Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1 | #!/bin/sh |
| 2 | |
| 3 | # Test various options that are not covered by compat.sh |
| 4 | # |
| 5 | # Here the goal is not to cover every ciphersuite/version, but |
| 6 | # rather specific options (max fragment length, truncated hmac, etc) |
| 7 | # or procedures (session resumption from cache or ticket, renego, etc). |
| 8 | # |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 9 | # Assumes a build with default options. |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 10 | |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 11 | set -u |
| 12 | |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 13 | # default values, can be overriden by the environment |
| 14 | : ${P_SRV:=../programs/ssl/ssl_server2} |
| 15 | : ${P_CLI:=../programs/ssl/ssl_client2} |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 16 | : ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 17 | : ${GNUTLS_CLI:=gnutls-cli} |
| 18 | : ${GNUTLS_SERV:=gnutls-serv} |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 19 | |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 20 | O_SRV="$OPENSSL_CMD s_server -cert data_files/server5.crt -key data_files/server5.key" |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 21 | O_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_CMD s_client" |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 22 | G_SRV="$GNUTLS_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key" |
| 23 | G_CLI="$GNUTLS_CLI" |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 24 | |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 25 | TESTS=0 |
| 26 | FAILS=0 |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 27 | SKIPS=0 |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 28 | |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 29 | CONFIG_H='../include/polarssl/config.h' |
| 30 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 31 | MEMCHECK=0 |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 32 | FILTER='.*' |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 33 | EXCLUDE='^$' |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 34 | |
| 35 | print_usage() { |
| 36 | echo "Usage: $0 [options]" |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 37 | echo -e " -h|--help\tPrint this help." |
| 38 | echo -e " -m|--memcheck\tCheck memory leaks and errors." |
| 39 | echo -e " -f|--filter\tOnly matching tests are executed (default: '$FILTER')" |
| 40 | echo -e " -e|--exclude\tMatching tests are excluded (default: '$EXCLUDE')" |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 41 | } |
| 42 | |
| 43 | get_options() { |
| 44 | while [ $# -gt 0 ]; do |
| 45 | case "$1" in |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 46 | -f|--filter) |
| 47 | shift; FILTER=$1 |
| 48 | ;; |
| 49 | -e|--exclude) |
| 50 | shift; EXCLUDE=$1 |
| 51 | ;; |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 52 | -m|--memcheck) |
| 53 | MEMCHECK=1 |
| 54 | ;; |
| 55 | -h|--help) |
| 56 | print_usage |
| 57 | exit 0 |
| 58 | ;; |
| 59 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 60 | echo "Unknown argument: '$1'" |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 61 | print_usage |
| 62 | exit 1 |
| 63 | ;; |
| 64 | esac |
| 65 | shift |
| 66 | done |
| 67 | } |
| 68 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 69 | # skip next test if OpenSSL can't send SSLv2 ClientHello |
| 70 | requires_openssl_with_sslv2() { |
| 71 | if [ -z "${OPENSSL_HAS_SSL2:-}" ]; then |
Manuel Pégourié-Gonnard | a4afadf | 2014-08-30 22:09:36 +0200 | [diff] [blame] | 72 | if $OPENSSL_CMD ciphers -ssl2 >/dev/null 2>&1; then |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 73 | OPENSSL_HAS_SSL2="YES" |
| 74 | else |
| 75 | OPENSSL_HAS_SSL2="NO" |
| 76 | fi |
| 77 | fi |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 78 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 79 | if [ "$OPENSSL_HAS_SSL2" = "NO" ]; then |
| 80 | SKIP_NEXT="YES" |
| 81 | fi |
| 82 | } |
| 83 | |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 84 | # skip next test if GnuTLS isn't available |
| 85 | requires_gnutls() { |
| 86 | if [ -z "${GNUTLS_AVAILABLE:-}" ]; then |
| 87 | if ( which "$GNUTLS_CLI" && which "$GNUTLS_SERV" ) >/dev/null; then |
| 88 | GNUTLS_AVAILABLE="YES" |
| 89 | else |
| 90 | GNUTLS_AVAILABLE="NO" |
| 91 | fi |
| 92 | fi |
| 93 | if [ "$GNUTLS_AVAILABLE" = "NO" ]; then |
| 94 | SKIP_NEXT="YES" |
| 95 | fi |
| 96 | } |
| 97 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 98 | # skip next test if IPv6 isn't available on this host |
| 99 | requires_ipv6() { |
| 100 | if [ -z "${HAS_IPV6:-}" ]; then |
| 101 | $P_SRV server_addr='::1' > $SRV_OUT 2>&1 & |
| 102 | SRV_PID=$! |
| 103 | sleep 1 |
| 104 | kill $SRV_PID >/dev/null 2>&1 |
| 105 | if grep "NET - Binding of the socket failed" $SRV_OUT >/dev/null; then |
| 106 | HAS_IPV6="NO" |
| 107 | else |
| 108 | HAS_IPV6="YES" |
| 109 | fi |
| 110 | rm -r $SRV_OUT |
| 111 | fi |
| 112 | |
| 113 | if [ "$HAS_IPV6" = "NO" ]; then |
| 114 | SKIP_NEXT="YES" |
| 115 | fi |
| 116 | } |
| 117 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 118 | # print_name <name> |
| 119 | print_name() { |
| 120 | echo -n "$1 " |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 121 | LEN=$(( 72 - `echo "$1" | wc -c` )) |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 122 | for i in `seq 1 $LEN`; do echo -n '.'; done |
| 123 | echo -n ' ' |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 124 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 125 | TESTS=$(( $TESTS + 1 )) |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 126 | } |
| 127 | |
| 128 | # fail <message> |
| 129 | fail() { |
| 130 | echo "FAIL" |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 131 | echo " ! $1" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 132 | |
Manuel Pégourié-Gonnard | c2b0092 | 2014-08-31 16:46:04 +0200 | [diff] [blame] | 133 | mv $SRV_OUT o-srv-${TESTS}.log |
| 134 | mv $CLI_OUT o-cli-${TESTS}.log |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 135 | echo " ! outputs saved to o-srv-${TESTS}.log and o-cli-${TESTS}.log" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 136 | |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 137 | if [ "X${USER:-}" = Xbuildbot -o "X${LOGNAME:-}" = Xbuildbot ]; then |
| 138 | echo " ! server output:" |
| 139 | cat o-srv-${TESTS}.log |
| 140 | echo " ! ============================================================" |
| 141 | echo " ! client output:" |
| 142 | cat o-cli-${TESTS}.log |
| 143 | fi |
| 144 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 145 | FAILS=$(( $FAILS + 1 )) |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 146 | } |
| 147 | |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 148 | # is_polar <cmd_line> |
| 149 | is_polar() { |
| 150 | echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null |
| 151 | } |
| 152 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 153 | # has_mem_err <log_file_name> |
| 154 | has_mem_err() { |
| 155 | if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" && |
| 156 | grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null |
| 157 | then |
| 158 | return 1 # false: does not have errors |
| 159 | else |
| 160 | return 0 # true: has errors |
| 161 | fi |
| 162 | } |
| 163 | |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 164 | # wait for server to start: two versions depending on lsof availability |
| 165 | wait_server_start() { |
| 166 | if which lsof >/dev/null; then |
| 167 | # make sure we don't loop forever |
| 168 | ( sleep "$DOG_DELAY"; echo "SERVERSTART TIMEOUT"; kill $MAIN_PID ) & |
| 169 | WATCHDOG_PID=$! |
| 170 | |
| 171 | # make a tight loop, server usually takes less than 1 sec to start |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 172 | if [ "$DTLS" -eq 1 ]; then |
| 173 | until lsof -nbi UDP:"$PORT" | grep UDP >/dev/null; do :; done |
| 174 | else |
| 175 | until lsof -nbi TCP:"$PORT" | grep LISTEN >/dev/null; do :; done |
| 176 | fi |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 177 | |
| 178 | kill $WATCHDOG_PID |
| 179 | wait $WATCHDOG_PID |
| 180 | else |
| 181 | sleep "$START_DELAY" |
| 182 | fi |
| 183 | } |
| 184 | |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 185 | # wait for client to terminate and set CLI_EXIT |
| 186 | # must be called right after starting the client |
| 187 | wait_client_done() { |
| 188 | CLI_PID=$! |
| 189 | |
| 190 | ( sleep "$DOG_DELAY"; echo "TIMEOUT" >> $CLI_OUT; kill $CLI_PID ) & |
| 191 | WATCHDOG_PID=$! |
| 192 | |
| 193 | wait $CLI_PID |
| 194 | CLI_EXIT=$? |
| 195 | |
| 196 | kill $WATCHDOG_PID |
| 197 | wait $WATCHDOG_PID |
| 198 | |
| 199 | echo "EXIT: $CLI_EXIT" >> $CLI_OUT |
| 200 | } |
| 201 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 202 | # check if the given command uses dtls and sets global variable DTLS |
| 203 | detect_dtls() { |
| 204 | if echo "$1" | grep ' dtls=1 \| -dtls1\| -u ' >/dev/null; then |
| 205 | DTLS=1 |
| 206 | else |
| 207 | DTLS=0 |
| 208 | fi |
| 209 | } |
| 210 | |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 211 | # Usage: run_test name srv_cmd cli_cmd cli_exit [option [...]] |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 212 | # Options: -s pattern pattern that must be present in server output |
| 213 | # -c pattern pattern that must be present in client output |
| 214 | # -S pattern pattern that must be absent in server output |
| 215 | # -C pattern pattern that must be absent in client output |
| 216 | run_test() { |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 217 | NAME="$1" |
| 218 | SRV_CMD="$2" |
| 219 | CLI_CMD="$3" |
| 220 | CLI_EXPECT="$4" |
| 221 | shift 4 |
| 222 | |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 223 | if echo "$NAME" | grep "$FILTER" | grep -v "$EXCLUDE" >/dev/null; then : |
| 224 | else |
| 225 | return |
| 226 | fi |
| 227 | |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 228 | print_name "$NAME" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 229 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 230 | # should we skip? |
| 231 | if [ "X$SKIP_NEXT" = "XYES" ]; then |
| 232 | SKIP_NEXT="NO" |
| 233 | echo "SKIP" |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 234 | SKIPS=$(( $SKIPS + 1 )) |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 235 | return |
| 236 | fi |
| 237 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 238 | # update DTLS variable |
| 239 | detect_dtls "$SRV_CMD" |
| 240 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 241 | # prepend valgrind to our commands if active |
| 242 | if [ "$MEMCHECK" -gt 0 ]; then |
| 243 | if is_polar "$SRV_CMD"; then |
| 244 | SRV_CMD="valgrind --leak-check=full $SRV_CMD" |
| 245 | fi |
| 246 | if is_polar "$CLI_CMD"; then |
| 247 | CLI_CMD="valgrind --leak-check=full $CLI_CMD" |
| 248 | fi |
| 249 | fi |
| 250 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 251 | # run the commands |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 252 | echo "$SRV_CMD" > $SRV_OUT |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 253 | # for servers without -www, eg openssl with DTLS |
| 254 | yes blabla | $SRV_CMD >> $SRV_OUT 2>&1 & |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 255 | SRV_PID=$! |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 256 | wait_server_start |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 257 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 258 | echo "$CLI_CMD" > $CLI_OUT |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 259 | eval "$CLI_CMD" >> $CLI_OUT 2>&1 & |
| 260 | wait_client_done |
Manuel Pégourié-Gonnard | e01af4c | 2014-03-25 14:16:44 +0100 | [diff] [blame] | 261 | |
Manuel Pégourié-Gonnard | 74b1170 | 2014-08-14 15:47:33 +0200 | [diff] [blame] | 262 | # kill the server |
| 263 | kill $SRV_PID |
| 264 | wait $SRV_PID |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 265 | |
| 266 | # check if the client and server went at least to the handshake stage |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 267 | # (useful to avoid tests with only negative assertions and non-zero |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 268 | # expected client exit to incorrectly succeed in case of catastrophic |
| 269 | # failure) |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 270 | if is_polar "$SRV_CMD"; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 271 | if grep "Performing the SSL/TLS handshake" $SRV_OUT >/dev/null; then :; |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 272 | else |
| 273 | fail "server failed to start" |
| 274 | return |
| 275 | fi |
| 276 | fi |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 277 | if is_polar "$CLI_CMD"; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 278 | if grep "Performing the SSL/TLS handshake" $CLI_OUT >/dev/null; then :; |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 279 | else |
| 280 | fail "client failed to start" |
| 281 | return |
| 282 | fi |
| 283 | fi |
| 284 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 285 | # check server exit code |
| 286 | if [ $? != 0 ]; then |
| 287 | fail "server fail" |
| 288 | return |
| 289 | fi |
