Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1 | #!/bin/sh |
| 2 | |
Simon Butcher | 58eddef | 2016-05-19 23:43:11 +0100 | [diff] [blame] | 3 | # ssl-opt.sh |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 4 | # |
Bence Szépkúti | 1e14827 | 2020-08-07 13:07:28 +0200 | [diff] [blame] | 5 | # Copyright The Mbed TLS Contributors |
Bence Szépkúti | c7da1fe | 2020-05-26 01:54:15 +0200 | [diff] [blame] | 6 | # SPDX-License-Identifier: Apache-2.0 |
| 7 | # |
| 8 | # Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 9 | # not use this file except in compliance with the License. |
| 10 | # You may obtain a copy of the License at |
| 11 | # |
| 12 | # http://www.apache.org/licenses/LICENSE-2.0 |
| 13 | # |
| 14 | # Unless required by applicable law or agreed to in writing, software |
| 15 | # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 16 | # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 17 | # See the License for the specific language governing permissions and |
| 18 | # limitations under the License. |
| 19 | # |
Simon Butcher | 58eddef | 2016-05-19 23:43:11 +0100 | [diff] [blame] | 20 | # Purpose |
| 21 | # |
| 22 | # Executes tests to prove various TLS/SSL options and extensions. |
| 23 | # |
| 24 | # The goal is not to cover every ciphersuite/version, but instead to cover |
| 25 | # specific options (max fragment length, truncated hmac, etc) or procedures |
| 26 | # (session resumption from cache or ticket, renego, etc). |
| 27 | # |
| 28 | # The tests assume a build with default options, with exceptions expressed |
| 29 | # with a dependency. The tests focus on functionality and do not consider |
| 30 | # performance. |
| 31 | # |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 32 | |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 33 | set -u |
| 34 | |
Jaeden Amero | 6e70eb2 | 2019-07-03 13:51:04 +0100 | [diff] [blame] | 35 | # Limit the size of each log to 10 GiB, in case of failures with this script |
| 36 | # where it may output seemingly unlimited length error logs. |
| 37 | ulimit -f 20971520 |
| 38 | |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 39 | ORIGINAL_PWD=$PWD |
| 40 | if ! cd "$(dirname "$0")"; then |
| 41 | exit 125 |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 42 | fi |
| 43 | |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 44 | # default values, can be overridden by the environment |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 45 | : ${P_SRV:=../programs/ssl/ssl_server2} |
| 46 | : ${P_CLI:=../programs/ssl/ssl_client2} |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 47 | : ${P_PXY:=../programs/test/udp_proxy} |
Jerry Yu | d04fd35 | 2021-12-06 16:52:57 +0800 | [diff] [blame] | 48 | : ${P_QUERY:=../programs/test/query_compile_time_config} |
Manuel Pégourié-Gonnard | c572246 | 2022-12-19 11:42:12 +0100 | [diff] [blame] | 49 | : ${OPENSSL:=openssl} |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 50 | : ${GNUTLS_CLI:=gnutls-cli} |
| 51 | : ${GNUTLS_SERV:=gnutls-serv} |
Gilles Peskine | d50177f | 2017-05-16 17:53:03 +0200 | [diff] [blame] | 52 | : ${PERL:=perl} |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 53 | |
Manuel Pégourié-Gonnard | c572246 | 2022-12-19 11:42:12 +0100 | [diff] [blame] | 54 | # The OPENSSL variable used to be OPENSSL_CMD for historical reasons. |
| 55 | # To help the migration, error out if the old variable is set, |
| 56 | # but only if it has a different value than the new one. |
| 57 | if [ "${OPENSSL_CMD+set}" = set ]; then |
| 58 | # the variable is set, we can now check its value |
| 59 | if [ "$OPENSSL_CMD" != "$OPENSSL" ]; then |
| 60 | echo "Please use OPENSSL instead of OPENSSL_CMD." >&2 |
| 61 | exit 125 |
| 62 | fi |
| 63 | fi |
| 64 | |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 65 | guess_config_name() { |
Bence Szépkúti | bb0cfeb | 2021-05-28 09:42:25 +0200 | [diff] [blame] | 66 | if git diff --quiet ../include/mbedtls/mbedtls_config.h 2>/dev/null; then |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 67 | echo "default" |
| 68 | else |
| 69 | echo "unknown" |
| 70 | fi |
| 71 | } |
| 72 | : ${MBEDTLS_TEST_OUTCOME_FILE=} |
| 73 | : ${MBEDTLS_TEST_CONFIGURATION:="$(guess_config_name)"} |
| 74 | : ${MBEDTLS_TEST_PLATFORM:="$(uname -s | tr -c \\n0-9A-Za-z _)-$(uname -m | tr -c \\n0-9A-Za-z _)"} |
| 75 | |
Manuel Pégourié-Gonnard | c572246 | 2022-12-19 11:42:12 +0100 | [diff] [blame] | 76 | O_SRV="$OPENSSL s_server -www -cert data_files/server5.crt -key data_files/server5.key" |
| 77 | O_CLI="echo 'GET / HTTP/1.0' | $OPENSSL s_client" |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 78 | G_SRV="$GNUTLS_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key" |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 79 | G_CLI="echo 'GET / HTTP/1.0' | $GNUTLS_CLI --x509cafile data_files/test-ca_cat12.crt" |
Gilles Peskine | d50177f | 2017-05-16 17:53:03 +0200 | [diff] [blame] | 80 | TCP_CLIENT="$PERL scripts/tcp_client.pl" |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 81 | |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 82 | # alternative versions of OpenSSL and GnuTLS (no default path) |
| 83 | |
| 84 | if [ -n "${OPENSSL_LEGACY:-}" ]; then |
| 85 | O_LEGACY_SRV="$OPENSSL_LEGACY s_server -www -cert data_files/server5.crt -key data_files/server5.key" |
| 86 | O_LEGACY_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_LEGACY s_client" |
| 87 | else |
| 88 | O_LEGACY_SRV=false |
| 89 | O_LEGACY_CLI=false |
| 90 | fi |
| 91 | |
Jerry Yu | 0402979 | 2021-08-10 16:45:37 +0800 | [diff] [blame] | 92 | if [ -n "${OPENSSL_NEXT:-}" ]; then |
XiaokangQian | 30f5560 | 2021-11-24 01:54:50 +0000 | [diff] [blame] | 93 | O_NEXT_SRV="$OPENSSL_NEXT s_server -www -cert data_files/server5.crt -key data_files/server5.key" |
Xiaokang Qian | b0c32d8 | 2022-11-02 10:51:13 +0000 | [diff] [blame] | 94 | O_NEXT_SRV_EARLY_DATA="$OPENSSL_NEXT s_server -early_data -cert data_files/server5.crt -key data_files/server5.key" |
Jerry Yu | 305bfc3 | 2021-11-24 16:04:47 +0800 | [diff] [blame] | 95 | O_NEXT_SRV_NO_CERT="$OPENSSL_NEXT s_server -www " |
Jerry Yu | 6622049 | 2022-04-23 13:53:36 +0800 | [diff] [blame] | 96 | O_NEXT_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_NEXT s_client -CAfile data_files/test-ca_cat12.crt" |
XiaokangQian | d5d5b60 | 2022-05-23 09:16:20 +0000 | [diff] [blame] | 97 | O_NEXT_CLI_NO_CERT="echo 'GET / HTTP/1.0' | $OPENSSL_NEXT s_client" |
Jerry Yu | 0402979 | 2021-08-10 16:45:37 +0800 | [diff] [blame] | 98 | else |
| 99 | O_NEXT_SRV=false |
Jerry Yu | 305bfc3 | 2021-11-24 16:04:47 +0800 | [diff] [blame] | 100 | O_NEXT_SRV_NO_CERT=false |
Xiaokang Qian | b0c32d8 | 2022-11-02 10:51:13 +0000 | [diff] [blame] | 101 | O_NEXT_SRV_EARLY_DATA=false |
XiaokangQian | b1847a2 | 2022-06-08 07:49:31 +0000 | [diff] [blame] | 102 | O_NEXT_CLI_NO_CERT=false |
Jerry Yu | 0402979 | 2021-08-10 16:45:37 +0800 | [diff] [blame] | 103 | O_NEXT_CLI=false |
| 104 | fi |
| 105 | |
Hanno Becker | 58e9dc3 | 2018-08-17 15:53:21 +0100 | [diff] [blame] | 106 | if [ -n "${GNUTLS_NEXT_SERV:-}" ]; then |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 107 | G_NEXT_SRV="$GNUTLS_NEXT_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key" |
Jerry Yu | 305bfc3 | 2021-11-24 16:04:47 +0800 | [diff] [blame] | 108 | G_NEXT_SRV_NO_CERT="$GNUTLS_NEXT_SERV" |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 109 | else |
| 110 | G_NEXT_SRV=false |
Jerry Yu | 305bfc3 | 2021-11-24 16:04:47 +0800 | [diff] [blame] | 111 | G_NEXT_SRV_NO_CERT=false |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 112 | fi |
| 113 | |
Hanno Becker | 58e9dc3 | 2018-08-17 15:53:21 +0100 | [diff] [blame] | 114 | if [ -n "${GNUTLS_NEXT_CLI:-}" ]; then |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 115 | G_NEXT_CLI="echo 'GET / HTTP/1.0' | $GNUTLS_NEXT_CLI --x509cafile data_files/test-ca_cat12.crt" |
XiaokangQian | d5d5b60 | 2022-05-23 09:16:20 +0000 | [diff] [blame] | 116 | G_NEXT_CLI_NO_CERT="echo 'GET / HTTP/1.0' | $GNUTLS_NEXT_CLI" |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 117 | else |
| 118 | G_NEXT_CLI=false |
XiaokangQian | fb1a3fe | 2022-06-09 06:37:33 +0000 | [diff] [blame] | 119 | G_NEXT_CLI_NO_CERT=false |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 120 | fi |
| 121 | |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 122 | TESTS=0 |
| 123 | FAILS=0 |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 124 | SKIPS=0 |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 125 | |
Bence Szépkúti | bb0cfeb | 2021-05-28 09:42:25 +0200 | [diff] [blame] | 126 | CONFIG_H='../include/mbedtls/mbedtls_config.h' |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 127 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 128 | MEMCHECK=0 |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 129 | FILTER='.*' |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 130 | EXCLUDE='^$' |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 131 | |
Paul Bakker | e20310a | 2016-05-10 11:18:17 +0100 | [diff] [blame] | 132 | SHOW_TEST_NUMBER=0 |
Paul Bakker | b7584a5 | 2016-05-10 10:50:43 +0100 | [diff] [blame] | 133 | RUN_TEST_NUMBER='' |
| 134 | |
Paul Bakker | acaac85 | 2016-05-10 11:47:13 +0100 | [diff] [blame] | 135 | PRESERVE_LOGS=0 |
| 136 | |
Gilles Peskine | f93c7d3 | 2017-04-14 17:55:28 +0200 | [diff] [blame] | 137 | # Pick a "unique" server port in the range 10000-19999, and a proxy |
| 138 | # port which is this plus 10000. Each port number may be independently |
| 139 | # overridden by a command line option. |
| 140 | SRV_PORT=$(($$ % 10000 + 10000)) |
| 141 | PXY_PORT=$((SRV_PORT + 10000)) |
| 142 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 143 | print_usage() { |
| 144 | echo "Usage: $0 [options]" |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 145 | printf " -h|--help\tPrint this help.\n" |
| 146 | printf " -m|--memcheck\tCheck memory leaks and errors.\n" |
Gilles Peskine | 9fa4ed6 | 2020-08-26 22:35:46 +0200 | [diff] [blame] | 147 | printf " -f|--filter\tOnly matching tests are executed (substring or BRE)\n" |
| 148 | printf " -e|--exclude\tMatching tests are excluded (substring or BRE)\n" |
Paul Bakker | b7584a5 | 2016-05-10 10:50:43 +0100 | [diff] [blame] | 149 | printf " -n|--number\tExecute only numbered test (comma-separated, e.g. '245,256')\n" |
Paul Bakker | e20310a | 2016-05-10 11:18:17 +0100 | [diff] [blame] | 150 | printf " -s|--show-numbers\tShow test numbers in front of test names\n" |
Paul Bakker | acaac85 | 2016-05-10 11:47:13 +0100 | [diff] [blame] | 151 | printf " -p|--preserve-logs\tPreserve logs of successful tests as well\n" |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 152 | printf " --outcome-file\tFile where test outcomes are written\n" |
| 153 | printf " \t(default: \$MBEDTLS_TEST_OUTCOME_FILE, none if empty)\n" |
| 154 | printf " --port \tTCP/UDP port (default: randomish 1xxxx)\n" |
Gilles Peskine | f93c7d3 | 2017-04-14 17:55:28 +0200 | [diff] [blame] | 155 | printf " --proxy-port\tTCP/UDP proxy port (default: randomish 2xxxx)\n" |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 156 | printf " --seed \tInteger seed value to use for this test run\n" |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 157 | } |
| 158 | |
| 159 | get_options() { |
| 160 | while [ $# -gt 0 ]; do |
| 161 | case "$1" in |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 162 | -f|--filter) |
| 163 | shift; FILTER=$1 |
| 164 | ;; |
| 165 | -e|--exclude) |
| 166 | shift; EXCLUDE=$1 |
| 167 | ;; |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 168 | -m|--memcheck) |
| 169 | MEMCHECK=1 |
| 170 | ;; |
Paul Bakker | b7584a5 | 2016-05-10 10:50:43 +0100 | [diff] [blame] | 171 | -n|--number) |
| 172 | shift; RUN_TEST_NUMBER=$1 |
| 173 | ;; |
Paul Bakker | e20310a | 2016-05-10 11:18:17 +0100 | [diff] [blame] | 174 | -s|--show-numbers) |
| 175 | SHOW_TEST_NUMBER=1 |
| 176 | ;; |
Paul Bakker | acaac85 | 2016-05-10 11:47:13 +0100 | [diff] [blame] | 177 | -p|--preserve-logs) |
| 178 | PRESERVE_LOGS=1 |
| 179 | ;; |
Yanray Wang | 5b33f64 | 2023-02-28 11:56:59 +0800 | [diff] [blame] | 180 | --outcome-file) |
| 181 | shift; MBEDTLS_TEST_OUTCOME_FILE=$1 |
| 182 | ;; |
Gilles Peskine | f93c7d3 | 2017-04-14 17:55:28 +0200 | [diff] [blame] | 183 | --port) |
| 184 | shift; SRV_PORT=$1 |
| 185 | ;; |
| 186 | --proxy-port) |
| 187 | shift; PXY_PORT=$1 |
| 188 | ;; |
Andres AG | f04f54d | 2016-10-10 15:46:20 +0100 | [diff] [blame] | 189 | --seed) |
| 190 | shift; SEED="$1" |
| 191 | ;; |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 192 | -h|--help) |
| 193 | print_usage |
| 194 | exit 0 |
| 195 | ;; |
| 196 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 197 | echo "Unknown argument: '$1'" |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 198 | print_usage |
| 199 | exit 1 |
| 200 | ;; |
| 201 | esac |
| 202 | shift |
| 203 | done |
| 204 | } |
| 205 | |
Bence Szépkúti | bb0cfeb | 2021-05-28 09:42:25 +0200 | [diff] [blame] | 206 | # Read boolean configuration options from mbedtls_config.h for easy and quick |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 207 | # testing. Skip non-boolean options (with something other than spaces |
| 208 | # and a comment after "#define SYMBOL"). The variable contains a |
| 209 | # space-separated list of symbols. |
Jerry Yu | d0fcf7f | 2021-12-10 18:45:51 +0800 | [diff] [blame] | 210 | CONFIGS_ENABLED=" $(echo `$P_QUERY -l` )" |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 211 | # Skip next test; use this macro to skip tests which are legitimate |
| 212 | # in theory and expected to be re-introduced at some point, but |
| 213 | # aren't expected to succeed at the moment due to problems outside |
| 214 | # our control (such as bugs in other TLS implementations). |
| 215 | skip_next_test() { |
| 216 | SKIP_NEXT="YES" |
| 217 | } |
| 218 | |
Valerio Setti | d1f991c | 2023-02-22 12:54:13 +0100 | [diff] [blame] | 219 | # Check if the required configuration ($1) is enabled |
| 220 | is_config_enabled() |
| 221 | { |
| 222 | case $CONFIGS_ENABLED in |
| 223 | *" $1"[\ =]*) return 0;; |
| 224 | *) return 1;; |
| 225 | esac |
| 226 | } |
| 227 | |
Bence Szépkúti | bb0cfeb | 2021-05-28 09:42:25 +0200 | [diff] [blame] | 228 | # skip next test if the flag is not enabled in mbedtls_config.h |
Manuel Pégourié-Gonnard | 988209f | 2015-03-24 10:43:55 +0100 | [diff] [blame] | 229 | requires_config_enabled() { |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 230 | case $CONFIGS_ENABLED in |
Jerry Yu | 2e8b001 | 2021-12-10 20:29:02 +0800 | [diff] [blame] | 231 | *" $1"[\ =]*) :;; |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 232 | *) SKIP_NEXT="YES";; |
| 233 | esac |
Manuel Pégourié-Gonnard | 988209f | 2015-03-24 10:43:55 +0100 | [diff] [blame] | 234 | } |
| 235 | |
Bence Szépkúti | bb0cfeb | 2021-05-28 09:42:25 +0200 | [diff] [blame] | 236 | # skip next test if the flag is enabled in mbedtls_config.h |
Manuel Pégourié-Gonnard | af63c21 | 2017-06-08 17:51:08 +0200 | [diff] [blame] | 237 | requires_config_disabled() { |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 238 | case $CONFIGS_ENABLED in |
Jerry Yu | 2e8b001 | 2021-12-10 20:29:02 +0800 | [diff] [blame] | 239 | *" $1"[\ =]*) SKIP_NEXT="YES";; |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 240 | esac |
Manuel Pégourié-Gonnard | af63c21 | 2017-06-08 17:51:08 +0200 | [diff] [blame] | 241 | } |
| 242 | |
Jerry Yu | 2fcb056 | 2022-07-27 17:30:49 +0800 | [diff] [blame] | 243 | requires_all_configs_enabled() { |
| 244 | if ! $P_QUERY -all $* |
| 245 | then |
| 246 | SKIP_NEXT="YES" |
| 247 | fi |
| 248 | } |
| 249 | |
| 250 | requires_all_configs_disabled() { |
| 251 | if $P_QUERY -any $* |
| 252 | then |
| 253 | SKIP_NEXT="YES" |
| 254 | fi |
| 255 | } |
| 256 | |
| 257 | requires_any_configs_enabled() { |
| 258 | if ! $P_QUERY -any $* |
| 259 | then |
| 260 | SKIP_NEXT="YES" |
| 261 | fi |
| 262 | } |
| 263 | |
| 264 | requires_any_configs_disabled() { |
| 265 | if $P_QUERY -all $* |
| 266 | then |
| 267 | SKIP_NEXT="YES" |
| 268 | fi |
| 269 | } |
| 270 | |
Ronald Cron | 454eb91 | 2022-10-21 08:56:04 +0200 | [diff] [blame] | 271 | TLS1_2_KEY_EXCHANGES_WITH_CERT="MBEDTLS_KEY_EXCHANGE_RSA_ENABLED \ |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 272 | MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \ |
| 273 | MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \ |
| 274 | MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \ |
| 275 | MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED \ |
| 276 | MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \ |
| 277 | MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED" |
| 278 | |
Valerio Setti | d1f991c | 2023-02-22 12:54:13 +0100 | [diff] [blame] | 279 | TLS1_2_KEY_EXCHANGES_WITH_ECDSA_CERT="MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \ |
| 280 | MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED" |
| 281 | |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 282 | TLS1_2_KEY_EXCHANGES_WITH_CERT_WO_ECDH="MBEDTLS_KEY_EXCHANGE_RSA_ENABLED \ |
| 283 | MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \ |
| 284 | MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \ |
| 285 | MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \ |
| 286 | MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED" |
| 287 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 288 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled() { |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 289 | if $P_QUERY -all MBEDTLS_SSL_PROTO_TLS1_2 |
| 290 | then |
Valerio Setti | e7f896d | 2023-03-13 13:55:28 +0100 | [diff] [blame] | 291 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 292 | elif ! $P_QUERY -all MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 293 | then |
| 294 | SKIP_NEXT="YES" |
| 295 | fi |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 296 | } |
| 297 | |
Hanno Becker | 7c48dd1 | 2018-08-28 16:09:22 +0100 | [diff] [blame] | 298 | get_config_value_or_default() { |
Andres Amaya Garcia | 3169dc0 | 2018-10-16 21:29:07 +0100 | [diff] [blame] | 299 | # This function uses the query_config command line option to query the |
| 300 | # required Mbed TLS compile time configuration from the ssl_server2 |
| 301 | # program. The command will always return a success value if the |
| 302 | # configuration is defined and the value will be printed to stdout. |
| 303 | # |
| 304 | # Note that if the configuration is not defined or is defined to nothing, |
| 305 | # the output of this function will be an empty string. |
| 306 | ${P_SRV} "query_config=${1}" |
Hanno Becker | 7c48dd1 | 2018-08-28 16:09:22 +0100 | [diff] [blame] | 307 | } |
| 308 | |
| 309 | requires_config_value_at_least() { |
Andres Amaya Garcia | 3169dc0 | 2018-10-16 21:29:07 +0100 | [diff] [blame] | 310 | VAL="$( get_config_value_or_default "$1" )" |
| 311 | if [ -z "$VAL" ]; then |
| 312 | # Should never happen |
| 313 | echo "Mbed TLS configuration $1 is not defined" |
| 314 | exit 1 |
| 315 | elif [ "$VAL" -lt "$2" ]; then |
Hanno Becker | 5cd017f | 2018-08-24 14:40:12 +0100 | [diff] [blame] | 316 | SKIP_NEXT="YES" |
| 317 | fi |
| 318 | } |
| 319 | |
| 320 | requires_config_value_at_most() { |
Hanno Becker | 7c48dd1 | 2018-08-28 16:09:22 +0100 | [diff] [blame] | 321 | VAL=$( get_config_value_or_default "$1" ) |
Andres Amaya Garcia | 3169dc0 | 2018-10-16 21:29:07 +0100 | [diff] [blame] | 322 | if [ -z "$VAL" ]; then |
| 323 | # Should never happen |
| 324 | echo "Mbed TLS configuration $1 is not defined" |
| 325 | exit 1 |
| 326 | elif [ "$VAL" -gt "$2" ]; then |
Hanno Becker | 5cd017f | 2018-08-24 14:40:12 +0100 | [diff] [blame] | 327 | SKIP_NEXT="YES" |
| 328 | fi |
| 329 | } |
| 330 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 331 | requires_config_value_equals() { |
| 332 | VAL=$( get_config_value_or_default "$1" ) |
| 333 | if [ -z "$VAL" ]; then |
| 334 | # Should never happen |
| 335 | echo "Mbed TLS configuration $1 is not defined" |
| 336 | exit 1 |
| 337 | elif [ "$VAL" -ne "$2" ]; then |
| 338 | SKIP_NEXT="YES" |
| 339 | fi |
| 340 | } |
| 341 | |
Gilles Peskine | c912673 | 2022-04-08 19:33:07 +0200 | [diff] [blame] | 342 | # Require Mbed TLS to support the given protocol version. |
| 343 | # |
| 344 | # Inputs: |
| 345 | # * $1: protocol version in mbedtls syntax (argument to force_version=) |
| 346 | requires_protocol_version() { |
| 347 | # Support for DTLS is detected separately in detect_dtls(). |
| 348 | case "$1" in |
| 349 | tls12|dtls12) requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2;; |
| 350 | tls13|dtls13) requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3;; |
| 351 | *) echo "Unknown required protocol version: $1"; exit 1;; |
| 352 | esac |
| 353 | } |
| 354 | |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 355 | # Space-separated list of ciphersuites supported by this build of |
| 356 | # Mbed TLS. |
| 357 | P_CIPHERSUITES=" $($P_CLI --help 2>/dev/null | |
XiaokangQian | 4b82ca1 | 2021-11-18 08:27:17 +0000 | [diff] [blame] | 358 | grep 'TLS-\|TLS1-3' | |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 359 | tr -s ' \n' ' ')" |
Hanno Becker | 9d76d56 | 2018-11-16 17:27:29 +0000 | [diff] [blame] | 360 | requires_ciphersuite_enabled() { |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 361 | case $P_CIPHERSUITES in |
| 362 | *" $1 "*) :;; |
| 363 | *) SKIP_NEXT="YES";; |
| 364 | esac |
Hanno Becker | 9d76d56 | 2018-11-16 17:27:29 +0000 | [diff] [blame] | 365 | } |
| 366 | |
Valerio Setti | 1af76d1 | 2023-02-23 15:55:10 +0100 | [diff] [blame] | 367 | # Automatically detect required features based on command line parameters. |
| 368 | # Parameters are: |
| 369 | # - $1 = command line (call to a TLS client or server program) |
| 370 | # - $2 = client/server |
| 371 | # - $3 = TLS version (TLS12 or TLS13) |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 372 | # - $4 = Use an external tool without ECDH support |
| 373 | # - $5 = run test options |
Gilles Peskine | b898b3d | 2022-04-08 19:26:26 +0200 | [diff] [blame] | 374 | detect_required_features() { |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 375 | CMD_LINE=$1 |
| 376 | ROLE=$2 |
| 377 | TLS_VERSION=$3 |
| 378 | EXT_WO_ECDH=$4 |
| 379 | TEST_OPTIONS=${5:-} |
| 380 | |
| 381 | case "$CMD_LINE" in |
Gilles Peskine | c912673 | 2022-04-08 19:33:07 +0200 | [diff] [blame] | 382 | *\ force_version=*) |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 383 | tmp="${CMD_LINE##*\ force_version=}" |
Gilles Peskine | c912673 | 2022-04-08 19:33:07 +0200 | [diff] [blame] | 384 | tmp="${tmp%%[!-0-9A-Z_a-z]*}" |
| 385 | requires_protocol_version "$tmp";; |
Gilles Peskine | 0d72165 | 2020-06-26 23:35:53 +0200 | [diff] [blame] | 386 | esac |
Gilles Peskine | 0d72165 | 2020-06-26 23:35:53 +0200 | [diff] [blame] | 387 | |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 388 | case "$CMD_LINE" in |
Gilles Peskine | b898b3d | 2022-04-08 19:26:26 +0200 | [diff] [blame] | 389 | *\ force_ciphersuite=*) |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 390 | tmp="${CMD_LINE##*\ force_ciphersuite=}" |
Gilles Peskine | b898b3d | 2022-04-08 19:26:26 +0200 | [diff] [blame] | 391 | tmp="${tmp%%[!-0-9A-Z_a-z]*}" |
| 392 | requires_ciphersuite_enabled "$tmp";; |
Gilles Peskine | 0d72165 | 2020-06-26 23:35:53 +0200 | [diff] [blame] | 393 | esac |
Gilles Peskine | 0d72165 | 2020-06-26 23:35:53 +0200 | [diff] [blame] | 394 | |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 395 | case " $CMD_LINE " in |
Gilles Peskine | 740b734 | 2022-04-08 19:29:27 +0200 | [diff] [blame] | 396 | *[-_\ =]tickets=[^0]*) |
| 397 | requires_config_enabled MBEDTLS_SSL_TICKET_C;; |
| 398 | esac |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 399 | case " $CMD_LINE " in |
Gilles Peskine | 740b734 | 2022-04-08 19:29:27 +0200 | [diff] [blame] | 400 | *[-_\ =]alpn=*) |
| 401 | requires_config_enabled MBEDTLS_SSL_ALPN;; |
| 402 | esac |
| 403 | |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 404 | case "$CMD_LINE" in |
Valerio Setti | ccfad9a | 2023-03-08 10:25:05 +0100 | [diff] [blame] | 405 | *server5*|\ |
Valerio Setti | 80318d2 | 2023-03-13 12:26:42 +0100 | [diff] [blame] | 406 | *server7*|\ |
| 407 | *dir-maxpath*) |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 408 | if [ "$TLS_VERSION" = "TLS13" ]; then |
Valerio Setti | 1af76d1 | 2023-02-23 15:55:10 +0100 | [diff] [blame] | 409 | # In case of TLS13 the support for ECDSA is enough |
| 410 | requires_pk_alg "ECDSA" |
| 411 | else |
| 412 | # For TLS12 requirements are different between server and client |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 413 | if [ "$ROLE" = "server" ]; then |
Valerio Setti | 194e2bd | 2023-03-02 17:18:10 +0100 | [diff] [blame] | 414 | # If the server uses "server5*" certificates, then an ECDSA based |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 415 | # key exchange is required. However gnutls also does not |
| 416 | # support ECDH, so this limit the choice to ECDHE-ECDSA |
| 417 | if [ "$EXT_WO_ECDH" = "yes" ]; then |
| 418 | requires_any_configs_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
| 419 | else |
| 420 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_ECDSA_CERT |
| 421 | fi |
| 422 | elif [ "$ROLE" = "client" ]; then |
| 423 | # On the client side it is enough to have any certificate |
| 424 | # based authentication together with support for ECDSA. |
| 425 | # Of course the GnuTLS limitation mentioned above applies |
| 426 | # also here. |
| 427 | if [ "$EXT_WO_ECDH" = "yes" ]; then |
| 428 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT_WO_ECDH |
| 429 | else |
| 430 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
| 431 | fi |
Valerio Setti | 1af76d1 | 2023-02-23 15:55:10 +0100 | [diff] [blame] | 432 | requires_pk_alg "ECDSA" |
| 433 | fi |
| 434 | fi |
| 435 | ;; |
| 436 | esac |
| 437 | |
Gilles Peskine | b898b3d | 2022-04-08 19:26:26 +0200 | [diff] [blame] | 438 | unset tmp |
Gilles Peskine | 0d72165 | 2020-06-26 23:35:53 +0200 | [diff] [blame] | 439 | } |
| 440 | |
Gilles Peskine | 6f160ca | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 441 | requires_certificate_authentication () { |
| 442 | if [ "$PSK_ONLY" = "YES" ]; then |
| 443 | SKIP_NEXT="YES" |
| 444 | fi |
| 445 | } |
| 446 | |
Gilles Peskine | 6e86e54 | 2022-02-25 19:52:52 +0100 | [diff] [blame] | 447 | adapt_cmd_for_psk () { |
| 448 | case "$2" in |
| 449 | *openssl*) s='-psk abc123 -nocert';; |
| 450 | *gnutls-*) s='--pskkey=abc123';; |
| 451 | *) s='psk=abc123';; |
| 452 | esac |
| 453 | eval $1='"$2 $s"' |
| 454 | unset s |
| 455 | } |
| 456 | |
| 457 | # maybe_adapt_for_psk [RUN_TEST_OPTION...] |
| 458 | # If running in a PSK-only build, maybe adapt the test to use a pre-shared key. |
| 459 | # |
| 460 | # If not running in a PSK-only build, do nothing. |
| 461 | # If the test looks like it doesn't use a pre-shared key but can run with a |
| 462 | # pre-shared key, pass a pre-shared key. If the test looks like it can't run |
| 463 | # with a pre-shared key, skip it. If the test looks like it's already using |
| 464 | # a pre-shared key, do nothing. |
| 465 | # |
Gilles Peskine | 59601d7 | 2022-04-05 22:00:17 +0200 | [diff] [blame] | 466 | # This code does not consider builds with ECDHE-PSK or RSA-PSK. |
Gilles Peskine | 6e86e54 | 2022-02-25 19:52:52 +0100 | [diff] [blame] | 467 | # |
| 468 | # Inputs: |
| 469 | # * $CLI_CMD, $SRV_CMD, $PXY_CMD: client/server/proxy commands. |
| 470 | # * $PSK_ONLY: YES if running in a PSK-only build (no asymmetric key exchanges). |
| 471 | # * "$@": options passed to run_test. |
| 472 | # |
| 473 | # Outputs: |
| 474 | # * $CLI_CMD, $SRV_CMD: may be modified to add PSK-relevant arguments. |
| 475 | # * $SKIP_NEXT: set to YES if the test can't run with PSK. |
| 476 | maybe_adapt_for_psk() { |
| 477 | if [ "$PSK_ONLY" != "YES" ]; then |
| 478 | return |
| 479 | fi |
| 480 | if [ "$SKIP_NEXT" = "YES" ]; then |
| 481 | return |
| 482 | fi |
| 483 | case "$CLI_CMD $SRV_CMD" in |
| 484 | *[-_\ =]psk*|*[-_\ =]PSK*) |
| 485 | return;; |
| 486 | *force_ciphersuite*) |
| 487 | # The test case forces a non-PSK cipher suite. In some cases, a |
| 488 | # PSK cipher suite could be substituted, but we're not ready for |
| 489 | # that yet. |
| 490 | SKIP_NEXT="YES" |
| 491 | return;; |
| 492 | *\ auth_mode=*|*[-_\ =]crt[_=]*) |
| 493 | # The test case involves certificates. PSK won't do. |
| 494 | SKIP_NEXT="YES" |
| 495 | return;; |
| 496 | esac |
| 497 | adapt_cmd_for_psk CLI_CMD "$CLI_CMD" |
| 498 | adapt_cmd_for_psk SRV_CMD "$SRV_CMD" |
| 499 | } |
| 500 | |
| 501 | case " $CONFIGS_ENABLED " in |
| 502 | *\ MBEDTLS_KEY_EXCHANGE_[^P]*) PSK_ONLY="NO";; |
| 503 | *\ MBEDTLS_KEY_EXCHANGE_P[^S]*) PSK_ONLY="NO";; |
| 504 | *\ MBEDTLS_KEY_EXCHANGE_PS[^K]*) PSK_ONLY="NO";; |
| 505 | *\ MBEDTLS_KEY_EXCHANGE_PSK[^_]*) PSK_ONLY="NO";; |
| 506 | *\ MBEDTLS_KEY_EXCHANGE_PSK_ENABLED\ *) PSK_ONLY="YES";; |
| 507 | *) PSK_ONLY="NO";; |
| 508 | esac |
| 509 | |
Andrzej Kurek | 9c061a2 | 2022-09-05 10:51:19 -0400 | [diff] [blame] | 510 | HAS_ALG_SHA_1="NO" |
| 511 | HAS_ALG_SHA_224="NO" |
| 512 | HAS_ALG_SHA_256="NO" |
| 513 | HAS_ALG_SHA_384="NO" |
| 514 | HAS_ALG_SHA_512="NO" |
| 515 | |
| 516 | check_for_hash_alg() |
| 517 | { |
| 518 | CURR_ALG="INVALID"; |
| 519 | USE_PSA="NO" |
Valerio Setti | d1f991c | 2023-02-22 12:54:13 +0100 | [diff] [blame] | 520 | if is_config_enabled "MBEDTLS_USE_PSA_CRYPTO"; then |
| 521 | USE_PSA="YES"; |
| 522 | fi |
Andrzej Kurek | 9c061a2 | 2022-09-05 10:51:19 -0400 | [diff] [blame] | 523 | if [ $USE_PSA = "YES" ]; then |
| 524 | CURR_ALG=PSA_WANT_ALG_${1} |
| 525 | else |
| 526 | CURR_ALG=MBEDTLS_${1}_C |
| 527 | # Remove the second underscore to match MBEDTLS_* naming convention |
| 528 | CURR_ALG=$(echo "$CURR_ALG" | sed 's/_//2') |
| 529 | fi |
| 530 | |
| 531 | case $CONFIGS_ENABLED in |
| 532 | *" $CURR_ALG"[\ =]*) |
| 533 | return 0 |
| 534 | ;; |
| 535 | *) :;; |
| 536 | esac |
| 537 | return 1 |
| 538 | } |
| 539 | |
| 540 | populate_enabled_hash_algs() |
| 541 | { |
| 542 | for hash_alg in SHA_1 SHA_224 SHA_256 SHA_384 SHA_512; do |
| 543 | if check_for_hash_alg "$hash_alg"; then |
| 544 | hash_alg_variable=HAS_ALG_${hash_alg} |
| 545 | eval ${hash_alg_variable}=YES |
| 546 | fi |
Valerio Setti | e7f896d | 2023-03-13 13:55:28 +0100 | [diff] [blame] | 547 | done |
Andrzej Kurek | 9c061a2 | 2022-09-05 10:51:19 -0400 | [diff] [blame] | 548 | } |
| 549 | |
| 550 | # skip next test if the given hash alg is not supported |
| 551 | requires_hash_alg() { |
| 552 | HASH_DEFINE="Invalid" |
| 553 | HAS_HASH_ALG="NO" |
| 554 | case $1 in |
| 555 | SHA_1):;; |
| 556 | SHA_224):;; |
| 557 | SHA_256):;; |
| 558 | SHA_384):;; |
| 559 | SHA_512):;; |
| 560 | *) |
| 561 | echo "Unsupported hash alg - $1" |
| 562 | exit 1 |
| 563 | ;; |
| 564 | esac |
| 565 | |
| 566 | HASH_DEFINE=HAS_ALG_${1} |
| 567 | eval "HAS_HASH_ALG=\${${HASH_DEFINE}}" |
| 568 | if [ "$HAS_HASH_ALG" = "NO" ] |
| 569 | then |
| 570 | SKIP_NEXT="YES" |
| 571 | fi |
| 572 | } |
| 573 | |
Valerio Setti | d1f991c | 2023-02-22 12:54:13 +0100 | [diff] [blame] | 574 | # Skip next test if the given pk alg is not enabled |
| 575 | requires_pk_alg() { |
| 576 | case $1 in |
| 577 | ECDSA) |
| 578 | if is_config_enabled MBEDTLS_USE_PSA_CRYPTO; then |
| 579 | requires_config_enabled PSA_WANT_ALG_ECDSA |
| 580 | else |
| 581 | requires_config_enabled MBEDTLS_ECDSA_C |
| 582 | fi |
| 583 | ;; |
| 584 | *) |
| 585 | echo "Unknown/unimplemented case $1 in requires_pk_alg" |
| 586 | exit 1 |
| 587 | ;; |
| 588 | esac |
| 589 | } |
| 590 | |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 591 | # skip next test if OpenSSL doesn't support FALLBACK_SCSV |
| 592 | requires_openssl_with_fallback_scsv() { |
| 593 | if [ -z "${OPENSSL_HAS_FBSCSV:-}" ]; then |
Manuel Pégourié-Gonnard | c572246 | 2022-12-19 11:42:12 +0100 | [diff] [blame] | 594 | if $OPENSSL s_client -help 2>&1 | grep fallback_scsv >/dev/null |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 595 | then |
| 596 | OPENSSL_HAS_FBSCSV="YES" |
| 597 | else |
| 598 | OPENSSL_HAS_FBSCSV="NO" |
| 599 | fi |
| 600 | fi |
| 601 | if [ "$OPENSSL_HAS_FBSCSV" = "NO" ]; then |
| 602 | SKIP_NEXT="YES" |
| 603 | fi |
| 604 | } |
| 605 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 606 | # skip next test if either IN_CONTENT_LEN or MAX_CONTENT_LEN are below a value |
| 607 | requires_max_content_len() { |
| 608 | requires_config_value_at_least "MBEDTLS_SSL_IN_CONTENT_LEN" $1 |
| 609 | requires_config_value_at_least "MBEDTLS_SSL_OUT_CONTENT_LEN" $1 |
| 610 | } |
| 611 | |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 612 | # skip next test if GnuTLS isn't available |
| 613 | requires_gnutls() { |
| 614 | if [ -z "${GNUTLS_AVAILABLE:-}" ]; then |
Manuel Pégourié-Gonnard | 03db6b0 | 2015-06-26 15:45:30 +0200 | [diff] [blame] | 615 | if ( which "$GNUTLS_CLI" && which "$GNUTLS_SERV" ) >/dev/null 2>&1; then |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 616 | GNUTLS_AVAILABLE="YES" |
| 617 | else |
| 618 | GNUTLS_AVAILABLE="NO" |
| 619 | fi |
| 620 | fi |
| 621 | if [ "$GNUTLS_AVAILABLE" = "NO" ]; then |
| 622 | SKIP_NEXT="YES" |
| 623 | fi |
| 624 | } |
| 625 | |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 626 | # skip next test if GnuTLS-next isn't available |
| 627 | requires_gnutls_next() { |
| 628 | if [ -z "${GNUTLS_NEXT_AVAILABLE:-}" ]; then |
| 629 | if ( which "${GNUTLS_NEXT_CLI:-}" && which "${GNUTLS_NEXT_SERV:-}" ) >/dev/null 2>&1; then |
| 630 | GNUTLS_NEXT_AVAILABLE="YES" |
| 631 | else |
| 632 | GNUTLS_NEXT_AVAILABLE="NO" |
| 633 | fi |
| 634 | fi |
| 635 | if [ "$GNUTLS_NEXT_AVAILABLE" = "NO" ]; then |
| 636 | SKIP_NEXT="YES" |
| 637 | fi |
| 638 | } |
| 639 | |
| 640 | # skip next test if OpenSSL-legacy isn't available |
| 641 | requires_openssl_legacy() { |
| 642 | if [ -z "${OPENSSL_LEGACY_AVAILABLE:-}" ]; then |
| 643 | if which "${OPENSSL_LEGACY:-}" >/dev/null 2>&1; then |
| 644 | OPENSSL_LEGACY_AVAILABLE="YES" |
| 645 | else |
| 646 | OPENSSL_LEGACY_AVAILABLE="NO" |
| 647 | fi |
| 648 | fi |
| 649 | if [ "$OPENSSL_LEGACY_AVAILABLE" = "NO" ]; then |
| 650 | SKIP_NEXT="YES" |
| 651 | fi |
| 652 | } |
| 653 | |
Jerry Yu | 0402979 | 2021-08-10 16:45:37 +0800 | [diff] [blame] | 654 | requires_openssl_next() { |
| 655 | if [ -z "${OPENSSL_NEXT_AVAILABLE:-}" ]; then |
| 656 | if which "${OPENSSL_NEXT:-}" >/dev/null 2>&1; then |
| 657 | OPENSSL_NEXT_AVAILABLE="YES" |
| 658 | else |
| 659 | OPENSSL_NEXT_AVAILABLE="NO" |
| 660 | fi |
| 661 | fi |
| 662 | if [ "$OPENSSL_NEXT_AVAILABLE" = "NO" ]; then |
| 663 | SKIP_NEXT="YES" |
| 664 | fi |
| 665 | } |
| 666 | |
Przemek Stekiel | 422ab1f | 2023-06-14 11:04:28 +0200 | [diff] [blame] | 667 | # skip next test if openssl version is lower than 3.0 |
| 668 | requires_openssl_3_x() { |
| 669 | requires_openssl_next |
| 670 | if [ "$OPENSSL_NEXT_AVAILABLE" = "NO" ]; then |
| 671 | OPENSSL_3_X_AVAILABLE="NO" |
| 672 | fi |
| 673 | if [ -z "${OPENSSL_3_X_AVAILABLE:-}" ]; then |
Przemek Stekiel | a53dca1 | 2023-06-14 20:53:09 +0200 | [diff] [blame] | 674 | if $OPENSSL_NEXT version 2>&1 | grep "OpenSSL 3." >/dev/null |
Przemek Stekiel | 422ab1f | 2023-06-14 11:04:28 +0200 | [diff] [blame] | 675 | then |
| 676 | OPENSSL_3_X_AVAILABLE="YES" |
| 677 | else |
| 678 | OPENSSL_3_X_AVAILABLE="NO" |
| 679 | fi |
| 680 | fi |
| 681 | if [ "$OPENSSL_3_X_AVAILABLE" = "NO" ]; then |
| 682 | SKIP_NEXT="YES" |
| 683 | fi |
| 684 | } |
| 685 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 686 | # skip next test if openssl does not support ffdh keys |
| 687 | requires_openssl_tls1_3_with_ffdh() { |
| 688 | requires_openssl_3_x |
| 689 | } |
| 690 | |
Przemek Stekiel | 7dda271 | 2023-06-27 14:43:33 +0200 | [diff] [blame] | 691 | # skip next test if openssl cannot handle ephemeral key exchange |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 692 | requires_openssl_tls1_3_with_compatible_ephemeral() { |
| 693 | requires_openssl_next |
| 694 | |
| 695 | if !(is_config_enabled "PSA_WANT_ALG_ECDH"); then |
| 696 | requires_openssl_tls1_3_with_ffdh |
| 697 | fi |
| 698 | } |
| 699 | |
Jerry Yu | 0402979 | 2021-08-10 16:45:37 +0800 | [diff] [blame] | 700 | # skip next test if tls1_3 is not available |
Przemek Stekiel | 1f5c2ba | 2023-06-15 17:04:44 +0200 | [diff] [blame] | 701 | requires_openssl_tls1_3() { |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 702 | requires_openssl_next |
Przemek Stekiel | 1f5c2ba | 2023-06-15 17:04:44 +0200 | [diff] [blame] | 703 | if [ "$OPENSSL_NEXT_AVAILABLE" = "NO" ]; then |
| 704 | OPENSSL_TLS1_3_AVAILABLE="NO" |
| 705 | fi |
| 706 | if [ -z "${OPENSSL_TLS1_3_AVAILABLE:-}" ]; then |
| 707 | if $OPENSSL_NEXT s_client -help 2>&1 | grep tls1_3 >/dev/null |
| 708 | then |
| 709 | OPENSSL_TLS1_3_AVAILABLE="YES" |
| 710 | else |
| 711 | OPENSSL_TLS1_3_AVAILABLE="NO" |
| 712 | fi |
| 713 | fi |
Przemek Stekiel | 1f5c2ba | 2023-06-15 17:04:44 +0200 | [diff] [blame] | 714 | if [ "$OPENSSL_TLS1_3_AVAILABLE" = "NO" ]; then |
| 715 | SKIP_NEXT="YES" |
Przemek Stekiel | 1f5c2ba | 2023-06-15 17:04:44 +0200 | [diff] [blame] | 716 | fi |
| 717 | } |
| 718 | |
| 719 | # skip next test if tls1_3 is not available |
Jerry Yu | 0402979 | 2021-08-10 16:45:37 +0800 | [diff] [blame] | 720 | requires_gnutls_tls1_3() { |
| 721 | requires_gnutls_next |
| 722 | if [ "$GNUTLS_NEXT_AVAILABLE" = "NO" ]; then |
| 723 | GNUTLS_TLS1_3_AVAILABLE="NO" |
| 724 | fi |
| 725 | if [ -z "${GNUTLS_TLS1_3_AVAILABLE:-}" ]; then |
| 726 | if $GNUTLS_NEXT_CLI -l 2>&1 | grep VERS-TLS1.3 >/dev/null |
| 727 | then |
| 728 | GNUTLS_TLS1_3_AVAILABLE="YES" |
| 729 | else |
| 730 | GNUTLS_TLS1_3_AVAILABLE="NO" |
| 731 | fi |
| 732 | fi |
| 733 | if [ "$GNUTLS_TLS1_3_AVAILABLE" = "NO" ]; then |
| 734 | SKIP_NEXT="YES" |
| 735 | fi |
| 736 | } |
| 737 | |
Jerry Yu | 75261df | 2021-09-02 17:40:08 +0800 | [diff] [blame] | 738 | # Check %NO_TICKETS option |
Jerry Yu | b12d81d | 2021-08-17 10:56:08 +0800 | [diff] [blame] | 739 | requires_gnutls_next_no_ticket() { |
| 740 | requires_gnutls_next |
| 741 | if [ "$GNUTLS_NEXT_AVAILABLE" = "NO" ]; then |
| 742 | GNUTLS_NO_TICKETS_AVAILABLE="NO" |
| 743 | fi |
| 744 | if [ -z "${GNUTLS_NO_TICKETS_AVAILABLE:-}" ]; then |
| 745 | if $GNUTLS_NEXT_CLI --priority-list 2>&1 | grep NO_TICKETS >/dev/null |
| 746 | then |
| 747 | GNUTLS_NO_TICKETS_AVAILABLE="YES" |
| 748 | else |
| 749 | GNUTLS_NO_TICKETS_AVAILABLE="NO" |
| 750 | fi |
| 751 | fi |
| 752 | if [ "$GNUTLS_NO_TICKETS_AVAILABLE" = "NO" ]; then |
| 753 | SKIP_NEXT="YES" |
| 754 | fi |
| 755 | } |
| 756 | |
Jerry Yu | 75261df | 2021-09-02 17:40:08 +0800 | [diff] [blame] | 757 | # Check %DISABLE_TLS13_COMPAT_MODE option |
Jerry Yu | b12d81d | 2021-08-17 10:56:08 +0800 | [diff] [blame] | 758 | requires_gnutls_next_disable_tls13_compat() { |
| 759 | requires_gnutls_next |
| 760 | if [ "$GNUTLS_NEXT_AVAILABLE" = "NO" ]; then |
| 761 | GNUTLS_DISABLE_TLS13_COMPAT_MODE_AVAILABLE="NO" |
| 762 | fi |
| 763 | if [ -z "${GNUTLS_DISABLE_TLS13_COMPAT_MODE_AVAILABLE:-}" ]; then |
| 764 | if $GNUTLS_NEXT_CLI --priority-list 2>&1 | grep DISABLE_TLS13_COMPAT_MODE >/dev/null |
| 765 | then |
| 766 | GNUTLS_DISABLE_TLS13_COMPAT_MODE_AVAILABLE="YES" |
| 767 | else |
| 768 | GNUTLS_DISABLE_TLS13_COMPAT_MODE_AVAILABLE="NO" |
| 769 | fi |
| 770 | fi |
| 771 | if [ "$GNUTLS_DISABLE_TLS13_COMPAT_MODE_AVAILABLE" = "NO" ]; then |
| 772 | SKIP_NEXT="YES" |
| 773 | fi |
| 774 | } |
| 775 | |
Jan Bruckner | aa31b19 | 2023-02-06 12:54:29 +0100 | [diff] [blame] | 776 | # skip next test if GnuTLS does not support the record size limit extension |
| 777 | requires_gnutls_record_size_limit() { |
| 778 | requires_gnutls_next |
| 779 | if [ "$GNUTLS_NEXT_AVAILABLE" = "NO" ]; then |
| 780 | GNUTLS_RECORD_SIZE_LIMIT_AVAILABLE="NO" |
| 781 | else |
| 782 | GNUTLS_RECORD_SIZE_LIMIT_AVAILABLE="YES" |
| 783 | fi |
| 784 | if [ "$GNUTLS_RECORD_SIZE_LIMIT_AVAILABLE" = "NO" ]; then |
| 785 | SKIP_NEXT="YES" |
| 786 | fi |
| 787 | } |
| 788 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 789 | # skip next test if IPv6 isn't available on this host |
| 790 | requires_ipv6() { |
| 791 | if [ -z "${HAS_IPV6:-}" ]; then |
| 792 | $P_SRV server_addr='::1' > $SRV_OUT 2>&1 & |
| 793 | SRV_PID=$! |
| 794 | sleep 1 |
| 795 | kill $SRV_PID >/dev/null 2>&1 |
| 796 | if grep "NET - Binding of the socket failed" $SRV_OUT >/dev/null; then |
| 797 | HAS_IPV6="NO" |
| 798 | else |
| 799 | HAS_IPV6="YES" |
| 800 | fi |
| 801 | rm -r $SRV_OUT |
| 802 | fi |
| 803 | |
| 804 | if [ "$HAS_IPV6" = "NO" ]; then |
| 805 | SKIP_NEXT="YES" |
| 806 | fi |
| 807 | } |
| 808 | |
Andrzej Kurek | b459346 | 2018-10-11 08:43:30 -0400 | [diff] [blame] | 809 | # skip next test if it's i686 or uname is not available |
| 810 | requires_not_i686() { |
| 811 | if [ -z "${IS_I686:-}" ]; then |
| 812 | IS_I686="YES" |
| 813 | if which "uname" >/dev/null 2>&1; then |
| 814 | if [ -z "$(uname -a | grep i686)" ]; then |
| 815 | IS_I686="NO" |
| 816 | fi |
| 817 | fi |
| 818 | fi |
| 819 | if [ "$IS_I686" = "YES" ]; then |
| 820 | SKIP_NEXT="YES" |
| 821 | fi |
| 822 | } |
| 823 | |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 824 | # Calculate the input & output maximum content lengths set in the config |
David Horstmann | 95d516f | 2021-05-04 18:36:56 +0100 | [diff] [blame] | 825 | MAX_CONTENT_LEN=16384 |
Yuto Takano | 2be6f1a | 2021-06-22 07:16:40 +0100 | [diff] [blame] | 826 | MAX_IN_LEN=$( get_config_value_or_default "MBEDTLS_SSL_IN_CONTENT_LEN" ) |
| 827 | MAX_OUT_LEN=$( get_config_value_or_default "MBEDTLS_SSL_OUT_CONTENT_LEN" ) |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 828 | |
Yuto Takano | 0509fea | 2021-06-21 19:43:33 +0100 | [diff] [blame] | 829 | # Calculate the maximum content length that fits both |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 830 | if [ "$MAX_IN_LEN" -lt "$MAX_CONTENT_LEN" ]; then |
| 831 | MAX_CONTENT_LEN="$MAX_IN_LEN" |
| 832 | fi |
| 833 | if [ "$MAX_OUT_LEN" -lt "$MAX_CONTENT_LEN" ]; then |
| 834 | MAX_CONTENT_LEN="$MAX_OUT_LEN" |
| 835 | fi |
| 836 | |
| 837 | # skip the next test if the SSL output buffer is less than 16KB |
| 838 | requires_full_size_output_buffer() { |
| 839 | if [ "$MAX_OUT_LEN" -ne 16384 ]; then |
| 840 | SKIP_NEXT="YES" |
| 841 | fi |
| 842 | } |
| 843 | |
Manuel Pégourié-Gonnard | 76fe9e4 | 2014-09-24 15:17:31 +0200 | [diff] [blame] | 844 | # skip the next test if valgrind is in use |
| 845 | not_with_valgrind() { |
| 846 | if [ "$MEMCHECK" -gt 0 ]; then |
| 847 | SKIP_NEXT="YES" |
| 848 | fi |
| 849 | } |
| 850 | |
Paul Bakker | 362689d | 2016-05-13 10:33:25 +0100 | [diff] [blame] | 851 | # skip the next test if valgrind is NOT in use |
| 852 | only_with_valgrind() { |
| 853 | if [ "$MEMCHECK" -eq 0 ]; then |
| 854 | SKIP_NEXT="YES" |
| 855 | fi |
| 856 | } |
| 857 | |
Manuel Pégourié-Gonnard | a071972 | 2014-09-20 12:46:27 +0200 | [diff] [blame] | 858 | # multiply the client timeout delay by the given factor for the next test |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 859 | client_needs_more_time() { |
Manuel Pégourié-Gonnard | a071972 | 2014-09-20 12:46:27 +0200 | [diff] [blame] | 860 | CLI_DELAY_FACTOR=$1 |
| 861 | } |
| 862 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 863 | # wait for the given seconds after the client finished in the next test |
| 864 | server_needs_more_time() { |
| 865 | SRV_DELAY_SECONDS=$1 |
| 866 | } |
| 867 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 868 | # print_name <name> |
| 869 | print_name() { |
Paul Bakker | e20310a | 2016-05-10 11:18:17 +0100 | [diff] [blame] | 870 | TESTS=$(( $TESTS + 1 )) |
| 871 | LINE="" |
| 872 | |
| 873 | if [ "$SHOW_TEST_NUMBER" -gt 0 ]; then |
| 874 | LINE="$TESTS " |
| 875 | fi |
| 876 | |
| 877 | LINE="$LINE$1" |
Gilles Peskine | 231befa | 2020-08-26 20:05:11 +0200 | [diff] [blame] | 878 | printf "%s " "$LINE" |
Paul Bakker | e20310a | 2016-05-10 11:18:17 +0100 | [diff] [blame] | 879 | LEN=$(( 72 - `echo "$LINE" | wc -c` )) |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 880 | for i in `seq 1 $LEN`; do printf '.'; done |
| 881 | printf ' ' |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 882 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 883 | } |
| 884 | |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 885 | # record_outcome <outcome> [<failure-reason>] |
| 886 | # The test name must be in $NAME. |
Gilles Peskine | 5eb2b02 | 2022-01-07 15:47:02 +0100 | [diff] [blame] | 887 | # Use $TEST_SUITE_NAME as the test suite name if set. |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 888 | record_outcome() { |
| 889 | echo "$1" |
| 890 | if [ -n "$MBEDTLS_TEST_OUTCOME_FILE" ]; then |
| 891 | printf '%s;%s;%s;%s;%s;%s\n' \ |
| 892 | "$MBEDTLS_TEST_PLATFORM" "$MBEDTLS_TEST_CONFIGURATION" \ |
Gilles Peskine | 5eb2b02 | 2022-01-07 15:47:02 +0100 | [diff] [blame] | 893 | "${TEST_SUITE_NAME:-ssl-opt}" "$NAME" \ |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 894 | "$1" "${2-}" \ |
| 895 | >>"$MBEDTLS_TEST_OUTCOME_FILE" |
| 896 | fi |
| 897 | } |
Gilles Peskine | 5eb2b02 | 2022-01-07 15:47:02 +0100 | [diff] [blame] | 898 | unset TEST_SUITE_NAME |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 899 | |
Gilles Peskine | 788ad33 | 2021-10-20 14:17:02 +0200 | [diff] [blame] | 900 | # True if the presence of the given pattern in a log definitely indicates |
| 901 | # that the test has failed. False if the presence is inconclusive. |
| 902 | # |
| 903 | # Inputs: |
| 904 | # * $1: pattern found in the logs |
| 905 | # * $TIMES_LEFT: >0 if retrying is an option |
| 906 | # |
| 907 | # Outputs: |
| 908 | # * $outcome: set to a retry reason if the pattern is inconclusive, |
| 909 | # unchanged otherwise. |
| 910 | # * Return value: 1 if the pattern is inconclusive, |
| 911 | # 0 if the failure is definitive. |
| 912 | log_pattern_presence_is_conclusive() { |
| 913 | # If we've run out of attempts, then don't retry no matter what. |
| 914 | if [ $TIMES_LEFT -eq 0 ]; then |
| 915 | return 0 |
| 916 | fi |
| 917 | case $1 in |
| 918 | "resend") |
| 919 | # An undesired resend may have been caused by the OS dropping or |
| 920 | # delaying a packet at an inopportune time. |
| 921 | outcome="RETRY(resend)" |
| 922 | return 1;; |
| 923 | esac |
| 924 | } |
| 925 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 926 | # fail <message> |
| 927 | fail() { |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 928 | record_outcome "FAIL" "$1" |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 929 | echo " ! $1" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 930 | |
Manuel Pégourié-Gonnard | c2b0092 | 2014-08-31 16:46:04 +0200 | [diff] [blame] | 931 | mv $SRV_OUT o-srv-${TESTS}.log |
| 932 | mv $CLI_OUT o-cli-${TESTS}.log |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 933 | if [ -n "$PXY_CMD" ]; then |
| 934 | mv $PXY_OUT o-pxy-${TESTS}.log |
| 935 | fi |
| 936 | echo " ! outputs saved to o-XXX-${TESTS}.log" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 937 | |
Manuel Pégourié-Gonnard | 3f3302f | 2020-06-08 11:49:05 +0200 | [diff] [blame] | 938 | if [ "${LOG_FAILURE_ON_STDOUT:-0}" != 0 ]; then |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 939 | echo " ! server output:" |
| 940 | cat o-srv-${TESTS}.log |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 941 | echo " ! ========================================================" |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 942 | echo " ! client output:" |
| 943 | cat o-cli-${TESTS}.log |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 944 | if [ -n "$PXY_CMD" ]; then |
| 945 | echo " ! ========================================================" |
| 946 | echo " ! proxy output:" |
| 947 | cat o-pxy-${TESTS}.log |
| 948 | fi |
| 949 | echo "" |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 950 | fi |
| 951 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 952 | FAILS=$(( $FAILS + 1 )) |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 953 | } |
| 954 | |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 955 | # is_polar <cmd_line> |
| 956 | is_polar() { |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 957 | case "$1" in |
| 958 | *ssl_client2*) true;; |
| 959 | *ssl_server2*) true;; |
| 960 | *) false;; |
| 961 | esac |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 962 | } |
| 963 | |
Manuel Pégourié-Gonnard | fa60f12 | 2014-09-26 16:07:29 +0200 | [diff] [blame] | 964 | # openssl s_server doesn't have -www with DTLS |
| 965 | check_osrv_dtls() { |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 966 | case "$SRV_CMD" in |
| 967 | *s_server*-dtls*) |
| 968 | NEEDS_INPUT=1 |
| 969 | SRV_CMD="$( echo $SRV_CMD | sed s/-www// )";; |
| 970 | *) NEEDS_INPUT=0;; |
| 971 | esac |
Manuel Pégourié-Gonnard | fa60f12 | 2014-09-26 16:07:29 +0200 | [diff] [blame] | 972 | } |
| 973 | |
| 974 | # provide input to commands that need it |
| 975 | provide_input() { |
| 976 | if [ $NEEDS_INPUT -eq 0 ]; then |
| 977 | return |
| 978 | fi |
| 979 | |
| 980 | while true; do |
| 981 | echo "HTTP/1.0 200 OK" |
| 982 | sleep 1 |
| 983 | done |
| 984 | } |
| 985 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 986 | # has_mem_err <log_file_name> |
| 987 | has_mem_err() { |
| 988 | if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" && |
| 989 | grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null |
| 990 | then |
| 991 | return 1 # false: does not have errors |
| 992 | else |
| 993 | return 0 # true: has errors |
| 994 | fi |
| 995 | } |
| 996 | |
Unknown | d364f4c | 2019-09-02 10:42:57 -0400 | [diff] [blame] | 997 | # Wait for process $2 named $3 to be listening on port $1. Print error to $4. |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 998 | if type lsof >/dev/null 2>/dev/null; then |
Unknown | d364f4c | 2019-09-02 10:42:57 -0400 | [diff] [blame] | 999 | wait_app_start() { |
Paul Elliott | e05e126 | 2021-10-20 15:59:33 +0100 | [diff] [blame] | 1000 | newline=' |
| 1001 | ' |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 1002 | START_TIME=$(date +%s) |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1003 | if [ "$DTLS" -eq 1 ]; then |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 1004 | proto=UDP |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1005 | else |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 1006 | proto=TCP |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1007 | fi |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 1008 | # Make a tight loop, server normally takes less than 1s to start. |
Paul Elliott | 58ed8a7 | 2021-10-19 17:56:39 +0100 | [diff] [blame] | 1009 | while true; do |
Gilles Peskine | 5bd0b51 | 2022-04-15 22:53:18 +0200 | [diff] [blame] | 1010 | SERVER_PIDS=$(lsof -a -n -b -i "$proto:$1" -t) |
Paul Elliott | e05e126 | 2021-10-20 15:59:33 +0100 | [diff] [blame] | 1011 | # When we use a proxy, it will be listening on the same port we |
| 1012 | # are checking for as well as the server and lsof will list both. |
Paul Elliott | e05e126 | 2021-10-20 15:59:33 +0100 | [diff] [blame] | 1013 | case ${newline}${SERVER_PIDS}${newline} in |
Gilles Peskine | 5bd0b51 | 2022-04-15 22:53:18 +0200 | [diff] [blame] | 1014 | *${newline}${2}${newline}*) break;; |
Paul Elliott | e05e126 | 2021-10-20 15:59:33 +0100 | [diff] [blame] | 1015 | esac |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 1016 | if [ $(( $(date +%s) - $START_TIME )) -gt $DOG_DELAY ]; then |
Unknown | d364f4c | 2019-09-02 10:42:57 -0400 | [diff] [blame] | 1017 | echo "$3 START TIMEOUT" |
| 1018 | echo "$3 START TIMEOUT" >> $4 |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 1019 | break |
| 1020 | fi |
| 1021 | # Linux and *BSD support decimal arguments to sleep. On other |
| 1022 | # OSes this may be a tight loop. |
| 1023 | sleep 0.1 2>/dev/null || true |
| 1024 | done |
| 1025 | } |
| 1026 | else |
Unknown | d364f4c | 2019-09-02 10:42:57 -0400 | [diff] [blame] | 1027 | echo "Warning: lsof not available, wait_app_start = sleep" |
| 1028 | wait_app_start() { |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 1029 | sleep "$START_DELAY" |
Gilles Peskine | 418b536 | 2017-12-14 18:58:42 +0100 | [diff] [blame] | 1030 | } |
| 1031 | fi |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 1032 | |
Unknown | d364f4c | 2019-09-02 10:42:57 -0400 | [diff] [blame] | 1033 | # Wait for server process $2 to be listening on port $1. |
| 1034 | wait_server_start() { |
| 1035 | wait_app_start $1 $2 "SERVER" $SRV_OUT |
| 1036 | } |
| 1037 | |
| 1038 | # Wait for proxy process $2 to be listening on port $1. |
| 1039 | wait_proxy_start() { |
| 1040 | wait_app_start $1 $2 "PROXY" $PXY_OUT |
| 1041 | } |
| 1042 | |
Andres Amaya Garcia | b84c40b | 2017-09-06 15:44:01 +0100 | [diff] [blame] | 1043 | # Given the client or server debug output, parse the unix timestamp that is |
Andres Amaya Garcia | 3b1bdff | 2017-09-14 12:41:29 +0100 | [diff] [blame] | 1044 | # included in the first 4 bytes of the random bytes and check that it's within |
Andres Amaya Garcia | b84c40b | 2017-09-06 15:44:01 +0100 | [diff] [blame] | 1045 | # acceptable bounds |
| 1046 | check_server_hello_time() { |
| 1047 | # Extract the time from the debug (lvl 3) output of the client |
Andres Amaya Garcia | 67d8da5 | 2017-09-15 15:49:24 +0100 | [diff] [blame] | 1048 | SERVER_HELLO_TIME="$(sed -n 's/.*server hello, current time: //p' < "$1")" |
Andres Amaya Garcia | b84c40b | 2017-09-06 15:44:01 +0100 | [diff] [blame] | 1049 | # Get the Unix timestamp for now |
| 1050 | CUR_TIME=$(date +'%s') |
| 1051 | THRESHOLD_IN_SECS=300 |
| 1052 | |
| 1053 | # Check if the ServerHello time was printed |
| 1054 | if [ -z "$SERVER_HELLO_TIME" ]; then |
| 1055 | return 1 |
| 1056 | fi |
| 1057 | |
| 1058 | # Check the time in ServerHello is within acceptable bounds |
| 1059 | if [ $SERVER_HELLO_TIME -lt $(( $CUR_TIME - $THRESHOLD_IN_SECS )) ]; then |
| 1060 | # The time in ServerHello is at least 5 minutes before now |
| 1061 | return 1 |
| 1062 | elif [ $SERVER_HELLO_TIME -gt $(( $CUR_TIME + $THRESHOLD_IN_SECS )) ]; then |
Andres Amaya Garcia | 3b1bdff | 2017-09-14 12:41:29 +0100 | [diff] [blame] | 1063 | # The time in ServerHello is at least 5 minutes later than now |
Andres Amaya Garcia | b84c40b | 2017-09-06 15:44:01 +0100 | [diff] [blame] | 1064 | return 1 |
| 1065 | else |
| 1066 | return 0 |
| 1067 | fi |
| 1068 | } |
| 1069 | |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 1070 | # Get handshake memory usage from server or client output and put it into the variable specified by the first argument |
| 1071 | handshake_memory_get() { |
| 1072 | OUTPUT_VARIABLE="$1" |
| 1073 | OUTPUT_FILE="$2" |
| 1074 | |
| 1075 | # Get memory usage from a pattern like "Heap memory usage after handshake: 23112 bytes. Peak memory usage was 33112" |
| 1076 | MEM_USAGE=$(sed -n 's/.*Heap memory usage after handshake: //p' < "$OUTPUT_FILE" | grep -o "[0-9]*" | head -1) |
| 1077 | |
| 1078 | # Check if memory usage was read |
| 1079 | if [ -z "$MEM_USAGE" ]; then |
| 1080 | echo "Error: Can not read the value of handshake memory usage" |
| 1081 | return 1 |
| 1082 | else |
| 1083 | eval "$OUTPUT_VARIABLE=$MEM_USAGE" |
| 1084 | return 0 |
| 1085 | fi |
| 1086 | } |
| 1087 | |
| 1088 | # Get handshake memory usage from server or client output and check if this value |
| 1089 | # is not higher than the maximum given by the first argument |
| 1090 | handshake_memory_check() { |
| 1091 | MAX_MEMORY="$1" |
| 1092 | OUTPUT_FILE="$2" |
| 1093 | |
| 1094 | # Get memory usage |
| 1095 | if ! handshake_memory_get "MEMORY_USAGE" "$OUTPUT_FILE"; then |
| 1096 | return 1 |
| 1097 | fi |
| 1098 | |
| 1099 | # Check if memory usage is below max value |
| 1100 | if [ "$MEMORY_USAGE" -gt "$MAX_MEMORY" ]; then |
| 1101 | echo "\nFailed: Handshake memory usage was $MEMORY_USAGE bytes," \ |
| 1102 | "but should be below $MAX_MEMORY bytes" |
| 1103 | return 1 |
| 1104 | else |
| 1105 | return 0 |
| 1106 | fi |
| 1107 | } |
| 1108 | |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1109 | # wait for client to terminate and set CLI_EXIT |
| 1110 | # must be called right after starting the client |
| 1111 | wait_client_done() { |
| 1112 | CLI_PID=$! |
| 1113 | |
Manuel Pégourié-Gonnard | a071972 | 2014-09-20 12:46:27 +0200 | [diff] [blame] | 1114 | CLI_DELAY=$(( $DOG_DELAY * $CLI_DELAY_FACTOR )) |
| 1115 | CLI_DELAY_FACTOR=1 |
| 1116 | |
Manuel Pégourié-Gonnard | a365add | 2015-08-04 20:57:59 +0200 | [diff] [blame] | 1117 | ( sleep $CLI_DELAY; echo "===CLIENT_TIMEOUT===" >> $CLI_OUT; kill $CLI_PID ) & |
Manuel Pégourié-Gonnard | a6189f0 | 2014-09-20 13:15:43 +0200 | [diff] [blame] | 1118 | DOG_PID=$! |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1119 | |
Jerry Yu | d2d4110 | 2022-07-26 17:34:42 +0800 | [diff] [blame] | 1120 | # For Ubuntu 22.04, `Terminated` message is outputed by wait command. |
| 1121 | # To remove it from stdout, redirect stdout/stderr to CLI_OUT |
| 1122 | wait $CLI_PID >> $CLI_OUT 2>&1 |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1123 | CLI_EXIT=$? |
| 1124 | |
Manuel Pégourié-Gonnard | a6189f0 | 2014-09-20 13:15:43 +0200 | [diff] [blame] | 1125 | kill $DOG_PID >/dev/null 2>&1 |
Jerry Yu | fe52e55 | 2022-07-09 04:23:43 +0000 | [diff] [blame] | 1126 | wait $DOG_PID >> $CLI_OUT 2>&1 |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1127 | |
| 1128 | echo "EXIT: $CLI_EXIT" >> $CLI_OUT |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 1129 | |
| 1130 | sleep $SRV_DELAY_SECONDS |
| 1131 | SRV_DELAY_SECONDS=0 |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 1132 | } |
| 1133 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1134 | # check if the given command uses dtls and sets global variable DTLS |
| 1135 | detect_dtls() { |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 1136 | case "$1" in |
Paul Elliott | 1428f25 | 2021-10-12 16:02:55 +0100 | [diff] [blame] | 1137 | *dtls=1*|*-dtls*|*-u*) DTLS=1;; |
Gilles Peskine | 6445749 | 2020-08-26 21:53:33 +0200 | [diff] [blame] | 1138 | *) DTLS=0;; |
| 1139 | esac |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1140 | } |
| 1141 | |
Dave Rodgman | 0279c2f | 2021-02-10 12:45:41 +0000 | [diff] [blame] | 1142 | # check if the given command uses gnutls and sets global variable CMD_IS_GNUTLS |
| 1143 | is_gnutls() { |
| 1144 | case "$1" in |
| 1145 | *gnutls-cli*) |
| 1146 | CMD_IS_GNUTLS=1 |
| 1147 | ;; |
| 1148 | *gnutls-serv*) |
| 1149 | CMD_IS_GNUTLS=1 |
| 1150 | ;; |
| 1151 | *) |
| 1152 | CMD_IS_GNUTLS=0 |
| 1153 | ;; |
| 1154 | esac |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1155 | } |
| 1156 | |
Valerio Setti | 2f8eb62 | 2023-03-16 13:04:44 +0100 | [diff] [blame] | 1157 | # Some external tools (gnutls or openssl) might not have support for static ECDH |
| 1158 | # and this limit the tests that can be run with them. This function checks server |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 1159 | # and client command lines, given as input, to verify if the current test |
| 1160 | # is using one of these tools. |
| 1161 | use_ext_tool_without_ecdh_support() { |
| 1162 | case "$1" in |
| 1163 | *$GNUTLS_SERV*|\ |
| 1164 | *${GNUTLS_NEXT_SERV:-"gnutls-serv-dummy"}*|\ |
| 1165 | *${OPENSSL_NEXT:-"openssl-dummy"}*) |
| 1166 | echo "yes" |
| 1167 | return;; |
| 1168 | esac |
| 1169 | case "$2" in |
| 1170 | *$GNUTLS_CLI*|\ |
