 \
1848 -s "parse ServerName extension" \
1849 -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \
1850 -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example"
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001851
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001852run_test "SNI: no matching cert" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001853 "$P_SRV debug_level=3 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001854 crt_file=data_files/server5.crt key_file=data_files/server5.key \
Manuel Pégourié-Gonnard4d6f1782015-06-19 14:40:39 +02001855 sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02001856 "$P_CLI server_name=nonesuch.example" \
Manuel Pégourié-Gonnard6ea831d2015-06-22 16:50:52 +02001857 1 \
1858 -s "parse ServerName extension" \
1859 -s "ssl_sni_wrapper() returned" \
1860 -s "mbedtls_ssl_handshake returned" \
1861 -c "mbedtls_ssl_handshake returned" \
1862 -c "SSL - A fatal alert message was received from our peer"
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001863
Manuel Pégourié-Gonnardc948a792015-06-22 16:04:20 +02001864run_test "SNI: client auth no override: optional" \
1865 "$P_SRV debug_level=3 auth_mode=optional \
1866 crt_file=data_files/server5.crt key_file=data_files/server5.key \
1867 sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-" \
1868 "$P_CLI debug_level=3 server_name=localhost" \
Manuel Pégourié-Gonnard6ea831d2015-06-22 16:50:52 +02001869 0 \
Manuel Pégourié-Gonnardc948a792015-06-22 16:04:20 +02001870 -S "skip write certificate request" \
1871 -C "skip parse certificate request" \
1872 -c "got a certificate request" \
1873 -C "skip write certificate" \
1874 -C "skip write certificate verify" \
1875 -S "skip parse certificate verify"
1876
1877run_test "SNI: client auth override: none -> optional" \
1878 "$P_SRV debug_level=3 auth_mode=none \
1879 crt_file=data_files/server5.crt key_file=data_files/server5.key \
1880 sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,optional" \
1881 "$P_CLI debug_level=3 server_name=localhost" \
Manuel Pégourié-Gonnard6ea831d2015-06-22 16:50:52 +02001882 0 \
Manuel Pégourié-Gonnardc948a792015-06-22 16:04:20 +02001883 -S "skip write certificate request" \
1884 -C "skip parse certificate request" \
1885 -c "got a certificate request" \
1886 -C "skip write certificate" \
1887 -C "skip write certificate verify" \
1888 -S "skip parse certificate verify"
1889
1890run_test "SNI: client auth override: optional -> none" \
1891 "$P_SRV debug_level=3 auth_mode=optional \
1892 crt_file=data_files/server5.crt key_file=data_files/server5.key \
1893 sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,none" \
1894 "$P_CLI debug_level=3 server_name=localhost" \
Manuel Pégourié-Gonnard6ea831d2015-06-22 16:50:52 +02001895 0 \
Manuel Pégourié-Gonnardc948a792015-06-22 16:04:20 +02001896 -s "skip write certificate request" \
1897 -C "skip parse certificate request" \
1898 -c "got no certificate request" \
1899 -c "skip write certificate" \
1900 -c "skip write certificate verify" \
1901 -s "skip parse certificate verify"
1902
Manuel Pégourié-Gonnard6ea831d2015-06-22 16:50:52 +02001903run_test "SNI: CA no override" \
1904 "$P_SRV debug_level=3 auth_mode=optional \
1905 crt_file=data_files/server5.crt key_file=data_files/server5.key \
1906 ca_file=data_files/test-ca.crt \
1907 sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,required" \
1908 "$P_CLI debug_level=3 server_name=localhost \
1909 crt_file=data_files/server6.crt key_file=data_files/server6.key" \
1910 1 \
1911 -S "skip write certificate request" \
1912 -C "skip parse certificate request" \
1913 -c "got a certificate request" \
1914 -C "skip write certificate" \
1915 -C "skip write certificate verify" \
1916 -S "skip parse certificate verify" \
1917 -s "x509_verify_cert() returned" \
1918 -s "! The certificate is not correctly signed by the trusted CA" \
1919 -S "The certificate has been revoked (is on a CRL)"
1920
1921run_test "SNI: CA override" \
1922 "$P_SRV debug_level=3 auth_mode=optional \
1923 crt_file=data_files/server5.crt key_file=data_files/server5.key \
1924 ca_file=data_files/test-ca.crt \
1925 sni=localhost,data_files/server2.crt,data_files/server2.key,data_files/test-ca2.crt,-,required" \
1926 "$P_CLI debug_level=3 server_name=localhost \
1927 crt_file=data_files/server6.crt key_file=data_files/server6.key" \
1928 0 \
1929 -S "skip write certificate request" \
1930 -C "skip parse certificate request" \
1931 -c "got a certificate request" \
1932 -C "skip write certificate" \
1933 -C "skip write certificate verify" \
1934 -S "skip parse certificate verify" \
1935 -S "x509_verify_cert() returned" \
1936 -S "! The certificate is not correctly signed by the trusted CA" \
1937 -S "The certificate has been revoked (is on a CRL)"
1938
1939run_test "SNI: CA override with CRL" \
1940 "$P_SRV debug_level=3 auth_mode=optional \
1941 crt_file=data_files/server5.crt key_file=data_files/server5.key \
1942 ca_file=data_files/test-ca.crt \
1943 sni=localhost,data_files/server2.crt,data_files/server2.key,data_files/test-ca2.crt,data_files/crl-ec-sha256.pem,required" \
1944 "$P_CLI debug_level=3 server_name=localhost \
1945 crt_file=data_files/server6.crt key_file=data_files/server6.key" \
1946 1 \
1947 -S "skip write certificate request" \
1948 -C "skip parse certificate request" \
1949 -c "got a certificate request" \
1950 -C "skip write certificate" \
1951 -C "skip write certificate verify" \
1952 -S "skip parse certificate verify" \
1953 -s "x509_verify_cert() returned" \
1954 -S "! The certificate is not correctly signed by the trusted CA" \
1955 -s "The certificate has been revoked (is on a CRL)"
1956
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001957# Tests for non-blocking I/O: exercise a variety of handshake flows
1958
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001959run_test "Non-blocking I/O: basic handshake" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001960 "$P_SRV nbio=2 tickets=0 auth_mode=none" \
1961 "$P_CLI nbio=2 tickets=0" \
1962 0 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001963 -S "mbedtls_ssl_handshake returned" \
1964 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001965 -c "Read from server: .* bytes read"
1966
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001967run_test "Non-blocking I/O: client auth" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001968 "$P_SRV nbio=2 tickets=0 auth_mode=required" \
1969 "$P_CLI nbio=2 tickets=0" \
1970 0 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001971 -S "mbedtls_ssl_handshake returned" \
1972 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001973 -c "Read from server: .* bytes read"
1974
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001975run_test "Non-blocking I/O: ticket" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001976 "$P_SRV nbio=2 tickets=1 auth_mode=none" \
1977 "$P_CLI nbio=2 tickets=1" \
1978 0 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001979 -S "mbedtls_ssl_handshake returned" \
1980 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001981 -c "Read from server: .* bytes read"
1982
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001983run_test "Non-blocking I/O: ticket + client auth" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001984 "$P_SRV nbio=2 tickets=1 auth_mode=required" \
1985 "$P_CLI nbio=2 tickets=1" \
1986 0 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001987 -S "mbedtls_ssl_handshake returned" \
1988 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001989 -c "Read from server: .* bytes read"
1990
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001991run_test "Non-blocking I/O: ticket + client auth + resume" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001992 "$P_SRV nbio=2 tickets=1 auth_mode=required" \
1993 "$P_CLI nbio=2 tickets=1 reconnect=1" \
1994 0 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001995 -S "mbedtls_ssl_handshake returned" \
1996 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001997 -c "Read from server: .* bytes read"
1998
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001999run_test "Non-blocking I/O: ticket + resume" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01002000 "$P_SRV nbio=2 tickets=1 auth_mode=none" \
2001 "$P_CLI nbio=2 tickets=1 reconnect=1" \
2002 0 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002003 -S "mbedtls_ssl_handshake returned" \
2004 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01002005 -c "Read from server: .* bytes read"
2006
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002007run_test "Non-blocking I/O: session-id resume" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01002008 "$P_SRV nbio=2 tickets=0 auth_mode=none" \
2009 "$P_CLI nbio=2 tickets=0 reconnect=1" \
2010 0 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002011 -S "mbedtls_ssl_handshake returned" \
2012 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01002013 -c "Read from server: .* bytes read"
2014
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02002015# Tests for version negotiation
2016
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002017run_test "Version check: all -> 1.2" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002018 "$P_SRV" \
2019 "$P_CLI" \
2020 0 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002021 -S "mbedtls_ssl_handshake returned" \
2022 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002023 -s "Protocol is TLSv1.2" \
2024 -c "Protocol is TLSv1.2"
2025
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002026run_test "Version check: cli max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002027 "$P_SRV" \
2028 "$P_CLI max_version=tls1_1" \
2029 0 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002030 -S "mbedtls_ssl_handshake returned" \
2031 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002032 -s "Protocol is TLSv1.1" \
2033 -c "Protocol is TLSv1.1"
2034
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002035run_test "Version check: srv max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002036 "$P_SRV max_version=tls1_1" \
2037 "$P_CLI" \
2038 0 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002039 -S "mbedtls_ssl_handshake returned" \
2040 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002041 -s "Protocol is TLSv1.1" \
2042 -c "Protocol is TLSv1.1"
2043
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002044run_test "Version check: cli+srv max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002045 "$P_SRV max_version=tls1_1" \