| 290 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 291 | # check client exit code |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 292 | if [ \( "$CLI_EXPECT" = 0 -a "$CLI_EXIT" != 0 \) -o \ |
| 293 | \( "$CLI_EXPECT" != 0 -a "$CLI_EXIT" = 0 \) ] |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 294 | then |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 295 | fail "bad client exit code" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 296 | return |
| 297 | fi |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 298 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 299 | # check other assertions |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 300 | # lines beginning with == are added by valgrind, ignore them |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 301 | while [ $# -gt 0 ] |
| 302 | do |
| 303 | case $1 in |
| 304 | "-s") |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 305 | if grep -v '^==' $SRV_OUT | grep "$2" >/dev/null; then :; else |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 306 | fail "-s $2" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 307 | return |
| 308 | fi |
| 309 | ;; |
| 310 | |
| 311 | "-c") |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 312 | if grep -v '^==' $CLI_OUT | grep "$2" >/dev/null; then :; else |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 313 | fail "-c $2" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 314 | return |
| 315 | fi |
| 316 | ;; |
| 317 | |
| 318 | "-S") |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 319 | if grep -v '^==' $SRV_OUT | grep "$2" >/dev/null; then |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 320 | fail "-S $2" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 321 | return |
| 322 | fi |
| 323 | ;; |
| 324 | |
| 325 | "-C") |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 326 | if grep -v '^==' $CLI_OUT | grep "$2" >/dev/null; then |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 327 | fail "-C $2" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 328 | return |
| 329 | fi |
| 330 | ;; |
| 331 | |
| 332 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 333 | echo "Unknown test: $1" >&2 |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 334 | exit 1 |
| 335 | esac |
| 336 | shift 2 |
| 337 | done |
| 338 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 339 | # check valgrind's results |
| 340 | if [ "$MEMCHECK" -gt 0 ]; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 341 | if is_polar "$SRV_CMD" && has_mem_err $SRV_OUT; then |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 342 | fail "Server has memory errors" |
| 343 | return |
| 344 | fi |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 345 | if is_polar "$CLI_CMD" && has_mem_err $CLI_OUT; then |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 346 | fail "Client has memory errors" |
| 347 | return |
| 348 | fi |
| 349 | fi |
| 350 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 351 | # if we're here, everything is ok |
| 352 | echo "PASS" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 353 | rm -f $SRV_OUT $CLI_OUT |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 354 | } |
| 355 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 356 | cleanup() { |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 357 | rm -f $CLI_OUT $SRV_OUT $SESSION |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 358 | kill $SRV_PID >/dev/null 2>&1 |
| 359 | kill $WATCHDOG_PID >/dev/null 2>&1 |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 360 | exit 1 |
| 361 | } |
| 362 | |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 363 | # |
| 364 | # MAIN |
| 365 | # |
| 366 | |
Manuel Pégourié-Gonnard | 913030c | 2014-03-28 10:12:38 +0100 | [diff] [blame] | 367 | get_options "$@" |
| 368 | |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 369 | # sanity checks, avoid an avalanche of errors |
| 370 | if [ ! -x "$P_SRV" ]; then |
| 371 | echo "Command '$P_SRV' is not an executable file" |
| 372 | exit 1 |
| 373 | fi |
| 374 | if [ ! -x "$P_CLI" ]; then |
| 375 | echo "Command '$P_CLI' is not an executable file" |
| 376 | exit 1 |
| 377 | fi |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 378 | if which $OPENSSL_CMD >/dev/null 2>&1; then :; else |
| 379 | echo "Command '$OPENSSL_CMD' not found" |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 380 | exit 1 |
| 381 | fi |
| 382 | |
Manuel Pégourié-Gonnard | 32f8f4d | 2014-05-29 11:31:20 +0200 | [diff] [blame] | 383 | # used by watchdog |
| 384 | MAIN_PID="$$" |
| 385 | |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 386 | # be more patient with valgrind |
| 387 | if [ "$MEMCHECK" -gt 0 ]; then |
| 388 | START_DELAY=3 |
| 389 | DOG_DELAY=30 |
| 390 | else |
| 391 | START_DELAY=1 |
| 392 | DOG_DELAY=10 |
| 393 | fi |
| 394 | |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 395 | # Pick a "unique" port in the range 10000-19999. |
| 396 | PORT="0000$$" |
Manuel Pégourié-Gonnard | fab2a3c | 2014-06-16 16:54:36 +0200 | [diff] [blame] | 397 | PORT="1$(echo $PORT | tail -c 5)" |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 398 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 399 | # fix commands to use this port, force IPv4 while at it |
| 400 | P_SRV="$P_SRV server_addr=127.0.0.1 server_port=$PORT" |
| 401 | P_CLI="$P_CLI server_addr=127.0.0.1 server_port=$PORT" |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 402 | O_SRV="$O_SRV -accept $PORT" |
| 403 | O_CLI="$O_CLI -connect localhost:$PORT" |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 404 | G_SRV="$G_SRV -p $PORT" |
| 405 | G_CLI="$G_CLI -p $PORT" |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 406 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 407 | # Also pick a unique name for intermediate files |
| 408 | SRV_OUT="srv_out.$$" |
| 409 | CLI_OUT="cli_out.$$" |
| 410 | SESSION="session.$$" |
| 411 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 412 | SKIP_NEXT="NO" |
| 413 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 414 | trap cleanup INT TERM HUP |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 415 | |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 416 | # Basic test |
| 417 | |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 418 | # Checks that: |
| 419 | # - things work with all ciphersuites active (used with config-full in all.sh) |
| 420 | # - the expected (highest security) parameters are selected |
| 421 | # ("signature_algorithm ext: 6" means SHA-512 (highest common hash)) |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 422 | run_test "Default" \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 423 | "$P_SRV debug_level=3" \ |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 424 | "$P_CLI" \ |
| 425 | 0 \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 426 | -s "Protocol is TLSv1.2" \ |
| 427 | -s "Ciphersuite is TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ |
| 428 | -s "client hello v3, signature_algorithm ext: 6" \ |
| 429 | -s "ECDHE curve: secp521r1" \ |
| 430 | -S "error" \ |
| 431 | -C "error" |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 432 | |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 433 | # Test for SSLv2 ClientHello |
| 434 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 435 | requires_openssl_with_sslv2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 436 | run_test "SSLv2 ClientHello: reference" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 437 | "$P_SRV debug_level=3" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 438 | "$O_CLI -no_ssl2" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 439 | 0 \ |
| 440 | -S "parse client hello v2" \ |
| 441 | -S "ssl_handshake returned" |
| 442 | |
| 443 | # Adding a SSL2-only suite makes OpenSSL client send SSLv2 ClientHello |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 444 | requires_openssl_with_sslv2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 445 | run_test "SSLv2 ClientHello: actual test" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 446 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 447 | "$O_CLI -cipher 'DES-CBC-MD5:ALL'" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 448 | 0 \ |
| 449 | -s "parse client hello v2" \ |
| 450 | -S "ssl_handshake returned" |
| 451 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 452 | # Tests for Truncated HMAC extension |
| 453 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 454 | run_test "Truncated HMAC: reference" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 455 | "$P_SRV debug_level=4" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 456 | "$P_CLI trunc_hmac=0 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 457 | 0 \ |
| 458 | -s "dumping 'computed mac' (20 bytes)" |
| 459 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 460 | run_test "Truncated HMAC: actual test" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 461 | "$P_SRV debug_level=4" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 462 | "$P_CLI trunc_hmac=1 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 463 | 0 \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 464 | -s "dumping 'computed mac' (10 bytes)" |
| 465 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 466 | # Tests for Session Tickets |
| 467 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 468 | run_test "Session resume using tickets: basic" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 469 | "$P_SRV debug_level=3 tickets=1" \ |
| 470 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 471 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 472 | -c "client hello, adding session ticket extension" \ |
| 473 | -s "found session ticket extension" \ |
| 474 | -s "server hello, adding session ticket extension" \ |
| 475 | -c "found session_ticket extension" \ |
| 476 | -c "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 477 | -S "session successfully restored from cache" \ |
| 478 | -s "session successfully restored from ticket" \ |
| 479 | -s "a session has been resumed" \ |
| 480 | -c "a session has been resumed" |
| 481 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 482 | run_test "Session resume using tickets: cache disabled" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 483 | "$P_SRV debug_level=3 tickets=1 cache_max=0" \ |
| 484 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 485 | 0 \ |
| 486 | -c "client hello, adding session ticket extension" \ |
| 487 | -s "found session ticket extension" \ |
| 488 | -s "server hello, adding session ticket extension" \ |
| 489 | -c "found session_ticket extension" \ |
| 490 | -c "parse new session ticket" \ |
| 491 | -S "session successfully restored from cache" \ |
| 492 | -s "session successfully restored from ticket" \ |
| 493 | -s "a session has been resumed" \ |
| 494 | -c "a session has been resumed" |
| 495 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 496 | run_test "Session resume using tickets: timeout" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 497 | "$P_SRV debug_level=3 tickets=1 cache_max=0 ticket_timeout=1" \ |
| 498 | "$P_CLI debug_level=3 tickets=1 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 499 | 0 \ |
| 500 | -c "client hello, adding session ticket extension" \ |
| 501 | -s "found session ticket extension" \ |
| 502 | -s "server hello, adding session ticket extension" \ |
| 503 | -c "found session_ticket extension" \ |
| 504 | -c "parse new session ticket" \ |
| 505 | -S "session successfully restored from cache" \ |
| 506 | -S "session successfully restored from ticket" \ |
| 507 | -S "a session has been resumed" \ |
| 508 | -C "a session has been resumed" |
| 509 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 510 | run_test "Session resume using tickets: openssl server" \ |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 511 | "$O_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 512 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 513 | 0 \ |
| 514 | -c "client hello, adding session ticket extension" \ |
| 515 | -c "found session_ticket extension" \ |
| 516 | -c "parse new session ticket" \ |
| 517 | -c "a session has been resumed" |
| 518 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 519 | run_test "Session resume using tickets: openssl client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 520 | "$P_SRV debug_level=3 tickets=1" \ |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 521 | "( $O_CLI -sess_out $SESSION; \ |
| 522 | $O_CLI -sess_in $SESSION; \ |
| 523 | rm -f $SESSION )" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 524 | 0 \ |
| 525 | -s "found session ticket extension" \ |
| 526 | -s "server hello, adding session ticket extension" \ |
| 527 | -S "session successfully restored from cache" \ |
| 528 | -s "session successfully restored from ticket" \ |
| 529 | -s "a session has been resumed" |
| 530 | |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 531 | # Tests for Session Resume based on session-ID and cache |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 532 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 533 | run_test "Session resume using cache: tickets enabled on client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 534 | "$P_SRV debug_level=3 tickets=0" \ |
