blob: c2ea8821dfa4aad43a1c2e930f8ffef83cb56efe [file] [log] [blame]
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001#!/bin/sh
Paul Bakkeraccd4eb2013-07-19 13:41:51 +02002
Simon Butcherac22d112016-09-04 22:31:09 +01003# compat.sh
4#
Bence Szépkúti1e148272020-08-07 13:07:28 +02005# Copyright The Mbed TLS Contributors
Dave Rodgman7ff79652023-11-03 12:04:52 +00006# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
Bence Szépkútic7da1fe2020-05-26 01:54:15 +02007#
Simon Butcherac22d112016-09-04 22:31:09 +01008# Purpose
9#
10# Test interoperbility with OpenSSL, GnuTLS as well as itself.
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +010011#
12# Check each common ciphersuite, with each version, both ways (client/server),
13# with and without client authentication.
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +010014
Manuel Pégourié-Gonnard913030c2014-03-28 10:12:38 +010015set -u
16
Jaeden Amero6e70eb22019-07-03 13:51:04 +010017# Limit the size of each log to 10 GiB, in case of failures with this script
18# where it may output seemingly unlimited length error logs.
19ulimit -f 20971520
20
Yanray Wang44ba9692023-02-20 14:58:03 +080021ORIGINAL_PWD=$PWD
22if ! cd "$(dirname "$0")"; then
23 exit 125
24fi
25
Manuel Pégourié-Gonnarda1a9f9a2014-03-25 18:04:59 +010026# initialise counters
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +020027TESTS=0
28FAILED=0
29SKIPPED=0
30SRVMEM=0
Manuel Pégourié-Gonnard70064fd2013-08-27 22:00:47 +020031
Antonin Décimo36e89b52019-01-23 15:24:37 +010032# default commands, can be overridden by the environment
Simon Butcherac22d112016-09-04 22:31:09 +010033: ${M_SRV:=../programs/ssl/ssl_server2}
34: ${M_CLI:=../programs/ssl/ssl_client2}
Manuel Pégourié-Gonnard89d40272022-12-19 11:42:12 +010035: ${OPENSSL:=openssl}
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +010036: ${GNUTLS_CLI:=gnutls-cli}
37: ${GNUTLS_SERV:=gnutls-serv}
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +010038
Manuel Pégourié-Gonnard89d40272022-12-19 11:42:12 +010039# The OPENSSL variable used to be OPENSSL_CMD for historical reasons.
40# To help the migration, error out if the old variable is set,
41# but only if it has a different value than the new one.
42if [ "${OPENSSL_CMD+set}" = set ]; then
43 # the variable is set, we can now check its value
44 if [ "$OPENSSL_CMD" != "$OPENSSL" ]; then
45 echo "Please use OPENSSL instead of OPENSSL_CMD." >&2
46 exit 125
47 fi
48fi
49
Manuel Pégourié-Gonnard1287f112014-08-31 16:20:58 +020050# do we have a recent enough GnuTLS?
Manuel Pégourié-Gonnard03db6b02015-06-26 15:45:30 +020051if ( which $GNUTLS_CLI && which $GNUTLS_SERV ) >/dev/null 2>&1; then
Manuel Pégourié-Gonnarddd459272014-10-24 12:57:37 +020052 G_VER="$( $GNUTLS_CLI --version | head -n1 )"
53 if echo "$G_VER" | grep '@VERSION@' > /dev/null; then # git version
Manuel Pégourié-Gonnard1287f112014-08-31 16:20:58 +020054 PEER_GNUTLS=" GnuTLS"
Manuel Pégourié-Gonnarddd459272014-10-24 12:57:37 +020055 else
56 eval $( echo $G_VER | sed 's/.* \([0-9]*\)\.\([0-9]\)*\.\([0-9]*\)$/MAJOR="\1" MINOR="\2" PATCH="\3"/' )
57 if [ $MAJOR -lt 3 -o \
58 \( $MAJOR -eq 3 -a $MINOR -lt 2 \) -o \
59 \( $MAJOR -eq 3 -a $MINOR -eq 2 -a $PATCH -lt 15 \) ]
60 then
61 PEER_GNUTLS=""
62 else
63 PEER_GNUTLS=" GnuTLS"
Manuel Pégourié-Gonnardc36b4322018-06-14 13:14:29 +020064 if [ $MINOR -lt 4 ]; then
65 GNUTLS_MINOR_LT_FOUR='x'
66 fi
Manuel Pégourié-Gonnarddd459272014-10-24 12:57:37 +020067 fi
Manuel Pégourié-Gonnard1287f112014-08-31 16:20:58 +020068 fi
69else
70 PEER_GNUTLS=""
71fi
72
Yanray Wang44ba9692023-02-20 14:58:03 +080073guess_config_name() {
74 if git diff --quiet ../include/mbedtls/config.h 2>/dev/null; then
75 echo "default"
76 else
77 echo "unknown"
78 fi
79}
80: ${MBEDTLS_TEST_OUTCOME_FILE=}
81: ${MBEDTLS_TEST_CONFIGURATION:="$(guess_config_name)"}
82: ${MBEDTLS_TEST_PLATFORM:="$(uname -s | tr -c \\n0-9A-Za-z _)-$(uname -m | tr -c \\n0-9A-Za-z _)"}
83
Manuel Pégourié-Gonnarda1a9f9a2014-03-25 18:04:59 +010084# default values for options
Manuel Pégourié-Gonnard6abc6252022-04-14 09:21:56 +020085# /!\ keep this synchronised with:
86# - basic-build-test.sh
87# - all.sh (multiple components)
88MODES="tls1 tls1_1 tls12 dtls1 dtls12" # ssl3 not in default config
Paul Bakker1eeceae2012-11-23 14:25:34 +010089VERIFIES="NO YES"
Manuel Pégourié-Gonnard7ebaf372013-08-27 21:03:33 +020090TYPES="ECDSA RSA PSK"
Paul Bakkeraccd4eb2013-07-19 13:41:51 +020091FILTER=""
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +010092# exclude:
Manuel Pégourié-Gonnard6abc6252022-04-14 09:21:56 +020093# - NULL: excluded from our default config + requires OpenSSL legacy
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +010094# - RC4, single-DES: requires legacy OpenSSL/GnuTLS versions
Manuel Pégourié-Gonnard6abc6252022-04-14 09:21:56 +020095# - 3DES: not in default config
Manuel Pégourié-Gonnard2268b962018-02-27 12:22:36 +010096# - ARIA: not in default config.h + requires OpenSSL >= 1.1.1
Manuel Pégourié-Gonnard9fece7e2018-06-18 11:38:22 +020097# - ChachaPoly: requires OpenSSL >= 1.1.0
Andres Amaya Garcia419bd002019-02-19 20:20:57 +000098EXCLUDE='NULL\|DES\|RC4\|ARCFOUR\|ARIA\|CHACHA20-POLY1305'
Paul Bakkeraccd4eb2013-07-19 13:41:51 +020099VERBOSE=""
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100100MEMCHECK=0
Gilles Peskine67bf9f62023-08-28 17:36:22 +0200101PRESERVE_LOGS=0
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +0000102PEERS="OpenSSL$PEER_GNUTLS mbedTLS"
Paul Bakkeraccd4eb2013-07-19 13:41:51 +0200103
Manuel Pégourié-Gonnard39e2ca92015-08-04 16:43:37 +0200104# hidden option: skip DTLS with OpenSSL
105# (travis CI has a version that doesn't work for us)
106: ${OSSL_NO_DTLS:=0}
107
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100108print_usage() {
109 echo "Usage: $0"
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +0100110 printf " -h|--help\tPrint this help.\n"
Gilles Peskine231befa2020-08-26 20:05:11 +0200111 printf " -f|--filter\tOnly matching ciphersuites are tested (Default: '%s')\n" "$FILTER"
112 printf " -e|--exclude\tMatching ciphersuites are excluded (Default: '%s')\n" "$EXCLUDE"
113 printf " -m|--modes\tWhich modes to perform (Default: '%s')\n" "$MODES"
114 printf " -t|--types\tWhich key exchange type to perform (Default: '%s')\n" "$TYPES"
115 printf " -V|--verify\tWhich verification modes to perform (Default: '%s')\n" "$VERIFIES"
116 printf " -p|--peers\tWhich peers to use (Default: '%s')\n" "$PEERS"
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +0100117 printf " \tAlso available: GnuTLS (needs v3.2.15 or higher)\n"
118 printf " -M|--memcheck\tCheck memory leaks and errors.\n"
119 printf " -v|--verbose\tSet verbose output.\n"
Tomás Gonzálezaaea3a32023-09-13 11:41:29 +0100120 printf " --list-test-cases\tList all potential test cases (No Execution)\n"
Yanray Wang44ba9692023-02-20 14:58:03 +0800121 printf " --outcome-file\tFile where test outcomes are written\n"
122 printf " \t(default: \$MBEDTLS_TEST_OUTCOME_FILE, none if empty)\n"
Gilles Peskine67bf9f62023-08-28 17:36:22 +0200123 printf " --preserve-logs\tPreserve logs of successful tests as well\n"
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100124}
125
Yanray Wangf0dbde12023-03-02 11:55:55 +0800126# print_test_case <CLIENT> <SERVER> <STANDARD_CIPHER_SUITE>
127print_test_case() {
128 for i in $3; do
129 uniform_title $1 $2 $i
130 echo $TITLE
131 done
132}
133
Yanray Wang88448442023-03-03 17:12:29 +0800134# list_test_case lists all potential test cases in compat.sh without execution
Tomás Gonzálezaaea3a32023-09-13 11:41:29 +0100135list_test_cases() {
Yanray Wangb2cd07c2023-08-30 12:07:26 +0800136 for MODE in $MODES; do
137 for TYPE in $TYPES; do
Pengyu Lv8fa06dc2023-12-01 14:23:27 +0800138 # PSK cipher suites do not allow client certificate verification.
139 SUB_VERIFIES=$VERIFIES
140 if [ "$TYPE" = "PSK" ]; then
141 SUB_VERIFIES="NO"
142 fi
143 for VERIFY in $SUB_VERIFIES; do
Yanray Wangb2cd07c2023-08-30 12:07:26 +0800144 VERIF=$(echo $VERIFY | tr '[:upper:]' '[:lower:]')
145 reset_ciphersuites
146 add_common_ciphersuites
147 add_openssl_ciphersuites
148 add_gnutls_ciphersuites
149 add_mbedtls_ciphersuites
150 print_test_case m O "$O_CIPHERS"
151 print_test_case O m "$O_CIPHERS"
152 print_test_case m G "$G_CIPHERS"
Pengyu Lvac0b3502023-12-01 14:25:40 +0800153 print_test_case G m "$G_CIPHERS"
Yanray Wangb2cd07c2023-08-30 12:07:26 +0800154 print_test_case m m "$M_CIPHERS"
155 done
Yanray Wangdd21fc92023-02-23 10:04:58 +0800156 done
157 done
158}
159
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100160get_options() {
161 while [ $# -gt 0 ]; do
162 case "$1" in
163 -f|--filter)
164 shift; FILTER=$1
165 ;;
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +0100166 -e|--exclude)
167 shift; EXCLUDE=$1
168 ;;
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100169 -m|--modes)
170 shift; MODES=$1
171 ;;
172 -t|--types)
173 shift; TYPES=$1
174 ;;
175 -V|--verify)
176 shift; VERIFIES=$1
177 ;;
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +0100178 -p|--peers)
179 shift; PEERS=$1
180 ;;
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100181 -v|--verbose)
182 VERBOSE=1
183 ;;
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100184 -M|--memcheck)
185 MEMCHECK=1
186 ;;
Yanray Wang88448442023-03-03 17:12:29 +0800187 # Please check scripts/check_test_cases.py correspondingly
Tomás Gonzálezaaea3a32023-09-13 11:41:29 +0100188 # if you have to modify option, --list-test-cases
189 --list-test-cases)
190 list_test_cases
Yanray Wang8aba83b2023-03-06 19:37:07 +0800191 exit $?
