Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1 | #!/bin/sh |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 2 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 3 | # compat.sh |
| 4 | # |
Bence Szépkúti | 44bfbe3 | 2020-08-19 16:54:51 +0200 | [diff] [blame] | 5 | # Copyright The Mbed TLS Contributors |
Bence Szépkúti | 4e9f712 | 2020-06-05 13:02:18 +0200 | [diff] [blame] | 6 | # SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later |
| 7 | # |
| 8 | # This file is provided under the Apache License 2.0, or the |
| 9 | # GNU General Public License v2.0 or later. |
| 10 | # |
| 11 | # ********** |
| 12 | # Apache License 2.0: |
Bence Szépkúti | 09b4f19 | 2020-05-26 01:54:15 +0200 | [diff] [blame] | 13 | # |
| 14 | # Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 15 | # not use this file except in compliance with the License. |
| 16 | # You may obtain a copy of the License at |
| 17 | # |
| 18 | # http://www.apache.org/licenses/LICENSE-2.0 |
| 19 | # |
| 20 | # Unless required by applicable law or agreed to in writing, software |
| 21 | # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 22 | # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 23 | # See the License for the specific language governing permissions and |
| 24 | # limitations under the License. |
| 25 | # |
Bence Szépkúti | 4e9f712 | 2020-06-05 13:02:18 +0200 | [diff] [blame] | 26 | # ********** |
| 27 | # |
| 28 | # ********** |
| 29 | # GNU General Public License v2.0 or later: |
| 30 | # |
| 31 | # This program is free software; you can redistribute it and/or modify |
| 32 | # it under the terms of the GNU General Public License as published by |
| 33 | # the Free Software Foundation; either version 2 of the License, or |
| 34 | # (at your option) any later version. |
| 35 | # |
| 36 | # This program is distributed in the hope that it will be useful, |
| 37 | # but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 38 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 39 | # GNU General Public License for more details. |
| 40 | # |
| 41 | # You should have received a copy of the GNU General Public License along |
| 42 | # with this program; if not, write to the Free Software Foundation, Inc., |
| 43 | # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
| 44 | # |
| 45 | # ********** |
| 46 | # |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 47 | # Purpose |
| 48 | # |
| 49 | # Test interoperbility with OpenSSL, GnuTLS as well as itself. |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 50 | # |
| 51 | # Check each common ciphersuite, with each version, both ways (client/server), |
| 52 | # with and without client authentication. |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 53 | |
Manuel Pégourié-Gonnard | 913030c | 2014-03-28 10:12:38 +0100 | [diff] [blame] | 54 | set -u |
| 55 | |
Jaeden Amero | 3473091 | 2019-07-03 13:51:04 +0100 | [diff] [blame] | 56 | # Limit the size of each log to 10 GiB, in case of failures with this script |
| 57 | # where it may output seemingly unlimited length error logs. |
| 58 | ulimit -f 20971520 |
| 59 | |
Manuel Pégourié-Gonnard | a1a9f9a | 2014-03-25 18:04:59 +0100 | [diff] [blame] | 60 | # initialise counters |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 61 | TESTS=0 |
| 62 | FAILED=0 |
| 63 | SKIPPED=0 |
| 64 | SRVMEM=0 |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 65 | |
Antonin Décimo | 8fd9156 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 66 | # default commands, can be overridden by the environment |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 67 | : ${M_SRV:=../programs/ssl/ssl_server2} |
| 68 | : ${M_CLI:=../programs/ssl/ssl_client2} |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 69 | : ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system |
| 70 | : ${GNUTLS_CLI:=gnutls-cli} |
| 71 | : ${GNUTLS_SERV:=gnutls-serv} |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 72 | |
Manuel Pégourié-Gonnard | 1287f11 | 2014-08-31 16:20:58 +0200 | [diff] [blame] | 73 | # do we have a recent enough GnuTLS? |
Manuel Pégourié-Gonnard | 03db6b0 | 2015-06-26 15:45:30 +0200 | [diff] [blame] | 74 | if ( which $GNUTLS_CLI && which $GNUTLS_SERV ) >/dev/null 2>&1; then |
Manuel Pégourié-Gonnard | dd45927 | 2014-10-24 12:57:37 +0200 | [diff] [blame] | 75 | G_VER="$( $GNUTLS_CLI --version | head -n1 )" |
| 76 | if echo "$G_VER" | grep '@VERSION@' > /dev/null; then # git version |
Manuel Pégourié-Gonnard | 1287f11 | 2014-08-31 16:20:58 +0200 | [diff] [blame] | 77 | PEER_GNUTLS=" GnuTLS" |
Manuel Pégourié-Gonnard | dd45927 | 2014-10-24 12:57:37 +0200 | [diff] [blame] | 78 | else |
| 79 | eval $( echo $G_VER | sed 's/.* \([0-9]*\)\.\([0-9]\)*\.\([0-9]*\)$/MAJOR="\1" MINOR="\2" PATCH="\3"/' ) |
| 80 | if [ $MAJOR -lt 3 -o \ |
| 81 | \( $MAJOR -eq 3 -a $MINOR -lt 2 \) -o \ |
| 82 | \( $MAJOR -eq 3 -a $MINOR -eq 2 -a $PATCH -lt 15 \) ] |
| 83 | then |
| 84 | PEER_GNUTLS="" |
| 85 | else |
| 86 | PEER_GNUTLS=" GnuTLS" |
| 87 | fi |
Manuel Pégourié-Gonnard | 1287f11 | 2014-08-31 16:20:58 +0200 | [diff] [blame] | 88 | fi |
| 89 | else |
| 90 | PEER_GNUTLS="" |
| 91 | fi |
| 92 | |
Manuel Pégourié-Gonnard | a1a9f9a | 2014-03-25 18:04:59 +0100 | [diff] [blame] | 93 | # default values for options |
Simon Butcher | 3ea7f52 | 2016-03-07 23:22:10 +0000 | [diff] [blame] | 94 | MODES="tls1 tls1_1 tls1_2 dtls1 dtls1_2" |
Paul Bakker | 1eeceae | 2012-11-23 14:25:34 +0100 | [diff] [blame] | 95 | VERIFIES="NO YES" |
Manuel Pégourié-Gonnard | 7ebaf37 | 2013-08-27 21:03:33 +0200 | [diff] [blame] | 96 | TYPES="ECDSA RSA PSK" |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 97 | FILTER="" |
Andres Amaya Garcia | 0a0e5b1 | 2019-01-08 21:42:27 +0000 | [diff] [blame] | 98 | # exclude: |
| 99 | # - NULL: excluded from our default config |
| 100 | # - RC4, single-DES: requires legacy OpenSSL/GnuTLS versions |
| 101 | # avoid plain DES but keep 3DES-EDE-CBC (mbedTLS), DES-CBC3 (OpenSSL) |
Andres Amaya Garcia | b7c22ec | 2019-02-11 21:47:30 +0000 | [diff] [blame] | 102 | # - 3DES: not in default config |
Andres Amaya Garcia | fea3d0a | 2019-02-19 20:20:57 +0000 | [diff] [blame] | 103 | EXCLUDE='NULL\|DES\|RC4\|ARCFOUR' |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 104 | VERBOSE="" |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 105 | MEMCHECK=0 |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 106 | PEERS="OpenSSL$PEER_GNUTLS mbedTLS" |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 107 | |
Manuel Pégourié-Gonnard | 39e2ca9 | 2015-08-04 16:43:37 +0200 | [diff] [blame] | 108 | # hidden option: skip DTLS with OpenSSL |
| 109 | # (travis CI has a version that doesn't work for us) |
| 110 | : ${OSSL_NO_DTLS:=0} |
| 111 | |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 112 | print_usage() { |
| 113 | echo "Usage: $0" |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 114 | printf " -h|--help\tPrint this help.\n" |
| 115 | printf " -f|--filter\tOnly matching ciphersuites are tested (Default: '$FILTER')\n" |
| 116 | printf " -e|--exclude\tMatching ciphersuites are excluded (Default: '$EXCLUDE')\n" |
| 117 | printf " -m|--modes\tWhich modes to perform (Default: '$MODES')\n" |
| 118 | printf " -t|--types\tWhich key exchange type to perform (Default: '$TYPES')\n" |
| 119 | printf " -V|--verify\tWhich verification modes to perform (Default: '$VERIFIES')\n" |
| 120 | printf " -p|--peers\tWhich peers to use (Default: '$PEERS')\n" |
| 121 | printf " \tAlso available: GnuTLS (needs v3.2.15 or higher)\n" |
| 122 | printf " -M|--memcheck\tCheck memory leaks and errors.\n" |
| 123 | printf " -v|--verbose\tSet verbose output.\n" |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 124 | } |
| 125 | |
| 126 | get_options() { |
| 127 | while [ $# -gt 0 ]; do |
| 128 | case "$1" in |
| 129 | -f|--filter) |
| 130 | shift; FILTER=$1 |
| 131 | ;; |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 132 | -e|--exclude) |
| 133 | shift; EXCLUDE=$1 |
| 134 | ;; |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 135 | -m|--modes) |
| 136 | shift; MODES=$1 |
| 137 | ;; |
| 138 | -t|--types) |
| 139 | shift; TYPES=$1 |
| 140 | ;; |
| 141 | -V|--verify) |
| 142 | shift; VERIFIES=$1 |
| 143 | ;; |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 144 | -p|--peers) |
| 145 | shift; PEERS=$1 |
| 146 | ;; |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 147 | -v|--verbose) |
| 148 | VERBOSE=1 |
| 149 | ;; |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 150 | -M|--memcheck) |
| 151 | MEMCHECK=1 |
| 152 | ;; |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 153 | -h|--help) |
| 154 | print_usage |
| 155 | exit 0 |
| 156 | ;; |
| 157 | *) |
| 158 | echo "Unknown argument: '$1'" |
| 159 | print_usage |
| 160 | exit 1 |
| 161 | ;; |
| 162 | esac |
| 163 | shift |
| 164 | done |
Manuel Pégourié-Gonnard | 85a4178 | 2014-10-24 12:47:26 +0200 | [diff] [blame] | 165 | |
| 166 | # sanitize some options (modes checked later) |
| 167 | VERIFIES="$( echo $VERIFIES | tr [a-z] [A-Z] )" |
