Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1 | #!/bin/sh |
| 2 | |
| 3 | # Test various options that are not covered by compat.sh |
| 4 | # |
| 5 | # Here the goal is not to cover every ciphersuite/version, but |
| 6 | # rather specific options (max fragment length, truncated hmac, etc) |
| 7 | # or procedures (session resumption from cache or ticket, renego, etc). |
| 8 | # |
| 9 | # Assumes all options are compiled in. |
| 10 | |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 11 | set -u |
| 12 | |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 13 | # default values, can be overriden by the environment |
| 14 | : ${P_SRV:=../programs/ssl/ssl_server2} |
| 15 | : ${P_CLI:=../programs/ssl/ssl_client2} |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 16 | : ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 17 | : ${GNUTLS_CLI:=gnutls-cli} |
| 18 | : ${GNUTLS_SERV:=gnutls-serv} |
Gilles Peskine | a1cf6c8 | 2017-05-17 14:50:38 +0200 | [diff] [blame] | 19 | : ${PERL:=perl} |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 20 | |
Manuel Pégourié-Gonnard | 6461f36 | 2015-06-29 16:20:13 +0200 | [diff] [blame] | 21 | O_SRV="$OPENSSL_CMD s_server -www -cert data_files/server5.crt -key data_files/server5.key -dhparam data_files/dhparams.pem" |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 22 | O_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_CMD s_client" |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 23 | G_SRV="$GNUTLS_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key" |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 24 | G_CLI="echo 'GET / HTTP/1.0' | $GNUTLS_CLI --x509cafile data_files/test-ca_cat12.crt" |
Gilles Peskine | a1cf6c8 | 2017-05-17 14:50:38 +0200 | [diff] [blame] | 25 | TCP_CLIENT="$PERL scripts/tcp_client.pl" |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 26 | |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 27 | TESTS=0 |
| 28 | FAILS=0 |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 29 | SKIPS=0 |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 30 | |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 31 | CONFIG_H='../include/polarssl/config.h' |
| 32 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 33 | MEMCHECK=0 |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 34 | FILTER='.*' |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 35 | EXCLUDE='^$' |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 36 | |
| 37 | print_usage() { |
| 38 | echo "Usage: $0 [options]" |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 39 | printf " -h|--help\tPrint this help.\n" |
| 40 | printf " -m|--memcheck\tCheck memory leaks and errors.\n" |
| 41 | printf " -f|--filter\tOnly matching tests are executed (default: '$FILTER')\n" |
| 42 | printf " -e|--exclude\tMatching tests are excluded (default: '$EXCLUDE')\n" |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 43 | } |
| 44 | |
| 45 | get_options() { |
| 46 | while [ $# -gt 0 ]; do |
| 47 | case "$1" in |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 48 | -f|--filter) |
| 49 | shift; FILTER=$1 |
| 50 | ;; |
| 51 | -e|--exclude) |
| 52 | shift; EXCLUDE=$1 |
| 53 | ;; |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 54 | -m|--memcheck) |
| 55 | MEMCHECK=1 |
| 56 | ;; |
| 57 | -h|--help) |
| 58 | print_usage |
| 59 | exit 0 |
| 60 | ;; |
| 61 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 62 | echo "Unknown argument: '$1'" |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 63 | print_usage |
| 64 | exit 1 |
| 65 | ;; |
| 66 | esac |
| 67 | shift |
| 68 | done |
| 69 | } |
| 70 | |
Janos Follath | 4dfecab | 2016-03-14 13:40:43 +0000 | [diff] [blame] | 71 | # skip next test if the flag is not enabled in config.h |
| 72 | requires_config_enabled() { |
| 73 | if grep "^#define $1" $CONFIG_H > /dev/null; then :; else |
| 74 | SKIP_NEXT="YES" |
| 75 | fi |
| 76 | } |
| 77 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 78 | # skip next test if OpenSSL can't send SSLv2 ClientHello |
| 79 | requires_openssl_with_sslv2() { |
| 80 | if [ -z "${OPENSSL_HAS_SSL2:-}" ]; then |
Manuel Pégourié-Gonnard | a4afadf | 2014-08-30 22:09:36 +0200 | [diff] [blame] | 81 | if $OPENSSL_CMD ciphers -ssl2 >/dev/null 2>&1; then |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 82 | OPENSSL_HAS_SSL2="YES" |
| 83 | else |
| 84 | OPENSSL_HAS_SSL2="NO" |
| 85 | fi |
| 86 | fi |
| 87 | if [ "$OPENSSL_HAS_SSL2" = "NO" ]; then |
| 88 | SKIP_NEXT="YES" |
| 89 | fi |
| 90 | } |
| 91 | |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 92 | # skip next test if OpenSSL doesn't support FALLBACK_SCSV |
| 93 | requires_openssl_with_fallback_scsv() { |
| 94 | if [ -z "${OPENSSL_HAS_FBSCSV:-}" ]; then |
| 95 | if $OPENSSL_CMD s_client -help 2>&1 | grep fallback_scsv >/dev/null |
| 96 | then |
| 97 | OPENSSL_HAS_FBSCSV="YES" |
| 98 | else |
| 99 | OPENSSL_HAS_FBSCSV="NO" |
| 100 | fi |
| 101 | fi |
| 102 | if [ "$OPENSSL_HAS_FBSCSV" = "NO" ]; then |
| 103 | SKIP_NEXT="YES" |
| 104 | fi |
| 105 | } |
| 106 | |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 107 | # skip next test if GnuTLS isn't available |
| 108 | requires_gnutls() { |
| 109 | if [ -z "${GNUTLS_AVAILABLE:-}" ]; then |
| 110 | if ( which "$GNUTLS_CLI" && which "$GNUTLS_SERV" ) >/dev/null; then |
| 111 | GNUTLS_AVAILABLE="YES" |
| 112 | else |
| 113 | GNUTLS_AVAILABLE="NO" |
| 114 | fi |
| 115 | fi |
| 116 | if [ "$GNUTLS_AVAILABLE" = "NO" ]; then |
| 117 | SKIP_NEXT="YES" |
| 118 | fi |
| 119 | } |
| 120 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 121 | # print_name <name> |
| 122 | print_name() { |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 123 | printf "$1 " |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 124 | LEN=$(( 72 - `echo "$1" | wc -c` )) |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 125 | for i in `seq 1 $LEN`; do printf '.'; done |
| 126 | printf ' ' |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 127 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 128 | TESTS=$(( $TESTS + 1 )) |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 129 | } |
| 130 | |
| 131 | # fail <message> |
| 132 | fail() { |
| 133 | echo "FAIL" |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 134 | echo " ! $1" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 135 | |
Manuel Pégourié-Gonnard | c2b0092 | 2014-08-31 16:46:04 +0200 | [diff] [blame] | 136 | mv $SRV_OUT o-srv-${TESTS}.log |
| 137 | mv $CLI_OUT o-cli-${TESTS}.log |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 138 | echo " ! outputs saved to o-srv-${TESTS}.log and o-cli-${TESTS}.log" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 139 | |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 140 | if [ "X${USER:-}" = Xbuildbot -o "X${LOGNAME:-}" = Xbuildbot ]; then |
| 141 | echo " ! server output:" |
| 142 | cat o-srv-${TESTS}.log |
| 143 | echo " ! ============================================================" |
| 144 | echo " ! client output:" |
| 145 | cat o-cli-${TESTS}.log |
| 146 | fi |
| 147 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 148 | FAILS=$(( $FAILS + 1 )) |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 149 | } |
| 150 | |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 151 | # is_polar <cmd_line> |
| 152 | is_polar() { |
| 153 | echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null |
| 154 | } |
| 155 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 156 | # has_mem_err <log_file_name> |
| 157 | has_mem_err() { |
| 158 | if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" && |
| 159 | grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null |
| 160 | then |
| 161 | return 1 # false: does not have errors |
| 162 | else |
| 163 | return 0 # true: has errors |
| 164 | fi |
| 165 | } |
| 166 | |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 167 | # wait for server to start: two versions depending on lsof availability |
| 168 | wait_server_start() { |
Manuel Pégourié-Gonnard | 84690c3 | 2015-08-04 20:34:39 +0200 | [diff] [blame] | 169 | if which lsof >/dev/null 2>&1; then |
| 170 | START_TIME=$( date +%s ) |
| 171 | DONE=0 |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 172 | |
| 173 | # make a tight loop, server usually takes less than 1 sec to start |
Manuel Pégourié-Gonnard | 84690c3 | 2015-08-04 20:34:39 +0200 | [diff] [blame] | 174 | while [ $DONE -eq 0 ]; do |
| 175 | if lsof -nbi TCP:"$PORT" 2>/dev/null | grep LISTEN >/dev/null |
| 176 | then |
| 177 | DONE=1 |
| 178 | elif [ $(( $( date +%s ) - $START_TIME )) -gt $DOG_DELAY ]; then |
| 179 | echo "SERVERSTART TIMEOUT" |
| 180 | echo "SERVERSTART TIMEOUT" >> $SRV_OUT |
| 181 | DONE=1 |
| 182 | fi |
| 183 | done |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 184 | else |
| 185 | sleep "$START_DELAY" |
| 186 | fi |
| 187 | } |
| 188 | |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 189 | # wait for client to terminate and set CLI_EXIT |
| 190 | # must be called right after starting the client |
| 191 | wait_client_done() { |
| 192 | CLI_PID=$! |
| 193 | |
| 194 | ( sleep "$DOG_DELAY"; echo "TIMEOUT" >> $CLI_OUT; kill $CLI_PID ) & |
| 195 | WATCHDOG_PID=$! |
| 196 | |
| 197 | wait $CLI_PID |
| 198 | CLI_EXIT=$? |
| 199 | |
| 200 | kill $WATCHDOG_PID |
| 201 | wait $WATCHDOG_PID |
| 202 | |
| 203 | echo "EXIT: $CLI_EXIT" >> $CLI_OUT |
| 204 | } |
| 205 | |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 206 | # Usage: run_test name srv_cmd cli_cmd cli_exit [option [...]] |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 207 | # Options: -s pattern pattern that must be present in server output |
| 208 | # -c pattern pattern that must be present in client output |
Simon Butcher | 696f92e | 2016-10-13 14:13:17 +0100 | [diff] [blame] | 209 | # -u pattern lines after pattern must be unique in client output |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 210 | # -S pattern pattern that must be absent in server output |
| 211 | # -C pattern pattern that must be absent in client output |
Simon Butcher | 696f92e | 2016-10-13 14:13:17 +0100 | [diff] [blame] | 212 | # -U pattern lines after pattern must be unique in server output |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 213 | run_test() { |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 214 | NAME="$1" |
| 215 | SRV_CMD="$2" |
| 216 | CLI_CMD="$3" |
| 217 | CLI_EXPECT="$4" |
| 218 | shift 4 |
| 219 | |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 220 | if echo "$NAME" | grep "$FILTER" | grep -v "$EXCLUDE" >/dev/null; then : |
| 221 | else |
| 222 | return |
| 223 | fi |
| 224 | |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 225 | print_name "$NAME" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 226 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 227 | # should we skip? |
| 228 | if [ "X$SKIP_NEXT" = "XYES" ]; then |
| 229 | SKIP_NEXT="NO" |
| 230 | echo "SKIP" |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 231 | SKIPS=$(( $SKIPS + 1 )) |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 232 | return |
| 233 | fi |
| 234 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 235 | # prepend valgrind to our commands if active |
| 236 | if [ "$MEMCHECK" -gt 0 ]; then |
| 237 | if is_polar "$SRV_CMD"; then |
| 238 | SRV_CMD="valgrind --leak-check=full $SRV_CMD" |
| 239 | fi |
| 240 | if is_polar "$CLI_CMD"; then |
| 241 | CLI_CMD="valgrind --leak-check=full $CLI_CMD" |
| 242 | fi |
| 243 | fi |
| 244 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 245 | # run the commands |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 246 | echo "$SRV_CMD" > $SRV_OUT |
| 247 | $SRV_CMD >> $SRV_OUT 2>&1 & |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 248 | SRV_PID=$! |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 249 | wait_server_start |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 250 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 251 | echo "$CLI_CMD" > $CLI_OUT |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 252 | eval "$CLI_CMD" >> $CLI_OUT 2>&1 & |
| 253 | wait_client_done |
Manuel Pégourié-Gonnard | e01af4c | 2014-03-25 14:16:44 +0100 | [diff] [blame] | 254 | |
Manuel Pégourié-Gonnard | 74b1170 | 2014-08-14 15:47:33 +0200 | [diff] [blame] | 255 | # kill the server |
| 256 | kill $SRV_PID |
| 257 | wait $SRV_PID |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 258 | |
| 259 | # check if the client and server went at least to the handshake stage |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 260 | # (useful to avoid tests with only negative assertions and non-zero |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 261 | # expected client exit to incorrectly succeed in case of catastrophic |
| 262 | # failure) |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 263 | if is_polar "$SRV_CMD"; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 264 | if grep "Performing the SSL/TLS handshake" $SRV_OUT >/dev/null; then :; |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 265 | else |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 266 | fail "server or client failed to reach handshake stage" |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 267 | return |
| 268 | fi |
| 269 | fi |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 270 | if is_polar "$CLI_CMD"; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 271 | if grep "Performing the SSL/TLS handshake" $CLI_OUT >/dev/null; then :; |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 272 | else |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 273 | fail "server or client failed to reach handshake stage" |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 274 | return |
| 275 | fi |
| 276 | fi |
| 277 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 278 | # check server exit code |
| 279 | if [ $? != 0 ]; then |
| 280 | fail "server fail" |
| 281 | return |
| 282 | fi |
| 283 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 284 | # check client exit code |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 285 | if [ \( "$CLI_EXPECT" = 0 -a "$CLI_EXIT" != 0 \) -o \ |
| 286 | \( "$CLI_EXPECT" != 0 -a "$CLI_EXIT" = 0 \) ] |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 287 | then |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 288 | fail "bad client exit code" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 289 | return |
| 290 | fi |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 291 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 292 | # check other assertions |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 293 | # lines beginning with == are added by valgrind, ignore them |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 294 | while [ $# -gt 0 ] |
| 295 | do |
| 296 | case $1 in |
| 297 | "-s") |
Simon Butcher | 696f92e | 2016-10-13 14:13:17 +0100 | [diff] [blame] | 298 | if grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then :; else |
| 299 | fail "pattern '$2' MUST be present in the Server output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 300 | return |
| 301 | fi |
| 302 | ;; |
| 303 | |
| 304 | "-c") |
Simon Butcher | 696f92e | 2016-10-13 14:13:17 +0100 | [diff] [blame] | 305 | if grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then :; else |
| 306 | fail "pattern '$2' MUST be present in the Client output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 307 | return |
| 308 | fi |
| 309 | ;; |
| 310 | |
| 311 | "-S") |
Simon Butcher | 696f92e | 2016-10-13 14:13:17 +0100 | [diff] [blame] | 312 | if grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then |
| 313 | fail "pattern '$2' MUST NOT be present in the Server output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 314 | return |
| 315 | fi |
| 316 | ;; |
| 317 | |
| 318 | "-C") |
Simon Butcher | 696f92e | 2016-10-13 14:13:17 +0100 | [diff] [blame] | 319 | if grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then |
| 320 | fail "pattern '$2' MUST NOT be present in the Client output" |
| 321 | return |
| 322 | fi |
| 323 | ;; |
| 324 | |
| 325 | # The filtering in the following two options (-u and -U) do the following |
| 326 | # - ignore valgrind output |
| 327 | # - filter out everything but lines right after the pattern occurances |
| 328 | # - keep one of each non-unique line |
| 329 | # - count how many lines remain |
| 330 | # A line with '--' will remain in the result from previous outputs, so the number of lines in the result will be 1 |
| 331 | # if there were no duplicates. |
| 332 | "-U") |
| 333 | if [ $(grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep -A1 "$2" | grep -v "$2" | sort | uniq -d | wc -l) -gt 1 ]; then |
| 334 | fail "lines following pattern '$2' must be unique in Server output" |
| 335 | return |
| 336 | fi |
| 337 | ;; |
| 338 | |
| 339 | "-u") |
| 340 | if [ $(grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep -A1 "$2" | grep -v "$2" | sort | uniq -d | wc -l) -gt 1 ]; then |
| 341 | fail "lines following pattern '$2' must be unique in Client output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 342 | return |
| 343 | fi |
| 344 | ;; |
| 345 | |
| 346 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 347 | echo "Unknown test: $1" >&2 |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 348 | exit 1 |
| 349 | esac |
| 350 | shift 2 |
| 351 | done |
| 352 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 353 | # check valgrind's results |
| 354 | if [ "$MEMCHECK" -gt 0 ]; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 355 | if is_polar "$SRV_CMD" && has_mem_err $SRV_OUT; then |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 356 | fail "Server has memory errors" |
| 357 | return |
| 358 | fi |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 359 | if is_polar "$CLI_CMD" && has_mem_err $CLI_OUT; then |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 360 | fail "Client has memory errors" |