Yanray Wangdd21fc92023-02-23 10:04:58 +0800192 ;;
Yanray Wang44ba9692023-02-20 14:58:03 +0800193 --outcome-file)
194 shift; MBEDTLS_TEST_OUTCOME_FILE=$1
195 ;;
Gilles Peskine67bf9f62023-08-28 17:36:22 +0200196 --preserve-logs)
197 PRESERVE_LOGS=1
198 ;;
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100199 -h|--help)
200 print_usage
201 exit 0
202 ;;
203 *)
204 echo "Unknown argument: '$1'"
205 print_usage
206 exit 1
207 ;;
208 esac
209 shift
210 done
Manuel Pégourié-Gonnard85a41782014-10-24 12:47:26 +0200211
212 # sanitize some options (modes checked later)
213 VERIFIES="$( echo $VERIFIES | tr [a-z] [A-Z] )"
214 TYPES="$( echo $TYPES | tr [a-z] [A-Z] )"
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100215}
Paul Bakkeraccd4eb2013-07-19 13:41:51 +0200216
Manuel Pégourié-Gonnard95957712014-02-19 15:29:38 +0100217log() {
Paul Bakkeraccd4eb2013-07-19 13:41:51 +0200218 if [ "X" != "X$VERBOSE" ]; then
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100219 echo ""
Paul Bakkeraccd4eb2013-07-19 13:41:51 +0200220 echo "$@"
221 fi
222}
Paul Bakker10cd2252012-04-12 21:26:34 +0000223
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100224# is_dtls <mode>
225is_dtls()
226{
Xiaofei Baif40545d2021-12-02 08:43:35 +0000227 test "$1" = "dtls1" -o "$1" = "dtls12"
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100228}
229
230# minor_ver <mode>
231minor_ver()
232{
233 case "$1" in
234 ssl3)
235 echo 0
236 ;;
237 tls1)
238 echo 1
239 ;;
240 tls1_1|dtls1)
241 echo 2
242 ;;
Xiaofei Baif40545d2021-12-02 08:43:35 +0000243 tls12|dtls12)
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100244 echo 3
245 ;;
246 *)
247 echo "error: invalid mode: $MODE" >&2
248 # exiting is no good here, typically called in a subshell
249 echo -1
250 esac
251}
252
Manuel Pégourié-Gonnarddfc8d5a2013-08-27 20:48:40 +0200253filter()
254{
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +0100255 LIST="$1"
Manuel Pégourié-Gonnarddfc8d5a2013-08-27 20:48:40 +0200256 NEW_LIST=""
257
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100258 if is_dtls "$MODE"; then
Manuel Pégourié-Gonnard29980b12014-07-10 20:12:56 +0200259 EXCLMODE="$EXCLUDE"'\|RC4\|ARCFOUR'
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100260 else
261 EXCLMODE="$EXCLUDE"
262 fi
263
Manuel Pégourié-Gonnarddfc8d5a2013-08-27 20:48:40 +0200264 for i in $LIST;
265 do
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100266 NEW_LIST="$NEW_LIST $( echo "$i" | grep "$FILTER" | grep -v "$EXCLMODE" )"
Manuel Pégourié-Gonnarddfc8d5a2013-08-27 20:48:40 +0200267 done
268
Manuel Pégourié-Gonnard911622d2014-02-27 11:50:40 +0100269 # normalize whitespace
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +0100270 echo "$NEW_LIST" | sed -e 's/[[:space:]][[:space:]]*/ /g' -e 's/^ //' -e 's/ $//'
Manuel Pégourié-Gonnarddfc8d5a2013-08-27 20:48:40 +0200271}
272
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100273filter_ciphersuites()
274{
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +0100275 if [ "X" != "X$FILTER" -o "X" != "X$EXCLUDE" ];
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100276 then
Gilles Peskinef08ca832023-09-12 19:21:54 +0200277 # Ciphersuite for Mbed TLS
Simon Butcherac22d112016-09-04 22:31:09 +0100278 M_CIPHERS=$( filter "$M_CIPHERS" )
279
280 # Ciphersuite for OpenSSL
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +0100281 O_CIPHERS=$( filter "$O_CIPHERS" )
Simon Butcherac22d112016-09-04 22:31:09 +0100282
283 # Ciphersuite for GnuTLS
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +0100284 G_CIPHERS=$( filter "$G_CIPHERS" )
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100285 fi
286}
287
288reset_ciphersuites()
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100289{
Simon Butcherac22d112016-09-04 22:31:09 +0100290 M_CIPHERS=""
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100291 O_CIPHERS=""
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100292 G_CIPHERS=""
293}
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100294
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100295# Ciphersuites that can be used with all peers.
296# Since we currently have three possible peers, each ciphersuite should appear
297# three times: in each peer's list (with the name that this peer uses).
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100298add_common_ciphersuites()
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100299{
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100300 case $TYPE in
301
302 "ECDSA")
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100303 if [ `minor_ver "$MODE"` -gt 0 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100304 then
Simon Butcherac22d112016-09-04 22:31:09 +0100305 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100306 TLS-ECDHE-ECDSA-WITH-NULL-SHA \
307 TLS-ECDHE-ECDSA-WITH-RC4-128-SHA \
308 TLS-ECDHE-ECDSA-WITH-3DES-EDE-CBC-SHA \
309 TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA \
310 TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100311 "
312 G_CIPHERS="$G_CIPHERS \
313 +ECDHE-ECDSA:+NULL:+SHA1 \
314 +ECDHE-ECDSA:+ARCFOUR-128:+SHA1 \
315 +ECDHE-ECDSA:+3DES-CBC:+SHA1 \
316 +ECDHE-ECDSA:+AES-128-CBC:+SHA1 \
317 +ECDHE-ECDSA:+AES-256-CBC:+SHA1 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100318 "
319 O_CIPHERS="$O_CIPHERS \
320 ECDHE-ECDSA-NULL-SHA \
321 ECDHE-ECDSA-RC4-SHA \
322 ECDHE-ECDSA-DES-CBC3-SHA \
323 ECDHE-ECDSA-AES128-SHA \
324 ECDHE-ECDSA-AES256-SHA \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100325 "
326 fi
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100327 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100328 then
Simon Butcherac22d112016-09-04 22:31:09 +0100329 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100330 TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 \
331 TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384 \
332 TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \
333 TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100334 "
335 G_CIPHERS="$G_CIPHERS \
336 +ECDHE-ECDSA:+AES-128-CBC:+SHA256 \
337 +ECDHE-ECDSA:+AES-256-CBC:+SHA384 \
338 +ECDHE-ECDSA:+AES-128-GCM:+AEAD \
339 +ECDHE-ECDSA:+AES-256-GCM:+AEAD \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100340 "
341 O_CIPHERS="$O_CIPHERS \
342 ECDHE-ECDSA-AES128-SHA256 \
343 ECDHE-ECDSA-AES256-SHA384 \
344 ECDHE-ECDSA-AES128-GCM-SHA256 \
345 ECDHE-ECDSA-AES256-GCM-SHA384 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100346 "
347 fi
348 ;;
349
350 "RSA")
Simon Butcherac22d112016-09-04 22:31:09 +0100351 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100352 TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
353 TLS-DHE-RSA-WITH-AES-256-CBC-SHA \
354 TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA \
355 TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA \
356 TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA \
357 TLS-RSA-WITH-AES-256-CBC-SHA \
358 TLS-RSA-WITH-CAMELLIA-256-CBC-SHA \
359 TLS-RSA-WITH-AES-128-CBC-SHA \
360 TLS-RSA-WITH-CAMELLIA-128-CBC-SHA \
361 TLS-RSA-WITH-3DES-EDE-CBC-SHA \
362 TLS-RSA-WITH-RC4-128-SHA \
363 TLS-RSA-WITH-RC4-128-MD5 \
364 TLS-RSA-WITH-NULL-MD5 \
365 TLS-RSA-WITH-NULL-SHA \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100366 "
367 G_CIPHERS="$G_CIPHERS \
368 +DHE-RSA:+AES-128-CBC:+SHA1 \
369 +DHE-RSA:+AES-256-CBC:+SHA1 \
370 +DHE-RSA:+CAMELLIA-128-CBC:+SHA1 \
371 +DHE-RSA:+CAMELLIA-256-CBC:+SHA1 \
372 +DHE-RSA:+3DES-CBC:+SHA1 \
373 +RSA:+AES-256-CBC:+SHA1 \
374 +RSA:+CAMELLIA-256-CBC:+SHA1 \
375 +RSA:+AES-128-CBC:+SHA1 \
376 +RSA:+CAMELLIA-128-CBC:+SHA1 \
377 +RSA:+3DES-CBC:+SHA1 \
378 +RSA:+ARCFOUR-128:+SHA1 \
379 +RSA:+ARCFOUR-128:+MD5 \
380 +RSA:+NULL:+MD5 \
381 +RSA:+NULL:+SHA1 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100382 "
383 O_CIPHERS="$O_CIPHERS \
384 DHE-RSA-AES128-SHA \
385 DHE-RSA-AES256-SHA \
386 DHE-RSA-CAMELLIA128-SHA \
387 DHE-RSA-CAMELLIA256-SHA \
388 EDH-RSA-DES-CBC3-SHA \
389 AES256-SHA \
390 CAMELLIA256-SHA \
391 AES128-SHA \
392 CAMELLIA128-SHA \
393 DES-CBC3-SHA \
394 RC4-SHA \
395 RC4-MD5 \
396 NULL-MD5 \
397 NULL-SHA \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100398 "
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100399 if [ `minor_ver "$MODE"` -gt 0 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100400 then
Simon Butcherac22d112016-09-04 22:31:09 +0100401 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100402 TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA \
403 TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA \
404 TLS-ECDHE-RSA-WITH-3DES-EDE-CBC-SHA \
405 TLS-ECDHE-RSA-WITH-RC4-128-SHA \
406 TLS-ECDHE-RSA-WITH-NULL-SHA \
407 "
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100408 G_CIPHERS="$G_CIPHERS \
409 +ECDHE-RSA:+AES-128-CBC:+SHA1 \
410 +ECDHE-RSA:+AES-256-CBC:+SHA1 \
411 +ECDHE-RSA:+3DES-CBC:+SHA1 \
412 +ECDHE-RSA:+ARCFOUR-128:+SHA1 \
413 +ECDHE-RSA:+NULL:+SHA1 \
414 "
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100415 O_CIPHERS="$O_CIPHERS \
416 ECDHE-RSA-AES256-SHA \
417 ECDHE-RSA-AES128-SHA \
418 ECDHE-RSA-DES-CBC3-SHA \
419 ECDHE-RSA-RC4-SHA \
420 ECDHE-RSA-NULL-SHA \
421 "
422 fi
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100423 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100424 then
Simon Butcherac22d112016-09-04 22:31:09 +0100425 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100426 TLS-RSA-WITH-AES-128-CBC-SHA256 \
427 TLS-DHE-RSA-WITH-AES-128-CBC-SHA256 \
428 TLS-RSA-WITH-AES-256-CBC-SHA256 \
429 TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 \
430 TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256 \
431 TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384 \
432 TLS-RSA-WITH-AES-128-GCM-SHA256 \
433 TLS-RSA-WITH-AES-256-GCM-SHA384 \
434 TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 \
435 TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 \
436 TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256 \
437 TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 \
438 "
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100439 G_CIPHERS="$G_CIPHERS \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100440 +RSA:+AES-128-CBC:+SHA256 \
441 +DHE-RSA:+AES-128-CBC:+SHA256 \
442 +RSA:+AES-256-CBC:+SHA256 \
443 +DHE-RSA:+AES-256-CBC:+SHA256 \
444 +ECDHE-RSA:+AES-128-CBC:+SHA256 \
445 +ECDHE-RSA:+AES-256-CBC:+SHA384 \
446 +RSA:+AES-128-GCM:+AEAD \
447 +RSA:+AES-256-GCM:+AEAD \
448 +DHE-RSA:+AES-128-GCM:+AEAD \
449 +DHE-RSA:+AES-256-GCM:+AEAD \
450 +ECDHE-RSA:+AES-128-GCM:+AEAD \
451 +ECDHE-RSA:+AES-256-GCM:+AEAD \
452 "
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100453 O_CIPHERS="$O_CIPHERS \
454 NULL-SHA256 \
455 AES128-SHA256 \
456 DHE-RSA-AES128-SHA256 \
457 AES256-SHA256 \
458 DHE-RSA-AES256-SHA256 \
459 ECDHE-RSA-AES128-SHA256 \
460 ECDHE-RSA-AES256-SHA384 \
461 AES128-GCM-SHA256 \
462 DHE-RSA-AES128-GCM-SHA256 \
463 AES256-GCM-SHA384 \
464 DHE-RSA-AES256-GCM-SHA384 \
465 ECDHE-RSA-AES128-GCM-SHA256 \
466 ECDHE-RSA-AES256-GCM-SHA384 \
467 "
468 fi
469 ;;
470
471 "PSK")
Simon Butcherac22d112016-09-04 22:31:09 +0100472 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100473 TLS-PSK-WITH-RC4-128-SHA \
474 TLS-PSK-WITH-3DES-EDE-CBC-SHA \
475 TLS-PSK-WITH-AES-128-CBC-SHA \
476 TLS-PSK-WITH-AES-256-CBC-SHA \
477 "
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100478 G_CIPHERS="$G_CIPHERS \
479 +PSK:+ARCFOUR-128:+SHA1 \
480 +PSK:+3DES-CBC:+SHA1 \
481 +PSK:+AES-128-CBC:+SHA1 \
482 +PSK:+AES-256-CBC:+SHA1 \
483 "
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100484 O_CIPHERS="$O_CIPHERS \
485 PSK-RC4-SHA \
486 PSK-3DES-EDE-CBC-SHA \
487 PSK-AES128-CBC-SHA \
488 PSK-AES256-CBC-SHA \
489 "
490 ;;
491 esac
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100492}
493
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100494# Ciphersuites usable only with Mbed TLS and OpenSSL
495# Each ciphersuite should appear two times, once with its OpenSSL name, once
496# with its Mbed TLS name.
