Detect mismatching compile-time and cmd line config in ssl-opt.sh
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 3dd69a5..7bcba24 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -503,6 +503,49 @@
fi
}
+# Strip off a particular parameter from the command line
+# and return its value.
+# Parameter 1: Command line parameter to strip off
+# ENV I/O: CMD command line to search and modify
+extract_cmdline_argument() {
+ __ARG=$(echo "$CMD" | sed -n "s/^.* $1=\([^ ]*\).*$/\1/p")
+ CMD=$(echo "$CMD" | sed "s/$1=\([^ ]*\)//")
+}
+
+# Check compatibility of the ssl_client2/ssl_server2 command-line
+# with a particular compile-time configurable option.
+# Parameter 1: Command-line argument (e.g. extended_ms)
+# Parameter 2: Corresponding compile-time configuration
+# (e.g. MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
+# ENV I/O: CMD command line to search and modify
+# SKIP_NEXT set to "YES" on a mismatch
+check_cmdline_param_compat() {
+ __VAL="$( get_config_value_or_default "$2" )"
+ if [ ! -z "$__VAL" ]; then
+ extract_cmdline_argument "$1"
+ if [ ! -z "$__ARG" ] && [ "$__ARG" != "$__VAL" ]; then
+ SKIP_NEXT="YES"
+ fi
+ fi
+}
+
+# Go through all options that can be hardcoded at compile-time and
+# detect whether the command line configures them in a conflicting
+# way. If so, skip the test. Otherwise, remove the corresponding
+# entry.
+# Parameter 1: Command line to inspect
+# Output: Modified command line
+# ENV I/O: SKIP_TEST set to 1 on mismatch.
+check_cmdline_compat() {
+ CMD="$1"
+
+ # ExtendedMasterSecret configuration
+ check_cmdline_param_compat "extended_ms" \
+ "MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET"
+ check_cmdline_param_compat "enforce_extended_master_secret" \
+ "MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET"
+}
+
# Usage: run_test name [-p proxy_cmd] srv_cmd cli_cmd cli_exit [option [...]]
# Options: -s pattern pattern that must be present in server output
# -c pattern pattern that must be present in client output
@@ -531,14 +574,6 @@
SKIP_NEXT="YES"
fi
- # should we skip?
- if [ "X$SKIP_NEXT" = "XYES" ]; then
- SKIP_NEXT="NO"
- echo "SKIP"
- SKIPS=$(( $SKIPS + 1 ))
- return
- fi
-
# does this test use a proxy?
if [ "X$1" = "X-p" ]; then
PXY_CMD="$2"
@@ -553,6 +588,12 @@
CLI_EXPECT="$3"
shift 3
+ check_cmdline_compat "$SRV_CMD"
+ SRV_CMD="$CMD"
+
+ check_cmdline_compat "$CLI_CMD"
+ CLI_CMD="$CMD"
+
# Check if test uses files
TEST_USES_FILES=$(echo "$SRV_CMD $CLI_CMD" | grep "\.\(key\|crt\|pem\)" )
if [ ! -z "$TEST_USES_FILES" ]; then
@@ -1836,8 +1877,8 @@
# Tests for Extended Master Secret extension
run_test "Extended Master Secret: default (not enforcing)" \
- "$P_SRV debug_level=3" \
- "$P_CLI debug_level=3" \
+ "$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=0 " \
+ "$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
0 \
-c "client hello, adding extended_master_secret extension" \
-s "found extended master secret extension" \
@@ -1847,8 +1888,8 @@
-s "session hash for extended master secret"
run_test "Extended Master Secret: both enabled, both enforcing" \
- "$P_SRV debug_level=3 enforce_extended_master_secret=1" \
- "$P_CLI debug_level=3 enforce_extended_master_secret=1" \
+ "$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
+ "$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
0 \
-c "client hello, adding extended_master_secret extension" \
-s "found extended master secret extension" \
@@ -1858,8 +1899,8 @@
-s "session hash for extended master secret"
run_test "Extended Master Secret: both enabled, client enforcing" \
- "$P_SRV debug_level=3 enforce_extended_master_secret=0" \
- "$P_CLI debug_level=3 enforce_extended_master_secret=1" \
+ "$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
+ "$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
0 \