| 361 | return |
| 362 | fi |
| 363 | fi |
| 364 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 365 | # if we're here, everything is ok |
| 366 | echo "PASS" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 367 | rm -f $SRV_OUT $CLI_OUT |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 368 | } |
| 369 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 370 | cleanup() { |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 371 | rm -f $CLI_OUT $SRV_OUT $SESSION |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 372 | kill $SRV_PID >/dev/null 2>&1 |
| 373 | kill $WATCHDOG_PID >/dev/null 2>&1 |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 374 | exit 1 |
| 375 | } |
| 376 | |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 377 | # |
| 378 | # MAIN |
| 379 | # |
| 380 | |
Manuel Pégourié-Gonnard | 751286b | 2015-03-10 13:41:04 +0000 | [diff] [blame] | 381 | if cd $( dirname $0 ); then :; else |
| 382 | echo "cd $( dirname $0 ) failed" >&2 |
| 383 | exit 1 |
| 384 | fi |
| 385 | |
Manuel Pégourié-Gonnard | 913030c | 2014-03-28 10:12:38 +0100 | [diff] [blame] | 386 | get_options "$@" |
| 387 | |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 388 | # sanity checks, avoid an avalanche of errors |
| 389 | if [ ! -x "$P_SRV" ]; then |
| 390 | echo "Command '$P_SRV' is not an executable file" |
| 391 | exit 1 |
| 392 | fi |
| 393 | if [ ! -x "$P_CLI" ]; then |
| 394 | echo "Command '$P_CLI' is not an executable file" |
| 395 | exit 1 |
| 396 | fi |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 397 | if which $OPENSSL_CMD >/dev/null 2>&1; then :; else |
| 398 | echo "Command '$OPENSSL_CMD' not found" |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 399 | exit 1 |
| 400 | fi |
| 401 | |
Manuel Pégourié-Gonnard | 32f8f4d | 2014-05-29 11:31:20 +0200 | [diff] [blame] | 402 | # used by watchdog |
| 403 | MAIN_PID="$$" |
| 404 | |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 405 | # be more patient with valgrind |
| 406 | if [ "$MEMCHECK" -gt 0 ]; then |
| 407 | START_DELAY=3 |
| 408 | DOG_DELAY=30 |
| 409 | else |
| 410 | START_DELAY=1 |
| 411 | DOG_DELAY=10 |
| 412 | fi |
| 413 | |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 414 | # Pick a "unique" port in the range 10000-19999. |
| 415 | PORT="0000$$" |
Manuel Pégourié-Gonnard | dc370e4 | 2015-01-22 10:24:59 +0000 | [diff] [blame] | 416 | PORT="1$( printf $PORT | tail -c 4 )" |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 417 | |
| 418 | # fix commands to use this port |
| 419 | P_SRV="$P_SRV server_port=$PORT" |
| 420 | P_CLI="$P_CLI server_port=$PORT" |
| 421 | O_SRV="$O_SRV -accept $PORT" |
| 422 | O_CLI="$O_CLI -connect localhost:$PORT" |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 423 | G_SRV="$G_SRV -p $PORT" |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 424 | G_CLI="$G_CLI -p $PORT localhost" |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 425 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 426 | # Also pick a unique name for intermediate files |
| 427 | SRV_OUT="srv_out.$$" |
| 428 | CLI_OUT="cli_out.$$" |
| 429 | SESSION="session.$$" |
| 430 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 431 | SKIP_NEXT="NO" |
| 432 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 433 | trap cleanup INT TERM HUP |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 434 | |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 435 | # Basic test |
| 436 | |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 437 | # Checks that: |
| 438 | # - things work with all ciphersuites active (used with config-full in all.sh) |
| 439 | # - the expected (highest security) parameters are selected |
| 440 | # ("signature_algorithm ext: 6" means SHA-512 (highest common hash)) |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 441 | run_test "Default" \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 442 | "$P_SRV debug_level=3" \ |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 443 | "$P_CLI" \ |
| 444 | 0 \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 445 | -s "Protocol is TLSv1.2" \ |
| 446 | -s "Ciphersuite is TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ |
| 447 | -s "client hello v3, signature_algorithm ext: 6" \ |
| 448 | -s "ECDHE curve: secp521r1" \ |
| 449 | -S "error" \ |
| 450 | -C "error" |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 451 | |
Simon Butcher | 696f92e | 2016-10-13 14:13:17 +0100 | [diff] [blame] | 452 | # Test for uniqueness of IVs in AEAD ciphersuites |
| 453 | run_test "Unique IV in GCM" \ |
| 454 | "$P_SRV exchanges=20 debug_level=4" \ |
| 455 | "$P_CLI exchanges=20 debug_level=4 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ |
| 456 | 0 \ |
| 457 | -u "IV used" \ |
| 458 | -U "IV used" |
| 459 | |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 460 | # Tests for rc4 option |
| 461 | |
| 462 | run_test "RC4: server disabled, client enabled" \ |
| 463 | "$P_SRV" \ |
| 464 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 465 | 1 \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 466 | -s "SSL - None of the common ciphersuites is usable" |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 467 | |
| 468 | run_test "RC4: server enabled, client disabled" \ |
| 469 | "$P_SRV force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 470 | "$P_CLI" \ |
| 471 | 1 \ |
| 472 | -s "SSL - The server has no ciphersuites in common" |
| 473 | |
| 474 | run_test "RC4: both enabled" \ |
| 475 | "$P_SRV arc4=1" \ |
| 476 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 477 | 0 \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 478 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 479 | -S "SSL - The server has no ciphersuites in common" |
| 480 | |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 481 | # Test for SSLv2 ClientHello |
| 482 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 483 | requires_openssl_with_sslv2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 484 | run_test "SSLv2 ClientHello: reference" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 485 | "$P_SRV debug_level=3" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 486 | "$O_CLI -no_ssl2" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 487 | 0 \ |
| 488 | -S "parse client hello v2" \ |
| 489 | -S "ssl_handshake returned" |
| 490 | |
| 491 | # Adding a SSL2-only suite makes OpenSSL client send SSLv2 ClientHello |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 492 | requires_openssl_with_sslv2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 493 | run_test "SSLv2 ClientHello: actual test" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 494 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 495 | "$O_CLI -cipher 'DES-CBC-MD5:ALL'" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 496 | 0 \ |
| 497 | -s "parse client hello v2" \ |
| 498 | -S "ssl_handshake returned" |
| 499 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 500 | # Tests for Truncated HMAC extension |
| 501 | |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 502 | run_test "Truncated HMAC: client default, server default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 503 | "$P_SRV debug_level=4" \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 504 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 505 | 0 \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 506 | -s "dumping 'computed mac' (20 bytes)" \ |
| 507 | -S "dumping 'computed mac' (10 bytes)" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 508 | |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 509 | run_test "Truncated HMAC: client disabled, server default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 510 | "$P_SRV debug_level=4" \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 511 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 512 | trunc_hmac=0" \ |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 513 | 0 \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 514 | -s "dumping 'computed mac' (20 bytes)" \ |
| 515 | -S "dumping 'computed mac' (10 bytes)" |
| 516 | |
| 517 | run_test "Truncated HMAC: client enabled, server default" \ |
| 518 | "$P_SRV debug_level=4" \ |
| 519 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 520 | trunc_hmac=1" \ |
| 521 | 0 \ |
| 522 | -S "dumping 'computed mac' (20 bytes)" \ |
| 523 | -s "dumping 'computed mac' (10 bytes)" |
| 524 | |
| 525 | run_test "Truncated HMAC: client enabled, server disabled" \ |
| 526 | "$P_SRV debug_level=4 trunc_hmac=0" \ |
| 527 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 528 | trunc_hmac=1" \ |
| 529 | 0 \ |
| 530 | -s "dumping 'computed mac' (20 bytes)" \ |
| 531 | -S "dumping 'computed mac' (10 bytes)" |
| 532 | |
| 533 | run_test "Truncated HMAC: client enabled, server enabled" \ |
| 534 | "$P_SRV debug_level=4 trunc_hmac=1" \ |
| 535 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 536 | trunc_hmac=1" \ |
| 537 | 0 \ |
| 538 | -S "dumping 'computed mac' (20 bytes)" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 539 | -s "dumping 'computed mac' (10 bytes)" |
| 540 | |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 541 | # Tests for Encrypt-then-MAC extension |
| 542 | |
| 543 | run_test "Encrypt then MAC: default" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 544 | "$P_SRV debug_level=3 \ |
| 545 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 546 | "$P_CLI debug_level=3" \ |
| 547 | 0 \ |
| 548 | -c "client hello, adding encrypt_then_mac extension" \ |
| 549 | -s "found encrypt then mac extension" \ |
| 550 | -s "server hello, adding encrypt then mac extension" \ |
| 551 | -c "found encrypt_then_mac extension" \ |
| 552 | -c "using encrypt then mac" \ |
| 553 | -s "using encrypt then mac" |
| 554 | |
| 555 | run_test "Encrypt then MAC: client enabled, server disabled" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 556 | "$P_SRV debug_level=3 etm=0 \ |
| 557 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 558 | "$P_CLI debug_level=3 etm=1" \ |
| 559 | 0 \ |
| 560 | -c "client hello, adding encrypt_then_mac extension" \ |
| 561 | -s "found encrypt then mac extension" \ |
| 562 | -S "server hello, adding encrypt then mac extension" \ |
| 563 | -C "found encrypt_then_mac extension" \ |
| 564 | -C "using encrypt then mac" \ |
| 565 | -S "using encrypt then mac" |
| 566 | |
Manuel Pégourié-Gonnard | 78e745f | 2014-11-04 15:44:06 +0100 | [diff] [blame] | 567 | run_test "Encrypt then MAC: client enabled, aead cipher" \ |
| 568 | "$P_SRV debug_level=3 etm=1 \ |
| 569 | force_ciphersuite=TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 570 | "$P_CLI debug_level=3 etm=1" \ |
| 571 | 0 \ |
| 572 | -c "client hello, adding encrypt_then_mac extension" \ |
| 573 | -s "found encrypt then mac extension" \ |
| 574 | -S "server hello, adding encrypt then mac extension" \ |
| 575 | -C "found encrypt_then_mac extension" \ |
| 576 | -C "using encrypt then mac" \ |
| 577 | -S "using encrypt then mac" |
| 578 | |
| 579 | run_test "Encrypt then MAC: client enabled, stream cipher" \ |
| 580 | "$P_SRV debug_level=3 etm=1 \ |
| 581 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 582 | "$P_CLI debug_level=3 etm=1 arc4=1" \ |
Manuel Pégourié-Gonnard | 78e745f | 2014-11-04 15:44:06 +0100 | [diff] [blame] | 583 | 0 \ |
| 584 | -c "client hello, adding encrypt_then_mac extension" \ |
| 585 | -s "found encrypt then mac extension" \ |
| 586 | -S "server hello, adding encrypt then mac extension" \ |
| 587 | -C "found encrypt_then_mac extension" \ |
| 588 | -C "using encrypt then mac" \ |
| 589 | -S "using encrypt then mac" |
| 590 | |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 591 | run_test "Encrypt then MAC: client disabled, server enabled" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 592 | "$P_SRV debug_level=3 etm=1 \ |
| 593 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 594 | "$P_CLI debug_level=3 etm=0" \ |
| 595 | 0 \ |
| 596 | -C "client hello, adding encrypt_then_mac extension" \ |
| 597 | -S "found encrypt then mac extension" \ |
| 598 | -S "server hello, adding encrypt then mac extension" \ |
| 599 | -C "found encrypt_then_mac extension" \ |
| 600 | -C "using encrypt then mac" \ |
| 601 | -S "using encrypt then mac" |
| 602 | |
Janos Follath | 4dfecab | 2016-03-14 13:40:43 +0000 | [diff] [blame] | 603 | requires_config_enabled POLARSSL_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 604 | run_test "Encrypt then MAC: client SSLv3, server enabled" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 605 | "$P_SRV debug_level=3 min_version=ssl3 \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 606 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 607 | "$P_CLI debug_level=3 force_version=ssl3" \ |
| 608 | 0 \ |
| 609 | -C "client hello, adding encrypt_then_mac extension" \ |
| 610 | -S "found encrypt then mac extension" \ |
| 611 | -S "server hello, adding encrypt then mac extension" \ |
| 612 | -C "found encrypt_then_mac extension" \ |
| 613 | -C "using encrypt then mac" \ |
| 614 | -S "using encrypt then mac" |
| 615 | |
Janos Follath | 4dfecab | 2016-03-14 13:40:43 +0000 | [diff] [blame] | 616 | requires_config_enabled POLARSSL_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 617 | run_test "Encrypt then MAC: client enabled, server SSLv3" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 618 | "$P_SRV debug_level=3 force_version=ssl3 \ |
| 619 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 620 | "$P_CLI debug_level=3 min_version=ssl3" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 621 | 0 \ |
| 622 | -c "client hello, adding encrypt_then_mac extension" \ |
Janos Follath | 8abaa8b | 2016-05-06 13:48:23 +0100 | [diff] [blame] | 623 | -S "found encrypt then mac extension" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 624 | -S "server hello, adding encrypt then mac extension" \ |
| 625 | -C "found encrypt_then_mac extension" \ |
| 626 | -C "using encrypt then mac" \ |
| 627 | -S "using encrypt then mac" |
| 628 | |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 629 | # Tests for Extended Master Secret extension |
| 630 | |
| 631 | run_test "Extended Master Secret: default" \ |
| 632 | "$P_SRV debug_level=3" \ |
| 633 | "$P_CLI debug_level=3" \ |
| 634 | 0 \ |
| 635 | -c "client hello, adding extended_master_secret extension" \ |
| 636 | -s "found extended master secret extension" \ |
| 637 | -s "server hello, adding extended master secret extension" \ |
| 638 | -c "found extended_master_secret extension" \ |
| 639 | -c "using extended master secret" \ |
| 640 | -s "using extended master secret" |
| 641 | |
| 642 | run_test "Extended Master Secret: client enabled, server disabled" \ |
| 643 | "$P_SRV debug_level=3 extended_ms=0" \ |
| 644 | "$P_CLI debug_level=3 extended_ms=1" \ |
| 645 | 0 \ |
| 646 | -c "client hello, adding extended_master_secret extension" \ |
| 647 | -s "found extended master secret extension" \ |
| 648 | -S "server hello, adding extended master secret extension" \ |
| 649 | -C "found extended_master_secret extension" \ |
| 650 | -C "using extended master secret" \ |
| 651 | -S "using extended master secret" |
| 652 | |
| 653 | run_test "Extended Master Secret: client disabled, server enabled" \ |
| 654 | "$P_SRV debug_level=3 extended_ms=1" \ |
| 655 | "$P_CLI debug_level=3 extended_ms=0" \ |
| 656 | 0 \ |
| 657 | -C "client hello, adding extended_master_secret extension" \ |
| 658 | -S "found extended master secret extension" \ |
| 659 | -S "server hello, adding extended master secret extension" \ |
| 660 | -C "found extended_master_secret extension" \ |
| 661 | -C "using extended master secret" \ |
| 662 | -S "using extended master secret" |
| 663 | |
Janos Follath | 4dfecab | 2016-03-14 13:40:43 +0000 | [diff] [blame] | 664 | requires_config_enabled POLARSSL_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 665 | run_test "Extended Master Secret: client SSLv3, server enabled" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 666 | "$P_SRV debug_level=3 min_version=ssl3" \ |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 667 | "$P_CLI debug_level=3 force_version=ssl3" \ |
| 668 | 0 \ |
| 669 | -C "client hello, adding extended_master_secret extension" \ |
| 670 | -S "found extended master secret extension" \ |
| 671 | -S "server hello, adding extended master secret extension" \ |
| 672 | -C "found extended_master_secret extension" \ |
| 673 | -C "using extended master secret" \ |
| 674 | -S "using extended master secret" |
| 675 | |
Janos Follath | 4dfecab | 2016-03-14 13:40:43 +0000 | [diff] [blame] | 676 | requires_config_enabled POLARSSL_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 677 | run_test "Extended Master Secret: client enabled, server SSLv3" \ |
| 678 | "$P_SRV debug_level=3 force_version=ssl3" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 679 | "$P_CLI debug_level=3 min_version=ssl3" \ |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 680 | 0 \ |
| 681 | -c "client hello, adding extended_master_secret extension" \ |
Janos Follath | 8abaa8b | 2016-05-06 13:48:23 +0100 | [diff] [blame] | 682 | -S "found extended master secret extension" \ |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 683 | -S "server hello, adding extended master secret extension" \ |
| 684 | -C "found extended_master_secret extension" \ |
| 685 | -C "using extended master secret" \ |
| 686 | -S "using extended master secret" |
| 687 | |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 688 | # Tests for FALLBACK_SCSV |
| 689 | |
| 690 | run_test "Fallback SCSV: default" \ |
| 691 | "$P_SRV" \ |
| 692 | "$P_CLI debug_level=3 force_version=tls1_1" \ |
| 693 | 0 \ |
| 694 | -C "adding FALLBACK_SCSV" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 695 | -S "received FALLBACK_SCSV" \ |