| 168 | TYPES="$( echo $TYPES | tr [a-z] [A-Z] )" |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 169 | } |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 170 | |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 171 | log() { |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 172 | if [ "X" != "X$VERBOSE" ]; then |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 173 | echo "" |
Paul Bakker | accd4eb | 2013-07-19 13:41:51 +0200 | [diff] [blame] | 174 | echo "$@" |
| 175 | fi |
| 176 | } |
Paul Bakker | 10cd225 | 2012-04-12 21:26:34 +0000 | [diff] [blame] | 177 | |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 178 | # is_dtls <mode> |
| 179 | is_dtls() |
| 180 | { |
| 181 | test "$1" = "dtls1" -o "$1" = "dtls1_2" |
| 182 | } |
| 183 | |
| 184 | # minor_ver <mode> |
| 185 | minor_ver() |
| 186 | { |
| 187 | case "$1" in |
| 188 | ssl3) |
| 189 | echo 0 |
| 190 | ;; |
| 191 | tls1) |
| 192 | echo 1 |
| 193 | ;; |
| 194 | tls1_1|dtls1) |
| 195 | echo 2 |
| 196 | ;; |
| 197 | tls1_2|dtls1_2) |
| 198 | echo 3 |
| 199 | ;; |
| 200 | *) |
| 201 | echo "error: invalid mode: $MODE" >&2 |
| 202 | # exiting is no good here, typically called in a subshell |
| 203 | echo -1 |
| 204 | esac |
| 205 | } |
| 206 | |
Manuel Pégourié-Gonnard | dfc8d5a | 2013-08-27 20:48:40 +0200 | [diff] [blame] | 207 | filter() |
| 208 | { |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 209 | LIST="$1" |
Manuel Pégourié-Gonnard | dfc8d5a | 2013-08-27 20:48:40 +0200 | [diff] [blame] | 210 | NEW_LIST="" |
| 211 | |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 212 | if is_dtls "$MODE"; then |
Manuel Pégourié-Gonnard | 29980b1 | 2014-07-10 20:12:56 +0200 | [diff] [blame] | 213 | EXCLMODE="$EXCLUDE"'\|RC4\|ARCFOUR' |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 214 | else |
| 215 | EXCLMODE="$EXCLUDE" |
| 216 | fi |
| 217 | |
Manuel Pégourié-Gonnard | dfc8d5a | 2013-08-27 20:48:40 +0200 | [diff] [blame] | 218 | for i in $LIST; |
| 219 | do |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 220 | NEW_LIST="$NEW_LIST $( echo "$i" | grep "$FILTER" | grep -v "$EXCLMODE" )" |
Manuel Pégourié-Gonnard | dfc8d5a | 2013-08-27 20:48:40 +0200 | [diff] [blame] | 221 | done |
| 222 | |
Manuel Pégourié-Gonnard | 911622d | 2014-02-27 11:50:40 +0100 | [diff] [blame] | 223 | # normalize whitespace |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 224 | echo "$NEW_LIST" | sed -e 's/[[:space:]][[:space:]]*/ /g' -e 's/^ //' -e 's/ $//' |
Manuel Pégourié-Gonnard | dfc8d5a | 2013-08-27 20:48:40 +0200 | [diff] [blame] | 225 | } |
| 226 | |
Manuel Pégourié-Gonnard | 53aef81 | 2014-07-11 17:41:24 +0200 | [diff] [blame] | 227 | # OpenSSL 1.0.1h with -Verify wants a ClientCertificate message even for |
| 228 | # PSK ciphersuites with DTLS, which is incorrect, so disable them for now |
| 229 | check_openssl_server_bug() |
| 230 | { |
| 231 | if test "X$VERIFY" = "XYES" && is_dtls "$MODE" && \ |
| 232 | echo "$1" | grep "^TLS-PSK" >/dev/null; |
| 233 | then |
| 234 | SKIP_NEXT="YES" |
| 235 | fi |
| 236 | } |
| 237 | |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 238 | filter_ciphersuites() |
| 239 | { |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 240 | if [ "X" != "X$FILTER" -o "X" != "X$EXCLUDE" ]; |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 241 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 242 | # Ciphersuite for mbed TLS |
| 243 | M_CIPHERS=$( filter "$M_CIPHERS" ) |
| 244 | |
| 245 | # Ciphersuite for OpenSSL |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 246 | O_CIPHERS=$( filter "$O_CIPHERS" ) |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 247 | |
| 248 | # Ciphersuite for GnuTLS |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 249 | G_CIPHERS=$( filter "$G_CIPHERS" ) |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 250 | fi |
Manuel Pégourié-Gonnard | 29980b1 | 2014-07-10 20:12:56 +0200 | [diff] [blame] | 251 | |
Gilles Peskine | 6ad89c2 | 2019-08-10 17:38:34 +0200 | [diff] [blame] | 252 | # OpenSSL <1.0.2 doesn't support DTLS 1.2. Check what OpenSSL |
| 253 | # supports from the s_server help. (The s_client help isn't |
| 254 | # accurate as of 1.0.2g: it supports DTLS 1.2 but doesn't list it. |
| 255 | # But the s_server help seems to be accurate.) |
| 256 | if ! $OPENSSL_CMD s_server -help 2>&1 | grep -q "^ *-$MODE "; then |
| 257 | M_CIPHERS="" |
Manuel Pégourié-Gonnard | 29980b1 | 2014-07-10 20:12:56 +0200 | [diff] [blame] | 258 | O_CIPHERS="" |
| 259 | fi |
| 260 | |
Manuel Pégourié-Gonnard | dba564b | 2015-01-23 11:33:38 +0000 | [diff] [blame] | 261 | # For GnuTLS client -> mbed TLS server, |
Manuel Pégourié-Gonnard | d1af102 | 2014-07-11 17:01:06 +0200 | [diff] [blame] | 262 | # we need to force IPv4 by connecting to 127.0.0.1 but then auth fails |
Manuel Pégourié-Gonnard | 29980b1 | 2014-07-10 20:12:56 +0200 | [diff] [blame] | 263 | if [ "X$VERIFY" = "XYES" ] && is_dtls "$MODE"; then |
| 264 | G_CIPHERS="" |
| 265 | fi |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 266 | } |
| 267 | |
| 268 | reset_ciphersuites() |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 269 | { |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 270 | M_CIPHERS="" |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 271 | O_CIPHERS="" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 272 | G_CIPHERS="" |
| 273 | } |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 274 | |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 275 | add_common_ciphersuites() |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 276 | { |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 277 | case $TYPE in |
| 278 | |
| 279 | "ECDSA") |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 280 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 281 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 282 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 283 | TLS-ECDHE-ECDSA-WITH-NULL-SHA \ |
| 284 | TLS-ECDHE-ECDSA-WITH-RC4-128-SHA \ |
| 285 | TLS-ECDHE-ECDSA-WITH-3DES-EDE-CBC-SHA \ |
| 286 | TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA \ |
| 287 | TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 288 | " |
| 289 | G_CIPHERS="$G_CIPHERS \ |
| 290 | +ECDHE-ECDSA:+NULL:+SHA1 \ |
| 291 | +ECDHE-ECDSA:+ARCFOUR-128:+SHA1 \ |
| 292 | +ECDHE-ECDSA:+3DES-CBC:+SHA1 \ |
| 293 | +ECDHE-ECDSA:+AES-128-CBC:+SHA1 \ |
| 294 | +ECDHE-ECDSA:+AES-256-CBC:+SHA1 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 295 | " |
| 296 | O_CIPHERS="$O_CIPHERS \ |
| 297 | ECDHE-ECDSA-NULL-SHA \ |
| 298 | ECDHE-ECDSA-RC4-SHA \ |
| 299 | ECDHE-ECDSA-DES-CBC3-SHA \ |
| 300 | ECDHE-ECDSA-AES128-SHA \ |
| 301 | ECDHE-ECDSA-AES256-SHA \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 302 | " |
| 303 | fi |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 304 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 305 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 306 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 307 | TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 \ |
| 308 | TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384 \ |
| 309 | TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 310 | TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 311 | " |
| 312 | G_CIPHERS="$G_CIPHERS \ |
| 313 | +ECDHE-ECDSA:+AES-128-CBC:+SHA256 \ |
| 314 | +ECDHE-ECDSA:+AES-256-CBC:+SHA384 \ |
| 315 | +ECDHE-ECDSA:+AES-128-GCM:+AEAD \ |
| 316 | +ECDHE-ECDSA:+AES-256-GCM:+AEAD \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 317 | " |
| 318 | O_CIPHERS="$O_CIPHERS \ |
| 319 | ECDHE-ECDSA-AES128-SHA256 \ |
| 320 | ECDHE-ECDSA-AES256-SHA384 \ |
| 321 | ECDHE-ECDSA-AES128-GCM-SHA256 \ |
| 322 | ECDHE-ECDSA-AES256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 323 | " |
| 324 | fi |
| 325 | ;; |
| 326 | |
| 327 | "RSA") |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 328 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 329 | TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 330 | TLS-DHE-RSA-WITH-AES-256-CBC-SHA \ |
| 331 | TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA \ |
| 332 | TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA \ |
| 333 | TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA \ |
| 334 | TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 335 | TLS-RSA-WITH-CAMELLIA-256-CBC-SHA \ |
| 336 | TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 337 | TLS-RSA-WITH-CAMELLIA-128-CBC-SHA \ |
| 338 | TLS-RSA-WITH-3DES-EDE-CBC-SHA \ |
| 339 | TLS-RSA-WITH-RC4-128-SHA \ |
| 340 | TLS-RSA-WITH-RC4-128-MD5 \ |
| 341 | TLS-RSA-WITH-NULL-MD5 \ |
| 342 | TLS-RSA-WITH-NULL-SHA \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 343 | " |
| 344 | G_CIPHERS="$G_CIPHERS \ |
| 345 | +DHE-RSA:+AES-128-CBC:+SHA1 \ |
| 346 | +DHE-RSA:+AES-256-CBC:+SHA1 \ |
| 347 | +DHE-RSA:+CAMELLIA-128-CBC:+SHA1 \ |
| 348 | +DHE-RSA:+CAMELLIA-256-CBC:+SHA1 \ |
| 349 | +DHE-RSA:+3DES-CBC:+SHA1 \ |
| 350 | +RSA:+AES-256-CBC:+SHA1 \ |
| 351 | +RSA:+CAMELLIA-256-CBC:+SHA1 \ |
| 352 | +RSA:+AES-128-CBC:+SHA1 \ |
| 353 | +RSA:+CAMELLIA-128-CBC:+SHA1 \ |
| 354 | +RSA:+3DES-CBC:+SHA1 \ |