2046 "$P_CLI max_version=tls1_1" \
2047 0 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002048 -S "mbedtls_ssl_handshake returned" \
2049 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002050 -s "Protocol is TLSv1.1" \
2051 -c "Protocol is TLSv1.1"
2052
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002053run_test "Version check: cli max 1.1, srv min 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002054 "$P_SRV min_version=tls1_1" \
2055 "$P_CLI max_version=tls1_1" \
2056 0 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002057 -S "mbedtls_ssl_handshake returned" \
2058 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002059 -s "Protocol is TLSv1.1" \
2060 -c "Protocol is TLSv1.1"
2061
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002062run_test "Version check: cli min 1.1, srv max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002063 "$P_SRV max_version=tls1_1" \
2064 "$P_CLI min_version=tls1_1" \
2065 0 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002066 -S "mbedtls_ssl_handshake returned" \
2067 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002068 -s "Protocol is TLSv1.1" \
2069 -c "Protocol is TLSv1.1"
2070
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002071run_test "Version check: cli min 1.2, srv max 1.1 -> fail" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002072 "$P_SRV max_version=tls1_1" \
2073 "$P_CLI min_version=tls1_2" \
2074 1 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002075 -s "mbedtls_ssl_handshake returned" \
2076 -c "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002077 -c "SSL - Handshake protocol not within min/max boundaries"
2078
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002079run_test "Version check: srv min 1.2, cli max 1.1 -> fail" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002080 "$P_SRV min_version=tls1_2" \
2081 "$P_CLI max_version=tls1_1" \
2082 1 \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002083 -s "mbedtls_ssl_handshake returned" \
2084 -c "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01002085 -s "SSL - Handshake protocol not within min/max boundaries"
2086
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02002087# Tests for ALPN extension
2088
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002089run_test "ALPN: none" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002090 "$P_SRV debug_level=3" \
2091 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02002092 0 \
2093 -C "client hello, adding alpn extension" \
2094 -S "found alpn extension" \
2095 -C "got an alert message, type: \\[2:120]" \
2096 -S "server hello, adding alpn extension" \
2097 -C "found alpn extension " \
2098 -C "Application Layer Protocol is" \
2099 -S "Application Layer Protocol is"
2100
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002101run_test "ALPN: client only" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002102 "$P_SRV debug_level=3" \
2103 "$P_CLI debug_level=3 alpn=abc,1234" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02002104 0 \
2105 -c "client hello, adding alpn extension" \
2106 -s "found alpn extension" \
2107 -C "got an alert message, type: \\[2:120]" \
2108 -S "server hello, adding alpn extension" \
2109 -C "found alpn extension " \
2110 -c "Application Layer Protocol is (none)" \
2111 -S "Application Layer Protocol is"
2112
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002113run_test "ALPN: server only" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002114 "$P_SRV debug_level=3 alpn=abc,1234" \
2115 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02002116 0 \
2117 -C "client hello, adding alpn extension" \
2118 -S "found alpn extension" \
2119 -C "got an alert message, type: \\[2:120]" \
2120 -S "server hello, adding alpn extension" \
2121 -C "found alpn extension " \
2122 -C "Application Layer Protocol is" \
2123 -s "Application Layer Protocol is (none)"
2124
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002125run_test "ALPN: both, common cli1-srv1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002126 "$P_SRV debug_level=3 alpn=abc,1234" \
2127 "$P_CLI debug_level=3 alpn=abc,1234" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02002128 0 \
2129 -c "client hello, adding alpn extension" \
2130 -s "found alpn extension" \
2131 -C "got an alert message, type: \\[2:120]" \
2132 -s "server hello, adding alpn extension" \
2133 -c "found alpn extension" \
2134 -c "Application Layer Protocol is abc" \
2135 -s "Application Layer Protocol is abc"
2136
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002137run_test "ALPN: both, common cli2-srv1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002138 "$P_SRV debug_level=3 alpn=abc,1234" \
2139 "$P_CLI debug_level=3 alpn=1234,abc" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02002140 0 \
2141 -c "client hello, adding alpn extension" \
2142 -s "found alpn extension" \
2143 -C "got an alert message, type: \\[2:120]" \
2144 -s "server hello, adding alpn extension" \
2145 -c "found alpn extension" \
2146 -c "Application Layer Protocol is abc" \
2147 -s "Application Layer Protocol is abc"
2148
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002149run_test "ALPN: both, common cli1-srv2" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002150 "$P_SRV debug_level=3 alpn=abc,1234" \
2151 "$P_CLI debug_level=3 alpn=1234,abcde" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02002152 0 \
2153 -c "client hello, adding alpn extension" \
2154 -s "found alpn extension" \
2155 -C "got an alert message, type: \\[2:120]" \
2156 -s "server hello, adding alpn extension" \
2157 -c "found alpn extension" \
2158 -c "Application Layer Protocol is 1234" \
2159 -s "Application Layer Protocol is 1234"
2160
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002161run_test "ALPN: both, no common" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002162 "$P_SRV debug_level=3 alpn=abc,123" \
2163 "$P_CLI debug_level=3 alpn=1234,abcde" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02002164 1 \
2165 -c "client hello, adding alpn extension" \
2166 -s "found alpn extension" \
2167 -c "got an alert message, type: \\[2:120]" \
2168 -S "server hello, adding alpn extension" \
2169 -C "found alpn extension" \
2170 -C "Application Layer Protocol is 1234" \
2171 -S "Application Layer Protocol is 1234"
2172
Manuel Pégourié-Gonnard83d8c732014-04-07 13:24:21 +02002173
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002174# Tests for keyUsage in leaf certificates, part 1:
2175# server-side certificate/suite selection
2176
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002177run_test "keyUsage srv: RSA, digitalSignature -> (EC)DHE-RSA" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002178 "$P_SRV key_file=data_files/server2.key \
2179 crt_file=data_files/server2.ku-ds.crt" \
2180 "$P_CLI" \
2181 0 \
Manuel Pégourié-Gonnard17cde5f2014-05-22 14:42:39 +02002182 -c "Ciphersuite is TLS-[EC]*DHE-RSA-WITH-"
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002183
2184
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002185run_test "keyUsage srv: RSA, keyEncipherment -> RSA" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002186 "$P_SRV key_file=data_files/server2.key \
2187 crt_file=data_files/server2.ku-ke.crt" \
2188 "$P_CLI" \
2189 0 \
2190 -c "Ciphersuite is TLS-RSA-WITH-"
2191
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002192run_test "keyUsage srv: RSA, keyAgreement -> fail" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02002193 "$P_SRV key_file=data_files/server2.key \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002194 crt_file=data_files/server2.ku-ka.crt" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02002195 "$P_CLI" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002196 1 \
2197 -C "Ciphersuite is "
2198
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002199run_test "keyUsage srv: ECDSA, digitalSignature -> ECDHE-ECDSA" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002200 "$P_SRV key_file=data_files/server5.key \
2201 crt_file=data_files/server5.ku-ds.crt" \
2202 "$P_CLI" \
2203 0 \
2204 -c "Ciphersuite is TLS-ECDHE-ECDSA-WITH-"
2205
2206
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002207run_test "keyUsage srv: ECDSA, keyAgreement -> ECDH-" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002208 "$P_SRV key_file=data_files/server5.key \
2209 crt_file=data_files/server5.ku-ka.crt" \
2210 "$P_CLI" \
2211 0 \
2212 -c "Ciphersuite is TLS-ECDH-"
2213
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002214run_test "keyUsage srv: ECDSA, keyEncipherment -> fail" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02002215 "$P_SRV key_file=data_files/server5.key \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002216 crt_file=data_files/server5.ku-ke.crt" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02002217 "$P_CLI" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002218 1 \
2219 -C "Ciphersuite is "
2220
2221# Tests for keyUsage in leaf certificates, part 2:
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002222# client-side checking of server cert
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002223
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002224run_test "keyUsage cli: DigitalSignature+KeyEncipherment, RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002225 "$O_SRV -key data_files/server2.key \
2226 -cert data_files/server2.ku-ds_ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002227 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002228 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
2229 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002230 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002231 -C "Processing of the Certificate handshake message failed" \
2232 -c "Ciphersuite is TLS-"
2233
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002234run_test "keyUsage cli: DigitalSignature+KeyEncipherment, DHE-RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002235 "$O_SRV -key data_files/server2.key \
2236 -cert data_files/server2.ku-ds_ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002237 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002238 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
2239 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002240 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002241 -C "Processing of the Certificate handshake message failed" \
2242 -c "Ciphersuite is TLS-"
