Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1 | #!/bin/sh |
| 2 | |
Simon Butcher | 58eddef | 2016-05-19 23:43:11 +0100 | [diff] [blame] | 3 | # ssl-opt.sh |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 4 | # |
Bence Szépkúti | 1e14827 | 2020-08-07 13:07:28 +0200 | [diff] [blame] | 5 | # Copyright The Mbed TLS Contributors |
Dave Rodgman | 7ff7965 | 2023-11-03 12:04:52 +0000 | [diff] [blame] | 6 | # SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later |
Bence Szépkúti | c7da1fe | 2020-05-26 01:54:15 +0200 | [diff] [blame] | 7 | # |
Simon Butcher | 58eddef | 2016-05-19 23:43:11 +0100 | [diff] [blame] | 8 | # Purpose |
| 9 | # |
| 10 | # Executes tests to prove various TLS/SSL options and extensions. |
| 11 | # |
| 12 | # The goal is not to cover every ciphersuite/version, but instead to cover |
| 13 | # specific options (max fragment length, truncated hmac, etc) or procedures |
| 14 | # (session resumption from cache or ticket, renego, etc). |
| 15 | # |
| 16 | # The tests assume a build with default options, with exceptions expressed |
| 17 | # with a dependency. The tests focus on functionality and do not consider |
| 18 | # performance. |
| 19 | # |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 20 | |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 21 | set -u |
| 22 | |
Jaeden Amero | 6e70eb2 | 2019-07-03 13:51:04 +0100 | [diff] [blame] | 23 | # Limit the size of each log to 10 GiB, in case of failures with this script |
| 24 | # where it may output seemingly unlimited length error logs. |
| 25 | ulimit -f 20971520 |
| 26 | |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 27 | ORIGINAL_PWD=$PWD |
| 28 | if ! cd "$(dirname "$0")"; then |
| 29 | exit 125 |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 30 | fi |
| 31 | |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 32 | # default values, can be overridden by the environment |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 33 | : ${P_SRV:=../programs/ssl/ssl_server2} |
| 34 | : ${P_CLI:=../programs/ssl/ssl_client2} |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 35 | : ${P_PXY:=../programs/test/udp_proxy} |
Jerry Yu | bbfa1d8 | 2021-12-06 16:52:57 +0800 | [diff] [blame] | 36 | : ${P_QUERY:=../programs/test/query_compile_time_config} |
Manuel Pégourié-Gonnard | 89d4027 | 2022-12-19 11:42:12 +0100 | [diff] [blame] | 37 | : ${OPENSSL:=openssl} |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 38 | : ${GNUTLS_CLI:=gnutls-cli} |
| 39 | : ${GNUTLS_SERV:=gnutls-serv} |
Gilles Peskine | d50177f | 2017-05-16 17:53:03 +0200 | [diff] [blame] | 40 | : ${PERL:=perl} |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 41 | |
Manuel Pégourié-Gonnard | 89d4027 | 2022-12-19 11:42:12 +0100 | [diff] [blame] | 42 | # The OPENSSL variable used to be OPENSSL_CMD for historical reasons. |
| 43 | # To help the migration, error out if the old variable is set, |
| 44 | # but only if it has a different value than the new one. |
| 45 | if [ "${OPENSSL_CMD+set}" = set ]; then |
| 46 | # the variable is set, we can now check its value |
| 47 | if [ "$OPENSSL_CMD" != "$OPENSSL" ]; then |
| 48 | echo "Please use OPENSSL instead of OPENSSL_CMD." >&2 |
| 49 | exit 125 |
| 50 | fi |
| 51 | fi |
| 52 | |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 53 | guess_config_name() { |
| 54 | if git diff --quiet ../include/mbedtls/config.h 2>/dev/null; then |
| 55 | echo "default" |
| 56 | else |
| 57 | echo "unknown" |
| 58 | fi |
| 59 | } |
| 60 | : ${MBEDTLS_TEST_OUTCOME_FILE=} |
| 61 | : ${MBEDTLS_TEST_CONFIGURATION:="$(guess_config_name)"} |
| 62 | : ${MBEDTLS_TEST_PLATFORM:="$(uname -s | tr -c \\n0-9A-Za-z _)-$(uname -m | tr -c \\n0-9A-Za-z _)"} |
| 63 | |
Manuel Pégourié-Gonnard | 89d4027 | 2022-12-19 11:42:12 +0100 | [diff] [blame] | 64 | O_SRV="$OPENSSL s_server -www -cert data_files/server5.crt -key data_files/server5.key" |
| 65 | O_CLI="echo 'GET / HTTP/1.0' | $OPENSSL s_client" |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 66 | G_SRV="$GNUTLS_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key" |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 67 | G_CLI="echo 'GET / HTTP/1.0' | $GNUTLS_CLI --x509cafile data_files/test-ca_cat12.crt" |
Gilles Peskine | d50177f | 2017-05-16 17:53:03 +0200 | [diff] [blame] | 68 | TCP_CLIENT="$PERL scripts/tcp_client.pl" |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 69 | |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 70 | # alternative versions of OpenSSL and GnuTLS (no default path) |
| 71 | |
Gilles Peskine | 757eb9c | 2024-04-29 17:46:24 +0200 | [diff] [blame] | 72 | # If $OPENSSL is at least 1.1.1, use it as OPENSSL_NEXT as well. |
| 73 | if [ -z "${OPENSSL_NEXT:-}" ]; then |
| 74 | case $($OPENSSL version) in |
| 75 | OpenSSL\ 1.1.[1-9]*) OPENSSL_NEXT=$OPENSSL;; |
| 76 | OpenSSL\ [3-9]*) OPENSSL_NEXT=$OPENSSL;; |
| 77 | esac |
| 78 | fi |
| 79 | |
| 80 | # If $GNUTLS_CLI is at least 3.7, use it as GNUTLS_NEXT_CLI as well. |
| 81 | if [ -z "${GNUTLS_NEXT_CLI:-}" ]; then |
| 82 | case $($GNUTLS_CLI --version) in |
| 83 | gnutls-cli\ 3.[1-9][0-9]*) GNUTLS_NEXT_CLI=$GNUTLS_CLI;; |
| 84 | gnutls-cli\ 3.[7-9].*) GNUTLS_NEXT_CLI=$GNUTLS_CLI;; |
| 85 | gnutls-cli\ [4-9]*) GNUTLS_NEXT_CLI=$GNUTLS_CLI;; |
| 86 | esac |
| 87 | fi |
| 88 | |
| 89 | # If $GNUTLS_SERV is at least 3.7, use it as GNUTLS_NEXT_SERV as well. |
| 90 | if [ -z "${GNUTLS_NEXT_SERV:-}" ]; then |
| 91 | case $($GNUTLS_SERV --version) in |
| 92 | gnutls-cli\ 3.[1-9][0-9]*) GNUTLS_NEXT_SERV=$GNUTLS_SERV;; |
| 93 | gnutls-cli\ 3.[7-9].*) GNUTLS_NEXT_SERV=$GNUTLS_SERV;; |
| 94 | gnutls-cli\ [4-9]*) GNUTLS_NEXT_SERV=$GNUTLS_SERV;; |
| 95 | esac |
| 96 | fi |
| 97 | |
Paul Elliott | 633a74e | 2021-10-13 18:31:07 +0100 | [diff] [blame] | 98 | if [ -n "${OPENSSL_NEXT:-}" ]; then |
| 99 | O_NEXT_SRV="$OPENSSL_NEXT s_server -www -cert data_files/server5.crt -key data_files/server5.key" |
| 100 | O_NEXT_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_NEXT s_client" |
| 101 | else |
| 102 | O_NEXT_SRV=false |
| 103 | O_NEXT_CLI=false |
| 104 | fi |
| 105 | |
Hanno Becker | 58e9dc3 | 2018-08-17 15:53:21 +0100 | [diff] [blame] | 106 | if [ -n "${GNUTLS_NEXT_SERV:-}" ]; then |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 107 | G_NEXT_SRV="$GNUTLS_NEXT_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key" |
| 108 | else |
| 109 | G_NEXT_SRV=false |
| 110 | fi |
| 111 | |
Hanno Becker | 58e9dc3 | 2018-08-17 15:53:21 +0100 | [diff] [blame] | 112 | if [ -n "${GNUTLS_NEXT_CLI:-}" ]; then |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 113 | G_NEXT_CLI="echo 'GET / HTTP/1.0' | $GNUTLS_NEXT_CLI --x509cafile data_files/test-ca_cat12.crt" |
| 114 | else |
| 115 | G_NEXT_CLI=false |
| 116 | fi |
| 117 | |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 118 | TESTS=0 |
| 119 | FAILS=0 |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 120 | SKIPS=0 |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 121 | |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 122 | CONFIG_H='../include/mbedtls/config.h' |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 123 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 124 | MEMCHECK=0 |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 125 | FILTER='.*' |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 126 | EXCLUDE='^$' |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 127 | |
Paul Bakker | e20310a | 2016-05-10 11:18:17 +0100 | [diff] [blame] | 128 | SHOW_TEST_NUMBER=0 |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 129 | LIST_TESTS=0 |
Paul Bakker | b7584a5 | 2016-05-10 10:50:43 +0100 | [diff] [blame] | 130 | RUN_TEST_NUMBER='' |
| 131 | |
Gilles Peskine | d2c4189 | 2024-05-17 11:55:15 +0200 | [diff] [blame^] | 132 | MIN_TESTS=1 |
Paul Bakker | acaac85 | 2016-05-10 11:47:13 +0100 | [diff] [blame] | 133 | PRESERVE_LOGS=0 |
| 134 | |
Gilles Peskine | f93c7d3 | 2017-04-14 17:55:28 +0200 | [diff] [blame] | 135 | # Pick a "unique" server port in the range 10000-19999, and a proxy |
| 136 | # port which is this plus 10000. Each port number may be independently |
| 137 | # overridden by a command line option. |
| 138 | SRV_PORT=$(($$ % 10000 + 10000)) |
| 139 | PXY_PORT=$((SRV_PORT + 10000)) |
| 140 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 141 | print_usage() { |
| 142 | echo "Usage: $0 [options]" |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 143 | printf " -h|--help\tPrint this help.\n" |
| 144 | printf " -m|--memcheck\tCheck memory leaks and errors.\n" |
Gilles Peskine | 9fa4ed6 | 2020-08-26 22:35:46 +0200 | [diff] [blame] | 145 | printf " -f|--filter\tOnly matching tests are executed (substring or BRE)\n" |
| 146 | printf " -e|--exclude\tMatching tests are excluded (substring or BRE)\n" |
Paul Bakker | b7584a5 | 2016-05-10 10:50:43 +0100 | [diff] [blame] | 147 | printf " -n|--number\tExecute only numbered test (comma-separated, e.g. '245,256')\n" |
Paul Bakker | e20310a | 2016-05-10 11:18:17 +0100 | [diff] [blame] | 148 | printf " -s|--show-numbers\tShow test numbers in front of test names\n" |
Paul Bakker | acaac85 | 2016-05-10 11:47:13 +0100 | [diff] [blame] | 149 | printf " -p|--preserve-logs\tPreserve logs of successful tests as well\n" |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 150 | printf " --list-test-cases\tList all potential test cases (No Execution)\n" |
Gilles Peskine | d2c4189 | 2024-05-17 11:55:15 +0200 | [diff] [blame^] | 151 | printf " --min \tMinimum number of non-skipped tests (default 1)\n" |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 152 | printf " --outcome-file\tFile where test outcomes are written\n" |
| 153 | printf " \t(default: \$MBEDTLS_TEST_OUTCOME_FILE, none if empty)\n" |
| 154 | printf " --port \tTCP/UDP port (default: randomish 1xxxx)\n" |
Gilles Peskine | f93c7d3 | 2017-04-14 17:55:28 +0200 | [diff] [blame] | 155 | printf " --proxy-port\tTCP/UDP proxy port (default: randomish 2xxxx)\n" |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 156 | printf " --seed \tInteger seed value to use for this test run\n" |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 157 | } |
| 158 | |
| 159 | get_options() { |
| 160 | while [ $# -gt 0 ]; do |
| 161 | case "$1" in |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 162 | -f|--filter) |
| 163 | shift; FILTER=$1 |
| 164 | ;; |
| 165 | -e|--exclude) |
| 166 | shift; EXCLUDE=$1 |
| 167 | ;; |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 168 | -m|--memcheck) |
| 169 | MEMCHECK=1 |
| 170 | ;; |
Paul Bakker | b7584a5 | 2016-05-10 10:50:43 +0100 | [diff] [blame] | 171 | -n|--number) |
| 172 | shift; RUN_TEST_NUMBER=$1 |
| 173 | ;; |
Paul Bakker | e20310a | 2016-05-10 11:18:17 +0100 | [diff] [blame] | 174 | -s|--show-numbers) |
| 175 | SHOW_TEST_NUMBER=1 |
| 176 | ;; |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 177 | -l|--list-test-cases) |
| 178 | LIST_TESTS=1 |
| 179 | ;; |
Paul Bakker | acaac85 | 2016-05-10 11:47:13 +0100 | [diff] [blame] | 180 | -p|--preserve-logs) |
| 181 | PRESERVE_LOGS=1 |
| 182 | ;; |
Gilles Peskine | d2c4189 | 2024-05-17 11:55:15 +0200 | [diff] [blame^] | 183 | --min) |
| 184 | shift; MIN_TESTS=$1 |
| 185 | ;; |
Yanray Wang | 5659981 | 2023-02-28 11:56:59 +0800 | [diff] [blame] | 186 | --outcome-file) |
| 187 | shift; MBEDTLS_TEST_OUTCOME_FILE=$1 |
| 188 | ;; |
Gilles Peskine | f93c7d3 | 2017-04-14 17:55:28 +0200 | [diff] [blame] | 189 | --port) |
| 190 | shift; SRV_PORT=$1 |
| 191 | ;; |
| 192 | --proxy-port) |
| 193 | shift; PXY_PORT=$1 |
| 194 | ;; |
Andres AG | f04f54d | 2016-10-10 15:46:20 +0100 | [diff] [blame] | 195 | --seed) |
| 196 | shift; SEED="$1" |
| 197 | ;; |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 198 | -h|--help) |
| 199 | print_usage |
| 200 | exit 0 |
| 201 | ;; |
| 202 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 203 | echo "Unknown argument: '$1'" |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 204 | print_usage |
| 205 | exit 1 |
| 206 | ;; |
| 207 | esac |
| 208 | shift |
| 209 | done |
| 210 | } |
| 211 | |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 212 | get_options "$@" |
| 213 | |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 214 | # Read boolean configuration options from config.h for easy and quick |
| 215 | # testing. Skip non-boolean options (with something other than spaces |
| 216 | # and a comment after "#define SYMBOL"). The variable contains a |
| 217 | # space-separated list of symbols. |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 218 | if [ "$LIST_TESTS" -eq 0 ];then |
| 219 | CONFIGS_ENABLED=" $(echo `$P_QUERY -l` )" |
| 220 | else |
| 221 | P_QUERY=":" |
| 222 | CONFIGS_ENABLED="" |
| 223 | fi |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 224 | # Skip next test; use this macro to skip tests which are legitimate |
| 225 | # in theory and expected to be re-introduced at some point, but |
| 226 | # aren't expected to succeed at the moment due to problems outside |
| 227 | # our control (such as bugs in other TLS implementations). |
| 228 | skip_next_test() { |
| 229 | SKIP_NEXT="YES" |
| 230 | } |
| 231 | |
Manuel Pégourié-Gonnard | 988209f | 2015-03-24 10:43:55 +0100 | [diff] [blame] | 232 | # skip next test if the flag is not enabled in config.h |
| 233 | requires_config_enabled() { |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 234 | case $CONFIGS_ENABLED in |
Jerry Yu | 969c01a | 2021-12-10 20:29:02 +0800 | [diff] [blame] | 235 | *" $1"[\ =]*) :;; |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 236 | *) SKIP_NEXT="YES";; |
| 237 | esac |
Manuel Pégourié-Gonnard | 988209f | 2015-03-24 10:43:55 +0100 | [diff] [blame] | 238 | } |
| 239 | |
Manuel Pégourié-Gonnard | af63c21 | 2017-06-08 17:51:08 +0200 | [diff] [blame] | 240 | # skip next test if the flag is enabled in config.h |
| 241 | requires_config_disabled() { |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 242 | case $CONFIGS_ENABLED in |
Jerry Yu | 969c01a | 2021-12-10 20:29:02 +0800 | [diff] [blame] | 243 | *" $1"[\ =]*) SKIP_NEXT="YES";; |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 244 | esac |
Manuel Pégourié-Gonnard | af63c21 | 2017-06-08 17:51:08 +0200 | [diff] [blame] | 245 | } |
| 246 | |
Hanno Becker | 7c48dd1 | 2018-08-28 16:09:22 +0100 | [diff] [blame] | 247 | get_config_value_or_default() { |
Andres Amaya Garcia | 3169dc0 | 2018-10-16 21:29:07 +0100 | [diff] [blame] | 248 | # This function uses the query_config command line option to query the |
| 249 | # required Mbed TLS compile time configuration from the ssl_server2 |
| 250 | # program. The command will always return a success value if the |
| 251 | # configuration is defined and the value will be printed to stdout. |
| 252 | # |
| 253 | # Note that if the configuration is not defined or is defined to nothing, |
| 254 | # the output of this function will be an empty string. |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 255 | if [ "$LIST_TESTS" -eq 0 ];then |
| 256 | ${P_SRV} "query_config=${1}" |
| 257 | else |
| 258 | echo "1" |
| 259 | fi |
| 260 | |
Hanno Becker | 7c48dd1 | 2018-08-28 16:09:22 +0100 | [diff] [blame] | 261 | } |
| 262 | |
| 263 | requires_config_value_at_least() { |
Andres Amaya Garcia | 3169dc0 | 2018-10-16 21:29:07 +0100 | [diff] [blame] | 264 | VAL="$( get_config_value_or_default "$1" )" |
| 265 | if [ -z "$VAL" ]; then |
| 266 | # Should never happen |
| 267 | echo "Mbed TLS configuration $1 is not defined" |
| 268 | exit 1 |
| 269 | elif [ "$VAL" -lt "$2" ]; then |
Hanno Becker | 5cd017f | 2018-08-24 14:40:12 +0100 | [diff] [blame] | 270 | SKIP_NEXT="YES" |
| 271 | fi |
| 272 | } |
| 273 | |
| 274 | requires_config_value_at_most() { |
Hanno Becker | 7c48dd1 | 2018-08-28 16:09:22 +0100 | [diff] [blame] | 275 | VAL=$( get_config_value_or_default "$1" ) |
Andres Amaya Garcia | 3169dc0 | 2018-10-16 21:29:07 +0100 | [diff] [blame] | 276 | if [ -z "$VAL" ]; then |
| 277 | # Should never happen |
| 278 | echo "Mbed TLS configuration $1 is not defined" |
| 279 | exit 1 |
| 280 | elif [ "$VAL" -gt "$2" ]; then |
Hanno Becker | 5cd017f | 2018-08-24 14:40:12 +0100 | [diff] [blame] | 281 | SKIP_NEXT="YES" |
| 282 | fi |
| 283 | } |
| 284 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 285 | requires_config_value_equals() { |
| 286 | VAL=$( get_config_value_or_default "$1" ) |
| 287 | if [ -z "$VAL" ]; then |
| 288 | # Should never happen |
| 289 | echo "Mbed TLS configuration $1 is not defined" |
| 290 | exit 1 |
| 291 | elif [ "$VAL" -ne "$2" ]; then |
| 292 | SKIP_NEXT="YES" |
| 293 | fi |
| 294 | } |
| 295 | |
Gilles Peskine | 4b137d1 | 2022-04-08 19:33:07 +0200 | [diff] [blame] | 296 | # Require Mbed TLS to support the given protocol version. |
| 297 | # |
| 298 | # Inputs: |
| 299 | # * $1: protocol version in mbedtls syntax (argument to force_version=) |
| 300 | requires_protocol_version() { |
| 301 | # Support for DTLS is detected separately in detect_dtls(). |
| 302 | case "$1" in |
| 303 | ssl3) requires_config_enabled MBEDTLS_SSL_PROTO_SSL3;; |
| 304 | tls1) requires_config_enabled MBEDTLS_SSL_PROTO_TLS1;; |
| 305 | tls1_1|dtls1) requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1;; |
| 306 | tls12|dtls12) requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2;; |
| 307 | *) echo "Unknown required protocol version: $1"; exit 1;; |
| 308 | esac |
| 309 | } |
| 310 | |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 311 | # Space-separated list of ciphersuites supported by this build of |
| 312 | # Mbed TLS. |
Ronald Cron | a8b474f | 2023-11-28 15:49:25 +0100 | [diff] [blame] | 313 | P_CIPHERSUITES="" |
| 314 | if [ "$LIST_TESTS" -eq 0 ]; then |
| 315 | P_CIPHERSUITES=" $($P_CLI help_ciphersuites 2>/dev/null | |
| 316 | grep 'TLS-' | |
| 317 | tr -s ' \n' ' ')" |
| 318 | |
| 319 | if [ -z "${P_CIPHERSUITES# }" ]; then |
| 320 | echo >&2 "$0: fatal error: no cipher suites found!" |
| 321 | exit 125 |
| 322 | fi |
| 323 | fi |
| 324 | |
Hanno Becker | 9d76d56 | 2018-11-16 17:27:29 +0000 | [diff] [blame] | 325 | requires_ciphersuite_enabled() { |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 326 | case $P_CIPHERSUITES in |
| 327 | *" $1 "*) :;; |
| 328 | *) SKIP_NEXT="YES";; |
| 329 | esac |
Hanno Becker | 9d76d56 | 2018-11-16 17:27:29 +0000 | [diff] [blame] | 330 | } |
| 331 | |
Gilles Peskine | 511fdf4 | 2022-04-08 19:26:26 +0200 | [diff] [blame] | 332 | # detect_required_features CMD [RUN_TEST_OPTION...] |
| 333 | # If CMD (call to a TLS client or server program) requires certain features, |
| 334 | # arrange to only run the following test case if those features are enabled. |
| 335 | detect_required_features() { |
Gilles Peskine | 0d72165 | 2020-06-26 23:35:53 +0200 | [diff] [blame] | 336 | case "$1" in |
Gilles Peskine | 4b137d1 | 2022-04-08 19:33:07 +0200 | [diff] [blame] | 337 | *\ force_version=*) |
| 338 | tmp="${1##*\ force_version=}" |
| 339 | tmp="${tmp%%[!-0-9A-Z_a-z]*}" |
| 340 | requires_protocol_version "$tmp";; |
| 341 | esac |
| 342 | |
| 343 | case "$1" in |
Gilles Peskine | 511fdf4 | 2022-04-08 19:26:26 +0200 | [diff] [blame] | 344 | *\ force_ciphersuite=*) |
| 345 | tmp="${1##*\ force_ciphersuite=}" |
| 346 | tmp="${tmp%%[!-0-9A-Z_a-z]*}" |
| 347 | case "$*" in |
| 348 | *"-s SSL - The server has no ciphersuites in common"*) |
| 349 | # This test case expects a ciphersuite mismatch, so it |
| 350 | # doesn't actually require the ciphersuite to be enabled. |
| 351 | :;; |
| 352 | *) requires_ciphersuite_enabled "$tmp";; |
| 353 | esac;; |
Gilles Peskine | 0d72165 | 2020-06-26 23:35:53 +0200 | [diff] [blame] | 354 | esac |
| 355 | |
Gilles Peskine | 3c985f6 | 2022-04-08 19:29:27 +0200 | [diff] [blame] | 356 | case " $1 " in |
| 357 | *[-_\ =]tickets=[^0]*) |
| 358 | requires_config_enabled MBEDTLS_SSL_TICKET_C;; |
| 359 | esac |
| 360 | case " $1 " in |
| 361 | *[-_\ =]alpn=*) |
| 362 | requires_config_enabled MBEDTLS_SSL_ALPN;; |
| 363 | esac |
| 364 | |
Gilles Peskine | bba3b4c | 2022-04-09 00:08:47 +0200 | [diff] [blame] | 365 | case " $1 " in |
Gilles Peskine | 6e257b0 | 2022-04-13 14:19:57 +0200 | [diff] [blame] | 366 | *\ badmac_limit=*) |
| 367 | requires_config_enabled MBEDTLS_SSL_DTLS_BADMAC_LIMIT;; |
| 368 | esac |
| 369 | |
| 370 | case " $1 " in |
Gilles Peskine | bba3b4c | 2022-04-09 00:08:47 +0200 | [diff] [blame] | 371 | *\ fallback=1\ *|*\ -fallback_scsv\ *) |
| 372 | requires_config_enabled MBEDTLS_SSL_FALLBACK_SCSV;; |
| 373 | esac |
| 374 | |
Gilles Peskine | 511fdf4 | 2022-04-08 19:26:26 +0200 | [diff] [blame] | 375 | unset tmp |
Gilles Peskine | 0d72165 | 2020-06-26 23:35:53 +0200 | [diff] [blame] | 376 | } |
| 377 | |
Gilles Peskine | 22cc649 | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 378 | requires_certificate_authentication () { |
| 379 | if [ "$PSK_ONLY" = "YES" ]; then |
| 380 | SKIP_NEXT="YES" |
| 381 | fi |
| 382 | } |
| 383 | |
Gilles Peskine | 89d892f | 2022-02-25 19:52:52 +0100 | [diff] [blame] | 384 | adapt_cmd_for_psk () { |
| 385 | case "$2" in |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 386 | *openssl*s_server*) s='-psk 73776f726466697368 -nocert';; |
| 387 | *openssl*) s='-psk 73776f726466697368';; |
| 388 | *gnutls-*) s='--pskusername=Client_identity --pskkey=73776f726466697368';; |
| 389 | *) s='psk=73776f726466697368';; |
Gilles Peskine | 89d892f | 2022-02-25 19:52:52 +0100 | [diff] [blame] | 390 | esac |
| 391 | eval $1='"$2 $s"' |
| 392 | unset s |
| 393 | } |
| 394 | |
| 395 | # maybe_adapt_for_psk [RUN_TEST_OPTION...] |
| 396 | # If running in a PSK-only build, maybe adapt the test to use a pre-shared key. |
| 397 | # |
| 398 | # If not running in a PSK-only build, do nothing. |
| 399 | # If the test looks like it doesn't use a pre-shared key but can run with a |
| 400 | # pre-shared key, pass a pre-shared key. If the test looks like it can't run |
| 401 | # with a pre-shared key, skip it. If the test looks like it's already using |
| 402 | # a pre-shared key, do nothing. |
| 403 | # |
Gilles Peskine | d5b1a30 | 2022-04-05 22:00:17 +0200 | [diff] [blame] | 404 | # This code does not consider builds with ECDHE-PSK or RSA-PSK. |
Gilles Peskine | 89d892f | 2022-02-25 19:52:52 +0100 | [diff] [blame] | 405 | # |
| 406 | # Inputs: |
| 407 | # * $CLI_CMD, $SRV_CMD, $PXY_CMD: client/server/proxy commands. |
| 408 | # * $PSK_ONLY: YES if running in a PSK-only build (no asymmetric key exchanges). |
| 409 | # * "$@": options passed to run_test. |
| 410 | # |
| 411 | # Outputs: |
| 412 | # * $CLI_CMD, $SRV_CMD: may be modified to add PSK-relevant arguments. |
| 413 | # * $SKIP_NEXT: set to YES if the test can't run with PSK. |
| 414 | maybe_adapt_for_psk() { |
| 415 | if [ "$PSK_ONLY" != "YES" ]; then |
| 416 | return |
| 417 | fi |
| 418 | if [ "$SKIP_NEXT" = "YES" ]; then |
| 419 | return |
| 420 | fi |
| 421 | case "$CLI_CMD $SRV_CMD" in |
| 422 | *[-_\ =]psk*|*[-_\ =]PSK*) |
| 423 | return;; |
| 424 | *force_ciphersuite*) |
| 425 | # The test case forces a non-PSK cipher suite. In some cases, a |
| 426 | # PSK cipher suite could be substituted, but we're not ready for |
| 427 | # that yet. |
| 428 | SKIP_NEXT="YES" |
| 429 | return;; |
| 430 | *\ auth_mode=*|*[-_\ =]crt[_=]*) |
| 431 | # The test case involves certificates. PSK won't do. |
| 432 | SKIP_NEXT="YES" |
| 433 | return;; |
| 434 | esac |
| 435 | adapt_cmd_for_psk CLI_CMD "$CLI_CMD" |
| 436 | adapt_cmd_for_psk SRV_CMD "$SRV_CMD" |
| 437 | } |
| 438 | |
| 439 | case " $CONFIGS_ENABLED " in |
| 440 | *\ MBEDTLS_KEY_EXCHANGE_[^P]*) PSK_ONLY="NO";; |
| 441 | *\ MBEDTLS_KEY_EXCHANGE_P[^S]*) PSK_ONLY="NO";; |
| 442 | *\ MBEDTLS_KEY_EXCHANGE_PS[^K]*) PSK_ONLY="NO";; |
| 443 | *\ MBEDTLS_KEY_EXCHANGE_PSK[^_]*) PSK_ONLY="NO";; |
| 444 | *\ MBEDTLS_KEY_EXCHANGE_PSK_ENABLED\ *) PSK_ONLY="YES";; |
| 445 | *) PSK_ONLY="NO";; |
| 446 | esac |
| 447 | |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 448 | # skip next test if OpenSSL doesn't support FALLBACK_SCSV |
| 449 | requires_openssl_with_fallback_scsv() { |
| 450 | if [ -z "${OPENSSL_HAS_FBSCSV:-}" ]; then |
Manuel Pégourié-Gonnard | 89d4027 | 2022-12-19 11:42:12 +0100 | [diff] [blame] | 451 | if $OPENSSL s_client -help 2>&1 | grep fallback_scsv >/dev/null |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 452 | then |
| 453 | OPENSSL_HAS_FBSCSV="YES" |
| 454 | else |
| 455 | OPENSSL_HAS_FBSCSV="NO" |
| 456 | fi |
| 457 | fi |
| 458 | if [ "$OPENSSL_HAS_FBSCSV" = "NO" ]; then |
| 459 | SKIP_NEXT="YES" |
| 460 | fi |
| 461 | } |
| 462 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 463 | # skip next test if either IN_CONTENT_LEN or MAX_CONTENT_LEN are below a value |
| 464 | requires_max_content_len() { |
| 465 | requires_config_value_at_least "MBEDTLS_SSL_IN_CONTENT_LEN" $1 |
| 466 | requires_config_value_at_least "MBEDTLS_SSL_OUT_CONTENT_LEN" $1 |
| 467 | } |
| 468 | |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 469 | # skip next test if GnuTLS isn't available |
| 470 | requires_gnutls() { |
| 471 | if [ -z "${GNUTLS_AVAILABLE:-}" ]; then |
Manuel Pégourié-Gonnard | 03db6b0 | 2015-06-26 15:45:30 +0200 | [diff] [blame] | 472 | if ( which "$GNUTLS_CLI" && which "$GNUTLS_SERV" ) >/dev/null 2>&1; then |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 473 | GNUTLS_AVAILABLE="YES" |
| 474 | else |
| 475 | GNUTLS_AVAILABLE="NO" |
| 476 | fi |
| 477 | fi |
| 478 | if [ "$GNUTLS_AVAILABLE" = "NO" ]; then |
| 479 | SKIP_NEXT="YES" |
| 480 | fi |
| 481 | } |
| 482 | |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 483 | # skip next test if GnuTLS-next isn't available |
| 484 | requires_gnutls_next() { |
| 485 | if [ -z "${GNUTLS_NEXT_AVAILABLE:-}" ]; then |
| 486 | if ( which "${GNUTLS_NEXT_CLI:-}" && which "${GNUTLS_NEXT_SERV:-}" ) >/dev/null 2>&1; then |
| 487 | GNUTLS_NEXT_AVAILABLE="YES" |
| 488 | else |
| 489 | GNUTLS_NEXT_AVAILABLE="NO" |
| 490 | fi |
| 491 | fi |
| 492 | if [ "$GNUTLS_NEXT_AVAILABLE" = "NO" ]; then |
| 493 | SKIP_NEXT="YES" |
| 494 | fi |
| 495 | } |
| 496 | |
Paul Elliott | 633a74e | 2021-10-13 18:31:07 +0100 | [diff] [blame] | 497 | requires_openssl_next() { |
| 498 | if [ -z "${OPENSSL_NEXT_AVAILABLE:-}" ]; then |
| 499 | if which "${OPENSSL_NEXT:-}" >/dev/null 2>&1; then |
| 500 | OPENSSL_NEXT_AVAILABLE="YES" |
| 501 | else |
| 502 | OPENSSL_NEXT_AVAILABLE="NO" |
| 503 | fi |
| 504 | fi |
| 505 | if [ "$OPENSSL_NEXT_AVAILABLE" = "NO" ]; then |
| 506 | SKIP_NEXT="YES" |
| 507 | fi |
| 508 | } |
| 509 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 510 | # skip next test if IPv6 isn't available on this host |
| 511 | requires_ipv6() { |
| 512 | if [ -z "${HAS_IPV6:-}" ]; then |
| 513 | $P_SRV server_addr='::1' > $SRV_OUT 2>&1 & |
| 514 | SRV_PID=$! |
| 515 | sleep 1 |
| 516 | kill $SRV_PID >/dev/null 2>&1 |
| 517 | if grep "NET - Binding of the socket failed" $SRV_OUT >/dev/null; then |
| 518 | HAS_IPV6="NO" |
| 519 | else |
| 520 | HAS_IPV6="YES" |
| 521 | fi |
| 522 | rm -r $SRV_OUT |
| 523 | fi |
| 524 | |
| 525 | if [ "$HAS_IPV6" = "NO" ]; then |
| 526 | SKIP_NEXT="YES" |
| 527 | fi |
| 528 | } |
| 529 | |
Andrzej Kurek | b459346 | 2018-10-11 08:43:30 -0400 | [diff] [blame] | 530 | # skip next test if it's i686 or uname is not available |
| 531 | requires_not_i686() { |
| 532 | if [ -z "${IS_I686:-}" ]; then |
| 533 | IS_I686="YES" |
| 534 | if which "uname" >/dev/null 2>&1; then |
| 535 | if [ -z "$(uname -a | grep i686)" ]; then |
| 536 | IS_I686="NO" |
| 537 | fi |
| 538 | fi |
| 539 | fi |
| 540 | if [ "$IS_I686" = "YES" ]; then |
| 541 | SKIP_NEXT="YES" |
| 542 | fi |
| 543 | } |
| 544 | |
Yuto Takano | ab9e4333 | 2021-06-22 07:16:40 +0100 | [diff] [blame] | 545 | MAX_CONTENT_LEN=$( get_config_value_or_default "MBEDTLS_SSL_MAX_CONTENT_LEN" ) |
| 546 | MAX_IN_LEN=$( get_config_value_or_default "MBEDTLS_SSL_IN_CONTENT_LEN" ) |
| 547 | MAX_OUT_LEN=$( get_config_value_or_default "MBEDTLS_SSL_OUT_CONTENT_LEN" ) |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 548 | if [ "$LIST_TESTS" -eq 0 ];then |
| 549 | # Calculate the input & output maximum content lengths set in the config |
| 550 | if [ "$MAX_IN_LEN" -lt "$MAX_CONTENT_LEN" ]; then |
| 551 | MAX_CONTENT_LEN="$MAX_IN_LEN" |
| 552 | fi |
| 553 | if [ "$MAX_OUT_LEN" -lt "$MAX_CONTENT_LEN" ]; then |
| 554 | MAX_CONTENT_LEN="$MAX_OUT_LEN" |
| 555 | fi |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 556 | fi |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 557 | # skip the next test if the SSL output buffer is less than 16KB |
| 558 | requires_full_size_output_buffer() { |
| 559 | if [ "$MAX_OUT_LEN" -ne 16384 ]; then |
| 560 | SKIP_NEXT="YES" |
| 561 | fi |
| 562 | } |
| 563 | |
Manuel Pégourié-Gonnard | 76fe9e4 | 2014-09-24 15:17:31 +0200 | [diff] [blame] | 564 | # skip the next test if valgrind is in use |
| 565 | not_with_valgrind() { |
| 566 | if [ "$MEMCHECK" -gt 0 ]; then |
| 567 | SKIP_NEXT="YES" |
| 568 | fi |
| 569 | } |
| 570 | |
Paul Bakker | 362689d | 2016-05-13 10:33:25 +0100 | [diff] [blame] | 571 | # skip the next test if valgrind is NOT in use |
| 572 | only_with_valgrind() { |
| 573 | if [ "$MEMCHECK" -eq 0 ]; then |
| 574 | SKIP_NEXT="YES" |
| 575 | fi |
| 576 | } |
| 577 | |
Manuel Pégourié-Gonnard | a071972 | 2014-09-20 12:46:27 +0200 | [diff] [blame] | 578 | # multiply the client timeout delay by the given factor for the next test |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 579 | client_needs_more_time() { |
Manuel Pégourié-Gonnard | a071972 | 2014-09-20 12:46:27 +0200 | [diff] [blame] | 580 | CLI_DELAY_FACTOR=$1 |
| 581 | } |
| 582 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 583 | # wait for the given seconds after the client finished in the next test |
| 584 | server_needs_more_time() { |
| 585 | SRV_DELAY_SECONDS=$1 |
| 586 | } |
| 587 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 588 | # print_name <name> |
| 589 | print_name() { |
Paul Bakker | e20310a | 2016-05-10 11:18:17 +0100 | [diff] [blame] | 590 | TESTS=$(( $TESTS + 1 )) |
| 591 | LINE="" |
| 592 | |
| 593 | if [ "$SHOW_TEST_NUMBER" -gt 0 ]; then |
| 594 | LINE="$TESTS " |
| 595 | fi |
| 596 | |
| 597 | LINE="$LINE$1" |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 598 | |
Gilles Peskine | 231befa | 2020-08-26 20:05:11 +0200 | [diff] [blame] | 599 | printf "%s " "$LINE" |
Paul Bakker | e20310a | 2016-05-10 11:18:17 +0100 | [diff] [blame] | 600 | LEN=$(( 72 - `echo "$LINE" | wc -c` )) |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 601 | for i in `seq 1 $LEN`; do printf '.'; done |
| 602 | printf ' ' |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 603 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 604 | } |
| 605 | |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 606 | # record_outcome <outcome> [<failure-reason>] |
| 607 | # The test name must be in $NAME. |
| 608 | record_outcome() { |
| 609 | echo "$1" |
| 610 | if [ -n "$MBEDTLS_TEST_OUTCOME_FILE" ]; then |
| 611 | printf '%s;%s;%s;%s;%s;%s\n' \ |
| 612 | "$MBEDTLS_TEST_PLATFORM" "$MBEDTLS_TEST_CONFIGURATION" \ |
| 613 | "ssl-opt" "$NAME" \ |
| 614 | "$1" "${2-}" \ |
| 615 | >>"$MBEDTLS_TEST_OUTCOME_FILE" |
| 616 | fi |
| 617 | } |
| 618 | |
Gilles Peskine | aa1d6ad | 2021-10-20 14:17:02 +0200 | [diff] [blame] | 619 | # True if the presence of the given pattern in a log definitely indicates |
| 620 | # that the test has failed. False if the presence is inconclusive. |
| 621 | # |
| 622 | # Inputs: |
| 623 | # * $1: pattern found in the logs |
| 624 | # * $TIMES_LEFT: >0 if retrying is an option |
| 625 | # |
| 626 | # Outputs: |
| 627 | # * $outcome: set to a retry reason if the pattern is inconclusive, |
| 628 | # unchanged otherwise. |
| 629 | # * Return value: 1 if the pattern is inconclusive, |
| 630 | # 0 if the failure is definitive. |
| 631 | log_pattern_presence_is_conclusive() { |
| 632 | # If we've run out of attempts, then don't retry no matter what. |
| 633 | if [ $TIMES_LEFT -eq 0 ]; then |
| 634 | return 0 |
| 635 | fi |
| 636 | case $1 in |
| 637 | "resend") |
| 638 | # An undesired resend may have been caused by the OS dropping or |
| 639 | # delaying a packet at an inopportune time. |
| 640 | outcome="RETRY(resend)" |
| 641 | return 1;; |
| 642 | esac |
| 643 | } |
| 644 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 645 | # fail <message> |
| 646 | fail() { |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 647 | record_outcome "FAIL" "$1" |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 648 | echo " ! $1" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 649 | |
Manuel Pégourié-Gonnard | c2b0092 | 2014-08-31 16:46:04 +0200 | [diff] [blame] | 650 | mv $SRV_OUT o-srv-${TESTS}.log |
| 651 | mv $CLI_OUT o-cli-${TESTS}.log |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 652 | if [ -n "$PXY_CMD" ]; then |
| 653 | mv $PXY_OUT o-pxy-${TESTS}.log |
| 654 | fi |
| 655 | echo " ! outputs saved to o-XXX-${TESTS}.log" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 656 | |
Manuel Pégourié-Gonnard | 3f3302f | 2020-06-08 11:49:05 +0200 | [diff] [blame] | 657 | if [ "${LOG_FAILURE_ON_STDOUT:-0}" != 0 ]; then |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 658 | echo " ! server output:" |
| 659 | cat o-srv-${TESTS}.log |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 660 | echo " ! ========================================================" |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 661 | echo " ! client output:" |
| 662 | cat o-cli-${TESTS}.log |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 663 | if [ -n "$PXY_CMD" ]; then |
| 664 | echo " ! ========================================================" |
| 665 | echo " ! proxy output:" |
| 666 | cat o-pxy-${TESTS}.log |
| 667 | fi |
| 668 | echo "" |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 669 | fi |
| 670 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 671 | FAILS=$(( $FAILS + 1 )) |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 672 | } |
| 673 | |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 674 | # is_polar <cmd_line> |
| 675 | is_polar() { |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 676 | case "$1" in |
| 677 | *ssl_client2*) true;; |
| 678 | *ssl_server2*) true;; |
| 679 | *) false;; |
| 680 | esac |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 681 | } |
| 682 | |
Manuel Pégourié-Gonnard | fa60f12 | 2014-09-26 16:07:29 +0200 | [diff] [blame] | 683 | # openssl s_server doesn't have -www with DTLS |
| 684 | check_osrv_dtls() { |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 685 | case "$SRV_CMD" in |
| 686 | *s_server*-dtls*) |
| 687 | NEEDS_INPUT=1 |
| 688 | SRV_CMD="$( echo $SRV_CMD | sed s/-www// )";; |
| 689 | *) NEEDS_INPUT=0;; |
| 690 | esac |
Manuel Pégourié-Gonnard | fa60f12 | 2014-09-26 16:07:29 +0200 | [diff] [blame] | 691 | } |
| 692 | |
| 693 | # provide input to commands that need it |
| 694 | provide_input() { |
| 695 | if [ $NEEDS_INPUT -eq 0 ]; then |
| 696 | return |
| 697 | fi |
| 698 | |
| 699 | while true; do |
| 700 | echo "HTTP/1.0 200 OK" |
| 701 | sleep 1 |
| 702 | done |
| 703 | } |
| 704 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 705 | # has_mem_err <log_file_name> |
| 706 | has_mem_err() { |
| 707 | if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" && |
| 708 | grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null |
| 709 | then |
| 710 | return 1 # false: does not have errors |
| 711 | else |
| 712 | return 0 # true: has errors |
| 713 | fi |
| 714 | } |
| 715 | |
Unknown | d364f4c | 2019-09-02 10:42:57 -0400 | [diff] [blame] | 716 | # Wait for process $2 named $3 to be listening on port $1. Print error to $4. |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 717 | if type lsof >/dev/null 2>/dev/null; then |
Unknown | d364f4c | 2019-09-02 10:42:57 -0400 | [diff] [blame] | 718 | wait_app_start() { |
Paul Elliott | ce77738 | 2021-10-20 15:59:33 +0100 | [diff] [blame] | 719 | newline=' |
| 720 | ' |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 721 | START_TIME=$(date +%s) |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 722 | if [ "$DTLS" -eq 1 ]; then |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 723 | proto=UDP |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 724 | else |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 725 | proto=TCP |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 726 | fi |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 727 | # Make a tight loop, server normally takes less than 1s to start. |
Paul Elliott | 6cd97ce | 2021-10-19 17:56:39 +0100 | [diff] [blame] | 728 | while true; do |
Gilles Peskine | 36019d5 | 2022-04-15 22:53:18 +0200 | [diff] [blame] | 729 | SERVER_PIDS=$(lsof -a -n -b -i "$proto:$1" -t) |
Paul Elliott | ce77738 | 2021-10-20 15:59:33 +0100 | [diff] [blame] | 730 | # When we use a proxy, it will be listening on the same port we |
| 731 | # are checking for as well as the server and lsof will list both. |
Paul Elliott | ce77738 | 2021-10-20 15:59:33 +0100 | [diff] [blame] | 732 | case ${newline}${SERVER_PIDS}${newline} in |
Gilles Peskine | 36019d5 | 2022-04-15 22:53:18 +0200 | [diff] [blame] | 733 | *${newline}${2}${newline}*) break;; |
Paul Elliott | ce77738 | 2021-10-20 15:59:33 +0100 | [diff] [blame] | 734 | esac |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 735 | if [ $(( $(date +%s) - $START_TIME )) -gt $DOG_DELAY ]; then |
Unknown | d364f4c | 2019-09-02 10:42:57 -0400 | [diff] [blame] | 736 | echo "$3 START TIMEOUT" |
| 737 | echo "$3 START TIMEOUT" >> $4 |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 738 | break |
| 739 | fi |
| 740 | # Linux and *BSD support decimal arguments to sleep. On other |
| 741 | # OSes this may be a tight loop. |
| 742 | sleep 0.1 2>/dev/null || true |
| 743 | done |
| 744 | } |
| 745 | else |
Unknown | d364f4c | 2019-09-02 10:42:57 -0400 | [diff] [blame] | 746 | echo "Warning: lsof not available, wait_app_start = sleep" |
| 747 | wait_app_start() { |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 748 | sleep "$START_DELAY" |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 749 | } |
| 750 | fi |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 751 | |
Unknown | d364f4c | 2019-09-02 10:42:57 -0400 | [diff] [blame] | 752 | # Wait for server process $2 to be listening on port $1. |
| 753 | wait_server_start() { |
| 754 | wait_app_start $1 $2 "SERVER" $SRV_OUT |
| 755 | } |
| 756 | |
| 757 | # Wait for proxy process $2 to be listening on port $1. |
| 758 | wait_proxy_start() { |
| 759 | wait_app_start $1 $2 "PROXY" $PXY_OUT |
| 760 | } |
| 761 | |
Andres Amaya Garcia | b84c40b | 2017-09-06 15:44:01 +0100 | [diff] [blame] | 762 | # Given the client or server debug output, parse the unix timestamp that is |
Andres Amaya Garcia | 3b1bdff | 2017-09-14 12:41:29 +0100 | [diff] [blame] | 763 | # included in the first 4 bytes of the random bytes and check that it's within |
Andres Amaya Garcia | b84c40b | 2017-09-06 15:44:01 +0100 | [diff] [blame] | 764 | # acceptable bounds |
| 765 | check_server_hello_time() { |
| 766 | # Extract the time from the debug (lvl 3) output of the client |
Andres Amaya Garcia | 67d8da5 | 2017-09-15 15:49:24 +0100 | [diff] [blame] | 767 | SERVER_HELLO_TIME="$(sed -n 's/.*server hello, current time: //p' < "$1")" |
Andres Amaya Garcia | b84c40b | 2017-09-06 15:44:01 +0100 | [diff] [blame] | 768 | # Get the Unix timestamp for now |
| 769 | CUR_TIME=$(date +'%s') |
| 770 | THRESHOLD_IN_SECS=300 |
| 771 | |
| 772 | # Check if the ServerHello time was printed |
| 773 | if [ -z "$SERVER_HELLO_TIME" ]; then |
| 774 | return 1 |
| 775 | fi |
| 776 | |
| 777 | # Check the time in ServerHello is within acceptable bounds |
| 778 | if [ $SERVER_HELLO_TIME -lt $(( $CUR_TIME - $THRESHOLD_IN_SECS )) ]; then |
| 779 | # The time in ServerHello is at least 5 minutes before now |
| 780 | return 1 |
| 781 | elif [ $SERVER_HELLO_TIME -gt $(( $CUR_TIME + $THRESHOLD_IN_SECS )) ]; then |
Andres Amaya Garcia | 3b1bdff | 2017-09-14 12:41:29 +0100 | [diff] [blame] | 782 | # The time in ServerHello is at least 5 minutes later than now |
Andres Amaya Garcia | b84c40b | 2017-09-06 15:44:01 +0100 | [diff] [blame] | 783 | return 1 |
| 784 | else |
| 785 | return 0 |
| 786 | fi |
| 787 | } |
| 788 | |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 789 | # Get handshake memory usage from server or client output and put it into the variable specified by the first argument |
| 790 | handshake_memory_get() { |
| 791 | OUTPUT_VARIABLE="$1" |
| 792 | OUTPUT_FILE="$2" |
| 793 | |
| 794 | # Get memory usage from a pattern like "Heap memory usage after handshake: 23112 bytes. Peak memory usage was 33112" |
| 795 | MEM_USAGE=$(sed -n 's/.*Heap memory usage after handshake: //p' < "$OUTPUT_FILE" | grep -o "[0-9]*" | head -1) |
| 796 | |
| 797 | # Check if memory usage was read |
| 798 | if [ -z "$MEM_USAGE" ]; then |
| 799 | echo "Error: Can not read the value of handshake memory usage" |
| 800 | return 1 |
| 801 | else |
| 802 | eval "$OUTPUT_VARIABLE=$MEM_USAGE" |
| 803 | return 0 |
| 804 | fi |
| 805 | } |
| 806 | |
| 807 | # Get handshake memory usage from server or client output and check if this value |
| 808 | # is not higher than the maximum given by the first argument |
| 809 | handshake_memory_check() { |
| 810 | MAX_MEMORY="$1" |
| 811 | OUTPUT_FILE="$2" |
| 812 | |
| 813 | # Get memory usage |
| 814 | if ! handshake_memory_get "MEMORY_USAGE" "$OUTPUT_FILE"; then |
| 815 | return 1 |
| 816 | fi |
| 817 | |
| 818 | # Check if memory usage is below max value |
| 819 | if [ "$MEMORY_USAGE" -gt "$MAX_MEMORY" ]; then |
| 820 | echo "\nFailed: Handshake memory usage was $MEMORY_USAGE bytes," \ |
| 821 | "but should be below $MAX_MEMORY bytes" |
| 822 | return 1 |
| 823 | else |
| 824 | return 0 |
| 825 | fi |
| 826 | } |
| 827 | |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 828 | # wait for client to terminate and set CLI_EXIT |
| 829 | # must be called right after starting the client |
| 830 | wait_client_done() { |
| 831 | CLI_PID=$! |
| 832 | |
Manuel Pégourié-Gonnard | a071972 | 2014-09-20 12:46:27 +0200 | [diff] [blame] | 833 | CLI_DELAY=$(( $DOG_DELAY * $CLI_DELAY_FACTOR )) |
| 834 | CLI_DELAY_FACTOR=1 |
| 835 | |
Manuel Pégourié-Gonnard | a365add | 2015-08-04 20:57:59 +0200 | [diff] [blame] | 836 | ( sleep $CLI_DELAY; echo "===CLIENT_TIMEOUT===" >> $CLI_OUT; kill $CLI_PID ) & |
Manuel Pégourié-Gonnard | a6189f0 | 2014-09-20 13:15:43 +0200 | [diff] [blame] | 837 | DOG_PID=$! |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 838 | |
| 839 | wait $CLI_PID |
| 840 | CLI_EXIT=$? |
| 841 | |
Manuel Pégourié-Gonnard | a6189f0 | 2014-09-20 13:15:43 +0200 | [diff] [blame] | 842 | kill $DOG_PID >/dev/null 2>&1 |
| 843 | wait $DOG_PID |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 844 | |
| 845 | echo "EXIT: $CLI_EXIT" >> $CLI_OUT |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 846 | |
| 847 | sleep $SRV_DELAY_SECONDS |
| 848 | SRV_DELAY_SECONDS=0 |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 849 | } |
| 850 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 851 | # check if the given command uses dtls and sets global variable DTLS |
| 852 | detect_dtls() { |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 853 | case "$1" in |
Paul Elliott | 405fccc | 2021-10-12 16:02:55 +0100 | [diff] [blame] | 854 | *dtls=1*|*-dtls*|*-u*) DTLS=1;; |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 855 | *) DTLS=0;; |
| 856 | esac |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 857 | } |
| 858 | |
Dave Rodgman | 0279c2f | 2021-02-10 12:45:41 +0000 | [diff] [blame] | 859 | # check if the given command uses gnutls and sets global variable CMD_IS_GNUTLS |
| 860 | is_gnutls() { |
| 861 | case "$1" in |
| 862 | *gnutls-cli*) |
| 863 | CMD_IS_GNUTLS=1 |
| 864 | ;; |
| 865 | *gnutls-serv*) |
| 866 | CMD_IS_GNUTLS=1 |
| 867 | ;; |
| 868 | *) |
| 869 | CMD_IS_GNUTLS=0 |
| 870 | ;; |
| 871 | esac |
| 872 | } |
| 873 | |
Gilles Peskine | 64c683f | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 874 | # Determine what calc_verify trace is to be expected, if any. |
| 875 | # |
| 876 | # calc_verify is only called for two things: to calculate the |
| 877 | # extended master secret, and to process client authentication. |
| 878 | # |
| 879 | # Warning: the current implementation assumes that extended_ms is not |
| 880 | # disabled on the client or on the server. |
| 881 | # |
| 882 | # Inputs: |
Gilles Peskine | f2e1f47 | 2022-04-06 22:23:45 +0200 | [diff] [blame] | 883 | # * $1: the value of the server auth_mode parameter. |
| 884 | # 'required' if client authentication is expected, |
| 885 | # 'none' or absent if not. |
Gilles Peskine | 64c683f | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 886 | # * $CONFIGS_ENABLED |
| 887 | # |
| 888 | # Outputs: |
| 889 | # * $maybe_calc_verify: set to a trace expected in the debug logs |
| 890 | set_maybe_calc_verify() { |
| 891 | maybe_calc_verify= |
| 892 | case $CONFIGS_ENABLED in |
| 893 | *\ MBEDTLS_SSL_EXTENDED_MASTER_SECRET\ *) :;; |
| 894 | *) |
| 895 | case ${1-} in |
Gilles Peskine | f2e1f47 | 2022-04-06 22:23:45 +0200 | [diff] [blame] | 896 | ''|none) return;; |
| 897 | required) :;; |
Gilles Peskine | 64c683f | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 898 | *) echo "Bad parameter 1 to set_maybe_calc_verify: $1"; exit 1;; |
| 899 | esac |
| 900 | esac |
| 901 | case $CONFIGS_ENABLED in |
| 902 | *\ MBEDTLS_USE_PSA_CRYPTO\ *) maybe_calc_verify="PSA calc verify";; |
| 903 | *) maybe_calc_verify="<= calc verify";; |
| 904 | esac |
| 905 | } |
| 906 | |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 907 | # Compare file content |
| 908 | # Usage: find_in_both pattern file1 file2 |
| 909 | # extract from file1 the first line matching the pattern |
| 910 | # check in file2 that the same line can be found |
| 911 | find_in_both() { |
| 912 | srv_pattern=$(grep -m 1 "$1" "$2"); |
| 913 | if [ -z "$srv_pattern" ]; then |
| 914 | return 1; |
| 915 | fi |
| 916 | |
| 917 | if grep "$srv_pattern" $3 >/dev/null; then : |
Johan Pascal | 1040315 | 2020-10-09 20:43:51 +0200 | [diff] [blame] | 918 | return 0; |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 919 | else |
| 920 | return 1; |
| 921 | fi |
| 922 | } |
| 923 | |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 924 | # Analyze the commands that will be used in a test. |
| 925 | # |
| 926 | # Analyze and possibly instrument $PXY_CMD, $CLI_CMD, $SRV_CMD to pass |
| 927 | # extra arguments or go through wrappers. |
Gilles Peskine | d5b1a30 | 2022-04-05 22:00:17 +0200 | [diff] [blame] | 928 | # |
| 929 | # Inputs: |
| 930 | # * $@: supplemental options to run_test() (after the mandatory arguments). |
| 931 | # * $CLI_CMD, $PXY_CMD, $SRV_CMD: the client, proxy and server commands. |
| 932 | # * $DTLS: 1 if DTLS, otherwise 0. |
| 933 | # |
| 934 | # Outputs: |
| 935 | # * $CLI_CMD, $PXY_CMD, $SRV_CMD: may be tweaked. |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 936 | analyze_test_commands() { |
Manuel Pégourié-Gonnard | f455786 | 2020-06-08 11:40:06 +0200 | [diff] [blame] | 937 | # if the test uses DTLS but no custom proxy, add a simple proxy |
| 938 | # as it provides timing info that's useful to debug failures |
Manuel Pégourié-Gonnard | 70fce98 | 2020-06-25 09:54:46 +0200 | [diff] [blame] | 939 | if [ -z "$PXY_CMD" ] && [ "$DTLS" -eq 1 ]; then |
Manuel Pégourié-Gonnard | f455786 | 2020-06-08 11:40:06 +0200 | [diff] [blame] | 940 | PXY_CMD="$P_PXY" |
Manuel Pégourié-Gonnard | 8779e9a | 2020-07-16 10:19:32 +0200 | [diff] [blame] | 941 | case " $SRV_CMD " in |
| 942 | *' server_addr=::1 '*) |
| 943 | PXY_CMD="$PXY_CMD server_addr=::1 listen_addr=::1";; |
| 944 | esac |
Manuel Pégourié-Gonnard | f455786 | 2020-06-08 11:40:06 +0200 | [diff] [blame] | 945 | fi |
| 946 | |
Dave Rodgman | 0279c2f | 2021-02-10 12:45:41 +0000 | [diff] [blame] | 947 | # update CMD_IS_GNUTLS variable |
| 948 | is_gnutls "$SRV_CMD" |
| 949 | |
| 950 | # if the server uses gnutls but doesn't set priority, explicitly |
| 951 | # set the default priority |
| 952 | if [ "$CMD_IS_GNUTLS" -eq 1 ]; then |
| 953 | case "$SRV_CMD" in |
| 954 | *--priority*) :;; |
| 955 | *) SRV_CMD="$SRV_CMD --priority=NORMAL";; |
| 956 | esac |
| 957 | fi |
| 958 | |
| 959 | # update CMD_IS_GNUTLS variable |
| 960 | is_gnutls "$CLI_CMD" |
| 961 | |
| 962 | # if the client uses gnutls but doesn't set priority, explicitly |
| 963 | # set the default priority |
| 964 | if [ "$CMD_IS_GNUTLS" -eq 1 ]; then |
| 965 | case "$CLI_CMD" in |
| 966 | *--priority*) :;; |
| 967 | *) CLI_CMD="$CLI_CMD --priority=NORMAL";; |
| 968 | esac |
| 969 | fi |
| 970 | |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 971 | # fix client port |
| 972 | if [ -n "$PXY_CMD" ]; then |
| 973 | CLI_CMD=$( echo "$CLI_CMD" | sed s/+SRV_PORT/$PXY_PORT/g ) |
| 974 | else |
| 975 | CLI_CMD=$( echo "$CLI_CMD" | sed s/+SRV_PORT/$SRV_PORT/g ) |
| 976 | fi |
| 977 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 978 | # prepend valgrind to our commands if active |
| 979 | if [ "$MEMCHECK" -gt 0 ]; then |
| 980 | if is_polar "$SRV_CMD"; then |
| 981 | SRV_CMD="valgrind --leak-check=full $SRV_CMD" |
| 982 | fi |
| 983 | if is_polar "$CLI_CMD"; then |
| 984 | CLI_CMD="valgrind --leak-check=full $CLI_CMD" |
| 985 | fi |
| 986 | fi |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 987 | } |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 988 | |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 989 | # Check for failure conditions after a test case. |
| 990 | # |
| 991 | # Inputs from run_test: |
| 992 | # * positional parameters: test options (see run_test documentation) |
| 993 | # * $CLI_EXIT: client return code |
| 994 | # * $CLI_EXPECT: expected client return code |
| 995 | # * $SRV_RET: server return code |
| 996 | # * $CLI_OUT, $SRV_OUT, $PXY_OUT: files containing client/server/proxy logs |
Gilles Peskine | a28fd41 | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 997 | # * $TIMES_LEFT: if nonzero, a RETRY outcome is allowed |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 998 | # |
| 999 | # Outputs: |
Gilles Peskine | 2d3c9f8 | 2021-10-19 18:00:10 +0200 | [diff] [blame] | 1000 | # * $outcome: one of PASS/RETRY*/FAIL |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1001 | check_test_failure() { |
Gilles Peskine | a28fd41 | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1002 | outcome=FAIL |
Manuel Pégourié-Gonnard | a365add | 2015-08-04 20:57:59 +0200 | [diff] [blame] | 1003 | |
Gilles Peskine | a28fd41 | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1004 | if [ $TIMES_LEFT -gt 0 ] && |
| 1005 | grep '===CLIENT_TIMEOUT===' $CLI_OUT >/dev/null |
| 1006 | then |
Gilles Peskine | 2d3c9f8 | 2021-10-19 18:00:10 +0200 | [diff] [blame] | 1007 | outcome="RETRY(client-timeout)" |
Gilles Peskine | a28fd41 | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1008 | return |
| 1009 | fi |
Manuel Pégourié-Gonnard | a365add | 2015-08-04 20:57:59 +0200 | [diff] [blame] | 1010 | |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 1011 | # check if the client and server went at least to the handshake stage |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 1012 | # (useful to avoid tests with only negative assertions and non-zero |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 1013 | # expected client exit to incorrectly succeed in case of catastrophic |
| 1014 | # failure) |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 1015 | if is_polar "$SRV_CMD"; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1016 | if grep "Performing the SSL/TLS handshake" $SRV_OUT >/dev/null; then :; |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 1017 | else |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1018 | fail "server or client failed to reach handshake stage" |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 1019 | return |
| 1020 | fi |
| 1021 | fi |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 1022 | if is_polar "$CLI_CMD"; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1023 | if grep "Performing the SSL/TLS handshake" $CLI_OUT >/dev/null; then :; |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 1024 | else |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1025 | fail "server or client failed to reach handshake stage" |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 1026 | return |
| 1027 | fi |
| 1028 | fi |
| 1029 | |
Gilles Peskine | aaf866e | 2021-02-09 21:01:33 +0100 | [diff] [blame] | 1030 | # Check server exit code (only for Mbed TLS: GnuTLS and OpenSSL don't |
| 1031 | # exit with status 0 when interrupted by a signal, and we don't really |
| 1032 | # care anyway), in case e.g. the server reports a memory leak. |
| 1033 | if [ $SRV_RET != 0 ] && is_polar "$SRV_CMD"; then |
Gilles Peskine | 7f919de | 2021-02-02 23:29:03 +0100 | [diff] [blame] | 1034 | fail "Server exited with status $SRV_RET" |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 1035 | return |
| 1036 | fi |
| 1037 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1038 | # check client exit code |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 1039 | if [ \( "$CLI_EXPECT" = 0 -a "$CLI_EXIT" != 0 \) -o \ |
| 1040 | \( "$CLI_EXPECT" != 0 -a "$CLI_EXIT" = 0 \) ] |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1041 | then |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 1042 | fail "bad client exit code (expected $CLI_EXPECT, got $CLI_EXIT)" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1043 | return |
| 1044 | fi |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1045 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1046 | # check other assertions |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 1047 | # lines beginning with == are added by valgrind, ignore them |
Paul Bakker | 1f65092 | 2016-05-13 10:16:46 +0100 | [diff] [blame] | 1048 | # lines with 'Serious error when reading debug info', are valgrind issues as well |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1049 | while [ $# -gt 0 ] |
| 1050 | do |
| 1051 | case $1 in |
| 1052 | "-s") |
Paul Bakker | 1f65092 | 2016-05-13 10:16:46 +0100 | [diff] [blame] | 1053 | if grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then :; else |
Simon Butcher | 8e00410 | 2016-10-14 00:48:33 +0100 | [diff] [blame] | 1054 | fail "pattern '$2' MUST be present in the Server output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1055 | return |
| 1056 | fi |
| 1057 | ;; |
| 1058 | |
| 1059 | "-c") |
Paul Bakker | 1f65092 | 2016-05-13 10:16:46 +0100 | [diff] [blame] | 1060 | if grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then :; else |
Simon Butcher | 8e00410 | 2016-10-14 00:48:33 +0100 | [diff] [blame] | 1061 | fail "pattern '$2' MUST be present in the Client output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1062 | return |
| 1063 | fi |
| 1064 | ;; |
| 1065 | |
| 1066 | "-S") |
Paul Bakker | 1f65092 | 2016-05-13 10:16:46 +0100 | [diff] [blame] | 1067 | if grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then |
Gilles Peskine | aa1d6ad | 2021-10-20 14:17:02 +0200 | [diff] [blame] | 1068 | if log_pattern_presence_is_conclusive "$2"; then |
Gilles Peskine | 2d3c9f8 | 2021-10-19 18:00:10 +0200 | [diff] [blame] | 1069 | fail "pattern '$2' MUST NOT be present in the Server output" |
| 1070 | fi |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1071 | return |
| 1072 | fi |
| 1073 | ;; |
| 1074 | |
| 1075 | "-C") |
Paul Bakker | 1f65092 | 2016-05-13 10:16:46 +0100 | [diff] [blame] | 1076 | if grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then |
Gilles Peskine | aa1d6ad | 2021-10-20 14:17:02 +0200 | [diff] [blame] | 1077 | if log_pattern_presence_is_conclusive "$2"; then |
Gilles Peskine | 2d3c9f8 | 2021-10-19 18:00:10 +0200 | [diff] [blame] | 1078 | fail "pattern '$2' MUST NOT be present in the Client output" |
| 1079 | fi |
Simon Butcher | 8e00410 | 2016-10-14 00:48:33 +0100 | [diff] [blame] | 1080 | return |
| 1081 | fi |
| 1082 | ;; |
| 1083 | |
| 1084 | # The filtering in the following two options (-u and -U) do the following |
| 1085 | # - ignore valgrind output |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 1086 | # - filter out everything but lines right after the pattern occurrences |
Simon Butcher | 8e00410 | 2016-10-14 00:48:33 +0100 | [diff] [blame] | 1087 | # - keep one of each non-unique line |
| 1088 | # - count how many lines remain |
| 1089 | # A line with '--' will remain in the result from previous outputs, so the number of lines in the result will be 1 |
| 1090 | # if there were no duplicates. |
| 1091 | "-U") |
| 1092 | if [ $(grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep -A1 "$2" | grep -v "$2" | sort | uniq -d | wc -l) -gt 1 ]; then |
| 1093 | fail "lines following pattern '$2' must be unique in Server output" |
| 1094 | return |
| 1095 | fi |
| 1096 | ;; |
| 1097 | |
| 1098 | "-u") |
| 1099 | if [ $(grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep -A1 "$2" | grep -v "$2" | sort | uniq -d | wc -l) -gt 1 ]; then |
| 1100 | fail "lines following pattern '$2' must be unique in Client output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1101 | return |
| 1102 | fi |
| 1103 | ;; |
Andres Amaya Garcia | 93993de | 2017-09-06 15:38:07 +0100 | [diff] [blame] | 1104 | "-F") |
| 1105 | if ! $2 "$SRV_OUT"; then |
| 1106 | fail "function call to '$2' failed on Server output" |
| 1107 | return |
| 1108 | fi |
| 1109 | ;; |
| 1110 | "-f") |
| 1111 | if ! $2 "$CLI_OUT"; then |
| 1112 | fail "function call to '$2' failed on Client output" |
| 1113 | return |
| 1114 | fi |
| 1115 | ;; |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 1116 | "-g") |
| 1117 | if ! eval "$2 '$SRV_OUT' '$CLI_OUT'"; then |
| 1118 | fail "function call to '$2' failed on Server and Client output" |
| 1119 | return |
| 1120 | fi |
| 1121 | ;; |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1122 | |
| 1123 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 1124 | echo "Unknown test: $1" >&2 |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1125 | exit 1 |
| 1126 | esac |
| 1127 | shift 2 |
| 1128 | done |
| 1129 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1130 | # check valgrind's results |
| 1131 | if [ "$MEMCHECK" -gt 0 ]; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1132 | if is_polar "$SRV_CMD" && has_mem_err $SRV_OUT; then |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1133 | fail "Server has memory errors" |
| 1134 | return |
| 1135 | fi |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1136 | if is_polar "$CLI_CMD" && has_mem_err $CLI_OUT; then |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1137 | fail "Client has memory errors" |
| 1138 | return |
| 1139 | fi |
| 1140 | fi |
| 1141 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1142 | # if we're here, everything is ok |
Gilles Peskine | a28fd41 | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1143 | outcome=PASS |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1144 | } |
| 1145 | |
Gilles Peskine | 5d8e702 | 2021-10-19 16:35:35 +0200 | [diff] [blame] | 1146 | # Run the current test case: start the server and if applicable the proxy, run |
| 1147 | # the client, wait for all processes to finish or time out. |
| 1148 | # |
| 1149 | # Inputs: |
| 1150 | # * $NAME: test case name |
| 1151 | # * $CLI_CMD, $SRV_CMD, $PXY_CMD: commands to run |
| 1152 | # * $CLI_OUT, $SRV_OUT, $PXY_OUT: files to contain client/server/proxy logs |
| 1153 | # |
| 1154 | # Outputs: |
| 1155 | # * $CLI_EXIT: client return code |
| 1156 | # * $SRV_RET: server return code |
| 1157 | do_run_test_once() { |
| 1158 | # run the commands |
| 1159 | if [ -n "$PXY_CMD" ]; then |
| 1160 | printf "# %s\n%s\n" "$NAME" "$PXY_CMD" > $PXY_OUT |
| 1161 | $PXY_CMD >> $PXY_OUT 2>&1 & |
| 1162 | PXY_PID=$! |
| 1163 | wait_proxy_start "$PXY_PORT" "$PXY_PID" |
| 1164 | fi |
| 1165 | |
| 1166 | check_osrv_dtls |
| 1167 | printf '# %s\n%s\n' "$NAME" "$SRV_CMD" > $SRV_OUT |
| 1168 | provide_input | $SRV_CMD >> $SRV_OUT 2>&1 & |
| 1169 | SRV_PID=$! |
| 1170 | wait_server_start "$SRV_PORT" "$SRV_PID" |
| 1171 | |
| 1172 | printf '# %s\n%s\n' "$NAME" "$CLI_CMD" > $CLI_OUT |
Andrzej Kurek | d27cdcc | 2022-05-27 06:44:19 -0400 | [diff] [blame] | 1173 | # The client must be a subprocess of the script in order for killing it to |
| 1174 | # work properly, that's why the ampersand is placed inside the eval command, |
| 1175 | # not at the end of the line: the latter approach will spawn eval as a |
| 1176 | # subprocess, and the $CLI_CMD as a grandchild. |
| 1177 | eval "$CLI_CMD &" >> $CLI_OUT 2>&1 |
Gilles Peskine | 5d8e702 | 2021-10-19 16:35:35 +0200 | [diff] [blame] | 1178 | wait_client_done |
| 1179 | |
| 1180 | sleep 0.05 |
| 1181 | |
| 1182 | # terminate the server (and the proxy) |
| 1183 | kill $SRV_PID |
| 1184 | wait $SRV_PID |
| 1185 | SRV_RET=$? |
| 1186 | |
| 1187 | if [ -n "$PXY_CMD" ]; then |
| 1188 | kill $PXY_PID >/dev/null 2>&1 |
Jerry Yu | bf90047 | 2022-10-10 10:25:26 +0800 | [diff] [blame] | 1189 | wait $PXY_PID >> $PXY_OUT 2>&1 |
Gilles Peskine | 5d8e702 | 2021-10-19 16:35:35 +0200 | [diff] [blame] | 1190 | fi |
| 1191 | } |
| 1192 | |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1193 | # Usage: run_test name [-p proxy_cmd] srv_cmd cli_cmd cli_exit [option [...]] |
| 1194 | # Options: -s pattern pattern that must be present in server output |
| 1195 | # -c pattern pattern that must be present in client output |
| 1196 | # -u pattern lines after pattern must be unique in client output |
| 1197 | # -f call shell function on client output |
| 1198 | # -S pattern pattern that must be absent in server output |
| 1199 | # -C pattern pattern that must be absent in client output |
| 1200 | # -U pattern lines after pattern must be unique in server output |
| 1201 | # -F call shell function on server output |
| 1202 | # -g call shell function on server and client output |
| 1203 | run_test() { |
| 1204 | NAME="$1" |
| 1205 | shift 1 |
| 1206 | |
| 1207 | if is_excluded "$NAME"; then |
| 1208 | SKIP_NEXT="NO" |
| 1209 | # There was no request to run the test, so don't record its outcome. |
| 1210 | return |
| 1211 | fi |
| 1212 | |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 1213 | if [ "$LIST_TESTS" -gt 0 ]; then |
| 1214 | printf "%s\n" "$NAME" |
| 1215 | return |
| 1216 | fi |
| 1217 | |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1218 | print_name "$NAME" |
| 1219 | |
| 1220 | # Do we only run numbered tests? |
| 1221 | if [ -n "$RUN_TEST_NUMBER" ]; then |
| 1222 | case ",$RUN_TEST_NUMBER," in |
| 1223 | *",$TESTS,"*) :;; |
| 1224 | *) SKIP_NEXT="YES";; |
| 1225 | esac |
| 1226 | fi |
| 1227 | |
| 1228 | # does this test use a proxy? |
| 1229 | if [ "X$1" = "X-p" ]; then |
| 1230 | PXY_CMD="$2" |
| 1231 | shift 2 |
| 1232 | else |
| 1233 | PXY_CMD="" |
| 1234 | fi |
| 1235 | |
| 1236 | # get commands and client output |
| 1237 | SRV_CMD="$1" |
| 1238 | CLI_CMD="$2" |
| 1239 | CLI_EXPECT="$3" |
| 1240 | shift 3 |
| 1241 | |
| 1242 | # Check if test uses files |
| 1243 | case "$SRV_CMD $CLI_CMD" in |
| 1244 | *data_files/*) |
| 1245 | requires_config_enabled MBEDTLS_FS_IO;; |
| 1246 | esac |
| 1247 | |
Gilles Peskine | e5f4958 | 2022-02-25 19:46:30 +0100 | [diff] [blame] | 1248 | # Check if the test uses DTLS. |
| 1249 | detect_dtls "$SRV_CMD" |
| 1250 | if [ "$DTLS" -eq 1 ]; then |
| 1251 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 1252 | fi |
| 1253 | |
Gilles Peskine | 511fdf4 | 2022-04-08 19:26:26 +0200 | [diff] [blame] | 1254 | # If the client or server requires certain features that can be detected |
| 1255 | # from their command-line arguments, check that they're enabled. |
| 1256 | detect_required_features "$SRV_CMD" "$@" |
| 1257 | detect_required_features "$CLI_CMD" "$@" |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1258 | |
Gilles Peskine | 89d892f | 2022-02-25 19:52:52 +0100 | [diff] [blame] | 1259 | # If we're in a PSK-only build and the test can be adapted to PSK, do that. |
| 1260 | maybe_adapt_for_psk "$@" |
| 1261 | |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1262 | # should we skip? |
| 1263 | if [ "X$SKIP_NEXT" = "XYES" ]; then |
| 1264 | SKIP_NEXT="NO" |
| 1265 | record_outcome "SKIP" |
| 1266 | SKIPS=$(( $SKIPS + 1 )) |
| 1267 | return |
| 1268 | fi |
| 1269 | |
| 1270 | analyze_test_commands "$@" |
| 1271 | |
Andrzej Kurek | 363553b | 2022-04-01 08:52:06 -0400 | [diff] [blame] | 1272 | # One regular run and two retries |
| 1273 | TIMES_LEFT=3 |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1274 | while [ $TIMES_LEFT -gt 0 ]; do |
| 1275 | TIMES_LEFT=$(( $TIMES_LEFT - 1 )) |
| 1276 | |
Gilles Peskine | 5d8e702 | 2021-10-19 16:35:35 +0200 | [diff] [blame] | 1277 | do_run_test_once |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1278 | |
Gilles Peskine | a28fd41 | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1279 | check_test_failure "$@" |
| 1280 | case $outcome in |
| 1281 | PASS) break;; |
Gilles Peskine | 2d3c9f8 | 2021-10-19 18:00:10 +0200 | [diff] [blame] | 1282 | RETRY*) printf "$outcome ";; |
Gilles Peskine | a28fd41 | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1283 | FAIL) return;; |
| 1284 | esac |
Gilles Peskine | f9022b0 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1285 | done |
| 1286 | |
Gilles Peskine | a28fd41 | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1287 | # If we get this far, the test case passed. |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 1288 | record_outcome "PASS" |
Paul Bakker | acaac85 | 2016-05-10 11:47:13 +0100 | [diff] [blame] | 1289 | if [ "$PRESERVE_LOGS" -gt 0 ]; then |
| 1290 | mv $SRV_OUT o-srv-${TESTS}.log |
| 1291 | mv $CLI_OUT o-cli-${TESTS}.log |
Hanno Becker | 7be2e5b | 2018-08-20 12:21:35 +0100 | [diff] [blame] | 1292 | if [ -n "$PXY_CMD" ]; then |
| 1293 | mv $PXY_OUT o-pxy-${TESTS}.log |
| 1294 | fi |
Paul Bakker | acaac85 | 2016-05-10 11:47:13 +0100 | [diff] [blame] | 1295 | fi |
| 1296 | |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 1297 | rm -f $SRV_OUT $CLI_OUT $PXY_OUT |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1298 | } |
| 1299 | |
Hanno Becker | 9b5853c | 2018-11-16 17:28:40 +0000 | [diff] [blame] | 1300 | run_test_psa() { |
| 1301 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Gilles Peskine | 64c683f | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1302 | set_maybe_calc_verify none |
Hanno Becker | e9420c2 | 2018-11-20 11:37:34 +0000 | [diff] [blame] | 1303 | run_test "PSA-supported ciphersuite: $1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 1304 | "$P_SRV debug_level=3 force_version=tls12" \ |
| 1305 | "$P_CLI debug_level=3 force_version=tls12 force_ciphersuite=$1" \ |
Hanno Becker | 9b5853c | 2018-11-16 17:28:40 +0000 | [diff] [blame] | 1306 | 0 \ |
| 1307 | -c "Successfully setup PSA-based decryption cipher context" \ |
| 1308 | -c "Successfully setup PSA-based encryption cipher context" \ |
Gilles Peskine | 64c683f | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1309 | -c "$maybe_calc_verify" \ |
Andrzej Kurek | 92dd4d0 | 2019-01-30 04:10:19 -0500 | [diff] [blame] | 1310 | -c "calc PSA finished" \ |
Hanno Becker | 9b5853c | 2018-11-16 17:28:40 +0000 | [diff] [blame] | 1311 | -s "Successfully setup PSA-based decryption cipher context" \ |
| 1312 | -s "Successfully setup PSA-based encryption cipher context" \ |
Gilles Peskine | 64c683f | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1313 | -s "$maybe_calc_verify" \ |
Andrzej Kurek | 92dd4d0 | 2019-01-30 04:10:19 -0500 | [diff] [blame] | 1314 | -s "calc PSA finished" \ |
Hanno Becker | 9b5853c | 2018-11-16 17:28:40 +0000 | [diff] [blame] | 1315 | -C "Failed to setup PSA-based cipher context"\ |
| 1316 | -S "Failed to setup PSA-based cipher context"\ |
| 1317 | -s "Protocol is TLSv1.2" \ |
Hanno Becker | 28f7844 | 2019-02-18 16:47:50 +0000 | [diff] [blame] | 1318 | -c "Perform PSA-based ECDH computation."\ |
Andrzej Kurek | e85414e | 2019-01-15 05:23:59 -0500 | [diff] [blame] | 1319 | -c "Perform PSA-based computation of digest of ServerKeyExchange" \ |
Hanno Becker | 9b5853c | 2018-11-16 17:28:40 +0000 | [diff] [blame] | 1320 | -S "error" \ |
| 1321 | -C "error" |
Gilles Peskine | 64c683f | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1322 | unset maybe_calc_verify |
Hanno Becker | 9b5853c | 2018-11-16 17:28:40 +0000 | [diff] [blame] | 1323 | } |
| 1324 | |
Hanno Becker | 354e248 | 2019-01-08 11:40:25 +0000 | [diff] [blame] | 1325 | run_test_psa_force_curve() { |
| 1326 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Gilles Peskine | 64c683f | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1327 | set_maybe_calc_verify none |
Hanno Becker | 354e248 | 2019-01-08 11:40:25 +0000 | [diff] [blame] | 1328 | run_test "PSA - ECDH with $1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 1329 | "$P_SRV debug_level=4 force_version=tls12" \ |
| 1330 | "$P_CLI debug_level=4 force_version=tls12 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256 curves=$1" \ |
Hanno Becker | 354e248 | 2019-01-08 11:40:25 +0000 | [diff] [blame] | 1331 | 0 \ |
Hanno Becker | 28f7844 | 2019-02-18 16:47:50 +0000 | [diff] [blame] | 1332 | -c "Successfully setup PSA-based decryption cipher context" \ |
| 1333 | -c "Successfully setup PSA-based encryption cipher context" \ |
Gilles Peskine | 64c683f | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1334 | -c "$maybe_calc_verify" \ |
Hanno Becker | 28f7844 | 2019-02-18 16:47:50 +0000 | [diff] [blame] | 1335 | -c "calc PSA finished" \ |
| 1336 | -s "Successfully setup PSA-based decryption cipher context" \ |
| 1337 | -s "Successfully setup PSA-based encryption cipher context" \ |
Gilles Peskine | 64c683f | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1338 | -s "$maybe_calc_verify" \ |
Hanno Becker | 28f7844 | 2019-02-18 16:47:50 +0000 | [diff] [blame] | 1339 | -s "calc PSA finished" \ |
| 1340 | -C "Failed to setup PSA-based cipher context"\ |
| 1341 | -S "Failed to setup PSA-based cipher context"\ |
Hanno Becker | 354e248 | 2019-01-08 11:40:25 +0000 | [diff] [blame] | 1342 | -s "Protocol is TLSv1.2" \ |
Hanno Becker | 28f7844 | 2019-02-18 16:47:50 +0000 | [diff] [blame] | 1343 | -c "Perform PSA-based ECDH computation."\ |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 1344 | -c "Perform PSA-based computation of digest of ServerKeyExchange" \ |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 1345 | -S "error" \ |
Manuel Pégourié-Gonnard | a6189f0 | 2014-09-20 13:15:43 +0200 | [diff] [blame] | 1346 | -C "error" |
Gilles Peskine | 64c683f | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1347 | unset maybe_calc_verify |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1348 | } |
| 1349 | |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 1350 | # Test that the server's memory usage after a handshake is reduced when a client specifies |
| 1351 | # a maximum fragment length. |
| 1352 | # first argument ($1) is MFL for SSL client |
| 1353 | # second argument ($2) is memory usage for SSL client with default MFL (16k) |
| 1354 | run_test_memory_after_hanshake_with_mfl() |
| 1355 | { |
| 1356 | # The test passes if the difference is around 2*(16k-MFL) |
Gilles Peskine | 5b428d7 | 2020-08-26 21:52:23 +0200 | [diff] [blame] | 1357 | MEMORY_USAGE_LIMIT="$(( $2 - ( 2 * ( 16384 - $1 )) ))" |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 1358 | |
| 1359 | # Leave some margin for robustness |
| 1360 | MEMORY_USAGE_LIMIT="$(( ( MEMORY_USAGE_LIMIT * 110 ) / 100 ))" |
| 1361 | |
| 1362 | run_test "Handshake memory usage (MFL $1)" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 1363 | "$P_SRV debug_level=3 auth_mode=required force_version=tls12" \ |
| 1364 | "$P_CLI debug_level=3 force_version=tls12 \ |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 1365 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 1366 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM max_frag_len=$1" \ |
| 1367 | 0 \ |
| 1368 | -F "handshake_memory_check $MEMORY_USAGE_LIMIT" |
| 1369 | } |
| 1370 | |
| 1371 | |
| 1372 | # Test that the server's memory usage after a handshake is reduced when a client specifies |
| 1373 | # different values of Maximum Fragment Length: default (16k), 4k, 2k, 1k and 512 bytes |
| 1374 | run_tests_memory_after_hanshake() |
| 1375 | { |
| 1376 | # all tests in this sequence requires the same configuration (see requires_config_enabled()) |
| 1377 | SKIP_THIS_TESTS="$SKIP_NEXT" |
| 1378 | |
| 1379 | # first test with default MFU is to get reference memory usage |
| 1380 | MEMORY_USAGE_MFL_16K=0 |
| 1381 | run_test "Handshake memory usage initial (MFL 16384 - default)" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 1382 | "$P_SRV debug_level=3 auth_mode=required force_version=tls12" \ |
| 1383 | "$P_CLI debug_level=3 force_version=tls12 \ |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 1384 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 1385 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM" \ |
| 1386 | 0 \ |
| 1387 | -F "handshake_memory_get MEMORY_USAGE_MFL_16K" |
| 1388 | |
| 1389 | SKIP_NEXT="$SKIP_THIS_TESTS" |
| 1390 | run_test_memory_after_hanshake_with_mfl 4096 "$MEMORY_USAGE_MFL_16K" |
| 1391 | |
| 1392 | SKIP_NEXT="$SKIP_THIS_TESTS" |
| 1393 | run_test_memory_after_hanshake_with_mfl 2048 "$MEMORY_USAGE_MFL_16K" |
| 1394 | |
| 1395 | SKIP_NEXT="$SKIP_THIS_TESTS" |
| 1396 | run_test_memory_after_hanshake_with_mfl 1024 "$MEMORY_USAGE_MFL_16K" |
| 1397 | |
| 1398 | SKIP_NEXT="$SKIP_THIS_TESTS" |
| 1399 | run_test_memory_after_hanshake_with_mfl 512 "$MEMORY_USAGE_MFL_16K" |
| 1400 | } |
| 1401 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 1402 | cleanup() { |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1403 | rm -f $CLI_OUT $SRV_OUT $PXY_OUT $SESSION |
Piotr Nowicki | 3de298f | 2020-04-16 14:35:19 +0200 | [diff] [blame] | 1404 | rm -f context_srv.txt |
| 1405 | rm -f context_cli.txt |
Manuel Pégourié-Gonnard | a6189f0 | 2014-09-20 13:15:43 +0200 | [diff] [blame] | 1406 | test -n "${SRV_PID:-}" && kill $SRV_PID >/dev/null 2>&1 |
| 1407 | test -n "${PXY_PID:-}" && kill $PXY_PID >/dev/null 2>&1 |
| 1408 | test -n "${CLI_PID:-}" && kill $CLI_PID >/dev/null 2>&1 |
| 1409 | test -n "${DOG_PID:-}" && kill $DOG_PID >/dev/null 2>&1 |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 1410 | exit 1 |
| 1411 | } |
| 1412 | |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 1413 | # |
| 1414 | # MAIN |
| 1415 | # |
| 1416 | |
Yanray Wang | 5659981 | 2023-02-28 11:56:59 +0800 | [diff] [blame] | 1417 | # Make the outcome file path relative to the original directory, not |
| 1418 | # to .../tests |
| 1419 | case "$MBEDTLS_TEST_OUTCOME_FILE" in |
| 1420 | [!/]*) |
| 1421 | MBEDTLS_TEST_OUTCOME_FILE="$ORIGINAL_PWD/$MBEDTLS_TEST_OUTCOME_FILE" |
| 1422 | ;; |
| 1423 | esac |
| 1424 | |
Gilles Peskine | 9fa4ed6 | 2020-08-26 22:35:46 +0200 | [diff] [blame] | 1425 | # Optimize filters: if $FILTER and $EXCLUDE can be expressed as shell |
| 1426 | # patterns rather than regular expressions, use a case statement instead |
| 1427 | # of calling grep. To keep the optimizer simple, it is incomplete and only |
| 1428 | # detects simple cases: plain substring, everything, nothing. |
| 1429 | # |
| 1430 | # As an exception, the character '.' is treated as an ordinary character |
| 1431 | # if it is the only special character in the string. This is because it's |
| 1432 | # rare to need "any one character", but needing a literal '.' is common |
| 1433 | # (e.g. '-f "DTLS 1.2"'). |
| 1434 | need_grep= |
| 1435 | case "$FILTER" in |
| 1436 | '^$') simple_filter=;; |
| 1437 | '.*') simple_filter='*';; |
Gilles Peskine | b09e001 | 2020-09-29 23:48:39 +0200 | [diff] [blame] | 1438 | *[][$+*?\\^{\|}]*) # Regexp special characters (other than .), we need grep |
Gilles Peskine | 9fa4ed6 | 2020-08-26 22:35:46 +0200 | [diff] [blame] | 1439 | need_grep=1;; |
| 1440 | *) # No regexp or shell-pattern special character |
| 1441 | simple_filter="*$FILTER*";; |
| 1442 | esac |
| 1443 | case "$EXCLUDE" in |
| 1444 | '^$') simple_exclude=;; |
| 1445 | '.*') simple_exclude='*';; |
Gilles Peskine | b09e001 | 2020-09-29 23:48:39 +0200 | [diff] [blame] | 1446 | *[][$+*?\\^{\|}]*) # Regexp special characters (other than .), we need grep |
Gilles Peskine | 9fa4ed6 | 2020-08-26 22:35:46 +0200 | [diff] [blame] | 1447 | need_grep=1;; |
| 1448 | *) # No regexp or shell-pattern special character |
| 1449 | simple_exclude="*$EXCLUDE*";; |
| 1450 | esac |
| 1451 | if [ -n "$need_grep" ]; then |
| 1452 | is_excluded () { |
| 1453 | ! echo "$1" | grep "$FILTER" | grep -q -v "$EXCLUDE" |
| 1454 | } |
| 1455 | else |
| 1456 | is_excluded () { |
| 1457 | case "$1" in |
| 1458 | $simple_exclude) true;; |
| 1459 | $simple_filter) false;; |
| 1460 | *) true;; |
| 1461 | esac |
| 1462 | } |
| 1463 | fi |
| 1464 | |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 1465 | if [ "$LIST_TESTS" -eq 0 ];then |
| 1466 | |
| 1467 | # sanity checks, avoid an avalanche of errors |
| 1468 | P_SRV_BIN="${P_SRV%%[ ]*}" |
| 1469 | P_CLI_BIN="${P_CLI%%[ ]*}" |
| 1470 | P_PXY_BIN="${P_PXY%%[ ]*}" |
| 1471 | if [ ! -x "$P_SRV_BIN" ]; then |
| 1472 | echo "Command '$P_SRV_BIN' is not an executable file" |
Simon Butcher | 3c0d7b8 | 2016-05-23 11:13:17 +0100 | [diff] [blame] | 1473 | exit 1 |
| 1474 | fi |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 1475 | if [ ! -x "$P_CLI_BIN" ]; then |
| 1476 | echo "Command '$P_CLI_BIN' is not an executable file" |
| 1477 | exit 1 |
| 1478 | fi |
| 1479 | if [ ! -x "$P_PXY_BIN" ]; then |
| 1480 | echo "Command '$P_PXY_BIN' is not an executable file" |
| 1481 | exit 1 |
| 1482 | fi |
| 1483 | if [ "$MEMCHECK" -gt 0 ]; then |
| 1484 | if which valgrind >/dev/null 2>&1; then :; else |
| 1485 | echo "Memcheck not possible. Valgrind not found" |
| 1486 | exit 1 |
| 1487 | fi |
| 1488 | fi |
| 1489 | if which $OPENSSL >/dev/null 2>&1; then :; else |
| 1490 | echo "Command '$OPENSSL' not found" |
| 1491 | exit 1 |
| 1492 | fi |
| 1493 | |
| 1494 | # used by watchdog |
| 1495 | MAIN_PID="$$" |
| 1496 | |
| 1497 | # We use somewhat arbitrary delays for tests: |
| 1498 | # - how long do we wait for the server to start (when lsof not available)? |
| 1499 | # - how long do we allow for the client to finish? |
| 1500 | # (not to check performance, just to avoid waiting indefinitely) |
| 1501 | # Things are slower with valgrind, so give extra time here. |
| 1502 | # |
| 1503 | # Note: without lsof, there is a trade-off between the running time of this |
| 1504 | # script and the risk of spurious errors because we didn't wait long enough. |
| 1505 | # The watchdog delay on the other hand doesn't affect normal running time of |
| 1506 | # the script, only the case where a client or server gets stuck. |
| 1507 | if [ "$MEMCHECK" -gt 0 ]; then |
| 1508 | START_DELAY=6 |
| 1509 | DOG_DELAY=60 |
| 1510 | else |
| 1511 | START_DELAY=2 |
| 1512 | DOG_DELAY=20 |
| 1513 | fi |
| 1514 | |
| 1515 | # some particular tests need more time: |
| 1516 | # - for the client, we multiply the usual watchdog limit by a factor |
| 1517 | # - for the server, we sleep for a number of seconds after the client exits |
| 1518 | # see client_need_more_time() and server_needs_more_time() |
| 1519 | CLI_DELAY_FACTOR=1 |
| 1520 | SRV_DELAY_SECONDS=0 |
| 1521 | |
| 1522 | # fix commands to use this port, force IPv4 while at it |
| 1523 | # +SRV_PORT will be replaced by either $SRV_PORT or $PXY_PORT later |
| 1524 | # Note: Using 'localhost' rather than 127.0.0.1 here is unwise, as on many |
| 1525 | # machines that will resolve to ::1, and we don't want ipv6 here. |
| 1526 | P_SRV="$P_SRV server_addr=127.0.0.1 server_port=$SRV_PORT" |
| 1527 | P_CLI="$P_CLI server_addr=127.0.0.1 server_port=+SRV_PORT" |
| 1528 | P_PXY="$P_PXY server_addr=127.0.0.1 server_port=$SRV_PORT listen_addr=127.0.0.1 listen_port=$PXY_PORT ${SEED:+"seed=$SEED"}" |
| 1529 | O_SRV="$O_SRV -accept $SRV_PORT" |
| 1530 | O_CLI="$O_CLI -connect 127.0.0.1:+SRV_PORT" |
