| # components-configuration-tls.sh |
| # |
| # Copyright The Mbed TLS Contributors |
| # SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later |
| |
| # This file contains test components that are executed by all.sh |
| |
| ################################################################ |
| #### Configuration Testing - TLS |
| ################################################################ |
| |
| component_test_no_renegotiation () { |
| msg "build: Default + !MBEDTLS_SSL_RENEGOTIATION (ASan build)" # ~ 6 min |
| scripts/config.py unset MBEDTLS_SSL_RENEGOTIATION |
| CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| |
| msg "test: !MBEDTLS_SSL_RENEGOTIATION - main suites (inc. selftests) (ASan build)" # ~ 50s |
| make test |
| |
| msg "test: !MBEDTLS_SSL_RENEGOTIATION - ssl-opt.sh (ASan build)" # ~ 6 min |
| tests/ssl-opt.sh |
| } |
| |
| component_test_tls1_2_default_stream_cipher_only () { |
| msg "build: default with only stream cipher" |
| |
| # Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C |
| scripts/config.py unset MBEDTLS_GCM_C |
| scripts/config.py unset MBEDTLS_CCM_C |
| scripts/config.py unset MBEDTLS_CHACHAPOLY_C |
| #Disable TLS 1.3 (as no AEAD) |
| scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3 |
| # Disable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES)) |
| scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC |
| # Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
| scripts/config.py unset MBEDTLS_SSL_ENCRYPT_THEN_MAC |
| # Enable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER)) |
| scripts/config.py set MBEDTLS_CIPHER_NULL_CIPHER |
| # Modules that depend on AEAD |
| scripts/config.py unset MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| scripts/config.py unset MBEDTLS_SSL_TICKET_C |
| |
| make |
| |
| msg "test: default with only stream cipher" |
| make test |
| |
| # Not running ssl-opt.sh because most tests require a non-NULL ciphersuite. |
| } |
| |
| component_test_tls1_2_default_stream_cipher_only_use_psa () { |
| msg "build: default with only stream cipher use psa" |
| |
| scripts/config.py set MBEDTLS_USE_PSA_CRYPTO |
| # Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C) |
| scripts/config.py unset MBEDTLS_GCM_C |
| scripts/config.py unset MBEDTLS_CCM_C |
| scripts/config.py unset MBEDTLS_CHACHAPOLY_C |
| #Disable TLS 1.3 (as no AEAD) |
| scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3 |
| # Disable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES)) |
| scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC |
| # Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
| scripts/config.py unset MBEDTLS_SSL_ENCRYPT_THEN_MAC |
| # Enable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER)) |
| scripts/config.py set MBEDTLS_CIPHER_NULL_CIPHER |
| # Modules that depend on AEAD |
| scripts/config.py unset MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| scripts/config.py unset MBEDTLS_SSL_TICKET_C |
| |
| make |
| |
| msg "test: default with only stream cipher use psa" |
| make test |
| |
| # Not running ssl-opt.sh because most tests require a non-NULL ciphersuite. |
| } |
| |
| component_test_tls1_2_default_cbc_legacy_cipher_only () { |
| msg "build: default with only CBC-legacy cipher" |
| |
| # Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C) |
| scripts/config.py unset MBEDTLS_GCM_C |
| scripts/config.py unset MBEDTLS_CCM_C |
| scripts/config.py unset MBEDTLS_CHACHAPOLY_C |
| #Disable TLS 1.3 (as no AEAD) |
| scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3 |
| # Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES)) |