497#
498# NOTE: for some reason RSA-PSK doesn't work with OpenSSL,
Manuel Pégourié-Gonnardce5673c2018-03-06 09:54:10 +0100499# so RSA-PSK ciphersuites need to go in other sections, see
Dave Rodgman52af7692022-03-31 14:27:24 +0100500# https://github.com/Mbed-TLS/mbedtls/issues/1419
Manuel Pégourié-Gonnard9fece7e2018-06-18 11:38:22 +0200501#
502# ChachaPoly suites are here rather than in "common", as they were added in
503# GnuTLS in 3.5.0 and the CI only has 3.4.x so far.
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100504add_openssl_ciphersuites()
505{
506 case $TYPE in
507
508 "ECDSA")
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100509 if [ `minor_ver "$MODE"` -gt 0 ]
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100510 then
Simon Butcherac22d112016-09-04 22:31:09 +0100511 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100512 TLS-ECDH-ECDSA-WITH-NULL-SHA \
513 TLS-ECDH-ECDSA-WITH-RC4-128-SHA \
514 TLS-ECDH-ECDSA-WITH-3DES-EDE-CBC-SHA \
515 TLS-ECDH-ECDSA-WITH-AES-128-CBC-SHA \
516 TLS-ECDH-ECDSA-WITH-AES-256-CBC-SHA \
517 "
518 O_CIPHERS="$O_CIPHERS \
519 ECDH-ECDSA-NULL-SHA \
520 ECDH-ECDSA-RC4-SHA \
521 ECDH-ECDSA-DES-CBC3-SHA \
522 ECDH-ECDSA-AES128-SHA \
523 ECDH-ECDSA-AES256-SHA \
524 "
525 fi
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100526 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100527 then
Simon Butcherac22d112016-09-04 22:31:09 +0100528 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100529 TLS-ECDH-ECDSA-WITH-AES-128-CBC-SHA256 \
530 TLS-ECDH-ECDSA-WITH-AES-256-CBC-SHA384 \
531 TLS-ECDH-ECDSA-WITH-AES-128-GCM-SHA256 \
532 TLS-ECDH-ECDSA-WITH-AES-256-GCM-SHA384 \
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100533 TLS-ECDHE-ECDSA-WITH-ARIA-256-GCM-SHA384 \
534 TLS-ECDHE-ECDSA-WITH-ARIA-128-GCM-SHA256 \
Manuel Pégourié-Gonnard9fece7e2018-06-18 11:38:22 +0200535 TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256 \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100536 "
537 O_CIPHERS="$O_CIPHERS \
538 ECDH-ECDSA-AES128-SHA256 \
539 ECDH-ECDSA-AES256-SHA384 \
540 ECDH-ECDSA-AES128-GCM-SHA256 \
541 ECDH-ECDSA-AES256-GCM-SHA384 \
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100542 ECDHE-ECDSA-ARIA256-GCM-SHA384 \
543 ECDHE-ECDSA-ARIA128-GCM-SHA256 \
Manuel Pégourié-Gonnard9fece7e2018-06-18 11:38:22 +0200544 ECDHE-ECDSA-CHACHA20-POLY1305 \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100545 "
546 fi
547 ;;
548
549 "RSA")
Simon Butcherac22d112016-09-04 22:31:09 +0100550 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100551 TLS-RSA-WITH-DES-CBC-SHA \
552 TLS-DHE-RSA-WITH-DES-CBC-SHA \
553 "
554 O_CIPHERS="$O_CIPHERS \
555 DES-CBC-SHA \
556 EDH-RSA-DES-CBC-SHA \
557 "
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100558 if [ `minor_ver "$MODE"` -ge 3 ]
559 then
560 M_CIPHERS="$M_CIPHERS \
561 TLS-ECDHE-RSA-WITH-ARIA-256-GCM-SHA384 \
562 TLS-DHE-RSA-WITH-ARIA-256-GCM-SHA384 \
Manuel Pégourié-Gonnardbba64062018-02-20 11:58:44 +0100563 TLS-RSA-WITH-ARIA-256-GCM-SHA384 \
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100564 TLS-ECDHE-RSA-WITH-ARIA-128-GCM-SHA256 \
565 TLS-DHE-RSA-WITH-ARIA-128-GCM-SHA256 \
Manuel Pégourié-Gonnardbba64062018-02-20 11:58:44 +0100566 TLS-RSA-WITH-ARIA-128-GCM-SHA256 \
Manuel Pégourié-Gonnard9fece7e2018-06-18 11:38:22 +0200567 TLS-DHE-RSA-WITH-CHACHA20-POLY1305-SHA256 \
568 TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256 \
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100569 "
570 O_CIPHERS="$O_CIPHERS \
571 ECDHE-ARIA256-GCM-SHA384 \
572 DHE-RSA-ARIA256-GCM-SHA384 \
Manuel Pégourié-Gonnardbba64062018-02-20 11:58:44 +0100573 ARIA256-GCM-SHA384 \
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100574 ECDHE-ARIA128-GCM-SHA256 \
575 DHE-RSA-ARIA128-GCM-SHA256 \
Manuel Pégourié-Gonnardbba64062018-02-20 11:58:44 +0100576 ARIA128-GCM-SHA256 \
Manuel Pégourié-Gonnard9fece7e2018-06-18 11:38:22 +0200577 DHE-RSA-CHACHA20-POLY1305 \
578 ECDHE-RSA-CHACHA20-POLY1305 \
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100579 "
580 fi
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100581 ;;
582
583 "PSK")
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100584 if [ `minor_ver "$MODE"` -ge 3 ]
585 then
586 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnardbba64062018-02-20 11:58:44 +0100587 TLS-DHE-PSK-WITH-ARIA-256-GCM-SHA384 \
588 TLS-DHE-PSK-WITH-ARIA-128-GCM-SHA256 \
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100589 TLS-PSK-WITH-ARIA-256-GCM-SHA384 \
590 TLS-PSK-WITH-ARIA-128-GCM-SHA256 \
Manuel Pégourié-Gonnard9fece7e2018-06-18 11:38:22 +0200591 TLS-PSK-WITH-CHACHA20-POLY1305-SHA256 \
592 TLS-ECDHE-PSK-WITH-CHACHA20-POLY1305-SHA256 \
593 TLS-DHE-PSK-WITH-CHACHA20-POLY1305-SHA256 \
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100594 "
595 O_CIPHERS="$O_CIPHERS \
Manuel Pégourié-Gonnardbba64062018-02-20 11:58:44 +0100596 DHE-PSK-ARIA256-GCM-SHA384 \
597 DHE-PSK-ARIA128-GCM-SHA256 \
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100598 PSK-ARIA256-GCM-SHA384 \
599 PSK-ARIA128-GCM-SHA256 \
Manuel Pégourié-Gonnard9fece7e2018-06-18 11:38:22 +0200600 DHE-PSK-CHACHA20-POLY1305 \
601 ECDHE-PSK-CHACHA20-POLY1305 \
602 PSK-CHACHA20-POLY1305 \
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100603 "
604 fi
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100605 ;;
606 esac
607}
608
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100609# Ciphersuites usable only with Mbed TLS and GnuTLS
610# Each ciphersuite should appear two times, once with its GnuTLS name, once
611# with its Mbed TLS name.
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100612add_gnutls_ciphersuites()
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100613{
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100614 case $TYPE in
615
616 "ECDSA")
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100617 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100618 then
Simon Butcherac22d112016-09-04 22:31:09 +0100619 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100620 TLS-ECDHE-ECDSA-WITH-CAMELLIA-128-CBC-SHA256 \
621 TLS-ECDHE-ECDSA-WITH-CAMELLIA-256-CBC-SHA384 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100622 TLS-ECDHE-ECDSA-WITH-CAMELLIA-128-GCM-SHA256 \
623 TLS-ECDHE-ECDSA-WITH-CAMELLIA-256-GCM-SHA384 \
Manuel Pégourié-Gonnardc36b4322018-06-14 13:14:29 +0200624 TLS-ECDHE-ECDSA-WITH-AES-128-CCM \
625 TLS-ECDHE-ECDSA-WITH-AES-256-CCM \
626 TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8 \
627 TLS-ECDHE-ECDSA-WITH-AES-256-CCM-8 \
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100628 "
629 G_CIPHERS="$G_CIPHERS \
630 +ECDHE-ECDSA:+CAMELLIA-128-CBC:+SHA256 \
631 +ECDHE-ECDSA:+CAMELLIA-256-CBC:+SHA384 \
632 +ECDHE-ECDSA:+CAMELLIA-128-GCM:+AEAD \
633 +ECDHE-ECDSA:+CAMELLIA-256-GCM:+AEAD \
Manuel Pégourié-Gonnardc36b4322018-06-14 13:14:29 +0200634 +ECDHE-ECDSA:+AES-128-CCM:+AEAD \
635 +ECDHE-ECDSA:+AES-256-CCM:+AEAD \
636 +ECDHE-ECDSA:+AES-128-CCM-8:+AEAD \
637 +ECDHE-ECDSA:+AES-256-CCM-8:+AEAD \
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100638 "
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100639 fi
640 ;;
641
642 "RSA")
Gilles Peskineebfcf582024-03-20 17:51:48 +0100643 # Not actually supported with all GnuTLS versions. See
644 # GNUTLS_HAS_TLS1_RSA_NULL_SHA256= below.