| 1171 | *${GNUTLS_NEXT_CLI:-"gnutls-cli-dummy"}*|\ |
| 1172 | *${OPENSSL_NEXT:-"openssl-dummy"}*) |
| 1173 | echo "yes" |
| 1174 | return;; |
| 1175 | esac |
| 1176 | echo "no" |
| 1177 | } |
| 1178 | |
Jerry Yu | f467d46 | 2022-11-07 13:12:44 +0800 | [diff] [blame] | 1179 | # Generate random psk_list argument for ssl_server2 |
| 1180 | get_srv_psk_list () |
| 1181 | { |
| 1182 | case $(( TESTS % 3 )) in |
| 1183 | 0) echo "psk_list=abc,dead,def,beef,Client_identity,6162636465666768696a6b6c6d6e6f70";; |
| 1184 | 1) echo "psk_list=abc,dead,Client_identity,6162636465666768696a6b6c6d6e6f70,def,beef";; |
| 1185 | 2) echo "psk_list=Client_identity,6162636465666768696a6b6c6d6e6f70,abc,dead,def,beef";; |
| 1186 | esac |
| 1187 | } |
| 1188 | |
Gilles Peskine | 309ca65 | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1189 | # Determine what calc_verify trace is to be expected, if any. |
| 1190 | # |
| 1191 | # calc_verify is only called for two things: to calculate the |
| 1192 | # extended master secret, and to process client authentication. |
| 1193 | # |
| 1194 | # Warning: the current implementation assumes that extended_ms is not |
| 1195 | # disabled on the client or on the server. |
| 1196 | # |
| 1197 | # Inputs: |
Gilles Peskine | c8d242f | 2022-04-06 22:23:45 +0200 | [diff] [blame] | 1198 | # * $1: the value of the server auth_mode parameter. |
| 1199 | # 'required' if client authentication is expected, |
| 1200 | # 'none' or absent if not. |
Gilles Peskine | 309ca65 | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1201 | # * $CONFIGS_ENABLED |
| 1202 | # |
| 1203 | # Outputs: |
| 1204 | # * $maybe_calc_verify: set to a trace expected in the debug logs |
| 1205 | set_maybe_calc_verify() { |
| 1206 | maybe_calc_verify= |
| 1207 | case $CONFIGS_ENABLED in |
| 1208 | *\ MBEDTLS_SSL_EXTENDED_MASTER_SECRET\ *) :;; |
| 1209 | *) |
| 1210 | case ${1-} in |
Gilles Peskine | c8d242f | 2022-04-06 22:23:45 +0200 | [diff] [blame] | 1211 | ''|none) return;; |
| 1212 | required) :;; |
Gilles Peskine | 309ca65 | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1213 | *) echo "Bad parameter 1 to set_maybe_calc_verify: $1"; exit 1;; |
| 1214 | esac |
| 1215 | esac |
| 1216 | case $CONFIGS_ENABLED in |
| 1217 | *\ MBEDTLS_USE_PSA_CRYPTO\ *) maybe_calc_verify="PSA calc verify";; |
| 1218 | *) maybe_calc_verify="<= calc verify";; |
| 1219 | esac |
| 1220 | } |
| 1221 | |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 1222 | # Compare file content |
| 1223 | # Usage: find_in_both pattern file1 file2 |
| 1224 | # extract from file1 the first line matching the pattern |
| 1225 | # check in file2 that the same line can be found |
| 1226 | find_in_both() { |
| 1227 | srv_pattern=$(grep -m 1 "$1" "$2"); |
| 1228 | if [ -z "$srv_pattern" ]; then |
| 1229 | return 1; |
| 1230 | fi |
| 1231 | |
| 1232 | if grep "$srv_pattern" $3 >/dev/null; then : |
Johan Pascal | 1040315 | 2020-10-09 20:43:51 +0200 | [diff] [blame] | 1233 | return 0; |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 1234 | else |
| 1235 | return 1; |
| 1236 | fi |
| 1237 | } |
| 1238 | |
Jerry Yu | c46e9b4 | 2021-08-06 11:22:24 +0800 | [diff] [blame] | 1239 | SKIP_HANDSHAKE_CHECK="NO" |
| 1240 | skip_handshake_stage_check() { |
| 1241 | SKIP_HANDSHAKE_CHECK="YES" |
| 1242 | } |
| 1243 | |
Gilles Peskine | 236bf98 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1244 | # Analyze the commands that will be used in a test. |
| 1245 | # |
| 1246 | # Analyze and possibly instrument $PXY_CMD, $CLI_CMD, $SRV_CMD to pass |
| 1247 | # extra arguments or go through wrappers. |
Gilles Peskine | 59601d7 | 2022-04-05 22:00:17 +0200 | [diff] [blame] | 1248 | # |
| 1249 | # Inputs: |
| 1250 | # * $@: supplemental options to run_test() (after the mandatory arguments). |
| 1251 | # * $CLI_CMD, $PXY_CMD, $SRV_CMD: the client, proxy and server commands. |
| 1252 | # * $DTLS: 1 if DTLS, otherwise 0. |
| 1253 | # |
| 1254 | # Outputs: |
| 1255 | # * $CLI_CMD, $PXY_CMD, $SRV_CMD: may be tweaked. |
Gilles Peskine | 236bf98 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1256 | analyze_test_commands() { |
Manuel Pégourié-Gonnard | f455786 | 2020-06-08 11:40:06 +0200 | [diff] [blame] | 1257 | # if the test uses DTLS but no custom proxy, add a simple proxy |
| 1258 | # as it provides timing info that's useful to debug failures |
Manuel Pégourié-Gonnard | 70fce98 | 2020-06-25 09:54:46 +0200 | [diff] [blame] | 1259 | if [ -z "$PXY_CMD" ] && [ "$DTLS" -eq 1 ]; then |
Manuel Pégourié-Gonnard | f455786 | 2020-06-08 11:40:06 +0200 | [diff] [blame] | 1260 | PXY_CMD="$P_PXY" |
Manuel Pégourié-Gonnard | 8779e9a | 2020-07-16 10:19:32 +0200 | [diff] [blame] | 1261 | case " $SRV_CMD " in |
| 1262 | *' server_addr=::1 '*) |
| 1263 | PXY_CMD="$PXY_CMD server_addr=::1 listen_addr=::1";; |
| 1264 | esac |
Manuel Pégourié-Gonnard | f455786 | 2020-06-08 11:40:06 +0200 | [diff] [blame] | 1265 | fi |
| 1266 | |
Dave Rodgman | 0279c2f | 2021-02-10 12:45:41 +0000 | [diff] [blame] | 1267 | # update CMD_IS_GNUTLS variable |
| 1268 | is_gnutls "$SRV_CMD" |
| 1269 | |
| 1270 | # if the server uses gnutls but doesn't set priority, explicitly |
| 1271 | # set the default priority |
| 1272 | if [ "$CMD_IS_GNUTLS" -eq 1 ]; then |
| 1273 | case "$SRV_CMD" in |
| 1274 | *--priority*) :;; |
| 1275 | *) SRV_CMD="$SRV_CMD --priority=NORMAL";; |
| 1276 | esac |
| 1277 | fi |
| 1278 | |
| 1279 | # update CMD_IS_GNUTLS variable |
| 1280 | is_gnutls "$CLI_CMD" |
| 1281 | |
| 1282 | # if the client uses gnutls but doesn't set priority, explicitly |
| 1283 | # set the default priority |
| 1284 | if [ "$CMD_IS_GNUTLS" -eq 1 ]; then |
| 1285 | case "$CLI_CMD" in |
| 1286 | *--priority*) :;; |
| 1287 | *) CLI_CMD="$CLI_CMD --priority=NORMAL";; |
| 1288 | esac |
| 1289 | fi |
| 1290 | |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 1291 | # fix client port |
| 1292 | if [ -n "$PXY_CMD" ]; then |
| 1293 | CLI_CMD=$( echo "$CLI_CMD" | sed s/+SRV_PORT/$PXY_PORT/g ) |
| 1294 | else |
| 1295 | CLI_CMD=$( echo "$CLI_CMD" | sed s/+SRV_PORT/$SRV_PORT/g ) |
| 1296 | fi |
| 1297 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1298 | # prepend valgrind to our commands if active |
| 1299 | if [ "$MEMCHECK" -gt 0 ]; then |
| 1300 | if is_polar "$SRV_CMD"; then |
| 1301 | SRV_CMD="valgrind --leak-check=full $SRV_CMD" |
| 1302 | fi |
| 1303 | if is_polar "$CLI_CMD"; then |
| 1304 | CLI_CMD="valgrind --leak-check=full $CLI_CMD" |
| 1305 | fi |
| 1306 | fi |
Gilles Peskine | 236bf98 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1307 | } |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1308 | |
Gilles Peskine | 236bf98 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1309 | # Check for failure conditions after a test case. |
| 1310 | # |
| 1311 | # Inputs from run_test: |
| 1312 | # * positional parameters: test options (see run_test documentation) |
| 1313 | # * $CLI_EXIT: client return code |
| 1314 | # * $CLI_EXPECT: expected client return code |
| 1315 | # * $SRV_RET: server return code |
| 1316 | # * $CLI_OUT, $SRV_OUT, $PXY_OUT: files containing client/server/proxy logs |
Gilles Peskine | 0e3534c | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1317 | # * $TIMES_LEFT: if nonzero, a RETRY outcome is allowed |
Gilles Peskine | 236bf98 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1318 | # |
| 1319 | # Outputs: |
Gilles Peskine | f11d30e | 2021-10-19 18:00:10 +0200 | [diff] [blame] | 1320 | # * $outcome: one of PASS/RETRY*/FAIL |
Gilles Peskine | 236bf98 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1321 | check_test_failure() { |
Gilles Peskine | 0e3534c | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1322 | outcome=FAIL |
Manuel Pégourié-Gonnard | a365add | 2015-08-04 20:57:59 +0200 | [diff] [blame] | 1323 | |
Gilles Peskine | 0e3534c | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1324 | if [ $TIMES_LEFT -gt 0 ] && |
| 1325 | grep '===CLIENT_TIMEOUT===' $CLI_OUT >/dev/null |
| 1326 | then |
Gilles Peskine | f11d30e | 2021-10-19 18:00:10 +0200 | [diff] [blame] | 1327 | outcome="RETRY(client-timeout)" |
Gilles Peskine | 0e3534c | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1328 | return |
| 1329 | fi |
Manuel Pégourié-Gonnard | a365add | 2015-08-04 20:57:59 +0200 | [diff] [blame] | 1330 | |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 1331 | # check if the client and server went at least to the handshake stage |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 1332 | # (useful to avoid tests with only negative assertions and non-zero |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 1333 | # expected client exit to incorrectly succeed in case of catastrophic |
| 1334 | # failure) |
Jerry Yu | c46e9b4 | 2021-08-06 11:22:24 +0800 | [diff] [blame] | 1335 | if [ "X$SKIP_HANDSHAKE_CHECK" != "XYES" ] |
| 1336 | then |
| 1337 | if is_polar "$SRV_CMD"; then |
| 1338 | if grep "Performing the SSL/TLS handshake" $SRV_OUT >/dev/null; then :; |
| 1339 | else |
| 1340 | fail "server or client failed to reach handshake stage" |
| 1341 | return |
| 1342 | fi |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 1343 | fi |
Jerry Yu | c46e9b4 | 2021-08-06 11:22:24 +0800 | [diff] [blame] | 1344 | if is_polar "$CLI_CMD"; then |
| 1345 | if grep "Performing the SSL/TLS handshake" $CLI_OUT >/dev/null; then :; |
| 1346 | else |
| 1347 | fail "server or client failed to reach handshake stage" |
| 1348 | return |
| 1349 | fi |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 1350 | fi |
| 1351 | fi |
| 1352 | |
Jerry Yu | c46e9b4 | 2021-08-06 11:22:24 +0800 | [diff] [blame] | 1353 | SKIP_HANDSHAKE_CHECK="NO" |
Gilles Peskine | aaf866e | 2021-02-09 21:01:33 +0100 | [diff] [blame] | 1354 | # Check server exit code (only for Mbed TLS: GnuTLS and OpenSSL don't |
| 1355 | # exit with status 0 when interrupted by a signal, and we don't really |
| 1356 | # care anyway), in case e.g. the server reports a memory leak. |
| 1357 | if [ $SRV_RET != 0 ] && is_polar "$SRV_CMD"; then |
Gilles Peskine | 7f919de | 2021-02-02 23:29:03 +0100 | [diff] [blame] | 1358 | fail "Server exited with status $SRV_RET" |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 1359 | return |
| 1360 | fi |
| 1361 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1362 | # check client exit code |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 1363 | if [ \( "$CLI_EXPECT" = 0 -a "$CLI_EXIT" != 0 \) -o \ |
| 1364 | \( "$CLI_EXPECT" != 0 -a "$CLI_EXIT" = 0 \) ] |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1365 | then |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 1366 | fail "bad client exit code (expected $CLI_EXPECT, got $CLI_EXIT)" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1367 | return |
| 1368 | fi |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1369 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1370 | # check other assertions |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 1371 | # lines beginning with == are added by valgrind, ignore them |
Paul Bakker | 1f65092 | 2016-05-13 10:16:46 +0100 | [diff] [blame] | 1372 | # lines with 'Serious error when reading debug info', are valgrind issues as well |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1373 | while [ $# -gt 0 ] |
| 1374 | do |
| 1375 | case $1 in |
| 1376 | "-s") |
Paul Bakker | 1f65092 | 2016-05-13 10:16:46 +0100 | [diff] [blame] | 1377 | if grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then :; else |
Simon Butcher | 8e00410 | 2016-10-14 00:48:33 +0100 | [diff] [blame] | 1378 | fail "pattern '$2' MUST be present in the Server output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1379 | return |
| 1380 | fi |
| 1381 | ;; |
| 1382 | |
| 1383 | "-c") |
Paul Bakker | 1f65092 | 2016-05-13 10:16:46 +0100 | [diff] [blame] | 1384 | if grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then :; else |
Simon Butcher | 8e00410 | 2016-10-14 00:48:33 +0100 | [diff] [blame] | 1385 | fail "pattern '$2' MUST be present in the Client output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1386 | return |
| 1387 | fi |
| 1388 | ;; |
| 1389 | |
| 1390 | "-S") |
Paul Bakker | 1f65092 | 2016-05-13 10:16:46 +0100 | [diff] [blame] | 1391 | if grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then |
Gilles Peskine | 788ad33 | 2021-10-20 14:17:02 +0200 | [diff] [blame] | 1392 | if log_pattern_presence_is_conclusive "$2"; then |
Gilles Peskine | f11d30e | 2021-10-19 18:00:10 +0200 | [diff] [blame] | 1393 | fail "pattern '$2' MUST NOT be present in the Server output" |
| 1394 | fi |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1395 | return |
| 1396 | fi |
| 1397 | ;; |
| 1398 | |
| 1399 | "-C") |
Paul Bakker | 1f65092 | 2016-05-13 10:16:46 +0100 | [diff] [blame] | 1400 | if grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep "$2" >/dev/null; then |
Gilles Peskine | 788ad33 | 2021-10-20 14:17:02 +0200 | [diff] [blame] | 1401 | if log_pattern_presence_is_conclusive "$2"; then |
Gilles Peskine | f11d30e | 2021-10-19 18:00:10 +0200 | [diff] [blame] | 1402 | fail "pattern '$2' MUST NOT be present in the Client output" |
| 1403 | fi |
Simon Butcher | 8e00410 | 2016-10-14 00:48:33 +0100 | [diff] [blame] | 1404 | return |
| 1405 | fi |
| 1406 | ;; |
| 1407 | |
| 1408 | # The filtering in the following two options (-u and -U) do the following |
| 1409 | # - ignore valgrind output |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 1410 | # - filter out everything but lines right after the pattern occurrences |
Simon Butcher | 8e00410 | 2016-10-14 00:48:33 +0100 | [diff] [blame] | 1411 | # - keep one of each non-unique line |
| 1412 | # - count how many lines remain |
| 1413 | # A line with '--' will remain in the result from previous outputs, so the number of lines in the result will be 1 |
| 1414 | # if there were no duplicates. |
| 1415 | "-U") |
| 1416 | if [ $(grep -v '^==' $SRV_OUT | grep -v 'Serious error when reading debug info' | grep -A1 "$2" | grep -v "$2" | sort | uniq -d | wc -l) -gt 1 ]; then |
| 1417 | fail "lines following pattern '$2' must be unique in Server output" |
| 1418 | return |
| 1419 | fi |
| 1420 | ;; |
| 1421 | |
| 1422 | "-u") |
| 1423 | if [ $(grep -v '^==' $CLI_OUT | grep -v 'Serious error when reading debug info' | grep -A1 "$2" | grep -v "$2" | sort | uniq -d | wc -l) -gt 1 ]; then |
| 1424 | fail "lines following pattern '$2' must be unique in Client output" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1425 | return |
| 1426 | fi |
| 1427 | ;; |
Andres Amaya Garcia | 93993de | 2017-09-06 15:38:07 +0100 | [diff] [blame] | 1428 | "-F") |
| 1429 | if ! $2 "$SRV_OUT"; then |
| 1430 | fail "function call to '$2' failed on Server output" |
| 1431 | return |
| 1432 | fi |
| 1433 | ;; |
| 1434 | "-f") |
| 1435 | if ! $2 "$CLI_OUT"; then |
| 1436 | fail "function call to '$2' failed on Client output" |
| 1437 | return |
| 1438 | fi |
| 1439 | ;; |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 1440 | "-g") |
| 1441 | if ! eval "$2 '$SRV_OUT' '$CLI_OUT'"; then |
| 1442 | fail "function call to '$2' failed on Server and Client output" |
| 1443 | return |
| 1444 | fi |
| 1445 | ;; |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1446 | |
| 1447 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 1448 | echo "Unknown test: $1" >&2 |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1449 | exit 1 |
| 1450 | esac |
| 1451 | shift 2 |
| 1452 | done |
| 1453 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1454 | # check valgrind's results |
| 1455 | if [ "$MEMCHECK" -gt 0 ]; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1456 | if is_polar "$SRV_CMD" && has_mem_err $SRV_OUT; then |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1457 | fail "Server has memory errors" |
| 1458 | return |
| 1459 | fi |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1460 | if is_polar "$CLI_CMD" && has_mem_err $CLI_OUT; then |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 1461 | fail "Client has memory errors" |
| 1462 | return |
| 1463 | fi |
| 1464 | fi |
| 1465 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1466 | # if we're here, everything is ok |
Gilles Peskine | 0e3534c | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1467 | outcome=PASS |
Gilles Peskine | 236bf98 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1468 | } |
| 1469 | |
Gilles Peskine | 196d73b | 2021-10-19 16:35:35 +0200 | [diff] [blame] | 1470 | # Run the current test case: start the server and if applicable the proxy, run |
| 1471 | # the client, wait for all processes to finish or time out. |
| 1472 | # |
| 1473 | # Inputs: |
| 1474 | # * $NAME: test case name |
| 1475 | # * $CLI_CMD, $SRV_CMD, $PXY_CMD: commands to run |
| 1476 | # * $CLI_OUT, $SRV_OUT, $PXY_OUT: files to contain client/server/proxy logs |
| 1477 | # |
| 1478 | # Outputs: |
| 1479 | # * $CLI_EXIT: client return code |
| 1480 | # * $SRV_RET: server return code |
| 1481 | do_run_test_once() { |
| 1482 | # run the commands |
| 1483 | if [ -n "$PXY_CMD" ]; then |
| 1484 | printf "# %s\n%s\n" "$NAME" "$PXY_CMD" > $PXY_OUT |
| 1485 | $PXY_CMD >> $PXY_OUT 2>&1 & |
| 1486 | PXY_PID=$! |
| 1487 | wait_proxy_start "$PXY_PORT" "$PXY_PID" |
| 1488 | fi |
| 1489 | |
| 1490 | check_osrv_dtls |
| 1491 | printf '# %s\n%s\n' "$NAME" "$SRV_CMD" > $SRV_OUT |
| 1492 | provide_input | $SRV_CMD >> $SRV_OUT 2>&1 & |
| 1493 | SRV_PID=$! |
| 1494 | wait_server_start "$SRV_PORT" "$SRV_PID" |
| 1495 | |
| 1496 | printf '# %s\n%s\n' "$NAME" "$CLI_CMD" > $CLI_OUT |
Andrzej Kurek | 140b589 | 2022-05-27 06:44:19 -0400 | [diff] [blame] | 1497 | # The client must be a subprocess of the script in order for killing it to |
| 1498 | # work properly, that's why the ampersand is placed inside the eval command, |
| 1499 | # not at the end of the line: the latter approach will spawn eval as a |
| 1500 | # subprocess, and the $CLI_CMD as a grandchild. |
| 1501 | eval "$CLI_CMD &" >> $CLI_OUT 2>&1 |
Gilles Peskine | 196d73b | 2021-10-19 16:35:35 +0200 | [diff] [blame] | 1502 | wait_client_done |
| 1503 | |
| 1504 | sleep 0.05 |
| 1505 | |
| 1506 | # terminate the server (and the proxy) |
| 1507 | kill $SRV_PID |
Jerry Yu | d2d4110 | 2022-07-26 17:34:42 +0800 | [diff] [blame] | 1508 | # For Ubuntu 22.04, `Terminated` message is outputed by wait command. |
Jerry Yu | 27d8092 | 2022-08-02 21:28:55 +0800 | [diff] [blame] | 1509 | # To remove it from stdout, redirect stdout/stderr to SRV_OUT |
Jerry Yu | d2d4110 | 2022-07-26 17:34:42 +0800 | [diff] [blame] | 1510 | wait $SRV_PID >> $SRV_OUT 2>&1 |
Gilles Peskine | 196d73b | 2021-10-19 16:35:35 +0200 | [diff] [blame] | 1511 | SRV_RET=$? |
| 1512 | |
| 1513 | if [ -n "$PXY_CMD" ]; then |
| 1514 | kill $PXY_PID >/dev/null 2>&1 |
Jerry Yu | 6969eee | 2022-10-10 10:25:26 +0800 | [diff] [blame] | 1515 | wait $PXY_PID >> $PXY_OUT 2>&1 |
Gilles Peskine | 196d73b | 2021-10-19 16:35:35 +0200 | [diff] [blame] | 1516 | fi |
| 1517 | } |
| 1518 | |
Ronald Cron | 097ba14 | 2023-03-08 16:18:00 +0100 | [diff] [blame] | 1519 | # Detect if the current test is going to use TLS 1.3 or TLS 1.2. |
Valerio Setti | 194e2bd | 2023-03-02 17:18:10 +0100 | [diff] [blame] | 1520 | # $1 and $2 contain the server and client command lines, respectively. |
Valerio Setti | 213c4ea | 2023-03-07 19:29:57 +0100 | [diff] [blame] | 1521 | # |
| 1522 | # Note: this function only provides some guess about TLS version by simply |
| 1523 | # looking at the server/client command lines. Even thought this works |
| 1524 | # for the sake of tests' filtering (especially in conjunction with the |
| 1525 | # detect_required_features() function), it does NOT guarantee that the |
| 1526 | # result is accurate. It does not check other conditions, such as: |
Valerio Setti | 213c4ea | 2023-03-07 19:29:57 +0100 | [diff] [blame] | 1527 | # - we can force a ciphersuite which contains "WITH" in its name, meaning |
| 1528 | # that we are going to use TLS 1.2 |
| 1529 | # - etc etc |
Valerio Setti | 1af76d1 | 2023-02-23 15:55:10 +0100 | [diff] [blame] | 1530 | get_tls_version() { |
Ronald Cron | 097ba14 | 2023-03-08 16:18:00 +0100 | [diff] [blame] | 1531 | # First check if the version is forced on an Mbed TLS peer |
Valerio Setti | 1af76d1 | 2023-02-23 15:55:10 +0100 | [diff] [blame] | 1532 | case $1 in |
Ronald Cron | 097ba14 | 2023-03-08 16:18:00 +0100 | [diff] [blame] | 1533 | *tls12*) |
| 1534 | echo "TLS12" |
| 1535 | return;; |
| 1536 | *tls13*) |
Valerio Setti | 1af76d1 | 2023-02-23 15:55:10 +0100 | [diff] [blame] | 1537 | echo "TLS13" |
| 1538 | return;; |
| 1539 | esac |
| 1540 | case $2 in |
Ronald Cron | 097ba14 | 2023-03-08 16:18:00 +0100 | [diff] [blame] | 1541 | *tls12*) |
| 1542 | echo "TLS12" |
| 1543 | return;; |
| 1544 | *tls13*) |
Valerio Setti | 1af76d1 | 2023-02-23 15:55:10 +0100 | [diff] [blame] | 1545 | echo "TLS13" |
| 1546 | return;; |
| 1547 | esac |
Ronald Cron | 097ba14 | 2023-03-08 16:18:00 +0100 | [diff] [blame] | 1548 | # Second check if the version is forced on an OpenSSL or GnuTLS peer |
| 1549 | case $1 in |
| 1550 | tls1_2*) |
| 1551 | echo "TLS12" |
| 1552 | return;; |
| 1553 | *tls1_3) |
| 1554 | echo "TLS13" |
| 1555 | return;; |
| 1556 | esac |
| 1557 | case $2 in |
| 1558 | *tls1_2) |
| 1559 | echo "TLS12" |
| 1560 | return;; |
| 1561 | *tls1_3) |
| 1562 | echo "TLS13" |
| 1563 | return;; |
| 1564 | esac |
| 1565 | # Third if the version is not forced, if TLS 1.3 is enabled then the test |
| 1566 | # is aimed to run a TLS 1.3 handshake. |
| 1567 | if $P_QUERY -all MBEDTLS_SSL_PROTO_TLS1_3 |
| 1568 | then |
| 1569 | echo "TLS13" |
| 1570 | else |
| 1571 | echo "TLS12" |
| 1572 | fi |
Valerio Setti | 1af76d1 | 2023-02-23 15:55:10 +0100 | [diff] [blame] | 1573 | } |
| 1574 | |
Gilles Peskine | 236bf98 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1575 | # Usage: run_test name [-p proxy_cmd] srv_cmd cli_cmd cli_exit [option [...]] |
| 1576 | # Options: -s pattern pattern that must be present in server output |
| 1577 | # -c pattern pattern that must be present in client output |
| 1578 | # -u pattern lines after pattern must be unique in client output |
| 1579 | # -f call shell function on client output |
| 1580 | # -S pattern pattern that must be absent in server output |
| 1581 | # -C pattern pattern that must be absent in client output |
| 1582 | # -U pattern lines after pattern must be unique in server output |
| 1583 | # -F call shell function on server output |
| 1584 | # -g call shell function on server and client output |
| 1585 | run_test() { |
| 1586 | NAME="$1" |
| 1587 | shift 1 |
| 1588 | |
| 1589 | if is_excluded "$NAME"; then |
| 1590 | SKIP_NEXT="NO" |
| 1591 | # There was no request to run the test, so don't record its outcome. |
| 1592 | return |
| 1593 | fi |
| 1594 | |
| 1595 | print_name "$NAME" |
| 1596 | |
| 1597 | # Do we only run numbered tests? |
| 1598 | if [ -n "$RUN_TEST_NUMBER" ]; then |
| 1599 | case ",$RUN_TEST_NUMBER," in |
| 1600 | *",$TESTS,"*) :;; |
| 1601 | *) SKIP_NEXT="YES";; |
| 1602 | esac |
| 1603 | fi |
| 1604 | |
| 1605 | # does this test use a proxy? |
| 1606 | if [ "X$1" = "X-p" ]; then |
| 1607 | PXY_CMD="$2" |
| 1608 | shift 2 |
| 1609 | else |
| 1610 | PXY_CMD="" |
| 1611 | fi |
| 1612 | |
| 1613 | # get commands and client output |
| 1614 | SRV_CMD="$1" |
| 1615 | CLI_CMD="$2" |
| 1616 | CLI_EXPECT="$3" |
| 1617 | shift 3 |
| 1618 | |
| 1619 | # Check if test uses files |
| 1620 | case "$SRV_CMD $CLI_CMD" in |
| 1621 | *data_files/*) |
| 1622 | requires_config_enabled MBEDTLS_FS_IO;; |
| 1623 | esac |
| 1624 | |
Gilles Peskine | 82a4ab2 | 2022-02-25 19:46:30 +0100 | [diff] [blame] | 1625 | # Check if the test uses DTLS. |
| 1626 | detect_dtls "$SRV_CMD" |
| 1627 | if [ "$DTLS" -eq 1 ]; then |
| 1628 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 1629 | fi |
| 1630 | |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 1631 | # Check if we are trying to use an external tool wich does not support ECDH |
| 1632 | EXT_WO_ECDH=$(use_ext_tool_without_ecdh_support "$SRV_CMD" "$CLI_CMD") |
| 1633 | |
Valerio Setti | 726ffbf | 2023-08-02 20:02:44 +0200 | [diff] [blame] | 1634 | # Guess the TLS version which is going to be used |
| 1635 | if [ "$EXT_WO_ECDH" = "no" ]; then |
| 1636 | TLS_VERSION=$(get_tls_version "$SRV_CMD" "$CLI_CMD") |
| 1637 | else |
| 1638 | TLS_VERSION="TLS12" |
| 1639 | fi |
| 1640 | |
| 1641 | # If the client or server requires certain features that can be detected |
Manuel Pégourié-Gonnard | f299efd | 2023-09-18 11:19:04 +0200 | [diff] [blame^] | 1642 | # from their command-line arguments, check whether they're enabled. |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 1643 | detect_required_features "$SRV_CMD" "server" "$TLS_VERSION" "$EXT_WO_ECDH" "$@" |
| 1644 | detect_required_features "$CLI_CMD" "client" "$TLS_VERSION" "$EXT_WO_ECDH" "$@" |
Gilles Peskine | 236bf98 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1645 | |
Gilles Peskine | 6e86e54 | 2022-02-25 19:52:52 +0100 | [diff] [blame] | 1646 | # If we're in a PSK-only build and the test can be adapted to PSK, do that. |
| 1647 | maybe_adapt_for_psk "$@" |
Gilles Peskine | 236bf98 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1648 | |
| 1649 | # should we skip? |
| 1650 | if [ "X$SKIP_NEXT" = "XYES" ]; then |
| 1651 | SKIP_NEXT="NO" |
| 1652 | record_outcome "SKIP" |
| 1653 | SKIPS=$(( $SKIPS + 1 )) |
| 1654 | return |
| 1655 | fi |
| 1656 | |
| 1657 | analyze_test_commands "$@" |
| 1658 | |
Andrzej Kurek | 8db7c0e | 2022-04-01 08:52:06 -0400 | [diff] [blame] | 1659 | # One regular run and two retries |
| 1660 | TIMES_LEFT=3 |
Gilles Peskine | 236bf98 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1661 | while [ $TIMES_LEFT -gt 0 ]; do |
| 1662 | TIMES_LEFT=$(( $TIMES_LEFT - 1 )) |
| 1663 | |
Gilles Peskine | 196d73b | 2021-10-19 16:35:35 +0200 | [diff] [blame] | 1664 | do_run_test_once |
Gilles Peskine | 236bf98 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1665 | |
Gilles Peskine | 0e3534c | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1666 | check_test_failure "$@" |
| 1667 | case $outcome in |
| 1668 | PASS) break;; |
Gilles Peskine | f11d30e | 2021-10-19 18:00:10 +0200 | [diff] [blame] | 1669 | RETRY*) printf "$outcome ";; |
Gilles Peskine | 0e3534c | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1670 | FAIL) return;; |
| 1671 | esac |
Gilles Peskine | 236bf98 | 2021-10-19 16:25:10 +0200 | [diff] [blame] | 1672 | done |
| 1673 | |
Gilles Peskine | 0e3534c | 2021-10-19 17:23:25 +0200 | [diff] [blame] | 1674 | # If we get this far, the test case passed. |
Gilles Peskine | 560280b | 2019-09-16 15:17:38 +0200 | [diff] [blame] | 1675 | record_outcome "PASS" |
Paul Bakker | acaac85 | 2016-05-10 11:47:13 +0100 | [diff] [blame] | 1676 | if [ "$PRESERVE_LOGS" -gt 0 ]; then |
| 1677 | mv $SRV_OUT o-srv-${TESTS}.log |
| 1678 | mv $CLI_OUT o-cli-${TESTS}.log |
Hanno Becker | 7be2e5b | 2018-08-20 12:21:35 +0100 | [diff] [blame] | 1679 | if [ -n "$PXY_CMD" ]; then |
| 1680 | mv $PXY_OUT o-pxy-${TESTS}.log |
| 1681 | fi |
Paul Bakker | acaac85 | 2016-05-10 11:47:13 +0100 | [diff] [blame] | 1682 | fi |
| 1683 | |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 1684 | rm -f $SRV_OUT $CLI_OUT $PXY_OUT |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1685 | } |
| 1686 | |
Hanno Becker | 9b5853c | 2018-11-16 17:28:40 +0000 | [diff] [blame] | 1687 | run_test_psa() { |
| 1688 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Gilles Peskine | 309ca65 | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1689 | set_maybe_calc_verify none |
Hanno Becker | e9420c2 | 2018-11-20 11:37:34 +0000 | [diff] [blame] | 1690 | run_test "PSA-supported ciphersuite: $1" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 1691 | "$P_SRV debug_level=3 force_version=tls12" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 1692 | "$P_CLI debug_level=3 force_ciphersuite=$1" \ |
Hanno Becker | 9b5853c | 2018-11-16 17:28:40 +0000 | [diff] [blame] | 1693 | 0 \ |
Gilles Peskine | 309ca65 | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1694 | -c "$maybe_calc_verify" \ |
Andrzej Kurek | 92dd4d0 | 2019-01-30 04:10:19 -0500 | [diff] [blame] | 1695 | -c "calc PSA finished" \ |
Gilles Peskine | 309ca65 | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1696 | -s "$maybe_calc_verify" \ |
Andrzej Kurek | 92dd4d0 | 2019-01-30 04:10:19 -0500 | [diff] [blame] | 1697 | -s "calc PSA finished" \ |
Hanno Becker | 9b5853c | 2018-11-16 17:28:40 +0000 | [diff] [blame] | 1698 | -s "Protocol is TLSv1.2" \ |
Hanno Becker | 28f7844 | 2019-02-18 16:47:50 +0000 | [diff] [blame] | 1699 | -c "Perform PSA-based ECDH computation."\ |
Andrzej Kurek | e85414e | 2019-01-15 05:23:59 -0500 | [diff] [blame] | 1700 | -c "Perform PSA-based computation of digest of ServerKeyExchange" \ |
Hanno Becker | 9b5853c | 2018-11-16 17:28:40 +0000 | [diff] [blame] | 1701 | -S "error" \ |
| 1702 | -C "error" |
Gilles Peskine | 309ca65 | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1703 | unset maybe_calc_verify |
Hanno Becker | 9b5853c | 2018-11-16 17:28:40 +0000 | [diff] [blame] | 1704 | } |
| 1705 | |
Hanno Becker | 354e248 | 2019-01-08 11:40:25 +0000 | [diff] [blame] | 1706 | run_test_psa_force_curve() { |
| 1707 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Gilles Peskine | 309ca65 | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1708 | set_maybe_calc_verify none |
Hanno Becker | 354e248 | 2019-01-08 11:40:25 +0000 | [diff] [blame] | 1709 | run_test "PSA - ECDH with $1" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 1710 | "$P_SRV debug_level=4 force_version=tls12 groups=$1" \ |
| 1711 | "$P_CLI debug_level=4 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256 groups=$1" \ |
Hanno Becker | 354e248 | 2019-01-08 11:40:25 +0000 | [diff] [blame] | 1712 | 0 \ |
Gilles Peskine | 309ca65 | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1713 | -c "$maybe_calc_verify" \ |
Hanno Becker | 28f7844 | 2019-02-18 16:47:50 +0000 | [diff] [blame] | 1714 | -c "calc PSA finished" \ |
Gilles Peskine | 309ca65 | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1715 | -s "$maybe_calc_verify" \ |
Hanno Becker | 28f7844 | 2019-02-18 16:47:50 +0000 | [diff] [blame] | 1716 | -s "calc PSA finished" \ |
Hanno Becker | 354e248 | 2019-01-08 11:40:25 +0000 | [diff] [blame] | 1717 | -s "Protocol is TLSv1.2" \ |
Hanno Becker | 28f7844 | 2019-02-18 16:47:50 +0000 | [diff] [blame] | 1718 | -c "Perform PSA-based ECDH computation."\ |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 1719 | -c "Perform PSA-based computation of digest of ServerKeyExchange" \ |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 1720 | -S "error" \ |
Manuel Pégourié-Gonnard | a6189f0 | 2014-09-20 13:15:43 +0200 | [diff] [blame] | 1721 | -C "error" |
Gilles Peskine | 309ca65 | 2022-03-14 17:55:04 +0100 | [diff] [blame] | 1722 | unset maybe_calc_verify |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1723 | } |
| 1724 | |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 1725 | # Test that the server's memory usage after a handshake is reduced when a client specifies |
| 1726 | # a maximum fragment length. |
| 1727 | # first argument ($1) is MFL for SSL client |
| 1728 | # second argument ($2) is memory usage for SSL client with default MFL (16k) |
| 1729 | run_test_memory_after_hanshake_with_mfl() |
| 1730 | { |
| 1731 | # The test passes if the difference is around 2*(16k-MFL) |
Gilles Peskine | 5b428d7 | 2020-08-26 21:52:23 +0200 | [diff] [blame] | 1732 | MEMORY_USAGE_LIMIT="$(( $2 - ( 2 * ( 16384 - $1 )) ))" |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 1733 | |
| 1734 | # Leave some margin for robustness |
| 1735 | MEMORY_USAGE_LIMIT="$(( ( MEMORY_USAGE_LIMIT * 110 ) / 100 ))" |
| 1736 | |
| 1737 | run_test "Handshake memory usage (MFL $1)" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 1738 | "$P_SRV debug_level=3 auth_mode=required force_version=tls12" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 1739 | "$P_CLI debug_level=3 \ |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 1740 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 1741 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM max_frag_len=$1" \ |
| 1742 | 0 \ |
| 1743 | -F "handshake_memory_check $MEMORY_USAGE_LIMIT" |
| 1744 | } |
| 1745 | |
| 1746 | |
| 1747 | # Test that the server's memory usage after a handshake is reduced when a client specifies |
| 1748 | # different values of Maximum Fragment Length: default (16k), 4k, 2k, 1k and 512 bytes |
| 1749 | run_tests_memory_after_hanshake() |
| 1750 | { |
| 1751 | # all tests in this sequence requires the same configuration (see requires_config_enabled()) |
| 1752 | SKIP_THIS_TESTS="$SKIP_NEXT" |
| 1753 | |
| 1754 | # first test with default MFU is to get reference memory usage |
| 1755 | MEMORY_USAGE_MFL_16K=0 |
| 1756 | run_test "Handshake memory usage initial (MFL 16384 - default)" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 1757 | "$P_SRV debug_level=3 auth_mode=required force_version=tls12" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 1758 | "$P_CLI debug_level=3 \ |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 1759 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 1760 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM" \ |
| 1761 | 0 \ |
| 1762 | -F "handshake_memory_get MEMORY_USAGE_MFL_16K" |
| 1763 | |
| 1764 | SKIP_NEXT="$SKIP_THIS_TESTS" |
| 1765 | run_test_memory_after_hanshake_with_mfl 4096 "$MEMORY_USAGE_MFL_16K" |
| 1766 | |
| 1767 | SKIP_NEXT="$SKIP_THIS_TESTS" |
| 1768 | run_test_memory_after_hanshake_with_mfl 2048 "$MEMORY_USAGE_MFL_16K" |
| 1769 | |
| 1770 | SKIP_NEXT="$SKIP_THIS_TESTS" |
| 1771 | run_test_memory_after_hanshake_with_mfl 1024 "$MEMORY_USAGE_MFL_16K" |
| 1772 | |
| 1773 | SKIP_NEXT="$SKIP_THIS_TESTS" |
| 1774 | run_test_memory_after_hanshake_with_mfl 512 "$MEMORY_USAGE_MFL_16K" |
| 1775 | } |
| 1776 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 1777 | cleanup() { |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1778 | rm -f $CLI_OUT $SRV_OUT $PXY_OUT $SESSION |
Piotr Nowicki | 3de298f | 2020-04-16 14:35:19 +0200 | [diff] [blame] | 1779 | rm -f context_srv.txt |
| 1780 | rm -f context_cli.txt |
Manuel Pégourié-Gonnard | a6189f0 | 2014-09-20 13:15:43 +0200 | [diff] [blame] | 1781 | test -n "${SRV_PID:-}" && kill $SRV_PID >/dev/null 2>&1 |
| 1782 | test -n "${PXY_PID:-}" && kill $PXY_PID >/dev/null 2>&1 |
| 1783 | test -n "${CLI_PID:-}" && kill $CLI_PID >/dev/null 2>&1 |
| 1784 | test -n "${DOG_PID:-}" && kill $DOG_PID >/dev/null 2>&1 |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 1785 | exit 1 |
| 1786 | } |
| 1787 | |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 1788 | # |
| 1789 | # MAIN |
| 1790 | # |
| 1791 | |
Manuel Pégourié-Gonnard | 913030c | 2014-03-28 10:12:38 +0100 | [diff] [blame] | 1792 | get_options "$@" |
| 1793 | |
Yanray Wang | 5b33f64 | 2023-02-28 11:56:59 +0800 | [diff] [blame] | 1794 | # Make the outcome file path relative to the original directory, not |
| 1795 | # to .../tests |
| 1796 | case "$MBEDTLS_TEST_OUTCOME_FILE" in |
| 1797 | [!/]*) |
| 1798 | MBEDTLS_TEST_OUTCOME_FILE="$ORIGINAL_PWD/$MBEDTLS_TEST_OUTCOME_FILE" |
| 1799 | ;; |
| 1800 | esac |
| 1801 | |
Andrzej Kurek | 9c061a2 | 2022-09-05 10:51:19 -0400 | [diff] [blame] | 1802 | populate_enabled_hash_algs |
| 1803 | |
Gilles Peskine | 9fa4ed6 | 2020-08-26 22:35:46 +0200 | [diff] [blame] | 1804 | # Optimize filters: if $FILTER and $EXCLUDE can be expressed as shell |
| 1805 | # patterns rather than regular expressions, use a case statement instead |
| 1806 | # of calling grep. To keep the optimizer simple, it is incomplete and only |
| 1807 | # detects simple cases: plain substring, everything, nothing. |
| 1808 | # |
| 1809 | # As an exception, the character '.' is treated as an ordinary character |
| 1810 | # if it is the only special character in the string. This is because it's |
| 1811 | # rare to need "any one character", but needing a literal '.' is common |
| 1812 | # (e.g. '-f "DTLS 1.2"'). |
| 1813 | need_grep= |
| 1814 | case "$FILTER" in |
| 1815 | '^$') simple_filter=;; |
| 1816 | '.*') simple_filter='*';; |
Gilles Peskine | b09e001 | 2020-09-29 23:48:39 +0200 | [diff] [blame] | 1817 | *[][$+*?\\^{\|}]*) # Regexp special characters (other than .), we need grep |
Gilles Peskine | 9fa4ed6 | 2020-08-26 22:35:46 +0200 | [diff] [blame] | 1818 | need_grep=1;; |
| 1819 | *) # No regexp or shell-pattern special character |
| 1820 | simple_filter="*$FILTER*";; |
| 1821 | esac |
| 1822 | case "$EXCLUDE" in |
| 1823 | '^$') simple_exclude=;; |
| 1824 | '.*') simple_exclude='*';; |
Gilles Peskine | b09e001 | 2020-09-29 23:48:39 +0200 | [diff] [blame] | 1825 | *[][$+*?\\^{\|}]*) # Regexp special characters (other than .), we need grep |
Gilles Peskine | 9fa4ed6 | 2020-08-26 22:35:46 +0200 | [diff] [blame] | 1826 | need_grep=1;; |
| 1827 | *) # No regexp or shell-pattern special character |
| 1828 | simple_exclude="*$EXCLUDE*";; |
| 1829 | esac |
| 1830 | if [ -n "$need_grep" ]; then |
| 1831 | is_excluded () { |
| 1832 | ! echo "$1" | grep "$FILTER" | grep -q -v "$EXCLUDE" |
| 1833 | } |
| 1834 | else |
| 1835 | is_excluded () { |
| 1836 | case "$1" in |
| 1837 | $simple_exclude) true;; |
| 1838 | $simple_filter) false;; |
| 1839 | *) true;; |
| 1840 | esac |
| 1841 | } |
| 1842 | fi |
| 1843 | |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1844 | # sanity checks, avoid an avalanche of errors |
Hanno Becker | 4ac73e7 | 2017-10-23 15:27:37 +0100 | [diff] [blame] | 1845 | P_SRV_BIN="${P_SRV%%[ ]*}" |
| 1846 | P_CLI_BIN="${P_CLI%%[ ]*}" |
| 1847 | P_PXY_BIN="${P_PXY%%[ ]*}" |
Hanno Becker | 17c0493 | 2017-10-10 14:44:53 +0100 | [diff] [blame] | 1848 | if [ ! -x "$P_SRV_BIN" ]; then |
| 1849 | echo "Command '$P_SRV_BIN' is not an executable file" |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1850 | exit 1 |
| 1851 | fi |
Hanno Becker | 17c0493 | 2017-10-10 14:44:53 +0100 | [diff] [blame] | 1852 | if [ ! -x "$P_CLI_BIN" ]; then |
| 1853 | echo "Command '$P_CLI_BIN' is not an executable file" |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1854 | exit 1 |
| 1855 | fi |
Hanno Becker | 17c0493 | 2017-10-10 14:44:53 +0100 | [diff] [blame] | 1856 | if [ ! -x "$P_PXY_BIN" ]; then |
| 1857 | echo "Command '$P_PXY_BIN' is not an executable file" |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 1858 | exit 1 |
| 1859 | fi |
Simon Butcher | 3c0d7b8 | 2016-05-23 11:13:17 +0100 | [diff] [blame] | 1860 | if [ "$MEMCHECK" -gt 0 ]; then |
| 1861 | if which valgrind >/dev/null 2>&1; then :; else |
| 1862 | echo "Memcheck not possible. Valgrind not found" |
| 1863 | exit 1 |
| 1864 | fi |
| 1865 | fi |
Manuel Pégourié-Gonnard | c572246 | 2022-12-19 11:42:12 +0100 | [diff] [blame] | 1866 | if which $OPENSSL >/dev/null 2>&1; then :; else |
| 1867 | echo "Command '$OPENSSL' not found" |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 1868 | exit 1 |
| 1869 | fi |
| 1870 | |
Manuel Pégourié-Gonnard | 32f8f4d | 2014-05-29 11:31:20 +0200 | [diff] [blame] | 1871 | # used by watchdog |
| 1872 | MAIN_PID="$$" |
| 1873 | |
Manuel Pégourié-Gonnard | 0d225da | 2018-01-22 10:22:09 +0100 | [diff] [blame] | 1874 | # We use somewhat arbitrary delays for tests: |
| 1875 | # - how long do we wait for the server to start (when lsof not available)? |
| 1876 | # - how long do we allow for the client to finish? |
| 1877 | # (not to check performance, just to avoid waiting indefinitely) |
| 1878 | # Things are slower with valgrind, so give extra time here. |
| 1879 | # |
| 1880 | # Note: without lsof, there is a trade-off between the running time of this |
| 1881 | # script and the risk of spurious errors because we didn't wait long enough. |
| 1882 | # The watchdog delay on the other hand doesn't affect normal running time of |
| 1883 | # the script, only the case where a client or server gets stuck. |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 1884 | if [ "$MEMCHECK" -gt 0 ]; then |
Manuel Pégourié-Gonnard | 0d225da | 2018-01-22 10:22:09 +0100 | [diff] [blame] | 1885 | START_DELAY=6 |
| 1886 | DOG_DELAY=60 |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 1887 | else |
Manuel Pégourié-Gonnard | 0d225da | 2018-01-22 10:22:09 +0100 | [diff] [blame] | 1888 | START_DELAY=2 |
| 1889 | DOG_DELAY=20 |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 1890 | fi |
Manuel Pégourié-Gonnard | 0d225da | 2018-01-22 10:22:09 +0100 | [diff] [blame] | 1891 | |
| 1892 | # some particular tests need more time: |
| 1893 | # - for the client, we multiply the usual watchdog limit by a factor |
| 1894 | # - for the server, we sleep for a number of seconds after the client exits |
| 1895 | # see client_need_more_time() and server_needs_more_time() |
Manuel Pégourié-Gonnard | a071972 | 2014-09-20 12:46:27 +0200 | [diff] [blame] | 1896 | CLI_DELAY_FACTOR=1 |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 1897 | SRV_DELAY_SECONDS=0 |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 1898 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 1899 | # fix commands to use this port, force IPv4 while at it |
Manuel Pégourié-Gonnard | 0af1ba3 | 2015-01-21 11:44:33 +0000 | [diff] [blame] | 1900 | # +SRV_PORT will be replaced by either $SRV_PORT or $PXY_PORT later |
Paul Elliott | 0421715 | 2021-10-12 16:10:37 +0100 | [diff] [blame] | 1901 | # Note: Using 'localhost' rather than 127.0.0.1 here is unwise, as on many |
| 1902 | # machines that will resolve to ::1, and we don't want ipv6 here. |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 1903 | P_SRV="$P_SRV server_addr=127.0.0.1 server_port=$SRV_PORT" |
| 1904 | P_CLI="$P_CLI server_addr=127.0.0.1 server_port=+SRV_PORT" |
Andres AG | f04f54d | 2016-10-10 15:46:20 +0100 | [diff] [blame] | 1905 | P_PXY="$P_PXY server_addr=127.0.0.1 server_port=$SRV_PORT listen_addr=127.0.0.1 listen_port=$PXY_PORT ${SEED:+"seed=$SEED"}" |
Gilles Peskine | 96f5bae | 2021-04-01 14:00:11 +0200 | [diff] [blame] | 1906 | O_SRV="$O_SRV -accept $SRV_PORT" |
Paul Elliott | 0421715 | 2021-10-12 16:10:37 +0100 | [diff] [blame] | 1907 | O_CLI="$O_CLI -connect 127.0.0.1:+SRV_PORT" |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 1908 | G_SRV="$G_SRV -p $SRV_PORT" |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 1909 | G_CLI="$G_CLI -p +SRV_PORT" |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 1910 | |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 1911 | if [ -n "${OPENSSL_LEGACY:-}" ]; then |
| 1912 | O_LEGACY_SRV="$O_LEGACY_SRV -accept $SRV_PORT -dhparam data_files/dhparams.pem" |
Paul Elliott | 0421715 | 2021-10-12 16:10:37 +0100 | [diff] [blame] | 1913 | O_LEGACY_CLI="$O_LEGACY_CLI -connect 127.0.0.1:+SRV_PORT" |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 1914 | fi |
| 1915 | |
Gilles Peskine | 4bdb9fb | 2022-11-24 22:21:15 +0100 | [diff] [blame] | 1916 | # Newer versions of OpenSSL have a syntax to enable all "ciphers", even |
| 1917 | # low-security ones. This covers not just cipher suites but also protocol |
| 1918 | # versions. It is necessary, for example, to use (D)TLS 1.0/1.1 on |
| 1919 | # OpenSSL 1.1.1f from Ubuntu 20.04. The syntax was only introduced in |
| 1920 | # OpenSSL 1.1.0 (21e0c1d23afff48601eb93135defddae51f7e2e3) and I can't find |
| 1921 | # a way to discover it from -help, so check the openssl version. |
Manuel Pégourié-Gonnard | c572246 | 2022-12-19 11:42:12 +0100 | [diff] [blame] | 1922 | case $($OPENSSL version) in |
Gilles Peskine | 4bdb9fb | 2022-11-24 22:21:15 +0100 | [diff] [blame] | 1923 | "OpenSSL 0"*|"OpenSSL 1.0"*) :;; |
| 1924 | *) |
| 1925 | O_CLI="$O_CLI -cipher ALL@SECLEVEL=0" |
| 1926 | O_SRV="$O_SRV -cipher ALL@SECLEVEL=0" |
| 1927 | ;; |
| 1928 | esac |
| 1929 | |
Jerry Yu | ed2ef2d | 2021-08-19 18:11:43 +0800 | [diff] [blame] | 1930 | if [ -n "${OPENSSL_NEXT:-}" ]; then |
| 1931 | O_NEXT_SRV="$O_NEXT_SRV -accept $SRV_PORT" |
Jerry Yu | 305bfc3 | 2021-11-24 16:04:47 +0800 | [diff] [blame] | 1932 | O_NEXT_SRV_NO_CERT="$O_NEXT_SRV_NO_CERT -accept $SRV_PORT" |
Xiaokang Qian | b0c32d8 | 2022-11-02 10:51:13 +0000 | [diff] [blame] | 1933 | O_NEXT_SRV_EARLY_DATA="$O_NEXT_SRV_EARLY_DATA -accept $SRV_PORT" |
Paul Elliott | 0421715 | 2021-10-12 16:10:37 +0100 | [diff] [blame] | 1934 | O_NEXT_CLI="$O_NEXT_CLI -connect 127.0.0.1:+SRV_PORT" |
XiaokangQian | d5d5b60 | 2022-05-23 09:16:20 +0000 | [diff] [blame] | 1935 | O_NEXT_CLI_NO_CERT="$O_NEXT_CLI_NO_CERT -connect 127.0.0.1:+SRV_PORT" |
Jerry Yu | ed2ef2d | 2021-08-19 18:11:43 +0800 | [diff] [blame] | 1936 | fi |
| 1937 | |
Hanno Becker | 58e9dc3 | 2018-08-17 15:53:21 +0100 | [diff] [blame] | 1938 | if [ -n "${GNUTLS_NEXT_SERV:-}" ]; then |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 1939 | G_NEXT_SRV="$G_NEXT_SRV -p $SRV_PORT" |
Jerry Yu | 305bfc3 | 2021-11-24 16:04:47 +0800 | [diff] [blame] | 1940 | G_NEXT_SRV_NO_CERT="$G_NEXT_SRV_NO_CERT -p $SRV_PORT" |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 1941 | fi |
| 1942 | |
Hanno Becker | 58e9dc3 | 2018-08-17 15:53:21 +0100 | [diff] [blame] | 1943 | if [ -n "${GNUTLS_NEXT_CLI:-}" ]; then |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 1944 | G_NEXT_CLI="$G_NEXT_CLI -p +SRV_PORT" |
Jerry Yu | b7c12a4 | 2022-06-12 20:53:02 +0800 | [diff] [blame] | 1945 | G_NEXT_CLI_NO_CERT="$G_NEXT_CLI_NO_CERT -p +SRV_PORT localhost" |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 1946 | fi |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1947 | |
Gilles Peskine | 62469d9 | 2017-05-10 10:13:59 +0200 | [diff] [blame] | 1948 | # Allow SHA-1, because many of our test certificates use it |
| 1949 | P_SRV="$P_SRV allow_sha1=1" |
| 1950 | P_CLI="$P_CLI allow_sha1=1" |
| 1951 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1952 | # Also pick a unique name for intermediate files |
| 1953 | SRV_OUT="srv_out.$$" |
| 1954 | CLI_OUT="cli_out.$$" |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 1955 | PXY_OUT="pxy_out.$$" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 1956 | SESSION="session.$$" |
| 1957 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 1958 | SKIP_NEXT="NO" |
| 1959 | |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1960 | trap cleanup INT TERM HUP |
| 1961 | |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 1962 | # Basic test |
| 1963 | |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 1964 | # Checks that: |
| 1965 | # - things work with all ciphersuites active (used with config-full in all.sh) |
Gilles Peskine | 799eee6 | 2021-06-02 22:14:15 +0200 | [diff] [blame] | 1966 | # - the expected parameters are selected |
Gilles Peskine | 3561526 | 2022-02-25 19:50:38 +0100 | [diff] [blame] | 1967 | requires_ciphersuite_enabled TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256 |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 1968 | requires_hash_alg SHA_512 # "signature_algorithm ext: 6" |
Gilles Peskine | 1438e16 | 2022-04-05 22:00:32 +0200 | [diff] [blame] | 1969 | requires_config_enabled MBEDTLS_ECP_DP_CURVE25519_ENABLED |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 1970 | run_test "Default, TLS 1.2" \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 1971 | "$P_SRV debug_level=3" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 1972 | "$P_CLI force_version=tls12" \ |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 1973 | 0 \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 1974 | -s "Protocol is TLSv1.2" \ |
Manuel Pégourié-Gonnard | ce66d5e | 2018-06-14 11:11:15 +0200 | [diff] [blame] | 1975 | -s "Ciphersuite is TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256" \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 1976 | -s "client hello v3, signature_algorithm ext: 6" \ |
Gilles Peskine | 799eee6 | 2021-06-02 22:14:15 +0200 | [diff] [blame] | 1977 | -s "ECDHE curve: x25519" \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 1978 | -S "error" \ |
| 1979 | -C "error" |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 1980 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 1981 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | 3561526 | 2022-02-25 19:50:38 +0100 | [diff] [blame] | 1982 | requires_ciphersuite_enabled TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256 |
Manuel Pégourié-Gonnard | 3bb0801 | 2015-01-22 13:34:21 +0000 | [diff] [blame] | 1983 | run_test "Default, DTLS" \ |
| 1984 | "$P_SRV dtls=1" \ |
| 1985 | "$P_CLI dtls=1" \ |
| 1986 | 0 \ |
| 1987 | -s "Protocol is DTLSv1.2" \ |
Manuel Pégourié-Gonnard | ce66d5e | 2018-06-14 11:11:15 +0200 | [diff] [blame] | 1988 | -s "Ciphersuite is TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256" |
Manuel Pégourié-Gonnard | 3bb0801 | 2015-01-22 13:34:21 +0000 | [diff] [blame] | 1989 | |
Ronald Cron | c564938 | 2023-04-04 15:33:42 +0200 | [diff] [blame] | 1990 | # GnuTLS can be setup to send a ClientHello containing a supported versions |
| 1991 | # extension proposing TLS 1.2 (preferred) and then TLS 1.3. In that case, |
| 1992 | # a TLS 1.3 and TLS 1.2 capable server is supposed to negotiate TLS 1.2 and |
| 1993 | # to indicate in the ServerHello that it downgrades from TLS 1.3. The GnuTLS |
| 1994 | # client then detects the downgrade indication and aborts the handshake even |
| 1995 | # if TLS 1.2 was its preferred version. Keeping the test even if the |
| 1996 | # handshake fails eventually as it exercices parts of the Mbed TLS |
| 1997 | # implementation that are otherwise not exercised. |
Ronald Cron | d120bd6 | 2023-03-14 15:43:17 +0100 | [diff] [blame] | 1998 | requires_gnutls_tls1_3 |
| 1999 | requires_config_enabled MBEDTLS_DEBUG_C |
| 2000 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 2001 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ronald Cron | c564938 | 2023-04-04 15:33:42 +0200 | [diff] [blame] | 2002 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
Ronald Cron | d120bd6 | 2023-03-14 15:43:17 +0100 | [diff] [blame] | 2003 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Ronald Cron | c564938 | 2023-04-04 15:33:42 +0200 | [diff] [blame] | 2004 | run_test "Server selecting TLS 1.2 over TLS 1.3" \ |
| 2005 | "$P_SRV crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
| 2006 | "$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3" \ |
| 2007 | 1 \ |
| 2008 | -c "Detected downgrade to TLS 1.2 from TLS 1.3" |
| 2009 | |
| 2010 | requires_gnutls_tls1_3 |
| 2011 | requires_config_enabled MBEDTLS_DEBUG_C |
| 2012 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 2013 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
| 2014 | requires_config_disabled MBEDTLS_SSL_PROTO_TLS1_3 |
| 2015 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
| 2016 | run_test "Server selecting TLS 1.2" \ |
Ronald Cron | d120bd6 | 2023-03-14 15:43:17 +0100 | [diff] [blame] | 2017 | "$P_SRV crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
| 2018 | "$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3" \ |
| 2019 | 0 \ |
| 2020 | -s "Protocol is TLSv1.2" \ |
| 2021 | -c "HTTP/1.0 200 OK" |
| 2022 | |
| 2023 | requires_gnutls_tls1_3 |
| 2024 | requires_config_enabled MBEDTLS_DEBUG_C |
| 2025 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 2026 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
| 2027 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | 1a353ea | 2023-04-04 14:55:57 +0200 | [diff] [blame] | 2028 | run_test "Server selecting TLS 1.3, over TLS 1.2 if supported" \ |
Ronald Cron | d120bd6 | 2023-03-14 15:43:17 +0100 | [diff] [blame] | 2029 | "$P_SRV crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
| 2030 | "$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2:%DISABLE_TLS13_COMPAT_MODE" \ |
| 2031 | 0 \ |
| 2032 | -s "Protocol is TLSv1.3" \ |
| 2033 | -c "HTTP/1.0 200 OK" |
| 2034 | |
| 2035 | requires_gnutls_tls1_3 |
| 2036 | requires_config_enabled MBEDTLS_DEBUG_C |
| 2037 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 2038 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
| 2039 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 2040 | requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
Ronald Cron | 1a353ea | 2023-04-04 14:55:57 +0200 | [diff] [blame] | 2041 | run_test "Server selecting TLS 1.3, over TLS 1.2 if supported - compat mode enabled" \ |
Ronald Cron | d120bd6 | 2023-03-14 15:43:17 +0100 | [diff] [blame] | 2042 | "$P_SRV crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
| 2043 | "$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2" \ |
| 2044 | 0 \ |
| 2045 | -s "Protocol is TLSv1.3" \ |
| 2046 | -c "HTTP/1.0 200 OK" |
| 2047 | |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 2048 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Hanno Becker | 721f7c1 | 2020-08-17 12:17:32 +0100 | [diff] [blame] | 2049 | run_test "TLS client auth: required" \ |
| 2050 | "$P_SRV auth_mode=required" \ |
| 2051 | "$P_CLI" \ |
| 2052 | 0 \ |
| 2053 | -s "Verifying peer X.509 certificate... ok" |
| 2054 | |
Glenn Strauss | 6eef563 | 2022-01-23 08:37:02 -0500 | [diff] [blame] | 2055 | run_test "key size: TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2056 | "$P_SRV" \ |
| 2057 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2058 | 0 \ |
| 2059 | -c "Ciphersuite is TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2060 | -c "Key size is 256" |
| 2061 | |
| 2062 | run_test "key size: TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2063 | "$P_SRV" \ |
| 2064 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2065 | 0 \ |
| 2066 | -c "Ciphersuite is TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2067 | -c "Key size is 128" |
| 2068 | |
Hanno Becker | 2f54a3c | 2020-08-17 12:14:06 +0100 | [diff] [blame] | 2069 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2070 | requires_hash_alg SHA_256 |
Hanno Becker | 2f54a3c | 2020-08-17 12:14:06 +0100 | [diff] [blame] | 2071 | run_test "TLS: password protected client key" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2072 | "$P_SRV force_version=tls12 auth_mode=required" \ |
Hanno Becker | 2f54a3c | 2020-08-17 12:14:06 +0100 | [diff] [blame] | 2073 | "$P_CLI crt_file=data_files/server5.crt key_file=data_files/server5.key.enc key_pwd=PolarSSLTest" \ |
| 2074 | 0 |
| 2075 | |
| 2076 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2077 | requires_hash_alg SHA_256 |
Hanno Becker | 2f54a3c | 2020-08-17 12:14:06 +0100 | [diff] [blame] | 2078 | run_test "TLS: password protected server key" \ |
| 2079 | "$P_SRV crt_file=data_files/server5.crt key_file=data_files/server5.key.enc key_pwd=PolarSSLTest" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2080 | "$P_CLI force_version=tls12" \ |
Hanno Becker | 2f54a3c | 2020-08-17 12:14:06 +0100 | [diff] [blame] | 2081 | 0 |
| 2082 | |
| 2083 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Hanno Becker | 2f54a3c | 2020-08-17 12:14:06 +0100 | [diff] [blame] | 2084 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2085 | requires_hash_alg SHA_256 |
Hanno Becker | 2f54a3c | 2020-08-17 12:14:06 +0100 | [diff] [blame] | 2086 | run_test "TLS: password protected server key, two certificates" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2087 | "$P_SRV force_version=tls12\ |
Hanno Becker | 2f54a3c | 2020-08-17 12:14:06 +0100 | [diff] [blame] | 2088 | key_file=data_files/server5.key.enc key_pwd=PolarSSLTest crt_file=data_files/server5.crt \ |
| 2089 | key_file2=data_files/server2.key.enc key_pwd2=PolarSSLTest crt_file2=data_files/server2.crt" \ |
| 2090 | "$P_CLI" \ |
| 2091 | 0 |
| 2092 | |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 2093 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 2094 | run_test "CA callback on client" \ |
| 2095 | "$P_SRV debug_level=3" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 2096 | "$P_CLI force_version=tls12 ca_callback=1 debug_level=3 " \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 2097 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 2098 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 2099 | -S "error" \ |
| 2100 | -C "error" |
| 2101 | |
| 2102 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 2103 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2104 | requires_hash_alg SHA_256 |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 2105 | run_test "CA callback on server" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 2106 | "$P_SRV force_version=tls12 auth_mode=required" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 2107 | "$P_CLI ca_callback=1 debug_level=3 crt_file=data_files/server5.crt \ |
| 2108 | key_file=data_files/server5.key" \ |
| 2109 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 2110 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 2111 | -s "Verifying peer X.509 certificate... ok" \ |
| 2112 | -S "error" \ |
| 2113 | -C "error" |
| 2114 | |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2115 | # Test using an EC opaque private key for client authentication |
Manuel Pégourié-Gonnard | cfdf8f4 | 2018-11-08 09:52:25 +0100 | [diff] [blame] | 2116 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2117 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Valerio Setti | d1f991c | 2023-02-22 12:54:13 +0100 | [diff] [blame] | 2118 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2119 | requires_hash_alg SHA_256 |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2120 | run_test "Opaque key for client authentication: ECDHE-ECDSA" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2121 | "$P_SRV force_version=tls12 auth_mode=required crt_file=data_files/server5.crt \ |
Przemyslaw Stekiel | bb5d483 | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 2122 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | cfdf8f4 | 2018-11-08 09:52:25 +0100 | [diff] [blame] | 2123 | "$P_CLI key_opaque=1 crt_file=data_files/server5.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2124 | key_file=data_files/server5.key key_opaque_algs=ecdsa-sign,none" \ |
Manuel Pégourié-Gonnard | cfdf8f4 | 2018-11-08 09:52:25 +0100 | [diff] [blame] | 2125 | 0 \ |
| 2126 | -c "key type: Opaque" \ |
Przemyslaw Stekiel | bb5d483 | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 2127 | -c "Ciphersuite is TLS-ECDHE-ECDSA" \ |
Manuel Pégourié-Gonnard | cfdf8f4 | 2018-11-08 09:52:25 +0100 | [diff] [blame] | 2128 | -s "Verifying peer X.509 certificate... ok" \ |
Przemyslaw Stekiel | bb5d483 | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 2129 | -s "Ciphersuite is TLS-ECDHE-ECDSA" \ |
Manuel Pégourié-Gonnard | cfdf8f4 | 2018-11-08 09:52:25 +0100 | [diff] [blame] | 2130 | -S "error" \ |
| 2131 | -C "error" |
| 2132 | |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2133 | # Test using a RSA opaque private key for client authentication |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2134 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2135 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2136 | requires_config_enabled MBEDTLS_RSA_C |
valerio | f27472b | 2023-03-09 16:19:35 +0100 | [diff] [blame] | 2137 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2138 | requires_hash_alg SHA_256 |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2139 | run_test "Opaque key for client authentication: ECDHE-RSA" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2140 | "$P_SRV force_version=tls12 auth_mode=required crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2141 | key_file=data_files/server2.key" \ |
