blob: 87fea095b66a937eb5c90fed3f236e48c80e0f41 [file] [log] [blame]
Jerry Yue5991322022-11-07 14:03:44 +08001#!/bin/sh
2
3# tls13-misc.sh
4#
5# Copyright The Mbed TLS Contributors
Dave Rodgman16799db2023-11-02 19:47:20 +00006# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
Jerry Yue5991322022-11-07 14:03:44 +08007#
8
9requires_gnutls_tls1_3
Jerry Yu616ba752022-11-08 21:49:47 +080010requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
11requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
12requires_config_enabled MBEDTLS_SSL_SRV_C
13requires_config_enabled MBEDTLS_DEBUG_C
14requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
15
16run_test "TLS 1.3: PSK: No valid ciphersuite. G->m" \
Ronald Cron50ae84e2023-03-14 08:59:56 +010017 "$P_SRV tls13_kex_modes=all debug_level=5 $(get_srv_psk_list)" \
Jerry Yu616ba752022-11-08 21:49:47 +080018 "$G_NEXT_CLI -d 10 --priority NORMAL:-VERS-ALL:-CIPHER-ALL:+AES-256-GCM:+AEAD:+SHA384:-KX-ALL:+ECDHE-PSK:+DHE-PSK:+PSK:+VERS-TLS1.3 \
19 --pskusername Client_identity --pskkey=6162636465666768696a6b6c6d6e6f70 \
20 localhost" \
21 1 \
22 -s "found psk key exchange modes extension" \
23 -s "found pre_shared_key extension" \
24 -s "Found PSK_EPHEMERAL KEX MODE" \
25 -s "Found PSK KEX MODE" \
26 -s "No matched ciphersuite"
27
28requires_openssl_tls1_3
29requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
30requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
31requires_config_enabled MBEDTLS_SSL_SRV_C
32requires_config_enabled MBEDTLS_DEBUG_C
33requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
34
35run_test "TLS 1.3: PSK: No valid ciphersuite. O->m" \
Ronald Cron50ae84e2023-03-14 08:59:56 +010036 "$P_SRV tls13_kex_modes=all debug_level=5 $(get_srv_psk_list)" \
Jerry Yu616ba752022-11-08 21:49:47 +080037 "$O_NEXT_CLI -tls1_3 -msg -allow_no_dhe_kex -ciphersuites TLS_AES_256_GCM_SHA384\
38 -psk_identity Client_identity -psk 6162636465666768696a6b6c6d6e6f70" \
39 1 \
40 -s "found psk key exchange modes extension" \
41 -s "found pre_shared_key extension" \
42 -s "Found PSK_EPHEMERAL KEX MODE" \
43 -s "Found PSK KEX MODE" \
44 -s "No matched ciphersuite"
45
46requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 MBEDTLS_SSL_SESSION_TICKETS MBEDTLS_SSL_SRV_C \
Ronald Cronf5b47062022-12-15 13:46:23 +010047 MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C MBEDTLS_HAVE_TIME \
48 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Jerry Yu616ba752022-11-08 21:49:47 +080049run_test "TLS 1.3 m->m: Multiple PSKs: valid ticket, reconnect with ticket" \
Ronald Cron50ae84e2023-03-14 08:59:56 +010050 "$P_SRV tls13_kex_modes=psk_ephemeral debug_level=5 psk_identity=Client_identity psk=6162636465666768696a6b6c6d6e6f70 tickets=8" \
51 "$P_CLI tls13_kex_modes=psk_ephemeral debug_level=5 psk_identity=Client_identity psk=6162636465666768696a6b6c6d6e6f70 reco_mode=1 reconnect=1" \
Jerry Yu616ba752022-11-08 21:49:47 +080052 0 \
53 -c "Pre-configured PSK number = 2" \
54 -s "sent selected_identity: 0" \
55 -s "key exchange mode: psk_ephemeral" \
56 -S "key exchange mode: psk$" \
57 -S "key exchange mode: ephemeral$" \
58 -S "ticket is not authentic"
59
60requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 MBEDTLS_SSL_SESSION_TICKETS MBEDTLS_SSL_SRV_C \
Ronald Cronf5b47062022-12-15 13:46:23 +010061 MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C MBEDTLS_HAVE_TIME \
62 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Jerry Yu616ba752022-11-08 21:49:47 +080063run_test "TLS 1.3 m->m: Multiple PSKs: invalid ticket, reconnect with PSK" \
Ronald Cron50ae84e2023-03-14 08:59:56 +010064 "$P_SRV tls13_kex_modes=psk_ephemeral debug_level=5 psk_identity=Client_identity psk=6162636465666768696a6b6c6d6e6f70 tickets=8 dummy_ticket=1" \
65 "$P_CLI tls13_kex_modes=psk_ephemeral debug_level=5 psk_identity=Client_identity psk=6162636465666768696a6b6c6d6e6f70 reco_mode=1 reconnect=1" \
Jerry Yu616ba752022-11-08 21:49:47 +080066 0 \
67 -c "Pre-configured PSK number = 2" \
68 -s "sent selected_identity: 1" \
69 -s "key exchange mode: psk_ephemeral" \
70 -S "key exchange mode: psk$" \
71 -S "key exchange mode: ephemeral$" \
72 -s "ticket is not authentic"
73
74requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 MBEDTLS_SSL_SESSION_TICKETS MBEDTLS_SSL_SRV_C \
Ronald Cronf5b47062022-12-15 13:46:23 +010075 MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C MBEDTLS_HAVE_TIME \
76 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
77 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Jerry Yu616ba752022-11-08 21:49:47 +080078run_test "TLS 1.3 m->m: Session resumption failure, ticket authentication failed." \
Ronald Cron50ae84e2023-03-14 08:59:56 +010079 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=8 dummy_ticket=1" \
Jerry Yu616ba752022-11-08 21:49:47 +080080 "$P_CLI debug_level=4 reco_mode=1 reconnect=1" \
81 0 \
82 -c "Pre-configured PSK number = 1" \
83 -S "sent selected_identity:" \
84 -s "key exchange mode: ephemeral" \
85 -S "key exchange mode: psk_ephemeral" \
86 -S "key exchange mode: psk$" \
87 -s "ticket is not authentic" \
88 -S "ticket is expired" \
Jerry Yu60e99722023-11-20 09:55:24 +080089 -S "Invalid ticket creation time" \
Jerry Yu616ba752022-11-08 21:49:47 +080090 -S "Ticket age exceeds limitation" \
91 -S "Ticket age outside tolerance window"
92
93requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 MBEDTLS_SSL_SESSION_TICKETS MBEDTLS_SSL_SRV_C \
Ronald Cronf5b47062022-12-15 13:46:23 +010094 MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C MBEDTLS_HAVE_TIME \
95 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