| 1531 | G_SRV="$G_SRV -p $SRV_PORT" |
| 1532 | G_CLI="$G_CLI -p +SRV_PORT" |
| 1533 | |
| 1534 | # Newer versions of OpenSSL have a syntax to enable all "ciphers", even |
| 1535 | # low-security ones. This covers not just cipher suites but also protocol |
| 1536 | # versions. It is necessary, for example, to use (D)TLS 1.0/1.1 on |
| 1537 | # OpenSSL 1.1.1f from Ubuntu 20.04. The syntax was only introduced in |
| 1538 | # OpenSSL 1.1.0 (21e0c1d23afff48601eb93135defddae51f7e2e3) and I can't find |
| 1539 | # a way to discover it from -help, so check the openssl version. |
| 1540 | case $($OPENSSL version) in |
| 1541 | "OpenSSL 0"*|"OpenSSL 1.0"*) :;; |
| 1542 | *) |
| 1543 | O_CLI="$O_CLI -cipher ALL@SECLEVEL=0" |
| 1544 | O_SRV="$O_SRV -cipher ALL@SECLEVEL=0" |
| 1545 | ;; |
| 1546 | esac |
| 1547 | |
| 1548 | if [ -n "${OPENSSL_NEXT:-}" ]; then |
| 1549 | O_NEXT_SRV="$O_NEXT_SRV -accept $SRV_PORT" |
| 1550 | O_NEXT_CLI="$O_NEXT_CLI -connect 127.0.0.1:+SRV_PORT" |
| 1551 | fi |
| 1552 | |
| 1553 | if [ -n "${GNUTLS_NEXT_SERV:-}" ]; then |
| 1554 | G_NEXT_SRV="$G_NEXT_SRV -p $SRV_PORT" |
| 1555 | fi |
| 1556 | |
| 1557 | if [ -n "${GNUTLS_NEXT_CLI:-}" ]; then |
| 1558 | G_NEXT_CLI="$G_NEXT_CLI -p +SRV_PORT" |
| 1559 | fi |
| 1560 | |
| 1561 | # Allow SHA-1, because many of our test certificates use it |
| 1562 | P_SRV="$P_SRV allow_sha1=1" |
| 1563 | P_CLI="$P_CLI allow_sha1=1" |
Simon Butcher | 3c0d7b8 | 2016-05-23 11:13:17 +0100 | [diff] [blame] | 1564 | fi |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1565 | # Also pick a unique name for intermediate files |
| 1566 | SRV_OUT="srv_out.$$" |
| 1567 | CLI_OUT="cli_out.$$" |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 1568 | PXY_OUT="pxy_out.$$" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1569 | SESSION="session.$$" |
| 1570 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 1571 | SKIP_NEXT="NO" |
| 1572 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 1573 | trap cleanup INT TERM HUP |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1574 | |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 1575 | # Basic test |
| 1576 | |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 1577 | # Checks that: |
| 1578 | # - things work with all ciphersuites active (used with config-full in all.sh) |
Gilles Peskine | de4cb35 | 2022-04-05 22:00:32 +0200 | [diff] [blame] | 1579 | # - the expected parameters are selected |
Gilles Peskine | df4ad90 | 2022-04-08 15:14:38 +0200 | [diff] [blame] | 1580 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | dff48c1 | 2022-02-25 19:50:38 +0100 | [diff] [blame] | 1581 | requires_ciphersuite_enabled TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256 |
Gilles Peskine | de4cb35 | 2022-04-05 22:00:32 +0200 | [diff] [blame] | 1582 | requires_config_enabled MBEDTLS_SHA512_C # "signature_algorithm ext: 6" |
| 1583 | requires_config_enabled MBEDTLS_ECP_DP_SECP521R1_ENABLED |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 1584 | run_test "Default" \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 1585 | "$P_SRV debug_level=3" \ |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 1586 | "$P_CLI" \ |
| 1587 | 0 \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 1588 | -s "Protocol is TLSv1.2" \ |
Manuel Pégourié-Gonnard | ce66d5e | 2018-06-14 11:11:15 +0200 | [diff] [blame] | 1589 | -s "Ciphersuite is TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256" \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 1590 | -s "client hello v3, signature_algorithm ext: 6" \ |
| 1591 | -s "ECDHE curve: secp521r1" \ |
| 1592 | -S "error" \ |
| 1593 | -C "error" |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 1594 | |
Gilles Peskine | df4ad90 | 2022-04-08 15:14:38 +0200 | [diff] [blame] | 1595 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | dff48c1 | 2022-02-25 19:50:38 +0100 | [diff] [blame] | 1596 | requires_ciphersuite_enabled TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256 |
Manuel Pégourié-Gonnard | 3bb0801 | 2015-01-22 13:34:21 +0000 | [diff] [blame] | 1597 | run_test "Default, DTLS" \ |
| 1598 | "$P_SRV dtls=1" \ |
| 1599 | "$P_CLI dtls=1" \ |
| 1600 | 0 \ |
| 1601 | -s "Protocol is DTLSv1.2" \ |
Manuel Pégourié-Gonnard | ce66d5e | 2018-06-14 11:11:15 +0200 | [diff] [blame] | 1602 | -s "Ciphersuite is TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256" |
Manuel Pégourié-Gonnard | 3bb0801 | 2015-01-22 13:34:21 +0000 | [diff] [blame] | 1603 | |
Hanno Becker | 721f7c1 | 2020-08-17 12:17:32 +0100 | [diff] [blame] | 1604 | run_test "TLS client auth: required" \ |
| 1605 | "$P_SRV auth_mode=required" \ |
| 1606 | "$P_CLI" \ |
| 1607 | 0 \ |
| 1608 | -s "Verifying peer X.509 certificate... ok" |
| 1609 | |
Hanno Becker | 2f54a3c | 2020-08-17 12:14:06 +0100 | [diff] [blame] | 1610 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
| 1611 | requires_config_enabled MBEDTLS_ECDSA_C |
| 1612 | requires_config_enabled MBEDTLS_SHA256_C |
| 1613 | run_test "TLS: password protected client key" \ |
| 1614 | "$P_SRV auth_mode=required" \ |
| 1615 | "$P_CLI crt_file=data_files/server5.crt key_file=data_files/server5.key.enc key_pwd=PolarSSLTest" \ |
| 1616 | 0 |
| 1617 | |
| 1618 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
| 1619 | requires_config_enabled MBEDTLS_ECDSA_C |
| 1620 | requires_config_enabled MBEDTLS_SHA256_C |
| 1621 | run_test "TLS: password protected server key" \ |
| 1622 | "$P_SRV crt_file=data_files/server5.crt key_file=data_files/server5.key.enc key_pwd=PolarSSLTest" \ |
| 1623 | "$P_CLI" \ |
| 1624 | 0 |
| 1625 | |
| 1626 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
| 1627 | requires_config_enabled MBEDTLS_ECDSA_C |
| 1628 | requires_config_enabled MBEDTLS_RSA_C |
| 1629 | requires_config_enabled MBEDTLS_SHA256_C |
| 1630 | run_test "TLS: password protected server key, two certificates" \ |
| 1631 | "$P_SRV \ |
| 1632 | key_file=data_files/server5.key.enc key_pwd=PolarSSLTest crt_file=data_files/server5.crt \ |
| 1633 | key_file2=data_files/server2.key.enc key_pwd2=PolarSSLTest crt_file2=data_files/server2.crt" \ |
| 1634 | "$P_CLI" \ |
| 1635 | 0 |
| 1636 | |
Manuel Pégourié-Gonnard | 342d2ca | 2020-01-02 11:58:00 +0100 | [diff] [blame] | 1637 | requires_config_enabled MBEDTLS_ZLIB_SUPPORT |
| 1638 | run_test "Default (compression enabled)" \ |
| 1639 | "$P_SRV debug_level=3" \ |
| 1640 | "$P_CLI debug_level=3" \ |
| 1641 | 0 \ |
| 1642 | -s "Allocating compression buffer" \ |
| 1643 | -c "Allocating compression buffer" \ |
| 1644 | -s "Record expansion is unknown (compression)" \ |
| 1645 | -c "Record expansion is unknown (compression)" \ |
| 1646 | -S "error" \ |
| 1647 | -C "error" |
| 1648 | |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 1649 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 1650 | run_test "CA callback on client" \ |
| 1651 | "$P_SRV debug_level=3" \ |
| 1652 | "$P_CLI ca_callback=1 debug_level=3 " \ |
| 1653 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 1654 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 1655 | -S "error" \ |
| 1656 | -C "error" |
| 1657 | |
| 1658 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 1659 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
| 1660 | requires_config_enabled MBEDTLS_ECDSA_C |
| 1661 | requires_config_enabled MBEDTLS_SHA256_C |
| 1662 | run_test "CA callback on server" \ |
| 1663 | "$P_SRV auth_mode=required" \ |
| 1664 | "$P_CLI ca_callback=1 debug_level=3 crt_file=data_files/server5.crt \ |
| 1665 | key_file=data_files/server5.key" \ |
| 1666 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 1667 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 1668 | -s "Verifying peer X.509 certificate... ok" \ |
| 1669 | -S "error" \ |
| 1670 | -C "error" |
| 1671 | |
Manuel Pégourié-Gonnard | cfdf8f4 | 2018-11-08 09:52:25 +0100 | [diff] [blame] | 1672 | # Test using an opaque private key for client authentication |
| 1673 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 1674 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
| 1675 | requires_config_enabled MBEDTLS_ECDSA_C |
| 1676 | requires_config_enabled MBEDTLS_SHA256_C |
| 1677 | run_test "Opaque key for client authentication" \ |
Przemyslaw Stekiel | b3de3fd | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 1678 | "$P_SRV auth_mode=required crt_file=data_files/server5.crt \ |
| 1679 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | cfdf8f4 | 2018-11-08 09:52:25 +0100 | [diff] [blame] | 1680 | "$P_CLI key_opaque=1 crt_file=data_files/server5.crt \ |
| 1681 | key_file=data_files/server5.key" \ |
| 1682 | 0 \ |
| 1683 | -c "key type: Opaque" \ |
Przemyslaw Stekiel | b3de3fd | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 1684 | -c "Ciphersuite is TLS-ECDHE-ECDSA" \ |
Manuel Pégourié-Gonnard | cfdf8f4 | 2018-11-08 09:52:25 +0100 | [diff] [blame] | 1685 | -s "Verifying peer X.509 certificate... ok" \ |
Przemyslaw Stekiel | b3de3fd | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 1686 | -s "Ciphersuite is TLS-ECDHE-ECDSA" \ |
Manuel Pégourié-Gonnard | cfdf8f4 | 2018-11-08 09:52:25 +0100 | [diff] [blame] | 1687 | -S "error" \ |
| 1688 | -C "error" |
| 1689 | |
Przemyslaw Stekiel | ab09c9e | 2021-10-04 11:13:22 +0200 | [diff] [blame] | 1690 | # Test using an opaque private key for server authentication |
| 1691 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 1692 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
| 1693 | requires_config_enabled MBEDTLS_ECDSA_C |
| 1694 | requires_config_enabled MBEDTLS_SHA256_C |
| 1695 | run_test "Opaque key for server authentication" \ |
Przemyslaw Stekiel | b3de3fd | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 1696 | "$P_SRV auth_mode=required key_opaque=1 crt_file=data_files/server5.crt \ |
| 1697 | key_file=data_files/server5.key" \ |
Przemyslaw Stekiel | ab09c9e | 2021-10-04 11:13:22 +0200 | [diff] [blame] | 1698 | "$P_CLI crt_file=data_files/server5.crt \ |
| 1699 | key_file=data_files/server5.key" \ |
| 1700 | 0 \ |
| 1701 | -c "Verifying peer X.509 certificate... ok" \ |
Przemyslaw Stekiel | b3de3fd | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 1702 | -c "Ciphersuite is TLS-ECDHE-ECDSA" \ |
| 1703 | -s "key types: Opaque - invalid PK" \ |
| 1704 | -s "Ciphersuite is TLS-ECDHE-ECDSA" \ |
Przemyslaw Stekiel | ab09c9e | 2021-10-04 11:13:22 +0200 | [diff] [blame] | 1705 | -S "error" \ |
| 1706 | -C "error" |
| 1707 | |
Przemyslaw Stekiel | 5b6c4c9 | 2021-10-06 11:31:49 +0200 | [diff] [blame] | 1708 | # Test using an opaque private key for client/server authentication |
| 1709 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 1710 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
| 1711 | requires_config_enabled MBEDTLS_ECDSA_C |
| 1712 | requires_config_enabled MBEDTLS_SHA256_C |
| 1713 | run_test "Opaque key for client/server authentication" \ |
Przemyslaw Stekiel | b3de3fd | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 1714 | "$P_SRV auth_mode=required key_opaque=1 crt_file=data_files/server5.crt \ |
| 1715 | key_file=data_files/server5.key" \ |
Przemyslaw Stekiel | 5b6c4c9 | 2021-10-06 11:31:49 +0200 | [diff] [blame] | 1716 | "$P_CLI key_opaque=1 crt_file=data_files/server5.crt \ |
| 1717 | key_file=data_files/server5.key" \ |
| 1718 | 0 \ |
| 1719 | -c "key type: Opaque" \ |
| 1720 | -c "Verifying peer X.509 certificate... ok" \ |
Przemyslaw Stekiel | b3de3fd | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 1721 | -c "Ciphersuite is TLS-ECDHE-ECDSA" \ |
| 1722 | -s "key types: Opaque - invalid PK" \ |
Przemyslaw Stekiel | 5b6c4c9 | 2021-10-06 11:31:49 +0200 | [diff] [blame] | 1723 | -s "Verifying peer X.509 certificate... ok" \ |
Przemyslaw Stekiel | b3de3fd | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 1724 | -s "Ciphersuite is TLS-ECDHE-ECDSA" \ |
Przemyslaw Stekiel | 5b6c4c9 | 2021-10-06 11:31:49 +0200 | [diff] [blame] | 1725 | -S "error" \ |
| 1726 | -C "error" |
| 1727 | |
Manuel Pégourié-Gonnard | 938be42 | 2022-06-14 10:43:36 +0200 | [diff] [blame] | 1728 | # Opaque keys not supported for static ECDH |
| 1729 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 1730 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
| 1731 | run_test "Opaque key: server: ECDH-ECDSA not supported" \ |
| 1732 | "$P_SRV debug_level=1 key_opaque=1 |
| 1733 | crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
| 1734 | "$P_CLI force_ciphersuite=TLS-ECDH-ECDSA-WITH-AES-128-GCM-SHA256" \ |
| 1735 | 1 \ |
| 1736 | -s "server key not ECDH capable" \ |
| 1737 | -s "ssl_get_ecdh_params_from_cert() returned" \ |
| 1738 | -s "error" \ |
| 1739 | -c "error" |
| 1740 | |
| 1741 | # Opaque keys not supported for static ECDH |
| 1742 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 1743 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
| 1744 | run_test "Opaque key: server: ECDH-RSA not supported" \ |
| 1745 | "$P_SRV debug_level=1 key_opaque=1 |
| 1746 | crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
| 1747 | "$P_CLI force_ciphersuite=TLS-ECDH-RSA-WITH-AES-128-GCM-SHA256" \ |
| 1748 | 1 \ |
| 1749 | -s "server key not ECDH capable" \ |
| 1750 | -s "ssl_get_ecdh_params_from_cert() returned" \ |
| 1751 | -s "error" \ |
| 1752 | -c "error" |
| 1753 | |
Manuel Pégourié-Gonnard | a49a00c | 2022-06-14 10:45:19 +0200 | [diff] [blame] | 1754 | # Opaque PSKs not supported for mixed PSK |
| 1755 | |
| 1756 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 1757 | run_test "Opaque psk: client: ECDHE-PSK not supported" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 1758 | "$P_SRV debug_level=1 psk=73776f726466697368 psk_identity=foo" \ |
| 1759 | "$P_CLI debug_level=1 psk=73776f726466697368 psk_identity=foo psk_opaque=1 \ |
Manuel Pégourié-Gonnard | a49a00c | 2022-06-14 10:45:19 +0200 | [diff] [blame] | 1760 | force_version=tls12 \ |
| 1761 | force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA" \ |
| 1762 | 1 \ |
| 1763 | -c "opaque PSK not supported with ECDHE-PSK" \ |
| 1764 | -s "error" \ |
| 1765 | -c "error" |
| 1766 | |
| 1767 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 1768 | run_test "Opaque psk: client: DHE-PSK not supported" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 1769 | "$P_SRV debug_level=1 psk=73776f726466697368 psk_identity=foo" \ |
| 1770 | "$P_CLI debug_level=1 psk=73776f726466697368 psk_identity=foo psk_opaque=1 \ |
Manuel Pégourié-Gonnard | a49a00c | 2022-06-14 10:45:19 +0200 | [diff] [blame] | 1771 | force_version=tls12 \ |
| 1772 | force_ciphersuite=TLS-DHE-PSK-WITH-AES-128-CBC-SHA" \ |
| 1773 | 1 \ |
| 1774 | -c "opaque PSK not supported with DHE-PSK" \ |
| 1775 | -s "error" \ |
| 1776 | -c "error" |
| 1777 | |
| 1778 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 1779 | run_test "Opaque psk: client: RSA-PSK not supported" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 1780 | "$P_SRV debug_level=1 psk=73776f726466697368 psk_identity=foo" \ |
| 1781 | "$P_CLI debug_level=1 psk=73776f726466697368 psk_identity=foo psk_opaque=1 \ |
Manuel Pégourié-Gonnard | a49a00c | 2022-06-14 10:45:19 +0200 | [diff] [blame] | 1782 | force_version=tls12 \ |
| 1783 | force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA" \ |
| 1784 | 1 \ |
| 1785 | -c "opaque PSK not supported with RSA-PSK" \ |
| 1786 | -s "error" \ |
| 1787 | -c "error" |
| 1788 | |
Manuel Pégourié-Gonnard | d80d8a4 | 2022-06-14 10:53:15 +0200 | [diff] [blame] | 1789 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 1790 | run_test "Opaque psk: server: ECDHE-PSK not supported" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 1791 | "$P_SRV debug_level=1 psk=73776f726466697368 psk_identity=foo psk_opaque=1 \ |
Manuel Pégourié-Gonnard | d80d8a4 | 2022-06-14 10:53:15 +0200 | [diff] [blame] | 1792 | force_version=tls12 \ |
| 1793 | force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 1794 | "$P_CLI debug_level=1 psk=73776f726466697368 psk_identity=foo" \ |
Manuel Pégourié-Gonnard | d80d8a4 | 2022-06-14 10:53:15 +0200 | [diff] [blame] | 1795 | 1 \ |
| 1796 | -s "opaque PSK not supported with ECDHE-PSK" \ |
| 1797 | -s "error" \ |
| 1798 | -c "error" |
| 1799 | |
| 1800 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 1801 | run_test "Opaque psk: server: DHE-PSK not supported" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 1802 | "$P_SRV debug_level=1 psk=73776f726466697368 psk_identity=foo psk_opaque=1 \ |
Manuel Pégourié-Gonnard | d80d8a4 | 2022-06-14 10:53:15 +0200 | [diff] [blame] | 1803 | force_version=tls12 \ |
| 1804 | force_ciphersuite=TLS-DHE-PSK-WITH-AES-128-CBC-SHA" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 1805 | "$P_CLI debug_level=1 psk=73776f726466697368 psk_identity=foo" \ |
Manuel Pégourié-Gonnard | d80d8a4 | 2022-06-14 10:53:15 +0200 | [diff] [blame] | 1806 | 1 \ |
| 1807 | -s "opaque PSK not supported with DHE-PSK" \ |
| 1808 | -s "error" \ |
| 1809 | -c "error" |
| 1810 | |
| 1811 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 1812 | run_test "Opaque psk: server: RSA-PSK not supported" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 1813 | "$P_SRV debug_level=1 psk=73776f726466697368 psk_identity=foo psk_opaque=1 \ |
Manuel Pégourié-Gonnard | d80d8a4 | 2022-06-14 10:53:15 +0200 | [diff] [blame] | 1814 | force_version=tls12 \ |
| 1815 | force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 1816 | "$P_CLI debug_level=1 psk=73776f726466697368 psk_identity=foo" \ |
Manuel Pégourié-Gonnard | d80d8a4 | 2022-06-14 10:53:15 +0200 | [diff] [blame] | 1817 | 1 \ |
| 1818 | -s "opaque PSK not supported with RSA-PSK" \ |
| 1819 | -s "error" \ |
| 1820 | -c "error" |
| 1821 | |
Hanno Becker | 9b5853c | 2018-11-16 17:28:40 +0000 | [diff] [blame] | 1822 | # Test ciphersuites which we expect to be fully supported by PSA Crypto |
| 1823 | # and check that we don't fall back to Mbed TLS' internal crypto primitives. |
| 1824 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-128-CCM |
| 1825 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8 |
| 1826 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-256-CCM |
| 1827 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-256-CCM-8 |
| 1828 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 |
| 1829 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 |
| 1830 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA |
| 1831 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 |
| 1832 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384 |
| 1833 | |
Hanno Becker | 354e248 | 2019-01-08 11:40:25 +0000 | [diff] [blame] | 1834 | requires_config_enabled MBEDTLS_ECP_DP_SECP521R1_ENABLED |
| 1835 | run_test_psa_force_curve "secp521r1" |
| 1836 | requires_config_enabled MBEDTLS_ECP_DP_BP512R1_ENABLED |
| 1837 | run_test_psa_force_curve "brainpoolP512r1" |
| 1838 | requires_config_enabled MBEDTLS_ECP_DP_SECP384R1_ENABLED |
| 1839 | run_test_psa_force_curve "secp384r1" |
| 1840 | requires_config_enabled MBEDTLS_ECP_DP_BP384R1_ENABLED |
| 1841 | run_test_psa_force_curve "brainpoolP384r1" |
| 1842 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
| 1843 | run_test_psa_force_curve "secp256r1" |
| 1844 | requires_config_enabled MBEDTLS_ECP_DP_SECP256K1_ENABLED |
| 1845 | run_test_psa_force_curve "secp256k1" |
| 1846 | requires_config_enabled MBEDTLS_ECP_DP_BP256R1_ENABLED |
| 1847 | run_test_psa_force_curve "brainpoolP256r1" |
| 1848 | requires_config_enabled MBEDTLS_ECP_DP_SECP224R1_ENABLED |
| 1849 | run_test_psa_force_curve "secp224r1" |
Gilles Peskine | defdc3b | 2021-03-23 13:59:58 +0100 | [diff] [blame] | 1850 | ## SECP224K1 is buggy via the PSA API |
Dave Rodgman | 52af769 | 2022-03-31 14:27:24 +0100 | [diff] [blame] | 1851 | ## (https://github.com/Mbed-TLS/mbedtls/issues/3541), |
Gilles Peskine | defdc3b | 2021-03-23 13:59:58 +0100 | [diff] [blame] | 1852 | ## so it is disabled in PSA even when it's enabled in Mbed TLS. |
| 1853 | ## The proper dependency would be on PSA_WANT_ECC_SECP_K1_224 but |
| 1854 | ## dependencies on PSA symbols in ssl-opt.sh are not implemented yet. |
| 1855 | #requires_config_enabled MBEDTLS_ECP_DP_SECP224K1_ENABLED |
| 1856 | #run_test_psa_force_curve "secp224k1" |
Hanno Becker | 354e248 | 2019-01-08 11:40:25 +0000 | [diff] [blame] | 1857 | requires_config_enabled MBEDTLS_ECP_DP_SECP192R1_ENABLED |
| 1858 | run_test_psa_force_curve "secp192r1" |
| 1859 | requires_config_enabled MBEDTLS_ECP_DP_SECP192K1_ENABLED |
| 1860 | run_test_psa_force_curve "secp192k1" |
| 1861 | |
Andres Amaya Garcia | b84c40b | 2017-09-06 15:44:01 +0100 | [diff] [blame] | 1862 | # Test current time in ServerHello |
| 1863 | requires_config_enabled MBEDTLS_HAVE_TIME |
Manuel Pégourié-Gonnard | ce66d5e | 2018-06-14 11:11:15 +0200 | [diff] [blame] | 1864 | run_test "ServerHello contains gmt_unix_time" \ |
Andres Amaya Garcia | b84c40b | 2017-09-06 15:44:01 +0100 | [diff] [blame] | 1865 | "$P_SRV debug_level=3" \ |
| 1866 | "$P_CLI debug_level=3" \ |
| 1867 | 0 \ |
Andres Amaya Garcia | b84c40b | 2017-09-06 15:44:01 +0100 | [diff] [blame] | 1868 | -f "check_server_hello_time" \ |
| 1869 | -F "check_server_hello_time" |
| 1870 | |
Simon Butcher | 8e00410 | 2016-10-14 00:48:33 +0100 | [diff] [blame] | 1871 | # Test for uniqueness of IVs in AEAD ciphersuites |
| 1872 | run_test "Unique IV in GCM" \ |
| 1873 | "$P_SRV exchanges=20 debug_level=4" \ |
| 1874 | "$P_CLI exchanges=20 debug_level=4 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ |
| 1875 | 0 \ |
| 1876 | -u "IV used" \ |
| 1877 | -U "IV used" |
| 1878 | |
Janos Follath | ee11be6 | 2019-04-04 12:03:30 +0100 | [diff] [blame] | 1879 | # Tests for certificate verification callback |
| 1880 | run_test "Configuration-specific CRT verification callback" \ |
| 1881 | "$P_SRV debug_level=3" \ |
| 1882 | "$P_CLI context_crt_cb=0 debug_level=3" \ |
| 1883 | 0 \ |
Janos Follath | ee11be6 | 2019-04-04 12:03:30 +0100 | [diff] [blame] | 1884 | -S "error" \ |
| 1885 | -c "Verify requested for " \ |
| 1886 | -c "Use configuration-specific verification callback" \ |
| 1887 | -C "Use context-specific verification callback" \ |
| 1888 | -C "error" |
| 1889 | |
Hanno Becker | efb440a | 2019-04-03 13:04:33 +0100 | [diff] [blame] | 1890 | run_test "Context-specific CRT verification callback" \ |
| 1891 | "$P_SRV debug_level=3" \ |
| 1892 | "$P_CLI context_crt_cb=1 debug_level=3" \ |
| 1893 | 0 \ |
Hanno Becker | efb440a | 2019-04-03 13:04:33 +0100 | [diff] [blame] | 1894 | -S "error" \ |
Janos Follath | ee11be6 | 2019-04-04 12:03:30 +0100 | [diff] [blame] | 1895 | -c "Verify requested for " \ |
| 1896 | -c "Use context-specific verification callback" \ |
| 1897 | -C "Use configuration-specific verification callback" \ |
Hanno Becker | efb440a | 2019-04-03 13:04:33 +0100 | [diff] [blame] | 1898 | -C "error" |
| 1899 | |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 1900 | # Tests for rc4 option |
| 1901 | |
Gilles Peskine | 719a652 | 2022-04-15 20:03:33 +0200 | [diff] [blame] | 1902 | # Manual dependencies on the ciphersuite support are necessary |
| 1903 | # because the automatic requirements from force_ciphersuite=... detection |
| 1904 | # make an exception for these test cases since they expect a handshake |
| 1905 | # failure. |
| 1906 | requires_config_enabled MBEDTLS_ARC4_C |
| 1907 | requires_config_enabled MBEDTLS_SHA1_C |
| 1908 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_RSA_ENABLED |
Simon Butcher | a410af5 | 2016-05-19 22:12:18 +0100 | [diff] [blame] | 1909 | requires_config_enabled MBEDTLS_REMOVE_ARC4_CIPHERSUITES |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 1910 | run_test "RC4: server disabled, client enabled" \ |
| 1911 | "$P_SRV" \ |
| 1912 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 1913 | 1 \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 1914 | -s "SSL - The server has no ciphersuites in common" |
| 1915 | |
Gilles Peskine | 719a652 | 2022-04-15 20:03:33 +0200 | [diff] [blame] | 1916 | requires_config_enabled MBEDTLS_ARC4_C |
| 1917 | requires_config_enabled MBEDTLS_SHA1_C |
| 1918 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_RSA_ENABLED |
Simon Butcher | a410af5 | 2016-05-19 22:12:18 +0100 | [diff] [blame] | 1919 | requires_config_enabled MBEDTLS_REMOVE_ARC4_CIPHERSUITES |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 1920 | run_test "RC4: server half, client enabled" \ |
| 1921 | "$P_SRV arc4=1" \ |
| 1922 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 1923 | 1 \ |
| 1924 | -s "SSL - The server has no ciphersuites in common" |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 1925 | |
Gilles Peskine | 719a652 | 2022-04-15 20:03:33 +0200 | [diff] [blame] | 1926 | requires_config_enabled MBEDTLS_ARC4_C |
| 1927 | requires_config_enabled MBEDTLS_SHA1_C |
| 1928 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_RSA_ENABLED |
| 1929 | requires_config_enabled MBEDTLS_REMOVE_ARC4_CIPHERSUITES |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 1930 | run_test "RC4: server enabled, client disabled" \ |
| 1931 | "$P_SRV force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 1932 | "$P_CLI" \ |
| 1933 | 1 \ |
| 1934 | -s "SSL - The server has no ciphersuites in common" |
| 1935 | |
Gilles Peskine | 719a652 | 2022-04-15 20:03:33 +0200 | [diff] [blame] | 1936 | # Run even if the ciphersuite is disabled by default, but only if the |
| 1937 | # requisite cryptographic mechanisms are present. |
| 1938 | # Having "force_ciphersuite=..." in the client or server arguments would |
| 1939 | # prevent that due to the automatic detection, so hide behind some |
| 1940 | # shell expansion to fool the automatic detection. |
| 1941 | with_rc4_ciphersuite() { |
| 1942 | exec "$@" force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA |
| 1943 | } |
| 1944 | requires_config_enabled MBEDTLS_ARC4_C |
| 1945 | requires_config_enabled MBEDTLS_SHA1_C |
| 1946 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_RSA_ENABLED |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 1947 | run_test "RC4: both enabled" \ |
Gilles Peskine | 719a652 | 2022-04-15 20:03:33 +0200 | [diff] [blame] | 1948 | "with_rc4_ciphersuite $P_SRV" \ |
| 1949 | "with_rc4_ciphersuite $P_CLI" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 1950 | 0 \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 1951 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 1952 | -S "SSL - The server has no ciphersuites in common" |
| 1953 | |
Hanno Becker | d26bb20 | 2018-08-17 09:54:10 +0100 | [diff] [blame] | 1954 | # Test empty CA list in CertificateRequest in TLS 1.1 and earlier |
| 1955 | |
| 1956 | requires_gnutls |
Hanno Becker | d26bb20 | 2018-08-17 09:54:10 +0100 | [diff] [blame] | 1957 | run_test "CertificateRequest with empty CA list, TLS 1.1 (GnuTLS server)" \ |
| 1958 | "$G_SRV"\ |
| 1959 | "$P_CLI force_version=tls1_1" \ |
| 1960 | 0 |
| 1961 | |
| 1962 | requires_gnutls |
Hanno Becker | d26bb20 | 2018-08-17 09:54:10 +0100 | [diff] [blame] | 1963 | run_test "CertificateRequest with empty CA list, TLS 1.0 (GnuTLS server)" \ |
| 1964 | "$G_SRV"\ |
| 1965 | "$P_CLI force_version=tls1" \ |
| 1966 | 0 |
| 1967 | |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 1968 | # Tests for SHA-1 support |
| 1969 | |
Gilles Peskine | e4d2ab8 | 2024-04-29 17:42:52 +0200 | [diff] [blame] | 1970 | requires_config_enabled MBEDTLS_SHA1_C |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 1971 | run_test "SHA-1 forbidden by default in server certificate" \ |
| 1972 | "$P_SRV key_file=data_files/server2.key crt_file=data_files/server2.crt" \ |
| 1973 | "$P_CLI debug_level=2 allow_sha1=0" \ |
| 1974 | 1 \ |
| 1975 | -c "The certificate is signed with an unacceptable hash" |
| 1976 | |
Gilles Peskine | e4d2ab8 | 2024-04-29 17:42:52 +0200 | [diff] [blame] | 1977 | requires_config_enabled MBEDTLS_SHA1_C |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 1978 | run_test "SHA-1 explicitly allowed in server certificate" \ |
| 1979 | "$P_SRV key_file=data_files/server2.key crt_file=data_files/server2.crt" \ |
| 1980 | "$P_CLI allow_sha1=1" \ |
| 1981 | 0 |
| 1982 | |
| 1983 | run_test "SHA-256 allowed by default in server certificate" \ |
| 1984 | "$P_SRV key_file=data_files/server2.key crt_file=data_files/server2-sha256.crt" \ |
| 1985 | "$P_CLI allow_sha1=0" \ |
| 1986 | 0 |
| 1987 | |
Gilles Peskine | e4d2ab8 | 2024-04-29 17:42:52 +0200 | [diff] [blame] | 1988 | requires_config_enabled MBEDTLS_SHA1_C |
| 1989 | requires_config_enabled MBEDTLS_RSA_C |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 1990 | run_test "SHA-1 forbidden by default in client certificate" \ |
| 1991 | "$P_SRV auth_mode=required allow_sha1=0" \ |
| 1992 | "$P_CLI key_file=data_files/cli-rsa.key crt_file=data_files/cli-rsa-sha1.crt" \ |
| 1993 | 1 \ |
| 1994 | -s "The certificate is signed with an unacceptable hash" |
| 1995 | |
Gilles Peskine | e4d2ab8 | 2024-04-29 17:42:52 +0200 | [diff] [blame] | 1996 | requires_config_enabled MBEDTLS_SHA1_C |
| 1997 | requires_config_enabled MBEDTLS_RSA_C |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 1998 | run_test "SHA-1 explicitly allowed in client certificate" \ |
| 1999 | "$P_SRV auth_mode=required allow_sha1=1" \ |
| 2000 | "$P_CLI key_file=data_files/cli-rsa.key crt_file=data_files/cli-rsa-sha1.crt" \ |
| 2001 | 0 |
| 2002 | |
Gilles Peskine | e4d2ab8 | 2024-04-29 17:42:52 +0200 | [diff] [blame] | 2003 | requires_config_enabled MBEDTLS_RSA_C |
| 2004 | requires_config_enabled MBEDTLS_SHA256_C |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 2005 | run_test "SHA-256 allowed by default in client certificate" \ |
| 2006 | "$P_SRV auth_mode=required allow_sha1=0" \ |
| 2007 | "$P_CLI key_file=data_files/cli-rsa.key crt_file=data_files/cli-rsa-sha256.crt" \ |
| 2008 | 0 |
| 2009 | |
Hanno Becker | 7ae8a76 | 2018-08-14 15:43:35 +0100 | [diff] [blame] | 2010 | # Tests for datagram packing |
| 2011 | run_test "DTLS: multiple records in same datagram, client and server" \ |
| 2012 | "$P_SRV dtls=1 dgram_packing=1 debug_level=2" \ |
| 2013 | "$P_CLI dtls=1 dgram_packing=1 debug_level=2" \ |
| 2014 | 0 \ |
| 2015 | -c "next record in same datagram" \ |
| 2016 | -s "next record in same datagram" |
| 2017 | |
| 2018 | run_test "DTLS: multiple records in same datagram, client only" \ |
| 2019 | "$P_SRV dtls=1 dgram_packing=0 debug_level=2" \ |
| 2020 | "$P_CLI dtls=1 dgram_packing=1 debug_level=2" \ |
| 2021 | 0 \ |
| 2022 | -s "next record in same datagram" \ |
| 2023 | -C "next record in same datagram" |
| 2024 | |
| 2025 | run_test "DTLS: multiple records in same datagram, server only" \ |
| 2026 | "$P_SRV dtls=1 dgram_packing=1 debug_level=2" \ |
| 2027 | "$P_CLI dtls=1 dgram_packing=0 debug_level=2" \ |
| 2028 | 0 \ |
| 2029 | -S "next record in same datagram" \ |
| 2030 | -c "next record in same datagram" |
| 2031 | |
| 2032 | run_test "DTLS: multiple records in same datagram, neither client nor server" \ |
| 2033 | "$P_SRV dtls=1 dgram_packing=0 debug_level=2" \ |
| 2034 | "$P_CLI dtls=1 dgram_packing=0 debug_level=2" \ |
| 2035 | 0 \ |
| 2036 | -S "next record in same datagram" \ |
| 2037 | -C "next record in same datagram" |
| 2038 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 2039 | # Tests for Truncated HMAC extension |
| 2040 | |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 2041 | run_test "Truncated HMAC: client default, server default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2042 | "$P_SRV debug_level=4" \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 2043 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 2044 | 0 \ |
Hanno Becker | 992b687 | 2017-11-09 18:57:39 +0000 | [diff] [blame] | 2045 | -s "dumping 'expected mac' (20 bytes)" \ |
| 2046 | -S "dumping 'expected mac' (10 bytes)" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 2047 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 2048 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 2049 | run_test "Truncated HMAC: client disabled, server default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 2050 | "$P_SRV debug_level=4" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 2051 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA trunc_hmac=0" \ |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 2052 | 0 \ |
Hanno Becker | 992b687 | 2017-11-09 18:57:39 +0000 | [diff] [blame] | 2053 | -s "dumping 'expected mac' (20 bytes)" \ |
| 2054 | -S "dumping 'expected mac' (10 bytes)" |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 2055 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 2056 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 2057 | run_test "Truncated HMAC: client enabled, server default" \ |
| 2058 | "$P_SRV debug_level=4" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 2059 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 2060 | 0 \ |
Hanno Becker | 992b687 | 2017-11-09 18:57:39 +0000 | [diff] [blame] | 2061 | -s "dumping 'expected mac' (20 bytes)" \ |
| 2062 | -S "dumping 'expected mac' (10 bytes)" |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 2063 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 2064 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 2065 | run_test "Truncated HMAC: client enabled, server disabled" \ |
| 2066 | "$P_SRV debug_level=4 trunc_hmac=0" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 2067 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 2068 | 0 \ |
Hanno Becker | 992b687 | 2017-11-09 18:57:39 +0000 | [diff] [blame] | 2069 | -s "dumping 'expected mac' (20 bytes)" \ |
| 2070 | -S "dumping 'expected mac' (10 bytes)" |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 2071 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 2072 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Hanno Becker | 34d0c3f | 2017-11-17 15:46:24 +0000 | [diff] [blame] | 2073 | run_test "Truncated HMAC: client disabled, server enabled" \ |
| 2074 | "$P_SRV debug_level=4 trunc_hmac=1" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 2075 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA trunc_hmac=0" \ |
Hanno Becker | 34d0c3f | 2017-11-17 15:46:24 +0000 | [diff] [blame] | 2076 | 0 \ |
| 2077 | -s "dumping 'expected mac' (20 bytes)" \ |
| 2078 | -S "dumping 'expected mac' (10 bytes)" |
| 2079 | |
| 2080 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 2081 | run_test "Truncated HMAC: client enabled, server enabled" \ |
| 2082 | "$P_SRV debug_level=4 trunc_hmac=1" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 2083 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 2084 | 0 \ |
Hanno Becker | 992b687 | 2017-11-09 18:57:39 +0000 | [diff] [blame] | 2085 | -S "dumping 'expected mac' (20 bytes)" \ |
| 2086 | -s "dumping 'expected mac' (10 bytes)" |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 2087 | |
Hanno Becker | 4c4f410 | 2017-11-10 09:16:05 +0000 | [diff] [blame] | 2088 | run_test "Truncated HMAC, DTLS: client default, server default" \ |
| 2089 | "$P_SRV dtls=1 debug_level=4" \ |
| 2090 | "$P_CLI dtls=1 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 2091 | 0 \ |
| 2092 | -s "dumping 'expected mac' (20 bytes)" \ |
| 2093 | -S "dumping 'expected mac' (10 bytes)" |
| 2094 | |
| 2095 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 2096 | run_test "Truncated HMAC, DTLS: client disabled, server default" \ |
| 2097 | "$P_SRV dtls=1 debug_level=4" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 2098 | "$P_CLI dtls=1 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA trunc_hmac=0" \ |
Hanno Becker | 4c4f410 | 2017-11-10 09:16:05 +0000 | [diff] [blame] | 2099 | 0 \ |
| 2100 | -s "dumping 'expected mac' (20 bytes)" \ |
| 2101 | -S "dumping 'expected mac' (10 bytes)" |
| 2102 | |
| 2103 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 2104 | run_test "Truncated HMAC, DTLS: client enabled, server default" \ |
| 2105 | "$P_SRV dtls=1 debug_level=4" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 2106 | "$P_CLI dtls=1 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA trunc_hmac=1" \ |
Hanno Becker | 4c4f410 | 2017-11-10 09:16:05 +0000 | [diff] [blame] | 2107 | 0 \ |
| 2108 | -s "dumping 'expected mac' (20 bytes)" \ |
| 2109 | -S "dumping 'expected mac' (10 bytes)" |
| 2110 | |
| 2111 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 2112 | run_test "Truncated HMAC, DTLS: client enabled, server disabled" \ |
| 2113 | "$P_SRV dtls=1 debug_level=4 trunc_hmac=0" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 2114 | "$P_CLI dtls=1 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA trunc_hmac=1" \ |
Hanno Becker | 4c4f410 | 2017-11-10 09:16:05 +0000 | [diff] [blame] | 2115 | 0 \ |
| 2116 | -s "dumping 'expected mac' (20 bytes)" \ |
| 2117 | -S "dumping 'expected mac' (10 bytes)" |
| 2118 | |
| 2119 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 2120 | run_test "Truncated HMAC, DTLS: client disabled, server enabled" \ |
| 2121 | "$P_SRV dtls=1 debug_level=4 trunc_hmac=1" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 2122 | "$P_CLI dtls=1 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA trunc_hmac=0" \ |
Hanno Becker | 4c4f410 | 2017-11-10 09:16:05 +0000 | [diff] [blame] | 2123 | 0 \ |
| 2124 | -s "dumping 'expected mac' (20 bytes)" \ |
| 2125 | -S "dumping 'expected mac' (10 bytes)" |
| 2126 | |
| 2127 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 2128 | run_test "Truncated HMAC, DTLS: client enabled, server enabled" \ |
| 2129 | "$P_SRV dtls=1 debug_level=4 trunc_hmac=1" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 2130 | "$P_CLI dtls=1 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 2131 | 0 \ |
| 2132 | -S "dumping 'expected mac' (20 bytes)" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 2133 | -s "dumping 'expected mac' (10 bytes)" |
| 2134 | |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2135 | # Tests for Context serialization |
| 2136 | |
| 2137 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2138 | run_test "Context serialization, client serializes, CCM" \ |
Manuel Pégourié-Gonnard | 862b319 | 2019-07-23 14:13:43 +0200 | [diff] [blame] | 2139 | "$P_SRV dtls=1 serialize=0 exchanges=2" \ |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2140 | "$P_CLI dtls=1 serialize=1 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2141 | 0 \ |
| 2142 | -c "Deserializing connection..." \ |
| 2143 | -S "Deserializing connection..." |
| 2144 | |
| 2145 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2146 | run_test "Context serialization, client serializes, ChaChaPoly" \ |
| 2147 | "$P_SRV dtls=1 serialize=0 exchanges=2" \ |
| 2148 | "$P_CLI dtls=1 serialize=1 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2149 | 0 \ |
| 2150 | -c "Deserializing connection..." \ |
| 2151 | -S "Deserializing connection..." |
| 2152 | |
| 2153 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2154 | run_test "Context serialization, client serializes, GCM" \ |
| 2155 | "$P_SRV dtls=1 serialize=0 exchanges=2" \ |
| 2156 | "$P_CLI dtls=1 serialize=1 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2157 | 0 \ |
Jarno Lamsa | cbee1b3 | 2019-06-04 15:18:19 +0300 | [diff] [blame] | 2158 | -c "Deserializing connection..." \ |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2159 | -S "Deserializing connection..." |
| 2160 | |
| 2161 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | 1b18fd3 | 2019-08-30 11:18:59 +0100 | [diff] [blame] | 2162 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2163 | run_test "Context serialization, client serializes, with CID" \ |
| 2164 | "$P_SRV dtls=1 serialize=0 exchanges=2 cid=1 cid_val=dead" \ |
| 2165 | "$P_CLI dtls=1 serialize=1 exchanges=2 cid=1 cid_val=beef" \ |
| 2166 | 0 \ |
| 2167 | -c "Deserializing connection..." \ |
| 2168 | -S "Deserializing connection..." |
| 2169 | |
| 2170 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2171 | run_test "Context serialization, server serializes, CCM" \ |
Manuel Pégourié-Gonnard | 862b319 | 2019-07-23 14:13:43 +0200 | [diff] [blame] | 2172 | "$P_SRV dtls=1 serialize=1 exchanges=2" \ |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2173 | "$P_CLI dtls=1 serialize=0 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2174 | 0 \ |
| 2175 | -C "Deserializing connection..." \ |
| 2176 | -s "Deserializing connection..." |
| 2177 | |
| 2178 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2179 | run_test "Context serialization, server serializes, ChaChaPoly" \ |
| 2180 | "$P_SRV dtls=1 serialize=1 exchanges=2" \ |
| 2181 | "$P_CLI dtls=1 serialize=0 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2182 | 0 \ |
| 2183 | -C "Deserializing connection..." \ |
| 2184 | -s "Deserializing connection..." |
| 2185 | |
| 2186 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2187 | run_test "Context serialization, server serializes, GCM" \ |
| 2188 | "$P_SRV dtls=1 serialize=1 exchanges=2" \ |
| 2189 | "$P_CLI dtls=1 serialize=0 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2190 | 0 \ |
Jarno Lamsa | cbee1b3 | 2019-06-04 15:18:19 +0300 | [diff] [blame] | 2191 | -C "Deserializing connection..." \ |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2192 | -s "Deserializing connection..." |
| 2193 | |
| 2194 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | 1b18fd3 | 2019-08-30 11:18:59 +0100 | [diff] [blame] | 2195 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2196 | run_test "Context serialization, server serializes, with CID" \ |
| 2197 | "$P_SRV dtls=1 serialize=1 exchanges=2 cid=1 cid_val=dead" \ |
| 2198 | "$P_CLI dtls=1 serialize=0 exchanges=2 cid=1 cid_val=beef" \ |
| 2199 | 0 \ |
| 2200 | -C "Deserializing connection..." \ |
| 2201 | -s "Deserializing connection..." |
| 2202 | |
| 2203 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2204 | run_test "Context serialization, both serialize, CCM" \ |
Manuel Pégourié-Gonnard | 862b319 | 2019-07-23 14:13:43 +0200 | [diff] [blame] | 2205 | "$P_SRV dtls=1 serialize=1 exchanges=2" \ |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2206 | "$P_CLI dtls=1 serialize=1 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2207 | 0 \ |
| 2208 | -c "Deserializing connection..." \ |
| 2209 | -s "Deserializing connection..." |
| 2210 | |
| 2211 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2212 | run_test "Context serialization, both serialize, ChaChaPoly" \ |
| 2213 | "$P_SRV dtls=1 serialize=1 exchanges=2" \ |
| 2214 | "$P_CLI dtls=1 serialize=1 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2215 | 0 \ |
| 2216 | -c "Deserializing connection..." \ |
| 2217 | -s "Deserializing connection..." |
| 2218 | |
| 2219 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2220 | run_test "Context serialization, both serialize, GCM" \ |
| 2221 | "$P_SRV dtls=1 serialize=1 exchanges=2" \ |
| 2222 | "$P_CLI dtls=1 serialize=1 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2223 | 0 \ |
Jarno Lamsa | cbee1b3 | 2019-06-04 15:18:19 +0300 | [diff] [blame] | 2224 | -c "Deserializing connection..." \ |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2225 | -s "Deserializing connection..." |
| 2226 | |
Jarno Lamsa | c2376f0 | 2019-06-06 10:44:14 +0300 | [diff] [blame] | 2227 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | 1b18fd3 | 2019-08-30 11:18:59 +0100 | [diff] [blame] | 2228 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2229 | run_test "Context serialization, both serialize, with CID" \ |
| 2230 | "$P_SRV dtls=1 serialize=1 exchanges=2 cid=1 cid_val=dead" \ |
| 2231 | "$P_CLI dtls=1 serialize=1 exchanges=2 cid=1 cid_val=beef" \ |
| 2232 | 0 \ |
| 2233 | -c "Deserializing connection..." \ |
| 2234 | -s "Deserializing connection..." |
| 2235 | |
| 2236 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2237 | run_test "Context serialization, re-init, client serializes, CCM" \ |
Manuel Pégourié-Gonnard | 862b319 | 2019-07-23 14:13:43 +0200 | [diff] [blame] | 2238 | "$P_SRV dtls=1 serialize=0 exchanges=2" \ |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2239 | "$P_CLI dtls=1 serialize=2 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2240 | 0 \ |
| 2241 | -c "Deserializing connection..." \ |
| 2242 | -S "Deserializing connection..." |
| 2243 | |
| 2244 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2245 | run_test "Context serialization, re-init, client serializes, ChaChaPoly" \ |
| 2246 | "$P_SRV dtls=1 serialize=0 exchanges=2" \ |
| 2247 | "$P_CLI dtls=1 serialize=2 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2248 | 0 \ |
| 2249 | -c "Deserializing connection..." \ |
| 2250 | -S "Deserializing connection..." |
| 2251 | |
| 2252 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2253 | run_test "Context serialization, re-init, client serializes, GCM" \ |
| 2254 | "$P_SRV dtls=1 serialize=0 exchanges=2" \ |
| 2255 | "$P_CLI dtls=1 serialize=2 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ |
Jarno Lamsa | c2376f0 | 2019-06-06 10:44:14 +0300 | [diff] [blame] | 2256 | 0 \ |
| 2257 | -c "Deserializing connection..." \ |
| 2258 | -S "Deserializing connection..." |
| 2259 | |
Jarno Lamsa | c2376f0 | 2019-06-06 10:44:14 +0300 | [diff] [blame] | 2260 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | 1b18fd3 | 2019-08-30 11:18:59 +0100 | [diff] [blame] | 2261 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2262 | run_test "Context serialization, re-init, client serializes, with CID" \ |
| 2263 | "$P_SRV dtls=1 serialize=0 exchanges=2 cid=1 cid_val=dead" \ |
| 2264 | "$P_CLI dtls=1 serialize=2 exchanges=2 cid=1 cid_val=beef" \ |
| 2265 | 0 \ |
| 2266 | -c "Deserializing connection..." \ |
| 2267 | -S "Deserializing connection..." |
| 2268 | |
| 2269 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2270 | run_test "Context serialization, re-init, server serializes, CCM" \ |
Manuel Pégourié-Gonnard | 862b319 | 2019-07-23 14:13:43 +0200 | [diff] [blame] | 2271 | "$P_SRV dtls=1 serialize=2 exchanges=2" \ |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2272 | "$P_CLI dtls=1 serialize=0 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2273 | 0 \ |
| 2274 | -C "Deserializing connection..." \ |
| 2275 | -s "Deserializing connection..." |
| 2276 | |
| 2277 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2278 | run_test "Context serialization, re-init, server serializes, ChaChaPoly" \ |
| 2279 | "$P_SRV dtls=1 serialize=2 exchanges=2" \ |
| 2280 | "$P_CLI dtls=1 serialize=0 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2281 | 0 \ |
| 2282 | -C "Deserializing connection..." \ |
| 2283 | -s "Deserializing connection..." |
| 2284 | |
| 2285 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2286 | run_test "Context serialization, re-init, server serializes, GCM" \ |
| 2287 | "$P_SRV dtls=1 serialize=2 exchanges=2" \ |
| 2288 | "$P_CLI dtls=1 serialize=0 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
Jarno Lamsa | c2376f0 | 2019-06-06 10:44:14 +0300 | [diff] [blame] | 2289 | 0 \ |
| 2290 | -C "Deserializing connection..." \ |
| 2291 | -s "Deserializing connection..." |
| 2292 | |
Jarno Lamsa | c2376f0 | 2019-06-06 10:44:14 +0300 | [diff] [blame] | 2293 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | 1b18fd3 | 2019-08-30 11:18:59 +0100 | [diff] [blame] | 2294 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2295 | run_test "Context serialization, re-init, server serializes, with CID" \ |
| 2296 | "$P_SRV dtls=1 serialize=2 exchanges=2 cid=1 cid_val=dead" \ |
| 2297 | "$P_CLI dtls=1 serialize=0 exchanges=2 cid=1 cid_val=beef" \ |
| 2298 | 0 \ |
| 2299 | -C "Deserializing connection..." \ |
| 2300 | -s "Deserializing connection..." |
| 2301 | |
| 2302 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2303 | run_test "Context serialization, re-init, both serialize, CCM" \ |
Manuel Pégourié-Gonnard | 862b319 | 2019-07-23 14:13:43 +0200 | [diff] [blame] | 2304 | "$P_SRV dtls=1 serialize=2 exchanges=2" \ |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2305 | "$P_CLI dtls=1 serialize=2 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2306 | 0 \ |
| 2307 | -c "Deserializing connection..." \ |
| 2308 | -s "Deserializing connection..." |
| 2309 | |
| 2310 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2311 | run_test "Context serialization, re-init, both serialize, ChaChaPoly" \ |
| 2312 | "$P_SRV dtls=1 serialize=2 exchanges=2" \ |
| 2313 | "$P_CLI dtls=1 serialize=2 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2314 | 0 \ |
| 2315 | -c "Deserializing connection..." \ |
| 2316 | -s "Deserializing connection..." |
| 2317 | |
| 2318 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2319 | run_test "Context serialization, re-init, both serialize, GCM" \ |
| 2320 | "$P_SRV dtls=1 serialize=2 exchanges=2" \ |
| 2321 | "$P_CLI dtls=1 serialize=2 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
Jarno Lamsa | c2376f0 | 2019-06-06 10:44:14 +0300 | [diff] [blame] | 2322 | 0 \ |
| 2323 | -c "Deserializing connection..." \ |
| 2324 | -s "Deserializing connection..." |
| 2325 | |
Hanno Becker | 1b18fd3 | 2019-08-30 11:18:59 +0100 | [diff] [blame] | 2326 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2327 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2328 | run_test "Context serialization, re-init, both serialize, with CID" \ |
| 2329 | "$P_SRV dtls=1 serialize=2 exchanges=2 cid=1 cid_val=dead" \ |
| 2330 | "$P_CLI dtls=1 serialize=2 exchanges=2 cid=1 cid_val=beef" \ |
| 2331 | 0 \ |
| 2332 | -c "Deserializing connection..." \ |
| 2333 | -s "Deserializing connection..." |
| 2334 | |
Piotr Nowicki | 3de298f | 2020-04-16 14:35:19 +0200 | [diff] [blame] | 2335 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2336 | run_test "Saving the serialized context to a file" \ |
| 2337 | "$P_SRV dtls=1 serialize=1 context_file=context_srv.txt" \ |
| 2338 | "$P_CLI dtls=1 serialize=1 context_file=context_cli.txt" \ |
| 2339 | 0 \ |
| 2340 | -s "Save serialized context to a file... ok" \ |
| 2341 | -c "Save serialized context to a file... ok" |
| 2342 | rm -f context_srv.txt |
| 2343 | rm -f context_cli.txt |
| 2344 | |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2345 | # Tests for DTLS Connection ID extension |
| 2346 | |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2347 | # So far, the CID API isn't implemented, so we can't |
| 2348 | # grep for output witnessing its use. This needs to be |
| 2349 | # changed once the CID extension is implemented. |
| 2350 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2351 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2352 | run_test "Connection ID: Cli enabled, Srv disabled" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2353 | "$P_SRV debug_level=3 dtls=1 cid=0" \ |
| 2354 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=deadbeef" \ |
| 2355 | 0 \ |
| 2356 | -s "Disable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2357 | -s "found CID extension" \ |
| 2358 | -s "Client sent CID extension, but CID disabled" \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2359 | -c "Enable use of CID extension." \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2360 | -c "client hello, adding CID extension" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2361 | -S "server hello, adding CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2362 | -C "found CID extension" \ |
| 2363 | -S "Copy CIDs into SSL transform" \ |
Hanno Becker | fcffdcc | 2019-04-26 17:19:46 +0100 | [diff] [blame] | 2364 | -C "Copy CIDs into SSL transform" \ |
| 2365 | -c "Use of Connection ID was rejected by the server" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2366 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2367 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2368 | run_test "Connection ID: Cli disabled, Srv enabled" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2369 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=deadbeef" \ |
| 2370 | "$P_CLI debug_level=3 dtls=1 cid=0" \ |
| 2371 | 0 \ |
| 2372 | -c "Disable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2373 | -C "client hello, adding CID extension" \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2374 | -S "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2375 | -s "Enable use of CID extension." \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2376 | -S "server hello, adding CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2377 | -C "found CID extension" \ |
| 2378 | -S "Copy CIDs into SSL transform" \ |
Hanno Becker | fcffdcc | 2019-04-26 17:19:46 +0100 | [diff] [blame] | 2379 | -C "Copy CIDs into SSL transform" \ |
Hanno Becker | b3e9dd5 | 2019-05-08 13:19:53 +0100 | [diff] [blame] | 2380 | -s "Use of Connection ID was not offered by client" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2381 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2382 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2383 | run_test "Connection ID: Cli+Srv enabled, Cli+Srv CID nonempty" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2384 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead" \ |
| 2385 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef" \ |
| 2386 | 0 \ |
| 2387 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2388 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2389 | -c "client hello, adding CID extension" \ |
| 2390 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2391 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2392 | -s "server hello, adding CID extension" \ |
| 2393 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2394 | -c "Use of CID extension negotiated" \ |
| 2395 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 2396 | -c "Copy CIDs into SSL transform" \ |
| 2397 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 2398 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 2399 | -s "Use of Connection ID has been negotiated" \ |
| 2400 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2401 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2402 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2403 | run_test "Connection ID, 3D: Cli+Srv enabled, Cli+Srv CID nonempty" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2404 | -p "$P_PXY drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2405 | "$P_SRV debug_level=3 dtls=1 cid=1 dgram_packing=0 cid_val=dead" \ |
| 2406 | "$P_CLI debug_level=3 dtls=1 cid=1 dgram_packing=0 cid_val=beef" \ |
| 2407 | 0 \ |
| 2408 | -c "Enable use of CID extension." \ |
| 2409 | -s "Enable use of CID extension." \ |
| 2410 | -c "client hello, adding CID extension" \ |
| 2411 | -s "found CID extension" \ |
| 2412 | -s "Use of CID extension negotiated" \ |
| 2413 | -s "server hello, adding CID extension" \ |
| 2414 | -c "found CID extension" \ |
| 2415 | -c "Use of CID extension negotiated" \ |
| 2416 | -s "Copy CIDs into SSL transform" \ |
| 2417 | -c "Copy CIDs into SSL transform" \ |
| 2418 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 2419 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 2420 | -s "Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2421 | -c "Use of Connection ID has been negotiated" \ |
| 2422 | -c "ignoring unexpected CID" \ |
| 2423 | -s "ignoring unexpected CID" |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2424 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2425 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2426 | run_test "Connection ID, MTU: Cli+Srv enabled, Cli+Srv CID nonempty" \ |
| 2427 | -p "$P_PXY mtu=800" \ |
| 2428 | "$P_SRV debug_level=3 mtu=800 dtls=1 cid=1 cid_val=dead" \ |
| 2429 | "$P_CLI debug_level=3 mtu=800 dtls=1 cid=1 cid_val=beef" \ |
| 2430 | 0 \ |
| 2431 | -c "Enable use of CID extension." \ |
| 2432 | -s "Enable use of CID extension." \ |
| 2433 | -c "client hello, adding CID extension" \ |
| 2434 | -s "found CID extension" \ |
| 2435 | -s "Use of CID extension negotiated" \ |
| 2436 | -s "server hello, adding CID extension" \ |
| 2437 | -c "found CID extension" \ |
| 2438 | -c "Use of CID extension negotiated" \ |
| 2439 | -s "Copy CIDs into SSL transform" \ |
| 2440 | -c "Copy CIDs into SSL transform" \ |
| 2441 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 2442 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 2443 | -s "Use of Connection ID has been negotiated" \ |
| 2444 | -c "Use of Connection ID has been negotiated" |
| 2445 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2446 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2447 | run_test "Connection ID, 3D+MTU: Cli+Srv enabled, Cli+Srv CID nonempty" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2448 | -p "$P_PXY mtu=800 drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2449 | "$P_SRV debug_level=3 mtu=800 dtls=1 cid=1 cid_val=dead" \ |
| 2450 | "$P_CLI debug_level=3 mtu=800 dtls=1 cid=1 cid_val=beef" \ |
| 2451 | 0 \ |
| 2452 | -c "Enable use of CID extension." \ |
| 2453 | -s "Enable use of CID extension." \ |
| 2454 | -c "client hello, adding CID extension" \ |
| 2455 | -s "found CID extension" \ |
| 2456 | -s "Use of CID extension negotiated" \ |
| 2457 | -s "server hello, adding CID extension" \ |
| 2458 | -c "found CID extension" \ |
| 2459 | -c "Use of CID extension negotiated" \ |
| 2460 | -s "Copy CIDs into SSL transform" \ |
| 2461 | -c "Copy CIDs into SSL transform" \ |
| 2462 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 2463 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 2464 | -s "Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2465 | -c "Use of Connection ID has been negotiated" \ |
| 2466 | -c "ignoring unexpected CID" \ |
| 2467 | -s "ignoring unexpected CID" |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2468 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2469 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2470 | run_test "Connection ID: Cli+Srv enabled, Cli CID empty" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2471 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=deadbeef" \ |
| 2472 | "$P_CLI debug_level=3 dtls=1 cid=1" \ |
| 2473 | 0 \ |
| 2474 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2475 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2476 | -c "client hello, adding CID extension" \ |
| 2477 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2478 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2479 | -s "server hello, adding CID extension" \ |
| 2480 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2481 | -c "Use of CID extension negotiated" \ |
| 2482 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 2483 | -c "Copy CIDs into SSL transform" \ |
| 2484 | -c "Peer CID (length 4 Bytes): de ad be ef" \ |
| 2485 | -s "Peer CID (length 0 Bytes):" \ |
| 2486 | -s "Use of Connection ID has been negotiated" \ |
| 2487 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2488 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2489 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2490 | run_test "Connection ID: Cli+Srv enabled, Srv CID empty" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2491 | "$P_SRV debug_level=3 dtls=1 cid=1" \ |
| 2492 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=deadbeef" \ |
| 2493 | 0 \ |
| 2494 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2495 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2496 | -c "client hello, adding CID extension" \ |
| 2497 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2498 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2499 | -s "server hello, adding CID extension" \ |
| 2500 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2501 | -c "Use of CID extension negotiated" \ |
| 2502 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 2503 | -c "Copy CIDs into SSL transform" \ |
| 2504 | -s "Peer CID (length 4 Bytes): de ad be ef" \ |
| 2505 | -c "Peer CID (length 0 Bytes):" \ |
| 2506 | -s "Use of Connection ID has been negotiated" \ |
| 2507 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2508 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2509 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2510 | run_test "Connection ID: Cli+Srv enabled, Cli+Srv CID empty" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2511 | "$P_SRV debug_level=3 dtls=1 cid=1" \ |
| 2512 | "$P_CLI debug_level=3 dtls=1 cid=1" \ |
| 2513 | 0 \ |
| 2514 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2515 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2516 | -c "client hello, adding CID extension" \ |
| 2517 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2518 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2519 | -s "server hello, adding CID extension" \ |
| 2520 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2521 | -c "Use of CID extension negotiated" \ |
| 2522 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | fcffdcc | 2019-04-26 17:19:46 +0100 | [diff] [blame] | 2523 | -c "Copy CIDs into SSL transform" \ |
| 2524 | -S "Use of Connection ID has been negotiated" \ |
| 2525 | -C "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2526 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2527 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2528 | run_test "Connection ID: Cli+Srv enabled, Cli+Srv CID nonempty, AES-128-CCM-8" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2529 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead" \ |
| 2530 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2531 | 0 \ |
| 2532 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2533 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2534 | -c "client hello, adding CID extension" \ |
| 2535 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2536 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2537 | -s "server hello, adding CID extension" \ |
| 2538 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2539 | -c "Use of CID extension negotiated" \ |
| 2540 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 2541 | -c "Copy CIDs into SSL transform" \ |
| 2542 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 2543 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 2544 | -s "Use of Connection ID has been negotiated" \ |
| 2545 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2546 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2547 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2548 | run_test "Connection ID: Cli+Srv enabled, Cli CID empty, AES-128-CCM-8" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2549 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=deadbeef" \ |
| 2550 | "$P_CLI debug_level=3 dtls=1 cid=1 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2551 | 0 \ |
| 2552 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2553 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2554 | -c "client hello, adding CID extension" \ |
| 2555 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2556 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2557 | -s "server hello, adding CID extension" \ |
| 2558 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2559 | -c "Use of CID extension negotiated" \ |
| 2560 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 2561 | -c "Copy CIDs into SSL transform" \ |
| 2562 | -c "Peer CID (length 4 Bytes): de ad be ef" \ |
| 2563 | -s "Peer CID (length 0 Bytes):" \ |
| 2564 | -s "Use of Connection ID has been negotiated" \ |
| 2565 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2566 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2567 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2568 | run_test "Connection ID: Cli+Srv enabled, Srv CID empty, AES-128-CCM-8" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2569 | "$P_SRV debug_level=3 dtls=1 cid=1" \ |
| 2570 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=deadbeef force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2571 | 0 \ |
| 2572 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2573 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2574 | -c "client hello, adding CID extension" \ |
| 2575 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2576 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2577 | -s "server hello, adding CID extension" \ |
| 2578 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2579 | -c "Use of CID extension negotiated" \ |
| 2580 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 2581 | -c "Copy CIDs into SSL transform" \ |
| 2582 | -s "Peer CID (length 4 Bytes): de ad be ef" \ |
| 2583 | -c "Peer CID (length 0 Bytes):" \ |
| 2584 | -s "Use of Connection ID has been negotiated" \ |
| 2585 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2586 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2587 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2588 | run_test "Connection ID: Cli+Srv enabled, Cli+Srv CID empty, AES-128-CCM-8" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2589 | "$P_SRV debug_level=3 dtls=1 cid=1" \ |
| 2590 | "$P_CLI debug_level=3 dtls=1 cid=1 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2591 | 0 \ |
| 2592 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2593 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2594 | -c "client hello, adding CID extension" \ |
| 2595 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2596 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2597 | -s "server hello, adding CID extension" \ |
| 2598 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2599 | -c "Use of CID extension negotiated" \ |
| 2600 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | fcffdcc | 2019-04-26 17:19:46 +0100 | [diff] [blame] | 2601 | -c "Copy CIDs into SSL transform" \ |
| 2602 | -S "Use of Connection ID has been negotiated" \ |
| 2603 | -C "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2604 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2605 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2606 | run_test "Connection ID: Cli+Srv enabled, Cli+Srv CID nonempty, AES-128-CBC" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2607 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead" \ |
| 2608 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 2609 | 0 \ |
| 2610 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2611 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2612 | -c "client hello, adding CID extension" \ |
| 2613 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2614 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2615 | -s "server hello, adding CID extension" \ |
| 2616 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2617 | -c "Use of CID extension negotiated" \ |
| 2618 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 2619 | -c "Copy CIDs into SSL transform" \ |
| 2620 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 2621 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 2622 | -s "Use of Connection ID has been negotiated" \ |
| 2623 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2624 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2625 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2626 | run_test "Connection ID: Cli+Srv enabled, Cli CID empty, AES-128-CBC" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2627 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=deadbeef" \ |
| 2628 | "$P_CLI debug_level=3 dtls=1 cid=1 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 2629 | 0 \ |
| 2630 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2631 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2632 | -c "client hello, adding CID extension" \ |
| 2633 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2634 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2635 | -s "server hello, adding CID extension" \ |
| 2636 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2637 | -c "Use of CID extension negotiated" \ |
| 2638 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 2639 | -c "Copy CIDs into SSL transform" \ |
| 2640 | -c "Peer CID (length 4 Bytes): de ad be ef" \ |
| 2641 | -s "Peer CID (length 0 Bytes):" \ |
| 2642 | -s "Use of Connection ID has been negotiated" \ |
| 2643 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2644 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2645 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2646 | run_test "Connection ID: Cli+Srv enabled, Srv CID empty, AES-128-CBC" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2647 | "$P_SRV debug_level=3 dtls=1 cid=1" \ |
| 2648 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=deadbeef force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 2649 | 0 \ |
| 2650 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2651 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2652 | -c "client hello, adding CID extension" \ |
| 2653 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2654 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2655 | -s "server hello, adding CID extension" \ |
| 2656 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2657 | -c "Use of CID extension negotiated" \ |
| 2658 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 2659 | -c "Copy CIDs into SSL transform" \ |
| 2660 | -s "Peer CID (length 4 Bytes): de ad be ef" \ |
| 2661 | -c "Peer CID (length 0 Bytes):" \ |
| 2662 | -s "Use of Connection ID has been negotiated" \ |
| 2663 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2664 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2665 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2666 | run_test "Connection ID: Cli+Srv enabled, Cli+Srv CID empty, AES-128-CBC" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2667 | "$P_SRV debug_level=3 dtls=1 cid=1" \ |
| 2668 | "$P_CLI debug_level=3 dtls=1 cid=1 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 2669 | 0 \ |
| 2670 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2671 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2672 | -c "client hello, adding CID extension" \ |
| 2673 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2674 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2675 | -s "server hello, adding CID extension" \ |
| 2676 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2677 | -c "Use of CID extension negotiated" \ |
| 2678 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | fcffdcc | 2019-04-26 17:19:46 +0100 | [diff] [blame] | 2679 | -c "Copy CIDs into SSL transform" \ |
| 2680 | -S "Use of Connection ID has been negotiated" \ |
| 2681 | -C "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2682 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2683 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 9bae30d | 2019-04-23 11:52:44 +0100 | [diff] [blame] | 2684 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2685 | run_test "Connection ID: Cli+Srv enabled, renegotiate without change of CID" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2686 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead renegotiation=1" \ |
| 2687 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef renegotiation=1 renegotiate=1" \ |
| 2688 | 0 \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2689 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 2690 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 2691 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2692 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2693 | -c "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2694 | -s "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2695 | -s "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2696 | -c "(after renegotiation) Use of Connection ID has been negotiated" |
| 2697 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2698 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2699 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2700 | run_test "Connection ID: Cli+Srv enabled, renegotiate with different CID" \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2701 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead cid_val_renego=beef renegotiation=1" \ |
| 2702 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef cid_val_renego=dead renegotiation=1 renegotiate=1" \ |
| 2703 | 0 \ |
| 2704 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 2705 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 2706 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2707 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2708 | -c "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2709 | -s "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2710 | -s "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2711 | -c "(after renegotiation) Use of Connection ID has been negotiated" |
| 2712 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2713 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2714 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | c2045b0 | 2019-05-08 16:20:46 +0100 | [diff] [blame] | 2715 | run_test "Connection ID, no packing: Cli+Srv enabled, renegotiate with different CID" \ |
| 2716 | "$P_SRV debug_level=3 dtls=1 cid=1 dgram_packing=0 cid_val=dead cid_val_renego=beef renegotiation=1" \ |
| 2717 | "$P_CLI debug_level=3 dtls=1 cid=1 dgram_packing=0 cid_val=beef cid_val_renego=dead renegotiation=1 renegotiate=1" \ |
| 2718 | 0 \ |
| 2719 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 2720 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 2721 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2722 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2723 | -c "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2724 | -s "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2725 | -s "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2726 | -c "(after renegotiation) Use of Connection ID has been negotiated" |
| 2727 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2728 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | c2045b0 | 2019-05-08 16:20:46 +0100 | [diff] [blame] | 2729 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2730 | run_test "Connection ID, 3D+MTU: Cli+Srv enabled, renegotiate with different CID" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2731 | -p "$P_PXY mtu=800 drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2732 | "$P_SRV debug_level=3 mtu=800 dtls=1 cid=1 cid_val=dead cid_val_renego=beef renegotiation=1" \ |
| 2733 | "$P_CLI debug_level=3 mtu=800 dtls=1 cid=1 cid_val=beef cid_val_renego=dead renegotiation=1 renegotiate=1" \ |
| 2734 | 0 \ |
| 2735 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 2736 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 2737 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2738 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2739 | -c "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2740 | -s "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2741 | -s "(after renegotiation) Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2742 | -c "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2743 | -c "ignoring unexpected CID" \ |
| 2744 | -s "ignoring unexpected CID" |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2745 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2746 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2747 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 2748 | run_test "Connection ID: Cli+Srv enabled, renegotiate without CID" \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2749 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead cid_renego=0 renegotiation=1" \ |
| 2750 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef cid_renego=0 renegotiation=1 renegotiate=1" \ |
| 2751 | 0 \ |
| 2752 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 2753 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 2754 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2755 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2756 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2757 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2758 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2759 | -S "(after renegotiation) Use of Connection ID has been negotiated" |
| 2760 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2761 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2762 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | c2045b0 | 2019-05-08 16:20:46 +0100 | [diff] [blame] | 2763 | run_test "Connection ID, no packing: Cli+Srv enabled, renegotiate without CID" \ |
| 2764 | "$P_SRV debug_level=3 dtls=1 dgram_packing=0 cid=1 cid_val=dead cid_renego=0 renegotiation=1" \ |
| 2765 | "$P_CLI debug_level=3 dtls=1 dgram_packing=0 cid=1 cid_val=beef cid_renego=0 renegotiation=1 renegotiate=1" \ |
| 2766 | 0 \ |
| 2767 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 2768 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 2769 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2770 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2771 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2772 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2773 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2774 | -S "(after renegotiation) Use of Connection ID has been negotiated" |
| 2775 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2776 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | c2045b0 | 2019-05-08 16:20:46 +0100 | [diff] [blame] | 2777 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2778 | run_test "Connection ID, 3D+MTU: Cli+Srv enabled, renegotiate without CID" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2779 | -p "$P_PXY drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2780 | "$P_SRV debug_level=3 mtu=800 dtls=1 cid=1 cid_val=dead cid_renego=0 renegotiation=1" \ |
| 2781 | "$P_CLI debug_level=3 mtu=800 dtls=1 cid=1 cid_val=beef cid_renego=0 renegotiation=1 renegotiate=1" \ |
| 2782 | 0 \ |
| 2783 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 2784 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 2785 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2786 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2787 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2788 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2789 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2790 | -S "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2791 | -c "ignoring unexpected CID" \ |
| 2792 | -s "ignoring unexpected CID" |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2793 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2794 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2795 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 2796 | run_test "Connection ID: Cli+Srv enabled, CID on renegotiation" \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2797 | "$P_SRV debug_level=3 dtls=1 cid=0 cid_renego=1 cid_val_renego=dead renegotiation=1" \ |
| 2798 | "$P_CLI debug_level=3 dtls=1 cid=0 cid_renego=1 cid_val_renego=beef renegotiation=1 renegotiate=1" \ |
| 2799 | 0 \ |
| 2800 | -S "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2801 | -C "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2802 | -c "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2803 | -s "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2804 | -c "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2805 | -s "(after renegotiation) Use of Connection ID has been negotiated" |
| 2806 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2807 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2808 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | c2045b0 | 2019-05-08 16:20:46 +0100 | [diff] [blame] | 2809 | run_test "Connection ID, no packing: Cli+Srv enabled, CID on renegotiation" \ |
| 2810 | "$P_SRV debug_level=3 dtls=1 dgram_packing=0 cid=0 cid_renego=1 cid_val_renego=dead renegotiation=1" \ |
| 2811 | "$P_CLI debug_level=3 dtls=1 dgram_packing=0 cid=0 cid_renego=1 cid_val_renego=beef renegotiation=1 renegotiate=1" \ |
| 2812 | 0 \ |