| 2142 | "$P_CLI key_opaque=1 crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2143 | key_file=data_files/server2.key key_opaque_algs=rsa-sign-pkcs1,none" \ |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2144 | 0 \ |
| 2145 | -c "key type: Opaque" \ |
| 2146 | -c "Ciphersuite is TLS-ECDHE-RSA" \ |
| 2147 | -s "Verifying peer X.509 certificate... ok" \ |
| 2148 | -s "Ciphersuite is TLS-ECDHE-RSA" \ |
| 2149 | -S "error" \ |
| 2150 | -C "error" |
| 2151 | |
Neil Armstrong | a4dbfdd | 2022-03-21 10:11:07 +0100 | [diff] [blame] | 2152 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2153 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
| 2154 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2155 | requires_hash_alg SHA_256 |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2156 | run_test "Opaque key for client authentication: DHE-RSA" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2157 | "$P_SRV force_version=tls12 auth_mode=required crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | a4dbfdd | 2022-03-21 10:11:07 +0100 | [diff] [blame] | 2158 | key_file=data_files/server2.key" \ |
| 2159 | "$P_CLI key_opaque=1 crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2160 | key_file=data_files/server2.key force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 2161 | key_opaque_algs=rsa-sign-pkcs1,none" \ |
Neil Armstrong | a4dbfdd | 2022-03-21 10:11:07 +0100 | [diff] [blame] | 2162 | 0 \ |
| 2163 | -c "key type: Opaque" \ |
| 2164 | -c "Ciphersuite is TLS-DHE-RSA" \ |
| 2165 | -s "Verifying peer X.509 certificate... ok" \ |
| 2166 | -s "Ciphersuite is TLS-DHE-RSA" \ |
| 2167 | -S "error" \ |
| 2168 | -C "error" |
| 2169 | |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2170 | # Test using an EC opaque private key for server authentication |
Przemyslaw Stekiel | 0483e3d | 2021-10-04 11:13:22 +0200 | [diff] [blame] | 2171 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2172 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Valerio Setti | d1f991c | 2023-02-22 12:54:13 +0100 | [diff] [blame] | 2173 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2174 | requires_hash_alg SHA_256 |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2175 | run_test "Opaque key for server authentication: ECDHE-ECDSA" \ |
Neil Armstrong | 7999cb3 | 2022-07-01 09:51:33 +0200 | [diff] [blame] | 2176 | "$P_SRV key_opaque=1 crt_file=data_files/server5.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2177 | key_file=data_files/server5.key key_opaque_algs=ecdsa-sign,none" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2178 | "$P_CLI force_version=tls12" \ |
Przemyslaw Stekiel | 0483e3d | 2021-10-04 11:13:22 +0200 | [diff] [blame] | 2179 | 0 \ |
| 2180 | -c "Verifying peer X.509 certificate... ok" \ |
Przemyslaw Stekiel | bb5d483 | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 2181 | -c "Ciphersuite is TLS-ECDHE-ECDSA" \ |
Gilles Peskine | 05bf89d | 2022-01-25 17:50:25 +0100 | [diff] [blame] | 2182 | -s "key types: Opaque, none" \ |
Przemyslaw Stekiel | bb5d483 | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 2183 | -s "Ciphersuite is TLS-ECDHE-ECDSA" \ |
Przemyslaw Stekiel | 0483e3d | 2021-10-04 11:13:22 +0200 | [diff] [blame] | 2184 | -S "error" \ |
| 2185 | -C "error" |
| 2186 | |
Neil Armstrong | 023bf8d | 2022-03-23 14:04:04 +0100 | [diff] [blame] | 2187 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2188 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2189 | requires_hash_alg SHA_256 |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2190 | run_test "Opaque key for server authentication: ECDH-" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2191 | "$P_SRV auth_mode=required key_opaque=1\ |
Neil Armstrong | b7b549a | 2022-03-25 15:13:02 +0100 | [diff] [blame] | 2192 | crt_file=data_files/server5.ku-ka.crt\ |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2193 | key_file=data_files/server5.key key_opaque_algs=ecdh,none" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2194 | "$P_CLI force_version=tls12" \ |
Neil Armstrong | 023bf8d | 2022-03-23 14:04:04 +0100 | [diff] [blame] | 2195 | 0 \ |
| 2196 | -c "Verifying peer X.509 certificate... ok" \ |
| 2197 | -c "Ciphersuite is TLS-ECDH-" \ |
| 2198 | -s "key types: Opaque, none" \ |
| 2199 | -s "Ciphersuite is TLS-ECDH-" \ |
| 2200 | -S "error" \ |
| 2201 | -C "error" |
| 2202 | |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2203 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2204 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Andrzej Kurek | d681746 | 2022-09-06 14:32:00 -0400 | [diff] [blame] | 2205 | requires_config_disabled MBEDTLS_SSL_ASYNC_PRIVATE |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2206 | requires_hash_alg SHA_256 |
Andrzej Kurek | d681746 | 2022-09-06 14:32:00 -0400 | [diff] [blame] | 2207 | run_test "Opaque key for server authentication: invalid key: decrypt with ECC key, no async" \ |
| 2208 | "$P_SRV key_opaque=1 crt_file=data_files/server5.crt \ |
| 2209 | key_file=data_files/server5.key key_opaque_algs=rsa-decrypt,none \ |
| 2210 | debug_level=1" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2211 | "$P_CLI force_version=tls12" \ |
Andrzej Kurek | d681746 | 2022-09-06 14:32:00 -0400 | [diff] [blame] | 2212 | 1 \ |
| 2213 | -s "key types: Opaque, none" \ |
| 2214 | -s "error" \ |
| 2215 | -c "error" \ |
| 2216 | -c "Public key type mismatch" |
| 2217 | |
Andrzej Kurek | d681746 | 2022-09-06 14:32:00 -0400 | [diff] [blame] | 2218 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2219 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
| 2220 | requires_config_enabled MBEDTLS_ECDSA_C |
| 2221 | requires_config_enabled MBEDTLS_RSA_C |
| 2222 | requires_config_disabled MBEDTLS_SSL_ASYNC_PRIVATE |
| 2223 | requires_hash_alg SHA_256 |
| 2224 | run_test "Opaque key for server authentication: invalid key: ecdh with RSA key, no async" \ |
| 2225 | "$P_SRV key_opaque=1 crt_file=data_files/server2-sha256.crt \ |
| 2226 | key_file=data_files/server2.key key_opaque_algs=ecdh,none \ |
| 2227 | debug_level=1" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2228 | "$P_CLI force_version=tls12" \ |
Andrzej Kurek | d681746 | 2022-09-06 14:32:00 -0400 | [diff] [blame] | 2229 | 1 \ |
| 2230 | -s "key types: Opaque, none" \ |
| 2231 | -s "error" \ |
| 2232 | -c "error" \ |
| 2233 | -c "Public key type mismatch" |
| 2234 | |
Andrzej Kurek | d681746 | 2022-09-06 14:32:00 -0400 | [diff] [blame] | 2235 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2236 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Andrzej Kurek | d681746 | 2022-09-06 14:32:00 -0400 | [diff] [blame] | 2237 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
| 2238 | requires_hash_alg SHA_256 |
| 2239 | run_test "Opaque key for server authentication: invalid alg: decrypt with ECC key, async" \ |
Neil Armstrong | 7999cb3 | 2022-07-01 09:51:33 +0200 | [diff] [blame] | 2240 | "$P_SRV key_opaque=1 crt_file=data_files/server5.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2241 | key_file=data_files/server5.key key_opaque_algs=rsa-decrypt,none \ |
| 2242 | debug_level=1" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2243 | "$P_CLI force_version=tls12" \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2244 | 1 \ |
| 2245 | -s "key types: Opaque, none" \ |
| 2246 | -s "got ciphersuites in common, but none of them usable" \ |
| 2247 | -s "error" \ |
| 2248 | -c "error" |
| 2249 | |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2250 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2251 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Neil Armstrong | eb4390b | 2022-05-27 10:26:02 +0200 | [diff] [blame] | 2252 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | d681746 | 2022-09-06 14:32:00 -0400 | [diff] [blame] | 2253 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2254 | requires_hash_alg SHA_256 |
Andrzej Kurek | d681746 | 2022-09-06 14:32:00 -0400 | [diff] [blame] | 2255 | run_test "Opaque key for server authentication: invalid alg: ecdh with RSA key, async" \ |
Neil Armstrong | 7999cb3 | 2022-07-01 09:51:33 +0200 | [diff] [blame] | 2256 | "$P_SRV key_opaque=1 crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | eb4390b | 2022-05-27 10:26:02 +0200 | [diff] [blame] | 2257 | key_file=data_files/server2.key key_opaque_algs=ecdh,none \ |
| 2258 | debug_level=1" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2259 | "$P_CLI force_version=tls12" \ |
Neil Armstrong | eb4390b | 2022-05-27 10:26:02 +0200 | [diff] [blame] | 2260 | 1 \ |
| 2261 | -s "key types: Opaque, none" \ |
| 2262 | -s "got ciphersuites in common, but none of them usable" \ |
| 2263 | -s "error" \ |
| 2264 | -c "error" |
| 2265 | |
Neil Armstrong | eb4390b | 2022-05-27 10:26:02 +0200 | [diff] [blame] | 2266 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2267 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2268 | requires_hash_alg SHA_256 |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2269 | requires_config_enabled MBEDTLS_CCM_C |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2270 | run_test "Opaque key for server authentication: invalid alg: ECDHE-ECDSA with ecdh" \ |
Neil Armstrong | 7999cb3 | 2022-07-01 09:51:33 +0200 | [diff] [blame] | 2271 | "$P_SRV key_opaque=1 crt_file=data_files/server5.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2272 | key_file=data_files/server5.key key_opaque_algs=ecdh,none \ |
| 2273 | debug_level=1" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2274 | "$P_CLI force_version=tls12 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-CCM" \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2275 | 1 \ |
| 2276 | -s "key types: Opaque, none" \ |
| 2277 | -s "got ciphersuites in common, but none of them usable" \ |
| 2278 | -s "error" \ |
| 2279 | -c "error" |
| 2280 | |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2281 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2282 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Valerio Setti | d1f991c | 2023-02-22 12:54:13 +0100 | [diff] [blame] | 2283 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2284 | requires_hash_alg SHA_256 |
Neil Armstrong | c67e6e9 | 2022-07-01 15:48:10 +0200 | [diff] [blame] | 2285 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
Neil Armstrong | 4b10209 | 2022-07-01 09:42:29 +0200 | [diff] [blame] | 2286 | run_test "Opaque keys for server authentication: EC keys with different algs, force ECDHE-ECDSA" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2287 | "$P_SRV force_version=tls12 key_opaque=1 crt_file=data_files/server7.crt \ |
Neil Armstrong | 4b10209 | 2022-07-01 09:42:29 +0200 | [diff] [blame] | 2288 | key_file=data_files/server7.key key_opaque_algs=ecdh,none \ |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2289 | crt_file2=data_files/server5.crt key_file2=data_files/server5.key \ |
| 2290 | key_opaque_algs2=ecdsa-sign,none" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2291 | "$P_CLI force_version=tls12" \ |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2292 | 0 \ |
| 2293 | -c "Verifying peer X.509 certificate... ok" \ |
| 2294 | -c "Ciphersuite is TLS-ECDHE-ECDSA" \ |
Neil Armstrong | 4b10209 | 2022-07-01 09:42:29 +0200 | [diff] [blame] | 2295 | -c "CN=Polarssl Test EC CA" \ |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2296 | -s "key types: Opaque, Opaque" \ |
| 2297 | -s "Ciphersuite is TLS-ECDHE-ECDSA" \ |
| 2298 | -S "error" \ |
| 2299 | -C "error" |
| 2300 | |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2301 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2302 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2303 | requires_hash_alg SHA_384 |
Neil Armstrong | c67e6e9 | 2022-07-01 15:48:10 +0200 | [diff] [blame] | 2304 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
Neil Armstrong | 4b10209 | 2022-07-01 09:42:29 +0200 | [diff] [blame] | 2305 | run_test "Opaque keys for server authentication: EC keys with different algs, force ECDH-ECDSA" \ |
Neil Armstrong | 7999cb3 | 2022-07-01 09:51:33 +0200 | [diff] [blame] | 2306 | "$P_SRV key_opaque=1 crt_file=data_files/server7.crt \ |
Neil Armstrong | 4b10209 | 2022-07-01 09:42:29 +0200 | [diff] [blame] | 2307 | key_file=data_files/server7.key key_opaque_algs=ecdsa-sign,none \ |
| 2308 | crt_file2=data_files/server5.crt key_file2=data_files/server5.key \ |
| 2309 | key_opaque_algs2=ecdh,none debug_level=3" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2310 | "$P_CLI force_version=tls12 force_ciphersuite=TLS-ECDH-ECDSA-WITH-CAMELLIA-256-CBC-SHA384" \ |
Neil Armstrong | 4b10209 | 2022-07-01 09:42:29 +0200 | [diff] [blame] | 2311 | 0 \ |
| 2312 | -c "Verifying peer X.509 certificate... ok" \ |
| 2313 | -c "Ciphersuite is TLS-ECDH-ECDSA" \ |
| 2314 | -c "CN=Polarssl Test EC CA" \ |
| 2315 | -s "key types: Opaque, Opaque" \ |
| 2316 | -s "Ciphersuite is TLS-ECDH-ECDSA" \ |
| 2317 | -S "error" \ |
| 2318 | -C "error" |
| 2319 | |
Neil Armstrong | 4b10209 | 2022-07-01 09:42:29 +0200 | [diff] [blame] | 2320 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2321 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2322 | requires_hash_alg SHA_384 |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2323 | requires_config_enabled MBEDTLS_CCM_C |
Neil Armstrong | c67e6e9 | 2022-07-01 15:48:10 +0200 | [diff] [blame] | 2324 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2325 | run_test "Opaque keys for server authentication: EC + RSA, force ECDHE-ECDSA" \ |
Neil Armstrong | 7999cb3 | 2022-07-01 09:51:33 +0200 | [diff] [blame] | 2326 | "$P_SRV key_opaque=1 crt_file=data_files/server5.crt \ |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2327 | key_file=data_files/server5.key key_opaque_algs=ecdsa-sign,none \ |
| 2328 | crt_file2=data_files/server2-sha256.crt \ |
| 2329 | key_file2=data_files/server2.key key_opaque_algs2=rsa-sign-pkcs1,none" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2330 | "$P_CLI force_version=tls12 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-CCM" \ |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2331 | 0 \ |
| 2332 | -c "Verifying peer X.509 certificate... ok" \ |
| 2333 | -c "Ciphersuite is TLS-ECDHE-ECDSA" \ |
Neil Armstrong | 4b10209 | 2022-07-01 09:42:29 +0200 | [diff] [blame] | 2334 | -c "CN=Polarssl Test EC CA" \ |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2335 | -s "key types: Opaque, Opaque" \ |
| 2336 | -s "Ciphersuite is TLS-ECDHE-ECDSA" \ |
| 2337 | -S "error" \ |
| 2338 | -C "error" |
| 2339 | |
Przemek Stekiel | c454aba | 2022-07-07 09:56:13 +0200 | [diff] [blame] | 2340 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
| 2341 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2342 | requires_config_enabled MBEDTLS_RSA_C |
Jerry Yu | ddda050 | 2022-12-01 19:43:12 +0800 | [diff] [blame] | 2343 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 2344 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 6ec2123 | 2022-09-16 16:41:53 +0200 | [diff] [blame] | 2345 | run_test "TLS 1.3 opaque key: no suitable algorithm found" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 2346 | "$P_SRV debug_level=4 auth_mode=required key_opaque=1 key_opaque_algs=rsa-decrypt,none" \ |
Ronald Cron | e3196d2 | 2022-09-16 16:43:35 +0200 | [diff] [blame] | 2347 | "$P_CLI debug_level=4 key_opaque=1 key_opaque_algs=rsa-decrypt,rsa-sign-pss" \ |
Przemek Stekiel | c454aba | 2022-07-07 09:56:13 +0200 | [diff] [blame] | 2348 | 1 \ |
Przemek Stekiel | c454aba | 2022-07-07 09:56:13 +0200 | [diff] [blame] | 2349 | -c "key type: Opaque" \ |
| 2350 | -s "key types: Opaque, Opaque" \ |
| 2351 | -c "error" \ |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 2352 | -s "no suitable signature algorithm" |
Przemek Stekiel | c454aba | 2022-07-07 09:56:13 +0200 | [diff] [blame] | 2353 | |
| 2354 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
| 2355 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2356 | requires_config_enabled MBEDTLS_RSA_C |
Jerry Yu | ddda050 | 2022-12-01 19:43:12 +0800 | [diff] [blame] | 2357 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 2358 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 6ec2123 | 2022-09-16 16:41:53 +0200 | [diff] [blame] | 2359 | run_test "TLS 1.3 opaque key: suitable algorithm found" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 2360 | "$P_SRV debug_level=4 auth_mode=required key_opaque=1 key_opaque_algs=rsa-decrypt,rsa-sign-pss" \ |
Ronald Cron | e3196d2 | 2022-09-16 16:43:35 +0200 | [diff] [blame] | 2361 | "$P_CLI debug_level=4 key_opaque=1 key_opaque_algs=rsa-decrypt,rsa-sign-pss" \ |
Przemek Stekiel | c454aba | 2022-07-07 09:56:13 +0200 | [diff] [blame] | 2362 | 0 \ |
Przemek Stekiel | c454aba | 2022-07-07 09:56:13 +0200 | [diff] [blame] | 2363 | -c "key type: Opaque" \ |
| 2364 | -s "key types: Opaque, Opaque" \ |
| 2365 | -C "error" \ |
Jerry Yu | ddda050 | 2022-12-01 19:43:12 +0800 | [diff] [blame] | 2366 | -S "error" |
Przemek Stekiel | c454aba | 2022-07-07 09:56:13 +0200 | [diff] [blame] | 2367 | |
| 2368 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
| 2369 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2370 | requires_config_enabled MBEDTLS_RSA_C |
Jerry Yu | ddda050 | 2022-12-01 19:43:12 +0800 | [diff] [blame] | 2371 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 2372 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 50969e3 | 2022-09-16 15:54:33 +0200 | [diff] [blame] | 2373 | run_test "TLS 1.3 opaque key: first client sig alg not suitable" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 2374 | "$P_SRV debug_level=4 auth_mode=required key_opaque=1 key_opaque_algs=rsa-sign-pss-sha512,none" \ |
Ronald Cron | 50969e3 | 2022-09-16 15:54:33 +0200 | [diff] [blame] | 2375 | "$P_CLI debug_level=4 sig_algs=rsa_pss_rsae_sha256,rsa_pss_rsae_sha512" \ |
| 2376 | 0 \ |
Ronald Cron | 50969e3 | 2022-09-16 15:54:33 +0200 | [diff] [blame] | 2377 | -s "key types: Opaque, Opaque" \ |
| 2378 | -s "CertificateVerify signature failed with rsa_pss_rsae_sha256" \ |
| 2379 | -s "CertificateVerify signature with rsa_pss_rsae_sha512" \ |
| 2380 | -C "error" \ |
| 2381 | -S "error" \ |
| 2382 | |
| 2383 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
| 2384 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2385 | requires_config_enabled MBEDTLS_RSA_C |
Jerry Yu | ddda050 | 2022-12-01 19:43:12 +0800 | [diff] [blame] | 2386 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 2387 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 6ec2123 | 2022-09-16 16:41:53 +0200 | [diff] [blame] | 2388 | run_test "TLS 1.3 opaque key: 2 keys on server, suitable algorithm found" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 2389 | "$P_SRV debug_level=4 auth_mode=required key_opaque=1 key_opaque_algs2=ecdsa-sign,none key_opaque_algs=rsa-decrypt,rsa-sign-pss" \ |
Ronald Cron | e3196d2 | 2022-09-16 16:43:35 +0200 | [diff] [blame] | 2390 | "$P_CLI debug_level=4 key_opaque=1 key_opaque_algs=rsa-decrypt,rsa-sign-pss" \ |
Przemek Stekiel | c454aba | 2022-07-07 09:56:13 +0200 | [diff] [blame] | 2391 | 0 \ |
Przemek Stekiel | c454aba | 2022-07-07 09:56:13 +0200 | [diff] [blame] | 2392 | -c "key type: Opaque" \ |
| 2393 | -s "key types: Opaque, Opaque" \ |
| 2394 | -C "error" \ |
| 2395 | -S "error" \ |
| 2396 | |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2397 | # Test using a RSA opaque private key for server authentication |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2398 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2399 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2400 | requires_config_enabled MBEDTLS_RSA_C |
valerio | f27472b | 2023-03-09 16:19:35 +0100 | [diff] [blame] | 2401 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2402 | requires_hash_alg SHA_256 |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2403 | run_test "Opaque key for server authentication: ECDHE-RSA" \ |
Neil Armstrong | 7999cb3 | 2022-07-01 09:51:33 +0200 | [diff] [blame] | 2404 | "$P_SRV key_opaque=1 crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2405 | key_file=data_files/server2.key key_opaque_algs=rsa-sign-pkcs1,none" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2406 | "$P_CLI force_version=tls12" \ |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2407 | 0 \ |
| 2408 | -c "Verifying peer X.509 certificate... ok" \ |
| 2409 | -c "Ciphersuite is TLS-ECDHE-RSA" \ |
| 2410 | -s "key types: Opaque, none" \ |
| 2411 | -s "Ciphersuite is TLS-ECDHE-RSA" \ |
| 2412 | -S "error" \ |
| 2413 | -C "error" |
| 2414 | |
Neil Armstrong | a4dbfdd | 2022-03-21 10:11:07 +0100 | [diff] [blame] | 2415 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2416 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Neil Armstrong | a4dbfdd | 2022-03-21 10:11:07 +0100 | [diff] [blame] | 2417 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2418 | requires_hash_alg SHA_256 |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2419 | run_test "Opaque key for server authentication: DHE-RSA" \ |
Neil Armstrong | 7999cb3 | 2022-07-01 09:51:33 +0200 | [diff] [blame] | 2420 | "$P_SRV key_opaque=1 crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2421 | key_file=data_files/server2.key key_opaque_algs=rsa-sign-pkcs1,none" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2422 | "$P_CLI force_version=tls12 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
Neil Armstrong | a4dbfdd | 2022-03-21 10:11:07 +0100 | [diff] [blame] | 2423 | 0 \ |
| 2424 | -c "Verifying peer X.509 certificate... ok" \ |
| 2425 | -c "Ciphersuite is TLS-DHE-RSA" \ |
| 2426 | -s "key types: Opaque, none" \ |
| 2427 | -s "Ciphersuite is TLS-DHE-RSA" \ |
| 2428 | -S "error" \ |
| 2429 | -C "error" |
| 2430 | |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2431 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2432 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2433 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2434 | requires_hash_alg SHA_256 |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2435 | run_test "Opaque key for server authentication: RSA-PSK" \ |
| 2436 | "$P_SRV debug_level=1 key_opaque=1 key_opaque_algs=rsa-decrypt,none \ |
| 2437 | psk=abc123 psk_identity=foo" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2438 | "$P_CLI force_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA256 \ |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2439 | psk=abc123 psk_identity=foo" \ |
| 2440 | 0 \ |
| 2441 | -c "Verifying peer X.509 certificate... ok" \ |
| 2442 | -c "Ciphersuite is TLS-RSA-PSK-" \ |
| 2443 | -s "key types: Opaque, Opaque" \ |
| 2444 | -s "Ciphersuite is TLS-RSA-PSK-" \ |
| 2445 | -S "error" \ |
| 2446 | -C "error" |
| 2447 | |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2448 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2449 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
| 2450 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2451 | requires_hash_alg SHA_256 |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2452 | run_test "Opaque key for server authentication: RSA-" \ |
| 2453 | "$P_SRV debug_level=3 key_opaque=1 key_opaque_algs=rsa-decrypt,none " \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2454 | "$P_CLI force_version=tls12 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA256" \ |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2455 | 0 \ |
| 2456 | -c "Verifying peer X.509 certificate... ok" \ |
| 2457 | -c "Ciphersuite is TLS-RSA-" \ |
| 2458 | -s "key types: Opaque, Opaque" \ |
| 2459 | -s "Ciphersuite is TLS-RSA-" \ |
| 2460 | -S "error" \ |
| 2461 | -C "error" |
| 2462 | |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2463 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2464 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2465 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2466 | requires_hash_alg SHA_256 |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2467 | run_test "Opaque key for server authentication: DHE-RSA, PSS instead of PKCS1" \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2468 | "$P_SRV auth_mode=required key_opaque=1 crt_file=data_files/server2-sha256.crt \ |
| 2469 | key_file=data_files/server2.key key_opaque_algs=rsa-sign-pss,none debug_level=1" \ |
| 2470 | "$P_CLI crt_file=data_files/server2-sha256.crt \ |
| 2471 | key_file=data_files/server2.key force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 2472 | 1 \ |
| 2473 | -s "key types: Opaque, none" \ |
| 2474 | -s "got ciphersuites in common, but none of them usable" \ |
| 2475 | -s "error" \ |
| 2476 | -c "error" |
| 2477 | |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2478 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2479 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2480 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2481 | requires_hash_alg SHA_256 |
Neil Armstrong | c67e6e9 | 2022-07-01 15:48:10 +0200 | [diff] [blame] | 2482 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
valerio | f27472b | 2023-03-09 16:19:35 +0100 | [diff] [blame] | 2483 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2484 | run_test "Opaque keys for server authentication: RSA keys with different algs" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2485 | "$P_SRV force_version=tls12 auth_mode=required key_opaque=1 crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2486 | key_file=data_files/server2.key key_opaque_algs=rsa-sign-pss,none \ |
Neil Armstrong | 4b10209 | 2022-07-01 09:42:29 +0200 | [diff] [blame] | 2487 | crt_file2=data_files/server4.crt \ |
| 2488 | key_file2=data_files/server4.key key_opaque_algs2=rsa-sign-pkcs1,none" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2489 | "$P_CLI force_version=tls12" \ |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2490 | 0 \ |
| 2491 | -c "Verifying peer X.509 certificate... ok" \ |
| 2492 | -c "Ciphersuite is TLS-ECDHE-RSA" \ |
Neil Armstrong | 4b10209 | 2022-07-01 09:42:29 +0200 | [diff] [blame] | 2493 | -c "CN=Polarssl Test EC CA" \ |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2494 | -s "key types: Opaque, Opaque" \ |
| 2495 | -s "Ciphersuite is TLS-ECDHE-RSA" \ |
| 2496 | -S "error" \ |
| 2497 | -C "error" |
| 2498 | |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2499 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2500 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2501 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2502 | requires_hash_alg SHA_384 |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2503 | requires_config_enabled MBEDTLS_GCM_C |
Neil Armstrong | c67e6e9 | 2022-07-01 15:48:10 +0200 | [diff] [blame] | 2504 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2505 | run_test "Opaque keys for server authentication: EC + RSA, force DHE-RSA" \ |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2506 | "$P_SRV auth_mode=required key_opaque=1 crt_file=data_files/server5.crt \ |
| 2507 | key_file=data_files/server5.key key_opaque_algs=ecdsa-sign,none \ |
Neil Armstrong | 4b10209 | 2022-07-01 09:42:29 +0200 | [diff] [blame] | 2508 | crt_file2=data_files/server4.crt \ |
| 2509 | key_file2=data_files/server4.key key_opaque_algs2=rsa-sign-pkcs1,none" \ |
| 2510 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2511 | 0 \ |
| 2512 | -c "Verifying peer X.509 certificate... ok" \ |
| 2513 | -c "Ciphersuite is TLS-DHE-RSA" \ |
Neil Armstrong | 4b10209 | 2022-07-01 09:42:29 +0200 | [diff] [blame] | 2514 | -c "CN=Polarssl Test EC CA" \ |
Neil Armstrong | 167d82c | 2022-06-30 11:32:00 +0200 | [diff] [blame] | 2515 | -s "key types: Opaque, Opaque" \ |
| 2516 | -s "Ciphersuite is TLS-DHE-RSA" \ |
| 2517 | -S "error" \ |
| 2518 | -C "error" |
| 2519 | |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2520 | # Test using an EC opaque private key for client/server authentication |
Przemyslaw Stekiel | 575f23c | 2021-10-06 11:31:49 +0200 | [diff] [blame] | 2521 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2522 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Valerio Setti | d1f991c | 2023-02-22 12:54:13 +0100 | [diff] [blame] | 2523 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2524 | requires_hash_alg SHA_256 |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2525 | run_test "Opaque key for client/server authentication: ECDHE-ECDSA" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2526 | "$P_SRV force_version=tls12 auth_mode=required key_opaque=1 crt_file=data_files/server5.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2527 | key_file=data_files/server5.key key_opaque_algs=ecdsa-sign,none" \ |
Przemyslaw Stekiel | 575f23c | 2021-10-06 11:31:49 +0200 | [diff] [blame] | 2528 | "$P_CLI key_opaque=1 crt_file=data_files/server5.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2529 | key_file=data_files/server5.key key_opaque_algs=ecdsa-sign,none" \ |
Przemyslaw Stekiel | 575f23c | 2021-10-06 11:31:49 +0200 | [diff] [blame] | 2530 | 0 \ |
| 2531 | -c "key type: Opaque" \ |
| 2532 | -c "Verifying peer X.509 certificate... ok" \ |
Przemyslaw Stekiel | bb5d483 | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 2533 | -c "Ciphersuite is TLS-ECDHE-ECDSA" \ |
Gilles Peskine | 05bf89d | 2022-01-25 17:50:25 +0100 | [diff] [blame] | 2534 | -s "key types: Opaque, none" \ |
Przemyslaw Stekiel | 575f23c | 2021-10-06 11:31:49 +0200 | [diff] [blame] | 2535 | -s "Verifying peer X.509 certificate... ok" \ |
Przemyslaw Stekiel | bb5d483 | 2021-10-26 12:25:27 +0200 | [diff] [blame] | 2536 | -s "Ciphersuite is TLS-ECDHE-ECDSA" \ |
Simon Butcher | 8e00410 | 2016-10-14 00:48:33 +0100 | [diff] [blame] | 2537 | -S "error" \ |
| 2538 | -C "error" |
| 2539 | |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2540 | # Test using a RSA opaque private key for client/server authentication |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2541 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2542 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2543 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2544 | requires_hash_alg SHA_256 |
valerio | f27472b | 2023-03-09 16:19:35 +0100 | [diff] [blame] | 2545 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2546 | run_test "Opaque key for client/server authentication: ECDHE-RSA" \ |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2547 | "$P_SRV auth_mode=required key_opaque=1 crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2548 | key_file=data_files/server2.key key_opaque_algs=rsa-sign-pkcs1,none" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2549 | "$P_CLI force_version=tls12 key_opaque=1 crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2550 | key_file=data_files/server2.key key_opaque_algs=rsa-sign-pkcs1,none" \ |
Neil Armstrong | 3e9a142 | 2022-03-21 10:03:46 +0100 | [diff] [blame] | 2551 | 0 \ |
| 2552 | -c "key type: Opaque" \ |
| 2553 | -c "Verifying peer X.509 certificate... ok" \ |
| 2554 | -c "Ciphersuite is TLS-ECDHE-RSA" \ |
| 2555 | -s "key types: Opaque, none" \ |
| 2556 | -s "Verifying peer X.509 certificate... ok" \ |
| 2557 | -s "Ciphersuite is TLS-ECDHE-RSA" \ |
| 2558 | -S "error" \ |
| 2559 | -C "error" |
| 2560 | |
Neil Armstrong | a4dbfdd | 2022-03-21 10:11:07 +0100 | [diff] [blame] | 2561 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 2562 | requires_config_enabled MBEDTLS_X509_CRT_PARSE_C |
Neil Armstrong | a4dbfdd | 2022-03-21 10:11:07 +0100 | [diff] [blame] | 2563 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 2564 | requires_hash_alg SHA_256 |
Neil Armstrong | 1948a20 | 2022-06-30 18:05:57 +0200 | [diff] [blame] | 2565 | run_test "Opaque key for client/server authentication: DHE-RSA" \ |
Neil Armstrong | a4dbfdd | 2022-03-21 10:11:07 +0100 | [diff] [blame] | 2566 | "$P_SRV auth_mode=required key_opaque=1 crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2567 | key_file=data_files/server2.key key_opaque_algs=rsa-sign-pkcs1,none" \ |
Neil Armstrong | a4dbfdd | 2022-03-21 10:11:07 +0100 | [diff] [blame] | 2568 | "$P_CLI key_opaque=1 crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2569 | key_file=data_files/server2.key key_opaque_algs=rsa-sign-pkcs1,none \ |
| 2570 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
Neil Armstrong | a4dbfdd | 2022-03-21 10:11:07 +0100 | [diff] [blame] | 2571 | 0 \ |
| 2572 | -c "key type: Opaque" \ |
| 2573 | -c "Verifying peer X.509 certificate... ok" \ |
| 2574 | -c "Ciphersuite is TLS-DHE-RSA" \ |
| 2575 | -s "key types: Opaque, none" \ |
| 2576 | -s "Verifying peer X.509 certificate... ok" \ |
| 2577 | -s "Ciphersuite is TLS-DHE-RSA" \ |
| 2578 | -S "error" \ |
| 2579 | -C "error" |
| 2580 | |
Neil Armstrong | 36b0223 | 2022-06-30 11:16:53 +0200 | [diff] [blame] | 2581 | |
Hanno Becker | 9b5853c | 2018-11-16 17:28:40 +0000 | [diff] [blame] | 2582 | # Test ciphersuites which we expect to be fully supported by PSA Crypto |
| 2583 | # and check that we don't fall back to Mbed TLS' internal crypto primitives. |
| 2584 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-128-CCM |
| 2585 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8 |
| 2586 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-256-CCM |
| 2587 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-256-CCM-8 |
| 2588 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 |
| 2589 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 |
| 2590 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA |
| 2591 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 |
| 2592 | run_test_psa TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384 |
| 2593 | |
Hanno Becker | 354e248 | 2019-01-08 11:40:25 +0000 | [diff] [blame] | 2594 | requires_config_enabled MBEDTLS_ECP_DP_SECP521R1_ENABLED |
| 2595 | run_test_psa_force_curve "secp521r1" |
| 2596 | requires_config_enabled MBEDTLS_ECP_DP_BP512R1_ENABLED |
| 2597 | run_test_psa_force_curve "brainpoolP512r1" |
| 2598 | requires_config_enabled MBEDTLS_ECP_DP_SECP384R1_ENABLED |
| 2599 | run_test_psa_force_curve "secp384r1" |
| 2600 | requires_config_enabled MBEDTLS_ECP_DP_BP384R1_ENABLED |
| 2601 | run_test_psa_force_curve "brainpoolP384r1" |
| 2602 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
| 2603 | run_test_psa_force_curve "secp256r1" |
| 2604 | requires_config_enabled MBEDTLS_ECP_DP_SECP256K1_ENABLED |
| 2605 | run_test_psa_force_curve "secp256k1" |
| 2606 | requires_config_enabled MBEDTLS_ECP_DP_BP256R1_ENABLED |
| 2607 | run_test_psa_force_curve "brainpoolP256r1" |
| 2608 | requires_config_enabled MBEDTLS_ECP_DP_SECP224R1_ENABLED |
| 2609 | run_test_psa_force_curve "secp224r1" |
Gilles Peskine | defdc3b | 2021-03-23 13:59:58 +0100 | [diff] [blame] | 2610 | ## SECP224K1 is buggy via the PSA API |
Dave Rodgman | 017a199 | 2022-03-31 14:07:01 +0100 | [diff] [blame] | 2611 | ## (https://github.com/Mbed-TLS/mbedtls/issues/3541), |
Gilles Peskine | defdc3b | 2021-03-23 13:59:58 +0100 | [diff] [blame] | 2612 | ## so it is disabled in PSA even when it's enabled in Mbed TLS. |
| 2613 | ## The proper dependency would be on PSA_WANT_ECC_SECP_K1_224 but |
| 2614 | ## dependencies on PSA symbols in ssl-opt.sh are not implemented yet. |
| 2615 | #requires_config_enabled MBEDTLS_ECP_DP_SECP224K1_ENABLED |
| 2616 | #run_test_psa_force_curve "secp224k1" |
Hanno Becker | 354e248 | 2019-01-08 11:40:25 +0000 | [diff] [blame] | 2617 | requires_config_enabled MBEDTLS_ECP_DP_SECP192R1_ENABLED |
| 2618 | run_test_psa_force_curve "secp192r1" |
| 2619 | requires_config_enabled MBEDTLS_ECP_DP_SECP192K1_ENABLED |
| 2620 | run_test_psa_force_curve "secp192k1" |
| 2621 | |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2622 | # Test current time in ServerHello |
| 2623 | requires_config_enabled MBEDTLS_HAVE_TIME |
| 2624 | run_test "ServerHello contains gmt_unix_time" \ |
| 2625 | "$P_SRV debug_level=3" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2626 | "$P_CLI force_version=tls12 debug_level=3" \ |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2627 | 0 \ |
| 2628 | -f "check_server_hello_time" \ |
Manuel Pégourié-Gonnard | 51d8166 | 2015-01-14 17:20:46 +0100 | [diff] [blame] | 2629 | -F "check_server_hello_time" |
Manuel Pégourié-Gonnard | bd47a58 | 2015-01-12 13:43:29 +0100 | [diff] [blame] | 2630 | |
| 2631 | # Test for uniqueness of IVs in AEAD ciphersuites |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 2632 | run_test "Unique IV in GCM" \ |
| 2633 | "$P_SRV exchanges=20 debug_level=4" \ |
Manuel Pégourié-Gonnard | af63c21 | 2017-06-08 17:51:08 +0200 | [diff] [blame] | 2634 | "$P_CLI exchanges=20 debug_level=4 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 2635 | 0 \ |
| 2636 | -u "IV used" \ |
| 2637 | -U "IV used" |
| 2638 | |
Andrzej Kurek | ec71b09 | 2022-11-15 10:21:50 -0500 | [diff] [blame] | 2639 | # Test for correctness of sent single supported algorithm |
| 2640 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Andrzej Kurek | ec71b09 | 2022-11-15 10:21:50 -0500 | [diff] [blame] | 2641 | requires_config_enabled MBEDTLS_DEBUG_C |
| 2642 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Paul Elliott | 3b4ceda | 2022-11-17 12:47:10 +0000 | [diff] [blame] | 2643 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Valerio Setti | d1f991c | 2023-02-22 12:54:13 +0100 | [diff] [blame] | 2644 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
| 2645 | requires_pk_alg "ECDSA" |
Andrzej Kurek | ec71b09 | 2022-11-15 10:21:50 -0500 | [diff] [blame] | 2646 | requires_hash_alg SHA_256 |
Paul Elliott | f6e342c | 2022-11-17 12:50:29 +0000 | [diff] [blame] | 2647 | run_test "Single supported algorithm sending: mbedtls client" \ |
Andrzej Kurek | ec71b09 | 2022-11-15 10:21:50 -0500 | [diff] [blame] | 2648 | "$P_SRV sig_algs=ecdsa_secp256r1_sha256 auth_mode=required" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2649 | "$P_CLI force_version=tls12 sig_algs=ecdsa_secp256r1_sha256 debug_level=3" \ |
Andrzej Kurek | ec71b09 | 2022-11-15 10:21:50 -0500 | [diff] [blame] | 2650 | 0 \ |
| 2651 | -c "Supported Signature Algorithm found: 04 03" |
| 2652 | |
Paul Elliott | f6e342c | 2022-11-17 12:50:29 +0000 | [diff] [blame] | 2653 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
| 2654 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Paul Elliott | f6e342c | 2022-11-17 12:50:29 +0000 | [diff] [blame] | 2655 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
| 2656 | requires_hash_alg SHA_256 |
| 2657 | run_test "Single supported algorithm sending: openssl client" \ |
| 2658 | "$P_SRV sig_algs=ecdsa_secp256r1_sha256 auth_mode=required" \ |
| 2659 | "$O_CLI -cert data_files/server6.crt \ |
| 2660 | -key data_files/server6.key" \ |
| 2661 | 0 |
| 2662 | |
Janos Follath | ee11be6 | 2019-04-04 12:03:30 +0100 | [diff] [blame] | 2663 | # Tests for certificate verification callback |
| 2664 | run_test "Configuration-specific CRT verification callback" \ |
| 2665 | "$P_SRV debug_level=3" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 2666 | "$P_CLI force_version=tls12 context_crt_cb=0 debug_level=3" \ |
Janos Follath | ee11be6 | 2019-04-04 12:03:30 +0100 | [diff] [blame] | 2667 | 0 \ |
Janos Follath | ee11be6 | 2019-04-04 12:03:30 +0100 | [diff] [blame] | 2668 | -S "error" \ |
| 2669 | -c "Verify requested for " \ |
| 2670 | -c "Use configuration-specific verification callback" \ |
| 2671 | -C "Use context-specific verification callback" \ |
| 2672 | -C "error" |
| 2673 | |
Hanno Becker | efb440a | 2019-04-03 13:04:33 +0100 | [diff] [blame] | 2674 | run_test "Context-specific CRT verification callback" \ |
| 2675 | "$P_SRV debug_level=3" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 2676 | "$P_CLI force_version=tls12 context_crt_cb=1 debug_level=3" \ |
Hanno Becker | efb440a | 2019-04-03 13:04:33 +0100 | [diff] [blame] | 2677 | 0 \ |
Hanno Becker | efb440a | 2019-04-03 13:04:33 +0100 | [diff] [blame] | 2678 | -S "error" \ |
Janos Follath | ee11be6 | 2019-04-04 12:03:30 +0100 | [diff] [blame] | 2679 | -c "Verify requested for " \ |
| 2680 | -c "Use context-specific verification callback" \ |
| 2681 | -C "Use configuration-specific verification callback" \ |
Hanno Becker | efb440a | 2019-04-03 13:04:33 +0100 | [diff] [blame] | 2682 | -C "error" |
| 2683 | |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 2684 | # Tests for SHA-1 support |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 2685 | run_test "SHA-1 forbidden by default in server certificate" \ |
| 2686 | "$P_SRV key_file=data_files/server2.key crt_file=data_files/server2.crt" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2687 | "$P_CLI debug_level=2 force_version=tls12 allow_sha1=0" \ |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 2688 | 1 \ |
| 2689 | -c "The certificate is signed with an unacceptable hash" |
| 2690 | |
| 2691 | run_test "SHA-1 explicitly allowed in server certificate" \ |
| 2692 | "$P_SRV key_file=data_files/server2.key crt_file=data_files/server2.crt" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2693 | "$P_CLI force_version=tls12 allow_sha1=1" \ |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 2694 | 0 |
| 2695 | |
| 2696 | run_test "SHA-256 allowed by default in server certificate" \ |
| 2697 | "$P_SRV key_file=data_files/server2.key crt_file=data_files/server2-sha256.crt" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2698 | "$P_CLI force_version=tls12 allow_sha1=0" \ |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 2699 | 0 |
| 2700 | |
| 2701 | run_test "SHA-1 forbidden by default in client certificate" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2702 | "$P_SRV force_version=tls12 auth_mode=required allow_sha1=0" \ |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 2703 | "$P_CLI key_file=data_files/cli-rsa.key crt_file=data_files/cli-rsa-sha1.crt" \ |
| 2704 | 1 \ |
| 2705 | -s "The certificate is signed with an unacceptable hash" |
| 2706 | |
| 2707 | run_test "SHA-1 explicitly allowed in client certificate" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2708 | "$P_SRV force_version=tls12 auth_mode=required allow_sha1=1" \ |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 2709 | "$P_CLI key_file=data_files/cli-rsa.key crt_file=data_files/cli-rsa-sha1.crt" \ |
| 2710 | 0 |
| 2711 | |
| 2712 | run_test "SHA-256 allowed by default in client certificate" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 2713 | "$P_SRV force_version=tls12 auth_mode=required allow_sha1=0" \ |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 2714 | "$P_CLI key_file=data_files/cli-rsa.key crt_file=data_files/cli-rsa-sha256.crt" \ |
| 2715 | 0 |
| 2716 | |
Hanno Becker | 7ae8a76 | 2018-08-14 15:43:35 +0100 | [diff] [blame] | 2717 | # Tests for datagram packing |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2718 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 7ae8a76 | 2018-08-14 15:43:35 +0100 | [diff] [blame] | 2719 | run_test "DTLS: multiple records in same datagram, client and server" \ |
| 2720 | "$P_SRV dtls=1 dgram_packing=1 debug_level=2" \ |
| 2721 | "$P_CLI dtls=1 dgram_packing=1 debug_level=2" \ |
| 2722 | 0 \ |
| 2723 | -c "next record in same datagram" \ |
| 2724 | -s "next record in same datagram" |
| 2725 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2726 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 7ae8a76 | 2018-08-14 15:43:35 +0100 | [diff] [blame] | 2727 | run_test "DTLS: multiple records in same datagram, client only" \ |
| 2728 | "$P_SRV dtls=1 dgram_packing=0 debug_level=2" \ |
| 2729 | "$P_CLI dtls=1 dgram_packing=1 debug_level=2" \ |
| 2730 | 0 \ |
| 2731 | -s "next record in same datagram" \ |
| 2732 | -C "next record in same datagram" |
| 2733 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2734 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 7ae8a76 | 2018-08-14 15:43:35 +0100 | [diff] [blame] | 2735 | run_test "DTLS: multiple records in same datagram, server only" \ |
| 2736 | "$P_SRV dtls=1 dgram_packing=1 debug_level=2" \ |
| 2737 | "$P_CLI dtls=1 dgram_packing=0 debug_level=2" \ |
| 2738 | 0 \ |
| 2739 | -S "next record in same datagram" \ |
| 2740 | -c "next record in same datagram" |
| 2741 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2742 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 7ae8a76 | 2018-08-14 15:43:35 +0100 | [diff] [blame] | 2743 | run_test "DTLS: multiple records in same datagram, neither client nor server" \ |
| 2744 | "$P_SRV dtls=1 dgram_packing=0 debug_level=2" \ |
| 2745 | "$P_CLI dtls=1 dgram_packing=0 debug_level=2" \ |
| 2746 | 0 \ |
| 2747 | -S "next record in same datagram" \ |
| 2748 | -C "next record in same datagram" |
| 2749 | |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2750 | # Tests for Context serialization |
| 2751 | |
| 2752 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2753 | run_test "Context serialization, client serializes, CCM" \ |
Manuel Pégourié-Gonnard | 862b319 | 2019-07-23 14:13:43 +0200 | [diff] [blame] | 2754 | "$P_SRV dtls=1 serialize=0 exchanges=2" \ |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2755 | "$P_CLI dtls=1 serialize=1 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2756 | 0 \ |
| 2757 | -c "Deserializing connection..." \ |
| 2758 | -S "Deserializing connection..." |
| 2759 | |
| 2760 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2761 | run_test "Context serialization, client serializes, ChaChaPoly" \ |
| 2762 | "$P_SRV dtls=1 serialize=0 exchanges=2" \ |
| 2763 | "$P_CLI dtls=1 serialize=1 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2764 | 0 \ |
| 2765 | -c "Deserializing connection..." \ |
| 2766 | -S "Deserializing connection..." |
| 2767 | |
| 2768 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2769 | run_test "Context serialization, client serializes, GCM" \ |
| 2770 | "$P_SRV dtls=1 serialize=0 exchanges=2" \ |
| 2771 | "$P_CLI dtls=1 serialize=1 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2772 | 0 \ |
Jarno Lamsa | cbee1b3 | 2019-06-04 15:18:19 +0300 | [diff] [blame] | 2773 | -c "Deserializing connection..." \ |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2774 | -S "Deserializing connection..." |
| 2775 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2776 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2777 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | 1b18fd3 | 2019-08-30 11:18:59 +0100 | [diff] [blame] | 2778 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2779 | run_test "Context serialization, client serializes, with CID" \ |
| 2780 | "$P_SRV dtls=1 serialize=0 exchanges=2 cid=1 cid_val=dead" \ |
| 2781 | "$P_CLI dtls=1 serialize=1 exchanges=2 cid=1 cid_val=beef" \ |
| 2782 | 0 \ |
| 2783 | -c "Deserializing connection..." \ |
| 2784 | -S "Deserializing connection..." |
| 2785 | |
| 2786 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2787 | run_test "Context serialization, server serializes, CCM" \ |
Manuel Pégourié-Gonnard | 862b319 | 2019-07-23 14:13:43 +0200 | [diff] [blame] | 2788 | "$P_SRV dtls=1 serialize=1 exchanges=2" \ |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2789 | "$P_CLI dtls=1 serialize=0 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2790 | 0 \ |
| 2791 | -C "Deserializing connection..." \ |
| 2792 | -s "Deserializing connection..." |
| 2793 | |
| 2794 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2795 | run_test "Context serialization, server serializes, ChaChaPoly" \ |
| 2796 | "$P_SRV dtls=1 serialize=1 exchanges=2" \ |
| 2797 | "$P_CLI dtls=1 serialize=0 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2798 | 0 \ |
| 2799 | -C "Deserializing connection..." \ |
| 2800 | -s "Deserializing connection..." |
| 2801 | |
| 2802 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2803 | run_test "Context serialization, server serializes, GCM" \ |
| 2804 | "$P_SRV dtls=1 serialize=1 exchanges=2" \ |
| 2805 | "$P_CLI dtls=1 serialize=0 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2806 | 0 \ |
Jarno Lamsa | cbee1b3 | 2019-06-04 15:18:19 +0300 | [diff] [blame] | 2807 | -C "Deserializing connection..." \ |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2808 | -s "Deserializing connection..." |
| 2809 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2810 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2811 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | 1b18fd3 | 2019-08-30 11:18:59 +0100 | [diff] [blame] | 2812 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2813 | run_test "Context serialization, server serializes, with CID" \ |
| 2814 | "$P_SRV dtls=1 serialize=1 exchanges=2 cid=1 cid_val=dead" \ |
| 2815 | "$P_CLI dtls=1 serialize=0 exchanges=2 cid=1 cid_val=beef" \ |
| 2816 | 0 \ |
| 2817 | -C "Deserializing connection..." \ |
| 2818 | -s "Deserializing connection..." |
| 2819 | |
| 2820 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2821 | run_test "Context serialization, both serialize, CCM" \ |
Manuel Pégourié-Gonnard | 862b319 | 2019-07-23 14:13:43 +0200 | [diff] [blame] | 2822 | "$P_SRV dtls=1 serialize=1 exchanges=2" \ |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2823 | "$P_CLI dtls=1 serialize=1 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2824 | 0 \ |
| 2825 | -c "Deserializing connection..." \ |
| 2826 | -s "Deserializing connection..." |
| 2827 | |
| 2828 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2829 | run_test "Context serialization, both serialize, ChaChaPoly" \ |
| 2830 | "$P_SRV dtls=1 serialize=1 exchanges=2" \ |
| 2831 | "$P_CLI dtls=1 serialize=1 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2832 | 0 \ |
| 2833 | -c "Deserializing connection..." \ |
| 2834 | -s "Deserializing connection..." |
| 2835 | |
| 2836 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2837 | run_test "Context serialization, both serialize, GCM" \ |
| 2838 | "$P_SRV dtls=1 serialize=1 exchanges=2" \ |
| 2839 | "$P_CLI dtls=1 serialize=1 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2840 | 0 \ |
Jarno Lamsa | cbee1b3 | 2019-06-04 15:18:19 +0300 | [diff] [blame] | 2841 | -c "Deserializing connection..." \ |
Jarno Lamsa | 2937d81 | 2019-06-04 11:33:23 +0300 | [diff] [blame] | 2842 | -s "Deserializing connection..." |
| 2843 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2844 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Jarno Lamsa | c2376f0 | 2019-06-06 10:44:14 +0300 | [diff] [blame] | 2845 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | 1b18fd3 | 2019-08-30 11:18:59 +0100 | [diff] [blame] | 2846 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2847 | run_test "Context serialization, both serialize, with CID" \ |
| 2848 | "$P_SRV dtls=1 serialize=1 exchanges=2 cid=1 cid_val=dead" \ |
| 2849 | "$P_CLI dtls=1 serialize=1 exchanges=2 cid=1 cid_val=beef" \ |
| 2850 | 0 \ |
| 2851 | -c "Deserializing connection..." \ |
| 2852 | -s "Deserializing connection..." |
| 2853 | |
| 2854 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2855 | run_test "Context serialization, re-init, client serializes, CCM" \ |
Manuel Pégourié-Gonnard | 862b319 | 2019-07-23 14:13:43 +0200 | [diff] [blame] | 2856 | "$P_SRV dtls=1 serialize=0 exchanges=2" \ |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2857 | "$P_CLI dtls=1 serialize=2 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2858 | 0 \ |
| 2859 | -c "Deserializing connection..." \ |
| 2860 | -S "Deserializing connection..." |
| 2861 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2862 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2863 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2864 | run_test "Context serialization, re-init, client serializes, ChaChaPoly" \ |
| 2865 | "$P_SRV dtls=1 serialize=0 exchanges=2" \ |
| 2866 | "$P_CLI dtls=1 serialize=2 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2867 | 0 \ |
| 2868 | -c "Deserializing connection..." \ |
| 2869 | -S "Deserializing connection..." |
| 2870 | |
| 2871 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2872 | run_test "Context serialization, re-init, client serializes, GCM" \ |
| 2873 | "$P_SRV dtls=1 serialize=0 exchanges=2" \ |
| 2874 | "$P_CLI dtls=1 serialize=2 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ |
Jarno Lamsa | c2376f0 | 2019-06-06 10:44:14 +0300 | [diff] [blame] | 2875 | 0 \ |
| 2876 | -c "Deserializing connection..." \ |
| 2877 | -S "Deserializing connection..." |
| 2878 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2879 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Jarno Lamsa | c2376f0 | 2019-06-06 10:44:14 +0300 | [diff] [blame] | 2880 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | 1b18fd3 | 2019-08-30 11:18:59 +0100 | [diff] [blame] | 2881 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2882 | run_test "Context serialization, re-init, client serializes, with CID" \ |
| 2883 | "$P_SRV dtls=1 serialize=0 exchanges=2 cid=1 cid_val=dead" \ |
| 2884 | "$P_CLI dtls=1 serialize=2 exchanges=2 cid=1 cid_val=beef" \ |
| 2885 | 0 \ |
| 2886 | -c "Deserializing connection..." \ |
| 2887 | -S "Deserializing connection..." |
| 2888 | |
| 2889 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2890 | run_test "Context serialization, re-init, server serializes, CCM" \ |
Manuel Pégourié-Gonnard | 862b319 | 2019-07-23 14:13:43 +0200 | [diff] [blame] | 2891 | "$P_SRV dtls=1 serialize=2 exchanges=2" \ |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2892 | "$P_CLI dtls=1 serialize=0 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2893 | 0 \ |
| 2894 | -C "Deserializing connection..." \ |
| 2895 | -s "Deserializing connection..." |
| 2896 | |
| 2897 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2898 | run_test "Context serialization, re-init, server serializes, ChaChaPoly" \ |
| 2899 | "$P_SRV dtls=1 serialize=2 exchanges=2" \ |
| 2900 | "$P_CLI dtls=1 serialize=0 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2901 | 0 \ |
| 2902 | -C "Deserializing connection..." \ |
| 2903 | -s "Deserializing connection..." |
| 2904 | |
| 2905 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2906 | run_test "Context serialization, re-init, server serializes, GCM" \ |
| 2907 | "$P_SRV dtls=1 serialize=2 exchanges=2" \ |
| 2908 | "$P_CLI dtls=1 serialize=0 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
Jarno Lamsa | c2376f0 | 2019-06-06 10:44:14 +0300 | [diff] [blame] | 2909 | 0 \ |
| 2910 | -C "Deserializing connection..." \ |
| 2911 | -s "Deserializing connection..." |
| 2912 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2913 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Jarno Lamsa | c2376f0 | 2019-06-06 10:44:14 +0300 | [diff] [blame] | 2914 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | 1b18fd3 | 2019-08-30 11:18:59 +0100 | [diff] [blame] | 2915 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2916 | run_test "Context serialization, re-init, server serializes, with CID" \ |
| 2917 | "$P_SRV dtls=1 serialize=2 exchanges=2 cid=1 cid_val=dead" \ |
| 2918 | "$P_CLI dtls=1 serialize=0 exchanges=2 cid=1 cid_val=beef" \ |
| 2919 | 0 \ |
| 2920 | -C "Deserializing connection..." \ |
| 2921 | -s "Deserializing connection..." |
| 2922 | |
| 2923 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2924 | run_test "Context serialization, re-init, both serialize, CCM" \ |
Manuel Pégourié-Gonnard | 862b319 | 2019-07-23 14:13:43 +0200 | [diff] [blame] | 2925 | "$P_SRV dtls=1 serialize=2 exchanges=2" \ |
Hanno Becker | e0b90ec | 2019-08-30 11:32:12 +0100 | [diff] [blame] | 2926 | "$P_CLI dtls=1 serialize=2 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 2927 | 0 \ |
| 2928 | -c "Deserializing connection..." \ |
| 2929 | -s "Deserializing connection..." |
| 2930 | |
| 2931 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2932 | run_test "Context serialization, re-init, both serialize, ChaChaPoly" \ |
| 2933 | "$P_SRV dtls=1 serialize=2 exchanges=2" \ |
| 2934 | "$P_CLI dtls=1 serialize=2 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
| 2935 | 0 \ |
| 2936 | -c "Deserializing connection..." \ |
| 2937 | -s "Deserializing connection..." |
| 2938 | |
| 2939 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2940 | run_test "Context serialization, re-init, both serialize, GCM" \ |
| 2941 | "$P_SRV dtls=1 serialize=2 exchanges=2" \ |
| 2942 | "$P_CLI dtls=1 serialize=2 exchanges=2 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256" \ |
Jarno Lamsa | c2376f0 | 2019-06-06 10:44:14 +0300 | [diff] [blame] | 2943 | 0 \ |
| 2944 | -c "Deserializing connection..." \ |
| 2945 | -s "Deserializing connection..." |
| 2946 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2947 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 1b18fd3 | 2019-08-30 11:18:59 +0100 | [diff] [blame] | 2948 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2949 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 2950 | run_test "Context serialization, re-init, both serialize, with CID" \ |
| 2951 | "$P_SRV dtls=1 serialize=2 exchanges=2 cid=1 cid_val=dead" \ |
| 2952 | "$P_CLI dtls=1 serialize=2 exchanges=2 cid=1 cid_val=beef" \ |
| 2953 | 0 \ |
| 2954 | -c "Deserializing connection..." \ |
| 2955 | -s "Deserializing connection..." |
| 2956 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2957 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Piotr Nowicki | 3de298f | 2020-04-16 14:35:19 +0200 | [diff] [blame] | 2958 | requires_config_enabled MBEDTLS_SSL_CONTEXT_SERIALIZATION |
| 2959 | run_test "Saving the serialized context to a file" \ |
| 2960 | "$P_SRV dtls=1 serialize=1 context_file=context_srv.txt" \ |
| 2961 | "$P_CLI dtls=1 serialize=1 context_file=context_cli.txt" \ |
| 2962 | 0 \ |
| 2963 | -s "Save serialized context to a file... ok" \ |
| 2964 | -c "Save serialized context to a file... ok" |
| 2965 | rm -f context_srv.txt |
| 2966 | rm -f context_cli.txt |
| 2967 | |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2968 | # Tests for DTLS Connection ID extension |
| 2969 | |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2970 | # So far, the CID API isn't implemented, so we can't |
| 2971 | # grep for output witnessing its use. This needs to be |
| 2972 | # changed once the CID extension is implemented. |
| 2973 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2974 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2975 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2976 | run_test "Connection ID: Cli enabled, Srv disabled" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2977 | "$P_SRV debug_level=3 dtls=1 cid=0" \ |
| 2978 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=deadbeef" \ |
| 2979 | 0 \ |
| 2980 | -s "Disable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2981 | -s "found CID extension" \ |
| 2982 | -s "Client sent CID extension, but CID disabled" \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2983 | -c "Enable use of CID extension." \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 2984 | -c "client hello, adding CID extension" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 2985 | -S "server hello, adding CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 2986 | -C "found CID extension" \ |
| 2987 | -S "Copy CIDs into SSL transform" \ |
Hanno Becker | fcffdcc | 2019-04-26 17:19:46 +0100 | [diff] [blame] | 2988 | -C "Copy CIDs into SSL transform" \ |