96 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Jerry Yu616ba752022-11-08 21:49:47 +080097run_test "TLS 1.3 m->m: Session resumption failure, ticket expired." \
Ronald Cron50ae84e2023-03-14 08:59:56 +010098 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=8 dummy_ticket=2" \
Jerry Yu616ba752022-11-08 21:49:47 +080099 "$P_CLI debug_level=4 reco_mode=1 reconnect=1" \
100 0 \
101 -c "Pre-configured PSK number = 1" \
102 -S "sent selected_identity:" \
103 -s "key exchange mode: ephemeral" \
104 -S "key exchange mode: psk_ephemeral" \
105 -S "key exchange mode: psk$" \
106 -S "ticket is not authentic" \
107 -s "ticket is expired" \
Jerry Yu60e99722023-11-20 09:55:24 +0800108 -S "Invalid ticket creation time" \
Jerry Yu616ba752022-11-08 21:49:47 +0800109 -S "Ticket age exceeds limitation" \
110 -S "Ticket age outside tolerance window"
111
112requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 MBEDTLS_SSL_SESSION_TICKETS MBEDTLS_SSL_SRV_C \
Ronald Cronf5b47062022-12-15 13:46:23 +0100113 MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C MBEDTLS_HAVE_TIME \
114 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
115 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Jerry Yu616ba752022-11-08 21:49:47 +0800116run_test "TLS 1.3 m->m: Session resumption failure, invalid start time." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100117 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=8 dummy_ticket=3" \
Jerry Yu616ba752022-11-08 21:49:47 +0800118 "$P_CLI debug_level=4 reco_mode=1 reconnect=1" \
119 0 \
120 -c "Pre-configured PSK number = 1" \
121 -S "sent selected_identity:" \
122 -s "key exchange mode: ephemeral" \
123 -S "key exchange mode: psk_ephemeral" \
124 -S "key exchange mode: psk$" \
125 -S "ticket is not authentic" \
126 -S "ticket is expired" \
Jerry Yu60e99722023-11-20 09:55:24 +0800127 -s "Invalid ticket creation time" \
Jerry Yu616ba752022-11-08 21:49:47 +0800128 -S "Ticket age exceeds limitation" \
129 -S "Ticket age outside tolerance window"
130
131requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 MBEDTLS_SSL_SESSION_TICKETS MBEDTLS_SSL_SRV_C \
Ronald Cronf5b47062022-12-15 13:46:23 +0100132 MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C MBEDTLS_HAVE_TIME \
133 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
134 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Jerry Yu616ba752022-11-08 21:49:47 +0800135run_test "TLS 1.3 m->m: Session resumption failure, ticket expired. too old" \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100136 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=8 dummy_ticket=4" \
Jerry Yu616ba752022-11-08 21:49:47 +0800137 "$P_CLI debug_level=4 reco_mode=1 reconnect=1" \
138 0 \
139 -c "Pre-configured PSK number = 1" \
140 -S "sent selected_identity:" \
141 -s "key exchange mode: ephemeral" \
142 -S "key exchange mode: psk_ephemeral" \
143 -S "key exchange mode: psk$" \
144 -S "ticket is not authentic" \
145 -S "ticket is expired" \
Jerry Yu60e99722023-11-20 09:55:24 +0800146 -S "Invalid ticket creation time" \
Jerry Yu616ba752022-11-08 21:49:47 +0800147 -s "Ticket age exceeds limitation" \
148 -S "Ticket age outside tolerance window"
149
150requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 MBEDTLS_SSL_SESSION_TICKETS MBEDTLS_SSL_SRV_C \
Ronald Cronf5b47062022-12-15 13:46:23 +0100151 MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C MBEDTLS_HAVE_TIME \
152 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
153 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Jerry Yu616ba752022-11-08 21:49:47 +0800154run_test "TLS 1.3 m->m: Session resumption failure, age outside tolerance window, too young." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100155 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=8 dummy_ticket=5" \
Jerry Yu616ba752022-11-08 21:49:47 +0800156 "$P_CLI debug_level=4 reco_mode=1 reconnect=1" \
157 0 \
158 -c "Pre-configured PSK number = 1" \
159 -S "sent selected_identity:" \
160 -s "key exchange mode: ephemeral" \
161 -S "key exchange mode: psk_ephemeral" \
162 -S "key exchange mode: psk$" \
163 -S "ticket is not authentic" \
164 -S "ticket is expired" \
Jerry Yu60e99722023-11-20 09:55:24 +0800165 -S "Invalid ticket creation time" \
Jerry Yu616ba752022-11-08 21:49:47 +0800166 -S "Ticket age exceeds limitation" \
167 -s "Ticket age outside tolerance window"
168
169requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 MBEDTLS_SSL_SESSION_TICKETS MBEDTLS_SSL_SRV_C \
Ronald Cronf5b47062022-12-15 13:46:23 +0100170 MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C MBEDTLS_HAVE_TIME \
171 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
172 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Jerry Yu616ba752022-11-08 21:49:47 +0800173run_test "TLS 1.3 m->m: Session resumption failure, age outside tolerance window, too old." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100174 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=8 dummy_ticket=6" \
Jerry Yu616ba752022-11-08 21:49:47 +0800175 "$P_CLI debug_level=4 reco_mode=1 reconnect=1" \
176 0 \
177 -c "Pre-configured PSK number = 1" \
178 -S "sent selected_identity:" \
179 -s "key exchange mode: ephemeral" \
180 -S "key exchange mode: psk_ephemeral" \
181 -S "key exchange mode: psk$" \
182 -S "ticket is not authentic" \
183 -S "ticket is expired" \
Jerry Yu60e99722023-11-20 09:55:24 +0800184 -S "Invalid ticket creation time" \
Jerry Yu616ba752022-11-08 21:49:47 +0800185 -S "Ticket age exceeds limitation" \
186 -s "Ticket age outside tolerance window"
187
188requires_gnutls_tls1_3
189requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE MBEDTLS_SSL_SRV_C MBEDTLS_DEBUG_C
190requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