| 2813 | -S "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2814 | -C "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2815 | -c "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2816 | -s "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2817 | -c "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2818 | -s "(after renegotiation) Use of Connection ID has been negotiated" |
| 2819 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2820 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | c2045b0 | 2019-05-08 16:20:46 +0100 | [diff] [blame] | 2821 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2822 | run_test "Connection ID, 3D+MTU: Cli+Srv enabled, CID on renegotiation" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2823 | -p "$P_PXY mtu=800 drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2824 | "$P_SRV debug_level=3 mtu=800 dtls=1 dgram_packing=1 cid=0 cid_renego=1 cid_val_renego=dead renegotiation=1" \ |
| 2825 | "$P_CLI debug_level=3 mtu=800 dtls=1 dgram_packing=1 cid=0 cid_renego=1 cid_val_renego=beef renegotiation=1 renegotiate=1" \ |
| 2826 | 0 \ |
| 2827 | -S "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2828 | -C "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2829 | -c "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2830 | -s "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2831 | -c "(after renegotiation) Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2832 | -s "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2833 | -c "ignoring unexpected CID" \ |
| 2834 | -s "ignoring unexpected CID" |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2835 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2836 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2837 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 2838 | run_test "Connection ID: Cli+Srv enabled, Cli disables on renegotiation" \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2839 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead renegotiation=1" \ |
| 2840 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef cid_renego=0 renegotiation=1 renegotiate=1" \ |
| 2841 | 0 \ |
| 2842 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 2843 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 2844 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2845 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2846 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2847 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2848 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2849 | -S "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2850 | -s "(after renegotiation) Use of Connection ID was not offered by client" |
| 2851 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2852 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2853 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2854 | run_test "Connection ID, 3D: Cli+Srv enabled, Cli disables on renegotiation" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2855 | -p "$P_PXY drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2856 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead renegotiation=1" \ |
| 2857 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef cid_renego=0 renegotiation=1 renegotiate=1" \ |
| 2858 | 0 \ |
| 2859 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 2860 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 2861 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2862 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2863 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2864 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2865 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2866 | -S "(after renegotiation) Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2867 | -s "(after renegotiation) Use of Connection ID was not offered by client" \ |
| 2868 | -c "ignoring unexpected CID" \ |
| 2869 | -s "ignoring unexpected CID" |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2870 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2871 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2872 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 2873 | run_test "Connection ID: Cli+Srv enabled, Srv disables on renegotiation" \ |
| 2874 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead cid_renego=0 renegotiation=1" \ |
| 2875 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef renegotiation=1 renegotiate=1" \ |
| 2876 | 0 \ |
| 2877 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 2878 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 2879 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2880 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2881 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2882 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2883 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2884 | -S "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2885 | -c "(after renegotiation) Use of Connection ID was rejected by the server" |
| 2886 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2887 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2888 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 2889 | run_test "Connection ID, 3D: Cli+Srv enabled, Srv disables on renegotiation" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2890 | -p "$P_PXY drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2891 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead cid_renego=0 renegotiation=1" \ |
| 2892 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef renegotiation=1 renegotiate=1" \ |
| 2893 | 0 \ |
| 2894 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 2895 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 2896 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2897 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2898 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 2899 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 2900 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 2901 | -S "(after renegotiation) Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 2902 | -c "(after renegotiation) Use of Connection ID was rejected by the server" \ |
| 2903 | -c "ignoring unexpected CID" \ |
| 2904 | -s "ignoring unexpected CID" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2905 | |
Yuto Takano | 7187953 | 2021-07-09 11:32:38 +0100 | [diff] [blame] | 2906 | # This and the test below it require MAX_CONTENT_LEN to be at least MFL+1, because the |
| 2907 | # tests check that the buffer contents are reallocated when the message is |
| 2908 | # larger than the buffer. |
Andrzej Kurek | b657783 | 2020-06-08 07:08:03 -0400 | [diff] [blame] | 2909 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2910 | requires_config_enabled MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH |
Yuto Takano | 7187953 | 2021-07-09 11:32:38 +0100 | [diff] [blame] | 2911 | requires_max_content_len 513 |
Andrzej Kurek | b657783 | 2020-06-08 07:08:03 -0400 | [diff] [blame] | 2912 | run_test "Connection ID: Cli+Srv enabled, variable buffer lengths, MFL=512" \ |
| 2913 | "$P_SRV dtls=1 cid=1 cid_val=dead debug_level=2" \ |
| 2914 | "$P_CLI force_ciphersuite="TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" max_frag_len=512 dtls=1 cid=1 cid_val=beef" \ |
| 2915 | 0 \ |
| 2916 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 2917 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 2918 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2919 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2920 | -s "Reallocating in_buf" \ |
| 2921 | -s "Reallocating out_buf" |
| 2922 | |
| 2923 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2924 | requires_config_enabled MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH |
Yuto Takano | 7187953 | 2021-07-09 11:32:38 +0100 | [diff] [blame] | 2925 | requires_max_content_len 1025 |
Andrzej Kurek | b657783 | 2020-06-08 07:08:03 -0400 | [diff] [blame] | 2926 | run_test "Connection ID: Cli+Srv enabled, variable buffer lengths, MFL=1024" \ |
| 2927 | "$P_SRV dtls=1 cid=1 cid_val=dead debug_level=2" \ |
| 2928 | "$P_CLI force_ciphersuite="TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" max_frag_len=1024 dtls=1 cid=1 cid_val=beef" \ |
| 2929 | 0 \ |
| 2930 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 2931 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 2932 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2933 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 2934 | -s "Reallocating in_buf" \ |
| 2935 | -s "Reallocating out_buf" |
| 2936 | |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 2937 | # Tests for Encrypt-then-MAC extension |
| 2938 | |
| 2939 | run_test "Encrypt then MAC: default" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 2940 | "$P_SRV debug_level=3 \ |
| 2941 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 2942 | "$P_CLI debug_level=3" \ |
| 2943 | 0 \ |
| 2944 | -c "client hello, adding encrypt_then_mac extension" \ |
| 2945 | -s "found encrypt then mac extension" \ |
| 2946 | -s "server hello, adding encrypt then mac extension" \ |
| 2947 | -c "found encrypt_then_mac extension" \ |
| 2948 | -c "using encrypt then mac" \ |
| 2949 | -s "using encrypt then mac" |
| 2950 | |
| 2951 | run_test "Encrypt then MAC: client enabled, server disabled" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 2952 | "$P_SRV debug_level=3 etm=0 \ |
| 2953 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 2954 | "$P_CLI debug_level=3 etm=1" \ |
| 2955 | 0 \ |
| 2956 | -c "client hello, adding encrypt_then_mac extension" \ |
| 2957 | -s "found encrypt then mac extension" \ |
| 2958 | -S "server hello, adding encrypt then mac extension" \ |
| 2959 | -C "found encrypt_then_mac extension" \ |
| 2960 | -C "using encrypt then mac" \ |
| 2961 | -S "using encrypt then mac" |
| 2962 | |
Manuel Pégourié-Gonnard | 78e745f | 2014-11-04 15:44:06 +0100 | [diff] [blame] | 2963 | run_test "Encrypt then MAC: client enabled, aead cipher" \ |
| 2964 | "$P_SRV debug_level=3 etm=1 \ |
| 2965 | force_ciphersuite=TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 2966 | "$P_CLI debug_level=3 etm=1" \ |
| 2967 | 0 \ |
| 2968 | -c "client hello, adding encrypt_then_mac extension" \ |
| 2969 | -s "found encrypt then mac extension" \ |
| 2970 | -S "server hello, adding encrypt then mac extension" \ |
| 2971 | -C "found encrypt_then_mac extension" \ |
| 2972 | -C "using encrypt then mac" \ |
| 2973 | -S "using encrypt then mac" |
| 2974 | |
| 2975 | run_test "Encrypt then MAC: client enabled, stream cipher" \ |
| 2976 | "$P_SRV debug_level=3 etm=1 \ |
| 2977 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 2978 | "$P_CLI debug_level=3 etm=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 78e745f | 2014-11-04 15:44:06 +0100 | [diff] [blame] | 2979 | 0 \ |
| 2980 | -c "client hello, adding encrypt_then_mac extension" \ |
| 2981 | -s "found encrypt then mac extension" \ |
| 2982 | -S "server hello, adding encrypt then mac extension" \ |
| 2983 | -C "found encrypt_then_mac extension" \ |
| 2984 | -C "using encrypt then mac" \ |
| 2985 | -S "using encrypt then mac" |
| 2986 | |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 2987 | run_test "Encrypt then MAC: client disabled, server enabled" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 2988 | "$P_SRV debug_level=3 etm=1 \ |
| 2989 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 2990 | "$P_CLI debug_level=3 etm=0" \ |
| 2991 | 0 \ |
| 2992 | -C "client hello, adding encrypt_then_mac extension" \ |
| 2993 | -S "found encrypt then mac extension" \ |
| 2994 | -S "server hello, adding encrypt then mac extension" \ |
| 2995 | -C "found encrypt_then_mac extension" \ |
| 2996 | -C "using encrypt then mac" \ |
| 2997 | -S "using encrypt then mac" |
| 2998 | |
| 2999 | run_test "Encrypt then MAC: client SSLv3, server enabled" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 3000 | "$P_SRV debug_level=3 min_version=ssl3 \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 3001 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 3002 | "$P_CLI debug_level=3 force_version=ssl3" \ |
| 3003 | 0 \ |
| 3004 | -C "client hello, adding encrypt_then_mac extension" \ |
| 3005 | -S "found encrypt then mac extension" \ |
| 3006 | -S "server hello, adding encrypt then mac extension" \ |
| 3007 | -C "found encrypt_then_mac extension" \ |
| 3008 | -C "using encrypt then mac" \ |
| 3009 | -S "using encrypt then mac" |
| 3010 | |
| 3011 | run_test "Encrypt then MAC: client enabled, server SSLv3" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 3012 | "$P_SRV debug_level=3 force_version=ssl3 \ |
| 3013 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 3014 | "$P_CLI debug_level=3 min_version=ssl3" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 3015 | 0 \ |
| 3016 | -c "client hello, adding encrypt_then_mac extension" \ |
Janos Follath | 00efff7 | 2016-05-06 13:48:23 +0100 | [diff] [blame] | 3017 | -S "found encrypt then mac extension" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 3018 | -S "server hello, adding encrypt then mac extension" \ |
| 3019 | -C "found encrypt_then_mac extension" \ |
| 3020 | -C "using encrypt then mac" \ |
| 3021 | -S "using encrypt then mac" |
| 3022 | |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3023 | # Tests for Extended Master Secret extension |
| 3024 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3025 | requires_config_enabled MBEDTLS_SSL_EXTENDED_MASTER_SECRET |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3026 | run_test "Extended Master Secret: default" \ |
| 3027 | "$P_SRV debug_level=3" \ |
| 3028 | "$P_CLI debug_level=3" \ |
| 3029 | 0 \ |
| 3030 | -c "client hello, adding extended_master_secret extension" \ |
| 3031 | -s "found extended master secret extension" \ |
| 3032 | -s "server hello, adding extended master secret extension" \ |
| 3033 | -c "found extended_master_secret extension" \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 3034 | -c "session hash for extended master secret" \ |
| 3035 | -s "session hash for extended master secret" |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3036 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3037 | requires_config_enabled MBEDTLS_SSL_EXTENDED_MASTER_SECRET |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3038 | run_test "Extended Master Secret: client enabled, server disabled" \ |
| 3039 | "$P_SRV debug_level=3 extended_ms=0" \ |
| 3040 | "$P_CLI debug_level=3 extended_ms=1" \ |
| 3041 | 0 \ |
| 3042 | -c "client hello, adding extended_master_secret extension" \ |
| 3043 | -s "found extended master secret extension" \ |
| 3044 | -S "server hello, adding extended master secret extension" \ |
| 3045 | -C "found extended_master_secret extension" \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 3046 | -C "session hash for extended master secret" \ |
| 3047 | -S "session hash for extended master secret" |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3048 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3049 | requires_config_enabled MBEDTLS_SSL_EXTENDED_MASTER_SECRET |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3050 | run_test "Extended Master Secret: client disabled, server enabled" \ |
| 3051 | "$P_SRV debug_level=3 extended_ms=1" \ |
| 3052 | "$P_CLI debug_level=3 extended_ms=0" \ |
| 3053 | 0 \ |
| 3054 | -C "client hello, adding extended_master_secret extension" \ |
| 3055 | -S "found extended master secret extension" \ |
| 3056 | -S "server hello, adding extended master secret extension" \ |
| 3057 | -C "found extended_master_secret extension" \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 3058 | -C "session hash for extended master secret" \ |
| 3059 | -S "session hash for extended master secret" |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3060 | |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 3061 | run_test "Extended Master Secret: client SSLv3, server enabled" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 3062 | "$P_SRV debug_level=3 min_version=ssl3" \ |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 3063 | "$P_CLI debug_level=3 force_version=ssl3" \ |
| 3064 | 0 \ |
| 3065 | -C "client hello, adding extended_master_secret extension" \ |
| 3066 | -S "found extended master secret extension" \ |
| 3067 | -S "server hello, adding extended master secret extension" \ |
| 3068 | -C "found extended_master_secret extension" \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 3069 | -C "session hash for extended master secret" \ |
| 3070 | -S "session hash for extended master secret" |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 3071 | |
| 3072 | run_test "Extended Master Secret: client enabled, server SSLv3" \ |
| 3073 | "$P_SRV debug_level=3 force_version=ssl3" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 3074 | "$P_CLI debug_level=3 min_version=ssl3" \ |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 3075 | 0 \ |
| 3076 | -c "client hello, adding extended_master_secret extension" \ |
Janos Follath | 00efff7 | 2016-05-06 13:48:23 +0100 | [diff] [blame] | 3077 | -S "found extended master secret extension" \ |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 3078 | -S "server hello, adding extended master secret extension" \ |
| 3079 | -C "found extended_master_secret extension" \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 3080 | -C "session hash for extended master secret" \ |
| 3081 | -S "session hash for extended master secret" |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 3082 | |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 3083 | # Tests for FALLBACK_SCSV |
| 3084 | |
| 3085 | run_test "Fallback SCSV: default" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 3086 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 3087 | "$P_CLI debug_level=3 force_version=tls1_1" \ |
| 3088 | 0 \ |
| 3089 | -C "adding FALLBACK_SCSV" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 3090 | -S "received FALLBACK_SCSV" \ |
| 3091 | -S "inapropriate fallback" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 3092 | -C "is a fatal alert message (msg 86)" |
| 3093 | |
| 3094 | run_test "Fallback SCSV: explicitly disabled" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 3095 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 3096 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \ |
| 3097 | 0 \ |
| 3098 | -C "adding FALLBACK_SCSV" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 3099 | -S "received FALLBACK_SCSV" \ |
| 3100 | -S "inapropriate fallback" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 3101 | -C "is a fatal alert message (msg 86)" |
| 3102 | |
| 3103 | run_test "Fallback SCSV: enabled" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 3104 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 3105 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 3106 | 1 \ |
| 3107 | -c "adding FALLBACK_SCSV" \ |
| 3108 | -s "received FALLBACK_SCSV" \ |
| 3109 | -s "inapropriate fallback" \ |
| 3110 | -c "is a fatal alert message (msg 86)" |
| 3111 | |
| 3112 | run_test "Fallback SCSV: enabled, max version" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 3113 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 3114 | "$P_CLI debug_level=3 fallback=1" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 3115 | 0 \ |
| 3116 | -c "adding FALLBACK_SCSV" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 3117 | -s "received FALLBACK_SCSV" \ |
| 3118 | -S "inapropriate fallback" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 3119 | -C "is a fatal alert message (msg 86)" |
| 3120 | |
| 3121 | requires_openssl_with_fallback_scsv |
| 3122 | run_test "Fallback SCSV: default, openssl server" \ |
| 3123 | "$O_SRV" \ |
| 3124 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \ |
| 3125 | 0 \ |
| 3126 | -C "adding FALLBACK_SCSV" \ |
| 3127 | -C "is a fatal alert message (msg 86)" |
| 3128 | |
| 3129 | requires_openssl_with_fallback_scsv |
| 3130 | run_test "Fallback SCSV: enabled, openssl server" \ |
| 3131 | "$O_SRV" \ |
| 3132 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \ |
| 3133 | 1 \ |
| 3134 | -c "adding FALLBACK_SCSV" \ |
| 3135 | -c "is a fatal alert message (msg 86)" |
| 3136 | |
Gilles Peskine | add21ad | 2022-04-15 15:14:58 +0200 | [diff] [blame] | 3137 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1 |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 3138 | requires_openssl_with_fallback_scsv |
| 3139 | run_test "Fallback SCSV: disabled, openssl client" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 3140 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 3141 | "$O_CLI -tls1_1" \ |
| 3142 | 0 \ |
| 3143 | -S "received FALLBACK_SCSV" \ |
| 3144 | -S "inapropriate fallback" |
| 3145 | |
Gilles Peskine | add21ad | 2022-04-15 15:14:58 +0200 | [diff] [blame] | 3146 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1 |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 3147 | requires_openssl_with_fallback_scsv |
| 3148 | run_test "Fallback SCSV: enabled, openssl client" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 3149 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 3150 | "$O_CLI -tls1_1 -fallback_scsv" \ |
| 3151 | 1 \ |
| 3152 | -s "received FALLBACK_SCSV" \ |
| 3153 | -s "inapropriate fallback" |
| 3154 | |
| 3155 | requires_openssl_with_fallback_scsv |
| 3156 | run_test "Fallback SCSV: enabled, max version, openssl client" \ |
Manuel Pégourié-Gonnard | 4268ae0 | 2015-08-04 12:44:10 +0200 | [diff] [blame] | 3157 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 3158 | "$O_CLI -fallback_scsv" \ |
| 3159 | 0 \ |
| 3160 | -s "received FALLBACK_SCSV" \ |
| 3161 | -S "inapropriate fallback" |
| 3162 | |
Andres Amaya Garcia | 4c761fa | 2018-07-10 20:08:04 +0100 | [diff] [blame] | 3163 | # Test sending and receiving empty application data records |
| 3164 | |
| 3165 | run_test "Encrypt then MAC: empty application data record" \ |
| 3166 | "$P_SRV auth_mode=none debug_level=4 etm=1" \ |
| 3167 | "$P_CLI auth_mode=none etm=1 request_size=0 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA" \ |
| 3168 | 0 \ |
| 3169 | -S "0000: 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f" \ |
| 3170 | -s "dumping 'input payload after decrypt' (0 bytes)" \ |
| 3171 | -c "0 bytes written in 1 fragments" |
| 3172 | |
Manuel Pégourié-Gonnard | 9e2c80f | 2020-03-24 10:53:39 +0100 | [diff] [blame] | 3173 | run_test "Encrypt then MAC: disabled, empty application data record" \ |
Andres Amaya Garcia | 4c761fa | 2018-07-10 20:08:04 +0100 | [diff] [blame] | 3174 | "$P_SRV auth_mode=none debug_level=4 etm=0" \ |
| 3175 | "$P_CLI auth_mode=none etm=0 request_size=0" \ |
| 3176 | 0 \ |
| 3177 | -s "dumping 'input payload after decrypt' (0 bytes)" \ |
| 3178 | -c "0 bytes written in 1 fragments" |
| 3179 | |
| 3180 | run_test "Encrypt then MAC, DTLS: empty application data record" \ |
| 3181 | "$P_SRV auth_mode=none debug_level=4 etm=1 dtls=1" \ |
| 3182 | "$P_CLI auth_mode=none etm=1 request_size=0 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA dtls=1" \ |
| 3183 | 0 \ |
| 3184 | -S "0000: 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f" \ |
| 3185 | -s "dumping 'input payload after decrypt' (0 bytes)" \ |
| 3186 | -c "0 bytes written in 1 fragments" |
| 3187 | |
Manuel Pégourié-Gonnard | 9e2c80f | 2020-03-24 10:53:39 +0100 | [diff] [blame] | 3188 | run_test "Encrypt then MAC, DTLS: disabled, empty application data record" \ |
Andres Amaya Garcia | 4c761fa | 2018-07-10 20:08:04 +0100 | [diff] [blame] | 3189 | "$P_SRV auth_mode=none debug_level=4 etm=0 dtls=1" \ |
| 3190 | "$P_CLI auth_mode=none etm=0 request_size=0 dtls=1" \ |
| 3191 | 0 \ |
| 3192 | -s "dumping 'input payload after decrypt' (0 bytes)" \ |
| 3193 | -c "0 bytes written in 1 fragments" |
| 3194 | |
Gilles Peskine | d50177f | 2017-05-16 17:53:03 +0200 | [diff] [blame] | 3195 | ## ClientHello generated with |
| 3196 | ## "openssl s_client -CAfile tests/data_files/test-ca.crt -tls1_1 -connect localhost:4433 -cipher ..." |
| 3197 | ## then manually twiddling the ciphersuite list. |
| 3198 | ## The ClientHello content is spelled out below as a hex string as |
| 3199 | ## "prefix ciphersuite1 ciphersuite2 ciphersuite3 ciphersuite4 suffix". |
| 3200 | ## The expected response is an inappropriate_fallback alert. |
Gilles Peskine | bba3b4c | 2022-04-09 00:08:47 +0200 | [diff] [blame] | 3201 | requires_config_enabled MBEDTLS_SSL_FALLBACK_SCSV |
Gilles Peskine | d50177f | 2017-05-16 17:53:03 +0200 | [diff] [blame] | 3202 | run_test "Fallback SCSV: beginning of list" \ |
| 3203 | "$P_SRV debug_level=2" \ |
| 3204 | "$TCP_CLIENT localhost $SRV_PORT '160301003e0100003a03022aafb94308dc22ca1086c65acc00e414384d76b61ecab37df1633b1ae1034dbe000008 5600 0031 0032 0033 0100000900230000000f000101' '15030200020256'" \ |
| 3205 | 0 \ |
| 3206 | -s "received FALLBACK_SCSV" \ |
| 3207 | -s "inapropriate fallback" |
| 3208 | |
Gilles Peskine | bba3b4c | 2022-04-09 00:08:47 +0200 | [diff] [blame] | 3209 | requires_config_enabled MBEDTLS_SSL_FALLBACK_SCSV |
Gilles Peskine | d50177f | 2017-05-16 17:53:03 +0200 | [diff] [blame] | 3210 | run_test "Fallback SCSV: end of list" \ |
| 3211 | "$P_SRV debug_level=2" \ |
| 3212 | "$TCP_CLIENT localhost $SRV_PORT '160301003e0100003a03022aafb94308dc22ca1086c65acc00e414384d76b61ecab37df1633b1ae1034dbe000008 0031 0032 0033 5600 0100000900230000000f000101' '15030200020256'" \ |
| 3213 | 0 \ |
| 3214 | -s "received FALLBACK_SCSV" \ |
| 3215 | -s "inapropriate fallback" |
| 3216 | |
| 3217 | ## Here the expected response is a valid ServerHello prefix, up to the random. |
Gilles Peskine | bba3b4c | 2022-04-09 00:08:47 +0200 | [diff] [blame] | 3218 | requires_config_enabled MBEDTLS_SSL_FALLBACK_SCSV |
Gilles Peskine | d50177f | 2017-05-16 17:53:03 +0200 | [diff] [blame] | 3219 | run_test "Fallback SCSV: not in list" \ |
| 3220 | "$P_SRV debug_level=2" \ |
| 3221 | "$TCP_CLIENT localhost $SRV_PORT '160301003e0100003a03022aafb94308dc22ca1086c65acc00e414384d76b61ecab37df1633b1ae1034dbe000008 0056 0031 0032 0033 0100000900230000000f000101' '16030200300200002c0302'" \ |
| 3222 | 0 \ |
| 3223 | -S "received FALLBACK_SCSV" \ |
| 3224 | -S "inapropriate fallback" |
| 3225 | |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 3226 | # Tests for CBC 1/n-1 record splitting |
| 3227 | |
| 3228 | run_test "CBC Record splitting: TLS 1.2, no splitting" \ |
| 3229 | "$P_SRV" \ |
| 3230 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 3231 | request_size=123 force_version=tls12" \ |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 3232 | 0 \ |
| 3233 | -s "Read from client: 123 bytes read" \ |
| 3234 | -S "Read from client: 1 bytes read" \ |
| 3235 | -S "122 bytes read" |
| 3236 | |
| 3237 | run_test "CBC Record splitting: TLS 1.1, no splitting" \ |
| 3238 | "$P_SRV" \ |
| 3239 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 3240 | request_size=123 force_version=tls1_1" \ |
| 3241 | 0 \ |
| 3242 | -s "Read from client: 123 bytes read" \ |
| 3243 | -S "Read from client: 1 bytes read" \ |
| 3244 | -S "122 bytes read" |
| 3245 | |
| 3246 | run_test "CBC Record splitting: TLS 1.0, splitting" \ |
| 3247 | "$P_SRV" \ |
| 3248 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 3249 | request_size=123 force_version=tls1" \ |
| 3250 | 0 \ |
| 3251 | -S "Read from client: 123 bytes read" \ |
| 3252 | -s "Read from client: 1 bytes read" \ |
| 3253 | -s "122 bytes read" |
| 3254 | |
| 3255 | run_test "CBC Record splitting: SSLv3, splitting" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 3256 | "$P_SRV min_version=ssl3" \ |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 3257 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 3258 | request_size=123 force_version=ssl3" \ |
| 3259 | 0 \ |
| 3260 | -S "Read from client: 123 bytes read" \ |
| 3261 | -s "Read from client: 1 bytes read" \ |
| 3262 | -s "122 bytes read" |
| 3263 | |
| 3264 | run_test "CBC Record splitting: TLS 1.0 RC4, no splitting" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 3265 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 3266 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 3267 | request_size=123 force_version=tls1" \ |
| 3268 | 0 \ |
| 3269 | -s "Read from client: 123 bytes read" \ |
| 3270 | -S "Read from client: 1 bytes read" \ |
| 3271 | -S "122 bytes read" |
| 3272 | |
| 3273 | run_test "CBC Record splitting: TLS 1.0, splitting disabled" \ |
| 3274 | "$P_SRV" \ |
| 3275 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 3276 | request_size=123 force_version=tls1 recsplit=0" \ |
| 3277 | 0 \ |
| 3278 | -s "Read from client: 123 bytes read" \ |
| 3279 | -S "Read from client: 1 bytes read" \ |
| 3280 | -S "122 bytes read" |
| 3281 | |
Manuel Pégourié-Gonnard | a852cf4 | 2015-01-13 20:56:15 +0100 | [diff] [blame] | 3282 | run_test "CBC Record splitting: TLS 1.0, splitting, nbio" \ |
| 3283 | "$P_SRV nbio=2" \ |
| 3284 | "$P_CLI nbio=2 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 3285 | request_size=123 force_version=tls1" \ |
| 3286 | 0 \ |
| 3287 | -S "Read from client: 123 bytes read" \ |
| 3288 | -s "Read from client: 1 bytes read" \ |
| 3289 | -s "122 bytes read" |
| 3290 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 3291 | # Tests for Session Tickets |
| 3292 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3293 | run_test "Session resume using tickets: basic" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3294 | "$P_SRV debug_level=3 tickets=1" \ |
| 3295 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 3296 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 3297 | -c "client hello, adding session ticket extension" \ |
| 3298 | -s "found session ticket extension" \ |
| 3299 | -s "server hello, adding session ticket extension" \ |
| 3300 | -c "found session_ticket extension" \ |
| 3301 | -c "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 3302 | -S "session successfully restored from cache" \ |
| 3303 | -s "session successfully restored from ticket" \ |
| 3304 | -s "a session has been resumed" \ |
| 3305 | -c "a session has been resumed" |
| 3306 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3307 | run_test "Session resume using tickets: cache disabled" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3308 | "$P_SRV debug_level=3 tickets=1 cache_max=0" \ |
| 3309 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 3310 | 0 \ |
| 3311 | -c "client hello, adding session ticket extension" \ |
| 3312 | -s "found session ticket extension" \ |
| 3313 | -s "server hello, adding session ticket extension" \ |
| 3314 | -c "found session_ticket extension" \ |
| 3315 | -c "parse new session ticket" \ |
| 3316 | -S "session successfully restored from cache" \ |
| 3317 | -s "session successfully restored from ticket" \ |
| 3318 | -s "a session has been resumed" \ |
| 3319 | -c "a session has been resumed" |
| 3320 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3321 | run_test "Session resume using tickets: timeout" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3322 | "$P_SRV debug_level=3 tickets=1 cache_max=0 ticket_timeout=1" \ |
| 3323 | "$P_CLI debug_level=3 tickets=1 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 3324 | 0 \ |
| 3325 | -c "client hello, adding session ticket extension" \ |
| 3326 | -s "found session ticket extension" \ |
| 3327 | -s "server hello, adding session ticket extension" \ |
| 3328 | -c "found session_ticket extension" \ |
| 3329 | -c "parse new session ticket" \ |
| 3330 | -S "session successfully restored from cache" \ |
| 3331 | -S "session successfully restored from ticket" \ |
| 3332 | -S "a session has been resumed" \ |
| 3333 | -C "a session has been resumed" |
| 3334 | |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 3335 | run_test "Session resume using tickets: session copy" \ |
| 3336 | "$P_SRV debug_level=3 tickets=1 cache_max=0" \ |
| 3337 | "$P_CLI debug_level=3 tickets=1 reconnect=1 reco_mode=0" \ |
| 3338 | 0 \ |
| 3339 | -c "client hello, adding session ticket extension" \ |
| 3340 | -s "found session ticket extension" \ |
| 3341 | -s "server hello, adding session ticket extension" \ |
| 3342 | -c "found session_ticket extension" \ |
| 3343 | -c "parse new session ticket" \ |
| 3344 | -S "session successfully restored from cache" \ |
| 3345 | -s "session successfully restored from ticket" \ |
| 3346 | -s "a session has been resumed" \ |
| 3347 | -c "a session has been resumed" |
| 3348 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3349 | run_test "Session resume using tickets: openssl server" \ |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 3350 | "$O_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3351 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 3352 | 0 \ |
| 3353 | -c "client hello, adding session ticket extension" \ |
| 3354 | -c "found session_ticket extension" \ |
| 3355 | -c "parse new session ticket" \ |
| 3356 | -c "a session has been resumed" |
| 3357 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3358 | run_test "Session resume using tickets: openssl client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3359 | "$P_SRV debug_level=3 tickets=1" \ |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 3360 | "( $O_CLI -sess_out $SESSION; \ |
| 3361 | $O_CLI -sess_in $SESSION; \ |
| 3362 | rm -f $SESSION )" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 3363 | 0 \ |
| 3364 | -s "found session ticket extension" \ |
| 3365 | -s "server hello, adding session ticket extension" \ |
| 3366 | -S "session successfully restored from cache" \ |
| 3367 | -s "session successfully restored from ticket" \ |
| 3368 | -s "a session has been resumed" |
| 3369 | |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3370 | # Tests for Session Tickets with DTLS |
| 3371 | |
| 3372 | run_test "Session resume using tickets, DTLS: basic" \ |
| 3373 | "$P_SRV debug_level=3 dtls=1 tickets=1" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 3374 | "$P_CLI debug_level=3 dtls=1 tickets=1 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3375 | 0 \ |
| 3376 | -c "client hello, adding session ticket extension" \ |
| 3377 | -s "found session ticket extension" \ |
| 3378 | -s "server hello, adding session ticket extension" \ |
| 3379 | -c "found session_ticket extension" \ |
| 3380 | -c "parse new session ticket" \ |
| 3381 | -S "session successfully restored from cache" \ |
| 3382 | -s "session successfully restored from ticket" \ |
| 3383 | -s "a session has been resumed" \ |
| 3384 | -c "a session has been resumed" |
| 3385 | |
| 3386 | run_test "Session resume using tickets, DTLS: cache disabled" \ |
| 3387 | "$P_SRV debug_level=3 dtls=1 tickets=1 cache_max=0" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 3388 | "$P_CLI debug_level=3 dtls=1 tickets=1 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3389 | 0 \ |
| 3390 | -c "client hello, adding session ticket extension" \ |
| 3391 | -s "found session ticket extension" \ |
| 3392 | -s "server hello, adding session ticket extension" \ |
| 3393 | -c "found session_ticket extension" \ |
| 3394 | -c "parse new session ticket" \ |
| 3395 | -S "session successfully restored from cache" \ |
| 3396 | -s "session successfully restored from ticket" \ |
| 3397 | -s "a session has been resumed" \ |
| 3398 | -c "a session has been resumed" |
| 3399 | |
| 3400 | run_test "Session resume using tickets, DTLS: timeout" \ |
| 3401 | "$P_SRV debug_level=3 dtls=1 tickets=1 cache_max=0 ticket_timeout=1" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 3402 | "$P_CLI debug_level=3 dtls=1 tickets=1 reconnect=1 skip_close_notify=1 reco_delay=2" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3403 | 0 \ |
| 3404 | -c "client hello, adding session ticket extension" \ |
| 3405 | -s "found session ticket extension" \ |
| 3406 | -s "server hello, adding session ticket extension" \ |
| 3407 | -c "found session_ticket extension" \ |
| 3408 | -c "parse new session ticket" \ |
| 3409 | -S "session successfully restored from cache" \ |
| 3410 | -S "session successfully restored from ticket" \ |
| 3411 | -S "a session has been resumed" \ |
| 3412 | -C "a session has been resumed" |
| 3413 | |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 3414 | run_test "Session resume using tickets, DTLS: session copy" \ |
| 3415 | "$P_SRV debug_level=3 dtls=1 tickets=1 cache_max=0" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 3416 | "$P_CLI debug_level=3 dtls=1 tickets=1 reconnect=1 skip_close_notify=1 reco_mode=0" \ |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 3417 | 0 \ |
| 3418 | -c "client hello, adding session ticket extension" \ |
| 3419 | -s "found session ticket extension" \ |
| 3420 | -s "server hello, adding session ticket extension" \ |
| 3421 | -c "found session_ticket extension" \ |
| 3422 | -c "parse new session ticket" \ |
| 3423 | -S "session successfully restored from cache" \ |
| 3424 | -s "session successfully restored from ticket" \ |
| 3425 | -s "a session has been resumed" \ |
| 3426 | -c "a session has been resumed" |
| 3427 | |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3428 | run_test "Session resume using tickets, DTLS: openssl server" \ |
| 3429 | "$O_SRV -dtls1" \ |
| 3430 | "$P_CLI dtls=1 debug_level=3 tickets=1 reconnect=1" \ |
| 3431 | 0 \ |
| 3432 | -c "client hello, adding session ticket extension" \ |
| 3433 | -c "found session_ticket extension" \ |
| 3434 | -c "parse new session ticket" \ |
| 3435 | -c "a session has been resumed" |
| 3436 | |
Manuel Pégourié-Gonnard | d76c47d | 2021-10-13 13:12:47 +0200 | [diff] [blame] | 3437 | # For reasons that aren't fully understood, this test randomly fails with high |
Paul Elliott | 7ca2f39 | 2021-10-13 16:13:44 +0100 | [diff] [blame] | 3438 | # probability with OpenSSL 1.0.2g on the CI, see #5012. |
Manuel Pégourié-Gonnard | d76c47d | 2021-10-13 13:12:47 +0200 | [diff] [blame] | 3439 | requires_openssl_next |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3440 | run_test "Session resume using tickets, DTLS: openssl client" \ |
| 3441 | "$P_SRV dtls=1 debug_level=3 tickets=1" \ |
Manuel Pégourié-Gonnard | d76c47d | 2021-10-13 13:12:47 +0200 | [diff] [blame] | 3442 | "( $O_NEXT_CLI -dtls1 -sess_out $SESSION; \ |
| 3443 | $O_NEXT_CLI -dtls1 -sess_in $SESSION; \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3444 | rm -f $SESSION )" \ |
| 3445 | 0 \ |
| 3446 | -s "found session ticket extension" \ |
| 3447 | -s "server hello, adding session ticket extension" \ |
| 3448 | -S "session successfully restored from cache" \ |
| 3449 | -s "session successfully restored from ticket" \ |
| 3450 | -s "a session has been resumed" |
| 3451 | |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 3452 | # Tests for Session Resume based on session-ID and cache |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 3453 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3454 | run_test "Session resume using cache: tickets enabled on client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3455 | "$P_SRV debug_level=3 tickets=0" \ |
| 3456 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 3457 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 3458 | -c "client hello, adding session ticket extension" \ |
| 3459 | -s "found session ticket extension" \ |
| 3460 | -S "server hello, adding session ticket extension" \ |
| 3461 | -C "found session_ticket extension" \ |
| 3462 | -C "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 3463 | -s "session successfully restored from cache" \ |
| 3464 | -S "session successfully restored from ticket" \ |
| 3465 | -s "a session has been resumed" \ |
| 3466 | -c "a session has been resumed" |
| 3467 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3468 | run_test "Session resume using cache: tickets enabled on server" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3469 | "$P_SRV debug_level=3 tickets=1" \ |
| 3470 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 3471 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 3472 | -C "client hello, adding session ticket extension" \ |
| 3473 | -S "found session ticket extension" \ |
| 3474 | -S "server hello, adding session ticket extension" \ |
| 3475 | -C "found session_ticket extension" \ |
| 3476 | -C "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 3477 | -s "session successfully restored from cache" \ |
| 3478 | -S "session successfully restored from ticket" \ |
| 3479 | -s "a session has been resumed" \ |
| 3480 | -c "a session has been resumed" |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 3481 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3482 | run_test "Session resume using cache: cache_max=0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3483 | "$P_SRV debug_level=3 tickets=0 cache_max=0" \ |
| 3484 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 3485 | 0 \ |
| 3486 | -S "session successfully restored from cache" \ |
| 3487 | -S "session successfully restored from ticket" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 3488 | -S "a session has been resumed" \ |
| 3489 | -C "a session has been resumed" |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 3490 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3491 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3492 | run_test "Session resume using cache: cache_max=1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3493 | "$P_SRV debug_level=3 tickets=0 cache_max=1" \ |
| 3494 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 3495 | 0 \ |
| 3496 | -s "session successfully restored from cache" \ |
| 3497 | -S "session successfully restored from ticket" \ |
| 3498 | -s "a session has been resumed" \ |
| 3499 | -c "a session has been resumed" |
| 3500 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3501 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 6df3196 | 2015-05-04 10:55:47 +0200 | [diff] [blame] | 3502 | run_test "Session resume using cache: timeout > delay" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3503 | "$P_SRV debug_level=3 tickets=0" \ |
| 3504 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=0" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 3505 | 0 \ |
| 3506 | -s "session successfully restored from cache" \ |
| 3507 | -S "session successfully restored from ticket" \ |
| 3508 | -s "a session has been resumed" \ |
| 3509 | -c "a session has been resumed" |
| 3510 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3511 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3512 | run_test "Session resume using cache: timeout < delay" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3513 | "$P_SRV debug_level=3 tickets=0 cache_timeout=1" \ |
| 3514 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 3515 | 0 \ |
| 3516 | -S "session successfully restored from cache" \ |
| 3517 | -S "session successfully restored from ticket" \ |
| 3518 | -S "a session has been resumed" \ |
| 3519 | -C "a session has been resumed" |
| 3520 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3521 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3522 | run_test "Session resume using cache: no timeout" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3523 | "$P_SRV debug_level=3 tickets=0 cache_timeout=0" \ |
| 3524 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 3525 | 0 \ |
| 3526 | -s "session successfully restored from cache" \ |
| 3527 | -S "session successfully restored from ticket" \ |
| 3528 | -s "a session has been resumed" \ |
| 3529 | -c "a session has been resumed" |
| 3530 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3531 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 3532 | run_test "Session resume using cache: session copy" \ |
| 3533 | "$P_SRV debug_level=3 tickets=0" \ |
| 3534 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_mode=0" \ |
| 3535 | 0 \ |
| 3536 | -s "session successfully restored from cache" \ |
| 3537 | -S "session successfully restored from ticket" \ |
| 3538 | -s "a session has been resumed" \ |
| 3539 | -c "a session has been resumed" |
| 3540 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3541 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3542 | run_test "Session resume using cache: openssl client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3543 | "$P_SRV debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 3544 | "( $O_CLI -sess_out $SESSION; \ |
| 3545 | $O_CLI -sess_in $SESSION; \ |
| 3546 | rm -f $SESSION )" \ |
Manuel Pégourié-Gonnard | db735f6 | 2014-02-25 17:57:59 +0100 | [diff] [blame] | 3547 | 0 \ |
| 3548 | -s "found session ticket extension" \ |
| 3549 | -S "server hello, adding session ticket extension" \ |
| 3550 | -s "session successfully restored from cache" \ |
| 3551 | -S "session successfully restored from ticket" \ |
| 3552 | -s "a session has been resumed" |
| 3553 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3554 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3555 | run_test "Session resume using cache: openssl server" \ |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 3556 | "$O_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3557 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | db735f6 | 2014-02-25 17:57:59 +0100 | [diff] [blame] | 3558 | 0 \ |
| 3559 | -C "found session_ticket extension" \ |
| 3560 | -C "parse new session ticket" \ |
| 3561 | -c "a session has been resumed" |
| 3562 | |
Andrzej Kurek | c87d97b | 2022-06-14 07:12:33 -0400 | [diff] [blame] | 3563 | # Tests for Session resume and extensions |
| 3564 | |
| 3565 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
| 3566 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 3567 | run_test "Session resume and connection ID" \ |
| 3568 | "$P_SRV debug_level=3 cid=1 cid_val=dead dtls=1 tickets=0" \ |
| 3569 | "$P_CLI debug_level=3 cid=1 cid_val=beef dtls=1 tickets=0 reconnect=1" \ |
| 3570 | 0 \ |
| 3571 | -c "Enable use of CID extension." \ |
| 3572 | -s "Enable use of CID extension." \ |
| 3573 | -c "client hello, adding CID extension" \ |
| 3574 | -s "found CID extension" \ |
| 3575 | -s "Use of CID extension negotiated" \ |
| 3576 | -s "server hello, adding CID extension" \ |
| 3577 | -c "found CID extension" \ |
| 3578 | -c "Use of CID extension negotiated" \ |
| 3579 | -s "Copy CIDs into SSL transform" \ |
| 3580 | -c "Copy CIDs into SSL transform" \ |
| 3581 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 3582 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 3583 | -s "Use of Connection ID has been negotiated" \ |
| 3584 | -c "Use of Connection ID has been negotiated" |
| 3585 | |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3586 | # Tests for Session Resume based on session-ID and cache, DTLS |
| 3587 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3588 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3589 | run_test "Session resume using cache, DTLS: tickets enabled on client" \ |
| 3590 | "$P_SRV dtls=1 debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 3591 | "$P_CLI dtls=1 debug_level=3 tickets=1 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3592 | 0 \ |
| 3593 | -c "client hello, adding session ticket extension" \ |
| 3594 | -s "found session ticket extension" \ |
| 3595 | -S "server hello, adding session ticket extension" \ |
| 3596 | -C "found session_ticket extension" \ |
| 3597 | -C "parse new session ticket" \ |
| 3598 | -s "session successfully restored from cache" \ |
| 3599 | -S "session successfully restored from ticket" \ |
| 3600 | -s "a session has been resumed" \ |
| 3601 | -c "a session has been resumed" |
| 3602 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3603 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3604 | run_test "Session resume using cache, DTLS: tickets enabled on server" \ |
| 3605 | "$P_SRV dtls=1 debug_level=3 tickets=1" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 3606 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3607 | 0 \ |
| 3608 | -C "client hello, adding session ticket extension" \ |
| 3609 | -S "found session ticket extension" \ |
| 3610 | -S "server hello, adding session ticket extension" \ |
| 3611 | -C "found session_ticket extension" \ |
| 3612 | -C "parse new session ticket" \ |
| 3613 | -s "session successfully restored from cache" \ |
| 3614 | -S "session successfully restored from ticket" \ |
| 3615 | -s "a session has been resumed" \ |
| 3616 | -c "a session has been resumed" |
| 3617 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3618 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3619 | run_test "Session resume using cache, DTLS: cache_max=0" \ |
| 3620 | "$P_SRV dtls=1 debug_level=3 tickets=0 cache_max=0" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 3621 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3622 | 0 \ |
| 3623 | -S "session successfully restored from cache" \ |
| 3624 | -S "session successfully restored from ticket" \ |
| 3625 | -S "a session has been resumed" \ |
| 3626 | -C "a session has been resumed" |
| 3627 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3628 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3629 | run_test "Session resume using cache, DTLS: cache_max=1" \ |
| 3630 | "$P_SRV dtls=1 debug_level=3 tickets=0 cache_max=1" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 3631 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3632 | 0 \ |
| 3633 | -s "session successfully restored from cache" \ |
| 3634 | -S "session successfully restored from ticket" \ |
| 3635 | -s "a session has been resumed" \ |
| 3636 | -c "a session has been resumed" |
| 3637 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3638 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3639 | run_test "Session resume using cache, DTLS: timeout > delay" \ |
| 3640 | "$P_SRV dtls=1 debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 3641 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1 reco_delay=0" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3642 | 0 \ |
| 3643 | -s "session successfully restored from cache" \ |
| 3644 | -S "session successfully restored from ticket" \ |
| 3645 | -s "a session has been resumed" \ |
| 3646 | -c "a session has been resumed" |
| 3647 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3648 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3649 | run_test "Session resume using cache, DTLS: timeout < delay" \ |
| 3650 | "$P_SRV dtls=1 debug_level=3 tickets=0 cache_timeout=1" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 3651 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1 reco_delay=2" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3652 | 0 \ |
| 3653 | -S "session successfully restored from cache" \ |
| 3654 | -S "session successfully restored from ticket" \ |
| 3655 | -S "a session has been resumed" \ |
| 3656 | -C "a session has been resumed" |
| 3657 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3658 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3659 | run_test "Session resume using cache, DTLS: no timeout" \ |
| 3660 | "$P_SRV dtls=1 debug_level=3 tickets=0 cache_timeout=0" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 3661 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1 reco_delay=2" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3662 | 0 \ |
| 3663 | -s "session successfully restored from cache" \ |
| 3664 | -S "session successfully restored from ticket" \ |
| 3665 | -s "a session has been resumed" \ |
| 3666 | -c "a session has been resumed" |
| 3667 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3668 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 3669 | run_test "Session resume using cache, DTLS: session copy" \ |
| 3670 | "$P_SRV dtls=1 debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 3671 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1 reco_mode=0" \ |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 3672 | 0 \ |
| 3673 | -s "session successfully restored from cache" \ |
| 3674 | -S "session successfully restored from ticket" \ |
| 3675 | -s "a session has been resumed" \ |
| 3676 | -c "a session has been resumed" |
| 3677 | |
Manuel Pégourié-Gonnard | d76c47d | 2021-10-13 13:12:47 +0200 | [diff] [blame] | 3678 | # For reasons that aren't fully understood, this test randomly fails with high |
Paul Elliott | 7ca2f39 | 2021-10-13 16:13:44 +0100 | [diff] [blame] | 3679 | # probability with OpenSSL 1.0.2g on the CI, see #5012. |
Manuel Pégourié-Gonnard | d76c47d | 2021-10-13 13:12:47 +0200 | [diff] [blame] | 3680 | requires_openssl_next |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3681 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3682 | run_test "Session resume using cache, DTLS: openssl client" \ |
| 3683 | "$P_SRV dtls=1 debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | d76c47d | 2021-10-13 13:12:47 +0200 | [diff] [blame] | 3684 | "( $O_NEXT_CLI -dtls1 -sess_out $SESSION; \ |
| 3685 | $O_NEXT_CLI -dtls1 -sess_in $SESSION; \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3686 | rm -f $SESSION )" \ |
| 3687 | 0 \ |
| 3688 | -s "found session ticket extension" \ |
| 3689 | -S "server hello, adding session ticket extension" \ |
| 3690 | -s "session successfully restored from cache" \ |
| 3691 | -S "session successfully restored from ticket" \ |
| 3692 | -s "a session has been resumed" |
| 3693 | |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3694 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 3695 | run_test "Session resume using cache, DTLS: openssl server" \ |
| 3696 | "$O_SRV -dtls1" \ |
| 3697 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1" \ |
| 3698 | 0 \ |
| 3699 | -C "found session_ticket extension" \ |
| 3700 | -C "parse new session ticket" \ |
| 3701 | -c "a session has been resumed" |
| 3702 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 3703 | # Tests for Max Fragment Length extension |
| 3704 | |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 3705 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3706 | run_test "Max fragment length: enabled, default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3707 | "$P_SRV debug_level=3" \ |
| 3708 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 3709 | 0 \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3710 | -c "Maximum input fragment length is $MAX_CONTENT_LEN" \ |
| 3711 | -c "Maximum output fragment length is $MAX_CONTENT_LEN" \ |
| 3712 | -s "Maximum input fragment length is $MAX_CONTENT_LEN" \ |
| 3713 | -s "Maximum output fragment length is $MAX_CONTENT_LEN" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 3714 | -C "client hello, adding max_fragment_length extension" \ |
| 3715 | -S "found max fragment length extension" \ |
| 3716 | -S "server hello, max_fragment_length extension" \ |
| 3717 | -C "found max_fragment_length extension" |
| 3718 | |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 3719 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3720 | run_test "Max fragment length: enabled, default, larger message" \ |
| 3721 | "$P_SRV debug_level=3" \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 3722 | "$P_CLI debug_level=3 request_size=$(( $MAX_CONTENT_LEN + 1))" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3723 | 0 \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3724 | -c "Maximum input fragment length is $MAX_CONTENT_LEN" \ |
| 3725 | -c "Maximum output fragment length is $MAX_CONTENT_LEN" \ |
| 3726 | -s "Maximum input fragment length is $MAX_CONTENT_LEN" \ |
| 3727 | -s "Maximum output fragment length is $MAX_CONTENT_LEN" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3728 | -C "client hello, adding max_fragment_length extension" \ |
| 3729 | -S "found max fragment length extension" \ |
| 3730 | -S "server hello, max_fragment_length extension" \ |
| 3731 | -C "found max_fragment_length extension" \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 3732 | -c "$(( $MAX_CONTENT_LEN + 1)) bytes written in 2 fragments" \ |
| 3733 | -s "$MAX_CONTENT_LEN bytes read" \ |
Hanno Becker | 9cfabe3 | 2017-10-18 14:42:01 +0100 | [diff] [blame] | 3734 | -s "1 bytes read" |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3735 | |
| 3736 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3737 | run_test "Max fragment length, DTLS: enabled, default, larger message" \ |
| 3738 | "$P_SRV debug_level=3 dtls=1" \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 3739 | "$P_CLI debug_level=3 dtls=1 request_size=$(( $MAX_CONTENT_LEN + 1))" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3740 | 1 \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3741 | -c "Maximum input fragment length is $MAX_CONTENT_LEN" \ |
| 3742 | -c "Maximum output fragment length is $MAX_CONTENT_LEN" \ |
| 3743 | -s "Maximum input fragment length is $MAX_CONTENT_LEN" \ |
| 3744 | -s "Maximum output fragment length is $MAX_CONTENT_LEN" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3745 | -C "client hello, adding max_fragment_length extension" \ |
| 3746 | -S "found max fragment length extension" \ |
| 3747 | -S "server hello, max_fragment_length extension" \ |
| 3748 | -C "found max_fragment_length extension" \ |
| 3749 | -c "fragment larger than.*maximum " |
| 3750 | |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 3751 | # Run some tests with MBEDTLS_SSL_MAX_FRAGMENT_LENGTH disabled |
| 3752 | # (session fragment length will be 16384 regardless of mbedtls |
| 3753 | # content length configuration.) |
| 3754 | |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3755 | requires_config_disabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3756 | run_test "Max fragment length: disabled, larger message" \ |
| 3757 | "$P_SRV debug_level=3" \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 3758 | "$P_CLI debug_level=3 request_size=$(( $MAX_CONTENT_LEN + 1))" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3759 | 0 \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3760 | -C "Maximum input fragment length is 16384" \ |
| 3761 | -C "Maximum output fragment length is 16384" \ |
| 3762 | -S "Maximum input fragment length is 16384" \ |
| 3763 | -S "Maximum output fragment length is 16384" \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 3764 | -c "$(( $MAX_CONTENT_LEN + 1)) bytes written in 2 fragments" \ |
| 3765 | -s "$MAX_CONTENT_LEN bytes read" \ |
Hanno Becker | 9cfabe3 | 2017-10-18 14:42:01 +0100 | [diff] [blame] | 3766 | -s "1 bytes read" |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3767 | |
| 3768 | requires_config_disabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | 18ddccc | 2021-06-21 19:43:33 +0100 | [diff] [blame] | 3769 | run_test "Max fragment length, DTLS: disabled, larger message" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3770 | "$P_SRV debug_level=3 dtls=1" \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 3771 | "$P_CLI debug_level=3 dtls=1 request_size=$(( $MAX_CONTENT_LEN + 1))" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3772 | 1 \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3773 | -C "Maximum input fragment length is 16384" \ |
| 3774 | -C "Maximum output fragment length is 16384" \ |
| 3775 | -S "Maximum input fragment length is 16384" \ |
| 3776 | -S "Maximum output fragment length is 16384" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3777 | -c "fragment larger than.*maximum " |
| 3778 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3779 | requires_max_content_len 4096 |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 3780 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3781 | run_test "Max fragment length: used by client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3782 | "$P_SRV debug_level=3" \ |
| 3783 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 3784 | 0 \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3785 | -c "Maximum input fragment length is 4096" \ |
| 3786 | -c "Maximum output fragment length is 4096" \ |
| 3787 | -s "Maximum input fragment length is 4096" \ |
| 3788 | -s "Maximum output fragment length is 4096" \ |
| 3789 | -c "client hello, adding max_fragment_length extension" \ |
| 3790 | -s "found max fragment length extension" \ |
| 3791 | -s "server hello, max_fragment_length extension" \ |
| 3792 | -c "found max_fragment_length extension" |
| 3793 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3794 | requires_max_content_len 1024 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3795 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3796 | run_test "Max fragment length: client 512, server 1024" \ |
| 3797 | "$P_SRV debug_level=3 max_frag_len=1024" \ |
| 3798 | "$P_CLI debug_level=3 max_frag_len=512" \ |
| 3799 | 0 \ |
| 3800 | -c "Maximum input fragment length is 512" \ |
| 3801 | -c "Maximum output fragment length is 512" \ |
| 3802 | -s "Maximum input fragment length is 512" \ |
| 3803 | -s "Maximum output fragment length is 512" \ |
| 3804 | -c "client hello, adding max_fragment_length extension" \ |
| 3805 | -s "found max fragment length extension" \ |
| 3806 | -s "server hello, max_fragment_length extension" \ |
| 3807 | -c "found max_fragment_length extension" |
| 3808 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3809 | requires_max_content_len 2048 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3810 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3811 | run_test "Max fragment length: client 512, server 2048" \ |
| 3812 | "$P_SRV debug_level=3 max_frag_len=2048" \ |
| 3813 | "$P_CLI debug_level=3 max_frag_len=512" \ |
| 3814 | 0 \ |
| 3815 | -c "Maximum input fragment length is 512" \ |
| 3816 | -c "Maximum output fragment length is 512" \ |
| 3817 | -s "Maximum input fragment length is 512" \ |
| 3818 | -s "Maximum output fragment length is 512" \ |
| 3819 | -c "client hello, adding max_fragment_length extension" \ |
| 3820 | -s "found max fragment length extension" \ |
| 3821 | -s "server hello, max_fragment_length extension" \ |
| 3822 | -c "found max_fragment_length extension" |
| 3823 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3824 | requires_max_content_len 4096 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3825 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3826 | run_test "Max fragment length: client 512, server 4096" \ |
| 3827 | "$P_SRV debug_level=3 max_frag_len=4096" \ |
| 3828 | "$P_CLI debug_level=3 max_frag_len=512" \ |
| 3829 | 0 \ |
| 3830 | -c "Maximum input fragment length is 512" \ |
| 3831 | -c "Maximum output fragment length is 512" \ |
| 3832 | -s "Maximum input fragment length is 512" \ |
| 3833 | -s "Maximum output fragment length is 512" \ |
| 3834 | -c "client hello, adding max_fragment_length extension" \ |
| 3835 | -s "found max fragment length extension" \ |
| 3836 | -s "server hello, max_fragment_length extension" \ |
| 3837 | -c "found max_fragment_length extension" |
| 3838 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3839 | requires_max_content_len 1024 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3840 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3841 | run_test "Max fragment length: client 1024, server 512" \ |
| 3842 | "$P_SRV debug_level=3 max_frag_len=512" \ |
| 3843 | "$P_CLI debug_level=3 max_frag_len=1024" \ |
| 3844 | 0 \ |
| 3845 | -c "Maximum input fragment length is 1024" \ |
| 3846 | -c "Maximum output fragment length is 1024" \ |
| 3847 | -s "Maximum input fragment length is 1024" \ |
| 3848 | -s "Maximum output fragment length is 512" \ |
| 3849 | -c "client hello, adding max_fragment_length extension" \ |
| 3850 | -s "found max fragment length extension" \ |
| 3851 | -s "server hello, max_fragment_length extension" \ |
| 3852 | -c "found max_fragment_length extension" |
| 3853 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3854 | requires_max_content_len 2048 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3855 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3856 | run_test "Max fragment length: client 1024, server 2048" \ |
| 3857 | "$P_SRV debug_level=3 max_frag_len=2048" \ |
| 3858 | "$P_CLI debug_level=3 max_frag_len=1024" \ |
| 3859 | 0 \ |
| 3860 | -c "Maximum input fragment length is 1024" \ |
| 3861 | -c "Maximum output fragment length is 1024" \ |
| 3862 | -s "Maximum input fragment length is 1024" \ |
| 3863 | -s "Maximum output fragment length is 1024" \ |
| 3864 | -c "client hello, adding max_fragment_length extension" \ |
| 3865 | -s "found max fragment length extension" \ |
| 3866 | -s "server hello, max_fragment_length extension" \ |
| 3867 | -c "found max_fragment_length extension" |
| 3868 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3869 | requires_max_content_len 4096 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3870 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3871 | run_test "Max fragment length: client 1024, server 4096" \ |
| 3872 | "$P_SRV debug_level=3 max_frag_len=4096" \ |
| 3873 | "$P_CLI debug_level=3 max_frag_len=1024" \ |
| 3874 | 0 \ |
| 3875 | -c "Maximum input fragment length is 1024" \ |
| 3876 | -c "Maximum output fragment length is 1024" \ |
| 3877 | -s "Maximum input fragment length is 1024" \ |
| 3878 | -s "Maximum output fragment length is 1024" \ |
| 3879 | -c "client hello, adding max_fragment_length extension" \ |
| 3880 | -s "found max fragment length extension" \ |
| 3881 | -s "server hello, max_fragment_length extension" \ |
| 3882 | -c "found max_fragment_length extension" |
| 3883 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3884 | requires_max_content_len 2048 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3885 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3886 | run_test "Max fragment length: client 2048, server 512" \ |
| 3887 | "$P_SRV debug_level=3 max_frag_len=512" \ |
| 3888 | "$P_CLI debug_level=3 max_frag_len=2048" \ |
| 3889 | 0 \ |
| 3890 | -c "Maximum input fragment length is 2048" \ |
| 3891 | -c "Maximum output fragment length is 2048" \ |
| 3892 | -s "Maximum input fragment length is 2048" \ |
| 3893 | -s "Maximum output fragment length is 512" \ |
| 3894 | -c "client hello, adding max_fragment_length extension" \ |
| 3895 | -s "found max fragment length extension" \ |
| 3896 | -s "server hello, max_fragment_length extension" \ |
| 3897 | -c "found max_fragment_length extension" |
| 3898 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3899 | requires_max_content_len 2048 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3900 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3901 | run_test "Max fragment length: client 2048, server 1024" \ |
| 3902 | "$P_SRV debug_level=3 max_frag_len=1024" \ |
| 3903 | "$P_CLI debug_level=3 max_frag_len=2048" \ |
| 3904 | 0 \ |
| 3905 | -c "Maximum input fragment length is 2048" \ |
| 3906 | -c "Maximum output fragment length is 2048" \ |
| 3907 | -s "Maximum input fragment length is 2048" \ |
| 3908 | -s "Maximum output fragment length is 1024" \ |
| 3909 | -c "client hello, adding max_fragment_length extension" \ |
| 3910 | -s "found max fragment length extension" \ |
| 3911 | -s "server hello, max_fragment_length extension" \ |
| 3912 | -c "found max_fragment_length extension" |
| 3913 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3914 | requires_max_content_len 4096 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3915 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3916 | run_test "Max fragment length: client 2048, server 4096" \ |
| 3917 | "$P_SRV debug_level=3 max_frag_len=4096" \ |
| 3918 | "$P_CLI debug_level=3 max_frag_len=2048" \ |
| 3919 | 0 \ |
| 3920 | -c "Maximum input fragment length is 2048" \ |
| 3921 | -c "Maximum output fragment length is 2048" \ |
| 3922 | -s "Maximum input fragment length is 2048" \ |
| 3923 | -s "Maximum output fragment length is 2048" \ |
| 3924 | -c "client hello, adding max_fragment_length extension" \ |
| 3925 | -s "found max fragment length extension" \ |
| 3926 | -s "server hello, max_fragment_length extension" \ |
| 3927 | -c "found max_fragment_length extension" |
| 3928 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3929 | requires_max_content_len 4096 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3930 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3931 | run_test "Max fragment length: client 4096, server 512" \ |
| 3932 | "$P_SRV debug_level=3 max_frag_len=512" \ |
| 3933 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
| 3934 | 0 \ |
| 3935 | -c "Maximum input fragment length is 4096" \ |
| 3936 | -c "Maximum output fragment length is 4096" \ |
| 3937 | -s "Maximum input fragment length is 4096" \ |
| 3938 | -s "Maximum output fragment length is 512" \ |
| 3939 | -c "client hello, adding max_fragment_length extension" \ |
| 3940 | -s "found max fragment length extension" \ |
| 3941 | -s "server hello, max_fragment_length extension" \ |
| 3942 | -c "found max_fragment_length extension" |
| 3943 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3944 | requires_max_content_len 4096 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3945 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3946 | run_test "Max fragment length: client 4096, server 1024" \ |
| 3947 | "$P_SRV debug_level=3 max_frag_len=1024" \ |
| 3948 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
| 3949 | 0 \ |
| 3950 | -c "Maximum input fragment length is 4096" \ |
| 3951 | -c "Maximum output fragment length is 4096" \ |
| 3952 | -s "Maximum input fragment length is 4096" \ |
| 3953 | -s "Maximum output fragment length is 1024" \ |
| 3954 | -c "client hello, adding max_fragment_length extension" \ |
| 3955 | -s "found max fragment length extension" \ |
| 3956 | -s "server hello, max_fragment_length extension" \ |
| 3957 | -c "found max_fragment_length extension" |
| 3958 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3959 | requires_max_content_len 4096 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3960 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 3961 | run_test "Max fragment length: client 4096, server 2048" \ |
| 3962 | "$P_SRV debug_level=3 max_frag_len=2048" \ |
| 3963 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
| 3964 | 0 \ |
| 3965 | -c "Maximum input fragment length is 4096" \ |
| 3966 | -c "Maximum output fragment length is 4096" \ |
| 3967 | -s "Maximum input fragment length is 4096" \ |
| 3968 | -s "Maximum output fragment length is 2048" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 3969 | -c "client hello, adding max_fragment_length extension" \ |
| 3970 | -s "found max fragment length extension" \ |
| 3971 | -s "server hello, max_fragment_length extension" \ |
| 3972 | -c "found max_fragment_length extension" |
| 3973 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3974 | requires_max_content_len 4096 |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 3975 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3976 | run_test "Max fragment length: used by server" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3977 | "$P_SRV debug_level=3 max_frag_len=4096" \ |
| 3978 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 3979 | 0 \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3980 | -c "Maximum input fragment length is $MAX_CONTENT_LEN" \ |
| 3981 | -c "Maximum output fragment length is $MAX_CONTENT_LEN" \ |
| 3982 | -s "Maximum input fragment length is $MAX_CONTENT_LEN" \ |
| 3983 | -s "Maximum output fragment length is 4096" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 3984 | -C "client hello, adding max_fragment_length extension" \ |
| 3985 | -S "found max fragment length extension" \ |
| 3986 | -S "server hello, max_fragment_length extension" \ |
| 3987 | -C "found max_fragment_length extension" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 3988 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 3989 | requires_max_content_len 4096 |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 3990 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3991 | requires_gnutls |
| 3992 | run_test "Max fragment length: gnutls server" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 3993 | "$G_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3994 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 3995 | 0 \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 3996 | -c "Maximum input fragment length is 4096" \ |
| 3997 | -c "Maximum output fragment length is 4096" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 3998 | -c "client hello, adding max_fragment_length extension" \ |
| 3999 | -c "found max_fragment_length extension" |
| 4000 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4001 | requires_max_content_len 2048 |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 4002 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4003 | run_test "Max fragment length: client, message just fits" \ |
| 4004 | "$P_SRV debug_level=3" \ |
| 4005 | "$P_CLI debug_level=3 max_frag_len=2048 request_size=2048" \ |
| 4006 | 0 \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4007 | -c "Maximum input fragment length is 2048" \ |
| 4008 | -c "Maximum output fragment length is 2048" \ |
| 4009 | -s "Maximum input fragment length is 2048" \ |
| 4010 | -s "Maximum output fragment length is 2048" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4011 | -c "client hello, adding max_fragment_length extension" \ |
| 4012 | -s "found max fragment length extension" \ |
| 4013 | -s "server hello, max_fragment_length extension" \ |
| 4014 | -c "found max_fragment_length extension" \ |
| 4015 | -c "2048 bytes written in 1 fragments" \ |
| 4016 | -s "2048 bytes read" |
| 4017 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4018 | requires_max_content_len 2048 |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 4019 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4020 | run_test "Max fragment length: client, larger message" \ |
| 4021 | "$P_SRV debug_level=3" \ |
| 4022 | "$P_CLI debug_level=3 max_frag_len=2048 request_size=2345" \ |
| 4023 | 0 \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4024 | -c "Maximum input fragment length is 2048" \ |
| 4025 | -c "Maximum output fragment length is 2048" \ |
| 4026 | -s "Maximum input fragment length is 2048" \ |
| 4027 | -s "Maximum output fragment length is 2048" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4028 | -c "client hello, adding max_fragment_length extension" \ |
| 4029 | -s "found max fragment length extension" \ |
| 4030 | -s "server hello, max_fragment_length extension" \ |
| 4031 | -c "found max_fragment_length extension" \ |
| 4032 | -c "2345 bytes written in 2 fragments" \ |
| 4033 | -s "2048 bytes read" \ |
| 4034 | -s "297 bytes read" |
| 4035 | |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4036 | requires_max_content_len 2048 |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 4037 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 23eb74d | 2015-01-21 14:37:13 +0000 | [diff] [blame] | 4038 | run_test "Max fragment length: DTLS client, larger message" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4039 | "$P_SRV debug_level=3 dtls=1" \ |
| 4040 | "$P_CLI debug_level=3 dtls=1 max_frag_len=2048 request_size=2345" \ |
| 4041 | 1 \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4042 | -c "Maximum input fragment length is 2048" \ |
| 4043 | -c "Maximum output fragment length is 2048" \ |
| 4044 | -s "Maximum input fragment length is 2048" \ |
| 4045 | -s "Maximum output fragment length is 2048" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4046 | -c "client hello, adding max_fragment_length extension" \ |
| 4047 | -s "found max fragment length extension" \ |
| 4048 | -s "server hello, max_fragment_length extension" \ |
| 4049 | -c "found max_fragment_length extension" \ |
| 4050 | -c "fragment larger than.*maximum" |
| 4051 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4052 | # Tests for renegotiation |
| 4053 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4054 | # Renegotiation SCSV always added, regardless of SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4055 | run_test "Renegotiation: none, for reference" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4056 | "$P_SRV debug_level=3 exchanges=2 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4057 | "$P_CLI debug_level=3 exchanges=2" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4058 | 0 \ |
| 4059 | -C "client hello, adding renegotiation extension" \ |
| 4060 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4061 | -S "found renegotiation extension" \ |
| 4062 | -s "server hello, secure renegotiation extension" \ |
| 4063 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 4064 | -C "=> renegotiate" \ |
| 4065 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4066 | -S "write hello request" |
| 4067 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4068 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4069 | run_test "Renegotiation: client-initiated" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4070 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4071 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4072 | 0 \ |
| 4073 | -c "client hello, adding renegotiation extension" \ |
| 4074 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4075 | -s "found renegotiation extension" \ |
| 4076 | -s "server hello, secure renegotiation extension" \ |
| 4077 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 4078 | -c "=> renegotiate" \ |
| 4079 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4080 | -S "write hello request" |
| 4081 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4082 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4083 | run_test "Renegotiation: server-initiated" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4084 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4085 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4086 | 0 \ |
| 4087 | -c "client hello, adding renegotiation extension" \ |
| 4088 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4089 | -s "found renegotiation extension" \ |
| 4090 | -s "server hello, secure renegotiation extension" \ |
| 4091 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 4092 | -c "=> renegotiate" \ |
| 4093 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4094 | -s "write hello request" |
| 4095 | |
Janos Follath | b0f148c | 2017-10-05 12:29:42 +0100 | [diff] [blame] | 4096 | # Checks that no Signature Algorithm with SHA-1 gets negotiated. Negotiating SHA-1 would mean that |
| 4097 | # the server did not parse the Signature Algorithm extension. This test is valid only if an MD |
| 4098 | # algorithm stronger than SHA-1 is enabled in config.h |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4099 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Janos Follath | b0f148c | 2017-10-05 12:29:42 +0100 | [diff] [blame] | 4100 | run_test "Renegotiation: Signature Algorithms parsing, client-initiated" \ |
| 4101 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional" \ |
| 4102 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 4103 | 0 \ |
| 4104 | -c "client hello, adding renegotiation extension" \ |
| 4105 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4106 | -s "found renegotiation extension" \ |
| 4107 | -s "server hello, secure renegotiation extension" \ |
| 4108 | -c "found renegotiation extension" \ |
| 4109 | -c "=> renegotiate" \ |
| 4110 | -s "=> renegotiate" \ |
| 4111 | -S "write hello request" \ |
| 4112 | -S "client hello v3, signature_algorithm ext: 2" # Is SHA-1 negotiated? |
| 4113 | |
| 4114 | # Checks that no Signature Algorithm with SHA-1 gets negotiated. Negotiating SHA-1 would mean that |
| 4115 | # the server did not parse the Signature Algorithm extension. This test is valid only if an MD |
| 4116 | # algorithm stronger than SHA-1 is enabled in config.h |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4117 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Janos Follath | b0f148c | 2017-10-05 12:29:42 +0100 | [diff] [blame] | 4118 | run_test "Renegotiation: Signature Algorithms parsing, server-initiated" \ |