| 355 | +RSA:+ARCFOUR-128:+SHA1 \ |
| 356 | +RSA:+ARCFOUR-128:+MD5 \ |
| 357 | +RSA:+NULL:+MD5 \ |
| 358 | +RSA:+NULL:+SHA1 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 359 | " |
| 360 | O_CIPHERS="$O_CIPHERS \ |
| 361 | DHE-RSA-AES128-SHA \ |
| 362 | DHE-RSA-AES256-SHA \ |
| 363 | DHE-RSA-CAMELLIA128-SHA \ |
| 364 | DHE-RSA-CAMELLIA256-SHA \ |
| 365 | EDH-RSA-DES-CBC3-SHA \ |
| 366 | AES256-SHA \ |
| 367 | CAMELLIA256-SHA \ |
| 368 | AES128-SHA \ |
| 369 | CAMELLIA128-SHA \ |
| 370 | DES-CBC3-SHA \ |
| 371 | RC4-SHA \ |
| 372 | RC4-MD5 \ |
| 373 | NULL-MD5 \ |
| 374 | NULL-SHA \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 375 | " |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 376 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 377 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 378 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 379 | TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA \ |
| 380 | TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA \ |
| 381 | TLS-ECDHE-RSA-WITH-3DES-EDE-CBC-SHA \ |
| 382 | TLS-ECDHE-RSA-WITH-RC4-128-SHA \ |
| 383 | TLS-ECDHE-RSA-WITH-NULL-SHA \ |
| 384 | " |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 385 | G_CIPHERS="$G_CIPHERS \ |
| 386 | +ECDHE-RSA:+AES-128-CBC:+SHA1 \ |
| 387 | +ECDHE-RSA:+AES-256-CBC:+SHA1 \ |
| 388 | +ECDHE-RSA:+3DES-CBC:+SHA1 \ |
| 389 | +ECDHE-RSA:+ARCFOUR-128:+SHA1 \ |
| 390 | +ECDHE-RSA:+NULL:+SHA1 \ |
| 391 | " |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 392 | O_CIPHERS="$O_CIPHERS \ |
| 393 | ECDHE-RSA-AES256-SHA \ |
| 394 | ECDHE-RSA-AES128-SHA \ |
| 395 | ECDHE-RSA-DES-CBC3-SHA \ |
| 396 | ECDHE-RSA-RC4-SHA \ |
| 397 | ECDHE-RSA-NULL-SHA \ |
| 398 | " |
| 399 | fi |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 400 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 401 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 402 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 403 | TLS-RSA-WITH-AES-128-CBC-SHA256 \ |
| 404 | TLS-DHE-RSA-WITH-AES-128-CBC-SHA256 \ |
| 405 | TLS-RSA-WITH-AES-256-CBC-SHA256 \ |
| 406 | TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 \ |
| 407 | TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256 \ |
| 408 | TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384 \ |
| 409 | TLS-RSA-WITH-AES-128-GCM-SHA256 \ |
| 410 | TLS-RSA-WITH-AES-256-GCM-SHA384 \ |
| 411 | TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 \ |
| 412 | TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 \ |
| 413 | TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256 \ |
| 414 | TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 \ |
| 415 | " |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 416 | G_CIPHERS="$G_CIPHERS \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 417 | +RSA:+AES-128-CBC:+SHA256 \ |
| 418 | +DHE-RSA:+AES-128-CBC:+SHA256 \ |
| 419 | +RSA:+AES-256-CBC:+SHA256 \ |
| 420 | +DHE-RSA:+AES-256-CBC:+SHA256 \ |
| 421 | +ECDHE-RSA:+AES-128-CBC:+SHA256 \ |
| 422 | +ECDHE-RSA:+AES-256-CBC:+SHA384 \ |
| 423 | +RSA:+AES-128-GCM:+AEAD \ |
| 424 | +RSA:+AES-256-GCM:+AEAD \ |
| 425 | +DHE-RSA:+AES-128-GCM:+AEAD \ |
| 426 | +DHE-RSA:+AES-256-GCM:+AEAD \ |
| 427 | +ECDHE-RSA:+AES-128-GCM:+AEAD \ |
| 428 | +ECDHE-RSA:+AES-256-GCM:+AEAD \ |
| 429 | " |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 430 | O_CIPHERS="$O_CIPHERS \ |
| 431 | NULL-SHA256 \ |
| 432 | AES128-SHA256 \ |
| 433 | DHE-RSA-AES128-SHA256 \ |
| 434 | AES256-SHA256 \ |
| 435 | DHE-RSA-AES256-SHA256 \ |
| 436 | ECDHE-RSA-AES128-SHA256 \ |
| 437 | ECDHE-RSA-AES256-SHA384 \ |
| 438 | AES128-GCM-SHA256 \ |
| 439 | DHE-RSA-AES128-GCM-SHA256 \ |
| 440 | AES256-GCM-SHA384 \ |
| 441 | DHE-RSA-AES256-GCM-SHA384 \ |
| 442 | ECDHE-RSA-AES128-GCM-SHA256 \ |
| 443 | ECDHE-RSA-AES256-GCM-SHA384 \ |
| 444 | " |
| 445 | fi |
| 446 | ;; |
| 447 | |
| 448 | "PSK") |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 449 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 450 | TLS-PSK-WITH-RC4-128-SHA \ |
| 451 | TLS-PSK-WITH-3DES-EDE-CBC-SHA \ |
| 452 | TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 453 | TLS-PSK-WITH-AES-256-CBC-SHA \ |
| 454 | " |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 455 | G_CIPHERS="$G_CIPHERS \ |
| 456 | +PSK:+ARCFOUR-128:+SHA1 \ |
| 457 | +PSK:+3DES-CBC:+SHA1 \ |
| 458 | +PSK:+AES-128-CBC:+SHA1 \ |
| 459 | +PSK:+AES-256-CBC:+SHA1 \ |
| 460 | " |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 461 | O_CIPHERS="$O_CIPHERS \ |
| 462 | PSK-RC4-SHA \ |
| 463 | PSK-3DES-EDE-CBC-SHA \ |
| 464 | PSK-AES128-CBC-SHA \ |
| 465 | PSK-AES256-CBC-SHA \ |
| 466 | " |
| 467 | ;; |
| 468 | esac |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 469 | } |
| 470 | |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 471 | add_openssl_ciphersuites() |
| 472 | { |
| 473 | case $TYPE in |
| 474 | |
| 475 | "ECDSA") |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 476 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 477 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 478 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 479 | TLS-ECDH-ECDSA-WITH-NULL-SHA \ |
| 480 | TLS-ECDH-ECDSA-WITH-RC4-128-SHA \ |
| 481 | TLS-ECDH-ECDSA-WITH-3DES-EDE-CBC-SHA \ |
| 482 | TLS-ECDH-ECDSA-WITH-AES-128-CBC-SHA \ |
| 483 | TLS-ECDH-ECDSA-WITH-AES-256-CBC-SHA \ |
| 484 | " |
| 485 | O_CIPHERS="$O_CIPHERS \ |
| 486 | ECDH-ECDSA-NULL-SHA \ |
| 487 | ECDH-ECDSA-RC4-SHA \ |
| 488 | ECDH-ECDSA-DES-CBC3-SHA \ |
| 489 | ECDH-ECDSA-AES128-SHA \ |
| 490 | ECDH-ECDSA-AES256-SHA \ |
| 491 | " |
| 492 | fi |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 493 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 494 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 495 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 496 | TLS-ECDH-ECDSA-WITH-AES-128-CBC-SHA256 \ |
| 497 | TLS-ECDH-ECDSA-WITH-AES-256-CBC-SHA384 \ |
| 498 | TLS-ECDH-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 499 | TLS-ECDH-ECDSA-WITH-AES-256-GCM-SHA384 \ |
| 500 | " |
| 501 | O_CIPHERS="$O_CIPHERS \ |
| 502 | ECDH-ECDSA-AES128-SHA256 \ |
| 503 | ECDH-ECDSA-AES256-SHA384 \ |
| 504 | ECDH-ECDSA-AES128-GCM-SHA256 \ |
| 505 | ECDH-ECDSA-AES256-GCM-SHA384 \ |
| 506 | " |
| 507 | fi |
| 508 | ;; |
| 509 | |
| 510 | "RSA") |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 511 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 512 | TLS-RSA-WITH-DES-CBC-SHA \ |
| 513 | TLS-DHE-RSA-WITH-DES-CBC-SHA \ |
| 514 | " |
| 515 | O_CIPHERS="$O_CIPHERS \ |
| 516 | DES-CBC-SHA \ |
| 517 | EDH-RSA-DES-CBC-SHA \ |
| 518 | " |
| 519 | ;; |
| 520 | |
| 521 | "PSK") |
| 522 | ;; |
| 523 | esac |
| 524 | } |
| 525 | |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 526 | add_gnutls_ciphersuites() |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 527 | { |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 528 | case $TYPE in |
| 529 | |
| 530 | "ECDSA") |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 531 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 532 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 533 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 534 | TLS-ECDHE-ECDSA-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 535 | TLS-ECDHE-ECDSA-WITH-CAMELLIA-256-CBC-SHA384 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 536 | TLS-ECDHE-ECDSA-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 537 | TLS-ECDHE-ECDSA-WITH-CAMELLIA-256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 538 | " |
| 539 | G_CIPHERS="$G_CIPHERS \ |
| 540 | +ECDHE-ECDSA:+CAMELLIA-128-CBC:+SHA256 \ |
| 541 | +ECDHE-ECDSA:+CAMELLIA-256-CBC:+SHA384 \ |
| 542 | +ECDHE-ECDSA:+CAMELLIA-128-GCM:+AEAD \ |
| 543 | +ECDHE-ECDSA:+CAMELLIA-256-GCM:+AEAD \ |
| 544 | " |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 545 | fi |
| 546 | ;; |
| 547 | |
| 548 | "RSA") |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 549 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 7457cb3 | 2014-07-13 13:57:24 +0200 | [diff] [blame] | 550 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 551 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 7457cb3 | 2014-07-13 13:57:24 +0200 | [diff] [blame] | 552 | TLS-RSA-WITH-NULL-SHA256 \ |
| 553 | " |
| 554 | G_CIPHERS="$G_CIPHERS \ |
| 555 | +RSA:+NULL:+SHA256 \ |
| 556 | " |
| 557 | fi |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 558 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 559 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 560 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 561 | TLS-ECDHE-RSA-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 562 | TLS-ECDHE-RSA-WITH-CAMELLIA-256-CBC-SHA384 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 563 | TLS-RSA-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 564 | TLS-RSA-WITH-CAMELLIA-256-CBC-SHA256 \ |
| 565 | TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 566 | TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA256 \ |
| 567 | TLS-ECDHE-RSA-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 568 | TLS-ECDHE-RSA-WITH-CAMELLIA-256-GCM-SHA384 \ |