| 2989 | -c "Use of Connection ID was rejected by the server" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 2990 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 2991 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2992 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 2993 | run_test "Connection ID: Cli disabled, Srv enabled" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 2994 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=deadbeef" \ |
| 2995 | "$P_CLI debug_level=3 dtls=1 cid=0" \ |
| 2996 | 0 \ |
| 2997 | -c "Disable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 2998 | -C "client hello, adding CID extension" \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 2999 | -S "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 3000 | -s "Enable use of CID extension." \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 3001 | -S "server hello, adding CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 3002 | -C "found CID extension" \ |
| 3003 | -S "Copy CIDs into SSL transform" \ |
Hanno Becker | fcffdcc | 2019-04-26 17:19:46 +0100 | [diff] [blame] | 3004 | -C "Copy CIDs into SSL transform" \ |
Hanno Becker | b3e9dd5 | 2019-05-08 13:19:53 +0100 | [diff] [blame] | 3005 | -s "Use of Connection ID was not offered by client" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3006 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3007 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3008 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3009 | run_test "Connection ID: Cli+Srv enabled, Cli+Srv CID nonempty" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 3010 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead" \ |
| 3011 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef" \ |
| 3012 | 0 \ |
| 3013 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 3014 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 3015 | -c "client hello, adding CID extension" \ |
| 3016 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 3017 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 3018 | -s "server hello, adding CID extension" \ |
| 3019 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 3020 | -c "Use of CID extension negotiated" \ |
| 3021 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 3022 | -c "Copy CIDs into SSL transform" \ |
| 3023 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 3024 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 3025 | -s "Use of Connection ID has been negotiated" \ |
| 3026 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3027 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3028 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3029 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3030 | run_test "Connection ID, 3D: Cli+Srv enabled, Cli+Srv CID nonempty" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3031 | -p "$P_PXY drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3032 | "$P_SRV debug_level=3 dtls=1 cid=1 dgram_packing=0 cid_val=dead" \ |
| 3033 | "$P_CLI debug_level=3 dtls=1 cid=1 dgram_packing=0 cid_val=beef" \ |
| 3034 | 0 \ |
| 3035 | -c "Enable use of CID extension." \ |
| 3036 | -s "Enable use of CID extension." \ |
| 3037 | -c "client hello, adding CID extension" \ |
| 3038 | -s "found CID extension" \ |
| 3039 | -s "Use of CID extension negotiated" \ |
| 3040 | -s "server hello, adding CID extension" \ |
| 3041 | -c "found CID extension" \ |
| 3042 | -c "Use of CID extension negotiated" \ |
| 3043 | -s "Copy CIDs into SSL transform" \ |
| 3044 | -c "Copy CIDs into SSL transform" \ |
| 3045 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 3046 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 3047 | -s "Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3048 | -c "Use of Connection ID has been negotiated" \ |
| 3049 | -c "ignoring unexpected CID" \ |
| 3050 | -s "ignoring unexpected CID" |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3051 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3052 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3053 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3054 | run_test "Connection ID, MTU: Cli+Srv enabled, Cli+Srv CID nonempty" \ |
| 3055 | -p "$P_PXY mtu=800" \ |
| 3056 | "$P_SRV debug_level=3 mtu=800 dtls=1 cid=1 cid_val=dead" \ |
| 3057 | "$P_CLI debug_level=3 mtu=800 dtls=1 cid=1 cid_val=beef" \ |
| 3058 | 0 \ |
| 3059 | -c "Enable use of CID extension." \ |
| 3060 | -s "Enable use of CID extension." \ |
| 3061 | -c "client hello, adding CID extension" \ |
| 3062 | -s "found CID extension" \ |
| 3063 | -s "Use of CID extension negotiated" \ |
| 3064 | -s "server hello, adding CID extension" \ |
| 3065 | -c "found CID extension" \ |
| 3066 | -c "Use of CID extension negotiated" \ |
| 3067 | -s "Copy CIDs into SSL transform" \ |
| 3068 | -c "Copy CIDs into SSL transform" \ |
| 3069 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 3070 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 3071 | -s "Use of Connection ID has been negotiated" \ |
| 3072 | -c "Use of Connection ID has been negotiated" |
| 3073 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3074 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3075 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3076 | run_test "Connection ID, 3D+MTU: Cli+Srv enabled, Cli+Srv CID nonempty" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3077 | -p "$P_PXY mtu=800 drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3078 | "$P_SRV debug_level=3 mtu=800 dtls=1 cid=1 cid_val=dead" \ |
| 3079 | "$P_CLI debug_level=3 mtu=800 dtls=1 cid=1 cid_val=beef" \ |
| 3080 | 0 \ |
| 3081 | -c "Enable use of CID extension." \ |
| 3082 | -s "Enable use of CID extension." \ |
| 3083 | -c "client hello, adding CID extension" \ |
| 3084 | -s "found CID extension" \ |
| 3085 | -s "Use of CID extension negotiated" \ |
| 3086 | -s "server hello, adding CID extension" \ |
| 3087 | -c "found CID extension" \ |
| 3088 | -c "Use of CID extension negotiated" \ |
| 3089 | -s "Copy CIDs into SSL transform" \ |
| 3090 | -c "Copy CIDs into SSL transform" \ |
| 3091 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 3092 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 3093 | -s "Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3094 | -c "Use of Connection ID has been negotiated" \ |
| 3095 | -c "ignoring unexpected CID" \ |
| 3096 | -s "ignoring unexpected CID" |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3097 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3098 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3099 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3100 | run_test "Connection ID: Cli+Srv enabled, Cli CID empty" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 3101 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=deadbeef" \ |
| 3102 | "$P_CLI debug_level=3 dtls=1 cid=1" \ |
| 3103 | 0 \ |
| 3104 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 3105 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 3106 | -c "client hello, adding CID extension" \ |
| 3107 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 3108 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 3109 | -s "server hello, adding CID extension" \ |
| 3110 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 3111 | -c "Use of CID extension negotiated" \ |
| 3112 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 3113 | -c "Copy CIDs into SSL transform" \ |
| 3114 | -c "Peer CID (length 4 Bytes): de ad be ef" \ |
| 3115 | -s "Peer CID (length 0 Bytes):" \ |
| 3116 | -s "Use of Connection ID has been negotiated" \ |
| 3117 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3118 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3119 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3120 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3121 | run_test "Connection ID: Cli+Srv enabled, Srv CID empty" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 3122 | "$P_SRV debug_level=3 dtls=1 cid=1" \ |
| 3123 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=deadbeef" \ |
| 3124 | 0 \ |
| 3125 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 3126 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 3127 | -c "client hello, adding CID extension" \ |
| 3128 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 3129 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 3130 | -s "server hello, adding CID extension" \ |
| 3131 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 3132 | -c "Use of CID extension negotiated" \ |
| 3133 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 3134 | -c "Copy CIDs into SSL transform" \ |
| 3135 | -s "Peer CID (length 4 Bytes): de ad be ef" \ |
| 3136 | -c "Peer CID (length 0 Bytes):" \ |
| 3137 | -s "Use of Connection ID has been negotiated" \ |
| 3138 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3139 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3140 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3141 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3142 | run_test "Connection ID: Cli+Srv enabled, Cli+Srv CID empty" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 3143 | "$P_SRV debug_level=3 dtls=1 cid=1" \ |
| 3144 | "$P_CLI debug_level=3 dtls=1 cid=1" \ |
| 3145 | 0 \ |
| 3146 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 3147 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 3148 | -c "client hello, adding CID extension" \ |
| 3149 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 3150 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 3151 | -s "server hello, adding CID extension" \ |
| 3152 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 3153 | -c "Use of CID extension negotiated" \ |
| 3154 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | fcffdcc | 2019-04-26 17:19:46 +0100 | [diff] [blame] | 3155 | -c "Copy CIDs into SSL transform" \ |
| 3156 | -S "Use of Connection ID has been negotiated" \ |
| 3157 | -C "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3158 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3159 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3160 | run_test "Connection ID: Cli+Srv enabled, Cli+Srv CID nonempty, AES-128-CCM-8" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 3161 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead" \ |
| 3162 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 3163 | 0 \ |
| 3164 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 3165 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 3166 | -c "client hello, adding CID extension" \ |
| 3167 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 3168 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 3169 | -s "server hello, adding CID extension" \ |
| 3170 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 3171 | -c "Use of CID extension negotiated" \ |
| 3172 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 3173 | -c "Copy CIDs into SSL transform" \ |
| 3174 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 3175 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 3176 | -s "Use of Connection ID has been negotiated" \ |
| 3177 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3178 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3179 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3180 | run_test "Connection ID: Cli+Srv enabled, Cli CID empty, AES-128-CCM-8" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 3181 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=deadbeef" \ |
| 3182 | "$P_CLI debug_level=3 dtls=1 cid=1 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 3183 | 0 \ |
| 3184 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 3185 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 3186 | -c "client hello, adding CID extension" \ |
| 3187 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 3188 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 3189 | -s "server hello, adding CID extension" \ |
| 3190 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 3191 | -c "Use of CID extension negotiated" \ |
| 3192 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 3193 | -c "Copy CIDs into SSL transform" \ |
| 3194 | -c "Peer CID (length 4 Bytes): de ad be ef" \ |
| 3195 | -s "Peer CID (length 0 Bytes):" \ |
| 3196 | -s "Use of Connection ID has been negotiated" \ |
| 3197 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3198 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3199 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3200 | run_test "Connection ID: Cli+Srv enabled, Srv CID empty, AES-128-CCM-8" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 3201 | "$P_SRV debug_level=3 dtls=1 cid=1" \ |
| 3202 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=deadbeef force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 3203 | 0 \ |
| 3204 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 3205 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 3206 | -c "client hello, adding CID extension" \ |
| 3207 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 3208 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 3209 | -s "server hello, adding CID extension" \ |
| 3210 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 3211 | -c "Use of CID extension negotiated" \ |
| 3212 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 3213 | -c "Copy CIDs into SSL transform" \ |
| 3214 | -s "Peer CID (length 4 Bytes): de ad be ef" \ |
| 3215 | -c "Peer CID (length 0 Bytes):" \ |
| 3216 | -s "Use of Connection ID has been negotiated" \ |
| 3217 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3218 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3219 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3220 | run_test "Connection ID: Cli+Srv enabled, Cli+Srv CID empty, AES-128-CCM-8" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 3221 | "$P_SRV debug_level=3 dtls=1 cid=1" \ |
| 3222 | "$P_CLI debug_level=3 dtls=1 cid=1 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 3223 | 0 \ |
| 3224 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 3225 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 3226 | -c "client hello, adding CID extension" \ |
| 3227 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 3228 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 3229 | -s "server hello, adding CID extension" \ |
| 3230 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 3231 | -c "Use of CID extension negotiated" \ |
| 3232 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | fcffdcc | 2019-04-26 17:19:46 +0100 | [diff] [blame] | 3233 | -c "Copy CIDs into SSL transform" \ |
| 3234 | -S "Use of Connection ID has been negotiated" \ |
| 3235 | -C "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3236 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3237 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3238 | run_test "Connection ID: Cli+Srv enabled, Cli+Srv CID nonempty, AES-128-CBC" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 3239 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead" \ |
| 3240 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 3241 | 0 \ |
| 3242 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 3243 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 3244 | -c "client hello, adding CID extension" \ |
| 3245 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 3246 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 3247 | -s "server hello, adding CID extension" \ |
| 3248 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 3249 | -c "Use of CID extension negotiated" \ |
| 3250 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 3251 | -c "Copy CIDs into SSL transform" \ |
| 3252 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 3253 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 3254 | -s "Use of Connection ID has been negotiated" \ |
| 3255 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3256 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3257 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3258 | run_test "Connection ID: Cli+Srv enabled, Cli CID empty, AES-128-CBC" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 3259 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=deadbeef" \ |
| 3260 | "$P_CLI debug_level=3 dtls=1 cid=1 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 3261 | 0 \ |
| 3262 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 3263 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 3264 | -c "client hello, adding CID extension" \ |
| 3265 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 3266 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 3267 | -s "server hello, adding CID extension" \ |
| 3268 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 3269 | -c "Use of CID extension negotiated" \ |
| 3270 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 3271 | -c "Copy CIDs into SSL transform" \ |
| 3272 | -c "Peer CID (length 4 Bytes): de ad be ef" \ |
| 3273 | -s "Peer CID (length 0 Bytes):" \ |
| 3274 | -s "Use of Connection ID has been negotiated" \ |
| 3275 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3276 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3277 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3278 | run_test "Connection ID: Cli+Srv enabled, Srv CID empty, AES-128-CBC" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 3279 | "$P_SRV debug_level=3 dtls=1 cid=1" \ |
| 3280 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=deadbeef force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 3281 | 0 \ |
| 3282 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 3283 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 3284 | -c "client hello, adding CID extension" \ |
| 3285 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 3286 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 3287 | -s "server hello, adding CID extension" \ |
| 3288 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 3289 | -c "Use of CID extension negotiated" \ |
| 3290 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | 2749a67 | 2019-05-03 17:04:23 +0100 | [diff] [blame] | 3291 | -c "Copy CIDs into SSL transform" \ |
| 3292 | -s "Peer CID (length 4 Bytes): de ad be ef" \ |
| 3293 | -c "Peer CID (length 0 Bytes):" \ |
| 3294 | -s "Use of Connection ID has been negotiated" \ |
| 3295 | -c "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3296 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3297 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3298 | run_test "Connection ID: Cli+Srv enabled, Cli+Srv CID empty, AES-128-CBC" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 3299 | "$P_SRV debug_level=3 dtls=1 cid=1" \ |
| 3300 | "$P_CLI debug_level=3 dtls=1 cid=1 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 3301 | 0 \ |
| 3302 | -c "Enable use of CID extension." \ |
Hanno Becker | 6b78c83 | 2019-04-25 17:01:43 +0100 | [diff] [blame] | 3303 | -s "Enable use of CID extension." \ |
Hanno Becker | 7dee2c6 | 2019-04-26 14:17:56 +0100 | [diff] [blame] | 3304 | -c "client hello, adding CID extension" \ |
| 3305 | -s "found CID extension" \ |
Hanno Becker | 4bc9e9d | 2019-04-26 16:00:29 +0100 | [diff] [blame] | 3306 | -s "Use of CID extension negotiated" \ |
Hanno Becker | a6a4c76 | 2019-04-26 16:13:31 +0100 | [diff] [blame] | 3307 | -s "server hello, adding CID extension" \ |
| 3308 | -c "found CID extension" \ |
Hanno Becker | 9ecb6c6 | 2019-04-26 16:23:52 +0100 | [diff] [blame] | 3309 | -c "Use of CID extension negotiated" \ |
| 3310 | -s "Copy CIDs into SSL transform" \ |
Hanno Becker | fcffdcc | 2019-04-26 17:19:46 +0100 | [diff] [blame] | 3311 | -c "Copy CIDs into SSL transform" \ |
| 3312 | -S "Use of Connection ID has been negotiated" \ |
| 3313 | -C "Use of Connection ID has been negotiated" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3314 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3315 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3316 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 9bae30d | 2019-04-23 11:52:44 +0100 | [diff] [blame] | 3317 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3318 | run_test "Connection ID: Cli+Srv enabled, renegotiate without change of CID" \ |
Hanno Becker | f157a97 | 2019-04-25 16:05:45 +0100 | [diff] [blame] | 3319 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead renegotiation=1" \ |
| 3320 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef renegotiation=1 renegotiate=1" \ |
| 3321 | 0 \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3322 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 3323 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 3324 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3325 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3326 | -c "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3327 | -s "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3328 | -s "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3329 | -c "(after renegotiation) Use of Connection ID has been negotiated" |
| 3330 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3331 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3332 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3333 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3334 | run_test "Connection ID: Cli+Srv enabled, renegotiate with different CID" \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3335 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead cid_val_renego=beef renegotiation=1" \ |
| 3336 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef cid_val_renego=dead renegotiation=1 renegotiate=1" \ |
| 3337 | 0 \ |
| 3338 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 3339 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 3340 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3341 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3342 | -c "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3343 | -s "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3344 | -s "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3345 | -c "(after renegotiation) Use of Connection ID has been negotiated" |
| 3346 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3347 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3348 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3349 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | c2045b0 | 2019-05-08 16:20:46 +0100 | [diff] [blame] | 3350 | run_test "Connection ID, no packing: Cli+Srv enabled, renegotiate with different CID" \ |
| 3351 | "$P_SRV debug_level=3 dtls=1 cid=1 dgram_packing=0 cid_val=dead cid_val_renego=beef renegotiation=1" \ |
| 3352 | "$P_CLI debug_level=3 dtls=1 cid=1 dgram_packing=0 cid_val=beef cid_val_renego=dead renegotiation=1 renegotiate=1" \ |
| 3353 | 0 \ |
| 3354 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 3355 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 3356 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3357 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3358 | -c "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3359 | -s "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3360 | -s "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3361 | -c "(after renegotiation) Use of Connection ID has been negotiated" |
| 3362 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3363 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3364 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | c2045b0 | 2019-05-08 16:20:46 +0100 | [diff] [blame] | 3365 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3366 | run_test "Connection ID, 3D+MTU: Cli+Srv enabled, renegotiate with different CID" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3367 | -p "$P_PXY mtu=800 drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3368 | "$P_SRV debug_level=3 mtu=800 dtls=1 cid=1 cid_val=dead cid_val_renego=beef renegotiation=1" \ |
| 3369 | "$P_CLI debug_level=3 mtu=800 dtls=1 cid=1 cid_val=beef cid_val_renego=dead renegotiation=1 renegotiate=1" \ |
| 3370 | 0 \ |
| 3371 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 3372 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 3373 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3374 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3375 | -c "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3376 | -s "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3377 | -s "(after renegotiation) Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3378 | -c "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3379 | -c "ignoring unexpected CID" \ |
| 3380 | -s "ignoring unexpected CID" |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3381 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3382 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3383 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3384 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 3385 | run_test "Connection ID: Cli+Srv enabled, renegotiate without CID" \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3386 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead cid_renego=0 renegotiation=1" \ |
| 3387 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef cid_renego=0 renegotiation=1 renegotiate=1" \ |
| 3388 | 0 \ |
| 3389 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 3390 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 3391 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3392 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3393 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3394 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3395 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3396 | -S "(after renegotiation) Use of Connection ID has been negotiated" |
| 3397 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3398 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3399 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3400 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | c2045b0 | 2019-05-08 16:20:46 +0100 | [diff] [blame] | 3401 | run_test "Connection ID, no packing: Cli+Srv enabled, renegotiate without CID" \ |
| 3402 | "$P_SRV debug_level=3 dtls=1 dgram_packing=0 cid=1 cid_val=dead cid_renego=0 renegotiation=1" \ |
| 3403 | "$P_CLI debug_level=3 dtls=1 dgram_packing=0 cid=1 cid_val=beef cid_renego=0 renegotiation=1 renegotiate=1" \ |
| 3404 | 0 \ |
| 3405 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 3406 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 3407 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3408 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3409 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3410 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3411 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3412 | -S "(after renegotiation) Use of Connection ID has been negotiated" |
| 3413 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3414 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3415 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | c2045b0 | 2019-05-08 16:20:46 +0100 | [diff] [blame] | 3416 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3417 | run_test "Connection ID, 3D+MTU: Cli+Srv enabled, renegotiate without CID" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3418 | -p "$P_PXY drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3419 | "$P_SRV debug_level=3 mtu=800 dtls=1 cid=1 cid_val=dead cid_renego=0 renegotiation=1" \ |
| 3420 | "$P_CLI debug_level=3 mtu=800 dtls=1 cid=1 cid_val=beef cid_renego=0 renegotiation=1 renegotiate=1" \ |
| 3421 | 0 \ |
| 3422 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 3423 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 3424 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3425 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3426 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3427 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3428 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3429 | -S "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3430 | -c "ignoring unexpected CID" \ |
| 3431 | -s "ignoring unexpected CID" |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3432 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3433 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3434 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3435 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 3436 | run_test "Connection ID: Cli+Srv enabled, CID on renegotiation" \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3437 | "$P_SRV debug_level=3 dtls=1 cid=0 cid_renego=1 cid_val_renego=dead renegotiation=1" \ |
| 3438 | "$P_CLI debug_level=3 dtls=1 cid=0 cid_renego=1 cid_val_renego=beef renegotiation=1 renegotiate=1" \ |
| 3439 | 0 \ |
| 3440 | -S "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3441 | -C "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3442 | -c "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3443 | -s "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3444 | -c "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3445 | -s "(after renegotiation) Use of Connection ID has been negotiated" |
| 3446 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3447 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3448 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3449 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | c2045b0 | 2019-05-08 16:20:46 +0100 | [diff] [blame] | 3450 | run_test "Connection ID, no packing: Cli+Srv enabled, CID on renegotiation" \ |
| 3451 | "$P_SRV debug_level=3 dtls=1 dgram_packing=0 cid=0 cid_renego=1 cid_val_renego=dead renegotiation=1" \ |
| 3452 | "$P_CLI debug_level=3 dtls=1 dgram_packing=0 cid=0 cid_renego=1 cid_val_renego=beef renegotiation=1 renegotiate=1" \ |
| 3453 | 0 \ |
| 3454 | -S "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3455 | -C "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3456 | -c "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3457 | -s "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3458 | -c "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3459 | -s "(after renegotiation) Use of Connection ID has been negotiated" |
| 3460 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3461 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3462 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | c2045b0 | 2019-05-08 16:20:46 +0100 | [diff] [blame] | 3463 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3464 | run_test "Connection ID, 3D+MTU: Cli+Srv enabled, CID on renegotiation" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3465 | -p "$P_PXY mtu=800 drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3466 | "$P_SRV debug_level=3 mtu=800 dtls=1 dgram_packing=1 cid=0 cid_renego=1 cid_val_renego=dead renegotiation=1" \ |
| 3467 | "$P_CLI debug_level=3 mtu=800 dtls=1 dgram_packing=1 cid=0 cid_renego=1 cid_val_renego=beef renegotiation=1 renegotiate=1" \ |
| 3468 | 0 \ |
| 3469 | -S "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3470 | -C "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3471 | -c "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3472 | -s "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3473 | -c "(after renegotiation) Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3474 | -s "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3475 | -c "ignoring unexpected CID" \ |
| 3476 | -s "ignoring unexpected CID" |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3477 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3478 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3479 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3480 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 3481 | run_test "Connection ID: Cli+Srv enabled, Cli disables on renegotiation" \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3482 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead renegotiation=1" \ |
| 3483 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef cid_renego=0 renegotiation=1 renegotiate=1" \ |
| 3484 | 0 \ |
| 3485 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 3486 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 3487 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3488 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3489 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3490 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3491 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3492 | -S "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3493 | -s "(after renegotiation) Use of Connection ID was not offered by client" |
| 3494 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3495 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3496 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3497 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3498 | run_test "Connection ID, 3D: Cli+Srv enabled, Cli disables on renegotiation" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3499 | -p "$P_PXY drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3500 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead renegotiation=1" \ |
| 3501 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef cid_renego=0 renegotiation=1 renegotiate=1" \ |
| 3502 | 0 \ |
| 3503 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 3504 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 3505 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3506 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3507 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3508 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3509 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3510 | -S "(after renegotiation) Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3511 | -s "(after renegotiation) Use of Connection ID was not offered by client" \ |
| 3512 | -c "ignoring unexpected CID" \ |
| 3513 | -s "ignoring unexpected CID" |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3514 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3515 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3516 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3517 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 3518 | run_test "Connection ID: Cli+Srv enabled, Srv disables on renegotiation" \ |
| 3519 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead cid_renego=0 renegotiation=1" \ |
| 3520 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef renegotiation=1 renegotiate=1" \ |
| 3521 | 0 \ |
| 3522 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 3523 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 3524 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3525 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3526 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3527 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3528 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3529 | -S "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3530 | -c "(after renegotiation) Use of Connection ID was rejected by the server" |
| 3531 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3532 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3533 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
Hanno Becker | 78c9137 | 2019-05-08 13:31:15 +0100 | [diff] [blame] | 3534 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 3535 | run_test "Connection ID, 3D: Cli+Srv enabled, Srv disables on renegotiation" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3536 | -p "$P_PXY drop=5 delay=5 duplicate=5 bad_cid=1" \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3537 | "$P_SRV debug_level=3 dtls=1 cid=1 cid_val=dead cid_renego=0 renegotiation=1" \ |
| 3538 | "$P_CLI debug_level=3 dtls=1 cid=1 cid_val=beef renegotiation=1 renegotiate=1" \ |
| 3539 | 0 \ |
| 3540 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 3541 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 3542 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3543 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3544 | -C "(after renegotiation) Peer CID (length 2 Bytes): de ad" \ |
| 3545 | -S "(after renegotiation) Peer CID (length 2 Bytes): be ef" \ |
| 3546 | -C "(after renegotiation) Use of Connection ID has been negotiated" \ |
| 3547 | -S "(after renegotiation) Use of Connection ID has been negotiated" \ |
Hanno Becker | d0ac5fa | 2019-05-24 10:11:23 +0100 | [diff] [blame] | 3548 | -c "(after renegotiation) Use of Connection ID was rejected by the server" \ |
| 3549 | -c "ignoring unexpected CID" \ |
| 3550 | -s "ignoring unexpected CID" |
Hanno Becker | 7cf463e | 2019-04-09 18:08:47 +0100 | [diff] [blame] | 3551 | |
Yuto Takano | 3fa1673 | 2021-07-09 11:21:43 +0100 | [diff] [blame] | 3552 | # This and the test below it require MAX_CONTENT_LEN to be at least MFL+1, because the |
Yuto Takano | 9c09d55 | 2021-07-08 16:03:44 +0100 | [diff] [blame] | 3553 | # tests check that the buffer contents are reallocated when the message is |
| 3554 | # larger than the buffer. |
Andrzej Kurek | b657783 | 2020-06-08 07:08:03 -0400 | [diff] [blame] | 3555 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 3556 | requires_config_enabled MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH |
Yuto Takano | 9c09d55 | 2021-07-08 16:03:44 +0100 | [diff] [blame] | 3557 | requires_max_content_len 513 |
Andrzej Kurek | b657783 | 2020-06-08 07:08:03 -0400 | [diff] [blame] | 3558 | run_test "Connection ID: Cli+Srv enabled, variable buffer lengths, MFL=512" \ |
| 3559 | "$P_SRV dtls=1 cid=1 cid_val=dead debug_level=2" \ |
| 3560 | "$P_CLI force_ciphersuite="TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" max_frag_len=512 dtls=1 cid=1 cid_val=beef" \ |
| 3561 | 0 \ |
| 3562 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 3563 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 3564 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3565 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3566 | -s "Reallocating in_buf" \ |
| 3567 | -s "Reallocating out_buf" |
| 3568 | |
| 3569 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 3570 | requires_config_enabled MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH |
Yuto Takano | 9c09d55 | 2021-07-08 16:03:44 +0100 | [diff] [blame] | 3571 | requires_max_content_len 1025 |
Andrzej Kurek | b657783 | 2020-06-08 07:08:03 -0400 | [diff] [blame] | 3572 | run_test "Connection ID: Cli+Srv enabled, variable buffer lengths, MFL=1024" \ |
| 3573 | "$P_SRV dtls=1 cid=1 cid_val=dead debug_level=2" \ |
| 3574 | "$P_CLI force_ciphersuite="TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" max_frag_len=1024 dtls=1 cid=1 cid_val=beef" \ |
| 3575 | 0 \ |
| 3576 | -c "(initial handshake) Peer CID (length 2 Bytes): de ad" \ |
| 3577 | -s "(initial handshake) Peer CID (length 2 Bytes): be ef" \ |
| 3578 | -s "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3579 | -c "(initial handshake) Use of Connection ID has been negotiated" \ |
| 3580 | -s "Reallocating in_buf" \ |
| 3581 | -s "Reallocating out_buf" |
| 3582 | |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 3583 | # Tests for Encrypt-then-MAC extension |
| 3584 | |
| 3585 | run_test "Encrypt then MAC: default" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 3586 | "$P_SRV debug_level=3 \ |
| 3587 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 3588 | "$P_CLI debug_level=3" \ |
| 3589 | 0 \ |
| 3590 | -c "client hello, adding encrypt_then_mac extension" \ |
| 3591 | -s "found encrypt then mac extension" \ |
| 3592 | -s "server hello, adding encrypt then mac extension" \ |
| 3593 | -c "found encrypt_then_mac extension" \ |
| 3594 | -c "using encrypt then mac" \ |
| 3595 | -s "using encrypt then mac" |
| 3596 | |
| 3597 | run_test "Encrypt then MAC: client enabled, server disabled" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 3598 | "$P_SRV debug_level=3 etm=0 \ |
| 3599 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 3600 | "$P_CLI debug_level=3 etm=1" \ |
| 3601 | 0 \ |
| 3602 | -c "client hello, adding encrypt_then_mac extension" \ |
| 3603 | -s "found encrypt then mac extension" \ |
| 3604 | -S "server hello, adding encrypt then mac extension" \ |
| 3605 | -C "found encrypt_then_mac extension" \ |
| 3606 | -C "using encrypt then mac" \ |
| 3607 | -S "using encrypt then mac" |
| 3608 | |
Manuel Pégourié-Gonnard | 78e745f | 2014-11-04 15:44:06 +0100 | [diff] [blame] | 3609 | run_test "Encrypt then MAC: client enabled, aead cipher" \ |
| 3610 | "$P_SRV debug_level=3 etm=1 \ |
| 3611 | force_ciphersuite=TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 3612 | "$P_CLI debug_level=3 etm=1" \ |
| 3613 | 0 \ |
| 3614 | -c "client hello, adding encrypt_then_mac extension" \ |
| 3615 | -s "found encrypt then mac extension" \ |
| 3616 | -S "server hello, adding encrypt then mac extension" \ |
| 3617 | -C "found encrypt_then_mac extension" \ |
| 3618 | -C "using encrypt then mac" \ |
| 3619 | -S "using encrypt then mac" |
| 3620 | |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 3621 | run_test "Encrypt then MAC: client disabled, server enabled" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 3622 | "$P_SRV debug_level=3 etm=1 \ |
| 3623 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 3624 | "$P_CLI debug_level=3 etm=0" \ |
| 3625 | 0 \ |
| 3626 | -C "client hello, adding encrypt_then_mac extension" \ |
| 3627 | -S "found encrypt then mac extension" \ |
| 3628 | -S "server hello, adding encrypt then mac extension" \ |
| 3629 | -C "found encrypt_then_mac extension" \ |
| 3630 | -C "using encrypt then mac" \ |
| 3631 | -S "using encrypt then mac" |
| 3632 | |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3633 | # Tests for Extended Master Secret extension |
| 3634 | |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3635 | requires_config_enabled MBEDTLS_SSL_EXTENDED_MASTER_SECRET |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3636 | run_test "Extended Master Secret: default" \ |
| 3637 | "$P_SRV debug_level=3" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3638 | "$P_CLI force_version=tls12 debug_level=3" \ |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3639 | 0 \ |
| 3640 | -c "client hello, adding extended_master_secret extension" \ |
| 3641 | -s "found extended master secret extension" \ |
| 3642 | -s "server hello, adding extended master secret extension" \ |
| 3643 | -c "found extended_master_secret extension" \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 3644 | -c "session hash for extended master secret" \ |
| 3645 | -s "session hash for extended master secret" |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3646 | |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3647 | requires_config_enabled MBEDTLS_SSL_EXTENDED_MASTER_SECRET |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3648 | run_test "Extended Master Secret: client enabled, server disabled" \ |
| 3649 | "$P_SRV debug_level=3 extended_ms=0" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3650 | "$P_CLI force_version=tls12 debug_level=3 extended_ms=1" \ |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3651 | 0 \ |
| 3652 | -c "client hello, adding extended_master_secret extension" \ |
| 3653 | -s "found extended master secret extension" \ |
| 3654 | -S "server hello, adding extended master secret extension" \ |
| 3655 | -C "found extended_master_secret extension" \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 3656 | -C "session hash for extended master secret" \ |
| 3657 | -S "session hash for extended master secret" |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3658 | |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 3659 | requires_config_enabled MBEDTLS_SSL_EXTENDED_MASTER_SECRET |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3660 | run_test "Extended Master Secret: client disabled, server enabled" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3661 | "$P_SRV force_version=tls12 debug_level=3 extended_ms=1" \ |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3662 | "$P_CLI debug_level=3 extended_ms=0" \ |
| 3663 | 0 \ |
| 3664 | -C "client hello, adding extended_master_secret extension" \ |
| 3665 | -S "found extended master secret extension" \ |
| 3666 | -S "server hello, adding extended master secret extension" \ |
| 3667 | -C "found extended_master_secret extension" \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 3668 | -C "session hash for extended master secret" \ |
| 3669 | -S "session hash for extended master secret" |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 3670 | |
Andres Amaya Garcia | 4c761fa | 2018-07-10 20:08:04 +0100 | [diff] [blame] | 3671 | # Test sending and receiving empty application data records |
| 3672 | |
| 3673 | run_test "Encrypt then MAC: empty application data record" \ |
| 3674 | "$P_SRV auth_mode=none debug_level=4 etm=1" \ |
| 3675 | "$P_CLI auth_mode=none etm=1 request_size=0 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA" \ |
| 3676 | 0 \ |
| 3677 | -S "0000: 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f" \ |
| 3678 | -s "dumping 'input payload after decrypt' (0 bytes)" \ |
| 3679 | -c "0 bytes written in 1 fragments" |
| 3680 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3681 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 9e2c80f | 2020-03-24 10:53:39 +0100 | [diff] [blame] | 3682 | run_test "Encrypt then MAC: disabled, empty application data record" \ |
Andres Amaya Garcia | 4c761fa | 2018-07-10 20:08:04 +0100 | [diff] [blame] | 3683 | "$P_SRV auth_mode=none debug_level=4 etm=0" \ |
| 3684 | "$P_CLI auth_mode=none etm=0 request_size=0" \ |
| 3685 | 0 \ |
| 3686 | -s "dumping 'input payload after decrypt' (0 bytes)" \ |
| 3687 | -c "0 bytes written in 1 fragments" |
| 3688 | |
| 3689 | run_test "Encrypt then MAC, DTLS: empty application data record" \ |
| 3690 | "$P_SRV auth_mode=none debug_level=4 etm=1 dtls=1" \ |
| 3691 | "$P_CLI auth_mode=none etm=1 request_size=0 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA dtls=1" \ |
| 3692 | 0 \ |
| 3693 | -S "0000: 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f" \ |
| 3694 | -s "dumping 'input payload after decrypt' (0 bytes)" \ |
| 3695 | -c "0 bytes written in 1 fragments" |
| 3696 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3697 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 9e2c80f | 2020-03-24 10:53:39 +0100 | [diff] [blame] | 3698 | run_test "Encrypt then MAC, DTLS: disabled, empty application data record" \ |
Andres Amaya Garcia | 4c761fa | 2018-07-10 20:08:04 +0100 | [diff] [blame] | 3699 | "$P_SRV auth_mode=none debug_level=4 etm=0 dtls=1" \ |
| 3700 | "$P_CLI auth_mode=none etm=0 request_size=0 dtls=1" \ |
| 3701 | 0 \ |
| 3702 | -s "dumping 'input payload after decrypt' (0 bytes)" \ |
| 3703 | -c "0 bytes written in 1 fragments" |
| 3704 | |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 3705 | # Tests for CBC 1/n-1 record splitting |
| 3706 | |
| 3707 | run_test "CBC Record splitting: TLS 1.2, no splitting" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 3708 | "$P_SRV force_version=tls12" \ |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 3709 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 3710 | request_size=123" \ |
Manuel Pégourié-Gonnard | 3ff7823 | 2015-01-08 11:15:09 +0100 | [diff] [blame] | 3711 | 0 \ |
| 3712 | -s "Read from client: 123 bytes read" \ |
| 3713 | -S "Read from client: 1 bytes read" \ |
| 3714 | -S "122 bytes read" |
| 3715 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 3716 | # Tests for Session Tickets |
| 3717 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3718 | run_test "Session resume using tickets: basic" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3719 | "$P_SRV debug_level=3 tickets=1" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3720 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 3721 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 3722 | -c "client hello, adding session ticket extension" \ |
| 3723 | -s "found session ticket extension" \ |
| 3724 | -s "server hello, adding session ticket extension" \ |
| 3725 | -c "found session_ticket extension" \ |
| 3726 | -c "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 3727 | -S "session successfully restored from cache" \ |
| 3728 | -s "session successfully restored from ticket" \ |
| 3729 | -s "a session has been resumed" \ |
| 3730 | -c "a session has been resumed" |
| 3731 | |
Glenn Strauss | e328245 | 2022-02-03 17:23:24 -0500 | [diff] [blame] | 3732 | run_test "Session resume using tickets: manual rotation" \ |
| 3733 | "$P_SRV debug_level=3 tickets=1 ticket_rotate=1" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3734 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Glenn Strauss | e328245 | 2022-02-03 17:23:24 -0500 | [diff] [blame] | 3735 | 0 \ |
| 3736 | -c "client hello, adding session ticket extension" \ |
| 3737 | -s "found session ticket extension" \ |
| 3738 | -s "server hello, adding session ticket extension" \ |
| 3739 | -c "found session_ticket extension" \ |
| 3740 | -c "parse new session ticket" \ |
| 3741 | -S "session successfully restored from cache" \ |
| 3742 | -s "session successfully restored from ticket" \ |
| 3743 | -s "a session has been resumed" \ |
| 3744 | -c "a session has been resumed" |
| 3745 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3746 | run_test "Session resume using tickets: cache disabled" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3747 | "$P_SRV debug_level=3 tickets=1 cache_max=0" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3748 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 3749 | 0 \ |
| 3750 | -c "client hello, adding session ticket extension" \ |
| 3751 | -s "found session ticket extension" \ |
| 3752 | -s "server hello, adding session ticket extension" \ |
| 3753 | -c "found session_ticket extension" \ |
| 3754 | -c "parse new session ticket" \ |
| 3755 | -S "session successfully restored from cache" \ |
| 3756 | -s "session successfully restored from ticket" \ |
| 3757 | -s "a session has been resumed" \ |
| 3758 | -c "a session has been resumed" |
| 3759 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3760 | run_test "Session resume using tickets: timeout" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3761 | "$P_SRV debug_level=3 tickets=1 cache_max=0 ticket_timeout=1" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3762 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1 reco_delay=2000" \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 3763 | 0 \ |
| 3764 | -c "client hello, adding session ticket extension" \ |
| 3765 | -s "found session ticket extension" \ |
| 3766 | -s "server hello, adding session ticket extension" \ |
| 3767 | -c "found session_ticket extension" \ |
| 3768 | -c "parse new session ticket" \ |
| 3769 | -S "session successfully restored from cache" \ |
| 3770 | -S "session successfully restored from ticket" \ |
| 3771 | -S "a session has been resumed" \ |
| 3772 | -C "a session has been resumed" |
| 3773 | |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 3774 | run_test "Session resume using tickets: session copy" \ |
| 3775 | "$P_SRV debug_level=3 tickets=1 cache_max=0" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3776 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1 reco_mode=0" \ |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 3777 | 0 \ |
| 3778 | -c "client hello, adding session ticket extension" \ |
| 3779 | -s "found session ticket extension" \ |
| 3780 | -s "server hello, adding session ticket extension" \ |
| 3781 | -c "found session_ticket extension" \ |
| 3782 | -c "parse new session ticket" \ |
| 3783 | -S "session successfully restored from cache" \ |
| 3784 | -s "session successfully restored from ticket" \ |
| 3785 | -s "a session has been resumed" \ |
| 3786 | -c "a session has been resumed" |
| 3787 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3788 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3789 | run_test "Session resume using tickets: openssl server" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 3790 | "$O_SRV -tls1_2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3791 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 3792 | 0 \ |
| 3793 | -c "client hello, adding session ticket extension" \ |
| 3794 | -c "found session_ticket extension" \ |
| 3795 | -c "parse new session ticket" \ |
| 3796 | -c "a session has been resumed" |
| 3797 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 3798 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 3799 | run_test "Session resume using tickets: openssl client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 3800 | "$P_SRV debug_level=3 tickets=1" \ |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 3801 | "( $O_CLI -sess_out $SESSION; \ |
| 3802 | $O_CLI -sess_in $SESSION; \ |
| 3803 | rm -f $SESSION )" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 3804 | 0 \ |
| 3805 | -s "found session ticket extension" \ |
| 3806 | -s "server hello, adding session ticket extension" \ |
| 3807 | -S "session successfully restored from cache" \ |
| 3808 | -s "session successfully restored from ticket" \ |
| 3809 | -s "a session has been resumed" |
| 3810 | |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3811 | run_test "Session resume using tickets: AES-128-GCM" \ |
| 3812 | "$P_SRV debug_level=3 tickets=1 ticket_aead=AES-128-GCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3813 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3814 | 0 \ |
| 3815 | -c "client hello, adding session ticket extension" \ |
| 3816 | -s "found session ticket extension" \ |
| 3817 | -s "server hello, adding session ticket extension" \ |
| 3818 | -c "found session_ticket extension" \ |
| 3819 | -c "parse new session ticket" \ |
| 3820 | -S "session successfully restored from cache" \ |
| 3821 | -s "session successfully restored from ticket" \ |
| 3822 | -s "a session has been resumed" \ |
| 3823 | -c "a session has been resumed" |
| 3824 | |
| 3825 | run_test "Session resume using tickets: AES-192-GCM" \ |
| 3826 | "$P_SRV debug_level=3 tickets=1 ticket_aead=AES-192-GCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3827 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3828 | 0 \ |
| 3829 | -c "client hello, adding session ticket extension" \ |
| 3830 | -s "found session ticket extension" \ |
| 3831 | -s "server hello, adding session ticket extension" \ |
| 3832 | -c "found session_ticket extension" \ |
| 3833 | -c "parse new session ticket" \ |
| 3834 | -S "session successfully restored from cache" \ |
| 3835 | -s "session successfully restored from ticket" \ |
| 3836 | -s "a session has been resumed" \ |
| 3837 | -c "a session has been resumed" |
| 3838 | |
| 3839 | run_test "Session resume using tickets: AES-128-CCM" \ |
| 3840 | "$P_SRV debug_level=3 tickets=1 ticket_aead=AES-128-CCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3841 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3842 | 0 \ |
| 3843 | -c "client hello, adding session ticket extension" \ |
| 3844 | -s "found session ticket extension" \ |
| 3845 | -s "server hello, adding session ticket extension" \ |
| 3846 | -c "found session_ticket extension" \ |
| 3847 | -c "parse new session ticket" \ |
| 3848 | -S "session successfully restored from cache" \ |
| 3849 | -s "session successfully restored from ticket" \ |
| 3850 | -s "a session has been resumed" \ |
| 3851 | -c "a session has been resumed" |
| 3852 | |
| 3853 | run_test "Session resume using tickets: AES-192-CCM" \ |
| 3854 | "$P_SRV debug_level=3 tickets=1 ticket_aead=AES-192-CCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3855 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3856 | 0 \ |
| 3857 | -c "client hello, adding session ticket extension" \ |
| 3858 | -s "found session ticket extension" \ |
| 3859 | -s "server hello, adding session ticket extension" \ |
| 3860 | -c "found session_ticket extension" \ |
| 3861 | -c "parse new session ticket" \ |
| 3862 | -S "session successfully restored from cache" \ |
| 3863 | -s "session successfully restored from ticket" \ |
| 3864 | -s "a session has been resumed" \ |
| 3865 | -c "a session has been resumed" |
| 3866 | |
| 3867 | run_test "Session resume using tickets: AES-256-CCM" \ |
| 3868 | "$P_SRV debug_level=3 tickets=1 ticket_aead=AES-256-CCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3869 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3870 | 0 \ |
| 3871 | -c "client hello, adding session ticket extension" \ |
| 3872 | -s "found session ticket extension" \ |
| 3873 | -s "server hello, adding session ticket extension" \ |
| 3874 | -c "found session_ticket extension" \ |
| 3875 | -c "parse new session ticket" \ |
| 3876 | -S "session successfully restored from cache" \ |
| 3877 | -s "session successfully restored from ticket" \ |
| 3878 | -s "a session has been resumed" \ |
| 3879 | -c "a session has been resumed" |
| 3880 | |
| 3881 | run_test "Session resume using tickets: CAMELLIA-128-CCM" \ |
| 3882 | "$P_SRV debug_level=3 tickets=1 ticket_aead=CAMELLIA-128-CCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3883 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3884 | 0 \ |
| 3885 | -c "client hello, adding session ticket extension" \ |
| 3886 | -s "found session ticket extension" \ |
| 3887 | -s "server hello, adding session ticket extension" \ |
| 3888 | -c "found session_ticket extension" \ |
| 3889 | -c "parse new session ticket" \ |
| 3890 | -S "session successfully restored from cache" \ |
| 3891 | -s "session successfully restored from ticket" \ |
| 3892 | -s "a session has been resumed" \ |
| 3893 | -c "a session has been resumed" |
| 3894 | |
| 3895 | run_test "Session resume using tickets: CAMELLIA-192-CCM" \ |
| 3896 | "$P_SRV debug_level=3 tickets=1 ticket_aead=CAMELLIA-192-CCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3897 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3898 | 0 \ |
| 3899 | -c "client hello, adding session ticket extension" \ |
| 3900 | -s "found session ticket extension" \ |
| 3901 | -s "server hello, adding session ticket extension" \ |
| 3902 | -c "found session_ticket extension" \ |
| 3903 | -c "parse new session ticket" \ |
| 3904 | -S "session successfully restored from cache" \ |
| 3905 | -s "session successfully restored from ticket" \ |
| 3906 | -s "a session has been resumed" \ |
| 3907 | -c "a session has been resumed" |
| 3908 | |
| 3909 | run_test "Session resume using tickets: CAMELLIA-256-CCM" \ |
| 3910 | "$P_SRV debug_level=3 tickets=1 ticket_aead=CAMELLIA-256-CCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3911 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3912 | 0 \ |
| 3913 | -c "client hello, adding session ticket extension" \ |
| 3914 | -s "found session ticket extension" \ |
| 3915 | -s "server hello, adding session ticket extension" \ |
| 3916 | -c "found session_ticket extension" \ |
| 3917 | -c "parse new session ticket" \ |
| 3918 | -S "session successfully restored from cache" \ |
| 3919 | -s "session successfully restored from ticket" \ |
| 3920 | -s "a session has been resumed" \ |
| 3921 | -c "a session has been resumed" |
| 3922 | |
| 3923 | run_test "Session resume using tickets: ARIA-128-GCM" \ |