| 4119 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1" \ |
| 4120 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
| 4121 | 0 \ |
| 4122 | -c "client hello, adding renegotiation extension" \ |
| 4123 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4124 | -s "found renegotiation extension" \ |
| 4125 | -s "server hello, secure renegotiation extension" \ |
| 4126 | -c "found renegotiation extension" \ |
| 4127 | -c "=> renegotiate" \ |
| 4128 | -s "=> renegotiate" \ |
| 4129 | -s "write hello request" \ |
| 4130 | -S "client hello v3, signature_algorithm ext: 2" # Is SHA-1 negotiated? |
| 4131 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4132 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4133 | run_test "Renegotiation: double" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4134 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4135 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4136 | 0 \ |
| 4137 | -c "client hello, adding renegotiation extension" \ |
| 4138 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4139 | -s "found renegotiation extension" \ |
| 4140 | -s "server hello, secure renegotiation extension" \ |
| 4141 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 4142 | -c "=> renegotiate" \ |
| 4143 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4144 | -s "write hello request" |
| 4145 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4146 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Andrzej Kurek | 8ea6872 | 2020-04-03 06:40:47 -0400 | [diff] [blame] | 4147 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | bec7cf7 | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4148 | requires_max_content_len 2048 |
Andrzej Kurek | 8ea6872 | 2020-04-03 06:40:47 -0400 | [diff] [blame] | 4149 | run_test "Renegotiation with max fragment length: client 2048, server 512" \ |
| 4150 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1 max_frag_len=512" \ |
| 4151 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 max_frag_len=2048 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 4152 | 0 \ |
| 4153 | -c "Maximum input fragment length is 2048" \ |
| 4154 | -c "Maximum output fragment length is 2048" \ |
| 4155 | -s "Maximum input fragment length is 2048" \ |
| 4156 | -s "Maximum output fragment length is 512" \ |
| 4157 | -c "client hello, adding max_fragment_length extension" \ |
| 4158 | -s "found max fragment length extension" \ |
| 4159 | -s "server hello, max_fragment_length extension" \ |
| 4160 | -c "found max_fragment_length extension" \ |
| 4161 | -c "client hello, adding renegotiation extension" \ |
| 4162 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4163 | -s "found renegotiation extension" \ |
| 4164 | -s "server hello, secure renegotiation extension" \ |
| 4165 | -c "found renegotiation extension" \ |
| 4166 | -c "=> renegotiate" \ |
| 4167 | -s "=> renegotiate" \ |
| 4168 | -s "write hello request" |
| 4169 | |
| 4170 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4171 | run_test "Renegotiation: client-initiated, server-rejected" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4172 | "$P_SRV debug_level=3 exchanges=2 renegotiation=0 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4173 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4174 | 1 \ |
| 4175 | -c "client hello, adding renegotiation extension" \ |
| 4176 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4177 | -S "found renegotiation extension" \ |
| 4178 | -s "server hello, secure renegotiation extension" \ |
| 4179 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 4180 | -c "=> renegotiate" \ |
| 4181 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4182 | -S "write hello request" \ |
Manuel Pégourié-Gonnard | 6591962 | 2014-08-19 12:50:30 +0200 | [diff] [blame] | 4183 | -c "SSL - Unexpected message at ServerHello in renegotiation" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4184 | -c "failed" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4185 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4186 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4187 | run_test "Renegotiation: server-initiated, client-rejected, default" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4188 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4189 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4190 | 0 \ |
| 4191 | -C "client hello, adding renegotiation extension" \ |
| 4192 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4193 | -S "found renegotiation extension" \ |
| 4194 | -s "server hello, secure renegotiation extension" \ |
| 4195 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 4196 | -C "=> renegotiate" \ |
| 4197 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4198 | -s "write hello request" \ |
Manuel Pégourié-Gonnard | a9964db | 2014-07-03 19:29:16 +0200 | [diff] [blame] | 4199 | -S "SSL - An unexpected message was received from our peer" \ |
| 4200 | -S "failed" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 4201 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4202 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4203 | run_test "Renegotiation: server-initiated, client-rejected, not enforced" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4204 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4205 | renego_delay=-1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4206 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4207 | 0 \ |
| 4208 | -C "client hello, adding renegotiation extension" \ |
| 4209 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4210 | -S "found renegotiation extension" \ |
| 4211 | -s "server hello, secure renegotiation extension" \ |
| 4212 | -c "found renegotiation extension" \ |
| 4213 | -C "=> renegotiate" \ |
| 4214 | -S "=> renegotiate" \ |
| 4215 | -s "write hello request" \ |
| 4216 | -S "SSL - An unexpected message was received from our peer" \ |
| 4217 | -S "failed" |
| 4218 | |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 4219 | # delay 2 for 1 alert record + 1 application data record |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4220 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4221 | run_test "Renegotiation: server-initiated, client-rejected, delay 2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4222 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4223 | renego_delay=2 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4224 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4225 | 0 \ |
| 4226 | -C "client hello, adding renegotiation extension" \ |
| 4227 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4228 | -S "found renegotiation extension" \ |
| 4229 | -s "server hello, secure renegotiation extension" \ |
| 4230 | -c "found renegotiation extension" \ |
| 4231 | -C "=> renegotiate" \ |
| 4232 | -S "=> renegotiate" \ |
| 4233 | -s "write hello request" \ |
| 4234 | -S "SSL - An unexpected message was received from our peer" \ |
| 4235 | -S "failed" |
| 4236 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4237 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4238 | run_test "Renegotiation: server-initiated, client-rejected, delay 0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4239 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4240 | renego_delay=0 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4241 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4242 | 0 \ |
| 4243 | -C "client hello, adding renegotiation extension" \ |
| 4244 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4245 | -S "found renegotiation extension" \ |
| 4246 | -s "server hello, secure renegotiation extension" \ |
| 4247 | -c "found renegotiation extension" \ |
| 4248 | -C "=> renegotiate" \ |
| 4249 | -S "=> renegotiate" \ |
| 4250 | -s "write hello request" \ |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 4251 | -s "SSL - An unexpected message was received from our peer" |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4252 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4253 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4254 | run_test "Renegotiation: server-initiated, client-accepted, delay 0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4255 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4256 | renego_delay=0 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4257 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4258 | 0 \ |
| 4259 | -c "client hello, adding renegotiation extension" \ |
| 4260 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4261 | -s "found renegotiation extension" \ |
| 4262 | -s "server hello, secure renegotiation extension" \ |
| 4263 | -c "found renegotiation extension" \ |
| 4264 | -c "=> renegotiate" \ |
| 4265 | -s "=> renegotiate" \ |
| 4266 | -s "write hello request" \ |
| 4267 | -S "SSL - An unexpected message was received from our peer" \ |
| 4268 | -S "failed" |
| 4269 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4270 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 4271 | run_test "Renegotiation: periodic, just below period" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4272 | "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 4273 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
| 4274 | 0 \ |
| 4275 | -C "client hello, adding renegotiation extension" \ |
| 4276 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4277 | -S "found renegotiation extension" \ |
| 4278 | -s "server hello, secure renegotiation extension" \ |
| 4279 | -c "found renegotiation extension" \ |
| 4280 | -S "record counter limit reached: renegotiate" \ |
| 4281 | -C "=> renegotiate" \ |
| 4282 | -S "=> renegotiate" \ |
| 4283 | -S "write hello request" \ |
| 4284 | -S "SSL - An unexpected message was received from our peer" \ |
| 4285 | -S "failed" |
| 4286 | |
Manuel Pégourié-Gonnard | 9835bc0 | 2015-01-14 14:41:58 +0100 | [diff] [blame] | 4287 | # one extra exchange to be able to complete renego |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4288 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 4289 | run_test "Renegotiation: periodic, just above period" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4290 | "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 9835bc0 | 2015-01-14 14:41:58 +0100 | [diff] [blame] | 4291 | "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 4292 | 0 \ |
| 4293 | -c "client hello, adding renegotiation extension" \ |
| 4294 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4295 | -s "found renegotiation extension" \ |
| 4296 | -s "server hello, secure renegotiation extension" \ |
| 4297 | -c "found renegotiation extension" \ |
| 4298 | -s "record counter limit reached: renegotiate" \ |
| 4299 | -c "=> renegotiate" \ |
| 4300 | -s "=> renegotiate" \ |
| 4301 | -s "write hello request" \ |
| 4302 | -S "SSL - An unexpected message was received from our peer" \ |
| 4303 | -S "failed" |
| 4304 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4305 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 4306 | run_test "Renegotiation: periodic, two times period" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4307 | "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 9835bc0 | 2015-01-14 14:41:58 +0100 | [diff] [blame] | 4308 | "$P_CLI debug_level=3 exchanges=7 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 4309 | 0 \ |
| 4310 | -c "client hello, adding renegotiation extension" \ |
| 4311 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4312 | -s "found renegotiation extension" \ |
| 4313 | -s "server hello, secure renegotiation extension" \ |
| 4314 | -c "found renegotiation extension" \ |
| 4315 | -s "record counter limit reached: renegotiate" \ |
| 4316 | -c "=> renegotiate" \ |
| 4317 | -s "=> renegotiate" \ |
| 4318 | -s "write hello request" \ |
| 4319 | -S "SSL - An unexpected message was received from our peer" \ |
| 4320 | -S "failed" |
| 4321 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4322 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 4323 | run_test "Renegotiation: periodic, above period, disabled" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4324 | "$P_SRV debug_level=3 exchanges=9 renegotiation=0 renego_period=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 4325 | "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \ |
| 4326 | 0 \ |
| 4327 | -C "client hello, adding renegotiation extension" \ |
| 4328 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4329 | -S "found renegotiation extension" \ |
| 4330 | -s "server hello, secure renegotiation extension" \ |
| 4331 | -c "found renegotiation extension" \ |
| 4332 | -S "record counter limit reached: renegotiate" \ |
| 4333 | -C "=> renegotiate" \ |
| 4334 | -S "=> renegotiate" \ |
| 4335 | -S "write hello request" \ |
| 4336 | -S "SSL - An unexpected message was received from our peer" \ |
| 4337 | -S "failed" |
| 4338 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4339 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4340 | run_test "Renegotiation: nbio, client-initiated" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4341 | "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4342 | "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | f07f421 | 2014-08-15 19:04:47 +0200 | [diff] [blame] | 4343 | 0 \ |
| 4344 | -c "client hello, adding renegotiation extension" \ |
| 4345 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4346 | -s "found renegotiation extension" \ |
| 4347 | -s "server hello, secure renegotiation extension" \ |
| 4348 | -c "found renegotiation extension" \ |
| 4349 | -c "=> renegotiate" \ |
| 4350 | -s "=> renegotiate" \ |
| 4351 | -S "write hello request" |
| 4352 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4353 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4354 | run_test "Renegotiation: nbio, server-initiated" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4355 | "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4356 | "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | f07f421 | 2014-08-15 19:04:47 +0200 | [diff] [blame] | 4357 | 0 \ |
| 4358 | -c "client hello, adding renegotiation extension" \ |
| 4359 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4360 | -s "found renegotiation extension" \ |
| 4361 | -s "server hello, secure renegotiation extension" \ |
| 4362 | -c "found renegotiation extension" \ |
| 4363 | -c "=> renegotiate" \ |
| 4364 | -s "=> renegotiate" \ |
| 4365 | -s "write hello request" |
| 4366 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4367 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4368 | run_test "Renegotiation: openssl server, client-initiated" \ |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 4369 | "$O_SRV -www" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4370 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 4371 | 0 \ |
| 4372 | -c "client hello, adding renegotiation extension" \ |
| 4373 | -c "found renegotiation extension" \ |
| 4374 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4375 | -C "ssl_hanshake() returned" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 4376 | -C "error" \ |
| 4377 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 4378 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 4379 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4380 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4381 | run_test "Renegotiation: gnutls server strict, client-initiated" \ |
| 4382 | "$G_SRV --priority=NORMAL:%SAFE_RENEGOTIATION" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4383 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 4384 | 0 \ |
| 4385 | -c "client hello, adding renegotiation extension" \ |
| 4386 | -c "found renegotiation extension" \ |
| 4387 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4388 | -C "ssl_hanshake() returned" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 4389 | -C "error" \ |
| 4390 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 4391 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 4392 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4393 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4394 | run_test "Renegotiation: gnutls server unsafe, client-initiated default" \ |
| 4395 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 4396 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
| 4397 | 1 \ |
| 4398 | -c "client hello, adding renegotiation extension" \ |
| 4399 | -C "found renegotiation extension" \ |
| 4400 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4401 | -c "mbedtls_ssl_handshake() returned" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4402 | -c "error" \ |
| 4403 | -C "HTTP/1.0 200 [Oo][Kk]" |
| 4404 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 4405 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4406 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4407 | run_test "Renegotiation: gnutls server unsafe, client-inititated no legacy" \ |
| 4408 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 4409 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \ |
| 4410 | allow_legacy=0" \ |
| 4411 | 1 \ |
| 4412 | -c "client hello, adding renegotiation extension" \ |
| 4413 | -C "found renegotiation extension" \ |
| 4414 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4415 | -c "mbedtls_ssl_handshake() returned" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4416 | -c "error" \ |
| 4417 | -C "HTTP/1.0 200 [Oo][Kk]" |
| 4418 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 4419 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4420 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4421 | run_test "Renegotiation: gnutls server unsafe, client-inititated legacy" \ |
| 4422 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 4423 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \ |
| 4424 | allow_legacy=1" \ |
| 4425 | 0 \ |
| 4426 | -c "client hello, adding renegotiation extension" \ |
| 4427 | -C "found renegotiation extension" \ |
| 4428 | -c "=> renegotiate" \ |
| 4429 | -C "ssl_hanshake() returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4430 | -C "error" \ |
| 4431 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 4432 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4433 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 30d16eb | 2014-08-19 17:43:50 +0200 | [diff] [blame] | 4434 | run_test "Renegotiation: DTLS, client-initiated" \ |
| 4435 | "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1" \ |
| 4436 | "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 4437 | 0 \ |
| 4438 | -c "client hello, adding renegotiation extension" \ |
| 4439 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4440 | -s "found renegotiation extension" \ |
| 4441 | -s "server hello, secure renegotiation extension" \ |
| 4442 | -c "found renegotiation extension" \ |
| 4443 | -c "=> renegotiate" \ |
| 4444 | -s "=> renegotiate" \ |
| 4445 | -S "write hello request" |
| 4446 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4447 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | c392b24 | 2014-08-19 17:53:11 +0200 | [diff] [blame] | 4448 | run_test "Renegotiation: DTLS, server-initiated" \ |
| 4449 | "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | df9a0a8 | 2014-10-02 14:17:18 +0200 | [diff] [blame] | 4450 | "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1 \ |
| 4451 | read_timeout=1000 max_resend=2" \ |
Manuel Pégourié-Gonnard | c392b24 | 2014-08-19 17:53:11 +0200 | [diff] [blame] | 4452 | 0 \ |
| 4453 | -c "client hello, adding renegotiation extension" \ |
| 4454 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4455 | -s "found renegotiation extension" \ |
| 4456 | -s "server hello, secure renegotiation extension" \ |
| 4457 | -c "found renegotiation extension" \ |
| 4458 | -c "=> renegotiate" \ |
| 4459 | -s "=> renegotiate" \ |
| 4460 | -s "write hello request" |
| 4461 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4462 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Andres AG | 692ad84 | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 4463 | run_test "Renegotiation: DTLS, renego_period overflow" \ |
| 4464 | "$P_SRV debug_level=3 dtls=1 exchanges=4 renegotiation=1 renego_period=18446462598732840962 auth_mode=optional" \ |
| 4465 | "$P_CLI debug_level=3 dtls=1 exchanges=4 renegotiation=1" \ |
| 4466 | 0 \ |
| 4467 | -c "client hello, adding renegotiation extension" \ |
| 4468 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4469 | -s "found renegotiation extension" \ |
| 4470 | -s "server hello, secure renegotiation extension" \ |
| 4471 | -s "record counter limit reached: renegotiate" \ |
| 4472 | -c "=> renegotiate" \ |
| 4473 | -s "=> renegotiate" \ |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4474 | -s "write hello request" |
Andres AG | 692ad84 | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 4475 | |
Manuel Pégourié-Gonnard | 9699996 | 2015-02-17 16:02:37 +0000 | [diff] [blame] | 4476 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4477 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | f1499f6 | 2014-08-31 17:13:13 +0200 | [diff] [blame] | 4478 | run_test "Renegotiation: DTLS, gnutls server, client-initiated" \ |
| 4479 | "$G_SRV -u --mtu 4096" \ |
| 4480 | "$P_CLI debug_level=3 dtls=1 exchanges=1 renegotiation=1 renegotiate=1" \ |
| 4481 | 0 \ |
| 4482 | -c "client hello, adding renegotiation extension" \ |
| 4483 | -c "found renegotiation extension" \ |
| 4484 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4485 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | f1499f6 | 2014-08-31 17:13:13 +0200 | [diff] [blame] | 4486 | -C "error" \ |
| 4487 | -s "Extra-header:" |
| 4488 | |
Shaun Case | 0e7791f | 2021-12-20 21:14:10 -0800 | [diff] [blame] | 4489 | # Test for the "secure renegotiation" extension only (no actual renegotiation) |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4490 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 4491 | requires_gnutls |
Gilles Peskine | b3bba1a | 2024-04-29 17:47:35 +0200 | [diff] [blame] | 4492 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4493 | run_test "Renego ext: gnutls server strict, client default" \ |
| 4494 | "$G_SRV --priority=NORMAL:%SAFE_RENEGOTIATION" \ |
| 4495 | "$P_CLI debug_level=3" \ |
| 4496 | 0 \ |
| 4497 | -c "found renegotiation extension" \ |
| 4498 | -C "error" \ |
| 4499 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 4500 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 4501 | requires_gnutls |
Gilles Peskine | b3bba1a | 2024-04-29 17:47:35 +0200 | [diff] [blame] | 4502 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4503 | run_test "Renego ext: gnutls server unsafe, client default" \ |
| 4504 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 4505 | "$P_CLI debug_level=3" \ |
| 4506 | 0 \ |
| 4507 | -C "found renegotiation extension" \ |
| 4508 | -C "error" \ |
| 4509 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 4510 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 4511 | requires_gnutls |
Gilles Peskine | b3bba1a | 2024-04-29 17:47:35 +0200 | [diff] [blame] | 4512 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4513 | run_test "Renego ext: gnutls server unsafe, client break legacy" \ |
| 4514 | "$G_SRV --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \ |
| 4515 | "$P_CLI debug_level=3 allow_legacy=-1" \ |
| 4516 | 1 \ |
| 4517 | -C "found renegotiation extension" \ |
| 4518 | -c "error" \ |
| 4519 | -C "HTTP/1.0 200 [Oo][Kk]" |
| 4520 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 4521 | requires_gnutls |
Gilles Peskine | b3bba1a | 2024-04-29 17:47:35 +0200 | [diff] [blame] | 4522 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4523 | run_test "Renego ext: gnutls client strict, server default" \ |
| 4524 | "$P_SRV debug_level=3" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 4525 | "$G_CLI --priority=NORMAL:%SAFE_RENEGOTIATION localhost" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4526 | 0 \ |
| 4527 | -s "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ |
| 4528 | -s "server hello, secure renegotiation extension" |
| 4529 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 4530 | requires_gnutls |
Gilles Peskine | b3bba1a | 2024-04-29 17:47:35 +0200 | [diff] [blame] | 4531 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4532 | run_test "Renego ext: gnutls client unsafe, server default" \ |
| 4533 | "$P_SRV debug_level=3" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 4534 | "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION localhost" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4535 | 0 \ |
| 4536 | -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ |
| 4537 | -S "server hello, secure renegotiation extension" |
| 4538 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 4539 | requires_gnutls |
Gilles Peskine | b3bba1a | 2024-04-29 17:47:35 +0200 | [diff] [blame] | 4540 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4541 | run_test "Renego ext: gnutls client unsafe, server break legacy" \ |
| 4542 | "$P_SRV debug_level=3 allow_legacy=-1" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 4543 | "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION localhost" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 4544 | 1 \ |
| 4545 | -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ |
| 4546 | -S "server hello, secure renegotiation extension" |
| 4547 | |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 4548 | # Tests for silently dropping trailing extra bytes in .der certificates |
| 4549 | |
| 4550 | requires_gnutls |
| 4551 | run_test "DER format: no trailing bytes" \ |
| 4552 | "$P_SRV crt_file=data_files/server5-der0.crt \ |
| 4553 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 4554 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 4555 | 0 \ |
| 4556 | -c "Handshake was completed" \ |
| 4557 | |
| 4558 | requires_gnutls |
| 4559 | run_test "DER format: with a trailing zero byte" \ |
| 4560 | "$P_SRV crt_file=data_files/server5-der1a.crt \ |
| 4561 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 4562 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 4563 | 0 \ |
| 4564 | -c "Handshake was completed" \ |
| 4565 | |
| 4566 | requires_gnutls |
| 4567 | run_test "DER format: with a trailing random byte" \ |
| 4568 | "$P_SRV crt_file=data_files/server5-der1b.crt \ |
| 4569 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 4570 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 4571 | 0 \ |
| 4572 | -c "Handshake was completed" \ |
| 4573 | |
| 4574 | requires_gnutls |
| 4575 | run_test "DER format: with 2 trailing random bytes" \ |
| 4576 | "$P_SRV crt_file=data_files/server5-der2.crt \ |
| 4577 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 4578 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 4579 | 0 \ |
| 4580 | -c "Handshake was completed" \ |
| 4581 | |
| 4582 | requires_gnutls |
| 4583 | run_test "DER format: with 4 trailing random bytes" \ |
| 4584 | "$P_SRV crt_file=data_files/server5-der4.crt \ |
| 4585 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 4586 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 4587 | 0 \ |
| 4588 | -c "Handshake was completed" \ |
| 4589 | |
| 4590 | requires_gnutls |
| 4591 | run_test "DER format: with 8 trailing random bytes" \ |
| 4592 | "$P_SRV crt_file=data_files/server5-der8.crt \ |
| 4593 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 4594 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 4595 | 0 \ |
| 4596 | -c "Handshake was completed" \ |
| 4597 | |
| 4598 | requires_gnutls |
| 4599 | run_test "DER format: with 9 trailing random bytes" \ |
| 4600 | "$P_SRV crt_file=data_files/server5-der9.crt \ |
| 4601 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 4602 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 4603 | 0 \ |
| 4604 | -c "Handshake was completed" \ |
| 4605 | |
Jarno Lamsa | f7a7f9e | 2019-04-01 15:11:54 +0300 | [diff] [blame] | 4606 | # Tests for auth_mode, there are duplicated tests using ca callback for authentication |
| 4607 | # When updating these tests, modify the matching authentication tests accordingly |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4608 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4609 | run_test "Authentication: server badcert, client required" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4610 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
| 4611 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4612 | "$P_CLI debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4613 | 1 \ |
| 4614 | -c "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 4615 | -c "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4616 | -c "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4617 | -c "X509 - Certificate verification failed" |
| 4618 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4619 | run_test "Authentication: server badcert, client optional" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4620 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
| 4621 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4622 | "$P_CLI debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4623 | 0 \ |
| 4624 | -c "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 4625 | -c "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4626 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4627 | -C "X509 - Certificate verification failed" |
| 4628 | |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 4629 | run_test "Authentication: server goodcert, client optional, no trusted CA" \ |
| 4630 | "$P_SRV" \ |
| 4631 | "$P_CLI debug_level=3 auth_mode=optional ca_file=none ca_path=none" \ |
| 4632 | 0 \ |
| 4633 | -c "x509_verify_cert() returned" \ |
| 4634 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 4635 | -c "! Certificate verification flags"\ |
| 4636 | -C "! mbedtls_ssl_handshake returned" \ |
| 4637 | -C "X509 - Certificate verification failed" \ |
| 4638 | -C "SSL - No CA Chain is set, but required to operate" |
| 4639 | |
| 4640 | run_test "Authentication: server goodcert, client required, no trusted CA" \ |
| 4641 | "$P_SRV" \ |
| 4642 | "$P_CLI debug_level=3 auth_mode=required ca_file=none ca_path=none" \ |
| 4643 | 1 \ |
| 4644 | -c "x509_verify_cert() returned" \ |
| 4645 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 4646 | -c "! Certificate verification flags"\ |
| 4647 | -c "! mbedtls_ssl_handshake returned" \ |
| 4648 | -c "SSL - No CA Chain is set, but required to operate" |
| 4649 | |
| 4650 | # The purpose of the next two tests is to test the client's behaviour when receiving a server |
| 4651 | # certificate with an unsupported elliptic curve. This should usually not happen because |
| 4652 | # the client informs the server about the supported curves - it does, though, in the |
| 4653 | # corner case of a static ECDH suite, because the server doesn't check the curve on that |
| 4654 | # occasion (to be fixed). If that bug's fixed, the test needs to be altered to use a |
| 4655 | # different means to have the server ignoring the client's supported curve list. |
| 4656 | |
| 4657 | requires_config_enabled MBEDTLS_ECP_C |
| 4658 | run_test "Authentication: server ECDH p256v1, client required, p256v1 unsupported" \ |
| 4659 | "$P_SRV debug_level=1 key_file=data_files/server5.key \ |
| 4660 | crt_file=data_files/server5.ku-ka.crt" \ |
| 4661 | "$P_CLI debug_level=3 auth_mode=required curves=secp521r1" \ |
| 4662 | 1 \ |
| 4663 | -c "bad certificate (EC key curve)"\ |
| 4664 | -c "! Certificate verification flags"\ |
| 4665 | -C "bad server certificate (ECDH curve)" # Expect failure at earlier verification stage |
| 4666 | |
| 4667 | requires_config_enabled MBEDTLS_ECP_C |
| 4668 | run_test "Authentication: server ECDH p256v1, client optional, p256v1 unsupported" \ |
| 4669 | "$P_SRV debug_level=1 key_file=data_files/server5.key \ |
| 4670 | crt_file=data_files/server5.ku-ka.crt" \ |
| 4671 | "$P_CLI debug_level=3 auth_mode=optional curves=secp521r1" \ |
| 4672 | 1 \ |
| 4673 | -c "bad certificate (EC key curve)"\ |
| 4674 | -c "! Certificate verification flags"\ |
| 4675 | -c "bad server certificate (ECDH curve)" # Expect failure only at ECDH params check |
| 4676 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4677 | run_test "Authentication: server badcert, client none" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 4678 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4679 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4680 | "$P_CLI debug_level=1 auth_mode=none" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4681 | 0 \ |
| 4682 | -C "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 4683 | -C "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4684 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4685 | -C "X509 - Certificate verification failed" |
| 4686 | |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 4687 | run_test "Authentication: client SHA256, server required" \ |
| 4688 | "$P_SRV auth_mode=required" \ |
| 4689 | "$P_CLI debug_level=3 crt_file=data_files/server6.crt \ |
| 4690 | key_file=data_files/server6.key \ |
| 4691 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ |
| 4692 | 0 \ |
| 4693 | -c "Supported Signature Algorithm found: 4," \ |
| 4694 | -c "Supported Signature Algorithm found: 5," |
| 4695 | |
| 4696 | run_test "Authentication: client SHA384, server required" \ |
| 4697 | "$P_SRV auth_mode=required" \ |
| 4698 | "$P_CLI debug_level=3 crt_file=data_files/server6.crt \ |
| 4699 | key_file=data_files/server6.key \ |
| 4700 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ |
| 4701 | 0 \ |
| 4702 | -c "Supported Signature Algorithm found: 4," \ |
| 4703 | -c "Supported Signature Algorithm found: 5," |
| 4704 | |
Gilles Peskine | fd8332e | 2017-05-03 16:25:07 +0200 | [diff] [blame] | 4705 | run_test "Authentication: client has no cert, server required (SSLv3)" \ |
| 4706 | "$P_SRV debug_level=3 min_version=ssl3 auth_mode=required" \ |
| 4707 | "$P_CLI debug_level=3 force_version=ssl3 crt_file=none \ |
| 4708 | key_file=data_files/server5.key" \ |
| 4709 | 1 \ |
| 4710 | -S "skip write certificate request" \ |
| 4711 | -C "skip parse certificate request" \ |
| 4712 | -c "got a certificate request" \ |
| 4713 | -c "got no certificate to send" \ |
| 4714 | -S "x509_verify_cert() returned" \ |
| 4715 | -s "client has no certificate" \ |
| 4716 | -s "! mbedtls_ssl_handshake returned" \ |
| 4717 | -c "! mbedtls_ssl_handshake returned" \ |
| 4718 | -s "No client certification received from the client, but required by the authentication mode" |
| 4719 | |
| 4720 | run_test "Authentication: client has no cert, server required (TLS)" \ |
| 4721 | "$P_SRV debug_level=3 auth_mode=required" \ |
| 4722 | "$P_CLI debug_level=3 crt_file=none \ |
| 4723 | key_file=data_files/server5.key" \ |
| 4724 | 1 \ |
| 4725 | -S "skip write certificate request" \ |
| 4726 | -C "skip parse certificate request" \ |
| 4727 | -c "got a certificate request" \ |
| 4728 | -c "= write certificate$" \ |
| 4729 | -C "skip write certificate$" \ |
| 4730 | -S "x509_verify_cert() returned" \ |
| 4731 | -s "client has no certificate" \ |
| 4732 | -s "! mbedtls_ssl_handshake returned" \ |
| 4733 | -c "! mbedtls_ssl_handshake returned" \ |
| 4734 | -s "No client certification received from the client, but required by the authentication mode" |
| 4735 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4736 | run_test "Authentication: client badcert, server required" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4737 | "$P_SRV debug_level=3 auth_mode=required" \ |
| 4738 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4739 | key_file=data_files/server5.key" \ |
| 4740 | 1 \ |
| 4741 | -S "skip write certificate request" \ |
| 4742 | -C "skip parse certificate request" \ |
| 4743 | -c "got a certificate request" \ |
| 4744 | -C "skip write certificate" \ |
| 4745 | -C "skip write certificate verify" \ |
| 4746 | -S "skip parse certificate verify" \ |
| 4747 | -s "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 4748 | -s "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4749 | -s "! mbedtls_ssl_handshake returned" \ |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 4750 | -s "send alert level=2 message=48" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4751 | -c "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4752 | -s "X509 - Certificate verification failed" |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 4753 | # We don't check that the client receives the alert because it might |
| 4754 | # detect that its write end of the connection is closed and abort |
| 4755 | # before reading the alert message. |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4756 | |
Gilles Peskine | 8c681b7 | 2022-01-07 23:10:56 +0100 | [diff] [blame] | 4757 | run_test "Authentication: client cert self-signed and trusted, server required" \ |
| 4758 | "$P_SRV debug_level=3 auth_mode=required ca_file=data_files/server5-selfsigned.crt" \ |
| 4759 | "$P_CLI debug_level=3 crt_file=data_files/server5-selfsigned.crt \ |
| 4760 | key_file=data_files/server5.key" \ |
| 4761 | 0 \ |
| 4762 | -S "skip write certificate request" \ |
| 4763 | -C "skip parse certificate request" \ |
| 4764 | -c "got a certificate request" \ |
| 4765 | -C "skip write certificate" \ |
| 4766 | -C "skip write certificate verify" \ |
| 4767 | -S "skip parse certificate verify" \ |
| 4768 | -S "x509_verify_cert() returned" \ |
| 4769 | -S "! The certificate is not correctly signed" \ |
| 4770 | -S "X509 - Certificate verification failed" |
| 4771 | |
Janos Follath | 89baba2 | 2017-04-10 14:34:35 +0100 | [diff] [blame] | 4772 | run_test "Authentication: client cert not trusted, server required" \ |
| 4773 | "$P_SRV debug_level=3 auth_mode=required" \ |
| 4774 | "$P_CLI debug_level=3 crt_file=data_files/server5-selfsigned.crt \ |
| 4775 | key_file=data_files/server5.key" \ |
| 4776 | 1 \ |
| 4777 | -S "skip write certificate request" \ |
| 4778 | -C "skip parse certificate request" \ |
| 4779 | -c "got a certificate request" \ |
| 4780 | -C "skip write certificate" \ |
| 4781 | -C "skip write certificate verify" \ |
| 4782 | -S "skip parse certificate verify" \ |
| 4783 | -s "x509_verify_cert() returned" \ |
| 4784 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 4785 | -s "! mbedtls_ssl_handshake returned" \ |
| 4786 | -c "! mbedtls_ssl_handshake returned" \ |
| 4787 | -s "X509 - Certificate verification failed" |
| 4788 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4789 | run_test "Authentication: client badcert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4790 | "$P_SRV debug_level=3 auth_mode=optional" \ |
| 4791 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4792 | key_file=data_files/server5.key" \ |
| 4793 | 0 \ |
| 4794 | -S "skip write certificate request" \ |
| 4795 | -C "skip parse certificate request" \ |
| 4796 | -c "got a certificate request" \ |
| 4797 | -C "skip write certificate" \ |
| 4798 | -C "skip write certificate verify" \ |
| 4799 | -S "skip parse certificate verify" \ |
| 4800 | -s "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 4801 | -s "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4802 | -S "! mbedtls_ssl_handshake returned" \ |
| 4803 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4804 | -S "X509 - Certificate verification failed" |
| 4805 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4806 | run_test "Authentication: client badcert, server none" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4807 | "$P_SRV debug_level=3 auth_mode=none" \ |
| 4808 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4809 | key_file=data_files/server5.key" \ |
| 4810 | 0 \ |
| 4811 | -s "skip write certificate request" \ |
| 4812 | -C "skip parse certificate request" \ |
| 4813 | -c "got no certificate request" \ |
| 4814 | -c "skip write certificate" \ |
| 4815 | -c "skip write certificate verify" \ |
| 4816 | -s "skip parse certificate verify" \ |
| 4817 | -S "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 4818 | -S "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4819 | -S "! mbedtls_ssl_handshake returned" \ |
| 4820 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 4821 | -S "X509 - Certificate verification failed" |
| 4822 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4823 | run_test "Authentication: client no cert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4824 | "$P_SRV debug_level=3 auth_mode=optional" \ |
| 4825 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 4826 | 0 \ |
| 4827 | -S "skip write certificate request" \ |
| 4828 | -C "skip parse certificate request" \ |
| 4829 | -c "got a certificate request" \ |
| 4830 | -C "skip write certificate$" \ |
| 4831 | -C "got no certificate to send" \ |
| 4832 | -S "SSLv3 client has no certificate" \ |
| 4833 | -c "skip write certificate verify" \ |
| 4834 | -s "skip parse certificate verify" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 4835 | -s "! Certificate was missing" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4836 | -S "! mbedtls_ssl_handshake returned" \ |
| 4837 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 4838 | -S "X509 - Certificate verification failed" |
| 4839 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4840 | run_test "Authentication: openssl client no cert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4841 | "$P_SRV debug_level=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 4842 | "$O_CLI" \ |
| 4843 | 0 \ |
| 4844 | -S "skip write certificate request" \ |
| 4845 | -s "skip parse certificate verify" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 4846 | -s "! Certificate was missing" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4847 | -S "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 4848 | -S "X509 - Certificate verification failed" |
| 4849 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4850 | run_test "Authentication: client no cert, openssl server optional" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 4851 | "$O_SRV -verify 10" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4852 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 4853 | 0 \ |
| 4854 | -C "skip parse certificate request" \ |
| 4855 | -c "got a certificate request" \ |
| 4856 | -C "skip write certificate$" \ |
| 4857 | -c "skip write certificate verify" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4858 | -C "! mbedtls_ssl_handshake returned" |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 4859 | |
Gilles Peskine | fd8332e | 2017-05-03 16:25:07 +0200 | [diff] [blame] | 4860 | run_test "Authentication: client no cert, openssl server required" \ |
| 4861 | "$O_SRV -Verify 10" \ |
| 4862 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
| 4863 | 1 \ |
| 4864 | -C "skip parse certificate request" \ |
| 4865 | -c "got a certificate request" \ |
| 4866 | -C "skip write certificate$" \ |
| 4867 | -c "skip write certificate verify" \ |
| 4868 | -c "! mbedtls_ssl_handshake returned" |
| 4869 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4870 | run_test "Authentication: client no cert, ssl3" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4871 | "$P_SRV debug_level=3 auth_mode=optional force_version=ssl3" \ |
Manuel Pégourié-Gonnard | 448ea50 | 2015-01-12 11:40:14 +0100 | [diff] [blame] | 4872 | "$P_CLI debug_level=3 crt_file=none key_file=none min_version=ssl3" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 4873 | 0 \ |
| 4874 | -S "skip write certificate request" \ |
| 4875 | -C "skip parse certificate request" \ |
| 4876 | -c "got a certificate request" \ |
| 4877 | -C "skip write certificate$" \ |
| 4878 | -c "skip write certificate verify" \ |
| 4879 | -c "got no certificate to send" \ |
| 4880 | -s "SSLv3 client has no certificate" \ |
| 4881 | -s "skip parse certificate verify" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 4882 | -s "! Certificate was missing" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4883 | -S "! mbedtls_ssl_handshake returned" \ |
| 4884 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 4885 | -S "X509 - Certificate verification failed" |
| 4886 | |
Yuto Takano | ccdd25c | 2021-07-02 13:05:15 +0100 | [diff] [blame] | 4887 | # This script assumes that MBEDTLS_X509_MAX_INTERMEDIATE_CA has its default |
| 4888 | # value, defined here as MAX_IM_CA. Some test cases will be skipped if the |
| 4889 | # library is configured with a different value. |
Hanno Becker | a6bca9f | 2017-07-26 13:35:11 +0100 | [diff] [blame] | 4890 | |
Simon Butcher | bcfa6f4 | 2017-07-28 15:59:35 +0100 | [diff] [blame] | 4891 | MAX_IM_CA='8' |
Hanno Becker | a6bca9f | 2017-07-26 13:35:11 +0100 | [diff] [blame] | 4892 | |
Yuto Takano | ccdd25c | 2021-07-02 13:05:15 +0100 | [diff] [blame] | 4893 | # The tests for the max_int tests can pass with any number higher than MAX_IM_CA |
| 4894 | # because only a chain of MAX_IM_CA length is tested. Equally, the max_int+1 |
| 4895 | # tests can pass with any number less than MAX_IM_CA. However, stricter preconditions |
| 4896 | # are in place so that the semantics are consistent with the test description. |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 4897 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4898 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4899 | run_test "Authentication: server max_int chain, client default" \ |
| 4900 | "$P_SRV crt_file=data_files/dir-maxpath/c09.pem \ |
| 4901 | key_file=data_files/dir-maxpath/09.key" \ |
| 4902 | "$P_CLI server_name=CA09 ca_file=data_files/dir-maxpath/00.crt" \ |
| 4903 | 0 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 4904 | -C "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4905 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 4906 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4907 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4908 | run_test "Authentication: server max_int+1 chain, client default" \ |
| 4909 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 4910 | key_file=data_files/dir-maxpath/10.key" \ |
| 4911 | "$P_CLI server_name=CA10 ca_file=data_files/dir-maxpath/00.crt" \ |
| 4912 | 1 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 4913 | -c "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4914 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 4915 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4916 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4917 | run_test "Authentication: server max_int+1 chain, client optional" \ |
| 4918 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 4919 | key_file=data_files/dir-maxpath/10.key" \ |
| 4920 | "$P_CLI server_name=CA10 ca_file=data_files/dir-maxpath/00.crt \ |
| 4921 | auth_mode=optional" \ |
| 4922 | 1 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 4923 | -c "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4924 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 4925 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4926 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4927 | run_test "Authentication: server max_int+1 chain, client none" \ |
| 4928 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 4929 | key_file=data_files/dir-maxpath/10.key" \ |
| 4930 | "$P_CLI server_name=CA10 ca_file=data_files/dir-maxpath/00.crt \ |
| 4931 | auth_mode=none" \ |
| 4932 | 0 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 4933 | -C "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4934 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 4935 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4936 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4937 | run_test "Authentication: client max_int+1 chain, server default" \ |
| 4938 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt" \ |
| 4939 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 4940 | key_file=data_files/dir-maxpath/10.key" \ |
| 4941 | 0 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 4942 | -S "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4943 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 4944 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4945 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4946 | run_test "Authentication: client max_int+1 chain, server optional" \ |
| 4947 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=optional" \ |
| 4948 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 4949 | key_file=data_files/dir-maxpath/10.key" \ |
| 4950 | 1 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 4951 | -s "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4952 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 4953 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4954 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4955 | run_test "Authentication: client max_int+1 chain, server required" \ |
| 4956 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \ |
| 4957 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 4958 | key_file=data_files/dir-maxpath/10.key" \ |
| 4959 | 1 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 4960 | -s "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4961 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 4962 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4963 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4964 | run_test "Authentication: client max_int chain, server required" \ |
| 4965 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \ |
| 4966 | "$P_CLI crt_file=data_files/dir-maxpath/c09.pem \ |
| 4967 | key_file=data_files/dir-maxpath/09.key" \ |
| 4968 | 0 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 4969 | -S "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 4970 | |
Janos Follath | 89baba2 | 2017-04-10 14:34:35 +0100 | [diff] [blame] | 4971 | # Tests for CA list in CertificateRequest messages |
| 4972 | |
| 4973 | run_test "Authentication: send CA list in CertificateRequest (default)" \ |
| 4974 | "$P_SRV debug_level=3 auth_mode=required" \ |
| 4975 | "$P_CLI crt_file=data_files/server6.crt \ |
| 4976 | key_file=data_files/server6.key" \ |
| 4977 | 0 \ |
| 4978 | -s "requested DN" |
| 4979 | |
| 4980 | run_test "Authentication: do not send CA list in CertificateRequest" \ |
| 4981 | "$P_SRV debug_level=3 auth_mode=required cert_req_ca_list=0" \ |
| 4982 | "$P_CLI crt_file=data_files/server6.crt \ |
| 4983 | key_file=data_files/server6.key" \ |
| 4984 | 0 \ |
| 4985 | -S "requested DN" |
| 4986 | |
| 4987 | run_test "Authentication: send CA list in CertificateRequest, client self signed" \ |
| 4988 | "$P_SRV debug_level=3 auth_mode=required cert_req_ca_list=0" \ |
| 4989 | "$P_CLI debug_level=3 crt_file=data_files/server5-selfsigned.crt \ |
| 4990 | key_file=data_files/server5.key" \ |
| 4991 | 1 \ |
| 4992 | -S "requested DN" \ |
| 4993 | -s "x509_verify_cert() returned" \ |
| 4994 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 4995 | -s "! mbedtls_ssl_handshake returned" \ |
| 4996 | -c "! mbedtls_ssl_handshake returned" \ |
| 4997 | -s "X509 - Certificate verification failed" |
| 4998 | |
Jarno Lamsa | f7a7f9e | 2019-04-01 15:11:54 +0300 | [diff] [blame] | 4999 | # Tests for auth_mode, using CA callback, these are duplicated from the authentication tests |
| 5000 | # When updating these tests, modify the matching authentication tests accordingly |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5001 | |
| 5002 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5003 | run_test "Authentication, CA callback: server badcert, client required" \ |
| 5004 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
| 5005 | key_file=data_files/server5.key" \ |
| 5006 | "$P_CLI ca_callback=1 debug_level=3 auth_mode=required" \ |
| 5007 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5008 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5009 | -c "x509_verify_cert() returned" \ |
| 5010 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 5011 | -c "! mbedtls_ssl_handshake returned" \ |
| 5012 | -c "X509 - Certificate verification failed" |
| 5013 | |
| 5014 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5015 | run_test "Authentication, CA callback: server badcert, client optional" \ |
| 5016 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
| 5017 | key_file=data_files/server5.key" \ |
| 5018 | "$P_CLI ca_callback=1 debug_level=3 auth_mode=optional" \ |
| 5019 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5020 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5021 | -c "x509_verify_cert() returned" \ |
| 5022 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 5023 | -C "! mbedtls_ssl_handshake returned" \ |
| 5024 | -C "X509 - Certificate verification failed" |
| 5025 | |
| 5026 | # The purpose of the next two tests is to test the client's behaviour when receiving a server |
| 5027 | # certificate with an unsupported elliptic curve. This should usually not happen because |
| 5028 | # the client informs the server about the supported curves - it does, though, in the |
| 5029 | # corner case of a static ECDH suite, because the server doesn't check the curve on that |
| 5030 | # occasion (to be fixed). If that bug's fixed, the test needs to be altered to use a |
| 5031 | # different means to have the server ignoring the client's supported curve list. |
| 5032 | |
| 5033 | requires_config_enabled MBEDTLS_ECP_C |
| 5034 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5035 | run_test "Authentication, CA callback: server ECDH p256v1, client required, p256v1 unsupported" \ |
| 5036 | "$P_SRV debug_level=1 key_file=data_files/server5.key \ |
| 5037 | crt_file=data_files/server5.ku-ka.crt" \ |
| 5038 | "$P_CLI ca_callback=1 debug_level=3 auth_mode=required curves=secp521r1" \ |
| 5039 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5040 | -c "use CA callback for X.509 CRT verification" \ |
| 5041 | -c "bad certificate (EC key curve)" \ |
| 5042 | -c "! Certificate verification flags" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5043 | -C "bad server certificate (ECDH curve)" # Expect failure at earlier verification stage |
| 5044 | |
| 5045 | requires_config_enabled MBEDTLS_ECP_C |
| 5046 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5047 | run_test "Authentication, CA callback: server ECDH p256v1, client optional, p256v1 unsupported" \ |
| 5048 | "$P_SRV debug_level=1 key_file=data_files/server5.key \ |
| 5049 | crt_file=data_files/server5.ku-ka.crt" \ |
| 5050 | "$P_CLI ca_callback=1 debug_level=3 auth_mode=optional curves=secp521r1" \ |
| 5051 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5052 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5053 | -c "bad certificate (EC key curve)"\ |
| 5054 | -c "! Certificate verification flags"\ |
| 5055 | -c "bad server certificate (ECDH curve)" # Expect failure only at ECDH params check |
| 5056 | |
| 5057 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5058 | run_test "Authentication, CA callback: client SHA256, server required" \ |
| 5059 | "$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \ |
| 5060 | "$P_CLI debug_level=3 crt_file=data_files/server6.crt \ |
| 5061 | key_file=data_files/server6.key \ |
| 5062 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ |
| 5063 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5064 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5065 | -c "Supported Signature Algorithm found: 4," \ |
| 5066 | -c "Supported Signature Algorithm found: 5," |
| 5067 | |
| 5068 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5069 | run_test "Authentication, CA callback: client SHA384, server required" \ |
| 5070 | "$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \ |
| 5071 | "$P_CLI debug_level=3 crt_file=data_files/server6.crt \ |
| 5072 | key_file=data_files/server6.key \ |
| 5073 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ |
| 5074 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5075 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5076 | -c "Supported Signature Algorithm found: 4," \ |
| 5077 | -c "Supported Signature Algorithm found: 5," |
| 5078 | |
| 5079 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5080 | run_test "Authentication, CA callback: client badcert, server required" \ |
| 5081 | "$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \ |
| 5082 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
| 5083 | key_file=data_files/server5.key" \ |
| 5084 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5085 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5086 | -S "skip write certificate request" \ |
| 5087 | -C "skip parse certificate request" \ |
| 5088 | -c "got a certificate request" \ |
| 5089 | -C "skip write certificate" \ |
| 5090 | -C "skip write certificate verify" \ |
| 5091 | -S "skip parse certificate verify" \ |
| 5092 | -s "x509_verify_cert() returned" \ |
| 5093 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 5094 | -s "! mbedtls_ssl_handshake returned" \ |
| 5095 | -s "send alert level=2 message=48" \ |
| 5096 | -c "! mbedtls_ssl_handshake returned" \ |
| 5097 | -s "X509 - Certificate verification failed" |
| 5098 | # We don't check that the client receives the alert because it might |
| 5099 | # detect that its write end of the connection is closed and abort |
| 5100 | # before reading the alert message. |
| 5101 | |
| 5102 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5103 | run_test "Authentication, CA callback: client cert not trusted, server required" \ |
| 5104 | "$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \ |
| 5105 | "$P_CLI debug_level=3 crt_file=data_files/server5-selfsigned.crt \ |
| 5106 | key_file=data_files/server5.key" \ |
| 5107 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5108 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5109 | -S "skip write certificate request" \ |
| 5110 | -C "skip parse certificate request" \ |
| 5111 | -c "got a certificate request" \ |
| 5112 | -C "skip write certificate" \ |
| 5113 | -C "skip write certificate verify" \ |
| 5114 | -S "skip parse certificate verify" \ |
| 5115 | -s "x509_verify_cert() returned" \ |
| 5116 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 5117 | -s "! mbedtls_ssl_handshake returned" \ |
| 5118 | -c "! mbedtls_ssl_handshake returned" \ |
| 5119 | -s "X509 - Certificate verification failed" |
| 5120 | |
| 5121 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5122 | run_test "Authentication, CA callback: client badcert, server optional" \ |
| 5123 | "$P_SRV ca_callback=1 debug_level=3 auth_mode=optional" \ |
| 5124 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
| 5125 | key_file=data_files/server5.key" \ |
| 5126 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5127 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5128 | -S "skip write certificate request" \ |
| 5129 | -C "skip parse certificate request" \ |
| 5130 | -c "got a certificate request" \ |
| 5131 | -C "skip write certificate" \ |
| 5132 | -C "skip write certificate verify" \ |
| 5133 | -S "skip parse certificate verify" \ |
| 5134 | -s "x509_verify_cert() returned" \ |
| 5135 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 5136 | -S "! mbedtls_ssl_handshake returned" \ |
| 5137 | -C "! mbedtls_ssl_handshake returned" \ |
| 5138 | -S "X509 - Certificate verification failed" |
| 5139 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5140 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5141 | requires_full_size_output_buffer |
| 5142 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5143 | run_test "Authentication, CA callback: server max_int chain, client default" \ |
| 5144 | "$P_SRV crt_file=data_files/dir-maxpath/c09.pem \ |
| 5145 | key_file=data_files/dir-maxpath/09.key" \ |
| 5146 | "$P_CLI ca_callback=1 debug_level=3 server_name=CA09 ca_file=data_files/dir-maxpath/00.crt" \ |
| 5147 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5148 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5149 | -C "X509 - A fatal error occurred" |
| 5150 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5151 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5152 | requires_full_size_output_buffer |
| 5153 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5154 | run_test "Authentication, CA callback: server max_int+1 chain, client default" \ |
| 5155 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 5156 | key_file=data_files/dir-maxpath/10.key" \ |
| 5157 | "$P_CLI debug_level=3 ca_callback=1 server_name=CA10 ca_file=data_files/dir-maxpath/00.crt" \ |
| 5158 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5159 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5160 | -c "X509 - A fatal error occurred" |
| 5161 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5162 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5163 | requires_full_size_output_buffer |
| 5164 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5165 | run_test "Authentication, CA callback: server max_int+1 chain, client optional" \ |
| 5166 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 5167 | key_file=data_files/dir-maxpath/10.key" \ |
| 5168 | "$P_CLI ca_callback=1 server_name=CA10 ca_file=data_files/dir-maxpath/00.crt \ |
| 5169 | debug_level=3 auth_mode=optional" \ |
| 5170 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5171 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5172 | -c "X509 - A fatal error occurred" |
| 5173 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5174 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5175 | requires_full_size_output_buffer |
| 5176 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5177 | run_test "Authentication, CA callback: client max_int+1 chain, server optional" \ |
| 5178 | "$P_SRV ca_callback=1 debug_level=3 ca_file=data_files/dir-maxpath/00.crt auth_mode=optional" \ |
| 5179 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 5180 | key_file=data_files/dir-maxpath/10.key" \ |
| 5181 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5182 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5183 | -s "X509 - A fatal error occurred" |
| 5184 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5185 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5186 | requires_full_size_output_buffer |
| 5187 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5188 | run_test "Authentication, CA callback: client max_int+1 chain, server required" \ |
| 5189 | "$P_SRV ca_callback=1 debug_level=3 ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \ |
| 5190 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 5191 | key_file=data_files/dir-maxpath/10.key" \ |
| 5192 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5193 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5194 | -s "X509 - A fatal error occurred" |
| 5195 | |
Yuto Takano | 8a693ef | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5196 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5197 | requires_full_size_output_buffer |
| 5198 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5199 | run_test "Authentication, CA callback: client max_int chain, server required" \ |
| 5200 | "$P_SRV ca_callback=1 debug_level=3 ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \ |
| 5201 | "$P_CLI crt_file=data_files/dir-maxpath/c09.pem \ |
| 5202 | key_file=data_files/dir-maxpath/09.key" \ |
| 5203 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5204 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5205 | -S "X509 - A fatal error occurred" |
| 5206 | |
Shaun Case | 0e7791f | 2021-12-20 21:14:10 -0800 | [diff] [blame] | 5207 | # Tests for certificate selection based on SHA version |
Manuel Pégourié-Gonnard | df331a5 | 2015-01-08 16:43:07 +0100 | [diff] [blame] | 5208 | |
| 5209 | run_test "Certificate hash: client TLS 1.2 -> SHA-2" \ |
| 5210 | "$P_SRV crt_file=data_files/server5.crt \ |
| 5211 | key_file=data_files/server5.key \ |
| 5212 | crt_file2=data_files/server5-sha1.crt \ |
| 5213 | key_file2=data_files/server5.key" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 5214 | "$P_CLI force_version=tls12" \ |
Manuel Pégourié-Gonnard | df331a5 | 2015-01-08 16:43:07 +0100 | [diff] [blame] | 5215 | 0 \ |
| 5216 | -c "signed using.*ECDSA with SHA256" \ |
| 5217 | -C "signed using.*ECDSA with SHA1" |
| 5218 | |
| 5219 | run_test "Certificate hash: client TLS 1.1 -> SHA-1" \ |
| 5220 | "$P_SRV crt_file=data_files/server5.crt \ |
| 5221 | key_file=data_files/server5.key \ |
| 5222 | crt_file2=data_files/server5-sha1.crt \ |
| 5223 | key_file2=data_files/server5.key" \ |
| 5224 | "$P_CLI force_version=tls1_1" \ |
| 5225 | 0 \ |
| 5226 | -C "signed using.*ECDSA with SHA256" \ |
| 5227 | -c "signed using.*ECDSA with SHA1" |
| 5228 | |
| 5229 | run_test "Certificate hash: client TLS 1.0 -> SHA-1" \ |
| 5230 | "$P_SRV crt_file=data_files/server5.crt \ |
| 5231 | key_file=data_files/server5.key \ |
| 5232 | crt_file2=data_files/server5-sha1.crt \ |
| 5233 | key_file2=data_files/server5.key" \ |
| 5234 | "$P_CLI force_version=tls1" \ |
| 5235 | 0 \ |
| 5236 | -C "signed using.*ECDSA with SHA256" \ |
| 5237 | -c "signed using.*ECDSA with SHA1" |
| 5238 | |
| 5239 | run_test "Certificate hash: client TLS 1.1, no SHA-1 -> SHA-2 (order 1)" \ |
| 5240 | "$P_SRV crt_file=data_files/server5.crt \ |
| 5241 | key_file=data_files/server5.key \ |
| 5242 | crt_file2=data_files/server6.crt \ |
| 5243 | key_file2=data_files/server6.key" \ |
| 5244 | "$P_CLI force_version=tls1_1" \ |
| 5245 | 0 \ |
| 5246 | -c "serial number.*09" \ |
| 5247 | -c "signed using.*ECDSA with SHA256" \ |
| 5248 | -C "signed using.*ECDSA with SHA1" |
| 5249 | |
| 5250 | run_test "Certificate hash: client TLS 1.1, no SHA-1 -> SHA-2 (order 2)" \ |
| 5251 | "$P_SRV crt_file=data_files/server6.crt \ |
| 5252 | key_file=data_files/server6.key \ |
| 5253 | crt_file2=data_files/server5.crt \ |
| 5254 | key_file2=data_files/server5.key" \ |
| 5255 | "$P_CLI force_version=tls1_1" \ |
| 5256 | 0 \ |
| 5257 | -c "serial number.*0A" \ |
| 5258 | -c "signed using.*ECDSA with SHA256" \ |
| 5259 | -C "signed using.*ECDSA with SHA1" |
| 5260 | |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 5261 | # tests for SNI |
| 5262 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5263 | run_test "SNI: no SNI callback" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 5264 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 5265 | crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 5266 | "$P_CLI server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 5267 | 0 \ |
| 5268 | -S "parse ServerName extension" \ |
| 5269 | -c "issuer name *: C=NL, O=PolarSSL, CN=Polarssl Test EC CA" \ |
| 5270 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 5271 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5272 | run_test "SNI: matching cert 1" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 5273 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 5274 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 5275 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 5276 | "$P_CLI server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 5277 | 0 \ |
| 5278 | -s "parse ServerName extension" \ |
| 5279 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 5280 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 5281 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5282 | run_test "SNI: matching cert 2" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 5283 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 5284 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 5285 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 5286 | "$P_CLI server_name=polarssl.example" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 5287 | 0 \ |
| 5288 | -s "parse ServerName extension" \ |
| 5289 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 5290 | -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 5291 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5292 | run_test "SNI: no matching cert" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 5293 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 5294 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 5295 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 5296 | "$P_CLI server_name=nonesuch.example" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 5297 | 1 \ |
| 5298 | -s "parse ServerName extension" \ |
| 5299 | -s "ssl_sni_wrapper() returned" \ |
| 5300 | -s "mbedtls_ssl_handshake returned" \ |
| 5301 | -c "mbedtls_ssl_handshake returned" \ |
| 5302 | -c "SSL - A fatal alert message was received from our peer" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 5303 | |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 5304 | run_test "SNI: client auth no override: optional" \ |
| 5305 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 5306 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5307 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-" \ |
| 5308 | "$P_CLI debug_level=3 server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 5309 | 0 \ |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 5310 | -S "skip write certificate request" \ |
| 5311 | -C "skip parse certificate request" \ |
| 5312 | -c "got a certificate request" \ |
| 5313 | -C "skip write certificate" \ |
| 5314 | -C "skip write certificate verify" \ |
| 5315 | -S "skip parse certificate verify" |
| 5316 | |
| 5317 | run_test "SNI: client auth override: none -> optional" \ |
| 5318 | "$P_SRV debug_level=3 auth_mode=none \ |
| 5319 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5320 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,optional" \ |
| 5321 | "$P_CLI debug_level=3 server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 5322 | 0 \ |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 5323 | -S "skip write certificate request" \ |
| 5324 | -C "skip parse certificate request" \ |
| 5325 | -c "got a certificate request" \ |
| 5326 | -C "skip write certificate" \ |
| 5327 | -C "skip write certificate verify" \ |
| 5328 | -S "skip parse certificate verify" |
| 5329 | |
| 5330 | run_test "SNI: client auth override: optional -> none" \ |
| 5331 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 5332 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5333 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,none" \ |
| 5334 | "$P_CLI debug_level=3 server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 5335 | 0 \ |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 5336 | -s "skip write certificate request" \ |
| 5337 | -C "skip parse certificate request" \ |
| 5338 | -c "got no certificate request" \ |
| 5339 | -c "skip write certificate" \ |
| 5340 | -c "skip write certificate verify" \ |
| 5341 | -s "skip parse certificate verify" |
| 5342 | |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 5343 | run_test "SNI: CA no override" \ |
| 5344 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 5345 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5346 | ca_file=data_files/test-ca.crt \ |
| 5347 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,required" \ |
| 5348 | "$P_CLI debug_level=3 server_name=localhost \ |
| 5349 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 5350 | 1 \ |
| 5351 | -S "skip write certificate request" \ |
| 5352 | -C "skip parse certificate request" \ |
| 5353 | -c "got a certificate request" \ |
| 5354 | -C "skip write certificate" \ |
| 5355 | -C "skip write certificate verify" \ |
| 5356 | -S "skip parse certificate verify" \ |
| 5357 | -s "x509_verify_cert() returned" \ |
| 5358 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 5359 | -S "The certificate has been revoked (is on a CRL)" |
| 5360 | |
| 5361 | run_test "SNI: CA override" \ |
| 5362 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 5363 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5364 | ca_file=data_files/test-ca.crt \ |
| 5365 | sni=localhost,data_files/server2.crt,data_files/server2.key,data_files/test-ca2.crt,-,required" \ |
| 5366 | "$P_CLI debug_level=3 server_name=localhost \ |
| 5367 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 5368 | 0 \ |
| 5369 | -S "skip write certificate request" \ |
| 5370 | -C "skip parse certificate request" \ |
| 5371 | -c "got a certificate request" \ |
| 5372 | -C "skip write certificate" \ |
| 5373 | -C "skip write certificate verify" \ |
| 5374 | -S "skip parse certificate verify" \ |
| 5375 | -S "x509_verify_cert() returned" \ |
| 5376 | -S "! The certificate is not correctly signed by the trusted CA" \ |
| 5377 | -S "The certificate has been revoked (is on a CRL)" |
| 5378 | |
| 5379 | run_test "SNI: CA override with CRL" \ |
| 5380 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 5381 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5382 | ca_file=data_files/test-ca.crt \ |
| 5383 | sni=localhost,data_files/server2.crt,data_files/server2.key,data_files/test-ca2.crt,data_files/crl-ec-sha256.pem,required" \ |
| 5384 | "$P_CLI debug_level=3 server_name=localhost \ |
| 5385 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 5386 | 1 \ |
| 5387 | -S "skip write certificate request" \ |
| 5388 | -C "skip parse certificate request" \ |
| 5389 | -c "got a certificate request" \ |
| 5390 | -C "skip write certificate" \ |
| 5391 | -C "skip write certificate verify" \ |
| 5392 | -S "skip parse certificate verify" \ |
| 5393 | -s "x509_verify_cert() returned" \ |
| 5394 | -S "! The certificate is not correctly signed by the trusted CA" \ |
| 5395 | -s "The certificate has been revoked (is on a CRL)" |
| 5396 | |
Andres AG | 1a83445 | 2016-12-07 10:01:30 +0000 | [diff] [blame] | 5397 | # Tests for SNI and DTLS |
| 5398 | |
Andres Amaya Garcia | 54306c1 | 2018-05-01 20:27:37 +0100 | [diff] [blame] | 5399 | run_test "SNI: DTLS, no SNI callback" \ |
| 5400 | "$P_SRV debug_level=3 dtls=1 \ |
| 5401 | crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
| 5402 | "$P_CLI server_name=localhost dtls=1" \ |
| 5403 | 0 \ |
| 5404 | -S "parse ServerName extension" \ |
| 5405 | -c "issuer name *: C=NL, O=PolarSSL, CN=Polarssl Test EC CA" \ |
| 5406 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
| 5407 | |
Andres Amaya Garcia | f77d3d3 | 2018-05-01 20:26:47 +0100 | [diff] [blame] | 5408 | run_test "SNI: DTLS, matching cert 1" \ |
Andres AG | 1a83445 | 2016-12-07 10:01:30 +0000 | [diff] [blame] | 5409 | "$P_SRV debug_level=3 dtls=1 \ |
| 5410 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5411 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
| 5412 | "$P_CLI server_name=localhost dtls=1" \ |
| 5413 | 0 \ |
| 5414 | -s "parse ServerName extension" \ |
| 5415 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 5416 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
| 5417 | |
Andres Amaya Garcia | 54306c1 | 2018-05-01 20:27:37 +0100 | [diff] [blame] | 5418 | run_test "SNI: DTLS, matching cert 2" \ |
| 5419 | "$P_SRV debug_level=3 dtls=1 \ |
| 5420 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5421 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
| 5422 | "$P_CLI server_name=polarssl.example dtls=1" \ |
| 5423 | 0 \ |
| 5424 | -s "parse ServerName extension" \ |
| 5425 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 5426 | -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example" |
| 5427 | |
| 5428 | run_test "SNI: DTLS, no matching cert" \ |
| 5429 | "$P_SRV debug_level=3 dtls=1 \ |
| 5430 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5431 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
| 5432 | "$P_CLI server_name=nonesuch.example dtls=1" \ |
| 5433 | 1 \ |
| 5434 | -s "parse ServerName extension" \ |
| 5435 | -s "ssl_sni_wrapper() returned" \ |
| 5436 | -s "mbedtls_ssl_handshake returned" \ |
| 5437 | -c "mbedtls_ssl_handshake returned" \ |
| 5438 | -c "SSL - A fatal alert message was received from our peer" |
| 5439 | |
| 5440 | run_test "SNI: DTLS, client auth no override: optional" \ |
| 5441 | "$P_SRV debug_level=3 auth_mode=optional dtls=1 \ |
| 5442 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5443 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-" \ |
| 5444 | "$P_CLI debug_level=3 server_name=localhost dtls=1" \ |
| 5445 | 0 \ |
| 5446 | -S "skip write certificate request" \ |
| 5447 | -C "skip parse certificate request" \ |
| 5448 | -c "got a certificate request" \ |
| 5449 | -C "skip write certificate" \ |
| 5450 | -C "skip write certificate verify" \ |
| 5451 | -S "skip parse certificate verify" |
| 5452 | |
| 5453 | run_test "SNI: DTLS, client auth override: none -> optional" \ |
| 5454 | "$P_SRV debug_level=3 auth_mode=none dtls=1 \ |
| 5455 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5456 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,optional" \ |
| 5457 | "$P_CLI debug_level=3 server_name=localhost dtls=1" \ |
| 5458 | 0 \ |
| 5459 | -S "skip write certificate request" \ |
| 5460 | -C "skip parse certificate request" \ |
| 5461 | -c "got a certificate request" \ |
| 5462 | -C "skip write certificate" \ |
| 5463 | -C "skip write certificate verify" \ |
| 5464 | -S "skip parse certificate verify" |
| 5465 | |
| 5466 | run_test "SNI: DTLS, client auth override: optional -> none" \ |
| 5467 | "$P_SRV debug_level=3 auth_mode=optional dtls=1 \ |
| 5468 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5469 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,none" \ |
| 5470 | "$P_CLI debug_level=3 server_name=localhost dtls=1" \ |
| 5471 | 0 \ |
| 5472 | -s "skip write certificate request" \ |
| 5473 | -C "skip parse certificate request" \ |
| 5474 | -c "got no certificate request" \ |
| 5475 | -c "skip write certificate" \ |
| 5476 | -c "skip write certificate verify" \ |
| 5477 | -s "skip parse certificate verify" |
| 5478 | |
| 5479 | run_test "SNI: DTLS, CA no override" \ |
| 5480 | "$P_SRV debug_level=3 auth_mode=optional dtls=1 \ |
| 5481 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5482 | ca_file=data_files/test-ca.crt \ |
| 5483 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,required" \ |
| 5484 | "$P_CLI debug_level=3 server_name=localhost dtls=1 \ |
| 5485 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 5486 | 1 \ |
| 5487 | -S "skip write certificate request" \ |
| 5488 | -C "skip parse certificate request" \ |
| 5489 | -c "got a certificate request" \ |
| 5490 | -C "skip write certificate" \ |
| 5491 | -C "skip write certificate verify" \ |
| 5492 | -S "skip parse certificate verify" \ |
| 5493 | -s "x509_verify_cert() returned" \ |
| 5494 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 5495 | -S "The certificate has been revoked (is on a CRL)" |
| 5496 | |
Andres Amaya Garcia | f77d3d3 | 2018-05-01 20:26:47 +0100 | [diff] [blame] | 5497 | run_test "SNI: DTLS, CA override" \ |
Andres AG | 1a83445 | 2016-12-07 10:01:30 +0000 | [diff] [blame] | 5498 | "$P_SRV debug_level=3 auth_mode=optional dtls=1 \ |
| 5499 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 5500 | ca_file=data_files/test-ca.crt \ |
| 5501 | sni=localhost,data_files/server2.crt,data_files/server2.key,data_files/test-ca2.crt,-,required" \ |
| 5502 | "$P_CLI debug_level=3 server_name=localhost dtls=1 \ |
| 5503 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 5504 | 0 \ |
| 5505 | -S "skip write certificate request" \ |
| 5506 | -C "skip parse certificate request" \ |
| 5507 | -c "got a certificate request" \ |
| 5508 | -C "skip write certificate" \ |
| 5509 | -C "skip write certificate verify" \ |
| 5510 | -S "skip parse certificate verify" \ |
| 5511 | -S "x509_verify_cert() returned" \ |
| 5512 | -S "! The certificate is not correctly signed by the trusted CA" \ |
| 5513 | -S "The certificate has been revoked (is on a CRL)" |