| scripts/config.py set MBEDTLS_CIPHER_MODE_CBC |
| # Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
| scripts/config.py unset MBEDTLS_SSL_ENCRYPT_THEN_MAC |
| # Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER)) |
| scripts/config.py unset MBEDTLS_CIPHER_NULL_CIPHER |
| # Modules that depend on AEAD |
| scripts/config.py unset MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| scripts/config.py unset MBEDTLS_SSL_TICKET_C |
| |
| make |
| |
| msg "test: default with only CBC-legacy cipher" |
| make test |
| |
| msg "test: default with only CBC-legacy cipher - ssl-opt.sh (subset)" |
| tests/ssl-opt.sh -f "TLS 1.2" |
| } |
| |
| component_test_tls1_2_default_cbc_legacy_cipher_only_use_psa () { |
| msg "build: default with only CBC-legacy cipher use psa" |
| |
| scripts/config.py set MBEDTLS_USE_PSA_CRYPTO |
| # Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C) |
| scripts/config.py unset MBEDTLS_GCM_C |
| scripts/config.py unset MBEDTLS_CCM_C |
| scripts/config.py unset MBEDTLS_CHACHAPOLY_C |
| #Disable TLS 1.3 (as no AEAD) |
| scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3 |
| # Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES)) |
| scripts/config.py set MBEDTLS_CIPHER_MODE_CBC |
| # Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
| scripts/config.py unset MBEDTLS_SSL_ENCRYPT_THEN_MAC |
| # Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER)) |
| scripts/config.py unset MBEDTLS_CIPHER_NULL_CIPHER |
| # Modules that depend on AEAD |
| scripts/config.py unset MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| scripts/config.py unset MBEDTLS_SSL_TICKET_C |
| |
| make |
| |
| msg "test: default with only CBC-legacy cipher use psa" |
| make test |
| |
| msg "test: default with only CBC-legacy cipher use psa - ssl-opt.sh (subset)" |
| tests/ssl-opt.sh -f "TLS 1.2" |
| } |
| |
| component_test_tls1_2_default_cbc_legacy_cbc_etm_cipher_only () { |
| msg "build: default with only CBC-legacy and CBC-EtM ciphers" |
| |
| # Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C) |
| scripts/config.py unset MBEDTLS_GCM_C |
| scripts/config.py unset MBEDTLS_CCM_C |
| scripts/config.py unset MBEDTLS_CHACHAPOLY_C |
| #Disable TLS 1.3 (as no AEAD) |
| scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3 |
| # Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES)) |
| scripts/config.py set MBEDTLS_CIPHER_MODE_CBC |
| # Enable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
| scripts/config.py set MBEDTLS_SSL_ENCRYPT_THEN_MAC |
| # Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER)) |
| scripts/config.py unset MBEDTLS_CIPHER_NULL_CIPHER |
| # Modules that depend on AEAD |
| scripts/config.py unset MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| scripts/config.py unset MBEDTLS_SSL_TICKET_C |
| |
| make |
| |
| msg "test: default with only CBC-legacy and CBC-EtM ciphers" |
| make test |
| |
| msg "test: default with only CBC-legacy and CBC-EtM ciphers - ssl-opt.sh (subset)" |
| tests/ssl-opt.sh -f "TLS 1.2" |
| } |
| |
| component_test_tls1_2_default_cbc_legacy_cbc_etm_cipher_only_use_psa () { |
| msg "build: default with only CBC-legacy and CBC-EtM ciphers use psa" |
| |
| scripts/config.py set MBEDTLS_USE_PSA_CRYPTO |
| # Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C) |
| scripts/config.py unset MBEDTLS_GCM_C |
| scripts/config.py unset MBEDTLS_CCM_C |
| scripts/config.py unset MBEDTLS_CHACHAPOLY_C |
| #Disable TLS 1.3 (as no AEAD) |
| scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3 |
| # Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES)) |