| 569 | TLS-DHE-RSA-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 570 | TLS-DHE-RSA-WITH-CAMELLIA-256-GCM-SHA384 \ |
| 571 | TLS-RSA-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 572 | TLS-RSA-WITH-CAMELLIA-256-GCM-SHA384 \ |
| 573 | " |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 574 | G_CIPHERS="$G_CIPHERS \ |
| 575 | +ECDHE-RSA:+CAMELLIA-128-CBC:+SHA256 \ |
| 576 | +ECDHE-RSA:+CAMELLIA-256-CBC:+SHA384 \ |
| 577 | +RSA:+CAMELLIA-128-CBC:+SHA256 \ |
| 578 | +RSA:+CAMELLIA-256-CBC:+SHA256 \ |
| 579 | +DHE-RSA:+CAMELLIA-128-CBC:+SHA256 \ |
| 580 | +DHE-RSA:+CAMELLIA-256-CBC:+SHA256 \ |
| 581 | +ECDHE-RSA:+CAMELLIA-128-GCM:+AEAD \ |
| 582 | +ECDHE-RSA:+CAMELLIA-256-GCM:+AEAD \ |
| 583 | +DHE-RSA:+CAMELLIA-128-GCM:+AEAD \ |
| 584 | +DHE-RSA:+CAMELLIA-256-GCM:+AEAD \ |
| 585 | +RSA:+CAMELLIA-128-GCM:+AEAD \ |
| 586 | +RSA:+CAMELLIA-256-GCM:+AEAD \ |
| 587 | " |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 588 | fi |
| 589 | ;; |
| 590 | |
| 591 | "PSK") |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 592 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | e46aa5e | 2014-07-13 15:44:19 +0200 | [diff] [blame] | 593 | TLS-DHE-PSK-WITH-3DES-EDE-CBC-SHA \ |
| 594 | TLS-DHE-PSK-WITH-AES-128-CBC-SHA \ |
| 595 | TLS-DHE-PSK-WITH-AES-256-CBC-SHA \ |
| 596 | TLS-DHE-PSK-WITH-RC4-128-SHA \ |
| 597 | " |
| 598 | G_CIPHERS="$G_CIPHERS \ |
| 599 | +DHE-PSK:+3DES-CBC:+SHA1 \ |
| 600 | +DHE-PSK:+AES-128-CBC:+SHA1 \ |
| 601 | +DHE-PSK:+AES-256-CBC:+SHA1 \ |
| 602 | +DHE-PSK:+ARCFOUR-128:+SHA1 \ |
| 603 | " |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 604 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 605 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 606 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 607 | TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA \ |
| 608 | TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA \ |
| 609 | TLS-ECDHE-PSK-WITH-3DES-EDE-CBC-SHA \ |
Manuel Pégourié-Gonnard | e46aa5e | 2014-07-13 15:44:19 +0200 | [diff] [blame] | 610 | TLS-ECDHE-PSK-WITH-RC4-128-SHA \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 611 | TLS-RSA-PSK-WITH-3DES-EDE-CBC-SHA \ |
| 612 | TLS-RSA-PSK-WITH-AES-256-CBC-SHA \ |
| 613 | TLS-RSA-PSK-WITH-AES-128-CBC-SHA \ |
Manuel Pégourié-Gonnard | e46aa5e | 2014-07-13 15:44:19 +0200 | [diff] [blame] | 614 | TLS-RSA-PSK-WITH-RC4-128-SHA \ |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 615 | " |
| 616 | G_CIPHERS="$G_CIPHERS \ |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 617 | +ECDHE-PSK:+3DES-CBC:+SHA1 \ |
Manuel Pégourié-Gonnard | e46aa5e | 2014-07-13 15:44:19 +0200 | [diff] [blame] | 618 | +ECDHE-PSK:+AES-128-CBC:+SHA1 \ |
| 619 | +ECDHE-PSK:+AES-256-CBC:+SHA1 \ |
| 620 | +ECDHE-PSK:+ARCFOUR-128:+SHA1 \ |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 621 | +RSA-PSK:+3DES-CBC:+SHA1 \ |
| 622 | +RSA-PSK:+AES-256-CBC:+SHA1 \ |
| 623 | +RSA-PSK:+AES-128-CBC:+SHA1 \ |
Manuel Pégourié-Gonnard | e46aa5e | 2014-07-13 15:44:19 +0200 | [diff] [blame] | 624 | +RSA-PSK:+ARCFOUR-128:+SHA1 \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 625 | " |
| 626 | fi |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 627 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 628 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 629 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 630 | TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 631 | TLS-ECDHE-PSK-WITH-CAMELLIA-256-CBC-SHA384 \ |
| 632 | TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 \ |
| 633 | TLS-ECDHE-PSK-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 634 | TLS-ECDHE-PSK-WITH-NULL-SHA384 \ |
| 635 | TLS-ECDHE-PSK-WITH-NULL-SHA256 \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 636 | TLS-PSK-WITH-AES-128-CBC-SHA256 \ |
| 637 | TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
| 638 | TLS-DHE-PSK-WITH-AES-128-CBC-SHA256 \ |
| 639 | TLS-DHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 640 | TLS-PSK-WITH-NULL-SHA256 \ |
| 641 | TLS-PSK-WITH-NULL-SHA384 \ |
| 642 | TLS-DHE-PSK-WITH-NULL-SHA256 \ |
| 643 | TLS-DHE-PSK-WITH-NULL-SHA384 \ |
| 644 | TLS-RSA-PSK-WITH-AES-256-CBC-SHA384 \ |
| 645 | TLS-RSA-PSK-WITH-AES-128-CBC-SHA256 \ |
| 646 | TLS-RSA-PSK-WITH-NULL-SHA256 \ |
| 647 | TLS-RSA-PSK-WITH-NULL-SHA384 \ |
| 648 | TLS-DHE-PSK-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 649 | TLS-DHE-PSK-WITH-CAMELLIA-256-CBC-SHA384 \ |
| 650 | TLS-PSK-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 651 | TLS-PSK-WITH-CAMELLIA-256-CBC-SHA384 \ |
| 652 | TLS-RSA-PSK-WITH-CAMELLIA-256-CBC-SHA384 \ |
| 653 | TLS-RSA-PSK-WITH-CAMELLIA-128-CBC-SHA256 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 654 | TLS-PSK-WITH-AES-128-GCM-SHA256 \ |
| 655 | TLS-PSK-WITH-AES-256-GCM-SHA384 \ |
| 656 | TLS-DHE-PSK-WITH-AES-128-GCM-SHA256 \ |
| 657 | TLS-DHE-PSK-WITH-AES-256-GCM-SHA384 \ |
| 658 | TLS-RSA-PSK-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 659 | TLS-RSA-PSK-WITH-CAMELLIA-256-GCM-SHA384 \ |
| 660 | TLS-PSK-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 661 | TLS-PSK-WITH-CAMELLIA-256-GCM-SHA384 \ |
| 662 | TLS-DHE-PSK-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 663 | TLS-DHE-PSK-WITH-CAMELLIA-256-GCM-SHA384 \ |
| 664 | TLS-RSA-PSK-WITH-AES-256-GCM-SHA384 \ |
| 665 | TLS-RSA-PSK-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 666 | " |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 667 | G_CIPHERS="$G_CIPHERS \ |
| 668 | +ECDHE-PSK:+AES-256-CBC:+SHA384 \ |
| 669 | +ECDHE-PSK:+CAMELLIA-256-CBC:+SHA384 \ |
| 670 | +ECDHE-PSK:+AES-128-CBC:+SHA256 \ |
| 671 | +ECDHE-PSK:+CAMELLIA-128-CBC:+SHA256 \ |
| 672 | +PSK:+AES-128-CBC:+SHA256 \ |
| 673 | +PSK:+AES-256-CBC:+SHA384 \ |
| 674 | +DHE-PSK:+AES-128-CBC:+SHA256 \ |
| 675 | +DHE-PSK:+AES-256-CBC:+SHA384 \ |
| 676 | +RSA-PSK:+AES-256-CBC:+SHA384 \ |
| 677 | +RSA-PSK:+AES-128-CBC:+SHA256 \ |
| 678 | +DHE-PSK:+CAMELLIA-128-CBC:+SHA256 \ |
| 679 | +DHE-PSK:+CAMELLIA-256-CBC:+SHA384 \ |
| 680 | +PSK:+CAMELLIA-128-CBC:+SHA256 \ |
| 681 | +PSK:+CAMELLIA-256-CBC:+SHA384 \ |
| 682 | +RSA-PSK:+CAMELLIA-256-CBC:+SHA384 \ |
| 683 | +RSA-PSK:+CAMELLIA-128-CBC:+SHA256 \ |
| 684 | +PSK:+AES-128-GCM:+AEAD \ |
| 685 | +PSK:+AES-256-GCM:+AEAD \ |
| 686 | +DHE-PSK:+AES-128-GCM:+AEAD \ |
| 687 | +DHE-PSK:+AES-256-GCM:+AEAD \ |
| 688 | +RSA-PSK:+CAMELLIA-128-GCM:+AEAD \ |
| 689 | +RSA-PSK:+CAMELLIA-256-GCM:+AEAD \ |
| 690 | +PSK:+CAMELLIA-128-GCM:+AEAD \ |
| 691 | +PSK:+CAMELLIA-256-GCM:+AEAD \ |
| 692 | +DHE-PSK:+CAMELLIA-128-GCM:+AEAD \ |
| 693 | +DHE-PSK:+CAMELLIA-256-GCM:+AEAD \ |
| 694 | +RSA-PSK:+AES-256-GCM:+AEAD \ |
| 695 | +RSA-PSK:+AES-128-GCM:+AEAD \ |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 696 | +ECDHE-PSK:+NULL:+SHA384 \ |
| 697 | +ECDHE-PSK:+NULL:+SHA256 \ |
| 698 | +PSK:+NULL:+SHA256 \ |
| 699 | +PSK:+NULL:+SHA384 \ |
| 700 | +DHE-PSK:+NULL:+SHA256 \ |
| 701 | +DHE-PSK:+NULL:+SHA384 \ |
| 702 | +RSA-PSK:+NULL:+SHA256 \ |
| 703 | +RSA-PSK:+NULL:+SHA384 \ |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 704 | " |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 705 | fi |
| 706 | ;; |
| 707 | esac |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 708 | } |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 709 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 710 | add_mbedtls_ciphersuites() |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 711 | { |
| 712 | case $TYPE in |
| 713 | |
| 714 | "ECDSA") |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 715 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 716 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 717 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 718 | TLS-ECDH-ECDSA-WITH-CAMELLIA-128-CBC-SHA256 \ |
| 719 | TLS-ECDH-ECDSA-WITH-CAMELLIA-256-CBC-SHA384 \ |
| 720 | " |
| 721 | fi |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 722 | if [ `minor_ver "$MODE"` -ge 3 ] |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 723 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 724 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 725 | TLS-ECDH-ECDSA-WITH-CAMELLIA-128-GCM-SHA256 \ |
| 726 | TLS-ECDH-ECDSA-WITH-CAMELLIA-256-GCM-SHA384 \ |
Manuel Pégourié-Gonnard | 2594859 | 2014-05-22 14:36:02 +0200 | [diff] [blame] | 727 | TLS-ECDHE-ECDSA-WITH-AES-128-CCM \ |
| 728 | TLS-ECDHE-ECDSA-WITH-AES-256-CCM \ |
| 729 | TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8 \ |
| 730 | TLS-ECDHE-ECDSA-WITH-AES-256-CCM-8 \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 731 | " |
| 732 | fi |
| 733 | ;; |
| 734 | |
| 735 | "RSA") |
Manuel Pégourié-Gonnard | 2594859 | 2014-05-22 14:36:02 +0200 | [diff] [blame] | 736 | if [ "$MODE" = "tls1_2" ]; |
| 737 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 738 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 2594859 | 2014-05-22 14:36:02 +0200 | [diff] [blame] | 739 | TLS-RSA-WITH-AES-128-CCM \ |
| 740 | TLS-RSA-WITH-AES-256-CCM \ |
| 741 | TLS-DHE-RSA-WITH-AES-128-CCM \ |
| 742 | TLS-DHE-RSA-WITH-AES-256-CCM \ |
| 743 | TLS-RSA-WITH-AES-128-CCM-8 \ |