2243
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002244run_test "keyUsage cli: KeyEncipherment, RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002245 "$O_SRV -key data_files/server2.key \
2246 -cert data_files/server2.ku-ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002247 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002248 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
2249 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002250 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002251 -C "Processing of the Certificate handshake message failed" \
2252 -c "Ciphersuite is TLS-"
2253
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002254run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002255 "$O_SRV -key data_files/server2.key \
2256 -cert data_files/server2.ku-ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002257 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002258 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
2259 1 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002260 -c "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002261 -c "Processing of the Certificate handshake message failed" \
2262 -C "Ciphersuite is TLS-"
2263
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01002264run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail, soft" \
2265 "$O_SRV -key data_files/server2.key \
2266 -cert data_files/server2.ku-ke.crt" \
2267 "$P_CLI debug_level=1 auth_mode=optional \
2268 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
2269 0 \
2270 -c "bad certificate (usage extensions)" \
2271 -C "Processing of the Certificate handshake message failed" \
2272 -c "Ciphersuite is TLS-" \
2273 -c "! Usage does not match the keyUsage extension"
2274
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002275run_test "keyUsage cli: DigitalSignature, DHE-RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002276 "$O_SRV -key data_files/server2.key \
2277 -cert data_files/server2.ku-ds.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002278 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002279 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
2280 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002281 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002282 -C "Processing of the Certificate handshake message failed" \
2283 -c "Ciphersuite is TLS-"
2284
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002285run_test "keyUsage cli: DigitalSignature, RSA: fail" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002286 "$O_SRV -key data_files/server2.key \
2287 -cert data_files/server2.ku-ds.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002288 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002289 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
2290 1 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002291 -c "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002292 -c "Processing of the Certificate handshake message failed" \
2293 -C "Ciphersuite is TLS-"
2294
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +01002295run_test "keyUsage cli: DigitalSignature, RSA: fail, soft" \
2296 "$O_SRV -key data_files/server2.key \
2297 -cert data_files/server2.ku-ds.crt" \
2298 "$P_CLI debug_level=1 auth_mode=optional \
2299 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
2300 0 \
2301 -c "bad certificate (usage extensions)" \
2302 -C "Processing of the Certificate handshake message failed" \
2303 -c "Ciphersuite is TLS-" \
2304 -c "! Usage does not match the keyUsage extension"
2305
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002306# Tests for keyUsage in leaf certificates, part 3:
2307# server-side checking of client cert
2308
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002309run_test "keyUsage cli-auth: RSA, DigitalSignature: OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002310 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002311 "$O_CLI -key data_files/server2.key \
2312 -cert data_files/server2.ku-ds.crt" \
2313 0 \
2314 -S "bad certificate (usage extensions)" \
2315 -S "Processing of the Certificate handshake message failed"
2316
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002317run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (soft)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002318 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002319 "$O_CLI -key data_files/server2.key \
2320 -cert data_files/server2.ku-ke.crt" \
2321 0 \
2322 -s "bad certificate (usage extensions)" \
2323 -S "Processing of the Certificate handshake message failed"
2324
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002325run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (hard)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002326 "$P_SRV debug_level=1 auth_mode=required" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002327 "$O_CLI -key data_files/server2.key \
2328 -cert data_files/server2.ku-ke.crt" \
2329 1 \
2330 -s "bad certificate (usage extensions)" \
2331 -s "Processing of the Certificate handshake message failed"
2332
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002333run_test "keyUsage cli-auth: ECDSA, DigitalSignature: OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002334 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002335 "$O_CLI -key data_files/server5.key \
2336 -cert data_files/server5.ku-ds.crt" \
2337 0 \
2338 -S "bad certificate (usage extensions)" \
2339 -S "Processing of the Certificate handshake message failed"
2340
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002341run_test "keyUsage cli-auth: ECDSA, KeyAgreement: fail (soft)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002342 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002343 "$O_CLI -key data_files/server5.key \
2344 -cert data_files/server5.ku-ka.crt" \
2345 0 \
2346 -s "bad certificate (usage extensions)" \
2347 -S "Processing of the Certificate handshake message failed"
2348
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002349# Tests for extendedKeyUsage, part 1: server-side certificate/suite selection
2350
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002351run_test "extKeyUsage srv: serverAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002352 "$P_SRV key_file=data_files/server5.key \
2353 crt_file=data_files/server5.eku-srv.crt" \
2354 "$P_CLI" \
2355 0
2356
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002357run_test "extKeyUsage srv: serverAuth,clientAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002358 "$P_SRV key_file=data_files/server5.key \
2359 crt_file=data_files/server5.eku-srv.crt" \
2360 "$P_CLI" \
2361 0
2362
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002363run_test "extKeyUsage srv: codeSign,anyEKU -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002364 "$P_SRV key_file=data_files/server5.key \
2365 crt_file=data_files/server5.eku-cs_any.crt" \
2366 "$P_CLI" \
2367 0
2368
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002369run_test "extKeyUsage srv: codeSign -> fail" \
Manuel Pégourié-Gonnard7eb58cb2015-07-07 11:54:14 +02002370 "$P_SRV key_file=data_files/server5.key \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002371 crt_file=data_files/server5.eku-cli.crt" \
Manuel Pégourié-Gonnard7eb58cb2015-07-07 11:54:14 +02002372 "$P_CLI" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002373 1
2374
2375# Tests for extendedKeyUsage, part 2: client-side checking of server cert
2376
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002377run_test "extKeyUsage cli: serverAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002378 "$O_SRV -key data_files/server5.key \
2379 -cert data_files/server5.eku-srv.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002380 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002381 0 \
2382 -C "bad certificate (usage extensions)" \
2383 -C "Processing of the Certificate handshake message failed" \
2384 -c "Ciphersuite is TLS-"
2385
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002386run_test "extKeyUsage cli: serverAuth,clientAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002387 "$O_SRV -key data_files/server5.key \
2388 -cert data_files/server5.eku-srv_cli.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002389 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002390 0 \
2391 -C "bad certificate (usage extensions)" \
2392 -C "Processing of the Certificate handshake message failed" \
2393 -c "Ciphersuite is TLS-"
2394
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002395run_test "extKeyUsage cli: codeSign,anyEKU -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002396 "$O_SRV -key data_files/server5.key \
2397 -cert data_files/server5.eku-cs_any.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002398 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002399 0 \
2400 -C "bad certificate (usage extensions)" \
2401 -C "Processing of the Certificate handshake message failed" \
2402 -c "Ciphersuite is TLS-"
2403
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002404run_test "extKeyUsage cli: codeSign -> fail" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002405 "$O_SRV -key data_files/server5.key \
2406 -cert data_files/server5.eku-cs.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002407 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002408 1 \
2409 -c "bad certificate (usage extensions)" \
2410 -c "Processing of the Certificate handshake message failed" \
2411 -C "Ciphersuite is TLS-"
2412
2413# Tests for extendedKeyUsage, part 3: server-side checking of client cert
2414
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002415run_test "extKeyUsage cli-auth: clientAuth -> OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002416 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002417 "$O_CLI -key data_files/server5.key \
2418 -cert data_files/server5.eku-cli.crt" \
2419 0 \
2420 -S "bad certificate (usage extensions)" \
2421 -S "Processing of the Certificate handshake message failed"
2422
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002423run_test "extKeyUsage cli-auth: serverAuth,clientAuth -> OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002424 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002425 "$O_CLI -key data_files/server5.key \
2426 -cert data_files/server5.eku-srv_cli.crt" \
2427 0 \
2428 -S "bad certificate (usage extensions)" \
2429 -S "Processing of the Certificate handshake message failed"
2430
