blob: dcb758cf3268b7ef637747fa74b18fcf25fc8a0d [file] [log] [blame]
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +01001#!/bin/sh
2
3# Test various options that are not covered by compat.sh
4#
5# Here the goal is not to cover every ciphersuite/version, but
6# rather specific options (max fragment length, truncated hmac, etc)
7# or procedures (session resumption from cache or ticket, renego, etc).
8#
9# Assumes all options are compiled in.
10
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +010011set -u
12
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +010013# default values, can be overriden by the environment
14: ${P_SRV:=../programs/ssl/ssl_server2}
15: ${P_CLI:=../programs/ssl/ssl_client2}
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +010016: ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +020017: ${GNUTLS_CLI:=gnutls-cli}
18: ${GNUTLS_SERV:=gnutls-serv}
Gilles Peskinea1cf6c82017-05-17 14:50:38 +020019: ${PERL:=perl}
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +010020
Manuel Pégourié-Gonnard6461f362015-06-29 16:20:13 +020021O_SRV="$OPENSSL_CMD s_server -www -cert data_files/server5.crt -key data_files/server5.key -dhparam data_files/dhparams.pem"
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +010022O_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_CMD s_client"
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +020023G_SRV="$GNUTLS_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key"
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +010024G_CLI="echo 'GET / HTTP/1.0' | $GNUTLS_CLI --x509cafile data_files/test-ca_cat12.crt"
Gilles Peskinea1cf6c82017-05-17 14:50:38 +020025TCP_CLIENT="$PERL scripts/tcp_client.pl"
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +010026
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +010027TESTS=0
28FAILS=0
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020029SKIPS=0
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +010030
Manuel Pégourié-Gonnard83d8c732014-04-07 13:24:21 +020031CONFIG_H='../include/polarssl/config.h'
32
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010033MEMCHECK=0
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +010034FILTER='.*'
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020035EXCLUDE='^$'
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010036
37print_usage() {
38 echo "Usage: $0 [options]"
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +010039 printf " -h|--help\tPrint this help.\n"
40 printf " -m|--memcheck\tCheck memory leaks and errors.\n"
41 printf " -f|--filter\tOnly matching tests are executed (default: '$FILTER')\n"
42 printf " -e|--exclude\tMatching tests are excluded (default: '$EXCLUDE')\n"
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010043}
44
45get_options() {
46 while [ $# -gt 0 ]; do
47 case "$1" in
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +010048 -f|--filter)
49 shift; FILTER=$1
50 ;;
51 -e|--exclude)
52 shift; EXCLUDE=$1
53 ;;
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010054 -m|--memcheck)
55 MEMCHECK=1
56 ;;
57 -h|--help)
58 print_usage
59 exit 0
60 ;;
61 *)
Paul Bakker1ebc0c52014-05-22 15:47:58 +020062 echo "Unknown argument: '$1'"
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010063 print_usage
64 exit 1
65 ;;
66 esac
67 shift
68 done
69}
70
Janos Follath4dfecab2016-03-14 13:40:43 +000071# skip next test if the flag is not enabled in config.h
72requires_config_enabled() {
73 if grep "^#define $1" $CONFIG_H > /dev/null; then :; else
74 SKIP_NEXT="YES"
75 fi
76}
77
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020078# skip next test if OpenSSL can't send SSLv2 ClientHello
79requires_openssl_with_sslv2() {
80 if [ -z "${OPENSSL_HAS_SSL2:-}" ]; then
Manuel Pégourié-Gonnarda4afadf2014-08-30 22:09:36 +020081 if $OPENSSL_CMD ciphers -ssl2 >/dev/null 2>&1; then
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020082 OPENSSL_HAS_SSL2="YES"
83 else
84 OPENSSL_HAS_SSL2="NO"
85 fi
86 fi
87 if [ "$OPENSSL_HAS_SSL2" = "NO" ]; then
88 SKIP_NEXT="YES"
89 fi
90}
91
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +020092# skip next test if OpenSSL doesn't support FALLBACK_SCSV
93requires_openssl_with_fallback_scsv() {
94 if [ -z "${OPENSSL_HAS_FBSCSV:-}" ]; then
95 if $OPENSSL_CMD s_client -help 2>&1 | grep fallback_scsv >/dev/null
96 then
97 OPENSSL_HAS_FBSCSV="YES"
98 else
99 OPENSSL_HAS_FBSCSV="NO"
100 fi
101 fi
102 if [ "$OPENSSL_HAS_FBSCSV" = "NO" ]; then
103 SKIP_NEXT="YES"
104 fi
105}
106
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +0200107# skip next test if GnuTLS isn't available
108requires_gnutls() {
109 if [ -z "${GNUTLS_AVAILABLE:-}" ]; then
110 if ( which "$GNUTLS_CLI" && which "$GNUTLS_SERV" ) >/dev/null; then
111 GNUTLS_AVAILABLE="YES"
112 else
113 GNUTLS_AVAILABLE="NO"
114 fi
115 fi
116 if [ "$GNUTLS_AVAILABLE" = "NO" ]; then
117 SKIP_NEXT="YES"
118 fi
119}
120
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100121# print_name <name>
122print_name() {
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +0100123 printf "$1 "
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200124 LEN=$(( 72 - `echo "$1" | wc -c` ))
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +0100125 for i in `seq 1 $LEN`; do printf '.'; done
126 printf ' '
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100127
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200128 TESTS=$(( $TESTS + 1 ))
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100129}
130
131# fail <message>
132fail() {
133 echo "FAIL"
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100134 echo " ! $1"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100135
Manuel Pégourié-Gonnardc2b00922014-08-31 16:46:04 +0200136 mv $SRV_OUT o-srv-${TESTS}.log
137 mv $CLI_OUT o-cli-${TESTS}.log
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100138 echo " ! outputs saved to o-srv-${TESTS}.log and o-cli-${TESTS}.log"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100139
Manuel Pégourié-Gonnard7fa67722014-08-31 17:42:53 +0200140 if [ "X${USER:-}" = Xbuildbot -o "X${LOGNAME:-}" = Xbuildbot ]; then
141 echo " ! server output:"
142 cat o-srv-${TESTS}.log
143 echo " ! ============================================================"
144 echo " ! client output:"
145 cat o-cli-${TESTS}.log
146 fi
147
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200148 FAILS=$(( $FAILS + 1 ))
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100149}
150
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100151# is_polar <cmd_line>
152is_polar() {
153 echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null
154}
155
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100156# has_mem_err <log_file_name>
157has_mem_err() {
158 if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" &&
159 grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null
160 then
161 return 1 # false: does not have errors
162 else
163 return 0 # true: has errors
164 fi
165}
166
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200167# wait for server to start: two versions depending on lsof availability
168wait_server_start() {
Manuel Pégourié-Gonnard84690c32015-08-04 20:34:39 +0200169 if which lsof >/dev/null 2>&1; then
170 START_TIME=$( date +%s )
171 DONE=0
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200172
173 # make a tight loop, server usually takes less than 1 sec to start
Manuel Pégourié-Gonnard84690c32015-08-04 20:34:39 +0200174 while [ $DONE -eq 0 ]; do
175 if lsof -nbi TCP:"$PORT" 2>/dev/null | grep LISTEN >/dev/null
176 then
177 DONE=1
178 elif [ $(( $( date +%s ) - $START_TIME )) -gt $DOG_DELAY ]; then
179 echo "SERVERSTART TIMEOUT"
180 echo "SERVERSTART TIMEOUT" >> $SRV_OUT
181 DONE=1
182 fi
183 done
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200184 else
185 sleep "$START_DELAY"
186 fi
187}
188
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200189# wait for client to terminate and set CLI_EXIT
190# must be called right after starting the client
191wait_client_done() {
192 CLI_PID=$!
193
194 ( sleep "$DOG_DELAY"; echo "TIMEOUT" >> $CLI_OUT; kill $CLI_PID ) &
195 WATCHDOG_PID=$!
196
197 wait $CLI_PID
198 CLI_EXIT=$?
199
200 kill $WATCHDOG_PID
201 wait $WATCHDOG_PID
202
203 echo "EXIT: $CLI_EXIT" >> $CLI_OUT
204}
205
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100206# Usage: run_test name srv_cmd cli_cmd cli_exit [option [...]]
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100207# Options: -s pattern pattern that must be present in server output
208# -c pattern pattern that must be present in client output
Simon Butcher696f92e2016-10-13 14:13:17 +0100209# -u pattern lines after pattern must be unique in client output
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100210# -S pattern pattern that must be absent in server output
211# -C pattern pattern that must be absent in client output
Simon Butcher696f92e2016-10-13 14:13:17 +0100212# -U pattern lines after pattern must be unique in server output
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100213run_test() {
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100214 NAME="$1"
215 SRV_CMD="$2"
216 CLI_CMD="$3"
217 CLI_EXPECT="$4"
218 shift 4
219
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +0100220 if echo "$NAME" | grep "$FILTER" | grep -v "$EXCLUDE" >/dev/null; then :
221 else
222 return
223 fi
224
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100225 print_name "$NAME"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100226
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200227 # should we skip?
228 if [ "X$SKIP_NEXT" = "XYES" ]; then
229 SKIP_NEXT="NO"
230 echo "SKIP"
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200231 SKIPS=$(( $SKIPS + 1 ))
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200232 return
233 fi
234
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100235 # prepend valgrind to our commands if active
236 if [ "$MEMCHECK" -gt 0 ]; then
237 if is_polar "$SRV_CMD"; then
238 SRV_CMD="valgrind --leak-check=full $SRV_CMD"
239 fi
240 if is_polar "$CLI_CMD"; then
241 CLI_CMD="valgrind --leak-check=full $CLI_CMD"
242 fi
243 fi
244
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100245 # run the commands
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200246 echo "$SRV_CMD" > $SRV_OUT
247 $SRV_CMD >> $SRV_OUT 2>&1 &
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100248 SRV_PID=$!
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200249 wait_server_start
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200250
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200251 echo "$CLI_CMD" > $CLI_OUT
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200252 eval "$CLI_CMD" >> $CLI_OUT 2>&1 &
253 wait_client_done
Manuel Pégourié-Gonnarde01af4c2014-03-25 14:16:44 +0100254
Manuel Pégourié-Gonnard74b11702014-08-14 15:47:33 +0200255 # kill the server
256 kill $SRV_PID
257 wait $SRV_PID
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100258
259 # check if the client and server went at least to the handshake stage
Paul Bakker1ebc0c52014-05-22 15:47:58 +0200260 # (useful to avoid tests with only negative assertions and non-zero
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100261 # expected client exit to incorrectly succeed in case of catastrophic
262 # failure)
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100263 if is_polar "$SRV_CMD"; then
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200264 if grep "Performing the SSL/TLS handshake" $SRV_OUT >/dev/null; then :;
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100265 else
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100266 fail "server or client failed to reach handshake stage"
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100267 return
268 fi
269 fi
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100270 if is_polar "$CLI_CMD"; then
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200271 if grep "Performing the SSL/TLS handshake" $CLI_OUT >/dev/null; then :;
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100272 else
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100273 fail "server or client failed to reach handshake stage"
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100274 return
275 fi
276 fi
277
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100278 # check server exit code
279 if [ $? != 0 ]; then
280 fail "server fail"
281 return
282 fi
283
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100284 # check client exit code
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100285 if [ \( "$CLI_EXPECT" = 0 -a "$CLI_EXIT" != 0 \) -o \
286 \( "$CLI_EXPECT" != 0 -a "$CLI_EXIT" = 0 \) ]
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100287 then
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +0100288 fail "bad client exit code"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100289 return
290 fi
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100291
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100292 # check other assertions
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200293 # lines beginning with == are added by valgrind, ignore them
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100294 while [ $# -gt 0 ]
295 do
296 case $1 in
297 "-s")
Simon Butcher696f92e2016-10-13 14:13:17 +0100298 if grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then :; else
299 fail "pattern '$2' MUST be present in the Server output"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100300 return
301 fi
302 ;;
303
304 "-c")
Simon Butcher696f92e2016-10-13 14:13:17 +0100305 if grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then :; else
306 fail "pattern '$2' MUST be present in the Client output"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100307 return
308 fi
309 ;;
310
311 "-S")
Simon Butcher696f92e2016-10-13 14:13:17 +0100312 if grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then
313 fail "pattern '$2' MUST NOT be present in the Server output"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100314 return
315 fi
316 ;;
317
318 "-C")
Simon Butcher696f92e2016-10-13 14:13:17 +0100319 if grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then
320 fail "pattern '$2' MUST NOT be present in the Client output"
321 return
322 fi
323 ;;
324
325 # The filtering in the following two options (-u and -U) do the following
326 # - ignore valgrind output
327 # - filter out everything but lines right after the pattern occurances
328 # - keep one of each non-unique line
329 # - count how many lines remain
330 # A line with '--' will remain in the result from previous outputs, so the number of lines in the result will be 1
331 # if there were no duplicates.