| scripts/config.py set MBEDTLS_CIPHER_MODE_CBC |
| # Enable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
| scripts/config.py set MBEDTLS_SSL_ENCRYPT_THEN_MAC |
| # Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER)) |
| scripts/config.py unset MBEDTLS_CIPHER_NULL_CIPHER |
| # Modules that depend on AEAD |
| scripts/config.py unset MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| scripts/config.py unset MBEDTLS_SSL_TICKET_C |
| |
| make |
| |
| msg "test: default with only CBC-legacy and CBC-EtM ciphers use psa" |
| make test |
| |
| msg "test: default with only CBC-legacy and CBC-EtM ciphers use psa - ssl-opt.sh (subset)" |
| tests/ssl-opt.sh -f "TLS 1.2" |
| } |
| |
| # We're not aware of any other (open source) implementation of EC J-PAKE in TLS |
| # that we could use for interop testing. However, we now have sort of two |
| # implementations ourselves: one using PSA, the other not. At least test that |
| # these two interoperate with each other. |
| component_test_tls1_2_ecjpake_compatibility () { |
| msg "build: TLS1.2 server+client w/ EC-JPAKE w/o USE_PSA" |
| scripts/config.py set MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
| # Explicitly make lib first to avoid a race condition: |
| # https://github.com/Mbed-TLS/mbedtls/issues/8229 |
| make lib |
| make -C programs ssl/ssl_server2 ssl/ssl_client2 |
| cp programs/ssl/ssl_server2 s2_no_use_psa |
| cp programs/ssl/ssl_client2 c2_no_use_psa |
| |
| msg "build: TLS1.2 server+client w/ EC-JPAKE w/ USE_PSA" |
| scripts/config.py set MBEDTLS_USE_PSA_CRYPTO |
| make clean |
| make lib |
| make -C programs ssl/ssl_server2 ssl/ssl_client2 |
| make -C programs test/udp_proxy test/query_compile_time_config |
| |
| msg "test: server w/o USE_PSA - client w/ USE_PSA, text password" |
| P_SRV=../s2_no_use_psa tests/ssl-opt.sh -f "ECJPAKE: working, TLS" |
| msg "test: server w/o USE_PSA - client w/ USE_PSA, opaque password" |
| P_SRV=../s2_no_use_psa tests/ssl-opt.sh -f "ECJPAKE: opaque password client only, working, TLS" |
| msg "test: client w/o USE_PSA - server w/ USE_PSA, text password" |
| P_CLI=../c2_no_use_psa tests/ssl-opt.sh -f "ECJPAKE: working, TLS" |
| msg "test: client w/o USE_PSA - server w/ USE_PSA, opaque password" |
| P_CLI=../c2_no_use_psa tests/ssl-opt.sh -f "ECJPAKE: opaque password server only, working, TLS" |
| |
| rm s2_no_use_psa c2_no_use_psa |
| } |
| |
| component_test_small_ssl_out_content_len () { |
| msg "build: small SSL_OUT_CONTENT_LEN (ASan build)" |
| scripts/config.py set MBEDTLS_SSL_IN_CONTENT_LEN 16384 |
| scripts/config.py set MBEDTLS_SSL_OUT_CONTENT_LEN 4096 |
| CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| |
| msg "test: small SSL_OUT_CONTENT_LEN - ssl-opt.sh MFL and large packet tests" |
| tests/ssl-opt.sh -f "Max fragment\|Large packet" |
| } |
| |
| component_test_small_ssl_in_content_len () { |
| msg "build: small SSL_IN_CONTENT_LEN (ASan build)" |
| scripts/config.py set MBEDTLS_SSL_IN_CONTENT_LEN 4096 |
| scripts/config.py set MBEDTLS_SSL_OUT_CONTENT_LEN 16384 |
| CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| |
| msg "test: small SSL_IN_CONTENT_LEN - ssl-opt.sh MFL tests" |
| tests/ssl-opt.sh -f "Max fragment" |
| } |
| |
| component_test_small_ssl_dtls_max_buffering () { |
| msg "build: small MBEDTLS_SSL_DTLS_MAX_BUFFERING #0" |
| scripts/config.py set MBEDTLS_SSL_DTLS_MAX_BUFFERING 1000 |
| CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| |
| msg "test: small MBEDTLS_SSL_DTLS_MAX_BUFFERING #0 - ssl-opt.sh specific reordering test" |
| tests/ssl-opt.sh -f "DTLS reordering: Buffer out-of-order hs msg before reassembling next, free buffered msg" |