| 696 | -S "inapropriate fallback" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 697 | -C "is a fatal alert message (msg 86)" |
| 698 | |
| 699 | run_test "Fallback SCSV: explicitly disabled" \ |
| 700 | "$P_SRV" \ |
| 701 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \ |
| 702 | 0 \ |
| 703 | -C "adding FALLBACK_SCSV" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 704 | -S "received FALLBACK_SCSV" \ |
| 705 | -S "inapropriate fallback" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 706 | -C "is a fatal alert message (msg 86)" |
| 707 | |
| 708 | run_test "Fallback SCSV: enabled" \ |
| 709 | "$P_SRV" \ |
| 710 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 711 | 1 \ |
| 712 | -c "adding FALLBACK_SCSV" \ |
| 713 | -s "received FALLBACK_SCSV" \ |
| 714 | -s "inapropriate fallback" \ |
| 715 | -c "is a fatal alert message (msg 86)" |
| 716 | |
| 717 | run_test "Fallback SCSV: enabled, max version" \ |
| 718 | "$P_SRV" \ |
| 719 | "$P_CLI debug_level=3 fallback=1" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 720 | 0 \ |
| 721 | -c "adding FALLBACK_SCSV" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 722 | -s "received FALLBACK_SCSV" \ |
| 723 | -S "inapropriate fallback" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 724 | -C "is a fatal alert message (msg 86)" |
| 725 | |
| 726 | requires_openssl_with_fallback_scsv |
| 727 | run_test "Fallback SCSV: default, openssl server" \ |
| 728 | "$O_SRV" \ |
| 729 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \ |
| 730 | 0 \ |
| 731 | -C "adding FALLBACK_SCSV" \ |
| 732 | -C "is a fatal alert message (msg 86)" |
| 733 | |
| 734 | requires_openssl_with_fallback_scsv |
| 735 | run_test "Fallback SCSV: enabled, openssl server" \ |
| 736 | "$O_SRV" \ |
| 737 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \ |
| 738 | 1 \ |
| 739 | -c "adding FALLBACK_SCSV" \ |
| 740 | -c "is a fatal alert message (msg 86)" |
| 741 | |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 742 | requires_openssl_with_fallback_scsv |
| 743 | run_test "Fallback SCSV: disabled, openssl client" \ |
| 744 | "$P_SRV" \ |
| 745 | "$O_CLI -tls1_1" \ |
| 746 | 0 \ |
| 747 | -S "received FALLBACK_SCSV" \ |
| 748 | -S "inapropriate fallback" |
| 749 | |
| 750 | requires_openssl_with_fallback_scsv |
| 751 | run_test "Fallback SCSV: enabled, openssl client" \ |
| 752 | "$P_SRV" \ |
| 753 | "$O_CLI -tls1_1 -fallback_scsv" \ |
| 754 | 1 \ |
| 755 | -s "received FALLBACK_SCSV" \ |
| 756 | -s "inapropriate fallback" |
| 757 | |
| 758 | requires_openssl_with_fallback_scsv |
| 759 | run_test "Fallback SCSV: enabled, max version, openssl client" \ |
| 760 | "$P_SRV" \ |
| 761 | "$O_CLI -fallback_scsv" \ |
| 762 | 0 \ |
| 763 | -s "received FALLBACK_SCSV" \ |
| 764 | -S "inapropriate fallback" |
| 765 | |
Gilles Peskine | a1cf6c8 | 2017-05-17 14:50:38 +0200 | [diff] [blame] | 766 | ## ClientHello generated with |
| 767 | ## "openssl s_client -CAfile tests/data_files/test-ca.crt -tls1_1 -connect localhost:4433 -cipher ..." |
| 768 | ## then manually twiddling the ciphersuite list. |
| 769 | ## The ClientHello content is spelled out below as a hex string as |
| 770 | ## "prefix ciphersuite1 ciphersuite2 ciphersuite3 ciphersuite4 suffix". |
| 771 | ## The expected response is an inappropriate_fallback alert. |
| 772 | requires_openssl_with_fallback_scsv |
| 773 | run_test "Fallback SCSV: beginning of list" \ |
| 774 | "$P_SRV debug_level=2" \ |
| 775 | "$TCP_CLIENT localhost $PORT '160301003e0100003a03022aafb94308dc22ca1086c65acc00e414384d76b61ecab37df1633b1ae1034dbe000008 5600 0031 0032 0033 0100000900230000000f000101' '15030200020256'" \ |
| 776 | 0 \ |
| 777 | -s "received FALLBACK_SCSV" \ |
| 778 | -s "inapropriate fallback" |
| 779 | |
| 780 | requires_openssl_with_fallback_scsv |
| 781 | run_test "Fallback SCSV: end of list" \ |
| 782 | "$P_SRV debug_level=2" \ |
| 783 | "$TCP_CLIENT localhost $PORT '160301003e0100003a03022aafb94308dc22ca1086c65acc00e414384d76b61ecab37df1633b1ae1034dbe000008 0031 0032 0033 5600 0100000900230000000f000101' '15030200020256'" \ |
| 784 | 0 \ |
| 785 | -s "received FALLBACK_SCSV" \ |
| 786 | -s "inapropriate fallback" |
| 787 | |
| 788 | ## Here the expected response is a valid ServerHello prefix, up to the random. |
| 789 | requires_openssl_with_fallback_scsv |
| 790 | run_test "Fallback SCSV: not in list" \ |
| 791 | "$P_SRV debug_level=2" \ |
| 792 | "$TCP_CLIENT localhost $PORT '160301003e0100003a03022aafb94308dc22ca1086c65acc00e414384d76b61ecab37df1633b1ae1034dbe000008 0056 0031 0032 0033 0100000900230000000f000101' '16030200300200002c0302'" \ |
| 793 | 0 \ |
| 794 | -S "received FALLBACK_SCSV" \ |
| 795 | -S "inapropriate fallback" |
| 796 | |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 797 | # Tests for CBC 1/n-1 record splitting |
| 798 | |
| 799 | run_test "CBC Record splitting: TLS 1.2, no splitting" \ |
| 800 | "$P_SRV" \ |
| 801 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 802 | request_size=123 force_version=tls1_2" \ |
| 803 | 0 \ |
| 804 | -s "Read from client: 123 bytes read" \ |
| 805 | -S "Read from client: 1 bytes read" \ |
| 806 | -S "122 bytes read" |
| 807 | |
| 808 | run_test "CBC Record splitting: TLS 1.1, no splitting" \ |
| 809 | "$P_SRV" \ |
| 810 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 811 | request_size=123 force_version=tls1_1" \ |
| 812 | 0 \ |
| 813 | -s "Read from client: 123 bytes read" \ |
| 814 | -S "Read from client: 1 bytes read" \ |
| 815 | -S "122 bytes read" |
| 816 | |
| 817 | run_test "CBC Record splitting: TLS 1.0, splitting" \ |
| 818 | "$P_SRV" \ |
| 819 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 820 | request_size=123 force_version=tls1" \ |
| 821 | 0 \ |
| 822 | -S "Read from client: 123 bytes read" \ |
| 823 | -s "Read from client: 1 bytes read" \ |
| 824 | -s "122 bytes read" |
| 825 | |
Janos Follath | 4dfecab | 2016-03-14 13:40:43 +0000 | [diff] [blame] | 826 | requires_config_enabled POLARSSL_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 827 | run_test "CBC Record splitting: SSLv3, splitting" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 828 | "$P_SRV min_version=ssl3" \ |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 829 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 830 | request_size=123 force_version=ssl3" \ |
| 831 | 0 \ |
| 832 | -S "Read from client: 123 bytes read" \ |
| 833 | -s "Read from client: 1 bytes read" \ |
| 834 | -s "122 bytes read" |
| 835 | |
| 836 | run_test "CBC Record splitting: TLS 1.0 RC4, no splitting" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 837 | "$P_SRV arc4=1" \ |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 838 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 839 | request_size=123 force_version=tls1" \ |
| 840 | 0 \ |
| 841 | -s "Read from client: 123 bytes read" \ |
| 842 | -S "Read from client: 1 bytes read" \ |
| 843 | -S "122 bytes read" |
| 844 | |
| 845 | run_test "CBC Record splitting: TLS 1.0, splitting disabled" \ |
| 846 | "$P_SRV" \ |
| 847 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 848 | request_size=123 force_version=tls1 recsplit=0" \ |
| 849 | 0 \ |
| 850 | -s "Read from client: 123 bytes read" \ |
| 851 | -S "Read from client: 1 bytes read" \ |
| 852 | -S "122 bytes read" |
| 853 | |
Manuel Pégourié-Gonnard | a852cf4 | 2015-01-13 20:56:15 +0100 | [diff] [blame] | 854 | run_test "CBC Record splitting: TLS 1.0, splitting, nbio" \ |
| 855 | "$P_SRV nbio=2" \ |
| 856 | "$P_CLI nbio=2 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 857 | request_size=123 force_version=tls1" \ |
| 858 | 0 \ |
| 859 | -S "Read from client: 123 bytes read" \ |
| 860 | -s "Read from client: 1 bytes read" \ |
| 861 | -s "122 bytes read" |
| 862 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 863 | # Tests for Session Tickets |
| 864 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 865 | run_test "Session resume using tickets: basic" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 866 | "$P_SRV debug_level=3 tickets=1" \ |
| 867 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 868 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 869 | -c "client hello, adding session ticket extension" \ |
| 870 | -s "found session ticket extension" \ |
| 871 | -s "server hello, adding session ticket extension" \ |
| 872 | -c "found session_ticket extension" \ |
| 873 | -c "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 874 | -S "session successfully restored from cache" \ |
| 875 | -s "session successfully restored from ticket" \ |
| 876 | -s "a session has been resumed" \ |
| 877 | -c "a session has been resumed" |
| 878 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 879 | run_test "Session resume using tickets: cache disabled" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 880 | "$P_SRV debug_level=3 tickets=1 cache_max=0" \ |
| 881 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 882 | 0 \ |
| 883 | -c "client hello, adding session ticket extension" \ |
| 884 | -s "found session ticket extension" \ |
| 885 | -s "server hello, adding session ticket extension" \ |
| 886 | -c "found session_ticket extension" \ |
| 887 | -c "parse new session ticket" \ |
| 888 | -S "session successfully restored from cache" \ |
| 889 | -s "session successfully restored from ticket" \ |
| 890 | -s "a session has been resumed" \ |
| 891 | -c "a session has been resumed" |
| 892 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 893 | run_test "Session resume using tickets: timeout" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 894 | "$P_SRV debug_level=3 tickets=1 cache_max=0 ticket_timeout=1" \ |
| 895 | "$P_CLI debug_level=3 tickets=1 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 896 | 0 \ |
| 897 | -c "client hello, adding session ticket extension" \ |
| 898 | -s "found session ticket extension" \ |
| 899 | -s "server hello, adding session ticket extension" \ |
| 900 | -c "found session_ticket extension" \ |
| 901 | -c "parse new session ticket" \ |
| 902 | -S "session successfully restored from cache" \ |
| 903 | -S "session successfully restored from ticket" \ |
| 904 | -S "a session has been resumed" \ |
| 905 | -C "a session has been resumed" |
| 906 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 907 | run_test "Session resume using tickets: openssl server" \ |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 908 | "$O_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 909 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 910 | 0 \ |
| 911 | -c "client hello, adding session ticket extension" \ |
| 912 | -c "found session_ticket extension" \ |
| 913 | -c "parse new session ticket" \ |
| 914 | -c "a session has been resumed" |
| 915 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 916 | run_test "Session resume using tickets: openssl client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 917 | "$P_SRV debug_level=3 tickets=1" \ |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 918 | "( $O_CLI -sess_out $SESSION; \ |
| 919 | $O_CLI -sess_in $SESSION; \ |
| 920 | rm -f $SESSION )" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 921 | 0 \ |
| 922 | -s "found session ticket extension" \ |
| 923 | -s "server hello, adding session ticket extension" \ |
| 924 | -S "session successfully restored from cache" \ |
| 925 | -s "session successfully restored from ticket" \ |
| 926 | -s "a session has been resumed" |
| 927 | |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 928 | # Tests for Session Resume based on session-ID and cache |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 929 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 930 | run_test "Session resume using cache: tickets enabled on client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 931 | "$P_SRV debug_level=3 tickets=0" \ |
| 932 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 933 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 934 | -c "client hello, adding session ticket extension" \ |
| 935 | -s "found session ticket extension" \ |
| 936 | -S "server hello, adding session ticket extension" \ |
| 937 | -C "found session_ticket extension" \ |
| 938 | -C "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 939 | -s "session successfully restored from cache" \ |
| 940 | -S "session successfully restored from ticket" \ |
| 941 | -s "a session has been resumed" \ |
| 942 | -c "a session has been resumed" |
| 943 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 944 | run_test "Session resume using cache: tickets enabled on server" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 945 | "$P_SRV debug_level=3 tickets=1" \ |
| 946 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 947 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 948 | -C "client hello, adding session ticket extension" \ |
| 949 | -S "found session ticket extension" \ |
| 950 | -S "server hello, adding session ticket extension" \ |
| 951 | -C "found session_ticket extension" \ |
| 952 | -C "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 953 | -s "session successfully restored from cache" \ |
| 954 | -S "session successfully restored from ticket" \ |
| 955 | -s "a session has been resumed" \ |
| 956 | -c "a session has been resumed" |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 957 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 958 | run_test "Session resume using cache: cache_max=0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 959 | "$P_SRV debug_level=3 tickets=0 cache_max=0" \ |
| 960 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 961 | 0 \ |
| 962 | -S "session successfully restored from cache" \ |
| 963 | -S "session successfully restored from ticket" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 964 | -S "a session has been resumed" \ |
| 965 | -C "a session has been resumed" |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 966 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 967 | run_test "Session resume using cache: cache_max=1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 968 | "$P_SRV debug_level=3 tickets=0 cache_max=1" \ |
| 969 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 970 | 0 \ |
| 971 | -s "session successfully restored from cache" \ |
| 972 | -S "session successfully restored from ticket" \ |
| 973 | -s "a session has been resumed" \ |
| 974 | -c "a session has been resumed" |
| 975 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 976 | run_test "Session resume using cache: timemout > delay" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 977 | "$P_SRV debug_level=3 tickets=0" \ |
| 978 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=0" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 979 | 0 \ |
| 980 | -s "session successfully restored from cache" \ |
| 981 | -S "session successfully restored from ticket" \ |
| 982 | -s "a session has been resumed" \ |
| 983 | -c "a session has been resumed" |
| 984 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 985 | run_test "Session resume using cache: timeout < delay" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 986 | "$P_SRV debug_level=3 tickets=0 cache_timeout=1" \ |
| 987 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 988 | 0 \ |
| 989 | -S "session successfully restored from cache" \ |
| 990 | -S "session successfully restored from ticket" \ |
| 991 | -S "a session has been resumed" \ |
| 992 | -C "a session has been resumed" |
| 993 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 994 | run_test "Session resume using cache: no timeout" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 995 | "$P_SRV debug_level=3 tickets=0 cache_timeout=0" \ |
| 996 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 997 | 0 \ |
| 998 | -s "session successfully restored from cache" \ |
| 999 | -S "session successfully restored from ticket" \ |
| 1000 | -s "a session has been resumed" \ |
| 1001 | -c "a session has been resumed" |
| 1002 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1003 | run_test "Session resume using cache: openssl client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1004 | "$P_SRV debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1005 | "( $O_CLI -sess_out $SESSION; \ |
| 1006 | $O_CLI -sess_in $SESSION; \ |
| 1007 | rm -f $SESSION )" \ |
Manuel Pégourié-Gonnard | db735f6 | 2014-02-25 17:57:59 +0100 | [diff] [blame] | 1008 | 0 \ |
| 1009 | -s "found session ticket extension" \ |
| 1010 | -S "server hello, adding session ticket extension" \ |
| 1011 | -s "session successfully restored from cache" \ |
| 1012 | -S "session successfully restored from ticket" \ |
| 1013 | -s "a session has been resumed" |
| 1014 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1015 | run_test "Session resume using cache: openssl server" \ |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1016 | "$O_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1017 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | db735f6 | 2014-02-25 17:57:59 +0100 | [diff] [blame] | 1018 | 0 \ |
| 1019 | -C "found session_ticket extension" \ |
| 1020 | -C "parse new session ticket" \ |
| 1021 | -c "a session has been resumed" |
| 1022 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1023 | # Tests for Max Fragment Length extension |
| 1024 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1025 | run_test "Max fragment length: not used, reference" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1026 | "$P_SRV debug_level=3" \ |
| 1027 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 1028 | 0 \ |
| 1029 | -C "client hello, adding max_fragment_length extension" \ |
| 1030 | -S "found max fragment length extension" \ |
| 1031 | -S "server hello, max_fragment_length extension" \ |
| 1032 | -C "found max_fragment_length extension" |
| 1033 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1034 | run_test "Max fragment length: used by client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1035 | "$P_SRV debug_level=3" \ |