332 "-U")
333 if [ $(grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep -A1 "$2" | grep -v "$2" | sort | uniq -d | wc -l) -gt 1 ]; then
334 fail "lines following pattern '$2' must be unique in Server output"
335 return
336 fi
337 ;;
338
339 "-u")
340 if [ $(grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep -A1 "$2" | grep -v "$2" | sort | uniq -d | wc -l) -gt 1 ]; then
341 fail "lines following pattern '$2' must be unique in Client output"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100342 return
343 fi
344 ;;
345
346 *)
Paul Bakker1ebc0c52014-05-22 15:47:58 +0200347 echo "Unknown test: $1" >&2
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100348 exit 1
349 esac
350 shift 2
351 done
352
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100353 # check valgrind's results
354 if [ "$MEMCHECK" -gt 0 ]; then
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200355 if is_polar "$SRV_CMD" && has_mem_err $SRV_OUT; then
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100356 fail "Server has memory errors"
357 return
358 fi
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200359 if is_polar "$CLI_CMD" && has_mem_err $CLI_OUT; then
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100360 fail "Client has memory errors"
361 return
362 fi
363 fi
364
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100365 # if we're here, everything is ok
366 echo "PASS"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200367 rm -f $SRV_OUT $CLI_OUT
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100368}
369
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100370cleanup() {
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200371 rm -f $CLI_OUT $SRV_OUT $SESSION
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200372 kill $SRV_PID >/dev/null 2>&1
373 kill $WATCHDOG_PID >/dev/null 2>&1
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100374 exit 1
375}
376
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100377#
378# MAIN
379#
380
Manuel Pégourié-Gonnard751286b2015-03-10 13:41:04 +0000381if cd $( dirname $0 ); then :; else
382 echo "cd $( dirname $0 ) failed" >&2
383 exit 1
384fi
385
Manuel Pégourié-Gonnard913030c2014-03-28 10:12:38 +0100386get_options "$@"
387
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100388# sanity checks, avoid an avalanche of errors
389if [ ! -x "$P_SRV" ]; then
390 echo "Command '$P_SRV' is not an executable file"
391 exit 1
392fi
393if [ ! -x "$P_CLI" ]; then
394 echo "Command '$P_CLI' is not an executable file"
395 exit 1
396fi
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +0100397if which $OPENSSL_CMD >/dev/null 2>&1; then :; else
398 echo "Command '$OPENSSL_CMD' not found"
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100399 exit 1
400fi
401
Manuel Pégourié-Gonnard32f8f4d2014-05-29 11:31:20 +0200402# used by watchdog
403MAIN_PID="$$"
404
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200405# be more patient with valgrind
406if [ "$MEMCHECK" -gt 0 ]; then
407 START_DELAY=3
408 DOG_DELAY=30
409else
410 START_DELAY=1
411 DOG_DELAY=10
412fi
413
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +0200414# Pick a "unique" port in the range 10000-19999.
415PORT="0000$$"
Manuel Pégourié-Gonnarddc370e42015-01-22 10:24:59 +0000416PORT="1$( printf $PORT | tail -c 4 )"
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +0200417
418# fix commands to use this port
419P_SRV="$P_SRV server_port=$PORT"
420P_CLI="$P_CLI server_port=$PORT"
421O_SRV="$O_SRV -accept $PORT"
422O_CLI="$O_CLI -connect localhost:$PORT"
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +0200423G_SRV="$G_SRV -p $PORT"
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +0100424G_CLI="$G_CLI -p $PORT localhost"
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +0200425
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200426# Also pick a unique name for intermediate files
427SRV_OUT="srv_out.$$"
428CLI_OUT="cli_out.$$"
429SESSION="session.$$"
430
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200431SKIP_NEXT="NO"
432
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100433trap cleanup INT TERM HUP
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100434
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200435# Basic test
436
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200437# Checks that:
438# - things work with all ciphersuites active (used with config-full in all.sh)
439# - the expected (highest security) parameters are selected
440# ("signature_algorithm ext: 6" means SHA-512 (highest common hash))
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200441run_test "Default" \
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200442 "$P_SRV debug_level=3" \
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200443 "$P_CLI" \
444 0 \
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200445 -s "Protocol is TLSv1.2" \
446 -s "Ciphersuite is TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \
447 -s "client hello v3, signature_algorithm ext: 6" \
448 -s "ECDHE curve: secp521r1" \
449 -S "error" \
450 -C "error"
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200451
Simon Butcher696f92e2016-10-13 14:13:17 +0100452# Test for uniqueness of IVs in AEAD ciphersuites
453run_test "Unique IV in GCM" \
454 "$P_SRV exchanges=20 debug_level=4" \
455 "$P_CLI exchanges=20 debug_level=4 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \
456 0 \
457 -u "IV used" \
458 -U "IV used"
459
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100460# Tests for rc4 option
461
462run_test "RC4: server disabled, client enabled" \
463 "$P_SRV" \
464 "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
465 1 \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100466 -s "SSL - None of the common ciphersuites is usable"
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100467
468run_test "RC4: server enabled, client disabled" \
469 "$P_SRV force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
470 "$P_CLI" \
471 1 \
472 -s "SSL - The server has no ciphersuites in common"
473
474run_test "RC4: both enabled" \
475 "$P_SRV arc4=1" \
476 "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
477 0 \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100478 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100479 -S "SSL - The server has no ciphersuites in common"
480
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100481# Test for SSLv2 ClientHello
482
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200483requires_openssl_with_sslv2
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200484run_test "SSLv2 ClientHello: reference" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100485 "$P_SRV debug_level=3" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +0100486 "$O_CLI -no_ssl2" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100487 0 \
488 -S "parse client hello v2" \
489 -S "ssl_handshake returned"
490
491# Adding a SSL2-only suite makes OpenSSL client send SSLv2 ClientHello
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200492requires_openssl_with_sslv2
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200493run_test "SSLv2 ClientHello: actual test" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200494 "$P_SRV debug_level=2" \
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100495 "$O_CLI -cipher 'DES-CBC-MD5:ALL'" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100496 0 \
497 -s "parse client hello v2" \
498 -S "ssl_handshake returned"
499
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100500# Tests for Truncated HMAC extension
501
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100502run_test "Truncated HMAC: client default, server default" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200503 "$P_SRV debug_level=4" \
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100504 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100505 0 \
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100506 -s "dumping 'computed mac' (20 bytes)" \
507 -S "dumping 'computed mac' (10 bytes)"
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100508
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100509run_test "Truncated HMAC: client disabled, server default" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200510 "$P_SRV debug_level=4" \
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100511 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
512 trunc_hmac=0" \
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100513 0 \
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100514 -s "dumping 'computed mac' (20 bytes)" \
515 -S "dumping 'computed mac' (10 bytes)"
516
517run_test "Truncated HMAC: client enabled, server default" \
518 "$P_SRV debug_level=4" \
519 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
520 trunc_hmac=1" \
521 0 \
522 -S "dumping 'computed mac' (20 bytes)" \
523 -s "dumping 'computed mac' (10 bytes)"
524
525run_test "Truncated HMAC: client enabled, server disabled" \
526 "$P_SRV debug_level=4 trunc_hmac=0" \
527 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
528 trunc_hmac=1" \
529 0 \
530 -s "dumping 'computed mac' (20 bytes)" \
531 -S "dumping 'computed mac' (10 bytes)"
532
533run_test "Truncated HMAC: client enabled, server enabled" \
534 "$P_SRV debug_level=4 trunc_hmac=1" \
535 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
536 trunc_hmac=1" \
537 0 \
538 -S "dumping 'computed mac' (20 bytes)" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100539 -s "dumping 'computed mac' (10 bytes)"
540
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100541# Tests for Encrypt-then-MAC extension
542
543run_test "Encrypt then MAC: default" \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100544 "$P_SRV debug_level=3 \
545 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100546 "$P_CLI debug_level=3" \
547 0 \
548 -c "client hello, adding encrypt_then_mac extension" \
549 -s "found encrypt then mac extension" \
550 -s "server hello, adding encrypt then mac extension" \
551 -c "found encrypt_then_mac extension" \
552 -c "using encrypt then mac" \
553 -s "using encrypt then mac"
554
555run_test "Encrypt then MAC: client enabled, server disabled" \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100556 "$P_SRV debug_level=3 etm=0 \
557 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100558 "$P_CLI debug_level=3 etm=1" \
559 0 \
560 -c "client hello, adding encrypt_then_mac extension" \
561 -s "found encrypt then mac extension" \
562 -S "server hello, adding encrypt then mac extension" \
563 -C "found encrypt_then_mac extension" \
564 -C "using encrypt then mac" \
565 -S "using encrypt then mac"
566
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +0100567run_test "Encrypt then MAC: client enabled, aead cipher" \
568 "$P_SRV debug_level=3 etm=1 \
569 force_ciphersuite=TLS-RSA-WITH-AES-128-GCM-SHA256" \
570 "$P_CLI debug_level=3 etm=1" \
571 0 \
572 -c "client hello, adding encrypt_then_mac extension" \
573 -s "found encrypt then mac extension" \
574 -S "server hello, adding encrypt then mac extension" \
575 -C "found encrypt_then_mac extension" \
576 -C "using encrypt then mac" \
577 -S "using encrypt then mac"
578
579run_test "Encrypt then MAC: client enabled, stream cipher" \
580 "$P_SRV debug_level=3 etm=1 \
581 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100582 "$P_CLI debug_level=3 etm=1 arc4=1" \
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +0100583 0 \
584 -c "client hello, adding encrypt_then_mac extension" \
585 -s "found encrypt then mac extension" \
586 -S "server hello, adding encrypt then mac extension" \
587 -C "found encrypt_then_mac extension" \
588 -C "using encrypt then mac" \
589 -S "using encrypt then mac"
590
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100591run_test "Encrypt then MAC: client disabled, server enabled" \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100592 "$P_SRV debug_level=3 etm=1 \
593 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100594 "$P_CLI debug_level=3 etm=0" \
595 0 \
596 -C "client hello, adding encrypt_then_mac extension" \
597 -S "found encrypt then mac extension" \
598 -S "server hello, adding encrypt then mac extension" \
599 -C "found encrypt_then_mac extension" \
600 -C "using encrypt then mac" \
601 -S "using encrypt then mac"
602
Janos Follath4dfecab2016-03-14 13:40:43 +0000603requires_config_enabled POLARSSL_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100604run_test "Encrypt then MAC: client SSLv3, server enabled" \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100605 "$P_SRV debug_level=3 min_version=ssl3 \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100606 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100607 "$P_CLI debug_level=3 force_version=ssl3" \
608 0 \
609 -C "client hello, adding encrypt_then_mac extension" \
610 -S "found encrypt then mac extension" \
611 -S "server hello, adding encrypt then mac extension" \
612 -C "found encrypt_then_mac extension" \
613 -C "using encrypt then mac" \
614 -S "using encrypt then mac"
615
Janos Follath4dfecab2016-03-14 13:40:43 +0000616requires_config_enabled POLARSSL_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100617run_test "Encrypt then MAC: client enabled, server SSLv3" \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100618 "$P_SRV debug_level=3 force_version=ssl3 \
619 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100620 "$P_CLI debug_level=3 min_version=ssl3" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100621 0 \
622 -c "client hello, adding encrypt_then_mac extension" \
Janos Follath8abaa8b2016-05-06 13:48:23 +0100623 -S "found encrypt then mac extension" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100624 -S "server hello, adding encrypt then mac extension" \
625 -C "found encrypt_then_mac extension" \
626 -C "using encrypt then mac" \
627 -S "using encrypt then mac"
628
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200629# Tests for Extended Master Secret extension
630
631run_test "Extended Master Secret: default" \
632 "$P_SRV debug_level=3" \
633 "$P_CLI debug_level=3" \
634 0 \
635 -c "client hello, adding extended_master_secret extension" \
636 -s "found extended master secret extension" \
637 -s "server hello, adding extended master secret extension" \
638 -c "found extended_master_secret extension" \
639 -c "using extended master secret" \
640 -s "using extended master secret"
641
642run_test "Extended Master Secret: client enabled, server disabled" \
643 "$P_SRV debug_level=3 extended_ms=0" \
644 "$P_CLI debug_level=3 extended_ms=1" \
645 0 \
646 -c "client hello, adding extended_master_secret extension" \
647 -s "found extended master secret extension" \
648 -S "server hello, adding extended master secret extension" \
649 -C "found extended_master_secret extension" \
650 -C "using extended master secret" \
651 -S "using extended master secret"
652
653run_test "Extended Master Secret: client disabled, server enabled" \
654 "$P_SRV debug_level=3 extended_ms=1" \
655 "$P_CLI debug_level=3 extended_ms=0" \
656 0 \
657 -C "client hello, adding extended_master_secret extension" \
658 -S "found extended master secret extension" \
659 -S "server hello, adding extended master secret extension" \
660 -C "found extended_master_secret extension" \
661 -C "using extended master secret" \
662 -S "using extended master secret"
663
Janos Follath4dfecab2016-03-14 13:40:43 +0000664requires_config_enabled POLARSSL_SSL_PROTO_SSL3
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200665run_test "Extended Master Secret: client SSLv3, server enabled" \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100666 "$P_SRV debug_level=3 min_version=ssl3" \
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200667 "$P_CLI debug_level=3 force_version=ssl3" \
668 0 \
669 -C "client hello, adding extended_master_secret extension" \
670 -S "found extended master secret extension" \
671 -S "server hello, adding extended master secret extension" \
672 -C "found extended_master_secret extension" \
673 -C "using extended master secret" \
674 -S "using extended master secret"
675
Janos Follath4dfecab2016-03-14 13:40:43 +0000676requires_config_enabled POLARSSL_SSL_PROTO_SSL3
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200677run_test "Extended Master Secret: client enabled, server SSLv3" \
678 "$P_SRV debug_level=3 force_version=ssl3" \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100679 "$P_CLI debug_level=3 min_version=ssl3" \
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200680 0 \
681 -c "client hello, adding extended_master_secret extension" \
Janos Follath8abaa8b2016-05-06 13:48:23 +0100682 -S "found extended master secret extension" \
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200683 -S "server hello, adding extended master secret extension" \
684 -C "found extended_master_secret extension" \
685 -C "using extended master secret" \
686 -S "using extended master secret"
687
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200688# Tests for FALLBACK_SCSV
689
690run_test "Fallback SCSV: default" \
691 "$P_SRV" \
692 "$P_CLI debug_level=3 force_version=tls1_1" \
693 0 \
694 -C "adding FALLBACK_SCSV" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200695 -S "received FALLBACK_SCSV" \
696 -S "inapropriate fallback" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200697 -C "is a fatal alert message (msg 86)"
698
699run_test "Fallback SCSV: explicitly disabled" \
700 "$P_SRV" \
701 "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \
702 0 \
703 -C "adding FALLBACK_SCSV" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200704 -S "received FALLBACK_SCSV" \
705 -S "inapropriate fallback" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200706 -C "is a fatal alert message (msg 86)"
707
708run_test "Fallback SCSV: enabled" \
709 "$P_SRV" \
710 "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200711 1 \
712 -c "adding FALLBACK_SCSV" \
713 -s "received FALLBACK_SCSV" \
714 -s "inapropriate fallback" \
715 -c "is a fatal alert message (msg 86)"
716
717run_test "Fallback SCSV: enabled, max version" \
718 "$P_SRV" \
719 "$P_CLI debug_level=3 fallback=1" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200720 0 \
721 -c "adding FALLBACK_SCSV" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200722 -s "received FALLBACK_SCSV" \
723 -S "inapropriate fallback" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200724 -C "is a fatal alert message (msg 86)"
725
726requires_openssl_with_fallback_scsv
727run_test "Fallback SCSV: default, openssl server" \
728 "$O_SRV" \
729 "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \
730 0 \
731 -C "adding FALLBACK_SCSV" \
732 -C "is a fatal alert message (msg 86)"
733
734requires_openssl_with_fallback_scsv
735run_test "Fallback SCSV: enabled, openssl server" \
736 "$O_SRV" \
737 "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \
738 1 \
739 -c "adding FALLBACK_SCSV" \
740 -c "is a fatal alert message (msg 86)"
741
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200742requires_openssl_with_fallback_scsv
743run_test "Fallback SCSV: disabled, openssl client" \
744 "$P_SRV" \
745 "$O_CLI -tls1_1" \
746 0 \
747 -S "received FALLBACK_SCSV" \
748 -S "inapropriate fallback"
749
750requires_openssl_with_fallback_scsv
751run_test "Fallback SCSV: enabled, openssl client" \
752 "$P_SRV" \
753 "$O_CLI -tls1_1 -fallback_scsv" \
754 1 \
755 -s "received FALLBACK_SCSV" \
756 -s "inapropriate fallback"
757
758requires_openssl_with_fallback_scsv
759run_test "Fallback SCSV: enabled, max version, openssl client" \
760 "$P_SRV" \
761 "$O_CLI -fallback_scsv" \
762 0 \
763 -s "received FALLBACK_SCSV" \
764 -S "inapropriate fallback"
765
Gilles Peskinea1cf6c82017-05-17 14:50:38 +0200766## ClientHello generated with
767## "openssl s_client -CAfile tests/data_files/test-ca.crt -tls1_1 -connect localhost:4433 -cipher ..."