| 3924 | "$P_SRV debug_level=3 tickets=1 ticket_aead=ARIA-128-GCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3925 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3926 | 0 \ |
| 3927 | -c "client hello, adding session ticket extension" \ |
| 3928 | -s "found session ticket extension" \ |
| 3929 | -s "server hello, adding session ticket extension" \ |
| 3930 | -c "found session_ticket extension" \ |
| 3931 | -c "parse new session ticket" \ |
| 3932 | -S "session successfully restored from cache" \ |
| 3933 | -s "session successfully restored from ticket" \ |
| 3934 | -s "a session has been resumed" \ |
| 3935 | -c "a session has been resumed" |
| 3936 | |
| 3937 | run_test "Session resume using tickets: ARIA-192-GCM" \ |
| 3938 | "$P_SRV debug_level=3 tickets=1 ticket_aead=ARIA-192-GCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3939 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3940 | 0 \ |
| 3941 | -c "client hello, adding session ticket extension" \ |
| 3942 | -s "found session ticket extension" \ |
| 3943 | -s "server hello, adding session ticket extension" \ |
| 3944 | -c "found session_ticket extension" \ |
| 3945 | -c "parse new session ticket" \ |
| 3946 | -S "session successfully restored from cache" \ |
| 3947 | -s "session successfully restored from ticket" \ |
| 3948 | -s "a session has been resumed" \ |
| 3949 | -c "a session has been resumed" |
| 3950 | |
| 3951 | run_test "Session resume using tickets: ARIA-256-GCM" \ |
| 3952 | "$P_SRV debug_level=3 tickets=1 ticket_aead=ARIA-256-GCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3953 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3954 | 0 \ |
| 3955 | -c "client hello, adding session ticket extension" \ |
| 3956 | -s "found session ticket extension" \ |
| 3957 | -s "server hello, adding session ticket extension" \ |
| 3958 | -c "found session_ticket extension" \ |
| 3959 | -c "parse new session ticket" \ |
| 3960 | -S "session successfully restored from cache" \ |
| 3961 | -s "session successfully restored from ticket" \ |
| 3962 | -s "a session has been resumed" \ |
| 3963 | -c "a session has been resumed" |
| 3964 | |
| 3965 | run_test "Session resume using tickets: ARIA-128-CCM" \ |
| 3966 | "$P_SRV debug_level=3 tickets=1 ticket_aead=ARIA-128-CCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3967 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3968 | 0 \ |
| 3969 | -c "client hello, adding session ticket extension" \ |
| 3970 | -s "found session ticket extension" \ |
| 3971 | -s "server hello, adding session ticket extension" \ |
| 3972 | -c "found session_ticket extension" \ |
| 3973 | -c "parse new session ticket" \ |
| 3974 | -S "session successfully restored from cache" \ |
| 3975 | -s "session successfully restored from ticket" \ |
| 3976 | -s "a session has been resumed" \ |
| 3977 | -c "a session has been resumed" |
| 3978 | |
| 3979 | run_test "Session resume using tickets: ARIA-192-CCM" \ |
| 3980 | "$P_SRV debug_level=3 tickets=1 ticket_aead=ARIA-192-CCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3981 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3982 | 0 \ |
| 3983 | -c "client hello, adding session ticket extension" \ |
| 3984 | -s "found session ticket extension" \ |
| 3985 | -s "server hello, adding session ticket extension" \ |
| 3986 | -c "found session_ticket extension" \ |
| 3987 | -c "parse new session ticket" \ |
| 3988 | -S "session successfully restored from cache" \ |
| 3989 | -s "session successfully restored from ticket" \ |
| 3990 | -s "a session has been resumed" \ |
| 3991 | -c "a session has been resumed" |
| 3992 | |
| 3993 | run_test "Session resume using tickets: ARIA-256-CCM" \ |
| 3994 | "$P_SRV debug_level=3 tickets=1 ticket_aead=ARIA-256-CCM" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 3995 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 6e5aae6 | 2022-01-12 16:29:58 +0100 | [diff] [blame] | 3996 | 0 \ |
| 3997 | -c "client hello, adding session ticket extension" \ |
| 3998 | -s "found session ticket extension" \ |
| 3999 | -s "server hello, adding session ticket extension" \ |
| 4000 | -c "found session_ticket extension" \ |
| 4001 | -c "parse new session ticket" \ |
| 4002 | -S "session successfully restored from cache" \ |
| 4003 | -s "session successfully restored from ticket" \ |
| 4004 | -s "a session has been resumed" \ |
| 4005 | -c "a session has been resumed" |
| 4006 | |
Gabor Mezei | 49c8eb3 | 2022-03-10 16:13:17 +0100 | [diff] [blame] | 4007 | run_test "Session resume using tickets: CHACHA20-POLY1305" \ |
| 4008 | "$P_SRV debug_level=3 tickets=1 ticket_aead=CHACHA20-POLY1305" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4009 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Gabor Mezei | 49c8eb3 | 2022-03-10 16:13:17 +0100 | [diff] [blame] | 4010 | 0 \ |
| 4011 | -c "client hello, adding session ticket extension" \ |
| 4012 | -s "found session ticket extension" \ |
| 4013 | -s "server hello, adding session ticket extension" \ |
| 4014 | -c "found session_ticket extension" \ |
| 4015 | -c "parse new session ticket" \ |
| 4016 | -S "session successfully restored from cache" \ |
| 4017 | -s "session successfully restored from ticket" \ |
| 4018 | -s "a session has been resumed" \ |
| 4019 | -c "a session has been resumed" |
| 4020 | |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4021 | # Tests for Session Tickets with DTLS |
| 4022 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4023 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4024 | run_test "Session resume using tickets, DTLS: basic" \ |
| 4025 | "$P_SRV debug_level=3 dtls=1 tickets=1" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 4026 | "$P_CLI debug_level=3 dtls=1 tickets=1 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4027 | 0 \ |
| 4028 | -c "client hello, adding session ticket extension" \ |
| 4029 | -s "found session ticket extension" \ |
| 4030 | -s "server hello, adding session ticket extension" \ |
| 4031 | -c "found session_ticket extension" \ |
| 4032 | -c "parse new session ticket" \ |
| 4033 | -S "session successfully restored from cache" \ |
| 4034 | -s "session successfully restored from ticket" \ |
| 4035 | -s "a session has been resumed" \ |
| 4036 | -c "a session has been resumed" |
| 4037 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4038 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4039 | run_test "Session resume using tickets, DTLS: cache disabled" \ |
| 4040 | "$P_SRV debug_level=3 dtls=1 tickets=1 cache_max=0" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 4041 | "$P_CLI debug_level=3 dtls=1 tickets=1 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4042 | 0 \ |
| 4043 | -c "client hello, adding session ticket extension" \ |
| 4044 | -s "found session ticket extension" \ |
| 4045 | -s "server hello, adding session ticket extension" \ |
| 4046 | -c "found session_ticket extension" \ |
| 4047 | -c "parse new session ticket" \ |
| 4048 | -S "session successfully restored from cache" \ |
| 4049 | -s "session successfully restored from ticket" \ |
| 4050 | -s "a session has been resumed" \ |
| 4051 | -c "a session has been resumed" |
| 4052 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4053 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4054 | run_test "Session resume using tickets, DTLS: timeout" \ |
| 4055 | "$P_SRV debug_level=3 dtls=1 tickets=1 cache_max=0 ticket_timeout=1" \ |
Jerry Yu | a15af37 | 2022-12-05 15:55:24 +0800 | [diff] [blame] | 4056 | "$P_CLI debug_level=3 dtls=1 tickets=1 reconnect=1 skip_close_notify=1 reco_delay=2000" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4057 | 0 \ |
| 4058 | -c "client hello, adding session ticket extension" \ |
| 4059 | -s "found session ticket extension" \ |
| 4060 | -s "server hello, adding session ticket extension" \ |
| 4061 | -c "found session_ticket extension" \ |
| 4062 | -c "parse new session ticket" \ |
| 4063 | -S "session successfully restored from cache" \ |
| 4064 | -S "session successfully restored from ticket" \ |
| 4065 | -S "a session has been resumed" \ |
| 4066 | -C "a session has been resumed" |
| 4067 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4068 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 4069 | run_test "Session resume using tickets, DTLS: session copy" \ |
| 4070 | "$P_SRV debug_level=3 dtls=1 tickets=1 cache_max=0" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 4071 | "$P_CLI debug_level=3 dtls=1 tickets=1 reconnect=1 skip_close_notify=1 reco_mode=0" \ |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 4072 | 0 \ |
| 4073 | -c "client hello, adding session ticket extension" \ |
| 4074 | -s "found session ticket extension" \ |
| 4075 | -s "server hello, adding session ticket extension" \ |
| 4076 | -c "found session_ticket extension" \ |
| 4077 | -c "parse new session ticket" \ |
| 4078 | -S "session successfully restored from cache" \ |
| 4079 | -s "session successfully restored from ticket" \ |
| 4080 | -s "a session has been resumed" \ |
| 4081 | -c "a session has been resumed" |
| 4082 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4083 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 4084 | run_test "Session resume using tickets, DTLS: openssl server" \ |
| 4085 | "$O_SRV -dtls" \ |
| 4086 | "$P_CLI dtls=1 debug_level=3 tickets=1 reconnect=1" \ |
| 4087 | 0 \ |
| 4088 | -c "client hello, adding session ticket extension" \ |
| 4089 | -c "found session_ticket extension" \ |
| 4090 | -c "parse new session ticket" \ |
| 4091 | -c "a session has been resumed" |
| 4092 | |
Manuel Pégourié-Gonnard | d60950c | 2021-10-13 13:12:47 +0200 | [diff] [blame] | 4093 | # For reasons that aren't fully understood, this test randomly fails with high |
Paul Elliott | 09cfa18 | 2021-10-13 16:13:44 +0100 | [diff] [blame] | 4094 | # probability with OpenSSL 1.0.2g on the CI, see #5012. |
Manuel Pégourié-Gonnard | d60950c | 2021-10-13 13:12:47 +0200 | [diff] [blame] | 4095 | requires_openssl_next |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4096 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 4097 | run_test "Session resume using tickets, DTLS: openssl client" \ |
| 4098 | "$P_SRV dtls=1 debug_level=3 tickets=1" \ |
Manuel Pégourié-Gonnard | d60950c | 2021-10-13 13:12:47 +0200 | [diff] [blame] | 4099 | "( $O_NEXT_CLI -dtls -sess_out $SESSION; \ |
| 4100 | $O_NEXT_CLI -dtls -sess_in $SESSION; \ |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 4101 | rm -f $SESSION )" \ |
| 4102 | 0 \ |
| 4103 | -s "found session ticket extension" \ |
| 4104 | -s "server hello, adding session ticket extension" \ |
| 4105 | -S "session successfully restored from cache" \ |
| 4106 | -s "session successfully restored from ticket" \ |
| 4107 | -s "a session has been resumed" |
| 4108 | |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 4109 | # Tests for Session Resume based on session-ID and cache |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4110 | |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4111 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4112 | run_test "Session resume using cache: tickets enabled on client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4113 | "$P_SRV debug_level=3 tickets=0" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4114 | "$P_CLI force_version=tls12 debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 4115 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 4116 | -c "client hello, adding session ticket extension" \ |
| 4117 | -s "found session ticket extension" \ |
| 4118 | -S "server hello, adding session ticket extension" \ |
| 4119 | -C "found session_ticket extension" \ |
| 4120 | -C "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 4121 | -s "session successfully restored from cache" \ |
| 4122 | -S "session successfully restored from ticket" \ |
| 4123 | -s "a session has been resumed" \ |
| 4124 | -c "a session has been resumed" |
| 4125 | |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4126 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4127 | run_test "Session resume using cache: tickets enabled on server" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4128 | "$P_SRV debug_level=3 tickets=1" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4129 | "$P_CLI force_version=tls12 debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 4130 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 4131 | -C "client hello, adding session ticket extension" \ |
| 4132 | -S "found session ticket extension" \ |
| 4133 | -S "server hello, adding session ticket extension" \ |
| 4134 | -C "found session_ticket extension" \ |
| 4135 | -C "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 4136 | -s "session successfully restored from cache" \ |
| 4137 | -S "session successfully restored from ticket" \ |
| 4138 | -s "a session has been resumed" \ |
| 4139 | -c "a session has been resumed" |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 4140 | |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4141 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4142 | run_test "Session resume using cache: cache_max=0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4143 | "$P_SRV debug_level=3 tickets=0 cache_max=0" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4144 | "$P_CLI force_version=tls12 debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 4145 | 0 \ |
| 4146 | -S "session successfully restored from cache" \ |
| 4147 | -S "session successfully restored from ticket" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 4148 | -S "a session has been resumed" \ |
| 4149 | -C "a session has been resumed" |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 4150 | |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4151 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4152 | run_test "Session resume using cache: cache_max=1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4153 | "$P_SRV debug_level=3 tickets=0 cache_max=1" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4154 | "$P_CLI force_version=tls12 debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 4155 | 0 \ |
| 4156 | -s "session successfully restored from cache" \ |
| 4157 | -S "session successfully restored from ticket" \ |
| 4158 | -s "a session has been resumed" \ |
| 4159 | -c "a session has been resumed" |
| 4160 | |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4161 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Pengyu Lv | 62ed1aa | 2023-03-07 14:52:47 +0800 | [diff] [blame] | 4162 | run_test "Session resume using cache: cache removed" \ |
| 4163 | "$P_SRV debug_level=3 tickets=0 cache_remove=1" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4164 | "$P_CLI force_version=tls12 debug_level=3 tickets=0 reconnect=1" \ |
Pengyu Lv | 62ed1aa | 2023-03-07 14:52:47 +0800 | [diff] [blame] | 4165 | 0 \ |
| 4166 | -C "client hello, adding session ticket extension" \ |
| 4167 | -S "found session ticket extension" \ |
| 4168 | -S "server hello, adding session ticket extension" \ |
| 4169 | -C "found session_ticket extension" \ |
| 4170 | -C "parse new session ticket" \ |
| 4171 | -S "session successfully restored from cache" \ |
| 4172 | -S "session successfully restored from ticket" \ |
| 4173 | -S "a session has been resumed" \ |
| 4174 | -C "a session has been resumed" |
| 4175 | |
| 4176 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
| 4177 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 6df3196 | 2015-05-04 10:55:47 +0200 | [diff] [blame] | 4178 | run_test "Session resume using cache: timeout > delay" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4179 | "$P_SRV debug_level=3 tickets=0" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4180 | "$P_CLI force_version=tls12 debug_level=3 tickets=0 reconnect=1 reco_delay=0" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 4181 | 0 \ |
| 4182 | -s "session successfully restored from cache" \ |
| 4183 | -S "session successfully restored from ticket" \ |
| 4184 | -s "a session has been resumed" \ |
| 4185 | -c "a session has been resumed" |
| 4186 | |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4187 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4188 | run_test "Session resume using cache: timeout < delay" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4189 | "$P_SRV debug_level=3 tickets=0 cache_timeout=1" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4190 | "$P_CLI force_version=tls12 debug_level=3 tickets=0 reconnect=1 reco_delay=2000" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 4191 | 0 \ |
| 4192 | -S "session successfully restored from cache" \ |
| 4193 | -S "session successfully restored from ticket" \ |
| 4194 | -S "a session has been resumed" \ |
| 4195 | -C "a session has been resumed" |
| 4196 | |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4197 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4198 | run_test "Session resume using cache: no timeout" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4199 | "$P_SRV debug_level=3 tickets=0 cache_timeout=0" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4200 | "$P_CLI force_version=tls12 debug_level=3 tickets=0 reconnect=1 reco_delay=2000" \ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 4201 | 0 \ |
| 4202 | -s "session successfully restored from cache" \ |
| 4203 | -S "session successfully restored from ticket" \ |
| 4204 | -s "a session has been resumed" \ |
| 4205 | -c "a session has been resumed" |
| 4206 | |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4207 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 4208 | run_test "Session resume using cache: session copy" \ |
| 4209 | "$P_SRV debug_level=3 tickets=0" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4210 | "$P_CLI force_version=tls12 debug_level=3 tickets=0 reconnect=1 reco_mode=0" \ |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 4211 | 0 \ |
| 4212 | -s "session successfully restored from cache" \ |
| 4213 | -S "session successfully restored from ticket" \ |
| 4214 | -s "a session has been resumed" \ |
| 4215 | -c "a session has been resumed" |
| 4216 | |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4217 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4218 | run_test "Session resume using cache: openssl client" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4219 | "$P_SRV force_version=tls12 debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 4220 | "( $O_CLI -sess_out $SESSION; \ |
| 4221 | $O_CLI -sess_in $SESSION; \ |
| 4222 | rm -f $SESSION )" \ |
Manuel Pégourié-Gonnard | db735f6 | 2014-02-25 17:57:59 +0100 | [diff] [blame] | 4223 | 0 \ |
| 4224 | -s "found session ticket extension" \ |
| 4225 | -S "server hello, adding session ticket extension" \ |
| 4226 | -s "session successfully restored from cache" \ |
| 4227 | -S "session successfully restored from ticket" \ |
| 4228 | -s "a session has been resumed" |
| 4229 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4230 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4231 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4232 | run_test "Session resume using cache: openssl server" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 4233 | "$O_SRV -tls1_2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4234 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | db735f6 | 2014-02-25 17:57:59 +0100 | [diff] [blame] | 4235 | 0 \ |
| 4236 | -C "found session_ticket extension" \ |
| 4237 | -C "parse new session ticket" \ |
| 4238 | -c "a session has been resumed" |
| 4239 | |
Andrzej Kurek | 7cf8725 | 2022-06-14 07:12:33 -0400 | [diff] [blame] | 4240 | # Tests for Session resume and extensions |
| 4241 | |
| 4242 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
| 4243 | requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID |
| 4244 | run_test "Session resume and connection ID" \ |
| 4245 | "$P_SRV debug_level=3 cid=1 cid_val=dead dtls=1 tickets=0" \ |
| 4246 | "$P_CLI debug_level=3 cid=1 cid_val=beef dtls=1 tickets=0 reconnect=1" \ |
| 4247 | 0 \ |
| 4248 | -c "Enable use of CID extension." \ |
| 4249 | -s "Enable use of CID extension." \ |
| 4250 | -c "client hello, adding CID extension" \ |
| 4251 | -s "found CID extension" \ |
| 4252 | -s "Use of CID extension negotiated" \ |
| 4253 | -s "server hello, adding CID extension" \ |
| 4254 | -c "found CID extension" \ |
| 4255 | -c "Use of CID extension negotiated" \ |
| 4256 | -s "Copy CIDs into SSL transform" \ |
| 4257 | -c "Copy CIDs into SSL transform" \ |
| 4258 | -c "Peer CID (length 2 Bytes): de ad" \ |
| 4259 | -s "Peer CID (length 2 Bytes): be ef" \ |
| 4260 | -s "Use of Connection ID has been negotiated" \ |
| 4261 | -c "Use of Connection ID has been negotiated" |
| 4262 | |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4263 | # Tests for Session Resume based on session-ID and cache, DTLS |
| 4264 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4265 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4266 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4267 | run_test "Session resume using cache, DTLS: tickets enabled on client" \ |
| 4268 | "$P_SRV dtls=1 debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 4269 | "$P_CLI dtls=1 debug_level=3 tickets=1 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4270 | 0 \ |
| 4271 | -c "client hello, adding session ticket extension" \ |
| 4272 | -s "found session ticket extension" \ |
| 4273 | -S "server hello, adding session ticket extension" \ |
| 4274 | -C "found session_ticket extension" \ |
| 4275 | -C "parse new session ticket" \ |
| 4276 | -s "session successfully restored from cache" \ |
| 4277 | -S "session successfully restored from ticket" \ |
| 4278 | -s "a session has been resumed" \ |
| 4279 | -c "a session has been resumed" |
| 4280 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4281 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4282 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4283 | run_test "Session resume using cache, DTLS: tickets enabled on server" \ |
| 4284 | "$P_SRV dtls=1 debug_level=3 tickets=1" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 4285 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4286 | 0 \ |
| 4287 | -C "client hello, adding session ticket extension" \ |
| 4288 | -S "found session ticket extension" \ |
| 4289 | -S "server hello, adding session ticket extension" \ |
| 4290 | -C "found session_ticket extension" \ |
| 4291 | -C "parse new session ticket" \ |
| 4292 | -s "session successfully restored from cache" \ |
| 4293 | -S "session successfully restored from ticket" \ |
| 4294 | -s "a session has been resumed" \ |
| 4295 | -c "a session has been resumed" |
| 4296 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4297 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4298 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4299 | run_test "Session resume using cache, DTLS: cache_max=0" \ |
| 4300 | "$P_SRV dtls=1 debug_level=3 tickets=0 cache_max=0" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 4301 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4302 | 0 \ |
| 4303 | -S "session successfully restored from cache" \ |
| 4304 | -S "session successfully restored from ticket" \ |
| 4305 | -S "a session has been resumed" \ |
| 4306 | -C "a session has been resumed" |
| 4307 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4308 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4309 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4310 | run_test "Session resume using cache, DTLS: cache_max=1" \ |
| 4311 | "$P_SRV dtls=1 debug_level=3 tickets=0 cache_max=1" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 4312 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4313 | 0 \ |
| 4314 | -s "session successfully restored from cache" \ |
| 4315 | -S "session successfully restored from ticket" \ |
| 4316 | -s "a session has been resumed" \ |
| 4317 | -c "a session has been resumed" |
| 4318 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4319 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4320 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4321 | run_test "Session resume using cache, DTLS: timeout > delay" \ |
| 4322 | "$P_SRV dtls=1 debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 4323 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1 reco_delay=0" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4324 | 0 \ |
| 4325 | -s "session successfully restored from cache" \ |
| 4326 | -S "session successfully restored from ticket" \ |
| 4327 | -s "a session has been resumed" \ |
| 4328 | -c "a session has been resumed" |
| 4329 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4330 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4331 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4332 | run_test "Session resume using cache, DTLS: timeout < delay" \ |
| 4333 | "$P_SRV dtls=1 debug_level=3 tickets=0 cache_timeout=1" \ |
Jerry Yu | a15af37 | 2022-12-05 15:55:24 +0800 | [diff] [blame] | 4334 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1 reco_delay=2000" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4335 | 0 \ |
| 4336 | -S "session successfully restored from cache" \ |
| 4337 | -S "session successfully restored from ticket" \ |
| 4338 | -S "a session has been resumed" \ |
| 4339 | -C "a session has been resumed" |
| 4340 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4341 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4342 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4343 | run_test "Session resume using cache, DTLS: no timeout" \ |
| 4344 | "$P_SRV dtls=1 debug_level=3 tickets=0 cache_timeout=0" \ |
Jerry Yu | a15af37 | 2022-12-05 15:55:24 +0800 | [diff] [blame] | 4345 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1 reco_delay=2000" \ |
Hanno Becker | 1d73993 | 2018-08-21 13:55:22 +0100 | [diff] [blame] | 4346 | 0 \ |
| 4347 | -s "session successfully restored from cache" \ |
| 4348 | -S "session successfully restored from ticket" \ |
| 4349 | -s "a session has been resumed" \ |
| 4350 | -c "a session has been resumed" |
| 4351 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4352 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4353 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 4354 | run_test "Session resume using cache, DTLS: session copy" \ |
| 4355 | "$P_SRV dtls=1 debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 4356 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1 skip_close_notify=1 reco_mode=0" \ |
Manuel Pégourié-Gonnard | a7c3765 | 2019-05-20 12:46:26 +0200 | [diff] [blame] | 4357 | 0 \ |
| 4358 | -s "session successfully restored from cache" \ |
| 4359 | -S "session successfully restored from ticket" \ |
| 4360 | -s "a session has been resumed" \ |
| 4361 | -c "a session has been resumed" |
| 4362 | |
Manuel Pégourié-Gonnard | d60950c | 2021-10-13 13:12:47 +0200 | [diff] [blame] | 4363 | # For reasons that aren't fully understood, this test randomly fails with high |
Paul Elliott | 09cfa18 | 2021-10-13 16:13:44 +0100 | [diff] [blame] | 4364 | # probability with OpenSSL 1.0.2g on the CI, see #5012. |
Manuel Pégourié-Gonnard | d60950c | 2021-10-13 13:12:47 +0200 | [diff] [blame] | 4365 | requires_openssl_next |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4366 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4367 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 4368 | run_test "Session resume using cache, DTLS: openssl client" \ |
| 4369 | "$P_SRV dtls=1 debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | d60950c | 2021-10-13 13:12:47 +0200 | [diff] [blame] | 4370 | "( $O_NEXT_CLI -dtls -sess_out $SESSION; \ |
| 4371 | $O_NEXT_CLI -dtls -sess_in $SESSION; \ |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 4372 | rm -f $SESSION )" \ |
| 4373 | 0 \ |
| 4374 | -s "found session ticket extension" \ |
| 4375 | -S "server hello, adding session ticket extension" \ |
| 4376 | -s "session successfully restored from cache" \ |
| 4377 | -S "session successfully restored from ticket" \ |
| 4378 | -s "a session has been resumed" |
| 4379 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4380 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 4381 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 4382 | run_test "Session resume using cache, DTLS: openssl server" \ |
| 4383 | "$O_SRV -dtls" \ |
| 4384 | "$P_CLI dtls=1 debug_level=3 tickets=0 reconnect=1" \ |
| 4385 | 0 \ |
| 4386 | -C "found session_ticket extension" \ |
| 4387 | -C "parse new session ticket" \ |
| 4388 | -c "a session has been resumed" |
| 4389 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4390 | # Tests for Max Fragment Length extension |
| 4391 | |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 4392 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4393 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4394 | run_test "Max fragment length: enabled, default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4395 | "$P_SRV debug_level=3" \ |
| 4396 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 4397 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4398 | -c "Maximum incoming record payload length is $MAX_CONTENT_LEN" \ |
| 4399 | -c "Maximum outgoing record payload length is $MAX_CONTENT_LEN" \ |
| 4400 | -s "Maximum incoming record payload length is $MAX_CONTENT_LEN" \ |
| 4401 | -s "Maximum outgoing record payload length is $MAX_CONTENT_LEN" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 4402 | -C "client hello, adding max_fragment_length extension" \ |
| 4403 | -S "found max fragment length extension" \ |
| 4404 | -S "server hello, max_fragment_length extension" \ |
| 4405 | -C "found max_fragment_length extension" |
| 4406 | |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 4407 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4408 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4409 | run_test "Max fragment length: enabled, default, larger message" \ |
| 4410 | "$P_SRV debug_level=3" \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4411 | "$P_CLI debug_level=3 request_size=$(( $MAX_CONTENT_LEN + 1))" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4412 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4413 | -c "Maximum incoming record payload length is $MAX_CONTENT_LEN" \ |
| 4414 | -c "Maximum outgoing record payload length is $MAX_CONTENT_LEN" \ |
| 4415 | -s "Maximum incoming record payload length is $MAX_CONTENT_LEN" \ |
| 4416 | -s "Maximum outgoing record payload length is $MAX_CONTENT_LEN" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4417 | -C "client hello, adding max_fragment_length extension" \ |
| 4418 | -S "found max fragment length extension" \ |
| 4419 | -S "server hello, max_fragment_length extension" \ |
| 4420 | -C "found max_fragment_length extension" \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4421 | -c "$(( $MAX_CONTENT_LEN + 1)) bytes written in 2 fragments" \ |
| 4422 | -s "$MAX_CONTENT_LEN bytes read" \ |
Hanno Becker | 9cfabe3 | 2017-10-18 14:42:01 +0100 | [diff] [blame] | 4423 | -s "1 bytes read" |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4424 | |
| 4425 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4426 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4427 | run_test "Max fragment length, DTLS: enabled, default, larger message" \ |
| 4428 | "$P_SRV debug_level=3 dtls=1" \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4429 | "$P_CLI debug_level=3 dtls=1 request_size=$(( $MAX_CONTENT_LEN + 1))" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4430 | 1 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4431 | -c "Maximum incoming record payload length is $MAX_CONTENT_LEN" \ |
| 4432 | -c "Maximum outgoing record payload length is $MAX_CONTENT_LEN" \ |
| 4433 | -s "Maximum incoming record payload length is $MAX_CONTENT_LEN" \ |
| 4434 | -s "Maximum outgoing record payload length is $MAX_CONTENT_LEN" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4435 | -C "client hello, adding max_fragment_length extension" \ |
| 4436 | -S "found max fragment length extension" \ |
| 4437 | -S "server hello, max_fragment_length extension" \ |
| 4438 | -C "found max_fragment_length extension" \ |
| 4439 | -c "fragment larger than.*maximum " |
| 4440 | |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4441 | # Run some tests with MBEDTLS_SSL_MAX_FRAGMENT_LENGTH disabled |
| 4442 | # (session fragment length will be 16384 regardless of mbedtls |
| 4443 | # content length configuration.) |
| 4444 | |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4445 | requires_config_disabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4446 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4447 | run_test "Max fragment length: disabled, larger message" \ |
| 4448 | "$P_SRV debug_level=3" \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4449 | "$P_CLI debug_level=3 request_size=$(( $MAX_CONTENT_LEN + 1))" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4450 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4451 | -C "Maximum incoming record payload length is 16384" \ |
| 4452 | -C "Maximum outgoing record payload length is 16384" \ |
| 4453 | -S "Maximum incoming record payload length is 16384" \ |
| 4454 | -S "Maximum outgoing record payload length is 16384" \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4455 | -c "$(( $MAX_CONTENT_LEN + 1)) bytes written in 2 fragments" \ |
| 4456 | -s "$MAX_CONTENT_LEN bytes read" \ |
Hanno Becker | 9cfabe3 | 2017-10-18 14:42:01 +0100 | [diff] [blame] | 4457 | -s "1 bytes read" |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4458 | |
| 4459 | requires_config_disabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4460 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Yuto Takano | 0509fea | 2021-06-21 19:43:33 +0100 | [diff] [blame] | 4461 | run_test "Max fragment length, DTLS: disabled, larger message" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4462 | "$P_SRV debug_level=3 dtls=1" \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 4463 | "$P_CLI debug_level=3 dtls=1 request_size=$(( $MAX_CONTENT_LEN + 1))" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4464 | 1 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4465 | -C "Maximum incoming record payload length is 16384" \ |
| 4466 | -C "Maximum outgoing record payload length is 16384" \ |
| 4467 | -S "Maximum incoming record payload length is 16384" \ |
| 4468 | -S "Maximum outgoing record payload length is 16384" \ |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4469 | -c "fragment larger than.*maximum " |
| 4470 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4471 | requires_max_content_len 4096 |
Hanno Becker | c526696 | 2017-09-18 15:01:50 +0100 | [diff] [blame] | 4472 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4473 | run_test "Max fragment length: used by client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4474 | "$P_SRV debug_level=3" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4475 | "$P_CLI force_version=tls12 debug_level=3 max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 4476 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4477 | -c "Maximum incoming record payload length is 4096" \ |
| 4478 | -c "Maximum outgoing record payload length is 4096" \ |
| 4479 | -s "Maximum incoming record payload length is 4096" \ |
| 4480 | -s "Maximum outgoing record payload length is 4096" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4481 | -c "client hello, adding max_fragment_length extension" \ |
| 4482 | -s "found max fragment length extension" \ |
| 4483 | -s "server hello, max_fragment_length extension" \ |
| 4484 | -c "found max_fragment_length extension" |
| 4485 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4486 | requires_max_content_len 1024 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4487 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 4488 | run_test "Max fragment length: client 512, server 1024" \ |
| 4489 | "$P_SRV debug_level=3 max_frag_len=1024" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4490 | "$P_CLI force_version=tls12 debug_level=3 max_frag_len=512" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4491 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4492 | -c "Maximum incoming record payload length is 512" \ |
| 4493 | -c "Maximum outgoing record payload length is 512" \ |
| 4494 | -s "Maximum incoming record payload length is 512" \ |
| 4495 | -s "Maximum outgoing record payload length is 512" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4496 | -c "client hello, adding max_fragment_length extension" \ |
| 4497 | -s "found max fragment length extension" \ |
| 4498 | -s "server hello, max_fragment_length extension" \ |
| 4499 | -c "found max_fragment_length extension" |
| 4500 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4501 | requires_max_content_len 2048 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4502 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 4503 | run_test "Max fragment length: client 512, server 2048" \ |
| 4504 | "$P_SRV debug_level=3 max_frag_len=2048" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4505 | "$P_CLI force_version=tls12 debug_level=3 max_frag_len=512" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4506 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4507 | -c "Maximum incoming record payload length is 512" \ |
| 4508 | -c "Maximum outgoing record payload length is 512" \ |
| 4509 | -s "Maximum incoming record payload length is 512" \ |
| 4510 | -s "Maximum outgoing record payload length is 512" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4511 | -c "client hello, adding max_fragment_length extension" \ |
| 4512 | -s "found max fragment length extension" \ |
| 4513 | -s "server hello, max_fragment_length extension" \ |
| 4514 | -c "found max_fragment_length extension" |
| 4515 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4516 | requires_max_content_len 4096 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4517 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 4518 | run_test "Max fragment length: client 512, server 4096" \ |
| 4519 | "$P_SRV debug_level=3 max_frag_len=4096" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4520 | "$P_CLI force_version=tls12 debug_level=3 max_frag_len=512" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4521 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4522 | -c "Maximum incoming record payload length is 512" \ |
| 4523 | -c "Maximum outgoing record payload length is 512" \ |
| 4524 | -s "Maximum incoming record payload length is 512" \ |
| 4525 | -s "Maximum outgoing record payload length is 512" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4526 | -c "client hello, adding max_fragment_length extension" \ |
| 4527 | -s "found max fragment length extension" \ |
| 4528 | -s "server hello, max_fragment_length extension" \ |
| 4529 | -c "found max_fragment_length extension" |
| 4530 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4531 | requires_max_content_len 1024 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4532 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 4533 | run_test "Max fragment length: client 1024, server 512" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4534 | "$P_SRV force_version=tls12 debug_level=3 max_frag_len=512" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4535 | "$P_CLI debug_level=3 max_frag_len=1024" \ |
| 4536 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4537 | -c "Maximum incoming record payload length is 1024" \ |
| 4538 | -c "Maximum outgoing record payload length is 1024" \ |
| 4539 | -s "Maximum incoming record payload length is 1024" \ |
| 4540 | -s "Maximum outgoing record payload length is 512" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4541 | -c "client hello, adding max_fragment_length extension" \ |
| 4542 | -s "found max fragment length extension" \ |
| 4543 | -s "server hello, max_fragment_length extension" \ |
| 4544 | -c "found max_fragment_length extension" |
| 4545 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4546 | requires_max_content_len 2048 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4547 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 4548 | run_test "Max fragment length: client 1024, server 2048" \ |
| 4549 | "$P_SRV debug_level=3 max_frag_len=2048" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4550 | "$P_CLI force_version=tls12 debug_level=3 max_frag_len=1024" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4551 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4552 | -c "Maximum incoming record payload length is 1024" \ |
| 4553 | -c "Maximum outgoing record payload length is 1024" \ |
| 4554 | -s "Maximum incoming record payload length is 1024" \ |
| 4555 | -s "Maximum outgoing record payload length is 1024" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4556 | -c "client hello, adding max_fragment_length extension" \ |
| 4557 | -s "found max fragment length extension" \ |
| 4558 | -s "server hello, max_fragment_length extension" \ |
| 4559 | -c "found max_fragment_length extension" |
| 4560 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4561 | requires_max_content_len 4096 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4562 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 4563 | run_test "Max fragment length: client 1024, server 4096" \ |
| 4564 | "$P_SRV debug_level=3 max_frag_len=4096" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4565 | "$P_CLI force_version=tls12 debug_level=3 max_frag_len=1024" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4566 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4567 | -c "Maximum incoming record payload length is 1024" \ |
| 4568 | -c "Maximum outgoing record payload length is 1024" \ |
| 4569 | -s "Maximum incoming record payload length is 1024" \ |
| 4570 | -s "Maximum outgoing record payload length is 1024" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4571 | -c "client hello, adding max_fragment_length extension" \ |
| 4572 | -s "found max fragment length extension" \ |
| 4573 | -s "server hello, max_fragment_length extension" \ |
| 4574 | -c "found max_fragment_length extension" |
| 4575 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4576 | requires_max_content_len 2048 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4577 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 4578 | run_test "Max fragment length: client 2048, server 512" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4579 | "$P_SRV force_version=tls12 debug_level=3 max_frag_len=512" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4580 | "$P_CLI debug_level=3 max_frag_len=2048" \ |
| 4581 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4582 | -c "Maximum incoming record payload length is 2048" \ |
| 4583 | -c "Maximum outgoing record payload length is 2048" \ |
| 4584 | -s "Maximum incoming record payload length is 2048" \ |
| 4585 | -s "Maximum outgoing record payload length is 512" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4586 | -c "client hello, adding max_fragment_length extension" \ |
| 4587 | -s "found max fragment length extension" \ |
| 4588 | -s "server hello, max_fragment_length extension" \ |
| 4589 | -c "found max_fragment_length extension" |
| 4590 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4591 | requires_max_content_len 2048 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4592 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 4593 | run_test "Max fragment length: client 2048, server 1024" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4594 | "$P_SRV force_version=tls12 debug_level=3 max_frag_len=1024" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4595 | "$P_CLI debug_level=3 max_frag_len=2048" \ |
| 4596 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4597 | -c "Maximum incoming record payload length is 2048" \ |
| 4598 | -c "Maximum outgoing record payload length is 2048" \ |
| 4599 | -s "Maximum incoming record payload length is 2048" \ |
| 4600 | -s "Maximum outgoing record payload length is 1024" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4601 | -c "client hello, adding max_fragment_length extension" \ |
| 4602 | -s "found max fragment length extension" \ |
| 4603 | -s "server hello, max_fragment_length extension" \ |
| 4604 | -c "found max_fragment_length extension" |
| 4605 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4606 | requires_max_content_len 4096 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4607 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 4608 | run_test "Max fragment length: client 2048, server 4096" \ |
| 4609 | "$P_SRV debug_level=3 max_frag_len=4096" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4610 | "$P_CLI force_version=tls12 debug_level=3 max_frag_len=2048" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4611 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4612 | -c "Maximum incoming record payload length is 2048" \ |
| 4613 | -c "Maximum outgoing record payload length is 2048" \ |
| 4614 | -s "Maximum incoming record payload length is 2048" \ |
| 4615 | -s "Maximum outgoing record payload length is 2048" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4616 | -c "client hello, adding max_fragment_length extension" \ |
| 4617 | -s "found max fragment length extension" \ |
| 4618 | -s "server hello, max_fragment_length extension" \ |
| 4619 | -c "found max_fragment_length extension" |
| 4620 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4621 | requires_max_content_len 4096 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4622 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 4623 | run_test "Max fragment length: client 4096, server 512" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4624 | "$P_SRV force_version=tls12 debug_level=3 max_frag_len=512" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4625 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
| 4626 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4627 | -c "Maximum incoming record payload length is 4096" \ |
| 4628 | -c "Maximum outgoing record payload length is 4096" \ |
| 4629 | -s "Maximum incoming record payload length is 4096" \ |
| 4630 | -s "Maximum outgoing record payload length is 512" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4631 | -c "client hello, adding max_fragment_length extension" \ |
| 4632 | -s "found max fragment length extension" \ |
| 4633 | -s "server hello, max_fragment_length extension" \ |
| 4634 | -c "found max_fragment_length extension" |
| 4635 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4636 | requires_max_content_len 4096 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4637 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 4638 | run_test "Max fragment length: client 4096, server 1024" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4639 | "$P_SRV force_version=tls12 debug_level=3 max_frag_len=1024" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4640 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
| 4641 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4642 | -c "Maximum incoming record payload length is 4096" \ |
| 4643 | -c "Maximum outgoing record payload length is 4096" \ |
| 4644 | -s "Maximum incoming record payload length is 4096" \ |
| 4645 | -s "Maximum outgoing record payload length is 1024" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4646 | -c "client hello, adding max_fragment_length extension" \ |
| 4647 | -s "found max fragment length extension" \ |
| 4648 | -s "server hello, max_fragment_length extension" \ |
| 4649 | -c "found max_fragment_length extension" |
| 4650 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4651 | requires_max_content_len 4096 |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4652 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
| 4653 | run_test "Max fragment length: client 4096, server 2048" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4654 | "$P_SRV force_version=tls12 debug_level=3 max_frag_len=2048" \ |
Andrzej Kurek | 90c6e84 | 2020-04-03 05:25:29 -0400 | [diff] [blame] | 4655 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
| 4656 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4657 | -c "Maximum incoming record payload length is 4096" \ |
| 4658 | -c "Maximum outgoing record payload length is 4096" \ |
| 4659 | -s "Maximum incoming record payload length is 4096" \ |
| 4660 | -s "Maximum outgoing record payload length is 2048" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 4661 | -c "client hello, adding max_fragment_length extension" \ |
| 4662 | -s "found max fragment length extension" \ |
| 4663 | -s "server hello, max_fragment_length extension" \ |
| 4664 | -c "found max_fragment_length extension" |
| 4665 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4666 | requires_max_content_len 4096 |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 4667 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4668 | run_test "Max fragment length: used by server" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4669 | "$P_SRV force_version=tls12 debug_level=3 max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4670 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 4671 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4672 | -c "Maximum incoming record payload length is $MAX_CONTENT_LEN" \ |
| 4673 | -c "Maximum outgoing record payload length is $MAX_CONTENT_LEN" \ |
| 4674 | -s "Maximum incoming record payload length is $MAX_CONTENT_LEN" \ |
| 4675 | -s "Maximum outgoing record payload length is 4096" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 4676 | -C "client hello, adding max_fragment_length extension" \ |
| 4677 | -S "found max fragment length extension" \ |
| 4678 | -S "server hello, max_fragment_length extension" \ |
| 4679 | -C "found max_fragment_length extension" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4680 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4681 | requires_max_content_len 4096 |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 4682 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4683 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4684 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4685 | run_test "Max fragment length: gnutls server" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 4686 | "$G_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4687 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 4688 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4689 | -c "Maximum incoming record payload length is 4096" \ |
| 4690 | -c "Maximum outgoing record payload length is 4096" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 4691 | -c "client hello, adding max_fragment_length extension" \ |
| 4692 | -c "found max_fragment_length extension" |
| 4693 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4694 | requires_max_content_len 2048 |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 4695 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4696 | run_test "Max fragment length: client, message just fits" \ |
| 4697 | "$P_SRV debug_level=3" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4698 | "$P_CLI force_version=tls12 debug_level=3 max_frag_len=2048 request_size=2048" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4699 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4700 | -c "Maximum incoming record payload length is 2048" \ |
| 4701 | -c "Maximum outgoing record payload length is 2048" \ |
| 4702 | -s "Maximum incoming record payload length is 2048" \ |
| 4703 | -s "Maximum outgoing record payload length is 2048" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4704 | -c "client hello, adding max_fragment_length extension" \ |
| 4705 | -s "found max fragment length extension" \ |
| 4706 | -s "server hello, max_fragment_length extension" \ |
| 4707 | -c "found max_fragment_length extension" \ |
| 4708 | -c "2048 bytes written in 1 fragments" \ |
| 4709 | -s "2048 bytes read" |
| 4710 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4711 | requires_max_content_len 2048 |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 4712 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4713 | run_test "Max fragment length: client, larger message" \ |
| 4714 | "$P_SRV debug_level=3" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 4715 | "$P_CLI force_version=tls12 debug_level=3 max_frag_len=2048 request_size=2345" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4716 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4717 | -c "Maximum incoming record payload length is 2048" \ |
| 4718 | -c "Maximum outgoing record payload length is 2048" \ |
| 4719 | -s "Maximum incoming record payload length is 2048" \ |
| 4720 | -s "Maximum outgoing record payload length is 2048" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4721 | -c "client hello, adding max_fragment_length extension" \ |
| 4722 | -s "found max fragment length extension" \ |
| 4723 | -s "server hello, max_fragment_length extension" \ |
| 4724 | -c "found max_fragment_length extension" \ |
| 4725 | -c "2345 bytes written in 2 fragments" \ |
| 4726 | -s "2048 bytes read" \ |
| 4727 | -s "297 bytes read" |
| 4728 | |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4729 | requires_max_content_len 2048 |
Hanno Becker | 4aed27e | 2017-09-18 15:00:34 +0100 | [diff] [blame] | 4730 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 4731 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 23eb74d | 2015-01-21 14:37:13 +0000 | [diff] [blame] | 4732 | run_test "Max fragment length: DTLS client, larger message" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4733 | "$P_SRV debug_level=3 dtls=1" \ |
| 4734 | "$P_CLI debug_level=3 dtls=1 max_frag_len=2048 request_size=2345" \ |
| 4735 | 1 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4736 | -c "Maximum incoming record payload length is 2048" \ |
| 4737 | -c "Maximum outgoing record payload length is 2048" \ |
| 4738 | -s "Maximum incoming record payload length is 2048" \ |
| 4739 | -s "Maximum outgoing record payload length is 2048" \ |
Manuel Pégourié-Gonnard | 37e08e1 | 2014-10-13 17:55:52 +0200 | [diff] [blame] | 4740 | -c "client hello, adding max_fragment_length extension" \ |
| 4741 | -s "found max fragment length extension" \ |
| 4742 | -s "server hello, max_fragment_length extension" \ |
| 4743 | -c "found max_fragment_length extension" \ |
| 4744 | -c "fragment larger than.*maximum" |
| 4745 | |
Jan Bruckner | aa31b19 | 2023-02-06 12:54:29 +0100 | [diff] [blame] | 4746 | # Tests for Record Size Limit extension |
| 4747 | |
Jan Bruckner | aa31b19 | 2023-02-06 12:54:29 +0100 | [diff] [blame] | 4748 | requires_gnutls_tls1_3 |
| 4749 | requires_gnutls_record_size_limit |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 4750 | requires_config_enabled MBEDTLS_SSL_RECORD_SIZE_LIMIT |
| 4751 | run_test "Record Size Limit: TLS 1.3: Server-side parsing, debug output and fatal alert" \ |
| 4752 | "$P_SRV debug_level=3 force_version=tls13" \ |
Jan Bruckner | aa31b19 | 2023-02-06 12:54:29 +0100 | [diff] [blame] | 4753 | "$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3 -V -d 4" \ |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 4754 | 1 \ |
| 4755 | -c "Preparing extension (Record Size Limit/28) for 'client hello'" \ |
| 4756 | -c "Sending extension Record Size Limit/28 (2 bytes)" \ |
| 4757 | -s "ClientHello: record_size_limit(28) extension received."\ |
| 4758 | -s "found record_size_limit extension" \ |
| 4759 | -s "RecordSizeLimit: 16385 Bytes" \ |
| 4760 | -c "Received alert \[110]: An unsupported extension was sent" |
| 4761 | |
| 4762 | requires_gnutls_tls1_3 |
| 4763 | requires_gnutls_record_size_limit |
| 4764 | requires_gnutls_next_disable_tls13_compat |
| 4765 | requires_config_enabled MBEDTLS_SSL_RECORD_SIZE_LIMIT |
| 4766 | run_test "Record Size Limit: TLS 1.3: Client-side parsing, debug output and fatal alert" \ |
| 4767 | "$G_NEXT_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%DISABLE_TLS13_COMPAT_MODE --disable-client-cert -d 4" \ |
| 4768 | "$P_CLI debug_level=4 force_version=tls13" \ |
Jan Bruckner | aa31b19 | 2023-02-06 12:54:29 +0100 | [diff] [blame] | 4769 | 0 \ |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 4770 | -s "Preparing extension (Record Size Limit/28) for 'encrypted extensions'" |
| 4771 | # The P_CLI can not yet send the Record Size Limit extension. Thus, the G_NEXT_SRV does not send |
| 4772 | # a response in its EncryptedExtensions record. |
| 4773 | # -s "Parsing extension 'Record Size Limit/28 (2 bytes)" \ |
| 4774 | # -s "Sending extension Record Size Limit/28 (2 bytes)" \ |
| 4775 | # -c "EncryptedExtensions: record_size_limit(28) extension received."\ |
| 4776 | # -c "found record_size_limit extension" \ |
| 4777 | # -c "RecordSizeLimit: 16385 Bytes" \ |
| 4778 | # -s "Received alert \[110]: An unsupported extension was sent" |
Jan Bruckner | aa31b19 | 2023-02-06 12:54:29 +0100 | [diff] [blame] | 4779 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4780 | # Tests for renegotiation |
| 4781 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4782 | # Renegotiation SCSV always added, regardless of SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4783 | run_test "Renegotiation: none, for reference" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4784 | "$P_SRV debug_level=3 exchanges=2 auth_mode=optional" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4785 | "$P_CLI force_version=tls12 debug_level=3 exchanges=2" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4786 | 0 \ |
| 4787 | -C "client hello, adding renegotiation extension" \ |
| 4788 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4789 | -S "found renegotiation extension" \ |
| 4790 | -s "server hello, secure renegotiation extension" \ |
| 4791 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 4792 | -C "=> renegotiate" \ |
| 4793 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4794 | -S "write hello request" |
| 4795 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4796 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4797 | run_test "Renegotiation: client-initiated" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4798 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4799 | "$P_CLI force_version=tls12 debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4800 | 0 \ |
| 4801 | -c "client hello, adding renegotiation extension" \ |
| 4802 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4803 | -s "found renegotiation extension" \ |
| 4804 | -s "server hello, secure renegotiation extension" \ |
| 4805 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 4806 | -c "=> renegotiate" \ |
| 4807 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4808 | -S "write hello request" |
| 4809 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4810 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4811 | run_test "Renegotiation: server-initiated" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4812 | "$P_SRV force_version=tls12 debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4813 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4814 | 0 \ |