| } |
| |
| component_test_small_mbedtls_ssl_dtls_max_buffering () { |
| msg "build: small MBEDTLS_SSL_DTLS_MAX_BUFFERING #1" |
| scripts/config.py set MBEDTLS_SSL_DTLS_MAX_BUFFERING 190 |
| CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| |
| msg "test: small MBEDTLS_SSL_DTLS_MAX_BUFFERING #1 - ssl-opt.sh specific reordering test" |
| tests/ssl-opt.sh -f "DTLS reordering: Buffer encrypted Finished message, drop for fragmented NewSessionTicket" |
| } |
| |
| component_test_depends_py_kex () { |
| msg "test/build: depends.py kex (gcc)" |
| tests/scripts/depends.py kex --unset-use-psa |
| } |
| |
| component_test_depends_py_kex_psa () { |
| msg "test/build: depends.py kex (gcc) with MBEDTLS_USE_PSA_CRYPTO defined" |
| tests/scripts/depends.py kex |
| } |
| |
| # Common helper for component_full_without_ecdhe_ecdsa() and |
| # component_full_without_ecdhe_ecdsa_and_tls13() which: |
| # - starts from the "full" configuration minus the list of symbols passed in |
| # as 1st parameter |
| # - build |
| # - test only TLS (i.e. test_suite_tls and ssl-opt) |
| build_full_minus_something_and_test_tls () { |
| symbols_to_disable="$1" |
| |
| msg "build: full minus something, test TLS" |
| |
| scripts/config.py full |
| for sym in $symbols_to_disable; do |
| echo "Disabling $sym" |
| scripts/config.py unset $sym |
| done |
| |
| make |
| |
| msg "test: full minus something, test TLS" |
| ( cd tests; ./test_suite_ssl ) |
| |
| msg "ssl-opt: full minus something, test TLS" |
| tests/ssl-opt.sh |
| } |
| |
| component_full_without_ecdhe_ecdsa () { |
| build_full_minus_something_and_test_tls "MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED" |
| } |
| |
| component_full_without_ecdhe_ecdsa_and_tls13 () { |
| build_full_minus_something_and_test_tls "MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
| MBEDTLS_SSL_PROTO_TLS1_3" |
| } |
| |
| component_build_no_ssl_srv () { |
| msg "build: full config except SSL server, make, gcc" # ~ 30s |
| scripts/config.py full |
| scripts/config.py unset MBEDTLS_SSL_SRV_C |
| make CC=gcc CFLAGS='-Werror -Wall -Wextra -O1 -Wmissing-prototypes' |
| } |
| |
| component_build_no_ssl_cli () { |
| msg "build: full config except SSL client, make, gcc" # ~ 30s |
| scripts/config.py full |
| scripts/config.py unset MBEDTLS_SSL_CLI_C |
| make CC=gcc CFLAGS='-Werror -Wall -Wextra -O1 -Wmissing-prototypes' |
| } |
| |
| component_test_no_max_fragment_length () { |
| # Run max fragment length tests with MFL disabled |
| msg "build: default config except MFL extension (ASan build)" # ~ 30s |
| scripts/config.py unset MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| |
| msg "test: ssl-opt.sh, MFL-related tests" |
| tests/ssl-opt.sh -f "Max fragment length" |
| } |
| |
| component_test_asan_remove_peer_certificate () { |
| msg "build: default config with MBEDTLS_SSL_KEEP_PEER_CERTIFICATE disabled (ASan build)" |
| scripts/config.py unset MBEDTLS_SSL_KEEP_PEER_CERTIFICATE |
| scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3 |
| CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| |
| msg "test: !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE" |
| make test |
| |
| msg "test: ssl-opt.sh, !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE" |
| tests/ssl-opt.sh |
| |
| msg "test: compat.sh, !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE" |
| tests/compat.sh |
| |
| msg "test: context-info.sh, !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE" |
| tests/context-info.sh |
| } |
| |
| component_test_no_max_fragment_length_small_ssl_out_content_len () { |