| 535 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 536 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 537 | -c "client hello, adding session ticket extension" \ |
| 538 | -s "found session ticket extension" \ |
| 539 | -S "server hello, adding session ticket extension" \ |
| 540 | -C "found session_ticket extension" \ |
| 541 | -C "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 542 | -s "session successfully restored from cache" \ |
| 543 | -S "session successfully restored from ticket" \ |
| 544 | -s "a session has been resumed" \ |
| 545 | -c "a session has been resumed" |
| 546 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 547 | run_test "Session resume using cache: tickets enabled on server" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 548 | "$P_SRV debug_level=3 tickets=1" \ |
| 549 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 550 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 551 | -C "client hello, adding session ticket extension" \ |
| 552 | -S "found session ticket extension" \ |
| 553 | -S "server hello, adding session ticket extension" \ |
| 554 | -C "found session_ticket extension" \ |
| 555 | -C "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 556 | -s "session successfully restored from cache" \ |
| 557 | -S "session successfully restored from ticket" \ |
| 558 | -s "a session has been resumed" \ |
| 559 | -c "a session has been resumed" |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 560 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 561 | run_test "Session resume using cache: cache_max=0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 562 | "$P_SRV debug_level=3 tickets=0 cache_max=0" \ |
| 563 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 564 | 0 \ |
| 565 | -S "session successfully restored from cache" \ |
| 566 | -S "session successfully restored from ticket" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 567 | -S "a session has been resumed" \ |
| 568 | -C "a session has been resumed" |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 569 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 570 | run_test "Session resume using cache: cache_max=1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 571 | "$P_SRV debug_level=3 tickets=0 cache_max=1" \ |
| 572 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 573 | 0 \ |
| 574 | -s "session successfully restored from cache" \ |
| 575 | -S "session successfully restored from ticket" \ |
| 576 | -s "a session has been resumed" \ |
| 577 | -c "a session has been resumed" |
| 578 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 579 | run_test "Session resume using cache: timemout > delay" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 580 | "$P_SRV debug_level=3 tickets=0" \ |
| 581 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=0" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 582 | 0 \ |
| 583 | -s "session successfully restored from cache" \ |
| 584 | -S "session successfully restored from ticket" \ |
| 585 | -s "a session has been resumed" \ |
| 586 | -c "a session has been resumed" |
| 587 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 588 | run_test "Session resume using cache: timeout < delay" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 589 | "$P_SRV debug_level=3 tickets=0 cache_timeout=1" \ |
| 590 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 591 | 0 \ |
| 592 | -S "session successfully restored from cache" \ |
| 593 | -S "session successfully restored from ticket" \ |
| 594 | -S "a session has been resumed" \ |
| 595 | -C "a session has been resumed" |
| 596 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 597 | run_test "Session resume using cache: no timeout" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 598 | "$P_SRV debug_level=3 tickets=0 cache_timeout=0" \ |
| 599 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 600 | 0 \ |
| 601 | -s "session successfully restored from cache" \ |
| 602 | -S "session successfully restored from ticket" \ |
| 603 | -s "a session has been resumed" \ |
| 604 | -c "a session has been resumed" |
| 605 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 606 | run_test "Session resume using cache: openssl client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 607 | "$P_SRV debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 608 | "( $O_CLI -sess_out $SESSION; \ |
| 609 | $O_CLI -sess_in $SESSION; \ |
| 610 | rm -f $SESSION )" \ |
Manuel Pégourié-Gonnard | db735f6 | 2014-02-25 17:57:59 +0100 | [diff] [blame] | 611 | 0 \ |
| 612 | -s "found session ticket extension" \ |
| 613 | -S "server hello, adding session ticket extension" \ |
| 614 | -s "session successfully restored from cache" \ |
| 615 | -S "session successfully restored from ticket" \ |
| 616 | -s "a session has been resumed" |
| 617 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 618 | run_test "Session resume using cache: openssl server" \ |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 619 | "$O_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 620 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | db735f6 | 2014-02-25 17:57:59 +0100 | [diff] [blame] | 621 | 0 \ |
| 622 | -C "found session_ticket extension" \ |
| 623 | -C "parse new session ticket" \ |
| 624 | -c "a session has been resumed" |
| 625 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 626 | # Tests for Max Fragment Length extension |
| 627 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 628 | run_test "Max fragment length: not used, reference" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 629 | "$P_SRV debug_level=3" \ |
| 630 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 631 | 0 \ |
| 632 | -C "client hello, adding max_fragment_length extension" \ |
| 633 | -S "found max fragment length extension" \ |
| 634 | -S "server hello, max_fragment_length extension" \ |
| 635 | -C "found max_fragment_length extension" |
| 636 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 637 | run_test "Max fragment length: used by client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 638 | "$P_SRV debug_level=3" \ |
| 639 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 640 | 0 \ |
| 641 | -c "client hello, adding max_fragment_length extension" \ |
| 642 | -s "found max fragment length extension" \ |
| 643 | -s "server hello, max_fragment_length extension" \ |
| 644 | -c "found max_fragment_length extension" |
| 645 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 646 | run_test "Max fragment length: used by server" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 647 | "$P_SRV debug_level=3 max_frag_len=4096" \ |
| 648 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 649 | 0 \ |
| 650 | -C "client hello, adding max_fragment_length extension" \ |
| 651 | -S "found max fragment length extension" \ |
| 652 | -S "server hello, max_fragment_length extension" \ |
| 653 | -C "found max_fragment_length extension" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 654 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 655 | requires_gnutls |
| 656 | run_test "Max fragment length: gnutls server" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 657 | "$G_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 658 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 659 | 0 \ |
| 660 | -c "client hello, adding max_fragment_length extension" \ |
| 661 | -c "found max_fragment_length extension" |
| 662 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 663 | # Tests for renegotiation |
| 664 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 665 | run_test "Renegotiation: none, for reference" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 666 | "$P_SRV debug_level=3 exchanges=2" \ |
| 667 | "$P_CLI debug_level=3 exchanges=2" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 668 | 0 \ |
| 669 | -C "client hello, adding renegotiation extension" \ |
| 670 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 671 | -S "found renegotiation extension" \ |
| 672 | -s "server hello, secure renegotiation extension" \ |
| 673 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 674 | -C "=> renegotiate" \ |
| 675 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 676 | -S "write hello request" |
| 677 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 678 | run_test "Renegotiation: client-initiated" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 679 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1" \ |
| 680 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 681 | 0 \ |
| 682 | -c "client hello, adding renegotiation extension" \ |
| 683 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 684 | -s "found renegotiation extension" \ |
| 685 | -s "server hello, secure renegotiation extension" \ |
| 686 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 687 | -c "=> renegotiate" \ |
| 688 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 689 | -S "write hello request" |
| 690 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 691 | run_test "Renegotiation: server-initiated" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 692 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 693 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 694 | 0 \ |
| 695 | -c "client hello, adding renegotiation extension" \ |
| 696 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 697 | -s "found renegotiation extension" \ |
| 698 | -s "server hello, secure renegotiation extension" \ |
| 699 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 700 | -c "=> renegotiate" \ |
| 701 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 702 | -s "write hello request" |
| 703 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 704 | run_test "Renegotiation: double" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 705 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 706 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 707 | 0 \ |
| 708 | -c "client hello, adding renegotiation extension" \ |
| 709 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 710 | -s "found renegotiation extension" \ |
| 711 | -s "server hello, secure renegotiation extension" \ |
| 712 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 713 | -c "=> renegotiate" \ |
| 714 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 715 | -s "write hello request" |
| 716 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 717 | run_test "Renegotiation: client-initiated, server-rejected" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 718 | "$P_SRV debug_level=3 exchanges=2 renegotiation=0" \ |
| 719 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 720 | 1 \ |
| 721 | -c "client hello, adding renegotiation extension" \ |
| 722 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 723 | -S "found renegotiation extension" \ |
| 724 | -s "server hello, secure renegotiation extension" \ |
| 725 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 726 | -c "=> renegotiate" \ |
| 727 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 728 | -S "write hello request" \ |
Manuel Pégourié-Gonnard | 6591962 | 2014-08-19 12:50:30 +0200 | [diff] [blame] | 729 | -c "SSL - Unexpected message at ServerHello in renegotiation" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 730 | -c "failed" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 731 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 732 | run_test "Renegotiation: server-initiated, client-rejected, default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 733 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 734 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 735 | 0 \ |
| 736 | -C "client hello, adding renegotiation extension" \ |
| 737 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 738 | -S "found renegotiation extension" \ |
| 739 | -s "server hello, secure renegotiation extension" \ |
| 740 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 741 | -C "=> renegotiate" \ |
| 742 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 743 | -s "write hello request" \ |
Manuel Pégourié-Gonnard | a9964db | 2014-07-03 19:29:16 +0200 | [diff] [blame] | 744 | -S "SSL - An unexpected message was received from our peer" \ |
| 745 | -S "failed" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 746 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 747 | run_test "Renegotiation: server-initiated, client-rejected, not enforced" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 748 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 749 | renego_delay=-1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 750 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 751 | 0 \ |
| 752 | -C "client hello, adding renegotiation extension" \ |
| 753 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 754 | -S "found renegotiation extension" \ |
| 755 | -s "server hello, secure renegotiation extension" \ |
| 756 | -c "found renegotiation extension" \ |
| 757 | -C "=> renegotiate" \ |
| 758 | -S "=> renegotiate" \ |
| 759 | -s "write hello request" \ |
| 760 | -S "SSL - An unexpected message was received from our peer" \ |