| 4815 | -c "client hello, adding renegotiation extension" \ |
| 4816 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4817 | -s "found renegotiation extension" \ |
| 4818 | -s "server hello, secure renegotiation extension" \ |
| 4819 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 4820 | -c "=> renegotiate" \ |
| 4821 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4822 | -s "write hello request" |
| 4823 | |
Janos Follath | b0f148c | 2017-10-05 12:29:42 +0100 | [diff] [blame] | 4824 | # Checks that no Signature Algorithm with SHA-1 gets negotiated. Negotiating SHA-1 would mean that |
| 4825 | # the server did not parse the Signature Algorithm extension. This test is valid only if an MD |
Bence Szépkúti | bb0cfeb | 2021-05-28 09:42:25 +0200 | [diff] [blame] | 4826 | # algorithm stronger than SHA-1 is enabled in mbedtls_config.h |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4827 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Janos Follath | b0f148c | 2017-10-05 12:29:42 +0100 | [diff] [blame] | 4828 | run_test "Renegotiation: Signature Algorithms parsing, client-initiated" \ |
| 4829 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4830 | "$P_CLI force_version=tls12 debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Janos Follath | b0f148c | 2017-10-05 12:29:42 +0100 | [diff] [blame] | 4831 | 0 \ |
| 4832 | -c "client hello, adding renegotiation extension" \ |
| 4833 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4834 | -s "found renegotiation extension" \ |
| 4835 | -s "server hello, secure renegotiation extension" \ |
| 4836 | -c "found renegotiation extension" \ |
| 4837 | -c "=> renegotiate" \ |
| 4838 | -s "=> renegotiate" \ |
| 4839 | -S "write hello request" \ |
| 4840 | -S "client hello v3, signature_algorithm ext: 2" # Is SHA-1 negotiated? |
| 4841 | |
| 4842 | # Checks that no Signature Algorithm with SHA-1 gets negotiated. Negotiating SHA-1 would mean that |
| 4843 | # the server did not parse the Signature Algorithm extension. This test is valid only if an MD |
Bence Szépkúti | bb0cfeb | 2021-05-28 09:42:25 +0200 | [diff] [blame] | 4844 | # algorithm stronger than SHA-1 is enabled in mbedtls_config.h |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4845 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Janos Follath | b0f148c | 2017-10-05 12:29:42 +0100 | [diff] [blame] | 4846 | run_test "Renegotiation: Signature Algorithms parsing, server-initiated" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4847 | "$P_SRV force_version=tls12 debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1" \ |
Janos Follath | b0f148c | 2017-10-05 12:29:42 +0100 | [diff] [blame] | 4848 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
| 4849 | 0 \ |
| 4850 | -c "client hello, adding renegotiation extension" \ |
| 4851 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4852 | -s "found renegotiation extension" \ |
| 4853 | -s "server hello, secure renegotiation extension" \ |
| 4854 | -c "found renegotiation extension" \ |
| 4855 | -c "=> renegotiate" \ |
| 4856 | -s "=> renegotiate" \ |
| 4857 | -s "write hello request" \ |
| 4858 | -S "client hello v3, signature_algorithm ext: 2" # Is SHA-1 negotiated? |
| 4859 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4860 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4861 | run_test "Renegotiation: double" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4862 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4863 | "$P_CLI force_version=tls12 debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4864 | 0 \ |
| 4865 | -c "client hello, adding renegotiation extension" \ |
| 4866 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4867 | -s "found renegotiation extension" \ |
| 4868 | -s "server hello, secure renegotiation extension" \ |
| 4869 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 4870 | -c "=> renegotiate" \ |
| 4871 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4872 | -s "write hello request" |
| 4873 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4874 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Andrzej Kurek | 8ea6872 | 2020-04-03 06:40:47 -0400 | [diff] [blame] | 4875 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | b0a1c5b | 2021-07-02 10:10:49 +0100 | [diff] [blame] | 4876 | requires_max_content_len 2048 |
Andrzej Kurek | 8ea6872 | 2020-04-03 06:40:47 -0400 | [diff] [blame] | 4877 | run_test "Renegotiation with max fragment length: client 2048, server 512" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4878 | "$P_SRV force_version=tls12 debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1 max_frag_len=512" \ |
Andrzej Kurek | 8ea6872 | 2020-04-03 06:40:47 -0400 | [diff] [blame] | 4879 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 max_frag_len=2048 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8" \ |
| 4880 | 0 \ |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 4881 | -c "Maximum incoming record payload length is 2048" \ |
| 4882 | -c "Maximum outgoing record payload length is 2048" \ |
| 4883 | -s "Maximum incoming record payload length is 2048" \ |
| 4884 | -s "Maximum outgoing record payload length is 512" \ |
Andrzej Kurek | 8ea6872 | 2020-04-03 06:40:47 -0400 | [diff] [blame] | 4885 | -c "client hello, adding max_fragment_length extension" \ |
| 4886 | -s "found max fragment length extension" \ |
| 4887 | -s "server hello, max_fragment_length extension" \ |
| 4888 | -c "found max_fragment_length extension" \ |
| 4889 | -c "client hello, adding renegotiation extension" \ |
| 4890 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4891 | -s "found renegotiation extension" \ |
| 4892 | -s "server hello, secure renegotiation extension" \ |
| 4893 | -c "found renegotiation extension" \ |
| 4894 | -c "=> renegotiate" \ |
| 4895 | -s "=> renegotiate" \ |
| 4896 | -s "write hello request" |
| 4897 | |
| 4898 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4899 | run_test "Renegotiation: client-initiated, server-rejected" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4900 | "$P_SRV debug_level=3 exchanges=2 renegotiation=0 auth_mode=optional" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4901 | "$P_CLI force_version=tls12 debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4902 | 1 \ |
| 4903 | -c "client hello, adding renegotiation extension" \ |
| 4904 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4905 | -S "found renegotiation extension" \ |
| 4906 | -s "server hello, secure renegotiation extension" \ |
| 4907 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 4908 | -c "=> renegotiate" \ |
| 4909 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4910 | -S "write hello request" \ |
Manuel Pégourié-Gonnard | 6591962 | 2014-08-19 12:50:30 +0200 | [diff] [blame] | 4911 | -c "SSL - Unexpected message at ServerHello in renegotiation" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4912 | -c "failed" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4913 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4914 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4915 | run_test "Renegotiation: server-initiated, client-rejected, default" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4916 | "$P_SRV force_version=tls12 debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4917 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4918 | 0 \ |
| 4919 | -C "client hello, adding renegotiation extension" \ |
| 4920 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4921 | -S "found renegotiation extension" \ |
| 4922 | -s "server hello, secure renegotiation extension" \ |
| 4923 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 4924 | -C "=> renegotiate" \ |
| 4925 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 4926 | -s "write hello request" \ |
Manuel Pégourié-Gonnard | a9964db | 2014-07-03 19:29:16 +0200 | [diff] [blame] | 4927 | -S "SSL - An unexpected message was received from our peer" \ |
| 4928 | -S "failed" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 4929 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4930 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4931 | run_test "Renegotiation: server-initiated, client-rejected, not enforced" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4932 | "$P_SRV force_version=tls12 debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4933 | renego_delay=-1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4934 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4935 | 0 \ |
| 4936 | -C "client hello, adding renegotiation extension" \ |
| 4937 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4938 | -S "found renegotiation extension" \ |
| 4939 | -s "server hello, secure renegotiation extension" \ |
| 4940 | -c "found renegotiation extension" \ |
| 4941 | -C "=> renegotiate" \ |
| 4942 | -S "=> renegotiate" \ |
| 4943 | -s "write hello request" \ |
| 4944 | -S "SSL - An unexpected message was received from our peer" \ |
| 4945 | -S "failed" |
| 4946 | |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 4947 | # delay 2 for 1 alert record + 1 application data record |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4948 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4949 | run_test "Renegotiation: server-initiated, client-rejected, delay 2" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4950 | "$P_SRV force_version=tls12 debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4951 | renego_delay=2 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4952 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4953 | 0 \ |
| 4954 | -C "client hello, adding renegotiation extension" \ |
| 4955 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4956 | -S "found renegotiation extension" \ |
| 4957 | -s "server hello, secure renegotiation extension" \ |
| 4958 | -c "found renegotiation extension" \ |
| 4959 | -C "=> renegotiate" \ |
| 4960 | -S "=> renegotiate" \ |
| 4961 | -s "write hello request" \ |
| 4962 | -S "SSL - An unexpected message was received from our peer" \ |
| 4963 | -S "failed" |
| 4964 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4965 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4966 | run_test "Renegotiation: server-initiated, client-rejected, delay 0" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4967 | "$P_SRV force_version=tls12 debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4968 | renego_delay=0 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4969 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4970 | 0 \ |
| 4971 | -C "client hello, adding renegotiation extension" \ |
| 4972 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4973 | -S "found renegotiation extension" \ |
| 4974 | -s "server hello, secure renegotiation extension" \ |
| 4975 | -c "found renegotiation extension" \ |
| 4976 | -C "=> renegotiate" \ |
| 4977 | -S "=> renegotiate" \ |
| 4978 | -s "write hello request" \ |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 4979 | -s "SSL - An unexpected message was received from our peer" |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4980 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4981 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 4982 | run_test "Renegotiation: server-initiated, client-accepted, delay 0" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 4983 | "$P_SRV force_version=tls12 debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 4984 | renego_delay=0 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 4985 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 4986 | 0 \ |
| 4987 | -c "client hello, adding renegotiation extension" \ |
| 4988 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 4989 | -s "found renegotiation extension" \ |
| 4990 | -s "server hello, secure renegotiation extension" \ |
| 4991 | -c "found renegotiation extension" \ |
| 4992 | -c "=> renegotiate" \ |
| 4993 | -s "=> renegotiate" \ |
| 4994 | -s "write hello request" \ |
| 4995 | -S "SSL - An unexpected message was received from our peer" \ |
| 4996 | -S "failed" |
| 4997 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 4998 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 4999 | run_test "Renegotiation: periodic, just below period" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 5000 | "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5001 | "$P_CLI force_version=tls12 debug_level=3 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 5002 | 0 \ |
| 5003 | -C "client hello, adding renegotiation extension" \ |
| 5004 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 5005 | -S "found renegotiation extension" \ |
| 5006 | -s "server hello, secure renegotiation extension" \ |
| 5007 | -c "found renegotiation extension" \ |
| 5008 | -S "record counter limit reached: renegotiate" \ |
| 5009 | -C "=> renegotiate" \ |
| 5010 | -S "=> renegotiate" \ |
| 5011 | -S "write hello request" \ |
| 5012 | -S "SSL - An unexpected message was received from our peer" \ |
| 5013 | -S "failed" |
| 5014 | |
Manuel Pégourié-Gonnard | 9835bc0 | 2015-01-14 14:41:58 +0100 | [diff] [blame] | 5015 | # one extra exchange to be able to complete renego |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5016 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 5017 | run_test "Renegotiation: periodic, just above period" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5018 | "$P_SRV force_version=tls12 debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 9835bc0 | 2015-01-14 14:41:58 +0100 | [diff] [blame] | 5019 | "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 5020 | 0 \ |
| 5021 | -c "client hello, adding renegotiation extension" \ |
| 5022 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 5023 | -s "found renegotiation extension" \ |
| 5024 | -s "server hello, secure renegotiation extension" \ |
| 5025 | -c "found renegotiation extension" \ |
| 5026 | -s "record counter limit reached: renegotiate" \ |
| 5027 | -c "=> renegotiate" \ |
| 5028 | -s "=> renegotiate" \ |
| 5029 | -s "write hello request" \ |
| 5030 | -S "SSL - An unexpected message was received from our peer" \ |
| 5031 | -S "failed" |
| 5032 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5033 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 5034 | run_test "Renegotiation: periodic, two times period" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 5035 | "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5036 | "$P_CLI force_version=tls12 debug_level=3 exchanges=7 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 5037 | 0 \ |
| 5038 | -c "client hello, adding renegotiation extension" \ |
| 5039 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 5040 | -s "found renegotiation extension" \ |
| 5041 | -s "server hello, secure renegotiation extension" \ |
| 5042 | -c "found renegotiation extension" \ |
| 5043 | -s "record counter limit reached: renegotiate" \ |
| 5044 | -c "=> renegotiate" \ |
| 5045 | -s "=> renegotiate" \ |
| 5046 | -s "write hello request" \ |
| 5047 | -S "SSL - An unexpected message was received from our peer" \ |
| 5048 | -S "failed" |
| 5049 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5050 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 5051 | run_test "Renegotiation: periodic, above period, disabled" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5052 | "$P_SRV force_version=tls12 debug_level=3 exchanges=9 renegotiation=0 renego_period=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 5053 | "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \ |
| 5054 | 0 \ |
| 5055 | -C "client hello, adding renegotiation extension" \ |
| 5056 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 5057 | -S "found renegotiation extension" \ |
| 5058 | -s "server hello, secure renegotiation extension" \ |
| 5059 | -c "found renegotiation extension" \ |
| 5060 | -S "record counter limit reached: renegotiate" \ |
| 5061 | -C "=> renegotiate" \ |
| 5062 | -S "=> renegotiate" \ |
| 5063 | -S "write hello request" \ |
| 5064 | -S "SSL - An unexpected message was received from our peer" \ |
| 5065 | -S "failed" |
| 5066 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5067 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5068 | run_test "Renegotiation: nbio, client-initiated" \ |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 5069 | "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 auth_mode=optional" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5070 | "$P_CLI force_version=tls12 debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | f07f421 | 2014-08-15 19:04:47 +0200 | [diff] [blame] | 5071 | 0 \ |
| 5072 | -c "client hello, adding renegotiation extension" \ |
| 5073 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 5074 | -s "found renegotiation extension" \ |
| 5075 | -s "server hello, secure renegotiation extension" \ |
| 5076 | -c "found renegotiation extension" \ |
| 5077 | -c "=> renegotiate" \ |
| 5078 | -s "=> renegotiate" \ |
| 5079 | -S "write hello request" |
| 5080 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5081 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5082 | run_test "Renegotiation: nbio, server-initiated" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5083 | "$P_SRV force_version=tls12 debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5084 | "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | f07f421 | 2014-08-15 19:04:47 +0200 | [diff] [blame] | 5085 | 0 \ |
| 5086 | -c "client hello, adding renegotiation extension" \ |
| 5087 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 5088 | -s "found renegotiation extension" \ |
| 5089 | -s "server hello, secure renegotiation extension" \ |
| 5090 | -c "found renegotiation extension" \ |
| 5091 | -c "=> renegotiate" \ |
| 5092 | -s "=> renegotiate" \ |
| 5093 | -s "write hello request" |
| 5094 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5095 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5096 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5097 | run_test "Renegotiation: openssl server, client-initiated" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 5098 | "$O_SRV -www -tls1_2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5099 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 5100 | 0 \ |
| 5101 | -c "client hello, adding renegotiation extension" \ |
| 5102 | -c "found renegotiation extension" \ |
| 5103 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5104 | -C "ssl_hanshake() returned" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 5105 | -C "error" \ |
| 5106 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 5107 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 5108 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5109 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5110 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5111 | run_test "Renegotiation: gnutls server strict, client-initiated" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 5112 | "$G_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:%SAFE_RENEGOTIATION" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5113 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 5114 | 0 \ |
| 5115 | -c "client hello, adding renegotiation extension" \ |
| 5116 | -c "found renegotiation extension" \ |
| 5117 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5118 | -C "ssl_hanshake() returned" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 5119 | -C "error" \ |
| 5120 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 5121 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 5122 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5123 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5124 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5125 | run_test "Renegotiation: gnutls server unsafe, client-initiated default" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 5126 | "$G_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:%DISABLE_SAFE_RENEGOTIATION" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5127 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
| 5128 | 1 \ |
| 5129 | -c "client hello, adding renegotiation extension" \ |
| 5130 | -C "found renegotiation extension" \ |
| 5131 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5132 | -c "mbedtls_ssl_handshake() returned" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5133 | -c "error" \ |
| 5134 | -C "HTTP/1.0 200 [Oo][Kk]" |
| 5135 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 5136 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5137 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5138 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5139 | run_test "Renegotiation: gnutls server unsafe, client-inititated no legacy" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 5140 | "$G_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:%DISABLE_SAFE_RENEGOTIATION" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5141 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \ |
| 5142 | allow_legacy=0" \ |
| 5143 | 1 \ |
| 5144 | -c "client hello, adding renegotiation extension" \ |
| 5145 | -C "found renegotiation extension" \ |
| 5146 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5147 | -c "mbedtls_ssl_handshake() returned" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5148 | -c "error" \ |
| 5149 | -C "HTTP/1.0 200 [Oo][Kk]" |
| 5150 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 5151 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5152 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5153 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5154 | run_test "Renegotiation: gnutls server unsafe, client-inititated legacy" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 5155 | "$G_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:%DISABLE_SAFE_RENEGOTIATION" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5156 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1 \ |
| 5157 | allow_legacy=1" \ |
| 5158 | 0 \ |
| 5159 | -c "client hello, adding renegotiation extension" \ |
| 5160 | -C "found renegotiation extension" \ |
| 5161 | -c "=> renegotiate" \ |
| 5162 | -C "ssl_hanshake() returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5163 | -C "error" \ |
| 5164 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 5165 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5166 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5167 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 30d16eb | 2014-08-19 17:43:50 +0200 | [diff] [blame] | 5168 | run_test "Renegotiation: DTLS, client-initiated" \ |
| 5169 | "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1" \ |
| 5170 | "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 5171 | 0 \ |
| 5172 | -c "client hello, adding renegotiation extension" \ |
| 5173 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 5174 | -s "found renegotiation extension" \ |
| 5175 | -s "server hello, secure renegotiation extension" \ |
| 5176 | -c "found renegotiation extension" \ |
| 5177 | -c "=> renegotiate" \ |
| 5178 | -s "=> renegotiate" \ |
| 5179 | -S "write hello request" |
| 5180 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5181 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5182 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | c392b24 | 2014-08-19 17:53:11 +0200 | [diff] [blame] | 5183 | run_test "Renegotiation: DTLS, server-initiated" \ |
| 5184 | "$P_SRV debug_level=3 dtls=1 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | df9a0a8 | 2014-10-02 14:17:18 +0200 | [diff] [blame] | 5185 | "$P_CLI debug_level=3 dtls=1 exchanges=2 renegotiation=1 \ |
| 5186 | read_timeout=1000 max_resend=2" \ |
Manuel Pégourié-Gonnard | c392b24 | 2014-08-19 17:53:11 +0200 | [diff] [blame] | 5187 | 0 \ |
| 5188 | -c "client hello, adding renegotiation extension" \ |
| 5189 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 5190 | -s "found renegotiation extension" \ |
| 5191 | -s "server hello, secure renegotiation extension" \ |
| 5192 | -c "found renegotiation extension" \ |
| 5193 | -c "=> renegotiate" \ |
| 5194 | -s "=> renegotiate" \ |
| 5195 | -s "write hello request" |
| 5196 | |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5197 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5198 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andres AG | 692ad84 | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 5199 | run_test "Renegotiation: DTLS, renego_period overflow" \ |
| 5200 | "$P_SRV debug_level=3 dtls=1 exchanges=4 renegotiation=1 renego_period=18446462598732840962 auth_mode=optional" \ |
| 5201 | "$P_CLI debug_level=3 dtls=1 exchanges=4 renegotiation=1" \ |
| 5202 | 0 \ |
| 5203 | -c "client hello, adding renegotiation extension" \ |
| 5204 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 5205 | -s "found renegotiation extension" \ |
| 5206 | -s "server hello, secure renegotiation extension" \ |
| 5207 | -s "record counter limit reached: renegotiate" \ |
| 5208 | -c "=> renegotiate" \ |
| 5209 | -s "=> renegotiate" \ |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5210 | -s "write hello request" |
Andres AG | 692ad84 | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 5211 | |
Manuel Pégourié-Gonnard | 9699996 | 2015-02-17 16:02:37 +0000 | [diff] [blame] | 5212 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 5213 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5214 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | f1499f6 | 2014-08-31 17:13:13 +0200 | [diff] [blame] | 5215 | run_test "Renegotiation: DTLS, gnutls server, client-initiated" \ |
| 5216 | "$G_SRV -u --mtu 4096" \ |
| 5217 | "$P_CLI debug_level=3 dtls=1 exchanges=1 renegotiation=1 renegotiate=1" \ |
| 5218 | 0 \ |
| 5219 | -c "client hello, adding renegotiation extension" \ |
| 5220 | -c "found renegotiation extension" \ |
| 5221 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5222 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | f1499f6 | 2014-08-31 17:13:13 +0200 | [diff] [blame] | 5223 | -C "error" \ |
| 5224 | -s "Extra-header:" |
| 5225 | |
Shaun Case | 8b0ecbc | 2021-12-20 21:14:10 -0800 | [diff] [blame] | 5226 | # Test for the "secure renegotiation" extension only (no actual renegotiation) |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5227 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 5228 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5229 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5230 | run_test "Renego ext: gnutls server strict, client default" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 5231 | "$G_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:%SAFE_RENEGOTIATION" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5232 | "$P_CLI debug_level=3" \ |
| 5233 | 0 \ |
| 5234 | -c "found renegotiation extension" \ |
| 5235 | -C "error" \ |
| 5236 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 5237 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 5238 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5239 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5240 | run_test "Renego ext: gnutls server unsafe, client default" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 5241 | "$G_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:%DISABLE_SAFE_RENEGOTIATION" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5242 | "$P_CLI debug_level=3" \ |
| 5243 | 0 \ |
| 5244 | -C "found renegotiation extension" \ |
| 5245 | -C "error" \ |
| 5246 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 5247 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 5248 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5249 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5250 | run_test "Renego ext: gnutls server unsafe, client break legacy" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 5251 | "$G_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:%DISABLE_SAFE_RENEGOTIATION" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5252 | "$P_CLI debug_level=3 allow_legacy=-1" \ |
| 5253 | 1 \ |
| 5254 | -C "found renegotiation extension" \ |
| 5255 | -c "error" \ |
| 5256 | -C "HTTP/1.0 200 [Oo][Kk]" |
| 5257 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 5258 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5259 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5260 | run_test "Renego ext: gnutls client strict, server default" \ |
| 5261 | "$P_SRV debug_level=3" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 5262 | "$G_CLI --priority=NORMAL:%SAFE_RENEGOTIATION localhost" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5263 | 0 \ |
| 5264 | -s "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ |
| 5265 | -s "server hello, secure renegotiation extension" |
| 5266 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 5267 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5268 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5269 | run_test "Renego ext: gnutls client unsafe, server default" \ |
| 5270 | "$P_SRV debug_level=3" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 5271 | "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION localhost" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5272 | 0 \ |
| 5273 | -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ |
| 5274 | -S "server hello, secure renegotiation extension" |
| 5275 | |
Paul Bakker | 539d972 | 2015-02-08 16:18:35 +0100 | [diff] [blame] | 5276 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5277 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5278 | run_test "Renego ext: gnutls client unsafe, server break legacy" \ |
| 5279 | "$P_SRV debug_level=3 allow_legacy=-1" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 5280 | "$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION localhost" \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 5281 | 1 \ |
| 5282 | -S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \ |
| 5283 | -S "server hello, secure renegotiation extension" |
| 5284 | |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5285 | # Tests for silently dropping trailing extra bytes in .der certificates |
| 5286 | |
| 5287 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5288 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5289 | run_test "DER format: no trailing bytes" \ |
| 5290 | "$P_SRV crt_file=data_files/server5-der0.crt \ |
| 5291 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 5292 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5293 | 0 \ |
| 5294 | -c "Handshake was completed" \ |
| 5295 | |
| 5296 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5297 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5298 | run_test "DER format: with a trailing zero byte" \ |
| 5299 | "$P_SRV crt_file=data_files/server5-der1a.crt \ |
| 5300 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 5301 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5302 | 0 \ |
| 5303 | -c "Handshake was completed" \ |
| 5304 | |
| 5305 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5306 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5307 | run_test "DER format: with a trailing random byte" \ |
| 5308 | "$P_SRV crt_file=data_files/server5-der1b.crt \ |
| 5309 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 5310 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5311 | 0 \ |
| 5312 | -c "Handshake was completed" \ |
| 5313 | |
| 5314 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5315 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5316 | run_test "DER format: with 2 trailing random bytes" \ |
| 5317 | "$P_SRV crt_file=data_files/server5-der2.crt \ |
| 5318 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 5319 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5320 | 0 \ |
| 5321 | -c "Handshake was completed" \ |
| 5322 | |
| 5323 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5324 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5325 | run_test "DER format: with 4 trailing random bytes" \ |
| 5326 | "$P_SRV crt_file=data_files/server5-der4.crt \ |
| 5327 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 5328 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5329 | 0 \ |
| 5330 | -c "Handshake was completed" \ |
| 5331 | |
| 5332 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5333 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5334 | run_test "DER format: with 8 trailing random bytes" \ |
| 5335 | "$P_SRV crt_file=data_files/server5-der8.crt \ |
| 5336 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 5337 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5338 | 0 \ |
| 5339 | -c "Handshake was completed" \ |
| 5340 | |
| 5341 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5342 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5343 | run_test "DER format: with 9 trailing random bytes" \ |
| 5344 | "$P_SRV crt_file=data_files/server5-der9.crt \ |
| 5345 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 5346 | "$G_CLI localhost" \ |
Janos Follath | 0b24234 | 2016-02-17 10:11:21 +0000 | [diff] [blame] | 5347 | 0 \ |
| 5348 | -c "Handshake was completed" \ |
| 5349 | |
Jarno Lamsa | f7a7f9e | 2019-04-01 15:11:54 +0300 | [diff] [blame] | 5350 | # Tests for auth_mode, there are duplicated tests using ca callback for authentication |
| 5351 | # When updating these tests, modify the matching authentication tests accordingly |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5352 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 5353 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5354 | run_test "Authentication: server badcert, client required" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5355 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
| 5356 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5357 | "$P_CLI debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5358 | 1 \ |
| 5359 | -c "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 5360 | -c "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5361 | -c "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5362 | -c "X509 - Certificate verification failed" |
| 5363 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5364 | run_test "Authentication: server badcert, client optional" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5365 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
| 5366 | key_file=data_files/server5.key" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5367 | "$P_CLI force_version=tls12 debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5368 | 0 \ |
| 5369 | -c "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 5370 | -c "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5371 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5372 | -C "X509 - Certificate verification failed" |
| 5373 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 5374 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 5375 | run_test "Authentication: server goodcert, client optional, no trusted CA" \ |
| 5376 | "$P_SRV" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5377 | "$P_CLI force_version=tls12 debug_level=3 auth_mode=optional ca_file=none ca_path=none" \ |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 5378 | 0 \ |
| 5379 | -c "x509_verify_cert() returned" \ |
| 5380 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 5381 | -c "! Certificate verification flags"\ |
| 5382 | -C "! mbedtls_ssl_handshake returned" \ |
| 5383 | -C "X509 - Certificate verification failed" \ |
| 5384 | -C "SSL - No CA Chain is set, but required to operate" |
| 5385 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 5386 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 5387 | run_test "Authentication: server goodcert, client required, no trusted CA" \ |
| 5388 | "$P_SRV" \ |
| 5389 | "$P_CLI debug_level=3 auth_mode=required ca_file=none ca_path=none" \ |
| 5390 | 1 \ |
| 5391 | -c "x509_verify_cert() returned" \ |
| 5392 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 5393 | -c "! Certificate verification flags"\ |
| 5394 | -c "! mbedtls_ssl_handshake returned" \ |
| 5395 | -c "SSL - No CA Chain is set, but required to operate" |
| 5396 | |
| 5397 | # The purpose of the next two tests is to test the client's behaviour when receiving a server |
| 5398 | # certificate with an unsupported elliptic curve. This should usually not happen because |
| 5399 | # the client informs the server about the supported curves - it does, though, in the |
| 5400 | # corner case of a static ECDH suite, because the server doesn't check the curve on that |
| 5401 | # occasion (to be fixed). If that bug's fixed, the test needs to be altered to use a |
| 5402 | # different means to have the server ignoring the client's supported curve list. |
| 5403 | |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 5404 | run_test "Authentication: server ECDH p256v1, client required, p256v1 unsupported" \ |
| 5405 | "$P_SRV debug_level=1 key_file=data_files/server5.key \ |
| 5406 | crt_file=data_files/server5.ku-ka.crt" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 5407 | "$P_CLI force_version=tls12 debug_level=3 auth_mode=required groups=secp521r1" \ |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 5408 | 1 \ |
| 5409 | -c "bad certificate (EC key curve)"\ |
| 5410 | -c "! Certificate verification flags"\ |
| 5411 | -C "bad server certificate (ECDH curve)" # Expect failure at earlier verification stage |
| 5412 | |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 5413 | run_test "Authentication: server ECDH p256v1, client optional, p256v1 unsupported" \ |
| 5414 | "$P_SRV debug_level=1 key_file=data_files/server5.key \ |
| 5415 | crt_file=data_files/server5.ku-ka.crt" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 5416 | "$P_CLI force_version=tls12 debug_level=3 auth_mode=optional groups=secp521r1" \ |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 5417 | 1 \ |
| 5418 | -c "bad certificate (EC key curve)"\ |
| 5419 | -c "! Certificate verification flags"\ |
| 5420 | -c "bad server certificate (ECDH curve)" # Expect failure only at ECDH params check |
| 5421 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5422 | run_test "Authentication: server badcert, client none" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 5423 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5424 | key_file=data_files/server5.key" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5425 | "$P_CLI force_version=tls12 debug_level=1 auth_mode=none" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5426 | 0 \ |
| 5427 | -C "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 5428 | -C "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5429 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5430 | -C "X509 - Certificate verification failed" |
| 5431 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 5432 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 5433 | run_test "Authentication: client SHA256, server required" \ |
| 5434 | "$P_SRV auth_mode=required" \ |
| 5435 | "$P_CLI debug_level=3 crt_file=data_files/server6.crt \ |
| 5436 | key_file=data_files/server6.key \ |
| 5437 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ |
| 5438 | 0 \ |
Andrzej Kurek | ec71b09 | 2022-11-15 10:21:50 -0500 | [diff] [blame] | 5439 | -c "Supported Signature Algorithm found: 04 " \ |
| 5440 | -c "Supported Signature Algorithm found: 05 " |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 5441 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 5442 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 5443 | run_test "Authentication: client SHA384, server required" \ |
| 5444 | "$P_SRV auth_mode=required" \ |
| 5445 | "$P_CLI debug_level=3 crt_file=data_files/server6.crt \ |
| 5446 | key_file=data_files/server6.key \ |
| 5447 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ |
| 5448 | 0 \ |
Andrzej Kurek | ec71b09 | 2022-11-15 10:21:50 -0500 | [diff] [blame] | 5449 | -c "Supported Signature Algorithm found: 04 " \ |
| 5450 | -c "Supported Signature Algorithm found: 05 " |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 5451 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 5452 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Gilles Peskine | fd8332e | 2017-05-03 16:25:07 +0200 | [diff] [blame] | 5453 | run_test "Authentication: client has no cert, server required (TLS)" \ |
| 5454 | "$P_SRV debug_level=3 auth_mode=required" \ |
| 5455 | "$P_CLI debug_level=3 crt_file=none \ |
| 5456 | key_file=data_files/server5.key" \ |
| 5457 | 1 \ |
| 5458 | -S "skip write certificate request" \ |
| 5459 | -C "skip parse certificate request" \ |
| 5460 | -c "got a certificate request" \ |
| 5461 | -c "= write certificate$" \ |
| 5462 | -C "skip write certificate$" \ |
| 5463 | -S "x509_verify_cert() returned" \ |
Ronald Cron | 1938588 | 2022-06-15 16:26:13 +0200 | [diff] [blame] | 5464 | -s "peer has no certificate" \ |
Gilles Peskine | fd8332e | 2017-05-03 16:25:07 +0200 | [diff] [blame] | 5465 | -s "! mbedtls_ssl_handshake returned" \ |
Gilles Peskine | fd8332e | 2017-05-03 16:25:07 +0200 | [diff] [blame] | 5466 | -s "No client certification received from the client, but required by the authentication mode" |
| 5467 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 5468 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5469 | run_test "Authentication: client badcert, server required" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5470 | "$P_SRV debug_level=3 auth_mode=required" \ |
| 5471 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5472 | key_file=data_files/server5.key" \ |
| 5473 | 1 \ |
| 5474 | -S "skip write certificate request" \ |
| 5475 | -C "skip parse certificate request" \ |
| 5476 | -c "got a certificate request" \ |
| 5477 | -C "skip write certificate" \ |
| 5478 | -C "skip write certificate verify" \ |
| 5479 | -S "skip parse certificate verify" \ |
| 5480 | -s "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 5481 | -s "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5482 | -s "! mbedtls_ssl_handshake returned" \ |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 5483 | -s "send alert level=2 message=48" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5484 | -s "X509 - Certificate verification failed" |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 5485 | # We don't check that the client receives the alert because it might |
| 5486 | # detect that its write end of the connection is closed and abort |
| 5487 | # before reading the alert message. |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5488 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 5489 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Gilles Peskine | e1cc60e | 2022-01-07 23:10:56 +0100 | [diff] [blame] | 5490 | run_test "Authentication: client cert self-signed and trusted, server required" \ |
| 5491 | "$P_SRV debug_level=3 auth_mode=required ca_file=data_files/server5-selfsigned.crt" \ |
| 5492 | "$P_CLI debug_level=3 crt_file=data_files/server5-selfsigned.crt \ |
| 5493 | key_file=data_files/server5.key" \ |
| 5494 | 0 \ |
| 5495 | -S "skip write certificate request" \ |
| 5496 | -C "skip parse certificate request" \ |
| 5497 | -c "got a certificate request" \ |
| 5498 | -C "skip write certificate" \ |
| 5499 | -C "skip write certificate verify" \ |
| 5500 | -S "skip parse certificate verify" \ |
| 5501 | -S "x509_verify_cert() returned" \ |
| 5502 | -S "! The certificate is not correctly signed" \ |
| 5503 | -S "X509 - Certificate verification failed" |
| 5504 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 5505 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Janos Follath | 89baba2 | 2017-04-10 14:34:35 +0100 | [diff] [blame] | 5506 | run_test "Authentication: client cert not trusted, server required" \ |
| 5507 | "$P_SRV debug_level=3 auth_mode=required" \ |
| 5508 | "$P_CLI debug_level=3 crt_file=data_files/server5-selfsigned.crt \ |
| 5509 | key_file=data_files/server5.key" \ |
| 5510 | 1 \ |
| 5511 | -S "skip write certificate request" \ |
| 5512 | -C "skip parse certificate request" \ |
| 5513 | -c "got a certificate request" \ |
| 5514 | -C "skip write certificate" \ |
| 5515 | -C "skip write certificate verify" \ |
| 5516 | -S "skip parse certificate verify" \ |
| 5517 | -s "x509_verify_cert() returned" \ |
| 5518 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 5519 | -s "! mbedtls_ssl_handshake returned" \ |
Janos Follath | 89baba2 | 2017-04-10 14:34:35 +0100 | [diff] [blame] | 5520 | -s "X509 - Certificate verification failed" |
| 5521 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 5522 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5523 | run_test "Authentication: client badcert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5524 | "$P_SRV debug_level=3 auth_mode=optional" \ |
| 5525 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5526 | key_file=data_files/server5.key" \ |
| 5527 | 0 \ |
| 5528 | -S "skip write certificate request" \ |
| 5529 | -C "skip parse certificate request" \ |
| 5530 | -c "got a certificate request" \ |
| 5531 | -C "skip write certificate" \ |
| 5532 | -C "skip write certificate verify" \ |
| 5533 | -S "skip parse certificate verify" \ |
| 5534 | -s "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 5535 | -s "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5536 | -S "! mbedtls_ssl_handshake returned" \ |
| 5537 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5538 | -S "X509 - Certificate verification failed" |
| 5539 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 5540 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5541 | run_test "Authentication: client badcert, server none" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5542 | "$P_SRV debug_level=3 auth_mode=none" \ |
| 5543 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5544 | key_file=data_files/server5.key" \ |
| 5545 | 0 \ |
| 5546 | -s "skip write certificate request" \ |
| 5547 | -C "skip parse certificate request" \ |
| 5548 | -c "got no certificate request" \ |
| 5549 | -c "skip write certificate" \ |
| 5550 | -c "skip write certificate verify" \ |
| 5551 | -s "skip parse certificate verify" \ |
| 5552 | -S "x509_verify_cert() returned" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 5553 | -S "! The certificate is not correctly signed by the trusted CA" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5554 | -S "! mbedtls_ssl_handshake returned" \ |
| 5555 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 5556 | -S "X509 - Certificate verification failed" |
| 5557 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 5558 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5559 | run_test "Authentication: client no cert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5560 | "$P_SRV debug_level=3 auth_mode=optional" \ |
| 5561 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 5562 | 0 \ |
| 5563 | -S "skip write certificate request" \ |
| 5564 | -C "skip parse certificate request" \ |
| 5565 | -c "got a certificate request" \ |
| 5566 | -C "skip write certificate$" \ |
| 5567 | -C "got no certificate to send" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 5568 | -c "skip write certificate verify" \ |
| 5569 | -s "skip parse certificate verify" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 5570 | -s "! Certificate was missing" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5571 | -S "! mbedtls_ssl_handshake returned" \ |
| 5572 | -C "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 5573 | -S "X509 - Certificate verification failed" |
| 5574 | |
Przemek Stekiel | c31a798 | 2023-06-27 10:53:33 +0200 | [diff] [blame] | 5575 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 5576 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5577 | run_test "Authentication: openssl client no cert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5578 | "$P_SRV debug_level=3 auth_mode=optional" \ |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 5579 | "$O_NEXT_CLI_NO_CERT -no_middlebox" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 5580 | 0 \ |
| 5581 | -S "skip write certificate request" \ |
| 5582 | -s "skip parse certificate verify" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 5583 | -s "! Certificate was missing" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5584 | -S "! mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 5585 | -S "X509 - Certificate verification failed" |
| 5586 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5587 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5588 | run_test "Authentication: client no cert, openssl server optional" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 5589 | "$O_SRV -verify 10 -tls1_2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 5590 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 5591 | 0 \ |
| 5592 | -C "skip parse certificate request" \ |
| 5593 | -c "got a certificate request" \ |
| 5594 | -C "skip write certificate$" \ |
| 5595 | -c "skip write certificate verify" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 5596 | -C "! mbedtls_ssl_handshake returned" |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 5597 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 5598 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | fd8332e | 2017-05-03 16:25:07 +0200 | [diff] [blame] | 5599 | run_test "Authentication: client no cert, openssl server required" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 5600 | "$O_SRV -Verify 10 -tls1_2" \ |
Gilles Peskine | fd8332e | 2017-05-03 16:25:07 +0200 | [diff] [blame] | 5601 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
| 5602 | 1 \ |
| 5603 | -C "skip parse certificate request" \ |
| 5604 | -c "got a certificate request" \ |
| 5605 | -C "skip write certificate$" \ |
| 5606 | -c "skip write certificate verify" \ |
| 5607 | -c "! mbedtls_ssl_handshake returned" |
| 5608 | |
Yuto Takano | 0248582 | 2021-07-02 13:05:15 +0100 | [diff] [blame] | 5609 | # This script assumes that MBEDTLS_X509_MAX_INTERMEDIATE_CA has its default |
| 5610 | # value, defined here as MAX_IM_CA. Some test cases will be skipped if the |
| 5611 | # library is configured with a different value. |
Hanno Becker | a6bca9f | 2017-07-26 13:35:11 +0100 | [diff] [blame] | 5612 | |
Simon Butcher | bcfa6f4 | 2017-07-28 15:59:35 +0100 | [diff] [blame] | 5613 | MAX_IM_CA='8' |
Hanno Becker | a6bca9f | 2017-07-26 13:35:11 +0100 | [diff] [blame] | 5614 | |
Yuto Takano | 0248582 | 2021-07-02 13:05:15 +0100 | [diff] [blame] | 5615 | # The tests for the max_int tests can pass with any number higher than MAX_IM_CA |
| 5616 | # because only a chain of MAX_IM_CA length is tested. Equally, the max_int+1 |
| 5617 | # tests can pass with any number less than MAX_IM_CA. However, stricter preconditions |
| 5618 | # are in place so that the semantics are consistent with the test description. |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5619 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 5620 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5621 | run_test "Authentication: server max_int chain, client default" \ |
| 5622 | "$P_SRV crt_file=data_files/dir-maxpath/c09.pem \ |
| 5623 | key_file=data_files/dir-maxpath/09.key" \ |
| 5624 | "$P_CLI server_name=CA09 ca_file=data_files/dir-maxpath/00.crt" \ |
| 5625 | 0 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 5626 | -C "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5627 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5628 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 5629 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5630 | run_test "Authentication: server max_int+1 chain, client default" \ |
| 5631 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 5632 | key_file=data_files/dir-maxpath/10.key" \ |
| 5633 | "$P_CLI server_name=CA10 ca_file=data_files/dir-maxpath/00.crt" \ |
| 5634 | 1 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 5635 | -c "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5636 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5637 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 5638 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5639 | run_test "Authentication: server max_int+1 chain, client optional" \ |
| 5640 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 5641 | key_file=data_files/dir-maxpath/10.key" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5642 | "$P_CLI force_version=tls12 server_name=CA10 ca_file=data_files/dir-maxpath/00.crt \ |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5643 | auth_mode=optional" \ |
| 5644 | 1 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 5645 | -c "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5646 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5647 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 5648 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5649 | run_test "Authentication: server max_int+1 chain, client none" \ |
| 5650 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 5651 | key_file=data_files/dir-maxpath/10.key" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5652 | "$P_CLI force_version=tls12 server_name=CA10 ca_file=data_files/dir-maxpath/00.crt \ |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5653 | auth_mode=none" \ |
| 5654 | 0 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 5655 | -C "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5656 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5657 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 5658 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5659 | run_test "Authentication: client max_int+1 chain, server default" \ |
| 5660 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt" \ |
| 5661 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 5662 | key_file=data_files/dir-maxpath/10.key" \ |
| 5663 | 0 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 5664 | -S "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5665 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5666 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 5667 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5668 | run_test "Authentication: client max_int+1 chain, server optional" \ |
| 5669 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=optional" \ |
| 5670 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 5671 | key_file=data_files/dir-maxpath/10.key" \ |
| 5672 | 1 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 5673 | -s "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5674 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5675 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 5676 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5677 | run_test "Authentication: client max_int+1 chain, server required" \ |
| 5678 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \ |
| 5679 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 5680 | key_file=data_files/dir-maxpath/10.key" \ |
| 5681 | 1 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 5682 | -s "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5683 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5684 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 5685 | requires_full_size_output_buffer |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5686 | run_test "Authentication: client max_int chain, server required" \ |
| 5687 | "$P_SRV ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \ |
| 5688 | "$P_CLI crt_file=data_files/dir-maxpath/c09.pem \ |
| 5689 | key_file=data_files/dir-maxpath/09.key" \ |
| 5690 | 0 \ |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 5691 | -S "X509 - A fatal error occurred" |
Manuel Pégourié-Gonnard | 81bb6b6 | 2017-06-26 10:45:33 +0200 | [diff] [blame] | 5692 | |
Janos Follath | 89baba2 | 2017-04-10 14:34:35 +0100 | [diff] [blame] | 5693 | # Tests for CA list in CertificateRequest messages |
| 5694 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 5695 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Janos Follath | 89baba2 | 2017-04-10 14:34:35 +0100 | [diff] [blame] | 5696 | run_test "Authentication: send CA list in CertificateRequest (default)" \ |
| 5697 | "$P_SRV debug_level=3 auth_mode=required" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5698 | "$P_CLI force_version=tls12 crt_file=data_files/server6.crt \ |
Janos Follath | 89baba2 | 2017-04-10 14:34:35 +0100 | [diff] [blame] | 5699 | key_file=data_files/server6.key" \ |
| 5700 | 0 \ |
| 5701 | -s "requested DN" |
| 5702 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 5703 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Janos Follath | 89baba2 | 2017-04-10 14:34:35 +0100 | [diff] [blame] | 5704 | run_test "Authentication: do not send CA list in CertificateRequest" \ |
| 5705 | "$P_SRV debug_level=3 auth_mode=required cert_req_ca_list=0" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5706 | "$P_CLI force_version=tls12 crt_file=data_files/server6.crt \ |
Janos Follath | 89baba2 | 2017-04-10 14:34:35 +0100 | [diff] [blame] | 5707 | key_file=data_files/server6.key" \ |
| 5708 | 0 \ |
| 5709 | -S "requested DN" |
| 5710 | |
| 5711 | run_test "Authentication: send CA list in CertificateRequest, client self signed" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5712 | "$P_SRV force_version=tls12 debug_level=3 auth_mode=required cert_req_ca_list=0" \ |
Janos Follath | 89baba2 | 2017-04-10 14:34:35 +0100 | [diff] [blame] | 5713 | "$P_CLI debug_level=3 crt_file=data_files/server5-selfsigned.crt \ |
| 5714 | key_file=data_files/server5.key" \ |
| 5715 | 1 \ |
| 5716 | -S "requested DN" \ |
| 5717 | -s "x509_verify_cert() returned" \ |
| 5718 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 5719 | -s "! mbedtls_ssl_handshake returned" \ |
| 5720 | -c "! mbedtls_ssl_handshake returned" \ |
| 5721 | -s "X509 - Certificate verification failed" |
| 5722 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 5723 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Glenn Strauss | bd10c4e | 2022-06-25 03:15:48 -0400 | [diff] [blame] | 5724 | run_test "Authentication: send alt conf DN hints in CertificateRequest" \ |
| 5725 | "$P_SRV debug_level=3 auth_mode=optional cert_req_ca_list=2 \ |
| 5726 | crt_file2=data_files/server1.crt \ |
| 5727 | key_file2=data_files/server1.key" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5728 | "$P_CLI force_version=tls12 debug_level=3 auth_mode=optional \ |
Glenn Strauss | bd10c4e | 2022-06-25 03:15:48 -0400 | [diff] [blame] | 5729 | crt_file=data_files/server6.crt \ |
| 5730 | key_file=data_files/server6.key" \ |
| 5731 | 0 \ |
| 5732 | -c "DN hint: C=NL, O=PolarSSL, CN=PolarSSL Server 1" |
| 5733 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 5734 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Glenn Strauss | bd10c4e | 2022-06-25 03:15:48 -0400 | [diff] [blame] | 5735 | run_test "Authentication: send alt conf DN hints in CertificateRequest (2)" \ |
| 5736 | "$P_SRV debug_level=3 auth_mode=optional cert_req_ca_list=2 \ |
| 5737 | crt_file2=data_files/server2.crt \ |