| msg "build: no MFL extension, small SSL_OUT_CONTENT_LEN (ASan build)" |
| scripts/config.py unset MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| scripts/config.py set MBEDTLS_SSL_IN_CONTENT_LEN 16384 |
| scripts/config.py set MBEDTLS_SSL_OUT_CONTENT_LEN 4096 |
| CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| |
| msg "test: MFL tests (disabled MFL extension case) & large packet tests" |
| tests/ssl-opt.sh -f "Max fragment length\|Large buffer" |
| |
| msg "test: context-info.sh (disabled MFL extension case)" |
| tests/context-info.sh |
| } |
| |
| component_test_variable_ssl_in_out_buffer_len () { |
| msg "build: MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH enabled (ASan build)" |
| scripts/config.py set MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH |
| CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| |
| msg "test: MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH enabled" |
| make test |
| |
| msg "test: ssl-opt.sh, MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH enabled" |
| tests/ssl-opt.sh |
| |
| msg "test: compat.sh, MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH enabled" |
| tests/compat.sh |
| } |
| |
| component_test_dtls_cid_legacy () { |
| msg "build: MBEDTLS_SSL_DTLS_CONNECTION_ID (legacy) enabled (ASan build)" |
| scripts/config.py set MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT 1 |
| |
| CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| |
| msg "test: MBEDTLS_SSL_DTLS_CONNECTION_ID (legacy)" |
| make test |
| |
| msg "test: ssl-opt.sh, MBEDTLS_SSL_DTLS_CONNECTION_ID (legacy) enabled" |
| tests/ssl-opt.sh |
| |
| msg "test: compat.sh, MBEDTLS_SSL_DTLS_CONNECTION_ID (legacy) enabled" |
| tests/compat.sh |
| } |
| |
| component_test_ssl_alloc_buffer_and_mfl () { |
| msg "build: default config with memory buffer allocator and MFL extension" |
| scripts/config.py set MBEDTLS_MEMORY_BUFFER_ALLOC_C |
| scripts/config.py set MBEDTLS_PLATFORM_MEMORY |
| scripts/config.py set MBEDTLS_MEMORY_DEBUG |
| scripts/config.py set MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| scripts/config.py set MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH |
| cmake -DCMAKE_BUILD_TYPE:String=Release . |
| make |
| |
| msg "test: MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH, MBEDTLS_MEMORY_BUFFER_ALLOC_C, MBEDTLS_MEMORY_DEBUG and MBEDTLS_SSL_MAX_FRAGMENT_LENGTH" |
| make test |
| |
| msg "test: MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH, MBEDTLS_MEMORY_BUFFER_ALLOC_C, MBEDTLS_MEMORY_DEBUG and MBEDTLS_SSL_MAX_FRAGMENT_LENGTH" |
| tests/ssl-opt.sh -f "Handshake memory usage" |
| } |
| |
| component_test_when_no_ciphersuites_have_mac () { |
| msg "build: when no ciphersuites have MAC" |
| scripts/config.py unset MBEDTLS_CIPHER_NULL_CIPHER |
| scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC |
| scripts/config.py unset MBEDTLS_CMAC_C |
| make |
| |
| msg "test: !MBEDTLS_SSL_SOME_SUITES_USE_MAC" |
| make test |
| |
| msg "test ssl-opt.sh: !MBEDTLS_SSL_SOME_SUITES_USE_MAC" |
| tests/ssl-opt.sh -f 'Default\|EtM' -e 'without EtM' |
| } |
| |
| component_test_tls12_only () { |
| msg "build: default config without MBEDTLS_SSL_PROTO_TLS1_3, cmake, gcc, ASan" |
| scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3 |
| CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| |
| msg "test: main suites (inc. selftests) (ASan build)" |
| make test |
| |
| msg "test: ssl-opt.sh (ASan build)" |
| tests/ssl-opt.sh |
| |
| msg "test: compat.sh (ASan build)" |
| tests/compat.sh |
| } |
| |