| 744 | TLS-RSA-WITH-AES-256-CCM-8 \ |
| 745 | TLS-DHE-RSA-WITH-AES-128-CCM-8 \ |
| 746 | TLS-DHE-RSA-WITH-AES-256-CCM-8 \ |
| 747 | " |
| 748 | fi |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 749 | ;; |
| 750 | |
| 751 | "PSK") |
Manuel Pégourié-Gonnard | 7eb58cb | 2015-07-07 11:54:14 +0200 | [diff] [blame] | 752 | # *PSK-NULL-SHA suites supported by GnuTLS 3.3.5 but not 3.2.15 |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 753 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 754 | TLS-PSK-WITH-NULL-SHA \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 755 | TLS-DHE-PSK-WITH-NULL-SHA \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 756 | " |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 757 | if [ `minor_ver "$MODE"` -gt 0 ] |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 758 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 759 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 760 | TLS-ECDHE-PSK-WITH-NULL-SHA \ |
Manuel Pégourié-Gonnard | e46aa5e | 2014-07-13 15:44:19 +0200 | [diff] [blame] | 761 | TLS-RSA-PSK-WITH-NULL-SHA \ |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 762 | " |
| 763 | fi |
Manuel Pégourié-Gonnard | 2594859 | 2014-05-22 14:36:02 +0200 | [diff] [blame] | 764 | if [ "$MODE" = "tls1_2" ]; |
| 765 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 766 | M_CIPHERS="$M_CIPHERS \ |
Manuel Pégourié-Gonnard | 2594859 | 2014-05-22 14:36:02 +0200 | [diff] [blame] | 767 | TLS-PSK-WITH-AES-128-CCM \ |
| 768 | TLS-PSK-WITH-AES-256-CCM \ |
| 769 | TLS-DHE-PSK-WITH-AES-128-CCM \ |
| 770 | TLS-DHE-PSK-WITH-AES-256-CCM \ |
| 771 | TLS-PSK-WITH-AES-128-CCM-8 \ |
| 772 | TLS-PSK-WITH-AES-256-CCM-8 \ |
| 773 | TLS-DHE-PSK-WITH-AES-128-CCM-8 \ |
| 774 | TLS-DHE-PSK-WITH-AES-256-CCM-8 \ |
| 775 | " |
| 776 | fi |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 777 | ;; |
| 778 | esac |
Manuel Pégourié-Gonnard | 48f196c | 2014-02-19 13:51:58 +0100 | [diff] [blame] | 779 | } |
| 780 | |
Manuel Pégourié-Gonnard | d941a79 | 2014-02-19 13:35:52 +0100 | [diff] [blame] | 781 | setup_arguments() |
| 782 | { |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 783 | G_MODE="" |
| 784 | case "$MODE" in |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 785 | "ssl3") |
| 786 | G_PRIO_MODE="+VERS-SSL3.0" |
| 787 | ;; |
| 788 | "tls1") |
| 789 | G_PRIO_MODE="+VERS-TLS1.0" |
| 790 | ;; |
| 791 | "tls1_1") |
| 792 | G_PRIO_MODE="+VERS-TLS1.1" |
| 793 | ;; |
| 794 | "tls1_2") |
| 795 | G_PRIO_MODE="+VERS-TLS1.2" |
Manuel Pégourié-Gonnard | 9ada01a | 2014-02-19 14:24:24 +0100 | [diff] [blame] | 796 | ;; |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 797 | "dtls1") |
| 798 | G_PRIO_MODE="+VERS-DTLS1.0" |
Manuel Pégourié-Gonnard | 3679519 | 2014-09-26 16:33:45 +0200 | [diff] [blame] | 799 | G_MODE="-u" |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 800 | ;; |
| 801 | "dtls1_2") |
| 802 | G_PRIO_MODE="+VERS-DTLS1.2" |
Manuel Pégourié-Gonnard | 3679519 | 2014-09-26 16:33:45 +0200 | [diff] [blame] | 803 | G_MODE="-u" |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 804 | ;; |
Manuel Pégourié-Gonnard | 9ada01a | 2014-02-19 14:24:24 +0100 | [diff] [blame] | 805 | *) |
| 806 | echo "error: invalid mode: $MODE" >&2 |
| 807 | exit 1; |
| 808 | esac |
| 809 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 810 | M_SERVER_ARGS="server_port=$PORT server_addr=0.0.0.0 force_version=$MODE arc4=1" |
Manuel Pégourié-Gonnard | 6195767 | 2015-06-18 17:54:58 +0200 | [diff] [blame] | 811 | O_SERVER_ARGS="-accept $PORT -cipher NULL,ALL -$MODE -dhparam data_files/dhparams.pem" |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 812 | G_SERVER_ARGS="-p $PORT --http $G_MODE" |
Manuel Pégourié-Gonnard | a6e6402 | 2020-08-21 12:06:47 +0200 | [diff] [blame^] | 813 | G_SERVER_PRIO="NORMAL:+ARCFOUR-128:+NULL:+MD5:+PSK:+DHE-PSK:+ECDHE-PSK:+SHA256:+SHA384:+RSA-PSK:-VERS-TLS-ALL:$G_PRIO_MODE" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 814 | |
Manuel Pégourié-Gonnard | d1af102 | 2014-07-11 17:01:06 +0200 | [diff] [blame] | 815 | # with OpenSSL 1.0.1h, -www, -WWW and -HTTP break DTLS handshakes |
| 816 | if is_dtls "$MODE"; then |
Manuel Pégourié-Gonnard | 3679519 | 2014-09-26 16:33:45 +0200 | [diff] [blame] | 817 | O_SERVER_ARGS="$O_SERVER_ARGS" |
Manuel Pégourié-Gonnard | d1af102 | 2014-07-11 17:01:06 +0200 | [diff] [blame] | 818 | else |
| 819 | O_SERVER_ARGS="$O_SERVER_ARGS -www" |
| 820 | fi |
| 821 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 822 | M_CLIENT_ARGS="server_port=$PORT server_addr=127.0.0.1 force_version=$MODE" |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 823 | O_CLIENT_ARGS="-connect localhost:$PORT -$MODE" |
Manuel Pégourié-Gonnard | 3025b6c | 2014-03-26 15:30:16 +0100 | [diff] [blame] | 824 | G_CLIENT_ARGS="-p $PORT --debug 3 $G_MODE" |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 825 | G_CLIENT_PRIO="NONE:$G_PRIO_MODE:+COMP-NULL:+CURVE-ALL:+SIGN-ALL" |
Manuel Pégourié-Gonnard | 9ada01a | 2014-02-19 14:24:24 +0100 | [diff] [blame] | 826 | |
Manuel Pégourié-Gonnard | d941a79 | 2014-02-19 13:35:52 +0100 | [diff] [blame] | 827 | if [ "X$VERIFY" = "XYES" ]; |
| 828 | then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 829 | M_SERVER_ARGS="$M_SERVER_ARGS ca_file=data_files/test-ca_cat12.crt auth_mode=required" |
Manuel Pégourié-Gonnard | 9ada01a | 2014-02-19 14:24:24 +0100 | [diff] [blame] | 830 | O_SERVER_ARGS="$O_SERVER_ARGS -CAfile data_files/test-ca_cat12.crt -Verify 10" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 831 | G_SERVER_ARGS="$G_SERVER_ARGS --x509cafile data_files/test-ca_cat12.crt --require-client-cert" |
| 832 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 833 | M_CLIENT_ARGS="$M_CLIENT_ARGS ca_file=data_files/test-ca_cat12.crt auth_mode=required" |
Manuel Pégourié-Gonnard | da782c9 | 2014-02-21 10:10:20 +0100 | [diff] [blame] | 834 | O_CLIENT_ARGS="$O_CLIENT_ARGS -CAfile data_files/test-ca_cat12.crt -verify 10" |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 835 | G_CLIENT_ARGS="$G_CLIENT_ARGS --x509cafile data_files/test-ca_cat12.crt" |
Manuel Pégourié-Gonnard | da782c9 | 2014-02-21 10:10:20 +0100 | [diff] [blame] | 836 | else |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 837 | # don't request a client cert at all |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 838 | M_SERVER_ARGS="$M_SERVER_ARGS ca_file=none auth_mode=none" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 839 | G_SERVER_ARGS="$G_SERVER_ARGS --disable-client-cert" |
| 840 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 841 | M_CLIENT_ARGS="$M_CLIENT_ARGS ca_file=none auth_mode=none" |
Manuel Pégourié-Gonnard | 5de31ec | 2014-03-19 17:34:52 +0100 | [diff] [blame] | 842 | O_CLIENT_ARGS="$O_CLIENT_ARGS" |
| 843 | G_CLIENT_ARGS="$G_CLIENT_ARGS --insecure" |
Manuel Pégourié-Gonnard | d941a79 | 2014-02-19 13:35:52 +0100 | [diff] [blame] | 844 | fi |
| 845 | |
| 846 | case $TYPE in |
| 847 | "ECDSA") |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 848 | M_SERVER_ARGS="$M_SERVER_ARGS crt_file=data_files/server5.crt key_file=data_files/server5.key" |
Manuel Pégourié-Gonnard | 9ada01a | 2014-02-19 14:24:24 +0100 | [diff] [blame] | 849 | O_SERVER_ARGS="$O_SERVER_ARGS -cert data_files/server5.crt -key data_files/server5.key" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 850 | G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key" |
| 851 | |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 852 | if [ "X$VERIFY" = "XYES" ]; then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 853 | M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=data_files/server6.crt key_file=data_files/server6.key" |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 854 | O_CLIENT_ARGS="$O_CLIENT_ARGS -cert data_files/server6.crt -key data_files/server6.key" |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 855 | G_CLIENT_ARGS="$G_CLIENT_ARGS --x509certfile data_files/server6.crt --x509keyfile data_files/server6.key" |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 856 | else |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 857 | M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=none key_file=none" |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 858 | fi |
Manuel Pégourié-Gonnard | d941a79 | 2014-02-19 13:35:52 +0100 | [diff] [blame] | 859 | ;; |
| 860 | |
| 861 | "RSA") |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 862 | M_SERVER_ARGS="$M_SERVER_ARGS crt_file=data_files/server2.crt key_file=data_files/server2.key" |
Manuel Pégourié-Gonnard | da782c9 | 2014-02-21 10:10:20 +0100 | [diff] [blame] | 863 | O_SERVER_ARGS="$O_SERVER_ARGS -cert data_files/server2.crt -key data_files/server2.key" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 864 | G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server2.crt --x509keyfile data_files/server2.key" |