| 761 | -S "failed" |
| 762 | |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 763 | # delay 2 for 1 alert record + 1 application data record |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 764 | run_test "Renegotiation: server-initiated, client-rejected, delay 2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 765 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 766 | renego_delay=2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 767 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 768 | 0 \ |
| 769 | -C "client hello, adding renegotiation extension" \ |
| 770 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 771 | -S "found renegotiation extension" \ |
| 772 | -s "server hello, secure renegotiation extension" \ |
| 773 | -c "found renegotiation extension" \ |
| 774 | -C "=> renegotiate" \ |
| 775 | -S "=> renegotiate" \ |
| 776 | -s "write hello request" \ |
| 777 | -S "SSL - An unexpected message was received from our peer" \ |
| 778 | -S "failed" |
| 779 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 780 | run_test "Renegotiation: server-initiated, client-rejected, delay 0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 781 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 782 | renego_delay=0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 783 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 784 | 0 \ |
| 785 | -C "client hello, adding renegotiation extension" \ |
| 786 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 787 | -S "found renegotiation extension" \ |
| 788 | -s "server hello, secure renegotiation extension" \ |
| 789 | -c "found renegotiation extension" \ |
| 790 | -C "=> renegotiate" \ |
| 791 | -S "=> renegotiate" \ |
| 792 | -s "write hello request" \ |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 793 | -s "SSL - An unexpected message was received from our peer" |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 794 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 795 | run_test "Renegotiation: server-initiated, client-accepted, delay 0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 796 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 797 | renego_delay=0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 798 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 799 | 0 \ |
| 800 | -c "client hello, adding renegotiation extension" \ |
| 801 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 802 | -s "found renegotiation extension" \ |
| 803 | -s "server hello, secure renegotiation extension" \ |
| 804 | -c "found renegotiation extension" \ |
| 805 | -c "=> renegotiate" \ |
| 806 | -s "=> renegotiate" \ |
| 807 | -s "write hello request" \ |
| 808 | -S "SSL - An unexpected message was received from our peer" \ |
| 809 | -S "failed" |
| 810 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 811 | run_test "Renegotiation: nbio, client-initiated" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 812 | "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1" \ |
| 813 | "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | f07f421 | 2014-08-15 19:04:47 +0200 | [diff] [blame] | 814 | 0 \ |
| 815 | -c "client hello, adding renegotiation extension" \ |
| 816 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 817 | -s "found renegotiation extension" \ |
| 818 | -s "server hello, secure renegotiation extension" \ |
| 819 | -c "found renegotiation extension" \ |
| 820 | -c "=> renegotiate" \ |
| 821 | -s "=> renegotiate" \ |
| 822 | -S "write hello request" |
| 823 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 824 | run_test "Renegotiation: nbio, server-initiated" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 825 | "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 826 | "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | f07f421 | 2014-08-15 19:04:47 +0200 | [diff] [blame] | 827 | 0 \ |
| 828 | -c "client hello, adding renegotiation extension" \ |
| 829 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 830 | -s "found renegotiation extension" \ |
| 831 | -s "server hello, secure renegotiation extension" \ |
| 832 | -c "found renegotiation extension" \ |
| 833 | -c "=> renegotiate" \ |
| 834 | -s "=> renegotiate" \ |
| 835 | -s "write hello request" |
| 836 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 837 | run_test "Renegotiation: openssl server, client-initiated" \ |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 838 | "$O_SRV -www" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 839 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 840 | 0 \ |
| 841 | -c "client hello, adding renegotiation extension" \ |
| 842 | -c "found renegotiation extension" \ |
| 843 | -c "=> renegotiate" \ |
| 844 | -C "ssl_handshake returned" \ |
| 845 | -C "error" \ |
| 846 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 847 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 848 | run_test "Renegotiation: gnutls server, client-initiated" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 849 | "$G_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 850 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 851 | 0 \ |
| 852 | -c "client hello, adding renegotiation extension" \ |
| 853 | -c "found renegotiation extension" \ |
| 854 | -c "=> renegotiate" \ |
| 855 | -C "ssl_handshake returned" \ |
| 856 | -C "error" \ |
| 857 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 858 | |
Manuel Pégourié-Gonnard | 30d16eb | 2014-08-19 17:43:50 +0200 | [diff] [blame] | 859 | run_test "Renegotiation: DTLS, client-initiated" \ |
| 860 | "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1" \ |
| 861 | "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 862 | 0 \ |
| 863 | -c "client hello, adding renegotiation extension" \ |
| 864 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 865 | -s "found renegotiation extension" \ |
| 866 | -s "server hello, secure renegotiation extension" \ |
| 867 | -c "found renegotiation extension" \ |
| 868 | -c "=> renegotiate" \ |
| 869 | -s "=> renegotiate" \ |
| 870 | -S "write hello request" |
| 871 | |
Manuel Pégourié-Gonnard | c392b24 | 2014-08-19 17:53:11 +0200 | [diff] [blame] | 872 | run_test "Renegotiation: DTLS, server-initiated" \ |
| 873 | "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 874 | "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1" \ |
| 875 | 0 \ |
| 876 | -c "client hello, adding renegotiation extension" \ |
| 877 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 878 | -s "found renegotiation extension" \ |
| 879 | -s "server hello, secure renegotiation extension" \ |
| 880 | -c "found renegotiation extension" \ |
| 881 | -c "=> renegotiate" \ |
| 882 | -s "=> renegotiate" \ |
| 883 | -s "write hello request" |
| 884 | |
Manuel Pégourié-Gonnard | f1499f6 | 2014-08-31 17:13:13 +0200 | [diff] [blame] | 885 | run_test "Renegotiation: DTLS, gnutls server, client-initiated" \ |
| 886 | "$G_SRV -u --mtu 4096" \ |
| 887 | "$P_CLI debug_level=3 dtls=1 exchanges=1 renegotiation=1 renegotiate=1" \ |
| 888 | 0 \ |
| 889 | -c "client hello, adding renegotiation extension" \ |
| 890 | -c "found renegotiation extension" \ |
| 891 | -c "=> renegotiate" \ |
| 892 | -C "ssl_handshake returned" \ |
| 893 | -C "error" \ |
| 894 | -s "Extra-header:" |
| 895 | |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 896 | # Tests for auth_mode |
| 897 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 898 | run_test "Authentication: server badcert, client required" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 899 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 900 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 901 | "$P_CLI debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 902 | 1 \ |
| 903 | -c "x509_verify_cert() returned" \ |
| 904 | -c "! self-signed or not signed by a trusted CA" \ |
| 905 | -c "! ssl_handshake returned" \ |
| 906 | -c "X509 - Certificate verification failed" |
| 907 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 908 | run_test "Authentication: server badcert, client optional" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 909 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 910 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 911 | "$P_CLI debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 912 | 0 \ |
| 913 | -c "x509_verify_cert() returned" \ |
| 914 | -c "! self-signed or not signed by a trusted CA" \ |
| 915 | -C "! ssl_handshake returned" \ |
| 916 | -C "X509 - Certificate verification failed" |
| 917 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 918 | run_test "Authentication: server badcert, client none" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 919 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 920 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 921 | "$P_CLI debug_level=1 auth_mode=none" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 922 | 0 \ |
| 923 | -C "x509_verify_cert() returned" \ |
| 924 | -C "! self-signed or not signed by a trusted CA" \ |
| 925 | -C "! ssl_handshake returned" \ |
| 926 | -C "X509 - Certificate verification failed" |
| 927 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 928 | run_test "Authentication: client badcert, server required" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 929 | "$P_SRV debug_level=3 auth_mode=required" \ |
| 930 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 931 | key_file=data_files/server5.key" \ |
| 932 | 1 \ |
| 933 | -S "skip write certificate request" \ |
| 934 | -C "skip parse certificate request" \ |
| 935 | -c "got a certificate request" \ |
| 936 | -C "skip write certificate" \ |
| 937 | -C "skip write certificate verify" \ |
| 938 | -S "skip parse certificate verify" \ |
| 939 | -s "x509_verify_cert() returned" \ |
| 940 | -S "! self-signed or not signed by a trusted CA" \ |
| 941 | -s "! ssl_handshake returned" \ |
| 942 | -c "! ssl_handshake returned" \ |
| 943 | -s "X509 - Certificate verification failed" |
| 944 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 945 | run_test "Authentication: client badcert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 946 | "$P_SRV debug_level=3 auth_mode=optional" \ |
| 947 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 948 | key_file=data_files/server5.key" \ |
| 949 | 0 \ |
| 950 | -S "skip write certificate request" \ |
| 951 | -C "skip parse certificate request" \ |
| 952 | -c "got a certificate request" \ |
| 953 | -C "skip write certificate" \ |
| 954 | -C "skip write certificate verify" \ |
| 955 | -S "skip parse certificate verify" \ |
| 956 | -s "x509_verify_cert() returned" \ |
| 957 | -s "! self-signed or not signed by a trusted CA" \ |
| 958 | -S "! ssl_handshake returned" \ |
| 959 | -C "! ssl_handshake returned" \ |
| 960 | -S "X509 - Certificate verification failed" |
| 961 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 962 | run_test "Authentication: client badcert, server none" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 963 | "$P_SRV debug_level=3 auth_mode=none" \ |
| 964 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 965 | key_file=data_files/server5.key" \ |
| 966 | 0 \ |
| 967 | -s "skip write certificate request" \ |
| 968 | -C "skip parse certificate request" \ |
| 969 | -c "got no certificate request" \ |
| 970 | -c "skip write certificate" \ |
| 971 | -c "skip write certificate verify" \ |
| 972 | -s "skip parse certificate verify" \ |
| 973 | -S "x509_verify_cert() returned" \ |
| 974 | -S "! self-signed or not signed by a trusted CA" \ |
| 975 | -S "! ssl_handshake returned" \ |
| 976 | -C "! ssl_handshake returned" \ |
| 977 | -S "X509 - Certificate verification failed" |
| 978 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 979 | run_test "Authentication: client no cert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 980 | "$P_SRV debug_level=3 auth_mode=optional" \ |
| 981 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 982 | 0 \ |
| 983 | -S "skip write certificate request" \ |
| 984 | -C "skip parse certificate request" \ |
| 985 | -c "got a certificate request" \ |
| 986 | -C "skip write certificate$" \ |
| 987 | -C "got no certificate to send" \ |
| 988 | -S "SSLv3 client has no certificate" \ |
| 989 | -c "skip write certificate verify" \ |
| 990 | -s "skip parse certificate verify" \ |
| 991 | -s "! no client certificate sent" \ |
| 992 | -S "! ssl_handshake returned" \ |
| 993 | -C "! ssl_handshake returned" \ |
| 994 | -S "X509 - Certificate verification failed" |
| 995 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 996 | run_test "Authentication: openssl client no cert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 997 | "$P_SRV debug_level=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 998 | "$O_CLI" \ |
| 999 | 0 \ |
| 1000 | -S "skip write certificate request" \ |
| 1001 | -s "skip parse certificate verify" \ |
| 1002 | -s "! no client certificate sent" \ |
| 1003 | -S "! ssl_handshake returned" \ |
| 1004 | -S "X509 - Certificate verification failed" |
| 1005 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1006 | run_test "Authentication: client no cert, openssl server optional" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1007 | "$O_SRV -verify 10" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1008 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1009 | 0 \ |