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002431run_test "extKeyUsage cli-auth: codeSign,anyEKU -> OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002432 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002433 "$O_CLI -key data_files/server5.key \
2434 -cert data_files/server5.eku-cs_any.crt" \
2435 0 \
2436 -S "bad certificate (usage extensions)" \
2437 -S "Processing of the Certificate handshake message failed"
2438
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002439run_test "extKeyUsage cli-auth: codeSign -> fail (soft)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002440 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002441 "$O_CLI -key data_files/server5.key \
2442 -cert data_files/server5.eku-cs.crt" \
2443 0 \
2444 -s "bad certificate (usage extensions)" \
2445 -S "Processing of the Certificate handshake message failed"
2446
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002447run_test "extKeyUsage cli-auth: codeSign -> fail (hard)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002448 "$P_SRV debug_level=1 auth_mode=required" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002449 "$O_CLI -key data_files/server5.key \
2450 -cert data_files/server5.eku-cs.crt" \
2451 1 \
2452 -s "bad certificate (usage extensions)" \
2453 -s "Processing of the Certificate handshake message failed"
2454
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02002455# Tests for DHM parameters loading
2456
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002457run_test "DHM parameters: reference" \
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02002458 "$P_SRV" \
2459 "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
2460 debug_level=3" \
2461 0 \
2462 -c "value of 'DHM: P ' (2048 bits)" \
2463 -c "value of 'DHM: G ' (2048 bits)"
2464
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002465run_test "DHM parameters: other parameters" \
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02002466 "$P_SRV dhm_file=data_files/dhparams.pem" \
2467 "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
2468 debug_level=3" \
2469 0 \
2470 -c "value of 'DHM: P ' (1024 bits)" \
2471 -c "value of 'DHM: G ' (2 bits)"
2472
Manuel Pégourié-Gonnard7a010aa2015-06-12 11:19:10 +02002473# Tests for DHM client-side size checking
2474
2475run_test "DHM size: server default, client default, OK" \
2476 "$P_SRV" \
2477 "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
2478 debug_level=1" \
2479 0 \
2480 -C "DHM prime too short:"
2481
2482run_test "DHM size: server default, client 2048, OK" \
2483 "$P_SRV" \
2484 "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
2485 debug_level=1 dhmlen=2048" \
2486 0 \
2487 -C "DHM prime too short:"
2488
2489run_test "DHM size: server 1024, client default, OK" \
2490 "$P_SRV dhm_file=data_files/dhparams.pem" \
2491 "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
2492 debug_level=1" \
2493 0 \
2494 -C "DHM prime too short:"
2495
2496run_test "DHM size: server 1000, client default, rejected" \
2497 "$P_SRV dhm_file=data_files/dh.1000.pem" \
2498 "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
2499 debug_level=1" \
2500 1 \
2501 -c "DHM prime too short:"
2502
2503run_test "DHM size: server default, client 2049, rejected" \
2504 "$P_SRV" \
2505 "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
2506 debug_level=1 dhmlen=2049" \
2507 1 \
2508 -c "DHM prime too short:"
2509
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002510# Tests for PSK callback
2511
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002512run_test "PSK callback: psk, no callback" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002513 "$P_SRV psk=abc123 psk_identity=foo" \
2514 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2515 psk_identity=foo psk=abc123" \
2516 0 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002517 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02002518 -S "SSL - Unknown identity received" \
2519 -S "SSL - Verification of the message MAC failed"
2520
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002521run_test "PSK callback: no psk, no callback" \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02002522 "$P_SRV" \
2523 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2524 psk_identity=foo psk=abc123" \
2525 1 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002526 -s "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002527 -S "SSL - Unknown identity received" \
2528 -S "SSL - Verification of the message MAC failed"
2529
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002530run_test "PSK callback: callback overrides other settings" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002531 "$P_SRV psk=abc123 psk_identity=foo psk_list=abc,dead,def,beef" \
2532 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2533 psk_identity=foo psk=abc123" \
2534 1 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002535 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002536 -s "SSL - Unknown identity received" \
2537 -S "SSL - Verification of the message MAC failed"
2538
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002539run_test "PSK callback: first id matches" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002540 "$P_SRV psk_list=abc,dead,def,beef" \
2541 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2542 psk_identity=abc psk=dead" \
2543 0 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002544 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002545 -S "SSL - Unknown identity received" \
2546 -S "SSL - Verification of the message MAC failed"
2547
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002548run_test "PSK callback: second id matches" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002549 "$P_SRV psk_list=abc,dead,def,beef" \
2550 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2551 psk_identity=def psk=beef" \
2552 0 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002553 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002554 -S "SSL - Unknown identity received" \
2555 -S "SSL - Verification of the message MAC failed"
2556
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002557run_test "PSK callback: no match" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002558 "$P_SRV psk_list=abc,dead,def,beef" \
2559 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2560 psk_identity=ghi psk=beef" \
2561 1 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002562 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002563 -s "SSL - Unknown identity received" \
2564 -S "SSL - Verification of the message MAC failed"
2565
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002566run_test "PSK callback: wrong key" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002567 "$P_SRV psk_list=abc,dead,def,beef" \
2568 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2569 psk_identity=abc psk=beef" \
2570 1 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002571 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002572 -S "SSL - Unknown identity received" \
2573 -s "SSL - Verification of the message MAC failed"
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02002574
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02002575# Tests for ciphersuites per version
2576
Janos Follath542ee5d2016-03-07 15:57:05 +00002577requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002578run_test "Per-version suites: SSL3" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002579 "$P_SRV min_version=ssl3 version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-AES-256-CBC-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02002580 "$P_CLI force_version=ssl3" \
2581 0 \
2582 -c "Ciphersuite is TLS-RSA-WITH-3DES-EDE-CBC-SHA"
2583
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002584run_test "Per-version suites: TLS 1.0" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002585 "$P_SRV arc4=1 version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-AES-256-CBC-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002586 "$P_CLI force_version=tls1 arc4=1" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02002587 0 \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002588 -c "Ciphersuite is TLS-RSA-WITH-AES-256-CBC-SHA"
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02002589
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002590run_test "Per-version suites: TLS 1.1" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002591 "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-AES-256-CBC-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02002592 "$P_CLI force_version=tls1_1" \
2593 0 \
2594 -c "Ciphersuite is TLS-RSA-WITH-AES-128-CBC-SHA"
2595
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002596run_test "Per-version suites: TLS 1.2" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002597 "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-AES-256-CBC-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02002598 "$P_CLI force_version=tls1_2" \
2599 0 \
2600 -c "Ciphersuite is TLS-RSA-WITH-AES-128-GCM-SHA256"
2601
Manuel Pégourié-Gonnard4cc8c632015-07-23 12:24:03 +02002602# Test for ClientHello without extensions
2603
Manuel Pégourié-Gonnardd55bc202015-08-04 16:22:30 +02002604requires_gnutls
2605run_test "ClientHello without extensions" \
Manuel Pégourié-Gonnard4cc8c632015-07-23 12:24:03 +02002606 "$P_SRV debug_level=3" \
2607 "$G_CLI --priority=NORMAL:%NO_EXTENSIONS:%DISABLE_SAFE_RENEGOTIATION" \
2608 0 \
2609 -s "dumping 'client hello extensions' (0 bytes)"
2610
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002611# Tests for mbedtls_ssl_get_bytes_avail()
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +02002612
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002613run_test "mbedtls_ssl_get_bytes_avail: no extra data" \
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +02002614 "$P_SRV" \
2615 "$P_CLI request_size=100" \
2616 0 \
2617 -s "Read from client: 100 bytes read$"
2618
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002619run_test "mbedtls_ssl_get_bytes_avail: extra data" \
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +02002620 "$P_SRV" \
2621 "$P_CLI request_size=500" \
2622 0 \
2623 -s "Read from client: 500 bytes read (.*+.*)"
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02002624
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002625# Tests for small packets
2626
Janos Follath542ee5d2016-03-07 15:57:05 +00002627requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002628run_test "Small packet SSLv3 BlockCipher" \