768## then manually twiddling the ciphersuite list.
769## The ClientHello content is spelled out below as a hex string as
770## "prefix ciphersuite1 ciphersuite2 ciphersuite3 ciphersuite4 suffix".
771## The expected response is an inappropriate_fallback alert.
772requires_openssl_with_fallback_scsv
773run_test "Fallback SCSV: beginning of list" \
774 "$P_SRV debug_level=2" \
775 "$TCP_CLIENT localhost $PORT '160301003e0100003a03022aafb94308dc22ca1086c65acc00e414384d76b61ecab37df1633b1ae1034dbe000008 5600 0031 0032 0033 0100000900230000000f000101' '15030200020256'" \
776 0 \
777 -s "received FALLBACK_SCSV" \
778 -s "inapropriate fallback"
779
780requires_openssl_with_fallback_scsv
781run_test "Fallback SCSV: end of list" \
782 "$P_SRV debug_level=2" \
783 "$TCP_CLIENT localhost $PORT '160301003e0100003a03022aafb94308dc22ca1086c65acc00e414384d76b61ecab37df1633b1ae1034dbe000008 0031 0032 0033 5600 0100000900230000000f000101' '15030200020256'" \
784 0 \
785 -s "received FALLBACK_SCSV" \
786 -s "inapropriate fallback"
787
788## Here the expected response is a valid ServerHello prefix, up to the random.
789requires_openssl_with_fallback_scsv
790run_test "Fallback SCSV: not in list" \
791 "$P_SRV debug_level=2" \
792 "$TCP_CLIENT localhost $PORT '160301003e0100003a03022aafb94308dc22ca1086c65acc00e414384d76b61ecab37df1633b1ae1034dbe000008 0056 0031 0032 0033 0100000900230000000f000101' '16030200300200002c0302'" \
793 0 \
794 -S "received FALLBACK_SCSV" \
795 -S "inapropriate fallback"
796
Manuel Pégourié-Gonnard3ff78232015-01-08 11:15:09 +0100797# Tests for CBC 1/n-1 record splitting
798
799run_test "CBC Record splitting: TLS 1.2, no splitting" \
800 "$P_SRV" \
801 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
802 request_size=123 force_version=tls1_2" \
803 0 \
804 -s "Read from client: 123 bytes read" \
805 -S "Read from client: 1 bytes read" \
806 -S "122 bytes read"
807
808run_test "CBC Record splitting: TLS 1.1, no splitting" \
809 "$P_SRV" \
810 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
811 request_size=123 force_version=tls1_1" \
812 0 \
813 -s "Read from client: 123 bytes read" \
814 -S "Read from client: 1 bytes read" \
815 -S "122 bytes read"
816
817run_test "CBC Record splitting: TLS 1.0, splitting" \
818 "$P_SRV" \
819 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
820 request_size=123 force_version=tls1" \
821 0 \
822 -S "Read from client: 123 bytes read" \
823 -s "Read from client: 1 bytes read" \
824 -s "122 bytes read"
825
Janos Follath4dfecab2016-03-14 13:40:43 +0000826requires_config_enabled POLARSSL_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard3ff78232015-01-08 11:15:09 +0100827run_test "CBC Record splitting: SSLv3, splitting" \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100828 "$P_SRV min_version=ssl3" \
Manuel Pégourié-Gonnard3ff78232015-01-08 11:15:09 +0100829 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
830 request_size=123 force_version=ssl3" \
831 0 \
832 -S "Read from client: 123 bytes read" \
833 -s "Read from client: 1 bytes read" \
834 -s "122 bytes read"
835
836run_test "CBC Record splitting: TLS 1.0 RC4, no splitting" \
Manuel Pégourié-Gonnard51d81662015-01-14 17:20:46 +0100837 "$P_SRV arc4=1" \
Manuel Pégourié-Gonnard3ff78232015-01-08 11:15:09 +0100838 "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
839 request_size=123 force_version=tls1" \
840 0 \
841 -s "Read from client: 123 bytes read" \
842 -S "Read from client: 1 bytes read" \
843 -S "122 bytes read"
844
845run_test "CBC Record splitting: TLS 1.0, splitting disabled" \
846 "$P_SRV" \
847 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
848 request_size=123 force_version=tls1 recsplit=0" \
849 0 \
850 -s "Read from client: 123 bytes read" \
851 -S "Read from client: 1 bytes read" \
852 -S "122 bytes read"
853
Manuel Pégourié-Gonnarda852cf42015-01-13 20:56:15 +0100854run_test "CBC Record splitting: TLS 1.0, splitting, nbio" \
855 "$P_SRV nbio=2" \
856 "$P_CLI nbio=2 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
857 request_size=123 force_version=tls1" \
858 0 \
859 -S "Read from client: 123 bytes read" \
860 -s "Read from client: 1 bytes read" \
861 -s "122 bytes read"
862
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100863# Tests for Session Tickets
864
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200865run_test "Session resume using tickets: basic" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200866 "$P_SRV debug_level=3 tickets=1" \
867 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100868 0 \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100869 -c "client hello, adding session ticket extension" \
870 -s "found session ticket extension" \
871 -s "server hello, adding session ticket extension" \
872 -c "found session_ticket extension" \
873 -c "parse new session ticket" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100874 -S "session successfully restored from cache" \
875 -s "session successfully restored from ticket" \
876 -s "a session has been resumed" \
877 -c "a session has been resumed"
878
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200879run_test "Session resume using tickets: cache disabled" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200880 "$P_SRV debug_level=3 tickets=1 cache_max=0" \
881 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnarddbe1ee12014-02-21 09:18:13 +0100882 0 \
883 -c "client hello, adding session ticket extension" \
884 -s "found session ticket extension" \
885 -s "server hello, adding session ticket extension" \
886 -c "found session_ticket extension" \
887 -c "parse new session ticket" \
888 -S "session successfully restored from cache" \
889 -s "session successfully restored from ticket" \
890 -s "a session has been resumed" \
891 -c "a session has been resumed"
892
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200893run_test "Session resume using tickets: timeout" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200894 "$P_SRV debug_level=3 tickets=1 cache_max=0 ticket_timeout=1" \
895 "$P_CLI debug_level=3 tickets=1 reconnect=1 reco_delay=2" \
Manuel Pégourié-Gonnarddbe1ee12014-02-21 09:18:13 +0100896 0 \
897 -c "client hello, adding session ticket extension" \
898 -s "found session ticket extension" \
899 -s "server hello, adding session ticket extension" \
900 -c "found session_ticket extension" \
901 -c "parse new session ticket" \
902 -S "session successfully restored from cache" \
903 -S "session successfully restored from ticket" \
904 -S "a session has been resumed" \
905 -C "a session has been resumed"
906
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200907run_test "Session resume using tickets: openssl server" \
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100908 "$O_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200909 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100910 0 \
911 -c "client hello, adding session ticket extension" \
912 -c "found session_ticket extension" \
913 -c "parse new session ticket" \
914 -c "a session has been resumed"
915
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200916run_test "Session resume using tickets: openssl client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200917 "$P_SRV debug_level=3 tickets=1" \
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200918 "( $O_CLI -sess_out $SESSION; \
919 $O_CLI -sess_in $SESSION; \
920 rm -f $SESSION )" \
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100921 0 \
922 -s "found session ticket extension" \
923 -s "server hello, adding session ticket extension" \
924 -S "session successfully restored from cache" \
925 -s "session successfully restored from ticket" \
926 -s "a session has been resumed"
927
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100928# Tests for Session Resume based on session-ID and cache
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100929
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200930run_test "Session resume using cache: tickets enabled on client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200931 "$P_SRV debug_level=3 tickets=0" \
932 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100933 0 \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100934 -c "client hello, adding session ticket extension" \
935 -s "found session ticket extension" \
936 -S "server hello, adding session ticket extension" \
937 -C "found session_ticket extension" \
938 -C "parse new session ticket" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100939 -s "session successfully restored from cache" \
940 -S "session successfully restored from ticket" \
941 -s "a session has been resumed" \
942 -c "a session has been resumed"
943
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200944run_test "Session resume using cache: tickets enabled on server" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200945 "$P_SRV debug_level=3 tickets=1" \
946 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100947 0 \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100948 -C "client hello, adding session ticket extension" \
949 -S "found session ticket extension" \
950 -S "server hello, adding session ticket extension" \
951 -C "found session_ticket extension" \
952 -C "parse new session ticket" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100953 -s "session successfully restored from cache" \
954 -S "session successfully restored from ticket" \
955 -s "a session has been resumed" \
956 -c "a session has been resumed"
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +0100957
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200958run_test "Session resume using cache: cache_max=0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200959 "$P_SRV debug_level=3 tickets=0 cache_max=0" \
960 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100961 0 \
962 -S "session successfully restored from cache" \
963 -S "session successfully restored from ticket" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100964 -S "a session has been resumed" \
965 -C "a session has been resumed"
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100966
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200967run_test "Session resume using cache: cache_max=1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200968 "$P_SRV debug_level=3 tickets=0 cache_max=1" \
969 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100970 0 \
971 -s "session successfully restored from cache" \
972 -S "session successfully restored from ticket" \
973 -s "a session has been resumed" \
974 -c "a session has been resumed"
975
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200976run_test "Session resume using cache: timemout > delay" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200977 "$P_SRV debug_level=3 tickets=0" \
978 "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=0" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100979 0 \
980 -s "session successfully restored from cache" \
981 -S "session successfully restored from ticket" \
982 -s "a session has been resumed" \
983 -c "a session has been resumed"
984
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200985run_test "Session resume using cache: timeout < delay" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200986 "$P_SRV debug_level=3 tickets=0 cache_timeout=1" \
987 "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100988 0 \
989 -S "session successfully restored from cache" \
990 -S "session successfully restored from ticket" \
991 -S "a session has been resumed" \
992 -C "a session has been resumed"
993
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200994run_test "Session resume using cache: no timeout" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200995 "$P_SRV debug_level=3 tickets=0 cache_timeout=0" \
996 "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100997 0 \
998 -s "session successfully restored from cache" \
999 -S "session successfully restored from ticket" \
1000 -s "a session has been resumed" \
1001 -c "a session has been resumed"
1002
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001003run_test "Session resume using cache: openssl client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001004 "$P_SRV debug_level=3 tickets=0" \
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +02001005 "( $O_CLI -sess_out $SESSION; \
1006 $O_CLI -sess_in $SESSION; \
1007 rm -f $SESSION )" \
Manuel Pégourié-Gonnarddb735f62014-02-25 17:57:59 +01001008 0 \
1009 -s "found session ticket extension" \
1010 -S "server hello, adding session ticket extension" \
1011 -s "session successfully restored from cache" \
1012 -S "session successfully restored from ticket" \
1013 -s "a session has been resumed"
1014
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001015run_test "Session resume using cache: openssl server" \
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +01001016 "$O_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001017 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnarddb735f62014-02-25 17:57:59 +01001018 0 \
1019 -C "found session_ticket extension" \
1020 -C "parse new session ticket" \
1021 -c "a session has been resumed"
1022
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001023# Tests for Max Fragment Length extension
1024
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001025run_test "Max fragment length: not used, reference" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001026 "$P_SRV debug_level=3" \
1027 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +01001028 0 \
1029 -C "client hello, adding max_fragment_length extension" \
1030 -S "found max fragment length extension" \
1031 -S "server hello, max_fragment_length extension" \
1032 -C "found max_fragment_length extension"
1033
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001034run_test "Max fragment length: used by client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001035 "$P_SRV debug_level=3" \
1036 "$P_CLI debug_level=3 max_frag_len=4096" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +01001037 0 \
1038 -c "client hello, adding max_fragment_length extension" \
1039 -s "found max fragment length extension" \
1040 -s "server hello, max_fragment_length extension" \
1041 -c "found max_fragment_length extension"
1042
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001043run_test "Max fragment length: used by server" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001044 "$P_SRV debug_level=3 max_frag_len=4096" \
1045 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +01001046 0 \
1047 -C "client hello, adding max_fragment_length extension" \
1048 -S "found max fragment length extension" \
1049 -S "server hello, max_fragment_length extension" \
1050 -C "found max_fragment_length extension"
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001051
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001052requires_gnutls
1053run_test "Max fragment length: gnutls server" \
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +02001054 "$G_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001055 "$P_CLI debug_level=3 max_frag_len=4096" \
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +02001056 0 \
1057 -c "client hello, adding max_fragment_length extension" \
1058 -c "found max_fragment_length extension"
1059
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001060# Tests for renegotiation
1061
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001062run_test "Renegotiation: none, for reference" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001063 "$P_SRV debug_level=3 exchanges=2" \
1064 "$P_CLI debug_level=3 exchanges=2" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001065 0 \
1066 -C "client hello, adding renegotiation extension" \
1067 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1068 -S "found renegotiation extension" \
1069 -s "server hello, secure renegotiation extension" \
1070 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +01001071 -C "=> renegotiate" \
1072 -S "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001073 -S "write hello request"
1074
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001075run_test "Renegotiation: client-initiated" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001076 "$P_SRV debug_level=3 exchanges=2 renegotiation=1" \
1077 "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001078 0 \
1079 -c "client hello, adding renegotiation extension" \
1080 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1081 -s "found renegotiation extension" \
1082 -s "server hello, secure renegotiation extension" \
1083 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +01001084 -c "=> renegotiate" \
1085 -s "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001086 -S "write hello request"
1087
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001088run_test "Renegotiation: server-initiated" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001089 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
1090 "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001091 0 \
1092 -c "client hello, adding renegotiation extension" \
1093 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1094 -s "found renegotiation extension" \
1095 -s "server hello, secure renegotiation extension" \
1096 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +01001097 -c "=> renegotiate" \
1098 -s "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001099 -s "write hello request"
1100
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001101run_test "Renegotiation: double" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001102 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
1103 "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001104 0 \
1105 -c "client hello, adding renegotiation extension" \
1106 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1107 -s "found renegotiation extension" \
1108 -s "server hello, secure renegotiation extension" \
1109 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +01001110 -c "=> renegotiate" \
1111 -s "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001112 -s "write hello request"