| 5514 | |
Andres Amaya Garcia | f77d3d3 | 2018-05-01 20:26:47 +0100 | [diff] [blame] | 5515 | run_test "SNI: DTLS, CA override with CRL" \ |
Andres AG | 1a83445 | 2016-12-07 10:01:30 +0000 | [diff] [blame] | 5516 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 5517 | crt_file=data_files/server5.crt key_file=data_files/server5.key dtls=1 \ |
| 5518 | ca_file=data_files/test-ca.crt \ |
| 5519 | sni=localhost,data_files/server2.crt,data_files/server2.key,data_files/test-ca2.crt,data_files/crl-ec-sha256.pem,required" \ |
| 5520 | "$P_CLI debug_level=3 server_name=localhost dtls=1 \ |
| 5521 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 5522 | 1 \ |
| 5523 | -S "skip write certificate request" \ |
| 5524 | -C "skip parse certificate request" \ |
| 5525 | -c "got a certificate request" \ |
| 5526 | -C "skip write certificate" \ |
| 5527 | -C "skip write certificate verify" \ |
| 5528 | -S "skip parse certificate verify" \ |
| 5529 | -s "x509_verify_cert() returned" \ |
| 5530 | -S "! The certificate is not correctly signed by the trusted CA" \ |
| 5531 | -s "The certificate has been revoked (is on a CRL)" |
| 5532 | |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5533 | # Tests for non-blocking I/O: exercise a variety of handshake flows |
| 5534 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5535 | run_test "Non-blocking I/O: basic handshake" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5536 | "$P_SRV nbio=2 tickets=0 auth_mode=none" \ |
| 5537 | "$P_CLI nbio=2 tickets=0" \ |
| 5538 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5539 | -S "mbedtls_ssl_handshake returned" \ |
| 5540 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5541 | -c "Read from server: .* bytes read" |
| 5542 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5543 | run_test "Non-blocking I/O: client auth" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5544 | "$P_SRV nbio=2 tickets=0 auth_mode=required" \ |
| 5545 | "$P_CLI nbio=2 tickets=0" \ |
| 5546 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5547 | -S "mbedtls_ssl_handshake returned" \ |
| 5548 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5549 | -c "Read from server: .* bytes read" |
| 5550 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5551 | run_test "Non-blocking I/O: ticket" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5552 | "$P_SRV nbio=2 tickets=1 auth_mode=none" \ |
| 5553 | "$P_CLI nbio=2 tickets=1" \ |
| 5554 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5555 | -S "mbedtls_ssl_handshake returned" \ |
| 5556 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5557 | -c "Read from server: .* bytes read" |
| 5558 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5559 | run_test "Non-blocking I/O: ticket + client auth" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5560 | "$P_SRV nbio=2 tickets=1 auth_mode=required" \ |
| 5561 | "$P_CLI nbio=2 tickets=1" \ |
| 5562 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5563 | -S "mbedtls_ssl_handshake returned" \ |
| 5564 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5565 | -c "Read from server: .* bytes read" |
| 5566 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5567 | run_test "Non-blocking I/O: ticket + client auth + resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5568 | "$P_SRV nbio=2 tickets=1 auth_mode=required" \ |
| 5569 | "$P_CLI nbio=2 tickets=1 reconnect=1" \ |
| 5570 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5571 | -S "mbedtls_ssl_handshake returned" \ |
| 5572 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5573 | -c "Read from server: .* bytes read" |
| 5574 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5575 | run_test "Non-blocking I/O: ticket + resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5576 | "$P_SRV nbio=2 tickets=1 auth_mode=none" \ |
| 5577 | "$P_CLI nbio=2 tickets=1 reconnect=1" \ |
| 5578 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5579 | -S "mbedtls_ssl_handshake returned" \ |
| 5580 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5581 | -c "Read from server: .* bytes read" |
| 5582 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5583 | run_test "Non-blocking I/O: session-id resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5584 | "$P_SRV nbio=2 tickets=0 auth_mode=none" \ |
| 5585 | "$P_CLI nbio=2 tickets=0 reconnect=1" \ |
| 5586 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5587 | -S "mbedtls_ssl_handshake returned" \ |
| 5588 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 5589 | -c "Read from server: .* bytes read" |
| 5590 | |
Hanno Becker | 0007671 | 2017-11-15 16:39:08 +0000 | [diff] [blame] | 5591 | # Tests for event-driven I/O: exercise a variety of handshake flows |
| 5592 | |
| 5593 | run_test "Event-driven I/O: basic handshake" \ |
| 5594 | "$P_SRV event=1 tickets=0 auth_mode=none" \ |
| 5595 | "$P_CLI event=1 tickets=0" \ |
| 5596 | 0 \ |
| 5597 | -S "mbedtls_ssl_handshake returned" \ |
| 5598 | -C "mbedtls_ssl_handshake returned" \ |
| 5599 | -c "Read from server: .* bytes read" |
| 5600 | |
| 5601 | run_test "Event-driven I/O: client auth" \ |
| 5602 | "$P_SRV event=1 tickets=0 auth_mode=required" \ |
| 5603 | "$P_CLI event=1 tickets=0" \ |
| 5604 | 0 \ |
| 5605 | -S "mbedtls_ssl_handshake returned" \ |
| 5606 | -C "mbedtls_ssl_handshake returned" \ |
| 5607 | -c "Read from server: .* bytes read" |
| 5608 | |
| 5609 | run_test "Event-driven I/O: ticket" \ |
| 5610 | "$P_SRV event=1 tickets=1 auth_mode=none" \ |
| 5611 | "$P_CLI event=1 tickets=1" \ |
| 5612 | 0 \ |
| 5613 | -S "mbedtls_ssl_handshake returned" \ |
| 5614 | -C "mbedtls_ssl_handshake returned" \ |
| 5615 | -c "Read from server: .* bytes read" |
| 5616 | |
| 5617 | run_test "Event-driven I/O: ticket + client auth" \ |
| 5618 | "$P_SRV event=1 tickets=1 auth_mode=required" \ |
| 5619 | "$P_CLI event=1 tickets=1" \ |
| 5620 | 0 \ |
| 5621 | -S "mbedtls_ssl_handshake returned" \ |
| 5622 | -C "mbedtls_ssl_handshake returned" \ |
| 5623 | -c "Read from server: .* bytes read" |
| 5624 | |
| 5625 | run_test "Event-driven I/O: ticket + client auth + resume" \ |
| 5626 | "$P_SRV event=1 tickets=1 auth_mode=required" \ |
| 5627 | "$P_CLI event=1 tickets=1 reconnect=1" \ |
| 5628 | 0 \ |
| 5629 | -S "mbedtls_ssl_handshake returned" \ |
| 5630 | -C "mbedtls_ssl_handshake returned" \ |
| 5631 | -c "Read from server: .* bytes read" |
| 5632 | |
| 5633 | run_test "Event-driven I/O: ticket + resume" \ |
| 5634 | "$P_SRV event=1 tickets=1 auth_mode=none" \ |
| 5635 | "$P_CLI event=1 tickets=1 reconnect=1" \ |
| 5636 | 0 \ |
| 5637 | -S "mbedtls_ssl_handshake returned" \ |
| 5638 | -C "mbedtls_ssl_handshake returned" \ |
| 5639 | -c "Read from server: .* bytes read" |
| 5640 | |
| 5641 | run_test "Event-driven I/O: session-id resume" \ |
| 5642 | "$P_SRV event=1 tickets=0 auth_mode=none" \ |
| 5643 | "$P_CLI event=1 tickets=0 reconnect=1" \ |
| 5644 | 0 \ |
| 5645 | -S "mbedtls_ssl_handshake returned" \ |
| 5646 | -C "mbedtls_ssl_handshake returned" \ |
| 5647 | -c "Read from server: .* bytes read" |
| 5648 | |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 5649 | run_test "Event-driven I/O, DTLS: basic handshake" \ |
| 5650 | "$P_SRV dtls=1 event=1 tickets=0 auth_mode=none" \ |
| 5651 | "$P_CLI dtls=1 event=1 tickets=0" \ |
| 5652 | 0 \ |
| 5653 | -c "Read from server: .* bytes read" |
| 5654 | |
| 5655 | run_test "Event-driven I/O, DTLS: client auth" \ |
| 5656 | "$P_SRV dtls=1 event=1 tickets=0 auth_mode=required" \ |
| 5657 | "$P_CLI dtls=1 event=1 tickets=0" \ |
| 5658 | 0 \ |
| 5659 | -c "Read from server: .* bytes read" |
| 5660 | |
| 5661 | run_test "Event-driven I/O, DTLS: ticket" \ |
| 5662 | "$P_SRV dtls=1 event=1 tickets=1 auth_mode=none" \ |
| 5663 | "$P_CLI dtls=1 event=1 tickets=1" \ |
| 5664 | 0 \ |
| 5665 | -c "Read from server: .* bytes read" |
| 5666 | |
| 5667 | run_test "Event-driven I/O, DTLS: ticket + client auth" \ |
| 5668 | "$P_SRV dtls=1 event=1 tickets=1 auth_mode=required" \ |
| 5669 | "$P_CLI dtls=1 event=1 tickets=1" \ |
| 5670 | 0 \ |
| 5671 | -c "Read from server: .* bytes read" |
| 5672 | |
| 5673 | run_test "Event-driven I/O, DTLS: ticket + client auth + resume" \ |
| 5674 | "$P_SRV dtls=1 event=1 tickets=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 5675 | "$P_CLI dtls=1 event=1 tickets=1 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 5676 | 0 \ |
| 5677 | -c "Read from server: .* bytes read" |
| 5678 | |
| 5679 | run_test "Event-driven I/O, DTLS: ticket + resume" \ |
| 5680 | "$P_SRV dtls=1 event=1 tickets=1 auth_mode=none" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 5681 | "$P_CLI dtls=1 event=1 tickets=1 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 5682 | 0 \ |
| 5683 | -c "Read from server: .* bytes read" |
| 5684 | |
| 5685 | run_test "Event-driven I/O, DTLS: session-id resume" \ |
| 5686 | "$P_SRV dtls=1 event=1 tickets=0 auth_mode=none" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 5687 | "$P_CLI dtls=1 event=1 tickets=0 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 5688 | 0 \ |
| 5689 | -c "Read from server: .* bytes read" |
Hanno Becker | bc6c110 | 2018-03-13 11:39:40 +0000 | [diff] [blame] | 5690 | |
| 5691 | # This test demonstrates the need for the mbedtls_ssl_check_pending function. |
| 5692 | # During session resumption, the client will send its ApplicationData record |
| 5693 | # within the same datagram as the Finished messages. In this situation, the |
| 5694 | # server MUST NOT idle on the underlying transport after handshake completion, |
| 5695 | # because the ApplicationData request has already been queued internally. |
| 5696 | run_test "Event-driven I/O, DTLS: session-id resume, UDP packing" \ |
Hanno Becker | 8d83218 | 2018-03-15 10:14:19 +0000 | [diff] [blame] | 5697 | -p "$P_PXY pack=50" \ |
Hanno Becker | bc6c110 | 2018-03-13 11:39:40 +0000 | [diff] [blame] | 5698 | "$P_SRV dtls=1 event=1 tickets=0 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 5699 | "$P_CLI dtls=1 event=1 tickets=0 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | bc6c110 | 2018-03-13 11:39:40 +0000 | [diff] [blame] | 5700 | 0 \ |
| 5701 | -c "Read from server: .* bytes read" |
| 5702 | |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 5703 | # Tests for version negotiation |
| 5704 | |
Gilles Peskine | df4ad90 | 2022-04-08 15:14:38 +0200 | [diff] [blame] | 5705 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5706 | run_test "Version check: all -> 1.2" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5707 | "$P_SRV" \ |
| 5708 | "$P_CLI" \ |
| 5709 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5710 | -S "mbedtls_ssl_handshake returned" \ |
| 5711 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5712 | -s "Protocol is TLSv1.2" \ |
| 5713 | -c "Protocol is TLSv1.2" |
| 5714 | |
Gilles Peskine | df4ad90 | 2022-04-08 15:14:38 +0200 | [diff] [blame] | 5715 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5716 | run_test "Version check: cli max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5717 | "$P_SRV" \ |
| 5718 | "$P_CLI max_version=tls1_1" \ |
| 5719 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5720 | -S "mbedtls_ssl_handshake returned" \ |
| 5721 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5722 | -s "Protocol is TLSv1.1" \ |
| 5723 | -c "Protocol is TLSv1.1" |
| 5724 | |
Gilles Peskine | df4ad90 | 2022-04-08 15:14:38 +0200 | [diff] [blame] | 5725 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5726 | run_test "Version check: srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5727 | "$P_SRV max_version=tls1_1" \ |
| 5728 | "$P_CLI" \ |
| 5729 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5730 | -S "mbedtls_ssl_handshake returned" \ |
| 5731 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5732 | -s "Protocol is TLSv1.1" \ |
| 5733 | -c "Protocol is TLSv1.1" |
| 5734 | |
Gilles Peskine | df4ad90 | 2022-04-08 15:14:38 +0200 | [diff] [blame] | 5735 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5736 | run_test "Version check: cli+srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5737 | "$P_SRV max_version=tls1_1" \ |
| 5738 | "$P_CLI max_version=tls1_1" \ |
| 5739 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5740 | -S "mbedtls_ssl_handshake returned" \ |
| 5741 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5742 | -s "Protocol is TLSv1.1" \ |
| 5743 | -c "Protocol is TLSv1.1" |
| 5744 | |
Gilles Peskine | df4ad90 | 2022-04-08 15:14:38 +0200 | [diff] [blame] | 5745 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5746 | run_test "Version check: cli max 1.1, srv min 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5747 | "$P_SRV min_version=tls1_1" \ |
| 5748 | "$P_CLI max_version=tls1_1" \ |
| 5749 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5750 | -S "mbedtls_ssl_handshake returned" \ |
| 5751 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5752 | -s "Protocol is TLSv1.1" \ |
| 5753 | -c "Protocol is TLSv1.1" |
| 5754 | |
Gilles Peskine | df4ad90 | 2022-04-08 15:14:38 +0200 | [diff] [blame] | 5755 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5756 | run_test "Version check: cli min 1.1, srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5757 | "$P_SRV max_version=tls1_1" \ |
| 5758 | "$P_CLI min_version=tls1_1" \ |
| 5759 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5760 | -S "mbedtls_ssl_handshake returned" \ |
| 5761 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5762 | -s "Protocol is TLSv1.1" \ |
| 5763 | -c "Protocol is TLSv1.1" |
| 5764 | |
Gilles Peskine | bcb2ab0 | 2022-04-09 00:11:16 +0200 | [diff] [blame] | 5765 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1 |
| 5766 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5767 | run_test "Version check: cli min 1.2, srv max 1.1 -> fail" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5768 | "$P_SRV max_version=tls1_1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 5769 | "$P_CLI min_version=tls12" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5770 | 1 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5771 | -s "mbedtls_ssl_handshake returned" \ |
| 5772 | -c "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5773 | -c "SSL - Handshake protocol not within min/max boundaries" |
| 5774 | |
Gilles Peskine | bcb2ab0 | 2022-04-09 00:11:16 +0200 | [diff] [blame] | 5775 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1 |
| 5776 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5777 | run_test "Version check: srv min 1.2, cli max 1.1 -> fail" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 5778 | "$P_SRV min_version=tls12" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5779 | "$P_CLI max_version=tls1_1" \ |
| 5780 | 1 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5781 | -s "mbedtls_ssl_handshake returned" \ |
| 5782 | -c "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 5783 | -s "SSL - Handshake protocol not within min/max boundaries" |
| 5784 | |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 5785 | # Tests for ALPN extension |
| 5786 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5787 | run_test "ALPN: none" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5788 | "$P_SRV debug_level=3" \ |
| 5789 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 5790 | 0 \ |
| 5791 | -C "client hello, adding alpn extension" \ |
| 5792 | -S "found alpn extension" \ |
| 5793 | -C "got an alert message, type: \\[2:120]" \ |
| 5794 | -S "server hello, adding alpn extension" \ |
| 5795 | -C "found alpn extension " \ |
| 5796 | -C "Application Layer Protocol is" \ |
| 5797 | -S "Application Layer Protocol is" |
| 5798 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5799 | run_test "ALPN: client only" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5800 | "$P_SRV debug_level=3" \ |
| 5801 | "$P_CLI debug_level=3 alpn=abc,1234" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 5802 | 0 \ |
| 5803 | -c "client hello, adding alpn extension" \ |
| 5804 | -s "found alpn extension" \ |
| 5805 | -C "got an alert message, type: \\[2:120]" \ |
| 5806 | -S "server hello, adding alpn extension" \ |
| 5807 | -C "found alpn extension " \ |
| 5808 | -c "Application Layer Protocol is (none)" \ |
| 5809 | -S "Application Layer Protocol is" |
| 5810 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5811 | run_test "ALPN: server only" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5812 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 5813 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 5814 | 0 \ |
| 5815 | -C "client hello, adding alpn extension" \ |
| 5816 | -S "found alpn extension" \ |
| 5817 | -C "got an alert message, type: \\[2:120]" \ |
| 5818 | -S "server hello, adding alpn extension" \ |
| 5819 | -C "found alpn extension " \ |
| 5820 | -C "Application Layer Protocol is" \ |
| 5821 | -s "Application Layer Protocol is (none)" |
| 5822 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5823 | run_test "ALPN: both, common cli1-srv1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5824 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 5825 | "$P_CLI debug_level=3 alpn=abc,1234" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 5826 | 0 \ |
| 5827 | -c "client hello, adding alpn extension" \ |
| 5828 | -s "found alpn extension" \ |
| 5829 | -C "got an alert message, type: \\[2:120]" \ |
| 5830 | -s "server hello, adding alpn extension" \ |
| 5831 | -c "found alpn extension" \ |
| 5832 | -c "Application Layer Protocol is abc" \ |
| 5833 | -s "Application Layer Protocol is abc" |
| 5834 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5835 | run_test "ALPN: both, common cli2-srv1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5836 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 5837 | "$P_CLI debug_level=3 alpn=1234,abc" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 5838 | 0 \ |
| 5839 | -c "client hello, adding alpn extension" \ |
| 5840 | -s "found alpn extension" \ |
| 5841 | -C "got an alert message, type: \\[2:120]" \ |
| 5842 | -s "server hello, adding alpn extension" \ |
| 5843 | -c "found alpn extension" \ |
| 5844 | -c "Application Layer Protocol is abc" \ |
| 5845 | -s "Application Layer Protocol is abc" |
| 5846 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5847 | run_test "ALPN: both, common cli1-srv2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5848 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 5849 | "$P_CLI debug_level=3 alpn=1234,abcde" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 5850 | 0 \ |
| 5851 | -c "client hello, adding alpn extension" \ |
| 5852 | -s "found alpn extension" \ |
| 5853 | -C "got an alert message, type: \\[2:120]" \ |
| 5854 | -s "server hello, adding alpn extension" \ |
| 5855 | -c "found alpn extension" \ |
| 5856 | -c "Application Layer Protocol is 1234" \ |
| 5857 | -s "Application Layer Protocol is 1234" |
| 5858 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5859 | run_test "ALPN: both, no common" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5860 | "$P_SRV debug_level=3 alpn=abc,123" \ |
| 5861 | "$P_CLI debug_level=3 alpn=1234,abcde" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 5862 | 1 \ |
| 5863 | -c "client hello, adding alpn extension" \ |
| 5864 | -s "found alpn extension" \ |
| 5865 | -c "got an alert message, type: \\[2:120]" \ |
| 5866 | -S "server hello, adding alpn extension" \ |
| 5867 | -C "found alpn extension" \ |
| 5868 | -C "Application Layer Protocol is 1234" \ |
| 5869 | -S "Application Layer Protocol is 1234" |
| 5870 | |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 5871 | |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5872 | # Tests for keyUsage in leaf certificates, part 1: |
| 5873 | # server-side certificate/suite selection |
| 5874 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5875 | run_test "keyUsage srv: RSA, digitalSignature -> (EC)DHE-RSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5876 | "$P_SRV key_file=data_files/server2.key \ |
| 5877 | crt_file=data_files/server2.ku-ds.crt" \ |
| 5878 | "$P_CLI" \ |
| 5879 | 0 \ |
Manuel Pégourié-Gonnard | 17cde5f | 2014-05-22 14:42:39 +0200 | [diff] [blame] | 5880 | -c "Ciphersuite is TLS-[EC]*DHE-RSA-WITH-" |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5881 | |
| 5882 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5883 | run_test "keyUsage srv: RSA, keyEncipherment -> RSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5884 | "$P_SRV key_file=data_files/server2.key \ |
| 5885 | crt_file=data_files/server2.ku-ke.crt" \ |
| 5886 | "$P_CLI" \ |
| 5887 | 0 \ |
| 5888 | -c "Ciphersuite is TLS-RSA-WITH-" |
| 5889 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5890 | run_test "keyUsage srv: RSA, keyAgreement -> fail" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 5891 | "$P_SRV key_file=data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5892 | crt_file=data_files/server2.ku-ka.crt" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 5893 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5894 | 1 \ |
| 5895 | -C "Ciphersuite is " |
| 5896 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5897 | run_test "keyUsage srv: ECDSA, digitalSignature -> ECDHE-ECDSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5898 | "$P_SRV key_file=data_files/server5.key \ |
| 5899 | crt_file=data_files/server5.ku-ds.crt" \ |
| 5900 | "$P_CLI" \ |
| 5901 | 0 \ |
| 5902 | -c "Ciphersuite is TLS-ECDHE-ECDSA-WITH-" |
| 5903 | |
| 5904 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5905 | run_test "keyUsage srv: ECDSA, keyAgreement -> ECDH-" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5906 | "$P_SRV key_file=data_files/server5.key \ |
| 5907 | crt_file=data_files/server5.ku-ka.crt" \ |
| 5908 | "$P_CLI" \ |
| 5909 | 0 \ |
| 5910 | -c "Ciphersuite is TLS-ECDH-" |
| 5911 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5912 | run_test "keyUsage srv: ECDSA, keyEncipherment -> fail" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 5913 | "$P_SRV key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5914 | crt_file=data_files/server5.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 5915 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5916 | 1 \ |
| 5917 | -C "Ciphersuite is " |
| 5918 | |
| 5919 | # Tests for keyUsage in leaf certificates, part 2: |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 5920 | # client-side checking of server cert |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5921 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5922 | run_test "keyUsage cli: DigitalSignature+KeyEncipherment, RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5923 | "$O_SRV -key data_files/server2.key \ |
| 5924 | -cert data_files/server2.ku-ds_ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5925 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5926 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 5927 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 5928 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5929 | -C "Processing of the Certificate handshake message failed" \ |
| 5930 | -c "Ciphersuite is TLS-" |
| 5931 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5932 | run_test "keyUsage cli: DigitalSignature+KeyEncipherment, DHE-RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5933 | "$O_SRV -key data_files/server2.key \ |
| 5934 | -cert data_files/server2.ku-ds_ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5935 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5936 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 5937 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 5938 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5939 | -C "Processing of the Certificate handshake message failed" \ |
| 5940 | -c "Ciphersuite is TLS-" |
| 5941 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5942 | run_test "keyUsage cli: KeyEncipherment, RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5943 | "$O_SRV -key data_files/server2.key \ |
| 5944 | -cert data_files/server2.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5945 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5946 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 5947 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 5948 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5949 | -C "Processing of the Certificate handshake message failed" \ |
| 5950 | -c "Ciphersuite is TLS-" |
| 5951 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5952 | run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5953 | "$O_SRV -key data_files/server2.key \ |
| 5954 | -cert data_files/server2.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5955 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5956 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 5957 | 1 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 5958 | -c "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5959 | -c "Processing of the Certificate handshake message failed" \ |
| 5960 | -C "Ciphersuite is TLS-" |
| 5961 | |
Manuel Pégourié-Gonnard | e6efa6f | 2015-04-20 11:01:48 +0100 | [diff] [blame] | 5962 | run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail, soft" \ |
| 5963 | "$O_SRV -key data_files/server2.key \ |
| 5964 | -cert data_files/server2.ku-ke.crt" \ |
| 5965 | "$P_CLI debug_level=1 auth_mode=optional \ |
| 5966 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 5967 | 0 \ |
| 5968 | -c "bad certificate (usage extensions)" \ |
| 5969 | -C "Processing of the Certificate handshake message failed" \ |
| 5970 | -c "Ciphersuite is TLS-" \ |
| 5971 | -c "! Usage does not match the keyUsage extension" |
| 5972 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5973 | run_test "keyUsage cli: DigitalSignature, DHE-RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5974 | "$O_SRV -key data_files/server2.key \ |
| 5975 | -cert data_files/server2.ku-ds.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5976 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5977 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 5978 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 5979 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5980 | -C "Processing of the Certificate handshake message failed" \ |
| 5981 | -c "Ciphersuite is TLS-" |
| 5982 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5983 | run_test "keyUsage cli: DigitalSignature, RSA: fail" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5984 | "$O_SRV -key data_files/server2.key \ |
| 5985 | -cert data_files/server2.ku-ds.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5986 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5987 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 5988 | 1 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 5989 | -c "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 5990 | -c "Processing of the Certificate handshake message failed" \ |
| 5991 | -C "Ciphersuite is TLS-" |
| 5992 | |
Manuel Pégourié-Gonnard | e6efa6f | 2015-04-20 11:01:48 +0100 | [diff] [blame] | 5993 | run_test "keyUsage cli: DigitalSignature, RSA: fail, soft" \ |
| 5994 | "$O_SRV -key data_files/server2.key \ |
| 5995 | -cert data_files/server2.ku-ds.crt" \ |
| 5996 | "$P_CLI debug_level=1 auth_mode=optional \ |
| 5997 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 5998 | 0 \ |
| 5999 | -c "bad certificate (usage extensions)" \ |
| 6000 | -C "Processing of the Certificate handshake message failed" \ |
| 6001 | -c "Ciphersuite is TLS-" \ |
| 6002 | -c "! Usage does not match the keyUsage extension" |
| 6003 | |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6004 | # Tests for keyUsage in leaf certificates, part 3: |
| 6005 | # server-side checking of client cert |
| 6006 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6007 | run_test "keyUsage cli-auth: RSA, DigitalSignature: OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6008 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6009 | "$O_CLI -key data_files/server2.key \ |
| 6010 | -cert data_files/server2.ku-ds.crt" \ |
| 6011 | 0 \ |
| 6012 | -S "bad certificate (usage extensions)" \ |
| 6013 | -S "Processing of the Certificate handshake message failed" |
| 6014 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6015 | run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6016 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6017 | "$O_CLI -key data_files/server2.key \ |
| 6018 | -cert data_files/server2.ku-ke.crt" \ |
| 6019 | 0 \ |
| 6020 | -s "bad certificate (usage extensions)" \ |
| 6021 | -S "Processing of the Certificate handshake message failed" |
| 6022 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6023 | run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (hard)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6024 | "$P_SRV debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6025 | "$O_CLI -key data_files/server2.key \ |
| 6026 | -cert data_files/server2.ku-ke.crt" \ |
| 6027 | 1 \ |
| 6028 | -s "bad certificate (usage extensions)" \ |
| 6029 | -s "Processing of the Certificate handshake message failed" |
| 6030 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6031 | run_test "keyUsage cli-auth: ECDSA, DigitalSignature: OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6032 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6033 | "$O_CLI -key data_files/server5.key \ |
| 6034 | -cert data_files/server5.ku-ds.crt" \ |
| 6035 | 0 \ |
| 6036 | -S "bad certificate (usage extensions)" \ |
| 6037 | -S "Processing of the Certificate handshake message failed" |
| 6038 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6039 | run_test "keyUsage cli-auth: ECDSA, KeyAgreement: fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6040 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6041 | "$O_CLI -key data_files/server5.key \ |
| 6042 | -cert data_files/server5.ku-ka.crt" \ |
| 6043 | 0 \ |
| 6044 | -s "bad certificate (usage extensions)" \ |
| 6045 | -S "Processing of the Certificate handshake message failed" |
| 6046 | |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6047 | # Tests for extendedKeyUsage, part 1: server-side certificate/suite selection |
| 6048 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6049 | run_test "extKeyUsage srv: serverAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6050 | "$P_SRV key_file=data_files/server5.key \ |
| 6051 | crt_file=data_files/server5.eku-srv.crt" \ |
| 6052 | "$P_CLI" \ |
| 6053 | 0 |
| 6054 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6055 | run_test "extKeyUsage srv: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6056 | "$P_SRV key_file=data_files/server5.key \ |
| 6057 | crt_file=data_files/server5.eku-srv.crt" \ |
| 6058 | "$P_CLI" \ |
| 6059 | 0 |
| 6060 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6061 | run_test "extKeyUsage srv: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6062 | "$P_SRV key_file=data_files/server5.key \ |
| 6063 | crt_file=data_files/server5.eku-cs_any.crt" \ |
| 6064 | "$P_CLI" \ |
| 6065 | 0 |
| 6066 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6067 | run_test "extKeyUsage srv: codeSign -> fail" \ |
Manuel Pégourié-Gonnard | 7eb58cb | 2015-07-07 11:54:14 +0200 | [diff] [blame] | 6068 | "$P_SRV key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6069 | crt_file=data_files/server5.eku-cli.crt" \ |
Manuel Pégourié-Gonnard | 7eb58cb | 2015-07-07 11:54:14 +0200 | [diff] [blame] | 6070 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6071 | 1 |
| 6072 | |
| 6073 | # Tests for extendedKeyUsage, part 2: client-side checking of server cert |
| 6074 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6075 | run_test "extKeyUsage cli: serverAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6076 | "$O_SRV -key data_files/server5.key \ |
| 6077 | -cert data_files/server5.eku-srv.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6078 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6079 | 0 \ |
| 6080 | -C "bad certificate (usage extensions)" \ |
| 6081 | -C "Processing of the Certificate handshake message failed" \ |
| 6082 | -c "Ciphersuite is TLS-" |
| 6083 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6084 | run_test "extKeyUsage cli: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6085 | "$O_SRV -key data_files/server5.key \ |
| 6086 | -cert data_files/server5.eku-srv_cli.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6087 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6088 | 0 \ |
| 6089 | -C "bad certificate (usage extensions)" \ |
| 6090 | -C "Processing of the Certificate handshake message failed" \ |
| 6091 | -c "Ciphersuite is TLS-" |
| 6092 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6093 | run_test "extKeyUsage cli: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6094 | "$O_SRV -key data_files/server5.key \ |
| 6095 | -cert data_files/server5.eku-cs_any.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6096 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6097 | 0 \ |
| 6098 | -C "bad certificate (usage extensions)" \ |
| 6099 | -C "Processing of the Certificate handshake message failed" \ |
| 6100 | -c "Ciphersuite is TLS-" |
| 6101 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6102 | run_test "extKeyUsage cli: codeSign -> fail" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6103 | "$O_SRV -key data_files/server5.key \ |
| 6104 | -cert data_files/server5.eku-cs.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6105 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6106 | 1 \ |
| 6107 | -c "bad certificate (usage extensions)" \ |
| 6108 | -c "Processing of the Certificate handshake message failed" \ |
| 6109 | -C "Ciphersuite is TLS-" |
| 6110 | |
| 6111 | # Tests for extendedKeyUsage, part 3: server-side checking of client cert |
| 6112 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6113 | run_test "extKeyUsage cli-auth: clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6114 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6115 | "$O_CLI -key data_files/server5.key \ |
| 6116 | -cert data_files/server5.eku-cli.crt" \ |
| 6117 | 0 \ |
| 6118 | -S "bad certificate (usage extensions)" \ |
| 6119 | -S "Processing of the Certificate handshake message failed" |
| 6120 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6121 | run_test "extKeyUsage cli-auth: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6122 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6123 | "$O_CLI -key data_files/server5.key \ |
| 6124 | -cert data_files/server5.eku-srv_cli.crt" \ |
| 6125 | 0 \ |
| 6126 | -S "bad certificate (usage extensions)" \ |
| 6127 | -S "Processing of the Certificate handshake message failed" |
| 6128 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6129 | run_test "extKeyUsage cli-auth: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6130 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6131 | "$O_CLI -key data_files/server5.key \ |
| 6132 | -cert data_files/server5.eku-cs_any.crt" \ |
| 6133 | 0 \ |
| 6134 | -S "bad certificate (usage extensions)" \ |
| 6135 | -S "Processing of the Certificate handshake message failed" |
| 6136 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6137 | run_test "extKeyUsage cli-auth: codeSign -> fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6138 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6139 | "$O_CLI -key data_files/server5.key \ |
| 6140 | -cert data_files/server5.eku-cs.crt" \ |
| 6141 | 0 \ |
| 6142 | -s "bad certificate (usage extensions)" \ |
| 6143 | -S "Processing of the Certificate handshake message failed" |
| 6144 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6145 | run_test "extKeyUsage cli-auth: codeSign -> fail (hard)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6146 | "$P_SRV debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6147 | "$O_CLI -key data_files/server5.key \ |
| 6148 | -cert data_files/server5.eku-cs.crt" \ |
| 6149 | 1 \ |
| 6150 | -s "bad certificate (usage extensions)" \ |
| 6151 | -s "Processing of the Certificate handshake message failed" |
| 6152 | |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 6153 | # Tests for DHM parameters loading |
| 6154 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6155 | run_test "DHM parameters: reference" \ |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 6156 | "$P_SRV" \ |
| 6157 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 6158 | debug_level=3" \ |
| 6159 | 0 \ |
| 6160 | -c "value of 'DHM: P ' (2048 bits)" \ |
Hanno Becker | 13be990 | 2017-09-27 17:17:30 +0100 | [diff] [blame] | 6161 | -c "value of 'DHM: G ' (2 bits)" |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 6162 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6163 | run_test "DHM parameters: other parameters" \ |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 6164 | "$P_SRV dhm_file=data_files/dhparams.pem" \ |
| 6165 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 6166 | debug_level=3" \ |
| 6167 | 0 \ |
| 6168 | -c "value of 'DHM: P ' (1024 bits)" \ |
| 6169 | -c "value of 'DHM: G ' (2 bits)" |
| 6170 | |
Manuel Pégourié-Gonnard | 7a010aa | 2015-06-12 11:19:10 +0200 | [diff] [blame] | 6171 | # Tests for DHM client-side size checking |
| 6172 | |
| 6173 | run_test "DHM size: server default, client default, OK" \ |
| 6174 | "$P_SRV" \ |
| 6175 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 6176 | debug_level=1" \ |
| 6177 | 0 \ |
| 6178 | -C "DHM prime too short:" |
| 6179 | |
| 6180 | run_test "DHM size: server default, client 2048, OK" \ |
| 6181 | "$P_SRV" \ |
| 6182 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 6183 | debug_level=1 dhmlen=2048" \ |
| 6184 | 0 \ |
| 6185 | -C "DHM prime too short:" |
| 6186 | |
| 6187 | run_test "DHM size: server 1024, client default, OK" \ |
| 6188 | "$P_SRV dhm_file=data_files/dhparams.pem" \ |
| 6189 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 6190 | debug_level=1" \ |
| 6191 | 0 \ |
| 6192 | -C "DHM prime too short:" |
| 6193 | |
Gilles Peskine | c6b0d96 | 2020-12-08 22:31:52 +0100 | [diff] [blame] | 6194 | run_test "DHM size: server 999, client 999, OK" \ |
| 6195 | "$P_SRV dhm_file=data_files/dh.999.pem" \ |
| 6196 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 6197 | debug_level=1 dhmlen=999" \ |
| 6198 | 0 \ |
| 6199 | -C "DHM prime too short:" |
| 6200 | |
| 6201 | run_test "DHM size: server 1000, client 1000, OK" \ |
| 6202 | "$P_SRV dhm_file=data_files/dh.1000.pem" \ |
| 6203 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 6204 | debug_level=1 dhmlen=1000" \ |
| 6205 | 0 \ |
| 6206 | -C "DHM prime too short:" |
| 6207 | |
Manuel Pégourié-Gonnard | 7a010aa | 2015-06-12 11:19:10 +0200 | [diff] [blame] | 6208 | run_test "DHM size: server 1000, client default, rejected" \ |
| 6209 | "$P_SRV dhm_file=data_files/dh.1000.pem" \ |
| 6210 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 6211 | debug_level=1" \ |
| 6212 | 1 \ |
| 6213 | -c "DHM prime too short:" |
| 6214 | |
Gilles Peskine | c6b0d96 | 2020-12-08 22:31:52 +0100 | [diff] [blame] | 6215 | run_test "DHM size: server 1000, client 1001, rejected" \ |
| 6216 | "$P_SRV dhm_file=data_files/dh.1000.pem" \ |
| 6217 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 6218 | debug_level=1 dhmlen=1001" \ |
| 6219 | 1 \ |
| 6220 | -c "DHM prime too short:" |
| 6221 | |
| 6222 | run_test "DHM size: server 999, client 1000, rejected" \ |
| 6223 | "$P_SRV dhm_file=data_files/dh.999.pem" \ |
| 6224 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 6225 | debug_level=1 dhmlen=1000" \ |
| 6226 | 1 \ |
| 6227 | -c "DHM prime too short:" |
| 6228 | |
| 6229 | run_test "DHM size: server 998, client 999, rejected" \ |
| 6230 | "$P_SRV dhm_file=data_files/dh.998.pem" \ |
| 6231 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 6232 | debug_level=1 dhmlen=999" \ |
| 6233 | 1 \ |
| 6234 | -c "DHM prime too short:" |
| 6235 | |
Manuel Pégourié-Gonnard | 7a010aa | 2015-06-12 11:19:10 +0200 | [diff] [blame] | 6236 | run_test "DHM size: server default, client 2049, rejected" \ |
| 6237 | "$P_SRV" \ |
| 6238 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 6239 | debug_level=1 dhmlen=2049" \ |
| 6240 | 1 \ |
| 6241 | -c "DHM prime too short:" |
| 6242 | |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6243 | # Tests for PSK callback |
| 6244 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6245 | run_test "PSK callback: psk, no callback" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6246 | "$P_SRV psk=73776f726466697368 psk_identity=foo" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6247 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6248 | psk_identity=foo psk=73776f726466697368" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6249 | 0 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 6250 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 6251 | -S "SSL - Unknown identity received" \ |
| 6252 | -S "SSL - Verification of the message MAC failed" |
| 6253 | |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 6254 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6255 | run_test "PSK callback: opaque psk on client, no callback" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6256 | "$P_SRV extended_ms=0 debug_level=1 psk=73776f726466697368 psk_identity=foo" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6257 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6258 | psk_identity=foo psk=73776f726466697368 psk_opaque=1" \ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 6259 | 0 \ |
| 6260 | -c "skip PMS generation for opaque PSK"\ |
| 6261 | -S "skip PMS generation for opaque PSK"\ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6262 | -C "session hash for extended master secret"\ |
| 6263 | -S "session hash for extended master secret"\ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 6264 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6265 | -S "SSL - Unknown identity received" \ |
| 6266 | -S "SSL - Verification of the message MAC failed" |
| 6267 | |
| 6268 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6269 | run_test "PSK callback: opaque psk on client, no callback, SHA-384" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6270 | "$P_SRV extended_ms=0 debug_level=1 psk=73776f726466697368 psk_identity=foo" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6271 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6272 | psk_identity=foo psk=73776f726466697368 psk_opaque=1" \ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 6273 | 0 \ |
| 6274 | -c "skip PMS generation for opaque PSK"\ |
| 6275 | -S "skip PMS generation for opaque PSK"\ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6276 | -C "session hash for extended master secret"\ |
| 6277 | -S "session hash for extended master secret"\ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 6278 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6279 | -S "SSL - Unknown identity received" \ |
| 6280 | -S "SSL - Verification of the message MAC failed" |
| 6281 | |
| 6282 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6283 | run_test "PSK callback: opaque psk on client, no callback, EMS" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6284 | "$P_SRV extended_ms=1 debug_level=3 psk=73776f726466697368 psk_identity=foo" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6285 | "$P_CLI extended_ms=1 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6286 | psk_identity=foo psk=73776f726466697368 psk_opaque=1" \ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 6287 | 0 \ |
| 6288 | -c "skip PMS generation for opaque PSK"\ |
| 6289 | -S "skip PMS generation for opaque PSK"\ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6290 | -c "session hash for extended master secret"\ |
| 6291 | -s "session hash for extended master secret"\ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 6292 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6293 | -S "SSL - Unknown identity received" \ |
| 6294 | -S "SSL - Verification of the message MAC failed" |
| 6295 | |
| 6296 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6297 | run_test "PSK callback: opaque psk on client, no callback, SHA-384, EMS" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6298 | "$P_SRV extended_ms=1 debug_level=3 psk=73776f726466697368 psk_identity=foo" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6299 | "$P_CLI extended_ms=1 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6300 | psk_identity=foo psk=73776f726466697368 psk_opaque=1" \ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 6301 | 0 \ |
| 6302 | -c "skip PMS generation for opaque PSK"\ |
| 6303 | -S "skip PMS generation for opaque PSK"\ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6304 | -c "session hash for extended master secret"\ |
| 6305 | -s "session hash for extended master secret"\ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 6306 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6307 | -S "SSL - Unknown identity received" \ |
| 6308 | -S "SSL - Verification of the message MAC failed" |
| 6309 | |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6310 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6311 | run_test "PSK callback: raw psk on client, static opaque on server, no callback" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6312 | "$P_SRV extended_ms=0 debug_level=1 psk=73776f726466697368 psk_identity=foo psk_opaque=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6313 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6314 | psk_identity=foo psk=73776f726466697368" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6315 | 0 \ |
| 6316 | -C "skip PMS generation for opaque PSK"\ |
| 6317 | -s "skip PMS generation for opaque PSK"\ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6318 | -C "session hash for extended master secret"\ |
| 6319 | -S "session hash for extended master secret"\ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6320 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6321 | -S "SSL - Unknown identity received" \ |
| 6322 | -S "SSL - Verification of the message MAC failed" |
| 6323 | |
| 6324 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6325 | run_test "PSK callback: raw psk on client, static opaque on server, no callback, SHA-384" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6326 | "$P_SRV extended_ms=0 debug_level=1 psk=73776f726466697368 psk_identity=foo psk_opaque=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6327 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6328 | psk_identity=foo psk=73776f726466697368" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6329 | 0 \ |
| 6330 | -C "skip PMS generation for opaque PSK"\ |
| 6331 | -s "skip PMS generation for opaque PSK"\ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6332 | -C "session hash for extended master secret"\ |
| 6333 | -S "session hash for extended master secret"\ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6334 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6335 | -S "SSL - Unknown identity received" \ |
| 6336 | -S "SSL - Verification of the message MAC failed" |
| 6337 | |
| 6338 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6339 | run_test "PSK callback: raw psk on client, static opaque on server, no callback, EMS" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6340 | "$P_SRV debug_level=3 psk=73776f726466697368 psk_identity=foo psk_opaque=1 min_version=tls12 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6341 | force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA extended_ms=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6342 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6343 | psk_identity=foo psk=73776f726466697368 extended_ms=1" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6344 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6345 | -c "session hash for extended master secret"\ |
| 6346 | -s "session hash for extended master secret"\ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6347 | -C "skip PMS generation for opaque PSK"\ |
| 6348 | -s "skip PMS generation for opaque PSK"\ |
| 6349 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6350 | -S "SSL - Unknown identity received" \ |
| 6351 | -S "SSL - Verification of the message MAC failed" |
| 6352 | |
| 6353 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6354 | run_test "PSK callback: raw psk on client, static opaque on server, no callback, EMS, SHA384" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6355 | "$P_SRV debug_level=3 psk=73776f726466697368 psk_identity=foo psk_opaque=1 min_version=tls12 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6356 | force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 extended_ms=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6357 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6358 | psk_identity=foo psk=73776f726466697368 extended_ms=1" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6359 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6360 | -c "session hash for extended master secret"\ |
| 6361 | -s "session hash for extended master secret"\ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6362 | -C "skip PMS generation for opaque PSK"\ |
| 6363 | -s "skip PMS generation for opaque PSK"\ |
| 6364 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6365 | -S "SSL - Unknown identity received" \ |
| 6366 | -S "SSL - Verification of the message MAC failed" |
| 6367 | |
| 6368 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6369 | run_test "PSK callback: raw psk on client, no static PSK on server, opaque PSK from callback" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6370 | "$P_SRV extended_ms=0 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
| 6371 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6372 | psk_identity=def psk=beef" \ |
| 6373 | 0 \ |
| 6374 | -C "skip PMS generation for opaque PSK"\ |
| 6375 | -s "skip PMS generation for opaque PSK"\ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6376 | -C "session hash for extended master secret"\ |
| 6377 | -S "session hash for extended master secret"\ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6378 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6379 | -S "SSL - Unknown identity received" \ |
| 6380 | -S "SSL - Verification of the message MAC failed" |
| 6381 | |
| 6382 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6383 | run_test "PSK callback: raw psk on client, no static PSK on server, opaque PSK from callback, SHA-384" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6384 | "$P_SRV extended_ms=0 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384" \ |
| 6385 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6386 | psk_identity=def psk=beef" \ |
| 6387 | 0 \ |
| 6388 | -C "skip PMS generation for opaque PSK"\ |
| 6389 | -s "skip PMS generation for opaque PSK"\ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6390 | -C "session hash for extended master secret"\ |
| 6391 | -S "session hash for extended master secret"\ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6392 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6393 | -S "SSL - Unknown identity received" \ |
| 6394 | -S "SSL - Verification of the message MAC failed" |
| 6395 | |
| 6396 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6397 | run_test "PSK callback: raw psk on client, no static PSK on server, opaque PSK from callback, EMS" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6398 | "$P_SRV debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6399 | force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA extended_ms=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6400 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6401 | psk_identity=abc psk=dead extended_ms=1" \ |
| 6402 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6403 | -c "session hash for extended master secret"\ |
| 6404 | -s "session hash for extended master secret"\ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6405 | -C "skip PMS generation for opaque PSK"\ |
| 6406 | -s "skip PMS generation for opaque PSK"\ |
| 6407 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6408 | -S "SSL - Unknown identity received" \ |
| 6409 | -S "SSL - Verification of the message MAC failed" |
| 6410 | |
| 6411 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6412 | run_test "PSK callback: raw psk on client, no static PSK on server, opaque PSK from callback, EMS, SHA384" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6413 | "$P_SRV debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6414 | force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 extended_ms=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6415 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6416 | psk_identity=abc psk=dead extended_ms=1" \ |
| 6417 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6418 | -c "session hash for extended master secret"\ |
| 6419 | -s "session hash for extended master secret"\ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6420 | -C "skip PMS generation for opaque PSK"\ |
| 6421 | -s "skip PMS generation for opaque PSK"\ |
| 6422 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6423 | -S "SSL - Unknown identity received" \ |
| 6424 | -S "SSL - Verification of the message MAC failed" |
| 6425 | |
| 6426 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6427 | run_test "PSK callback: raw psk on client, mismatching static raw PSK on server, opaque PSK from callback" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6428 | "$P_SRV extended_ms=0 psk_identity=foo psk=73776f726466697368 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6429 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6430 | psk_identity=def psk=beef" \ |
| 6431 | 0 \ |
| 6432 | -C "skip PMS generation for opaque PSK"\ |
| 6433 | -s "skip PMS generation for opaque PSK"\ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6434 | -C "session hash for extended master secret"\ |
| 6435 | -S "session hash for extended master secret"\ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6436 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6437 | -S "SSL - Unknown identity received" \ |
| 6438 | -S "SSL - Verification of the message MAC failed" |
| 6439 | |
| 6440 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6441 | run_test "PSK callback: raw psk on client, mismatching static opaque PSK on server, opaque PSK from callback" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6442 | "$P_SRV extended_ms=0 psk_opaque=1 psk_identity=foo psk=73776f726466697368 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6443 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6444 | psk_identity=def psk=beef" \ |
| 6445 | 0 \ |
| 6446 | -C "skip PMS generation for opaque PSK"\ |
| 6447 | -s "skip PMS generation for opaque PSK"\ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6448 | -C "session hash for extended master secret"\ |
| 6449 | -S "session hash for extended master secret"\ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6450 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6451 | -S "SSL - Unknown identity received" \ |
| 6452 | -S "SSL - Verification of the message MAC failed" |
| 6453 | |
| 6454 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6455 | run_test "PSK callback: raw psk on client, mismatching static opaque PSK on server, raw PSK from callback" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6456 | "$P_SRV extended_ms=0 psk_opaque=1 psk_identity=foo psk=73776f726466697368 debug_level=3 psk_list=abc,dead,def,beef min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6457 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6458 | psk_identity=def psk=beef" \ |
| 6459 | 0 \ |
| 6460 | -C "skip PMS generation for opaque PSK"\ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6461 | -C "session hash for extended master secret"\ |
| 6462 | -S "session hash for extended master secret"\ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6463 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6464 | -S "SSL - Unknown identity received" \ |
| 6465 | -S "SSL - Verification of the message MAC failed" |
| 6466 | |
| 6467 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6468 | run_test "PSK callback: raw psk on client, id-matching but wrong raw PSK on server, opaque PSK from callback" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6469 | "$P_SRV extended_ms=0 psk_opaque=1 psk_identity=def psk=73776f726466697368 debug_level=3 psk_list=abc,dead,def,beef min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6470 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6471 | psk_identity=def psk=beef" \ |
| 6472 | 0 \ |
| 6473 | -C "skip PMS generation for opaque PSK"\ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 6474 | -C "session hash for extended master secret"\ |
| 6475 | -S "session hash for extended master secret"\ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6476 | -S "SSL - None of the common ciphersuites is usable" \ |
| 6477 | -S "SSL - Unknown identity received" \ |
| 6478 | -S "SSL - Verification of the message MAC failed" |
| 6479 | |
| 6480 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 6481 | run_test "PSK callback: raw psk on client, matching opaque PSK on server, wrong opaque PSK from callback" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6482 | "$P_SRV extended_ms=0 psk_opaque=1 psk_identity=def psk=beef debug_level=3 psk_list=abc,dead,def,73776f726466697368 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6483 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 6484 | psk_identity=def psk=beef" \ |
| 6485 | 1 \ |
| 6486 | -s "SSL - Verification of the message MAC failed" |
| 6487 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6488 | run_test "PSK callback: no psk, no callback" \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 6489 | "$P_SRV" \ |
| 6490 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6491 | psk_identity=foo psk=73776f726466697368" \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 6492 | 1 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 6493 | -s "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6494 | -S "SSL - Unknown identity received" \ |
| 6495 | -S "SSL - Verification of the message MAC failed" |
| 6496 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6497 | run_test "PSK callback: callback overrides other settings" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6498 | "$P_SRV psk=73776f726466697368 psk_identity=foo psk_list=abc,dead,def,beef" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6499 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 6500 | psk_identity=foo psk=73776f726466697368" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6501 | 1 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 6502 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6503 | -s "SSL - Unknown identity received" \ |
| 6504 | -S "SSL - Verification of the message MAC failed" |
| 6505 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6506 | run_test "PSK callback: first id matches" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6507 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 6508 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 6509 | psk_identity=abc psk=dead" \ |
| 6510 | 0 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 6511 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6512 | -S "SSL - Unknown identity received" \ |
| 6513 | -S "SSL - Verification of the message MAC failed" |
| 6514 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6515 | run_test "PSK callback: second id matches" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6516 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 6517 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 6518 | psk_identity=def psk=beef" \ |
| 6519 | 0 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 6520 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6521 | -S "SSL - Unknown identity received" \ |
| 6522 | -S "SSL - Verification of the message MAC failed" |
| 6523 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6524 | run_test "PSK callback: no match" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6525 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 6526 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 6527 | psk_identity=ghi psk=beef" \ |
| 6528 | 1 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 6529 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6530 | -s "SSL - Unknown identity received" \ |
| 6531 | -S "SSL - Verification of the message MAC failed" |
| 6532 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6533 | run_test "PSK callback: wrong key" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6534 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 6535 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 6536 | psk_identity=abc psk=beef" \ |
| 6537 | 1 \ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 6538 | -S "SSL - None of the common ciphersuites is usable" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 6539 | -S "SSL - Unknown identity received" \ |
| 6540 | -s "SSL - Verification of the message MAC failed" |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 6541 | |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 6542 | # Tests for EC J-PAKE |
| 6543 | |
Hanno Becker | fa452c4 | 2020-08-14 15:42:49 +0100 | [diff] [blame] | 6544 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 6545 | run_test "ECJPAKE: client not configured" \ |
| 6546 | "$P_SRV debug_level=3" \ |
| 6547 | "$P_CLI debug_level=3" \ |
| 6548 | 0 \ |
Hanno Becker | ee63af6 | 2020-08-14 15:41:23 +0100 | [diff] [blame] | 6549 | -C "add ciphersuite: 0xc0ff" \ |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 6550 | -C "adding ecjpake_kkpp extension" \ |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 6551 | -S "found ecjpake kkpp extension" \ |
| 6552 | -S "skip ecjpake kkpp extension" \ |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 6553 | -S "ciphersuite mismatch: ecjpake not configured" \ |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 6554 | -S "server hello, ecjpake kkpp extension" \ |
Manuel Pégourié-Gonnard | 0a1324a | 2015-09-16 16:01:00 +0200 | [diff] [blame] | 6555 | -C "found ecjpake_kkpp extension" \ |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 6556 | -S "None of the common ciphersuites is usable" |
| 6557 | |
Hanno Becker | fa452c4 | 2020-08-14 15:42:49 +0100 | [diff] [blame] | 6558 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 6559 | run_test "ECJPAKE: server not configured" \ |
| 6560 | "$P_SRV debug_level=3" \ |
| 6561 | "$P_CLI debug_level=3 ecjpake_pw=bla \ |
| 6562 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 6563 | 1 \ |
Hanno Becker | ee63af6 | 2020-08-14 15:41:23 +0100 | [diff] [blame] | 6564 | -c "add ciphersuite: 0xc0ff" \ |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 6565 | -c "adding ecjpake_kkpp extension" \ |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 6566 | -s "found ecjpake kkpp extension" \ |
| 6567 | -s "skip ecjpake kkpp extension" \ |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 6568 | -s "ciphersuite mismatch: ecjpake not configured" \ |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 6569 | -S "server hello, ecjpake kkpp extension" \ |
Manuel Pégourié-Gonnard | 0a1324a | 2015-09-16 16:01:00 +0200 | [diff] [blame] | 6570 | -C "found ecjpake_kkpp extension" \ |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 6571 | -s "None of the common ciphersuites is usable" |
| 6572 | |
Hanno Becker | fa452c4 | 2020-08-14 15:42:49 +0100 | [diff] [blame] | 6573 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 6574 | run_test "ECJPAKE: working, TLS" \ |
| 6575 | "$P_SRV debug_level=3 ecjpake_pw=bla" \ |
| 6576 | "$P_CLI debug_level=3 ecjpake_pw=bla \ |
| 6577 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
Manuel Pégourié-Gonnard | 0f1660a | 2015-09-16 22:41:06 +0200 | [diff] [blame] | 6578 | 0 \ |
Hanno Becker | ee63af6 | 2020-08-14 15:41:23 +0100 | [diff] [blame] | 6579 | -c "add ciphersuite: 0xc0ff" \ |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 6580 | -c "adding ecjpake_kkpp extension" \ |
Manuel Pégourié-Gonnard | d0d8cb3 | 2015-09-17 14:16:30 +0200 | [diff] [blame] | 6581 | -C "re-using cached ecjpake parameters" \ |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 6582 | -s "found ecjpake kkpp extension" \ |
| 6583 | -S "skip ecjpake kkpp extension" \ |
| 6584 | -S "ciphersuite mismatch: ecjpake not configured" \ |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 6585 | -s "server hello, ecjpake kkpp extension" \ |
Manuel Pégourié-Gonnard | 0a1324a | 2015-09-16 16:01:00 +0200 | [diff] [blame] | 6586 | -c "found ecjpake_kkpp extension" \ |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 6587 | -S "None of the common ciphersuites is usable" \ |
| 6588 | -S "SSL - Verification of the message MAC failed" |
| 6589 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 6590 | server_needs_more_time 1 |
Dave Rodgman | 7ed75e2 | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 6591 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 6592 | run_test "ECJPAKE: password mismatch, TLS" \ |
| 6593 | "$P_SRV debug_level=3 ecjpake_pw=bla" \ |
| 6594 | "$P_CLI debug_level=3 ecjpake_pw=bad \ |
| 6595 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 6596 | 1 \ |
Manuel Pégourié-Gonnard | d0d8cb3 | 2015-09-17 14:16:30 +0200 | [diff] [blame] | 6597 | -C "re-using cached ecjpake parameters" \ |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 6598 | -s "SSL - Verification of the message MAC failed" |
| 6599 | |
Dave Rodgman | 7ed75e2 | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 6600 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 6601 | run_test "ECJPAKE: working, DTLS" \ |
| 6602 | "$P_SRV debug_level=3 dtls=1 ecjpake_pw=bla" \ |
| 6603 | "$P_CLI debug_level=3 dtls=1 ecjpake_pw=bla \ |
| 6604 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 6605 | 0 \ |
Manuel Pégourié-Gonnard | d0d8cb3 | 2015-09-17 14:16:30 +0200 | [diff] [blame] | 6606 | -c "re-using cached ecjpake parameters" \ |
| 6607 | -S "SSL - Verification of the message MAC failed" |
| 6608 | |
Dave Rodgman | 7ed75e2 | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 6609 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | d0d8cb3 | 2015-09-17 14:16:30 +0200 | [diff] [blame] | 6610 | run_test "ECJPAKE: working, DTLS, no cookie" \ |
| 6611 | "$P_SRV debug_level=3 dtls=1 ecjpake_pw=bla cookies=0" \ |
| 6612 | "$P_CLI debug_level=3 dtls=1 ecjpake_pw=bla \ |
| 6613 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 6614 | 0 \ |
| 6615 | -C "re-using cached ecjpake parameters" \ |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 6616 | -S "SSL - Verification of the message MAC failed" |
| 6617 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 6618 | server_needs_more_time 1 |
Dave Rodgman | 7ed75e2 | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 6619 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 6620 | run_test "ECJPAKE: password mismatch, DTLS" \ |
| 6621 | "$P_SRV debug_level=3 dtls=1 ecjpake_pw=bla" \ |
| 6622 | "$P_CLI debug_level=3 dtls=1 ecjpake_pw=bad \ |
| 6623 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 6624 | 1 \ |
Manuel Pégourié-Gonnard | d0d8cb3 | 2015-09-17 14:16:30 +0200 | [diff] [blame] | 6625 | -c "re-using cached ecjpake parameters" \ |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 6626 | -s "SSL - Verification of the message MAC failed" |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 6627 | |
Manuel Pégourié-Gonnard | ca700b2 | 2015-10-20 14:47:00 +0200 | [diff] [blame] | 6628 | # for tests with configs/config-thread.h |
Dave Rodgman | 7ed75e2 | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 6629 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | ca700b2 | 2015-10-20 14:47:00 +0200 | [diff] [blame] | 6630 | run_test "ECJPAKE: working, DTLS, nolog" \ |
| 6631 | "$P_SRV dtls=1 ecjpake_pw=bla" \ |
| 6632 | "$P_CLI dtls=1 ecjpake_pw=bla \ |
| 6633 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 6634 | 0 |
| 6635 | |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 6636 | # Tests for ciphersuites per version |
| 6637 | |
Manuel Pégourié-Gonnard | aa946b2 | 2019-03-01 10:14:58 +0100 | [diff] [blame] | 6638 | requires_config_enabled MBEDTLS_CAMELLIA_C |
| 6639 | requires_config_enabled MBEDTLS_AES_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6640 | run_test "Per-version suites: SSL3" \ |
Manuel Pégourié-Gonnard | aa946b2 | 2019-03-01 10:14:58 +0100 | [diff] [blame] | 6641 | "$P_SRV min_version=ssl3 version_suites=TLS-RSA-WITH-CAMELLIA-128-CBC-SHA,TLS-RSA-WITH-AES-256-CBC-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 6642 | "$P_CLI force_version=ssl3" \ |
| 6643 | 0 \ |
Manuel Pégourié-Gonnard | aa946b2 | 2019-03-01 10:14:58 +0100 | [diff] [blame] | 6644 | -c "Ciphersuite is TLS-RSA-WITH-CAMELLIA-128-CBC-SHA" |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 6645 | |
Manuel Pégourié-Gonnard | aa946b2 | 2019-03-01 10:14:58 +0100 | [diff] [blame] | 6646 | requires_config_enabled MBEDTLS_CAMELLIA_C |
| 6647 | requires_config_enabled MBEDTLS_AES_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6648 | run_test "Per-version suites: TLS 1.0" \ |
Manuel Pégourié-Gonnard | aa946b2 | 2019-03-01 10:14:58 +0100 | [diff] [blame] | 6649 | "$P_SRV version_suites=TLS-RSA-WITH-CAMELLIA-128-CBC-SHA,TLS-RSA-WITH-AES-256-CBC-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 6650 | "$P_CLI force_version=tls1 arc4=1" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 6651 | 0 \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 6652 | -c "Ciphersuite is TLS-RSA-WITH-AES-256-CBC-SHA" |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 6653 | |
Manuel Pégourié-Gonnard | aa946b2 | 2019-03-01 10:14:58 +0100 | [diff] [blame] | 6654 | requires_config_enabled MBEDTLS_CAMELLIA_C |
| 6655 | requires_config_enabled MBEDTLS_AES_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6656 | run_test "Per-version suites: TLS 1.1" \ |
Manuel Pégourié-Gonnard | aa946b2 | 2019-03-01 10:14:58 +0100 | [diff] [blame] | 6657 | "$P_SRV version_suites=TLS-RSA-WITH-CAMELLIA-128-CBC-SHA,TLS-RSA-WITH-AES-256-CBC-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 6658 | "$P_CLI force_version=tls1_1" \ |
| 6659 | 0 \ |
| 6660 | -c "Ciphersuite is TLS-RSA-WITH-AES-128-CBC-SHA" |
| 6661 | |
Manuel Pégourié-Gonnard | aa946b2 | 2019-03-01 10:14:58 +0100 | [diff] [blame] | 6662 | requires_config_enabled MBEDTLS_CAMELLIA_C |
| 6663 | requires_config_enabled MBEDTLS_AES_C |
Przemek Stekiel | efc894b | 2022-10-06 12:15:21 +0200 | [diff] [blame] | 6664 | requires_config_enabled MBEDTLS_GCM_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6665 | run_test "Per-version suites: TLS 1.2" \ |
Manuel Pégourié-Gonnard | aa946b2 | 2019-03-01 10:14:58 +0100 | [diff] [blame] | 6666 | "$P_SRV version_suites=TLS-RSA-WITH-CAMELLIA-128-CBC-SHA,TLS-RSA-WITH-AES-256-CBC-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6667 | "$P_CLI force_version=tls12" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 6668 | 0 \ |
| 6669 | -c "Ciphersuite is TLS-RSA-WITH-AES-128-GCM-SHA256" |
| 6670 | |
Manuel Pégourié-Gonnard | 4cc8c63 | 2015-07-23 12:24:03 +0200 | [diff] [blame] | 6671 | # Test for ClientHello without extensions |
| 6672 | |
Gilles Peskine | e4d2ab8 | 2024-04-29 17:42:52 +0200 | [diff] [blame] | 6673 | # Without extensions, ECC is impossible (no curve negotiation). |
| 6674 | requires_config_enabled MBEDTLS_RSA_C |
Manuel Pégourié-Gonnard | d55bc20 | 2015-08-04 16:22:30 +0200 | [diff] [blame] | 6675 | requires_gnutls |
Gilles Peskine | e4d2ab8 | 2024-04-29 17:42:52 +0200 | [diff] [blame] | 6676 | run_test "ClientHello without extensions: RSA" \ |
Manuel Pégourié-Gonnard | 77cbeff | 2020-01-30 10:58:57 +0100 | [diff] [blame] | 6677 | "$P_SRV debug_level=3" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 6678 | "$G_CLI --priority=NORMAL:%NO_EXTENSIONS:%DISABLE_SAFE_RENEGOTIATION localhost" \ |
Gilles Peskine | 5d2511c | 2017-05-12 13:16:40 +0200 | [diff] [blame] | 6679 | 0 \ |
Gilles Peskine | e4d2ab8 | 2024-04-29 17:42:52 +0200 | [diff] [blame] | 6680 | -s "Ciphersuite is .*-RSA-WITH-.*" \ |
| 6681 | -S "Ciphersuite is .*-EC.*" \ |
| 6682 | -s "dumping 'client hello extensions' (0 bytes)" |
| 6683 | |
Gilles Peskine | 0d16d81 | 2024-05-13 21:18:41 +0200 | [diff] [blame] | 6684 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_PSK_ENABLED |
Gilles Peskine | e4d2ab8 | 2024-04-29 17:42:52 +0200 | [diff] [blame] | 6685 | requires_gnutls |
| 6686 | run_test "ClientHello without extensions: PSK" \ |
| 6687 | "$P_SRV debug_level=3 psk=73776f726466697368" \ |
| 6688 | "$G_CLI --priority=NORMAL:+PSK:-RSA:-DHE-RSA:%NO_EXTENSIONS:%DISABLE_SAFE_RENEGOTIATION --pskusername=Client_identity --pskkey=73776f726466697368 localhost" \ |
| 6689 | 0 \ |
| 6690 | -s "Ciphersuite is .*-PSK-.*" \ |
| 6691 | -S "Ciphersuite is .*-EC.*" \ |
Gilles Peskine | 5d2511c | 2017-05-12 13:16:40 +0200 | [diff] [blame] | 6692 | -s "dumping 'client hello extensions' (0 bytes)" |
| 6693 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 6694 | # Tests for mbedtls_ssl_get_bytes_avail() |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 6695 | |
Gilles Peskine | 5a1b3bd | 2022-04-06 23:35:56 +0200 | [diff] [blame] | 6696 | # The server first reads buffer_size-1 bytes, then reads the remainder. |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 6697 | run_test "mbedtls_ssl_get_bytes_avail: no extra data" \ |
Gilles Peskine | 5a1b3bd | 2022-04-06 23:35:56 +0200 | [diff] [blame] | 6698 | "$P_SRV buffer_size=100" \ |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 6699 | "$P_CLI request_size=100" \ |
| 6700 | 0 \ |
| 6701 | -s "Read from client: 100 bytes read$" |
| 6702 | |
Gilles Peskine | 5a1b3bd | 2022-04-06 23:35:56 +0200 | [diff] [blame] | 6703 | run_test "mbedtls_ssl_get_bytes_avail: extra data (+1)" \ |
| 6704 | "$P_SRV buffer_size=100" \ |
| 6705 | "$P_CLI request_size=101" \ |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 6706 | 0 \ |
Gilles Peskine | 5a1b3bd | 2022-04-06 23:35:56 +0200 | [diff] [blame] | 6707 | -s "Read from client: 101 bytes read (100 + 1)" |
| 6708 | |
| 6709 | requires_max_content_len 200 |
| 6710 | run_test "mbedtls_ssl_get_bytes_avail: extra data (*2)" \ |
| 6711 | "$P_SRV buffer_size=100" \ |
| 6712 | "$P_CLI request_size=200" \ |
| 6713 | 0 \ |
| 6714 | -s "Read from client: 200 bytes read (100 + 100)" |
| 6715 | |
| 6716 | run_test "mbedtls_ssl_get_bytes_avail: extra data (max)" \ |
| 6717 | "$P_SRV buffer_size=100" \ |
| 6718 | "$P_CLI request_size=$MAX_CONTENT_LEN" \ |
| 6719 | 0 \ |
| 6720 | -s "Read from client: $MAX_CONTENT_LEN bytes read (100 + $((MAX_CONTENT_LEN - 100)))" |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 6721 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6722 | # Tests for small client packets |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6723 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6724 | run_test "Small client packet SSLv3 BlockCipher" \ |
Manuel Pégourié-Gonnard | 448ea50 | 2015-01-12 11:40:14 +0100 | [diff] [blame] | 6725 | "$P_SRV min_version=ssl3" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6726 | "$P_CLI request_size=1 force_version=ssl3 \ |
| 6727 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 6728 | 0 \ |
| 6729 | -s "Read from client: 1 bytes read" |
| 6730 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6731 | run_test "Small client packet SSLv3 StreamCipher" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 6732 | "$P_SRV min_version=ssl3 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6733 | "$P_CLI request_size=1 force_version=ssl3 \ |
| 6734 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 6735 | 0 \ |
| 6736 | -s "Read from client: 1 bytes read" |
| 6737 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6738 | run_test "Small client packet TLS 1.0 BlockCipher" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6739 | "$P_SRV" \ |
| 6740 | "$P_CLI request_size=1 force_version=tls1 \ |
| 6741 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 6742 | 0 \ |
| 6743 | -s "Read from client: 1 bytes read" |
| 6744 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6745 | run_test "Small client packet TLS 1.0 BlockCipher, without EtM" \ |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 6746 | "$P_SRV" \ |
| 6747 | "$P_CLI request_size=1 force_version=tls1 etm=0 \ |
| 6748 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 6749 | 0 \ |
| 6750 | -s "Read from client: 1 bytes read" |
| 6751 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 6752 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6753 | run_test "Small client packet TLS 1.0 BlockCipher, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6754 | "$P_SRV trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6755 | "$P_CLI request_size=1 force_version=tls1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6756 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6757 | 0 \ |
| 6758 | -s "Read from client: 1 bytes read" |
| 6759 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 6760 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6761 | run_test "Small client packet TLS 1.0 BlockCipher, without EtM, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6762 | "$P_SRV trunc_hmac=1" \ |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6763 | "$P_CLI request_size=1 force_version=tls1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6764 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1 etm=0" \ |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6765 | 0 \ |
| 6766 | -s "Read from client: 1 bytes read" |
| 6767 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6768 | run_test "Small client packet TLS 1.0 StreamCipher" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 6769 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6770 | "$P_CLI request_size=1 force_version=tls1 \ |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6771 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 6772 | 0 \ |
| 6773 | -s "Read from client: 1 bytes read" |
| 6774 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6775 | run_test "Small client packet TLS 1.0 StreamCipher, without EtM" \ |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6776 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 6777 | "$P_CLI request_size=1 force_version=tls1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6778 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA etm=0" \ |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6779 | 0 \ |
| 6780 | -s "Read from client: 1 bytes read" |
| 6781 | |
| 6782 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6783 | run_test "Small client packet TLS 1.0 StreamCipher, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6784 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6785 | "$P_CLI request_size=1 force_version=tls1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6786 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6787 | 0 \ |
| 6788 | -s "Read from client: 1 bytes read" |
| 6789 | |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6790 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6791 | run_test "Small client packet TLS 1.0 StreamCipher, without EtM, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6792 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