191run_test "TLS 1.3: G->m: ephemeral_all/psk, fail, no common kex mode" \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100192 "$P_SRV tls13_kex_modes=psk debug_level=5 $(get_srv_psk_list)" \
Jerry Yu616ba752022-11-08 21:49:47 +0800193 "$G_NEXT_CLI -d 10 --priority NORMAL:-VERS-ALL:-KX-ALL:+ECDHE-PSK:+DHE-PSK:-PSK:+VERS-TLS1.3 \
194 --pskusername Client_identity --pskkey=6162636465666768696a6b6c6d6e6f70 \
195 localhost" \
196 1 \
197 -s "found psk key exchange modes extension" \
198 -s "found pre_shared_key extension" \
199 -s "Found PSK_EPHEMERAL KEX MODE" \
200 -S "Found PSK KEX MODE" \
201 -S "key exchange mode: psk$" \
202 -S "key exchange mode: psk_ephemeral" \
203 -S "key exchange mode: ephemeral"
204
205requires_gnutls_tls1_3
Jerry Yue5991322022-11-07 14:03:44 +0800206requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 MBEDTLS_SSL_SRV_C MBEDTLS_DEBUG_C \
207 MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
208 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
209requires_all_configs_disabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED \
210 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
211run_test "TLS 1.3: G->m: PSK: configured psk only, good." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100212 "$P_SRV tls13_kex_modes=all debug_level=5 $(get_srv_psk_list)" \
Jerry Yue5991322022-11-07 14:03:44 +0800213 "$G_NEXT_CLI -d 10 --priority NORMAL:-VERS-ALL:-KX-ALL:+ECDHE-PSK:+DHE-PSK:+PSK:+VERS-TLS1.3:+GROUP-ALL \
214 --pskusername Client_identity --pskkey=6162636465666768696a6b6c6d6e6f70 \
215 localhost" \
216 0 \
217 -s "found psk key exchange modes extension" \
218 -s "found pre_shared_key extension" \
219 -s "Found PSK_EPHEMERAL KEX MODE" \
220 -s "Found PSK KEX MODE" \
221 -s "key exchange mode: psk$"
222
223requires_gnutls_tls1_3
224requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 MBEDTLS_SSL_SRV_C MBEDTLS_DEBUG_C \
225 MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
226 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
227requires_all_configs_disabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED \
228 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
229run_test "TLS 1.3: G->m: PSK: configured psk_ephemeral only, good." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100230 "$P_SRV tls13_kex_modes=all debug_level=5 $(get_srv_psk_list)" \
Jerry Yue5991322022-11-07 14:03:44 +0800231 "$G_NEXT_CLI -d 10 --priority NORMAL:-VERS-ALL:-KX-ALL:+ECDHE-PSK:+DHE-PSK:+PSK:+VERS-TLS1.3:+GROUP-ALL \
232 --pskusername Client_identity --pskkey=6162636465666768696a6b6c6d6e6f70 \
233 localhost" \
234 0 \
235 -s "found psk key exchange modes extension" \
236 -s "found pre_shared_key extension" \
237 -s "Found PSK_EPHEMERAL KEX MODE" \
238 -s "Found PSK KEX MODE" \
239 -s "key exchange mode: psk_ephemeral$"
240
241requires_gnutls_tls1_3
242requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 MBEDTLS_SSL_SRV_C MBEDTLS_DEBUG_C \
243 MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
244 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
245requires_all_configs_disabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED \
246 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
247run_test "TLS 1.3: G->m: PSK: configured ephemeral only, good." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100248 "$P_SRV tls13_kex_modes=all debug_level=5 $(get_srv_psk_list)" \
Jerry Yue5991322022-11-07 14:03:44 +0800249 "$G_NEXT_CLI -d 10 --priority NORMAL:-VERS-ALL:-KX-ALL:+ECDHE-PSK:+DHE-PSK:+PSK:+VERS-TLS1.3:+GROUP-ALL \
250 --pskusername Client_identity --pskkey=6162636465666768696a6b6c6d6e6f70 \
251 localhost" \
252 0 \
253 -s "key exchange mode: ephemeral$"
254
Ronald Cronf1ad73f2024-03-05 08:38:49 +0100255requires_openssl_tls1_3_with_compatible_ephemeral
256requires_config_enabled MBEDTLS_DEBUG_C
257requires_config_enabled MBEDTLS_SSL_CLI_C
258requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
259 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
260 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
261run_test "TLS 1.3: NewSessionTicket: Basic check, m->O" \
262 "$O_NEXT_SRV -msg -tls1_3 -no_resume_ephemeral -no_cache --num_tickets 4" \
263 "$P_CLI debug_level=1 reco_mode=1 reconnect=1" \
264 0 \
265 -c "Protocol is TLSv1.3" \
266 -c "got new session ticket." \
267 -c "Saving session for reuse... ok" \
268 -c "Reconnecting with saved session" \
269 -c "HTTP/1.0 200 ok"
270
271requires_gnutls_tls1_3
272requires_config_enabled MBEDTLS_DEBUG_C
273requires_config_enabled MBEDTLS_SSL_CLI_C
274requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
275 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
276 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
277run_test "TLS 1.3: NewSessionTicket: Basic check, m->G" \
278 "$G_NEXT_SRV -d 10 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3 --disable-client-cert" \
279 "$P_CLI debug_level=1 reco_mode=1 reconnect=1" \
280 0 \
281 -c "Protocol is TLSv1.3" \
282 -c "got new session ticket." \
283 -c "Saving session for reuse... ok" \
284 -c "Reconnecting with saved session" \
285 -c "HTTP/1.0 200 OK" \
286 -s "This is a resumed session"
287
288requires_openssl_tls1_3_with_compatible_ephemeral
289requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS
290requires_config_enabled MBEDTLS_SSL_SRV_C
291requires_config_enabled MBEDTLS_DEBUG_C
292requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
293 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
294 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
295# https://github.com/openssl/openssl/issues/10714
296# Until now, OpenSSL client does not support reconnect.