| 1036 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 1037 | 0 \ |
| 1038 | -c "client hello, adding max_fragment_length extension" \ |
| 1039 | -s "found max fragment length extension" \ |
| 1040 | -s "server hello, max_fragment_length extension" \ |
| 1041 | -c "found max_fragment_length extension" |
| 1042 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1043 | run_test "Max fragment length: used by server" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1044 | "$P_SRV debug_level=3 max_frag_len=4096" \ |
| 1045 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 1046 | 0 \ |
| 1047 | -C "client hello, adding max_fragment_length extension" \ |
| 1048 | -S "found max fragment length extension" \ |
| 1049 | -S "server hello, max_fragment_length extension" \ |
| 1050 | -C "found max_fragment_length extension" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1051 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1052 | requires_gnutls |
| 1053 | run_test "Max fragment length: gnutls server" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 1054 | "$G_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1055 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 1056 | 0 \ |
| 1057 | -c "client hello, adding max_fragment_length extension" \ |
| 1058 | -c "found max_fragment_length extension" |
| 1059 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1060 | # Tests for renegotiation |
| 1061 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1062 | run_test "Renegotiation: none, for reference" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1063 | "$P_SRV debug_level=3 exchanges=2" \ |
| 1064 | "$P_CLI debug_level=3 exchanges=2" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1065 | 0 \ |
| 1066 | -C "client hello, adding renegotiation extension" \ |
| 1067 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1068 | -S "found renegotiation extension" \ |
| 1069 | -s "server hello, secure renegotiation extension" \ |
| 1070 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1071 | -C "=> renegotiate" \ |
| 1072 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1073 | -S "write hello request" |
| 1074 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1075 | run_test "Renegotiation: client-initiated" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1076 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1" \ |
| 1077 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1078 | 0 \ |
| 1079 | -c "client hello, adding renegotiation extension" \ |
| 1080 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1081 | -s "found renegotiation extension" \ |
| 1082 | -s "server hello, secure renegotiation extension" \ |
| 1083 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1084 | -c "=> renegotiate" \ |
| 1085 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1086 | -S "write hello request" |
| 1087 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1088 | run_test "Renegotiation: server-initiated" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1089 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 1090 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1091 | 0 \ |
| 1092 | -c "client hello, adding renegotiation extension" \ |
| 1093 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1094 | -s "found renegotiation extension" \ |
| 1095 | -s "server hello, secure renegotiation extension" \ |
| 1096 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1097 | -c "=> renegotiate" \ |
| 1098 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1099 | -s "write hello request" |
| 1100 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1101 | run_test "Renegotiation: double" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1102 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 1103 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1104 | 0 \ |
| 1105 | -c "client hello, adding renegotiation extension" \ |
| 1106 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1107 | -s "found renegotiation extension" \ |
| 1108 | -s "server hello, secure renegotiation extension" \ |
| 1109 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1110 | -c "=> renegotiate" \ |
| 1111 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1112 | -s "write hello request" |
| 1113 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1114 | run_test "Renegotiation: client-initiated, server-rejected" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1115 | "$P_SRV debug_level=3 exchanges=2 renegotiation=0" \ |
| 1116 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1117 | 1 \ |
| 1118 | -c "client hello, adding renegotiation extension" \ |
| 1119 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1120 | -S "found renegotiation extension" \ |
| 1121 | -s "server hello, secure renegotiation extension" \ |
| 1122 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1123 | -c "=> renegotiate" \ |
| 1124 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1125 | -S "write hello request" \ |
Manuel Pégourié-Gonnard | 6591962 | 2014-08-19 12:50:30 +0200 | [diff] [blame] | 1126 | -c "SSL - Unexpected message at ServerHello in renegotiation" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1127 | -c "failed" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1128 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1129 | run_test "Renegotiation: server-initiated, client-rejected, default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1130 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 1131 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1132 | 0 \ |
| 1133 | -C "client hello, adding renegotiation extension" \ |
| 1134 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1135 | -S "found renegotiation extension" \ |
| 1136 | -s "server hello, secure renegotiation extension" \ |
| 1137 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1138 | -C "=> renegotiate" \ |
| 1139 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1140 | -s "write hello request" \ |
Manuel Pégourié-Gonnard | a9964db | 2014-07-03 19:29:16 +0200 | [diff] [blame] | 1141 | -S "SSL - An unexpected message was received from our peer" \ |
| 1142 | -S "failed" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 1143 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1144 | run_test "Renegotiation: server-initiated, client-rejected, not enforced" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1145 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1146 | renego_delay=-1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1147 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1148 | 0 \ |
| 1149 | -C "client hello, adding renegotiation extension" \ |
| 1150 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1151 | -S "found renegotiation extension" \ |
| 1152 | -s "server hello, secure renegotiation extension" \ |
| 1153 | -c "found renegotiation extension" \ |
| 1154 | -C "=> renegotiate" \ |
| 1155 | -S "=> renegotiate" \ |
| 1156 | -s "write hello request" \ |
| 1157 | -S "SSL - An unexpected message was received from our peer" \ |
| 1158 | -S "failed" |
| 1159 | |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 1160 | # delay 2 for 1 alert record + 1 application data record |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1161 | run_test "Renegotiation: server-initiated, client-rejected, delay 2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1162 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 1163 | renego_delay=2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1164 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1165 | 0 \ |
| 1166 | -C "client hello, adding renegotiation extension" \ |
| 1167 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1168 | -S "found renegotiation extension" \ |
| 1169 | -s "server hello, secure renegotiation extension" \ |
| 1170 | -c "found renegotiation extension" \ |
| 1171 | -C "=> renegotiate" \ |
| 1172 | -S "=> renegotiate" \ |
| 1173 | -s "write hello request" \ |
| 1174 | -S "SSL - An unexpected message was received from our peer" \ |
| 1175 | -S "failed" |
| 1176 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1177 | run_test "Renegotiation: server-initiated, client-rejected, delay 0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1178 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1179 | renego_delay=0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1180 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1181 | 0 \ |
| 1182 | -C "client hello, adding renegotiation extension" \ |
| 1183 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1184 | -S "found renegotiation extension" \ |
| 1185 | -s "server hello, secure renegotiation extension" \ |
| 1186 | -c "found renegotiation extension" \ |
| 1187 | -C "=> renegotiate" \ |
| 1188 | -S "=> renegotiate" \ |
| 1189 | -s "write hello request" \ |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 1190 | -s "SSL - An unexpected message was received from our peer" |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1191 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1192 | run_test "Renegotiation: server-initiated, client-accepted, delay 0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1193 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1194 | renego_delay=0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1195 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1196 | 0 \ |
| 1197 | -c "client hello, adding renegotiation extension" \ |
| 1198 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1199 | -s "found renegotiation extension" \ |
| 1200 | -s "server hello, secure renegotiation extension" \ |
| 1201 | -c "found renegotiation extension" \ |
| 1202 | -c "=> renegotiate" \ |
| 1203 | -s "=> renegotiate" \ |
| 1204 | -s "write hello request" \ |
| 1205 | -S "SSL - An unexpected message was received from our peer" \ |
| 1206 | -S "failed" |
| 1207 | |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1208 | run_test "Renegotiation: periodic, just below period" \ |
| 1209 | "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3" \ |
| 1210 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
| 1211 | 0 \ |
| 1212 | -C "client hello, adding renegotiation extension" \ |
| 1213 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1214 | -S "found renegotiation extension" \ |
| 1215 | -s "server hello, secure renegotiation extension" \ |
| 1216 | -c "found renegotiation extension" \ |
| 1217 | -S "record counter limit reached: renegotiate" \ |
| 1218 | -C "=> renegotiate" \ |
| 1219 | -S "=> renegotiate" \ |
| 1220 | -S "write hello request" \ |
| 1221 | -S "SSL - An unexpected message was received from our peer" \ |
| 1222 | -S "failed" |
| 1223 | |
Manuel Pégourié-Gonnard | 9835bc0 | 2015-01-14 14:41:58 +0100 | [diff] [blame] | 1224 | # one extra exchange to be able to complete renego |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1225 | run_test "Renegotiation: periodic, just above period" \ |
| 1226 | "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3" \ |
Manuel Pégourié-Gonnard | 9835bc0 | 2015-01-14 14:41:58 +0100 | [diff] [blame] | 1227 | "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1228 | 0 \ |
| 1229 | -c "client hello, adding renegotiation extension" \ |
| 1230 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1231 | -s "found renegotiation extension" \ |
| 1232 | -s "server hello, secure renegotiation extension" \ |
| 1233 | -c "found renegotiation extension" \ |
| 1234 | -s "record counter limit reached: renegotiate" \ |
| 1235 | -c "=> renegotiate" \ |
| 1236 | -s "=> renegotiate" \ |
| 1237 | -s "write hello request" \ |
| 1238 | -S "SSL - An unexpected message was received from our peer" \ |
| 1239 | -S "failed" |
| 1240 | |
| 1241 | run_test "Renegotiation: periodic, two times period" \ |
| 1242 | "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3" \ |
Manuel Pégourié-Gonnard | 9835bc0 | 2015-01-14 14:41:58 +0100 | [diff] [blame] | 1243 | "$P_CLI debug_level=3 exchanges=7 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1244 | 0 \ |
| 1245 | -c "client hello, adding renegotiation extension" \ |
| 1246 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1247 | -s "found renegotiation extension" \ |
| 1248 | -s "server hello, secure renegotiation extension" \ |
| 1249 | -c "found renegotiation extension" \ |
| 1250 | -s "record counter limit reached: renegotiate" \ |
| 1251 | -c "=> renegotiate" \ |
| 1252 | -s "=> renegotiate" \ |
| 1253 | -s "write hello request" \ |
| 1254 | -S "SSL - An unexpected message was received from our peer" \ |
| 1255 | -S "failed" |
| 1256 | |
| 1257 | run_test "Renegotiation: periodic, above period, disabled" \ |
| 1258 | "$P_SRV debug_level=3 exchanges=9 renegotiation=0 renego_period=3" \ |
| 1259 | "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \ |
| 1260 | 0 \ |
| 1261 | -C "client hello, adding renegotiation extension" \ |
| 1262 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1263 | -S "found renegotiation extension" \ |
| 1264 | -s "server hello, secure renegotiation extension" \ |
| 1265 | -c "found renegotiation extension" \ |
| 1266 | -S "record counter limit reached: renegotiate" \ |
| 1267 | -C "=> renegotiate" \ |
| 1268 | -S "=> renegotiate" \ |
| 1269 | -S "write hello request" \ |
| 1270 | -S "SSL - An unexpected message was received from our peer" \ |
| 1271 | -S "failed" |
| 1272 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1273 | run_test "Renegotiation: nbio, client-initiated" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1274 | "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1" \ |
| 1275 | "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | f07f421 | 2014-08-15 19:04:47 +0200 | [diff] [blame] | 1276 | 0 \ |
| 1277 | -c "client hello, adding renegotiation extension" \ |
| 1278 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1279 | -s "found renegotiation extension" \ |
| 1280 | -s "server hello, secure renegotiation extension" \ |
| 1281 | -c "found renegotiation extension" \ |
| 1282 | -c "=> renegotiate" \ |
| 1283 | -s "=> renegotiate" \ |
| 1284 | -S "write hello request" |
| 1285 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1286 | run_test "Renegotiation: nbio, server-initiated" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1287 | "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 1288 | "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | f07f421 | 2014-08-15 19:04:47 +0200 | [diff] [blame] | 1289 | 0 \ |
| 1290 | -c "client hello, adding renegotiation extension" \ |
| 1291 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1292 | -s "found renegotiation extension" \ |
| 1293 | -s "server hello, secure renegotiation extension" \ |
| 1294 | -c "found renegotiation extension" \ |
| 1295 | -c "=> renegotiate" \ |
| 1296 | -s "=> renegotiate" \ |
| 1297 | -s "write hello request" |
| 1298 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1299 | run_test "Renegotiation: openssl server, client-initiated" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 1300 | "$O_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1301 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 1302 | 0 \ |
| 1303 | -c "client hello, adding renegotiation extension" \ |
| 1304 | -c "found renegotiation extension" \ |
| 1305 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1306 | -C "ssl_hanshake() returned" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 1307 | -C "error" \ |
| 1308 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 1309 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1310 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1311 | run_test "Renegotiation: gnutls server strict, client-initiated" \ |
| 1312 | "$G_SRV --priority=NORMAL:%SAFE_RENEGOTIATION" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1313 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 1314 | 0 \ |
| 1315 | -c "client hello, adding renegotiation extension" \ |
| 1316 | -c "found renegotiation extension" \ |
| 1317 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1318 | -C "ssl_hanshake() returned" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 1319 | -C "error" \ |
| 1320 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 1321 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1322 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1323 | run_test "Renegotiation: gnutls server unsafe, client-initiated default" \ |
| 1324 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1325 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
| 1326 | 1 \ |
| 1327 | -c "client hello, adding renegotiation extension" \ |
| 1328 | -C "found renegotiation extension" \ |
| 1329 | -c "=> renegotiate" \ |
| 1330 | -c "ssl_handshake() returned" \ |
| 1331 | -c "error" \ |
| 1332 | -C "HTTP/1.0 200 [Oo][Kk]" |
| 1333 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1334 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1335 | run_test "Renegotiation: gnutls server unsafe, client-inititated no legacy" \ |
| 1336 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1337 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \ |
| 1338 | allow_legacy=0" \ |
| 1339 | 1 \ |
| 1340 | -c "client hello, adding renegotiation extension" \ |
| 1341 | -C "found renegotiation extension" \ |
| 1342 | -c "=> renegotiate" \ |
| 1343 | -c "ssl_handshake() returned" \ |
| 1344 | -c "error" \ |
| 1345 | -C "HTTP/1.0 200 [Oo][Kk]" |
| 1346 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1347 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1348 | run_test "Renegotiation: gnutls server unsafe, client-inititated legacy" \ |
| 1349 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1350 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \ |
| 1351 | allow_legacy=1" \ |
| 1352 | 0 \ |