645 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard7457cb32014-07-13 13:57:24 +0200646 TLS-RSA-WITH-NULL-SHA256 \
647 "
Gilles Peskineebfcf582024-03-20 17:51:48 +0100648 G_CIPHERS="$G_CIPHERS \
Manuel Pégourié-Gonnard7457cb32014-07-13 13:57:24 +0200649 +RSA:+NULL:+SHA256 \
650 "
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100651 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100652 then
Simon Butcherac22d112016-09-04 22:31:09 +0100653 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100654 TLS-ECDHE-RSA-WITH-CAMELLIA-128-CBC-SHA256 \
655 TLS-ECDHE-RSA-WITH-CAMELLIA-256-CBC-SHA384 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100656 TLS-RSA-WITH-CAMELLIA-128-CBC-SHA256 \
657 TLS-RSA-WITH-CAMELLIA-256-CBC-SHA256 \
658 TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA256 \
659 TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA256 \
660 TLS-ECDHE-RSA-WITH-CAMELLIA-128-GCM-SHA256 \
661 TLS-ECDHE-RSA-WITH-CAMELLIA-256-GCM-SHA384 \
662 TLS-DHE-RSA-WITH-CAMELLIA-128-GCM-SHA256 \
663 TLS-DHE-RSA-WITH-CAMELLIA-256-GCM-SHA384 \
664 TLS-RSA-WITH-CAMELLIA-128-GCM-SHA256 \
665 TLS-RSA-WITH-CAMELLIA-256-GCM-SHA384 \
Manuel Pégourié-Gonnardc36b4322018-06-14 13:14:29 +0200666 TLS-RSA-WITH-AES-128-CCM \
667 TLS-RSA-WITH-AES-256-CCM \
668 TLS-DHE-RSA-WITH-AES-128-CCM \
669 TLS-DHE-RSA-WITH-AES-256-CCM \
670 TLS-RSA-WITH-AES-128-CCM-8 \
671 TLS-RSA-WITH-AES-256-CCM-8 \
672 TLS-DHE-RSA-WITH-AES-128-CCM-8 \
673 TLS-DHE-RSA-WITH-AES-256-CCM-8 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100674 "
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100675 G_CIPHERS="$G_CIPHERS \
676 +ECDHE-RSA:+CAMELLIA-128-CBC:+SHA256 \
677 +ECDHE-RSA:+CAMELLIA-256-CBC:+SHA384 \
678 +RSA:+CAMELLIA-128-CBC:+SHA256 \
679 +RSA:+CAMELLIA-256-CBC:+SHA256 \
680 +DHE-RSA:+CAMELLIA-128-CBC:+SHA256 \
681 +DHE-RSA:+CAMELLIA-256-CBC:+SHA256 \
682 +ECDHE-RSA:+CAMELLIA-128-GCM:+AEAD \
683 +ECDHE-RSA:+CAMELLIA-256-GCM:+AEAD \
684 +DHE-RSA:+CAMELLIA-128-GCM:+AEAD \
685 +DHE-RSA:+CAMELLIA-256-GCM:+AEAD \
686 +RSA:+CAMELLIA-128-GCM:+AEAD \
687 +RSA:+CAMELLIA-256-GCM:+AEAD \
Manuel Pégourié-Gonnardc36b4322018-06-14 13:14:29 +0200688 +RSA:+AES-128-CCM:+AEAD \
689 +RSA:+AES-256-CCM:+AEAD \
690 +RSA:+AES-128-CCM-8:+AEAD \
691 +RSA:+AES-256-CCM-8:+AEAD \
692 +DHE-RSA:+AES-128-CCM:+AEAD \
693 +DHE-RSA:+AES-256-CCM:+AEAD \
694 +DHE-RSA:+AES-128-CCM-8:+AEAD \
695 +DHE-RSA:+AES-256-CCM-8:+AEAD \
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100696 "
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100697 fi
698 ;;
699
700 "PSK")
Simon Butcherac22d112016-09-04 22:31:09 +0100701 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnarde46aa5e2014-07-13 15:44:19 +0200702 TLS-DHE-PSK-WITH-3DES-EDE-CBC-SHA \
703 TLS-DHE-PSK-WITH-AES-128-CBC-SHA \
704 TLS-DHE-PSK-WITH-AES-256-CBC-SHA \
705 TLS-DHE-PSK-WITH-RC4-128-SHA \
706 "
707 G_CIPHERS="$G_CIPHERS \
708 +DHE-PSK:+3DES-CBC:+SHA1 \
709 +DHE-PSK:+AES-128-CBC:+SHA1 \
710 +DHE-PSK:+AES-256-CBC:+SHA1 \
711 +DHE-PSK:+ARCFOUR-128:+SHA1 \
712 "
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100713 if [ `minor_ver "$MODE"` -gt 0 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100714 then
Simon Butcherac22d112016-09-04 22:31:09 +0100715 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100716 TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA \
717 TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA \
718 TLS-ECDHE-PSK-WITH-3DES-EDE-CBC-SHA \
Manuel Pégourié-Gonnarde46aa5e2014-07-13 15:44:19 +0200719 TLS-ECDHE-PSK-WITH-RC4-128-SHA \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100720 TLS-RSA-PSK-WITH-3DES-EDE-CBC-SHA \
721 TLS-RSA-PSK-WITH-AES-256-CBC-SHA \
722 TLS-RSA-PSK-WITH-AES-128-CBC-SHA \
Manuel Pégourié-Gonnarde46aa5e2014-07-13 15:44:19 +0200723 TLS-RSA-PSK-WITH-RC4-128-SHA \
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100724 "
725 G_CIPHERS="$G_CIPHERS \
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100726 +ECDHE-PSK:+3DES-CBC:+SHA1 \
Manuel Pégourié-Gonnarde46aa5e2014-07-13 15:44:19 +0200727 +ECDHE-PSK:+AES-128-CBC:+SHA1 \
728 +ECDHE-PSK:+AES-256-CBC:+SHA1 \
729 +ECDHE-PSK:+ARCFOUR-128:+SHA1 \
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100730 +RSA-PSK:+3DES-CBC:+SHA1 \
731 +RSA-PSK:+AES-256-CBC:+SHA1 \
732 +RSA-PSK:+AES-128-CBC:+SHA1 \
Manuel Pégourié-Gonnarde46aa5e2014-07-13 15:44:19 +0200733 +RSA-PSK:+ARCFOUR-128:+SHA1 \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100734 "
735 fi
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100736 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100737 then
Simon Butcherac22d112016-09-04 22:31:09 +0100738 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100739 TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384 \
740 TLS-ECDHE-PSK-WITH-CAMELLIA-256-CBC-SHA384 \
741 TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 \
742 TLS-ECDHE-PSK-WITH-CAMELLIA-128-CBC-SHA256 \
743 TLS-ECDHE-PSK-WITH-NULL-SHA384 \
744 TLS-ECDHE-PSK-WITH-NULL-SHA256 \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100745 TLS-PSK-WITH-AES-128-CBC-SHA256 \
746 TLS-PSK-WITH-AES-256-CBC-SHA384 \
747 TLS-DHE-PSK-WITH-AES-128-CBC-SHA256 \
748 TLS-DHE-PSK-WITH-AES-256-CBC-SHA384 \
749 TLS-PSK-WITH-NULL-SHA256 \
750 TLS-PSK-WITH-NULL-SHA384 \
751 TLS-DHE-PSK-WITH-NULL-SHA256 \
752 TLS-DHE-PSK-WITH-NULL-SHA384 \
753 TLS-RSA-PSK-WITH-AES-256-CBC-SHA384 \
754 TLS-RSA-PSK-WITH-AES-128-CBC-SHA256 \
755 TLS-RSA-PSK-WITH-NULL-SHA256 \
756 TLS-RSA-PSK-WITH-NULL-SHA384 \
757 TLS-DHE-PSK-WITH-CAMELLIA-128-CBC-SHA256 \
758 TLS-DHE-PSK-WITH-CAMELLIA-256-CBC-SHA384 \
759 TLS-PSK-WITH-CAMELLIA-128-CBC-SHA256 \
760 TLS-PSK-WITH-CAMELLIA-256-CBC-SHA384 \
761 TLS-RSA-PSK-WITH-CAMELLIA-256-CBC-SHA384 \
762 TLS-RSA-PSK-WITH-CAMELLIA-128-CBC-SHA256 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100763 TLS-PSK-WITH-AES-128-GCM-SHA256 \
764 TLS-PSK-WITH-AES-256-GCM-SHA384 \
765 TLS-DHE-PSK-WITH-AES-128-GCM-SHA256 \
766 TLS-DHE-PSK-WITH-AES-256-GCM-SHA384 \
Manuel Pégourié-Gonnardc36b4322018-06-14 13:14:29 +0200767 TLS-PSK-WITH-AES-128-CCM \
768 TLS-PSK-WITH-AES-256-CCM \
769 TLS-DHE-PSK-WITH-AES-128-CCM \
770 TLS-DHE-PSK-WITH-AES-256-CCM \
771 TLS-PSK-WITH-AES-128-CCM-8 \
772 TLS-PSK-WITH-AES-256-CCM-8 \
773 TLS-DHE-PSK-WITH-AES-128-CCM-8 \
774 TLS-DHE-PSK-WITH-AES-256-CCM-8 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100775 TLS-RSA-PSK-WITH-CAMELLIA-128-GCM-SHA256 \
776 TLS-RSA-PSK-WITH-CAMELLIA-256-GCM-SHA384 \
777 TLS-PSK-WITH-CAMELLIA-128-GCM-SHA256 \
778 TLS-PSK-WITH-CAMELLIA-256-GCM-SHA384 \
779 TLS-DHE-PSK-WITH-CAMELLIA-128-GCM-SHA256 \
780 TLS-DHE-PSK-WITH-CAMELLIA-256-GCM-SHA384 \
781 TLS-RSA-PSK-WITH-AES-256-GCM-SHA384 \
782 TLS-RSA-PSK-WITH-AES-128-GCM-SHA256 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100783 "
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100784 G_CIPHERS="$G_CIPHERS \
785 +ECDHE-PSK:+AES-256-CBC:+SHA384 \
786 +ECDHE-PSK:+CAMELLIA-256-CBC:+SHA384 \
787 +ECDHE-PSK:+AES-128-CBC:+SHA256 \
788 +ECDHE-PSK:+CAMELLIA-128-CBC:+SHA256 \
789 +PSK:+AES-128-CBC:+SHA256 \
790 +PSK:+AES-256-CBC:+SHA384 \
791 +DHE-PSK:+AES-128-CBC:+SHA256 \
792 +DHE-PSK:+AES-256-CBC:+SHA384 \
793 +RSA-PSK:+AES-256-CBC:+SHA384 \
794 +RSA-PSK:+AES-128-CBC:+SHA256 \
795 +DHE-PSK:+CAMELLIA-128-CBC:+SHA256 \
796 +DHE-PSK:+CAMELLIA-256-CBC:+SHA384 \
797 +PSK:+CAMELLIA-128-CBC:+SHA256 \
798 +PSK:+CAMELLIA-256-CBC:+SHA384 \
799 +RSA-PSK:+CAMELLIA-256-CBC:+SHA384 \
800 +RSA-PSK:+CAMELLIA-128-CBC:+SHA256 \
801 +PSK:+AES-128-GCM:+AEAD \
802 +PSK:+AES-256-GCM:+AEAD \
803 +DHE-PSK:+AES-128-GCM:+AEAD \
804 +DHE-PSK:+AES-256-GCM:+AEAD \
Manuel Pégourié-Gonnardc36b4322018-06-14 13:14:29 +0200805 +PSK:+AES-128-CCM:+AEAD \
806 +PSK:+AES-256-CCM:+AEAD \
807 +DHE-PSK:+AES-128-CCM:+AEAD \
808 +DHE-PSK:+AES-256-CCM:+AEAD \
809 +PSK:+AES-128-CCM-8:+AEAD \
810 +PSK:+AES-256-CCM-8:+AEAD \
811 +DHE-PSK:+AES-128-CCM-8:+AEAD \
812 +DHE-PSK:+AES-256-CCM-8:+AEAD \
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100813 +RSA-PSK:+CAMELLIA-128-GCM:+AEAD \
814 +RSA-PSK:+CAMELLIA-256-GCM:+AEAD \
815 +PSK:+CAMELLIA-128-GCM:+AEAD \
816 +PSK:+CAMELLIA-256-GCM:+AEAD \
817 +DHE-PSK:+CAMELLIA-128-GCM:+AEAD \
818 +DHE-PSK:+CAMELLIA-256-GCM:+AEAD \
819 +RSA-PSK:+AES-256-GCM:+AEAD \
820 +RSA-PSK:+AES-128-GCM:+AEAD \
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +0100821 +ECDHE-PSK:+NULL:+SHA384 \
822 +ECDHE-PSK:+NULL:+SHA256 \
823 +PSK:+NULL:+SHA256 \
824 +PSK:+NULL:+SHA384 \
825 +DHE-PSK:+NULL:+SHA256 \
826 +DHE-PSK:+NULL:+SHA384 \
827 +RSA-PSK:+NULL:+SHA256 \
828 +RSA-PSK:+NULL:+SHA384 \
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100829 "
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100830 fi
831 ;;
832 esac
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100833}
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100834
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100835# Ciphersuites usable only with Mbed TLS (not currently supported by another
836# peer usable in this script). This provide only very rudimentaty testing, as
837# this is not interop testing, but it's better than nothing.