| 6793 | "$P_CLI request_size=1 force_version=tls1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 6794 | trunc_hmac=1 etm=0" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6795 | 0 \ |
| 6796 | -s "Read from client: 1 bytes read" |
| 6797 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6798 | run_test "Small client packet TLS 1.1 BlockCipher" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6799 | "$P_SRV" \ |
| 6800 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 6801 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 6802 | 0 \ |
| 6803 | -s "Read from client: 1 bytes read" |
| 6804 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6805 | run_test "Small client packet TLS 1.1 BlockCipher, without EtM" \ |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 6806 | "$P_SRV" \ |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6807 | "$P_CLI request_size=1 force_version=tls1_1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6808 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA etm=0" \ |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6809 | 0 \ |
| 6810 | -s "Read from client: 1 bytes read" |
| 6811 | |
| 6812 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6813 | run_test "Small client packet TLS 1.1 BlockCipher, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6814 | "$P_SRV trunc_hmac=1" \ |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6815 | "$P_CLI request_size=1 force_version=tls1_1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6816 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1" \ |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6817 | 0 \ |
| 6818 | -s "Read from client: 1 bytes read" |
| 6819 | |
| 6820 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6821 | run_test "Small client packet TLS 1.1 BlockCipher, without EtM, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6822 | "$P_SRV trunc_hmac=1" \ |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6823 | "$P_CLI request_size=1 force_version=tls1_1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6824 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1 etm=0" \ |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 6825 | 0 \ |
| 6826 | -s "Read from client: 1 bytes read" |
| 6827 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6828 | run_test "Small client packet TLS 1.1 StreamCipher" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 6829 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6830 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 6831 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 6832 | 0 \ |
| 6833 | -s "Read from client: 1 bytes read" |
| 6834 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6835 | run_test "Small client packet TLS 1.1 StreamCipher, without EtM" \ |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6836 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6837 | "$P_CLI request_size=1 force_version=tls1_1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6838 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA etm=0" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6839 | 0 \ |
| 6840 | -s "Read from client: 1 bytes read" |
| 6841 | |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6842 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6843 | run_test "Small client packet TLS 1.1 StreamCipher, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6844 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6845 | "$P_CLI request_size=1 force_version=tls1_1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6846 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6847 | 0 \ |
| 6848 | -s "Read from client: 1 bytes read" |
| 6849 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 6850 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6851 | run_test "Small client packet TLS 1.1 StreamCipher, without EtM, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6852 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6853 | "$P_CLI request_size=1 force_version=tls1_1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6854 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1 etm=0" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6855 | 0 \ |
| 6856 | -s "Read from client: 1 bytes read" |
| 6857 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6858 | run_test "Small client packet TLS 1.2 BlockCipher" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6859 | "$P_SRV" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6860 | "$P_CLI request_size=1 force_version=tls12 \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6861 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 6862 | 0 \ |
| 6863 | -s "Read from client: 1 bytes read" |
| 6864 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6865 | run_test "Small client packet TLS 1.2 BlockCipher, without EtM" \ |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 6866 | "$P_SRV" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6867 | "$P_CLI request_size=1 force_version=tls12 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6868 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA etm=0" \ |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 6869 | 0 \ |
| 6870 | -s "Read from client: 1 bytes read" |
| 6871 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6872 | run_test "Small client packet TLS 1.2 BlockCipher larger MAC" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6873 | "$P_SRV" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6874 | "$P_CLI request_size=1 force_version=tls12 \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 6875 | force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6876 | 0 \ |
| 6877 | -s "Read from client: 1 bytes read" |
| 6878 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 6879 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6880 | run_test "Small client packet TLS 1.2 BlockCipher, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6881 | "$P_SRV trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6882 | "$P_CLI request_size=1 force_version=tls12 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6883 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6884 | 0 \ |
| 6885 | -s "Read from client: 1 bytes read" |
| 6886 | |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6887 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6888 | run_test "Small client packet TLS 1.2 BlockCipher, without EtM, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6889 | "$P_SRV trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6890 | "$P_CLI request_size=1 force_version=tls12 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6891 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1 etm=0" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6892 | 0 \ |
| 6893 | -s "Read from client: 1 bytes read" |
| 6894 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6895 | run_test "Small client packet TLS 1.2 StreamCipher" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 6896 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6897 | "$P_CLI request_size=1 force_version=tls12 \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6898 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 6899 | 0 \ |
| 6900 | -s "Read from client: 1 bytes read" |
| 6901 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6902 | run_test "Small client packet TLS 1.2 StreamCipher, without EtM" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 6903 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6904 | "$P_CLI request_size=1 force_version=tls12 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6905 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA etm=0" \ |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6906 | 0 \ |
| 6907 | -s "Read from client: 1 bytes read" |
| 6908 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 6909 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6910 | run_test "Small client packet TLS 1.2 StreamCipher, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6911 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6912 | "$P_CLI request_size=1 force_version=tls12 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6913 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6914 | 0 \ |
| 6915 | -s "Read from client: 1 bytes read" |
| 6916 | |
Hanno Becker | 8501f98 | 2017-11-10 08:59:04 +0000 | [diff] [blame] | 6917 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6918 | run_test "Small client packet TLS 1.2 StreamCipher, without EtM, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6919 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6920 | "$P_CLI request_size=1 force_version=tls12 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6921 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1 etm=0" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6922 | 0 \ |
| 6923 | -s "Read from client: 1 bytes read" |
| 6924 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6925 | run_test "Small client packet TLS 1.2 AEAD" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6926 | "$P_SRV" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6927 | "$P_CLI request_size=1 force_version=tls12 \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6928 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 6929 | 0 \ |
| 6930 | -s "Read from client: 1 bytes read" |
| 6931 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6932 | run_test "Small client packet TLS 1.2 AEAD shorter tag" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6933 | "$P_SRV" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6934 | "$P_CLI request_size=1 force_version=tls12 \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 6935 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 6936 | 0 \ |
| 6937 | -s "Read from client: 1 bytes read" |
| 6938 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6939 | # Tests for small client packets in DTLS |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 6940 | |
| 6941 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6942 | run_test "Small client packet DTLS 1.0" \ |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 6943 | "$P_SRV dtls=1 force_version=dtls1" \ |
| 6944 | "$P_CLI dtls=1 request_size=1 \ |
| 6945 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 6946 | 0 \ |
| 6947 | -s "Read from client: 1 bytes read" |
| 6948 | |
| 6949 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6950 | run_test "Small client packet DTLS 1.0, without EtM" \ |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 6951 | "$P_SRV dtls=1 force_version=dtls1 etm=0" \ |
| 6952 | "$P_CLI dtls=1 request_size=1 \ |
| 6953 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 6954 | 0 \ |
| 6955 | -s "Read from client: 1 bytes read" |
| 6956 | |
| 6957 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 6958 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6959 | run_test "Small client packet DTLS 1.0, truncated hmac" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6960 | "$P_SRV dtls=1 force_version=dtls1 trunc_hmac=1" \ |
| 6961 | "$P_CLI dtls=1 request_size=1 trunc_hmac=1 \ |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 6962 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 6963 | 0 \ |
| 6964 | -s "Read from client: 1 bytes read" |
| 6965 | |
| 6966 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 6967 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6968 | run_test "Small client packet DTLS 1.0, without EtM, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6969 | "$P_SRV dtls=1 force_version=dtls1 trunc_hmac=1 etm=0" \ |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 6970 | "$P_CLI dtls=1 request_size=1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6971 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1"\ |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 6972 | 0 \ |
| 6973 | -s "Read from client: 1 bytes read" |
| 6974 | |
| 6975 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6976 | run_test "Small client packet DTLS 1.2" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6977 | "$P_SRV dtls=1 force_version=dtls12" \ |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 6978 | "$P_CLI dtls=1 request_size=1 \ |
| 6979 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 6980 | 0 \ |
| 6981 | -s "Read from client: 1 bytes read" |
| 6982 | |
| 6983 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6984 | run_test "Small client packet DTLS 1.2, without EtM" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6985 | "$P_SRV dtls=1 force_version=dtls12 etm=0" \ |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 6986 | "$P_CLI dtls=1 request_size=1 \ |
| 6987 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 6988 | 0 \ |
| 6989 | -s "Read from client: 1 bytes read" |
| 6990 | |
| 6991 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 6992 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 6993 | run_test "Small client packet DTLS 1.2, truncated hmac" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 6994 | "$P_SRV dtls=1 force_version=dtls12 trunc_hmac=1" \ |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 6995 | "$P_CLI dtls=1 request_size=1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 6996 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1" \ |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 6997 | 0 \ |
| 6998 | -s "Read from client: 1 bytes read" |
| 6999 | |
| 7000 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 7001 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7002 | run_test "Small client packet DTLS 1.2, without EtM, truncated MAC" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7003 | "$P_SRV dtls=1 force_version=dtls12 trunc_hmac=1 etm=0" \ |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 7004 | "$P_CLI dtls=1 request_size=1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7005 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1"\ |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 7006 | 0 \ |
| 7007 | -s "Read from client: 1 bytes read" |
| 7008 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7009 | # Tests for small server packets |
| 7010 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7011 | run_test "Small server packet SSLv3 BlockCipher" \ |
| 7012 | "$P_SRV response_size=1 min_version=ssl3" \ |
| 7013 | "$P_CLI force_version=ssl3 \ |
| 7014 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7015 | 0 \ |
| 7016 | -c "Read from server: 1 bytes read" |
| 7017 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7018 | run_test "Small server packet SSLv3 StreamCipher" \ |
| 7019 | "$P_SRV response_size=1 min_version=ssl3 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7020 | "$P_CLI force_version=ssl3 \ |
| 7021 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7022 | 0 \ |
| 7023 | -c "Read from server: 1 bytes read" |
| 7024 | |
| 7025 | run_test "Small server packet TLS 1.0 BlockCipher" \ |
| 7026 | "$P_SRV response_size=1" \ |
| 7027 | "$P_CLI force_version=tls1 \ |
| 7028 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7029 | 0 \ |
| 7030 | -c "Read from server: 1 bytes read" |
| 7031 | |
| 7032 | run_test "Small server packet TLS 1.0 BlockCipher, without EtM" \ |
| 7033 | "$P_SRV response_size=1" \ |
| 7034 | "$P_CLI force_version=tls1 etm=0 \ |
| 7035 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7036 | 0 \ |
| 7037 | -c "Read from server: 1 bytes read" |
| 7038 | |
| 7039 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7040 | run_test "Small server packet TLS 1.0 BlockCipher, truncated MAC" \ |
| 7041 | "$P_SRV response_size=1 trunc_hmac=1" \ |
| 7042 | "$P_CLI force_version=tls1 \ |
| 7043 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1" \ |
| 7044 | 0 \ |
| 7045 | -c "Read from server: 1 bytes read" |
| 7046 | |
| 7047 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7048 | run_test "Small server packet TLS 1.0 BlockCipher, without EtM, truncated MAC" \ |
| 7049 | "$P_SRV response_size=1 trunc_hmac=1" \ |
| 7050 | "$P_CLI force_version=tls1 \ |
| 7051 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1 etm=0" \ |
| 7052 | 0 \ |
| 7053 | -c "Read from server: 1 bytes read" |
| 7054 | |
| 7055 | run_test "Small server packet TLS 1.0 StreamCipher" \ |
| 7056 | "$P_SRV response_size=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7057 | "$P_CLI force_version=tls1 \ |
| 7058 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7059 | 0 \ |
| 7060 | -c "Read from server: 1 bytes read" |
| 7061 | |
| 7062 | run_test "Small server packet TLS 1.0 StreamCipher, without EtM" \ |
| 7063 | "$P_SRV response_size=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7064 | "$P_CLI force_version=tls1 \ |
| 7065 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA etm=0" \ |
| 7066 | 0 \ |
| 7067 | -c "Read from server: 1 bytes read" |
| 7068 | |
| 7069 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7070 | run_test "Small server packet TLS 1.0 StreamCipher, truncated MAC" \ |
| 7071 | "$P_SRV response_size=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
| 7072 | "$P_CLI force_version=tls1 \ |
| 7073 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
| 7074 | 0 \ |
| 7075 | -c "Read from server: 1 bytes read" |
| 7076 | |
| 7077 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7078 | run_test "Small server packet TLS 1.0 StreamCipher, without EtM, truncated MAC" \ |
| 7079 | "$P_SRV response_size=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
| 7080 | "$P_CLI force_version=tls1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 7081 | trunc_hmac=1 etm=0" \ |
| 7082 | 0 \ |
| 7083 | -c "Read from server: 1 bytes read" |
| 7084 | |
| 7085 | run_test "Small server packet TLS 1.1 BlockCipher" \ |
| 7086 | "$P_SRV response_size=1" \ |
| 7087 | "$P_CLI force_version=tls1_1 \ |
| 7088 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7089 | 0 \ |
| 7090 | -c "Read from server: 1 bytes read" |
| 7091 | |
| 7092 | run_test "Small server packet TLS 1.1 BlockCipher, without EtM" \ |
| 7093 | "$P_SRV response_size=1" \ |
| 7094 | "$P_CLI force_version=tls1_1 \ |
| 7095 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA etm=0" \ |
| 7096 | 0 \ |
| 7097 | -c "Read from server: 1 bytes read" |
| 7098 | |
| 7099 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7100 | run_test "Small server packet TLS 1.1 BlockCipher, truncated MAC" \ |
| 7101 | "$P_SRV response_size=1 trunc_hmac=1" \ |
| 7102 | "$P_CLI force_version=tls1_1 \ |
| 7103 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1" \ |
| 7104 | 0 \ |
| 7105 | -c "Read from server: 1 bytes read" |
| 7106 | |
| 7107 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7108 | run_test "Small server packet TLS 1.1 BlockCipher, without EtM, truncated MAC" \ |
| 7109 | "$P_SRV response_size=1 trunc_hmac=1" \ |
| 7110 | "$P_CLI force_version=tls1_1 \ |
| 7111 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1 etm=0" \ |
| 7112 | 0 \ |
| 7113 | -c "Read from server: 1 bytes read" |
| 7114 | |
| 7115 | run_test "Small server packet TLS 1.1 StreamCipher" \ |
| 7116 | "$P_SRV response_size=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7117 | "$P_CLI force_version=tls1_1 \ |
| 7118 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7119 | 0 \ |
| 7120 | -c "Read from server: 1 bytes read" |
| 7121 | |
| 7122 | run_test "Small server packet TLS 1.1 StreamCipher, without EtM" \ |
| 7123 | "$P_SRV response_size=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7124 | "$P_CLI force_version=tls1_1 \ |
| 7125 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA etm=0" \ |
| 7126 | 0 \ |
| 7127 | -c "Read from server: 1 bytes read" |
| 7128 | |
| 7129 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7130 | run_test "Small server packet TLS 1.1 StreamCipher, truncated MAC" \ |
| 7131 | "$P_SRV response_size=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
| 7132 | "$P_CLI force_version=tls1_1 \ |
| 7133 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
| 7134 | 0 \ |
| 7135 | -c "Read from server: 1 bytes read" |
| 7136 | |
| 7137 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7138 | run_test "Small server packet TLS 1.1 StreamCipher, without EtM, truncated MAC" \ |
| 7139 | "$P_SRV response_size=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
| 7140 | "$P_CLI force_version=tls1_1 \ |
| 7141 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1 etm=0" \ |
| 7142 | 0 \ |
| 7143 | -c "Read from server: 1 bytes read" |
| 7144 | |
| 7145 | run_test "Small server packet TLS 1.2 BlockCipher" \ |
| 7146 | "$P_SRV response_size=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7147 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7148 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7149 | 0 \ |
| 7150 | -c "Read from server: 1 bytes read" |
| 7151 | |
| 7152 | run_test "Small server packet TLS 1.2 BlockCipher, without EtM" \ |
| 7153 | "$P_SRV response_size=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7154 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7155 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA etm=0" \ |
| 7156 | 0 \ |
| 7157 | -c "Read from server: 1 bytes read" |
| 7158 | |
| 7159 | run_test "Small server packet TLS 1.2 BlockCipher larger MAC" \ |
| 7160 | "$P_SRV response_size=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7161 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7162 | force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
| 7163 | 0 \ |
| 7164 | -c "Read from server: 1 bytes read" |
| 7165 | |
| 7166 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7167 | run_test "Small server packet TLS 1.2 BlockCipher, truncated MAC" \ |
| 7168 | "$P_SRV response_size=1 trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7169 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7170 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1" \ |
| 7171 | 0 \ |
| 7172 | -c "Read from server: 1 bytes read" |
| 7173 | |
| 7174 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7175 | run_test "Small server packet TLS 1.2 BlockCipher, without EtM, truncated MAC" \ |
| 7176 | "$P_SRV response_size=1 trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7177 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7178 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1 etm=0" \ |
| 7179 | 0 \ |
| 7180 | -c "Read from server: 1 bytes read" |
| 7181 | |
| 7182 | run_test "Small server packet TLS 1.2 StreamCipher" \ |
| 7183 | "$P_SRV response_size=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7184 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7185 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7186 | 0 \ |
| 7187 | -c "Read from server: 1 bytes read" |
| 7188 | |
| 7189 | run_test "Small server packet TLS 1.2 StreamCipher, without EtM" \ |
| 7190 | "$P_SRV response_size=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7191 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7192 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA etm=0" \ |
| 7193 | 0 \ |
| 7194 | -c "Read from server: 1 bytes read" |
| 7195 | |
| 7196 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7197 | run_test "Small server packet TLS 1.2 StreamCipher, truncated MAC" \ |
| 7198 | "$P_SRV response_size=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7199 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7200 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
| 7201 | 0 \ |
| 7202 | -c "Read from server: 1 bytes read" |
| 7203 | |
| 7204 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7205 | run_test "Small server packet TLS 1.2 StreamCipher, without EtM, truncated MAC" \ |
| 7206 | "$P_SRV response_size=1 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7207 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7208 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1 etm=0" \ |
| 7209 | 0 \ |
| 7210 | -c "Read from server: 1 bytes read" |
| 7211 | |
| 7212 | run_test "Small server packet TLS 1.2 AEAD" \ |
| 7213 | "$P_SRV response_size=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7214 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7215 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 7216 | 0 \ |
| 7217 | -c "Read from server: 1 bytes read" |
| 7218 | |
| 7219 | run_test "Small server packet TLS 1.2 AEAD shorter tag" \ |
| 7220 | "$P_SRV response_size=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7221 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7222 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 7223 | 0 \ |
| 7224 | -c "Read from server: 1 bytes read" |
| 7225 | |
| 7226 | # Tests for small server packets in DTLS |
| 7227 | |
| 7228 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 7229 | run_test "Small server packet DTLS 1.0" \ |
| 7230 | "$P_SRV dtls=1 response_size=1 force_version=dtls1" \ |
| 7231 | "$P_CLI dtls=1 \ |
| 7232 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7233 | 0 \ |
| 7234 | -c "Read from server: 1 bytes read" |
| 7235 | |
| 7236 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 7237 | run_test "Small server packet DTLS 1.0, without EtM" \ |
| 7238 | "$P_SRV dtls=1 response_size=1 force_version=dtls1 etm=0" \ |
| 7239 | "$P_CLI dtls=1 \ |
| 7240 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7241 | 0 \ |
| 7242 | -c "Read from server: 1 bytes read" |
| 7243 | |
| 7244 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 7245 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7246 | run_test "Small server packet DTLS 1.0, truncated hmac" \ |
| 7247 | "$P_SRV dtls=1 response_size=1 force_version=dtls1 trunc_hmac=1" \ |
| 7248 | "$P_CLI dtls=1 trunc_hmac=1 \ |
| 7249 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7250 | 0 \ |
| 7251 | -c "Read from server: 1 bytes read" |
| 7252 | |
| 7253 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 7254 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7255 | run_test "Small server packet DTLS 1.0, without EtM, truncated MAC" \ |
| 7256 | "$P_SRV dtls=1 response_size=1 force_version=dtls1 trunc_hmac=1 etm=0" \ |
| 7257 | "$P_CLI dtls=1 \ |
| 7258 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1"\ |
| 7259 | 0 \ |
| 7260 | -c "Read from server: 1 bytes read" |
| 7261 | |
| 7262 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 7263 | run_test "Small server packet DTLS 1.2" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7264 | "$P_SRV dtls=1 response_size=1 force_version=dtls12" \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7265 | "$P_CLI dtls=1 \ |
| 7266 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7267 | 0 \ |
| 7268 | -c "Read from server: 1 bytes read" |
| 7269 | |
| 7270 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 7271 | run_test "Small server packet DTLS 1.2, without EtM" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7272 | "$P_SRV dtls=1 response_size=1 force_version=dtls12 etm=0" \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7273 | "$P_CLI dtls=1 \ |
| 7274 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7275 | 0 \ |
| 7276 | -c "Read from server: 1 bytes read" |
| 7277 | |
| 7278 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 7279 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7280 | run_test "Small server packet DTLS 1.2, truncated hmac" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7281 | "$P_SRV dtls=1 response_size=1 force_version=dtls12 trunc_hmac=1" \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7282 | "$P_CLI dtls=1 \ |
| 7283 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1" \ |
| 7284 | 0 \ |
| 7285 | -c "Read from server: 1 bytes read" |
| 7286 | |
| 7287 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 7288 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7289 | run_test "Small server packet DTLS 1.2, without EtM, truncated MAC" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7290 | "$P_SRV dtls=1 response_size=1 force_version=dtls12 trunc_hmac=1 etm=0" \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7291 | "$P_CLI dtls=1 \ |
| 7292 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1"\ |
| 7293 | 0 \ |
| 7294 | -c "Read from server: 1 bytes read" |
| 7295 | |
Janos Follath | 00efff7 | 2016-05-06 13:48:23 +0100 | [diff] [blame] | 7296 | # A test for extensions in SSLv3 |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 7297 | requires_max_content_len 4096 |
Janos Follath | 00efff7 | 2016-05-06 13:48:23 +0100 | [diff] [blame] | 7298 | run_test "SSLv3 with extensions, server side" \ |
| 7299 | "$P_SRV min_version=ssl3 debug_level=3" \ |
| 7300 | "$P_CLI force_version=ssl3 tickets=1 max_frag_len=4096 alpn=abc,1234" \ |
| 7301 | 0 \ |
| 7302 | -S "dumping 'client hello extensions'" \ |
| 7303 | -S "server hello, total extension length:" |
| 7304 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7305 | # Test for large client packets |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7306 | |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7307 | # How many fragments do we expect to write $1 bytes? |
| 7308 | fragments_for_write() { |
| 7309 | echo "$(( ( $1 + $MAX_OUT_LEN - 1 ) / $MAX_OUT_LEN ))" |
| 7310 | } |
| 7311 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7312 | run_test "Large client packet SSLv3 BlockCipher" \ |
Manuel Pégourié-Gonnard | 448ea50 | 2015-01-12 11:40:14 +0100 | [diff] [blame] | 7313 | "$P_SRV min_version=ssl3" \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 7314 | "$P_CLI request_size=16384 force_version=ssl3 recsplit=0 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7315 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7316 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7317 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7318 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7319 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7320 | run_test "Large client packet SSLv3 StreamCipher" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 7321 | "$P_SRV min_version=ssl3 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7322 | "$P_CLI request_size=16384 force_version=ssl3 \ |
| 7323 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7324 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7325 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7326 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7327 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7328 | run_test "Large client packet TLS 1.0 BlockCipher" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7329 | "$P_SRV" \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 7330 | "$P_CLI request_size=16384 force_version=tls1 recsplit=0 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7331 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7332 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7333 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7334 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7335 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7336 | run_test "Large client packet TLS 1.0 BlockCipher, without EtM" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7337 | "$P_SRV" \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7338 | "$P_CLI request_size=16384 force_version=tls1 etm=0 recsplit=0 \ |
| 7339 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7340 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7341 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7342 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 7343 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7344 | run_test "Large client packet TLS 1.0 BlockCipher, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7345 | "$P_SRV trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 7346 | "$P_CLI request_size=16384 force_version=tls1 recsplit=0 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7347 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7348 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7349 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7350 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7351 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 7352 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7353 | run_test "Large client packet TLS 1.0 BlockCipher, without EtM, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7354 | "$P_SRV trunc_hmac=1" \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7355 | "$P_CLI request_size=16384 force_version=tls1 etm=0 recsplit=0 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7356 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1" \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7357 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7358 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7359 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7360 | run_test "Large client packet TLS 1.0 StreamCipher" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 7361 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7362 | "$P_CLI request_size=16384 force_version=tls1 \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7363 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7364 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7365 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7366 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7367 | run_test "Large client packet TLS 1.0 StreamCipher, without EtM" \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7368 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7369 | "$P_CLI request_size=16384 force_version=tls1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7370 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA etm=0" \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7371 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7372 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7373 | |
| 7374 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7375 | run_test "Large client packet TLS 1.0 StreamCipher, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7376 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7377 | "$P_CLI request_size=16384 force_version=tls1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7378 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7379 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7380 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7381 | |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7382 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7383 | run_test "Large client packet TLS 1.0 StreamCipher, without EtM, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7384 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7385 | "$P_CLI request_size=16384 force_version=tls1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7386 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1 etm=0" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7387 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7388 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7389 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7390 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7391 | run_test "Large client packet TLS 1.1 BlockCipher" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7392 | "$P_SRV" \ |
| 7393 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 7394 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7395 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7396 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7397 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7398 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7399 | run_test "Large client packet TLS 1.1 BlockCipher, without EtM" \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7400 | "$P_SRV" \ |
| 7401 | "$P_CLI request_size=16384 force_version=tls1_1 etm=0 \ |
| 7402 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7403 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7404 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7405 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 7406 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7407 | run_test "Large client packet TLS 1.1 BlockCipher, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7408 | "$P_SRV trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7409 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7410 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7411 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7412 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7413 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 7414 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7415 | run_test "Large client packet TLS 1.1 BlockCipher, without EtM, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7416 | "$P_SRV trunc_hmac=1" \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7417 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7418 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1 etm=0" \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7419 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7420 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7421 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7422 | run_test "Large client packet TLS 1.1 StreamCipher" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7423 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7424 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 7425 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7426 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7427 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7428 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7429 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7430 | run_test "Large client packet TLS 1.1 StreamCipher, without EtM" \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7431 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7432 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7433 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA etm=0" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7434 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7435 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7436 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7437 | |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7438 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7439 | run_test "Large client packet TLS 1.1 StreamCipher, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7440 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7441 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7442 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7443 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7444 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7445 | |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7446 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7447 | run_test "Large client packet TLS 1.1 StreamCipher, without EtM, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7448 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7449 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7450 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1 etm=0" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7451 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7452 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7453 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7454 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7455 | run_test "Large client packet TLS 1.2 BlockCipher" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7456 | "$P_SRV" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7457 | "$P_CLI request_size=16384 force_version=tls12 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7458 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7459 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7460 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7461 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7462 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7463 | run_test "Large client packet TLS 1.2 BlockCipher, without EtM" \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7464 | "$P_SRV" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7465 | "$P_CLI request_size=16384 force_version=tls12 etm=0 \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7466 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7467 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7468 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7469 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7470 | run_test "Large client packet TLS 1.2 BlockCipher larger MAC" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7471 | "$P_SRV" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7472 | "$P_CLI request_size=16384 force_version=tls12 \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 7473 | force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7474 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7475 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7476 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7477 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 7478 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7479 | run_test "Large client packet TLS 1.2 BlockCipher, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7480 | "$P_SRV trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7481 | "$P_CLI request_size=16384 force_version=tls12 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7482 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7483 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7484 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7485 | |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7486 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7487 | run_test "Large client packet TLS 1.2 BlockCipher, without EtM, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7488 | "$P_SRV trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7489 | "$P_CLI request_size=16384 force_version=tls12 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7490 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1 etm=0" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7491 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7492 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7493 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7494 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7495 | run_test "Large client packet TLS 1.2 StreamCipher" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 7496 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7497 | "$P_CLI request_size=16384 force_version=tls12 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7498 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7499 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7500 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7501 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7502 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7503 | run_test "Large client packet TLS 1.2 StreamCipher, without EtM" \ |
Manuel Pégourié-Gonnard | ea0920f | 2015-03-24 09:50:15 +0100 | [diff] [blame] | 7504 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7505 | "$P_CLI request_size=16384 force_version=tls12 \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7506 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA etm=0" \ |
| 7507 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7508 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7509 | |
Hanno Becker | 32c5501 | 2017-11-10 08:42:54 +0000 | [diff] [blame] | 7510 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7511 | run_test "Large client packet TLS 1.2 StreamCipher, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7512 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7513 | "$P_CLI request_size=16384 force_version=tls12 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7514 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7515 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7516 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7517 | |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 7518 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7519 | run_test "Large client packet TLS 1.2 StreamCipher, without EtM, truncated MAC" \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7520 | "$P_SRV arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7521 | "$P_CLI request_size=16384 force_version=tls12 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 7522 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1 etm=0" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7523 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7524 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7525 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7526 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7527 | run_test "Large client packet TLS 1.2 AEAD" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7528 | "$P_SRV" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7529 | "$P_CLI request_size=16384 force_version=tls12 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7530 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 7531 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7532 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7533 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7534 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7535 | run_test "Large client packet TLS 1.2 AEAD shorter tag" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7536 | "$P_SRV" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7537 | "$P_CLI request_size=16384 force_version=tls12 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7538 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 7539 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 7540 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 7541 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 7542 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7543 | # Test for large server packets |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 7544 | # The tests below fail when the server's OUT_CONTENT_LEN is less than 16384. |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7545 | run_test "Large server packet SSLv3 StreamCipher" \ |
| 7546 | "$P_SRV response_size=16384 min_version=ssl3 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7547 | "$P_CLI force_version=ssl3 \ |
| 7548 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7549 | 0 \ |
| 7550 | -c "Read from server: 16384 bytes read" |
| 7551 | |
Andrzej Kurek | 6a4f224 | 2018-08-27 08:00:13 -0400 | [diff] [blame] | 7552 | # Checking next 4 tests logs for 1n-1 split against BEAST too |
Andrzej Kurek | 6a4f224 | 2018-08-27 08:00:13 -0400 | [diff] [blame] | 7553 | run_test "Large server packet SSLv3 BlockCipher" \ |
| 7554 | "$P_SRV response_size=16384 min_version=ssl3" \ |
| 7555 | "$P_CLI force_version=ssl3 recsplit=0 \ |
| 7556 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7557 | 0 \ |
| 7558 | -c "Read from server: 1 bytes read"\ |
| 7559 | -c "16383 bytes read"\ |
| 7560 | -C "Read from server: 16384 bytes read" |
| 7561 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7562 | run_test "Large server packet TLS 1.0 BlockCipher" \ |
| 7563 | "$P_SRV response_size=16384" \ |
| 7564 | "$P_CLI force_version=tls1 recsplit=0 \ |
| 7565 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7566 | 0 \ |
| 7567 | -c "Read from server: 1 bytes read"\ |
| 7568 | -c "16383 bytes read"\ |
| 7569 | -C "Read from server: 16384 bytes read" |
| 7570 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7571 | run_test "Large server packet TLS 1.0 BlockCipher, without EtM" \ |
| 7572 | "$P_SRV response_size=16384" \ |
| 7573 | "$P_CLI force_version=tls1 etm=0 recsplit=0 \ |
| 7574 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7575 | 0 \ |
| 7576 | -c "Read from server: 1 bytes read"\ |
| 7577 | -c "16383 bytes read"\ |
| 7578 | -C "Read from server: 16384 bytes read" |
| 7579 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7580 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7581 | run_test "Large server packet TLS 1.0 BlockCipher truncated MAC" \ |
| 7582 | "$P_SRV response_size=16384" \ |
| 7583 | "$P_CLI force_version=tls1 recsplit=0 \ |
| 7584 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 7585 | trunc_hmac=1" \ |
| 7586 | 0 \ |
| 7587 | -c "Read from server: 1 bytes read"\ |
| 7588 | -c "16383 bytes read"\ |
| 7589 | -C "Read from server: 16384 bytes read" |
| 7590 | |
| 7591 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7592 | run_test "Large server packet TLS 1.0 StreamCipher truncated MAC" \ |
| 7593 | "$P_SRV response_size=16384 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7594 | "$P_CLI force_version=tls1 \ |
| 7595 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 7596 | trunc_hmac=1" \ |
| 7597 | 0 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7598 | -s "16384 bytes written in 1 fragments" \ |
| 7599 | -c "Read from server: 16384 bytes read" |
| 7600 | |
| 7601 | run_test "Large server packet TLS 1.0 StreamCipher" \ |
| 7602 | "$P_SRV response_size=16384 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7603 | "$P_CLI force_version=tls1 \ |
| 7604 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7605 | 0 \ |
| 7606 | -s "16384 bytes written in 1 fragments" \ |
| 7607 | -c "Read from server: 16384 bytes read" |
| 7608 | |
| 7609 | run_test "Large server packet TLS 1.0 StreamCipher, without EtM" \ |
| 7610 | "$P_SRV response_size=16384 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7611 | "$P_CLI force_version=tls1 \ |
| 7612 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA etm=0" \ |
| 7613 | 0 \ |
| 7614 | -s "16384 bytes written in 1 fragments" \ |
| 7615 | -c "Read from server: 16384 bytes read" |
| 7616 | |
| 7617 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7618 | run_test "Large server packet TLS 1.0 StreamCipher, truncated MAC" \ |
| 7619 | "$P_SRV response_size=16384 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
| 7620 | "$P_CLI force_version=tls1 \ |
| 7621 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
| 7622 | 0 \ |
| 7623 | -s "16384 bytes written in 1 fragments" \ |
| 7624 | -c "Read from server: 16384 bytes read" |
| 7625 | |
| 7626 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7627 | run_test "Large server packet TLS 1.0 StreamCipher, without EtM, truncated MAC" \ |
| 7628 | "$P_SRV response_size=16384 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
| 7629 | "$P_CLI force_version=tls1 \ |
| 7630 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1 etm=0" \ |
| 7631 | 0 \ |
| 7632 | -s "16384 bytes written in 1 fragments" \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7633 | -c "Read from server: 16384 bytes read" |
| 7634 | |
| 7635 | run_test "Large server packet TLS 1.1 BlockCipher" \ |
| 7636 | "$P_SRV response_size=16384" \ |
| 7637 | "$P_CLI force_version=tls1_1 \ |
| 7638 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7639 | 0 \ |
| 7640 | -c "Read from server: 16384 bytes read" |
| 7641 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7642 | run_test "Large server packet TLS 1.1 BlockCipher, without EtM" \ |
| 7643 | "$P_SRV response_size=16384" \ |
| 7644 | "$P_CLI force_version=tls1_1 etm=0 \ |
| 7645 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7646 | 0 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7647 | -s "16384 bytes written in 1 fragments" \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7648 | -c "Read from server: 16384 bytes read" |
| 7649 | |
| 7650 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7651 | run_test "Large server packet TLS 1.1 BlockCipher truncated MAC" \ |
| 7652 | "$P_SRV response_size=16384" \ |
| 7653 | "$P_CLI force_version=tls1_1 \ |
| 7654 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 7655 | trunc_hmac=1" \ |
| 7656 | 0 \ |
| 7657 | -c "Read from server: 16384 bytes read" |
| 7658 | |
| 7659 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7660 | run_test "Large server packet TLS 1.1 BlockCipher, without EtM, truncated MAC" \ |
| 7661 | "$P_SRV response_size=16384 trunc_hmac=1" \ |
| 7662 | "$P_CLI force_version=tls1_1 \ |
| 7663 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1 etm=0" \ |
| 7664 | 0 \ |
| 7665 | -s "16384 bytes written in 1 fragments" \ |
| 7666 | -c "Read from server: 16384 bytes read" |
| 7667 | |
| 7668 | run_test "Large server packet TLS 1.1 StreamCipher" \ |
| 7669 | "$P_SRV response_size=16384 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7670 | "$P_CLI force_version=tls1_1 \ |
| 7671 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7672 | 0 \ |
| 7673 | -c "Read from server: 16384 bytes read" |
| 7674 | |
| 7675 | run_test "Large server packet TLS 1.1 StreamCipher, without EtM" \ |
| 7676 | "$P_SRV response_size=16384 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7677 | "$P_CLI force_version=tls1_1 \ |
| 7678 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA etm=0" \ |
| 7679 | 0 \ |
| 7680 | -s "16384 bytes written in 1 fragments" \ |
| 7681 | -c "Read from server: 16384 bytes read" |
| 7682 | |
| 7683 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7684 | run_test "Large server packet TLS 1.1 StreamCipher truncated MAC" \ |
| 7685 | "$P_SRV response_size=16384 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7686 | "$P_CLI force_version=tls1_1 \ |
| 7687 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 7688 | trunc_hmac=1" \ |
| 7689 | 0 \ |
| 7690 | -c "Read from server: 16384 bytes read" |
| 7691 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7692 | run_test "Large server packet TLS 1.1 StreamCipher, without EtM, truncated MAC" \ |
| 7693 | "$P_SRV response_size=16384 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
| 7694 | "$P_CLI force_version=tls1_1 \ |
| 7695 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1 etm=0" \ |
| 7696 | 0 \ |
| 7697 | -s "16384 bytes written in 1 fragments" \ |
| 7698 | -c "Read from server: 16384 bytes read" |
| 7699 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7700 | run_test "Large server packet TLS 1.2 BlockCipher" \ |
| 7701 | "$P_SRV response_size=16384" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7702 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7703 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7704 | 0 \ |
| 7705 | -c "Read from server: 16384 bytes read" |
| 7706 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7707 | run_test "Large server packet TLS 1.2 BlockCipher, without EtM" \ |
| 7708 | "$P_SRV response_size=16384" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7709 | "$P_CLI force_version=tls12 etm=0 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7710 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 7711 | 0 \ |
| 7712 | -s "16384 bytes written in 1 fragments" \ |
| 7713 | -c "Read from server: 16384 bytes read" |
| 7714 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7715 | run_test "Large server packet TLS 1.2 BlockCipher larger MAC" \ |
| 7716 | "$P_SRV response_size=16384" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7717 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7718 | force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
| 7719 | 0 \ |
| 7720 | -c "Read from server: 16384 bytes read" |
| 7721 | |
| 7722 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7723 | run_test "Large server packet TLS 1.2 BlockCipher truncated MAC" \ |
| 7724 | "$P_SRV response_size=16384" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7725 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7726 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 7727 | trunc_hmac=1" \ |
| 7728 | 0 \ |
| 7729 | -c "Read from server: 16384 bytes read" |
| 7730 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7731 | run_test "Large server packet TLS 1.2 BlockCipher, without EtM, truncated MAC" \ |
| 7732 | "$P_SRV response_size=16384 trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7733 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7734 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1 etm=0" \ |
| 7735 | 0 \ |
| 7736 | -s "16384 bytes written in 1 fragments" \ |
| 7737 | -c "Read from server: 16384 bytes read" |
| 7738 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7739 | run_test "Large server packet TLS 1.2 StreamCipher" \ |
| 7740 | "$P_SRV response_size=16384 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7741 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7742 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 7743 | 0 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7744 | -s "16384 bytes written in 1 fragments" \ |
| 7745 | -c "Read from server: 16384 bytes read" |
| 7746 | |
| 7747 | run_test "Large server packet TLS 1.2 StreamCipher, without EtM" \ |
| 7748 | "$P_SRV response_size=16384 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7749 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7750 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA etm=0" \ |
| 7751 | 0 \ |
| 7752 | -s "16384 bytes written in 1 fragments" \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7753 | -c "Read from server: 16384 bytes read" |
| 7754 | |
| 7755 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7756 | run_test "Large server packet TLS 1.2 StreamCipher truncated MAC" \ |
| 7757 | "$P_SRV response_size=16384 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7758 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7759 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 7760 | trunc_hmac=1" \ |
| 7761 | 0 \ |
| 7762 | -c "Read from server: 16384 bytes read" |
| 7763 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7764 | requires_config_enabled MBEDTLS_SSL_TRUNCATED_HMAC |
| 7765 | run_test "Large server packet TLS 1.2 StreamCipher, without EtM, truncated MAC" \ |
| 7766 | "$P_SRV response_size=16384 arc4=1 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7767 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 7768 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA trunc_hmac=1 etm=0" \ |
| 7769 | 0 \ |
| 7770 | -s "16384 bytes written in 1 fragments" \ |
| 7771 | -c "Read from server: 16384 bytes read" |
| 7772 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7773 | run_test "Large server packet TLS 1.2 AEAD" \ |
| 7774 | "$P_SRV response_size=16384" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7775 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7776 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 7777 | 0 \ |
| 7778 | -c "Read from server: 16384 bytes read" |
| 7779 | |
| 7780 | run_test "Large server packet TLS 1.2 AEAD shorter tag" \ |
| 7781 | "$P_SRV response_size=16384" \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7782 | "$P_CLI force_version=tls12 \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 7783 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 7784 | 0 \ |
| 7785 | -c "Read from server: 16384 bytes read" |
| 7786 | |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7787 | # Tests for restartable ECC |
| 7788 | |
Manuel Pégourié-Gonnard | 875d1eb | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 7789 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
| 7790 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7791 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
| 7792 | run_test "EC restart: TLS, default" \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 7793 | "$P_SRV auth_mode=required" \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7794 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 7795 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7796 | debug_level=1" \ |
| 7797 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 7798 | -C "x509_verify_cert.*4b00" \ |
| 7799 | -C "mbedtls_pk_verify.*4b00" \ |
| 7800 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 7801 | -C "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7802 | |
Manuel Pégourié-Gonnard | 875d1eb | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 7803 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
| 7804 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7805 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
| 7806 | run_test "EC restart: TLS, max_ops=0" \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 7807 | "$P_SRV auth_mode=required" \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7808 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 7809 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7810 | debug_level=1 ec_max_ops=0" \ |
| 7811 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 7812 | -C "x509_verify_cert.*4b00" \ |
| 7813 | -C "mbedtls_pk_verify.*4b00" \ |
| 7814 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 7815 | -C "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7816 | |
Manuel Pégourié-Gonnard | 875d1eb | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 7817 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
| 7818 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7819 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
| 7820 | run_test "EC restart: TLS, max_ops=65535" \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 7821 | "$P_SRV auth_mode=required" \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7822 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 7823 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7824 | debug_level=1 ec_max_ops=65535" \ |
| 7825 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 7826 | -C "x509_verify_cert.*4b00" \ |
| 7827 | -C "mbedtls_pk_verify.*4b00" \ |
| 7828 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 7829 | -C "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7830 | |
Manuel Pégourié-Gonnard | 875d1eb | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 7831 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
| 7832 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7833 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
| 7834 | run_test "EC restart: TLS, max_ops=1000" \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 7835 | "$P_SRV auth_mode=required" \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7836 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 7837 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7838 | debug_level=1 ec_max_ops=1000" \ |
| 7839 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 7840 | -c "x509_verify_cert.*4b00" \ |
| 7841 | -c "mbedtls_pk_verify.*4b00" \ |
| 7842 | -c "mbedtls_ecdh_make_public.*4b00" \ |
| 7843 | -c "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7844 | |
Manuel Pégourié-Gonnard | 875d1eb | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 7845 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
| 7846 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7847 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 7848 | run_test "EC restart: TLS, max_ops=1000, badsign" \ |
| 7849 | "$P_SRV auth_mode=required \ |
| 7850 | crt_file=data_files/server5-badsign.crt \ |
| 7851 | key_file=data_files/server5.key" \ |
| 7852 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 7853 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 7854 | debug_level=1 ec_max_ops=1000" \ |
| 7855 | 1 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 7856 | -c "x509_verify_cert.*4b00" \ |
| 7857 | -C "mbedtls_pk_verify.*4b00" \ |
| 7858 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 7859 | -C "mbedtls_pk_sign.*4b00" \ |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 7860 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 7861 | -c "! mbedtls_ssl_handshake returned" \ |
| 7862 | -c "X509 - Certificate verification failed" |
| 7863 | |
Manuel Pégourié-Gonnard | 875d1eb | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 7864 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
| 7865 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 7866 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
| 7867 | run_test "EC restart: TLS, max_ops=1000, auth_mode=optional badsign" \ |
| 7868 | "$P_SRV auth_mode=required \ |
| 7869 | crt_file=data_files/server5-badsign.crt \ |
| 7870 | key_file=data_files/server5.key" \ |
| 7871 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 7872 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 7873 | debug_level=1 ec_max_ops=1000 auth_mode=optional" \ |
| 7874 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 7875 | -c "x509_verify_cert.*4b00" \ |
| 7876 | -c "mbedtls_pk_verify.*4b00" \ |
| 7877 | -c "mbedtls_ecdh_make_public.*4b00" \ |
| 7878 | -c "mbedtls_pk_sign.*4b00" \ |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 7879 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 7880 | -C "! mbedtls_ssl_handshake returned" \ |
| 7881 | -C "X509 - Certificate verification failed" |
| 7882 | |
Manuel Pégourié-Gonnard | 875d1eb | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 7883 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
| 7884 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 7885 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
| 7886 | run_test "EC restart: TLS, max_ops=1000, auth_mode=none badsign" \ |
| 7887 | "$P_SRV auth_mode=required \ |
| 7888 | crt_file=data_files/server5-badsign.crt \ |
| 7889 | key_file=data_files/server5.key" \ |
| 7890 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 7891 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 7892 | debug_level=1 ec_max_ops=1000 auth_mode=none" \ |
| 7893 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 7894 | -C "x509_verify_cert.*4b00" \ |
| 7895 | -c "mbedtls_pk_verify.*4b00" \ |
| 7896 | -c "mbedtls_ecdh_make_public.*4b00" \ |
| 7897 | -c "mbedtls_pk_sign.*4b00" \ |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 7898 | -C "! The certificate is not correctly signed by the trusted CA" \ |
| 7899 | -C "! mbedtls_ssl_handshake returned" \ |
| 7900 | -C "X509 - Certificate verification failed" |
| 7901 | |
Manuel Pégourié-Gonnard | 875d1eb | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 7902 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
| 7903 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 7904 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7905 | run_test "EC restart: DTLS, max_ops=1000" \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 7906 | "$P_SRV auth_mode=required dtls=1" \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7907 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 7908 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7909 | dtls=1 debug_level=1 ec_max_ops=1000" \ |
| 7910 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 7911 | -c "x509_verify_cert.*4b00" \ |
| 7912 | -c "mbedtls_pk_verify.*4b00" \ |
| 7913 | -c "mbedtls_ecdh_make_public.*4b00" \ |
| 7914 | -c "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 7915 | |
Manuel Pégourié-Gonnard | 875d1eb | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 7916 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
| 7917 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 32033da | 2017-05-18 12:49:27 +0200 | [diff] [blame] | 7918 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
| 7919 | run_test "EC restart: TLS, max_ops=1000 no client auth" \ |
| 7920 | "$P_SRV" \ |
| 7921 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 7922 | debug_level=1 ec_max_ops=1000" \ |
| 7923 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 7924 | -c "x509_verify_cert.*4b00" \ |
| 7925 | -c "mbedtls_pk_verify.*4b00" \ |
| 7926 | -c "mbedtls_ecdh_make_public.*4b00" \ |
| 7927 | -C "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 32033da | 2017-05-18 12:49:27 +0200 | [diff] [blame] | 7928 | |
Manuel Pégourié-Gonnard | 875d1eb | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 7929 | |
| 7930 | # Restartable is only for ECDHE-ECDSA, with another ciphersuite we expect no |
| 7931 | # restartable behaviour at all (not even client auth). |
| 7932 | # This is the same as "EC restart: TLS, max_ops=1000" except with ECDHE-RSA, |
| 7933 | # and all 4 assertions negated. |
Manuel Pégourié-Gonnard | 32033da | 2017-05-18 12:49:27 +0200 | [diff] [blame] | 7934 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
Manuel Pégourié-Gonnard | 875d1eb | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 7935 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
| 7936 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
| 7937 | run_test "EC restart: TLS, max_ops=1000, ECDHE-RSA" \ |
| 7938 | "$P_SRV curves=secp256r1 auth_mode=required" \ |
| 7939 | "$P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256 \ |
| 7940 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 7941 | debug_level=1 ec_max_ops=1000" \ |
Manuel Pégourié-Gonnard | 32033da | 2017-05-18 12:49:27 +0200 | [diff] [blame] | 7942 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 7943 | -C "x509_verify_cert.*4b00" \ |
| 7944 | -C "mbedtls_pk_verify.*4b00" \ |
| 7945 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 7946 | -C "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 32033da | 2017-05-18 12:49:27 +0200 | [diff] [blame] | 7947 | |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 7948 | # Tests of asynchronous private key support in SSL |
| 7949 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 7950 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 7951 | run_test "SSL async private: sign, delay=0" \ |
| 7952 | "$P_SRV \ |
| 7953 | async_operations=s async_private_delay1=0 async_private_delay2=0" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 7954 | "$P_CLI" \ |
| 7955 | 0 \ |
| 7956 | -s "Async sign callback: using key slot " \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 7957 | -s "Async resume (slot [0-9]): sign done, status=0" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 7958 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 7959 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 7960 | run_test "SSL async private: sign, delay=1" \ |
| 7961 | "$P_SRV \ |
| 7962 | async_operations=s async_private_delay1=1 async_private_delay2=1" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 7963 | "$P_CLI" \ |
| 7964 | 0 \ |
| 7965 | -s "Async sign callback: using key slot " \ |
| 7966 | -s "Async resume (slot [0-9]): call 0 more times." \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 7967 | -s "Async resume (slot [0-9]): sign done, status=0" |
| 7968 | |
Gilles Peskine | 12d0cc1 | 2018-04-26 15:06:56 +0200 | [diff] [blame] | 7969 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
| 7970 | run_test "SSL async private: sign, delay=2" \ |
| 7971 | "$P_SRV \ |
| 7972 | async_operations=s async_private_delay1=2 async_private_delay2=2" \ |
| 7973 | "$P_CLI" \ |
| 7974 | 0 \ |
| 7975 | -s "Async sign callback: using key slot " \ |
| 7976 | -U "Async sign callback: using key slot " \ |
| 7977 | -s "Async resume (slot [0-9]): call 1 more times." \ |
| 7978 | -s "Async resume (slot [0-9]): call 0 more times." \ |
| 7979 | -s "Async resume (slot [0-9]): sign done, status=0" |
| 7980 | |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 7981 | # Test that the async callback correctly signs the 36-byte hash of TLS 1.0/1.1 |
| 7982 | # with RSA PKCS#1v1.5 as used in TLS 1.0/1.1. |
| 7983 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 7984 | run_test "SSL async private: sign, RSA, TLS 1.1" \ |
| 7985 | "$P_SRV key_file=data_files/server2.key crt_file=data_files/server2.crt \ |
| 7986 | async_operations=s async_private_delay1=0 async_private_delay2=0" \ |
| 7987 | "$P_CLI force_version=tls1_1" \ |
| 7988 | 0 \ |
| 7989 | -s "Async sign callback: using key slot " \ |
| 7990 | -s "Async resume (slot [0-9]): sign done, status=0" |
| 7991 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 7992 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 807d74a | 2018-04-30 10:30:49 +0200 | [diff] [blame] | 7993 | run_test "SSL async private: sign, SNI" \ |
| 7994 | "$P_SRV debug_level=3 \ |
| 7995 | async_operations=s async_private_delay1=0 async_private_delay2=0 \ |
| 7996 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 7997 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
| 7998 | "$P_CLI server_name=polarssl.example" \ |
| 7999 | 0 \ |
| 8000 | -s "Async sign callback: using key slot " \ |
| 8001 | -s "Async resume (slot [0-9]): sign done, status=0" \ |
| 8002 | -s "parse ServerName extension" \ |
| 8003 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 8004 | -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example" |
| 8005 | |
| 8006 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8007 | run_test "SSL async private: decrypt, delay=0" \ |
| 8008 | "$P_SRV \ |
| 8009 | async_operations=d async_private_delay1=0 async_private_delay2=0" \ |
| 8010 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8011 | 0 \ |
| 8012 | -s "Async decrypt callback: using key slot " \ |
| 8013 | -s "Async resume (slot [0-9]): decrypt done, status=0" |
| 8014 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8015 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8016 | run_test "SSL async private: decrypt, delay=1" \ |
| 8017 | "$P_SRV \ |
| 8018 | async_operations=d async_private_delay1=1 async_private_delay2=1" \ |
| 8019 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8020 | 0 \ |
| 8021 | -s "Async decrypt callback: using key slot " \ |
| 8022 | -s "Async resume (slot [0-9]): call 0 more times." \ |
| 8023 | -s "Async resume (slot [0-9]): decrypt done, status=0" |
| 8024 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8025 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8026 | run_test "SSL async private: decrypt RSA-PSK, delay=0" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 8027 | "$P_SRV psk=73776f726466697368 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8028 | async_operations=d async_private_delay1=0 async_private_delay2=0" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 8029 | "$P_CLI psk=73776f726466697368 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8030 | force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA256" \ |
| 8031 | 0 \ |
| 8032 | -s "Async decrypt callback: using key slot " \ |
| 8033 | -s "Async resume (slot [0-9]): decrypt done, status=0" |
| 8034 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8035 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8036 | run_test "SSL async private: decrypt RSA-PSK, delay=1" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 8037 | "$P_SRV psk=73776f726466697368 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8038 | async_operations=d async_private_delay1=1 async_private_delay2=1" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 8039 | "$P_CLI psk=73776f726466697368 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8040 | force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA256" \ |
| 8041 | 0 \ |
| 8042 | -s "Async decrypt callback: using key slot " \ |
| 8043 | -s "Async resume (slot [0-9]): call 0 more times." \ |
| 8044 | -s "Async resume (slot [0-9]): decrypt done, status=0" |
| 8045 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8046 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8047 | run_test "SSL async private: sign callback not present" \ |
| 8048 | "$P_SRV \ |
| 8049 | async_operations=d async_private_delay1=1 async_private_delay2=1" \ |
| 8050 | "$P_CLI; [ \$? -eq 1 ] && |
| 8051 | $P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8052 | 0 \ |
| 8053 | -S "Async sign callback" \ |
| 8054 | -s "! mbedtls_ssl_handshake returned" \ |
| 8055 | -s "The own private key or pre-shared key is not set, but needed" \ |
| 8056 | -s "Async resume (slot [0-9]): decrypt done, status=0" \ |
| 8057 | -s "Successful connection" |
| 8058 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8059 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8060 | run_test "SSL async private: decrypt callback not present" \ |
| 8061 | "$P_SRV debug_level=1 \ |
| 8062 | async_operations=s async_private_delay1=1 async_private_delay2=1" \ |
| 8063 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA; |
| 8064 | [ \$? -eq 1 ] && $P_CLI" \ |
| 8065 | 0 \ |
| 8066 | -S "Async decrypt callback" \ |
| 8067 | -s "! mbedtls_ssl_handshake returned" \ |
| 8068 | -s "got no RSA private key" \ |
| 8069 | -s "Async resume (slot [0-9]): sign done, status=0" \ |
| 8070 | -s "Successful connection" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8071 | |
| 8072 | # key1: ECDSA, key2: RSA; use key1 from slot 0 |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8073 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8074 | run_test "SSL async private: slot 0 used with key1" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8075 | "$P_SRV \ |
| 8076 | async_operations=s async_private_delay1=1 \ |
| 8077 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8078 | key_file2=data_files/server2.key crt_file2=data_files/server2.crt" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8079 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 8080 | 0 \ |
| 8081 | -s "Async sign callback: using key slot 0," \ |
| 8082 | -s "Async resume (slot 0): call 0 more times." \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8083 | -s "Async resume (slot 0): sign done, status=0" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8084 | |
| 8085 | # key1: ECDSA, key2: RSA; use key2 from slot 0 |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8086 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8087 | run_test "SSL async private: slot 0 used with key2" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8088 | "$P_SRV \ |
| 8089 | async_operations=s async_private_delay2=1 \ |
| 8090 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8091 | key_file2=data_files/server2.key crt_file2=data_files/server2.crt" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8092 | "$P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256" \ |
| 8093 | 0 \ |
| 8094 | -s "Async sign callback: using key slot 0," \ |
| 8095 | -s "Async resume (slot 0): call 0 more times." \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8096 | -s "Async resume (slot 0): sign done, status=0" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8097 | |
| 8098 | # key1: ECDSA, key2: RSA; use key2 from slot 1 |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8099 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | ad28bf0 | 2018-04-26 00:19:16 +0200 | [diff] [blame] | 8100 | run_test "SSL async private: slot 1 used with key2" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8101 | "$P_SRV \ |
Gilles Peskine | 168dae8 | 2018-04-25 23:35:42 +0200 | [diff] [blame] | 8102 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8103 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8104 | key_file2=data_files/server2.key crt_file2=data_files/server2.crt" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8105 | "$P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256" \ |
| 8106 | 0 \ |
| 8107 | -s "Async sign callback: using key slot 1," \ |
| 8108 | -s "Async resume (slot 1): call 0 more times." \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8109 | -s "Async resume (slot 1): sign done, status=0" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8110 | |
| 8111 | # key1: ECDSA, key2: RSA; use key2 directly |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8112 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8113 | run_test "SSL async private: fall back to transparent key" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8114 | "$P_SRV \ |
| 8115 | async_operations=s async_private_delay1=1 \ |
