Add ssl_set_arc4_support()
Rationale: if people want to disable RC4 but otherwise keep the default suite
list, it was cumbersome. Also, since it uses a global array,
ssl_list_ciphersuite() is not a convenient place. So the SSL modules look like
the best place, even if it means temporarily adding one SSL setting.
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 361d393..bb8bd62 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -393,6 +393,26 @@
-S "error" \
-C "error"
+# Tests for rc4 option
+
+run_test "RC4: server disabled, client enabled" \
+ "$P_SRV" \
+ "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
+ 1 \
+ -s "SSL - The server has no ciphersuites in common"
+
+run_test "RC4: server enabled, client disabled" \
+ "$P_SRV force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
+ "$P_CLI" \
+ 1 \
+ -s "SSL - The server has no ciphersuites in common"
+
+run_test "RC4: both enabled" \
+ "$P_SRV arc4=1" \
+ "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
+ 0 \
+ -S "SSL - The server has no ciphersuites in common"
+
# Test for SSLv2 ClientHello
requires_openssl_with_sslv2
@@ -1575,8 +1595,8 @@
-c "Ciphersuite is TLS-RSA-WITH-3DES-EDE-CBC-SHA"
run_test "Per-version suites: TLS 1.0" \
- "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
- "$P_CLI force_version=tls1" \
+ "$P_SRV arc4=1 version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
+ "$P_CLI force_version=tls1 arc4=1" \
0 \
-c "Ciphersuite is TLS-RSA-WITH-RC4-128-SHA"
@@ -1616,7 +1636,7 @@
-s "Read from client: 1 bytes read"
run_test "Small packet SSLv3 StreamCipher" \
- "$P_SRV min_version=ssl3" \
+ "$P_SRV min_version=ssl3 arc4=1" \
"$P_CLI request_size=1 force_version=ssl3 \
force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
0 \
@@ -1638,7 +1658,7 @@
-s "Read from client: 1 bytes read"
run_test "Small packet TLS 1.0 StreamCipher truncated MAC" \
- "$P_SRV" \
+ "$P_SRV arc4=1" \
"$P_CLI request_size=1 force_version=tls1 \
force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
trunc_hmac=1" \
@@ -1653,7 +1673,7 @@
-s "Read from client: 1 bytes read"
run_test "Small packet TLS 1.1 StreamCipher" \
- "$P_SRV" \
+ "$P_SRV arc4=1" \
"$P_CLI request_size=1 force_version=tls1_1 \
force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
0 \
@@ -1668,7 +1688,7 @@
-s "Read from client: 1 bytes read"
run_test "Small packet TLS 1.1 StreamCipher truncated MAC" \
- "$P_SRV" \
+ "$P_SRV arc4=1" \
"$P_CLI request_size=1 force_version=tls1_1 \
force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
trunc_hmac=1" \
@@ -1697,14 +1717,14 @@
-s "Read from client: 1 bytes read"
run_test "Small packet TLS 1.2 StreamCipher" \
- "$P_SRV" \
+ "$P_SRV arc4=1" \
"$P_CLI request_size=1 force_version=tls1_2 \
force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
0 \
-s "Read from client: 1 bytes read"
run_test "Small packet TLS 1.2 StreamCipher truncated MAC" \
- "$P_SRV" \
+ "$P_SRV arc4=1" \
"$P_CLI request_size=1 force_version=tls1_2 \
force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
trunc_hmac=1" \
@@ -1735,7 +1755,7 @@
-s "Read from client: 16384 bytes read"
run_test "Large packet SSLv3 StreamCipher" \
- "$P_SRV min_version=ssl3" \
+ "$P_SRV min_version=ssl3 arc4=1" \
"$P_CLI request_size=16384 force_version=ssl3 \
force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
0 \
@@ -1757,7 +1777,7 @@
-s "Read from client: 16384 bytes read"
run_test "Large packet TLS 1.0 StreamCipher truncated MAC" \
- "$P_SRV" \
+ "$P_SRV arc4=1" \
"$P_CLI request_size=16384 force_version=tls1 \
force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
trunc_hmac=1" \
@@ -1772,7 +1792,7 @@
-s "Read from client: 16384 bytes read"
run_test "Large packet TLS 1.1 StreamCipher" \
- "$P_SRV" \
+ "$P_SRV arc4=1" \
"$P_CLI request_size=16384 force_version=tls1_1 \
force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
0 \
@@ -1787,7 +1807,7 @@
-s "Read from client: 16384 bytes read"
run_test "Large packet TLS 1.1 StreamCipher truncated MAC" \
- "$P_SRV" \
+ "$P_SRV arc4=1" \
"$P_CLI request_size=16384 force_version=tls1_1 \
force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
trunc_hmac=1" \
@@ -1816,14 +1836,14 @@
-s "Read from client: 16384 bytes read"
run_test "Large packet TLS 1.2 StreamCipher" \
- "$P_SRV" \
+ "$P_SRV arc4=1" \
"$P_CLI request_size=16384 force_version=tls1_2 \
force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
0 \
-s "Read from client: 16384 bytes read"
run_test "Large packet TLS 1.2 StreamCipher truncated MAC" \
- "$P_SRV" \
+ "$P_SRV arc4=1" \
"$P_CLI request_size=16384 force_version=tls1_2 \
force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
trunc_hmac=1" \