| 1353 | -c "client hello, adding renegotiation extension" \ |
| 1354 | -C "found renegotiation extension" \ |
| 1355 | -c "=> renegotiate" \ |
| 1356 | -C "ssl_hanshake() returned" \ |
| 1357 | -C "error" \ |
| 1358 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 1359 | |
| 1360 | # Test for the "secure renegotation" extension only (no actual renegotiation) |
| 1361 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1362 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1363 | run_test "Renego ext: gnutls server strict, client default" \ |
| 1364 | "$G_SRV --priority=NORMAL:%SAFE_RENEGOTIATION" \ |
| 1365 | "$P_CLI debug_level=3" \ |
| 1366 | 0 \ |
| 1367 | -c "found renegotiation extension" \ |
| 1368 | -C "error" \ |
| 1369 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 1370 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1371 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1372 | run_test "Renego ext: gnutls server unsafe, client default" \ |
| 1373 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1374 | "$P_CLI debug_level=3" \ |
| 1375 | 0 \ |
| 1376 | -C "found renegotiation extension" \ |
| 1377 | -C "error" \ |
| 1378 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 1379 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1380 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1381 | run_test "Renego ext: gnutls server unsafe, client break legacy" \ |
| 1382 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1383 | "$P_CLI debug_level=3 allow_legacy=-1" \ |
| 1384 | 1 \ |
| 1385 | -C "found renegotiation extension" \ |
| 1386 | -c "error" \ |
| 1387 | -C "HTTP/1.0 200 [Oo][Kk]" |
| 1388 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1389 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1390 | run_test "Renego ext: gnutls client strict, server default" \ |
| 1391 | "$P_SRV debug_level=3" \ |
| 1392 | "$G_CLI --priority=NORMAL:%SAFE_RENEGOTIATION" \ |
| 1393 | 0 \ |
| 1394 | -s "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ |
| 1395 | -s "server hello, secure renegotiation extension" |
| 1396 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1397 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1398 | run_test "Renego ext: gnutls client unsafe, server default" \ |
| 1399 | "$P_SRV debug_level=3" \ |
| 1400 | "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1401 | 0 \ |
| 1402 | -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ |
| 1403 | -S "server hello, secure renegotiation extension" |
| 1404 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 1405 | requires_gnutls |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1406 | run_test "Renego ext: gnutls client unsafe, server break legacy" \ |
| 1407 | "$P_SRV debug_level=3 allow_legacy=-1" \ |
| 1408 | "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 1409 | 1 \ |
| 1410 | -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ |
| 1411 | -S "server hello, secure renegotiation extension" |
| 1412 | |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1413 | # Tests for auth_mode |
| 1414 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1415 | run_test "Authentication: server badcert, client required" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1416 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1417 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1418 | "$P_CLI debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1419 | 1 \ |
| 1420 | -c "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 0c6ce2f | 2015-04-17 16:32:21 +0200 | [diff] [blame] | 1421 | -c "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1422 | -c "! ssl_handshake returned" \ |
| 1423 | -c "X509 - Certificate verification failed" |
| 1424 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1425 | run_test "Authentication: server badcert, client optional" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1426 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1427 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1428 | "$P_CLI debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1429 | 0 \ |
| 1430 | -c "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 0c6ce2f | 2015-04-17 16:32:21 +0200 | [diff] [blame] | 1431 | -c "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1432 | -C "! ssl_handshake returned" \ |
| 1433 | -C "X509 - Certificate verification failed" |
| 1434 | |
Hanno Becker | 6fd6d24 | 2017-05-25 17:51:31 +0100 | [diff] [blame] | 1435 | run_test "Authentication: server goodcert, client optional, no trusted CA" \ |
| 1436 | "$P_SRV" \ |
| 1437 | "$P_CLI debug_level=3 auth_mode=optional ca_file=none ca_path=none" \ |
| 1438 | 0 \ |
| 1439 | -c "x509_verify_cert() returned" \ |
| 1440 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 1441 | -c "! Certificate verification flags"\ |
| 1442 | -C "! ssl_handshake returned" \ |
| 1443 | -C "X509 - Certificate verification failed" \ |
| 1444 | -C "SSL - No CA Chain is set, but required to operate" |
| 1445 | |
| 1446 | run_test "Authentication: server goodcert, client required, no trusted CA" \ |
| 1447 | "$P_SRV" \ |
| 1448 | "$P_CLI debug_level=3 auth_mode=required ca_file=none ca_path=none" \ |
| 1449 | 1 \ |
| 1450 | -c "x509_verify_cert() returned" \ |
| 1451 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 1452 | -c "! Certificate verification flags"\ |
| 1453 | -c "! ssl_handshake returned" \ |
| 1454 | -c "SSL - No CA Chain is set, but required to operate" |
| 1455 | |
| 1456 | # The purpose of the next two tests is to test the client's behaviour when receiving a server |
| 1457 | # certificate with an unsupported elliptic curve. This should usually not happen because |
| 1458 | # the client informs the server about the supported curves - it does, though, in the |
| 1459 | # corner case of a static ECDH suite, because the server doesn't check the curve on that |
| 1460 | # occasion (to be fixed). If that bug's fixed, the test needs to be altered to use a |
| 1461 | # different means to have the server ignoring the client's supported curve list. |
| 1462 | |
| 1463 | requires_config_enabled POLARSSL_SSL_SET_CURVES |
| 1464 | run_test "Authentication: server ECDH p256v1, client required, p256v1 unsupported" \ |
| 1465 | "$P_SRV debug_level=1 key_file=data_files/server5.key \ |
| 1466 | crt_file=data_files/server5.ku-ka.crt" \ |
| 1467 | "$P_CLI debug_level=3 auth_mode=required curves=secp521r1" \ |
| 1468 | 1 \ |
| 1469 | -c "bad certificate (EC key curve)"\ |
| 1470 | -c "! Certificate verification flags"\ |
| 1471 | -C "bad server certificate (ECDH curve)" # Expect failure at earlier verification stage |
| 1472 | |
| 1473 | requires_config_enabled POLARSSL_SSL_SET_CURVES |
| 1474 | run_test "Authentication: server ECDH p256v1, client optional, p256v1 unsupported" \ |
| 1475 | "$P_SRV debug_level=1 key_file=data_files/server5.key \ |
| 1476 | crt_file=data_files/server5.ku-ka.crt" \ |
| 1477 | "$P_CLI debug_level=3 auth_mode=optional curves=secp521r1" \ |
| 1478 | 1 \ |
| 1479 | -c "bad certificate (EC key curve)"\ |
| 1480 | -c "! Certificate verification flags"\ |
| 1481 | -c "bad server certificate (ECDH curve)" # Expect failure only at ECDH params check |
| 1482 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1483 | run_test "Authentication: server badcert, client none" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1484 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1485 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1486 | "$P_CLI debug_level=1 auth_mode=none" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1487 | 0 \ |
| 1488 | -C "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 0c6ce2f | 2015-04-17 16:32:21 +0200 | [diff] [blame] | 1489 | -C "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1490 | -C "! ssl_handshake returned" \ |
| 1491 | -C "X509 - Certificate verification failed" |
| 1492 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1493 | run_test "Authentication: client badcert, server required" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1494 | "$P_SRV debug_level=3 auth_mode=required" \ |
| 1495 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1496 | key_file=data_files/server5.key" \ |
| 1497 | 1 \ |
| 1498 | -S "skip write certificate request" \ |
| 1499 | -C "skip parse certificate request" \ |
| 1500 | -c "got a certificate request" \ |
| 1501 | -C "skip write certificate" \ |
| 1502 | -C "skip write certificate verify" \ |
| 1503 | -S "skip parse certificate verify" \ |
| 1504 | -s "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 0c6ce2f | 2015-04-17 16:32:21 +0200 | [diff] [blame] | 1505 | -S "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1506 | -s "! ssl_handshake returned" \ |
| 1507 | -c "! ssl_handshake returned" \ |
| 1508 | -s "X509 - Certificate verification failed" |
| 1509 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1510 | run_test "Authentication: client badcert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1511 | "$P_SRV debug_level=3 auth_mode=optional" \ |
| 1512 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1513 | key_file=data_files/server5.key" \ |
| 1514 | 0 \ |
| 1515 | -S "skip write certificate request" \ |
| 1516 | -C "skip parse certificate request" \ |
| 1517 | -c "got a certificate request" \ |
| 1518 | -C "skip write certificate" \ |
| 1519 | -C "skip write certificate verify" \ |
| 1520 | -S "skip parse certificate verify" \ |
| 1521 | -s "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 0c6ce2f | 2015-04-17 16:32:21 +0200 | [diff] [blame] | 1522 | -s "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1523 | -S "! ssl_handshake returned" \ |
| 1524 | -C "! ssl_handshake returned" \ |
| 1525 | -S "X509 - Certificate verification failed" |
| 1526 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1527 | run_test "Authentication: client badcert, server none" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1528 | "$P_SRV debug_level=3 auth_mode=none" \ |
| 1529 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1530 | key_file=data_files/server5.key" \ |
| 1531 | 0 \ |
| 1532 | -s "skip write certificate request" \ |
| 1533 | -C "skip parse certificate request" \ |
| 1534 | -c "got no certificate request" \ |
| 1535 | -c "skip write certificate" \ |
| 1536 | -c "skip write certificate verify" \ |
| 1537 | -s "skip parse certificate verify" \ |
| 1538 | -S "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 0c6ce2f | 2015-04-17 16:32:21 +0200 | [diff] [blame] | 1539 | -S "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1540 | -S "! ssl_handshake returned" \ |
| 1541 | -C "! ssl_handshake returned" \ |
| 1542 | -S "X509 - Certificate verification failed" |
| 1543 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1544 | run_test "Authentication: client no cert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1545 | "$P_SRV debug_level=3 auth_mode=optional" \ |
| 1546 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1547 | 0 \ |
| 1548 | -S "skip write certificate request" \ |
| 1549 | -C "skip parse certificate request" \ |
| 1550 | -c "got a certificate request" \ |
| 1551 | -C "skip write certificate$" \ |
| 1552 | -C "got no certificate to send" \ |
| 1553 | -S "SSLv3 client has no certificate" \ |
| 1554 | -c "skip write certificate verify" \ |
| 1555 | -s "skip parse certificate verify" \ |
Manuel Pégourié-Gonnard | 0c6ce2f | 2015-04-17 16:32:21 +0200 | [diff] [blame] | 1556 | -s "! Certificate was missing" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1557 | -S "! ssl_handshake returned" \ |
| 1558 | -C "! ssl_handshake returned" \ |
| 1559 | -S "X509 - Certificate verification failed" |
| 1560 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1561 | run_test "Authentication: openssl client no cert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1562 | "$P_SRV debug_level=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1563 | "$O_CLI" \ |
| 1564 | 0 \ |
| 1565 | -S "skip write certificate request" \ |
| 1566 | -s "skip parse certificate verify" \ |
Manuel Pégourié-Gonnard | 0c6ce2f | 2015-04-17 16:32:21 +0200 | [diff] [blame] | 1567 | -s "! Certificate was missing" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1568 | -S "! ssl_handshake returned" \ |
| 1569 | -S "X509 - Certificate verification failed" |
| 1570 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1571 | run_test "Authentication: client no cert, openssl server optional" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1572 | "$O_SRV -verify 10" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1573 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1574 | 0 \ |
| 1575 | -C "skip parse certificate request" \ |
| 1576 | -c "got a certificate request" \ |
| 1577 | -C "skip write certificate$" \ |
| 1578 | -c "skip write certificate verify" \ |
| 1579 | -C "! ssl_handshake returned" |
| 1580 | |
Janos Follath | 4dfecab | 2016-03-14 13:40:43 +0000 | [diff] [blame] | 1581 | requires_config_enabled POLARSSL_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1582 | run_test "Authentication: client no cert, ssl3" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1583 | "$P_SRV debug_level=3 auth_mode=optional force_version=ssl3" \ |
Manuel Pégourié-Gonnard | 448ea50 | 2015-01-12 11:40:14 +0100 | [diff] [blame] | 1584 | "$P_CLI debug_level=3 crt_file=none key_file=none min_version=ssl3" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1585 | 0 \ |
| 1586 | -S "skip write certificate request" \ |
| 1587 | -C "skip parse certificate request" \ |
| 1588 | -c "got a certificate request" \ |
| 1589 | -C "skip write certificate$" \ |
| 1590 | -c "skip write certificate verify" \ |
| 1591 | -c "got no certificate to send" \ |
| 1592 | -s "SSLv3 client has no certificate" \ |
| 1593 | -s "skip parse certificate verify" \ |
Manuel Pégourié-Gonnard | 0c6ce2f | 2015-04-17 16:32:21 +0200 | [diff] [blame] | 1594 | -s "! Certificate was missing" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1595 | -S "! ssl_handshake returned" \ |
| 1596 | -C "! ssl_handshake returned" \ |
| 1597 | -S "X509 - Certificate verification failed" |
| 1598 | |
Manuel Pégourié-Gonnard | a68d591 | 2017-07-10 11:31:43 +0200 | [diff] [blame^] | 1599 | run_test "Authentication: server max_int chain, client default" \ |
| 1600 | "$P_SRV crt_file=data_files/dir-maxpath/c09.pem \ |
| 1601 | key_file=data_files/dir-maxpath/09.key" \ |
| 1602 | "$P_CLI server_name=CA09 server_addr=127.0.0.1 \ |
| 1603 | ca_file=data_files/dir-maxpath/00.crt" \ |
| 1604 | 0 \ |
| 1605 | -C "X509 - A fatal error occured" |
| 1606 | |
| 1607 | run_test "Authentication: server max_int+1 chain, client default" \ |
| 1608 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 1609 | key_file=data_files/dir-maxpath/10.key" \ |
| 1610 | "$P_CLI server_name=CA10 server_addr=127.0.0.1 \ |
| 1611 | ca_file=data_files/dir-maxpath/00.crt" \ |
| 1612 | 1 \ |
| 1613 | -c "X509 - A fatal error occured" |
| 1614 | |
| 1615 | run_test "Authentication: server max_int+1 chain, client optional" \ |
| 1616 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 1617 | key_file=data_files/dir-maxpath/10.key" \ |
| 1618 | "$P_CLI server_name=CA10 server_addr=127.0.0.1 \ |
| 1619 | ca_file=data_files/dir-maxpath/00.crt \ |
| 1620 | auth_mode=optional" \ |
| 1621 | 1 \ |
| 1622 | -c "X509 - A fatal error occured" |
| 1623 | |
| 1624 | run_test "Authentication: server max_int+1 chain, client none" \ |
| 1625 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 1626 | key_file=data_files/dir-maxpath/10.key" \ |
| 1627 | "$P_CLI server_name=CA10 server_addr=127.0.0.1 ca_file=data_files/dir-maxpath/00.crt \ |
| 1628 | auth_mode=none" \ |
| 1629 | 0 \ |
| 1630 | -C "X509 - A fatal error occured" |
| 1631 | |
| 1632 | run_test "Authentication: client max_int+1 chain, server none" \ |
| 1633 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=none" \ |
| 1634 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 1635 | key_file=data_files/dir-maxpath/10.key" \ |
| 1636 | 0 \ |
| 1637 | -S "X509 - A fatal error occured" |
| 1638 | |
| 1639 | run_test "Authentication: client max_int+1 chain, server optional" \ |
| 1640 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=optional" \ |
| 1641 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 1642 | key_file=data_files/dir-maxpath/10.key" \ |
| 1643 | 1 \ |
| 1644 | -s "X509 - A fatal error occured" |
| 1645 | |
| 1646 | run_test "Authentication: client max_int+1 chain, server required" \ |
| 1647 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \ |
| 1648 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 1649 | key_file=data_files/dir-maxpath/10.key" \ |
| 1650 | 1 \ |
| 1651 | -s "X509 - A fatal error occured" |
| 1652 | |
| 1653 | run_test "Authentication: client max_int chain, server required" \ |
| 1654 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \ |
| 1655 | "$P_CLI crt_file=data_files/dir-maxpath/c09.pem \ |
| 1656 | key_file=data_files/dir-maxpath/09.key" \ |
| 1657 | 0 \ |
| 1658 | -S "X509 - A fatal error occured" |
| 1659 | |
Manuel Pégourié-Gonnard | df331a5 | 2015-01-08 16:43:07 +0100 | [diff] [blame] | 1660 | # Tests for certificate selection based on SHA verson |
| 1661 | |
| 1662 | run_test "Certificate hash: client TLS 1.2 -> SHA-2" \ |
| 1663 | "$P_SRV crt_file=data_files/server5.crt \ |
| 1664 | key_file=data_files/server5.key \ |
| 1665 | crt_file2=data_files/server5-sha1.crt \ |
| 1666 | key_file2=data_files/server5.key" \ |
| 1667 | "$P_CLI force_version=tls1_2" \ |
| 1668 | 0 \ |
| 1669 | -c "signed using.*ECDSA with SHA256" \ |
| 1670 | -C "signed using.*ECDSA with SHA1" |
| 1671 | |
| 1672 | run_test "Certificate hash: client TLS 1.1 -> SHA-1" \ |
| 1673 | "$P_SRV crt_file=data_files/server5.crt \ |
| 1674 | key_file=data_files/server5.key \ |
| 1675 | crt_file2=data_files/server5-sha1.crt \ |
| 1676 | key_file2=data_files/server5.key" \ |
