blob: 88f29843b73c03b3dd88d3b0a4f71d45d5fdb811 [file] [log] [blame]
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001#!/bin/sh
Paul Bakkeraccd4eb2013-07-19 13:41:51 +02002
Simon Butcherac22d112016-09-04 22:31:09 +01003# compat.sh
4#
5# This file is part of mbed TLS (https://tls.mbed.org)
6#
7# Copyright (c) 2012-2016, ARM Limited, All Rights Reserved
8#
9# Purpose
10#
11# Test interoperbility with OpenSSL, GnuTLS as well as itself.
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +010012#
13# Check each common ciphersuite, with each version, both ways (client/server),
14# with and without client authentication.
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +010015
Manuel Pégourié-Gonnard913030c2014-03-28 10:12:38 +010016set -u
17
Jaeden Amero34730912019-07-03 13:51:04 +010018# Limit the size of each log to 10 GiB, in case of failures with this script
19# where it may output seemingly unlimited length error logs.
20ulimit -f 20971520
21
Manuel Pégourié-Gonnarda1a9f9a2014-03-25 18:04:59 +010022# initialise counters
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +020023TESTS=0
24FAILED=0
25SKIPPED=0
26SRVMEM=0
Manuel Pégourié-Gonnard70064fd2013-08-27 22:00:47 +020027
Antonin Décimo8fd91562019-01-23 15:24:37 +010028# default commands, can be overridden by the environment
Simon Butcherac22d112016-09-04 22:31:09 +010029: ${M_SRV:=../programs/ssl/ssl_server2}
30: ${M_CLI:=../programs/ssl/ssl_client2}
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +010031: ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system
32: ${GNUTLS_CLI:=gnutls-cli}
33: ${GNUTLS_SERV:=gnutls-serv}
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +010034
Manuel Pégourié-Gonnard1287f112014-08-31 16:20:58 +020035# do we have a recent enough GnuTLS?
Manuel Pégourié-Gonnard03db6b02015-06-26 15:45:30 +020036if ( which $GNUTLS_CLI && which $GNUTLS_SERV ) >/dev/null 2>&1; then
Manuel Pégourié-Gonnarddd459272014-10-24 12:57:37 +020037 G_VER="$( $GNUTLS_CLI --version | head -n1 )"
38 if echo "$G_VER" | grep '@VERSION@' > /dev/null; then # git version
Manuel Pégourié-Gonnard1287f112014-08-31 16:20:58 +020039 PEER_GNUTLS=" GnuTLS"
Manuel Pégourié-Gonnarddd459272014-10-24 12:57:37 +020040 else
41 eval $( echo $G_VER | sed 's/.* \([0-9]*\)\.\([0-9]\)*\.\([0-9]*\)$/MAJOR="\1" MINOR="\2" PATCH="\3"/' )
42 if [ $MAJOR -lt 3 -o \
43 \( $MAJOR -eq 3 -a $MINOR -lt 2 \) -o \
44 \( $MAJOR -eq 3 -a $MINOR -eq 2 -a $PATCH -lt 15 \) ]
45 then
46 PEER_GNUTLS=""
47 else
48 PEER_GNUTLS=" GnuTLS"
49 fi
Manuel Pégourié-Gonnard1287f112014-08-31 16:20:58 +020050 fi
51else
52 PEER_GNUTLS=""
53fi
54
Manuel Pégourié-Gonnarda1a9f9a2014-03-25 18:04:59 +010055# default values for options
Simon Butcher3ea7f522016-03-07 23:22:10 +000056MODES="tls1 tls1_1 tls1_2 dtls1 dtls1_2"
Paul Bakker1eeceae2012-11-23 14:25:34 +010057VERIFIES="NO YES"
Manuel Pégourié-Gonnard7ebaf372013-08-27 21:03:33 +020058TYPES="ECDSA RSA PSK"
Paul Bakkeraccd4eb2013-07-19 13:41:51 +020059FILTER=""
Andres Amaya Garcia0a0e5b12019-01-08 21:42:27 +000060# exclude:
61# - NULL: excluded from our default config
62# - RC4, single-DES: requires legacy OpenSSL/GnuTLS versions
63# avoid plain DES but keep 3DES-EDE-CBC (mbedTLS), DES-CBC3 (OpenSSL)
Andres Amaya Garciab7c22ec2019-02-11 21:47:30 +000064# - 3DES: not in default config
Andres Amaya Garciafea3d0a2019-02-19 20:20:57 +000065EXCLUDE='NULL\|DES\|RC4\|ARCFOUR'
Paul Bakkeraccd4eb2013-07-19 13:41:51 +020066VERBOSE=""
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +010067MEMCHECK=0
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +000068PEERS="OpenSSL$PEER_GNUTLS mbedTLS"
Paul Bakkeraccd4eb2013-07-19 13:41:51 +020069
Manuel Pégourié-Gonnard39e2ca92015-08-04 16:43:37 +020070# hidden option: skip DTLS with OpenSSL
71# (travis CI has a version that doesn't work for us)
72: ${OSSL_NO_DTLS:=0}
73
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +010074print_usage() {
75 echo "Usage: $0"
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +010076 printf " -h|--help\tPrint this help.\n"
77 printf " -f|--filter\tOnly matching ciphersuites are tested (Default: '$FILTER')\n"
78 printf " -e|--exclude\tMatching ciphersuites are excluded (Default: '$EXCLUDE')\n"
79 printf " -m|--modes\tWhich modes to perform (Default: '$MODES')\n"
80 printf " -t|--types\tWhich key exchange type to perform (Default: '$TYPES')\n"
81 printf " -V|--verify\tWhich verification modes to perform (Default: '$VERIFIES')\n"
82 printf " -p|--peers\tWhich peers to use (Default: '$PEERS')\n"
83 printf " \tAlso available: GnuTLS (needs v3.2.15 or higher)\n"
84 printf " -M|--memcheck\tCheck memory leaks and errors.\n"
85 printf " -v|--verbose\tSet verbose output.\n"
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +010086}
87
88get_options() {
89 while [ $# -gt 0 ]; do
90 case "$1" in
91 -f|--filter)
92 shift; FILTER=$1
93 ;;
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +010094 -e|--exclude)
95 shift; EXCLUDE=$1
96 ;;
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +010097 -m|--modes)
98 shift; MODES=$1
99 ;;
100 -t|--types)
101 shift; TYPES=$1
102 ;;
103 -V|--verify)
104 shift; VERIFIES=$1
105 ;;
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +0100106 -p|--peers)
107 shift; PEERS=$1
108 ;;
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100109 -v|--verbose)
110 VERBOSE=1
111 ;;
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100112 -M|--memcheck)
113 MEMCHECK=1
114 ;;
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100115 -h|--help)
116 print_usage
117 exit 0
118 ;;
119 *)
120 echo "Unknown argument: '$1'"
121 print_usage
122 exit 1
123 ;;
124 esac
125 shift
126 done
Manuel Pégourié-Gonnard85a41782014-10-24 12:47:26 +0200127
128 # sanitize some options (modes checked later)
129 VERIFIES="$( echo $VERIFIES | tr [a-z] [A-Z] )"
130 TYPES="$( echo $TYPES | tr [a-z] [A-Z] )"
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100131}
Paul Bakkeraccd4eb2013-07-19 13:41:51 +0200132
Manuel Pégourié-Gonnard95957712014-02-19 15:29:38 +0100133log() {
Paul Bakkeraccd4eb2013-07-19 13:41:51 +0200134 if [ "X" != "X$VERBOSE" ]; then
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100135 echo ""
Paul Bakkeraccd4eb2013-07-19 13:41:51 +0200136 echo "$@"
137 fi
138}
Paul Bakker10cd2252012-04-12 21:26:34 +0000139
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100140# is_dtls <mode>
141is_dtls()
142{
143 test "$1" = "dtls1" -o "$1" = "dtls1_2"
144}
145
146# minor_ver <mode>
147minor_ver()
148{
149 case "$1" in
150 ssl3)
151 echo 0
152 ;;
153 tls1)
154 echo 1
155 ;;
156 tls1_1|dtls1)
157 echo 2
158 ;;
159 tls1_2|dtls1_2)
160 echo 3
161 ;;
162 *)
163 echo "error: invalid mode: $MODE" >&2
164 # exiting is no good here, typically called in a subshell
165 echo -1
166 esac
167}
168
Manuel Pégourié-Gonnarddfc8d5a2013-08-27 20:48:40 +0200169filter()
170{
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +0100171 LIST="$1"
Manuel Pégourié-Gonnarddfc8d5a2013-08-27 20:48:40 +0200172 NEW_LIST=""
173
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100174 if is_dtls "$MODE"; then
Manuel Pégourié-Gonnard29980b12014-07-10 20:12:56 +0200175 EXCLMODE="$EXCLUDE"'\|RC4\|ARCFOUR'
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100176 else
177 EXCLMODE="$EXCLUDE"
178 fi
179
Manuel Pégourié-Gonnarddfc8d5a2013-08-27 20:48:40 +0200180 for i in $LIST;
181 do
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100182 NEW_LIST="$NEW_LIST $( echo "$i" | grep "$FILTER" | grep -v "$EXCLMODE" )"
Manuel Pégourié-Gonnarddfc8d5a2013-08-27 20:48:40 +0200183 done
184
Manuel Pégourié-Gonnard911622d2014-02-27 11:50:40 +0100185 # normalize whitespace
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +0100186 echo "$NEW_LIST" | sed -e 's/[[:space:]][[:space:]]*/ /g' -e 's/^ //' -e 's/ $//'
Manuel Pégourié-Gonnarddfc8d5a2013-08-27 20:48:40 +0200187}
188
Manuel Pégourié-Gonnard53aef812014-07-11 17:41:24 +0200189# OpenSSL 1.0.1h with -Verify wants a ClientCertificate message even for
190# PSK ciphersuites with DTLS, which is incorrect, so disable them for now
191check_openssl_server_bug()
192{
193 if test "X$VERIFY" = "XYES" && is_dtls "$MODE" && \
194 echo "$1" | grep "^TLS-PSK" >/dev/null;
195 then
196 SKIP_NEXT="YES"
197 fi
198}
199
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100200filter_ciphersuites()
201{
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +0100202 if [ "X" != "X$FILTER" -o "X" != "X$EXCLUDE" ];
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100203 then
Simon Butcherac22d112016-09-04 22:31:09 +0100204 # Ciphersuite for mbed TLS
205 M_CIPHERS=$( filter "$M_CIPHERS" )
206
207 # Ciphersuite for OpenSSL
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +0100208 O_CIPHERS=$( filter "$O_CIPHERS" )
Simon Butcherac22d112016-09-04 22:31:09 +0100209
210 # Ciphersuite for GnuTLS
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +0100211 G_CIPHERS=$( filter "$G_CIPHERS" )
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100212 fi
Manuel Pégourié-Gonnard29980b12014-07-10 20:12:56 +0200213
Gilles Peskine6ad89c22019-08-10 17:38:34 +0200214 # OpenSSL <1.0.2 doesn't support DTLS 1.2. Check what OpenSSL
215 # supports from the s_server help. (The s_client help isn't
216 # accurate as of 1.0.2g: it supports DTLS 1.2 but doesn't list it.