297skip_next_test
298run_test "TLS 1.3: NewSessionTicket: Basic check, O->m" \
299 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=4" \
300 "$O_NEXT_CLI -msg -debug -tls1_3 -reconnect" \
301 0 \
302 -s "=> write NewSessionTicket msg" \
303 -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \
304 -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH"
305
306requires_gnutls_tls1_3
307requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS
308requires_config_enabled MBEDTLS_SSL_SRV_C
309requires_config_enabled MBEDTLS_DEBUG_C
310requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
311 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
312 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
313run_test "TLS 1.3: NewSessionTicket: Basic check, G->m" \
314 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=4" \
315 "$G_NEXT_CLI localhost -d 4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3 -V -r" \
316 0 \
317 -c "Connecting again- trying to resume previous session" \
318 -c "NEW SESSION TICKET (4) was received" \
319 -s "=> write NewSessionTicket msg" \
320 -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \
321 -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH" \
322 -s "key exchange mode: ephemeral" \
323 -s "key exchange mode: psk_ephemeral" \
324 -s "found pre_shared_key extension"
325
326requires_gnutls_tls1_3
327requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS
328requires_config_enabled MBEDTLS_SSL_SRV_C
329requires_config_enabled MBEDTLS_DEBUG_C
330requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
331 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
332 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
333# Test the session resumption when the cipher suite for the original session is
334# TLS1-3-AES-256-GCM-SHA384. In that case, the PSK is 384 bits long and not
335# 256 bits long as with all the other TLS 1.3 cipher suites.
336requires_ciphersuite_enabled TLS1-3-AES-256-GCM-SHA384
337run_test "TLS 1.3: NewSessionTicket: Basic check with AES-256-GCM only, G->m" \
338 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=4" \
339 "$G_NEXT_CLI localhost -d 4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM -V -r" \
340 0 \
341 -c "Connecting again- trying to resume previous session" \
342 -c "NEW SESSION TICKET (4) was received" \
343 -s "Ciphersuite is TLS1-3-AES-256-GCM-SHA384" \
344 -s "=> write NewSessionTicket msg" \
345 -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \
346 -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH" \
347 -s "key exchange mode: ephemeral" \
348 -s "key exchange mode: psk_ephemeral" \
349 -s "found pre_shared_key extension"
350
351requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS
352requires_config_enabled MBEDTLS_SSL_SRV_C
353requires_config_enabled MBEDTLS_SSL_CLI_C
354requires_config_enabled MBEDTLS_DEBUG_C
355requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
356 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
357 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
358run_test "TLS 1.3: NewSessionTicket: Basic check, m->m" \
359 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=4" \
360 "$P_CLI debug_level=4 reco_mode=1 reconnect=1" \
361 0 \
362 -c "Protocol is TLSv1.3" \
363 -c "got new session ticket ( 3 )" \
364 -c "Saving session for reuse... ok" \
365 -c "Reconnecting with saved session" \
366 -c "HTTP/1.0 200 OK" \
367 -s "=> write NewSessionTicket msg" \
368 -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \
369 -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH" \
370 -s "key exchange mode: ephemeral" \
371 -s "key exchange mode: psk_ephemeral" \
372 -s "found pre_shared_key extension"
373
374requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 \
375 MBEDTLS_SSL_CLI_C MBEDTLS_SSL_SRV_C \
376 MBEDTLS_SSL_SESSION_TICKETS MBEDTLS_HAVE_TIME \
377 MBEDTLS_DEBUG_C \
378 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
379requires_any_configs_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED \
380 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
381run_test "TLS 1.3 m->m: NewSessionTicket: Ticket lifetime max value (7d)" \
382 "$P_SRV debug_level=1 crt_file=data_files/server5.crt key_file=data_files/server5.key ticket_timeout=604800 tickets=1" \
383 "$P_CLI reco_mode=1 reconnect=1" \
384 0 \
385 -c "Protocol is TLSv1.3" \
386 -c "HTTP/1.0 200 OK" \
387 -c "got new session ticket" \
388 -c "Reconnecting with saved session... ok" \
389 -s "Protocol is TLSv1.3" \
390 -S "Ticket lifetime (604800) is greater than 7 days."