| 1677 | "$P_CLI force_version=tls1_1" \ |
| 1678 | 0 \ |
| 1679 | -C "signed using.*ECDSA with SHA256" \ |
| 1680 | -c "signed using.*ECDSA with SHA1" |
| 1681 | |
| 1682 | run_test "Certificate hash: client TLS 1.0 -> SHA-1" \ |
| 1683 | "$P_SRV crt_file=data_files/server5.crt \ |
| 1684 | key_file=data_files/server5.key \ |
| 1685 | crt_file2=data_files/server5-sha1.crt \ |
| 1686 | key_file2=data_files/server5.key" \ |
| 1687 | "$P_CLI force_version=tls1" \ |
| 1688 | 0 \ |
| 1689 | -C "signed using.*ECDSA with SHA256" \ |
| 1690 | -c "signed using.*ECDSA with SHA1" |
| 1691 | |
| 1692 | run_test "Certificate hash: client TLS 1.1, no SHA-1 -> SHA-2 (order 1)" \ |
| 1693 | "$P_SRV crt_file=data_files/server5.crt \ |
| 1694 | key_file=data_files/server5.key \ |
| 1695 | crt_file2=data_files/server6.crt \ |
| 1696 | key_file2=data_files/server6.key" \ |
| 1697 | "$P_CLI force_version=tls1_1" \ |
| 1698 | 0 \ |
| 1699 | -c "serial number.*09" \ |
| 1700 | -c "signed using.*ECDSA with SHA256" \ |
| 1701 | -C "signed using.*ECDSA with SHA1" |
| 1702 | |
| 1703 | run_test "Certificate hash: client TLS 1.1, no SHA-1 -> SHA-2 (order 2)" \ |
| 1704 | "$P_SRV crt_file=data_files/server6.crt \ |
| 1705 | key_file=data_files/server6.key \ |
| 1706 | crt_file2=data_files/server5.crt \ |
| 1707 | key_file2=data_files/server5.key" \ |
| 1708 | "$P_CLI force_version=tls1_1" \ |
| 1709 | 0 \ |
| 1710 | -c "serial number.*0A" \ |
| 1711 | -c "signed using.*ECDSA with SHA256" \ |
| 1712 | -C "signed using.*ECDSA with SHA1" |
| 1713 | |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1714 | # tests for SNI |
| 1715 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1716 | run_test "SNI: no SNI callback" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1717 | "$P_SRV debug_level=3 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1718 | crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1719 | "$P_CLI debug_level=0 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1720 | server_name=localhost" \ |
| 1721 | 0 \ |
| 1722 | -S "parse ServerName extension" \ |
| 1723 | -c "issuer name *: C=NL, O=PolarSSL, CN=Polarssl Test EC CA" \ |
| 1724 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
| 1725 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1726 | run_test "SNI: matching cert 1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1727 | "$P_SRV debug_level=3 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1728 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1729 | sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1730 | "$P_CLI debug_level=0 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1731 | server_name=localhost" \ |
| 1732 | 0 \ |
| 1733 | -s "parse ServerName extension" \ |
| 1734 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 1735 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
| 1736 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1737 | run_test "SNI: matching cert 2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1738 | "$P_SRV debug_level=3 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1739 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1740 | sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1741 | "$P_CLI debug_level=0 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1742 | server_name=polarssl.example" \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1743 | 0 \ |
| 1744 | -s "parse ServerName extension" \ |
| 1745 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1746 | -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1747 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1748 | run_test "SNI: no matching cert" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1749 | "$P_SRV debug_level=3 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1750 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1751 | sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1752 | "$P_CLI debug_level=0 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1753 | server_name=nonesuch.example" \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1754 | 1 \ |
| 1755 | -s "parse ServerName extension" \ |
| 1756 | -s "ssl_sni_wrapper() returned" \ |
| 1757 | -s "ssl_handshake returned" \ |
| 1758 | -c "ssl_handshake returned" \ |
| 1759 | -c "SSL - A fatal alert message was received from our peer" |
| 1760 | |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1761 | # Tests for non-blocking I/O: exercise a variety of handshake flows |
| 1762 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1763 | run_test "Non-blocking I/O: basic handshake" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1764 | "$P_SRV nbio=2 tickets=0 auth_mode=none" \ |
| 1765 | "$P_CLI nbio=2 tickets=0" \ |
| 1766 | 0 \ |
| 1767 | -S "ssl_handshake returned" \ |
| 1768 | -C "ssl_handshake returned" \ |
| 1769 | -c "Read from server: .* bytes read" |
| 1770 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1771 | run_test "Non-blocking I/O: client auth" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1772 | "$P_SRV nbio=2 tickets=0 auth_mode=required" \ |
| 1773 | "$P_CLI nbio=2 tickets=0" \ |
| 1774 | 0 \ |
| 1775 | -S "ssl_handshake returned" \ |
| 1776 | -C "ssl_handshake returned" \ |
| 1777 | -c "Read from server: .* bytes read" |
| 1778 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1779 | run_test "Non-blocking I/O: ticket" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1780 | "$P_SRV nbio=2 tickets=1 auth_mode=none" \ |
| 1781 | "$P_CLI nbio=2 tickets=1" \ |
| 1782 | 0 \ |
| 1783 | -S "ssl_handshake returned" \ |
| 1784 | -C "ssl_handshake returned" \ |
| 1785 | -c "Read from server: .* bytes read" |
| 1786 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1787 | run_test "Non-blocking I/O: ticket + client auth" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1788 | "$P_SRV nbio=2 tickets=1 auth_mode=required" \ |
| 1789 | "$P_CLI nbio=2 tickets=1" \ |
| 1790 | 0 \ |
| 1791 | -S "ssl_handshake returned" \ |
| 1792 | -C "ssl_handshake returned" \ |
| 1793 | -c "Read from server: .* bytes read" |
| 1794 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1795 | run_test "Non-blocking I/O: ticket + client auth + resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1796 | "$P_SRV nbio=2 tickets=1 auth_mode=required" \ |
| 1797 | "$P_CLI nbio=2 tickets=1 reconnect=1" \ |
| 1798 | 0 \ |
| 1799 | -S "ssl_handshake returned" \ |
| 1800 | -C "ssl_handshake returned" \ |
| 1801 | -c "Read from server: .* bytes read" |
| 1802 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1803 | run_test "Non-blocking I/O: ticket + resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1804 | "$P_SRV nbio=2 tickets=1 auth_mode=none" \ |
| 1805 | "$P_CLI nbio=2 tickets=1 reconnect=1" \ |
| 1806 | 0 \ |
| 1807 | -S "ssl_handshake returned" \ |
| 1808 | -C "ssl_handshake returned" \ |
| 1809 | -c "Read from server: .* bytes read" |
| 1810 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1811 | run_test "Non-blocking I/O: session-id resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1812 | "$P_SRV nbio=2 tickets=0 auth_mode=none" \ |
| 1813 | "$P_CLI nbio=2 tickets=0 reconnect=1" \ |
| 1814 | 0 \ |
| 1815 | -S "ssl_handshake returned" \ |
| 1816 | -C "ssl_handshake returned" \ |
| 1817 | -c "Read from server: .* bytes read" |
| 1818 | |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1819 | # Tests for version negotiation |
| 1820 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1821 | run_test "Version check: all -> 1.2" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1822 | "$P_SRV" \ |
| 1823 | "$P_CLI" \ |
| 1824 | 0 \ |
| 1825 | -S "ssl_handshake returned" \ |
| 1826 | -C "ssl_handshake returned" \ |
| 1827 | -s "Protocol is TLSv1.2" \ |
| 1828 | -c "Protocol is TLSv1.2" |
| 1829 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1830 | run_test "Version check: cli max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1831 | "$P_SRV" \ |
| 1832 | "$P_CLI max_version=tls1_1" \ |
| 1833 | 0 \ |
| 1834 | -S "ssl_handshake returned" \ |
| 1835 | -C "ssl_handshake returned" \ |
| 1836 | -s "Protocol is TLSv1.1" \ |
| 1837 | -c "Protocol is TLSv1.1" |
| 1838 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1839 | run_test "Version check: srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1840 | "$P_SRV max_version=tls1_1" \ |
| 1841 | "$P_CLI" \ |
| 1842 | 0 \ |
| 1843 | -S "ssl_handshake returned" \ |
| 1844 | -C "ssl_handshake returned" \ |
| 1845 | -s "Protocol is TLSv1.1" \ |
| 1846 | -c "Protocol is TLSv1.1" |
| 1847 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1848 | run_test "Version check: cli+srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1849 | "$P_SRV max_version=tls1_1" \ |
| 1850 | "$P_CLI max_version=tls1_1" \ |
| 1851 | 0 \ |
| 1852 | -S "ssl_handshake returned" \ |
| 1853 | -C "ssl_handshake returned" \ |
| 1854 | -s "Protocol is TLSv1.1" \ |
| 1855 | -c "Protocol is TLSv1.1" |
| 1856 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1857 | run_test "Version check: cli max 1.1, srv min 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1858 | "$P_SRV min_version=tls1_1" \ |
| 1859 | "$P_CLI max_version=tls1_1" \ |
| 1860 | 0 \ |
| 1861 | -S "ssl_handshake returned" \ |
| 1862 | -C "ssl_handshake returned" \ |
| 1863 | -s "Protocol is TLSv1.1" \ |
| 1864 | -c "Protocol is TLSv1.1" |
| 1865 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1866 | run_test "Version check: cli min 1.1, srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1867 | "$P_SRV max_version=tls1_1" \ |
| 1868 | "$P_CLI min_version=tls1_1" \ |
| 1869 | 0 \ |
| 1870 | -S "ssl_handshake returned" \ |
| 1871 | -C "ssl_handshake returned" \ |
| 1872 | -s "Protocol is TLSv1.1" \ |
| 1873 | -c "Protocol is TLSv1.1" |
| 1874 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1875 | run_test "Version check: cli min 1.2, srv max 1.1 -> fail" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1876 | "$P_SRV max_version=tls1_1" \ |
| 1877 | "$P_CLI min_version=tls1_2" \ |
| 1878 | 1 \ |
| 1879 | -s "ssl_handshake returned" \ |
| 1880 | -c "ssl_handshake returned" \ |
| 1881 | -c "SSL - Handshake protocol not within min/max boundaries" |
| 1882 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1883 | run_test "Version check: srv min 1.2, cli max 1.1 -> fail" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1884 | "$P_SRV min_version=tls1_2" \ |
| 1885 | "$P_CLI max_version=tls1_1" \ |
| 1886 | 1 \ |
| 1887 | -s "ssl_handshake returned" \ |
| 1888 | -c "ssl_handshake returned" \ |
| 1889 | -s "SSL - Handshake protocol not within min/max boundaries" |
| 1890 | |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1891 | # Tests for ALPN extension |
| 1892 | |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 1893 | if grep '^#define POLARSSL_SSL_ALPN' $CONFIG_H >/dev/null; then |
| 1894 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1895 | run_test "ALPN: none" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1896 | "$P_SRV debug_level=3" \ |
| 1897 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1898 | 0 \ |
| 1899 | -C "client hello, adding alpn extension" \ |
| 1900 | -S "found alpn extension" \ |
| 1901 | -C "got an alert message, type: \\[2:120]" \ |
| 1902 | -S "server hello, adding alpn extension" \ |
| 1903 | -C "found alpn extension " \ |
| 1904 | -C "Application Layer Protocol is" \ |
| 1905 | -S "Application Layer Protocol is" |
| 1906 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1907 | run_test "ALPN: client only" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1908 | "$P_SRV debug_level=3" \ |
| 1909 | "$P_CLI debug_level=3 alpn=abc,1234" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1910 | 0 \ |
| 1911 | -c "client hello, adding alpn extension" \ |
| 1912 | -s "found alpn extension" \ |
| 1913 | -C "got an alert message, type: \\[2:120]" \ |
| 1914 | -S "server hello, adding alpn extension" \ |
| 1915 | -C "found alpn extension " \ |
| 1916 | -c "Application Layer Protocol is (none)" \ |
| 1917 | -S "Application Layer Protocol is" |
| 1918 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1919 | run_test "ALPN: server only" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1920 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 1921 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1922 | 0 \ |
| 1923 | -C "client hello, adding alpn extension" \ |
| 1924 | -S "found alpn extension" \ |
| 1925 | -C "got an alert message, type: \\[2:120]" \ |
| 1926 | -S "server hello, adding alpn extension" \ |
| 1927 | -C "found alpn extension " \ |
| 1928 | -C "Application Layer Protocol is" \ |
| 1929 | -s "Application Layer Protocol is (none)" |
| 1930 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1931 | run_test "ALPN: both, common cli1-srv1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1932 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 1933 | "$P_CLI debug_level=3 alpn=abc,1234" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1934 | 0 \ |
| 1935 | -c "client hello, adding alpn extension" \ |
| 1936 | -s "found alpn extension" \ |
| 1937 | -C "got an alert message, type: \\[2:120]" \ |
| 1938 | -s "server hello, adding alpn extension" \ |
| 1939 | -c "found alpn extension" \ |
| 1940 | -c "Application Layer Protocol is abc" \ |
| 1941 | -s "Application Layer Protocol is abc" |
| 1942 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1943 | run_test "ALPN: both, common cli2-srv1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1944 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 1945 | "$P_CLI debug_level=3 alpn=1234,abc" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1946 | 0 \ |
| 1947 | -c "client hello, adding alpn extension" \ |
| 1948 | -s "found alpn extension" \ |
| 1949 | -C "got an alert message, type: \\[2:120]" \ |
| 1950 | -s "server hello, adding alpn extension" \ |
| 1951 | -c "found alpn extension" \ |
| 1952 | -c "Application Layer Protocol is abc" \ |
| 1953 | -s "Application Layer Protocol is abc" |
| 1954 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1955 | run_test "ALPN: both, common cli1-srv2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1956 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 1957 | "$P_CLI debug_level=3 alpn=1234,abcde" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1958 | 0 \ |
| 1959 | -c "client hello, adding alpn extension" \ |
| 1960 | -s "found alpn extension" \ |
| 1961 | -C "got an alert message, type: \\[2:120]" \ |
| 1962 | -s "server hello, adding alpn extension" \ |
| 1963 | -c "found alpn extension" \ |
| 1964 | -c "Application Layer Protocol is 1234" \ |
| 1965 | -s "Application Layer Protocol is 1234" |
| 1966 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1967 | run_test "ALPN: both, no common" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1968 | "$P_SRV debug_level=3 alpn=abc,123" \ |
| 1969 | "$P_CLI debug_level=3 alpn=1234,abcde" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1970 | 1 \ |
| 1971 | -c "client hello, adding alpn extension" \ |
| 1972 | -s "found alpn extension" \ |
| 1973 | -c "got an alert message, type: \\[2:120]" \ |
| 1974 | -S "server hello, adding alpn extension" \ |
| 1975 | -C "found alpn extension" \ |
| 1976 | -C "Application Layer Protocol is 1234" \ |
| 1977 | -S "Application Layer Protocol is 1234" |
| 1978 | |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 1979 | fi |
| 1980 | |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1981 | # Tests for keyUsage in leaf certificates, part 1: |
| 1982 | # server-side certificate/suite selection |
| 1983 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1984 | run_test "keyUsage srv: RSA, digitalSignature -> (EC)DHE-RSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1985 | "$P_SRV key_file=data_files/server2.key \ |
| 1986 | crt_file=data_files/server2.ku-ds.crt" \ |
| 1987 | "$P_CLI" \ |
| 1988 | 0 \ |
Manuel Pégourié-Gonnard | 17cde5f | 2014-05-22 14:42:39 +0200 | [diff] [blame] | 1989 | -c "Ciphersuite is TLS-[EC]*DHE-RSA-WITH-" |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1990 | |
| 1991 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1992 | run_test "keyUsage srv: RSA, keyEncipherment -> RSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1993 | "$P_SRV key_file=data_files/server2.key \ |
| 1994 | crt_file=data_files/server2.ku-ke.crt" \ |
| 1995 | "$P_CLI" \ |
| 1996 | 0 \ |
| 1997 | -c "Ciphersuite is TLS-RSA-WITH-" |
| 1998 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1999 | run_test "keyUsage srv: RSA, keyAgreement -> fail" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 2000 | "$P_SRV key_file=data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2001 | crt_file=data_files/server2.ku-ka.crt" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 2002 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2003 | 1 \ |
| 2004 | -C "Ciphersuite is " |
| 2005 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2006 | run_test "keyUsage srv: ECDSA, digitalSignature -> ECDHE-ECDSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2007 | "$P_SRV key_file=data_files/server5.key \ |
| 2008 | crt_file=data_files/server5.ku-ds.crt" \ |
| 2009 | "$P_CLI" \ |
| 2010 | 0 \ |
| 2011 | -c "Ciphersuite is TLS-ECDHE-ECDSA-WITH-" |
| 2012 | |
| 2013 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2014 | run_test "keyUsage srv: ECDSA, keyAgreement -> ECDH-" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2015 | "$P_SRV key_file=data_files/server5.key \ |
| 2016 | crt_file=data_files/server5.ku-ka.crt" \ |
| 2017 | "$P_CLI" \ |
| 2018 | 0 \ |
| 2019 | -c "Ciphersuite is TLS-ECDH-" |
| 2020 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2021 | run_test "keyUsage srv: ECDSA, keyEncipherment -> fail" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 2022 | "$P_SRV key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2023 | crt_file=data_files/server5.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 2024 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2025 | 1 \ |