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200838add_mbedtls_ciphersuites()
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100839{
840 case $TYPE in
841
842 "ECDSA")
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100843 if [ `minor_ver "$MODE"` -gt 0 ]
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100844 then
Simon Butcherac22d112016-09-04 22:31:09 +0100845 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100846 TLS-ECDH-ECDSA-WITH-CAMELLIA-128-CBC-SHA256 \
847 TLS-ECDH-ECDSA-WITH-CAMELLIA-256-CBC-SHA384 \
848 "
849 fi
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100850 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100851 then
Simon Butcherac22d112016-09-04 22:31:09 +0100852 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100853 TLS-ECDH-ECDSA-WITH-CAMELLIA-128-GCM-SHA256 \
854 TLS-ECDH-ECDSA-WITH-CAMELLIA-256-GCM-SHA384 \
Manuel Pégourié-Gonnarda0e47082018-02-15 11:07:58 +0100855 TLS-ECDHE-ECDSA-WITH-ARIA-256-CBC-SHA384 \
Manuel Pégourié-Gonnarda0e47082018-02-15 11:07:58 +0100856 TLS-ECDHE-ECDSA-WITH-ARIA-128-CBC-SHA256 \
Manuel Pégourié-Gonnardbba64062018-02-20 11:58:44 +0100857 TLS-ECDH-ECDSA-WITH-ARIA-256-GCM-SHA384 \
858 TLS-ECDH-ECDSA-WITH-ARIA-128-GCM-SHA256 \
859 TLS-ECDH-ECDSA-WITH-ARIA-256-CBC-SHA384 \
860 TLS-ECDH-ECDSA-WITH-ARIA-128-CBC-SHA256 \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100861 "
862 fi
863 ;;
864
865 "RSA")
Manuel Pégourié-Gonnard392c2d22018-02-15 11:06:14 +0100866 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard25948592014-05-22 14:36:02 +0200867 then
Simon Butcherac22d112016-09-04 22:31:09 +0100868 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnarda0e47082018-02-15 11:07:58 +0100869 TLS-ECDHE-RSA-WITH-ARIA-256-CBC-SHA384 \
870 TLS-DHE-RSA-WITH-ARIA-256-CBC-SHA384 \
Manuel Pégourié-Gonnarda0e47082018-02-15 11:07:58 +0100871 TLS-ECDHE-RSA-WITH-ARIA-128-CBC-SHA256 \
872 TLS-DHE-RSA-WITH-ARIA-128-CBC-SHA256 \
Manuel Pégourié-Gonnardbba64062018-02-20 11:58:44 +0100873 TLS-RSA-WITH-ARIA-256-CBC-SHA384 \
874 TLS-RSA-WITH-ARIA-128-CBC-SHA256 \
Manuel Pégourié-Gonnard25948592014-05-22 14:36:02 +0200875 "
876 fi
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100877 ;;
878
879 "PSK")
Manuel Pégourié-Gonnard7eb58cb2015-07-07 11:54:14 +0200880 # *PSK-NULL-SHA suites supported by GnuTLS 3.3.5 but not 3.2.15
Simon Butcherac22d112016-09-04 22:31:09 +0100881 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100882 TLS-PSK-WITH-NULL-SHA \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100883 TLS-DHE-PSK-WITH-NULL-SHA \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100884 "
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100885 if [ `minor_ver "$MODE"` -gt 0 ]
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100886 then
Simon Butcherac22d112016-09-04 22:31:09 +0100887 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100888 TLS-ECDHE-PSK-WITH-NULL-SHA \
Manuel Pégourié-Gonnarde46aa5e2014-07-13 15:44:19 +0200889 TLS-RSA-PSK-WITH-NULL-SHA \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100890 "
891 fi
Manuel Pégourié-Gonnard392c2d22018-02-15 11:06:14 +0100892 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard25948592014-05-22 14:36:02 +0200893 then
Simon Butcherac22d112016-09-04 22:31:09 +0100894 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnarda0e47082018-02-15 11:07:58 +0100895 TLS-RSA-PSK-WITH-ARIA-256-CBC-SHA384 \
Manuel Pégourié-Gonnarda0e47082018-02-15 11:07:58 +0100896 TLS-RSA-PSK-WITH-ARIA-128-CBC-SHA256 \
Manuel Pégourié-Gonnarda0e47082018-02-15 11:07:58 +0100897 TLS-PSK-WITH-ARIA-256-CBC-SHA384 \
Manuel Pégourié-Gonnarda0e47082018-02-15 11:07:58 +0100898 TLS-PSK-WITH-ARIA-128-CBC-SHA256 \
Manuel Pégourié-Gonnard7299dfd2018-02-15 11:43:55 +0100899 TLS-RSA-PSK-WITH-ARIA-256-GCM-SHA384 \
900 TLS-RSA-PSK-WITH-ARIA-128-GCM-SHA256 \
Manuel Pégourié-Gonnardbba64062018-02-20 11:58:44 +0100901 TLS-ECDHE-PSK-WITH-ARIA-256-CBC-SHA384 \
902 TLS-ECDHE-PSK-WITH-ARIA-128-CBC-SHA256 \
903 TLS-DHE-PSK-WITH-ARIA-256-CBC-SHA384 \
904 TLS-DHE-PSK-WITH-ARIA-128-CBC-SHA256 \
Manuel Pégourié-Gonnard9fece7e2018-06-18 11:38:22 +0200905 TLS-RSA-PSK-WITH-CHACHA20-POLY1305-SHA256 \
Manuel Pégourié-Gonnard25948592014-05-22 14:36:02 +0200906 "
907 fi
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100908 ;;
909 esac
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100910}
911
Pengyu Lv02a76a52023-02-20 18:05:21 +0800912# o_check_ciphersuite CIPHER_SUITE_NAME
913o_check_ciphersuite()
914{
915 if [ "${O_SUPPORT_ECDH}" = "NO" ]; then
916 case "$1" in
917 *ECDH-*) SKIP_NEXT="YES"
918 esac
919 fi
920}
921
Gilles Peskineebfcf582024-03-20 17:51:48 +0100922# g_check_ciphersuite CIPHER_SUITE_NAME
923g_check_ciphersuite()
924{
Gilles Peskineebfcf582024-03-20 17:51:48 +0100925 if [ -z "$GNUTLS_HAS_TLS1_RSA_NULL_SHA256" ]; then
926 case "$MODE" in
927 tls1|tls1_1|dtls1)
928 case "$1" in
929 TLS-RSA-WITH-NULL-SHA256|+RSA:+NULL:+SHA256)
930 SKIP_NEXT="YES";;
931 esac;;
932 esac
933 fi
Gilles Peskineebfcf582024-03-20 17:51:48 +0100934}
935
936
Manuel Pégourié-Gonnardd941a792014-02-19 13:35:52 +0100937setup_arguments()
938{
Ronald Cron01e3c372022-03-11 17:15:23 +0100939 O_MODE=""
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100940 G_MODE=""
941 case "$MODE" in
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100942 "ssl3")
Ronald Crona7ba2b52022-11-24 12:59:52 +0100943 O_MODE="ssl3"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100944 G_PRIO_MODE="+VERS-SSL3.0"
945 ;;
946 "tls1")
Ronald Crona7ba2b52022-11-24 12:59:52 +0100947 O_MODE="tls1"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100948 G_PRIO_MODE="+VERS-TLS1.0"
949 ;;
950 "tls1_1")
Ronald Crona7ba2b52022-11-24 12:59:52 +0100951 O_MODE="tls1_1"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100952 G_PRIO_MODE="+VERS-TLS1.1"
953 ;;
Xiaofei Baif40545d2021-12-02 08:43:35 +0000954 "tls12")
Ronald Cron01e3c372022-03-11 17:15:23 +0100955 O_MODE="tls1_2"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100956 G_PRIO_MODE="+VERS-TLS1.2"
Manuel Pégourié-Gonnard9ada01a2014-02-19 14:24:24 +0100957 ;;
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100958 "dtls1")
Ronald Crona7ba2b52022-11-24 12:59:52 +0100959 O_MODE="dtls1"
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100960 G_PRIO_MODE="+VERS-DTLS1.0"
Manuel Pégourié-Gonnard36795192014-09-26 16:33:45 +0200961 G_MODE="-u"
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100962 ;;
Xiaofei Baif40545d2021-12-02 08:43:35 +0000963 "dtls12")
Ronald Cron01e3c372022-03-11 17:15:23 +0100964 O_MODE="dtls1_2"
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100965 G_PRIO_MODE="+VERS-DTLS1.2"
Manuel Pégourié-Gonnard36795192014-09-26 16:33:45 +0200966 G_MODE="-u"
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100967 ;;
Manuel Pégourié-Gonnard9ada01a2014-02-19 14:24:24 +0100968 *)
969 echo "error: invalid mode: $MODE" >&2
970 exit 1;
971 esac
972
Manuel Pégourié-Gonnardc36b4322018-06-14 13:14:29 +0200973 # GnuTLS < 3.4 will choke if we try to allow CCM-8
974 if [ -z "${GNUTLS_MINOR_LT_FOUR-}" ]; then
975 G_PRIO_CCM="+AES-256-CCM-8:+AES-128-CCM-8:"
976 else
977 G_PRIO_CCM=""
978 fi
979
Simon Butcherac22d112016-09-04 22:31:09 +0100980 M_SERVER_ARGS="server_port=$PORT server_addr=0.0.0.0 force_version=$MODE arc4=1"
Gilles Peskineaf2ad3d2023-08-27 21:32:36 +0200981 O_SERVER_ARGS="-accept $PORT -cipher ALL,COMPLEMENTOFALL -$O_MODE"
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100982 G_SERVER_ARGS="-p $PORT --http $G_MODE"
Manuel Pégourié-Gonnard244d0662020-08-21 12:06:47 +0200983 G_SERVER_PRIO="NORMAL:${G_PRIO_CCM}+ARCFOUR-128:+NULL:+MD5:+PSK:+DHE-PSK:+ECDHE-PSK:+SHA256:+SHA384:+RSA-PSK:-VERS-TLS-ALL:$G_PRIO_MODE"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100984
Gilles Peskine3aec89b2021-04-01 14:00:11 +0200985 # The default prime for `openssl s_server` depends on the version:
986 # * OpenSSL <= 1.0.2a: 512-bit
987 # * OpenSSL 1.0.2b to 1.1.1b: 1024-bit
988 # * OpenSSL >= 1.1.1c: 2048-bit
989 # Mbed TLS wants >=1024, so force that for older versions. Don't force
990 # it for newer versions, which reject a 1024-bit prime. Indifferently
991 # force it or not for intermediate versions.