| 8116 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8117 | key_file2=data_files/server2.key crt_file2=data_files/server2.crt " \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8118 | "$P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256" \ |
| 8119 | 0 \ |
| 8120 | -s "Async sign callback: no key matches this certificate." |
| 8121 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8122 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 725f1cb | 2018-06-12 15:06:40 +0200 | [diff] [blame] | 8123 | run_test "SSL async private: sign, error in start" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8124 | "$P_SRV \ |
| 8125 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
| 8126 | async_private_error=1" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8127 | "$P_CLI" \ |
| 8128 | 1 \ |
| 8129 | -s "Async sign callback: injected error" \ |
| 8130 | -S "Async resume" \ |
Gilles Peskine | 37289cd | 2018-04-27 11:50:14 +0200 | [diff] [blame] | 8131 | -S "Async cancel" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8132 | -s "! mbedtls_ssl_handshake returned" |
| 8133 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8134 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 725f1cb | 2018-06-12 15:06:40 +0200 | [diff] [blame] | 8135 | run_test "SSL async private: sign, cancel after start" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8136 | "$P_SRV \ |
| 8137 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
| 8138 | async_private_error=2" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8139 | "$P_CLI" \ |
| 8140 | 1 \ |
| 8141 | -s "Async sign callback: using key slot " \ |
| 8142 | -S "Async resume" \ |
| 8143 | -s "Async cancel" |
| 8144 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8145 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 725f1cb | 2018-06-12 15:06:40 +0200 | [diff] [blame] | 8146 | run_test "SSL async private: sign, error in resume" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8147 | "$P_SRV \ |
| 8148 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
| 8149 | async_private_error=3" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8150 | "$P_CLI" \ |
| 8151 | 1 \ |
| 8152 | -s "Async sign callback: using key slot " \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8153 | -s "Async resume callback: sign done but injected error" \ |
Gilles Peskine | 37289cd | 2018-04-27 11:50:14 +0200 | [diff] [blame] | 8154 | -S "Async cancel" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8155 | -s "! mbedtls_ssl_handshake returned" |
| 8156 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8157 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 725f1cb | 2018-06-12 15:06:40 +0200 | [diff] [blame] | 8158 | run_test "SSL async private: decrypt, error in start" \ |
| 8159 | "$P_SRV \ |
| 8160 | async_operations=d async_private_delay1=1 async_private_delay2=1 \ |
| 8161 | async_private_error=1" \ |
| 8162 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8163 | 1 \ |
| 8164 | -s "Async decrypt callback: injected error" \ |
| 8165 | -S "Async resume" \ |
| 8166 | -S "Async cancel" \ |
| 8167 | -s "! mbedtls_ssl_handshake returned" |
| 8168 | |
| 8169 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
| 8170 | run_test "SSL async private: decrypt, cancel after start" \ |
| 8171 | "$P_SRV \ |
| 8172 | async_operations=d async_private_delay1=1 async_private_delay2=1 \ |
| 8173 | async_private_error=2" \ |
| 8174 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8175 | 1 \ |
| 8176 | -s "Async decrypt callback: using key slot " \ |
| 8177 | -S "Async resume" \ |
| 8178 | -s "Async cancel" |
| 8179 | |
| 8180 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
| 8181 | run_test "SSL async private: decrypt, error in resume" \ |
| 8182 | "$P_SRV \ |
| 8183 | async_operations=d async_private_delay1=1 async_private_delay2=1 \ |
| 8184 | async_private_error=3" \ |
| 8185 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8186 | 1 \ |
| 8187 | -s "Async decrypt callback: using key slot " \ |
| 8188 | -s "Async resume callback: decrypt done but injected error" \ |
| 8189 | -S "Async cancel" \ |
| 8190 | -s "! mbedtls_ssl_handshake returned" |
| 8191 | |
| 8192 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8193 | run_test "SSL async private: cancel after start then operate correctly" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8194 | "$P_SRV \ |
| 8195 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
| 8196 | async_private_error=-2" \ |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8197 | "$P_CLI; [ \$? -eq 1 ] && $P_CLI" \ |
| 8198 | 0 \ |
| 8199 | -s "Async cancel" \ |
| 8200 | -s "! mbedtls_ssl_handshake returned" \ |
| 8201 | -s "Async resume" \ |
| 8202 | -s "Successful connection" |
| 8203 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8204 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8205 | run_test "SSL async private: error in resume then operate correctly" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8206 | "$P_SRV \ |
| 8207 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
| 8208 | async_private_error=-3" \ |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8209 | "$P_CLI; [ \$? -eq 1 ] && $P_CLI" \ |
| 8210 | 0 \ |
| 8211 | -s "! mbedtls_ssl_handshake returned" \ |
| 8212 | -s "Async resume" \ |
| 8213 | -s "Successful connection" |
| 8214 | |
| 8215 | # key1: ECDSA, key2: RSA; use key1 through async, then key2 directly |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8216 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8217 | run_test "SSL async private: cancel after start then fall back to transparent key" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8218 | "$P_SRV \ |
| 8219 | async_operations=s async_private_delay1=1 async_private_error=-2 \ |
| 8220 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8221 | key_file2=data_files/server2.key crt_file2=data_files/server2.crt" \ |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8222 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256; |
| 8223 | [ \$? -eq 1 ] && |
| 8224 | $P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256" \ |
| 8225 | 0 \ |
Gilles Peskine | deda75a | 2018-04-30 10:02:45 +0200 | [diff] [blame] | 8226 | -s "Async sign callback: using key slot 0" \ |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8227 | -S "Async resume" \ |
| 8228 | -s "Async cancel" \ |
| 8229 | -s "! mbedtls_ssl_handshake returned" \ |
| 8230 | -s "Async sign callback: no key matches this certificate." \ |
| 8231 | -s "Successful connection" |
| 8232 | |
| 8233 | # key1: ECDSA, key2: RSA; use key1 through async, then key2 directly |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8234 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 725f1cb | 2018-06-12 15:06:40 +0200 | [diff] [blame] | 8235 | run_test "SSL async private: sign, error in resume then fall back to transparent key" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8236 | "$P_SRV \ |
| 8237 | async_operations=s async_private_delay1=1 async_private_error=-3 \ |
| 8238 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8239 | key_file2=data_files/server2.key crt_file2=data_files/server2.crt" \ |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8240 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256; |
| 8241 | [ \$? -eq 1 ] && |
| 8242 | $P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256" \ |
| 8243 | 0 \ |
| 8244 | -s "Async resume" \ |
| 8245 | -s "! mbedtls_ssl_handshake returned" \ |
| 8246 | -s "Async sign callback: no key matches this certificate." \ |
| 8247 | -s "Successful connection" |
| 8248 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8249 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8250 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Gilles Peskine | 654bab7 | 2019-09-16 15:19:20 +0200 | [diff] [blame] | 8251 | run_test "SSL async private: renegotiation: client-initiated, sign" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8252 | "$P_SRV \ |
| 8253 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8254 | exchanges=2 renegotiation=1" \ |
| 8255 | "$P_CLI exchanges=2 renegotiation=1 renegotiate=1" \ |
| 8256 | 0 \ |
| 8257 | -s "Async sign callback: using key slot " \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8258 | -s "Async resume (slot [0-9]): sign done, status=0" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8259 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8260 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8261 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Gilles Peskine | 654bab7 | 2019-09-16 15:19:20 +0200 | [diff] [blame] | 8262 | run_test "SSL async private: renegotiation: server-initiated, sign" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8263 | "$P_SRV \ |
| 8264 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8265 | exchanges=2 renegotiation=1 renegotiate=1" \ |
| 8266 | "$P_CLI exchanges=2 renegotiation=1" \ |
| 8267 | 0 \ |
| 8268 | -s "Async sign callback: using key slot " \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8269 | -s "Async resume (slot [0-9]): sign done, status=0" |
| 8270 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8271 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8272 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Gilles Peskine | 654bab7 | 2019-09-16 15:19:20 +0200 | [diff] [blame] | 8273 | run_test "SSL async private: renegotiation: client-initiated, decrypt" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8274 | "$P_SRV \ |
| 8275 | async_operations=d async_private_delay1=1 async_private_delay2=1 \ |
| 8276 | exchanges=2 renegotiation=1" \ |
| 8277 | "$P_CLI exchanges=2 renegotiation=1 renegotiate=1 \ |
| 8278 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8279 | 0 \ |
| 8280 | -s "Async decrypt callback: using key slot " \ |
| 8281 | -s "Async resume (slot [0-9]): decrypt done, status=0" |
| 8282 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8283 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8284 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Gilles Peskine | 654bab7 | 2019-09-16 15:19:20 +0200 | [diff] [blame] | 8285 | run_test "SSL async private: renegotiation: server-initiated, decrypt" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8286 | "$P_SRV \ |
| 8287 | async_operations=d async_private_delay1=1 async_private_delay2=1 \ |
| 8288 | exchanges=2 renegotiation=1 renegotiate=1" \ |
| 8289 | "$P_CLI exchanges=2 renegotiation=1 \ |
| 8290 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8291 | 0 \ |
| 8292 | -s "Async decrypt callback: using key slot " \ |
| 8293 | -s "Async resume (slot [0-9]): decrypt done, status=0" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8294 | |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 8295 | # Tests for ECC extensions (rfc 4492) |
| 8296 | |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 8297 | requires_config_enabled MBEDTLS_AES_C |
| 8298 | requires_config_enabled MBEDTLS_CIPHER_MODE_CBC |
| 8299 | requires_config_enabled MBEDTLS_SHA256_C |
| 8300 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_RSA_ENABLED |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 8301 | run_test "Force a non ECC ciphersuite in the client side" \ |
| 8302 | "$P_SRV debug_level=3" \ |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 8303 | "$P_CLI debug_level=3 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA256" \ |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 8304 | 0 \ |
| 8305 | -C "client hello, adding supported_elliptic_curves extension" \ |
| 8306 | -C "client hello, adding supported_point_formats extension" \ |
| 8307 | -S "found supported elliptic curves extension" \ |
| 8308 | -S "found supported point formats extension" |
| 8309 | |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 8310 | requires_config_enabled MBEDTLS_AES_C |
| 8311 | requires_config_enabled MBEDTLS_CIPHER_MODE_CBC |
| 8312 | requires_config_enabled MBEDTLS_SHA256_C |
| 8313 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_RSA_ENABLED |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 8314 | run_test "Force a non ECC ciphersuite in the server side" \ |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 8315 | "$P_SRV debug_level=3 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA256" \ |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 8316 | "$P_CLI debug_level=3" \ |
| 8317 | 0 \ |
| 8318 | -C "found supported_point_formats extension" \ |
| 8319 | -S "server hello, supported_point_formats extension" |
| 8320 | |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 8321 | requires_config_enabled MBEDTLS_AES_C |
| 8322 | requires_config_enabled MBEDTLS_CIPHER_MODE_CBC |
| 8323 | requires_config_enabled MBEDTLS_SHA256_C |
| 8324 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 8325 | run_test "Force an ECC ciphersuite in the client side" \ |
| 8326 | "$P_SRV debug_level=3" \ |
| 8327 | "$P_CLI debug_level=3 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 8328 | 0 \ |
| 8329 | -c "client hello, adding supported_elliptic_curves extension" \ |
| 8330 | -c "client hello, adding supported_point_formats extension" \ |
| 8331 | -s "found supported elliptic curves extension" \ |
| 8332 | -s "found supported point formats extension" |
| 8333 | |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 8334 | requires_config_enabled MBEDTLS_AES_C |
| 8335 | requires_config_enabled MBEDTLS_CIPHER_MODE_CBC |
| 8336 | requires_config_enabled MBEDTLS_SHA256_C |
| 8337 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 8338 | run_test "Force an ECC ciphersuite in the server side" \ |
| 8339 | "$P_SRV debug_level=3 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 8340 | "$P_CLI debug_level=3" \ |
| 8341 | 0 \ |
| 8342 | -c "found supported_point_formats extension" \ |
| 8343 | -s "server hello, supported_point_formats extension" |
| 8344 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 8345 | # Tests for DTLS HelloVerifyRequest |
| 8346 | |
| 8347 | run_test "DTLS cookie: enabled" \ |
| 8348 | "$P_SRV dtls=1 debug_level=2" \ |
| 8349 | "$P_CLI dtls=1 debug_level=2" \ |
| 8350 | 0 \ |
| 8351 | -s "cookie verification failed" \ |
| 8352 | -s "cookie verification passed" \ |
| 8353 | -S "cookie verification skipped" \ |
| 8354 | -c "received hello verify request" \ |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 8355 | -s "hello verification requested" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 8356 | -S "SSL - The requested feature is not available" |
| 8357 | |
| 8358 | run_test "DTLS cookie: disabled" \ |
| 8359 | "$P_SRV dtls=1 debug_level=2 cookies=0" \ |
| 8360 | "$P_CLI dtls=1 debug_level=2" \ |
| 8361 | 0 \ |
| 8362 | -S "cookie verification failed" \ |
| 8363 | -S "cookie verification passed" \ |
| 8364 | -s "cookie verification skipped" \ |
| 8365 | -C "received hello verify request" \ |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 8366 | -S "hello verification requested" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 8367 | -S "SSL - The requested feature is not available" |
| 8368 | |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 8369 | run_test "DTLS cookie: default (failing)" \ |
| 8370 | "$P_SRV dtls=1 debug_level=2 cookies=-1" \ |
| 8371 | "$P_CLI dtls=1 debug_level=2 hs_timeout=100-400" \ |
| 8372 | 1 \ |
| 8373 | -s "cookie verification failed" \ |
| 8374 | -S "cookie verification passed" \ |
| 8375 | -S "cookie verification skipped" \ |
| 8376 | -C "received hello verify request" \ |
| 8377 | -S "hello verification requested" \ |
| 8378 | -s "SSL - The requested feature is not available" |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 8379 | |
| 8380 | requires_ipv6 |
| 8381 | run_test "DTLS cookie: enabled, IPv6" \ |
| 8382 | "$P_SRV dtls=1 debug_level=2 server_addr=::1" \ |
| 8383 | "$P_CLI dtls=1 debug_level=2 server_addr=::1" \ |
| 8384 | 0 \ |
| 8385 | -s "cookie verification failed" \ |
| 8386 | -s "cookie verification passed" \ |
| 8387 | -S "cookie verification skipped" \ |
| 8388 | -c "received hello verify request" \ |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 8389 | -s "hello verification requested" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 8390 | -S "SSL - The requested feature is not available" |
| 8391 | |
Manuel Pégourié-Gonnard | 579950c | 2014-09-29 17:47:33 +0200 | [diff] [blame] | 8392 | run_test "DTLS cookie: enabled, nbio" \ |
| 8393 | "$P_SRV dtls=1 nbio=2 debug_level=2" \ |
| 8394 | "$P_CLI dtls=1 nbio=2 debug_level=2" \ |
| 8395 | 0 \ |
| 8396 | -s "cookie verification failed" \ |
| 8397 | -s "cookie verification passed" \ |
| 8398 | -S "cookie verification skipped" \ |
| 8399 | -c "received hello verify request" \ |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 8400 | -s "hello verification requested" \ |
Manuel Pégourié-Gonnard | 579950c | 2014-09-29 17:47:33 +0200 | [diff] [blame] | 8401 | -S "SSL - The requested feature is not available" |
| 8402 | |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 8403 | # Tests for client reconnecting from the same port with DTLS |
| 8404 | |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 8405 | not_with_valgrind # spurious resend |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 8406 | run_test "DTLS client reconnect from same port: reference" \ |
Manuel Pégourié-Gonnard | b692989 | 2019-09-09 11:14:37 +0200 | [diff] [blame] | 8407 | "$P_SRV dtls=1 exchanges=2 read_timeout=20000 hs_timeout=10000-20000" \ |
| 8408 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=10000-20000" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 8409 | 0 \ |
| 8410 | -C "resend" \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 8411 | -S "The operation timed out" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 8412 | -S "Client initiated reconnection from same port" |
| 8413 | |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 8414 | not_with_valgrind # spurious resend |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 8415 | run_test "DTLS client reconnect from same port: reconnect" \ |
Manuel Pégourié-Gonnard | b692989 | 2019-09-09 11:14:37 +0200 | [diff] [blame] | 8416 | "$P_SRV dtls=1 exchanges=2 read_timeout=20000 hs_timeout=10000-20000" \ |
| 8417 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=10000-20000 reconnect_hard=1" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 8418 | 0 \ |
| 8419 | -C "resend" \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 8420 | -S "The operation timed out" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 8421 | -s "Client initiated reconnection from same port" |
| 8422 | |
Paul Bakker | 362689d | 2016-05-13 10:33:25 +0100 | [diff] [blame] | 8423 | not_with_valgrind # server/client too slow to respond in time (next test has higher timeouts) |
| 8424 | run_test "DTLS client reconnect from same port: reconnect, nbio, no valgrind" \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 8425 | "$P_SRV dtls=1 exchanges=2 read_timeout=1000 nbio=2" \ |
| 8426 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=500-1000 reconnect_hard=1" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 8427 | 0 \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 8428 | -S "The operation timed out" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 8429 | -s "Client initiated reconnection from same port" |
| 8430 | |
Paul Bakker | 362689d | 2016-05-13 10:33:25 +0100 | [diff] [blame] | 8431 | only_with_valgrind # Only with valgrind, do previous test but with higher read_timeout and hs_timeout |
| 8432 | run_test "DTLS client reconnect from same port: reconnect, nbio, valgrind" \ |
| 8433 | "$P_SRV dtls=1 exchanges=2 read_timeout=2000 nbio=2 hs_timeout=1500-6000" \ |
| 8434 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=1500-3000 reconnect_hard=1" \ |
| 8435 | 0 \ |
| 8436 | -S "The operation timed out" \ |
| 8437 | -s "Client initiated reconnection from same port" |
| 8438 | |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 8439 | run_test "DTLS client reconnect from same port: no cookies" \ |
| 8440 | "$P_SRV dtls=1 exchanges=2 read_timeout=1000 cookies=0" \ |
Manuel Pégourié-Gonnard | 6ad23b9 | 2015-09-15 12:57:46 +0200 | [diff] [blame] | 8441 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=500-8000 reconnect_hard=1" \ |
| 8442 | 0 \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 8443 | -s "The operation timed out" \ |
| 8444 | -S "Client initiated reconnection from same port" |
| 8445 | |
Manuel Pégourié-Gonnard | baad2de | 2020-03-13 11:11:02 +0100 | [diff] [blame] | 8446 | run_test "DTLS client reconnect from same port: attacker-injected" \ |
| 8447 | -p "$P_PXY inject_clihlo=1" \ |
| 8448 | "$P_SRV dtls=1 exchanges=2 debug_level=1" \ |
| 8449 | "$P_CLI dtls=1 exchanges=2" \ |
| 8450 | 0 \ |
| 8451 | -s "possible client reconnect from the same port" \ |
| 8452 | -S "Client initiated reconnection from same port" |
| 8453 | |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 8454 | # Tests for various cases of client authentication with DTLS |
| 8455 | # (focused on handshake flows and message parsing) |
| 8456 | |
| 8457 | run_test "DTLS client auth: required" \ |
| 8458 | "$P_SRV dtls=1 auth_mode=required" \ |
| 8459 | "$P_CLI dtls=1" \ |
| 8460 | 0 \ |
| 8461 | -s "Verifying peer X.509 certificate... ok" |
| 8462 | |
| 8463 | run_test "DTLS client auth: optional, client has no cert" \ |
| 8464 | "$P_SRV dtls=1 auth_mode=optional" \ |
| 8465 | "$P_CLI dtls=1 crt_file=none key_file=none" \ |
| 8466 | 0 \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 8467 | -s "! Certificate was missing" |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 8468 | |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 8469 | run_test "DTLS client auth: none, client has no cert" \ |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 8470 | "$P_SRV dtls=1 auth_mode=none" \ |
| 8471 | "$P_CLI dtls=1 crt_file=none key_file=none debug_level=2" \ |
| 8472 | 0 \ |
| 8473 | -c "skip write certificate$" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 8474 | -s "! Certificate verification was skipped" |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 8475 | |
Manuel Pégourié-Gonnard | 0a88574 | 2015-08-04 12:08:35 +0200 | [diff] [blame] | 8476 | run_test "DTLS wrong PSK: badmac alert" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 8477 | "$P_SRV dtls=1 psk=73776f726466697368 force_ciphersuite=TLS-PSK-WITH-AES-128-GCM-SHA256" \ |
Gilles Peskine | dd53964 | 2024-05-13 21:06:26 +0200 | [diff] [blame] | 8478 | "$P_CLI dtls=1 psk=73776f726466697374" \ |
Manuel Pégourié-Gonnard | 0a88574 | 2015-08-04 12:08:35 +0200 | [diff] [blame] | 8479 | 1 \ |
| 8480 | -s "SSL - Verification of the message MAC failed" \ |
| 8481 | -c "SSL - A fatal alert message was received from our peer" |
| 8482 | |
Manuel Pégourié-Gonnard | 502bf30 | 2014-08-20 13:12:58 +0200 | [diff] [blame] | 8483 | # Tests for receiving fragmented handshake messages with DTLS |
| 8484 | |
| 8485 | requires_gnutls |
| 8486 | run_test "DTLS reassembly: no fragmentation (gnutls server)" \ |
| 8487 | "$G_SRV -u --mtu 2048 -a" \ |
| 8488 | "$P_CLI dtls=1 debug_level=2" \ |
| 8489 | 0 \ |
| 8490 | -C "found fragmented DTLS handshake message" \ |
| 8491 | -C "error" |
| 8492 | |
| 8493 | requires_gnutls |
| 8494 | run_test "DTLS reassembly: some fragmentation (gnutls server)" \ |
| 8495 | "$G_SRV -u --mtu 512" \ |
| 8496 | "$P_CLI dtls=1 debug_level=2" \ |
| 8497 | 0 \ |
| 8498 | -c "found fragmented DTLS handshake message" \ |
| 8499 | -C "error" |
| 8500 | |
| 8501 | requires_gnutls |
| 8502 | run_test "DTLS reassembly: more fragmentation (gnutls server)" \ |
| 8503 | "$G_SRV -u --mtu 128" \ |
| 8504 | "$P_CLI dtls=1 debug_level=2" \ |
| 8505 | 0 \ |
| 8506 | -c "found fragmented DTLS handshake message" \ |
| 8507 | -C "error" |
| 8508 | |
| 8509 | requires_gnutls |
| 8510 | run_test "DTLS reassembly: more fragmentation, nbio (gnutls server)" \ |
| 8511 | "$G_SRV -u --mtu 128" \ |
| 8512 | "$P_CLI dtls=1 nbio=2 debug_level=2" \ |
| 8513 | 0 \ |
| 8514 | -c "found fragmented DTLS handshake message" \ |
| 8515 | -C "error" |
| 8516 | |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 8517 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 8518 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 8519 | run_test "DTLS reassembly: fragmentation, renego (gnutls server)" \ |
| 8520 | "$G_SRV -u --mtu 256" \ |
| 8521 | "$P_CLI debug_level=3 dtls=1 renegotiation=1 renegotiate=1" \ |
| 8522 | 0 \ |
| 8523 | -c "found fragmented DTLS handshake message" \ |
| 8524 | -c "client hello, adding renegotiation extension" \ |
| 8525 | -c "found renegotiation extension" \ |
| 8526 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 8527 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 8528 | -C "error" \ |
| 8529 | -s "Extra-header:" |
| 8530 | |
| 8531 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 8532 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 8533 | run_test "DTLS reassembly: fragmentation, nbio, renego (gnutls server)" \ |
| 8534 | "$G_SRV -u --mtu 256" \ |
| 8535 | "$P_CLI debug_level=3 nbio=2 dtls=1 renegotiation=1 renegotiate=1" \ |
| 8536 | 0 \ |
| 8537 | -c "found fragmented DTLS handshake message" \ |
| 8538 | -c "client hello, adding renegotiation extension" \ |
| 8539 | -c "found renegotiation extension" \ |
| 8540 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 8541 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 8542 | -C "error" \ |
| 8543 | -s "Extra-header:" |
| 8544 | |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 8545 | run_test "DTLS reassembly: no fragmentation (openssl server)" \ |
| 8546 | "$O_SRV -dtls1 -mtu 2048" \ |
| 8547 | "$P_CLI dtls=1 debug_level=2" \ |
| 8548 | 0 \ |
| 8549 | -C "found fragmented DTLS handshake message" \ |
| 8550 | -C "error" |
| 8551 | |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 8552 | run_test "DTLS reassembly: some fragmentation (openssl server)" \ |
| 8553 | "$O_SRV -dtls1 -mtu 768" \ |
Manuel Pégourié-Gonnard | 64dffc5 | 2014-09-02 13:39:16 +0200 | [diff] [blame] | 8554 | "$P_CLI dtls=1 debug_level=2" \ |
| 8555 | 0 \ |
| 8556 | -c "found fragmented DTLS handshake message" \ |
| 8557 | -C "error" |
| 8558 | |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 8559 | run_test "DTLS reassembly: more fragmentation (openssl server)" \ |
Manuel Pégourié-Gonnard | 64dffc5 | 2014-09-02 13:39:16 +0200 | [diff] [blame] | 8560 | "$O_SRV -dtls1 -mtu 256" \ |
| 8561 | "$P_CLI dtls=1 debug_level=2" \ |
| 8562 | 0 \ |
| 8563 | -c "found fragmented DTLS handshake message" \ |
| 8564 | -C "error" |
| 8565 | |
| 8566 | run_test "DTLS reassembly: fragmentation, nbio (openssl server)" \ |
| 8567 | "$O_SRV -dtls1 -mtu 256" \ |
| 8568 | "$P_CLI dtls=1 nbio=2 debug_level=2" \ |
| 8569 | 0 \ |
| 8570 | -c "found fragmented DTLS handshake message" \ |
| 8571 | -C "error" |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 8572 | |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8573 | # Tests for sending fragmented handshake messages with DTLS |
| 8574 | # |
| 8575 | # Use client auth when we need the client to send large messages, |
| 8576 | # and use large cert chains on both sides too (the long chains we have all use |
| 8577 | # both RSA and ECDSA, but ideally we should have long chains with either). |
| 8578 | # Sizes reached (UDP payload): |
| 8579 | # - 2037B for server certificate |
| 8580 | # - 1542B for client certificate |
| 8581 | # - 1013B for newsessionticket |
| 8582 | # - all others below 512B |
| 8583 | # All those tests assume MAX_CONTENT_LEN is at least 2048 |
| 8584 | |
| 8585 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8586 | requires_config_enabled MBEDTLS_RSA_C |
| 8587 | requires_config_enabled MBEDTLS_ECDSA_C |
| 8588 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8589 | requires_max_content_len 4096 |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8590 | run_test "DTLS fragmenting: none (for reference)" \ |
| 8591 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8592 | crt_file=data_files/server7_int-ca.crt \ |
| 8593 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8594 | hs_timeout=2500-60000 \ |
Hanno Becker | 12405e7 | 2018-08-13 16:45:46 +0100 | [diff] [blame] | 8595 | max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8596 | "$P_CLI dtls=1 debug_level=2 \ |
| 8597 | crt_file=data_files/server8_int-ca2.crt \ |
| 8598 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8599 | hs_timeout=2500-60000 \ |
Hanno Becker | 12405e7 | 2018-08-13 16:45:46 +0100 | [diff] [blame] | 8600 | max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8601 | 0 \ |
| 8602 | -S "found fragmented DTLS handshake message" \ |
| 8603 | -C "found fragmented DTLS handshake message" \ |
| 8604 | -C "error" |
| 8605 | |
| 8606 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8607 | requires_config_enabled MBEDTLS_RSA_C |
| 8608 | requires_config_enabled MBEDTLS_ECDSA_C |
| 8609 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8610 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8611 | run_test "DTLS fragmenting: server only (max_frag_len)" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8612 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8613 | crt_file=data_files/server7_int-ca.crt \ |
| 8614 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8615 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8616 | max_frag_len=1024" \ |
| 8617 | "$P_CLI dtls=1 debug_level=2 \ |
| 8618 | crt_file=data_files/server8_int-ca2.crt \ |
| 8619 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8620 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8621 | max_frag_len=2048" \ |
| 8622 | 0 \ |
| 8623 | -S "found fragmented DTLS handshake message" \ |
| 8624 | -c "found fragmented DTLS handshake message" \ |
| 8625 | -C "error" |
| 8626 | |
Hanno Becker | 69ca0ad | 2018-08-24 12:11:35 +0100 | [diff] [blame] | 8627 | # With the MFL extension, the server has no way of forcing |
| 8628 | # the client to not exceed a certain MTU; hence, the following |
| 8629 | # test can't be replicated with an MTU proxy such as the one |
| 8630 | # `client-initiated, server only (max_frag_len)` below. |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8631 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8632 | requires_config_enabled MBEDTLS_RSA_C |
| 8633 | requires_config_enabled MBEDTLS_ECDSA_C |
| 8634 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8635 | requires_max_content_len 4096 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8636 | run_test "DTLS fragmenting: server only (more) (max_frag_len)" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8637 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8638 | crt_file=data_files/server7_int-ca.crt \ |
| 8639 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8640 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8641 | max_frag_len=512" \ |
| 8642 | "$P_CLI dtls=1 debug_level=2 \ |
| 8643 | crt_file=data_files/server8_int-ca2.crt \ |
| 8644 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8645 | hs_timeout=2500-60000 \ |
Hanno Becker | 69ca0ad | 2018-08-24 12:11:35 +0100 | [diff] [blame] | 8646 | max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8647 | 0 \ |
| 8648 | -S "found fragmented DTLS handshake message" \ |
| 8649 | -c "found fragmented DTLS handshake message" \ |
| 8650 | -C "error" |
| 8651 | |
| 8652 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8653 | requires_config_enabled MBEDTLS_RSA_C |
| 8654 | requires_config_enabled MBEDTLS_ECDSA_C |
| 8655 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8656 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8657 | run_test "DTLS fragmenting: client-initiated, server only (max_frag_len)" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8658 | "$P_SRV dtls=1 debug_level=2 auth_mode=none \ |
| 8659 | crt_file=data_files/server7_int-ca.crt \ |
| 8660 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8661 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8662 | max_frag_len=2048" \ |
| 8663 | "$P_CLI dtls=1 debug_level=2 \ |
| 8664 | crt_file=data_files/server8_int-ca2.crt \ |
| 8665 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8666 | hs_timeout=2500-60000 \ |
| 8667 | max_frag_len=1024" \ |
| 8668 | 0 \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8669 | -S "found fragmented DTLS handshake message" \ |
| 8670 | -c "found fragmented DTLS handshake message" \ |
| 8671 | -C "error" |
| 8672 | |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 8673 | # While not required by the standard defining the MFL extension |
| 8674 | # (according to which it only applies to records, not to datagrams), |
| 8675 | # Mbed TLS will never send datagrams larger than MFL + { Max record expansion }, |
| 8676 | # as otherwise there wouldn't be any means to communicate MTU restrictions |
| 8677 | # to the peer. |
| 8678 | # The next test checks that no datagrams significantly larger than the |
| 8679 | # negotiated MFL are sent. |
| 8680 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8681 | requires_config_enabled MBEDTLS_RSA_C |
| 8682 | requires_config_enabled MBEDTLS_ECDSA_C |
| 8683 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8684 | requires_max_content_len 2048 |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 8685 | run_test "DTLS fragmenting: client-initiated, server only (max_frag_len), proxy MTU" \ |
Andrzej Kurek | 0fc9cf4 | 2018-10-09 03:09:41 -0400 | [diff] [blame] | 8686 | -p "$P_PXY mtu=1110" \ |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 8687 | "$P_SRV dtls=1 debug_level=2 auth_mode=none \ |
| 8688 | crt_file=data_files/server7_int-ca.crt \ |
| 8689 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8690 | hs_timeout=2500-60000 \ |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 8691 | max_frag_len=2048" \ |
| 8692 | "$P_CLI dtls=1 debug_level=2 \ |
| 8693 | crt_file=data_files/server8_int-ca2.crt \ |
| 8694 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8695 | hs_timeout=2500-60000 \ |
| 8696 | max_frag_len=1024" \ |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 8697 | 0 \ |
| 8698 | -S "found fragmented DTLS handshake message" \ |
| 8699 | -c "found fragmented DTLS handshake message" \ |
| 8700 | -C "error" |
| 8701 | |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8702 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8703 | requires_config_enabled MBEDTLS_RSA_C |
| 8704 | requires_config_enabled MBEDTLS_ECDSA_C |
| 8705 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8706 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8707 | run_test "DTLS fragmenting: client-initiated, both (max_frag_len)" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8708 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8709 | crt_file=data_files/server7_int-ca.crt \ |
| 8710 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8711 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8712 | max_frag_len=2048" \ |
| 8713 | "$P_CLI dtls=1 debug_level=2 \ |
| 8714 | crt_file=data_files/server8_int-ca2.crt \ |
| 8715 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8716 | hs_timeout=2500-60000 \ |
| 8717 | max_frag_len=1024" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 8718 | 0 \ |
| 8719 | -s "found fragmented DTLS handshake message" \ |
| 8720 | -c "found fragmented DTLS handshake message" \ |
| 8721 | -C "error" |
| 8722 | |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 8723 | # While not required by the standard defining the MFL extension |
| 8724 | # (according to which it only applies to records, not to datagrams), |
| 8725 | # Mbed TLS will never send datagrams larger than MFL + { Max record expansion }, |
| 8726 | # as otherwise there wouldn't be any means to communicate MTU restrictions |
| 8727 | # to the peer. |
| 8728 | # The next test checks that no datagrams significantly larger than the |
| 8729 | # negotiated MFL are sent. |
| 8730 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8731 | requires_config_enabled MBEDTLS_RSA_C |
| 8732 | requires_config_enabled MBEDTLS_ECDSA_C |
| 8733 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8734 | requires_max_content_len 2048 |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 8735 | run_test "DTLS fragmenting: client-initiated, both (max_frag_len), proxy MTU" \ |
Andrzej Kurek | 0fc9cf4 | 2018-10-09 03:09:41 -0400 | [diff] [blame] | 8736 | -p "$P_PXY mtu=1110" \ |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 8737 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8738 | crt_file=data_files/server7_int-ca.crt \ |
| 8739 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8740 | hs_timeout=2500-60000 \ |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 8741 | max_frag_len=2048" \ |
| 8742 | "$P_CLI dtls=1 debug_level=2 \ |
| 8743 | crt_file=data_files/server8_int-ca2.crt \ |
| 8744 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8745 | hs_timeout=2500-60000 \ |
| 8746 | max_frag_len=1024" \ |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 8747 | 0 \ |
| 8748 | -s "found fragmented DTLS handshake message" \ |
| 8749 | -c "found fragmented DTLS handshake message" \ |
| 8750 | -C "error" |
| 8751 | |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8752 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8753 | requires_config_enabled MBEDTLS_RSA_C |
| 8754 | requires_config_enabled MBEDTLS_ECDSA_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8755 | requires_max_content_len 4096 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8756 | run_test "DTLS fragmenting: none (for reference) (MTU)" \ |
| 8757 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8758 | crt_file=data_files/server7_int-ca.crt \ |
| 8759 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8760 | hs_timeout=2500-60000 \ |
Hanno Becker | 12405e7 | 2018-08-13 16:45:46 +0100 | [diff] [blame] | 8761 | mtu=4096" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8762 | "$P_CLI dtls=1 debug_level=2 \ |
| 8763 | crt_file=data_files/server8_int-ca2.crt \ |
| 8764 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8765 | hs_timeout=2500-60000 \ |
Hanno Becker | 12405e7 | 2018-08-13 16:45:46 +0100 | [diff] [blame] | 8766 | mtu=4096" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8767 | 0 \ |
| 8768 | -S "found fragmented DTLS handshake message" \ |
| 8769 | -C "found fragmented DTLS handshake message" \ |
| 8770 | -C "error" |
| 8771 | |
| 8772 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8773 | requires_config_enabled MBEDTLS_RSA_C |
| 8774 | requires_config_enabled MBEDTLS_ECDSA_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8775 | requires_max_content_len 4096 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8776 | run_test "DTLS fragmenting: client (MTU)" \ |
| 8777 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8778 | crt_file=data_files/server7_int-ca.crt \ |
| 8779 | key_file=data_files/server7.key \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 8780 | hs_timeout=3500-60000 \ |
Hanno Becker | 12405e7 | 2018-08-13 16:45:46 +0100 | [diff] [blame] | 8781 | mtu=4096" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8782 | "$P_CLI dtls=1 debug_level=2 \ |
| 8783 | crt_file=data_files/server8_int-ca2.crt \ |
| 8784 | key_file=data_files/server8.key \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 8785 | hs_timeout=3500-60000 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8786 | mtu=1024" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8787 | 0 \ |
| 8788 | -s "found fragmented DTLS handshake message" \ |
| 8789 | -C "found fragmented DTLS handshake message" \ |
| 8790 | -C "error" |
| 8791 | |
| 8792 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8793 | requires_config_enabled MBEDTLS_RSA_C |
| 8794 | requires_config_enabled MBEDTLS_ECDSA_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8795 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8796 | run_test "DTLS fragmenting: server (MTU)" \ |
| 8797 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8798 | crt_file=data_files/server7_int-ca.crt \ |
| 8799 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8800 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8801 | mtu=512" \ |
| 8802 | "$P_CLI dtls=1 debug_level=2 \ |
| 8803 | crt_file=data_files/server8_int-ca2.crt \ |
| 8804 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8805 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8806 | mtu=2048" \ |
| 8807 | 0 \ |
| 8808 | -S "found fragmented DTLS handshake message" \ |
| 8809 | -c "found fragmented DTLS handshake message" \ |
| 8810 | -C "error" |
| 8811 | |
| 8812 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8813 | requires_config_enabled MBEDTLS_RSA_C |
| 8814 | requires_config_enabled MBEDTLS_ECDSA_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8815 | requires_max_content_len 2048 |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8816 | run_test "DTLS fragmenting: both (MTU=1024)" \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8817 | -p "$P_PXY mtu=1024" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8818 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8819 | crt_file=data_files/server7_int-ca.crt \ |
| 8820 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8821 | hs_timeout=2500-60000 \ |
Andrzej Kurek | 9580528 | 2018-10-11 08:55:37 -0400 | [diff] [blame] | 8822 | mtu=1024" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8823 | "$P_CLI dtls=1 debug_level=2 \ |
| 8824 | crt_file=data_files/server8_int-ca2.crt \ |
| 8825 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8826 | hs_timeout=2500-60000 \ |
| 8827 | mtu=1024" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 8828 | 0 \ |
| 8829 | -s "found fragmented DTLS handshake message" \ |
| 8830 | -c "found fragmented DTLS handshake message" \ |
| 8831 | -C "error" |
| 8832 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 8833 | # Forcing ciphersuite for this test to fit the MTU of 512 with full config. |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8834 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8835 | requires_config_enabled MBEDTLS_RSA_C |
| 8836 | requires_config_enabled MBEDTLS_ECDSA_C |
| 8837 | requires_config_enabled MBEDTLS_SHA256_C |
Gilles Peskine | e7738c3 | 2021-07-13 20:34:55 +0200 | [diff] [blame] | 8838 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8839 | requires_config_enabled MBEDTLS_AES_C |
| 8840 | requires_config_enabled MBEDTLS_GCM_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8841 | requires_max_content_len 2048 |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8842 | run_test "DTLS fragmenting: both (MTU=512)" \ |
Hanno Becker | 8d83218 | 2018-03-15 10:14:19 +0000 | [diff] [blame] | 8843 | -p "$P_PXY mtu=512" \ |
Hanno Becker | 72a4f03 | 2017-11-15 16:39:20 +0000 | [diff] [blame] | 8844 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8845 | crt_file=data_files/server7_int-ca.crt \ |
| 8846 | key_file=data_files/server7.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8847 | hs_timeout=2500-60000 \ |
Hanno Becker | 72a4f03 | 2017-11-15 16:39:20 +0000 | [diff] [blame] | 8848 | mtu=512" \ |
| 8849 | "$P_CLI dtls=1 debug_level=2 \ |
| 8850 | crt_file=data_files/server8_int-ca2.crt \ |
| 8851 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8852 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 8853 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 8854 | mtu=512" \ |
Manuel Pégourié-Gonnard | 63eca93 | 2014-09-08 16:39:08 +0200 | [diff] [blame] | 8855 | 0 \ |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 8856 | -s "found fragmented DTLS handshake message" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 8857 | -c "found fragmented DTLS handshake message" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 8858 | -C "error" |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 8859 | |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8860 | # Test for automatic MTU reduction on repeated resend. |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 8861 | # Forcing ciphersuite for this test to fit the MTU of 508 with full config. |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8862 | # The ratio of max/min timeout should ideally equal 4 to accept two |
| 8863 | # retransmissions, but in some cases (like both the server and client using |
| 8864 | # fragmentation and auto-reduction) an extra retransmission might occur, |
| 8865 | # hence the ratio of 8. |
Hanno Becker | 37029eb | 2018-08-29 17:01:40 +0100 | [diff] [blame] | 8866 | not_with_valgrind |
Manuel Pégourié-Gonnard | b8eec19 | 2018-08-20 09:34:02 +0200 | [diff] [blame] | 8867 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8868 | requires_config_enabled MBEDTLS_RSA_C |
| 8869 | requires_config_enabled MBEDTLS_ECDSA_C |
Gilles Peskine | e7738c3 | 2021-07-13 20:34:55 +0200 | [diff] [blame] | 8870 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8871 | requires_config_enabled MBEDTLS_AES_C |
| 8872 | requires_config_enabled MBEDTLS_GCM_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8873 | requires_max_content_len 2048 |
Gilles Peskine | 0d8b86a | 2019-09-20 18:03:11 +0200 | [diff] [blame] | 8874 | run_test "DTLS fragmenting: proxy MTU: auto-reduction (not valgrind)" \ |
Manuel Pégourié-Gonnard | b8eec19 | 2018-08-20 09:34:02 +0200 | [diff] [blame] | 8875 | -p "$P_PXY mtu=508" \ |
| 8876 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8877 | crt_file=data_files/server7_int-ca.crt \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8878 | key_file=data_files/server7.key \ |
| 8879 | hs_timeout=400-3200" \ |
Manuel Pégourié-Gonnard | b8eec19 | 2018-08-20 09:34:02 +0200 | [diff] [blame] | 8880 | "$P_CLI dtls=1 debug_level=2 \ |
| 8881 | crt_file=data_files/server8_int-ca2.crt \ |
| 8882 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8883 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 8884 | hs_timeout=400-3200" \ |
Manuel Pégourié-Gonnard | b8eec19 | 2018-08-20 09:34:02 +0200 | [diff] [blame] | 8885 | 0 \ |
| 8886 | -s "found fragmented DTLS handshake message" \ |
| 8887 | -c "found fragmented DTLS handshake message" \ |
| 8888 | -C "error" |
| 8889 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 8890 | # Forcing ciphersuite for this test to fit the MTU of 508 with full config. |
Hanno Becker | 108992e | 2018-08-29 17:04:18 +0100 | [diff] [blame] | 8891 | only_with_valgrind |
| 8892 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8893 | requires_config_enabled MBEDTLS_RSA_C |
| 8894 | requires_config_enabled MBEDTLS_ECDSA_C |
Gilles Peskine | e7738c3 | 2021-07-13 20:34:55 +0200 | [diff] [blame] | 8895 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8896 | requires_config_enabled MBEDTLS_AES_C |
| 8897 | requires_config_enabled MBEDTLS_GCM_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8898 | requires_max_content_len 2048 |
Gilles Peskine | 0d8b86a | 2019-09-20 18:03:11 +0200 | [diff] [blame] | 8899 | run_test "DTLS fragmenting: proxy MTU: auto-reduction (with valgrind)" \ |
Hanno Becker | 108992e | 2018-08-29 17:04:18 +0100 | [diff] [blame] | 8900 | -p "$P_PXY mtu=508" \ |
| 8901 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8902 | crt_file=data_files/server7_int-ca.crt \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8903 | key_file=data_files/server7.key \ |
Hanno Becker | 108992e | 2018-08-29 17:04:18 +0100 | [diff] [blame] | 8904 | hs_timeout=250-10000" \ |
| 8905 | "$P_CLI dtls=1 debug_level=2 \ |
| 8906 | crt_file=data_files/server8_int-ca2.crt \ |
| 8907 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8908 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Hanno Becker | 108992e | 2018-08-29 17:04:18 +0100 | [diff] [blame] | 8909 | hs_timeout=250-10000" \ |
| 8910 | 0 \ |
| 8911 | -s "found fragmented DTLS handshake message" \ |
| 8912 | -c "found fragmented DTLS handshake message" \ |
| 8913 | -C "error" |
| 8914 | |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 8915 | # the proxy shouldn't drop or mess up anything, so we shouldn't need to resend |
Manuel Pégourié-Gonnard | 3d183ce | 2018-08-22 09:56:22 +0200 | [diff] [blame] | 8916 | # OTOH the client might resend if the server is to slow to reset after sending |
| 8917 | # a HelloVerifyRequest, so only check for no retransmission server-side |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 8918 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 8919 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8920 | requires_config_enabled MBEDTLS_RSA_C |
| 8921 | requires_config_enabled MBEDTLS_ECDSA_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8922 | requires_max_content_len 2048 |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8923 | run_test "DTLS fragmenting: proxy MTU, simple handshake (MTU=1024)" \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8924 | -p "$P_PXY mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 8925 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8926 | crt_file=data_files/server7_int-ca.crt \ |
| 8927 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8928 | hs_timeout=10000-60000 \ |
| 8929 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 8930 | "$P_CLI dtls=1 debug_level=2 \ |
| 8931 | crt_file=data_files/server8_int-ca2.crt \ |
| 8932 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8933 | hs_timeout=10000-60000 \ |
| 8934 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 8935 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 8936 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 8937 | -s "found fragmented DTLS handshake message" \ |
| 8938 | -c "found fragmented DTLS handshake message" \ |
| 8939 | -C "error" |
| 8940 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 8941 | # Forcing ciphersuite for this test to fit the MTU of 512 with full config. |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8942 | # the proxy shouldn't drop or mess up anything, so we shouldn't need to resend |
| 8943 | # OTOH the client might resend if the server is to slow to reset after sending |
| 8944 | # a HelloVerifyRequest, so only check for no retransmission server-side |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 8945 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 8946 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8947 | requires_config_enabled MBEDTLS_RSA_C |
| 8948 | requires_config_enabled MBEDTLS_ECDSA_C |
Gilles Peskine | e7738c3 | 2021-07-13 20:34:55 +0200 | [diff] [blame] | 8949 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8950 | requires_config_enabled MBEDTLS_AES_C |
| 8951 | requires_config_enabled MBEDTLS_GCM_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8952 | requires_max_content_len 2048 |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8953 | run_test "DTLS fragmenting: proxy MTU, simple handshake (MTU=512)" \ |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 8954 | -p "$P_PXY mtu=512" \ |
| 8955 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8956 | crt_file=data_files/server7_int-ca.crt \ |
| 8957 | key_file=data_files/server7.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8958 | hs_timeout=10000-60000 \ |
| 8959 | mtu=512" \ |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 8960 | "$P_CLI dtls=1 debug_level=2 \ |
| 8961 | crt_file=data_files/server8_int-ca2.crt \ |
| 8962 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8963 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 8964 | hs_timeout=10000-60000 \ |
| 8965 | mtu=512" \ |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 8966 | 0 \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8967 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 8968 | -s "found fragmented DTLS handshake message" \ |
| 8969 | -c "found fragmented DTLS handshake message" \ |
| 8970 | -C "error" |
| 8971 | |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8972 | not_with_valgrind # spurious autoreduction due to timeout |
| 8973 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8974 | requires_config_enabled MBEDTLS_RSA_C |
| 8975 | requires_config_enabled MBEDTLS_ECDSA_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8976 | requires_max_content_len 2048 |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8977 | run_test "DTLS fragmenting: proxy MTU, simple handshake, nbio (MTU=1024)" \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 8978 | -p "$P_PXY mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 8979 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 8980 | crt_file=data_files/server7_int-ca.crt \ |
| 8981 | key_file=data_files/server7.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8982 | hs_timeout=10000-60000 \ |
| 8983 | mtu=1024 nbio=2" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 8984 | "$P_CLI dtls=1 debug_level=2 \ |
| 8985 | crt_file=data_files/server8_int-ca2.crt \ |
| 8986 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8987 | hs_timeout=10000-60000 \ |
| 8988 | mtu=1024 nbio=2" \ |
| 8989 | 0 \ |
| 8990 | -S "autoreduction" \ |
| 8991 | -s "found fragmented DTLS handshake message" \ |
| 8992 | -c "found fragmented DTLS handshake message" \ |
| 8993 | -C "error" |
| 8994 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 8995 | # Forcing ciphersuite for this test to fit the MTU of 512 with full config. |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 8996 | not_with_valgrind # spurious autoreduction due to timeout |
| 8997 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8998 | requires_config_enabled MBEDTLS_RSA_C |
| 8999 | requires_config_enabled MBEDTLS_ECDSA_C |
Gilles Peskine | e7738c3 | 2021-07-13 20:34:55 +0200 | [diff] [blame] | 9000 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9001 | requires_config_enabled MBEDTLS_AES_C |
| 9002 | requires_config_enabled MBEDTLS_GCM_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9003 | requires_max_content_len 2048 |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9004 | run_test "DTLS fragmenting: proxy MTU, simple handshake, nbio (MTU=512)" \ |
| 9005 | -p "$P_PXY mtu=512" \ |
| 9006 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9007 | crt_file=data_files/server7_int-ca.crt \ |
| 9008 | key_file=data_files/server7.key \ |
| 9009 | hs_timeout=10000-60000 \ |
| 9010 | mtu=512 nbio=2" \ |
| 9011 | "$P_CLI dtls=1 debug_level=2 \ |
| 9012 | crt_file=data_files/server8_int-ca2.crt \ |
| 9013 | key_file=data_files/server8.key \ |
| 9014 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 9015 | hs_timeout=10000-60000 \ |
| 9016 | mtu=512 nbio=2" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9017 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9018 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9019 | -s "found fragmented DTLS handshake message" \ |
| 9020 | -c "found fragmented DTLS handshake message" \ |
| 9021 | -C "error" |
| 9022 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 9023 | # Forcing ciphersuite for this test to fit the MTU of 1450 with full config. |
Hanno Becker | b841b4f | 2018-08-28 10:25:51 +0100 | [diff] [blame] | 9024 | # This ensures things still work after session_reset(). |
| 9025 | # It also exercises the "resumed handshake" flow. |
Manuel Pégourié-Gonnard | 19c62f9 | 2018-08-16 10:50:39 +0200 | [diff] [blame] | 9026 | # Since we don't support reading fragmented ClientHello yet, |
| 9027 | # up the MTU to 1450 (larger than ClientHello with session ticket, |
| 9028 | # but still smaller than client's Certificate to ensure fragmentation). |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9029 | # An autoreduction on the client-side might happen if the server is |
| 9030 | # slow to reset, therefore omitting '-C "autoreduction"' below. |
Manuel Pégourié-Gonnard | 2f2d902 | 2018-08-21 12:17:54 +0200 | [diff] [blame] | 9031 | # reco_delay avoids races where the client reconnects before the server has |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9032 | # resumed listening, which would result in a spurious autoreduction. |
| 9033 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 19c62f9 | 2018-08-16 10:50:39 +0200 | [diff] [blame] | 9034 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9035 | requires_config_enabled MBEDTLS_RSA_C |
| 9036 | requires_config_enabled MBEDTLS_ECDSA_C |
Gilles Peskine | e7738c3 | 2021-07-13 20:34:55 +0200 | [diff] [blame] | 9037 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9038 | requires_config_enabled MBEDTLS_AES_C |
| 9039 | requires_config_enabled MBEDTLS_GCM_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9040 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 19c62f9 | 2018-08-16 10:50:39 +0200 | [diff] [blame] | 9041 | run_test "DTLS fragmenting: proxy MTU, resumed handshake" \ |
| 9042 | -p "$P_PXY mtu=1450" \ |
| 9043 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9044 | crt_file=data_files/server7_int-ca.crt \ |
| 9045 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9046 | hs_timeout=10000-60000 \ |
Manuel Pégourié-Gonnard | 19c62f9 | 2018-08-16 10:50:39 +0200 | [diff] [blame] | 9047 | mtu=1450" \ |
| 9048 | "$P_CLI dtls=1 debug_level=2 \ |
| 9049 | crt_file=data_files/server8_int-ca2.crt \ |
| 9050 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9051 | hs_timeout=10000-60000 \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9052 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 9053 | mtu=1450 reconnect=1 skip_close_notify=1 reco_delay=1" \ |
Manuel Pégourié-Gonnard | 19c62f9 | 2018-08-16 10:50:39 +0200 | [diff] [blame] | 9054 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9055 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 19c62f9 | 2018-08-16 10:50:39 +0200 | [diff] [blame] | 9056 | -s "found fragmented DTLS handshake message" \ |
| 9057 | -c "found fragmented DTLS handshake message" \ |
| 9058 | -C "error" |
| 9059 | |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9060 | # An autoreduction on the client-side might happen if the server is |
| 9061 | # slow to reset, therefore omitting '-C "autoreduction"' below. |
| 9062 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9063 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9064 | requires_config_enabled MBEDTLS_RSA_C |
| 9065 | requires_config_enabled MBEDTLS_ECDSA_C |
| 9066 | requires_config_enabled MBEDTLS_SHA256_C |
Gilles Peskine | e7738c3 | 2021-07-13 20:34:55 +0200 | [diff] [blame] | 9067 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9068 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9069 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9070 | run_test "DTLS fragmenting: proxy MTU, ChachaPoly renego" \ |
| 9071 | -p "$P_PXY mtu=512" \ |
| 9072 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9073 | crt_file=data_files/server7_int-ca.crt \ |
| 9074 | key_file=data_files/server7.key \ |
| 9075 | exchanges=2 renegotiation=1 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9076 | hs_timeout=10000-60000 \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9077 | mtu=512" \ |
| 9078 | "$P_CLI dtls=1 debug_level=2 \ |
| 9079 | crt_file=data_files/server8_int-ca2.crt \ |
| 9080 | key_file=data_files/server8.key \ |
| 9081 | exchanges=2 renegotiation=1 renegotiate=1 \ |
Ronald Cron | ba77a66 | 2023-11-28 17:52:42 +0100 | [diff] [blame] | 9082 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9083 | hs_timeout=10000-60000 \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9084 | mtu=512" \ |
| 9085 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9086 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9087 | -s "found fragmented DTLS handshake message" \ |
| 9088 | -c "found fragmented DTLS handshake message" \ |
| 9089 | -C "error" |
| 9090 | |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9091 | # An autoreduction on the client-side might happen if the server is |
| 9092 | # slow to reset, therefore omitting '-C "autoreduction"' below. |
| 9093 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9094 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9095 | requires_config_enabled MBEDTLS_RSA_C |
| 9096 | requires_config_enabled MBEDTLS_ECDSA_C |
| 9097 | requires_config_enabled MBEDTLS_SHA256_C |
Gilles Peskine | e7738c3 | 2021-07-13 20:34:55 +0200 | [diff] [blame] | 9098 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9099 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9100 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9101 | run_test "DTLS fragmenting: proxy MTU, AES-GCM renego" \ |
| 9102 | -p "$P_PXY mtu=512" \ |
| 9103 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9104 | crt_file=data_files/server7_int-ca.crt \ |
| 9105 | key_file=data_files/server7.key \ |
| 9106 | exchanges=2 renegotiation=1 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9107 | hs_timeout=10000-60000 \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9108 | mtu=512" \ |
| 9109 | "$P_CLI dtls=1 debug_level=2 \ |
| 9110 | crt_file=data_files/server8_int-ca2.crt \ |
| 9111 | key_file=data_files/server8.key \ |
| 9112 | exchanges=2 renegotiation=1 renegotiate=1 \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9113 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9114 | hs_timeout=10000-60000 \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9115 | mtu=512" \ |
| 9116 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9117 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9118 | -s "found fragmented DTLS handshake message" \ |
| 9119 | -c "found fragmented DTLS handshake message" \ |
| 9120 | -C "error" |
| 9121 | |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9122 | # An autoreduction on the client-side might happen if the server is |
| 9123 | # slow to reset, therefore omitting '-C "autoreduction"' below. |
| 9124 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9125 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9126 | requires_config_enabled MBEDTLS_RSA_C |
| 9127 | requires_config_enabled MBEDTLS_ECDSA_C |
| 9128 | requires_config_enabled MBEDTLS_SHA256_C |
Gilles Peskine | e7738c3 | 2021-07-13 20:34:55 +0200 | [diff] [blame] | 9129 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9130 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9131 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9132 | run_test "DTLS fragmenting: proxy MTU, AES-CCM renego" \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9133 | -p "$P_PXY mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9134 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9135 | crt_file=data_files/server7_int-ca.crt \ |
| 9136 | key_file=data_files/server7.key \ |
| 9137 | exchanges=2 renegotiation=1 \ |
| 9138 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9139 | hs_timeout=10000-60000 \ |
| 9140 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9141 | "$P_CLI dtls=1 debug_level=2 \ |
| 9142 | crt_file=data_files/server8_int-ca2.crt \ |
| 9143 | key_file=data_files/server8.key \ |
| 9144 | exchanges=2 renegotiation=1 renegotiate=1 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9145 | hs_timeout=10000-60000 \ |
| 9146 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9147 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9148 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9149 | -s "found fragmented DTLS handshake message" \ |
| 9150 | -c "found fragmented DTLS handshake message" \ |
| 9151 | -C "error" |
| 9152 | |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9153 | # An autoreduction on the client-side might happen if the server is |
| 9154 | # slow to reset, therefore omitting '-C "autoreduction"' below. |
| 9155 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9156 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9157 | requires_config_enabled MBEDTLS_RSA_C |
| 9158 | requires_config_enabled MBEDTLS_ECDSA_C |
| 9159 | requires_config_enabled MBEDTLS_SHA256_C |
Gilles Peskine | e7738c3 | 2021-07-13 20:34:55 +0200 | [diff] [blame] | 9160 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9161 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9162 | requires_config_enabled MBEDTLS_SSL_ENCRYPT_THEN_MAC |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9163 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9164 | run_test "DTLS fragmenting: proxy MTU, AES-CBC EtM renego" \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9165 | -p "$P_PXY mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9166 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9167 | crt_file=data_files/server7_int-ca.crt \ |
| 9168 | key_file=data_files/server7.key \ |
| 9169 | exchanges=2 renegotiation=1 \ |
| 9170 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9171 | hs_timeout=10000-60000 \ |
| 9172 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9173 | "$P_CLI dtls=1 debug_level=2 \ |
| 9174 | crt_file=data_files/server8_int-ca2.crt \ |
| 9175 | key_file=data_files/server8.key \ |
| 9176 | exchanges=2 renegotiation=1 renegotiate=1 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9177 | hs_timeout=10000-60000 \ |
| 9178 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9179 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9180 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9181 | -s "found fragmented DTLS handshake message" \ |
| 9182 | -c "found fragmented DTLS handshake message" \ |
| 9183 | -C "error" |
| 9184 | |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9185 | # An autoreduction on the client-side might happen if the server is |
| 9186 | # slow to reset, therefore omitting '-C "autoreduction"' below. |
| 9187 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9188 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9189 | requires_config_enabled MBEDTLS_RSA_C |
| 9190 | requires_config_enabled MBEDTLS_ECDSA_C |
| 9191 | requires_config_enabled MBEDTLS_SHA256_C |
Gilles Peskine | e7738c3 | 2021-07-13 20:34:55 +0200 | [diff] [blame] | 9192 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9193 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9194 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9195 | run_test "DTLS fragmenting: proxy MTU, AES-CBC non-EtM renego" \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9196 | -p "$P_PXY mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9197 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9198 | crt_file=data_files/server7_int-ca.crt \ |
| 9199 | key_file=data_files/server7.key \ |
| 9200 | exchanges=2 renegotiation=1 \ |
| 9201 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 etm=0 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9202 | hs_timeout=10000-60000 \ |
| 9203 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9204 | "$P_CLI dtls=1 debug_level=2 \ |
| 9205 | crt_file=data_files/server8_int-ca2.crt \ |
| 9206 | key_file=data_files/server8.key \ |
| 9207 | exchanges=2 renegotiation=1 renegotiate=1 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9208 | hs_timeout=10000-60000 \ |
| 9209 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9210 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9211 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9212 | -s "found fragmented DTLS handshake message" \ |
| 9213 | -c "found fragmented DTLS handshake message" \ |
| 9214 | -C "error" |
| 9215 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 9216 | # Forcing ciphersuite for this test to fit the MTU of 512 with full config. |
Manuel Pégourié-Gonnard | 2d56f0d | 2018-08-16 11:09:03 +0200 | [diff] [blame] | 9217 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9218 | requires_config_enabled MBEDTLS_RSA_C |
| 9219 | requires_config_enabled MBEDTLS_ECDSA_C |
Gilles Peskine | e7738c3 | 2021-07-13 20:34:55 +0200 | [diff] [blame] | 9220 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9221 | requires_config_enabled MBEDTLS_AES_C |
| 9222 | requires_config_enabled MBEDTLS_GCM_C |
Manuel Pégourié-Gonnard | 2d56f0d | 2018-08-16 11:09:03 +0200 | [diff] [blame] | 9223 | client_needs_more_time 2 |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9224 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 2d56f0d | 2018-08-16 11:09:03 +0200 | [diff] [blame] | 9225 | run_test "DTLS fragmenting: proxy MTU + 3d" \ |
| 9226 | -p "$P_PXY mtu=512 drop=8 delay=8 duplicate=8" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 9227 | "$P_SRV dgram_packing=0 dtls=1 debug_level=2 auth_mode=required \ |
Manuel Pégourié-Gonnard | 2d56f0d | 2018-08-16 11:09:03 +0200 | [diff] [blame] | 9228 | crt_file=data_files/server7_int-ca.crt \ |
| 9229 | key_file=data_files/server7.key \ |
Manuel Pégourié-Gonnard | 02f3a8a | 2018-08-20 10:49:28 +0200 | [diff] [blame] | 9230 | hs_timeout=250-10000 mtu=512" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 9231 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 2d56f0d | 2018-08-16 11:09:03 +0200 | [diff] [blame] | 9232 | crt_file=data_files/server8_int-ca2.crt \ |
| 9233 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9234 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 02f3a8a | 2018-08-20 10:49:28 +0200 | [diff] [blame] | 9235 | hs_timeout=250-10000 mtu=512" \ |
Manuel Pégourié-Gonnard | 2d56f0d | 2018-08-16 11:09:03 +0200 | [diff] [blame] | 9236 | 0 \ |
| 9237 | -s "found fragmented DTLS handshake message" \ |
| 9238 | -c "found fragmented DTLS handshake message" \ |
| 9239 | -C "error" |
| 9240 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 9241 | # Forcing ciphersuite for this test to fit the MTU of 512 with full config. |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 9242 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9243 | requires_config_enabled MBEDTLS_RSA_C |
| 9244 | requires_config_enabled MBEDTLS_ECDSA_C |
Gilles Peskine | e7738c3 | 2021-07-13 20:34:55 +0200 | [diff] [blame] | 9245 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9246 | requires_config_enabled MBEDTLS_AES_C |
| 9247 | requires_config_enabled MBEDTLS_GCM_C |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 9248 | client_needs_more_time 2 |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9249 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 9250 | run_test "DTLS fragmenting: proxy MTU + 3d, nbio" \ |
| 9251 | -p "$P_PXY mtu=512 drop=8 delay=8 duplicate=8" \ |
| 9252 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9253 | crt_file=data_files/server7_int-ca.crt \ |
| 9254 | key_file=data_files/server7.key \ |
| 9255 | hs_timeout=250-10000 mtu=512 nbio=2" \ |
| 9256 | "$P_CLI dtls=1 debug_level=2 \ |
| 9257 | crt_file=data_files/server8_int-ca2.crt \ |
| 9258 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9259 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 9260 | hs_timeout=250-10000 mtu=512 nbio=2" \ |
| 9261 | 0 \ |
| 9262 | -s "found fragmented DTLS handshake message" \ |
| 9263 | -c "found fragmented DTLS handshake message" \ |
| 9264 | -C "error" |
| 9265 | |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9266 | # interop tests for DTLS fragmentating with reliable connection |
| 9267 | # |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9268 | # here and below we just want to test that the we fragment in a way that |
| 9269 | # pleases other implementations, so we don't need the peer to fragment |
| 9270 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9271 | requires_config_enabled MBEDTLS_RSA_C |
| 9272 | requires_config_enabled MBEDTLS_ECDSA_C |
Manuel Pégourié-Gonnard | 6151298 | 2018-08-21 09:40:07 +0200 | [diff] [blame] | 9273 | requires_gnutls |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9274 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9275 | run_test "DTLS fragmenting: gnutls server, DTLS 1.2" \ |
| 9276 | "$G_SRV -u" \ |
| 9277 | "$P_CLI dtls=1 debug_level=2 \ |
| 9278 | crt_file=data_files/server8_int-ca2.crt \ |
| 9279 | key_file=data_files/server8.key \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 9280 | mtu=512 force_version=dtls12" \ |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9281 | 0 \ |
| 9282 | -c "fragmenting handshake message" \ |
| 9283 | -C "error" |
| 9284 | |
| 9285 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9286 | requires_config_enabled MBEDTLS_RSA_C |
| 9287 | requires_config_enabled MBEDTLS_ECDSA_C |
Manuel Pégourié-Gonnard | 6151298 | 2018-08-21 09:40:07 +0200 | [diff] [blame] | 9288 | requires_gnutls |
Yuto Takano | 75ab928 | 2021-07-26 08:27:47 +0100 | [diff] [blame] | 9289 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9290 | run_test "DTLS fragmenting: gnutls server, DTLS 1.0" \ |
| 9291 | "$G_SRV -u" \ |
| 9292 | "$P_CLI dtls=1 debug_level=2 \ |
| 9293 | crt_file=data_files/server8_int-ca2.crt \ |
| 9294 | key_file=data_files/server8.key \ |
Manuel Pégourié-Gonnard | 02f3a8a | 2018-08-20 10:49:28 +0200 | [diff] [blame] | 9295 | mtu=512 force_version=dtls1" \ |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9296 | 0 \ |
| 9297 | -c "fragmenting handshake message" \ |
| 9298 | -C "error" |
| 9299 | |
Hanno Becker | b9a0086 | 2018-08-28 10:20:22 +0100 | [diff] [blame] | 9300 | # We use --insecure for the GnuTLS client because it expects |
| 9301 | # the hostname / IP it connects to to be the name used in the |
| 9302 | # certificate obtained from the server. Here, however, it |
| 9303 | # connects to 127.0.0.1 while our test certificates use 'localhost' |
| 9304 | # as the server name in the certificate. This will make the |
Shaun Case | 0e7791f | 2021-12-20 21:14:10 -0800 | [diff] [blame] | 9305 | # certificate validation fail, but passing --insecure makes |
Hanno Becker | b9a0086 | 2018-08-28 10:20:22 +0100 | [diff] [blame] | 9306 | # GnuTLS continue the connection nonetheless. |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9307 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9308 | requires_config_enabled MBEDTLS_RSA_C |
| 9309 | requires_config_enabled MBEDTLS_ECDSA_C |
Manuel Pégourié-Gonnard | 6151298 | 2018-08-21 09:40:07 +0200 | [diff] [blame] | 9310 | requires_gnutls |
Andrzej Kurek | b459346 | 2018-10-11 08:43:30 -0400 | [diff] [blame] | 9311 | requires_not_i686 |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9312 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9313 | run_test "DTLS fragmenting: gnutls client, DTLS 1.2" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 9314 | "$P_SRV dtls=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9315 | crt_file=data_files/server7_int-ca.crt \ |
| 9316 | key_file=data_files/server7.key \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 9317 | mtu=512 force_version=dtls12" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 9318 | "$G_CLI -u --insecure 127.0.0.1" \ |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9319 | 0 \ |
| 9320 | -s "fragmenting handshake message" |
| 9321 | |
Hanno Becker | b9a0086 | 2018-08-28 10:20:22 +0100 | [diff] [blame] | 9322 | # See previous test for the reason to use --insecure |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9323 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9324 | requires_config_enabled MBEDTLS_RSA_C |
| 9325 | requires_config_enabled MBEDTLS_ECDSA_C |
Manuel Pégourié-Gonnard | 6151298 | 2018-08-21 09:40:07 +0200 | [diff] [blame] | 9326 | requires_gnutls |
Andrzej Kurek | b459346 | 2018-10-11 08:43:30 -0400 | [diff] [blame] | 9327 | requires_not_i686 |
Yuto Takano | 75ab928 | 2021-07-26 08:27:47 +0100 | [diff] [blame] | 9328 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9329 | run_test "DTLS fragmenting: gnutls client, DTLS 1.0" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 9330 | "$P_SRV dtls=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9331 | crt_file=data_files/server7_int-ca.crt \ |
| 9332 | key_file=data_files/server7.key \ |
| 9333 | mtu=512 force_version=dtls1" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 9334 | "$G_CLI -u --insecure 127.0.0.1" \ |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9335 | 0 \ |
| 9336 | -s "fragmenting handshake message" |
| 9337 | |
| 9338 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9339 | requires_config_enabled MBEDTLS_RSA_C |
| 9340 | requires_config_enabled MBEDTLS_ECDSA_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9341 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9342 | run_test "DTLS fragmenting: openssl server, DTLS 1.2" \ |
| 9343 | "$O_SRV -dtls1_2 -verify 10" \ |
| 9344 | "$P_CLI dtls=1 debug_level=2 \ |
| 9345 | crt_file=data_files/server8_int-ca2.crt \ |
| 9346 | key_file=data_files/server8.key \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 9347 | mtu=512 force_version=dtls12" \ |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9348 | 0 \ |
| 9349 | -c "fragmenting handshake message" \ |
| 9350 | -C "error" |
| 9351 | |
| 9352 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9353 | requires_config_enabled MBEDTLS_RSA_C |
| 9354 | requires_config_enabled MBEDTLS_ECDSA_C |
Yuto Takano | 75ab928 | 2021-07-26 08:27:47 +0100 | [diff] [blame] | 9355 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9356 | run_test "DTLS fragmenting: openssl server, DTLS 1.0" \ |
| 9357 | "$O_SRV -dtls1 -verify 10" \ |
| 9358 | "$P_CLI dtls=1 debug_level=2 \ |
| 9359 | crt_file=data_files/server8_int-ca2.crt \ |
| 9360 | key_file=data_files/server8.key \ |
| 9361 | mtu=512 force_version=dtls1" \ |
| 9362 | 0 \ |
| 9363 | -c "fragmenting handshake message" \ |
| 9364 | -C "error" |
| 9365 | |
| 9366 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9367 | requires_config_enabled MBEDTLS_RSA_C |
| 9368 | requires_config_enabled MBEDTLS_ECDSA_C |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9369 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9370 | run_test "DTLS fragmenting: openssl client, DTLS 1.2" \ |
| 9371 | "$P_SRV dtls=1 debug_level=2 \ |
| 9372 | crt_file=data_files/server7_int-ca.crt \ |
| 9373 | key_file=data_files/server7.key \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 9374 | mtu=512 force_version=dtls12" \ |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9375 | "$O_CLI -dtls1_2" \ |
| 9376 | 0 \ |
| 9377 | -s "fragmenting handshake message" |
| 9378 | |
| 9379 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9380 | requires_config_enabled MBEDTLS_RSA_C |
| 9381 | requires_config_enabled MBEDTLS_ECDSA_C |
Yuto Takano | 75ab928 | 2021-07-26 08:27:47 +0100 | [diff] [blame] | 9382 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 9383 | run_test "DTLS fragmenting: openssl client, DTLS 1.0" \ |
| 9384 | "$P_SRV dtls=1 debug_level=2 \ |
| 9385 | crt_file=data_files/server7_int-ca.crt \ |
| 9386 | key_file=data_files/server7.key \ |
| 9387 | mtu=512 force_version=dtls1" \ |
| 9388 | "$O_CLI -dtls1" \ |
| 9389 | 0 \ |
| 9390 | -s "fragmenting handshake message" |
| 9391 | |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9392 | # interop tests for DTLS fragmentating with unreliable connection |
| 9393 | # |
| 9394 | # again we just want to test that the we fragment in a way that |
| 9395 | # pleases other implementations, so we don't need the peer to fragment |
| 9396 | requires_gnutls_next |
| 9397 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9398 | requires_config_enabled MBEDTLS_RSA_C |
| 9399 | requires_config_enabled MBEDTLS_ECDSA_C |
Manuel Pégourié-Gonnard | 02f3a8a | 2018-08-20 10:49:28 +0200 | [diff] [blame] | 9400 | client_needs_more_time 4 |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9401 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9402 | run_test "DTLS fragmenting: 3d, gnutls server, DTLS 1.2" \ |
| 9403 | -p "$P_PXY drop=8 delay=8 duplicate=8" \ |
| 9404 | "$G_NEXT_SRV -u" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 9405 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9406 | crt_file=data_files/server8_int-ca2.crt \ |