| 865 | |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 866 | if [ "X$VERIFY" = "XYES" ]; then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 867 | M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=data_files/server1.crt key_file=data_files/server1.key" |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 868 | O_CLIENT_ARGS="$O_CLIENT_ARGS -cert data_files/server1.crt -key data_files/server1.key" |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 869 | G_CLIENT_ARGS="$G_CLIENT_ARGS --x509certfile data_files/server1.crt --x509keyfile data_files/server1.key" |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 870 | else |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 871 | M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=none key_file=none" |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 872 | fi |
Gilles Peskine | 62469d9 | 2017-05-10 10:13:59 +0200 | [diff] [blame] | 873 | |
| 874 | # Allow SHA-1. It's disabled by default for security reasons but |
| 875 | # our tests still use certificates signed with it. |
| 876 | M_SERVER_ARGS="$M_SERVER_ARGS allow_sha1=1" |
| 877 | M_CLIENT_ARGS="$M_CLIENT_ARGS allow_sha1=1" |
Manuel Pégourié-Gonnard | d941a79 | 2014-02-19 13:35:52 +0100 | [diff] [blame] | 878 | ;; |
| 879 | |
| 880 | "PSK") |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 881 | # give RSA-PSK-capable server a RSA cert |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 882 | # (should be a separate type, but harder to close with openssl) |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 883 | M_SERVER_ARGS="$M_SERVER_ARGS psk=6162636465666768696a6b6c6d6e6f70 ca_file=none crt_file=data_files/server2.crt key_file=data_files/server2.key" |
Manuel Pégourié-Gonnard | 1b149ef | 2014-02-27 14:38:29 +0100 | [diff] [blame] | 884 | O_SERVER_ARGS="$O_SERVER_ARGS -psk 6162636465666768696a6b6c6d6e6f70 -nocert" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 885 | G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server2.crt --x509keyfile data_files/server2.key --pskpasswd data_files/passwd.psk" |
| 886 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 887 | M_CLIENT_ARGS="$M_CLIENT_ARGS psk=6162636465666768696a6b6c6d6e6f70 crt_file=none key_file=none" |
Manuel Pégourié-Gonnard | 9ada01a | 2014-02-19 14:24:24 +0100 | [diff] [blame] | 888 | O_CLIENT_ARGS="$O_CLIENT_ARGS -psk 6162636465666768696a6b6c6d6e6f70" |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 889 | G_CLIENT_ARGS="$G_CLIENT_ARGS --pskusername Client_identity --pskkey=6162636465666768696a6b6c6d6e6f70" |
Gilles Peskine | 62469d9 | 2017-05-10 10:13:59 +0200 | [diff] [blame] | 890 | |
| 891 | # Allow SHA-1. It's disabled by default for security reasons but |
| 892 | # our tests still use certificates signed with it. |
| 893 | M_SERVER_ARGS="$M_SERVER_ARGS allow_sha1=1" |
| 894 | M_CLIENT_ARGS="$M_CLIENT_ARGS allow_sha1=1" |
Manuel Pégourié-Gonnard | d941a79 | 2014-02-19 13:35:52 +0100 | [diff] [blame] | 895 | ;; |
| 896 | esac |
| 897 | } |
| 898 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 899 | # is_mbedtls <cmd_line> |
| 900 | is_mbedtls() { |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 901 | echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null |
| 902 | } |
| 903 | |
| 904 | # has_mem_err <log_file_name> |
| 905 | has_mem_err() { |
| 906 | if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" && |
| 907 | grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null |
| 908 | then |
| 909 | return 1 # false: does not have errors |
| 910 | else |
| 911 | return 0 # true: has errors |
| 912 | fi |
| 913 | } |
| 914 | |
Gilles Peskine | 12c49c7 | 2017-12-14 19:02:00 +0100 | [diff] [blame] | 915 | # Wait for process $2 to be listening on port $1 |
| 916 | if type lsof >/dev/null 2>/dev/null; then |
| 917 | wait_server_start() { |
| 918 | START_TIME=$(date +%s) |
| 919 | if is_dtls "$MODE"; then |
| 920 | proto=UDP |
| 921 | else |
| 922 | proto=TCP |
| 923 | fi |
| 924 | while ! lsof -a -n -b -i "$proto:$1" -p "$2" >/dev/null 2>/dev/null; do |
| 925 | if [ $(( $(date +%s) - $START_TIME )) -gt $DOG_DELAY ]; then |
| 926 | echo "SERVERSTART TIMEOUT" |
| 927 | echo "SERVERSTART TIMEOUT" >> $SRV_OUT |
| 928 | break |
| 929 | fi |
| 930 | # Linux and *BSD support decimal arguments to sleep. On other |
| 931 | # OSes this may be a tight loop. |
| 932 | sleep 0.1 2>/dev/null || true |
| 933 | done |
| 934 | } |
| 935 | else |
Gilles Peskine | 3c9e2b5 | 2018-01-08 12:38:15 +0100 | [diff] [blame] | 936 | echo "Warning: lsof not available, wait_server_start = sleep" |
Gilles Peskine | 12c49c7 | 2017-12-14 19:02:00 +0100 | [diff] [blame] | 937 | wait_server_start() { |
Manuel Pégourié-Gonnard | 0d225da | 2018-01-22 10:22:09 +0100 | [diff] [blame] | 938 | sleep 2 |
Gilles Peskine | 12c49c7 | 2017-12-14 19:02:00 +0100 | [diff] [blame] | 939 | } |
| 940 | fi |
| 941 | |
| 942 | |
Manuel Pégourié-Gonnard | 304beef | 2014-02-19 14:45:00 +0100 | [diff] [blame] | 943 | # start_server <name> |
| 944 | # also saves name and command |
| 945 | start_server() { |
Manuel Pégourié-Gonnard | 304beef | 2014-02-19 14:45:00 +0100 | [diff] [blame] | 946 | case $1 in |
| 947 | [Oo]pen*) |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 948 | SERVER_CMD="$OPENSSL_CMD s_server $O_SERVER_ARGS" |
Manuel Pégourié-Gonnard | 304beef | 2014-02-19 14:45:00 +0100 | [diff] [blame] | 949 | ;; |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 950 | [Gg]nu*) |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 951 | SERVER_CMD="$GNUTLS_SERV $G_SERVER_ARGS --priority $G_SERVER_PRIO" |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 952 | ;; |
Manuel Pégourié-Gonnard | a8f3b75 | 2015-01-22 17:05:05 +0000 | [diff] [blame] | 953 | mbed*) |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 954 | SERVER_CMD="$M_SRV $M_SERVER_ARGS" |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 955 | if [ "$MEMCHECK" -gt 0 ]; then |
| 956 | SERVER_CMD="valgrind --leak-check=full $SERVER_CMD" |
| 957 | fi |
Manuel Pégourié-Gonnard | 304beef | 2014-02-19 14:45:00 +0100 | [diff] [blame] | 958 | ;; |
| 959 | *) |
| 960 | echo "error: invalid server name: $1" >&2 |
| 961 | exit 1 |
| 962 | ;; |
| 963 | esac |
| 964 | SERVER_NAME=$1 |
| 965 | |
| 966 | log "$SERVER_CMD" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 967 | echo "$SERVER_CMD" > $SRV_OUT |
Manuel Pégourié-Gonnard | d1af102 | 2014-07-11 17:01:06 +0200 | [diff] [blame] | 968 | # for servers without -www or equivalent |
Manuel Pégourié-Gonnard | 82cf0a1 | 2015-02-09 13:05:54 +0000 | [diff] [blame] | 969 | while :; do echo bla; sleep 1; done | $SERVER_CMD >> $SRV_OUT 2>&1 & |
Manuel Pégourié-Gonnard | 304beef | 2014-02-19 14:45:00 +0100 | [diff] [blame] | 970 | PROCESS_ID=$! |
| 971 | |
Gilles Peskine | 12c49c7 | 2017-12-14 19:02:00 +0100 | [diff] [blame] | 972 | wait_server_start "$PORT" "$PROCESS_ID" |
Manuel Pégourié-Gonnard | 304beef | 2014-02-19 14:45:00 +0100 | [diff] [blame] | 973 | } |
| 974 | |
Manuel Pégourié-Gonnard | 1649449 | 2014-08-31 10:37:14 +0200 | [diff] [blame] | 975 | # terminate the running server |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 976 | stop_server() { |
Manuel Pégourié-Gonnard | 74b1170 | 2014-08-14 15:47:33 +0200 | [diff] [blame] | 977 | kill $PROCESS_ID 2>/dev/null |
| 978 | wait $PROCESS_ID 2>/dev/null |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 979 | |
| 980 | if [ "$MEMCHECK" -gt 0 ]; then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 981 | if is_mbedtls "$SERVER_CMD" && has_mem_err $SRV_OUT; then |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 982 | echo " ! Server had memory errors" |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 983 | SRVMEM=$(( $SRVMEM + 1 )) |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 984 | return |
| 985 | fi |
| 986 | fi |
| 987 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 988 | rm -f $SRV_OUT |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 989 | } |
| 990 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 991 | # kill the running server (used when killed by signal) |
| 992 | cleanup() { |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 993 | rm -f $SRV_OUT $CLI_OUT |
Manuel Pégourié-Gonnard | 1649449 | 2014-08-31 10:37:14 +0200 | [diff] [blame] | 994 | kill $PROCESS_ID >/dev/null 2>&1 |
| 995 | kill $WATCHDOG_PID >/dev/null 2>&1 |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 996 | exit 1 |
| 997 | } |
| 998 | |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 999 | # wait for client to terminate and set EXIT |
| 1000 | # must be called right after starting the client |
| 1001 | wait_client_done() { |
| 1002 | CLI_PID=$! |
| 1003 | |
| 1004 | ( sleep "$DOG_DELAY"; echo "TIMEOUT" >> $CLI_OUT; kill $CLI_PID ) & |
| 1005 | WATCHDOG_PID=$! |
| 1006 | |
| 1007 | wait $CLI_PID |
| 1008 | EXIT=$? |
| 1009 | |
| 1010 | kill $WATCHDOG_PID |
| 1011 | wait $WATCHDOG_PID |
| 1012 | |
| 1013 | echo "EXIT: $EXIT" >> $CLI_OUT |
| 1014 | } |
| 1015 | |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1016 | # run_client <name> <cipher> |
| 1017 | run_client() { |
Manuel Pégourié-Gonnard | 87ae303 | 2014-02-27 11:12:30 +0100 | [diff] [blame] | 1018 | # announce what we're going to do |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1019 | TESTS=$(( $TESTS + 1 )) |