1113
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001114run_test "Renegotiation: client-initiated, server-rejected" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001115 "$P_SRV debug_level=3 exchanges=2 renegotiation=0" \
1116 "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001117 1 \
1118 -c "client hello, adding renegotiation extension" \
1119 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1120 -S "found renegotiation extension" \
1121 -s "server hello, secure renegotiation extension" \
1122 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +01001123 -c "=> renegotiate" \
1124 -S "=> renegotiate" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001125 -S "write hello request" \
Manuel Pégourié-Gonnard65919622014-08-19 12:50:30 +02001126 -c "SSL - Unexpected message at ServerHello in renegotiation" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001127 -c "failed"
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001128
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001129run_test "Renegotiation: server-initiated, client-rejected, default" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001130 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
1131 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001132 0 \
1133 -C "client hello, adding renegotiation extension" \
1134 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1135 -S "found renegotiation extension" \
1136 -s "server hello, secure renegotiation extension" \
1137 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +01001138 -C "=> renegotiate" \
1139 -S "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +01001140 -s "write hello request" \
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +02001141 -S "SSL - An unexpected message was received from our peer" \
1142 -S "failed"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01001143
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001144run_test "Renegotiation: server-initiated, client-rejected, not enforced" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001145 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001146 renego_delay=-1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001147 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001148 0 \
1149 -C "client hello, adding renegotiation extension" \
1150 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1151 -S "found renegotiation extension" \
1152 -s "server hello, secure renegotiation extension" \
1153 -c "found renegotiation extension" \
1154 -C "=> renegotiate" \
1155 -S "=> renegotiate" \
1156 -s "write hello request" \
1157 -S "SSL - An unexpected message was received from our peer" \
1158 -S "failed"
1159
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02001160# delay 2 for 1 alert record + 1 application data record
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001161run_test "Renegotiation: server-initiated, client-rejected, delay 2" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001162 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02001163 renego_delay=2" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001164 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001165 0 \
1166 -C "client hello, adding renegotiation extension" \
1167 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1168 -S "found renegotiation extension" \
1169 -s "server hello, secure renegotiation extension" \
1170 -c "found renegotiation extension" \
1171 -C "=> renegotiate" \
1172 -S "=> renegotiate" \
1173 -s "write hello request" \
1174 -S "SSL - An unexpected message was received from our peer" \
1175 -S "failed"
1176
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001177run_test "Renegotiation: server-initiated, client-rejected, delay 0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001178 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001179 renego_delay=0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001180 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001181 0 \
1182 -C "client hello, adding renegotiation extension" \
1183 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1184 -S "found renegotiation extension" \
1185 -s "server hello, secure renegotiation extension" \
1186 -c "found renegotiation extension" \
1187 -C "=> renegotiate" \
1188 -S "=> renegotiate" \
1189 -s "write hello request" \
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02001190 -s "SSL - An unexpected message was received from our peer"
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001191
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001192run_test "Renegotiation: server-initiated, client-accepted, delay 0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001193 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001194 renego_delay=0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001195 "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001196 0 \
1197 -c "client hello, adding renegotiation extension" \
1198 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1199 -s "found renegotiation extension" \
1200 -s "server hello, secure renegotiation extension" \
1201 -c "found renegotiation extension" \
1202 -c "=> renegotiate" \
1203 -s "=> renegotiate" \
1204 -s "write hello request" \
1205 -S "SSL - An unexpected message was received from our peer" \
1206 -S "failed"
1207
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +01001208run_test "Renegotiation: periodic, just below period" \
1209 "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3" \
1210 "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \
1211 0 \
1212 -C "client hello, adding renegotiation extension" \
1213 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1214 -S "found renegotiation extension" \
1215 -s "server hello, secure renegotiation extension" \
1216 -c "found renegotiation extension" \
1217 -S "record counter limit reached: renegotiate" \
1218 -C "=> renegotiate" \
1219 -S "=> renegotiate" \
1220 -S "write hello request" \
1221 -S "SSL - An unexpected message was received from our peer" \
1222 -S "failed"
1223
Manuel Pégourié-Gonnard9835bc02015-01-14 14:41:58 +01001224# one extra exchange to be able to complete renego
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +01001225run_test "Renegotiation: periodic, just above period" \
1226 "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3" \
Manuel Pégourié-Gonnard9835bc02015-01-14 14:41:58 +01001227 "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +01001228 0 \
1229 -c "client hello, adding renegotiation extension" \
1230 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1231 -s "found renegotiation extension" \
1232 -s "server hello, secure renegotiation extension" \
1233 -c "found renegotiation extension" \
1234 -s "record counter limit reached: renegotiate" \
1235 -c "=> renegotiate" \
1236 -s "=> renegotiate" \
1237 -s "write hello request" \
1238 -S "SSL - An unexpected message was received from our peer" \
1239 -S "failed"
1240
1241run_test "Renegotiation: periodic, two times period" \
1242 "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3" \
Manuel Pégourié-Gonnard9835bc02015-01-14 14:41:58 +01001243 "$P_CLI debug_level=3 exchanges=7 renegotiation=1" \
Manuel Pégourié-Gonnard590f4162014-11-05 14:23:03 +01001244 0 \
1245 -c "client hello, adding renegotiation extension" \
1246 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1247 -s "found renegotiation extension" \
1248 -s "server hello, secure renegotiation extension" \
1249 -c "found renegotiation extension" \
1250 -s "record counter limit reached: renegotiate" \
1251 -c "=> renegotiate" \
1252 -s "=> renegotiate" \
1253 -s "write hello request" \
1254 -S "SSL - An unexpected message was received from our peer" \
1255 -S "failed"
1256
1257run_test "Renegotiation: periodic, above period, disabled" \
1258 "$P_SRV debug_level=3 exchanges=9 renegotiation=0 renego_period=3" \
1259 "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \
1260 0 \
1261 -C "client hello, adding renegotiation extension" \
1262 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1263 -S "found renegotiation extension" \
1264 -s "server hello, secure renegotiation extension" \
1265 -c "found renegotiation extension" \
1266 -S "record counter limit reached: renegotiate" \
1267 -C "=> renegotiate" \
1268 -S "=> renegotiate" \
1269 -S "write hello request" \
1270 -S "SSL - An unexpected message was received from our peer" \
1271 -S "failed"
1272
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001273run_test "Renegotiation: nbio, client-initiated" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001274 "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1" \
1275 "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02001276 0 \
1277 -c "client hello, adding renegotiation extension" \
1278 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1279 -s "found renegotiation extension" \
1280 -s "server hello, secure renegotiation extension" \
1281 -c "found renegotiation extension" \
1282 -c "=> renegotiate" \
1283 -s "=> renegotiate" \
1284 -S "write hello request"
1285
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001286run_test "Renegotiation: nbio, server-initiated" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001287 "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \
1288 "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1" \
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02001289 0 \
1290 -c "client hello, adding renegotiation extension" \
1291 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1292 -s "found renegotiation extension" \
1293 -s "server hello, secure renegotiation extension" \
1294 -c "found renegotiation extension" \
1295 -c "=> renegotiate" \
1296 -s "=> renegotiate" \
1297 -s "write hello request"
1298
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001299run_test "Renegotiation: openssl server, client-initiated" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +02001300 "$O_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001301 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +02001302 0 \
1303 -c "client hello, adding renegotiation extension" \
1304 -c "found renegotiation extension" \
1305 -c "=> renegotiate" \
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001306 -C "ssl_hanshake() returned" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +02001307 -C "error" \
1308 -c "HTTP/1.0 200 [Oo][Kk]"
1309
Paul Bakker539d9722015-02-08 16:18:35 +01001310requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001311run_test "Renegotiation: gnutls server strict, client-initiated" \
1312 "$G_SRV --priority=NORMAL:%SAFE_RENEGOTIATION" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001313 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +02001314 0 \
1315 -c "client hello, adding renegotiation extension" \
1316 -c "found renegotiation extension" \
1317 -c "=> renegotiate" \
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001318 -C "ssl_hanshake() returned" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +02001319 -C "error" \
1320 -c "HTTP/1.0 200 [Oo][Kk]"
1321
Paul Bakker539d9722015-02-08 16:18:35 +01001322requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001323run_test "Renegotiation: gnutls server unsafe, client-initiated default" \
1324 "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1325 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \
1326 1 \
1327 -c "client hello, adding renegotiation extension" \
1328 -C "found renegotiation extension" \
1329 -c "=> renegotiate" \
1330 -c "ssl_handshake() returned" \
1331 -c "error" \
1332 -C "HTTP/1.0 200 [Oo][Kk]"
1333
Paul Bakker539d9722015-02-08 16:18:35 +01001334requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001335run_test "Renegotiation: gnutls server unsafe, client-inititated no legacy" \
1336 "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1337 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \
1338 allow_legacy=0" \
1339 1 \
1340 -c "client hello, adding renegotiation extension" \
1341 -C "found renegotiation extension" \
1342 -c "=> renegotiate" \
1343 -c "ssl_handshake() returned" \
1344 -c "error" \
1345 -C "HTTP/1.0 200 [Oo][Kk]"
1346
Paul Bakker539d9722015-02-08 16:18:35 +01001347requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001348run_test "Renegotiation: gnutls server unsafe, client-inititated legacy" \
1349 "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1350 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \
1351 allow_legacy=1" \
1352 0 \
1353 -c "client hello, adding renegotiation extension" \
1354 -C "found renegotiation extension" \
1355 -c "=> renegotiate" \
1356 -C "ssl_hanshake() returned" \
1357 -C "error" \
1358 -c "HTTP/1.0 200 [Oo][Kk]"
1359
1360# Test for the "secure renegotation" extension only (no actual renegotiation)
1361
Paul Bakker539d9722015-02-08 16:18:35 +01001362requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001363run_test "Renego ext: gnutls server strict, client default" \
1364 "$G_SRV --priority=NORMAL:%SAFE_RENEGOTIATION" \
1365 "$P_CLI debug_level=3" \
1366 0 \
1367 -c "found renegotiation extension" \
1368 -C "error" \
1369 -c "HTTP/1.0 200 [Oo][Kk]"
1370
Paul Bakker539d9722015-02-08 16:18:35 +01001371requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001372run_test "Renego ext: gnutls server unsafe, client default" \
1373 "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1374 "$P_CLI debug_level=3" \
1375 0 \
1376 -C "found renegotiation extension" \
1377 -C "error" \
1378 -c "HTTP/1.0 200 [Oo][Kk]"
1379
Paul Bakker539d9722015-02-08 16:18:35 +01001380requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001381run_test "Renego ext: gnutls server unsafe, client break legacy" \
1382 "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1383 "$P_CLI debug_level=3 allow_legacy=-1" \
1384 1 \
1385 -C "found renegotiation extension" \
1386 -c "error" \
1387 -C "HTTP/1.0 200 [Oo][Kk]"
1388
Paul Bakker539d9722015-02-08 16:18:35 +01001389requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001390run_test "Renego ext: gnutls client strict, server default" \
1391 "$P_SRV debug_level=3" \
1392 "$G_CLI --priority=NORMAL:%SAFE_RENEGOTIATION" \
1393 0 \
1394 -s "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \
1395 -s "server hello, secure renegotiation extension"
1396
Paul Bakker539d9722015-02-08 16:18:35 +01001397requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001398run_test "Renego ext: gnutls client unsafe, server default" \
1399 "$P_SRV debug_level=3" \
1400 "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1401 0 \
1402 -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \
1403 -S "server hello, secure renegotiation extension"
1404
Paul Bakker539d9722015-02-08 16:18:35 +01001405requires_gnutls
Manuel Pégourié-Gonnard85d915b2014-11-03 20:10:36 +01001406run_test "Renego ext: gnutls client unsafe, server break legacy" \
1407 "$P_SRV debug_level=3 allow_legacy=-1" \
1408 "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
1409 1 \
1410 -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \
1411 -S "server hello, secure renegotiation extension"
1412
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001413# Tests for auth_mode
1414
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001415run_test "Authentication: server badcert, client required" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001416 "$P_SRV crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001417 key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001418 "$P_CLI debug_level=1 auth_mode=required" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001419 1 \
1420 -c "x509_verify_cert() returned" \
Manuel Pégourié-Gonnard0c6ce2f2015-04-17 16:32:21 +02001421 -c "! The certificate is not correctly signed by the trusted CA" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001422 -c "! ssl_handshake returned" \
1423 -c "X509 - Certificate verification failed"
1424
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001425run_test "Authentication: server badcert, client optional" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001426 "$P_SRV crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001427 key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001428 "$P_CLI debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001429 0 \
1430 -c "x509_verify_cert() returned" \
Manuel Pégourié-Gonnard0c6ce2f2015-04-17 16:32:21 +02001431 -c "! The certificate is not correctly signed by the trusted CA" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001432 -C "! ssl_handshake returned" \
1433 -C "X509 - Certificate verification failed"
1434
Hanno Becker6fd6d242017-05-25 17:51:31 +01001435run_test "Authentication: server goodcert, client optional, no trusted CA" \
1436 "$P_SRV" \
1437 "$P_CLI debug_level=3 auth_mode=optional ca_file=none ca_path=none" \
1438 0 \
1439 -c "x509_verify_cert() returned" \
1440 -c "! The certificate is not correctly signed by the trusted CA" \
1441 -c "! Certificate verification flags"\
1442 -C "! ssl_handshake returned" \
1443 -C "X509 - Certificate verification failed" \
1444 -C "SSL - No CA Chain is set, but required to operate"
1445
1446run_test "Authentication: server goodcert, client required, no trusted CA" \
1447 "$P_SRV" \
1448 "$P_CLI debug_level=3 auth_mode=required ca_file=none ca_path=none" \
1449 1 \
1450 -c "x509_verify_cert() returned" \
1451 -c "! The certificate is not correctly signed by the trusted CA" \
1452 -c "! Certificate verification flags"\
1453 -c "! ssl_handshake returned" \
1454 -c "SSL - No CA Chain is set, but required to operate"
1455
1456# The purpose of the next two tests is to test the client's behaviour when receiving a server
1457# certificate with an unsupported elliptic curve. This should usually not happen because
1458# the client informs the server about the supported curves - it does, though, in the
1459# corner case of a static ECDH suite, because the server doesn't check the curve on that
1460# occasion (to be fixed). If that bug's fixed, the test needs to be altered to use a
1461# different means to have the server ignoring the client's supported curve list.