| 9407 | key_file=data_files/server8.key \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 9408 | hs_timeout=250-60000 mtu=512 force_version=dtls12" \ |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9409 | 0 \ |
| 9410 | -c "fragmenting handshake message" \ |
| 9411 | -C "error" |
| 9412 | |
| 9413 | requires_gnutls_next |
| 9414 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9415 | requires_config_enabled MBEDTLS_RSA_C |
| 9416 | requires_config_enabled MBEDTLS_ECDSA_C |
Manuel Pégourié-Gonnard | 02f3a8a | 2018-08-20 10:49:28 +0200 | [diff] [blame] | 9417 | client_needs_more_time 4 |
Yuto Takano | 75ab928 | 2021-07-26 08:27:47 +0100 | [diff] [blame] | 9418 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9419 | run_test "DTLS fragmenting: 3d, gnutls server, DTLS 1.0" \ |
| 9420 | -p "$P_PXY drop=8 delay=8 duplicate=8" \ |
| 9421 | "$G_NEXT_SRV -u" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 9422 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9423 | crt_file=data_files/server8_int-ca2.crt \ |
| 9424 | key_file=data_files/server8.key \ |
Manuel Pégourié-Gonnard | 02f3a8a | 2018-08-20 10:49:28 +0200 | [diff] [blame] | 9425 | hs_timeout=250-60000 mtu=512 force_version=dtls1" \ |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9426 | 0 \ |
| 9427 | -c "fragmenting handshake message" \ |
| 9428 | -C "error" |
| 9429 | |
k-stachowiak | 17a38d3 | 2019-02-18 15:29:56 +0100 | [diff] [blame] | 9430 | requires_gnutls_next |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 9431 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9432 | requires_config_enabled MBEDTLS_RSA_C |
| 9433 | requires_config_enabled MBEDTLS_ECDSA_C |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 9434 | client_needs_more_time 4 |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9435 | requires_max_content_len 2048 |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 9436 | run_test "DTLS fragmenting: 3d, gnutls client, DTLS 1.2" \ |
| 9437 | -p "$P_PXY drop=8 delay=8 duplicate=8" \ |
| 9438 | "$P_SRV dtls=1 debug_level=2 \ |
| 9439 | crt_file=data_files/server7_int-ca.crt \ |
| 9440 | key_file=data_files/server7.key \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 9441 | hs_timeout=250-60000 mtu=512 force_version=dtls12" \ |
k-stachowiak | 17a38d3 | 2019-02-18 15:29:56 +0100 | [diff] [blame] | 9442 | "$G_NEXT_CLI -u --insecure 127.0.0.1" \ |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 9443 | 0 \ |
| 9444 | -s "fragmenting handshake message" |
| 9445 | |
k-stachowiak | 17a38d3 | 2019-02-18 15:29:56 +0100 | [diff] [blame] | 9446 | requires_gnutls_next |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 9447 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9448 | requires_config_enabled MBEDTLS_RSA_C |
| 9449 | requires_config_enabled MBEDTLS_ECDSA_C |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 9450 | client_needs_more_time 4 |
Yuto Takano | 75ab928 | 2021-07-26 08:27:47 +0100 | [diff] [blame] | 9451 | requires_max_content_len 2048 |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 9452 | run_test "DTLS fragmenting: 3d, gnutls client, DTLS 1.0" \ |
| 9453 | -p "$P_PXY drop=8 delay=8 duplicate=8" \ |
| 9454 | "$P_SRV dtls=1 debug_level=2 \ |
| 9455 | crt_file=data_files/server7_int-ca.crt \ |
| 9456 | key_file=data_files/server7.key \ |
| 9457 | hs_timeout=250-60000 mtu=512 force_version=dtls1" \ |
k-stachowiak | 17a38d3 | 2019-02-18 15:29:56 +0100 | [diff] [blame] | 9458 | "$G_NEXT_CLI -u --insecure 127.0.0.1" \ |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 9459 | 0 \ |
| 9460 | -s "fragmenting handshake message" |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9461 | |
Zhangsen Wang | 1c981f5 | 2022-08-02 06:18:40 +0000 | [diff] [blame] | 9462 | ## The two tests below require 1.1.1a or higher version of openssl, otherwise |
Zhangsen Wang | 7d0e658 | 2022-06-29 07:33:35 +0000 | [diff] [blame] | 9463 | ## it might trigger a bug due to openssl (https://github.com/openssl/openssl/issues/6902) |
| 9464 | requires_openssl_next |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 9465 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9466 | requires_config_enabled MBEDTLS_RSA_C |
| 9467 | requires_config_enabled MBEDTLS_ECDSA_C |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 9468 | client_needs_more_time 4 |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9469 | requires_max_content_len 2048 |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 9470 | run_test "DTLS fragmenting: 3d, openssl server, DTLS 1.2" \ |
| 9471 | -p "$P_PXY drop=8 delay=8 duplicate=8" \ |
Zhangsen Wang | 7d0e658 | 2022-06-29 07:33:35 +0000 | [diff] [blame] | 9472 | "$O_NEXT_SRV -dtls1_2 -verify 10" \ |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 9473 | "$P_CLI dtls=1 debug_level=2 \ |
| 9474 | crt_file=data_files/server8_int-ca2.crt \ |
| 9475 | key_file=data_files/server8.key \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 9476 | hs_timeout=250-60000 mtu=512 force_version=dtls12" \ |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 9477 | 0 \ |
| 9478 | -c "fragmenting handshake message" \ |
| 9479 | -C "error" |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9480 | |
Zhangsen Wang | 7d0e658 | 2022-06-29 07:33:35 +0000 | [diff] [blame] | 9481 | requires_openssl_next |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9482 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9483 | requires_config_enabled MBEDTLS_RSA_C |
| 9484 | requires_config_enabled MBEDTLS_ECDSA_C |
Manuel Pégourié-Gonnard | 02f3a8a | 2018-08-20 10:49:28 +0200 | [diff] [blame] | 9485 | client_needs_more_time 4 |
Yuto Takano | 75ab928 | 2021-07-26 08:27:47 +0100 | [diff] [blame] | 9486 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9487 | run_test "DTLS fragmenting: 3d, openssl server, DTLS 1.0" \ |
| 9488 | -p "$P_PXY drop=8 delay=8 duplicate=8" \ |
Zhangsen Wang | 7d0e658 | 2022-06-29 07:33:35 +0000 | [diff] [blame] | 9489 | "$O_NEXT_SRV -dtls1 -verify 10" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 9490 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9491 | crt_file=data_files/server8_int-ca2.crt \ |
| 9492 | key_file=data_files/server8.key \ |
Manuel Pégourié-Gonnard | 02f3a8a | 2018-08-20 10:49:28 +0200 | [diff] [blame] | 9493 | hs_timeout=250-60000 mtu=512 force_version=dtls1" \ |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9494 | 0 \ |
| 9495 | -c "fragmenting handshake message" \ |
| 9496 | -C "error" |
| 9497 | |
Zhangsen Wang | 1c981f5 | 2022-08-02 06:18:40 +0000 | [diff] [blame] | 9498 | ## the two tests below will time out with certain seed. |
| 9499 | ## The cause is an openssl bug (https://github.com/openssl/openssl/issues/18887) |
| 9500 | skip_next_test |
Manuel Pégourié-Gonnard | c1eda67 | 2018-09-03 10:41:49 +0200 | [diff] [blame] | 9501 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9502 | requires_config_enabled MBEDTLS_RSA_C |
| 9503 | requires_config_enabled MBEDTLS_ECDSA_C |
Manuel Pégourié-Gonnard | c1eda67 | 2018-09-03 10:41:49 +0200 | [diff] [blame] | 9504 | client_needs_more_time 4 |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9505 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | c1eda67 | 2018-09-03 10:41:49 +0200 | [diff] [blame] | 9506 | run_test "DTLS fragmenting: 3d, openssl client, DTLS 1.2" \ |
| 9507 | -p "$P_PXY drop=8 delay=8 duplicate=8" \ |
| 9508 | "$P_SRV dtls=1 debug_level=2 \ |
| 9509 | crt_file=data_files/server7_int-ca.crt \ |
| 9510 | key_file=data_files/server7.key \ |
Xiaofei Bai | f40545d | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 9511 | hs_timeout=250-60000 mtu=512 force_version=dtls12" \ |
Manuel Pégourié-Gonnard | c1eda67 | 2018-09-03 10:41:49 +0200 | [diff] [blame] | 9512 | "$O_CLI -dtls1_2" \ |
| 9513 | 0 \ |
| 9514 | -s "fragmenting handshake message" |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9515 | |
| 9516 | # -nbio is added to prevent s_client from blocking in case of duplicated |
| 9517 | # messages at the end of the handshake |
Zhangsen Wang | 1c981f5 | 2022-08-02 06:18:40 +0000 | [diff] [blame] | 9518 | skip_next_test |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9519 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9520 | requires_config_enabled MBEDTLS_RSA_C |
| 9521 | requires_config_enabled MBEDTLS_ECDSA_C |
Manuel Pégourié-Gonnard | 02f3a8a | 2018-08-20 10:49:28 +0200 | [diff] [blame] | 9522 | client_needs_more_time 4 |
Yuto Takano | 75ab928 | 2021-07-26 08:27:47 +0100 | [diff] [blame] | 9523 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9524 | run_test "DTLS fragmenting: 3d, openssl client, DTLS 1.0" \ |
| 9525 | -p "$P_PXY drop=8 delay=8 duplicate=8" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 9526 | "$P_SRV dgram_packing=0 dtls=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9527 | crt_file=data_files/server7_int-ca.crt \ |
| 9528 | key_file=data_files/server7.key \ |
Manuel Pégourié-Gonnard | 02f3a8a | 2018-08-20 10:49:28 +0200 | [diff] [blame] | 9529 | hs_timeout=250-60000 mtu=512 force_version=dtls1" \ |
Manuel Pégourié-Gonnard | c1eda67 | 2018-09-03 10:41:49 +0200 | [diff] [blame] | 9530 | "$O_CLI -nbio -dtls1" \ |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 9531 | 0 \ |
| 9532 | -s "fragmenting handshake message" |
| 9533 | |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9534 | # Tests for DTLS-SRTP (RFC 5764) |
| 9535 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9536 | run_test "DTLS-SRTP all profiles supported" \ |
| 9537 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
| 9538 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 9539 | 0 \ |
| 9540 | -s "found use_srtp extension" \ |
| 9541 | -s "found srtp profile" \ |
| 9542 | -s "selected srtp profile" \ |
| 9543 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9544 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9545 | -c "client hello, adding use_srtp extension" \ |
| 9546 | -c "found use_srtp extension" \ |
| 9547 | -c "found srtp profile" \ |
| 9548 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9549 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 9550 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9551 | -C "error" |
| 9552 | |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 9553 | |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9554 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9555 | run_test "DTLS-SRTP server supports all profiles. Client supports one profile." \ |
| 9556 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9557 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=5 debug_level=3" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9558 | 0 \ |
| 9559 | -s "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9560 | -s "found srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80" \ |
| 9561 | -s "selected srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9562 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9563 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9564 | -c "client hello, adding use_srtp extension" \ |
| 9565 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9566 | -c "found srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9567 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9568 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 9569 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9570 | -C "error" |
| 9571 | |
| 9572 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9573 | run_test "DTLS-SRTP server supports one profile. Client supports all profiles." \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9574 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=6 debug_level=3" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9575 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 9576 | 0 \ |
| 9577 | -s "found use_srtp extension" \ |
| 9578 | -s "found srtp profile" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9579 | -s "selected srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9580 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9581 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9582 | -c "client hello, adding use_srtp extension" \ |
| 9583 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9584 | -c "found srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9585 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9586 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 9587 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9588 | -C "error" |
| 9589 | |
| 9590 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9591 | run_test "DTLS-SRTP server and Client support only one matching profile." \ |
| 9592 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 9593 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 9594 | 0 \ |
| 9595 | -s "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9596 | -s "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
| 9597 | -s "selected srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9598 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9599 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9600 | -c "client hello, adding use_srtp extension" \ |
| 9601 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9602 | -c "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9603 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9604 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 9605 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9606 | -C "error" |
| 9607 | |
| 9608 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9609 | run_test "DTLS-SRTP server and Client support only one different profile." \ |
| 9610 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9611 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=6 debug_level=3" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9612 | 0 \ |
| 9613 | -s "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9614 | -s "found srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9615 | -S "selected srtp profile" \ |
| 9616 | -S "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9617 | -S "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9618 | -c "client hello, adding use_srtp extension" \ |
| 9619 | -C "found use_srtp extension" \ |
| 9620 | -C "found srtp profile" \ |
| 9621 | -C "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9622 | -C "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9623 | -C "error" |
| 9624 | |
| 9625 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9626 | run_test "DTLS-SRTP server doesn't support use_srtp extension." \ |
| 9627 | "$P_SRV dtls=1 debug_level=3" \ |
| 9628 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 9629 | 0 \ |
| 9630 | -s "found use_srtp extension" \ |
| 9631 | -S "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9632 | -S "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9633 | -c "client hello, adding use_srtp extension" \ |
| 9634 | -C "found use_srtp extension" \ |
| 9635 | -C "found srtp profile" \ |
| 9636 | -C "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9637 | -C "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9638 | -C "error" |
| 9639 | |
| 9640 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9641 | run_test "DTLS-SRTP all profiles supported. mki used" \ |
| 9642 | "$P_SRV dtls=1 use_srtp=1 support_mki=1 debug_level=3" \ |
| 9643 | "$P_CLI dtls=1 use_srtp=1 mki=542310ab34290481 debug_level=3" \ |
| 9644 | 0 \ |
| 9645 | -s "found use_srtp extension" \ |
| 9646 | -s "found srtp profile" \ |
| 9647 | -s "selected srtp profile" \ |
| 9648 | -s "server hello, adding use_srtp extension" \ |
| 9649 | -s "dumping 'using mki' (8 bytes)" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9650 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9651 | -c "client hello, adding use_srtp extension" \ |
| 9652 | -c "found use_srtp extension" \ |
| 9653 | -c "found srtp profile" \ |
| 9654 | -c "selected srtp profile" \ |
| 9655 | -c "dumping 'sending mki' (8 bytes)" \ |
| 9656 | -c "dumping 'received mki' (8 bytes)" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9657 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 9658 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Johan Pascal | 20c7db3 | 2020-10-26 22:45:58 +0100 | [diff] [blame] | 9659 | -g "find_in_both '^ *DTLS-SRTP mki value: [0-9A-F]*$'"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9660 | -C "error" |
| 9661 | |
| 9662 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9663 | run_test "DTLS-SRTP all profiles supported. server doesn't support mki." \ |
| 9664 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
| 9665 | "$P_CLI dtls=1 use_srtp=1 mki=542310ab34290481 debug_level=3" \ |
| 9666 | 0 \ |
| 9667 | -s "found use_srtp extension" \ |
| 9668 | -s "found srtp profile" \ |
| 9669 | -s "selected srtp profile" \ |
| 9670 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9671 | -s "DTLS-SRTP key material is"\ |
Johan Pascal | 5ef72d2 | 2020-10-28 17:05:47 +0100 | [diff] [blame] | 9672 | -s "DTLS-SRTP no mki value negotiated"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9673 | -S "dumping 'using mki' (8 bytes)" \ |
| 9674 | -c "client hello, adding use_srtp extension" \ |
| 9675 | -c "found use_srtp extension" \ |
| 9676 | -c "found srtp profile" \ |
| 9677 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9678 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 5ef72d2 | 2020-10-28 17:05:47 +0100 | [diff] [blame] | 9679 | -c "DTLS-SRTP no mki value negotiated"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 9680 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 9681 | -c "dumping 'sending mki' (8 bytes)" \ |
| 9682 | -C "dumping 'received mki' (8 bytes)" \ |
| 9683 | -C "error" |
| 9684 | |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9685 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9686 | run_test "DTLS-SRTP all profiles supported. openssl client." \ |
| 9687 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9688 | "$O_CLI -dtls1 -use_srtp SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9689 | 0 \ |
| 9690 | -s "found use_srtp extension" \ |
| 9691 | -s "found srtp profile" \ |
| 9692 | -s "selected srtp profile" \ |
| 9693 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9694 | -s "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 9695 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9696 | -c "SRTP Extension negotiated, profile=SRTP_AES128_CM_SHA1_80" |
| 9697 | |
| 9698 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9699 | run_test "DTLS-SRTP server supports all profiles. Client supports all profiles, in different order. openssl client." \ |
| 9700 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9701 | "$O_CLI -dtls1 -use_srtp SRTP_AES128_CM_SHA1_32:SRTP_AES128_CM_SHA1_80 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9702 | 0 \ |
| 9703 | -s "found use_srtp extension" \ |
| 9704 | -s "found srtp profile" \ |
| 9705 | -s "selected srtp profile" \ |
| 9706 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9707 | -s "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 9708 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9709 | -c "SRTP Extension negotiated, profile=SRTP_AES128_CM_SHA1_32" |
| 9710 | |
| 9711 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9712 | run_test "DTLS-SRTP server supports all profiles. Client supports one profile. openssl client." \ |
| 9713 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9714 | "$O_CLI -dtls1 -use_srtp SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9715 | 0 \ |
| 9716 | -s "found use_srtp extension" \ |
| 9717 | -s "found srtp profile" \ |
| 9718 | -s "selected srtp profile" \ |
| 9719 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9720 | -s "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 9721 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9722 | -c "SRTP Extension negotiated, profile=SRTP_AES128_CM_SHA1_32" |
| 9723 | |
| 9724 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9725 | run_test "DTLS-SRTP server supports one profile. Client supports all profiles. openssl client." \ |
| 9726 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9727 | "$O_CLI -dtls1 -use_srtp SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9728 | 0 \ |
| 9729 | -s "found use_srtp extension" \ |
| 9730 | -s "found srtp profile" \ |
| 9731 | -s "selected srtp profile" \ |
| 9732 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9733 | -s "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 9734 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9735 | -c "SRTP Extension negotiated, profile=SRTP_AES128_CM_SHA1_32" |
| 9736 | |
| 9737 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9738 | run_test "DTLS-SRTP server and Client support only one matching profile. openssl client." \ |
| 9739 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9740 | "$O_CLI -dtls1 -use_srtp SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9741 | 0 \ |
| 9742 | -s "found use_srtp extension" \ |
| 9743 | -s "found srtp profile" \ |
| 9744 | -s "selected srtp profile" \ |
| 9745 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9746 | -s "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 9747 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9748 | -c "SRTP Extension negotiated, profile=SRTP_AES128_CM_SHA1_32" |
| 9749 | |
| 9750 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9751 | run_test "DTLS-SRTP server and Client support only one different profile. openssl client." \ |
| 9752 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=1 debug_level=3" \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9753 | "$O_CLI -dtls1 -use_srtp SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9754 | 0 \ |
| 9755 | -s "found use_srtp extension" \ |
| 9756 | -s "found srtp profile" \ |
| 9757 | -S "selected srtp profile" \ |
| 9758 | -S "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9759 | -S "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9760 | -C "SRTP Extension negotiated, profile" |
| 9761 | |
| 9762 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9763 | run_test "DTLS-SRTP server doesn't support use_srtp extension. openssl client" \ |
| 9764 | "$P_SRV dtls=1 debug_level=3" \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9765 | "$O_CLI -dtls1 -use_srtp SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9766 | 0 \ |
| 9767 | -s "found use_srtp extension" \ |
| 9768 | -S "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9769 | -S "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9770 | -C "SRTP Extension negotiated, profile" |
| 9771 | |
| 9772 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9773 | run_test "DTLS-SRTP all profiles supported. openssl server" \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9774 | "$O_SRV -dtls1 -verify 0 -use_srtp SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9775 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 9776 | 0 \ |
| 9777 | -c "client hello, adding use_srtp extension" \ |
| 9778 | -c "found use_srtp extension" \ |
| 9779 | -c "found srtp profile" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9780 | -c "selected srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9781 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9782 | -C "error" |
| 9783 | |
| 9784 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9785 | run_test "DTLS-SRTP server supports all profiles. Client supports all profiles, in different order. openssl server." \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9786 | "$O_SRV -dtls1 -verify 0 -use_srtp SRTP_AES128_CM_SHA1_32:SRTP_AES128_CM_SHA1_80 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9787 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 9788 | 0 \ |
| 9789 | -c "client hello, adding use_srtp extension" \ |
| 9790 | -c "found use_srtp extension" \ |
| 9791 | -c "found srtp profile" \ |
| 9792 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9793 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9794 | -C "error" |
| 9795 | |
| 9796 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9797 | run_test "DTLS-SRTP server supports all profiles. Client supports one profile. openssl server." \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9798 | "$O_SRV -dtls1 -verify 0 -use_srtp SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9799 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 9800 | 0 \ |
| 9801 | -c "client hello, adding use_srtp extension" \ |
| 9802 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9803 | -c "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9804 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9805 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9806 | -C "error" |
| 9807 | |
| 9808 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9809 | run_test "DTLS-SRTP server supports one profile. Client supports all profiles. openssl server." \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9810 | "$O_SRV -dtls1 -verify 0 -use_srtp SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9811 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 9812 | 0 \ |
| 9813 | -c "client hello, adding use_srtp extension" \ |
| 9814 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9815 | -c "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9816 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9817 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9818 | -C "error" |
| 9819 | |
| 9820 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9821 | run_test "DTLS-SRTP server and Client support only one matching profile. openssl server." \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9822 | "$O_SRV -dtls1 -verify 0 -use_srtp SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9823 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 9824 | 0 \ |
| 9825 | -c "client hello, adding use_srtp extension" \ |
| 9826 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9827 | -c "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9828 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9829 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9830 | -C "error" |
| 9831 | |
| 9832 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9833 | run_test "DTLS-SRTP server and Client support only one different profile. openssl server." \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9834 | "$O_SRV -dtls1 -verify 0 -use_srtp SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9835 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=6 debug_level=3" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9836 | 0 \ |
| 9837 | -c "client hello, adding use_srtp extension" \ |
| 9838 | -C "found use_srtp extension" \ |
| 9839 | -C "found srtp profile" \ |
| 9840 | -C "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9841 | -C "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9842 | -C "error" |
| 9843 | |
| 9844 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9845 | run_test "DTLS-SRTP server doesn't support use_srtp extension. openssl server" \ |
| 9846 | "$O_SRV -dtls1" \ |
| 9847 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 9848 | 0 \ |
| 9849 | -c "client hello, adding use_srtp extension" \ |
| 9850 | -C "found use_srtp extension" \ |
| 9851 | -C "found srtp profile" \ |
| 9852 | -C "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9853 | -C "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9854 | -C "error" |
| 9855 | |
| 9856 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
| 9857 | run_test "DTLS-SRTP all profiles supported. server doesn't support mki. openssl server." \ |
Johan Pascal | 39cfd3b | 2020-09-23 18:49:13 +0200 | [diff] [blame] | 9858 | "$O_SRV -dtls1 -verify 0 -use_srtp SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9859 | "$P_CLI dtls=1 use_srtp=1 mki=542310ab34290481 debug_level=3" \ |
| 9860 | 0 \ |
| 9861 | -c "client hello, adding use_srtp extension" \ |
| 9862 | -c "found use_srtp extension" \ |
| 9863 | -c "found srtp profile" \ |
| 9864 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9865 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 5ef72d2 | 2020-10-28 17:05:47 +0100 | [diff] [blame] | 9866 | -c "DTLS-SRTP no mki value negotiated"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9867 | -c "dumping 'sending mki' (8 bytes)" \ |
| 9868 | -C "dumping 'received mki' (8 bytes)" \ |
| 9869 | -C "error" |
| 9870 | |
| 9871 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9872 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9873 | run_test "DTLS-SRTP all profiles supported. gnutls client." \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9874 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
| 9875 | "$G_CLI -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_80:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9876 | 0 \ |
| 9877 | -s "found use_srtp extension" \ |
| 9878 | -s "found srtp profile" \ |
| 9879 | -s "selected srtp profile" \ |
| 9880 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9881 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9882 | -c "SRTP profile: SRTP_AES128_CM_HMAC_SHA1_80" |
| 9883 | |
| 9884 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9885 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9886 | run_test "DTLS-SRTP server supports all profiles. Client supports all profiles, in different order. gnutls client." \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9887 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
| 9888 | "$G_CLI -u --srtp-profiles=SRTP_NULL_HMAC_SHA1_80:SRTP_AES128_CM_HMAC_SHA1_80:SRTP_NULL_SHA1_32:SRTP_AES128_CM_HMAC_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9889 | 0 \ |
| 9890 | -s "found use_srtp extension" \ |
| 9891 | -s "found srtp profile" \ |
| 9892 | -s "selected srtp profile" \ |
| 9893 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9894 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9895 | -c "SRTP profile: SRTP_NULL_HMAC_SHA1_80" |
| 9896 | |
| 9897 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9898 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9899 | run_test "DTLS-SRTP server supports all profiles. Client supports one profile. gnutls client." \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9900 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
| 9901 | "$G_CLI -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9902 | 0 \ |
| 9903 | -s "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9904 | -s "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
| 9905 | -s "selected srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9906 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9907 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9908 | -c "SRTP profile: SRTP_AES128_CM_HMAC_SHA1_32" |
| 9909 | |
| 9910 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9911 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9912 | run_test "DTLS-SRTP server supports one profile. Client supports all profiles. gnutls client." \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9913 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=6 debug_level=3" \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9914 | "$G_CLI -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_80:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9915 | 0 \ |
| 9916 | -s "found use_srtp extension" \ |
| 9917 | -s "found srtp profile" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9918 | -s "selected srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9919 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9920 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9921 | -c "SRTP profile: SRTP_NULL_SHA1_32" |
| 9922 | |
| 9923 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9924 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9925 | run_test "DTLS-SRTP server and Client support only one matching profile. gnutls client." \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9926 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 9927 | "$G_CLI -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9928 | 0 \ |
| 9929 | -s "found use_srtp extension" \ |
| 9930 | -s "found srtp profile" \ |
| 9931 | -s "selected srtp profile" \ |
| 9932 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9933 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9934 | -c "SRTP profile: SRTP_AES128_CM_HMAC_SHA1_32" |
| 9935 | |
| 9936 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9937 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9938 | run_test "DTLS-SRTP server and Client support only one different profile. gnutls client." \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9939 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=1 debug_level=3" \ |
| 9940 | "$G_CLI -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9941 | 0 \ |
| 9942 | -s "found use_srtp extension" \ |
| 9943 | -s "found srtp profile" \ |
| 9944 | -S "selected srtp profile" \ |
| 9945 | -S "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9946 | -S "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9947 | -C "SRTP profile:" |
| 9948 | |
| 9949 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9950 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9951 | run_test "DTLS-SRTP server doesn't support use_srtp extension. gnutls client" \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9952 | "$P_SRV dtls=1 debug_level=3" \ |
| 9953 | "$G_CLI -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_80:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9954 | 0 \ |
| 9955 | -s "found use_srtp extension" \ |
| 9956 | -S "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9957 | -S "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9958 | -C "SRTP profile:" |
| 9959 | |
| 9960 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9961 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9962 | run_test "DTLS-SRTP all profiles supported. gnutls server" \ |
| 9963 | "$G_SRV -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_80:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32" \ |
| 9964 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 9965 | 0 \ |
| 9966 | -c "client hello, adding use_srtp extension" \ |
| 9967 | -c "found use_srtp extension" \ |
| 9968 | -c "found srtp profile" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9969 | -c "selected srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9970 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9971 | -C "error" |
| 9972 | |
| 9973 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9974 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9975 | run_test "DTLS-SRTP server supports all profiles. Client supports all profiles, in different order. gnutls server." \ |
| 9976 | "$G_SRV -u --srtp-profiles=SRTP_NULL_SHA1_32:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_AES128_CM_HMAC_SHA1_80:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32" \ |
| 9977 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 9978 | 0 \ |
| 9979 | -c "client hello, adding use_srtp extension" \ |
| 9980 | -c "found use_srtp extension" \ |
| 9981 | -c "found srtp profile" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9982 | -c "selected srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9983 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9984 | -C "error" |
| 9985 | |
| 9986 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 9987 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9988 | run_test "DTLS-SRTP server supports all profiles. Client supports one profile. gnutls server." \ |
| 9989 | "$G_SRV -u --srtp-profiles=SRTP_NULL_SHA1_32:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_AES128_CM_HMAC_SHA1_80:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32" \ |
| 9990 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 9991 | 0 \ |
| 9992 | -c "client hello, adding use_srtp extension" \ |
| 9993 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 9994 | -c "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9995 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 9996 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 9997 | -C "error" |
| 9998 | |
| 9999 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10000 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10001 | run_test "DTLS-SRTP server supports one profile. Client supports all profiles. gnutls server." \ |
| 10002 | "$G_SRV -u --srtp-profiles=SRTP_NULL_HMAC_SHA1_80" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10003 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10004 | 0 \ |
| 10005 | -c "client hello, adding use_srtp extension" \ |
| 10006 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10007 | -c "found srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10008 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10009 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10010 | -C "error" |
| 10011 | |
| 10012 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10013 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10014 | run_test "DTLS-SRTP server and Client support only one matching profile. gnutls server." \ |
| 10015 | "$G_SRV -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_32" \ |
| 10016 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 10017 | 0 \ |
| 10018 | -c "client hello, adding use_srtp extension" \ |
| 10019 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10020 | -c "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10021 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10022 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10023 | -C "error" |
| 10024 | |
| 10025 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10026 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10027 | run_test "DTLS-SRTP server and Client support only one different profile. gnutls server." \ |
| 10028 | "$G_SRV -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_32" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10029 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=6 debug_level=3" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10030 | 0 \ |
| 10031 | -c "client hello, adding use_srtp extension" \ |
| 10032 | -C "found use_srtp extension" \ |
| 10033 | -C "found srtp profile" \ |
| 10034 | -C "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10035 | -C "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10036 | -C "error" |
| 10037 | |
| 10038 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10039 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10040 | run_test "DTLS-SRTP server doesn't support use_srtp extension. gnutls server" \ |
| 10041 | "$G_SRV -u" \ |
| 10042 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 10043 | 0 \ |
| 10044 | -c "client hello, adding use_srtp extension" \ |
| 10045 | -C "found use_srtp extension" \ |
| 10046 | -C "found srtp profile" \ |
| 10047 | -C "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10048 | -C "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10049 | -C "error" |
| 10050 | |
| 10051 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10052 | requires_gnutls |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10053 | run_test "DTLS-SRTP all profiles supported. mki used. gnutls server." \ |
| 10054 | "$G_SRV -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_80:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32" \ |
| 10055 | "$P_CLI dtls=1 use_srtp=1 mki=542310ab34290481 debug_level=3" \ |
| 10056 | 0 \ |
| 10057 | -c "client hello, adding use_srtp extension" \ |
| 10058 | -c "found use_srtp extension" \ |
| 10059 | -c "found srtp profile" \ |
| 10060 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10061 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 20c7db3 | 2020-10-26 22:45:58 +0100 | [diff] [blame] | 10062 | -c "DTLS-SRTP mki value:"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10063 | -c "dumping 'sending mki' (8 bytes)" \ |
| 10064 | -c "dumping 'received mki' (8 bytes)" \ |
| 10065 | -C "error" |
| 10066 | |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 10067 | # Tests for specific things with "unreliable" UDP connection |
| 10068 | |
| 10069 | not_with_valgrind # spurious resend due to timeout |
| 10070 | run_test "DTLS proxy: reference" \ |
| 10071 | -p "$P_PXY" \ |
Manuel Pégourié-Gonnard | b692989 | 2019-09-09 11:14:37 +0200 | [diff] [blame] | 10072 | "$P_SRV dtls=1 debug_level=2 hs_timeout=10000-20000" \ |
| 10073 | "$P_CLI dtls=1 debug_level=2 hs_timeout=10000-20000" \ |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 10074 | 0 \ |
| 10075 | -C "replayed record" \ |
| 10076 | -S "replayed record" \ |
Hanno Becker | b2a86c3 | 2019-07-19 15:43:09 +0100 | [diff] [blame] | 10077 | -C "Buffer record from epoch" \ |
| 10078 | -S "Buffer record from epoch" \ |
| 10079 | -C "ssl_buffer_message" \ |
| 10080 | -S "ssl_buffer_message" \ |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 10081 | -C "discarding invalid record" \ |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 10082 | -S "discarding invalid record" \ |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 10083 | -S "resend" \ |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 10084 | -s "Extra-header:" \ |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 10085 | -c "HTTP/1.0 200 OK" |
| 10086 | |
| 10087 | not_with_valgrind # spurious resend due to timeout |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 10088 | run_test "DTLS proxy: duplicate every packet" \ |
| 10089 | -p "$P_PXY duplicate=1" \ |
Manuel Pégourié-Gonnard | b692989 | 2019-09-09 11:14:37 +0200 | [diff] [blame] | 10090 | "$P_SRV dtls=1 dgram_packing=0 debug_level=2 hs_timeout=10000-20000" \ |
| 10091 | "$P_CLI dtls=1 dgram_packing=0 debug_level=2 hs_timeout=10000-20000" \ |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 10092 | 0 \ |
| 10093 | -c "replayed record" \ |
| 10094 | -s "replayed record" \ |
| 10095 | -c "record from another epoch" \ |
| 10096 | -s "record from another epoch" \ |
| 10097 | -S "resend" \ |
| 10098 | -s "Extra-header:" \ |
| 10099 | -c "HTTP/1.0 200 OK" |
| 10100 | |
| 10101 | run_test "DTLS proxy: duplicate every packet, server anti-replay off" \ |
| 10102 | -p "$P_PXY duplicate=1" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10103 | "$P_SRV dtls=1 dgram_packing=0 debug_level=2 anti_replay=0" \ |
| 10104 | "$P_CLI dtls=1 dgram_packing=0 debug_level=2" \ |
Manuel Pégourié-Gonnard | 63eca93 | 2014-09-08 16:39:08 +0200 | [diff] [blame] | 10105 | 0 \ |
| 10106 | -c "replayed record" \ |
| 10107 | -S "replayed record" \ |
| 10108 | -c "record from another epoch" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10109 | -s "record from another epoch" \ |
| 10110 | -c "resend" \ |
| 10111 | -s "resend" \ |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 10112 | -s "Extra-header:" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10113 | -c "HTTP/1.0 200 OK" |
| 10114 | |
| 10115 | run_test "DTLS proxy: multiple records in same datagram" \ |
| 10116 | -p "$P_PXY pack=50" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10117 | "$P_SRV dtls=1 dgram_packing=0 debug_level=2" \ |
| 10118 | "$P_CLI dtls=1 dgram_packing=0 debug_level=2" \ |
Manuel Pégourié-Gonnard | 63eca93 | 2014-09-08 16:39:08 +0200 | [diff] [blame] | 10119 | 0 \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10120 | -c "next record in same datagram" \ |
| 10121 | -s "next record in same datagram" |
| 10122 | |
| 10123 | run_test "DTLS proxy: multiple records in same datagram, duplicate every packet" \ |
| 10124 | -p "$P_PXY pack=50 duplicate=1" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10125 | "$P_SRV dtls=1 dgram_packing=0 debug_level=2" \ |
| 10126 | "$P_CLI dtls=1 dgram_packing=0 debug_level=2" \ |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 10127 | 0 \ |
| 10128 | -c "next record in same datagram" \ |
| 10129 | -s "next record in same datagram" |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10130 | |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 10131 | run_test "DTLS proxy: inject invalid AD record, default badmac_limit" \ |
| 10132 | -p "$P_PXY bad_ad=1" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10133 | "$P_SRV dtls=1 dgram_packing=0 debug_level=1" \ |
| 10134 | "$P_CLI dtls=1 dgram_packing=0 debug_level=1 read_timeout=100" \ |
Manuel Pégourié-Gonnard | 63eca93 | 2014-09-08 16:39:08 +0200 | [diff] [blame] | 10135 | 0 \ |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 10136 | -c "discarding invalid record (mac)" \ |
| 10137 | -s "discarding invalid record (mac)" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10138 | -s "Extra-header:" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10139 | -c "HTTP/1.0 200 OK" \ |
| 10140 | -S "too many records with bad MAC" \ |
| 10141 | -S "Verification of the message MAC failed" |
| 10142 | |
| 10143 | run_test "DTLS proxy: inject invalid AD record, badmac_limit 1" \ |
| 10144 | -p "$P_PXY bad_ad=1" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10145 | "$P_SRV dtls=1 dgram_packing=0 debug_level=1 badmac_limit=1" \ |
| 10146 | "$P_CLI dtls=1 dgram_packing=0 debug_level=1 read_timeout=100" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10147 | 1 \ |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 10148 | -C "discarding invalid record (mac)" \ |
| 10149 | -S "discarding invalid record (mac)" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10150 | -S "Extra-header:" \ |
| 10151 | -C "HTTP/1.0 200 OK" \ |
| 10152 | -s "too many records with bad MAC" \ |
| 10153 | -s "Verification of the message MAC failed" |
| 10154 | |
| 10155 | run_test "DTLS proxy: inject invalid AD record, badmac_limit 2" \ |
| 10156 | -p "$P_PXY bad_ad=1" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10157 | "$P_SRV dtls=1 dgram_packing=0 debug_level=1 badmac_limit=2" \ |
| 10158 | "$P_CLI dtls=1 dgram_packing=0 debug_level=1 read_timeout=100" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10159 | 0 \ |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 10160 | -c "discarding invalid record (mac)" \ |
| 10161 | -s "discarding invalid record (mac)" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10162 | -s "Extra-header:" \ |
| 10163 | -c "HTTP/1.0 200 OK" \ |
| 10164 | -S "too many records with bad MAC" \ |
| 10165 | -S "Verification of the message MAC failed" |
| 10166 | |
| 10167 | run_test "DTLS proxy: inject invalid AD record, badmac_limit 2, exchanges 2"\ |
| 10168 | -p "$P_PXY bad_ad=1" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10169 | "$P_SRV dtls=1 dgram_packing=0 debug_level=1 badmac_limit=2 exchanges=2" \ |
| 10170 | "$P_CLI dtls=1 dgram_packing=0 debug_level=1 read_timeout=100 exchanges=2" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10171 | 1 \ |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 10172 | -c "discarding invalid record (mac)" \ |
| 10173 | -s "discarding invalid record (mac)" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10174 | -s "Extra-header:" \ |
| 10175 | -c "HTTP/1.0 200 OK" \ |
| 10176 | -s "too many records with bad MAC" \ |
| 10177 | -s "Verification of the message MAC failed" |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10178 | |
| 10179 | run_test "DTLS proxy: delay ChangeCipherSpec" \ |
| 10180 | -p "$P_PXY delay_ccs=1" \ |
Hanno Becker | c430523 | 2018-08-14 13:41:21 +0100 | [diff] [blame] | 10181 | "$P_SRV dtls=1 debug_level=1 dgram_packing=0" \ |
| 10182 | "$P_CLI dtls=1 debug_level=1 dgram_packing=0" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10183 | 0 \ |
| 10184 | -c "record from another epoch" \ |
| 10185 | -s "record from another epoch" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10186 | -s "Extra-header:" \ |
| 10187 | -c "HTTP/1.0 200 OK" |
| 10188 | |
Hanno Becker | aa5d0c4 | 2018-08-16 13:15:19 +0100 | [diff] [blame] | 10189 | # Tests for reordering support with DTLS |
| 10190 | |
Gilles Peskine | 22cc649 | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10191 | requires_certificate_authentication |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10192 | run_test "DTLS reordering: Buffer out-of-order handshake message on client" \ |
| 10193 | -p "$P_PXY delay_srv=ServerHello" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10194 | "$P_SRV dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10195 | hs_timeout=2500-60000" \ |
| 10196 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10197 | hs_timeout=2500-60000" \ |
Hanno Becker | e384221 | 2018-08-16 15:28:59 +0100 | [diff] [blame] | 10198 | 0 \ |
| 10199 | -c "Buffering HS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10200 | -c "Next handshake message has been buffered - load"\ |
| 10201 | -S "Buffering HS message" \ |
| 10202 | -S "Next handshake message has been buffered - load"\ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10203 | -C "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10204 | -C "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10205 | -S "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10206 | -S "Remember CCS message" |
Hanno Becker | e384221 | 2018-08-16 15:28:59 +0100 | [diff] [blame] | 10207 | |
Gilles Peskine | 22cc649 | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10208 | requires_certificate_authentication |
Hanno Becker | dc1e950 | 2018-08-28 16:02:33 +0100 | [diff] [blame] | 10209 | run_test "DTLS reordering: Buffer out-of-order handshake message fragment on client" \ |
| 10210 | -p "$P_PXY delay_srv=ServerHello" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10211 | "$P_SRV mtu=512 dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10212 | hs_timeout=2500-60000" \ |
| 10213 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10214 | hs_timeout=2500-60000" \ |
Hanno Becker | dc1e950 | 2018-08-28 16:02:33 +0100 | [diff] [blame] | 10215 | 0 \ |
| 10216 | -c "Buffering HS message" \ |
| 10217 | -c "found fragmented DTLS handshake message"\ |
| 10218 | -c "Next handshake message 1 not or only partially bufffered" \ |
| 10219 | -c "Next handshake message has been buffered - load"\ |
| 10220 | -S "Buffering HS message" \ |
| 10221 | -S "Next handshake message has been buffered - load"\ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10222 | -C "Injecting buffered CCS message" \ |
Hanno Becker | dc1e950 | 2018-08-28 16:02:33 +0100 | [diff] [blame] | 10223 | -C "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10224 | -S "Injecting buffered CCS message" \ |
Hanno Becker | aa5d0c4 | 2018-08-16 13:15:19 +0100 | [diff] [blame] | 10225 | -S "Remember CCS message" |
| 10226 | |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10227 | # The client buffers the ServerKeyExchange before receiving the fragmented |
| 10228 | # Certificate message; at the time of writing, together these are aroudn 1200b |
| 10229 | # in size, so that the bound below ensures that the certificate can be reassembled |
| 10230 | # while keeping the ServerKeyExchange. |
Gilles Peskine | 22cc649 | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10231 | requires_certificate_authentication |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10232 | requires_config_value_at_least "MBEDTLS_SSL_DTLS_MAX_BUFFERING" 1300 |
| 10233 | run_test "DTLS reordering: Buffer out-of-order hs msg before reassembling next" \ |
Hanno Becker | e356705 | 2018-08-21 16:50:43 +0100 | [diff] [blame] | 10234 | -p "$P_PXY delay_srv=Certificate delay_srv=Certificate" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10235 | "$P_SRV mtu=512 dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10236 | hs_timeout=2500-60000" \ |
| 10237 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10238 | hs_timeout=2500-60000" \ |
Hanno Becker | e356705 | 2018-08-21 16:50:43 +0100 | [diff] [blame] | 10239 | 0 \ |
| 10240 | -c "Buffering HS message" \ |
| 10241 | -c "Next handshake message has been buffered - load"\ |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10242 | -C "attempt to make space by freeing buffered messages" \ |
| 10243 | -S "Buffering HS message" \ |
| 10244 | -S "Next handshake message has been buffered - load"\ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10245 | -C "Injecting buffered CCS message" \ |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10246 | -C "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10247 | -S "Injecting buffered CCS message" \ |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10248 | -S "Remember CCS message" |
| 10249 | |
| 10250 | # The size constraints ensure that the delayed certificate message can't |
| 10251 | # be reassembled while keeping the ServerKeyExchange message, but it can |
| 10252 | # when dropping it first. |
Gilles Peskine | 22cc649 | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10253 | requires_certificate_authentication |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10254 | requires_config_value_at_least "MBEDTLS_SSL_DTLS_MAX_BUFFERING" 900 |
| 10255 | requires_config_value_at_most "MBEDTLS_SSL_DTLS_MAX_BUFFERING" 1299 |
| 10256 | run_test "DTLS reordering: Buffer out-of-order hs msg before reassembling next, free buffered msg" \ |
| 10257 | -p "$P_PXY delay_srv=Certificate delay_srv=Certificate" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10258 | "$P_SRV mtu=512 dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10259 | hs_timeout=2500-60000" \ |
| 10260 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10261 | hs_timeout=2500-60000" \ |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10262 | 0 \ |
| 10263 | -c "Buffering HS message" \ |
| 10264 | -c "attempt to make space by freeing buffered future messages" \ |
| 10265 | -c "Enough space available after freeing buffered HS messages" \ |
Hanno Becker | e356705 | 2018-08-21 16:50:43 +0100 | [diff] [blame] | 10266 | -S "Buffering HS message" \ |
| 10267 | -S "Next handshake message has been buffered - load"\ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10268 | -C "Injecting buffered CCS message" \ |
Hanno Becker | e356705 | 2018-08-21 16:50:43 +0100 | [diff] [blame] | 10269 | -C "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10270 | -S "Injecting buffered CCS message" \ |
Hanno Becker | e356705 | 2018-08-21 16:50:43 +0100 | [diff] [blame] | 10271 | -S "Remember CCS message" |
| 10272 | |
Gilles Peskine | 22cc649 | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10273 | requires_certificate_authentication |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10274 | run_test "DTLS reordering: Buffer out-of-order handshake message on server" \ |
| 10275 | -p "$P_PXY delay_cli=Certificate" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10276 | "$P_SRV dgram_packing=0 auth_mode=required cookies=0 dtls=1 debug_level=2 \ |
| 10277 | hs_timeout=2500-60000" \ |
| 10278 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10279 | hs_timeout=2500-60000" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10280 | 0 \ |
| 10281 | -C "Buffering HS message" \ |
| 10282 | -C "Next handshake message has been buffered - load"\ |
| 10283 | -s "Buffering HS message" \ |
| 10284 | -s "Next handshake message has been buffered - load" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10285 | -C "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10286 | -C "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10287 | -S "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10288 | -S "Remember CCS message" |
| 10289 | |
Gilles Peskine | 22cc649 | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10290 | requires_certificate_authentication |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10291 | run_test "DTLS reordering: Buffer out-of-order CCS message on client"\ |
| 10292 | -p "$P_PXY delay_srv=NewSessionTicket" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10293 | "$P_SRV dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10294 | hs_timeout=2500-60000" \ |
| 10295 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10296 | hs_timeout=2500-60000" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10297 | 0 \ |
| 10298 | -C "Buffering HS message" \ |
| 10299 | -C "Next handshake message has been buffered - load"\ |
| 10300 | -S "Buffering HS message" \ |
| 10301 | -S "Next handshake message has been buffered - load" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10302 | -c "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10303 | -c "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10304 | -S "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10305 | -S "Remember CCS message" |
| 10306 | |
Gilles Peskine | 22cc649 | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10307 | requires_certificate_authentication |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10308 | run_test "DTLS reordering: Buffer out-of-order CCS message on server"\ |
| 10309 | -p "$P_PXY delay_cli=ClientKeyExchange" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10310 | "$P_SRV dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10311 | hs_timeout=2500-60000" \ |
| 10312 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10313 | hs_timeout=2500-60000" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10314 | 0 \ |
| 10315 | -C "Buffering HS message" \ |
| 10316 | -C "Next handshake message has been buffered - load"\ |
| 10317 | -S "Buffering HS message" \ |
| 10318 | -S "Next handshake message has been buffered - load" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10319 | -C "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10320 | -C "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10321 | -s "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10322 | -s "Remember CCS message" |
| 10323 | |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10324 | run_test "DTLS reordering: Buffer encrypted Finished message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10325 | -p "$P_PXY delay_ccs=1" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10326 | "$P_SRV dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10327 | hs_timeout=2500-60000" \ |
| 10328 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10329 | hs_timeout=2500-60000" \ |
Hanno Becker | b34149c | 2018-08-16 15:29:06 +0100 | [diff] [blame] | 10330 | 0 \ |
| 10331 | -s "Buffer record from epoch 1" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10332 | -s "Found buffered record from current epoch - load" \ |
| 10333 | -c "Buffer record from epoch 1" \ |
| 10334 | -c "Found buffered record from current epoch - load" |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 10335 | |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10336 | # In this test, both the fragmented NewSessionTicket and the ChangeCipherSpec |
| 10337 | # from the server are delayed, so that the encrypted Finished message |
| 10338 | # is received and buffered. When the fragmented NewSessionTicket comes |
| 10339 | # in afterwards, the encrypted Finished message must be freed in order |
| 10340 | # to make space for the NewSessionTicket to be reassembled. |
| 10341 | # This works only in very particular circumstances: |
| 10342 | # - MBEDTLS_SSL_DTLS_MAX_BUFFERING must be large enough to allow buffering |
| 10343 | # of the NewSessionTicket, but small enough to also allow buffering of |
| 10344 | # the encrypted Finished message. |
| 10345 | # - The MTU setting on the server must be so small that the NewSessionTicket |
| 10346 | # needs to be fragmented. |
| 10347 | # - All messages sent by the server must be small enough to be either sent |
| 10348 | # without fragmentation or be reassembled within the bounds of |
| 10349 | # MBEDTLS_SSL_DTLS_MAX_BUFFERING. Achieve this by testing with a PSK-based |
| 10350 | # handshake, omitting CRTs. |
Manuel Pégourié-Gonnard | eef4c75 | 2019-05-28 10:21:30 +0200 | [diff] [blame] | 10351 | requires_config_value_at_least "MBEDTLS_SSL_DTLS_MAX_BUFFERING" 190 |
| 10352 | requires_config_value_at_most "MBEDTLS_SSL_DTLS_MAX_BUFFERING" 230 |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10353 | run_test "DTLS reordering: Buffer encrypted Finished message, drop for fragmented NewSessionTicket" \ |
| 10354 | -p "$P_PXY delay_srv=NewSessionTicket delay_srv=NewSessionTicket delay_ccs=1" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 10355 | "$P_SRV mtu=140 response_size=90 dgram_packing=0 psk=73776f726466697368 psk_identity=foo cookies=0 dtls=1 debug_level=2" \ |
| 10356 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8 psk=73776f726466697368 psk_identity=foo" \ |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10357 | 0 \ |
| 10358 | -s "Buffer record from epoch 1" \ |
| 10359 | -s "Found buffered record from current epoch - load" \ |
| 10360 | -c "Buffer record from epoch 1" \ |
| 10361 | -C "Found buffered record from current epoch - load" \ |
| 10362 | -c "Enough space available after freeing future epoch record" |
| 10363 | |
Manuel Pégourié-Gonnard | a071972 | 2014-09-20 12:46:27 +0200 | [diff] [blame] | 10364 | # Tests for "randomly unreliable connection": try a variety of flows and peers |
| 10365 | |
| 10366 | client_needs_more_time 2 |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10367 | run_test "DTLS proxy: 3d (drop, delay, duplicate), \"short\" PSK handshake" \ |
| 10368 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10369 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 10370 | psk=73776f726466697368" \ |
| 10371 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=73776f726466697368 \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 10372 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 10373 | 0 \ |
| 10374 | -s "Extra-header:" \ |
| 10375 | -c "HTTP/1.0 200 OK" |
| 10376 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10377 | client_needs_more_time 2 |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 10378 | run_test "DTLS proxy: 3d, \"short\" RSA handshake" \ |
| 10379 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10380 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none" \ |
| 10381 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 10382 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 10383 | 0 \ |
| 10384 | -s "Extra-header:" \ |
| 10385 | -c "HTTP/1.0 200 OK" |
| 10386 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10387 | client_needs_more_time 2 |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 10388 | run_test "DTLS proxy: 3d, \"short\" (no ticket, no cli_auth) FS handshake" \ |
| 10389 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10390 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none" \ |
| 10391 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0" \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 10392 | 0 \ |
| 10393 | -s "Extra-header:" \ |
| 10394 | -c "HTTP/1.0 200 OK" |
| 10395 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10396 | client_needs_more_time 2 |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 10397 | run_test "DTLS proxy: 3d, FS, client auth" \ |
| 10398 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10399 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=required" \ |
| 10400 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0" \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 10401 | 0 \ |
| 10402 | -s "Extra-header:" \ |
| 10403 | -c "HTTP/1.0 200 OK" |
| 10404 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10405 | client_needs_more_time 2 |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 10406 | run_test "DTLS proxy: 3d, FS, ticket" \ |
| 10407 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10408 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=1 auth_mode=none" \ |
| 10409 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=1" \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 10410 | 0 \ |
| 10411 | -s "Extra-header:" \ |
| 10412 | -c "HTTP/1.0 200 OK" |
| 10413 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10414 | client_needs_more_time 2 |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 10415 | run_test "DTLS proxy: 3d, max handshake (FS, ticket + client auth)" \ |
| 10416 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10417 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=1 auth_mode=required" \ |
| 10418 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=1" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10419 | 0 \ |
| 10420 | -s "Extra-header:" \ |
| 10421 | -c "HTTP/1.0 200 OK" |
| 10422 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10423 | client_needs_more_time 2 |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 10424 | run_test "DTLS proxy: 3d, max handshake, nbio" \ |
| 10425 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10426 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 nbio=2 tickets=1 \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 10427 | auth_mode=required" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10428 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 nbio=2 tickets=1" \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 10429 | 0 \ |
| 10430 | -s "Extra-header:" \ |
| 10431 | -c "HTTP/1.0 200 OK" |
| 10432 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10433 | client_needs_more_time 4 |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 10434 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 7a26d73 | 2014-10-02 14:50:46 +0200 | [diff] [blame] | 10435 | run_test "DTLS proxy: 3d, min handshake, resumption" \ |
| 10436 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10437 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 10438 | psk=73776f726466697368 debug_level=3" \ |
| 10439 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=73776f726466697368 \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 10440 | debug_level=3 reconnect=1 skip_close_notify=1 read_timeout=1000 max_resend=10 \ |
Manuel Pégourié-Gonnard | 7a26d73 | 2014-10-02 14:50:46 +0200 | [diff] [blame] | 10441 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 10442 | 0 \ |
| 10443 | -s "a session has been resumed" \ |
| 10444 | -c "a session has been resumed" \ |
| 10445 | -s "Extra-header:" \ |
| 10446 | -c "HTTP/1.0 200 OK" |
| 10447 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10448 | client_needs_more_time 4 |
Gilles Peskine | 111fde4 | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 10449 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 85beb30 | 2014-10-02 17:59:19 +0200 | [diff] [blame] | 10450 | run_test "DTLS proxy: 3d, min handshake, resumption, nbio" \ |
| 10451 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10452 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 10453 | psk=73776f726466697368 debug_level=3 nbio=2" \ |
| 10454 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=73776f726466697368 \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 10455 | debug_level=3 reconnect=1 skip_close_notify=1 read_timeout=1000 max_resend=10 \ |
Manuel Pégourié-Gonnard | 85beb30 | 2014-10-02 17:59:19 +0200 | [diff] [blame] | 10456 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8 nbio=2" \ |
| 10457 | 0 \ |
| 10458 | -s "a session has been resumed" \ |
| 10459 | -c "a session has been resumed" \ |
| 10460 | -s "Extra-header:" \ |
| 10461 | -c "HTTP/1.0 200 OK" |
| 10462 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10463 | client_needs_more_time 4 |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 10464 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 10465 | run_test "DTLS proxy: 3d, min handshake, client-initiated renego" \ |
Manuel Pégourié-Gonnard | 1b753f1 | 2014-09-25 16:09:36 +0200 | [diff] [blame] | 10466 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10467 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 10468 | psk=73776f726466697368 renegotiation=1 debug_level=2" \ |
| 10469 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=73776f726466697368 \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 10470 | renegotiate=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 1b753f1 | 2014-09-25 16:09:36 +0200 | [diff] [blame] | 10471 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 10472 | 0 \ |
| 10473 | -c "=> renegotiate" \ |
| 10474 | -s "=> renegotiate" \ |
| 10475 | -s "Extra-header:" \ |
| 10476 | -c "HTTP/1.0 200 OK" |
| 10477 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10478 | client_needs_more_time 4 |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 10479 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 10480 | run_test "DTLS proxy: 3d, min handshake, client-initiated renego, nbio" \ |
| 10481 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10482 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 10483 | psk=73776f726466697368 renegotiation=1 debug_level=2" \ |
| 10484 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=73776f726466697368 \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 10485 | renegotiate=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 10486 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 10487 | 0 \ |
| 10488 | -c "=> renegotiate" \ |
| 10489 | -s "=> renegotiate" \ |
| 10490 | -s "Extra-header:" \ |
| 10491 | -c "HTTP/1.0 200 OK" |
| 10492 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10493 | client_needs_more_time 4 |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 10494 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 10495 | run_test "DTLS proxy: 3d, min handshake, server-initiated renego" \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 10496 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10497 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 10498 | psk=73776f726466697368 renegotiate=1 renegotiation=1 exchanges=4 \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 10499 | debug_level=2" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 10500 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=73776f726466697368 \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 10501 | renegotiation=1 exchanges=4 debug_level=2 \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 10502 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 10503 | 0 \ |
| 10504 | -c "=> renegotiate" \ |
| 10505 | -s "=> renegotiate" \ |
| 10506 | -s "Extra-header:" \ |
| 10507 | -c "HTTP/1.0 200 OK" |
| 10508 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10509 | client_needs_more_time 4 |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 10510 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 10511 | run_test "DTLS proxy: 3d, min handshake, server-initiated renego, nbio" \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 10512 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10513 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 10514 | psk=73776f726466697368 renegotiate=1 renegotiation=1 exchanges=4 \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 10515 | debug_level=2 nbio=2" \ |
Gilles Peskine | d84733d | 2024-04-29 16:09:52 +0200 | [diff] [blame] | 10516 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=73776f726466697368 \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 10517 | renegotiation=1 exchanges=4 debug_level=2 nbio=2 \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 10518 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 10519 | 0 \ |
| 10520 | -c "=> renegotiate" \ |
| 10521 | -s "=> renegotiate" \ |
| 10522 | -s "Extra-header:" \ |
| 10523 | -c "HTTP/1.0 200 OK" |
| 10524 | |
Zhangsen Wang | 7d0e658 | 2022-06-29 07:33:35 +0000 | [diff] [blame] | 10525 | ## The three tests below require 1.1.1a or higher version of openssl, otherwise |
| 10526 | ## it might trigger a bug due to openssl (https://github.com/openssl/openssl/issues/6902) |
| 10527 | requires_openssl_next |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10528 | client_needs_more_time 6 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 10529 | not_with_valgrind # risk of non-mbedtls peer timing out |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 10530 | run_test "DTLS proxy: 3d, openssl server" \ |
Manuel Pégourié-Gonnard | d0fd1da | 2014-09-25 17:00:27 +0200 | [diff] [blame] | 10531 | -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \ |
Zhangsen Wang | 7d0e658 | 2022-06-29 07:33:35 +0000 | [diff] [blame] | 10532 | "$O_NEXT_SRV -dtls1 -mtu 2048" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10533 | "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 tickets=0" \ |
Manuel Pégourié-Gonnard | d0fd1da | 2014-09-25 17:00:27 +0200 | [diff] [blame] | 10534 | 0 \ |
Manuel Pégourié-Gonnard | d0fd1da | 2014-09-25 17:00:27 +0200 | [diff] [blame] | 10535 | -c "HTTP/1.0 200 OK" |
| 10536 | |
Zhangsen Wang | 7d0e658 | 2022-06-29 07:33:35 +0000 | [diff] [blame] | 10537 | requires_openssl_next |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10538 | client_needs_more_time 8 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 10539 | not_with_valgrind # risk of non-mbedtls peer timing out |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 10540 | run_test "DTLS proxy: 3d, openssl server, fragmentation" \ |
| 10541 | -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \ |
Zhangsen Wang | 7d0e658 | 2022-06-29 07:33:35 +0000 | [diff] [blame] | 10542 | "$O_NEXT_SRV -dtls1 -mtu 768" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10543 | "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 tickets=0" \ |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 10544 | 0 \ |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 10545 | -c "HTTP/1.0 200 OK" |
| 10546 | |
Zhangsen Wang | 7d0e658 | 2022-06-29 07:33:35 +0000 | [diff] [blame] | 10547 | requires_openssl_next |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10548 | client_needs_more_time 8 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 10549 | not_with_valgrind # risk of non-mbedtls peer timing out |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 10550 | run_test "DTLS proxy: 3d, openssl server, fragmentation, nbio" \ |
| 10551 | -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \ |
Zhangsen Wang | 1c981f5 | 2022-08-02 06:18:40 +0000 | [diff] [blame] | 10552 | "$O_NEXT_SRV -dtls1 -mtu 768" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10553 | "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 nbio=2 tickets=0" \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 10554 | 0 \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 10555 | -c "HTTP/1.0 200 OK" |
| 10556 | |
Manuel Pégourié-Gonnard | 9699996 | 2015-02-17 16:02:37 +0000 | [diff] [blame] | 10557 | requires_gnutls |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10558 | client_needs_more_time 6 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 10559 | not_with_valgrind # risk of non-mbedtls peer timing out |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 10560 | run_test "DTLS proxy: 3d, gnutls server" \ |
| 10561 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
| 10562 | "$G_SRV -u --mtu 2048 -a" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10563 | "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000" \ |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 10564 | 0 \ |
| 10565 | -s "Extra-header:" \ |
| 10566 | -c "Extra-header:" |
| 10567 | |
k-stachowiak | 17a38d3 | 2019-02-18 15:29:56 +0100 | [diff] [blame] | 10568 | requires_gnutls_next |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10569 | client_needs_more_time 8 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 10570 | not_with_valgrind # risk of non-mbedtls peer timing out |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 10571 | run_test "DTLS proxy: 3d, gnutls server, fragmentation" \ |
| 10572 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
k-stachowiak | 17a38d3 | 2019-02-18 15:29:56 +0100 | [diff] [blame] | 10573 | "$G_NEXT_SRV -u --mtu 512" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10574 | "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000" \ |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 10575 | 0 \ |
| 10576 | -s "Extra-header:" \ |
| 10577 | -c "Extra-header:" |
| 10578 | |
k-stachowiak | 17a38d3 | 2019-02-18 15:29:56 +0100 | [diff] [blame] | 10579 | requires_gnutls_next |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 10580 | client_needs_more_time 8 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 10581 | not_with_valgrind # risk of non-mbedtls peer timing out |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 10582 | run_test "DTLS proxy: 3d, gnutls server, fragmentation, nbio" \ |
| 10583 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
k-stachowiak | 17a38d3 | 2019-02-18 15:29:56 +0100 | [diff] [blame] | 10584 | "$G_NEXT_SRV -u --mtu 512" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10585 | "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 nbio=2" \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 10586 | 0 \ |
| 10587 | -s "Extra-header:" \ |
| 10588 | -c "Extra-header:" |
| 10589 | |
Ron Eldor | f75e252 | 2019-05-14 20:38:49 +0300 | [diff] [blame] | 10590 | requires_config_enabled MBEDTLS_SSL_EXPORT_KEYS |
| 10591 | run_test "export keys functionality" \ |
| 10592 | "$P_SRV eap_tls=1 debug_level=3" \ |
| 10593 | "$P_CLI eap_tls=1 debug_level=3" \ |
| 10594 | 0 \ |
| 10595 | -s "exported maclen is " \ |
| 10596 | -s "exported keylen is " \ |
| 10597 | -s "exported ivlen is " \ |
| 10598 | -c "exported maclen is " \ |
| 10599 | -c "exported keylen is " \ |
Ron Eldor | 65d8c26 | 2019-06-04 13:05:36 +0300 | [diff] [blame] | 10600 | -c "exported ivlen is " \ |
| 10601 | -c "EAP-TLS key material is:"\ |
| 10602 | -s "EAP-TLS key material is:"\ |
| 10603 | -c "EAP-TLS IV is:" \ |
| 10604 | -s "EAP-TLS IV is:" |
Ron Eldor | f75e252 | 2019-05-14 20:38:49 +0300 | [diff] [blame] | 10605 | |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 10606 | # Test heap memory usage after handshake |
| 10607 | requires_config_enabled MBEDTLS_MEMORY_DEBUG |
| 10608 | requires_config_enabled MBEDTLS_MEMORY_BUFFER_ALLOC_C |
| 10609 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | a49124e | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 10610 | requires_max_content_len 16384 |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 10611 | run_tests_memory_after_hanshake |
| 10612 | |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 10613 | if [ "$LIST_TESTS" -eq 0 ]; then |
| 10614 | # Final report |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 10615 | |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 10616 | echo "------------------------------------------------------------------------" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 10617 | |
Tomás González | cbb2e45 | 2023-09-13 11:47:13 +0100 | [diff] [blame] | 10618 | if [ $FAILS = 0 ]; then |
| 10619 | printf "PASSED" |
| 10620 | else |
| 10621 | printf "FAILED" |
| 10622 | fi |
| 10623 | PASSES=$(( $TESTS - $FAILS )) |
| 10624 | echo " ($PASSES / $TESTS tests ($SKIPS skipped))" |
Gilles Peskine | d2c4189 | 2024-05-17 11:55:15 +0200 | [diff] [blame^] | 10625 | |
| 10626 | if [ $((TESTS - SKIPS)) -lt $MIN_TESTS ]; then |
| 10627 | cat <<EOF |
| 10628 | Error: Expected to run at least $MIN_TESTS, but only ran $((TESTS - SKIPS)). |
| 10629 | Maybe a bad filter ('$FILTER') or a bad configuration? |
| 10630 | EOF |
| 10631 | if [ $FAILS -eq 0 ]; then |
| 10632 | FAILS=1 |
| 10633 | fi |
| 10634 | fi |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 10635 | fi |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 10636 | |
Tom Cosgrove | c1ae9f9 | 2023-01-13 12:13:41 +0000 | [diff] [blame] | 10637 | if [ $FAILS -gt 255 ]; then |
| 10638 | # Clamp at 255 as caller gets exit code & 0xFF |
| 10639 | # (so 256 would be 0, or success, etc) |
| 10640 | FAILS=255 |
| 10641 | fi |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 10642 | exit $FAILS |