Manuel Pégourié-Gonnard | 87ae303 | 2014-02-27 11:12:30 +0100 | [diff] [blame] | 1020 | VERIF=$(echo $VERIFY | tr '[:upper:]' '[:lower:]') |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1021 | TITLE="`echo $1 | head -c1`->`echo $SERVER_NAME | head -c1`" |
| 1022 | TITLE="$TITLE $MODE,$VERIF $2" |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 1023 | printf "$TITLE " |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1024 | LEN=$(( 72 - `echo "$TITLE" | wc -c` )) |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 1025 | for i in `seq 1 $LEN`; do printf '.'; done; printf ' ' |
Manuel Pégourié-Gonnard | 87ae303 | 2014-02-27 11:12:30 +0100 | [diff] [blame] | 1026 | |
Manuel Pégourié-Gonnard | 53aef81 | 2014-07-11 17:41:24 +0200 | [diff] [blame] | 1027 | # should we skip? |
| 1028 | if [ "X$SKIP_NEXT" = "XYES" ]; then |
| 1029 | SKIP_NEXT="NO" |
| 1030 | echo "SKIP" |
| 1031 | SKIPPED=$(( $SKIPPED + 1 )) |
| 1032 | return |
| 1033 | fi |
| 1034 | |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1035 | # run the command and interpret result |
| 1036 | case $1 in |
| 1037 | [Oo]pen*) |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 1038 | CLIENT_CMD="$OPENSSL_CMD s_client $O_CLIENT_ARGS -cipher $2" |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1039 | log "$CLIENT_CMD" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1040 | echo "$CLIENT_CMD" > $CLI_OUT |
Manuel Pégourié-Gonnard | 9afdc83 | 2015-08-04 17:15:13 +0200 | [diff] [blame] | 1041 | printf 'GET HTTP/1.0\r\n\r\n' | $CLIENT_CMD >> $CLI_OUT 2>&1 & |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1042 | wait_client_done |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1043 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1044 | if [ $EXIT -eq 0 ]; then |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1045 | RESULT=0 |
| 1046 | else |
Simon Butcher | bb5e1c3 | 2018-06-08 11:14:43 +0100 | [diff] [blame] | 1047 | # If the cipher isn't supported... |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1048 | if grep 'Cipher is (NONE)' $CLI_OUT >/dev/null; then |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1049 | RESULT=1 |
| 1050 | else |
| 1051 | RESULT=2 |
| 1052 | fi |
| 1053 | fi |
| 1054 | ;; |
| 1055 | |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 1056 | [Gg]nu*) |
Manuel Pégourié-Gonnard | 29980b1 | 2014-07-10 20:12:56 +0200 | [diff] [blame] | 1057 | # need to force IPv4 with UDP, but keep localhost for auth |
| 1058 | if is_dtls "$MODE"; then |
| 1059 | G_HOST="127.0.0.1" |
| 1060 | else |
| 1061 | G_HOST="localhost" |
| 1062 | fi |
| 1063 | CLIENT_CMD="$GNUTLS_CLI $G_CLIENT_ARGS --priority $G_PRIO_MODE:$2 $G_HOST" |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 1064 | log "$CLIENT_CMD" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1065 | echo "$CLIENT_CMD" > $CLI_OUT |
Manuel Pégourié-Gonnard | 9afdc83 | 2015-08-04 17:15:13 +0200 | [diff] [blame] | 1066 | printf 'GET HTTP/1.0\r\n\r\n' | $CLIENT_CMD >> $CLI_OUT 2>&1 & |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1067 | wait_client_done |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 1068 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1069 | if [ $EXIT -eq 0 ]; then |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 1070 | RESULT=0 |
| 1071 | else |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1072 | RESULT=2 |
| 1073 | # interpret early failure, with a handshake_failure alert |
| 1074 | # before the server hello, as "no ciphersuite in common" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1075 | if grep -F 'Received alert [40]: Handshake failed' $CLI_OUT; then |
| 1076 | if grep -i 'SERVER HELLO .* was received' $CLI_OUT; then : |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1077 | else |
| 1078 | RESULT=1 |
| 1079 | fi |
| 1080 | fi >/dev/null |
Manuel Pégourié-Gonnard | a437144 | 2014-03-13 16:21:59 +0100 | [diff] [blame] | 1081 | fi |
| 1082 | ;; |
| 1083 | |
Manuel Pégourié-Gonnard | a8f3b75 | 2015-01-22 17:05:05 +0000 | [diff] [blame] | 1084 | mbed*) |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1085 | CLIENT_CMD="$M_CLI $M_CLIENT_ARGS force_ciphersuite=$2" |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 1086 | if [ "$MEMCHECK" -gt 0 ]; then |
| 1087 | CLIENT_CMD="valgrind --leak-check=full $CLIENT_CMD" |
| 1088 | fi |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1089 | log "$CLIENT_CMD" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1090 | echo "$CLIENT_CMD" > $CLI_OUT |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1091 | $CLIENT_CMD >> $CLI_OUT 2>&1 & |
| 1092 | wait_client_done |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1093 | |
| 1094 | case $EXIT in |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1095 | # Success |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1096 | "0") RESULT=0 ;; |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1097 | |
| 1098 | # Ciphersuite not supported |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1099 | "2") RESULT=1 ;; |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1100 | |
| 1101 | # Error |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1102 | *) RESULT=2 ;; |
| 1103 | esac |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 1104 | |
| 1105 | if [ "$MEMCHECK" -gt 0 ]; then |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1106 | if is_mbedtls "$CLIENT_CMD" && has_mem_err $CLI_OUT; then |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 1107 | RESULT=2 |
| 1108 | fi |
| 1109 | fi |
| 1110 | |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1111 | ;; |
| 1112 | |
| 1113 | *) |
| 1114 | echo "error: invalid client name: $1" >&2 |
| 1115 | exit 1 |
| 1116 | ;; |
| 1117 | esac |
| 1118 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1119 | echo "EXIT: $EXIT" >> $CLI_OUT |
Manuel Pégourié-Gonnard | e01af4c | 2014-03-25 14:16:44 +0100 | [diff] [blame] | 1120 | |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1121 | # report and count result |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1122 | case $RESULT in |
| 1123 | "0") |
Manuel Pégourié-Gonnard | 4145b89 | 2014-02-24 13:20:14 +0100 | [diff] [blame] | 1124 | echo PASS |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1125 | ;; |
| 1126 | "1") |
Manuel Pégourié-Gonnard | 4145b89 | 2014-02-24 13:20:14 +0100 | [diff] [blame] | 1127 | echo SKIP |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1128 | SKIPPED=$(( $SKIPPED + 1 )) |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1129 | ;; |
| 1130 | "2") |
Manuel Pégourié-Gonnard | 4145b89 | 2014-02-24 13:20:14 +0100 | [diff] [blame] | 1131 | echo FAIL |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1132 | cp $SRV_OUT c-srv-${TESTS}.log |
| 1133 | cp $CLI_OUT c-cli-${TESTS}.log |
| 1134 | echo " ! outputs saved to c-srv-${TESTS}.log, c-cli-${TESTS}.log" |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 1135 | |
Manuel Pégourié-Gonnard | 793c436 | 2020-07-27 09:46:53 +0200 | [diff] [blame] | 1136 | if [ "${LOG_FAILURE_ON_STDOUT:-0}" != 0 ]; then |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 1137 | echo " ! server output:" |
| 1138 | cat c-srv-${TESTS}.log |
| 1139 | echo " ! ===================================================" |
| 1140 | echo " ! client output:" |
| 1141 | cat c-cli-${TESTS}.log |
| 1142 | fi |
| 1143 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1144 | FAILED=$(( $FAILED + 1 )) |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1145 | ;; |
| 1146 | esac |
Manuel Pégourié-Gonnard | 87ae303 | 2014-02-27 11:12:30 +0100 | [diff] [blame] | 1147 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1148 | rm -f $CLI_OUT |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1149 | } |
| 1150 | |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 1151 | # |
| 1152 | # MAIN |
| 1153 | # |
| 1154 | |
Manuel Pégourié-Gonnard | 19db8ea | 2015-03-10 13:41:04 +0000 | [diff] [blame] | 1155 | if cd $( dirname $0 ); then :; else |
| 1156 | echo "cd $( dirname $0 ) failed" >&2 |
| 1157 | exit 1 |
| 1158 | fi |
| 1159 | |
Manuel Pégourié-Gonnard | 3947d04 | 2014-03-14 18:13:53 +0100 | [diff] [blame] | 1160 | get_options "$@" |
| 1161 | |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1162 | # sanity checks, avoid an avalanche of errors |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1163 | if [ ! -x "$M_SRV" ]; then |
| 1164 | echo "Command '$M_SRV' is not an executable file" >&2 |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1165 | exit 1 |
| 1166 | fi |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1167 | if [ ! -x "$M_CLI" ]; then |
| 1168 | echo "Command '$M_CLI' is not an executable file" >&2 |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1169 | exit 1 |
| 1170 | fi |
Manuel Pégourié-Gonnard | 3947d04 | 2014-03-14 18:13:53 +0100 | [diff] [blame] | 1171 | |
| 1172 | if echo "$PEERS" | grep -i openssl > /dev/null; then |
| 1173 | if which "$OPENSSL_CMD" >/dev/null 2>&1; then :; else |
| 1174 | echo "Command '$OPENSSL_CMD' not found" >&2 |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 1175 | exit 1 |