Manuel Pégourié-Gonnard448ea502015-01-12 11:40:14 +01002629 "$P_SRV min_version=ssl3" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002630 "$P_CLI request_size=1 force_version=ssl3 \
2631 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2632 0 \
2633 -s "Read from client: 1 bytes read"
2634
Janos Follath542ee5d2016-03-07 15:57:05 +00002635requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002636run_test "Small packet SSLv3 StreamCipher" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002637 "$P_SRV min_version=ssl3 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002638 "$P_CLI request_size=1 force_version=ssl3 \
2639 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2640 0 \
2641 -s "Read from client: 1 bytes read"
2642
2643run_test "Small packet TLS 1.0 BlockCipher" \
2644 "$P_SRV" \
2645 "$P_CLI request_size=1 force_version=tls1 \
2646 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2647 0 \
2648 -s "Read from client: 1 bytes read"
2649
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +01002650run_test "Small packet TLS 1.0 BlockCipher without EtM" \
2651 "$P_SRV" \
2652 "$P_CLI request_size=1 force_version=tls1 etm=0 \
2653 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2654 0 \
2655 -s "Read from client: 1 bytes read"
2656
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002657run_test "Small packet TLS 1.0 BlockCipher truncated MAC" \
2658 "$P_SRV" \
2659 "$P_CLI request_size=1 force_version=tls1 \
2660 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2661 trunc_hmac=1" \
2662 0 \
2663 -s "Read from client: 1 bytes read"
2664
2665run_test "Small packet TLS 1.0 StreamCipher truncated MAC" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002666 "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002667 "$P_CLI request_size=1 force_version=tls1 \
2668 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2669 trunc_hmac=1" \
2670 0 \
2671 -s "Read from client: 1 bytes read"
2672
2673run_test "Small packet TLS 1.1 BlockCipher" \
2674 "$P_SRV" \
2675 "$P_CLI request_size=1 force_version=tls1_1 \
2676 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2677 0 \
2678 -s "Read from client: 1 bytes read"
2679
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +01002680run_test "Small packet TLS 1.1 BlockCipher without EtM" \
2681 "$P_SRV" \
2682 "$P_CLI request_size=1 force_version=tls1_1 etm=0 \
2683 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2684 0 \
2685 -s "Read from client: 1 bytes read"
2686
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002687run_test "Small packet TLS 1.1 StreamCipher" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002688 "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002689 "$P_CLI request_size=1 force_version=tls1_1 \
2690 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2691 0 \
2692 -s "Read from client: 1 bytes read"
2693
2694run_test "Small packet TLS 1.1 BlockCipher truncated MAC" \
2695 "$P_SRV" \
2696 "$P_CLI request_size=1 force_version=tls1_1 \
2697 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2698 trunc_hmac=1" \
2699 0 \
2700 -s "Read from client: 1 bytes read"
2701
2702run_test "Small packet TLS 1.1 StreamCipher truncated MAC" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002703 "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002704 "$P_CLI request_size=1 force_version=tls1_1 \
2705 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2706 trunc_hmac=1" \
2707 0 \
2708 -s "Read from client: 1 bytes read"
2709
2710run_test "Small packet TLS 1.2 BlockCipher" \
2711 "$P_SRV" \
2712 "$P_CLI request_size=1 force_version=tls1_2 \
2713 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2714 0 \
2715 -s "Read from client: 1 bytes read"
2716
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +01002717run_test "Small packet TLS 1.2 BlockCipher without EtM" \
2718 "$P_SRV" \
2719 "$P_CLI request_size=1 force_version=tls1_2 etm=0 \
2720 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2721 0 \
2722 -s "Read from client: 1 bytes read"
2723
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002724run_test "Small packet TLS 1.2 BlockCipher larger MAC" \
2725 "$P_SRV" \
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +01002726 "$P_CLI request_size=1 force_version=tls1_2 \
2727 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002728 0 \
2729 -s "Read from client: 1 bytes read"
2730
2731run_test "Small packet TLS 1.2 BlockCipher truncated MAC" \
2732 "$P_SRV" \
2733 "$P_CLI request_size=1 force_version=tls1_2 \
2734 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2735 trunc_hmac=1" \
2736 0 \
2737 -s "Read from client: 1 bytes read"
2738
2739run_test "Small packet TLS 1.2 StreamCipher" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002740 "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002741 "$P_CLI request_size=1 force_version=tls1_2 \
2742 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2743 0 \
2744 -s "Read from client: 1 bytes read"
2745
2746run_test "Small packet TLS 1.2 StreamCipher truncated MAC" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002747 "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002748 "$P_CLI request_size=1 force_version=tls1_2 \
2749 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2750 trunc_hmac=1" \
2751 0 \
2752 -s "Read from client: 1 bytes read"
2753
2754run_test "Small packet TLS 1.2 AEAD" \
2755 "$P_SRV" \
2756 "$P_CLI request_size=1 force_version=tls1_2 \
2757 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \
2758 0 \
2759 -s "Read from client: 1 bytes read"
2760
2761run_test "Small packet TLS 1.2 AEAD shorter tag" \
2762 "$P_SRV" \
2763 "$P_CLI request_size=1 force_version=tls1_2 \
2764 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \
2765 0 \
2766 -s "Read from client: 1 bytes read"
2767
Janos Follathb700c462016-05-06 13:48:23 +01002768# A test for extensions in SSLv3
2769
2770requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
2771run_test "SSLv3 with extensions, server side" \
2772 "$P_SRV min_version=ssl3 debug_level=3" \
2773 "$P_CLI force_version=ssl3 tickets=1 max_frag_len=4096 alpn=abc,1234" \
2774 0 \
2775 -S "dumping 'client hello extensions'" \
2776 -S "server hello, total extension length:"
2777
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002778# Test for large packets
2779
Janos Follath542ee5d2016-03-07 15:57:05 +00002780requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002781run_test "Large packet SSLv3 BlockCipher" \
Manuel Pégourié-Gonnard448ea502015-01-12 11:40:14 +01002782 "$P_SRV min_version=ssl3" \
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +01002783 "$P_CLI request_size=16384 force_version=ssl3 recsplit=0 \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002784 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2785 0 \
2786 -s "Read from client: 16384 bytes read"
2787
Janos Follath542ee5d2016-03-07 15:57:05 +00002788requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002789run_test "Large packet SSLv3 StreamCipher" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002790 "$P_SRV min_version=ssl3 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002791 "$P_CLI request_size=16384 force_version=ssl3 \
2792 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2793 0 \
2794 -s "Read from client: 16384 bytes read"
2795
2796run_test "Large packet TLS 1.0 BlockCipher" \
2797 "$P_SRV" \
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +01002798 "$P_CLI request_size=16384 force_version=tls1 recsplit=0 \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002799 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2800 0 \
2801 -s "Read from client: 16384 bytes read"
2802
2803run_test "Large packet TLS 1.0 BlockCipher truncated MAC" \
2804 "$P_SRV" \
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +01002805 "$P_CLI request_size=16384 force_version=tls1 recsplit=0 \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002806 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2807 trunc_hmac=1" \
2808 0 \
2809 -s "Read from client: 16384 bytes read"
2810
2811run_test "Large packet TLS 1.0 StreamCipher truncated MAC" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002812 "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002813 "$P_CLI request_size=16384 force_version=tls1 \
2814 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2815 trunc_hmac=1" \
2816 0 \
2817 -s "Read from client: 16384 bytes read"
2818
2819run_test "Large packet TLS 1.1 BlockCipher" \
2820 "$P_SRV" \
2821 "$P_CLI request_size=16384 force_version=tls1_1 \
2822 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2823 0 \
2824 -s "Read from client: 16384 bytes read"
2825
2826run_test "Large packet TLS 1.1 StreamCipher" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002827 "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002828 "$P_CLI request_size=16384 force_version=tls1_1 \
2829 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2830 0 \
2831 -s "Read from client: 16384 bytes read"
2832
2833run_test "Large packet TLS 1.1 BlockCipher truncated MAC" \
2834 "$P_SRV" \
2835 "$P_CLI request_size=16384 force_version=tls1_1 \
2836 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2837 trunc_hmac=1" \
2838 0 \
2839 -s "Read from client: 16384 bytes read"
2840
2841run_test "Large packet TLS 1.1 StreamCipher truncated MAC" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002842 "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002843 "$P_CLI request_size=16384 force_version=tls1_1 \
2844 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2845 trunc_hmac=1" \
2846 0 \
2847 -s "Read from client: 16384 bytes read"
2848
2849run_test "Large packet TLS 1.2 BlockCipher" \
2850 "$P_SRV" \
2851 "$P_CLI request_size=16384 force_version=tls1_2 \
2852 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2853 0 \
2854 -s "Read from client: 16384 bytes read"
2855
2856run_test "Large packet TLS 1.2 BlockCipher larger MAC" \
2857 "$P_SRV" \
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +01002858 "$P_CLI request_size=16384 force_version=tls1_2 \
2859 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002860 0 \
2861 -s "Read from client: 16384 bytes read"
2862
2863run_test "Large packet TLS 1.2 BlockCipher truncated MAC" \
2864 "$P_SRV" \
2865 "$P_CLI request_size=16384 force_version=tls1_2 \
2866 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2867 trunc_hmac=1" \
2868 0 \
2869 -s "Read from client: 16384 bytes read"