| 2026 | -C "Ciphersuite is " |
| 2027 | |
| 2028 | # Tests for keyUsage in leaf certificates, part 2: |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2029 | # client-side checking of server cert |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2030 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2031 | run_test "keyUsage cli: DigitalSignature+KeyEncipherment, RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2032 | "$O_SRV -key data_files/server2.key \ |
| 2033 | -cert data_files/server2.ku-ds_ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2034 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2035 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 2036 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2037 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2038 | -C "Processing of the Certificate handshake message failed" \ |
| 2039 | -c "Ciphersuite is TLS-" |
| 2040 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2041 | run_test "keyUsage cli: DigitalSignature+KeyEncipherment, DHE-RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2042 | "$O_SRV -key data_files/server2.key \ |
| 2043 | -cert data_files/server2.ku-ds_ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2044 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2045 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 2046 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2047 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2048 | -C "Processing of the Certificate handshake message failed" \ |
| 2049 | -c "Ciphersuite is TLS-" |
| 2050 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2051 | run_test "keyUsage cli: KeyEncipherment, RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2052 | "$O_SRV -key data_files/server2.key \ |
| 2053 | -cert data_files/server2.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2054 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2055 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 2056 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2057 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2058 | -C "Processing of the Certificate handshake message failed" \ |
| 2059 | -c "Ciphersuite is TLS-" |
| 2060 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2061 | run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2062 | "$O_SRV -key data_files/server2.key \ |
| 2063 | -cert data_files/server2.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2064 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2065 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 2066 | 1 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2067 | -c "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2068 | -c "Processing of the Certificate handshake message failed" \ |
| 2069 | -C "Ciphersuite is TLS-" |
| 2070 | |
Manuel Pégourié-Gonnard | e16b62c | 2015-04-17 16:55:53 +0200 | [diff] [blame] | 2071 | run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail, soft" \ |
| 2072 | "$O_SRV -key data_files/server2.key \ |
| 2073 | -cert data_files/server2.ku-ke.crt" \ |
| 2074 | "$P_CLI debug_level=1 auth_mode=optional \ |
| 2075 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 2076 | 0 \ |
| 2077 | -c "bad certificate (usage extensions)" \ |
| 2078 | -C "Processing of the Certificate handshake message failed" \ |
| 2079 | -c "Ciphersuite is TLS-" \ |
| 2080 | -c "! Usage does not match the keyUsage extension" |
| 2081 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2082 | run_test "keyUsage cli: DigitalSignature, DHE-RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2083 | "$O_SRV -key data_files/server2.key \ |
| 2084 | -cert data_files/server2.ku-ds.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2085 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2086 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 2087 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2088 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2089 | -C "Processing of the Certificate handshake message failed" \ |
| 2090 | -c "Ciphersuite is TLS-" |
| 2091 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2092 | run_test "keyUsage cli: DigitalSignature, RSA: fail" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2093 | "$O_SRV -key data_files/server2.key \ |
| 2094 | -cert data_files/server2.ku-ds.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2095 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2096 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 2097 | 1 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2098 | -c "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 2099 | -c "Processing of the Certificate handshake message failed" \ |
| 2100 | -C "Ciphersuite is TLS-" |
| 2101 | |
Manuel Pégourié-Gonnard | e16b62c | 2015-04-17 16:55:53 +0200 | [diff] [blame] | 2102 | run_test "keyUsage cli: DigitalSignature, RSA: fail, soft" \ |
| 2103 | "$O_SRV -key data_files/server2.key \ |
| 2104 | -cert data_files/server2.ku-ds.crt" \ |
| 2105 | "$P_CLI debug_level=1 auth_mode=optional \ |
| 2106 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 2107 | 0 \ |
| 2108 | -c "bad certificate (usage extensions)" \ |
| 2109 | -C "Processing of the Certificate handshake message failed" \ |
| 2110 | -c "Ciphersuite is TLS-" \ |
| 2111 | -c "! Usage does not match the keyUsage extension" |
| 2112 | |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2113 | # Tests for keyUsage in leaf certificates, part 3: |
| 2114 | # server-side checking of client cert |
| 2115 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2116 | run_test "keyUsage cli-auth: RSA, DigitalSignature: OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2117 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2118 | "$O_CLI -key data_files/server2.key \ |
| 2119 | -cert data_files/server2.ku-ds.crt" \ |
| 2120 | 0 \ |
| 2121 | -S "bad certificate (usage extensions)" \ |
| 2122 | -S "Processing of the Certificate handshake message failed" |
| 2123 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2124 | run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2125 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2126 | "$O_CLI -key data_files/server2.key \ |
| 2127 | -cert data_files/server2.ku-ke.crt" \ |
| 2128 | 0 \ |
| 2129 | -s "bad certificate (usage extensions)" \ |
| 2130 | -S "Processing of the Certificate handshake message failed" |
| 2131 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2132 | run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (hard)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2133 | "$P_SRV debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2134 | "$O_CLI -key data_files/server2.key \ |
| 2135 | -cert data_files/server2.ku-ke.crt" \ |
| 2136 | 1 \ |
| 2137 | -s "bad certificate (usage extensions)" \ |
| 2138 | -s "Processing of the Certificate handshake message failed" |
| 2139 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2140 | run_test "keyUsage cli-auth: ECDSA, DigitalSignature: OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2141 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2142 | "$O_CLI -key data_files/server5.key \ |
| 2143 | -cert data_files/server5.ku-ds.crt" \ |
| 2144 | 0 \ |
| 2145 | -S "bad certificate (usage extensions)" \ |
| 2146 | -S "Processing of the Certificate handshake message failed" |
| 2147 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2148 | run_test "keyUsage cli-auth: ECDSA, KeyAgreement: fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2149 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 2150 | "$O_CLI -key data_files/server5.key \ |
| 2151 | -cert data_files/server5.ku-ka.crt" \ |
| 2152 | 0 \ |
| 2153 | -s "bad certificate (usage extensions)" \ |
| 2154 | -S "Processing of the Certificate handshake message failed" |
| 2155 | |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2156 | # Tests for extendedKeyUsage, part 1: server-side certificate/suite selection |
| 2157 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2158 | run_test "extKeyUsage srv: serverAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2159 | "$P_SRV key_file=data_files/server5.key \ |
| 2160 | crt_file=data_files/server5.eku-srv.crt" \ |
| 2161 | "$P_CLI" \ |
| 2162 | 0 |
| 2163 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2164 | run_test "extKeyUsage srv: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2165 | "$P_SRV key_file=data_files/server5.key \ |
| 2166 | crt_file=data_files/server5.eku-srv.crt" \ |
| 2167 | "$P_CLI" \ |
| 2168 | 0 |
| 2169 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2170 | run_test "extKeyUsage srv: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2171 | "$P_SRV key_file=data_files/server5.key \ |
| 2172 | crt_file=data_files/server5.eku-cs_any.crt" \ |
| 2173 | "$P_CLI" \ |
| 2174 | 0 |
| 2175 | |
| 2176 | # add psk to leave an option for client to send SERVERQUIT |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2177 | run_test "extKeyUsage srv: codeSign -> fail" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2178 | "$P_SRV psk=abc123 key_file=data_files/server5.key \ |
| 2179 | crt_file=data_files/server5.eku-cli.crt" \ |
| 2180 | "$P_CLI psk=badbad" \ |
| 2181 | 1 |
| 2182 | |
| 2183 | # Tests for extendedKeyUsage, part 2: client-side checking of server cert |
| 2184 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2185 | run_test "extKeyUsage cli: serverAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2186 | "$O_SRV -key data_files/server5.key \ |
| 2187 | -cert data_files/server5.eku-srv.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2188 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2189 | 0 \ |
| 2190 | -C "bad certificate (usage extensions)" \ |
| 2191 | -C "Processing of the Certificate handshake message failed" \ |
| 2192 | -c "Ciphersuite is TLS-" |
| 2193 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2194 | run_test "extKeyUsage cli: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2195 | "$O_SRV -key data_files/server5.key \ |
| 2196 | -cert data_files/server5.eku-srv_cli.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2197 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2198 | 0 \ |
| 2199 | -C "bad certificate (usage extensions)" \ |
| 2200 | -C "Processing of the Certificate handshake message failed" \ |
| 2201 | -c "Ciphersuite is TLS-" |
| 2202 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2203 | run_test "extKeyUsage cli: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2204 | "$O_SRV -key data_files/server5.key \ |
| 2205 | -cert data_files/server5.eku-cs_any.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2206 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2207 | 0 \ |
| 2208 | -C "bad certificate (usage extensions)" \ |
| 2209 | -C "Processing of the Certificate handshake message failed" \ |
| 2210 | -c "Ciphersuite is TLS-" |
| 2211 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2212 | run_test "extKeyUsage cli: codeSign -> fail" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2213 | "$O_SRV -key data_files/server5.key \ |
| 2214 | -cert data_files/server5.eku-cs.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2215 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2216 | 1 \ |
| 2217 | -c "bad certificate (usage extensions)" \ |
| 2218 | -c "Processing of the Certificate handshake message failed" \ |
| 2219 | -C "Ciphersuite is TLS-" |
| 2220 | |
| 2221 | # Tests for extendedKeyUsage, part 3: server-side checking of client cert |
| 2222 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2223 | run_test "extKeyUsage cli-auth: clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2224 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2225 | "$O_CLI -key data_files/server5.key \ |
| 2226 | -cert data_files/server5.eku-cli.crt" \ |
| 2227 | 0 \ |
| 2228 | -S "bad certificate (usage extensions)" \ |
| 2229 | -S "Processing of the Certificate handshake message failed" |
| 2230 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2231 | run_test "extKeyUsage cli-auth: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2232 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2233 | "$O_CLI -key data_files/server5.key \ |
| 2234 | -cert data_files/server5.eku-srv_cli.crt" \ |
| 2235 | 0 \ |
| 2236 | -S "bad certificate (usage extensions)" \ |
| 2237 | -S "Processing of the Certificate handshake message failed" |
| 2238 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2239 | run_test "extKeyUsage cli-auth: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2240 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2241 | "$O_CLI -key data_files/server5.key \ |
| 2242 | -cert data_files/server5.eku-cs_any.crt" \ |
| 2243 | 0 \ |
| 2244 | -S "bad certificate (usage extensions)" \ |
| 2245 | -S "Processing of the Certificate handshake message failed" |
| 2246 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2247 | run_test "extKeyUsage cli-auth: codeSign -> fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2248 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2249 | "$O_CLI -key data_files/server5.key \ |
| 2250 | -cert data_files/server5.eku-cs.crt" \ |
| 2251 | 0 \ |
| 2252 | -s "bad certificate (usage extensions)" \ |
| 2253 | -S "Processing of the Certificate handshake message failed" |
| 2254 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2255 | run_test "extKeyUsage cli-auth: codeSign -> fail (hard)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2256 | "$P_SRV debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 2257 | "$O_CLI -key data_files/server5.key \ |
| 2258 | -cert data_files/server5.eku-cs.crt" \ |
| 2259 | 1 \ |
| 2260 | -s "bad certificate (usage extensions)" \ |
| 2261 | -s "Processing of the Certificate handshake message failed" |
| 2262 | |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 2263 | # Tests for DHM parameters loading |
| 2264 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2265 | run_test "DHM parameters: reference" \ |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 2266 | "$P_SRV" \ |
| 2267 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 2268 | debug_level=3" \ |
| 2269 | 0 \ |
| 2270 | -c "value of 'DHM: P ' (2048 bits)" \ |
| 2271 | -c "value of 'DHM: G ' (2048 bits)" |
| 2272 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2273 | run_test "DHM parameters: other parameters" \ |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 2274 | "$P_SRV dhm_file=data_files/dhparams.pem" \ |
| 2275 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 2276 | debug_level=3" \ |
| 2277 | 0 \ |
| 2278 | -c "value of 'DHM: P ' (1024 bits)" \ |
| 2279 | -c "value of 'DHM: G ' (2 bits)" |
| 2280 | |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2281 | # Tests for PSK callback |
| 2282 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2283 | run_test "PSK callback: psk, no callback" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2284 | "$P_SRV psk=abc123 psk_identity=foo" \ |
| 2285 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2286 | psk_identity=foo psk=abc123" \ |
| 2287 | 0 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2288 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 2289 | -S "SSL - Unknown identity received" \ |
| 2290 | -S "SSL - Verification of the message MAC failed" |
| 2291 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2292 | run_test "PSK callback: no psk, no callback" \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 2293 | "$P_SRV" \ |
| 2294 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2295 | psk_identity=foo psk=abc123" \ |
| 2296 | 1 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2297 | -s "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2298 | -S "SSL - Unknown identity received" \ |
| 2299 | -S "SSL - Verification of the message MAC failed" |
| 2300 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2301 | run_test "PSK callback: callback overrides other settings" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2302 | "$P_SRV psk=abc123 psk_identity=foo psk_list=abc,dead,def,beef" \ |
| 2303 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2304 | psk_identity=foo psk=abc123" \ |
| 2305 | 1 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2306 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2307 | -s "SSL - Unknown identity received" \ |
| 2308 | -S "SSL - Verification of the message MAC failed" |
| 2309 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2310 | run_test "PSK callback: first id matches" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2311 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 2312 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2313 | psk_identity=abc psk=dead" \ |
| 2314 | 0 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2315 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2316 | -S "SSL - Unknown identity received" \ |
| 2317 | -S "SSL - Verification of the message MAC failed" |
| 2318 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2319 | run_test "PSK callback: second id matches" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2320 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 2321 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2322 | psk_identity=def psk=beef" \ |
| 2323 | 0 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2324 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2325 | -S "SSL - Unknown identity received" \ |
| 2326 | -S "SSL - Verification of the message MAC failed" |
| 2327 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2328 | run_test "PSK callback: no match" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2329 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 2330 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2331 | psk_identity=ghi psk=beef" \ |