217 # But the s_server help seems to be accurate.)
218 if ! $OPENSSL_CMD s_server -help 2>&1 | grep -q "^ *-$MODE "; then
219 M_CIPHERS=""
Manuel Pégourié-Gonnard29980b12014-07-10 20:12:56 +0200220 O_CIPHERS=""
221 fi
222
Manuel Pégourié-Gonnarddba564b2015-01-23 11:33:38 +0000223 # For GnuTLS client -> mbed TLS server,
Manuel Pégourié-Gonnardd1af1022014-07-11 17:01:06 +0200224 # we need to force IPv4 by connecting to 127.0.0.1 but then auth fails
Manuel Pégourié-Gonnard29980b12014-07-10 20:12:56 +0200225 if [ "X$VERIFY" = "XYES" ] && is_dtls "$MODE"; then
226 G_CIPHERS=""
227 fi
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100228}
229
230reset_ciphersuites()
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100231{
Simon Butcherac22d112016-09-04 22:31:09 +0100232 M_CIPHERS=""
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100233 O_CIPHERS=""
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100234 G_CIPHERS=""
235}
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100236
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100237add_common_ciphersuites()
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100238{
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100239 case $TYPE in
240
241 "ECDSA")
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100242 if [ `minor_ver "$MODE"` -gt 0 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100243 then
Simon Butcherac22d112016-09-04 22:31:09 +0100244 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100245 TLS-ECDHE-ECDSA-WITH-NULL-SHA \
246 TLS-ECDHE-ECDSA-WITH-RC4-128-SHA \
247 TLS-ECDHE-ECDSA-WITH-3DES-EDE-CBC-SHA \
248 TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA \
249 TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100250 "
251 G_CIPHERS="$G_CIPHERS \
252 +ECDHE-ECDSA:+NULL:+SHA1 \
253 +ECDHE-ECDSA:+ARCFOUR-128:+SHA1 \
254 +ECDHE-ECDSA:+3DES-CBC:+SHA1 \
255 +ECDHE-ECDSA:+AES-128-CBC:+SHA1 \
256 +ECDHE-ECDSA:+AES-256-CBC:+SHA1 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100257 "
258 O_CIPHERS="$O_CIPHERS \
259 ECDHE-ECDSA-NULL-SHA \
260 ECDHE-ECDSA-RC4-SHA \
261 ECDHE-ECDSA-DES-CBC3-SHA \
262 ECDHE-ECDSA-AES128-SHA \
263 ECDHE-ECDSA-AES256-SHA \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100264 "
265 fi
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100266 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100267 then
Simon Butcherac22d112016-09-04 22:31:09 +0100268 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100269 TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 \
270 TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384 \
271 TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \
272 TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100273 "
274 G_CIPHERS="$G_CIPHERS \
275 +ECDHE-ECDSA:+AES-128-CBC:+SHA256 \
276 +ECDHE-ECDSA:+AES-256-CBC:+SHA384 \
277 +ECDHE-ECDSA:+AES-128-GCM:+AEAD \
278 +ECDHE-ECDSA:+AES-256-GCM:+AEAD \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100279 "
280 O_CIPHERS="$O_CIPHERS \
281 ECDHE-ECDSA-AES128-SHA256 \
282 ECDHE-ECDSA-AES256-SHA384 \
283 ECDHE-ECDSA-AES128-GCM-SHA256 \
284 ECDHE-ECDSA-AES256-GCM-SHA384 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100285 "
286 fi
287 ;;
288
289 "RSA")
Simon Butcherac22d112016-09-04 22:31:09 +0100290 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100291 TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
292 TLS-DHE-RSA-WITH-AES-256-CBC-SHA \
293 TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA \
294 TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA \
295 TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA \
296 TLS-RSA-WITH-AES-256-CBC-SHA \
297 TLS-RSA-WITH-CAMELLIA-256-CBC-SHA \
298 TLS-RSA-WITH-AES-128-CBC-SHA \
299 TLS-RSA-WITH-CAMELLIA-128-CBC-SHA \
300 TLS-RSA-WITH-3DES-EDE-CBC-SHA \
301 TLS-RSA-WITH-RC4-128-SHA \
302 TLS-RSA-WITH-RC4-128-MD5 \
303 TLS-RSA-WITH-NULL-MD5 \
304 TLS-RSA-WITH-NULL-SHA \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100305 "
306 G_CIPHERS="$G_CIPHERS \
307 +DHE-RSA:+AES-128-CBC:+SHA1 \
308 +DHE-RSA:+AES-256-CBC:+SHA1 \
309 +DHE-RSA:+CAMELLIA-128-CBC:+SHA1 \
310 +DHE-RSA:+CAMELLIA-256-CBC:+SHA1 \
311 +DHE-RSA:+3DES-CBC:+SHA1 \
312 +RSA:+AES-256-CBC:+SHA1 \
313 +RSA:+CAMELLIA-256-CBC:+SHA1 \
314 +RSA:+AES-128-CBC:+SHA1 \
315 +RSA:+CAMELLIA-128-CBC:+SHA1 \
316 +RSA:+3DES-CBC:+SHA1 \
317 +RSA:+ARCFOUR-128:+SHA1 \
318 +RSA:+ARCFOUR-128:+MD5 \
319 +RSA:+NULL:+MD5 \
320 +RSA:+NULL:+SHA1 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100321 "
322 O_CIPHERS="$O_CIPHERS \
323 DHE-RSA-AES128-SHA \
324 DHE-RSA-AES256-SHA \
325 DHE-RSA-CAMELLIA128-SHA \
326 DHE-RSA-CAMELLIA256-SHA \
327 EDH-RSA-DES-CBC3-SHA \
328 AES256-SHA \
329 CAMELLIA256-SHA \
330 AES128-SHA \
331 CAMELLIA128-SHA \
332 DES-CBC3-SHA \
333 RC4-SHA \
334 RC4-MD5 \
335 NULL-MD5 \
336 NULL-SHA \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100337 "
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100338 if [ `minor_ver "$MODE"` -gt 0 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100339 then
Simon Butcherac22d112016-09-04 22:31:09 +0100340 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100341 TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA \
342 TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA \
343 TLS-ECDHE-RSA-WITH-3DES-EDE-CBC-SHA \
344 TLS-ECDHE-RSA-WITH-RC4-128-SHA \
345 TLS-ECDHE-RSA-WITH-NULL-SHA \
346 "
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100347 G_CIPHERS="$G_CIPHERS \
348 +ECDHE-RSA:+AES-128-CBC:+SHA1 \
349 +ECDHE-RSA:+AES-256-CBC:+SHA1 \
350 +ECDHE-RSA:+3DES-CBC:+SHA1 \
351 +ECDHE-RSA:+ARCFOUR-128:+SHA1 \
352 +ECDHE-RSA:+NULL:+SHA1 \
353 "
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100354 O_CIPHERS="$O_CIPHERS \
355 ECDHE-RSA-AES256-SHA \
356 ECDHE-RSA-AES128-SHA \
357 ECDHE-RSA-DES-CBC3-SHA \
358 ECDHE-RSA-RC4-SHA \
359 ECDHE-RSA-NULL-SHA \
360 "
361 fi
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100362 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100363 then
Simon Butcherac22d112016-09-04 22:31:09 +0100364 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100365 TLS-RSA-WITH-AES-128-CBC-SHA256 \
366 TLS-DHE-RSA-WITH-AES-128-CBC-SHA256 \
367 TLS-RSA-WITH-AES-256-CBC-SHA256 \
368 TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 \
369 TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256 \
370 TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384 \
371 TLS-RSA-WITH-AES-128-GCM-SHA256 \
372 TLS-RSA-WITH-AES-256-GCM-SHA384 \
373 TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 \
374 TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 \
375 TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256 \
376 TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 \