| 5738 | key_file2=data_files/server2.key" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5739 | "$P_CLI force_version=tls12 debug_level=3 auth_mode=optional \ |
Glenn Strauss | bd10c4e | 2022-06-25 03:15:48 -0400 | [diff] [blame] | 5740 | crt_file=data_files/server6.crt \ |
| 5741 | key_file=data_files/server6.key" \ |
| 5742 | 0 \ |
| 5743 | -c "DN hint: C=NL, O=PolarSSL, CN=localhost" |
| 5744 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 5745 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Glenn Strauss | bd10c4e | 2022-06-25 03:15:48 -0400 | [diff] [blame] | 5746 | run_test "Authentication: send alt hs DN hints in CertificateRequest" \ |
| 5747 | "$P_SRV debug_level=3 auth_mode=optional cert_req_ca_list=3 \ |
| 5748 | crt_file2=data_files/server1.crt \ |
| 5749 | key_file2=data_files/server1.key" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 5750 | "$P_CLI force_version=tls12 debug_level=3 auth_mode=optional \ |
Glenn Strauss | bd10c4e | 2022-06-25 03:15:48 -0400 | [diff] [blame] | 5751 | crt_file=data_files/server6.crt \ |
| 5752 | key_file=data_files/server6.key" \ |
| 5753 | 0 \ |
| 5754 | -c "DN hint: C=NL, O=PolarSSL, CN=PolarSSL Server 1" |
| 5755 | |
Jarno Lamsa | f7a7f9e | 2019-04-01 15:11:54 +0300 | [diff] [blame] | 5756 | # Tests for auth_mode, using CA callback, these are duplicated from the authentication tests |
| 5757 | # When updating these tests, modify the matching authentication tests accordingly |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5758 | |
| 5759 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5760 | run_test "Authentication, CA callback: server badcert, client required" \ |
| 5761 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
| 5762 | key_file=data_files/server5.key" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 5763 | "$P_CLI force_version=tls12 ca_callback=1 debug_level=3 auth_mode=required" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5764 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5765 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5766 | -c "x509_verify_cert() returned" \ |
| 5767 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 5768 | -c "! mbedtls_ssl_handshake returned" \ |
| 5769 | -c "X509 - Certificate verification failed" |
| 5770 | |
| 5771 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5772 | run_test "Authentication, CA callback: server badcert, client optional" \ |
| 5773 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
| 5774 | key_file=data_files/server5.key" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 5775 | "$P_CLI force_version=tls12 ca_callback=1 debug_level=3 auth_mode=optional" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5776 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5777 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5778 | -c "x509_verify_cert() returned" \ |
| 5779 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 5780 | -C "! mbedtls_ssl_handshake returned" \ |
| 5781 | -C "X509 - Certificate verification failed" |
| 5782 | |
| 5783 | # The purpose of the next two tests is to test the client's behaviour when receiving a server |
| 5784 | # certificate with an unsupported elliptic curve. This should usually not happen because |
| 5785 | # the client informs the server about the supported curves - it does, though, in the |
| 5786 | # corner case of a static ECDH suite, because the server doesn't check the curve on that |
| 5787 | # occasion (to be fixed). If that bug's fixed, the test needs to be altered to use a |
| 5788 | # different means to have the server ignoring the client's supported curve list. |
| 5789 | |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5790 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5791 | run_test "Authentication, CA callback: server ECDH p256v1, client required, p256v1 unsupported" \ |
| 5792 | "$P_SRV debug_level=1 key_file=data_files/server5.key \ |
| 5793 | crt_file=data_files/server5.ku-ka.crt" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 5794 | "$P_CLI force_version=tls12 ca_callback=1 debug_level=3 auth_mode=required groups=secp521r1" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5795 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5796 | -c "use CA callback for X.509 CRT verification" \ |
| 5797 | -c "bad certificate (EC key curve)" \ |
| 5798 | -c "! Certificate verification flags" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5799 | -C "bad server certificate (ECDH curve)" # Expect failure at earlier verification stage |
| 5800 | |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5801 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5802 | run_test "Authentication, CA callback: server ECDH p256v1, client optional, p256v1 unsupported" \ |
Valerio Setti | a9aafd4 | 2023-04-11 12:30:45 +0200 | [diff] [blame] | 5803 | "$P_SRV debug_level=1 key_file=data_files/server5.key \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5804 | crt_file=data_files/server5.ku-ka.crt" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 5805 | "$P_CLI force_version=tls12 ca_callback=1 debug_level=3 auth_mode=optional groups=secp521r1" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5806 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5807 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5808 | -c "bad certificate (EC key curve)"\ |
| 5809 | -c "! Certificate verification flags"\ |
| 5810 | -c "bad server certificate (ECDH curve)" # Expect failure only at ECDH params check |
| 5811 | |
| 5812 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 5813 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5814 | run_test "Authentication, CA callback: client SHA256, server required" \ |
| 5815 | "$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \ |
| 5816 | "$P_CLI debug_level=3 crt_file=data_files/server6.crt \ |
| 5817 | key_file=data_files/server6.key \ |
| 5818 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ |
| 5819 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5820 | -s "use CA callback for X.509 CRT verification" \ |
Andrzej Kurek | ec71b09 | 2022-11-15 10:21:50 -0500 | [diff] [blame] | 5821 | -c "Supported Signature Algorithm found: 04 " \ |
| 5822 | -c "Supported Signature Algorithm found: 05 " |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5823 | |
| 5824 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 5825 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5826 | run_test "Authentication, CA callback: client SHA384, server required" \ |
| 5827 | "$P_SRV ca_callback=1 debug_level=3 auth_mode=required" \ |
| 5828 | "$P_CLI debug_level=3 crt_file=data_files/server6.crt \ |
| 5829 | key_file=data_files/server6.key \ |
| 5830 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" \ |
| 5831 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5832 | -s "use CA callback for X.509 CRT verification" \ |
Andrzej Kurek | ec71b09 | 2022-11-15 10:21:50 -0500 | [diff] [blame] | 5833 | -c "Supported Signature Algorithm found: 04 " \ |
| 5834 | -c "Supported Signature Algorithm found: 05 " |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5835 | |
| 5836 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5837 | run_test "Authentication, CA callback: client badcert, server required" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 5838 | "$P_SRV force_version=tls12 ca_callback=1 debug_level=3 auth_mode=required" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5839 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
| 5840 | key_file=data_files/server5.key" \ |
| 5841 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5842 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5843 | -S "skip write certificate request" \ |
| 5844 | -C "skip parse certificate request" \ |
| 5845 | -c "got a certificate request" \ |
| 5846 | -C "skip write certificate" \ |
| 5847 | -C "skip write certificate verify" \ |
| 5848 | -S "skip parse certificate verify" \ |
| 5849 | -s "x509_verify_cert() returned" \ |
| 5850 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 5851 | -s "! mbedtls_ssl_handshake returned" \ |
| 5852 | -s "send alert level=2 message=48" \ |
| 5853 | -c "! mbedtls_ssl_handshake returned" \ |
| 5854 | -s "X509 - Certificate verification failed" |
| 5855 | # We don't check that the client receives the alert because it might |
| 5856 | # detect that its write end of the connection is closed and abort |
| 5857 | # before reading the alert message. |
| 5858 | |
| 5859 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5860 | run_test "Authentication, CA callback: client cert not trusted, server required" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 5861 | "$P_SRV force_version=tls12 ca_callback=1 debug_level=3 auth_mode=required" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5862 | "$P_CLI debug_level=3 crt_file=data_files/server5-selfsigned.crt \ |
| 5863 | key_file=data_files/server5.key" \ |
| 5864 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5865 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5866 | -S "skip write certificate request" \ |
| 5867 | -C "skip parse certificate request" \ |
| 5868 | -c "got a certificate request" \ |
| 5869 | -C "skip write certificate" \ |
| 5870 | -C "skip write certificate verify" \ |
| 5871 | -S "skip parse certificate verify" \ |
| 5872 | -s "x509_verify_cert() returned" \ |
| 5873 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 5874 | -s "! mbedtls_ssl_handshake returned" \ |
| 5875 | -c "! mbedtls_ssl_handshake returned" \ |
| 5876 | -s "X509 - Certificate verification failed" |
| 5877 | |
| 5878 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5879 | run_test "Authentication, CA callback: client badcert, server optional" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 5880 | "$P_SRV force_version=tls12 ca_callback=1 debug_level=3 auth_mode=optional" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5881 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
| 5882 | key_file=data_files/server5.key" \ |
| 5883 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5884 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5885 | -S "skip write certificate request" \ |
| 5886 | -C "skip parse certificate request" \ |
| 5887 | -c "got a certificate request" \ |
| 5888 | -C "skip write certificate" \ |
| 5889 | -C "skip write certificate verify" \ |
| 5890 | -S "skip parse certificate verify" \ |
| 5891 | -s "x509_verify_cert() returned" \ |
| 5892 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 5893 | -S "! mbedtls_ssl_handshake returned" \ |
| 5894 | -C "! mbedtls_ssl_handshake returned" \ |
| 5895 | -S "X509 - Certificate verification failed" |
| 5896 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5897 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5898 | requires_full_size_output_buffer |
| 5899 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5900 | run_test "Authentication, CA callback: server max_int chain, client default" \ |
| 5901 | "$P_SRV crt_file=data_files/dir-maxpath/c09.pem \ |
| 5902 | key_file=data_files/dir-maxpath/09.key" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 5903 | "$P_CLI force_version=tls12 ca_callback=1 debug_level=3 server_name=CA09 ca_file=data_files/dir-maxpath/00.crt" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5904 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5905 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5906 | -C "X509 - A fatal error occurred" |
| 5907 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5908 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5909 | requires_full_size_output_buffer |
| 5910 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5911 | run_test "Authentication, CA callback: server max_int+1 chain, client default" \ |
| 5912 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 5913 | key_file=data_files/dir-maxpath/10.key" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 5914 | "$P_CLI force_version=tls12 debug_level=3 ca_callback=1 server_name=CA10 ca_file=data_files/dir-maxpath/00.crt" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5915 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5916 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5917 | -c "X509 - A fatal error occurred" |
| 5918 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5919 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5920 | requires_full_size_output_buffer |
| 5921 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5922 | run_test "Authentication, CA callback: server max_int+1 chain, client optional" \ |
| 5923 | "$P_SRV crt_file=data_files/dir-maxpath/c10.pem \ |
| 5924 | key_file=data_files/dir-maxpath/10.key" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 5925 | "$P_CLI force_version=tls12 ca_callback=1 server_name=CA10 ca_file=data_files/dir-maxpath/00.crt \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5926 | debug_level=3 auth_mode=optional" \ |
| 5927 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5928 | -c "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5929 | -c "X509 - A fatal error occurred" |
| 5930 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5931 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5932 | requires_full_size_output_buffer |
| 5933 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5934 | run_test "Authentication, CA callback: client max_int+1 chain, server optional" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 5935 | "$P_SRV force_version=tls12 ca_callback=1 debug_level=3 ca_file=data_files/dir-maxpath/00.crt auth_mode=optional" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5936 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 5937 | key_file=data_files/dir-maxpath/10.key" \ |
| 5938 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5939 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5940 | -s "X509 - A fatal error occurred" |
| 5941 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5942 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5943 | requires_full_size_output_buffer |
| 5944 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5945 | run_test "Authentication, CA callback: client max_int+1 chain, server required" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 5946 | "$P_SRV force_version=tls12 ca_callback=1 debug_level=3 ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5947 | "$P_CLI crt_file=data_files/dir-maxpath/c10.pem \ |
| 5948 | key_file=data_files/dir-maxpath/10.key" \ |
| 5949 | 1 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5950 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5951 | -s "X509 - A fatal error occurred" |
| 5952 | |
Yuto Takano | 6f65743 | 2021-07-02 13:10:41 +0100 | [diff] [blame] | 5953 | requires_config_value_equals "MBEDTLS_X509_MAX_INTERMEDIATE_CA" $MAX_IM_CA |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5954 | requires_full_size_output_buffer |
| 5955 | requires_config_enabled MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK |
| 5956 | run_test "Authentication, CA callback: client max_int chain, server required" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 5957 | "$P_SRV force_version=tls12 ca_callback=1 debug_level=3 ca_file=data_files/dir-maxpath/00.crt auth_mode=required" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5958 | "$P_CLI crt_file=data_files/dir-maxpath/c09.pem \ |
| 5959 | key_file=data_files/dir-maxpath/09.key" \ |
| 5960 | 0 \ |
Janos Follath | d7ecbd6 | 2019-04-05 14:52:17 +0100 | [diff] [blame] | 5961 | -s "use CA callback for X.509 CRT verification" \ |
Hanno Becker | 746aaf3 | 2019-03-28 15:25:23 +0000 | [diff] [blame] | 5962 | -S "X509 - A fatal error occurred" |
| 5963 | |
Shaun Case | 8b0ecbc | 2021-12-20 21:14:10 -0800 | [diff] [blame] | 5964 | # Tests for certificate selection based on SHA version |
Manuel Pégourié-Gonnard | df331a5 | 2015-01-08 16:43:07 +0100 | [diff] [blame] | 5965 | |
Hanno Becker | c5722d1 | 2020-10-09 11:10:42 +0100 | [diff] [blame] | 5966 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
Manuel Pégourié-Gonnard | df331a5 | 2015-01-08 16:43:07 +0100 | [diff] [blame] | 5967 | run_test "Certificate hash: client TLS 1.2 -> SHA-2" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 5968 | "$P_SRV force_version=tls12 crt_file=data_files/server5.crt \ |
Manuel Pégourié-Gonnard | df331a5 | 2015-01-08 16:43:07 +0100 | [diff] [blame] | 5969 | key_file=data_files/server5.key \ |
| 5970 | crt_file2=data_files/server5-sha1.crt \ |
| 5971 | key_file2=data_files/server5.key" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 5972 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | df331a5 | 2015-01-08 16:43:07 +0100 | [diff] [blame] | 5973 | 0 \ |
| 5974 | -c "signed using.*ECDSA with SHA256" \ |
| 5975 | -C "signed using.*ECDSA with SHA1" |
| 5976 | |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 5977 | # tests for SNI |
| 5978 | |
Hanno Becker | c5722d1 | 2020-10-09 11:10:42 +0100 | [diff] [blame] | 5979 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 5980 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5981 | run_test "SNI: no SNI callback" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 5982 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 5983 | crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 5984 | "$P_CLI server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 5985 | 0 \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 5986 | -c "issuer name *: C=NL, O=PolarSSL, CN=Polarssl Test EC CA" \ |
| 5987 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 5988 | |
Hanno Becker | c5722d1 | 2020-10-09 11:10:42 +0100 | [diff] [blame] | 5989 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 5990 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 5991 | run_test "SNI: matching cert 1" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 5992 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 5993 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 5994 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 5995 | "$P_CLI server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 5996 | 0 \ |
| 5997 | -s "parse ServerName extension" \ |
| 5998 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 5999 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 6000 | |
Hanno Becker | c5722d1 | 2020-10-09 11:10:42 +0100 | [diff] [blame] | 6001 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6002 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6003 | run_test "SNI: matching cert 2" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 6004 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 6005 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 6006 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 6007 | "$P_CLI server_name=polarssl.example" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 6008 | 0 \ |
| 6009 | -s "parse ServerName extension" \ |
| 6010 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 6011 | -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 6012 | |
Hanno Becker | c5722d1 | 2020-10-09 11:10:42 +0100 | [diff] [blame] | 6013 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6014 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6015 | run_test "SNI: no matching cert" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 6016 | "$P_SRV debug_level=3 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 6017 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 6018 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 6019 | "$P_CLI server_name=nonesuch.example" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 6020 | 1 \ |
| 6021 | -s "parse ServerName extension" \ |
| 6022 | -s "ssl_sni_wrapper() returned" \ |
| 6023 | -s "mbedtls_ssl_handshake returned" \ |
| 6024 | -c "mbedtls_ssl_handshake returned" \ |
| 6025 | -c "SSL - A fatal alert message was received from our peer" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 6026 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6027 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 6028 | run_test "SNI: client auth no override: optional" \ |
| 6029 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 6030 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6031 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-" \ |
| 6032 | "$P_CLI debug_level=3 server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 6033 | 0 \ |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 6034 | -S "skip write certificate request" \ |
| 6035 | -C "skip parse certificate request" \ |
| 6036 | -c "got a certificate request" \ |
| 6037 | -C "skip write certificate" \ |
| 6038 | -C "skip write certificate verify" \ |
| 6039 | -S "skip parse certificate verify" |
| 6040 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6041 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 6042 | run_test "SNI: client auth override: none -> optional" \ |
| 6043 | "$P_SRV debug_level=3 auth_mode=none \ |
| 6044 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6045 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,optional" \ |
| 6046 | "$P_CLI debug_level=3 server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 6047 | 0 \ |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 6048 | -S "skip write certificate request" \ |
| 6049 | -C "skip parse certificate request" \ |
| 6050 | -c "got a certificate request" \ |
| 6051 | -C "skip write certificate" \ |
| 6052 | -C "skip write certificate verify" \ |
| 6053 | -S "skip parse certificate verify" |
| 6054 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6055 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 6056 | run_test "SNI: client auth override: optional -> none" \ |
| 6057 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 6058 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6059 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,none" \ |
| 6060 | "$P_CLI debug_level=3 server_name=localhost" \ |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 6061 | 0 \ |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 6062 | -s "skip write certificate request" \ |
| 6063 | -C "skip parse certificate request" \ |
| 6064 | -c "got no certificate request" \ |
XiaokangQian | 23c5be6 | 2022-06-07 02:04:34 +0000 | [diff] [blame] | 6065 | -c "skip write certificate" |
Manuel Pégourié-Gonnard | c948a79 | 2015-06-22 16:04:20 +0200 | [diff] [blame] | 6066 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6067 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 6068 | run_test "SNI: CA no override" \ |
| 6069 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 6070 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6071 | ca_file=data_files/test-ca.crt \ |
| 6072 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,required" \ |
| 6073 | "$P_CLI debug_level=3 server_name=localhost \ |
| 6074 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 6075 | 1 \ |
| 6076 | -S "skip write certificate request" \ |
| 6077 | -C "skip parse certificate request" \ |
| 6078 | -c "got a certificate request" \ |
| 6079 | -C "skip write certificate" \ |
| 6080 | -C "skip write certificate verify" \ |
| 6081 | -S "skip parse certificate verify" \ |
| 6082 | -s "x509_verify_cert() returned" \ |
| 6083 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 6084 | -S "The certificate has been revoked (is on a CRL)" |
| 6085 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6086 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 6087 | run_test "SNI: CA override" \ |
| 6088 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 6089 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6090 | ca_file=data_files/test-ca.crt \ |
| 6091 | sni=localhost,data_files/server2.crt,data_files/server2.key,data_files/test-ca2.crt,-,required" \ |
| 6092 | "$P_CLI debug_level=3 server_name=localhost \ |
| 6093 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 6094 | 0 \ |
| 6095 | -S "skip write certificate request" \ |
| 6096 | -C "skip parse certificate request" \ |
| 6097 | -c "got a certificate request" \ |
| 6098 | -C "skip write certificate" \ |
| 6099 | -C "skip write certificate verify" \ |
| 6100 | -S "skip parse certificate verify" \ |
| 6101 | -S "x509_verify_cert() returned" \ |
| 6102 | -S "! The certificate is not correctly signed by the trusted CA" \ |
| 6103 | -S "The certificate has been revoked (is on a CRL)" |
| 6104 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6105 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 6106 | run_test "SNI: CA override with CRL" \ |
| 6107 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 6108 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6109 | ca_file=data_files/test-ca.crt \ |
| 6110 | sni=localhost,data_files/server2.crt,data_files/server2.key,data_files/test-ca2.crt,data_files/crl-ec-sha256.pem,required" \ |
| 6111 | "$P_CLI debug_level=3 server_name=localhost \ |
| 6112 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 6113 | 1 \ |
| 6114 | -S "skip write certificate request" \ |
| 6115 | -C "skip parse certificate request" \ |
| 6116 | -c "got a certificate request" \ |
| 6117 | -C "skip write certificate" \ |
| 6118 | -C "skip write certificate verify" \ |
| 6119 | -S "skip parse certificate verify" \ |
| 6120 | -s "x509_verify_cert() returned" \ |
| 6121 | -S "! The certificate is not correctly signed by the trusted CA" \ |
| 6122 | -s "The certificate has been revoked (is on a CRL)" |
| 6123 | |
Andres AG | 1a83445 | 2016-12-07 10:01:30 +0000 | [diff] [blame] | 6124 | # Tests for SNI and DTLS |
| 6125 | |
Hanno Becker | c5722d1 | 2020-10-09 11:10:42 +0100 | [diff] [blame] | 6126 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6127 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andres Amaya Garcia | 54306c1 | 2018-05-01 20:27:37 +0100 | [diff] [blame] | 6128 | run_test "SNI: DTLS, no SNI callback" \ |
| 6129 | "$P_SRV debug_level=3 dtls=1 \ |
| 6130 | crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
| 6131 | "$P_CLI server_name=localhost dtls=1" \ |
| 6132 | 0 \ |
Andres Amaya Garcia | 54306c1 | 2018-05-01 20:27:37 +0100 | [diff] [blame] | 6133 | -c "issuer name *: C=NL, O=PolarSSL, CN=Polarssl Test EC CA" \ |
| 6134 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
| 6135 | |
Hanno Becker | c5722d1 | 2020-10-09 11:10:42 +0100 | [diff] [blame] | 6136 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6137 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andres Amaya Garcia | f77d3d3 | 2018-05-01 20:26:47 +0100 | [diff] [blame] | 6138 | run_test "SNI: DTLS, matching cert 1" \ |
Andres AG | 1a83445 | 2016-12-07 10:01:30 +0000 | [diff] [blame] | 6139 | "$P_SRV debug_level=3 dtls=1 \ |
| 6140 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6141 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
| 6142 | "$P_CLI server_name=localhost dtls=1" \ |
| 6143 | 0 \ |
| 6144 | -s "parse ServerName extension" \ |
| 6145 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 6146 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
| 6147 | |
Hanno Becker | c5722d1 | 2020-10-09 11:10:42 +0100 | [diff] [blame] | 6148 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6149 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andres Amaya Garcia | 54306c1 | 2018-05-01 20:27:37 +0100 | [diff] [blame] | 6150 | run_test "SNI: DTLS, matching cert 2" \ |
| 6151 | "$P_SRV debug_level=3 dtls=1 \ |
| 6152 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6153 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
| 6154 | "$P_CLI server_name=polarssl.example dtls=1" \ |
| 6155 | 0 \ |
| 6156 | -s "parse ServerName extension" \ |
| 6157 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 6158 | -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example" |
| 6159 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6160 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andres Amaya Garcia | 54306c1 | 2018-05-01 20:27:37 +0100 | [diff] [blame] | 6161 | run_test "SNI: DTLS, no matching cert" \ |
| 6162 | "$P_SRV debug_level=3 dtls=1 \ |
| 6163 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6164 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
| 6165 | "$P_CLI server_name=nonesuch.example dtls=1" \ |
| 6166 | 1 \ |
| 6167 | -s "parse ServerName extension" \ |
| 6168 | -s "ssl_sni_wrapper() returned" \ |
| 6169 | -s "mbedtls_ssl_handshake returned" \ |
| 6170 | -c "mbedtls_ssl_handshake returned" \ |
| 6171 | -c "SSL - A fatal alert message was received from our peer" |
| 6172 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6173 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andres Amaya Garcia | 54306c1 | 2018-05-01 20:27:37 +0100 | [diff] [blame] | 6174 | run_test "SNI: DTLS, client auth no override: optional" \ |
| 6175 | "$P_SRV debug_level=3 auth_mode=optional dtls=1 \ |
| 6176 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6177 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-" \ |
| 6178 | "$P_CLI debug_level=3 server_name=localhost dtls=1" \ |
| 6179 | 0 \ |
| 6180 | -S "skip write certificate request" \ |
| 6181 | -C "skip parse certificate request" \ |
| 6182 | -c "got a certificate request" \ |
| 6183 | -C "skip write certificate" \ |
| 6184 | -C "skip write certificate verify" \ |
| 6185 | -S "skip parse certificate verify" |
| 6186 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6187 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andres Amaya Garcia | 54306c1 | 2018-05-01 20:27:37 +0100 | [diff] [blame] | 6188 | run_test "SNI: DTLS, client auth override: none -> optional" \ |
| 6189 | "$P_SRV debug_level=3 auth_mode=none dtls=1 \ |
| 6190 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6191 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,optional" \ |
| 6192 | "$P_CLI debug_level=3 server_name=localhost dtls=1" \ |
| 6193 | 0 \ |
| 6194 | -S "skip write certificate request" \ |
| 6195 | -C "skip parse certificate request" \ |
| 6196 | -c "got a certificate request" \ |
| 6197 | -C "skip write certificate" \ |
| 6198 | -C "skip write certificate verify" \ |
| 6199 | -S "skip parse certificate verify" |
| 6200 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6201 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andres Amaya Garcia | 54306c1 | 2018-05-01 20:27:37 +0100 | [diff] [blame] | 6202 | run_test "SNI: DTLS, client auth override: optional -> none" \ |
| 6203 | "$P_SRV debug_level=3 auth_mode=optional dtls=1 \ |
| 6204 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6205 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,none" \ |
| 6206 | "$P_CLI debug_level=3 server_name=localhost dtls=1" \ |
| 6207 | 0 \ |
| 6208 | -s "skip write certificate request" \ |
| 6209 | -C "skip parse certificate request" \ |
| 6210 | -c "got no certificate request" \ |
| 6211 | -c "skip write certificate" \ |
| 6212 | -c "skip write certificate verify" \ |
| 6213 | -s "skip parse certificate verify" |
| 6214 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6215 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andres Amaya Garcia | 54306c1 | 2018-05-01 20:27:37 +0100 | [diff] [blame] | 6216 | run_test "SNI: DTLS, CA no override" \ |
| 6217 | "$P_SRV debug_level=3 auth_mode=optional dtls=1 \ |
| 6218 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6219 | ca_file=data_files/test-ca.crt \ |
| 6220 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,required" \ |
| 6221 | "$P_CLI debug_level=3 server_name=localhost dtls=1 \ |
| 6222 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 6223 | 1 \ |
| 6224 | -S "skip write certificate request" \ |
| 6225 | -C "skip parse certificate request" \ |
| 6226 | -c "got a certificate request" \ |
| 6227 | -C "skip write certificate" \ |
| 6228 | -C "skip write certificate verify" \ |
| 6229 | -S "skip parse certificate verify" \ |
| 6230 | -s "x509_verify_cert() returned" \ |
| 6231 | -s "! The certificate is not correctly signed by the trusted CA" \ |
| 6232 | -S "The certificate has been revoked (is on a CRL)" |
| 6233 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6234 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andres Amaya Garcia | f77d3d3 | 2018-05-01 20:26:47 +0100 | [diff] [blame] | 6235 | run_test "SNI: DTLS, CA override" \ |
Andres AG | 1a83445 | 2016-12-07 10:01:30 +0000 | [diff] [blame] | 6236 | "$P_SRV debug_level=3 auth_mode=optional dtls=1 \ |
| 6237 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 6238 | ca_file=data_files/test-ca.crt \ |
| 6239 | sni=localhost,data_files/server2.crt,data_files/server2.key,data_files/test-ca2.crt,-,required" \ |
| 6240 | "$P_CLI debug_level=3 server_name=localhost dtls=1 \ |
| 6241 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 6242 | 0 \ |
| 6243 | -S "skip write certificate request" \ |
| 6244 | -C "skip parse certificate request" \ |
| 6245 | -c "got a certificate request" \ |
| 6246 | -C "skip write certificate" \ |
| 6247 | -C "skip write certificate verify" \ |
| 6248 | -S "skip parse certificate verify" \ |
| 6249 | -S "x509_verify_cert() returned" \ |
| 6250 | -S "! The certificate is not correctly signed by the trusted CA" \ |
| 6251 | -S "The certificate has been revoked (is on a CRL)" |
| 6252 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6253 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andres Amaya Garcia | f77d3d3 | 2018-05-01 20:26:47 +0100 | [diff] [blame] | 6254 | run_test "SNI: DTLS, CA override with CRL" \ |
Andres AG | 1a83445 | 2016-12-07 10:01:30 +0000 | [diff] [blame] | 6255 | "$P_SRV debug_level=3 auth_mode=optional \ |
| 6256 | crt_file=data_files/server5.crt key_file=data_files/server5.key dtls=1 \ |
| 6257 | ca_file=data_files/test-ca.crt \ |
| 6258 | sni=localhost,data_files/server2.crt,data_files/server2.key,data_files/test-ca2.crt,data_files/crl-ec-sha256.pem,required" \ |
| 6259 | "$P_CLI debug_level=3 server_name=localhost dtls=1 \ |
| 6260 | crt_file=data_files/server6.crt key_file=data_files/server6.key" \ |
| 6261 | 1 \ |
| 6262 | -S "skip write certificate request" \ |
| 6263 | -C "skip parse certificate request" \ |
| 6264 | -c "got a certificate request" \ |
| 6265 | -C "skip write certificate" \ |
| 6266 | -C "skip write certificate verify" \ |
| 6267 | -S "skip parse certificate verify" \ |
| 6268 | -s "x509_verify_cert() returned" \ |
| 6269 | -S "! The certificate is not correctly signed by the trusted CA" \ |
| 6270 | -s "The certificate has been revoked (is on a CRL)" |
| 6271 | |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6272 | # Tests for non-blocking I/O: exercise a variety of handshake flows |
| 6273 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6274 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6275 | run_test "Non-blocking I/O: basic handshake" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6276 | "$P_SRV nbio=2 tickets=0 auth_mode=none" \ |
| 6277 | "$P_CLI nbio=2 tickets=0" \ |
| 6278 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 6279 | -S "mbedtls_ssl_handshake returned" \ |
| 6280 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6281 | -c "Read from server: .* bytes read" |
| 6282 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6283 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6284 | run_test "Non-blocking I/O: client auth" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6285 | "$P_SRV nbio=2 tickets=0 auth_mode=required" \ |
| 6286 | "$P_CLI nbio=2 tickets=0" \ |
| 6287 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 6288 | -S "mbedtls_ssl_handshake returned" \ |
| 6289 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6290 | -c "Read from server: .* bytes read" |
| 6291 | |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6292 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6293 | run_test "Non-blocking I/O: ticket" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6294 | "$P_SRV nbio=2 tickets=1 auth_mode=none" \ |
| 6295 | "$P_CLI nbio=2 tickets=1" \ |
| 6296 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 6297 | -S "mbedtls_ssl_handshake returned" \ |
| 6298 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6299 | -c "Read from server: .* bytes read" |
| 6300 | |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6301 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6302 | run_test "Non-blocking I/O: ticket + client auth" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6303 | "$P_SRV nbio=2 tickets=1 auth_mode=required" \ |
| 6304 | "$P_CLI nbio=2 tickets=1" \ |
| 6305 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 6306 | -S "mbedtls_ssl_handshake returned" \ |
| 6307 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6308 | -c "Read from server: .* bytes read" |
| 6309 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 6310 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6311 | run_test "Non-blocking I/O: TLS 1.2 + ticket + client auth + resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6312 | "$P_SRV nbio=2 tickets=1 auth_mode=required" \ |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6313 | "$P_CLI force_version=tls12 nbio=2 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6314 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 6315 | -S "mbedtls_ssl_handshake returned" \ |
| 6316 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6317 | -c "Read from server: .* bytes read" |
| 6318 | |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6319 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
| 6320 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 6321 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
| 6322 | run_test "Non-blocking I/O: TLS 1.3 + ticket + client auth + resume" \ |
| 6323 | "$P_SRV nbio=2 tickets=1 auth_mode=required" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 6324 | "$P_CLI nbio=2 tickets=1 reconnect=1" \ |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6325 | 0 \ |
| 6326 | -S "mbedtls_ssl_handshake returned" \ |
| 6327 | -C "mbedtls_ssl_handshake returned" \ |
| 6328 | -c "Read from server: .* bytes read" |
| 6329 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 6330 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6331 | run_test "Non-blocking I/O: TLS 1.2 + ticket + resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6332 | "$P_SRV nbio=2 tickets=1 auth_mode=none" \ |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6333 | "$P_CLI force_version=tls12 nbio=2 tickets=1 reconnect=1" \ |
| 6334 | 0 \ |
| 6335 | -S "mbedtls_ssl_handshake returned" \ |
| 6336 | -C "mbedtls_ssl_handshake returned" \ |
| 6337 | -c "Read from server: .* bytes read" |
| 6338 | |
| 6339 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
| 6340 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 6341 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
| 6342 | run_test "Non-blocking I/O: TLS 1.3 + ticket + resume" \ |
| 6343 | "$P_SRV nbio=2 tickets=1 auth_mode=none" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 6344 | "$P_CLI nbio=2 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6345 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 6346 | -S "mbedtls_ssl_handshake returned" \ |
| 6347 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6348 | -c "Read from server: .* bytes read" |
| 6349 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 6350 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6351 | run_test "Non-blocking I/O: session-id resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6352 | "$P_SRV nbio=2 tickets=0 auth_mode=none" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 6353 | "$P_CLI force_version=tls12 nbio=2 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6354 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 6355 | -S "mbedtls_ssl_handshake returned" \ |
| 6356 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 6357 | -c "Read from server: .* bytes read" |
| 6358 | |
Hanno Becker | 0007671 | 2017-11-15 16:39:08 +0000 | [diff] [blame] | 6359 | # Tests for event-driven I/O: exercise a variety of handshake flows |
| 6360 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6361 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Hanno Becker | 0007671 | 2017-11-15 16:39:08 +0000 | [diff] [blame] | 6362 | run_test "Event-driven I/O: basic handshake" \ |
| 6363 | "$P_SRV event=1 tickets=0 auth_mode=none" \ |
| 6364 | "$P_CLI event=1 tickets=0" \ |
| 6365 | 0 \ |
| 6366 | -S "mbedtls_ssl_handshake returned" \ |
| 6367 | -C "mbedtls_ssl_handshake returned" \ |
| 6368 | -c "Read from server: .* bytes read" |
| 6369 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6370 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Hanno Becker | 0007671 | 2017-11-15 16:39:08 +0000 | [diff] [blame] | 6371 | run_test "Event-driven I/O: client auth" \ |
| 6372 | "$P_SRV event=1 tickets=0 auth_mode=required" \ |
| 6373 | "$P_CLI event=1 tickets=0" \ |
| 6374 | 0 \ |
| 6375 | -S "mbedtls_ssl_handshake returned" \ |
| 6376 | -C "mbedtls_ssl_handshake returned" \ |
| 6377 | -c "Read from server: .* bytes read" |
| 6378 | |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6379 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Hanno Becker | 0007671 | 2017-11-15 16:39:08 +0000 | [diff] [blame] | 6380 | run_test "Event-driven I/O: ticket" \ |
| 6381 | "$P_SRV event=1 tickets=1 auth_mode=none" \ |
| 6382 | "$P_CLI event=1 tickets=1" \ |
| 6383 | 0 \ |
| 6384 | -S "mbedtls_ssl_handshake returned" \ |
| 6385 | -C "mbedtls_ssl_handshake returned" \ |
| 6386 | -c "Read from server: .* bytes read" |
| 6387 | |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6388 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Hanno Becker | 0007671 | 2017-11-15 16:39:08 +0000 | [diff] [blame] | 6389 | run_test "Event-driven I/O: ticket + client auth" \ |
| 6390 | "$P_SRV event=1 tickets=1 auth_mode=required" \ |
| 6391 | "$P_CLI event=1 tickets=1" \ |
| 6392 | 0 \ |
| 6393 | -S "mbedtls_ssl_handshake returned" \ |
| 6394 | -C "mbedtls_ssl_handshake returned" \ |
| 6395 | -c "Read from server: .* bytes read" |
| 6396 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 6397 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6398 | run_test "Event-driven I/O: TLS 1.2 + ticket + client auth + resume" \ |
Hanno Becker | 0007671 | 2017-11-15 16:39:08 +0000 | [diff] [blame] | 6399 | "$P_SRV event=1 tickets=1 auth_mode=required" \ |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6400 | "$P_CLI force_version=tls12 event=1 tickets=1 reconnect=1" \ |
Hanno Becker | 0007671 | 2017-11-15 16:39:08 +0000 | [diff] [blame] | 6401 | 0 \ |
| 6402 | -S "mbedtls_ssl_handshake returned" \ |
| 6403 | -C "mbedtls_ssl_handshake returned" \ |
| 6404 | -c "Read from server: .* bytes read" |
| 6405 | |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6406 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
| 6407 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 6408 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
| 6409 | run_test "Event-driven I/O: TLS 1.3 + ticket + client auth + resume" \ |
| 6410 | "$P_SRV event=1 tickets=1 auth_mode=required" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 6411 | "$P_CLI event=1 tickets=1 reconnect=1" \ |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6412 | 0 \ |
| 6413 | -S "mbedtls_ssl_handshake returned" \ |
| 6414 | -C "mbedtls_ssl_handshake returned" \ |
| 6415 | -c "Read from server: .* bytes read" |
| 6416 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 6417 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6418 | run_test "Event-driven I/O: TLS 1.2 + ticket + resume" \ |
Hanno Becker | 0007671 | 2017-11-15 16:39:08 +0000 | [diff] [blame] | 6419 | "$P_SRV event=1 tickets=1 auth_mode=none" \ |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6420 | "$P_CLI force_version=tls12 event=1 tickets=1 reconnect=1" \ |
| 6421 | 0 \ |
| 6422 | -S "mbedtls_ssl_handshake returned" \ |
| 6423 | -C "mbedtls_ssl_handshake returned" \ |
| 6424 | -c "Read from server: .* bytes read" |
| 6425 | |
| 6426 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
| 6427 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 6428 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
| 6429 | run_test "Event-driven I/O: TLS 1.3 + ticket + resume" \ |
| 6430 | "$P_SRV event=1 tickets=1 auth_mode=none" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 6431 | "$P_CLI event=1 tickets=1 reconnect=1" \ |
Hanno Becker | 0007671 | 2017-11-15 16:39:08 +0000 | [diff] [blame] | 6432 | 0 \ |
| 6433 | -S "mbedtls_ssl_handshake returned" \ |
| 6434 | -C "mbedtls_ssl_handshake returned" \ |
| 6435 | -c "Read from server: .* bytes read" |
| 6436 | |
Ronald Cron | 5de538c | 2022-10-20 14:47:56 +0200 | [diff] [blame] | 6437 | requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT |
Hanno Becker | 0007671 | 2017-11-15 16:39:08 +0000 | [diff] [blame] | 6438 | run_test "Event-driven I/O: session-id resume" \ |
| 6439 | "$P_SRV event=1 tickets=0 auth_mode=none" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 6440 | "$P_CLI force_version=tls12 event=1 tickets=0 reconnect=1" \ |
Hanno Becker | 0007671 | 2017-11-15 16:39:08 +0000 | [diff] [blame] | 6441 | 0 \ |
| 6442 | -S "mbedtls_ssl_handshake returned" \ |
| 6443 | -C "mbedtls_ssl_handshake returned" \ |
| 6444 | -c "Read from server: .* bytes read" |
| 6445 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6446 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 6447 | run_test "Event-driven I/O, DTLS: basic handshake" \ |
| 6448 | "$P_SRV dtls=1 event=1 tickets=0 auth_mode=none" \ |
| 6449 | "$P_CLI dtls=1 event=1 tickets=0" \ |
| 6450 | 0 \ |
| 6451 | -c "Read from server: .* bytes read" |
| 6452 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6453 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 6454 | run_test "Event-driven I/O, DTLS: client auth" \ |
| 6455 | "$P_SRV dtls=1 event=1 tickets=0 auth_mode=required" \ |
| 6456 | "$P_CLI dtls=1 event=1 tickets=0" \ |
| 6457 | 0 \ |
| 6458 | -c "Read from server: .* bytes read" |
| 6459 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6460 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 6461 | run_test "Event-driven I/O, DTLS: ticket" \ |
| 6462 | "$P_SRV dtls=1 event=1 tickets=1 auth_mode=none" \ |
| 6463 | "$P_CLI dtls=1 event=1 tickets=1" \ |
| 6464 | 0 \ |
| 6465 | -c "Read from server: .* bytes read" |
| 6466 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6467 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 6468 | run_test "Event-driven I/O, DTLS: ticket + client auth" \ |
| 6469 | "$P_SRV dtls=1 event=1 tickets=1 auth_mode=required" \ |
| 6470 | "$P_CLI dtls=1 event=1 tickets=1" \ |
| 6471 | 0 \ |
| 6472 | -c "Read from server: .* bytes read" |
| 6473 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6474 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 6475 | run_test "Event-driven I/O, DTLS: ticket + client auth + resume" \ |
| 6476 | "$P_SRV dtls=1 event=1 tickets=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 6477 | "$P_CLI dtls=1 event=1 tickets=1 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 6478 | 0 \ |
| 6479 | -c "Read from server: .* bytes read" |
| 6480 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6481 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 6482 | run_test "Event-driven I/O, DTLS: ticket + resume" \ |
| 6483 | "$P_SRV dtls=1 event=1 tickets=1 auth_mode=none" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 6484 | "$P_CLI dtls=1 event=1 tickets=1 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 6485 | 0 \ |
| 6486 | -c "Read from server: .* bytes read" |
| 6487 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6488 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 6489 | run_test "Event-driven I/O, DTLS: session-id resume" \ |
| 6490 | "$P_SRV dtls=1 event=1 tickets=0 auth_mode=none" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 6491 | "$P_CLI dtls=1 event=1 tickets=0 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | 6a33f59 | 2018-03-13 11:38:46 +0000 | [diff] [blame] | 6492 | 0 \ |
| 6493 | -c "Read from server: .* bytes read" |
Hanno Becker | bc6c110 | 2018-03-13 11:39:40 +0000 | [diff] [blame] | 6494 | |
| 6495 | # This test demonstrates the need for the mbedtls_ssl_check_pending function. |
| 6496 | # During session resumption, the client will send its ApplicationData record |
| 6497 | # within the same datagram as the Finished messages. In this situation, the |
| 6498 | # server MUST NOT idle on the underlying transport after handshake completion, |
| 6499 | # because the ApplicationData request has already been queued internally. |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6500 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | bc6c110 | 2018-03-13 11:39:40 +0000 | [diff] [blame] | 6501 | run_test "Event-driven I/O, DTLS: session-id resume, UDP packing" \ |
Hanno Becker | 8d83218 | 2018-03-15 10:14:19 +0000 | [diff] [blame] | 6502 | -p "$P_PXY pack=50" \ |
Hanno Becker | bc6c110 | 2018-03-13 11:39:40 +0000 | [diff] [blame] | 6503 | "$P_SRV dtls=1 event=1 tickets=0 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 6504 | "$P_CLI dtls=1 event=1 tickets=0 reconnect=1 skip_close_notify=1" \ |
Hanno Becker | bc6c110 | 2018-03-13 11:39:40 +0000 | [diff] [blame] | 6505 | 0 \ |
| 6506 | -c "Read from server: .* bytes read" |
| 6507 | |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6508 | # Tests for version negotiation |
| 6509 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6510 | run_test "Version check: all -> 1.2" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 6511 | "$P_SRV" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 6512 | "$P_CLI force_version=tls12" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 6513 | 0 \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 6514 | -S "mbedtls_ssl_handshake returned" \ |
| 6515 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 6516 | -s "Protocol is TLSv1.2" \ |
| 6517 | -c "Protocol is TLSv1.2" |
| 6518 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6519 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 2abf03c | 2021-06-25 14:40:09 +0200 | [diff] [blame] | 6520 | run_test "Not supported version check: cli TLS 1.0" \ |
| 6521 | "$P_SRV" \ |
| 6522 | "$G_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.0" \ |
| 6523 | 1 \ |
| 6524 | -s "Handshake protocol not within min/max boundaries" \ |
| 6525 | -c "Error in protocol version" \ |
| 6526 | -S "Protocol is TLSv1.0" \ |
| 6527 | -C "Handshake was completed" |
| 6528 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6529 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 2abf03c | 2021-06-25 14:40:09 +0200 | [diff] [blame] | 6530 | run_test "Not supported version check: cli TLS 1.1" \ |
| 6531 | "$P_SRV" \ |
| 6532 | "$G_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.1" \ |
| 6533 | 1 \ |
| 6534 | -s "Handshake protocol not within min/max boundaries" \ |
| 6535 | -c "Error in protocol version" \ |
| 6536 | -S "Protocol is TLSv1.1" \ |
| 6537 | -C "Handshake was completed" |
| 6538 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6539 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 2abf03c | 2021-06-25 14:40:09 +0200 | [diff] [blame] | 6540 | run_test "Not supported version check: srv max TLS 1.0" \ |
| 6541 | "$G_SRV --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.0" \ |
| 6542 | "$P_CLI" \ |
| 6543 | 1 \ |
| 6544 | -s "Error in protocol version" \ |
| 6545 | -c "Handshake protocol not within min/max boundaries" \ |
| 6546 | -S "Version: TLS1.0" \ |
| 6547 | -C "Protocol is TLSv1.0" |
| 6548 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6549 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 2abf03c | 2021-06-25 14:40:09 +0200 | [diff] [blame] | 6550 | run_test "Not supported version check: srv max TLS 1.1" \ |
| 6551 | "$G_SRV --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.1" \ |
| 6552 | "$P_CLI" \ |
| 6553 | 1 \ |
| 6554 | -s "Error in protocol version" \ |
| 6555 | -c "Handshake protocol not within min/max boundaries" \ |
| 6556 | -S "Version: TLS1.1" \ |
| 6557 | -C "Protocol is TLSv1.1" |
| 6558 | |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6559 | # Tests for ALPN extension |
| 6560 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6561 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6562 | run_test "ALPN: none" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6563 | "$P_SRV debug_level=3" \ |
| 6564 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6565 | 0 \ |
| 6566 | -C "client hello, adding alpn extension" \ |
| 6567 | -S "found alpn extension" \ |
| 6568 | -C "got an alert message, type: \\[2:120]" \ |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 6569 | -S "server side, adding alpn extension" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6570 | -C "found alpn extension " \ |
| 6571 | -C "Application Layer Protocol is" \ |
| 6572 | -S "Application Layer Protocol is" |
| 6573 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6574 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6575 | run_test "ALPN: client only" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6576 | "$P_SRV debug_level=3" \ |
| 6577 | "$P_CLI debug_level=3 alpn=abc,1234" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6578 | 0 \ |
| 6579 | -c "client hello, adding alpn extension" \ |
| 6580 | -s "found alpn extension" \ |
| 6581 | -C "got an alert message, type: \\[2:120]" \ |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 6582 | -S "server side, adding alpn extension" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6583 | -C "found alpn extension " \ |
| 6584 | -c "Application Layer Protocol is (none)" \ |
| 6585 | -S "Application Layer Protocol is" |
| 6586 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6587 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6588 | run_test "ALPN: server only" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6589 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 6590 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6591 | 0 \ |
| 6592 | -C "client hello, adding alpn extension" \ |
| 6593 | -S "found alpn extension" \ |
| 6594 | -C "got an alert message, type: \\[2:120]" \ |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 6595 | -S "server side, adding alpn extension" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6596 | -C "found alpn extension " \ |
| 6597 | -C "Application Layer Protocol is" \ |
| 6598 | -s "Application Layer Protocol is (none)" |
| 6599 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6600 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6601 | run_test "ALPN: both, common cli1-srv1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6602 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 6603 | "$P_CLI debug_level=3 alpn=abc,1234" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6604 | 0 \ |
| 6605 | -c "client hello, adding alpn extension" \ |
| 6606 | -s "found alpn extension" \ |
| 6607 | -C "got an alert message, type: \\[2:120]" \ |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 6608 | -s "server side, adding alpn extension" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6609 | -c "found alpn extension" \ |
| 6610 | -c "Application Layer Protocol is abc" \ |
| 6611 | -s "Application Layer Protocol is abc" |
| 6612 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6613 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6614 | run_test "ALPN: both, common cli2-srv1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6615 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 6616 | "$P_CLI debug_level=3 alpn=1234,abc" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6617 | 0 \ |
| 6618 | -c "client hello, adding alpn extension" \ |
| 6619 | -s "found alpn extension" \ |
| 6620 | -C "got an alert message, type: \\[2:120]" \ |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 6621 | -s "server side, adding alpn extension" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6622 | -c "found alpn extension" \ |
| 6623 | -c "Application Layer Protocol is abc" \ |
| 6624 | -s "Application Layer Protocol is abc" |
| 6625 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6626 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6627 | run_test "ALPN: both, common cli1-srv2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6628 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 6629 | "$P_CLI debug_level=3 alpn=1234,abcde" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6630 | 0 \ |
| 6631 | -c "client hello, adding alpn extension" \ |
| 6632 | -s "found alpn extension" \ |
| 6633 | -C "got an alert message, type: \\[2:120]" \ |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 6634 | -s "server side, adding alpn extension" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6635 | -c "found alpn extension" \ |
| 6636 | -c "Application Layer Protocol is 1234" \ |
| 6637 | -s "Application Layer Protocol is 1234" |
| 6638 | |
Ronald Cron | bc5adf4 | 2022-10-04 11:06:14 +0200 | [diff] [blame] | 6639 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6640 | run_test "ALPN: both, no common" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6641 | "$P_SRV debug_level=3 alpn=abc,123" \ |
| 6642 | "$P_CLI debug_level=3 alpn=1234,abcde" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6643 | 1 \ |
| 6644 | -c "client hello, adding alpn extension" \ |
| 6645 | -s "found alpn extension" \ |
| 6646 | -c "got an alert message, type: \\[2:120]" \ |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 6647 | -S "server side, adding alpn extension" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 6648 | -C "found alpn extension" \ |
| 6649 | -C "Application Layer Protocol is 1234" \ |
| 6650 | -S "Application Layer Protocol is 1234" |
| 6651 | |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 6652 | |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6653 | # Tests for keyUsage in leaf certificates, part 1: |
| 6654 | # server-side certificate/suite selection |
| 6655 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6656 | run_test "keyUsage srv: RSA, digitalSignature -> (EC)DHE-RSA" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 6657 | "$P_SRV force_version=tls12 key_file=data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6658 | crt_file=data_files/server2.ku-ds.crt" \ |
| 6659 | "$P_CLI" \ |
| 6660 | 0 \ |
Manuel Pégourié-Gonnard | 17cde5f | 2014-05-22 14:42:39 +0200 | [diff] [blame] | 6661 | -c "Ciphersuite is TLS-[EC]*DHE-RSA-WITH-" |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6662 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6663 | run_test "keyUsage srv: RSA, keyEncipherment -> RSA" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 6664 | "$P_SRV force_version=tls12 key_file=data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6665 | crt_file=data_files/server2.ku-ke.crt" \ |
| 6666 | "$P_CLI" \ |
| 6667 | 0 \ |
| 6668 | -c "Ciphersuite is TLS-RSA-WITH-" |