-c "client hello, adding extended_master_secret extension" \
-s "found extended master secret extension" \
@@ -1869,8 +1910,8 @@
-s "session hash for extended master secret"
run_test "Extended Master Secret: both enabled, server enforcing" \
- "$P_SRV debug_level=3 enforce_extended_master_secret=1" \
- "$P_CLI debug_level=3 enforce_extended_master_secret=0" \
+ "$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
+ "$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
0 \
-c "client hello, adding extended_master_secret extension" \
-s "found extended master secret extension" \
@@ -1880,7 +1921,7 @@
-s "session hash for extended master secret"
run_test "Extended Master Secret: client enabled, server disabled, client enforcing" \
- "$P_SRV debug_level=3 extended_ms=0" \
+ "$P_SRV debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
"$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
1 \
-c "client hello, adding extended_master_secret extension" \
@@ -1891,7 +1932,7 @@
run_test "Extended Master Secret enforced: client disabled, server enabled, server enforcing" \
"$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
- "$P_CLI debug_level=3 extended_ms=0" \
+ "$P_CLI debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
1 \
-C "client hello, adding extended_master_secret extension" \
-S "found extended master secret extension" \
@@ -1900,8 +1941,8 @@
-s "Peer not offering extended master secret, while it is enforced"
run_test "Extended Master Secret: client enabled, server disabled, not enforcing" \
- "$P_SRV debug_level=3 extended_ms=0" \
- "$P_CLI debug_level=3 extended_ms=1" \
+ "$P_SRV debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
+ "$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
0 \
-c "client hello, adding extended_master_secret extension" \
-s "found extended master secret extension" \
@@ -1911,8 +1952,8 @@
-S "session hash for extended master secret"
run_test "Extended Master Secret: client disabled, server enabled, not enforcing" \
- "$P_SRV debug_level=3 extended_ms=1" \
- "$P_CLI debug_level=3 extended_ms=0" \
+ "$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
+ "$P_CLI debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
0 \
-C "client hello, adding extended_master_secret extension" \
-S "found extended master secret extension" \
@@ -1922,8 +1963,8 @@
-S "session hash for extended master secret"
run_test "Extended Master Secret: client disabled, server disabled" \
- "$P_SRV debug_level=3 extended_ms=0" \
- "$P_CLI debug_level=3 extended_ms=0" \
+ "$P_SRV debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
+ "$P_CLI debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
0 \
-C "client hello, adding extended_master_secret extension" \
-S "found extended master secret extension" \
@@ -1934,8 +1975,8 @@
requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
run_test "Extended Master Secret: client SSLv3, server enabled" \
- "$P_SRV debug_level=3 min_version=ssl3" \
- "$P_CLI debug_level=3 force_version=ssl3" \
+ "$P_SRV debug_level=3 min_version=ssl3 extended_ms=1 enforce_extended_master_secret=0" \
+ "$P_CLI debug_level=3 force_version=ssl3 extended_ms=1 enforce_extended_master_secret=0" \
0 \
-C "client hello, adding extended_master_secret extension" \
-S "found extended master secret extension" \
@@ -1946,8 +1987,8 @@
requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
run_test "Extended Master Secret: client enabled, server SSLv3" \
- "$P_SRV debug_level=3 force_version=ssl3" \
- "$P_CLI debug_level=3 min_version=ssl3" \
+ "$P_SRV debug_level=3 force_version=ssl3 extended_ms=1 enforce_extended_master_secret=0" \
+ "$P_CLI debug_level=3 min_version=ssl3 extended_ms=1 enforce_extended_master_secret=0" \
0 \
-c "client hello, adding extended_master_secret extension" \
-S "found extended master secret extension" \