377 "
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100378 G_CIPHERS="$G_CIPHERS \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100379 +RSA:+AES-128-CBC:+SHA256 \
380 +DHE-RSA:+AES-128-CBC:+SHA256 \
381 +RSA:+AES-256-CBC:+SHA256 \
382 +DHE-RSA:+AES-256-CBC:+SHA256 \
383 +ECDHE-RSA:+AES-128-CBC:+SHA256 \
384 +ECDHE-RSA:+AES-256-CBC:+SHA384 \
385 +RSA:+AES-128-GCM:+AEAD \
386 +RSA:+AES-256-GCM:+AEAD \
387 +DHE-RSA:+AES-128-GCM:+AEAD \
388 +DHE-RSA:+AES-256-GCM:+AEAD \
389 +ECDHE-RSA:+AES-128-GCM:+AEAD \
390 +ECDHE-RSA:+AES-256-GCM:+AEAD \
391 "
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100392 O_CIPHERS="$O_CIPHERS \
393 NULL-SHA256 \
394 AES128-SHA256 \
395 DHE-RSA-AES128-SHA256 \
396 AES256-SHA256 \
397 DHE-RSA-AES256-SHA256 \
398 ECDHE-RSA-AES128-SHA256 \
399 ECDHE-RSA-AES256-SHA384 \
400 AES128-GCM-SHA256 \
401 DHE-RSA-AES128-GCM-SHA256 \
402 AES256-GCM-SHA384 \
403 DHE-RSA-AES256-GCM-SHA384 \
404 ECDHE-RSA-AES128-GCM-SHA256 \
405 ECDHE-RSA-AES256-GCM-SHA384 \
406 "
407 fi
408 ;;
409
410 "PSK")
Simon Butcherac22d112016-09-04 22:31:09 +0100411 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100412 TLS-PSK-WITH-RC4-128-SHA \
413 TLS-PSK-WITH-3DES-EDE-CBC-SHA \
414 TLS-PSK-WITH-AES-128-CBC-SHA \
415 TLS-PSK-WITH-AES-256-CBC-SHA \
416 "
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100417 G_CIPHERS="$G_CIPHERS \
418 +PSK:+ARCFOUR-128:+SHA1 \
419 +PSK:+3DES-CBC:+SHA1 \
420 +PSK:+AES-128-CBC:+SHA1 \
421 +PSK:+AES-256-CBC:+SHA1 \
422 "
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100423 O_CIPHERS="$O_CIPHERS \
424 PSK-RC4-SHA \
425 PSK-3DES-EDE-CBC-SHA \
426 PSK-AES128-CBC-SHA \
427 PSK-AES256-CBC-SHA \
428 "
429 ;;
430 esac
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100431}
432
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100433add_openssl_ciphersuites()
434{
435 case $TYPE in
436
437 "ECDSA")
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100438 if [ `minor_ver "$MODE"` -gt 0 ]
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100439 then
Simon Butcherac22d112016-09-04 22:31:09 +0100440 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100441 TLS-ECDH-ECDSA-WITH-NULL-SHA \
442 TLS-ECDH-ECDSA-WITH-RC4-128-SHA \
443 TLS-ECDH-ECDSA-WITH-3DES-EDE-CBC-SHA \
444 TLS-ECDH-ECDSA-WITH-AES-128-CBC-SHA \
445 TLS-ECDH-ECDSA-WITH-AES-256-CBC-SHA \
446 "
447 O_CIPHERS="$O_CIPHERS \
448 ECDH-ECDSA-NULL-SHA \
449 ECDH-ECDSA-RC4-SHA \
450 ECDH-ECDSA-DES-CBC3-SHA \
451 ECDH-ECDSA-AES128-SHA \
452 ECDH-ECDSA-AES256-SHA \
453 "
454 fi
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100455 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100456 then
Simon Butcherac22d112016-09-04 22:31:09 +0100457 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100458 TLS-ECDH-ECDSA-WITH-AES-128-CBC-SHA256 \
459 TLS-ECDH-ECDSA-WITH-AES-256-CBC-SHA384 \
460 TLS-ECDH-ECDSA-WITH-AES-128-GCM-SHA256 \
461 TLS-ECDH-ECDSA-WITH-AES-256-GCM-SHA384 \
462 "
463 O_CIPHERS="$O_CIPHERS \
464 ECDH-ECDSA-AES128-SHA256 \
465 ECDH-ECDSA-AES256-SHA384 \
466 ECDH-ECDSA-AES128-GCM-SHA256 \
467 ECDH-ECDSA-AES256-GCM-SHA384 \
468 "
469 fi
470 ;;
471
472 "RSA")
Simon Butcherac22d112016-09-04 22:31:09 +0100473 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +0100474 TLS-RSA-WITH-DES-CBC-SHA \
475 TLS-DHE-RSA-WITH-DES-CBC-SHA \
476 "
477 O_CIPHERS="$O_CIPHERS \
478 DES-CBC-SHA \
479 EDH-RSA-DES-CBC-SHA \
480 "
481 ;;
482
483 "PSK")
484 ;;
485 esac
486}
487
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100488add_gnutls_ciphersuites()
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100489{
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100490 case $TYPE in
491
492 "ECDSA")
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100493 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100494 then
Simon Butcherac22d112016-09-04 22:31:09 +0100495 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100496 TLS-ECDHE-ECDSA-WITH-CAMELLIA-128-CBC-SHA256 \
497 TLS-ECDHE-ECDSA-WITH-CAMELLIA-256-CBC-SHA384 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100498 TLS-ECDHE-ECDSA-WITH-CAMELLIA-128-GCM-SHA256 \
499 TLS-ECDHE-ECDSA-WITH-CAMELLIA-256-GCM-SHA384 \
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100500 "
501 G_CIPHERS="$G_CIPHERS \
502 +ECDHE-ECDSA:+CAMELLIA-128-CBC:+SHA256 \
503 +ECDHE-ECDSA:+CAMELLIA-256-CBC:+SHA384 \
504 +ECDHE-ECDSA:+CAMELLIA-128-GCM:+AEAD \
505 +ECDHE-ECDSA:+CAMELLIA-256-GCM:+AEAD \
506 "
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100507 fi
508 ;;
509
510 "RSA")
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100511 if [ `minor_ver "$MODE"` -gt 0 ]
Manuel Pégourié-Gonnard7457cb32014-07-13 13:57:24 +0200512 then
Simon Butcherac22d112016-09-04 22:31:09 +0100513 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard7457cb32014-07-13 13:57:24 +0200514 TLS-RSA-WITH-NULL-SHA256 \
515 "
516 G_CIPHERS="$G_CIPHERS \
517 +RSA:+NULL:+SHA256 \
518 "
519 fi
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100520 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100521 then
Simon Butcherac22d112016-09-04 22:31:09 +0100522 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100523 TLS-ECDHE-RSA-WITH-CAMELLIA-128-CBC-SHA256 \
524 TLS-ECDHE-RSA-WITH-CAMELLIA-256-CBC-SHA384 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100525 TLS-RSA-WITH-CAMELLIA-128-CBC-SHA256 \
526 TLS-RSA-WITH-CAMELLIA-256-CBC-SHA256 \
527 TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA256 \
528 TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA256 \
529 TLS-ECDHE-RSA-WITH-CAMELLIA-128-GCM-SHA256 \
530 TLS-ECDHE-RSA-WITH-CAMELLIA-256-GCM-SHA384 \
531 TLS-DHE-RSA-WITH-CAMELLIA-128-GCM-SHA256 \
532 TLS-DHE-RSA-WITH-CAMELLIA-256-GCM-SHA384 \
533 TLS-RSA-WITH-CAMELLIA-128-GCM-SHA256 \
534 TLS-RSA-WITH-CAMELLIA-256-GCM-SHA384 \
535 "
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100536 G_CIPHERS="$G_CIPHERS \
537 +ECDHE-RSA:+CAMELLIA-128-CBC:+SHA256 \
538 +ECDHE-RSA:+CAMELLIA-256-CBC:+SHA384 \
539 +RSA:+CAMELLIA-128-CBC:+SHA256 \
540 +RSA:+CAMELLIA-256-CBC:+SHA256 \
541 +DHE-RSA:+CAMELLIA-128-CBC:+SHA256 \
542 +DHE-RSA:+CAMELLIA-256-CBC:+SHA256 \
543 +ECDHE-RSA:+CAMELLIA-128-GCM:+AEAD \
544 +ECDHE-RSA:+CAMELLIA-256-GCM:+AEAD \
545 +DHE-RSA:+CAMELLIA-128-GCM:+AEAD \
546 +DHE-RSA:+CAMELLIA-256-GCM:+AEAD \
547 +RSA:+CAMELLIA-128-GCM:+AEAD \
548 +RSA:+CAMELLIA-256-GCM:+AEAD \
549 "
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100550 fi
551 ;;
552
553 "PSK")
Simon Butcherac22d112016-09-04 22:31:09 +0100554 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnarde46aa5e2014-07-13 15:44:19 +0200555 TLS-DHE-PSK-WITH-3DES-EDE-CBC-SHA \
556 TLS-DHE-PSK-WITH-AES-128-CBC-SHA \
557 TLS-DHE-PSK-WITH-AES-256-CBC-SHA \
558 TLS-DHE-PSK-WITH-RC4-128-SHA \