1462
1463requires_config_enabled POLARSSL_SSL_SET_CURVES
1464run_test "Authentication: server ECDH p256v1, client required, p256v1 unsupported" \
1465 "$P_SRV debug_level=1 key_file=data_files/server5.key \
1466 crt_file=data_files/server5.ku-ka.crt" \
1467 "$P_CLI debug_level=3 auth_mode=required curves=secp521r1" \
1468 1 \
1469 -c "bad certificate (EC key curve)"\
1470 -c "! Certificate verification flags"\
1471 -C "bad server certificate (ECDH curve)" # Expect failure at earlier verification stage
1472
1473requires_config_enabled POLARSSL_SSL_SET_CURVES
1474run_test "Authentication: server ECDH p256v1, client optional, p256v1 unsupported" \
1475 "$P_SRV debug_level=1 key_file=data_files/server5.key \
1476 crt_file=data_files/server5.ku-ka.crt" \
1477 "$P_CLI debug_level=3 auth_mode=optional curves=secp521r1" \
1478 1 \
1479 -c "bad certificate (EC key curve)"\
1480 -c "! Certificate verification flags"\
1481 -c "bad server certificate (ECDH curve)" # Expect failure only at ECDH params check
1482
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001483run_test "Authentication: server badcert, client none" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001484 "$P_SRV crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001485 key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001486 "$P_CLI debug_level=1 auth_mode=none" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001487 0 \
1488 -C "x509_verify_cert() returned" \
Manuel Pégourié-Gonnard0c6ce2f2015-04-17 16:32:21 +02001489 -C "! The certificate is not correctly signed by the trusted CA" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001490 -C "! ssl_handshake returned" \
1491 -C "X509 - Certificate verification failed"
1492
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001493run_test "Authentication: client badcert, server required" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001494 "$P_SRV debug_level=3 auth_mode=required" \
1495 "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001496 key_file=data_files/server5.key" \
1497 1 \
1498 -S "skip write certificate request" \
1499 -C "skip parse certificate request" \
1500 -c "got a certificate request" \
1501 -C "skip write certificate" \
1502 -C "skip write certificate verify" \
1503 -S "skip parse certificate verify" \
1504 -s "x509_verify_cert() returned" \
Manuel Pégourié-Gonnard0c6ce2f2015-04-17 16:32:21 +02001505 -S "! The certificate is not correctly signed by the trusted CA" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001506 -s "! ssl_handshake returned" \
1507 -c "! ssl_handshake returned" \
1508 -s "X509 - Certificate verification failed"
1509
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001510run_test "Authentication: client badcert, server optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001511 "$P_SRV debug_level=3 auth_mode=optional" \
1512 "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001513 key_file=data_files/server5.key" \
1514 0 \
1515 -S "skip write certificate request" \
1516 -C "skip parse certificate request" \
1517 -c "got a certificate request" \
1518 -C "skip write certificate" \
1519 -C "skip write certificate verify" \
1520 -S "skip parse certificate verify" \
1521 -s "x509_verify_cert() returned" \
Manuel Pégourié-Gonnard0c6ce2f2015-04-17 16:32:21 +02001522 -s "! The certificate is not correctly signed by the trusted CA" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001523 -S "! ssl_handshake returned" \
1524 -C "! ssl_handshake returned" \
1525 -S "X509 - Certificate verification failed"
1526
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001527run_test "Authentication: client badcert, server none" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001528 "$P_SRV debug_level=3 auth_mode=none" \
1529 "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001530 key_file=data_files/server5.key" \
1531 0 \
1532 -s "skip write certificate request" \
1533 -C "skip parse certificate request" \
1534 -c "got no certificate request" \
1535 -c "skip write certificate" \
1536 -c "skip write certificate verify" \
1537 -s "skip parse certificate verify" \
1538 -S "x509_verify_cert() returned" \
Manuel Pégourié-Gonnard0c6ce2f2015-04-17 16:32:21 +02001539 -S "! The certificate is not correctly signed by the trusted CA" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001540 -S "! ssl_handshake returned" \
1541 -C "! ssl_handshake returned" \
1542 -S "X509 - Certificate verification failed"
1543
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001544run_test "Authentication: client no cert, server optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001545 "$P_SRV debug_level=3 auth_mode=optional" \
1546 "$P_CLI debug_level=3 crt_file=none key_file=none" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001547 0 \
1548 -S "skip write certificate request" \
1549 -C "skip parse certificate request" \
1550 -c "got a certificate request" \
1551 -C "skip write certificate$" \
1552 -C "got no certificate to send" \
1553 -S "SSLv3 client has no certificate" \
1554 -c "skip write certificate verify" \
1555 -s "skip parse certificate verify" \
Manuel Pégourié-Gonnard0c6ce2f2015-04-17 16:32:21 +02001556 -s "! Certificate was missing" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001557 -S "! ssl_handshake returned" \
1558 -C "! ssl_handshake returned" \
1559 -S "X509 - Certificate verification failed"
1560
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001561run_test "Authentication: openssl client no cert, server optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001562 "$P_SRV debug_level=3 auth_mode=optional" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001563 "$O_CLI" \
1564 0 \
1565 -S "skip write certificate request" \
1566 -s "skip parse certificate verify" \
Manuel Pégourié-Gonnard0c6ce2f2015-04-17 16:32:21 +02001567 -s "! Certificate was missing" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001568 -S "! ssl_handshake returned" \
1569 -S "X509 - Certificate verification failed"
1570
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001571run_test "Authentication: client no cert, openssl server optional" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001572 "$O_SRV -verify 10" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001573 "$P_CLI debug_level=3 crt_file=none key_file=none" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001574 0 \
1575 -C "skip parse certificate request" \
1576 -c "got a certificate request" \
1577 -C "skip write certificate$" \
1578 -c "skip write certificate verify" \
1579 -C "! ssl_handshake returned"
1580
Janos Follath4dfecab2016-03-14 13:40:43 +00001581requires_config_enabled POLARSSL_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001582run_test "Authentication: client no cert, ssl3" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001583 "$P_SRV debug_level=3 auth_mode=optional force_version=ssl3" \
Manuel Pégourié-Gonnard448ea502015-01-12 11:40:14 +01001584 "$P_CLI debug_level=3 crt_file=none key_file=none min_version=ssl3" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001585 0 \
1586 -S "skip write certificate request" \
1587 -C "skip parse certificate request" \
1588 -c "got a certificate request" \
1589 -C "skip write certificate$" \
1590 -c "skip write certificate verify" \
1591 -c "got no certificate to send" \
1592 -s "SSLv3 client has no certificate" \
1593 -s "skip parse certificate verify" \
Manuel Pégourié-Gonnard0c6ce2f2015-04-17 16:32:21 +02001594 -s "! Certificate was missing" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001595 -S "! ssl_handshake returned" \
1596 -C "! ssl_handshake returned" \
1597 -S "X509 - Certificate verification failed"
1598
Manuel Pégourié-Gonnarda68d5912017-07-10 11:31:43 +02001599run_test "Authentication: server max_int chain, client default" \
1600 "$P_SRV crt_file=data_files/dir-maxpath/c09.pem \
1601 key_file=data_files/dir-maxpath/09.key" \
1602 "$P_CLI server_name=CA09 server_addr=127.0.0.1 \
1603 ca_file=data_files/dir-maxpath/00.crt" \
1604 0 \
1605 -C "X509 - A fatal error occured"
1606
1607run_test "Authentication: server max_int+1 chain, client default" \
1608 "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \
1609 key_file=data_files/dir-maxpath/10.key" \
1610 "$P_CLI server_name=CA10 server_addr=127.0.0.1 \
1611 ca_file=data_files/dir-maxpath/00.crt" \
1612 1 \
1613 -c "X509 - A fatal error occured"
1614
1615run_test "Authentication: server max_int+1 chain, client optional" \
1616 "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \
1617 key_file=data_files/dir-maxpath/10.key" \
1618 "$P_CLI server_name=CA10 server_addr=127.0.0.1 \
1619 ca_file=data_files/dir-maxpath/00.crt \
1620 auth_mode=optional" \
1621 1 \
1622 -c "X509 - A fatal error occured"
1623
1624run_test "Authentication: server max_int+1 chain, client none" \
1625 "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \
1626 key_file=data_files/dir-maxpath/10.key" \
1627 "$P_CLI server_name=CA10 server_addr=127.0.0.1 ca_file=data_files/dir-maxpath/00.crt \
1628 auth_mode=none" \
1629 0 \
1630 -C "X509 - A fatal error occured"
1631
1632run_test "Authentication: client max_int+1 chain, server none" \
1633 "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=none" \
1634 "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \
1635 key_file=data_files/dir-maxpath/10.key" \
1636 0 \
1637 -S "X509 - A fatal error occured"
1638
1639run_test "Authentication: client max_int+1 chain, server optional" \
1640 "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=optional" \
1641 "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \
1642 key_file=data_files/dir-maxpath/10.key" \
1643 1 \
1644 -s "X509 - A fatal error occured"
1645
1646run_test "Authentication: client max_int+1 chain, server required" \
1647 "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \
1648 "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \
1649 key_file=data_files/dir-maxpath/10.key" \
1650 1 \
1651 -s "X509 - A fatal error occured"
1652
1653run_test "Authentication: client max_int chain, server required" \
1654 "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \
1655 "$P_CLI crt_file=data_files/dir-maxpath/c09.pem \
1656 key_file=data_files/dir-maxpath/09.key" \
1657 0 \
1658 -S "X509 - A fatal error occured"
1659
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +01001660# Tests for certificate selection based on SHA verson
1661
1662run_test "Certificate hash: client TLS 1.2 -> SHA-2" \
1663 "$P_SRV crt_file=data_files/server5.crt \
1664 key_file=data_files/server5.key \
1665 crt_file2=data_files/server5-sha1.crt \
1666 key_file2=data_files/server5.key" \
1667 "$P_CLI force_version=tls1_2" \
1668 0 \
1669 -c "signed using.*ECDSA with SHA256" \
1670 -C "signed using.*ECDSA with SHA1"
1671
1672run_test "Certificate hash: client TLS 1.1 -> SHA-1" \
1673 "$P_SRV crt_file=data_files/server5.crt \
1674 key_file=data_files/server5.key \
1675 crt_file2=data_files/server5-sha1.crt \
1676 key_file2=data_files/server5.key" \
1677 "$P_CLI force_version=tls1_1" \
1678 0 \
1679 -C "signed using.*ECDSA with SHA256" \
1680 -c "signed using.*ECDSA with SHA1"
1681
1682run_test "Certificate hash: client TLS 1.0 -> SHA-1" \
1683 "$P_SRV crt_file=data_files/server5.crt \
1684 key_file=data_files/server5.key \
1685 crt_file2=data_files/server5-sha1.crt \
1686 key_file2=data_files/server5.key" \
1687 "$P_CLI force_version=tls1" \
1688 0 \
1689 -C "signed using.*ECDSA with SHA256" \
1690 -c "signed using.*ECDSA with SHA1"
1691
1692run_test "Certificate hash: client TLS 1.1, no SHA-1 -> SHA-2 (order 1)" \
1693 "$P_SRV crt_file=data_files/server5.crt \
1694 key_file=data_files/server5.key \
1695 crt_file2=data_files/server6.crt \
1696 key_file2=data_files/server6.key" \
1697 "$P_CLI force_version=tls1_1" \
1698 0 \
1699 -c "serial number.*09" \
1700 -c "signed using.*ECDSA with SHA256" \
1701 -C "signed using.*ECDSA with SHA1"
1702
1703run_test "Certificate hash: client TLS 1.1, no SHA-1 -> SHA-2 (order 2)" \
1704 "$P_SRV crt_file=data_files/server6.crt \
1705 key_file=data_files/server6.key \
1706 crt_file2=data_files/server5.crt \
1707 key_file2=data_files/server5.key" \
1708 "$P_CLI force_version=tls1_1" \
1709 0 \
1710 -c "serial number.*0A" \
1711 -c "signed using.*ECDSA with SHA256" \
1712 -C "signed using.*ECDSA with SHA1"
1713
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001714# tests for SNI
1715
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001716run_test "SNI: no SNI callback" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001717 "$P_SRV debug_level=3 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001718 crt_file=data_files/server5.crt key_file=data_files/server5.key" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001719 "$P_CLI debug_level=0 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001720 server_name=localhost" \
1721 0 \
1722 -S "parse ServerName extension" \
1723 -c "issuer name *: C=NL, O=PolarSSL, CN=Polarssl Test EC CA" \
1724 -c "subject name *: C=NL, O=PolarSSL, CN=localhost"
1725
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001726run_test "SNI: matching cert 1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001727 "$P_SRV debug_level=3 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001728 crt_file=data_files/server5.crt key_file=data_files/server5.key \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001729 sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001730 "$P_CLI debug_level=0 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001731 server_name=localhost" \
1732 0 \
1733 -s "parse ServerName extension" \
1734 -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \
1735 -c "subject name *: C=NL, O=PolarSSL, CN=localhost"
1736
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001737run_test "SNI: matching cert 2" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001738 "$P_SRV debug_level=3 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001739 crt_file=data_files/server5.crt key_file=data_files/server5.key \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001740 sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001741 "$P_CLI debug_level=0 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001742 server_name=polarssl.example" \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001743 0 \
1744 -s "parse ServerName extension" \
1745 -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001746 -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example"
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001747
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001748run_test "SNI: no matching cert" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001749 "$P_SRV debug_level=3 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001750 crt_file=data_files/server5.crt key_file=data_files/server5.key \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001751 sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001752 "$P_CLI debug_level=0 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001753 server_name=nonesuch.example" \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001754 1 \
1755 -s "parse ServerName extension" \
1756 -s "ssl_sni_wrapper() returned" \
1757 -s "ssl_handshake returned" \
1758 -c "ssl_handshake returned" \
1759 -c "SSL - A fatal alert message was received from our peer"