Manuel Pégourié-Gonnard89d40272022-12-19 11:42:12 +0100992 case $($OPENSSL version) in
Gilles Peskine3aec89b2021-04-01 14:00:11 +0200993 "OpenSSL 1.0"*)
994 O_SERVER_ARGS="$O_SERVER_ARGS -dhparam data_files/dhparams.pem"
995 ;;
996 esac
997
Manuel Pégourié-Gonnardd1af1022014-07-11 17:01:06 +0200998 # with OpenSSL 1.0.1h, -www, -WWW and -HTTP break DTLS handshakes
999 if is_dtls "$MODE"; then
Manuel Pégourié-Gonnard36795192014-09-26 16:33:45 +02001000 O_SERVER_ARGS="$O_SERVER_ARGS"
Manuel Pégourié-Gonnardd1af1022014-07-11 17:01:06 +02001001 else
1002 O_SERVER_ARGS="$O_SERVER_ARGS -www"
1003 fi
1004
Simon Butcherac22d112016-09-04 22:31:09 +01001005 M_CLIENT_ARGS="server_port=$PORT server_addr=127.0.0.1 force_version=$MODE"
Ronald Cron01e3c372022-03-11 17:15:23 +01001006 O_CLIENT_ARGS="-connect localhost:$PORT -$O_MODE"
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +01001007 G_CLIENT_ARGS="-p $PORT --debug 3 $G_MODE"
Manuel Pégourié-Gonnard9ada01a2014-02-19 14:24:24 +01001008
Gilles Peskine4eea1962022-11-24 22:21:15 +01001009 # Newer versions of OpenSSL have a syntax to enable all "ciphers", even
1010 # low-security ones. This covers not just cipher suites but also protocol
1011 # versions. It is necessary, for example, to use (D)TLS 1.0/1.1 on
1012 # OpenSSL 1.1.1f from Ubuntu 20.04. The syntax was only introduced in
1013 # OpenSSL 1.1.0 (21e0c1d23afff48601eb93135defddae51f7e2e3) and I can't find
1014 # a way to discover it from -help, so check the openssl version.
Manuel Pégourié-Gonnard89d40272022-12-19 11:42:12 +01001015 case $($OPENSSL version) in
Gilles Peskine4eea1962022-11-24 22:21:15 +01001016 "OpenSSL 0"*|"OpenSSL 1.0"*) :;;
1017 *)
1018 O_CLIENT_ARGS="$O_CLIENT_ARGS -cipher ALL@SECLEVEL=0"
1019 O_SERVER_ARGS="$O_SERVER_ARGS -cipher ALL@SECLEVEL=0"
1020 ;;
1021 esac
1022
Pengyu Lv02a76a52023-02-20 18:05:21 +08001023 case $($OPENSSL ciphers ALL) in
1024 *ECDH-ECDSA*|*ECDH-RSA*) O_SUPPORT_ECDH="YES";;
1025 *) O_SUPPORT_ECDH="NO";;
1026 esac
1027
Yanray Wang21daf292023-02-08 12:38:31 +08001028 if [ "X$VERIFY" = "XYES" ];
Manuel Pégourié-Gonnardd941a792014-02-19 13:35:52 +01001029 then
Simon Butcherac22d112016-09-04 22:31:09 +01001030 M_SERVER_ARGS="$M_SERVER_ARGS ca_file=data_files/test-ca_cat12.crt auth_mode=required"
Manuel Pégourié-Gonnard9ada01a2014-02-19 14:24:24 +01001031 O_SERVER_ARGS="$O_SERVER_ARGS -CAfile data_files/test-ca_cat12.crt -Verify 10"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001032 G_SERVER_ARGS="$G_SERVER_ARGS --x509cafile data_files/test-ca_cat12.crt --require-client-cert"
1033
Simon Butcherac22d112016-09-04 22:31:09 +01001034 M_CLIENT_ARGS="$M_CLIENT_ARGS ca_file=data_files/test-ca_cat12.crt auth_mode=required"
Manuel Pégourié-Gonnardda782c92014-02-21 10:10:20 +01001035 O_CLIENT_ARGS="$O_CLIENT_ARGS -CAfile data_files/test-ca_cat12.crt -verify 10"
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +01001036 G_CLIENT_ARGS="$G_CLIENT_ARGS --x509cafile data_files/test-ca_cat12.crt"
Manuel Pégourié-Gonnardda782c92014-02-21 10:10:20 +01001037 else
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001038 # don't request a client cert at all
Simon Butcherac22d112016-09-04 22:31:09 +01001039 M_SERVER_ARGS="$M_SERVER_ARGS ca_file=none auth_mode=none"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001040 G_SERVER_ARGS="$G_SERVER_ARGS --disable-client-cert"
1041
Simon Butcherac22d112016-09-04 22:31:09 +01001042 M_CLIENT_ARGS="$M_CLIENT_ARGS ca_file=none auth_mode=none"
Manuel Pégourié-Gonnard5de31ec2014-03-19 17:34:52 +01001043 O_CLIENT_ARGS="$O_CLIENT_ARGS"
1044 G_CLIENT_ARGS="$G_CLIENT_ARGS --insecure"
Manuel Pégourié-Gonnardd941a792014-02-19 13:35:52 +01001045 fi
1046
1047 case $TYPE in
1048 "ECDSA")
Simon Butcherac22d112016-09-04 22:31:09 +01001049 M_SERVER_ARGS="$M_SERVER_ARGS crt_file=data_files/server5.crt key_file=data_files/server5.key"
Manuel Pégourié-Gonnard9ada01a2014-02-19 14:24:24 +01001050 O_SERVER_ARGS="$O_SERVER_ARGS -cert data_files/server5.crt -key data_files/server5.key"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001051 G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key"
1052
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +01001053 if [ "X$VERIFY" = "XYES" ]; then
Simon Butcherac22d112016-09-04 22:31:09 +01001054 M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=data_files/server6.crt key_file=data_files/server6.key"
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +01001055 O_CLIENT_ARGS="$O_CLIENT_ARGS -cert data_files/server6.crt -key data_files/server6.key"
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +01001056 G_CLIENT_ARGS="$G_CLIENT_ARGS --x509certfile data_files/server6.crt --x509keyfile data_files/server6.key"
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +01001057 else
Simon Butcherac22d112016-09-04 22:31:09 +01001058 M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=none key_file=none"
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +01001059 fi
Manuel Pégourié-Gonnardd941a792014-02-19 13:35:52 +01001060 ;;
1061
1062 "RSA")
Manuel Pégourié-Gonnard499bf4c2020-08-21 12:24:32 +02001063 M_SERVER_ARGS="$M_SERVER_ARGS crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key"
1064 O_SERVER_ARGS="$O_SERVER_ARGS -cert data_files/server2-sha256.crt -key data_files/server2.key"
1065 G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001066
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +01001067 if [ "X$VERIFY" = "XYES" ]; then
Manuel Pégourié-Gonnard499bf4c2020-08-21 12:24:32 +02001068 M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=data_files/cert_sha256.crt key_file=data_files/server1.key"
1069 O_CLIENT_ARGS="$O_CLIENT_ARGS -cert data_files/cert_sha256.crt -key data_files/server1.key"
1070 G_CLIENT_ARGS="$G_CLIENT_ARGS --x509certfile data_files/cert_sha256.crt --x509keyfile data_files/server1.key"
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +01001071 else
Simon Butcherac22d112016-09-04 22:31:09 +01001072 M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=none key_file=none"
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +01001073 fi
Manuel Pégourié-Gonnardd941a792014-02-19 13:35:52 +01001074 ;;
1075
1076 "PSK")
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001077 # give RSA-PSK-capable server a RSA cert
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +01001078 # (should be a separate type, but harder to close with openssl)
Manuel Pégourié-Gonnard499bf4c2020-08-21 12:24:32 +02001079 M_SERVER_ARGS="$M_SERVER_ARGS psk=6162636465666768696a6b6c6d6e6f70 ca_file=none crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key"
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +01001080 O_SERVER_ARGS="$O_SERVER_ARGS -psk 6162636465666768696a6b6c6d6e6f70 -nocert"
Manuel Pégourié-Gonnard499bf4c2020-08-21 12:24:32 +02001081 G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --pskpasswd data_files/passwd.psk"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001082
Simon Butcherac22d112016-09-04 22:31:09 +01001083 M_CLIENT_ARGS="$M_CLIENT_ARGS psk=6162636465666768696a6b6c6d6e6f70 crt_file=none key_file=none"
Manuel Pégourié-Gonnard9ada01a2014-02-19 14:24:24 +01001084 O_CLIENT_ARGS="$O_CLIENT_ARGS -psk 6162636465666768696a6b6c6d6e6f70"
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +01001085 G_CLIENT_ARGS="$G_CLIENT_ARGS --pskusername Client_identity --pskkey=6162636465666768696a6b6c6d6e6f70"
Manuel Pégourié-Gonnardd941a792014-02-19 13:35:52 +01001086 ;;
1087 esac
1088}
1089
Simon Butcherac22d112016-09-04 22:31:09 +01001090# is_mbedtls <cmd_line>
1091is_mbedtls() {
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +01001092 echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null
1093}
1094
1095# has_mem_err <log_file_name>
1096has_mem_err() {
1097 if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" &&
1098 grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null
1099 then
1100 return 1 # false: does not have errors
1101 else
1102 return 0 # true: has errors
1103 fi
1104}
1105
Gilles Peskine12c49c72017-12-14 19:02:00 +01001106# Wait for process $2 to be listening on port $1
1107if type lsof >/dev/null 2>/dev/null; then
1108 wait_server_start() {
1109 START_TIME=$(date +%s)
1110 if is_dtls "$MODE"; then
1111 proto=UDP
1112 else
1113 proto=TCP
1114 fi
1115 while ! lsof -a -n -b -i "$proto:$1" -p "$2" >/dev/null 2>/dev/null; do
1116 if [ $(( $(date +%s) - $START_TIME )) -gt $DOG_DELAY ]; then
1117 echo "SERVERSTART TIMEOUT"
1118 echo "SERVERSTART TIMEOUT" >> $SRV_OUT
1119 break
1120 fi
1121 # Linux and *BSD support decimal arguments to sleep. On other
1122 # OSes this may be a tight loop.
1123 sleep 0.1 2>/dev/null || true
1124 done
1125 }
1126else
Gilles Peskine3c9e2b52018-01-08 12:38:15 +01001127 echo "Warning: lsof not available, wait_server_start = sleep"
Gilles Peskine12c49c72017-12-14 19:02:00 +01001128 wait_server_start() {
Manuel Pégourié-Gonnard0d225da2018-01-22 10:22:09 +01001129 sleep 2
Gilles Peskine12c49c72017-12-14 19:02:00 +01001130 }
1131fi
1132
1133
Manuel Pégourié-Gonnard304beef2014-02-19 14:45:00 +01001134# start_server <name>
1135# also saves name and command
1136start_server() {
Manuel Pégourié-Gonnard304beef2014-02-19 14:45:00 +01001137 case $1 in
1138 [Oo]pen*)
Manuel Pégourié-Gonnard89d40272022-12-19 11:42:12 +01001139 SERVER_CMD="$OPENSSL s_server $O_SERVER_ARGS"
Manuel Pégourié-Gonnard304beef2014-02-19 14:45:00 +01001140 ;;
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001141 [Gg]nu*)
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +01001142 SERVER_CMD="$GNUTLS_SERV $G_SERVER_ARGS --priority $G_SERVER_PRIO"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001143 ;;
Manuel Pégourié-Gonnarda8f3b752015-01-22 17:05:05 +00001144 mbed*)
Simon Butcherac22d112016-09-04 22:31:09 +01001145 SERVER_CMD="$M_SRV $M_SERVER_ARGS"
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +01001146 if [ "$MEMCHECK" -gt 0 ]; then
1147 SERVER_CMD="valgrind --leak-check=full $SERVER_CMD"
1148 fi
Manuel Pégourié-Gonnard304beef2014-02-19 14:45:00 +01001149 ;;
1150 *)
1151 echo "error: invalid server name: $1" >&2
1152 exit 1
1153 ;;
1154 esac
1155 SERVER_NAME=$1
1156
1157 log "$SERVER_CMD"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001158 echo "$SERVER_CMD" > $SRV_OUT
Manuel Pégourié-Gonnardd1af1022014-07-11 17:01:06 +02001159 # for servers without -www or equivalent
Manuel Pégourié-Gonnard82cf0a12015-02-09 13:05:54 +00001160 while :; do echo bla; sleep 1; done | $SERVER_CMD >> $SRV_OUT 2>&1 &
Yanray Wang2a7b2a62023-01-13 11:42:11 +08001161 SRV_PID=$!