2870
2871run_test "Large packet TLS 1.2 StreamCipher" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002872 "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002873 "$P_CLI request_size=16384 force_version=tls1_2 \
2874 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2875 0 \
2876 -s "Read from client: 16384 bytes read"
2877
2878run_test "Large packet TLS 1.2 StreamCipher truncated MAC" \
Manuel Pégourié-Gonnardea0920f2015-03-24 09:50:15 +01002879 "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002880 "$P_CLI request_size=16384 force_version=tls1_2 \
2881 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2882 trunc_hmac=1" \
2883 0 \
2884 -s "Read from client: 16384 bytes read"
2885
2886run_test "Large packet TLS 1.2 AEAD" \
2887 "$P_SRV" \
2888 "$P_CLI request_size=16384 force_version=tls1_2 \
2889 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \
2890 0 \
2891 -s "Read from client: 16384 bytes read"
2892
2893run_test "Large packet TLS 1.2 AEAD shorter tag" \
2894 "$P_SRV" \
2895 "$P_CLI request_size=16384 force_version=tls1_2 \
2896 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \
2897 0 \
2898 -s "Read from client: 16384 bytes read"
2899
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02002900# Tests for DTLS HelloVerifyRequest
2901
2902run_test "DTLS cookie: enabled" \
2903 "$P_SRV dtls=1 debug_level=2" \
2904 "$P_CLI dtls=1 debug_level=2" \
2905 0 \
2906 -s "cookie verification failed" \
2907 -s "cookie verification passed" \
2908 -S "cookie verification skipped" \
2909 -c "received hello verify request" \
Manuel Pégourié-Gonnardcaecdae2014-10-13 19:04:37 +02002910 -s "hello verification requested" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02002911 -S "SSL - The requested feature is not available"
2912
2913run_test "DTLS cookie: disabled" \
2914 "$P_SRV dtls=1 debug_level=2 cookies=0" \
2915 "$P_CLI dtls=1 debug_level=2" \
2916 0 \
2917 -S "cookie verification failed" \
2918 -S "cookie verification passed" \
2919 -s "cookie verification skipped" \
2920 -C "received hello verify request" \
Manuel Pégourié-Gonnardcaecdae2014-10-13 19:04:37 +02002921 -S "hello verification requested" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02002922 -S "SSL - The requested feature is not available"
2923
Manuel Pégourié-Gonnardcaecdae2014-10-13 19:04:37 +02002924run_test "DTLS cookie: default (failing)" \
2925 "$P_SRV dtls=1 debug_level=2 cookies=-1" \
2926 "$P_CLI dtls=1 debug_level=2 hs_timeout=100-400" \
2927 1 \
2928 -s "cookie verification failed" \
2929 -S "cookie verification passed" \
2930 -S "cookie verification skipped" \
2931 -C "received hello verify request" \
2932 -S "hello verification requested" \
2933 -s "SSL - The requested feature is not available"
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02002934
2935requires_ipv6
2936run_test "DTLS cookie: enabled, IPv6" \
2937 "$P_SRV dtls=1 debug_level=2 server_addr=::1" \
2938 "$P_CLI dtls=1 debug_level=2 server_addr=::1" \
2939 0 \
2940 -s "cookie verification failed" \
2941 -s "cookie verification passed" \
2942 -S "cookie verification skipped" \
2943 -c "received hello verify request" \
Manuel Pégourié-Gonnardcaecdae2014-10-13 19:04:37 +02002944 -s "hello verification requested" \
Manuel Pégourié-Gonnard0eb6cab2014-07-23 20:17:47 +02002945 -S "SSL - The requested feature is not available"
2946
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02002947run_test "DTLS cookie: enabled, nbio" \
2948 "$P_SRV dtls=1 nbio=2 debug_level=2" \
2949 "$P_CLI dtls=1 nbio=2 debug_level=2" \
2950 0 \
2951 -s "cookie verification failed" \
2952 -s "cookie verification passed" \
2953 -S "cookie verification skipped" \
2954 -c "received hello verify request" \
Manuel Pégourié-Gonnardcaecdae2014-10-13 19:04:37 +02002955 -s "hello verification requested" \
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02002956 -S "SSL - The requested feature is not available"
2957
Manuel Pégourié-Gonnardd745a1a2015-09-08 12:40:43 +02002958# Tests for client reconnecting from the same port with DTLS
2959
Manuel Pégourié-Gonnard259db912015-09-09 11:37:17 +02002960not_with_valgrind # spurious resend
Manuel Pégourié-Gonnardd745a1a2015-09-08 12:40:43 +02002961run_test "DTLS client reconnect from same port: reference" \
Manuel Pégourié-Gonnard259db912015-09-09 11:37:17 +02002962 "$P_SRV dtls=1 exchanges=2 read_timeout=1000" \
2963 "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=500-1000" \
Manuel Pégourié-Gonnardd745a1a2015-09-08 12:40:43 +02002964 0 \
2965 -C "resend" \
Manuel Pégourié-Gonnard259db912015-09-09 11:37:17 +02002966 -S "The operation timed out" \
Manuel Pégourié-Gonnardd745a1a2015-09-08 12:40:43 +02002967 -S "Client initiated reconnection from same port"
2968
Manuel Pégourié-Gonnard259db912015-09-09 11:37:17 +02002969not_with_valgrind # spurious resend
Manuel Pégourié-Gonnardd745a1a2015-09-08 12:40:43 +02002970run_test "DTLS client reconnect from same port: reconnect" \
Manuel Pégourié-Gonnard259db912015-09-09 11:37:17 +02002971 "$P_SRV dtls=1 exchanges=2 read_timeout=1000" \
2972 "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=500-1000 reconnect_hard=1" \
Manuel Pégourié-Gonnardd745a1a2015-09-08 12:40:43 +02002973 0 \
2974 -C "resend" \
Manuel Pégourié-Gonnard259db912015-09-09 11:37:17 +02002975 -S "The operation timed out" \
Manuel Pégourié-Gonnardd745a1a2015-09-08 12:40:43 +02002976 -s "Client initiated reconnection from same port"
2977
Paul Bakker3b224ff2016-05-13 10:33:25 +01002978not_with_valgrind # server/client too slow to respond in time (next test has higher timeouts)
2979run_test "DTLS client reconnect from same port: reconnect, nbio, no valgrind" \
Manuel Pégourié-Gonnard259db912015-09-09 11:37:17 +02002980 "$P_SRV dtls=1 exchanges=2 read_timeout=1000 nbio=2" \
2981 "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=500-1000 reconnect_hard=1" \
Manuel Pégourié-Gonnardd745a1a2015-09-08 12:40:43 +02002982 0 \
Manuel Pégourié-Gonnard259db912015-09-09 11:37:17 +02002983 -S "The operation timed out" \
Manuel Pégourié-Gonnardd745a1a2015-09-08 12:40:43 +02002984 -s "Client initiated reconnection from same port"
2985
Paul Bakker3b224ff2016-05-13 10:33:25 +01002986only_with_valgrind # Only with valgrind, do previous test but with higher read_timeout and hs_timeout
2987run_test "DTLS client reconnect from same port: reconnect, nbio, valgrind" \
2988 "$P_SRV dtls=1 exchanges=2 read_timeout=2000 nbio=2 hs_timeout=1500-6000" \
2989 "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=1500-3000 reconnect_hard=1" \
2990 0 \
2991 -S "The operation timed out" \
2992 -s "Client initiated reconnection from same port"
2993
Manuel Pégourié-Gonnard259db912015-09-09 11:37:17 +02002994run_test "DTLS client reconnect from same port: no cookies" \
2995 "$P_SRV dtls=1 exchanges=2 read_timeout=1000 cookies=0" \
Manuel Pégourié-Gonnard6ad23b92015-09-15 12:57:46 +02002996 "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=500-8000 reconnect_hard=1" \
2997 0 \
Manuel Pégourié-Gonnard259db912015-09-09 11:37:17 +02002998 -s "The operation timed out" \
2999 -S "Client initiated reconnection from same port"
3000
Manuel Pégourié-Gonnard08a1d4b2014-09-26 10:35:50 +02003001# Tests for various cases of client authentication with DTLS
3002# (focused on handshake flows and message parsing)
3003
3004run_test "DTLS client auth: required" \
3005 "$P_SRV dtls=1 auth_mode=required" \
3006 "$P_CLI dtls=1" \
3007 0 \
3008 -s "Verifying peer X.509 certificate... ok"
3009
3010run_test "DTLS client auth: optional, client has no cert" \
3011 "$P_SRV dtls=1 auth_mode=optional" \
3012 "$P_CLI dtls=1 crt_file=none key_file=none" \
3013 0 \
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +01003014 -s "! Certificate was missing"
Manuel Pégourié-Gonnard08a1d4b2014-09-26 10:35:50 +02003015
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +01003016run_test "DTLS client auth: none, client has no cert" \
Manuel Pégourié-Gonnard08a1d4b2014-09-26 10:35:50 +02003017 "$P_SRV dtls=1 auth_mode=none" \
3018 "$P_CLI dtls=1 crt_file=none key_file=none debug_level=2" \
3019 0 \
3020 -c "skip write certificate$" \
Manuel Pégourié-Gonnard89addc42015-04-20 10:56:18 +01003021 -s "! Certificate verification was skipped"
Manuel Pégourié-Gonnard08a1d4b2014-09-26 10:35:50 +02003022
Manuel Pégourié-Gonnard0a885742015-08-04 12:08:35 +02003023run_test "DTLS wrong PSK: badmac alert" \
3024 "$P_SRV dtls=1 psk=abc123 force_ciphersuite=TLS-PSK-WITH-AES-128-GCM-SHA256" \
3025 "$P_CLI dtls=1 psk=abc124" \
3026 1 \
3027 -s "SSL - Verification of the message MAC failed" \
3028 -c "SSL - A fatal alert message was received from our peer"
3029
Manuel Pégourié-Gonnard502bf302014-08-20 13:12:58 +02003030# Tests for receiving fragmented handshake messages with DTLS
3031
3032requires_gnutls
3033run_test "DTLS reassembly: no fragmentation (gnutls server)" \
3034 "$G_SRV -u --mtu 2048 -a" \
3035 "$P_CLI dtls=1 debug_level=2" \
3036 0 \
3037 -C "found fragmented DTLS handshake message" \
3038 -C "error"
3039
3040requires_gnutls
3041run_test "DTLS reassembly: some fragmentation (gnutls server)" \
3042 "$G_SRV -u --mtu 512" \
3043 "$P_CLI dtls=1 debug_level=2" \
3044 0 \
3045 -c "found fragmented DTLS handshake message" \
3046 -C "error"
3047
3048requires_gnutls
3049run_test "DTLS reassembly: more fragmentation (gnutls server)" \
3050 "$G_SRV -u --mtu 128" \
3051 "$P_CLI dtls=1 debug_level=2" \
3052 0 \
3053 -c "found fragmented DTLS handshake message" \
3054 -C "error"
3055
3056requires_gnutls
3057run_test "DTLS reassembly: more fragmentation, nbio (gnutls server)" \
3058 "$G_SRV -u --mtu 128" \
3059 "$P_CLI dtls=1 nbio=2 debug_level=2" \
3060 0 \
3061 -c "found fragmented DTLS handshake message" \
3062 -C "error"
3063
Manuel Pégourié-Gonnard0c4cbc72014-09-02 14:47:31 +02003064requires_gnutls
Manuel Pégourié-Gonnard0c4cbc72014-09-02 14:47:31 +02003065run_test "DTLS reassembly: fragmentation, renego (gnutls server)" \
3066 "$G_SRV -u --mtu 256" \
3067 "$P_CLI debug_level=3 dtls=1 renegotiation=1 renegotiate=1" \
3068 0 \
3069 -c "found fragmented DTLS handshake message" \
3070 -c "client hello, adding renegotiation extension" \
3071 -c "found renegotiation extension" \
3072 -c "=> renegotiate" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003073 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard0c4cbc72014-09-02 14:47:31 +02003074 -C "error" \
3075 -s "Extra-header:"
3076
3077requires_gnutls
Manuel Pégourié-Gonnard0c4cbc72014-09-02 14:47:31 +02003078run_test "DTLS reassembly: fragmentation, nbio, renego (gnutls server)" \