1760
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001761# Tests for non-blocking I/O: exercise a variety of handshake flows
1762
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001763run_test "Non-blocking I/O: basic handshake" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001764 "$P_SRV nbio=2 tickets=0 auth_mode=none" \
1765 "$P_CLI nbio=2 tickets=0" \
1766 0 \
1767 -S "ssl_handshake returned" \
1768 -C "ssl_handshake returned" \
1769 -c "Read from server: .* bytes read"
1770
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001771run_test "Non-blocking I/O: client auth" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001772 "$P_SRV nbio=2 tickets=0 auth_mode=required" \
1773 "$P_CLI nbio=2 tickets=0" \
1774 0 \
1775 -S "ssl_handshake returned" \
1776 -C "ssl_handshake returned" \
1777 -c "Read from server: .* bytes read"
1778
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001779run_test "Non-blocking I/O: ticket" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001780 "$P_SRV nbio=2 tickets=1 auth_mode=none" \
1781 "$P_CLI nbio=2 tickets=1" \
1782 0 \
1783 -S "ssl_handshake returned" \
1784 -C "ssl_handshake returned" \
1785 -c "Read from server: .* bytes read"
1786
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001787run_test "Non-blocking I/O: ticket + client auth" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001788 "$P_SRV nbio=2 tickets=1 auth_mode=required" \
1789 "$P_CLI nbio=2 tickets=1" \
1790 0 \
1791 -S "ssl_handshake returned" \
1792 -C "ssl_handshake returned" \
1793 -c "Read from server: .* bytes read"
1794
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001795run_test "Non-blocking I/O: ticket + client auth + resume" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001796 "$P_SRV nbio=2 tickets=1 auth_mode=required" \
1797 "$P_CLI nbio=2 tickets=1 reconnect=1" \
1798 0 \
1799 -S "ssl_handshake returned" \
1800 -C "ssl_handshake returned" \
1801 -c "Read from server: .* bytes read"
1802
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001803run_test "Non-blocking I/O: ticket + resume" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001804 "$P_SRV nbio=2 tickets=1 auth_mode=none" \
1805 "$P_CLI nbio=2 tickets=1 reconnect=1" \
1806 0 \
1807 -S "ssl_handshake returned" \
1808 -C "ssl_handshake returned" \
1809 -c "Read from server: .* bytes read"
1810
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001811run_test "Non-blocking I/O: session-id resume" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001812 "$P_SRV nbio=2 tickets=0 auth_mode=none" \
1813 "$P_CLI nbio=2 tickets=0 reconnect=1" \
1814 0 \
1815 -S "ssl_handshake returned" \
1816 -C "ssl_handshake returned" \
1817 -c "Read from server: .* bytes read"
1818
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001819# Tests for version negotiation
1820
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001821run_test "Version check: all -> 1.2" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001822 "$P_SRV" \
1823 "$P_CLI" \
1824 0 \
1825 -S "ssl_handshake returned" \
1826 -C "ssl_handshake returned" \
1827 -s "Protocol is TLSv1.2" \
1828 -c "Protocol is TLSv1.2"
1829
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001830run_test "Version check: cli max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001831 "$P_SRV" \
1832 "$P_CLI max_version=tls1_1" \
1833 0 \
1834 -S "ssl_handshake returned" \
1835 -C "ssl_handshake returned" \
1836 -s "Protocol is TLSv1.1" \
1837 -c "Protocol is TLSv1.1"
1838
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001839run_test "Version check: srv max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001840 "$P_SRV max_version=tls1_1" \
1841 "$P_CLI" \
1842 0 \
1843 -S "ssl_handshake returned" \
1844 -C "ssl_handshake returned" \
1845 -s "Protocol is TLSv1.1" \
1846 -c "Protocol is TLSv1.1"
1847
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001848run_test "Version check: cli+srv max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001849 "$P_SRV max_version=tls1_1" \
1850 "$P_CLI max_version=tls1_1" \
1851 0 \
1852 -S "ssl_handshake returned" \
1853 -C "ssl_handshake returned" \
1854 -s "Protocol is TLSv1.1" \
1855 -c "Protocol is TLSv1.1"
1856
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001857run_test "Version check: cli max 1.1, srv min 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001858 "$P_SRV min_version=tls1_1" \
1859 "$P_CLI max_version=tls1_1" \
1860 0 \
1861 -S "ssl_handshake returned" \
1862 -C "ssl_handshake returned" \
1863 -s "Protocol is TLSv1.1" \
1864 -c "Protocol is TLSv1.1"
1865
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001866run_test "Version check: cli min 1.1, srv max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001867 "$P_SRV max_version=tls1_1" \
1868 "$P_CLI min_version=tls1_1" \
1869 0 \
1870 -S "ssl_handshake returned" \
1871 -C "ssl_handshake returned" \
1872 -s "Protocol is TLSv1.1" \
1873 -c "Protocol is TLSv1.1"
1874
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001875run_test "Version check: cli min 1.2, srv max 1.1 -> fail" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001876 "$P_SRV max_version=tls1_1" \
1877 "$P_CLI min_version=tls1_2" \
1878 1 \
1879 -s "ssl_handshake returned" \
1880 -c "ssl_handshake returned" \
1881 -c "SSL - Handshake protocol not within min/max boundaries"
1882
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001883run_test "Version check: srv min 1.2, cli max 1.1 -> fail" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001884 "$P_SRV min_version=tls1_2" \
1885 "$P_CLI max_version=tls1_1" \
1886 1 \
1887 -s "ssl_handshake returned" \
1888 -c "ssl_handshake returned" \
1889 -s "SSL - Handshake protocol not within min/max boundaries"
1890
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001891# Tests for ALPN extension
1892
Manuel Pégourié-Gonnard83d8c732014-04-07 13:24:21 +02001893if grep '^#define POLARSSL_SSL_ALPN' $CONFIG_H >/dev/null; then
1894
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001895run_test "ALPN: none" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001896 "$P_SRV debug_level=3" \
1897 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001898 0 \
1899 -C "client hello, adding alpn extension" \
1900 -S "found alpn extension" \
1901 -C "got an alert message, type: \\[2:120]" \
1902 -S "server hello, adding alpn extension" \
1903 -C "found alpn extension " \
1904 -C "Application Layer Protocol is" \
1905 -S "Application Layer Protocol is"
1906
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001907run_test "ALPN: client only" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001908 "$P_SRV debug_level=3" \
1909 "$P_CLI debug_level=3 alpn=abc,1234" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001910 0 \
1911 -c "client hello, adding alpn extension" \
1912 -s "found alpn extension" \
1913 -C "got an alert message, type: \\[2:120]" \
1914 -S "server hello, adding alpn extension" \
1915 -C "found alpn extension " \
1916 -c "Application Layer Protocol is (none)" \
1917 -S "Application Layer Protocol is"
1918
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001919run_test "ALPN: server only" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001920 "$P_SRV debug_level=3 alpn=abc,1234" \
1921 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001922 0 \
1923 -C "client hello, adding alpn extension" \
1924 -S "found alpn extension" \
1925 -C "got an alert message, type: \\[2:120]" \
1926 -S "server hello, adding alpn extension" \
1927 -C "found alpn extension " \
1928 -C "Application Layer Protocol is" \
1929 -s "Application Layer Protocol is (none)"
1930
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001931run_test "ALPN: both, common cli1-srv1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001932 "$P_SRV debug_level=3 alpn=abc,1234" \
1933 "$P_CLI debug_level=3 alpn=abc,1234" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001934 0 \
1935 -c "client hello, adding alpn extension" \
1936 -s "found alpn extension" \
1937 -C "got an alert message, type: \\[2:120]" \
1938 -s "server hello, adding alpn extension" \
1939 -c "found alpn extension" \
1940 -c "Application Layer Protocol is abc" \
1941 -s "Application Layer Protocol is abc"
1942
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001943run_test "ALPN: both, common cli2-srv1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001944 "$P_SRV debug_level=3 alpn=abc,1234" \
1945 "$P_CLI debug_level=3 alpn=1234,abc" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001946 0 \
1947 -c "client hello, adding alpn extension" \
1948 -s "found alpn extension" \
1949 -C "got an alert message, type: \\[2:120]" \
1950 -s "server hello, adding alpn extension" \
1951 -c "found alpn extension" \
1952 -c "Application Layer Protocol is abc" \
1953 -s "Application Layer Protocol is abc"
1954
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001955run_test "ALPN: both, common cli1-srv2" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001956 "$P_SRV debug_level=3 alpn=abc,1234" \
1957 "$P_CLI debug_level=3 alpn=1234,abcde" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001958 0 \
1959 -c "client hello, adding alpn extension" \
1960 -s "found alpn extension" \
1961 -C "got an alert message, type: \\[2:120]" \
1962 -s "server hello, adding alpn extension" \
1963 -c "found alpn extension" \
1964 -c "Application Layer Protocol is 1234" \
1965 -s "Application Layer Protocol is 1234"
1966
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001967run_test "ALPN: both, no common" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001968 "$P_SRV debug_level=3 alpn=abc,123" \
1969 "$P_CLI debug_level=3 alpn=1234,abcde" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001970 1 \
1971 -c "client hello, adding alpn extension" \
1972 -s "found alpn extension" \
1973 -c "got an alert message, type: \\[2:120]" \
1974 -S "server hello, adding alpn extension" \
1975 -C "found alpn extension" \
1976 -C "Application Layer Protocol is 1234" \
1977 -S "Application Layer Protocol is 1234"
1978
Manuel Pégourié-Gonnard83d8c732014-04-07 13:24:21 +02001979fi
1980
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001981# Tests for keyUsage in leaf certificates, part 1:
1982# server-side certificate/suite selection
1983
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001984run_test "keyUsage srv: RSA, digitalSignature -> (EC)DHE-RSA" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001985 "$P_SRV key_file=data_files/server2.key \
1986 crt_file=data_files/server2.ku-ds.crt" \
1987 "$P_CLI" \
1988 0 \
Manuel Pégourié-Gonnard17cde5f2014-05-22 14:42:39 +02001989 -c "Ciphersuite is TLS-[EC]*DHE-RSA-WITH-"
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001990
1991
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001992run_test "keyUsage srv: RSA, keyEncipherment -> RSA" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001993 "$P_SRV key_file=data_files/server2.key \
1994 crt_file=data_files/server2.ku-ke.crt" \
1995 "$P_CLI" \
1996 0 \
1997 -c "Ciphersuite is TLS-RSA-WITH-"
1998
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001999run_test "keyUsage srv: RSA, keyAgreement -> fail" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02002000 "$P_SRV key_file=data_files/server2.key \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002001 crt_file=data_files/server2.ku-ka.crt" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02002002 "$P_CLI" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002003 1 \
2004 -C "Ciphersuite is "
2005
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002006run_test "keyUsage srv: ECDSA, digitalSignature -> ECDHE-ECDSA" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002007 "$P_SRV key_file=data_files/server5.key \
2008 crt_file=data_files/server5.ku-ds.crt" \
2009 "$P_CLI" \
2010 0 \
2011 -c "Ciphersuite is TLS-ECDHE-ECDSA-WITH-"
2012
2013
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002014run_test "keyUsage srv: ECDSA, keyAgreement -> ECDH-" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002015 "$P_SRV key_file=data_files/server5.key \
2016 crt_file=data_files/server5.ku-ka.crt" \
2017 "$P_CLI" \
2018 0 \
2019 -c "Ciphersuite is TLS-ECDH-"
2020
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002021run_test "keyUsage srv: ECDSA, keyEncipherment -> fail" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02002022 "$P_SRV key_file=data_files/server5.key \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002023 crt_file=data_files/server5.ku-ke.crt" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02002024 "$P_CLI" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002025 1 \
2026 -C "Ciphersuite is "
2027
2028# Tests for keyUsage in leaf certificates, part 2:
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002029# client-side checking of server cert
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002030
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002031run_test "keyUsage cli: DigitalSignature+KeyEncipherment, RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002032 "$O_SRV -key data_files/server2.key \
2033 -cert data_files/server2.ku-ds_ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002034 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002035 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
2036 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002037 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002038 -C "Processing of the Certificate handshake message failed" \
2039 -c "Ciphersuite is TLS-"
2040
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002041run_test "keyUsage cli: DigitalSignature+KeyEncipherment, DHE-RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002042 "$O_SRV -key data_files/server2.key \
2043 -cert data_files/server2.ku-ds_ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002044 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002045 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
2046 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002047 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002048 -C "Processing of the Certificate handshake message failed" \
2049 -c "Ciphersuite is TLS-"
2050
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002051run_test "keyUsage cli: KeyEncipherment, RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002052 "$O_SRV -key data_files/server2.key \
2053 -cert data_files/server2.ku-ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002054 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002055 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
2056 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002057 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002058 -C "Processing of the Certificate handshake message failed" \
2059 -c "Ciphersuite is TLS-"
2060
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002061run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002062 "$O_SRV -key data_files/server2.key \
2063 -cert data_files/server2.ku-ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002064 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002065 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
2066 1 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002067 -c "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002068 -c "Processing of the Certificate handshake message failed" \