Manuel Pégourié-Gonnard304beef2014-02-19 14:45:00 +01001162
Yanray Wang2a7b2a62023-01-13 11:42:11 +08001163 wait_server_start "$PORT" "$SRV_PID"
Manuel Pégourié-Gonnard304beef2014-02-19 14:45:00 +01001164}
1165
Manuel Pégourié-Gonnard16494492014-08-31 10:37:14 +02001166# terminate the running server
Manuel Pégourié-Gonnard95957712014-02-19 15:29:38 +01001167stop_server() {
Yanray Wang2a7b2a62023-01-13 11:42:11 +08001168 # For Ubuntu 22.04, `Terminated` message is outputed by wait command.
1169 # To remove it from stdout, redirect stdout/stderr to SRV_OUT
1170 kill $SRV_PID >/dev/null 2>&1
1171 wait $SRV_PID >> $SRV_OUT 2>&1
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +01001172
1173 if [ "$MEMCHECK" -gt 0 ]; then
Simon Butcherac22d112016-09-04 22:31:09 +01001174 if is_mbedtls "$SERVER_CMD" && has_mem_err $SRV_OUT; then
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +01001175 echo " ! Server had memory errors"
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001176 SRVMEM=$(( $SRVMEM + 1 ))
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +01001177 return
1178 fi
1179 fi
1180
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001181 rm -f $SRV_OUT
Manuel Pégourié-Gonnard95957712014-02-19 15:29:38 +01001182}
1183
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +01001184# kill the running server (used when killed by signal)
1185cleanup() {
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001186 rm -f $SRV_OUT $CLI_OUT
Yanray Wang2a7b2a62023-01-13 11:42:11 +08001187 kill $SRV_PID >/dev/null 2>&1
Manuel Pégourié-Gonnard16494492014-08-31 10:37:14 +02001188 kill $WATCHDOG_PID >/dev/null 2>&1
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +01001189 exit 1
1190}
1191
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +02001192# wait for client to terminate and set EXIT
1193# must be called right after starting the client
1194wait_client_done() {
1195 CLI_PID=$!
1196
1197 ( sleep "$DOG_DELAY"; echo "TIMEOUT" >> $CLI_OUT; kill $CLI_PID ) &
1198 WATCHDOG_PID=$!
1199
Yanray Wangd2ad2002023-01-13 10:52:41 +08001200 # For Ubuntu 22.04, `Terminated` message is outputed by wait command.
1201 # To remove it from stdout, redirect stdout/stderr to CLI_OUT
1202 wait $CLI_PID >> $CLI_OUT 2>&1
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +02001203 EXIT=$?
1204
Yanray Wangd2ad2002023-01-13 10:52:41 +08001205 kill $WATCHDOG_PID >/dev/null 2>&1
1206 wait $WATCHDOG_PID >> $CLI_OUT 2>&1
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +02001207
1208 echo "EXIT: $EXIT" >> $CLI_OUT
1209}
1210
Yanray Wang44ba9692023-02-20 14:58:03 +08001211# record_outcome <outcome> [<failure-reason>]
1212record_outcome() {
1213 echo "$1"
1214 if [ -n "$MBEDTLS_TEST_OUTCOME_FILE" ]; then
1215 # The test outcome file has the format (in single line):
1216 # platform;configuration;
1217 # test suite name;test case description;
1218 # PASS/FAIL/SKIP;[failure cause]
1219 printf '%s;%s;%s;%s;%s;%s\n' \
1220 "$MBEDTLS_TEST_PLATFORM" "$MBEDTLS_TEST_CONFIGURATION" \
1221 "compat" "$TITLE" \
1222 "$1" "${2-}" \
1223 >> "$MBEDTLS_TEST_OUTCOME_FILE"
1224 fi
1225}
1226
Gilles Peskine67bf9f62023-08-28 17:36:22 +02001227save_logs() {
1228 cp $SRV_OUT c-srv-${TESTS}.log
1229 cp $CLI_OUT c-cli-${TESTS}.log
1230}
1231
Yanray Wang0f386b72023-02-20 15:49:10 +08001232# display additional information if test case fails
1233report_fail() {
Yanray Wang44ba9692023-02-20 14:58:03 +08001234 FAIL_PROMPT="outputs saved to c-srv-${TESTS}.log, c-cli-${TESTS}.log"
1235 record_outcome "FAIL" "$FAIL_PROMPT"
Gilles Peskine67bf9f62023-08-28 17:36:22 +02001236 save_logs
Yanray Wang44ba9692023-02-20 14:58:03 +08001237 echo " ! $FAIL_PROMPT"
Yanray Wang0f386b72023-02-20 15:49:10 +08001238
1239 if [ "${LOG_FAILURE_ON_STDOUT:-0}" != 0 ]; then
1240 echo " ! server output:"
1241 cat c-srv-${TESTS}.log
1242 echo " ! ==================================================="
1243 echo " ! client output:"
1244 cat c-cli-${TESTS}.log
1245 fi
1246}
1247
Yanray Wangf0dbde12023-03-02 11:55:55 +08001248# uniform_title <CLIENT> <SERVER> <STANDARD_CIPHER_SUITE>
Tomás Gonzálezaaea3a32023-09-13 11:41:29 +01001249# $TITLE is considered as test case description for both --list-test-cases and
Yanray Wangf0dbde12023-03-02 11:55:55 +08001250# MBEDTLS_TEST_OUTCOME_FILE. This function aims to control the format of
1251# each test case description.
1252uniform_title() {
1253 TITLE="$1->$2 $MODE,$VERIF $3"
Yanray Wang7e1c0c72023-02-24 17:07:47 +08001254}
1255
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001256# run_client <name> <cipher>
1257run_client() {
Manuel Pégourié-Gonnard87ae3032014-02-27 11:12:30 +01001258 # announce what we're going to do
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001259 TESTS=$(( $TESTS + 1 ))
Yanray Wangf0dbde12023-03-02 11:55:55 +08001260 uniform_title "${1%"${1#?}"}" "${SERVER_NAME%"${SERVER_NAME#?}"}" $2
1261 DOTS72="........................................................................"
1262 printf "%s %.*s " "$TITLE" "$((71 - ${#TITLE}))" "$DOTS72"
Manuel Pégourié-Gonnard87ae3032014-02-27 11:12:30 +01001263
Manuel Pégourié-Gonnard53aef812014-07-11 17:41:24 +02001264 # should we skip?
1265 if [ "X$SKIP_NEXT" = "XYES" ]; then
1266 SKIP_NEXT="NO"
Yanray Wang44ba9692023-02-20 14:58:03 +08001267 record_outcome "SKIP"
Manuel Pégourié-Gonnard53aef812014-07-11 17:41:24 +02001268 SKIPPED=$(( $SKIPPED + 1 ))
1269 return
1270 fi
1271
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001272 # run the command and interpret result
1273 case $1 in
1274 [Oo]pen*)
Manuel Pégourié-Gonnard89d40272022-12-19 11:42:12 +01001275 CLIENT_CMD="$OPENSSL s_client $O_CLIENT_ARGS -cipher $2"
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001276 log "$CLIENT_CMD"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001277 echo "$CLIENT_CMD" > $CLI_OUT
Manuel Pégourié-Gonnard9afdc832015-08-04 17:15:13 +02001278 printf 'GET HTTP/1.0\r\n\r\n' | $CLIENT_CMD >> $CLI_OUT 2>&1 &
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +02001279 wait_client_done
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001280
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001281 if [ $EXIT -eq 0 ]; then
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001282 RESULT=0
1283 else
Pengyu Lvab1fb392023-02-23 18:27:33 +08001284 # If it is NULL cipher ...
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001285 if grep 'Cipher is (NONE)' $CLI_OUT >/dev/null; then
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001286 RESULT=1
1287 else
1288 RESULT=2
1289 fi
1290 fi
1291 ;;
1292
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +01001293 [Gg]nu*)
Pengyu Lvac0b3502023-12-01 14:25:40 +08001294 CLIENT_CMD="$GNUTLS_CLI $G_CLIENT_ARGS --priority $G_PRIO_MODE:$2 localhost"
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +01001295 log "$CLIENT_CMD"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001296 echo "$CLIENT_CMD" > $CLI_OUT
Manuel Pégourié-Gonnard9afdc832015-08-04 17:15:13 +02001297 printf 'GET HTTP/1.0\r\n\r\n' | $CLIENT_CMD >> $CLI_OUT 2>&1 &
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +02001298 wait_client_done
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +01001299
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001300 if [ $EXIT -eq 0 ]; then
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +01001301 RESULT=0
1302 else
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001303 RESULT=2
1304 # interpret early failure, with a handshake_failure alert
1305 # before the server hello, as "no ciphersuite in common"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001306 if grep -F 'Received alert [40]: Handshake failed' $CLI_OUT; then
1307 if grep -i 'SERVER HELLO .* was received' $CLI_OUT; then :
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001308 else
1309 RESULT=1
1310 fi
1311 fi >/dev/null
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +01001312 fi
1313 ;;
1314
Manuel Pégourié-Gonnarda8f3b752015-01-22 17:05:05 +00001315 mbed*)
Simon Butcherac22d112016-09-04 22:31:09 +01001316 CLIENT_CMD="$M_CLI $M_CLIENT_ARGS force_ciphersuite=$2"
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +01001317 if [ "$MEMCHECK" -gt 0 ]; then
1318 CLIENT_CMD="valgrind --leak-check=full $CLIENT_CMD"
1319 fi
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001320 log "$CLIENT_CMD"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001321 echo "$CLIENT_CMD" > $CLI_OUT
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +02001322 $CLIENT_CMD >> $CLI_OUT 2>&1 &
1323 wait_client_done
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001324
1325 case $EXIT in
Simon Butcherac22d112016-09-04 22:31:09 +01001326 # Success
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001327 "0") RESULT=0 ;;
Simon Butcherac22d112016-09-04 22:31:09 +01001328
1329 # Ciphersuite not supported
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001330 "2") RESULT=1 ;;
Simon Butcherac22d112016-09-04 22:31:09 +01001331
1332 # Error
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001333 *) RESULT=2 ;;
1334 esac
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +01001335
1336 if [ "$MEMCHECK" -gt 0 ]; then
Simon Butcherac22d112016-09-04 22:31:09 +01001337 if is_mbedtls "$CLIENT_CMD" && has_mem_err $CLI_OUT; then
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +01001338 RESULT=2
1339 fi
1340 fi
1341
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001342 ;;
1343
1344 *)
1345 echo "error: invalid client name: $1" >&2
1346 exit 1
1347 ;;
1348 esac
1349
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001350 echo "EXIT: $EXIT" >> $CLI_OUT
Manuel Pégourié-Gonnarde01af4c2014-03-25 14:16:44 +01001351
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001352 # report and count result
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001353 case $RESULT in
1354 "0")
Yanray Wang44ba9692023-02-20 14:58:03 +08001355 record_outcome "PASS"
Gilles Peskine67bf9f62023-08-28 17:36:22 +02001356 if [ "$PRESERVE_LOGS" -gt 0 ]; then
1357 save_logs
1358 fi
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001359 ;;
1360 "1")
Yanray Wang44ba9692023-02-20 14:58:03 +08001361 record_outcome "SKIP"
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001362 SKIPPED=$(( $SKIPPED + 1 ))
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001363 ;;
1364 "2")
Yanray Wang0f386b72023-02-20 15:49:10 +08001365 report_fail
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001366 FAILED=$(( $FAILED + 1 ))
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001367 ;;
1368 esac
Manuel Pégourié-Gonnard87ae3032014-02-27 11:12:30 +01001369
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001370 rm -f $CLI_OUT
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001371}
1372
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +01001373#
1374# MAIN
1375#
1376
Manuel Pégourié-Gonnard3947d042014-03-14 18:13:53 +01001377get_options "$@"
1378
Yanray Wang44ba9692023-02-20 14:58:03 +08001379# Make the outcome file path relative to the original directory, not
1380# to .../tests
1381case "$MBEDTLS_TEST_OUTCOME_FILE" in
1382 [!/]*)
1383 MBEDTLS_TEST_OUTCOME_FILE="$ORIGINAL_PWD/$MBEDTLS_TEST_OUTCOME_FILE"
1384 ;;
1385esac
1386
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +01001387# sanity checks, avoid an avalanche of errors
Simon Butcherac22d112016-09-04 22:31:09 +01001388if [ ! -x "$M_SRV" ]; then
1389 echo "Command '$M_SRV' is not an executable file" >&2
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +01001390 exit 1
1391fi
Simon Butcherac22d112016-09-04 22:31:09 +01001392if [ ! -x "$M_CLI" ]; then
1393 echo "Command '$M_CLI' is not an executable file" >&2
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +01001394 exit 1
1395fi
Manuel Pégourié-Gonnard3947d042014-03-14 18:13:53 +01001396
1397if echo "$PEERS" | grep -i openssl > /dev/null; then
Manuel Pégourié-Gonnard89d40272022-12-19 11:42:12 +01001398 if which "$OPENSSL" >/dev/null 2>&1; then :; else
1399 echo "Command '$OPENSSL' not found" >&2
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +01001400 exit 1
1401 fi
Manuel Pégourié-Gonnard3947d042014-03-14 18:13:53 +01001402fi
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +01001403
Manuel Pégourié-Gonnard3947d042014-03-14 18:13:53 +01001404if echo "$PEERS" | grep -i gnutls > /dev/null; then
1405 for CMD in "$GNUTLS_CLI" "$GNUTLS_SERV"; do
1406 if which "$CMD" >/dev/null 2>&1; then :; else
1407 echo "Command '$CMD' not found" >&2
1408 exit 1
1409 fi
1410 done
1411fi
1412
1413for PEER in $PEERS; do
1414 case "$PEER" in
Manuel Pégourié-Gonnarda8f3b752015-01-22 17:05:05 +00001415 mbed*|[Oo]pen*|[Gg]nu*)
Manuel Pégourié-Gonnard3947d042014-03-14 18:13:53 +01001416 ;;
1417 *)
1418 echo "Unknown peers: $PEER" >&2
1419 exit 1
1420 esac
1421done
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +01001422
Gilles Peskineebfcf582024-03-20 17:51:48 +01001423case " $PEERS " in *\ [Gg]nu*)
1424 GNUTLS_HAS_TLS1_RSA_NULL_SHA256=
1425 # TLS-RSA-WITH-NULL-SHA256 is a (D)TLS 1.2-only cipher suite,
1426 # like all SHA256 cipher suites. But Mbed TLS supports it with
1427 # (D)TLS 1.0 and 1.1 as well. So do ancient versions of GnuTLS,
1428 # but this was considered a bug which was fixed in GnuTLS 3.4.7.