559 "
560 G_CIPHERS="$G_CIPHERS \
561 +DHE-PSK:+3DES-CBC:+SHA1 \
562 +DHE-PSK:+AES-128-CBC:+SHA1 \
563 +DHE-PSK:+AES-256-CBC:+SHA1 \
564 +DHE-PSK:+ARCFOUR-128:+SHA1 \
565 "
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100566 if [ `minor_ver "$MODE"` -gt 0 ]
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100567 then
Simon Butcherac22d112016-09-04 22:31:09 +0100568 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100569 TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA \
570 TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA \
571 TLS-ECDHE-PSK-WITH-3DES-EDE-CBC-SHA \
Manuel Pégourié-Gonnarde46aa5e2014-07-13 15:44:19 +0200572 TLS-ECDHE-PSK-WITH-RC4-128-SHA \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100573 TLS-RSA-PSK-WITH-3DES-EDE-CBC-SHA \
574 TLS-RSA-PSK-WITH-AES-256-CBC-SHA \
575 TLS-RSA-PSK-WITH-AES-128-CBC-SHA \
Manuel Pégourié-Gonnarde46aa5e2014-07-13 15:44:19 +0200576 TLS-RSA-PSK-WITH-RC4-128-SHA \
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100577 "
578 G_CIPHERS="$G_CIPHERS \
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100579 +ECDHE-PSK:+3DES-CBC:+SHA1 \
Manuel Pégourié-Gonnarde46aa5e2014-07-13 15:44:19 +0200580 +ECDHE-PSK:+AES-128-CBC:+SHA1 \
581 +ECDHE-PSK:+AES-256-CBC:+SHA1 \
582 +ECDHE-PSK:+ARCFOUR-128:+SHA1 \
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100583 +RSA-PSK:+3DES-CBC:+SHA1 \
584 +RSA-PSK:+AES-256-CBC:+SHA1 \
585 +RSA-PSK:+AES-128-CBC:+SHA1 \
Manuel Pégourié-Gonnarde46aa5e2014-07-13 15:44:19 +0200586 +RSA-PSK:+ARCFOUR-128:+SHA1 \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100587 "
588 fi
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100589 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100590 then
Simon Butcherac22d112016-09-04 22:31:09 +0100591 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100592 TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384 \
593 TLS-ECDHE-PSK-WITH-CAMELLIA-256-CBC-SHA384 \
594 TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 \
595 TLS-ECDHE-PSK-WITH-CAMELLIA-128-CBC-SHA256 \
596 TLS-ECDHE-PSK-WITH-NULL-SHA384 \
597 TLS-ECDHE-PSK-WITH-NULL-SHA256 \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100598 TLS-PSK-WITH-AES-128-CBC-SHA256 \
599 TLS-PSK-WITH-AES-256-CBC-SHA384 \
600 TLS-DHE-PSK-WITH-AES-128-CBC-SHA256 \
601 TLS-DHE-PSK-WITH-AES-256-CBC-SHA384 \
602 TLS-PSK-WITH-NULL-SHA256 \
603 TLS-PSK-WITH-NULL-SHA384 \
604 TLS-DHE-PSK-WITH-NULL-SHA256 \
605 TLS-DHE-PSK-WITH-NULL-SHA384 \
606 TLS-RSA-PSK-WITH-AES-256-CBC-SHA384 \
607 TLS-RSA-PSK-WITH-AES-128-CBC-SHA256 \
608 TLS-RSA-PSK-WITH-NULL-SHA256 \
609 TLS-RSA-PSK-WITH-NULL-SHA384 \
610 TLS-DHE-PSK-WITH-CAMELLIA-128-CBC-SHA256 \
611 TLS-DHE-PSK-WITH-CAMELLIA-256-CBC-SHA384 \
612 TLS-PSK-WITH-CAMELLIA-128-CBC-SHA256 \
613 TLS-PSK-WITH-CAMELLIA-256-CBC-SHA384 \
614 TLS-RSA-PSK-WITH-CAMELLIA-256-CBC-SHA384 \
615 TLS-RSA-PSK-WITH-CAMELLIA-128-CBC-SHA256 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100616 TLS-PSK-WITH-AES-128-GCM-SHA256 \
617 TLS-PSK-WITH-AES-256-GCM-SHA384 \
618 TLS-DHE-PSK-WITH-AES-128-GCM-SHA256 \
619 TLS-DHE-PSK-WITH-AES-256-GCM-SHA384 \
620 TLS-RSA-PSK-WITH-CAMELLIA-128-GCM-SHA256 \
621 TLS-RSA-PSK-WITH-CAMELLIA-256-GCM-SHA384 \
622 TLS-PSK-WITH-CAMELLIA-128-GCM-SHA256 \
623 TLS-PSK-WITH-CAMELLIA-256-GCM-SHA384 \
624 TLS-DHE-PSK-WITH-CAMELLIA-128-GCM-SHA256 \
625 TLS-DHE-PSK-WITH-CAMELLIA-256-GCM-SHA384 \
626 TLS-RSA-PSK-WITH-AES-256-GCM-SHA384 \
627 TLS-RSA-PSK-WITH-AES-128-GCM-SHA256 \
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100628 "
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100629 G_CIPHERS="$G_CIPHERS \
630 +ECDHE-PSK:+AES-256-CBC:+SHA384 \
631 +ECDHE-PSK:+CAMELLIA-256-CBC:+SHA384 \
632 +ECDHE-PSK:+AES-128-CBC:+SHA256 \
633 +ECDHE-PSK:+CAMELLIA-128-CBC:+SHA256 \
634 +PSK:+AES-128-CBC:+SHA256 \
635 +PSK:+AES-256-CBC:+SHA384 \
636 +DHE-PSK:+AES-128-CBC:+SHA256 \
637 +DHE-PSK:+AES-256-CBC:+SHA384 \
638 +RSA-PSK:+AES-256-CBC:+SHA384 \
639 +RSA-PSK:+AES-128-CBC:+SHA256 \
640 +DHE-PSK:+CAMELLIA-128-CBC:+SHA256 \
641 +DHE-PSK:+CAMELLIA-256-CBC:+SHA384 \
642 +PSK:+CAMELLIA-128-CBC:+SHA256 \
643 +PSK:+CAMELLIA-256-CBC:+SHA384 \
644 +RSA-PSK:+CAMELLIA-256-CBC:+SHA384 \
645 +RSA-PSK:+CAMELLIA-128-CBC:+SHA256 \
646 +PSK:+AES-128-GCM:+AEAD \
647 +PSK:+AES-256-GCM:+AEAD \
648 +DHE-PSK:+AES-128-GCM:+AEAD \
649 +DHE-PSK:+AES-256-GCM:+AEAD \
650 +RSA-PSK:+CAMELLIA-128-GCM:+AEAD \
651 +RSA-PSK:+CAMELLIA-256-GCM:+AEAD \
652 +PSK:+CAMELLIA-128-GCM:+AEAD \
653 +PSK:+CAMELLIA-256-GCM:+AEAD \
654 +DHE-PSK:+CAMELLIA-128-GCM:+AEAD \
655 +DHE-PSK:+CAMELLIA-256-GCM:+AEAD \
656 +RSA-PSK:+AES-256-GCM:+AEAD \
657 +RSA-PSK:+AES-128-GCM:+AEAD \
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +0100658 +ECDHE-PSK:+NULL:+SHA384 \
659 +ECDHE-PSK:+NULL:+SHA256 \
660 +PSK:+NULL:+SHA256 \
661 +PSK:+NULL:+SHA384 \
662 +DHE-PSK:+NULL:+SHA256 \
663 +DHE-PSK:+NULL:+SHA384 \
664 +RSA-PSK:+NULL:+SHA256 \
665 +RSA-PSK:+NULL:+SHA384 \
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100666 "
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100667 fi
668 ;;
669 esac
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100670}
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100671
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200672add_mbedtls_ciphersuites()
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100673{
674 case $TYPE in
675
676 "ECDSA")
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100677 if [ `minor_ver "$MODE"` -gt 0 ]
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100678 then
Simon Butcherac22d112016-09-04 22:31:09 +0100679 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100680 TLS-ECDH-ECDSA-WITH-CAMELLIA-128-CBC-SHA256 \
681 TLS-ECDH-ECDSA-WITH-CAMELLIA-256-CBC-SHA384 \
682 "
683 fi
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100684 if [ `minor_ver "$MODE"` -ge 3 ]
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100685 then
Simon Butcherac22d112016-09-04 22:31:09 +0100686 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100687 TLS-ECDH-ECDSA-WITH-CAMELLIA-128-GCM-SHA256 \
688 TLS-ECDH-ECDSA-WITH-CAMELLIA-256-GCM-SHA384 \
Manuel Pégourié-Gonnard25948592014-05-22 14:36:02 +0200689 TLS-ECDHE-ECDSA-WITH-AES-128-CCM \
690 TLS-ECDHE-ECDSA-WITH-AES-256-CCM \
691 TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8 \
692 TLS-ECDHE-ECDSA-WITH-AES-256-CCM-8 \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100693 "
694 fi
695 ;;
696
697 "RSA")
Manuel Pégourié-Gonnard25948592014-05-22 14:36:02 +0200698 if [ "$MODE" = "tls1_2" ];
699 then
Simon Butcherac22d112016-09-04 22:31:09 +0100700 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard25948592014-05-22 14:36:02 +0200701 TLS-RSA-WITH-AES-128-CCM \
702 TLS-RSA-WITH-AES-256-CCM \