| 2332 | 1 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2333 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2334 | -s "SSL - Unknown identity received" \ |
| 2335 | -S "SSL - Verification of the message MAC failed" |
| 2336 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2337 | run_test "PSK callback: wrong key" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2338 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 2339 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 2340 | psk_identity=abc psk=beef" \ |
| 2341 | 1 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 2342 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 2343 | -S "SSL - Unknown identity received" \ |
| 2344 | -s "SSL - Verification of the message MAC failed" |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 2345 | |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 2346 | # Tests for ciphersuites per version |
| 2347 | |
Janos Follath | 4dfecab | 2016-03-14 13:40:43 +0000 | [diff] [blame] | 2348 | requires_config_enabled POLARSSL_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2349 | run_test "Per-version suites: SSL3" \ |
Manuel Pégourié-Gonnard | 448ea50 | 2015-01-12 11:40:14 +0100 | [diff] [blame] | 2350 | "$P_SRV min_version=ssl3 version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 2351 | "$P_CLI force_version=ssl3" \ |
| 2352 | 0 \ |
| 2353 | -c "Ciphersuite is TLS-RSA-WITH-3DES-EDE-CBC-SHA" |
| 2354 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2355 | run_test "Per-version suites: TLS 1.0" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2356 | "$P_SRV arc4=1 version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 2357 | "$P_CLI force_version=tls1 arc4=1" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 2358 | 0 \ |
| 2359 | -c "Ciphersuite is TLS-RSA-WITH-RC4-128-SHA" |
| 2360 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2361 | run_test "Per-version suites: TLS 1.1" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 2362 | "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 2363 | "$P_CLI force_version=tls1_1" \ |
| 2364 | 0 \ |
| 2365 | -c "Ciphersuite is TLS-RSA-WITH-AES-128-CBC-SHA" |
| 2366 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2367 | run_test "Per-version suites: TLS 1.2" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 2368 | "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 2369 | "$P_CLI force_version=tls1_2" \ |
| 2370 | 0 \ |
| 2371 | -c "Ciphersuite is TLS-RSA-WITH-AES-128-GCM-SHA256" |
| 2372 | |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 2373 | # Tests for ssl_get_bytes_avail() |
| 2374 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2375 | run_test "ssl_get_bytes_avail: no extra data" \ |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 2376 | "$P_SRV" \ |
| 2377 | "$P_CLI request_size=100" \ |
| 2378 | 0 \ |
| 2379 | -s "Read from client: 100 bytes read$" |
| 2380 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 2381 | run_test "ssl_get_bytes_avail: extra data" \ |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 2382 | "$P_SRV" \ |
| 2383 | "$P_CLI request_size=500" \ |
| 2384 | 0 \ |
| 2385 | -s "Read from client: 500 bytes read (.*+.*)" |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 2386 | |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2387 | # Tests for small packets |
| 2388 | |
Janos Follath | 4dfecab | 2016-03-14 13:40:43 +0000 | [diff] [blame] | 2389 | requires_config_enabled POLARSSL_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2390 | run_test "Small packet SSLv3 BlockCipher" \ |
Manuel Pégourié-Gonnard | 448ea50 | 2015-01-12 11:40:14 +0100 | [diff] [blame] | 2391 | "$P_SRV min_version=ssl3" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2392 | "$P_CLI request_size=1 force_version=ssl3 \ |
| 2393 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2394 | 0 \ |
| 2395 | -s "Read from client: 1 bytes read" |
| 2396 | |
Janos Follath | 4dfecab | 2016-03-14 13:40:43 +0000 | [diff] [blame] | 2397 | requires_config_enabled POLARSSL_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2398 | run_test "Small packet SSLv3 StreamCipher" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2399 | "$P_SRV min_version=ssl3 arc4=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2400 | "$P_CLI request_size=1 force_version=ssl3 \ |
| 2401 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 2402 | 0 \ |
| 2403 | -s "Read from client: 1 bytes read" |
| 2404 | |
| 2405 | run_test "Small packet TLS 1.0 BlockCipher" \ |
| 2406 | "$P_SRV" \ |
| 2407 | "$P_CLI request_size=1 force_version=tls1 \ |
| 2408 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2409 | 0 \ |
| 2410 | -s "Read from client: 1 bytes read" |
| 2411 | |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 2412 | run_test "Small packet TLS 1.0 BlockCipher without EtM" \ |
| 2413 | "$P_SRV" \ |
| 2414 | "$P_CLI request_size=1 force_version=tls1 etm=0 \ |
| 2415 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2416 | 0 \ |
| 2417 | -s "Read from client: 1 bytes read" |
| 2418 | |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2419 | run_test "Small packet TLS 1.0 BlockCipher truncated MAC" \ |
| 2420 | "$P_SRV" \ |
| 2421 | "$P_CLI request_size=1 force_version=tls1 \ |
| 2422 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 2423 | trunc_hmac=1" \ |
| 2424 | 0 \ |
| 2425 | -s "Read from client: 1 bytes read" |
| 2426 | |
| 2427 | run_test "Small packet TLS 1.0 StreamCipher truncated MAC" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2428 | "$P_SRV arc4=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2429 | "$P_CLI request_size=1 force_version=tls1 \ |
| 2430 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 2431 | trunc_hmac=1" \ |
| 2432 | 0 \ |
| 2433 | -s "Read from client: 1 bytes read" |
| 2434 | |
| 2435 | run_test "Small packet TLS 1.1 BlockCipher" \ |
| 2436 | "$P_SRV" \ |
| 2437 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 2438 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2439 | 0 \ |
| 2440 | -s "Read from client: 1 bytes read" |
| 2441 | |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 2442 | run_test "Small packet TLS 1.1 BlockCipher without EtM" \ |
| 2443 | "$P_SRV" \ |
| 2444 | "$P_CLI request_size=1 force_version=tls1_1 etm=0 \ |
| 2445 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2446 | 0 \ |
| 2447 | -s "Read from client: 1 bytes read" |
| 2448 | |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2449 | run_test "Small packet TLS 1.1 StreamCipher" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2450 | "$P_SRV arc4=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2451 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 2452 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 2453 | 0 \ |
| 2454 | -s "Read from client: 1 bytes read" |
| 2455 | |
| 2456 | run_test "Small packet TLS 1.1 BlockCipher truncated MAC" \ |
| 2457 | "$P_SRV" \ |
| 2458 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 2459 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 2460 | trunc_hmac=1" \ |
| 2461 | 0 \ |
| 2462 | -s "Read from client: 1 bytes read" |
| 2463 | |
| 2464 | run_test "Small packet TLS 1.1 StreamCipher truncated MAC" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2465 | "$P_SRV arc4=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2466 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 2467 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 2468 | trunc_hmac=1" \ |
| 2469 | 0 \ |
| 2470 | -s "Read from client: 1 bytes read" |
| 2471 | |
| 2472 | run_test "Small packet TLS 1.2 BlockCipher" \ |
| 2473 | "$P_SRV" \ |
| 2474 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 2475 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2476 | 0 \ |
| 2477 | -s "Read from client: 1 bytes read" |
| 2478 | |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 2479 | run_test "Small packet TLS 1.2 BlockCipher without EtM" \ |
| 2480 | "$P_SRV" \ |
| 2481 | "$P_CLI request_size=1 force_version=tls1_2 etm=0 \ |
| 2482 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2483 | 0 \ |
| 2484 | -s "Read from client: 1 bytes read" |
| 2485 | |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2486 | run_test "Small packet TLS 1.2 BlockCipher larger MAC" \ |
| 2487 | "$P_SRV" \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 2488 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 2489 | force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2490 | 0 \ |
| 2491 | -s "Read from client: 1 bytes read" |
| 2492 | |
| 2493 | run_test "Small packet TLS 1.2 BlockCipher truncated MAC" \ |
| 2494 | "$P_SRV" \ |
| 2495 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 2496 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 2497 | trunc_hmac=1" \ |
| 2498 | 0 \ |
| 2499 | -s "Read from client: 1 bytes read" |
| 2500 | |
| 2501 | run_test "Small packet TLS 1.2 StreamCipher" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2502 | "$P_SRV arc4=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2503 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 2504 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 2505 | 0 \ |
| 2506 | -s "Read from client: 1 bytes read" |
| 2507 | |
| 2508 | run_test "Small packet TLS 1.2 StreamCipher truncated MAC" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2509 | "$P_SRV arc4=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 2510 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 2511 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 2512 | trunc_hmac=1" \ |
| 2513 | 0 \ |
| 2514 | -s "Read from client: 1 bytes read" |
| 2515 | |
| 2516 | run_test "Small packet TLS 1.2 AEAD" \ |
| 2517 | "$P_SRV" \ |
| 2518 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 2519 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 2520 | 0 \ |
| 2521 | -s "Read from client: 1 bytes read" |
| 2522 | |
| 2523 | run_test "Small packet TLS 1.2 AEAD shorter tag" \ |
| 2524 | "$P_SRV" \ |
| 2525 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 2526 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 2527 | 0 \ |
| 2528 | -s "Read from client: 1 bytes read" |
| 2529 | |
Janos Follath | 8abaa8b | 2016-05-06 13:48:23 +0100 | [diff] [blame] | 2530 | # A test for extensions in SSLv3 |
| 2531 | |
Hanno Becker | 6fd6d24 | 2017-05-25 17:51:31 +0100 | [diff] [blame] | 2532 | requires_config_enabled POLARSSL_SSL_PROTO_SSL3 |
Janos Follath | 8abaa8b | 2016-05-06 13:48:23 +0100 | [diff] [blame] | 2533 | run_test "SSLv3 with extensions, server side" \ |
| 2534 | "$P_SRV min_version=ssl3 debug_level=3" \ |
| 2535 | "$P_CLI force_version=ssl3 tickets=1 max_frag_len=4096 alpn=abc,1234" \ |
| 2536 | 0 \ |
| 2537 | -S "dumping 'client hello extensions'" \ |
| 2538 | -S "server hello, total extension length:" |
| 2539 | |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2540 | # Test for large packets |
| 2541 | |
Janos Follath | 4dfecab | 2016-03-14 13:40:43 +0000 | [diff] [blame] | 2542 | requires_config_enabled POLARSSL_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2543 | run_test "Large packet SSLv3 BlockCipher" \ |
Manuel Pégourié-Gonnard | 448ea50 | 2015-01-12 11:40:14 +0100 | [diff] [blame] | 2544 | "$P_SRV min_version=ssl3" \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 2545 | "$P_CLI request_size=16384 force_version=ssl3 recsplit=0 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2546 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2547 | 0 \ |
| 2548 | -s "Read from client: 16384 bytes read" |
| 2549 | |
Janos Follath | 4dfecab | 2016-03-14 13:40:43 +0000 | [diff] [blame] | 2550 | requires_config_enabled POLARSSL_SSL_PROTO_SSL3 |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2551 | run_test "Large packet SSLv3 StreamCipher" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2552 | "$P_SRV min_version=ssl3 arc4=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2553 | "$P_CLI request_size=16384 force_version=ssl3 \ |
| 2554 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 2555 | 0 \ |
| 2556 | -s "Read from client: 16384 bytes read" |
| 2557 | |
| 2558 | run_test "Large packet TLS 1.0 BlockCipher" \ |
| 2559 | "$P_SRV" \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 2560 | "$P_CLI request_size=16384 force_version=tls1 recsplit=0 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2561 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2562 | 0 \ |
| 2563 | -s "Read from client: 16384 bytes read" |
| 2564 | |
| 2565 | run_test "Large packet TLS 1.0 BlockCipher truncated MAC" \ |
| 2566 | "$P_SRV" \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 2567 | "$P_CLI request_size=16384 force_version=tls1 recsplit=0 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2568 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 2569 | trunc_hmac=1" \ |
| 2570 | 0 \ |
| 2571 | -s "Read from client: 16384 bytes read" |
| 2572 | |
| 2573 | run_test "Large packet TLS 1.0 StreamCipher truncated MAC" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2574 | "$P_SRV arc4=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2575 | "$P_CLI request_size=16384 force_version=tls1 \ |
| 2576 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 2577 | trunc_hmac=1" \ |
| 2578 | 0 \ |
| 2579 | -s "Read from client: 16384 bytes read" |
| 2580 | |
| 2581 | run_test "Large packet TLS 1.1 BlockCipher" \ |
| 2582 | "$P_SRV" \ |
| 2583 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 2584 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2585 | 0 \ |
| 2586 | -s "Read from client: 16384 bytes read" |
| 2587 | |
| 2588 | run_test "Large packet TLS 1.1 StreamCipher" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2589 | "$P_SRV arc4=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2590 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 2591 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 2592 | 0 \ |
| 2593 | -s "Read from client: 16384 bytes read" |
| 2594 | |
| 2595 | run_test "Large packet TLS 1.1 BlockCipher truncated MAC" \ |
| 2596 | "$P_SRV" \ |
| 2597 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 2598 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 2599 | trunc_hmac=1" \ |
| 2600 | 0 \ |
| 2601 | -s "Read from client: 16384 bytes read" |
| 2602 | |
| 2603 | run_test "Large packet TLS 1.1 StreamCipher truncated MAC" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2604 | "$P_SRV arc4=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2605 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 2606 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 2607 | trunc_hmac=1" \ |
| 2608 | 0 \ |
| 2609 | -s "Read from client: 16384 bytes read" |
| 2610 | |
| 2611 | run_test "Large packet TLS 1.2 BlockCipher" \ |
| 2612 | "$P_SRV" \ |
| 2613 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 2614 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2615 | 0 \ |
| 2616 | -s "Read from client: 16384 bytes read" |
| 2617 | |
| 2618 | run_test "Large packet TLS 1.2 BlockCipher larger MAC" \ |
| 2619 | "$P_SRV" \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 2620 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 2621 | force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2622 | 0 \ |
| 2623 | -s "Read from client: 16384 bytes read" |
| 2624 | |
| 2625 | run_test "Large packet TLS 1.2 BlockCipher truncated MAC" \ |
| 2626 | "$P_SRV" \ |
| 2627 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 2628 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 2629 | trunc_hmac=1" \ |
| 2630 | 0 \ |
| 2631 | -s "Read from client: 16384 bytes read" |
| 2632 | |
| 2633 | run_test "Large packet TLS 1.2 StreamCipher" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2634 | "$P_SRV arc4=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2635 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 2636 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 2637 | 0 \ |
| 2638 | -s "Read from client: 16384 bytes read" |
| 2639 | |
| 2640 | run_test "Large packet TLS 1.2 StreamCipher truncated MAC" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2641 | "$P_SRV arc4=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2642 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 2643 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 2644 | trunc_hmac=1" \ |
| 2645 | 0 \ |
| 2646 | -s "Read from client: 16384 bytes read" |
| 2647 | |
| 2648 | run_test "Large packet TLS 1.2 AEAD" \ |
| 2649 | "$P_SRV" \ |
| 2650 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 2651 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 2652 | 0 \ |
| 2653 | -s "Read from client: 16384 bytes read" |
| 2654 | |
| 2655 | run_test "Large packet TLS 1.2 AEAD shorter tag" \ |
| 2656 | "$P_SRV" \ |
| 2657 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 2658 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 2659 | 0 \ |
| 2660 | -s "Read from client: 16384 bytes read" |
| 2661 | |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 2662 | # Final report |
| 2663 | |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 2664 | echo "------------------------------------------------------------------------" |
| 2665 | |
| 2666 | if [ $FAILS = 0 ]; then |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 2667 | printf "PASSED" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 2668 | else |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 2669 | printf "FAILED" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 2670 | fi |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 2671 | PASSES=$(( $TESTS - $FAILS )) |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 2672 | echo " ($PASSES / $TESTS tests ($SKIPS skipped))" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 2673 | |
| 2674 | exit $FAILS |