3079 "$G_SRV -u --mtu 256" \
3080 "$P_CLI debug_level=3 nbio=2 dtls=1 renegotiation=1 renegotiate=1" \
3081 0 \
3082 -c "found fragmented DTLS handshake message" \
3083 -c "client hello, adding renegotiation extension" \
3084 -c "found renegotiation extension" \
3085 -c "=> renegotiate" \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003086 -C "mbedtls_ssl_handshake returned" \
Manuel Pégourié-Gonnard0c4cbc72014-09-02 14:47:31 +02003087 -C "error" \
3088 -s "Extra-header:"
3089
Manuel Pégourié-Gonnarda7756172014-08-31 18:37:01 +02003090run_test "DTLS reassembly: no fragmentation (openssl server)" \
3091 "$O_SRV -dtls1 -mtu 2048" \
3092 "$P_CLI dtls=1 debug_level=2" \
3093 0 \
3094 -C "found fragmented DTLS handshake message" \
3095 -C "error"
3096
Manuel Pégourié-Gonnard825a49e2014-09-23 11:00:37 +02003097run_test "DTLS reassembly: some fragmentation (openssl server)" \
3098 "$O_SRV -dtls1 -mtu 768" \
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02003099 "$P_CLI dtls=1 debug_level=2" \
3100 0 \
3101 -c "found fragmented DTLS handshake message" \
3102 -C "error"
3103
Manuel Pégourié-Gonnard825a49e2014-09-23 11:00:37 +02003104run_test "DTLS reassembly: more fragmentation (openssl server)" \
Manuel Pégourié-Gonnard64dffc52014-09-02 13:39:16 +02003105 "$O_SRV -dtls1 -mtu 256" \
3106 "$P_CLI dtls=1 debug_level=2" \
3107 0 \
3108 -c "found fragmented DTLS handshake message" \
3109 -C "error"
3110
3111run_test "DTLS reassembly: fragmentation, nbio (openssl server)" \
3112 "$O_SRV -dtls1 -mtu 256" \
3113 "$P_CLI dtls=1 nbio=2 debug_level=2" \
3114 0 \
3115 -c "found fragmented DTLS handshake message" \
3116 -C "error"
Manuel Pégourié-Gonnarda7756172014-08-31 18:37:01 +02003117
Manuel Pégourié-Gonnard7a66cbc2014-09-26 16:31:46 +02003118# Tests for specific things with "unreliable" UDP connection
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +02003119
Manuel Pégourié-Gonnard76fe9e42014-09-24 15:17:31 +02003120not_with_valgrind # spurious resend due to timeout
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02003121run_test "DTLS proxy: reference" \
Manuel Pégourié-Gonnardbe9eb872014-09-05 17:45:19 +02003122 -p "$P_PXY" \
Manuel Pégourié-Gonnard76fe9e42014-09-24 15:17:31 +02003123 "$P_SRV dtls=1 debug_level=2" \
3124 "$P_CLI dtls=1 debug_level=2" \
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02003125 0 \
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02003126 -C "replayed record" \
3127 -S "replayed record" \
3128 -C "record from another epoch" \
3129 -S "record from another epoch" \
3130 -C "discarding invalid record" \
3131 -S "discarding invalid record" \
Manuel Pégourié-Gonnard76fe9e42014-09-24 15:17:31 +02003132 -S "resend" \
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02003133 -s "Extra-header:" \
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02003134 -c "HTTP/1.0 200 OK"
3135
Manuel Pégourié-Gonnard76fe9e42014-09-24 15:17:31 +02003136not_with_valgrind # spurious resend due to timeout
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02003137run_test "DTLS proxy: duplicate every packet" \
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02003138 -p "$P_PXY duplicate=1" \
Manuel Pégourié-Gonnard76fe9e42014-09-24 15:17:31 +02003139 "$P_SRV dtls=1 debug_level=2" \
3140 "$P_CLI dtls=1 debug_level=2" \
Manuel Pégourié-Gonnard990f9e42014-09-06 12:27:02 +02003141 0 \
Manuel Pégourié-Gonnardb47368a2014-09-24 13:29:58 +02003142 -c "replayed record" \
3143 -s "replayed record" \
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02003144 -c "discarding invalid record" \
3145 -s "discarding invalid record" \
Manuel Pégourié-Gonnard76fe9e42014-09-24 15:17:31 +02003146 -S "resend" \
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02003147 -s "Extra-header:" \
3148 -c "HTTP/1.0 200 OK"
3149
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02003150run_test "DTLS proxy: duplicate every packet, server anti-replay off" \
3151 -p "$P_PXY duplicate=1" \
Manuel Pégourié-Gonnard76fe9e42014-09-24 15:17:31 +02003152 "$P_SRV dtls=1 debug_level=2 anti_replay=0" \
3153 "$P_CLI dtls=1 debug_level=2" \
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02003154 0 \
3155 -c "replayed record" \
3156 -S "replayed record" \
3157 -c "discarding invalid record" \
3158 -s "discarding invalid record" \
Manuel Pégourié-Gonnard76fe9e42014-09-24 15:17:31 +02003159 -c "resend" \
3160 -s "resend" \
Manuel Pégourié-Gonnard27393132014-09-24 14:41:11 +02003161 -s "Extra-header:" \
3162 -c "HTTP/1.0 200 OK"
3163
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +02003164run_test "DTLS proxy: inject invalid AD record, default badmac_limit" \
Manuel Pégourié-Gonnard63eca932014-09-08 16:39:08 +02003165 -p "$P_PXY bad_ad=1" \
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02003166 "$P_SRV dtls=1 debug_level=1" \
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +02003167 "$P_CLI dtls=1 debug_level=1 read_timeout=100" \
Manuel Pégourié-Gonnard825a49e2014-09-23 11:00:37 +02003168 0 \
Manuel Pégourié-Gonnard74a13782014-10-14 22:34:08 +02003169 -c "discarding invalid record (mac)" \
3170 -s "discarding invalid record (mac)" \
Manuel Pégourié-Gonnard825a49e2014-09-23 11:00:37 +02003171 -s "Extra-header:" \
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +02003172 -c "HTTP/1.0 200 OK" \
3173 -S "too many records with bad MAC" \
3174 -S "Verification of the message MAC failed"
3175
3176run_test "DTLS proxy: inject invalid AD record, badmac_limit 1" \
3177 -p "$P_PXY bad_ad=1" \
3178 "$P_SRV dtls=1 debug_level=1 badmac_limit=1" \
3179 "$P_CLI dtls=1 debug_level=1 read_timeout=100" \
3180 1 \
Manuel Pégourié-Gonnard74a13782014-10-14 22:34:08 +02003181 -C "discarding invalid record (mac)" \
3182 -S "discarding invalid record (mac)" \
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +02003183 -S "Extra-header:" \
3184 -C "HTTP/1.0 200 OK" \
3185 -s "too many records with bad MAC" \
3186 -s "Verification of the message MAC failed"
3187
3188run_test "DTLS proxy: inject invalid AD record, badmac_limit 2" \
3189 -p "$P_PXY bad_ad=1" \
3190 "$P_SRV dtls=1 debug_level=1 badmac_limit=2" \
3191 "$P_CLI dtls=1 debug_level=1 read_timeout=100" \
3192 0 \
Manuel Pégourié-Gonnard74a13782014-10-14 22:34:08 +02003193 -c "discarding invalid record (mac)" \
3194 -s "discarding invalid record (mac)" \
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +02003195 -s "Extra-header:" \
3196 -c "HTTP/1.0 200 OK" \
3197 -S "too many records with bad MAC" \
3198 -S "Verification of the message MAC failed"
3199
3200run_test "DTLS proxy: inject invalid AD record, badmac_limit 2, exchanges 2"\
3201 -p "$P_PXY bad_ad=1" \
3202 "$P_SRV dtls=1 debug_level=1 badmac_limit=2 exchanges=2" \
3203 "$P_CLI dtls=1 debug_level=1 read_timeout=100 exchanges=2" \
3204 1 \
Manuel Pégourié-Gonnard74a13782014-10-14 22:34:08 +02003205 -c "discarding invalid record (mac)" \
3206 -s "discarding invalid record (mac)" \
Manuel Pégourié-Gonnarde698f592014-10-14 19:36:36 +02003207 -s "Extra-header:" \
3208 -c "HTTP/1.0 200 OK" \
3209 -s "too many records with bad MAC" \
3210 -s "Verification of the message MAC failed"
Manuel Pégourié-Gonnard825a49e2014-09-23 11:00:37 +02003211
3212run_test "DTLS proxy: delay ChangeCipherSpec" \
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02003213 -p "$P_PXY delay_ccs=1" \
3214 "$P_SRV dtls=1 debug_level=1" \
3215 "$P_CLI dtls=1 debug_level=1" \
Manuel Pégourié-Gonnard825a49e2014-09-23 11:00:37 +02003216 0 \
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02003217 -c "record from another epoch" \
3218 -s "record from another epoch" \
Manuel Pégourié-Gonnard825a49e2014-09-23 11:00:37 +02003219 -c "discarding invalid record" \
Manuel Pégourié-Gonnard246c13a2014-09-24 13:56:09 +02003220 -s "discarding invalid record" \
Manuel Pégourié-Gonnard825a49e2014-09-23 11:00:37 +02003221 -s "Extra-header:" \
3222 -c "HTTP/1.0 200 OK"
3223
Manuel Pégourié-Gonnard7a66cbc2014-09-26 16:31:46 +02003224# Tests for "randomly unreliable connection": try a variety of flows and peers
Manuel Pégourié-Gonnard18e519a2014-09-24 19:09:17 +02003225
Manuel Pégourié-Gonnard825a49e2014-09-23 11:00:37 +02003226needs_more_time 2
Manuel Pégourié-Gonnard18e519a2014-09-24 19:09:17 +02003227run_test "DTLS proxy: 3d (drop, delay, duplicate), \"short\" PSK handshake" \
Manuel Pégourié-Gonnard825a49e2014-09-23 11:00:37 +02003228 -p "$P_PXY drop=5 delay=5 duplicate=5" \
Manuel Pégourié-Gonnard37a4de22014-10-01 16:38:03 +02003229 "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
3230 psk=abc123" \
3231 "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
Manuel Pégourié-Gonnard18e519a2014-09-24 19:09:17 +02003232 force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \
3233 0 \
3234 -s "Extra-header:" \
3235 -c "HTTP/1.0 200 OK"
3236
3237needs_more_time 2
3238run_test "DTLS proxy: 3d, \"short\" RSA handshake" \
3239 -p "$P_PXY drop=5 delay=5 duplicate=5" \
Manuel Pégourié-Gonnard37a4de22014-10-01 16:38:03 +02003240 "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none" \
3241 "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 \
Manuel Pégourié-Gonnard18e519a2014-09-24 19:09:17 +02003242 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
3243 0 \
3244 -s "Extra-header:" \
3245 -c "HTTP/1.0 200 OK"
3246
3247needs_more_time 2
3248run_test "DTLS proxy: 3d, \"short\" (no ticket, no cli_auth) FS handshake" \
3249 -p "$P_PXY drop=5 delay=5 duplicate=5" \
Manuel Pégourié-Gonnard37a4de22014-10-01 16:38:03 +02003250 "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none" \
3251 "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0" \
Manuel Pégourié-Gonnard18e519a2014-09-24 19:09:17 +02003252 0 \
3253 -s "Extra-header:" \
3254 -c "HTTP/1.0 200 OK"
3255
3256needs_more_time 2
3257run_test "DTLS proxy: 3d, FS, client auth" \
3258 -p "$P_PXY drop=5 delay=5 duplicate=5" \
Manuel Pégourié-Gonnard37a4de22014-10-01 16:38:03 +02003259 "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=required" \
3260 "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0" \
Manuel Pégourié-Gonnard18e519a2014-09-24 19:09:17 +02003261 0 \
3262 -s "Extra-header:" \
3263 -c "HTTP/1.0 200 OK"
3264
3265needs_more_time 2
3266run_test "DTLS proxy: 3d, FS, ticket" \
3267 -p "$P_PXY drop=5 delay=5 duplicate=5" \
Manuel Pégourié-Gonnard37a4de22014-10-01 16:38:03 +02003268 "$P_SRV dtls=1 hs_timeout=250-10000 tickets=1 auth_mode=none" \
3269 "$P_CLI dtls=1 hs_timeout=250-10000 tickets=1" \
Manuel Pégourié-Gonnard18e519a2014-09-24 19:09:17 +02003270 0 \