391
392requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 \
393 MBEDTLS_SSL_CLI_C MBEDTLS_SSL_SRV_C \
394 MBEDTLS_SSL_SESSION_TICKETS MBEDTLS_HAVE_TIME \
395 MBEDTLS_DEBUG_C \
396 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
397requires_any_configs_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED \
398 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
399run_test "TLS 1.3 m->m: NewSessionTicket: Ticket lifetime too long (7d + 1s)" \
400 "$P_SRV debug_level=1 crt_file=data_files/server5.crt key_file=data_files/server5.key ticket_timeout=604801 tickets=1" \
401 "$P_CLI reco_mode=1 reconnect=1" \
402 1 \
403 -c "Protocol is TLSv1.3" \
404 -C "HTTP/1.0 200 OK" \
405 -C "got new session ticket" \
406 -C "Reconnecting with saved session... ok" \
407 -S "Protocol is TLSv1.3" \
408 -s "Ticket lifetime (604801) is greater than 7 days."
409
410requires_all_configs_enabled MBEDTLS_SSL_PROTO_TLS1_3 \
411 MBEDTLS_SSL_CLI_C MBEDTLS_SSL_SRV_C \
412 MBEDTLS_SSL_SESSION_TICKETS MBEDTLS_HAVE_TIME \
413 MBEDTLS_DEBUG_C \
414 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
415requires_any_configs_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED \
416 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
417run_test "TLS 1.3 m->m: NewSessionTicket: ticket lifetime=0" \
418 "$P_SRV debug_level=2 crt_file=data_files/server5.crt key_file=data_files/server5.key ticket_timeout=0 tickets=1" \
419 "$P_CLI debug_level=2 reco_mode=1 reconnect=1" \
420 1 \
421 -c "Protocol is TLSv1.3" \
422 -c "HTTP/1.0 200 OK" \
423 -c "Discard new session ticket" \
424 -C "got new session ticket" \
425 -c "Reconnecting with saved session... failed" \
426 -s "Protocol is TLSv1.3" \
427 -s "<= write new session ticket"
428
429requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS
430requires_config_enabled MBEDTLS_SSL_SRV_C
431requires_config_enabled MBEDTLS_SSL_CLI_C
432requires_config_enabled MBEDTLS_DEBUG_C
433requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
434 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
435 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
436run_test "TLS 1.3: NewSessionTicket: servername check, m->m" \
437 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=4 \
438 sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \
439 "$P_CLI debug_level=4 server_name=localhost reco_mode=1 reconnect=1" \
440 0 \
441 -c "Protocol is TLSv1.3" \
442 -c "got new session ticket." \
443 -c "Saving session for reuse... ok" \
444 -c "Reconnecting with saved session" \
445 -c "HTTP/1.0 200 OK" \
446 -s "=> write NewSessionTicket msg" \
447 -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \
448 -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH" \
449 -s "key exchange mode: ephemeral" \
450 -s "key exchange mode: psk_ephemeral" \
451 -s "found pre_shared_key extension"
452
453requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS
454requires_config_enabled MBEDTLS_SSL_SRV_C
455requires_config_enabled MBEDTLS_SSL_CLI_C
456requires_config_enabled MBEDTLS_DEBUG_C
457requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
458 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
459 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
460run_test "TLS 1.3: NewSessionTicket: servername negative check, m->m" \
461 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=4 \
462 sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \
463 "$P_CLI debug_level=4 server_name=localhost reco_server_name=remote reco_mode=1 reconnect=1" \
464 1 \
465 -c "Protocol is TLSv1.3" \
466 -c "got new session ticket." \
467 -c "Saving session for reuse... ok" \
468 -c "Reconnecting with saved session" \
469 -c "Hostname mismatch the session ticket, disable session resumption." \
470 -s "=> write NewSessionTicket msg" \
471 -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \
472 -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH"
473
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000474requires_gnutls_tls1_3
475requires_config_enabled MBEDTLS_DEBUG_C
476requires_config_enabled MBEDTLS_SSL_CLI_C
477requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
478 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000479 MBEDTLS_SSL_EARLY_DATA
Xiaokang Qiane7bab002022-11-16 08:51:01 +0000480requires_any_configs_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED \
481 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000482run_test "TLS 1.3 m->G: EarlyData: basic check, good" \
Yanray Wang951b3cb2023-11-21 11:13:31 +0800483 "$G_NEXT_SRV -d 10 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:+ECDHE-PSK:+PSK \
484 --earlydata --maxearlydata 16384 --disable-client-cert" \
Ronald Cron54a38292024-01-25 09:39:59 +0100485 "$P_CLI debug_level=4 early_data=1 reco_mode=1 reconnect=1 reco_delay=900" \
Xiaokang Qian7ed30e52022-12-16 08:32:02 +0000486 0 \
Yanray Wang951b3cb2023-11-21 11:13:31 +0800487 -c "received max_early_data_size: 16384" \
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000488 -c "Reconnecting with saved session" \
489 -c "NewSessionTicket: early_data(42) extension received." \
490 -c "ClientHello: early_data(42) extension exists." \
491 -c "EncryptedExtensions: early_data(42) extension received." \
Xiaokang Qian8bee8992022-10-27 10:21:05 +0000492 -c "EncryptedExtensions: early_data(42) extension exists." \
Xiaokang Qian57a138d2022-12-19 06:40:47 +0000493 -c "<= write EndOfEarlyData" \
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000494 -s "Parsing extension 'Early Data/42' (0 bytes)" \
495 -s "Sending extension Early Data/42 (0 bytes)" \
Xiaokang Qian94dd1dd2022-12-15 15:13:04 +0000496 -s "END OF EARLY DATA (5) was received." \
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000497 -s "early data accepted"
498
499requires_gnutls_tls1_3
500requires_config_enabled MBEDTLS_DEBUG_C
501requires_config_enabled MBEDTLS_SSL_CLI_C
502requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
503 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000504 MBEDTLS_SSL_EARLY_DATA
Xiaokang Qiane7bab002022-11-16 08:51:01 +0000505requires_any_configs_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED \
506 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