2069 -C "Ciphersuite is TLS-"
2070
Manuel Pégourié-Gonnarde16b62c2015-04-17 16:55:53 +02002071run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail, soft" \
2072 "$O_SRV -key data_files/server2.key \
2073 -cert data_files/server2.ku-ke.crt" \
2074 "$P_CLI debug_level=1 auth_mode=optional \
2075 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
2076 0 \
2077 -c "bad certificate (usage extensions)" \
2078 -C "Processing of the Certificate handshake message failed" \
2079 -c "Ciphersuite is TLS-" \
2080 -c "! Usage does not match the keyUsage extension"
2081
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002082run_test "keyUsage cli: DigitalSignature, DHE-RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002083 "$O_SRV -key data_files/server2.key \
2084 -cert data_files/server2.ku-ds.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002085 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002086 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
2087 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002088 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002089 -C "Processing of the Certificate handshake message failed" \
2090 -c "Ciphersuite is TLS-"
2091
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002092run_test "keyUsage cli: DigitalSignature, RSA: fail" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002093 "$O_SRV -key data_files/server2.key \
2094 -cert data_files/server2.ku-ds.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002095 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002096 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
2097 1 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002098 -c "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02002099 -c "Processing of the Certificate handshake message failed" \
2100 -C "Ciphersuite is TLS-"
2101
Manuel Pégourié-Gonnarde16b62c2015-04-17 16:55:53 +02002102run_test "keyUsage cli: DigitalSignature, RSA: fail, soft" \
2103 "$O_SRV -key data_files/server2.key \
2104 -cert data_files/server2.ku-ds.crt" \
2105 "$P_CLI debug_level=1 auth_mode=optional \
2106 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
2107 0 \
2108 -c "bad certificate (usage extensions)" \
2109 -C "Processing of the Certificate handshake message failed" \
2110 -c "Ciphersuite is TLS-" \
2111 -c "! Usage does not match the keyUsage extension"
2112
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002113# Tests for keyUsage in leaf certificates, part 3:
2114# server-side checking of client cert
2115
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002116run_test "keyUsage cli-auth: RSA, DigitalSignature: OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002117 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002118 "$O_CLI -key data_files/server2.key \
2119 -cert data_files/server2.ku-ds.crt" \
2120 0 \
2121 -S "bad certificate (usage extensions)" \
2122 -S "Processing of the Certificate handshake message failed"
2123
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002124run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (soft)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002125 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002126 "$O_CLI -key data_files/server2.key \
2127 -cert data_files/server2.ku-ke.crt" \
2128 0 \
2129 -s "bad certificate (usage extensions)" \
2130 -S "Processing of the Certificate handshake message failed"
2131
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002132run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (hard)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002133 "$P_SRV debug_level=1 auth_mode=required" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002134 "$O_CLI -key data_files/server2.key \
2135 -cert data_files/server2.ku-ke.crt" \
2136 1 \
2137 -s "bad certificate (usage extensions)" \
2138 -s "Processing of the Certificate handshake message failed"
2139
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002140run_test "keyUsage cli-auth: ECDSA, DigitalSignature: OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002141 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002142 "$O_CLI -key data_files/server5.key \
2143 -cert data_files/server5.ku-ds.crt" \
2144 0 \
2145 -S "bad certificate (usage extensions)" \
2146 -S "Processing of the Certificate handshake message failed"
2147
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002148run_test "keyUsage cli-auth: ECDSA, KeyAgreement: fail (soft)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002149 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02002150 "$O_CLI -key data_files/server5.key \
2151 -cert data_files/server5.ku-ka.crt" \
2152 0 \
2153 -s "bad certificate (usage extensions)" \
2154 -S "Processing of the Certificate handshake message failed"
2155
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002156# Tests for extendedKeyUsage, part 1: server-side certificate/suite selection
2157
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002158run_test "extKeyUsage srv: serverAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002159 "$P_SRV key_file=data_files/server5.key \
2160 crt_file=data_files/server5.eku-srv.crt" \
2161 "$P_CLI" \
2162 0
2163
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002164run_test "extKeyUsage srv: serverAuth,clientAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002165 "$P_SRV key_file=data_files/server5.key \
2166 crt_file=data_files/server5.eku-srv.crt" \
2167 "$P_CLI" \
2168 0
2169
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002170run_test "extKeyUsage srv: codeSign,anyEKU -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002171 "$P_SRV key_file=data_files/server5.key \
2172 crt_file=data_files/server5.eku-cs_any.crt" \
2173 "$P_CLI" \
2174 0
2175
2176# add psk to leave an option for client to send SERVERQUIT
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002177run_test "extKeyUsage srv: codeSign -> fail" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002178 "$P_SRV psk=abc123 key_file=data_files/server5.key \
2179 crt_file=data_files/server5.eku-cli.crt" \
2180 "$P_CLI psk=badbad" \
2181 1
2182
2183# Tests for extendedKeyUsage, part 2: client-side checking of server cert
2184
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002185run_test "extKeyUsage cli: serverAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002186 "$O_SRV -key data_files/server5.key \
2187 -cert data_files/server5.eku-srv.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002188 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002189 0 \
2190 -C "bad certificate (usage extensions)" \
2191 -C "Processing of the Certificate handshake message failed" \
2192 -c "Ciphersuite is TLS-"
2193
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002194run_test "extKeyUsage cli: serverAuth,clientAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002195 "$O_SRV -key data_files/server5.key \
2196 -cert data_files/server5.eku-srv_cli.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002197 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002198 0 \
2199 -C "bad certificate (usage extensions)" \
2200 -C "Processing of the Certificate handshake message failed" \
2201 -c "Ciphersuite is TLS-"
2202
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002203run_test "extKeyUsage cli: codeSign,anyEKU -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002204 "$O_SRV -key data_files/server5.key \
2205 -cert data_files/server5.eku-cs_any.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002206 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002207 0 \
2208 -C "bad certificate (usage extensions)" \
2209 -C "Processing of the Certificate handshake message failed" \
2210 -c "Ciphersuite is TLS-"
2211
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002212run_test "extKeyUsage cli: codeSign -> fail" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002213 "$O_SRV -key data_files/server5.key \
2214 -cert data_files/server5.eku-cs.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002215 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002216 1 \
2217 -c "bad certificate (usage extensions)" \
2218 -c "Processing of the Certificate handshake message failed" \
2219 -C "Ciphersuite is TLS-"
2220
2221# Tests for extendedKeyUsage, part 3: server-side checking of client cert
2222
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002223run_test "extKeyUsage cli-auth: clientAuth -> OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002224 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002225 "$O_CLI -key data_files/server5.key \
2226 -cert data_files/server5.eku-cli.crt" \
2227 0 \
2228 -S "bad certificate (usage extensions)" \
2229 -S "Processing of the Certificate handshake message failed"
2230
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002231run_test "extKeyUsage cli-auth: serverAuth,clientAuth -> OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002232 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002233 "$O_CLI -key data_files/server5.key \
2234 -cert data_files/server5.eku-srv_cli.crt" \
2235 0 \
2236 -S "bad certificate (usage extensions)" \
2237 -S "Processing of the Certificate handshake message failed"
2238
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002239run_test "extKeyUsage cli-auth: codeSign,anyEKU -> OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002240 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002241 "$O_CLI -key data_files/server5.key \
2242 -cert data_files/server5.eku-cs_any.crt" \
2243 0 \
2244 -S "bad certificate (usage extensions)" \
2245 -S "Processing of the Certificate handshake message failed"
2246
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002247run_test "extKeyUsage cli-auth: codeSign -> fail (soft)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002248 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002249 "$O_CLI -key data_files/server5.key \
2250 -cert data_files/server5.eku-cs.crt" \
2251 0 \
2252 -s "bad certificate (usage extensions)" \
2253 -S "Processing of the Certificate handshake message failed"
2254
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002255run_test "extKeyUsage cli-auth: codeSign -> fail (hard)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02002256 "$P_SRV debug_level=1 auth_mode=required" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02002257 "$O_CLI -key data_files/server5.key \
2258 -cert data_files/server5.eku-cs.crt" \
2259 1 \
2260 -s "bad certificate (usage extensions)" \
2261 -s "Processing of the Certificate handshake message failed"
2262
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02002263# Tests for DHM parameters loading
2264
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002265run_test "DHM parameters: reference" \
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02002266 "$P_SRV" \
2267 "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
2268 debug_level=3" \
2269 0 \
2270 -c "value of 'DHM: P ' (2048 bits)" \
2271 -c "value of 'DHM: G ' (2048 bits)"
2272
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002273run_test "DHM parameters: other parameters" \
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02002274 "$P_SRV dhm_file=data_files/dhparams.pem" \
2275 "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
2276 debug_level=3" \
2277 0 \
2278 -c "value of 'DHM: P ' (1024 bits)" \
2279 -c "value of 'DHM: G ' (2 bits)"
2280
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002281# Tests for PSK callback
2282
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002283run_test "PSK callback: psk, no callback" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002284 "$P_SRV psk=abc123 psk_identity=foo" \
2285 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2286 psk_identity=foo psk=abc123" \
2287 0 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002288 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02002289 -S "SSL - Unknown identity received" \
2290 -S "SSL - Verification of the message MAC failed"
2291
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002292run_test "PSK callback: no psk, no callback" \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02002293 "$P_SRV" \
2294 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2295 psk_identity=foo psk=abc123" \
2296 1 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002297 -s "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002298 -S "SSL - Unknown identity received" \
2299 -S "SSL - Verification of the message MAC failed"
2300
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002301run_test "PSK callback: callback overrides other settings" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002302 "$P_SRV psk=abc123 psk_identity=foo psk_list=abc,dead,def,beef" \
2303 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2304 psk_identity=foo psk=abc123" \
2305 1 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002306 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002307 -s "SSL - Unknown identity received" \
2308 -S "SSL - Verification of the message MAC failed"
2309
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002310run_test "PSK callback: first id matches" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002311 "$P_SRV psk_list=abc,dead,def,beef" \
2312 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2313 psk_identity=abc psk=dead" \
2314 0 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002315 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002316 -S "SSL - Unknown identity received" \
2317 -S "SSL - Verification of the message MAC failed"
2318
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002319run_test "PSK callback: second id matches" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002320 "$P_SRV psk_list=abc,dead,def,beef" \
2321 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2322 psk_identity=def psk=beef" \
2323 0 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002324 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002325 -S "SSL - Unknown identity received" \
2326 -S "SSL - Verification of the message MAC failed"
2327
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002328run_test "PSK callback: no match" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002329 "$P_SRV psk_list=abc,dead,def,beef" \
2330 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2331 psk_identity=ghi psk=beef" \
2332 1 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002333 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002334 -s "SSL - Unknown identity received" \
2335 -S "SSL - Verification of the message MAC failed"
2336
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002337run_test "PSK callback: wrong key" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002338 "$P_SRV psk_list=abc,dead,def,beef" \
2339 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
2340 psk_identity=abc psk=beef" \
2341 1 \
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002342 -S "SSL - None of the common ciphersuites is usable" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02002343 -S "SSL - Unknown identity received" \
2344 -s "SSL - Verification of the message MAC failed"
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02002345