3271 -s "Extra-header:" \
3272 -c "HTTP/1.0 200 OK"
3273
3274needs_more_time 2
3275run_test "DTLS proxy: 3d, max handshake (FS, ticket + client auth)" \
3276 -p "$P_PXY drop=5 delay=5 duplicate=5" \
Manuel Pégourié-Gonnard37a4de22014-10-01 16:38:03 +02003277 "$P_SRV dtls=1 hs_timeout=250-10000 tickets=1 auth_mode=required" \
3278 "$P_CLI dtls=1 hs_timeout=250-10000 tickets=1" \
Manuel Pégourié-Gonnard825a49e2014-09-23 11:00:37 +02003279 0 \
3280 -s "Extra-header:" \
3281 -c "HTTP/1.0 200 OK"
3282
Manuel Pégourié-Gonnard6093d812014-09-29 17:52:57 +02003283needs_more_time 2
3284run_test "DTLS proxy: 3d, max handshake, nbio" \
3285 -p "$P_PXY drop=5 delay=5 duplicate=5" \
Manuel Pégourié-Gonnard37a4de22014-10-01 16:38:03 +02003286 "$P_SRV dtls=1 hs_timeout=250-10000 nbio=2 tickets=1 \
3287 auth_mode=required" \
3288 "$P_CLI dtls=1 hs_timeout=250-10000 nbio=2 tickets=1" \
Manuel Pégourié-Gonnard6093d812014-09-29 17:52:57 +02003289 0 \
3290 -s "Extra-header:" \
3291 -c "HTTP/1.0 200 OK"
3292
Manuel Pégourié-Gonnard1b753f12014-09-25 16:09:36 +02003293needs_more_time 4
Manuel Pégourié-Gonnard7a26d732014-10-02 14:50:46 +02003294run_test "DTLS proxy: 3d, min handshake, resumption" \
3295 -p "$P_PXY drop=5 delay=5 duplicate=5" \
3296 "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
3297 psk=abc123 debug_level=3" \
3298 "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
3299 debug_level=3 reconnect=1 read_timeout=1000 max_resend=10 \
3300 force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \
3301 0 \
3302 -s "a session has been resumed" \
3303 -c "a session has been resumed" \
3304 -s "Extra-header:" \
3305 -c "HTTP/1.0 200 OK"
3306
3307needs_more_time 4
Manuel Pégourié-Gonnard85beb302014-10-02 17:59:19 +02003308run_test "DTLS proxy: 3d, min handshake, resumption, nbio" \
3309 -p "$P_PXY drop=5 delay=5 duplicate=5" \
3310 "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
3311 psk=abc123 debug_level=3 nbio=2" \
3312 "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
3313 debug_level=3 reconnect=1 read_timeout=1000 max_resend=10 \
3314 force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8 nbio=2" \
3315 0 \
3316 -s "a session has been resumed" \
3317 -c "a session has been resumed" \
3318 -s "Extra-header:" \
3319 -c "HTTP/1.0 200 OK"
3320
3321needs_more_time 4
Manuel Pégourié-Gonnard6093d812014-09-29 17:52:57 +02003322run_test "DTLS proxy: 3d, min handshake, client-initiated renego" \
Manuel Pégourié-Gonnard1b753f12014-09-25 16:09:36 +02003323 -p "$P_PXY drop=5 delay=5 duplicate=5" \
Manuel Pégourié-Gonnard37a4de22014-10-01 16:38:03 +02003324 "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
3325 psk=abc123 renegotiation=1 debug_level=2" \
3326 "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
3327 renegotiate=1 debug_level=2 \
Manuel Pégourié-Gonnard1b753f12014-09-25 16:09:36 +02003328 force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \
3329 0 \
3330 -c "=> renegotiate" \
3331 -s "=> renegotiate" \
3332 -s "Extra-header:" \
3333 -c "HTTP/1.0 200 OK"
3334
Manuel Pégourié-Gonnard6093d812014-09-29 17:52:57 +02003335needs_more_time 4
3336run_test "DTLS proxy: 3d, min handshake, client-initiated renego, nbio" \
3337 -p "$P_PXY drop=5 delay=5 duplicate=5" \
Manuel Pégourié-Gonnard37a4de22014-10-01 16:38:03 +02003338 "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
3339 psk=abc123 renegotiation=1 debug_level=2" \
3340 "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
3341 renegotiate=1 debug_level=2 \
Manuel Pégourié-Gonnard6093d812014-09-29 17:52:57 +02003342 force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \
3343 0 \
3344 -c "=> renegotiate" \
3345 -s "=> renegotiate" \
3346 -s "Extra-header:" \
3347 -c "HTTP/1.0 200 OK"
3348
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02003349needs_more_time 4
3350run_test "DTLS proxy: 3d, min handshake, server-initiated renego" \
Manuel Pégourié-Gonnarda6ace042014-10-15 12:44:41 +02003351 -p "$P_PXY drop=5 delay=5 duplicate=5" \
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02003352 "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
Manuel Pégourié-Gonnarda6ace042014-10-15 12:44:41 +02003353 psk=abc123 renegotiate=1 renegotiation=1 exchanges=4 \
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02003354 debug_level=2" \
3355 "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
Manuel Pégourié-Gonnarda6ace042014-10-15 12:44:41 +02003356 renegotiation=1 exchanges=4 debug_level=2 \
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02003357 force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \
3358 0 \
3359 -c "=> renegotiate" \
3360 -s "=> renegotiate" \
3361 -s "Extra-header:" \
3362 -c "HTTP/1.0 200 OK"
3363
3364needs_more_time 4
3365run_test "DTLS proxy: 3d, min handshake, server-initiated renego, nbio" \
Manuel Pégourié-Gonnarda6ace042014-10-15 12:44:41 +02003366 -p "$P_PXY drop=5 delay=5 duplicate=5" \
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02003367 "$P_SRV dtls=1 hs_timeout=250-10000 tickets=0 auth_mode=none \
Manuel Pégourié-Gonnarda6ace042014-10-15 12:44:41 +02003368 psk=abc123 renegotiate=1 renegotiation=1 exchanges=4 \
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02003369 debug_level=2 nbio=2" \
3370 "$P_CLI dtls=1 hs_timeout=250-10000 tickets=0 psk=abc123 \
Manuel Pégourié-Gonnarda6ace042014-10-15 12:44:41 +02003371 renegotiation=1 exchanges=4 debug_level=2 nbio=2 \
Manuel Pégourié-Gonnardba958b82014-10-09 16:13:44 +02003372 force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \
3373 0 \
3374 -c "=> renegotiate" \
3375 -s "=> renegotiate" \
3376 -s "Extra-header:" \
3377 -c "HTTP/1.0 200 OK"
3378
Manuel Pégourié-Gonnard127ab882014-10-09 17:59:32 +02003379needs_more_time 6
Manuel Pégourié-Gonnardd68434e2015-08-31 12:48:22 +02003380not_with_valgrind # risk of non-mbedtls peer timing out
Manuel Pégourié-Gonnard9590e0a2014-09-26 16:27:59 +02003381run_test "DTLS proxy: 3d, openssl server" \
Manuel Pégourié-Gonnardd0fd1da2014-09-25 17:00:27 +02003382 -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \
3383 "$O_SRV -dtls1 -mtu 2048" \
Manuel Pégourié-Gonnard8fe411e2015-03-09 16:09:53 +00003384 "$P_CLI dtls=1 hs_timeout=250-60000 tickets=0" \
Manuel Pégourié-Gonnardd0fd1da2014-09-25 17:00:27 +02003385 0 \
Manuel Pégourié-Gonnardd0fd1da2014-09-25 17:00:27 +02003386 -c "HTTP/1.0 200 OK"
3387
Manuel Pégourié-Gonnard22404862015-05-14 12:11:45 +02003388needs_more_time 8
Manuel Pégourié-Gonnardd68434e2015-08-31 12:48:22 +02003389not_with_valgrind # risk of non-mbedtls peer timing out
Manuel Pégourié-Gonnard9590e0a2014-09-26 16:27:59 +02003390run_test "DTLS proxy: 3d, openssl server, fragmentation" \
3391 -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \
3392 "$O_SRV -dtls1 -mtu 768" \
Manuel Pégourié-Gonnard8fe411e2015-03-09 16:09:53 +00003393 "$P_CLI dtls=1 hs_timeout=250-60000 tickets=0" \
Manuel Pégourié-Gonnard9590e0a2014-09-26 16:27:59 +02003394 0 \
Manuel Pégourié-Gonnard9590e0a2014-09-26 16:27:59 +02003395 -c "HTTP/1.0 200 OK"
3396
Manuel Pégourié-Gonnard22404862015-05-14 12:11:45 +02003397needs_more_time 8
Manuel Pégourié-Gonnardd68434e2015-08-31 12:48:22 +02003398not_with_valgrind # risk of non-mbedtls peer timing out
Manuel Pégourié-Gonnard6093d812014-09-29 17:52:57 +02003399run_test "DTLS proxy: 3d, openssl server, fragmentation, nbio" \
3400 -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \
3401 "$O_SRV -dtls1 -mtu 768" \
Manuel Pégourié-Gonnard8fe411e2015-03-09 16:09:53 +00003402 "$P_CLI dtls=1 hs_timeout=250-60000 nbio=2 tickets=0" \
Manuel Pégourié-Gonnard6093d812014-09-29 17:52:57 +02003403 0 \
Manuel Pégourié-Gonnard6093d812014-09-29 17:52:57 +02003404 -c "HTTP/1.0 200 OK"
3405
Manuel Pégourié-Gonnard96999962015-02-17 16:02:37 +00003406requires_gnutls
Manuel Pégourié-Gonnard127ab882014-10-09 17:59:32 +02003407needs_more_time 6
Manuel Pégourié-Gonnardd68434e2015-08-31 12:48:22 +02003408not_with_valgrind # risk of non-mbedtls peer timing out
Manuel Pégourié-Gonnard9590e0a2014-09-26 16:27:59 +02003409run_test "DTLS proxy: 3d, gnutls server" \
3410 -p "$P_PXY drop=5 delay=5 duplicate=5" \
3411 "$G_SRV -u --mtu 2048 -a" \
Manuel Pégourié-Gonnardf1384472014-10-14 22:57:46 +02003412 "$P_CLI dtls=1 hs_timeout=250-60000" \
Manuel Pégourié-Gonnard9590e0a2014-09-26 16:27:59 +02003413 0 \
3414 -s "Extra-header:" \
3415 -c "Extra-header:"
3416
Manuel Pégourié-Gonnard96999962015-02-17 16:02:37 +00003417requires_gnutls
Manuel Pégourié-Gonnard22404862015-05-14 12:11:45 +02003418needs_more_time 8
Manuel Pégourié-Gonnardd68434e2015-08-31 12:48:22 +02003419not_with_valgrind # risk of non-mbedtls peer timing out
Manuel Pégourié-Gonnard9590e0a2014-09-26 16:27:59 +02003420run_test "DTLS proxy: 3d, gnutls server, fragmentation" \
3421 -p "$P_PXY drop=5 delay=5 duplicate=5" \
3422 "$G_SRV -u --mtu 512" \
Manuel Pégourié-Gonnardf1384472014-10-14 22:57:46 +02003423 "$P_CLI dtls=1 hs_timeout=250-60000" \
Manuel Pégourié-Gonnard9590e0a2014-09-26 16:27:59 +02003424 0 \
3425 -s "Extra-header:" \
3426 -c "Extra-header:"
3427
Manuel Pégourié-Gonnard96999962015-02-17 16:02:37 +00003428requires_gnutls
Manuel Pégourié-Gonnard22404862015-05-14 12:11:45 +02003429needs_more_time 8
Manuel Pégourié-Gonnardd68434e2015-08-31 12:48:22 +02003430not_with_valgrind # risk of non-mbedtls peer timing out
Manuel Pégourié-Gonnard6093d812014-09-29 17:52:57 +02003431run_test "DTLS proxy: 3d, gnutls server, fragmentation, nbio" \
3432 -p "$P_PXY drop=5 delay=5 duplicate=5" \
3433 "$G_SRV -u --mtu 512" \
Manuel Pégourié-Gonnardf1384472014-10-14 22:57:46 +02003434 "$P_CLI dtls=1 hs_timeout=250-60000 nbio=2" \
Manuel Pégourié-Gonnard6093d812014-09-29 17:52:57 +02003435 0 \
3436 -s "Extra-header:" \
3437 -c "Extra-header:"
3438
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01003439# Final report
3440
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01003441echo "------------------------------------------------------------------------"
3442
3443if [ $FAILS = 0 ]; then
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +01003444 printf "PASSED"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01003445else
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +01003446 printf "FAILED"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01003447fi
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02003448PASSES=$(( $TESTS - $FAILS ))
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +02003449echo " ($PASSES / $TESTS tests ($SKIPS skipped))"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01003450
3451exit $FAILS