Xiaokang Qian30bb7ce2023-11-30 09:59:09 +0000507run_test "TLS 1.3 m->G: EarlyData: write early data, good" \
508 "$G_NEXT_SRV -d 10 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:+ECDHE-PSK:+PSK --earlydata --disable-client-cert" \
509 "$P_CLI debug_level=4 early_data=1 reco_mode=1 reconnect=1 reco_delay=900" \
510 0 \
511 -c "Reconnecting with saved session" \
512 -c "NewSessionTicket: early_data(42) extension received." \
513 -c "ClientHello: early_data(42) extension exists." \
514 -c "EncryptedExtensions: early_data(42) extension received." \
515 -c "EncryptedExtensions: early_data(42) extension exists." \
516 -c "<= write early_data" \
517 -c "<= write EndOfEarlyData" \
518 -s "Parsing extension 'Early Data/42' (0 bytes)" \
519 -s "Sending extension Early Data/42 (0 bytes)" \
520 -s "END OF EARLY DATA (5) was received." \
521 -s "early data accepted" \
522 -s "decrypted early data with length"
523
524requires_gnutls_tls1_3
525requires_config_enabled MBEDTLS_DEBUG_C
526requires_config_enabled MBEDTLS_SSL_CLI_C
527requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
528 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
529 MBEDTLS_SSL_EARLY_DATA
530requires_any_configs_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED \
531 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
Xiaokang Qiane9622ac2022-11-17 09:23:32 +0000532run_test "TLS 1.3 m->G: EarlyData: no early_data in NewSessionTicket, good" \
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000533 "$G_NEXT_SRV -d 10 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:+ECDHE-PSK:+PSK --disable-client-cert" \
Ronald Cron54a38292024-01-25 09:39:59 +0100534 "$P_CLI debug_level=4 early_data=1 reco_mode=1 reconnect=1" \
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000535 0 \
536 -c "Reconnecting with saved session" \
537 -C "NewSessionTicket: early_data(42) extension received." \
538 -c "ClientHello: early_data(42) extension does not exist." \
539 -C "EncryptedExtensions: early_data(42) extension received." \
Xiaokang Qian8bee8992022-10-27 10:21:05 +0000540 -C "EncryptedExtensions: early_data(42) extension exists."
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000541
Xiaokang Qiane7bab002022-11-16 08:51:01 +0000542#TODO: OpenSSL tests don't work now. It might be openssl options issue, cause GnuTLS has worked.
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000543skip_next_test
Xiaokang Qiane7bab002022-11-16 08:51:01 +0000544requires_openssl_tls1_3
545requires_config_enabled MBEDTLS_DEBUG_C
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000546requires_config_enabled MBEDTLS_SSL_CLI_C
Xiaokang Qiane7bab002022-11-16 08:51:01 +0000547requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \
548 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
549 MBEDTLS_SSL_EARLY_DATA
550requires_any_configs_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED \
551 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000552run_test "TLS 1.3, ext PSK, early data" \
553 "$O_NEXT_SRV_EARLY_DATA -msg -debug -tls1_3 -psk_identity 0a0b0c -psk 010203 -allow_no_dhe_kex -nocert" \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100554 "$P_CLI debug_level=5 tls13_kex_modes=psk early_data=1 psk=010203 psk_identity=0a0b0c" \
Xiaokang Qianf3cefb42022-11-16 03:23:46 +0000555 1 \
556 -c "Reconnecting with saved session" \
557 -c "NewSessionTicket: early_data(42) extension received." \
558 -c "ClientHello: early_data(42) extension exists." \
559 -c "EncryptedExtensions: early_data(42) extension received." \
560 -c "EncryptedExtensions: early_data(42) extension ( ignored )."
561
Ronald Cronf1ad73f2024-03-05 08:38:49 +0100562EARLY_DATA_INPUT_LEN_BLOCKS=$(( ( $( cat $EARLY_DATA_INPUT | wc -c ) + 31 ) / 32 ))
563EARLY_DATA_INPUT_LEN=$(( $EARLY_DATA_INPUT_LEN_BLOCKS * 32 ))
564
565requires_gnutls_next
566requires_all_configs_enabled MBEDTLS_SSL_EARLY_DATA MBEDTLS_SSL_SESSION_TICKETS \
567 MBEDTLS_SSL_SRV_C MBEDTLS_DEBUG_C MBEDTLS_HAVE_TIME \
568 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
569 MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
570requires_any_configs_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED \
571 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
572run_test "TLS 1.3 G->m: EarlyData: feature is enabled, good." \
573 "$P_SRV force_version=tls13 debug_level=4 early_data=1 max_early_data_size=$EARLY_DATA_INPUT_LEN" \
574 "$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+GROUP-ALL:+KX-ALL \
575 -d 10 -r --earlydata $EARLY_DATA_INPUT " \
576 0 \
577 -s "Sent max_early_data_size=$EARLY_DATA_INPUT_LEN" \
578 -s "NewSessionTicket: early_data(42) extension exists." \
579 -s "ClientHello: early_data(42) extension exists." \
580 -s "EncryptedExtensions: early_data(42) extension exists." \
581 -s "$( head -1 $EARLY_DATA_INPUT )" \
582 -s "$( tail -1 $EARLY_DATA_INPUT )" \
583 -s "200 early data bytes read" \
584 -s "106 early data bytes read"
585
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800586requires_all_configs_enabled MBEDTLS_SSL_SESSION_TICKETS \
Pengyu Lvc1334d92023-01-12 16:18:08 +0800587 MBEDTLS_SSL_SRV_C MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C \
588 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
589 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800590run_test "TLS 1.3 m->m: Resumption with ticket flags, psk/none." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100591 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key dummy_ticket=7" \
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800592 "$P_CLI debug_level=4 tls13_kex_modes=psk_or_ephemeral reconnect=1" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800593 0 \
594 -c "Pre-configured PSK number = 1" \
595 -S "sent selected_identity:" \
596 -s "key exchange mode: ephemeral" \
597 -S "key exchange mode: psk_ephemeral" \
598 -S "key exchange mode: psk$" \
Ronald Croncf284562024-02-16 18:54:10 +0100599 -s "No suitable PSK key exchange mode" \
600 -s "No usable PSK or ticket"
Pengyu Lv302feb32022-12-09 14:27:08 +0800601
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800602requires_all_configs_enabled MBEDTLS_SSL_SESSION_TICKETS \
Pengyu Lvc1334d92023-01-12 16:18:08 +0800603 MBEDTLS_SSL_SRV_C MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C \