703 TLS-DHE-RSA-WITH-AES-128-CCM \
704 TLS-DHE-RSA-WITH-AES-256-CCM \
705 TLS-RSA-WITH-AES-128-CCM-8 \
706 TLS-RSA-WITH-AES-256-CCM-8 \
707 TLS-DHE-RSA-WITH-AES-128-CCM-8 \
708 TLS-DHE-RSA-WITH-AES-256-CCM-8 \
709 "
710 fi
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100711 ;;
712
713 "PSK")
Manuel Pégourié-Gonnard7eb58cb2015-07-07 11:54:14 +0200714 # *PSK-NULL-SHA suites supported by GnuTLS 3.3.5 but not 3.2.15
Simon Butcherac22d112016-09-04 22:31:09 +0100715 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100716 TLS-PSK-WITH-NULL-SHA \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100717 TLS-DHE-PSK-WITH-NULL-SHA \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100718 "
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100719 if [ `minor_ver "$MODE"` -gt 0 ]
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100720 then
Simon Butcherac22d112016-09-04 22:31:09 +0100721 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100722 TLS-ECDHE-PSK-WITH-NULL-SHA \
Manuel Pégourié-Gonnarde46aa5e2014-07-13 15:44:19 +0200723 TLS-RSA-PSK-WITH-NULL-SHA \
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100724 "
725 fi
Manuel Pégourié-Gonnard25948592014-05-22 14:36:02 +0200726 if [ "$MODE" = "tls1_2" ];
727 then
Simon Butcherac22d112016-09-04 22:31:09 +0100728 M_CIPHERS="$M_CIPHERS \
Manuel Pégourié-Gonnard25948592014-05-22 14:36:02 +0200729 TLS-PSK-WITH-AES-128-CCM \
730 TLS-PSK-WITH-AES-256-CCM \
731 TLS-DHE-PSK-WITH-AES-128-CCM \
732 TLS-DHE-PSK-WITH-AES-256-CCM \
733 TLS-PSK-WITH-AES-128-CCM-8 \
734 TLS-PSK-WITH-AES-256-CCM-8 \
735 TLS-DHE-PSK-WITH-AES-128-CCM-8 \
736 TLS-DHE-PSK-WITH-AES-256-CCM-8 \
737 "
738 fi
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100739 ;;
740 esac
Manuel Pégourié-Gonnard48f196c2014-02-19 13:51:58 +0100741}
742
Manuel Pégourié-Gonnardd941a792014-02-19 13:35:52 +0100743setup_arguments()
744{
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100745 G_MODE=""
746 case "$MODE" in
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100747 "ssl3")
748 G_PRIO_MODE="+VERS-SSL3.0"
749 ;;
750 "tls1")
751 G_PRIO_MODE="+VERS-TLS1.0"
752 ;;
753 "tls1_1")
754 G_PRIO_MODE="+VERS-TLS1.1"
755 ;;
756 "tls1_2")
757 G_PRIO_MODE="+VERS-TLS1.2"
Manuel Pégourié-Gonnard9ada01a2014-02-19 14:24:24 +0100758 ;;
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100759 "dtls1")
760 G_PRIO_MODE="+VERS-DTLS1.0"
Manuel Pégourié-Gonnard36795192014-09-26 16:33:45 +0200761 G_MODE="-u"
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100762 ;;
763 "dtls1_2")
764 G_PRIO_MODE="+VERS-DTLS1.2"
Manuel Pégourié-Gonnard36795192014-09-26 16:33:45 +0200765 G_MODE="-u"
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100766 ;;
Manuel Pégourié-Gonnard9ada01a2014-02-19 14:24:24 +0100767 *)
768 echo "error: invalid mode: $MODE" >&2
769 exit 1;
770 esac
771
Simon Butcherac22d112016-09-04 22:31:09 +0100772 M_SERVER_ARGS="server_port=$PORT server_addr=0.0.0.0 force_version=$MODE arc4=1"
Manuel Pégourié-Gonnard61957672015-06-18 17:54:58 +0200773 O_SERVER_ARGS="-accept $PORT -cipher NULL,ALL -$MODE -dhparam data_files/dhparams.pem"
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100774 G_SERVER_ARGS="-p $PORT --http $G_MODE"
Manuel Pégourié-Gonnardf52248a2015-04-30 12:15:16 +0200775 G_SERVER_PRIO="NORMAL:+ARCFOUR-128:+NULL:+MD5:+PSK:+DHE-PSK:+ECDHE-PSK:+RSA-PSK:-VERS-TLS-ALL:$G_PRIO_MODE"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100776
Manuel Pégourié-Gonnardd1af1022014-07-11 17:01:06 +0200777 # with OpenSSL 1.0.1h, -www, -WWW and -HTTP break DTLS handshakes
778 if is_dtls "$MODE"; then
Manuel Pégourié-Gonnard36795192014-09-26 16:33:45 +0200779 O_SERVER_ARGS="$O_SERVER_ARGS"
Manuel Pégourié-Gonnardd1af1022014-07-11 17:01:06 +0200780 else
781 O_SERVER_ARGS="$O_SERVER_ARGS -www"
782 fi
783
Simon Butcherac22d112016-09-04 22:31:09 +0100784 M_CLIENT_ARGS="server_port=$PORT server_addr=127.0.0.1 force_version=$MODE"
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +0200785 O_CLIENT_ARGS="-connect localhost:$PORT -$MODE"
Manuel Pégourié-Gonnard3025b6c2014-03-26 15:30:16 +0100786 G_CLIENT_ARGS="-p $PORT --debug 3 $G_MODE"
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100787 G_CLIENT_PRIO="NONE:$G_PRIO_MODE:+COMP-NULL:+CURVE-ALL:+SIGN-ALL"
Manuel Pégourié-Gonnard9ada01a2014-02-19 14:24:24 +0100788
Manuel Pégourié-Gonnardd941a792014-02-19 13:35:52 +0100789 if [ "X$VERIFY" = "XYES" ];
790 then
Simon Butcherac22d112016-09-04 22:31:09 +0100791 M_SERVER_ARGS="$M_SERVER_ARGS ca_file=data_files/test-ca_cat12.crt auth_mode=required"
Manuel Pégourié-Gonnard9ada01a2014-02-19 14:24:24 +0100792 O_SERVER_ARGS="$O_SERVER_ARGS -CAfile data_files/test-ca_cat12.crt -Verify 10"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100793 G_SERVER_ARGS="$G_SERVER_ARGS --x509cafile data_files/test-ca_cat12.crt --require-client-cert"
794
Simon Butcherac22d112016-09-04 22:31:09 +0100795 M_CLIENT_ARGS="$M_CLIENT_ARGS ca_file=data_files/test-ca_cat12.crt auth_mode=required"
Manuel Pégourié-Gonnardda782c92014-02-21 10:10:20 +0100796 O_CLIENT_ARGS="$O_CLIENT_ARGS -CAfile data_files/test-ca_cat12.crt -verify 10"
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100797 G_CLIENT_ARGS="$G_CLIENT_ARGS --x509cafile data_files/test-ca_cat12.crt"
Manuel Pégourié-Gonnardda782c92014-02-21 10:10:20 +0100798 else
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100799 # don't request a client cert at all
Simon Butcherac22d112016-09-04 22:31:09 +0100800 M_SERVER_ARGS="$M_SERVER_ARGS ca_file=none auth_mode=none"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100801 G_SERVER_ARGS="$G_SERVER_ARGS --disable-client-cert"
802
Simon Butcherac22d112016-09-04 22:31:09 +0100803 M_CLIENT_ARGS="$M_CLIENT_ARGS ca_file=none auth_mode=none"
Manuel Pégourié-Gonnard5de31ec2014-03-19 17:34:52 +0100804 O_CLIENT_ARGS="$O_CLIENT_ARGS"
805 G_CLIENT_ARGS="$G_CLIENT_ARGS --insecure"
Manuel Pégourié-Gonnardd941a792014-02-19 13:35:52 +0100806 fi
807
808 case $TYPE in
809 "ECDSA")
Simon Butcherac22d112016-09-04 22:31:09 +0100810 M_SERVER_ARGS="$M_SERVER_ARGS crt_file=data_files/server5.crt key_file=data_files/server5.key"
Manuel Pégourié-Gonnard9ada01a2014-02-19 14:24:24 +0100811 O_SERVER_ARGS="$O_SERVER_ARGS -cert data_files/server5.crt -key data_files/server5.key"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100812 G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key"
813
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +0100814 if [ "X$VERIFY" = "XYES" ]; then
Simon Butcherac22d112016-09-04 22:31:09 +0100815 M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=data_files/server6.crt key_file=data_files/server6.key"
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +0100816 O_CLIENT_ARGS="$O_CLIENT_ARGS -cert data_files/server6.crt -key data_files/server6.key"