| 1176 | fi |
Manuel Pégourié-Gonnard | 3947d04 | 2014-03-14 18:13:53 +0100 | [diff] [blame] | 1177 | fi |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1178 | |
Manuel Pégourié-Gonnard | 3947d04 | 2014-03-14 18:13:53 +0100 | [diff] [blame] | 1179 | if echo "$PEERS" | grep -i gnutls > /dev/null; then |
| 1180 | for CMD in "$GNUTLS_CLI" "$GNUTLS_SERV"; do |
| 1181 | if which "$CMD" >/dev/null 2>&1; then :; else |
| 1182 | echo "Command '$CMD' not found" >&2 |
| 1183 | exit 1 |
| 1184 | fi |
| 1185 | done |
| 1186 | fi |
| 1187 | |
| 1188 | for PEER in $PEERS; do |
| 1189 | case "$PEER" in |
Manuel Pégourié-Gonnard | a8f3b75 | 2015-01-22 17:05:05 +0000 | [diff] [blame] | 1190 | mbed*|[Oo]pen*|[Gg]nu*) |
Manuel Pégourié-Gonnard | 3947d04 | 2014-03-14 18:13:53 +0100 | [diff] [blame] | 1191 | ;; |
| 1192 | *) |
| 1193 | echo "Unknown peers: $PEER" >&2 |
| 1194 | exit 1 |
| 1195 | esac |
| 1196 | done |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 1197 | |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 1198 | # Pick a "unique" port in the range 10000-19999. |
| 1199 | PORT="0000$$" |
Manuel Pégourié-Gonnard | fab2a3c | 2014-06-16 16:54:36 +0200 | [diff] [blame] | 1200 | PORT="1$(echo $PORT | tail -c 5)" |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 1201 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1202 | # Also pick a unique name for intermediate files |
| 1203 | SRV_OUT="srv_out.$$" |
| 1204 | CLI_OUT="cli_out.$$" |
| 1205 | |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1206 | # client timeout delay: be more patient with valgrind |
| 1207 | if [ "$MEMCHECK" -gt 0 ]; then |
| 1208 | DOG_DELAY=30 |
| 1209 | else |
| 1210 | DOG_DELAY=10 |
| 1211 | fi |
| 1212 | |
Manuel Pégourié-Gonnard | 53aef81 | 2014-07-11 17:41:24 +0200 | [diff] [blame] | 1213 | SKIP_NEXT="NO" |
| 1214 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 1215 | trap cleanup INT TERM HUP |
| 1216 | |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 1217 | for VERIFY in $VERIFIES; do |
| 1218 | for MODE in $MODES; do |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 1219 | for TYPE in $TYPES; do |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1220 | for PEER in $PEERS; do |
Paul Bakker | 7e5e7ca | 2013-04-17 19:27:58 +0200 | [diff] [blame] | 1221 | |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 1222 | setup_arguments |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 1223 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1224 | case "$PEER" in |
Manuel Pégourié-Gonnard | d331319 | 2013-09-13 19:20:37 +0200 | [diff] [blame] | 1225 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1226 | [Oo]pen*) |
Paul Bakker | 398cb51 | 2012-04-10 08:22:31 +0000 | [diff] [blame] | 1227 | |
Manuel Pégourié-Gonnard | 39e2ca9 | 2015-08-04 16:43:37 +0200 | [diff] [blame] | 1228 | if test "$OSSL_NO_DTLS" -gt 0 && is_dtls "$MODE"; then |
| 1229 | continue; |
| 1230 | fi |
| 1231 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1232 | reset_ciphersuites |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 1233 | add_common_ciphersuites |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1234 | add_openssl_ciphersuites |
| 1235 | filter_ciphersuites |
Manuel Pégourié-Gonnard | 330e411 | 2014-02-19 15:23:21 +0100 | [diff] [blame] | 1236 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1237 | if [ "X" != "X$M_CIPHERS" ]; then |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1238 | start_server "OpenSSL" |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1239 | for i in $M_CIPHERS; do |
Manuel Pégourié-Gonnard | 53aef81 | 2014-07-11 17:41:24 +0200 | [diff] [blame] | 1240 | check_openssl_server_bug $i |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 1241 | run_client mbedTLS $i |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1242 | done |
| 1243 | stop_server |
| 1244 | fi |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 1245 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1246 | if [ "X" != "X$O_CIPHERS" ]; then |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 1247 | start_server "mbedTLS" |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1248 | for i in $O_CIPHERS; do |
| 1249 | run_client OpenSSL $i |
| 1250 | done |
| 1251 | stop_server |
| 1252 | fi |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 1253 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1254 | ;; |
Manuel Pégourié-Gonnard | 5b2d776 | 2014-02-28 12:42:57 +0100 | [diff] [blame] | 1255 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1256 | [Gg]nu*) |
Paul Bakker | fab5c82 | 2012-02-06 16:45:10 +0000 | [diff] [blame] | 1257 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1258 | reset_ciphersuites |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 1259 | add_common_ciphersuites |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1260 | add_gnutls_ciphersuites |
| 1261 | filter_ciphersuites |
Paul Bakker | fab5c82 | 2012-02-06 16:45:10 +0000 | [diff] [blame] | 1262 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1263 | if [ "X" != "X$M_CIPHERS" ]; then |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1264 | start_server "GnuTLS" |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1265 | for i in $M_CIPHERS; do |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 1266 | run_client mbedTLS $i |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1267 | done |
| 1268 | stop_server |
| 1269 | fi |
| 1270 | |
| 1271 | if [ "X" != "X$G_CIPHERS" ]; then |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 1272 | start_server "mbedTLS" |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1273 | for i in $G_CIPHERS; do |
| 1274 | run_client GnuTLS $i |
| 1275 | done |
| 1276 | stop_server |
| 1277 | fi |
| 1278 | |
| 1279 | ;; |
| 1280 | |
Manuel Pégourié-Gonnard | a8f3b75 | 2015-01-22 17:05:05 +0000 | [diff] [blame] | 1281 | mbed*) |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1282 | |
| 1283 | reset_ciphersuites |
Manuel Pégourié-Gonnard | 12b8472 | 2014-03-25 19:07:28 +0100 | [diff] [blame] | 1284 | add_common_ciphersuites |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1285 | add_openssl_ciphersuites |
| 1286 | add_gnutls_ciphersuites |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1287 | add_mbedtls_ciphersuites |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1288 | filter_ciphersuites |
| 1289 | |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1290 | if [ "X" != "X$M_CIPHERS" ]; then |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 1291 | start_server "mbedTLS" |
Simon Butcher | ac22d11 | 2016-09-04 22:31:09 +0100 | [diff] [blame] | 1292 | for i in $M_CIPHERS; do |
Manuel Pégourié-Gonnard | e4f6edc | 2015-01-22 16:43:54 +0000 | [diff] [blame] | 1293 | run_client mbedTLS $i |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1294 | done |
| 1295 | stop_server |
| 1296 | fi |
| 1297 | |
| 1298 | ;; |
| 1299 | |
Manuel Pégourié-Gonnard | a1a9f9a | 2014-03-25 18:04:59 +0100 | [diff] [blame] | 1300 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 1301 | echo "Unknown peer: $PEER" >&2 |
Manuel Pégourié-Gonnard | a1a9f9a | 2014-03-25 18:04:59 +0100 | [diff] [blame] | 1302 | exit 1 |
| 1303 | ;; |
| 1304 | |
Manuel Pégourié-Gonnard | 9edba77 | 2014-03-13 17:45:35 +0100 | [diff] [blame] | 1305 | esac |
| 1306 | |
| 1307 | done |
Manuel Pégourié-Gonnard | 9595771 | 2014-02-19 15:29:38 +0100 | [diff] [blame] | 1308 | done |
| 1309 | done |
Manuel Pégourié-Gonnard | 9791a40 | 2013-08-27 19:57:15 +0200 | [diff] [blame] | 1310 | done |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 1311 | |
Manuel Pégourié-Gonnard | 4145b89 | 2014-02-24 13:20:14 +0100 | [diff] [blame] | 1312 | echo "------------------------------------------------------------------------" |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 1313 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1314 | if [ $FAILED -ne 0 -o $SRVMEM -ne 0 ]; |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 1315 | then |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 1316 | printf "FAILED" |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 1317 | else |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 1318 | printf "PASSED" |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 1319 | fi |
| 1320 | |
Manuel Pégourié-Gonnard | ba0b844 | 2014-03-13 17:57:45 +0100 | [diff] [blame] | 1321 | if [ "$MEMCHECK" -gt 0 ]; then |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1322 | MEMREPORT=", $SRVMEM server memory errors" |
Manuel Pégourié-Gonnard | ba0b844 | 2014-03-13 17:57:45 +0100 | [diff] [blame] | 1323 | else |
| 1324 | MEMREPORT="" |
| 1325 | fi |
| 1326 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1327 | PASSED=$(( $TESTS - $FAILED )) |
| 1328 | echo " ($PASSED / $TESTS tests ($SKIPPED skipped$MEMREPORT))" |
Manuel Pégourié-Gonnard | 70064fd | 2013-08-27 22:00:47 +0200 | [diff] [blame] | 1329 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 1330 | FAILED=$(( $FAILED + $SRVMEM )) |
| 1331 | exit $FAILED |