| 1010 | -C "skip parse certificate request" \ |
| 1011 | -c "got a certificate request" \ |
| 1012 | -C "skip write certificate$" \ |
| 1013 | -c "skip write certificate verify" \ |
| 1014 | -C "! ssl_handshake returned" |
| 1015 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1016 | run_test "Authentication: client no cert, ssl3" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1017 | "$P_SRV debug_level=3 auth_mode=optional force_version=ssl3" \ |
| 1018 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1019 | 0 \ |
| 1020 | -S "skip write certificate request" \ |
| 1021 | -C "skip parse certificate request" \ |
| 1022 | -c "got a certificate request" \ |
| 1023 | -C "skip write certificate$" \ |
| 1024 | -c "skip write certificate verify" \ |
| 1025 | -c "got no certificate to send" \ |
| 1026 | -s "SSLv3 client has no certificate" \ |
| 1027 | -s "skip parse certificate verify" \ |
| 1028 | -s "! no client certificate sent" \ |
| 1029 | -S "! ssl_handshake returned" \ |
| 1030 | -C "! ssl_handshake returned" \ |
| 1031 | -S "X509 - Certificate verification failed" |
| 1032 | |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1033 | # tests for SNI |
| 1034 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1035 | run_test "SNI: no SNI callback" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1036 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1037 | crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1038 | "$P_CLI server_name=localhost" \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1039 | 0 \ |
| 1040 | -S "parse ServerName extension" \ |
| 1041 | -c "issuer name *: C=NL, O=PolarSSL, CN=Polarssl Test EC CA" \ |
| 1042 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
| 1043 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1044 | run_test "SNI: matching cert 1" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1045 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1046 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1047 | sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1048 | "$P_CLI server_name=localhost" \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1049 | 0 \ |
| 1050 | -s "parse ServerName extension" \ |
| 1051 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 1052 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
| 1053 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1054 | run_test "SNI: matching cert 2" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1055 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1056 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1057 | sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1058 | "$P_CLI server_name=polarssl.example" \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1059 | 0 \ |
| 1060 | -s "parse ServerName extension" \ |
| 1061 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1062 | -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1063 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1064 | run_test "SNI: no matching cert" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1065 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1066 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1067 | sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1068 | "$P_CLI server_name=nonesuch.example" \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1069 | 1 \ |
| 1070 | -s "parse ServerName extension" \ |
| 1071 | -s "ssl_sni_wrapper() returned" \ |
| 1072 | -s "ssl_handshake returned" \ |
| 1073 | -c "ssl_handshake returned" \ |
| 1074 | -c "SSL - A fatal alert message was received from our peer" |
| 1075 | |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1076 | # Tests for non-blocking I/O: exercise a variety of handshake flows |
| 1077 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1078 | run_test "Non-blocking I/O: basic handshake" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1079 | "$P_SRV nbio=2 tickets=0 auth_mode=none" \ |
| 1080 | "$P_CLI nbio=2 tickets=0" \ |
| 1081 | 0 \ |
| 1082 | -S "ssl_handshake returned" \ |
| 1083 | -C "ssl_handshake returned" \ |
| 1084 | -c "Read from server: .* bytes read" |
| 1085 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1086 | run_test "Non-blocking I/O: client auth" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1087 | "$P_SRV nbio=2 tickets=0 auth_mode=required" \ |
| 1088 | "$P_CLI nbio=2 tickets=0" \ |
| 1089 | 0 \ |
| 1090 | -S "ssl_handshake returned" \ |
| 1091 | -C "ssl_handshake returned" \ |
| 1092 | -c "Read from server: .* bytes read" |
| 1093 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1094 | run_test "Non-blocking I/O: ticket" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1095 | "$P_SRV nbio=2 tickets=1 auth_mode=none" \ |
| 1096 | "$P_CLI nbio=2 tickets=1" \ |
| 1097 | 0 \ |
| 1098 | -S "ssl_handshake returned" \ |
| 1099 | -C "ssl_handshake returned" \ |
| 1100 | -c "Read from server: .* bytes read" |
| 1101 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1102 | run_test "Non-blocking I/O: ticket + client auth" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1103 | "$P_SRV nbio=2 tickets=1 auth_mode=required" \ |
| 1104 | "$P_CLI nbio=2 tickets=1" \ |
| 1105 | 0 \ |
| 1106 | -S "ssl_handshake returned" \ |
| 1107 | -C "ssl_handshake returned" \ |
| 1108 | -c "Read from server: .* bytes read" |
| 1109 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1110 | run_test "Non-blocking I/O: ticket + client auth + resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1111 | "$P_SRV nbio=2 tickets=1 auth_mode=required" \ |
| 1112 | "$P_CLI nbio=2 tickets=1 reconnect=1" \ |
| 1113 | 0 \ |
| 1114 | -S "ssl_handshake returned" \ |
| 1115 | -C "ssl_handshake returned" \ |
| 1116 | -c "Read from server: .* bytes read" |
| 1117 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1118 | run_test "Non-blocking I/O: ticket + resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1119 | "$P_SRV nbio=2 tickets=1 auth_mode=none" \ |
| 1120 | "$P_CLI nbio=2 tickets=1 reconnect=1" \ |
| 1121 | 0 \ |
| 1122 | -S "ssl_handshake returned" \ |
| 1123 | -C "ssl_handshake returned" \ |
| 1124 | -c "Read from server: .* bytes read" |
| 1125 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1126 | run_test "Non-blocking I/O: session-id resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1127 | "$P_SRV nbio=2 tickets=0 auth_mode=none" \ |
| 1128 | "$P_CLI nbio=2 tickets=0 reconnect=1" \ |
| 1129 | 0 \ |
| 1130 | -S "ssl_handshake returned" \ |
| 1131 | -C "ssl_handshake returned" \ |
| 1132 | -c "Read from server: .* bytes read" |
| 1133 | |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1134 | # Tests for version negotiation |
| 1135 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1136 | run_test "Version check: all -> 1.2" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1137 | "$P_SRV" \ |
| 1138 | "$P_CLI" \ |
| 1139 | 0 \ |
| 1140 | -S "ssl_handshake returned" \ |
| 1141 | -C "ssl_handshake returned" \ |
| 1142 | -s "Protocol is TLSv1.2" \ |
| 1143 | -c "Protocol is TLSv1.2" |
| 1144 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1145 | run_test "Version check: cli max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1146 | "$P_SRV" \ |
| 1147 | "$P_CLI max_version=tls1_1" \ |
| 1148 | 0 \ |
| 1149 | -S "ssl_handshake returned" \ |
| 1150 | -C "ssl_handshake returned" \ |
| 1151 | -s "Protocol is TLSv1.1" \ |
| 1152 | -c "Protocol is TLSv1.1" |
| 1153 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1154 | run_test "Version check: srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1155 | "$P_SRV max_version=tls1_1" \ |
| 1156 | "$P_CLI" \ |
| 1157 | 0 \ |
| 1158 | -S "ssl_handshake returned" \ |
| 1159 | -C "ssl_handshake returned" \ |
| 1160 | -s "Protocol is TLSv1.1" \ |
| 1161 | -c "Protocol is TLSv1.1" |
| 1162 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1163 | run_test "Version check: cli+srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1164 | "$P_SRV max_version=tls1_1" \ |
| 1165 | "$P_CLI max_version=tls1_1" \ |
| 1166 | 0 \ |
| 1167 | -S "ssl_handshake returned" \ |
| 1168 | -C "ssl_handshake returned" \ |
| 1169 | -s "Protocol is TLSv1.1" \ |
| 1170 | -c "Protocol is TLSv1.1" |
| 1171 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1172 | run_test "Version check: cli max 1.1, srv min 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1173 | "$P_SRV min_version=tls1_1" \ |
| 1174 | "$P_CLI max_version=tls1_1" \ |
| 1175 | 0 \ |
| 1176 | -S "ssl_handshake returned" \ |
| 1177 | -C "ssl_handshake returned" \ |
| 1178 | -s "Protocol is TLSv1.1" \ |
| 1179 | -c "Protocol is TLSv1.1" |
| 1180 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1181 | run_test "Version check: cli min 1.1, srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1182 | "$P_SRV max_version=tls1_1" \ |
| 1183 | "$P_CLI min_version=tls1_1" \ |
| 1184 | 0 \ |
| 1185 | -S "ssl_handshake returned" \ |
| 1186 | -C "ssl_handshake returned" \ |
| 1187 | -s "Protocol is TLSv1.1" \ |
| 1188 | -c "Protocol is TLSv1.1" |
| 1189 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1190 | run_test "Version check: cli min 1.2, srv max 1.1 -> fail" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1191 | "$P_SRV max_version=tls1_1" \ |
| 1192 | "$P_CLI min_version=tls1_2" \ |
| 1193 | 1 \ |
| 1194 | -s "ssl_handshake returned" \ |
| 1195 | -c "ssl_handshake returned" \ |
| 1196 | -c "SSL - Handshake protocol not within min/max boundaries" |
| 1197 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1198 | run_test "Version check: srv min 1.2, cli max 1.1 -> fail" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1199 | "$P_SRV min_version=tls1_2" \ |
| 1200 | "$P_CLI max_version=tls1_1" \ |
| 1201 | 1 \ |
| 1202 | -s "ssl_handshake returned" \ |
| 1203 | -c "ssl_handshake returned" \ |
| 1204 | -s "SSL - Handshake protocol not within min/max boundaries" |
| 1205 | |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1206 | # Tests for ALPN extension |
| 1207 | |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 1208 | if grep '^#define POLARSSL_SSL_ALPN' $CONFIG_H >/dev/null; then |
| 1209 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1210 | run_test "ALPN: none" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1211 | "$P_SRV debug_level=3" \ |
| 1212 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1213 | 0 \ |
| 1214 | -C "client hello, adding alpn extension" \ |
| 1215 | -S "found alpn extension" \ |
| 1216 | -C "got an alert message, type: \\[2:120]" \ |
| 1217 | -S "server hello, adding alpn extension" \ |
| 1218 | -C "found alpn extension " \ |
| 1219 | -C "Application Layer Protocol is" \ |
| 1220 | -S "Application Layer Protocol is" |
| 1221 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1222 | run_test "ALPN: client only" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1223 | "$P_SRV debug_level=3" \ |
| 1224 | "$P_CLI debug_level=3 alpn=abc,1234" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1225 | 0 \ |
| 1226 | -c "client hello, adding alpn extension" \ |
| 1227 | -s "found alpn extension" \ |
| 1228 | -C "got an alert message, type: \\[2:120]" \ |
| 1229 | -S "server hello, adding alpn extension" \ |
| 1230 | -C "found alpn extension " \ |
| 1231 | -c "Application Layer Protocol is (none)" \ |
| 1232 | -S "Application Layer Protocol is" |
| 1233 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1234 | run_test "ALPN: server only" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1235 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 1236 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1237 | 0 \ |
| 1238 | -C "client hello, adding alpn extension" \ |
| 1239 | -S "found alpn extension" \ |
| 1240 | -C "got an alert message, type: \\[2:120]" \ |
| 1241 | -S "server hello, adding alpn extension" \ |
| 1242 | -C "found alpn extension " \ |
| 1243 | -C "Application Layer Protocol is" \ |
| 1244 | -s "Application Layer Protocol is (none)" |
| 1245 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1246 | run_test "ALPN: both, common cli1-srv1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1247 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 1248 | "$P_CLI debug_level=3 alpn=abc,1234" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1249 | 0 \ |
| 1250 | -c "client hello, adding alpn extension" \ |
| 1251 | -s "found alpn extension" \ |
| 1252 | -C "got an alert message, type: \\[2:120]" \ |
| 1253 | -s "server hello, adding alpn extension" \ |
| 1254 | -c "found alpn extension" \ |
| 1255 | -c "Application Layer Protocol is abc" \ |
| 1256 | -s "Application Layer Protocol is abc" |
| 1257 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1258 | run_test "ALPN: both, common cli2-srv1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1259 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 1260 | "$P_CLI debug_level=3 alpn=1234,abc" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1261 | 0 \ |
| 1262 | -c "client hello, adding alpn extension" \ |
| 1263 | -s "found alpn extension" \ |
| 1264 | -C "got an alert message, type: \\[2:120]" \ |
| 1265 | -s "server hello, adding alpn extension" \ |