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02002346# Tests for ciphersuites per version
2347
Janos Follath4dfecab2016-03-14 13:40:43 +00002348requires_config_enabled POLARSSL_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002349run_test "Per-version suites: SSL3" \
Manuel Pégourié-Gonnard448ea502015-01-12 11:40:14 +01002350 "$P_SRV min_version=ssl3 version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02002351 "$P_CLI force_version=ssl3" \
2352 0 \
2353 -c "Ciphersuite is TLS-RSA-WITH-3DES-EDE-CBC-SHA"
2354
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002355run_test "Per-version suites: TLS 1.0" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002356 "$P_SRV arc4=1 version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
2357 "$P_CLI force_version=tls1 arc4=1" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02002358 0 \
2359 -c "Ciphersuite is TLS-RSA-WITH-RC4-128-SHA"
2360
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002361run_test "Per-version suites: TLS 1.1" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02002362 "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
2363 "$P_CLI force_version=tls1_1" \
2364 0 \
2365 -c "Ciphersuite is TLS-RSA-WITH-AES-128-CBC-SHA"
2366
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002367run_test "Per-version suites: TLS 1.2" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02002368 "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
2369 "$P_CLI force_version=tls1_2" \
2370 0 \
2371 -c "Ciphersuite is TLS-RSA-WITH-AES-128-GCM-SHA256"
2372
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +02002373# Tests for ssl_get_bytes_avail()
2374
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002375run_test "ssl_get_bytes_avail: no extra data" \
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +02002376 "$P_SRV" \
2377 "$P_CLI request_size=100" \
2378 0 \
2379 -s "Read from client: 100 bytes read$"
2380
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02002381run_test "ssl_get_bytes_avail: extra data" \
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +02002382 "$P_SRV" \
2383 "$P_CLI request_size=500" \
2384 0 \
2385 -s "Read from client: 500 bytes read (.*+.*)"
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02002386
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002387# Tests for small packets
2388
Janos Follath4dfecab2016-03-14 13:40:43 +00002389requires_config_enabled POLARSSL_SSL_PROTO_SSL3
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002390run_test "Small packet SSLv3 BlockCipher" \
Manuel Pégourié-Gonnard448ea502015-01-12 11:40:14 +01002391 "$P_SRV min_version=ssl3" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002392 "$P_CLI request_size=1 force_version=ssl3 \
2393 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2394 0 \
2395 -s "Read from client: 1 bytes read"
2396
Janos Follath4dfecab2016-03-14 13:40:43 +00002397requires_config_enabled POLARSSL_SSL_PROTO_SSL3
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002398run_test "Small packet SSLv3 StreamCipher" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002399 "$P_SRV min_version=ssl3 arc4=1" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002400 "$P_CLI request_size=1 force_version=ssl3 \
2401 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2402 0 \
2403 -s "Read from client: 1 bytes read"
2404
2405run_test "Small packet TLS 1.0 BlockCipher" \
2406 "$P_SRV" \
2407 "$P_CLI request_size=1 force_version=tls1 \
2408 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2409 0 \
2410 -s "Read from client: 1 bytes read"
2411
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +01002412run_test "Small packet TLS 1.0 BlockCipher without EtM" \
2413 "$P_SRV" \
2414 "$P_CLI request_size=1 force_version=tls1 etm=0 \
2415 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2416 0 \
2417 -s "Read from client: 1 bytes read"
2418
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002419run_test "Small packet TLS 1.0 BlockCipher truncated MAC" \
2420 "$P_SRV" \
2421 "$P_CLI request_size=1 force_version=tls1 \
2422 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2423 trunc_hmac=1" \
2424 0 \
2425 -s "Read from client: 1 bytes read"
2426
2427run_test "Small packet TLS 1.0 StreamCipher truncated MAC" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002428 "$P_SRV arc4=1" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002429 "$P_CLI request_size=1 force_version=tls1 \
2430 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2431 trunc_hmac=1" \
2432 0 \
2433 -s "Read from client: 1 bytes read"
2434
2435run_test "Small packet TLS 1.1 BlockCipher" \
2436 "$P_SRV" \
2437 "$P_CLI request_size=1 force_version=tls1_1 \
2438 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2439 0 \
2440 -s "Read from client: 1 bytes read"
2441
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +01002442run_test "Small packet TLS 1.1 BlockCipher without EtM" \
2443 "$P_SRV" \
2444 "$P_CLI request_size=1 force_version=tls1_1 etm=0 \
2445 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2446 0 \
2447 -s "Read from client: 1 bytes read"
2448
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002449run_test "Small packet TLS 1.1 StreamCipher" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002450 "$P_SRV arc4=1" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002451 "$P_CLI request_size=1 force_version=tls1_1 \
2452 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2453 0 \
2454 -s "Read from client: 1 bytes read"
2455
2456run_test "Small packet TLS 1.1 BlockCipher truncated MAC" \
2457 "$P_SRV" \
2458 "$P_CLI request_size=1 force_version=tls1_1 \
2459 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2460 trunc_hmac=1" \
2461 0 \
2462 -s "Read from client: 1 bytes read"
2463
2464run_test "Small packet TLS 1.1 StreamCipher truncated MAC" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002465 "$P_SRV arc4=1" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002466 "$P_CLI request_size=1 force_version=tls1_1 \
2467 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2468 trunc_hmac=1" \
2469 0 \
2470 -s "Read from client: 1 bytes read"
2471
2472run_test "Small packet TLS 1.2 BlockCipher" \
2473 "$P_SRV" \
2474 "$P_CLI request_size=1 force_version=tls1_2 \
2475 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2476 0 \
2477 -s "Read from client: 1 bytes read"
2478
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +01002479run_test "Small packet TLS 1.2 BlockCipher without EtM" \
2480 "$P_SRV" \
2481 "$P_CLI request_size=1 force_version=tls1_2 etm=0 \
2482 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2483 0 \
2484 -s "Read from client: 1 bytes read"
2485
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002486run_test "Small packet TLS 1.2 BlockCipher larger MAC" \
2487 "$P_SRV" \
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +01002488 "$P_CLI request_size=1 force_version=tls1_2 \
2489 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002490 0 \
2491 -s "Read from client: 1 bytes read"
2492
2493run_test "Small packet TLS 1.2 BlockCipher truncated MAC" \
2494 "$P_SRV" \
2495 "$P_CLI request_size=1 force_version=tls1_2 \
2496 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2497 trunc_hmac=1" \
2498 0 \
2499 -s "Read from client: 1 bytes read"
2500
2501run_test "Small packet TLS 1.2 StreamCipher" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002502 "$P_SRV arc4=1" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002503 "$P_CLI request_size=1 force_version=tls1_2 \
2504 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2505 0 \
2506 -s "Read from client: 1 bytes read"
2507
2508run_test "Small packet TLS 1.2 StreamCipher truncated MAC" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002509 "$P_SRV arc4=1" \
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02002510 "$P_CLI request_size=1 force_version=tls1_2 \
2511 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2512 trunc_hmac=1" \
2513 0 \
2514 -s "Read from client: 1 bytes read"
2515
2516run_test "Small packet TLS 1.2 AEAD" \
2517 "$P_SRV" \
2518 "$P_CLI request_size=1 force_version=tls1_2 \
2519 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \
2520 0 \
2521 -s "Read from client: 1 bytes read"
2522
2523run_test "Small packet TLS 1.2 AEAD shorter tag" \
2524 "$P_SRV" \
2525 "$P_CLI request_size=1 force_version=tls1_2 \
2526 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \
2527 0 \
2528 -s "Read from client: 1 bytes read"
2529
Janos Follath8abaa8b2016-05-06 13:48:23 +01002530# A test for extensions in SSLv3
2531
Hanno Becker6fd6d242017-05-25 17:51:31 +01002532requires_config_enabled POLARSSL_SSL_PROTO_SSL3
Janos Follath8abaa8b2016-05-06 13:48:23 +01002533run_test "SSLv3 with extensions, server side" \
2534 "$P_SRV min_version=ssl3 debug_level=3" \
2535 "$P_CLI force_version=ssl3 tickets=1 max_frag_len=4096 alpn=abc,1234" \
2536 0 \
2537 -S "dumping 'client hello extensions'" \
2538 -S "server hello, total extension length:"
2539
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002540# Test for large packets
2541
Janos Follath4dfecab2016-03-14 13:40:43 +00002542requires_config_enabled POLARSSL_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002543run_test "Large packet SSLv3 BlockCipher" \
Manuel Pégourié-Gonnard448ea502015-01-12 11:40:14 +01002544 "$P_SRV min_version=ssl3" \
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +01002545 "$P_CLI request_size=16384 force_version=ssl3 recsplit=0 \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002546 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2547 0 \
2548 -s "Read from client: 16384 bytes read"
2549
Janos Follath4dfecab2016-03-14 13:40:43 +00002550requires_config_enabled POLARSSL_SSL_PROTO_SSL3
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002551run_test "Large packet SSLv3 StreamCipher" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002552 "$P_SRV min_version=ssl3 arc4=1" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002553 "$P_CLI request_size=16384 force_version=ssl3 \
2554 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2555 0 \
2556 -s "Read from client: 16384 bytes read"
2557
2558run_test "Large packet TLS 1.0 BlockCipher" \
2559 "$P_SRV" \
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +01002560 "$P_CLI request_size=16384 force_version=tls1 recsplit=0 \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002561 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2562 0 \
2563 -s "Read from client: 16384 bytes read"
2564
2565run_test "Large packet TLS 1.0 BlockCipher truncated MAC" \
2566 "$P_SRV" \
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +01002567 "$P_CLI request_size=16384 force_version=tls1 recsplit=0 \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002568 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2569 trunc_hmac=1" \
2570 0 \
2571 -s "Read from client: 16384 bytes read"
2572
2573run_test "Large packet TLS 1.0 StreamCipher truncated MAC" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002574 "$P_SRV arc4=1" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002575 "$P_CLI request_size=16384 force_version=tls1 \
2576 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2577 trunc_hmac=1" \
2578 0 \
2579 -s "Read from client: 16384 bytes read"
2580
2581run_test "Large packet TLS 1.1 BlockCipher" \
2582 "$P_SRV" \
2583 "$P_CLI request_size=16384 force_version=tls1_1 \
2584 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2585 0 \
2586 -s "Read from client: 16384 bytes read"
2587
2588run_test "Large packet TLS 1.1 StreamCipher" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002589 "$P_SRV arc4=1" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002590 "$P_CLI request_size=16384 force_version=tls1_1 \
2591 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2592 0 \
2593 -s "Read from client: 16384 bytes read"
2594
2595run_test "Large packet TLS 1.1 BlockCipher truncated MAC" \
2596 "$P_SRV" \
2597 "$P_CLI request_size=16384 force_version=tls1_1 \
2598 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2599 trunc_hmac=1" \
2600 0 \
2601 -s "Read from client: 16384 bytes read"
2602
2603run_test "Large packet TLS 1.1 StreamCipher truncated MAC" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002604 "$P_SRV arc4=1" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002605 "$P_CLI request_size=16384 force_version=tls1_1 \
2606 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2607 trunc_hmac=1" \
2608 0 \
2609 -s "Read from client: 16384 bytes read"
2610
2611run_test "Large packet TLS 1.2 BlockCipher" \
2612 "$P_SRV" \
2613 "$P_CLI request_size=16384 force_version=tls1_2 \
2614 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2615 0 \
2616 -s "Read from client: 16384 bytes read"
2617
2618run_test "Large packet TLS 1.2 BlockCipher larger MAC" \
2619 "$P_SRV" \
Manuel Pégourié-Gonnardc82ee352015-01-07 16:35:25 +01002620 "$P_CLI request_size=16384 force_version=tls1_2 \
2621 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002622 0 \
2623 -s "Read from client: 16384 bytes read"
2624
2625run_test "Large packet TLS 1.2 BlockCipher truncated MAC" \
2626 "$P_SRV" \
2627 "$P_CLI request_size=16384 force_version=tls1_2 \
2628 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2629 trunc_hmac=1" \
2630 0 \
2631 -s "Read from client: 16384 bytes read"
2632
2633run_test "Large packet TLS 1.2 StreamCipher" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002634 "$P_SRV arc4=1" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002635 "$P_CLI request_size=16384 force_version=tls1_2 \
2636 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2637 0 \
2638 -s "Read from client: 16384 bytes read"
2639
2640run_test "Large packet TLS 1.2 StreamCipher truncated MAC" \
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +01002641 "$P_SRV arc4=1" \
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002642 "$P_CLI request_size=16384 force_version=tls1_2 \
2643 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2644 trunc_hmac=1" \
2645 0 \
2646 -s "Read from client: 16384 bytes read"
2647
2648run_test "Large packet TLS 1.2 AEAD" \
2649 "$P_SRV" \
2650 "$P_CLI request_size=16384 force_version=tls1_2 \
2651 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \
2652 0 \
2653 -s "Read from client: 16384 bytes read"
2654
2655run_test "Large packet TLS 1.2 AEAD shorter tag" \
2656 "$P_SRV" \
2657 "$P_CLI request_size=16384 force_version=tls1_2 \
2658 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \
2659 0 \
2660 -s "Read from client: 16384 bytes read"
2661
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01002662# Final report
2663
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01002664echo "------------------------------------------------------------------------"
2665
2666if [ $FAILS = 0 ]; then
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +01002667 printf "PASSED"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01002668else
Manuel Pégourié-Gonnardf46f1282014-12-11 11:51:28 +01002669 printf "FAILED"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01002670fi
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02002671PASSES=$(( $TESTS - $FAILS ))
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +02002672echo " ($PASSES / $TESTS tests ($SKIPS skipped))"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01002673
2674exit $FAILS