| component_test_tls13_only () { |
| msg "build: default config without MBEDTLS_SSL_PROTO_TLS1_2" |
| scripts/config.py set MBEDTLS_SSL_EARLY_DATA |
| scripts/config.py set MBEDTLS_SSL_RECORD_SIZE_LIMIT |
| make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'" |
| |
| msg "test: TLS 1.3 only, all key exchange modes enabled" |
| make test |
| |
| msg "ssl-opt.sh: TLS 1.3 only, all key exchange modes enabled" |
| tests/ssl-opt.sh |
| } |
| |
| component_test_tls13_only_psk () { |
| msg "build: TLS 1.3 only from default, only PSK key exchange mode" |
| scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
| scripts/config.py unset MBEDTLS_ECDH_C |
| scripts/config.py unset MBEDTLS_DHM_C |
| scripts/config.py unset MBEDTLS_X509_CRT_PARSE_C |
| scripts/config.py unset MBEDTLS_X509_RSASSA_PSS_SUPPORT |
| scripts/config.py unset MBEDTLS_SSL_SERVER_NAME_INDICATION |
| scripts/config.py unset MBEDTLS_ECDSA_C |
| scripts/config.py unset MBEDTLS_PKCS1_V21 |
| scripts/config.py unset MBEDTLS_PKCS7_C |
| scripts/config.py set MBEDTLS_SSL_EARLY_DATA |
| make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'" |
| |
| msg "test_suite_ssl: TLS 1.3 only, only PSK key exchange mode enabled" |
| cd tests; ./test_suite_ssl; cd .. |
| |
| msg "ssl-opt.sh: TLS 1.3 only, only PSK key exchange mode enabled" |
| tests/ssl-opt.sh |
| } |
| |
| component_test_tls13_only_ephemeral () { |
| msg "build: TLS 1.3 only from default, only ephemeral key exchange mode" |
| scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED |
| scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
| scripts/config.py unset MBEDTLS_SSL_EARLY_DATA |
| make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'" |
| |
| msg "test_suite_ssl: TLS 1.3 only, only ephemeral key exchange mode" |
| cd tests; ./test_suite_ssl; cd .. |
| |
| msg "ssl-opt.sh: TLS 1.3 only, only ephemeral key exchange mode" |
| tests/ssl-opt.sh |
| } |
| |
| component_test_tls13_only_ephemeral_ffdh () { |
| msg "build: TLS 1.3 only from default, only ephemeral ffdh key exchange mode" |
| scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED |
| scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
| scripts/config.py unset MBEDTLS_SSL_EARLY_DATA |
| scripts/config.py unset MBEDTLS_ECDH_C |
| |
| make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'" |
| |
| msg "test_suite_ssl: TLS 1.3 only, only ephemeral ffdh key exchange mode" |
| cd tests; ./test_suite_ssl; cd .. |
| |
| msg "ssl-opt.sh: TLS 1.3 only, only ephemeral ffdh key exchange mode" |
| tests/ssl-opt.sh |
| } |
| |
| component_test_tls13_only_psk_ephemeral () { |
| msg "build: TLS 1.3 only from default, only PSK ephemeral key exchange mode" |
| scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED |
| scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| scripts/config.py unset MBEDTLS_X509_CRT_PARSE_C |
| scripts/config.py unset MBEDTLS_X509_RSASSA_PSS_SUPPORT |
| scripts/config.py unset MBEDTLS_SSL_SERVER_NAME_INDICATION |
| scripts/config.py unset MBEDTLS_ECDSA_C |
| scripts/config.py unset MBEDTLS_PKCS1_V21 |
| scripts/config.py unset MBEDTLS_PKCS7_C |
| scripts/config.py set MBEDTLS_SSL_EARLY_DATA |
| make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'" |
| |
| msg "test_suite_ssl: TLS 1.3 only, only PSK ephemeral key exchange mode" |
| cd tests; ./test_suite_ssl; cd .. |
| |
| msg "ssl-opt.sh: TLS 1.3 only, only PSK ephemeral key exchange mode" |
| tests/ssl-opt.sh |
| } |
| |
| component_test_tls13_only_psk_ephemeral_ffdh () { |
| msg "build: TLS 1.3 only from default, only PSK ephemeral ffdh key exchange mode" |
| scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED |
| scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| scripts/config.py unset MBEDTLS_X509_CRT_PARSE_C |
| scripts/config.py unset MBEDTLS_X509_RSASSA_PSS_SUPPORT |
| scripts/config.py unset MBEDTLS_SSL_SERVER_NAME_INDICATION |
| scripts/config.py unset MBEDTLS_ECDSA_C |
| scripts/config.py unset MBEDTLS_PKCS1_V21 |
| scripts/config.py unset MBEDTLS_PKCS7_C |
| scripts/config.py set MBEDTLS_SSL_EARLY_DATA |
| scripts/config.py unset MBEDTLS_ECDH_C |
| make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'" |
| |
| msg "test_suite_ssl: TLS 1.3 only, only PSK ephemeral ffdh key exchange mode" |
| cd tests; ./test_suite_ssl; cd .. |
| |
| msg "ssl-opt.sh: TLS 1.3 only, only PSK ephemeral ffdh key exchange mode" |
| tests/ssl-opt.sh |
| } |
| |
| component_test_tls13_only_psk_all () { |
| msg "build: TLS 1.3 only from default, without ephemeral key exchange mode" |
| scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| scripts/config.py unset MBEDTLS_X509_CRT_PARSE_C |
| scripts/config.py unset MBEDTLS_X509_RSASSA_PSS_SUPPORT |
| scripts/config.py unset MBEDTLS_SSL_SERVER_NAME_INDICATION |
| scripts/config.py unset MBEDTLS_ECDSA_C |
| scripts/config.py unset MBEDTLS_PKCS1_V21 |
| scripts/config.py unset MBEDTLS_PKCS7_C |
| scripts/config.py set MBEDTLS_SSL_EARLY_DATA |
| make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'" |
| |
| msg "test_suite_ssl: TLS 1.3 only, PSK and PSK ephemeral key exchange modes" |
| cd tests; ./test_suite_ssl; cd .. |
| |
| msg "ssl-opt.sh: TLS 1.3 only, PSK and PSK ephemeral key exchange modes" |
| tests/ssl-opt.sh |
| } |
| |
| component_test_tls13_only_ephemeral_all () { |
| msg "build: TLS 1.3 only from default, without PSK key exchange mode" |
| scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED |
| scripts/config.py set MBEDTLS_SSL_EARLY_DATA |
| make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'" |
| |
| msg "test_suite_ssl: TLS 1.3 only, ephemeral and PSK ephemeral key exchange modes" |
| cd tests; ./test_suite_ssl; cd .. |
| |
| msg "ssl-opt.sh: TLS 1.3 only, ephemeral and PSK ephemeral key exchange modes" |
| tests/ssl-opt.sh |
| } |
| |
| component_test_tls13_no_padding () { |
| msg "build: default config plus early data minus padding" |
| scripts/config.py set MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY 1 |
| scripts/config.py set MBEDTLS_SSL_EARLY_DATA |
| CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| msg "test: default config plus early data minus padding" |
| make test |
| msg "ssl-opt.sh (TLS 1.3 no padding)" |
| tests/ssl-opt.sh |
| } |
| |
| component_test_tls13_no_compatibility_mode () { |
| msg "build: default config plus early data minus middlebox compatibility mode" |
| scripts/config.py unset MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| scripts/config.py set MBEDTLS_SSL_EARLY_DATA |
| CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| msg "test: default config plus early data minus middlebox compatibility mode" |
| make test |
| msg "ssl-opt.sh (TLS 1.3 no compatibility mode)" |
| tests/ssl-opt.sh |
| } |
| |
| component_test_full_minus_session_tickets () { |
| msg "build: full config without session tickets" |
| scripts/config.py full |
| scripts/config.py unset MBEDTLS_SSL_SESSION_TICKETS |
| scripts/config.py unset MBEDTLS_SSL_EARLY_DATA |
| CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan . |
| make |
| msg "test: full config without session tickets" |
| make test |
| msg "ssl-opt.sh (full config without session tickets)" |
| tests/ssl-opt.sh |
| } |