| 1266 | -c "found alpn extension" \ |
| 1267 | -c "Application Layer Protocol is abc" \ |
| 1268 | -s "Application Layer Protocol is abc" |
| 1269 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1270 | run_test "ALPN: both, common cli1-srv2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1271 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 1272 | "$P_CLI debug_level=3 alpn=1234,abcde" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1273 | 0 \ |
| 1274 | -c "client hello, adding alpn extension" \ |
| 1275 | -s "found alpn extension" \ |
| 1276 | -C "got an alert message, type: \\[2:120]" \ |
| 1277 | -s "server hello, adding alpn extension" \ |
| 1278 | -c "found alpn extension" \ |
| 1279 | -c "Application Layer Protocol is 1234" \ |
| 1280 | -s "Application Layer Protocol is 1234" |
| 1281 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1282 | run_test "ALPN: both, no common" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1283 | "$P_SRV debug_level=3 alpn=abc,123" \ |
| 1284 | "$P_CLI debug_level=3 alpn=1234,abcde" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1285 | 1 \ |
| 1286 | -c "client hello, adding alpn extension" \ |
| 1287 | -s "found alpn extension" \ |
| 1288 | -c "got an alert message, type: \\[2:120]" \ |
| 1289 | -S "server hello, adding alpn extension" \ |
| 1290 | -C "found alpn extension" \ |
| 1291 | -C "Application Layer Protocol is 1234" \ |
| 1292 | -S "Application Layer Protocol is 1234" |
| 1293 | |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 1294 | fi |
| 1295 | |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1296 | # Tests for keyUsage in leaf certificates, part 1: |
| 1297 | # server-side certificate/suite selection |
| 1298 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1299 | run_test "keyUsage srv: RSA, digitalSignature -> (EC)DHE-RSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1300 | "$P_SRV key_file=data_files/server2.key \ |
| 1301 | crt_file=data_files/server2.ku-ds.crt" \ |
| 1302 | "$P_CLI" \ |
| 1303 | 0 \ |
Manuel Pégourié-Gonnard | 17cde5f | 2014-05-22 14:42:39 +0200 | [diff] [blame] | 1304 | -c "Ciphersuite is TLS-[EC]*DHE-RSA-WITH-" |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1305 | |
| 1306 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1307 | run_test "keyUsage srv: RSA, keyEncipherment -> RSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1308 | "$P_SRV key_file=data_files/server2.key \ |
| 1309 | crt_file=data_files/server2.ku-ke.crt" \ |
| 1310 | "$P_CLI" \ |
| 1311 | 0 \ |
| 1312 | -c "Ciphersuite is TLS-RSA-WITH-" |
| 1313 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1314 | run_test "keyUsage srv: RSA, keyAgreement -> fail" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 1315 | "$P_SRV key_file=data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1316 | crt_file=data_files/server2.ku-ka.crt" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 1317 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1318 | 1 \ |
| 1319 | -C "Ciphersuite is " |
| 1320 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1321 | run_test "keyUsage srv: ECDSA, digitalSignature -> ECDHE-ECDSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1322 | "$P_SRV key_file=data_files/server5.key \ |
| 1323 | crt_file=data_files/server5.ku-ds.crt" \ |
| 1324 | "$P_CLI" \ |
| 1325 | 0 \ |
| 1326 | -c "Ciphersuite is TLS-ECDHE-ECDSA-WITH-" |
| 1327 | |
| 1328 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1329 | run_test "keyUsage srv: ECDSA, keyAgreement -> ECDH-" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1330 | "$P_SRV key_file=data_files/server5.key \ |
| 1331 | crt_file=data_files/server5.ku-ka.crt" \ |
| 1332 | "$P_CLI" \ |
| 1333 | 0 \ |
| 1334 | -c "Ciphersuite is TLS-ECDH-" |
| 1335 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1336 | run_test "keyUsage srv: ECDSA, keyEncipherment -> fail" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 1337 | "$P_SRV key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1338 | crt_file=data_files/server5.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 1339 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1340 | 1 \ |
| 1341 | -C "Ciphersuite is " |
| 1342 | |
| 1343 | # Tests for keyUsage in leaf certificates, part 2: |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1344 | # client-side checking of server cert |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1345 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1346 | run_test "keyUsage cli: DigitalSignature+KeyEncipherment, RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1347 | "$O_SRV -key data_files/server2.key \ |
| 1348 | -cert data_files/server2.ku-ds_ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1349 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1350 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 1351 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1352 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1353 | -C "Processing of the Certificate handshake message failed" \ |
| 1354 | -c "Ciphersuite is TLS-" |
| 1355 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1356 | run_test "keyUsage cli: DigitalSignature+KeyEncipherment, DHE-RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1357 | "$O_SRV -key data_files/server2.key \ |
| 1358 | -cert data_files/server2.ku-ds_ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1359 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1360 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 1361 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1362 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1363 | -C "Processing of the Certificate handshake message failed" \ |
| 1364 | -c "Ciphersuite is TLS-" |
| 1365 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1366 | run_test "keyUsage cli: KeyEncipherment, RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1367 | "$O_SRV -key data_files/server2.key \ |
| 1368 | -cert data_files/server2.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1369 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1370 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 1371 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1372 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1373 | -C "Processing of the Certificate handshake message failed" \ |
| 1374 | -c "Ciphersuite is TLS-" |
| 1375 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1376 | run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1377 | "$O_SRV -key data_files/server2.key \ |
| 1378 | -cert data_files/server2.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1379 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1380 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 1381 | 1 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1382 | -c "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1383 | -c "Processing of the Certificate handshake message failed" \ |
| 1384 | -C "Ciphersuite is TLS-" |
| 1385 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1386 | run_test "keyUsage cli: DigitalSignature, DHE-RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1387 | "$O_SRV -key data_files/server2.key \ |
| 1388 | -cert data_files/server2.ku-ds.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1389 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1390 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 1391 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1392 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1393 | -C "Processing of the Certificate handshake message failed" \ |
| 1394 | -c "Ciphersuite is TLS-" |
| 1395 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1396 | run_test "keyUsage cli: DigitalSignature, RSA: fail" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1397 | "$O_SRV -key data_files/server2.key \ |
| 1398 | -cert data_files/server2.ku-ds.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1399 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1400 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 1401 | 1 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1402 | -c "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1403 | -c "Processing of the Certificate handshake message failed" \ |
| 1404 | -C "Ciphersuite is TLS-" |
| 1405 | |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1406 | # Tests for keyUsage in leaf certificates, part 3: |
| 1407 | # server-side checking of client cert |
| 1408 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1409 | run_test "keyUsage cli-auth: RSA, DigitalSignature: OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1410 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1411 | "$O_CLI -key data_files/server2.key \ |
| 1412 | -cert data_files/server2.ku-ds.crt" \ |
| 1413 | 0 \ |
| 1414 | -S "bad certificate (usage extensions)" \ |
| 1415 | -S "Processing of the Certificate handshake message failed" |
| 1416 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1417 | run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1418 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1419 | "$O_CLI -key data_files/server2.key \ |
| 1420 | -cert data_files/server2.ku-ke.crt" \ |
| 1421 | 0 \ |
| 1422 | -s "bad certificate (usage extensions)" \ |
| 1423 | -S "Processing of the Certificate handshake message failed" |
| 1424 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1425 | run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (hard)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1426 | "$P_SRV debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1427 | "$O_CLI -key data_files/server2.key \ |
| 1428 | -cert data_files/server2.ku-ke.crt" \ |
| 1429 | 1 \ |
| 1430 | -s "bad certificate (usage extensions)" \ |
| 1431 | -s "Processing of the Certificate handshake message failed" |
| 1432 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1433 | run_test "keyUsage cli-auth: ECDSA, DigitalSignature: OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1434 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1435 | "$O_CLI -key data_files/server5.key \ |
| 1436 | -cert data_files/server5.ku-ds.crt" \ |
| 1437 | 0 \ |
| 1438 | -S "bad certificate (usage extensions)" \ |
| 1439 | -S "Processing of the Certificate handshake message failed" |
| 1440 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1441 | run_test "keyUsage cli-auth: ECDSA, KeyAgreement: fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1442 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1443 | "$O_CLI -key data_files/server5.key \ |
| 1444 | -cert data_files/server5.ku-ka.crt" \ |
| 1445 | 0 \ |
| 1446 | -s "bad certificate (usage extensions)" \ |
| 1447 | -S "Processing of the Certificate handshake message failed" |
| 1448 | |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1449 | # Tests for extendedKeyUsage, part 1: server-side certificate/suite selection |
| 1450 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1451 | run_test "extKeyUsage srv: serverAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1452 | "$P_SRV key_file=data_files/server5.key \ |
| 1453 | crt_file=data_files/server5.eku-srv.crt" \ |
| 1454 | "$P_CLI" \ |
| 1455 | 0 |
| 1456 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1457 | run_test "extKeyUsage srv: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1458 | "$P_SRV key_file=data_files/server5.key \ |
| 1459 | crt_file=data_files/server5.eku-srv.crt" \ |
| 1460 | "$P_CLI" \ |
| 1461 | 0 |
| 1462 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1463 | run_test "extKeyUsage srv: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1464 | "$P_SRV key_file=data_files/server5.key \ |
| 1465 | crt_file=data_files/server5.eku-cs_any.crt" \ |
| 1466 | "$P_CLI" \ |
| 1467 | 0 |
| 1468 | |
| 1469 | # add psk to leave an option for client to send SERVERQUIT |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1470 | run_test "extKeyUsage srv: codeSign -> fail" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1471 | "$P_SRV psk=abc123 key_file=data_files/server5.key \ |
| 1472 | crt_file=data_files/server5.eku-cli.crt" \ |
| 1473 | "$P_CLI psk=badbad" \ |
| 1474 | 1 |
| 1475 | |
| 1476 | # Tests for extendedKeyUsage, part 2: client-side checking of server cert |
| 1477 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1478 | run_test "extKeyUsage cli: serverAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1479 | "$O_SRV -key data_files/server5.key \ |
| 1480 | -cert data_files/server5.eku-srv.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1481 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1482 | 0 \ |
| 1483 | -C "bad certificate (usage extensions)" \ |
| 1484 | -C "Processing of the Certificate handshake message failed" \ |
| 1485 | -c "Ciphersuite is TLS-" |
| 1486 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1487 | run_test "extKeyUsage cli: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1488 | "$O_SRV -key data_files/server5.key \ |
| 1489 | -cert data_files/server5.eku-srv_cli.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1490 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1491 | 0 \ |
| 1492 | -C "bad certificate (usage extensions)" \ |