604 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
605 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800606run_test "TLS 1.3 m->m: Resumption with ticket flags, psk/psk." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100607 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key dummy_ticket=8" \
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800608 "$P_CLI debug_level=4 tls13_kex_modes=psk_or_ephemeral reconnect=1" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800609 0 \
610 -c "Pre-configured PSK number = 1" \
Ronald Croncf284562024-02-16 18:54:10 +0100611 -S "No suitable PSK key exchange mode" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800612 -s "found matched identity"
613
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800614requires_all_configs_enabled MBEDTLS_SSL_SESSION_TICKETS \
Pengyu Lvc1334d92023-01-12 16:18:08 +0800615 MBEDTLS_SSL_SRV_C MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C \
616 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
617 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800618run_test "TLS 1.3 m->m: Resumption with ticket flags, psk/psk_ephemeral." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100619 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key dummy_ticket=9" \
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800620 "$P_CLI debug_level=4 tls13_kex_modes=psk_or_ephemeral reconnect=1" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800621 0 \
622 -c "Pre-configured PSK number = 1" \
623 -S "sent selected_identity:" \
624 -s "key exchange mode: ephemeral" \
625 -S "key exchange mode: psk_ephemeral" \
626 -S "key exchange mode: psk$" \
Ronald Croncf284562024-02-16 18:54:10 +0100627 -s "No suitable PSK key exchange mode" \
628 -s "No usable PSK or ticket"
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800629
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800630requires_all_configs_enabled MBEDTLS_SSL_SESSION_TICKETS \
Pengyu Lvc1334d92023-01-12 16:18:08 +0800631 MBEDTLS_SSL_SRV_C MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C \
632 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
633 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800634run_test "TLS 1.3 m->m: Resumption with ticket flags, psk/psk_all." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100635 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key dummy_ticket=10" \
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800636 "$P_CLI debug_level=4 tls13_kex_modes=psk_or_ephemeral reconnect=1" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800637 0 \
638 -c "Pre-configured PSK number = 1" \
Ronald Croncf284562024-02-16 18:54:10 +0100639 -S "No suitable PSK key exchange mode" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800640 -s "found matched identity"
641
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800642requires_all_configs_enabled MBEDTLS_SSL_SESSION_TICKETS \
Pengyu Lvc1334d92023-01-12 16:18:08 +0800643 MBEDTLS_SSL_SRV_C MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C \
644 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
645 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800646run_test "TLS 1.3 m->m: Resumption with ticket flags, psk_ephemeral/none." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100647 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key dummy_ticket=7" \
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800648 "$P_CLI debug_level=4 tls13_kex_modes=ephemeral_all reconnect=1" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800649 0 \
650 -c "Pre-configured PSK number = 1" \
651 -S "sent selected_identity:" \
652 -s "key exchange mode: ephemeral" \
653 -S "key exchange mode: psk_ephemeral" \
654 -S "key exchange mode: psk$" \
Ronald Croncf284562024-02-16 18:54:10 +0100655 -s "No suitable PSK key exchange mode" \
656 -s "No usable PSK or ticket"
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800657
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800658requires_all_configs_enabled MBEDTLS_SSL_SESSION_TICKETS \
Pengyu Lvc1334d92023-01-12 16:18:08 +0800659 MBEDTLS_SSL_SRV_C MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C \
660 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
661 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800662run_test "TLS 1.3 m->m: Resumption with ticket flags, psk_ephemeral/psk." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100663 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key dummy_ticket=8" \
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800664 "$P_CLI debug_level=4 tls13_kex_modes=ephemeral_all reconnect=1" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800665 0 \
666 -c "Pre-configured PSK number = 1" \
667 -S "sent selected_identity:" \
668 -s "key exchange mode: ephemeral" \
669 -S "key exchange mode: psk_ephemeral" \
670 -S "key exchange mode: psk$" \
Ronald Croncf284562024-02-16 18:54:10 +0100671 -s "No suitable PSK key exchange mode" \
672 -s "No usable PSK or ticket"
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800673
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800674requires_all_configs_enabled MBEDTLS_SSL_SESSION_TICKETS \
Pengyu Lvc1334d92023-01-12 16:18:08 +0800675 MBEDTLS_SSL_SRV_C MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C \
676 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
677 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800678run_test "TLS 1.3 m->m: Resumption with ticket flags, psk_ephemeral/psk_ephemeral." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100679 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key dummy_ticket=9" \
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800680 "$P_CLI debug_level=4 tls13_kex_modes=ephemeral_all reconnect=1" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800681 0 \
682 -c "Pre-configured PSK number = 1" \
Ronald Croncf284562024-02-16 18:54:10 +0100683 -S "No suitable PSK key exchange mode" \
Pengyu Lv1cc61342023-01-17 12:14:58 +0800684 -s "found matched identity" \
685 -s "key exchange mode: psk_ephemeral"
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800686
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800687requires_all_configs_enabled MBEDTLS_SSL_SESSION_TICKETS \