1429 # Check the GnuTLS support list to see what the protocol version
1430 # requirement is for that cipher suite.
1431 if $GNUTLS_CLI --list | grep -q '^TLS_RSA_NULL_SHA256.*0$'; then
1432 GNUTLS_HAS_TLS1_RSA_NULL_SHA256=YES
1433 fi
1434esac
1435
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +02001436# Pick a "unique" port in the range 10000-19999.
1437PORT="0000$$"
Manuel Pégourié-Gonnardfab2a3c2014-06-16 16:54:36 +02001438PORT="1$(echo $PORT | tail -c 5)"
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +02001439
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001440# Also pick a unique name for intermediate files
1441SRV_OUT="srv_out.$$"
1442CLI_OUT="cli_out.$$"
1443
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +02001444# client timeout delay: be more patient with valgrind
1445if [ "$MEMCHECK" -gt 0 ]; then
1446 DOG_DELAY=30
1447else
1448 DOG_DELAY=10
1449fi
1450
Manuel Pégourié-Gonnard53aef812014-07-11 17:41:24 +02001451SKIP_NEXT="NO"
1452
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +01001453trap cleanup INT TERM HUP
1454
Yanray Wang571e24b2023-02-07 10:41:04 +08001455for MODE in $MODES; do
Yanray Wang21daf292023-02-08 12:38:31 +08001456 for TYPE in $TYPES; do
Yanray Wang571e24b2023-02-07 10:41:04 +08001457
Yanray Wang21daf292023-02-08 12:38:31 +08001458 # PSK cipher suites do not allow client certificate verification.
1459 # This means PSK test cases with VERIFY=YES should be replaced by
1460 # VERIFY=NO or be ignored. SUB_VERIFIES variable is used to constrain
1461 # verification option for PSK test cases.
1462 SUB_VERIFIES=$VERIFIES
1463 if [ "$TYPE" = "PSK" ]; then
1464 SUB_VERIFIES="NO"
1465 fi
Yanray Wang571e24b2023-02-07 10:41:04 +08001466
Yanray Wang21daf292023-02-08 12:38:31 +08001467 for VERIFY in $SUB_VERIFIES; do
1468 VERIF=$(echo $VERIFY | tr '[:upper:]' '[:lower:]')
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001469 for PEER in $PEERS; do
Paul Bakker7e5e7ca2013-04-17 19:27:58 +02001470
Manuel Pégourié-Gonnard95957712014-02-19 15:29:38 +01001471 setup_arguments
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001472
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001473 case "$PEER" in
Manuel Pégourié-Gonnardd3313192013-09-13 19:20:37 +02001474
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001475 [Oo]pen*)
Paul Bakker398cb512012-04-10 08:22:31 +00001476
Manuel Pégourié-Gonnard39e2ca92015-08-04 16:43:37 +02001477 if test "$OSSL_NO_DTLS" -gt 0 && is_dtls "$MODE"; then
1478 continue;
1479 fi
1480
Ronald Cronc2e28762022-03-23 14:14:19 +01001481 # OpenSSL <1.0.2 doesn't support DTLS 1.2. Check if OpenSSL
1482 # supports $O_MODE from the s_server help. (The s_client
1483 # help isn't accurate as of 1.0.2g: it supports DTLS 1.2
1484 # but doesn't list it. But the s_server help seems to be
1485 # accurate.)
Manuel Pégourié-Gonnard89d40272022-12-19 11:42:12 +01001486 if ! $OPENSSL s_server -help 2>&1 | grep -q "^ *-$O_MODE "; then
Ronald Cronc2e28762022-03-23 14:14:19 +01001487 continue;
1488 fi
1489
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001490 reset_ciphersuites
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +01001491 add_common_ciphersuites
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001492 add_openssl_ciphersuites
1493 filter_ciphersuites
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001494
Simon Butcherac22d112016-09-04 22:31:09 +01001495 if [ "X" != "X$M_CIPHERS" ]; then
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001496 start_server "OpenSSL"
Simon Butcherac22d112016-09-04 22:31:09 +01001497 for i in $M_CIPHERS; do
Pengyu Lv02a76a52023-02-20 18:05:21 +08001498 o_check_ciphersuite "$i"
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +00001499 run_client mbedTLS $i
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001500 done
1501 stop_server
1502 fi
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001503
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001504 if [ "X" != "X$O_CIPHERS" ]; then
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +00001505 start_server "mbedTLS"
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001506 for i in $O_CIPHERS; do
Pengyu Lv02a76a52023-02-20 18:05:21 +08001507 o_check_ciphersuite "$i"
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001508 run_client OpenSSL $i
1509 done
1510 stop_server
1511 fi
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001512
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001513 ;;
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001514
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001515 [Gg]nu*)
Paul Bakkerfab5c822012-02-06 16:45:10 +00001516
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001517 reset_ciphersuites
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +01001518 add_common_ciphersuites
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001519 add_gnutls_ciphersuites
1520 filter_ciphersuites
Paul Bakkerfab5c822012-02-06 16:45:10 +00001521
Simon Butcherac22d112016-09-04 22:31:09 +01001522 if [ "X" != "X$M_CIPHERS" ]; then
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001523 start_server "GnuTLS"
Simon Butcherac22d112016-09-04 22:31:09 +01001524 for i in $M_CIPHERS; do
Gilles Peskineebfcf582024-03-20 17:51:48 +01001525 g_check_ciphersuite "$i"
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +00001526 run_client mbedTLS $i
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001527 done
1528 stop_server
1529 fi
1530
1531 if [ "X" != "X$G_CIPHERS" ]; then
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +00001532 start_server "mbedTLS"
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001533 for i in $G_CIPHERS; do
Gilles Peskineebfcf582024-03-20 17:51:48 +01001534 g_check_ciphersuite "$i"
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001535 run_client GnuTLS $i
1536 done
1537 stop_server
1538 fi
1539
1540 ;;
1541
Manuel Pégourié-Gonnarda8f3b752015-01-22 17:05:05 +00001542 mbed*)
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001543
1544 reset_ciphersuites
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +01001545 add_common_ciphersuites
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001546 add_openssl_ciphersuites
1547 add_gnutls_ciphersuites
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001548 add_mbedtls_ciphersuites
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001549 filter_ciphersuites
1550
Simon Butcherac22d112016-09-04 22:31:09 +01001551 if [ "X" != "X$M_CIPHERS" ]; then
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +00001552 start_server "mbedTLS"
Simon Butcherac22d112016-09-04 22:31:09 +01001553 for i in $M_CIPHERS; do
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +00001554 run_client mbedTLS $i
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001555 done
1556 stop_server
1557 fi
1558
1559 ;;
1560
Manuel Pégourié-Gonnarda1a9f9a2014-03-25 18:04:59 +01001561 *)
Paul Bakker1ebc0c52014-05-22 15:47:58 +02001562 echo "Unknown peer: $PEER" >&2
Manuel Pégourié-Gonnarda1a9f9a2014-03-25 18:04:59 +01001563 exit 1
1564 ;;
1565
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001566 esac
1567
1568 done
Manuel Pégourié-Gonnard95957712014-02-19 15:29:38 +01001569 done
1570 done
Manuel Pégourié-Gonnard9791a402013-08-27 19:57:15 +02001571done
Manuel Pégourié-Gonnard70064fd2013-08-27 22:00:47 +02001572
Manuel Pégourié-Gonnard4145b892014-02-24 13:20:14 +01001573echo "------------------------------------------------------------------------"
Manuel Pégourié-Gonnard70064fd2013-08-27 22:00:47 +02001574
Tom Cosgrovec1ae9f92023-01-13 12:13:41 +00001575if [ $FAILED -ne 0 -o $SRVMEM -ne 0 ]; then
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +01001576 printf "FAILED"
Manuel Pégourié-Gonnard70064fd2013-08-27 22:00:47 +02001577else
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +01001578 printf "PASSED"
Manuel Pégourié-Gonnard70064fd2013-08-27 22:00:47 +02001579fi
1580
Manuel Pégourié-Gonnardba0b8442014-03-13 17:57:45 +01001581if [ "$MEMCHECK" -gt 0 ]; then
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001582 MEMREPORT=", $SRVMEM server memory errors"
Manuel Pégourié-Gonnardba0b8442014-03-13 17:57:45 +01001583else
1584 MEMREPORT=""
1585fi
1586
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001587PASSED=$(( $TESTS - $FAILED ))
1588echo " ($PASSED / $TESTS tests ($SKIPPED skipped$MEMREPORT))"
Manuel Pégourié-Gonnard70064fd2013-08-27 22:00:47 +02001589
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001590FAILED=$(( $FAILED + $SRVMEM ))
Tom Cosgrovec1ae9f92023-01-13 12:13:41 +00001591if [ $FAILED -gt 255 ]; then
1592 # Clamp at 255 as caller gets exit code & 0xFF
1593 # (so 256 would be 0, or success, etc)
1594 FAILED=255
1595fi
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001596exit $FAILED