| 1493 | -C "Processing of the Certificate handshake message failed" \ |
| 1494 | -c "Ciphersuite is TLS-" |
| 1495 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1496 | run_test "extKeyUsage cli: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1497 | "$O_SRV -key data_files/server5.key \ |
| 1498 | -cert data_files/server5.eku-cs_any.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1499 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1500 | 0 \ |
| 1501 | -C "bad certificate (usage extensions)" \ |
| 1502 | -C "Processing of the Certificate handshake message failed" \ |
| 1503 | -c "Ciphersuite is TLS-" |
| 1504 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1505 | run_test "extKeyUsage cli: codeSign -> fail" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1506 | "$O_SRV -key data_files/server5.key \ |
| 1507 | -cert data_files/server5.eku-cs.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1508 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1509 | 1 \ |
| 1510 | -c "bad certificate (usage extensions)" \ |
| 1511 | -c "Processing of the Certificate handshake message failed" \ |
| 1512 | -C "Ciphersuite is TLS-" |
| 1513 | |
| 1514 | # Tests for extendedKeyUsage, part 3: server-side checking of client cert |
| 1515 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1516 | run_test "extKeyUsage cli-auth: clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1517 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1518 | "$O_CLI -key data_files/server5.key \ |
| 1519 | -cert data_files/server5.eku-cli.crt" \ |
| 1520 | 0 \ |
| 1521 | -S "bad certificate (usage extensions)" \ |
| 1522 | -S "Processing of the Certificate handshake message failed" |
| 1523 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1524 | run_test "extKeyUsage cli-auth: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1525 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1526 | "$O_CLI -key data_files/server5.key \ |
| 1527 | -cert data_files/server5.eku-srv_cli.crt" \ |
| 1528 | 0 \ |
| 1529 | -S "bad certificate (usage extensions)" \ |
| 1530 | -S "Processing of the Certificate handshake message failed" |
| 1531 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1532 | run_test "extKeyUsage cli-auth: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1533 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1534 | "$O_CLI -key data_files/server5.key \ |
| 1535 | -cert data_files/server5.eku-cs_any.crt" \ |
| 1536 | 0 \ |
| 1537 | -S "bad certificate (usage extensions)" \ |
| 1538 | -S "Processing of the Certificate handshake message failed" |
| 1539 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1540 | run_test "extKeyUsage cli-auth: codeSign -> fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1541 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1542 | "$O_CLI -key data_files/server5.key \ |
| 1543 | -cert data_files/server5.eku-cs.crt" \ |
| 1544 | 0 \ |
| 1545 | -s "bad certificate (usage extensions)" \ |
| 1546 | -S "Processing of the Certificate handshake message failed" |
| 1547 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1548 | run_test "extKeyUsage cli-auth: codeSign -> fail (hard)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1549 | "$P_SRV debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1550 | "$O_CLI -key data_files/server5.key \ |
| 1551 | -cert data_files/server5.eku-cs.crt" \ |
| 1552 | 1 \ |
| 1553 | -s "bad certificate (usage extensions)" \ |
| 1554 | -s "Processing of the Certificate handshake message failed" |
| 1555 | |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 1556 | # Tests for DHM parameters loading |
| 1557 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1558 | run_test "DHM parameters: reference" \ |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 1559 | "$P_SRV" \ |
| 1560 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 1561 | debug_level=3" \ |
| 1562 | 0 \ |
| 1563 | -c "value of 'DHM: P ' (2048 bits)" \ |
| 1564 | -c "value of 'DHM: G ' (2048 bits)" |
| 1565 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1566 | run_test "DHM parameters: other parameters" \ |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 1567 | "$P_SRV dhm_file=data_files/dhparams.pem" \ |
| 1568 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 1569 | debug_level=3" \ |
| 1570 | 0 \ |
| 1571 | -c "value of 'DHM: P ' (1024 bits)" \ |
| 1572 | -c "value of 'DHM: G ' (2 bits)" |
| 1573 | |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1574 | # Tests for PSK callback |
| 1575 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1576 | run_test "PSK callback: psk, no callback" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1577 | "$P_SRV psk=abc123 psk_identity=foo" \ |
| 1578 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1579 | psk_identity=foo psk=abc123" \ |
| 1580 | 0 \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1581 | -S "SSL - The server has no ciphersuites in common" \ |
| 1582 | -S "SSL - Unknown identity received" \ |
| 1583 | -S "SSL - Verification of the message MAC failed" |
| 1584 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1585 | run_test "PSK callback: no psk, no callback" \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1586 | "$P_SRV" \ |
| 1587 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1588 | psk_identity=foo psk=abc123" \ |
| 1589 | 1 \ |
| 1590 | -s "SSL - The server has no ciphersuites in common" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1591 | -S "SSL - Unknown identity received" \ |
| 1592 | -S "SSL - Verification of the message MAC failed" |
| 1593 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1594 | run_test "PSK callback: callback overrides other settings" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1595 | "$P_SRV psk=abc123 psk_identity=foo psk_list=abc,dead,def,beef" \ |
| 1596 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1597 | psk_identity=foo psk=abc123" \ |
| 1598 | 1 \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1599 | -S "SSL - The server has no ciphersuites in common" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1600 | -s "SSL - Unknown identity received" \ |
| 1601 | -S "SSL - Verification of the message MAC failed" |
| 1602 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1603 | run_test "PSK callback: first id matches" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1604 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 1605 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1606 | psk_identity=abc psk=dead" \ |
| 1607 | 0 \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1608 | -S "SSL - The server has no ciphersuites in common" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1609 | -S "SSL - Unknown identity received" \ |
| 1610 | -S "SSL - Verification of the message MAC failed" |
| 1611 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1612 | run_test "PSK callback: second id matches" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1613 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 1614 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1615 | psk_identity=def psk=beef" \ |
| 1616 | 0 \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1617 | -S "SSL - The server has no ciphersuites in common" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1618 | -S "SSL - Unknown identity received" \ |
| 1619 | -S "SSL - Verification of the message MAC failed" |
| 1620 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1621 | run_test "PSK callback: no match" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1622 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 1623 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1624 | psk_identity=ghi psk=beef" \ |
| 1625 | 1 \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1626 | -S "SSL - The server has no ciphersuites in common" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1627 | -s "SSL - Unknown identity received" \ |
| 1628 | -S "SSL - Verification of the message MAC failed" |
| 1629 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1630 | run_test "PSK callback: wrong key" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1631 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 1632 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1633 | psk_identity=abc psk=beef" \ |
| 1634 | 1 \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1635 | -S "SSL - The server has no ciphersuites in common" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1636 | -S "SSL - Unknown identity received" \ |
| 1637 | -s "SSL - Verification of the message MAC failed" |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 1638 | |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 1639 | # Tests for ciphersuites per version |
| 1640 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1641 | run_test "Per-version suites: SSL3" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 1642 | "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 1643 | "$P_CLI force_version=ssl3" \ |
| 1644 | 0 \ |
| 1645 | -c "Ciphersuite is TLS-RSA-WITH-3DES-EDE-CBC-SHA" |
| 1646 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1647 | run_test "Per-version suites: TLS 1.0" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 1648 | "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 1649 | "$P_CLI force_version=tls1" \ |
| 1650 | 0 \ |
| 1651 | -c "Ciphersuite is TLS-RSA-WITH-RC4-128-SHA" |
| 1652 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1653 | run_test "Per-version suites: TLS 1.1" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 1654 | "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 1655 | "$P_CLI force_version=tls1_1" \ |
| 1656 | 0 \ |
| 1657 | -c "Ciphersuite is TLS-RSA-WITH-AES-128-CBC-SHA" |
| 1658 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1659 | run_test "Per-version suites: TLS 1.2" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 1660 | "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 1661 | "$P_CLI force_version=tls1_2" \ |
| 1662 | 0 \ |
| 1663 | -c "Ciphersuite is TLS-RSA-WITH-AES-128-GCM-SHA256" |
| 1664 | |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 1665 | # Tests for ssl_get_bytes_avail() |
| 1666 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1667 | run_test "ssl_get_bytes_avail: no extra data" \ |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 1668 | "$P_SRV" \ |
| 1669 | "$P_CLI request_size=100" \ |
| 1670 | 0 \ |
| 1671 | -s "Read from client: 100 bytes read$" |
| 1672 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1673 | run_test "ssl_get_bytes_avail: extra data" \ |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 1674 | "$P_SRV" \ |
| 1675 | "$P_CLI request_size=500" \ |
| 1676 | 0 \ |
| 1677 | -s "Read from client: 500 bytes read (.*+.*)" |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 1678 | |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 1679 | # Tests for small packets |
| 1680 | |
| 1681 | run_test "Small packet SSLv3 BlockCipher" \ |
| 1682 | "$P_SRV" \ |
| 1683 | "$P_CLI request_size=1 force_version=ssl3 \ |
| 1684 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1685 | 0 \ |
| 1686 | -s "Read from client: 1 bytes read" |
| 1687 | |
| 1688 | run_test "Small packet SSLv3 StreamCipher" \ |
| 1689 | "$P_SRV" \ |
| 1690 | "$P_CLI request_size=1 force_version=ssl3 \ |
| 1691 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 1692 | 0 \ |
| 1693 | -s "Read from client: 1 bytes read" |
| 1694 | |
| 1695 | run_test "Small packet TLS 1.0 BlockCipher" \ |
| 1696 | "$P_SRV" \ |
| 1697 | "$P_CLI request_size=1 force_version=tls1 \ |
| 1698 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1699 | 0 \ |
| 1700 | -s "Read from client: 1 bytes read" |
| 1701 | |
| 1702 | run_test "Small packet TLS 1.0 BlockCipher truncated MAC" \ |
| 1703 | "$P_SRV" \ |
| 1704 | "$P_CLI request_size=1 force_version=tls1 \ |
| 1705 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 1706 | trunc_hmac=1" \ |
| 1707 | 0 \ |
| 1708 | -s "Read from client: 1 bytes read" |
| 1709 | |
| 1710 | run_test "Small packet TLS 1.0 StreamCipher truncated MAC" \ |
| 1711 | "$P_SRV" \ |
| 1712 | "$P_CLI request_size=1 force_version=tls1 \ |
| 1713 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 1714 | trunc_hmac=1" \ |
| 1715 | 0 \ |
| 1716 | -s "Read from client: 1 bytes read" |
| 1717 | |
| 1718 | run_test "Small packet TLS 1.1 BlockCipher" \ |
| 1719 | "$P_SRV" \ |
| 1720 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 1721 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1722 | 0 \ |
| 1723 | -s "Read from client: 1 bytes read" |
| 1724 | |
| 1725 | run_test "Small packet TLS 1.1 StreamCipher" \ |
| 1726 | "$P_SRV" \ |
| 1727 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 1728 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 1729 | 0 \ |
| 1730 | -s "Read from client: 1 bytes read" |
| 1731 | |
| 1732 | run_test "Small packet TLS 1.1 BlockCipher truncated MAC" \ |
| 1733 | "$P_SRV" \ |
| 1734 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 1735 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 1736 | trunc_hmac=1" \ |
| 1737 | 0 \ |
| 1738 | -s "Read from client: 1 bytes read" |
| 1739 | |
| 1740 | run_test "Small packet TLS 1.1 StreamCipher truncated MAC" \ |
