Implement initial negotiation of EtM
Not implemented yet:
- actually using EtM
- conditions on renegotiation
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 38bc89b..6db8571 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -247,14 +247,14 @@
if is_polar "$SRV_CMD"; then
if grep "Performing the SSL/TLS handshake" $SRV_OUT >/dev/null; then :;
else
- fail "server failed to start"
+ fail "server or client failed to reach handshake stage"
return
fi
fi
if is_polar "$CLI_CMD"; then
if grep "Performing the SSL/TLS handshake" $CLI_OUT >/dev/null; then :;
else
- fail "client failed to start"
+ fail "server or client failed to reach handshake stage"
return
fi
fi
@@ -440,6 +440,63 @@
0 \
-s "dumping 'computed mac' (10 bytes)"
+# Tests for Encrypt-then-MAC extension
+
+run_test "Encrypt then MAC: default" \
+ "$P_SRV debug_level=3" \
+ "$P_CLI debug_level=3" \
+ 0 \
+ -c "client hello, adding encrypt_then_mac extension" \
+ -s "found encrypt then mac extension" \
+ -s "server hello, adding encrypt then mac extension" \
+ -c "found encrypt_then_mac extension" \
+ -c "using encrypt then mac" \
+ -s "using encrypt then mac"
+
+run_test "Encrypt then MAC: client enabled, server disabled" \
+ "$P_SRV debug_level=3 etm=0" \
+ "$P_CLI debug_level=3 etm=1" \
+ 0 \
+ -c "client hello, adding encrypt_then_mac extension" \
+ -s "found encrypt then mac extension" \
+ -S "server hello, adding encrypt then mac extension" \
+ -C "found encrypt_then_mac extension" \
+ -C "using encrypt then mac" \
+ -S "using encrypt then mac"
+
+run_test "Encrypt then MAC: client disabled, server enabled" \
+ "$P_SRV debug_level=3 etm=1" \
+ "$P_CLI debug_level=3 etm=0" \
+ 0 \
+ -C "client hello, adding encrypt_then_mac extension" \
+ -S "found encrypt then mac extension" \
+ -S "server hello, adding encrypt then mac extension" \
+ -C "found encrypt_then_mac extension" \
+ -C "using encrypt then mac" \
+ -S "using encrypt then mac"
+
+run_test "Encrypt then MAC: client SSLv3, server enabled" \
+ "$P_SRV debug_level=3" \
+ "$P_CLI debug_level=3 force_version=ssl3" \
+ 0 \
+ -C "client hello, adding encrypt_then_mac extension" \
+ -S "found encrypt then mac extension" \
+ -S "server hello, adding encrypt then mac extension" \
+ -C "found encrypt_then_mac extension" \
+ -C "using encrypt then mac" \
+ -S "using encrypt then mac"
+
+run_test "Encrypt then MAC: client enabled, server SSLv3" \
+ "$P_SRV debug_level=3 force_version=ssl3" \
+ "$P_CLI debug_level=3" \
+ 0 \
+ -c "client hello, adding encrypt_then_mac extension" \
+ -s "found encrypt then mac extension" \
+ -S "server hello, adding encrypt then mac extension" \
+ -C "found encrypt_then_mac extension" \
+ -C "using encrypt then mac" \
+ -S "using encrypt then mac"
+
# Tests for Extended Master Secret extension
run_test "Extended Master Secret: default" \