Pengyu Lvc1334d92023-01-12 16:18:08 +0800688 MBEDTLS_SSL_SRV_C MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C \
689 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
690 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800691run_test "TLS 1.3 m->m: Resumption with ticket flags, psk_ephemeral/psk_all." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100692 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key dummy_ticket=10" \
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800693 "$P_CLI debug_level=4 tls13_kex_modes=ephemeral_all reconnect=1" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800694 0 \
695 -c "Pre-configured PSK number = 1" \
Ronald Croncf284562024-02-16 18:54:10 +0100696 -S "No suitable PSK key exchange mode" \
Pengyu Lv1cc61342023-01-17 12:14:58 +0800697 -s "found matched identity" \
698 -s "key exchange mode: psk_ephemeral"
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800699
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800700requires_all_configs_enabled MBEDTLS_SSL_SESSION_TICKETS \
Pengyu Lvc1334d92023-01-12 16:18:08 +0800701 MBEDTLS_SSL_SRV_C MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C \
702 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
703 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED \
704 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800705run_test "TLS 1.3 m->m: Resumption with ticket flags, psk_all/none." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100706 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key dummy_ticket=7" \
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800707 "$P_CLI debug_level=4 tls13_kex_modes=all reconnect=1" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800708 0 \
709 -c "Pre-configured PSK number = 1" \
710 -S "sent selected_identity:" \
711 -s "key exchange mode: ephemeral" \
712 -S "key exchange mode: psk_ephemeral" \
713 -S "key exchange mode: psk$" \
Ronald Croncf284562024-02-16 18:54:10 +0100714 -s "No suitable PSK key exchange mode" \
715 -s "No usable PSK or ticket"
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800716
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800717requires_all_configs_enabled MBEDTLS_SSL_SESSION_TICKETS \
Pengyu Lvc1334d92023-01-12 16:18:08 +0800718 MBEDTLS_SSL_SRV_C MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C \
719 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
720 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED \
721 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800722run_test "TLS 1.3 m->m: Resumption with ticket flags, psk_all/psk." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100723 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key dummy_ticket=8" \
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800724 "$P_CLI debug_level=4 tls13_kex_modes=all reconnect=1" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800725 0 \
726 -c "Pre-configured PSK number = 1" \
Ronald Croncf284562024-02-16 18:54:10 +0100727 -S "No suitable PSK key exchange mode" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800728 -s "found matched identity"
729
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800730requires_all_configs_enabled MBEDTLS_SSL_SESSION_TICKETS \
Pengyu Lvc1334d92023-01-12 16:18:08 +0800731 MBEDTLS_SSL_SRV_C MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C \
732 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
733 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED \
734 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800735run_test "TLS 1.3 m->m: Resumption with ticket flags, psk_all/psk_ephemeral." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100736 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key dummy_ticket=9" \
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800737 "$P_CLI debug_level=4 tls13_kex_modes=all reconnect=1" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800738 0 \
739 -c "Pre-configured PSK number = 1" \
Ronald Croncf284562024-02-16 18:54:10 +0100740 -S "No suitable PSK key exchange mode" \
Pengyu Lv1cc61342023-01-17 12:14:58 +0800741 -s "found matched identity" \
742 -s "key exchange mode: psk_ephemeral"
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800743
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800744requires_all_configs_enabled MBEDTLS_SSL_SESSION_TICKETS \
Pengyu Lvc1334d92023-01-12 16:18:08 +0800745 MBEDTLS_SSL_SRV_C MBEDTLS_SSL_CLI_C MBEDTLS_DEBUG_C \
746 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
747 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED \
748 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800749run_test "TLS 1.3 m->m: Resumption with ticket flags, psk_all/psk_all." \
Ronald Cron50ae84e2023-03-14 08:59:56 +0100750 "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key dummy_ticket=10" \
Pengyu Lv2bfd7162023-01-16 13:44:10 +0800751 "$P_CLI debug_level=4 tls13_kex_modes=all reconnect=1" \
Pengyu Lv06cf66d2022-12-12 10:43:55 +0800752 0 \
753 -c "Pre-configured PSK number = 1" \
Ronald Croncf284562024-02-16 18:54:10 +0100754 -S "No suitable PSK key exchange mode" \
Pengyu Lv1cc61342023-01-17 12:14:58 +0800755 -s "found matched identity" \
756 -s "key exchange mode: psk_ephemeral"
Pengyu Lv302feb32022-12-09 14:27:08 +0800757
Ronald Cron1f63fe42024-02-23 15:49:12 +0100758requires_all_configs_enabled MBEDTLS_SSL_EARLY_DATA MBEDTLS_SSL_SESSION_TICKETS \
759 MBEDTLS_SSL_CLI_C MBEDTLS_SSL_SRV_C \
760 MBEDTLS_DEBUG_C MBEDTLS_HAVE_TIME \
761 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED \
762 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
763run_test "TLS 1.3 m->m: Ephemeral over PSK kex with early data enabled" \
Ronald Cron74191a52024-03-09 17:38:16 +0100764 "$P_SRV force_version=tls13 debug_level=4 early_data=1 max_early_data_size=1024" \
Ronald Crone14770f2024-03-08 08:57:36 +0100765 "$P_CLI debug_level=4 early_data=1 tls13_kex_modes=psk_or_ephemeral reco_mode=1 reconnect=1" \
Ronald Cron1f63fe42024-02-23 15:49:12 +0100766 0 \
767 -s "key exchange mode: ephemeral" \
768 -S "key exchange mode: psk" \
769 -s "found matched identity" \
770 -s "EarlyData: rejected, not a session resumption" \
771 -C "EncryptedExtensions: early_data(42) extension exists."