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100817 G_CLIENT_ARGS="$G_CLIENT_ARGS --x509certfile data_files/server6.crt --x509keyfile data_files/server6.key"
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +0100818 else
Simon Butcherac22d112016-09-04 22:31:09 +0100819 M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=none key_file=none"
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +0100820 fi
Manuel Pégourié-Gonnardd941a792014-02-19 13:35:52 +0100821 ;;
822
823 "RSA")
Simon Butcherac22d112016-09-04 22:31:09 +0100824 M_SERVER_ARGS="$M_SERVER_ARGS crt_file=data_files/server2.crt key_file=data_files/server2.key"
Manuel Pégourié-Gonnardda782c92014-02-21 10:10:20 +0100825 O_SERVER_ARGS="$O_SERVER_ARGS -cert data_files/server2.crt -key data_files/server2.key"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100826 G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server2.crt --x509keyfile data_files/server2.key"
827
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +0100828 if [ "X$VERIFY" = "XYES" ]; then
Simon Butcherac22d112016-09-04 22:31:09 +0100829 M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=data_files/server1.crt key_file=data_files/server1.key"
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +0100830 O_CLIENT_ARGS="$O_CLIENT_ARGS -cert data_files/server1.crt -key data_files/server1.key"
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100831 G_CLIENT_ARGS="$G_CLIENT_ARGS --x509certfile data_files/server1.crt --x509keyfile data_files/server1.key"
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +0100832 else
Simon Butcherac22d112016-09-04 22:31:09 +0100833 M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=none key_file=none"
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +0100834 fi
Gilles Peskine62469d92017-05-10 10:13:59 +0200835
836 # Allow SHA-1. It's disabled by default for security reasons but
837 # our tests still use certificates signed with it.
838 M_SERVER_ARGS="$M_SERVER_ARGS allow_sha1=1"
839 M_CLIENT_ARGS="$M_CLIENT_ARGS allow_sha1=1"
Manuel Pégourié-Gonnardd941a792014-02-19 13:35:52 +0100840 ;;
841
842 "PSK")
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100843 # give RSA-PSK-capable server a RSA cert
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +0100844 # (should be a separate type, but harder to close with openssl)
Simon Butcherac22d112016-09-04 22:31:09 +0100845 M_SERVER_ARGS="$M_SERVER_ARGS psk=6162636465666768696a6b6c6d6e6f70 ca_file=none crt_file=data_files/server2.crt key_file=data_files/server2.key"
Manuel Pégourié-Gonnard1b149ef2014-02-27 14:38:29 +0100846 O_SERVER_ARGS="$O_SERVER_ARGS -psk 6162636465666768696a6b6c6d6e6f70 -nocert"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100847 G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server2.crt --x509keyfile data_files/server2.key --pskpasswd data_files/passwd.psk"
848
Simon Butcherac22d112016-09-04 22:31:09 +0100849 M_CLIENT_ARGS="$M_CLIENT_ARGS psk=6162636465666768696a6b6c6d6e6f70 crt_file=none key_file=none"
Manuel Pégourié-Gonnard9ada01a2014-02-19 14:24:24 +0100850 O_CLIENT_ARGS="$O_CLIENT_ARGS -psk 6162636465666768696a6b6c6d6e6f70"
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +0100851 G_CLIENT_ARGS="$G_CLIENT_ARGS --pskusername Client_identity --pskkey=6162636465666768696a6b6c6d6e6f70"
Gilles Peskine62469d92017-05-10 10:13:59 +0200852
853 # Allow SHA-1. It's disabled by default for security reasons but
854 # our tests still use certificates signed with it.
855 M_SERVER_ARGS="$M_SERVER_ARGS allow_sha1=1"
856 M_CLIENT_ARGS="$M_CLIENT_ARGS allow_sha1=1"
Manuel Pégourié-Gonnardd941a792014-02-19 13:35:52 +0100857 ;;
858 esac
859}
860
Simon Butcherac22d112016-09-04 22:31:09 +0100861# is_mbedtls <cmd_line>
862is_mbedtls() {
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100863 echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null
864}
865
866# has_mem_err <log_file_name>
867has_mem_err() {
868 if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" &&
869 grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null
870 then
871 return 1 # false: does not have errors
872 else
873 return 0 # true: has errors
874 fi
875}
876
Gilles Peskine12c49c72017-12-14 19:02:00 +0100877# Wait for process $2 to be listening on port $1
878if type lsof >/dev/null 2>/dev/null; then
879 wait_server_start() {
880 START_TIME=$(date +%s)
881 if is_dtls "$MODE"; then
882 proto=UDP
883 else
884 proto=TCP
885 fi
886 while ! lsof -a -n -b -i "$proto:$1" -p "$2" >/dev/null 2>/dev/null; do
887 if [ $(( $(date +%s) - $START_TIME )) -gt $DOG_DELAY ]; then
888 echo "SERVERSTART TIMEOUT"
889 echo "SERVERSTART TIMEOUT" >> $SRV_OUT
890 break
891 fi
892 # Linux and *BSD support decimal arguments to sleep. On other
893 # OSes this may be a tight loop.
894 sleep 0.1 2>/dev/null || true
895 done
896 }
897else
Gilles Peskine3c9e2b52018-01-08 12:38:15 +0100898 echo "Warning: lsof not available, wait_server_start = sleep"
Gilles Peskine12c49c72017-12-14 19:02:00 +0100899 wait_server_start() {
Manuel Pégourié-Gonnard0d225da2018-01-22 10:22:09 +0100900 sleep 2
Gilles Peskine12c49c72017-12-14 19:02:00 +0100901 }
902fi
903
904
Manuel Pégourié-Gonnard304beef2014-02-19 14:45:00 +0100905# start_server <name>
906# also saves name and command
907start_server() {
Manuel Pégourié-Gonnard304beef2014-02-19 14:45:00 +0100908 case $1 in
909 [Oo]pen*)
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +0100910 SERVER_CMD="$OPENSSL_CMD s_server $O_SERVER_ARGS"
Manuel Pégourié-Gonnard304beef2014-02-19 14:45:00 +0100911 ;;
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100912 [Gg]nu*)
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +0100913 SERVER_CMD="$GNUTLS_SERV $G_SERVER_ARGS --priority $G_SERVER_PRIO"
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +0100914 ;;
Manuel Pégourié-Gonnarda8f3b752015-01-22 17:05:05 +0000915 mbed*)
Simon Butcherac22d112016-09-04 22:31:09 +0100916 SERVER_CMD="$M_SRV $M_SERVER_ARGS"
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100917 if [ "$MEMCHECK" -gt 0 ]; then
918 SERVER_CMD="valgrind --leak-check=full $SERVER_CMD"
919 fi
Manuel Pégourié-Gonnard304beef2014-02-19 14:45:00 +0100920 ;;
921 *)
922 echo "error: invalid server name: $1" >&2
923 exit 1
924 ;;
925 esac
926 SERVER_NAME=$1
927
928 log "$SERVER_CMD"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200929 echo "$SERVER_CMD" > $SRV_OUT
Manuel Pégourié-Gonnardd1af1022014-07-11 17:01:06 +0200930 # for servers without -www or equivalent
Manuel Pégourié-Gonnard82cf0a12015-02-09 13:05:54 +0000931 while :; do echo bla; sleep 1; done | $SERVER_CMD >> $SRV_OUT 2>&1 &
Manuel Pégourié-Gonnard304beef2014-02-19 14:45:00 +0100932 PROCESS_ID=$!