| 1741 | "$P_SRV" \ |
| 1742 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 1743 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 1744 | trunc_hmac=1" \ |
| 1745 | 0 \ |
| 1746 | -s "Read from client: 1 bytes read" |
| 1747 | |
| 1748 | run_test "Small packet TLS 1.2 BlockCipher" \ |
| 1749 | "$P_SRV" \ |
| 1750 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 1751 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1752 | 0 \ |
| 1753 | -s "Read from client: 1 bytes read" |
| 1754 | |
| 1755 | run_test "Small packet TLS 1.2 BlockCipher larger MAC" \ |
| 1756 | "$P_SRV" \ |
| 1757 | "$P_CLI request_size=1 force_version=tls1_2 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
| 1758 | 0 \ |
| 1759 | -s "Read from client: 1 bytes read" |
| 1760 | |
| 1761 | run_test "Small packet TLS 1.2 BlockCipher truncated MAC" \ |
| 1762 | "$P_SRV" \ |
| 1763 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 1764 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 1765 | trunc_hmac=1" \ |
| 1766 | 0 \ |
| 1767 | -s "Read from client: 1 bytes read" |
| 1768 | |
| 1769 | run_test "Small packet TLS 1.2 StreamCipher" \ |
| 1770 | "$P_SRV" \ |
| 1771 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 1772 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 1773 | 0 \ |
| 1774 | -s "Read from client: 1 bytes read" |
| 1775 | |
| 1776 | run_test "Small packet TLS 1.2 StreamCipher truncated MAC" \ |
| 1777 | "$P_SRV" \ |
| 1778 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 1779 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 1780 | trunc_hmac=1" \ |
| 1781 | 0 \ |
| 1782 | -s "Read from client: 1 bytes read" |
| 1783 | |
| 1784 | run_test "Small packet TLS 1.2 AEAD" \ |
| 1785 | "$P_SRV" \ |
| 1786 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 1787 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 1788 | 0 \ |
| 1789 | -s "Read from client: 1 bytes read" |
| 1790 | |
| 1791 | run_test "Small packet TLS 1.2 AEAD shorter tag" \ |
| 1792 | "$P_SRV" \ |
| 1793 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 1794 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 1795 | 0 \ |
| 1796 | -s "Read from client: 1 bytes read" |
| 1797 | |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 1798 | # Test for large packets |
| 1799 | |
| 1800 | run_test "Large packet SSLv3 BlockCipher" \ |
| 1801 | "$P_SRV" \ |
| 1802 | "$P_CLI request_size=16384 force_version=ssl3 \ |
| 1803 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1804 | 0 \ |
| 1805 | -s "Read from client: 16384 bytes read" |
| 1806 | |
| 1807 | run_test "Large packet SSLv3 StreamCipher" \ |
| 1808 | "$P_SRV" \ |
| 1809 | "$P_CLI request_size=16384 force_version=ssl3 \ |
| 1810 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 1811 | 0 \ |
| 1812 | -s "Read from client: 16384 bytes read" |
| 1813 | |
| 1814 | run_test "Large packet TLS 1.0 BlockCipher" \ |
| 1815 | "$P_SRV" \ |
| 1816 | "$P_CLI request_size=16384 force_version=tls1 \ |
| 1817 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1818 | 0 \ |
| 1819 | -s "Read from client: 16384 bytes read" |
| 1820 | |
| 1821 | run_test "Large packet TLS 1.0 BlockCipher truncated MAC" \ |
| 1822 | "$P_SRV" \ |
| 1823 | "$P_CLI request_size=16384 force_version=tls1 \ |
| 1824 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 1825 | trunc_hmac=1" \ |
| 1826 | 0 \ |
| 1827 | -s "Read from client: 16384 bytes read" |
| 1828 | |
| 1829 | run_test "Large packet TLS 1.0 StreamCipher truncated MAC" \ |
| 1830 | "$P_SRV" \ |
| 1831 | "$P_CLI request_size=16384 force_version=tls1 \ |
| 1832 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 1833 | trunc_hmac=1" \ |
| 1834 | 0 \ |
| 1835 | -s "Read from client: 16384 bytes read" |
| 1836 | |
| 1837 | run_test "Large packet TLS 1.1 BlockCipher" \ |
| 1838 | "$P_SRV" \ |
| 1839 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 1840 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1841 | 0 \ |
| 1842 | -s "Read from client: 16384 bytes read" |
| 1843 | |
| 1844 | run_test "Large packet TLS 1.1 StreamCipher" \ |
| 1845 | "$P_SRV" \ |
| 1846 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 1847 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 1848 | 0 \ |
| 1849 | -s "Read from client: 16384 bytes read" |
| 1850 | |
| 1851 | run_test "Large packet TLS 1.1 BlockCipher truncated MAC" \ |
| 1852 | "$P_SRV" \ |
| 1853 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 1854 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 1855 | trunc_hmac=1" \ |
| 1856 | 0 \ |
| 1857 | -s "Read from client: 16384 bytes read" |
| 1858 | |
| 1859 | run_test "Large packet TLS 1.1 StreamCipher truncated MAC" \ |
| 1860 | "$P_SRV" \ |
| 1861 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 1862 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 1863 | trunc_hmac=1" \ |
| 1864 | 0 \ |
| 1865 | -s "Read from client: 16384 bytes read" |
| 1866 | |
| 1867 | run_test "Large packet TLS 1.2 BlockCipher" \ |
| 1868 | "$P_SRV" \ |
| 1869 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 1870 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1871 | 0 \ |
| 1872 | -s "Read from client: 16384 bytes read" |
| 1873 | |
| 1874 | run_test "Large packet TLS 1.2 BlockCipher larger MAC" \ |
| 1875 | "$P_SRV" \ |
| 1876 | "$P_CLI request_size=16384 force_version=tls1_2 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
| 1877 | 0 \ |
| 1878 | -s "Read from client: 16384 bytes read" |
| 1879 | |
| 1880 | run_test "Large packet TLS 1.2 BlockCipher truncated MAC" \ |
| 1881 | "$P_SRV" \ |
| 1882 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 1883 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 1884 | trunc_hmac=1" \ |
| 1885 | 0 \ |
| 1886 | -s "Read from client: 16384 bytes read" |
| 1887 | |
| 1888 | run_test "Large packet TLS 1.2 StreamCipher" \ |
| 1889 | "$P_SRV" \ |
| 1890 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 1891 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 1892 | 0 \ |
| 1893 | -s "Read from client: 16384 bytes read" |
| 1894 | |
| 1895 | run_test "Large packet TLS 1.2 StreamCipher truncated MAC" \ |
| 1896 | "$P_SRV" \ |
| 1897 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 1898 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 1899 | trunc_hmac=1" \ |
| 1900 | 0 \ |
| 1901 | -s "Read from client: 16384 bytes read" |
| 1902 | |
| 1903 | run_test "Large packet TLS 1.2 AEAD" \ |
| 1904 | "$P_SRV" \ |
| 1905 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 1906 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 1907 | 0 \ |
| 1908 | -s "Read from client: 16384 bytes read" |
| 1909 | |
| 1910 | run_test "Large packet TLS 1.2 AEAD shorter tag" \ |
| 1911 | "$P_SRV" \ |
| 1912 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 1913 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 1914 | 0 \ |
| 1915 | -s "Read from client: 16384 bytes read" |
| 1916 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1917 | # Tests for DTLS HelloVerifyRequest |
| 1918 | |
| 1919 | run_test "DTLS cookie: enabled" \ |
| 1920 | "$P_SRV dtls=1 debug_level=2" \ |
| 1921 | "$P_CLI dtls=1 debug_level=2" \ |
| 1922 | 0 \ |
| 1923 | -s "cookie verification failed" \ |
| 1924 | -s "cookie verification passed" \ |
| 1925 | -S "cookie verification skipped" \ |
| 1926 | -c "received hello verify request" \ |
| 1927 | -S "SSL - The requested feature is not available" |
| 1928 | |
| 1929 | run_test "DTLS cookie: disabled" \ |
| 1930 | "$P_SRV dtls=1 debug_level=2 cookies=0" \ |
| 1931 | "$P_CLI dtls=1 debug_level=2" \ |
| 1932 | 0 \ |
| 1933 | -S "cookie verification failed" \ |
| 1934 | -S "cookie verification passed" \ |
| 1935 | -s "cookie verification skipped" \ |
| 1936 | -C "received hello verify request" \ |
| 1937 | -S "SSL - The requested feature is not available" |
| 1938 | |
| 1939 | # wait for client having a timeout, or server sending an alert |
| 1940 | #run_test "DTLS cookie: default (failing)" \ |
| 1941 | # "$P_SRV dtls=1 debug_level=2 cookies=-1" \ |
| 1942 | # "$P_CLI dtls=1 debug_level=2" \ |
| 1943 | # 0 \ |
| 1944 | # -S "cookie verification failed" \ |
| 1945 | # -S "cookie verification passed" \ |
| 1946 | # -S "cookie verification skipped" \ |
| 1947 | # -C "received hello verify request" \ |
| 1948 | # -s "SSL - The requested feature is not available" |
| 1949 | |
| 1950 | requires_ipv6 |
| 1951 | run_test "DTLS cookie: enabled, IPv6" \ |
| 1952 | "$P_SRV dtls=1 debug_level=2 server_addr=::1" \ |
| 1953 | "$P_CLI dtls=1 debug_level=2 server_addr=::1" \ |
| 1954 | 0 \ |
| 1955 | -s "cookie verification failed" \ |
| 1956 | -s "cookie verification passed" \ |
| 1957 | -S "cookie verification skipped" \ |
| 1958 | -c "received hello verify request" \ |
| 1959 | -S "SSL - The requested feature is not available" |
| 1960 | |
Manuel Pégourié-Gonnard | 502bf30 | 2014-08-20 13:12:58 +0200 | [diff] [blame] | 1961 | # Tests for receiving fragmented handshake messages with DTLS |
| 1962 | |
| 1963 | requires_gnutls |
| 1964 | run_test "DTLS reassembly: no fragmentation (gnutls server)" \ |
| 1965 | "$G_SRV -u --mtu 2048 -a" \ |
| 1966 | "$P_CLI dtls=1 debug_level=2" \ |
| 1967 | 0 \ |
| 1968 | -C "found fragmented DTLS handshake message" \ |
| 1969 | -C "error" |
| 1970 | |
| 1971 | requires_gnutls |
| 1972 | run_test "DTLS reassembly: some fragmentation (gnutls server)" \ |
| 1973 | "$G_SRV -u --mtu 512" \ |
| 1974 | "$P_CLI dtls=1 debug_level=2" \ |
| 1975 | 0 \ |
| 1976 | -c "found fragmented DTLS handshake message" \ |
| 1977 | -C "error" |
| 1978 | |
| 1979 | requires_gnutls |
| 1980 | run_test "DTLS reassembly: more fragmentation (gnutls server)" \ |
| 1981 | "$G_SRV -u --mtu 128" \ |
| 1982 | "$P_CLI dtls=1 debug_level=2" \ |
| 1983 | 0 \ |
| 1984 | -c "found fragmented DTLS handshake message" \ |
| 1985 | -C "error" |
| 1986 | |
| 1987 | requires_gnutls |
| 1988 | run_test "DTLS reassembly: more fragmentation, nbio (gnutls server)" \ |
| 1989 | "$G_SRV -u --mtu 128" \ |
| 1990 | "$P_CLI dtls=1 nbio=2 debug_level=2" \ |
| 1991 | 0 \ |
| 1992 | -c "found fragmented DTLS handshake message" \ |
| 1993 | -C "error" |
| 1994 | |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 1995 | requires_gnutls |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 1996 | run_test "DTLS reassembly: fragmentation, renego (gnutls server)" \ |
| 1997 | "$G_SRV -u --mtu 256" \ |
| 1998 | "$P_CLI debug_level=3 dtls=1 renegotiation=1 renegotiate=1" \ |
| 1999 | 0 \ |
| 2000 | -c "found fragmented DTLS handshake message" \ |
| 2001 | -c "client hello, adding renegotiation extension" \ |
| 2002 | -c "found renegotiation extension" \ |
| 2003 | -c "=> renegotiate" \ |
| 2004 | -C "ssl_handshake returned" \ |
| 2005 | -C "error" \ |
| 2006 | -s "Extra-header:" |
| 2007 | |
| 2008 | requires_gnutls |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 2009 | run_test "DTLS reassembly: fragmentation, nbio, renego (gnutls server)" \ |
| 2010 | "$G_SRV -u --mtu 256" \ |
| 2011 | "$P_CLI debug_level=3 nbio=2 dtls=1 renegotiation=1 renegotiate=1" \ |
| 2012 | 0 \ |
| 2013 | -c "found fragmented DTLS handshake message" \ |
| 2014 | -c "client hello, adding renegotiation extension" \ |
| 2015 | -c "found renegotiation extension" \ |
| 2016 | -c "=> renegotiate" \ |
| 2017 | -C "ssl_handshake returned" \ |
| 2018 | -C "error" \ |
| 2019 | -s "Extra-header:" |
| 2020 | |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 2021 | run_test "DTLS reassembly: no fragmentation (openssl server)" \ |
| 2022 | "$O_SRV -dtls1 -mtu 2048" \ |
| 2023 | "$P_CLI dtls=1 debug_level=2" \ |
| 2024 | 0 \ |
| 2025 | -C "found fragmented DTLS handshake message" \ |
| 2026 | -C "error" |
| 2027 | |
Manuel Pégourié-Gonnard | 64dffc5 | 2014-09-02 13:39:16 +0200 | [diff] [blame] | 2028 | run_test "DTLS reassembly: fragmentation (openssl server)" \ |
| 2029 | "$O_SRV -dtls1 -mtu 256" \ |
| 2030 | "$P_CLI dtls=1 debug_level=2" \ |
| 2031 | 0 \ |
| 2032 | -c "found fragmented DTLS handshake message" \ |
| 2033 | -C "error" |
| 2034 | |
| 2035 | run_test "DTLS reassembly: fragmentation (openssl server)" \ |
| 2036 | "$O_SRV -dtls1 -mtu 256" \ |
| 2037 | "$P_CLI dtls=1 debug_level=2" \ |
| 2038 | 0 \ |
| 2039 | -c "found fragmented DTLS handshake message" \ |
| 2040 | -C "error" |
| 2041 | |
| 2042 | run_test "DTLS reassembly: fragmentation, nbio (openssl server)" \ |
| 2043 | "$O_SRV -dtls1 -mtu 256" \ |
| 2044 | "$P_CLI dtls=1 nbio=2 debug_level=2" \ |
| 2045 | 0 \ |
| 2046 | -c "found fragmented DTLS handshake message" \ |
| 2047 | -C "error" |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 2048 | |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 2049 | # Final report |
| 2050 | |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 2051 | echo "------------------------------------------------------------------------" |
| 2052 | |
| 2053 | if [ $FAILS = 0 ]; then |
| 2054 | echo -n "PASSED" |
| 2055 | else |
| 2056 | echo -n "FAILED" |
| 2057 | fi |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 2058 | PASSES=$(( $TESTS - $FAILS )) |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 2059 | echo " ($PASSES / $TESTS tests ($SKIPS skipped))" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 2060 | |
| 2061 | exit $FAILS |