933
Gilles Peskine12c49c72017-12-14 19:02:00 +0100934 wait_server_start "$PORT" "$PROCESS_ID"
Manuel Pégourié-Gonnard304beef2014-02-19 14:45:00 +0100935}
936
Manuel Pégourié-Gonnard16494492014-08-31 10:37:14 +0200937# terminate the running server
Manuel Pégourié-Gonnard95957712014-02-19 15:29:38 +0100938stop_server() {
Manuel Pégourié-Gonnard74b11702014-08-14 15:47:33 +0200939 kill $PROCESS_ID 2>/dev/null
940 wait $PROCESS_ID 2>/dev/null
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100941
942 if [ "$MEMCHECK" -gt 0 ]; then
Simon Butcherac22d112016-09-04 22:31:09 +0100943 if is_mbedtls "$SERVER_CMD" && has_mem_err $SRV_OUT; then
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100944 echo " ! Server had memory errors"
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200945 SRVMEM=$(( $SRVMEM + 1 ))
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100946 return
947 fi
948 fi
949
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200950 rm -f $SRV_OUT
Manuel Pégourié-Gonnard95957712014-02-19 15:29:38 +0100951}
952
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100953# kill the running server (used when killed by signal)
954cleanup() {
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200955 rm -f $SRV_OUT $CLI_OUT
Manuel Pégourié-Gonnard16494492014-08-31 10:37:14 +0200956 kill $PROCESS_ID >/dev/null 2>&1
957 kill $WATCHDOG_PID >/dev/null 2>&1
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100958 exit 1
959}
960
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200961# wait for client to terminate and set EXIT
962# must be called right after starting the client
963wait_client_done() {
964 CLI_PID=$!
965
966 ( sleep "$DOG_DELAY"; echo "TIMEOUT" >> $CLI_OUT; kill $CLI_PID ) &
967 WATCHDOG_PID=$!
968
969 wait $CLI_PID
970 EXIT=$?
971
972 kill $WATCHDOG_PID
973 wait $WATCHDOG_PID
974
975 echo "EXIT: $EXIT" >> $CLI_OUT
976}
977
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +0100978# run_client <name> <cipher>
979run_client() {
Manuel Pégourié-Gonnard87ae3032014-02-27 11:12:30 +0100980 # announce what we're going to do
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200981 TESTS=$(( $TESTS + 1 ))
Manuel Pégourié-Gonnard87ae3032014-02-27 11:12:30 +0100982 VERIF=$(echo $VERIFY | tr '[:upper:]' '[:lower:]')
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200983 TITLE="`echo $1 | head -c1`->`echo $SERVER_NAME | head -c1`"
984 TITLE="$TITLE $MODE,$VERIF $2"
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +0100985 printf "$TITLE "
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200986 LEN=$(( 72 - `echo "$TITLE" | wc -c` ))
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +0100987 for i in `seq 1 $LEN`; do printf '.'; done; printf ' '
Manuel Pégourié-Gonnard87ae3032014-02-27 11:12:30 +0100988
Manuel Pégourié-Gonnard53aef812014-07-11 17:41:24 +0200989 # should we skip?
990 if [ "X$SKIP_NEXT" = "XYES" ]; then
991 SKIP_NEXT="NO"
992 echo "SKIP"
993 SKIPPED=$(( $SKIPPED + 1 ))
994 return
995 fi
996
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +0100997 # run the command and interpret result
998 case $1 in
999 [Oo]pen*)
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +01001000 CLIENT_CMD="$OPENSSL_CMD s_client $O_CLIENT_ARGS -cipher $2"
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001001 log "$CLIENT_CMD"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001002 echo "$CLIENT_CMD" > $CLI_OUT
Manuel Pégourié-Gonnard9afdc832015-08-04 17:15:13 +02001003 printf 'GET HTTP/1.0\r\n\r\n' | $CLIENT_CMD >> $CLI_OUT 2>&1 &
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +02001004 wait_client_done
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001005
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001006 if [ $EXIT -eq 0 ]; then
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001007 RESULT=0
1008 else
Simon Butcherbb5e1c32018-06-08 11:14:43 +01001009 # If the cipher isn't supported...
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001010 if grep 'Cipher is (NONE)' $CLI_OUT >/dev/null; then
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001011 RESULT=1
1012 else
1013 RESULT=2
1014 fi
1015 fi
1016 ;;
1017
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +01001018 [Gg]nu*)
Manuel Pégourié-Gonnard29980b12014-07-10 20:12:56 +02001019 # need to force IPv4 with UDP, but keep localhost for auth
1020 if is_dtls "$MODE"; then
1021 G_HOST="127.0.0.1"
1022 else
1023 G_HOST="localhost"
1024 fi
1025 CLIENT_CMD="$GNUTLS_CLI $G_CLIENT_ARGS --priority $G_PRIO_MODE:$2 $G_HOST"
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +01001026 log "$CLIENT_CMD"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001027 echo "$CLIENT_CMD" > $CLI_OUT
Manuel Pégourié-Gonnard9afdc832015-08-04 17:15:13 +02001028 printf 'GET HTTP/1.0\r\n\r\n' | $CLIENT_CMD >> $CLI_OUT 2>&1 &
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +02001029 wait_client_done
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +01001030
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001031 if [ $EXIT -eq 0 ]; then
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +01001032 RESULT=0
1033 else
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001034 RESULT=2
1035 # interpret early failure, with a handshake_failure alert
1036 # before the server hello, as "no ciphersuite in common"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001037 if grep -F 'Received alert [40]: Handshake failed' $CLI_OUT; then
1038 if grep -i 'SERVER HELLO .* was received' $CLI_OUT; then :
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001039 else
1040 RESULT=1
1041 fi
1042 fi >/dev/null
Manuel Pégourié-Gonnarda4371442014-03-13 16:21:59 +01001043 fi
1044 ;;
1045
Manuel Pégourié-Gonnarda8f3b752015-01-22 17:05:05 +00001046 mbed*)
Simon Butcherac22d112016-09-04 22:31:09 +01001047 CLIENT_CMD="$M_CLI $M_CLIENT_ARGS force_ciphersuite=$2"
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +01001048 if [ "$MEMCHECK" -gt 0 ]; then
1049 CLIENT_CMD="valgrind --leak-check=full $CLIENT_CMD"
1050 fi
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001051 log "$CLIENT_CMD"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001052 echo "$CLIENT_CMD" > $CLI_OUT
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +02001053 $CLIENT_CMD >> $CLI_OUT 2>&1 &
1054 wait_client_done
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001055
1056 case $EXIT in
Simon Butcherac22d112016-09-04 22:31:09 +01001057 # Success
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001058 "0") RESULT=0 ;;
Simon Butcherac22d112016-09-04 22:31:09 +01001059
1060 # Ciphersuite not supported
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001061 "2") RESULT=1 ;;
Simon Butcherac22d112016-09-04 22:31:09 +01001062
1063 # Error
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001064 *) RESULT=2 ;;
1065 esac
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +01001066
1067 if [ "$MEMCHECK" -gt 0 ]; then
Simon Butcherac22d112016-09-04 22:31:09 +01001068 if is_mbedtls "$CLIENT_CMD" && has_mem_err $CLI_OUT; then
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +01001069 RESULT=2
1070 fi
1071 fi
1072
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001073 ;;
1074
1075 *)
1076 echo "error: invalid client name: $1" >&2
1077 exit 1
1078 ;;
1079 esac
1080
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001081 echo "EXIT: $EXIT" >> $CLI_OUT
Manuel Pégourié-Gonnarde01af4c2014-03-25 14:16:44 +01001082
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001083 # report and count result
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001084 case $RESULT in
1085 "0")
Manuel Pégourié-Gonnard4145b892014-02-24 13:20:14 +01001086 echo PASS
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001087 ;;
1088 "1")
Manuel Pégourié-Gonnard4145b892014-02-24 13:20:14 +01001089 echo SKIP
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001090 SKIPPED=$(( $SKIPPED + 1 ))
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001091 ;;
1092 "2")
Manuel Pégourié-Gonnard4145b892014-02-24 13:20:14 +01001093 echo FAIL
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001094 cp $SRV_OUT c-srv-${TESTS}.log
1095 cp $CLI_OUT c-cli-${TESTS}.log
1096 echo " ! outputs saved to c-srv-${TESTS}.log, c-cli-${TESTS}.log"
Manuel Pégourié-Gonnard7fa67722014-08-31 17:42:53 +02001097
Azim Khan03da1212018-03-29 11:04:20 +01001098 if [ "X${USER:-}" = Xbuildbot -o "X${LOGNAME:-}" = Xbuildbot -o "${LOG_FAILURE_ON_STDOUT:-0}" != 0 ]; then
Manuel Pégourié-Gonnard7fa67722014-08-31 17:42:53 +02001099 echo " ! server output:"
1100 cat c-srv-${TESTS}.log
1101 echo " ! ==================================================="
1102 echo " ! client output:"
1103 cat c-cli-${TESTS}.log
1104 fi
1105
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001106 FAILED=$(( $FAILED + 1 ))
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001107 ;;
1108 esac
Manuel Pégourié-Gonnard87ae3032014-02-27 11:12:30 +01001109
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001110 rm -f $CLI_OUT
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001111}
1112
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +01001113#
1114# MAIN
1115#
1116
Manuel Pégourié-Gonnard19db8ea2015-03-10 13:41:04 +00001117if cd $( dirname $0 ); then :; else
1118 echo "cd $( dirname $0 ) failed" >&2
1119 exit 1
1120fi
1121
Manuel Pégourié-Gonnard3947d042014-03-14 18:13:53 +01001122get_options "$@"
1123
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +01001124# sanity checks, avoid an avalanche of errors
Simon Butcherac22d112016-09-04 22:31:09 +01001125if [ ! -x "$M_SRV" ]; then
1126 echo "Command '$M_SRV' is not an executable file" >&2
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +01001127 exit 1
1128fi
Simon Butcherac22d112016-09-04 22:31:09 +01001129if [ ! -x "$M_CLI" ]; then
1130 echo "Command '$M_CLI' is not an executable file" >&2
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +01001131 exit 1
1132fi
Manuel Pégourié-Gonnard3947d042014-03-14 18:13:53 +01001133
1134if echo "$PEERS" | grep -i openssl > /dev/null; then
1135 if which "$OPENSSL_CMD" >/dev/null 2>&1; then :; else
1136 echo "Command '$OPENSSL_CMD' not found" >&2
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +01001137 exit 1
1138 fi
Manuel Pégourié-Gonnard3947d042014-03-14 18:13:53 +01001139fi
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +01001140
Manuel Pégourié-Gonnard3947d042014-03-14 18:13:53 +01001141if echo "$PEERS" | grep -i gnutls > /dev/null; then
1142 for CMD in "$GNUTLS_CLI" "$GNUTLS_SERV"; do
1143 if which "$CMD" >/dev/null 2>&1; then :; else
1144 echo "Command '$CMD' not found" >&2
1145 exit 1
1146 fi
1147 done
1148fi
1149
1150for PEER in $PEERS; do
1151 case "$PEER" in
Manuel Pégourié-Gonnarda8f3b752015-01-22 17:05:05 +00001152 mbed*|[Oo]pen*|[Gg]nu*)
Manuel Pégourié-Gonnard3947d042014-03-14 18:13:53 +01001153 ;;
1154 *)
1155 echo "Unknown peers: $PEER" >&2
1156 exit 1
1157 esac
1158done
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +01001159
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +02001160# Pick a "unique" port in the range 10000-19999.
1161PORT="0000$$"
Manuel Pégourié-Gonnardfab2a3c2014-06-16 16:54:36 +02001162PORT="1$(echo $PORT | tail -c 5)"
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +02001163
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001164# Also pick a unique name for intermediate files
1165SRV_OUT="srv_out.$$"
1166CLI_OUT="cli_out.$$"
1167
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +02001168# client timeout delay: be more patient with valgrind
1169if [ "$MEMCHECK" -gt 0 ]; then
1170 DOG_DELAY=30
1171else
1172 DOG_DELAY=10
1173fi
1174
Manuel Pégourié-Gonnard53aef812014-07-11 17:41:24 +02001175SKIP_NEXT="NO"
1176
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +01001177trap cleanup INT TERM HUP
1178
Manuel Pégourié-Gonnard95957712014-02-19 15:29:38 +01001179for VERIFY in $VERIFIES; do
1180 for MODE in $MODES; do
Manuel Pégourié-Gonnard95957712014-02-19 15:29:38 +01001181 for TYPE in $TYPES; do
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001182 for PEER in $PEERS; do
Paul Bakker7e5e7ca2013-04-17 19:27:58 +02001183
Manuel Pégourié-Gonnard95957712014-02-19 15:29:38 +01001184 setup_arguments
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001185
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001186 case "$PEER" in
Manuel Pégourié-Gonnardd3313192013-09-13 19:20:37 +02001187
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001188 [Oo]pen*)
Paul Bakker398cb512012-04-10 08:22:31 +00001189
Manuel Pégourié-Gonnard39e2ca92015-08-04 16:43:37 +02001190 if test "$OSSL_NO_DTLS" -gt 0 && is_dtls "$MODE"; then
1191 continue;
1192 fi
1193
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001194 reset_ciphersuites
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +01001195 add_common_ciphersuites
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001196 add_openssl_ciphersuites
1197 filter_ciphersuites
Manuel Pégourié-Gonnard330e4112014-02-19 15:23:21 +01001198
Simon Butcherac22d112016-09-04 22:31:09 +01001199 if [ "X" != "X$M_CIPHERS" ]; then
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001200 start_server "OpenSSL"
Simon Butcherac22d112016-09-04 22:31:09 +01001201 for i in $M_CIPHERS; do
Manuel Pégourié-Gonnard53aef812014-07-11 17:41:24 +02001202 check_openssl_server_bug $i
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +00001203 run_client mbedTLS $i
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001204 done
1205 stop_server
1206 fi
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001207
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001208 if [ "X" != "X$O_CIPHERS" ]; then
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +00001209 start_server "mbedTLS"
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001210 for i in $O_CIPHERS; do
1211 run_client OpenSSL $i
1212 done
1213 stop_server
1214 fi
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001215
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001216 ;;
Manuel Pégourié-Gonnard5b2d7762014-02-28 12:42:57 +01001217
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001218 [Gg]nu*)
Paul Bakkerfab5c822012-02-06 16:45:10 +00001219
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001220 reset_ciphersuites
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +01001221 add_common_ciphersuites
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001222 add_gnutls_ciphersuites
1223 filter_ciphersuites
Paul Bakkerfab5c822012-02-06 16:45:10 +00001224
Simon Butcherac22d112016-09-04 22:31:09 +01001225 if [ "X" != "X$M_CIPHERS" ]; then
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001226 start_server "GnuTLS"
Simon Butcherac22d112016-09-04 22:31:09 +01001227 for i in $M_CIPHERS; do
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +00001228 run_client mbedTLS $i
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001229 done
1230 stop_server
1231 fi
1232
1233 if [ "X" != "X$G_CIPHERS" ]; then
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +00001234 start_server "mbedTLS"
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001235 for i in $G_CIPHERS; do
1236 run_client GnuTLS $i
1237 done
1238 stop_server
1239 fi
1240
1241 ;;
1242
Manuel Pégourié-Gonnarda8f3b752015-01-22 17:05:05 +00001243 mbed*)
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001244
1245 reset_ciphersuites
Manuel Pégourié-Gonnard12b84722014-03-25 19:07:28 +01001246 add_common_ciphersuites
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001247 add_openssl_ciphersuites
1248 add_gnutls_ciphersuites
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001249 add_mbedtls_ciphersuites
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001250 filter_ciphersuites
1251
Simon Butcherac22d112016-09-04 22:31:09 +01001252 if [ "X" != "X$M_CIPHERS" ]; then
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +00001253 start_server "mbedTLS"
Simon Butcherac22d112016-09-04 22:31:09 +01001254 for i in $M_CIPHERS; do
Manuel Pégourié-Gonnarde4f6edc2015-01-22 16:43:54 +00001255 run_client mbedTLS $i
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001256 done
1257 stop_server
1258 fi
1259
1260 ;;
1261
Manuel Pégourié-Gonnarda1a9f9a2014-03-25 18:04:59 +01001262 *)
Paul Bakker1ebc0c52014-05-22 15:47:58 +02001263 echo "Unknown peer: $PEER" >&2
Manuel Pégourié-Gonnarda1a9f9a2014-03-25 18:04:59 +01001264 exit 1
1265 ;;
1266
Manuel Pégourié-Gonnard9edba772014-03-13 17:45:35 +01001267 esac
1268
1269 done
Manuel Pégourié-Gonnard95957712014-02-19 15:29:38 +01001270 done
1271 done
Manuel Pégourié-Gonnard9791a402013-08-27 19:57:15 +02001272done
Manuel Pégourié-Gonnard70064fd2013-08-27 22:00:47 +02001273
Manuel Pégourié-Gonnard4145b892014-02-24 13:20:14 +01001274echo "------------------------------------------------------------------------"
Manuel Pégourié-Gonnard70064fd2013-08-27 22:00:47 +02001275
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001276if [ $FAILED -ne 0 -o $SRVMEM -ne 0 ];
Manuel Pégourié-Gonnard70064fd2013-08-27 22:00:47 +02001277then
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +01001278 printf "FAILED"
Manuel Pégourié-Gonnard70064fd2013-08-27 22:00:47 +02001279else
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +01001280 printf "PASSED"
Manuel Pégourié-Gonnard70064fd2013-08-27 22:00:47 +02001281fi
1282
Manuel Pégourié-Gonnardba0b8442014-03-13 17:57:45 +01001283if [ "$MEMCHECK" -gt 0 ]; then
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001284 MEMREPORT=", $SRVMEM server memory errors"
Manuel Pégourié-Gonnardba0b8442014-03-13 17:57:45 +01001285else
1286 MEMREPORT=""
1287fi
1288
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001289PASSED=$(( $TESTS - $FAILED ))
1290echo " ($PASSED / $TESTS tests ($SKIPPED skipped$MEMREPORT))"
Manuel Pégourié-Gonnard70064fd2013-08-27 22:00:47 +02001291
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02001292FAILED=$(( $FAILED + $SRVMEM ))
1293exit $FAILED