| 6669 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6670 | run_test "keyUsage srv: RSA, keyAgreement -> fail" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 6671 | "$P_SRV force_version=tls12 key_file=data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6672 | crt_file=data_files/server2.ku-ka.crt" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 6673 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6674 | 1 \ |
| 6675 | -C "Ciphersuite is " |
| 6676 | |
Valerio Setti | d1f991c | 2023-02-22 12:54:13 +0100 | [diff] [blame] | 6677 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6678 | run_test "keyUsage srv: ECDSA, digitalSignature -> ECDHE-ECDSA" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 6679 | "$P_SRV force_version=tls12 key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6680 | crt_file=data_files/server5.ku-ds.crt" \ |
| 6681 | "$P_CLI" \ |
| 6682 | 0 \ |
| 6683 | -c "Ciphersuite is TLS-ECDHE-ECDSA-WITH-" |
| 6684 | |
| 6685 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6686 | run_test "keyUsage srv: ECDSA, keyAgreement -> ECDH-" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 6687 | "$P_SRV force_version=tls12 key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6688 | crt_file=data_files/server5.ku-ka.crt" \ |
| 6689 | "$P_CLI" \ |
| 6690 | 0 \ |
| 6691 | -c "Ciphersuite is TLS-ECDH-" |
| 6692 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6693 | run_test "keyUsage srv: ECDSA, keyEncipherment -> fail" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 6694 | "$P_SRV force_version=tls12 key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6695 | crt_file=data_files/server5.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 6696 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6697 | 1 \ |
| 6698 | -C "Ciphersuite is " |
| 6699 | |
| 6700 | # Tests for keyUsage in leaf certificates, part 2: |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6701 | # client-side checking of server cert |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6702 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6703 | run_test "keyUsage cli: DigitalSignature+KeyEncipherment, RSA: OK" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 6704 | "$O_SRV -tls1_2 -key data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6705 | -cert data_files/server2.ku-ds_ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6706 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6707 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 6708 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6709 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6710 | -C "Processing of the Certificate handshake message failed" \ |
| 6711 | -c "Ciphersuite is TLS-" |
| 6712 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6713 | run_test "keyUsage cli: DigitalSignature+KeyEncipherment, DHE-RSA: OK" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 6714 | "$O_SRV -tls1_2 -key data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6715 | -cert data_files/server2.ku-ds_ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6716 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6717 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 6718 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6719 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6720 | -C "Processing of the Certificate handshake message failed" \ |
| 6721 | -c "Ciphersuite is TLS-" |
| 6722 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6723 | run_test "keyUsage cli: KeyEncipherment, RSA: OK" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 6724 | "$O_SRV -tls1_2 -key data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6725 | -cert data_files/server2.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6726 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6727 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 6728 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6729 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6730 | -C "Processing of the Certificate handshake message failed" \ |
| 6731 | -c "Ciphersuite is TLS-" |
| 6732 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6733 | run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 6734 | "$O_SRV -tls1_2 -key data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6735 | -cert data_files/server2.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6736 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6737 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 6738 | 1 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6739 | -c "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6740 | -c "Processing of the Certificate handshake message failed" \ |
| 6741 | -C "Ciphersuite is TLS-" |
| 6742 | |
Manuel Pégourié-Gonnard | e6efa6f | 2015-04-20 11:01:48 +0100 | [diff] [blame] | 6743 | run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail, soft" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 6744 | "$O_SRV -tls1_2 -key data_files/server2.key \ |
Manuel Pégourié-Gonnard | e6efa6f | 2015-04-20 11:01:48 +0100 | [diff] [blame] | 6745 | -cert data_files/server2.ku-ke.crt" \ |
| 6746 | "$P_CLI debug_level=1 auth_mode=optional \ |
| 6747 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 6748 | 0 \ |
| 6749 | -c "bad certificate (usage extensions)" \ |
| 6750 | -C "Processing of the Certificate handshake message failed" \ |
| 6751 | -c "Ciphersuite is TLS-" \ |
| 6752 | -c "! Usage does not match the keyUsage extension" |
| 6753 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6754 | run_test "keyUsage cli: DigitalSignature, DHE-RSA: OK" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 6755 | "$O_SRV -tls1_2 -key data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6756 | -cert data_files/server2.ku-ds.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6757 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6758 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 6759 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6760 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6761 | -C "Processing of the Certificate handshake message failed" \ |
| 6762 | -c "Ciphersuite is TLS-" |
| 6763 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6764 | run_test "keyUsage cli: DigitalSignature, RSA: fail" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 6765 | "$O_SRV -tls1_2 -key data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6766 | -cert data_files/server2.ku-ds.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6767 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6768 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 6769 | 1 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6770 | -c "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 6771 | -c "Processing of the Certificate handshake message failed" \ |
| 6772 | -C "Ciphersuite is TLS-" |
| 6773 | |
Manuel Pégourié-Gonnard | e6efa6f | 2015-04-20 11:01:48 +0100 | [diff] [blame] | 6774 | run_test "keyUsage cli: DigitalSignature, RSA: fail, soft" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 6775 | "$O_SRV -tls1_2 -key data_files/server2.key \ |
Manuel Pégourié-Gonnard | e6efa6f | 2015-04-20 11:01:48 +0100 | [diff] [blame] | 6776 | -cert data_files/server2.ku-ds.crt" \ |
| 6777 | "$P_CLI debug_level=1 auth_mode=optional \ |
| 6778 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 6779 | 0 \ |
| 6780 | -c "bad certificate (usage extensions)" \ |
| 6781 | -C "Processing of the Certificate handshake message failed" \ |
| 6782 | -c "Ciphersuite is TLS-" \ |
| 6783 | -c "! Usage does not match the keyUsage extension" |
| 6784 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 6785 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 6786 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 6787 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6788 | run_test "keyUsage cli 1.3: DigitalSignature+KeyEncipherment, RSA: OK" \ |
| 6789 | "$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server2.key \ |
| 6790 | -cert data_files/server2.ku-ds_ke.crt" \ |
| 6791 | "$P_CLI debug_level=3" \ |
| 6792 | 0 \ |
| 6793 | -C "bad certificate (usage extensions)" \ |
| 6794 | -C "Processing of the Certificate handshake message failed" \ |
| 6795 | -c "Ciphersuite is" |
| 6796 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 6797 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 6798 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 6799 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | ba65fbb | 2022-06-22 14:35:05 +0200 | [diff] [blame] | 6800 | run_test "keyUsage cli 1.3: KeyEncipherment, RSA: fail" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6801 | "$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server2.key \ |
| 6802 | -cert data_files/server2.ku-ke.crt" \ |
| 6803 | "$P_CLI debug_level=1" \ |
| 6804 | 1 \ |
| 6805 | -c "bad certificate (usage extensions)" \ |
| 6806 | -c "Processing of the Certificate handshake message failed" \ |
| 6807 | -C "Ciphersuite is" |
| 6808 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 6809 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 6810 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 6811 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | ba65fbb | 2022-06-22 14:35:05 +0200 | [diff] [blame] | 6812 | run_test "keyUsage cli 1.3: KeyAgreement, RSA: fail" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6813 | "$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server2.key \ |
| 6814 | -cert data_files/server2.ku-ka.crt" \ |
| 6815 | "$P_CLI debug_level=1" \ |
| 6816 | 1 \ |
| 6817 | -c "bad certificate (usage extensions)" \ |
| 6818 | -c "Processing of the Certificate handshake message failed" \ |
| 6819 | -C "Ciphersuite is" |
| 6820 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 6821 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 6822 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 6823 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6824 | run_test "keyUsage cli 1.3: DigitalSignature, ECDSA: OK" \ |
| 6825 | "$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \ |
| 6826 | -cert data_files/server5.ku-ds.crt" \ |
| 6827 | "$P_CLI debug_level=3" \ |
| 6828 | 0 \ |
| 6829 | -C "bad certificate (usage extensions)" \ |
| 6830 | -C "Processing of the Certificate handshake message failed" \ |
| 6831 | -c "Ciphersuite is" |
| 6832 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 6833 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 6834 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 6835 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | ba65fbb | 2022-06-22 14:35:05 +0200 | [diff] [blame] | 6836 | run_test "keyUsage cli 1.3: KeyEncipherment, ECDSA: fail" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6837 | "$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \ |
| 6838 | -cert data_files/server5.ku-ke.crt" \ |
| 6839 | "$P_CLI debug_level=1" \ |
| 6840 | 1 \ |
| 6841 | -c "bad certificate (usage extensions)" \ |
| 6842 | -c "Processing of the Certificate handshake message failed" \ |
| 6843 | -C "Ciphersuite is" |
| 6844 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 6845 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 6846 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 6847 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | ba65fbb | 2022-06-22 14:35:05 +0200 | [diff] [blame] | 6848 | run_test "keyUsage cli 1.3: KeyAgreement, ECDSA: fail" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6849 | "$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \ |
| 6850 | -cert data_files/server5.ku-ka.crt" \ |
| 6851 | "$P_CLI debug_level=1" \ |
| 6852 | 1 \ |
| 6853 | -c "bad certificate (usage extensions)" \ |
| 6854 | -c "Processing of the Certificate handshake message failed" \ |
| 6855 | -C "Ciphersuite is" |
| 6856 | |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6857 | # Tests for keyUsage in leaf certificates, part 3: |
| 6858 | # server-side checking of client cert |
| 6859 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6860 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6861 | run_test "keyUsage cli-auth: RSA, DigitalSignature: OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6862 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6863 | "$O_CLI -key data_files/server2.key \ |
| 6864 | -cert data_files/server2.ku-ds.crt" \ |
| 6865 | 0 \ |
Ronald Cron | f9c13fe | 2022-06-22 14:35:17 +0200 | [diff] [blame] | 6866 | -s "Verifying peer X.509 certificate... ok" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6867 | -S "bad certificate (usage extensions)" \ |
| 6868 | -S "Processing of the Certificate handshake message failed" |
| 6869 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6870 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6871 | run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6872 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6873 | "$O_CLI -key data_files/server2.key \ |
| 6874 | -cert data_files/server2.ku-ke.crt" \ |
| 6875 | 0 \ |
| 6876 | -s "bad certificate (usage extensions)" \ |
| 6877 | -S "Processing of the Certificate handshake message failed" |
| 6878 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6879 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6880 | run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (hard)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6881 | "$P_SRV debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6882 | "$O_CLI -key data_files/server2.key \ |
| 6883 | -cert data_files/server2.ku-ke.crt" \ |
| 6884 | 1 \ |
| 6885 | -s "bad certificate (usage extensions)" \ |
| 6886 | -s "Processing of the Certificate handshake message failed" |
| 6887 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6888 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6889 | run_test "keyUsage cli-auth: ECDSA, DigitalSignature: OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6890 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6891 | "$O_CLI -key data_files/server5.key \ |
| 6892 | -cert data_files/server5.ku-ds.crt" \ |
| 6893 | 0 \ |
Ronald Cron | f9c13fe | 2022-06-22 14:35:17 +0200 | [diff] [blame] | 6894 | -s "Verifying peer X.509 certificate... ok" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6895 | -S "bad certificate (usage extensions)" \ |
| 6896 | -S "Processing of the Certificate handshake message failed" |
| 6897 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6898 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6899 | run_test "keyUsage cli-auth: ECDSA, KeyAgreement: fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6900 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 6901 | "$O_CLI -key data_files/server5.key \ |
| 6902 | -cert data_files/server5.ku-ka.crt" \ |
| 6903 | 0 \ |
| 6904 | -s "bad certificate (usage extensions)" \ |
| 6905 | -S "Processing of the Certificate handshake message failed" |
| 6906 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 6907 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 6908 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 6909 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6910 | run_test "keyUsage cli-auth 1.3: RSA, DigitalSignature: OK" \ |
Ronald Cron | 89ca977 | 2022-10-17 14:56:45 +0200 | [diff] [blame] | 6911 | "$P_SRV debug_level=1 force_version=tls13 auth_mode=optional" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6912 | "$O_NEXT_CLI_NO_CERT -key data_files/server2.key \ |
| 6913 | -cert data_files/server2.ku-ds.crt" \ |
| 6914 | 0 \ |
Ronald Cron | f9c13fe | 2022-06-22 14:35:17 +0200 | [diff] [blame] | 6915 | -s "Verifying peer X.509 certificate... ok" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6916 | -S "bad certificate (usage extensions)" \ |
| 6917 | -S "Processing of the Certificate handshake message failed" |
| 6918 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 6919 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 6920 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 6921 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6922 | run_test "keyUsage cli-auth 1.3: RSA, KeyEncipherment: fail (soft)" \ |
Ronald Cron | 89ca977 | 2022-10-17 14:56:45 +0200 | [diff] [blame] | 6923 | "$P_SRV debug_level=1 force_version=tls13 auth_mode=optional" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6924 | "$O_NEXT_CLI_NO_CERT -key data_files/server2.key \ |
| 6925 | -cert data_files/server2.ku-ke.crt" \ |
| 6926 | 0 \ |
| 6927 | -s "bad certificate (usage extensions)" \ |
| 6928 | -S "Processing of the Certificate handshake message failed" |
| 6929 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 6930 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 6931 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 6932 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6933 | run_test "keyUsage cli-auth 1.3: ECDSA, DigitalSignature: OK" \ |
Ronald Cron | 89ca977 | 2022-10-17 14:56:45 +0200 | [diff] [blame] | 6934 | "$P_SRV debug_level=1 force_version=tls13 auth_mode=optional" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6935 | "$O_NEXT_CLI_NO_CERT -key data_files/server5.key \ |
| 6936 | -cert data_files/server5.ku-ds.crt" \ |
| 6937 | 0 \ |
Ronald Cron | f9c13fe | 2022-06-22 14:35:17 +0200 | [diff] [blame] | 6938 | -s "Verifying peer X.509 certificate... ok" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6939 | -S "bad certificate (usage extensions)" \ |
| 6940 | -S "Processing of the Certificate handshake message failed" |
| 6941 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 6942 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 6943 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 6944 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6945 | run_test "keyUsage cli-auth 1.3: ECDSA, KeyAgreement: fail (soft)" \ |
Ronald Cron | 89ca977 | 2022-10-17 14:56:45 +0200 | [diff] [blame] | 6946 | "$P_SRV debug_level=1 force_version=tls13 auth_mode=optional" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 6947 | "$O_NEXT_CLI_NO_CERT -key data_files/server5.key \ |
| 6948 | -cert data_files/server5.ku-ka.crt" \ |
| 6949 | 0 \ |
| 6950 | -s "bad certificate (usage extensions)" \ |
| 6951 | -S "Processing of the Certificate handshake message failed" |
| 6952 | |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6953 | # Tests for extendedKeyUsage, part 1: server-side certificate/suite selection |
| 6954 | |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6955 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6956 | run_test "extKeyUsage srv: serverAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6957 | "$P_SRV key_file=data_files/server5.key \ |
| 6958 | crt_file=data_files/server5.eku-srv.crt" \ |
| 6959 | "$P_CLI" \ |
| 6960 | 0 |
| 6961 | |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6962 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6963 | run_test "extKeyUsage srv: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6964 | "$P_SRV key_file=data_files/server5.key \ |
| 6965 | crt_file=data_files/server5.eku-srv.crt" \ |
| 6966 | "$P_CLI" \ |
| 6967 | 0 |
| 6968 | |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6969 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6970 | run_test "extKeyUsage srv: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6971 | "$P_SRV key_file=data_files/server5.key \ |
| 6972 | crt_file=data_files/server5.eku-cs_any.crt" \ |
| 6973 | "$P_CLI" \ |
| 6974 | 0 |
| 6975 | |
Ronald Cron | 92dca39 | 2023-03-10 16:11:15 +0100 | [diff] [blame] | 6976 | requires_key_exchange_with_cert_in_tls12_or_tls13_enabled |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6977 | run_test "extKeyUsage srv: codeSign -> fail" \ |
Manuel Pégourié-Gonnard | 7eb58cb | 2015-07-07 11:54:14 +0200 | [diff] [blame] | 6978 | "$P_SRV key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6979 | crt_file=data_files/server5.eku-cli.crt" \ |
Manuel Pégourié-Gonnard | 7eb58cb | 2015-07-07 11:54:14 +0200 | [diff] [blame] | 6980 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6981 | 1 |
| 6982 | |
| 6983 | # Tests for extendedKeyUsage, part 2: client-side checking of server cert |
| 6984 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6985 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6986 | run_test "extKeyUsage cli: serverAuth -> OK" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 6987 | "$O_SRV -tls1_2 -key data_files/server5.key \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6988 | -cert data_files/server5.eku-srv.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6989 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6990 | 0 \ |
| 6991 | -C "bad certificate (usage extensions)" \ |
| 6992 | -C "Processing of the Certificate handshake message failed" \ |
| 6993 | -c "Ciphersuite is TLS-" |
| 6994 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 6995 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 6996 | run_test "extKeyUsage cli: serverAuth,clientAuth -> OK" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 6997 | "$O_SRV -tls1_2 -key data_files/server5.key \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 6998 | -cert data_files/server5.eku-srv_cli.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 6999 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 7000 | 0 \ |
| 7001 | -C "bad certificate (usage extensions)" \ |
| 7002 | -C "Processing of the Certificate handshake message failed" \ |
| 7003 | -c "Ciphersuite is TLS-" |
| 7004 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 7005 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7006 | run_test "extKeyUsage cli: codeSign,anyEKU -> OK" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 7007 | "$O_SRV -tls1_2 -key data_files/server5.key \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 7008 | -cert data_files/server5.eku-cs_any.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 7009 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 7010 | 0 \ |
| 7011 | -C "bad certificate (usage extensions)" \ |
| 7012 | -C "Processing of the Certificate handshake message failed" \ |
| 7013 | -c "Ciphersuite is TLS-" |
| 7014 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 7015 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7016 | run_test "extKeyUsage cli: codeSign -> fail" \ |
Ronald Cron | cbd7bfd | 2022-03-31 18:19:56 +0200 | [diff] [blame] | 7017 | "$O_SRV -tls1_2 -key data_files/server5.key \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 7018 | -cert data_files/server5.eku-cs.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 7019 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 7020 | 1 \ |
| 7021 | -c "bad certificate (usage extensions)" \ |
| 7022 | -c "Processing of the Certificate handshake message failed" \ |
| 7023 | -C "Ciphersuite is TLS-" |
| 7024 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 7025 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 7026 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 7027 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 7028 | run_test "extKeyUsage cli 1.3: serverAuth -> OK" \ |
| 7029 | "$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \ |
| 7030 | -cert data_files/server5.eku-srv.crt" \ |
| 7031 | "$P_CLI debug_level=1" \ |
| 7032 | 0 \ |
| 7033 | -C "bad certificate (usage extensions)" \ |
| 7034 | -C "Processing of the Certificate handshake message failed" \ |
| 7035 | -c "Ciphersuite is" |
| 7036 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 7037 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 7038 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 7039 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 7040 | run_test "extKeyUsage cli 1.3: serverAuth,clientAuth -> OK" \ |
| 7041 | "$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \ |
| 7042 | -cert data_files/server5.eku-srv_cli.crt" \ |
| 7043 | "$P_CLI debug_level=1" \ |
| 7044 | 0 \ |
| 7045 | -C "bad certificate (usage extensions)" \ |
| 7046 | -C "Processing of the Certificate handshake message failed" \ |
| 7047 | -c "Ciphersuite is" |
| 7048 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 7049 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 7050 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 7051 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 7052 | run_test "extKeyUsage cli 1.3: codeSign,anyEKU -> OK" \ |
| 7053 | "$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \ |
| 7054 | -cert data_files/server5.eku-cs_any.crt" \ |
| 7055 | "$P_CLI debug_level=1" \ |
| 7056 | 0 \ |
| 7057 | -C "bad certificate (usage extensions)" \ |
| 7058 | -C "Processing of the Certificate handshake message failed" \ |
| 7059 | -c "Ciphersuite is" |
| 7060 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 7061 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 7062 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 7063 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 7064 | run_test "extKeyUsage cli 1.3: codeSign -> fail" \ |
| 7065 | "$O_NEXT_SRV_NO_CERT -tls1_3 -num_tickets=0 -key data_files/server5.key \ |
| 7066 | -cert data_files/server5.eku-cs.crt" \ |
| 7067 | "$P_CLI debug_level=1" \ |
| 7068 | 1 \ |
| 7069 | -c "bad certificate (usage extensions)" \ |
| 7070 | -c "Processing of the Certificate handshake message failed" \ |
| 7071 | -C "Ciphersuite is" |
| 7072 | |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 7073 | # Tests for extendedKeyUsage, part 3: server-side checking of client cert |
| 7074 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 7075 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7076 | run_test "extKeyUsage cli-auth: clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 7077 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 7078 | "$O_CLI -key data_files/server5.key \ |
| 7079 | -cert data_files/server5.eku-cli.crt" \ |
| 7080 | 0 \ |
| 7081 | -S "bad certificate (usage extensions)" \ |
| 7082 | -S "Processing of the Certificate handshake message failed" |
| 7083 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 7084 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7085 | run_test "extKeyUsage cli-auth: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 7086 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 7087 | "$O_CLI -key data_files/server5.key \ |
| 7088 | -cert data_files/server5.eku-srv_cli.crt" \ |
| 7089 | 0 \ |
| 7090 | -S "bad certificate (usage extensions)" \ |
| 7091 | -S "Processing of the Certificate handshake message failed" |
| 7092 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 7093 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7094 | run_test "extKeyUsage cli-auth: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 7095 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 7096 | "$O_CLI -key data_files/server5.key \ |
| 7097 | -cert data_files/server5.eku-cs_any.crt" \ |
| 7098 | 0 \ |
| 7099 | -S "bad certificate (usage extensions)" \ |
| 7100 | -S "Processing of the Certificate handshake message failed" |
| 7101 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 7102 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7103 | run_test "extKeyUsage cli-auth: codeSign -> fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 7104 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 7105 | "$O_CLI -key data_files/server5.key \ |
| 7106 | -cert data_files/server5.eku-cs.crt" \ |
| 7107 | 0 \ |
| 7108 | -s "bad certificate (usage extensions)" \ |
| 7109 | -S "Processing of the Certificate handshake message failed" |
| 7110 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 7111 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7112 | run_test "extKeyUsage cli-auth: codeSign -> fail (hard)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 7113 | "$P_SRV debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 7114 | "$O_CLI -key data_files/server5.key \ |
| 7115 | -cert data_files/server5.eku-cs.crt" \ |
| 7116 | 1 \ |
| 7117 | -s "bad certificate (usage extensions)" \ |
| 7118 | -s "Processing of the Certificate handshake message failed" |
| 7119 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 7120 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 7121 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 7122 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 7123 | run_test "extKeyUsage cli-auth 1.3: clientAuth -> OK" \ |
Ronald Cron | 89ca977 | 2022-10-17 14:56:45 +0200 | [diff] [blame] | 7124 | "$P_SRV debug_level=1 force_version=tls13 auth_mode=optional" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 7125 | "$O_NEXT_CLI_NO_CERT -key data_files/server5.key \ |
| 7126 | -cert data_files/server5.eku-cli.crt" \ |
| 7127 | 0 \ |
| 7128 | -S "bad certificate (usage extensions)" \ |
| 7129 | -S "Processing of the Certificate handshake message failed" |
| 7130 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 7131 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 7132 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 7133 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 7134 | run_test "extKeyUsage cli-auth 1.3: serverAuth,clientAuth -> OK" \ |
Ronald Cron | 89ca977 | 2022-10-17 14:56:45 +0200 | [diff] [blame] | 7135 | "$P_SRV debug_level=1 force_version=tls13 auth_mode=optional" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 7136 | "$O_NEXT_CLI_NO_CERT -key data_files/server5.key \ |
| 7137 | -cert data_files/server5.eku-srv_cli.crt" \ |
| 7138 | 0 \ |
| 7139 | -S "bad certificate (usage extensions)" \ |
| 7140 | -S "Processing of the Certificate handshake message failed" |
| 7141 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 7142 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 7143 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 7144 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 7145 | run_test "extKeyUsage cli-auth 1.3: codeSign,anyEKU -> OK" \ |
Ronald Cron | 89ca977 | 2022-10-17 14:56:45 +0200 | [diff] [blame] | 7146 | "$P_SRV debug_level=1 force_version=tls13 auth_mode=optional" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 7147 | "$O_NEXT_CLI_NO_CERT -key data_files/server5.key \ |
| 7148 | -cert data_files/server5.eku-cs_any.crt" \ |
| 7149 | 0 \ |
| 7150 | -S "bad certificate (usage extensions)" \ |
| 7151 | -S "Processing of the Certificate handshake message failed" |
| 7152 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 7153 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 7154 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 7155 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 7156 | run_test "extKeyUsage cli-auth 1.3: codeSign -> fail (soft)" \ |
Ronald Cron | 89ca977 | 2022-10-17 14:56:45 +0200 | [diff] [blame] | 7157 | "$P_SRV debug_level=1 force_version=tls13 auth_mode=optional" \ |
Ronald Cron | d28f5a9 | 2022-06-16 19:27:25 +0200 | [diff] [blame] | 7158 | "$O_NEXT_CLI_NO_CERT -key data_files/server5.key \ |
| 7159 | -cert data_files/server5.eku-cs.crt" \ |
| 7160 | 0 \ |
| 7161 | -s "bad certificate (usage extensions)" \ |
| 7162 | -S "Processing of the Certificate handshake message failed" |
| 7163 | |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 7164 | # Tests for DHM parameters loading |
| 7165 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7166 | run_test "DHM parameters: reference" \ |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 7167 | "$P_SRV" \ |
| 7168 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 7169 | debug_level=3" \ |
| 7170 | 0 \ |
| 7171 | -c "value of 'DHM: P ' (2048 bits)" \ |
Hanno Becker | 13be990 | 2017-09-27 17:17:30 +0100 | [diff] [blame] | 7172 | -c "value of 'DHM: G ' (2 bits)" |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 7173 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7174 | run_test "DHM parameters: other parameters" \ |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 7175 | "$P_SRV dhm_file=data_files/dhparams.pem" \ |
| 7176 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 7177 | debug_level=3" \ |
| 7178 | 0 \ |
| 7179 | -c "value of 'DHM: P ' (1024 bits)" \ |
| 7180 | -c "value of 'DHM: G ' (2 bits)" |
| 7181 | |
Manuel Pégourié-Gonnard | 7a010aa | 2015-06-12 11:19:10 +0200 | [diff] [blame] | 7182 | # Tests for DHM client-side size checking |
| 7183 | |
| 7184 | run_test "DHM size: server default, client default, OK" \ |
| 7185 | "$P_SRV" \ |
| 7186 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 7187 | debug_level=1" \ |
| 7188 | 0 \ |
| 7189 | -C "DHM prime too short:" |
| 7190 | |
| 7191 | run_test "DHM size: server default, client 2048, OK" \ |
| 7192 | "$P_SRV" \ |
| 7193 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 7194 | debug_level=1 dhmlen=2048" \ |
| 7195 | 0 \ |
| 7196 | -C "DHM prime too short:" |
| 7197 | |
| 7198 | run_test "DHM size: server 1024, client default, OK" \ |
| 7199 | "$P_SRV dhm_file=data_files/dhparams.pem" \ |
| 7200 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 7201 | debug_level=1" \ |
| 7202 | 0 \ |
| 7203 | -C "DHM prime too short:" |
| 7204 | |
Gilles Peskine | c6b0d96 | 2020-12-08 22:31:52 +0100 | [diff] [blame] | 7205 | run_test "DHM size: server 999, client 999, OK" \ |
| 7206 | "$P_SRV dhm_file=data_files/dh.999.pem" \ |
| 7207 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 7208 | debug_level=1 dhmlen=999" \ |
| 7209 | 0 \ |
| 7210 | -C "DHM prime too short:" |
| 7211 | |
| 7212 | run_test "DHM size: server 1000, client 1000, OK" \ |
| 7213 | "$P_SRV dhm_file=data_files/dh.1000.pem" \ |
| 7214 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 7215 | debug_level=1 dhmlen=1000" \ |
| 7216 | 0 \ |
| 7217 | -C "DHM prime too short:" |
| 7218 | |
Manuel Pégourié-Gonnard | 7a010aa | 2015-06-12 11:19:10 +0200 | [diff] [blame] | 7219 | run_test "DHM size: server 1000, client default, rejected" \ |
| 7220 | "$P_SRV dhm_file=data_files/dh.1000.pem" \ |
| 7221 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 7222 | debug_level=1" \ |
| 7223 | 1 \ |
| 7224 | -c "DHM prime too short:" |
| 7225 | |
Gilles Peskine | c6b0d96 | 2020-12-08 22:31:52 +0100 | [diff] [blame] | 7226 | run_test "DHM size: server 1000, client 1001, rejected" \ |
| 7227 | "$P_SRV dhm_file=data_files/dh.1000.pem" \ |
| 7228 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 7229 | debug_level=1 dhmlen=1001" \ |
| 7230 | 1 \ |
| 7231 | -c "DHM prime too short:" |
| 7232 | |
| 7233 | run_test "DHM size: server 999, client 1000, rejected" \ |
| 7234 | "$P_SRV dhm_file=data_files/dh.999.pem" \ |
| 7235 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 7236 | debug_level=1 dhmlen=1000" \ |
| 7237 | 1 \ |
| 7238 | -c "DHM prime too short:" |
| 7239 | |
| 7240 | run_test "DHM size: server 998, client 999, rejected" \ |
| 7241 | "$P_SRV dhm_file=data_files/dh.998.pem" \ |
| 7242 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 7243 | debug_level=1 dhmlen=999" \ |
| 7244 | 1 \ |
| 7245 | -c "DHM prime too short:" |
| 7246 | |
Manuel Pégourié-Gonnard | 7a010aa | 2015-06-12 11:19:10 +0200 | [diff] [blame] | 7247 | run_test "DHM size: server default, client 2049, rejected" \ |
| 7248 | "$P_SRV" \ |
| 7249 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 7250 | debug_level=1 dhmlen=2049" \ |
| 7251 | 1 \ |
| 7252 | -c "DHM prime too short:" |
| 7253 | |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 7254 | # Tests for PSK callback |
| 7255 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7256 | run_test "PSK callback: psk, no callback" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 7257 | "$P_SRV psk=abc123 psk_identity=foo" \ |
| 7258 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 7259 | psk_identity=foo psk=abc123" \ |
| 7260 | 0 \ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7261 | -S "SSL - The handshake negotiation failed" \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 7262 | -S "SSL - Unknown identity received" \ |
| 7263 | -S "SSL - Verification of the message MAC failed" |
| 7264 | |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 7265 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7266 | run_test "PSK callback: opaque psk on client, no callback" \ |
| 7267 | "$P_SRV extended_ms=0 debug_level=1 psk=abc123 psk_identity=foo" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7268 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 7269 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 7270 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7271 | -C "session hash for extended master secret"\ |
| 7272 | -S "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7273 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 7274 | -S "SSL - Unknown identity received" \ |
| 7275 | -S "SSL - Verification of the message MAC failed" |
| 7276 | |
| 7277 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7278 | run_test "PSK callback: opaque psk on client, no callback, SHA-384" \ |
| 7279 | "$P_SRV extended_ms=0 debug_level=1 psk=abc123 psk_identity=foo" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7280 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 7281 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 7282 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7283 | -C "session hash for extended master secret"\ |
| 7284 | -S "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7285 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 7286 | -S "SSL - Unknown identity received" \ |
| 7287 | -S "SSL - Verification of the message MAC failed" |
| 7288 | |
| 7289 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7290 | run_test "PSK callback: opaque psk on client, no callback, EMS" \ |
| 7291 | "$P_SRV extended_ms=1 debug_level=3 psk=abc123 psk_identity=foo" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7292 | "$P_CLI extended_ms=1 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 7293 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 7294 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7295 | -c "session hash for extended master secret"\ |
| 7296 | -s "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7297 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 7298 | -S "SSL - Unknown identity received" \ |
| 7299 | -S "SSL - Verification of the message MAC failed" |
| 7300 | |
| 7301 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7302 | run_test "PSK callback: opaque psk on client, no callback, SHA-384, EMS" \ |
| 7303 | "$P_SRV extended_ms=1 debug_level=3 psk=abc123 psk_identity=foo" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7304 | "$P_CLI extended_ms=1 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 7305 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 7306 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7307 | -c "session hash for extended master secret"\ |
| 7308 | -s "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7309 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | f702751 | 2018-10-23 15:27:39 +0100 | [diff] [blame] | 7310 | -S "SSL - Unknown identity received" \ |
| 7311 | -S "SSL - Verification of the message MAC failed" |
| 7312 | |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7313 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 8e0495e | 2022-04-05 23:00:04 +0200 | [diff] [blame] | 7314 | run_test "PSK callback: opaque rsa-psk on client, no callback" \ |
| 7315 | "$P_SRV extended_ms=0 debug_level=1 psk=abc123 psk_identity=foo" \ |
| 7316 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA256 \ |
| 7317 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
| 7318 | 0 \ |
Przemek Stekiel | 8e0495e | 2022-04-05 23:00:04 +0200 | [diff] [blame] | 7319 | -C "session hash for extended master secret"\ |
| 7320 | -S "session hash for extended master secret"\ |
| 7321 | -S "SSL - The handshake negotiation failed" \ |
| 7322 | -S "SSL - Unknown identity received" \ |
| 7323 | -S "SSL - Verification of the message MAC failed" |
| 7324 | |
| 7325 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 8e0495e | 2022-04-05 23:00:04 +0200 | [diff] [blame] | 7326 | run_test "PSK callback: opaque rsa-psk on client, no callback, SHA-384" \ |
| 7327 | "$P_SRV extended_ms=0 debug_level=1 psk=abc123 psk_identity=foo" \ |
| 7328 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7329 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
| 7330 | 0 \ |
Przemek Stekiel | 8e0495e | 2022-04-05 23:00:04 +0200 | [diff] [blame] | 7331 | -C "session hash for extended master secret"\ |
| 7332 | -S "session hash for extended master secret"\ |
| 7333 | -S "SSL - The handshake negotiation failed" \ |
| 7334 | -S "SSL - Unknown identity received" \ |
| 7335 | -S "SSL - Verification of the message MAC failed" |
| 7336 | |
| 7337 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 8e0495e | 2022-04-05 23:00:04 +0200 | [diff] [blame] | 7338 | run_test "PSK callback: opaque rsa-psk on client, no callback, EMS" \ |
| 7339 | "$P_SRV extended_ms=1 debug_level=3 psk=abc123 psk_identity=foo" \ |
| 7340 | "$P_CLI extended_ms=1 debug_level=3 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA \ |
| 7341 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
| 7342 | 0 \ |
Przemek Stekiel | 8e0495e | 2022-04-05 23:00:04 +0200 | [diff] [blame] | 7343 | -c "session hash for extended master secret"\ |
| 7344 | -s "session hash for extended master secret"\ |
| 7345 | -S "SSL - The handshake negotiation failed" \ |
| 7346 | -S "SSL - Unknown identity received" \ |
| 7347 | -S "SSL - Verification of the message MAC failed" |
| 7348 | |
| 7349 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 8e0495e | 2022-04-05 23:00:04 +0200 | [diff] [blame] | 7350 | run_test "PSK callback: opaque rsa-psk on client, no callback, SHA-384, EMS" \ |
| 7351 | "$P_SRV extended_ms=1 debug_level=3 psk=abc123 psk_identity=foo" \ |
| 7352 | "$P_CLI extended_ms=1 debug_level=3 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7353 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
| 7354 | 0 \ |
Przemek Stekiel | 8e0495e | 2022-04-05 23:00:04 +0200 | [diff] [blame] | 7355 | -c "session hash for extended master secret"\ |
| 7356 | -s "session hash for extended master secret"\ |
| 7357 | -S "SSL - The handshake negotiation failed" \ |
| 7358 | -S "SSL - Unknown identity received" \ |
| 7359 | -S "SSL - Verification of the message MAC failed" |
| 7360 | |
| 7361 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7362 | run_test "PSK callback: opaque ecdhe-psk on client, no callback" \ |
| 7363 | "$P_SRV extended_ms=0 debug_level=1 psk=abc123 psk_identity=foo" \ |
| 7364 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 \ |
| 7365 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
| 7366 | 0 \ |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7367 | -C "session hash for extended master secret"\ |
| 7368 | -S "session hash for extended master secret"\ |
| 7369 | -S "SSL - The handshake negotiation failed" \ |
| 7370 | -S "SSL - Unknown identity received" \ |
| 7371 | -S "SSL - Verification of the message MAC failed" |
| 7372 | |
| 7373 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7374 | run_test "PSK callback: opaque ecdhe-psk on client, no callback, SHA-384" \ |
| 7375 | "$P_SRV extended_ms=0 debug_level=1 psk=abc123 psk_identity=foo" \ |
| 7376 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7377 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
| 7378 | 0 \ |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7379 | -C "session hash for extended master secret"\ |
| 7380 | -S "session hash for extended master secret"\ |
| 7381 | -S "SSL - The handshake negotiation failed" \ |
| 7382 | -S "SSL - Unknown identity received" \ |
| 7383 | -S "SSL - Verification of the message MAC failed" |
| 7384 | |
| 7385 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7386 | run_test "PSK callback: opaque ecdhe-psk on client, no callback, EMS" \ |
| 7387 | "$P_SRV extended_ms=1 debug_level=3 psk=abc123 psk_identity=foo" \ |
| 7388 | "$P_CLI extended_ms=1 debug_level=3 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA \ |
| 7389 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
| 7390 | 0 \ |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7391 | -c "session hash for extended master secret"\ |
| 7392 | -s "session hash for extended master secret"\ |
| 7393 | -S "SSL - The handshake negotiation failed" \ |
| 7394 | -S "SSL - Unknown identity received" \ |
| 7395 | -S "SSL - Verification of the message MAC failed" |
| 7396 | |
| 7397 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7398 | run_test "PSK callback: opaque ecdhe-psk on client, no callback, SHA-384, EMS" \ |
| 7399 | "$P_SRV extended_ms=1 debug_level=3 psk=abc123 psk_identity=foo" \ |
| 7400 | "$P_CLI extended_ms=1 debug_level=3 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7401 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
| 7402 | 0 \ |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7403 | -c "session hash for extended master secret"\ |
| 7404 | -s "session hash for extended master secret"\ |
| 7405 | -S "SSL - The handshake negotiation failed" \ |
| 7406 | -S "SSL - Unknown identity received" \ |
| 7407 | -S "SSL - Verification of the message MAC failed" |
| 7408 | |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7409 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7410 | run_test "PSK callback: opaque dhe-psk on client, no callback" \ |
| 7411 | "$P_SRV extended_ms=0 debug_level=1 psk=abc123 psk_identity=foo" \ |
| 7412 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-128-CBC-SHA256 \ |
| 7413 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
| 7414 | 0 \ |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7415 | -C "session hash for extended master secret"\ |
| 7416 | -S "session hash for extended master secret"\ |
| 7417 | -S "SSL - The handshake negotiation failed" \ |
| 7418 | -S "SSL - Unknown identity received" \ |
| 7419 | -S "SSL - Verification of the message MAC failed" |
| 7420 | |
| 7421 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7422 | run_test "PSK callback: opaque dhe-psk on client, no callback, SHA-384" \ |
| 7423 | "$P_SRV extended_ms=0 debug_level=1 psk=abc123 psk_identity=foo" \ |
| 7424 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7425 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
| 7426 | 0 \ |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7427 | -C "session hash for extended master secret"\ |
| 7428 | -S "session hash for extended master secret"\ |
| 7429 | -S "SSL - The handshake negotiation failed" \ |
| 7430 | -S "SSL - Unknown identity received" \ |
| 7431 | -S "SSL - Verification of the message MAC failed" |
| 7432 | |
| 7433 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7434 | run_test "PSK callback: opaque dhe-psk on client, no callback, EMS" \ |
| 7435 | "$P_SRV extended_ms=1 debug_level=3 psk=abc123 psk_identity=foo" \ |
| 7436 | "$P_CLI extended_ms=1 debug_level=3 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-128-CBC-SHA \ |
| 7437 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
| 7438 | 0 \ |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7439 | -c "session hash for extended master secret"\ |
| 7440 | -s "session hash for extended master secret"\ |
| 7441 | -S "SSL - The handshake negotiation failed" \ |
| 7442 | -S "SSL - Unknown identity received" \ |
| 7443 | -S "SSL - Verification of the message MAC failed" |
| 7444 | |
| 7445 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7446 | run_test "PSK callback: opaque dhe-psk on client, no callback, SHA-384, EMS" \ |
| 7447 | "$P_SRV extended_ms=1 debug_level=3 psk=abc123 psk_identity=foo" \ |
| 7448 | "$P_CLI extended_ms=1 debug_level=3 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7449 | psk_identity=foo psk=abc123 psk_opaque=1" \ |
| 7450 | 0 \ |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7451 | -c "session hash for extended master secret"\ |
| 7452 | -s "session hash for extended master secret"\ |
| 7453 | -S "SSL - The handshake negotiation failed" \ |
| 7454 | -S "SSL - Unknown identity received" \ |
| 7455 | -S "SSL - Verification of the message MAC failed" |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7456 | |
| 7457 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7458 | run_test "PSK callback: raw psk on client, static opaque on server, no callback" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7459 | "$P_SRV extended_ms=0 debug_level=1 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
| 7460 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7461 | psk_identity=foo psk=abc123" \ |
| 7462 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7463 | -C "session hash for extended master secret"\ |
| 7464 | -S "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7465 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7466 | -S "SSL - Unknown identity received" \ |
| 7467 | -S "SSL - Verification of the message MAC failed" |
| 7468 | |
| 7469 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7470 | run_test "PSK callback: raw psk on client, static opaque on server, no callback, SHA-384" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7471 | "$P_SRV extended_ms=0 debug_level=1 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384" \ |
| 7472 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7473 | psk_identity=foo psk=abc123" \ |
| 7474 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7475 | -C "session hash for extended master secret"\ |
| 7476 | -S "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7477 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7478 | -S "SSL - Unknown identity received" \ |
| 7479 | -S "SSL - Verification of the message MAC failed" |
| 7480 | |
| 7481 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7482 | run_test "PSK callback: raw psk on client, static opaque on server, no callback, EMS" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7483 | "$P_SRV debug_level=3 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7484 | force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA extended_ms=1" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7485 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7486 | psk_identity=foo psk=abc123 extended_ms=1" \ |
| 7487 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7488 | -c "session hash for extended master secret"\ |
| 7489 | -s "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7490 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7491 | -S "SSL - Unknown identity received" \ |
| 7492 | -S "SSL - Verification of the message MAC failed" |
| 7493 | |
| 7494 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7495 | run_test "PSK callback: raw psk on client, static opaque on server, no callback, EMS, SHA384" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7496 | "$P_SRV debug_level=3 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7497 | force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 extended_ms=1" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7498 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7499 | psk_identity=foo psk=abc123 extended_ms=1" \ |
| 7500 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7501 | -c "session hash for extended master secret"\ |
| 7502 | -s "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7503 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7504 | -S "SSL - Unknown identity received" \ |
| 7505 | -S "SSL - Verification of the message MAC failed" |
| 7506 | |
| 7507 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7508 | run_test "PSK callback: raw rsa-psk on client, static opaque on server, no callback" \ |
| 7509 | "$P_SRV extended_ms=0 debug_level=5 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA" \ |
| 7510 | "$P_CLI extended_ms=0 debug_level=5 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA \ |
| 7511 | psk_identity=foo psk=abc123" \ |
| 7512 | 0 \ |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7513 | -C "session hash for extended master secret"\ |
| 7514 | -S "session hash for extended master secret"\ |
| 7515 | -S "SSL - The handshake negotiation failed" \ |
| 7516 | -S "SSL - Unknown identity received" \ |
| 7517 | -S "SSL - Verification of the message MAC failed" |
| 7518 | |
| 7519 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7520 | run_test "PSK callback: raw rsa-psk on client, static opaque on server, no callback, SHA-384" \ |
| 7521 | "$P_SRV extended_ms=0 debug_level=1 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-256-CBC-SHA384" \ |
| 7522 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7523 | psk_identity=foo psk=abc123" \ |
| 7524 | 0 \ |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7525 | -C "session hash for extended master secret"\ |
| 7526 | -S "session hash for extended master secret"\ |
| 7527 | -S "SSL - The handshake negotiation failed" \ |
| 7528 | -S "SSL - Unknown identity received" \ |
| 7529 | -S "SSL - Verification of the message MAC failed" |
| 7530 | |
| 7531 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7532 | run_test "PSK callback: raw rsa-psk on client, static opaque on server, no callback, EMS" \ |
| 7533 | "$P_SRV debug_level=3 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 \ |
| 7534 | force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA extended_ms=1" \ |
| 7535 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA \ |
| 7536 | psk_identity=foo psk=abc123 extended_ms=1" \ |
| 7537 | 0 \ |
| 7538 | -c "session hash for extended master secret"\ |
| 7539 | -s "session hash for extended master secret"\ |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7540 | -S "SSL - The handshake negotiation failed" \ |
| 7541 | -S "SSL - Unknown identity received" \ |
| 7542 | -S "SSL - Verification of the message MAC failed" |
| 7543 | |
| 7544 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7545 | run_test "PSK callback: raw rsa-psk on client, static opaque on server, no callback, EMS, SHA384" \ |
| 7546 | "$P_SRV debug_level=3 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 \ |
| 7547 | force_ciphersuite=TLS-RSA-PSK-WITH-AES-256-CBC-SHA384 extended_ms=1" \ |
| 7548 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7549 | psk_identity=foo psk=abc123 extended_ms=1" \ |
| 7550 | 0 \ |
| 7551 | -c "session hash for extended master secret"\ |
| 7552 | -s "session hash for extended master secret"\ |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7553 | -S "SSL - The handshake negotiation failed" \ |
| 7554 | -S "SSL - Unknown identity received" \ |
| 7555 | -S "SSL - Verification of the message MAC failed" |
| 7556 | |
| 7557 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7558 | run_test "PSK callback: raw ecdhe-psk on client, static opaque on server, no callback" \ |
| 7559 | "$P_SRV extended_ms=0 debug_level=5 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA" \ |
| 7560 | "$P_CLI extended_ms=0 debug_level=5 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA \ |
| 7561 | psk_identity=foo psk=abc123" \ |
| 7562 | 0 \ |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7563 | -C "session hash for extended master secret"\ |
| 7564 | -S "session hash for extended master secret"\ |
| 7565 | -S "SSL - The handshake negotiation failed" \ |
| 7566 | -S "SSL - Unknown identity received" \ |
| 7567 | -S "SSL - Verification of the message MAC failed" |
| 7568 | |
| 7569 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7570 | run_test "PSK callback: raw ecdhe-psk on client, static opaque on server, no callback, SHA-384" \ |
| 7571 | "$P_SRV extended_ms=0 debug_level=1 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384" \ |
| 7572 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7573 | psk_identity=foo psk=abc123" \ |
| 7574 | 0 \ |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7575 | -C "session hash for extended master secret"\ |
| 7576 | -S "session hash for extended master secret"\ |
| 7577 | -S "SSL - The handshake negotiation failed" \ |
| 7578 | -S "SSL - Unknown identity received" \ |
| 7579 | -S "SSL - Verification of the message MAC failed" |
| 7580 | |
| 7581 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7582 | run_test "PSK callback: raw ecdhe-psk on client, static opaque on server, no callback, EMS" \ |
| 7583 | "$P_SRV debug_level=3 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 \ |
| 7584 | force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA extended_ms=1" \ |
| 7585 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA \ |
| 7586 | psk_identity=foo psk=abc123 extended_ms=1" \ |
| 7587 | 0 \ |
| 7588 | -c "session hash for extended master secret"\ |
| 7589 | -s "session hash for extended master secret"\ |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7590 | -S "SSL - The handshake negotiation failed" \ |
| 7591 | -S "SSL - Unknown identity received" \ |
| 7592 | -S "SSL - Verification of the message MAC failed" |
| 7593 | |
| 7594 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7595 | run_test "PSK callback: raw ecdhe-psk on client, static opaque on server, no callback, EMS, SHA384" \ |
| 7596 | "$P_SRV debug_level=3 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 \ |
| 7597 | force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384 extended_ms=1" \ |
| 7598 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7599 | psk_identity=foo psk=abc123 extended_ms=1" \ |
| 7600 | 0 \ |
| 7601 | -c "session hash for extended master secret"\ |
| 7602 | -s "session hash for extended master secret"\ |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7603 | -S "SSL - The handshake negotiation failed" \ |
| 7604 | -S "SSL - Unknown identity received" \ |
| 7605 | -S "SSL - Verification of the message MAC failed" |
| 7606 | |
| 7607 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7608 | run_test "PSK callback: raw dhe-psk on client, static opaque on server, no callback" \ |
| 7609 | "$P_SRV extended_ms=0 debug_level=5 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-128-CBC-SHA" \ |
| 7610 | "$P_CLI extended_ms=0 debug_level=5 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-128-CBC-SHA \ |
| 7611 | psk_identity=foo psk=abc123" \ |
| 7612 | 0 \ |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7613 | -C "session hash for extended master secret"\ |
| 7614 | -S "session hash for extended master secret"\ |
| 7615 | -S "SSL - The handshake negotiation failed" \ |
| 7616 | -S "SSL - Unknown identity received" \ |
| 7617 | -S "SSL - Verification of the message MAC failed" |
| 7618 | |
| 7619 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7620 | run_test "PSK callback: raw dhe-psk on client, static opaque on server, no callback, SHA-384" \ |
| 7621 | "$P_SRV extended_ms=0 debug_level=1 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-256-CBC-SHA384" \ |
| 7622 | "$P_CLI extended_ms=0 debug_level=1 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7623 | psk_identity=foo psk=abc123" \ |
| 7624 | 0 \ |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7625 | -C "session hash for extended master secret"\ |
| 7626 | -S "session hash for extended master secret"\ |
| 7627 | -S "SSL - The handshake negotiation failed" \ |
| 7628 | -S "SSL - Unknown identity received" \ |
| 7629 | -S "SSL - Verification of the message MAC failed" |
| 7630 | |
| 7631 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7632 | run_test "PSK callback: raw dhe-psk on client, static opaque on server, no callback, EMS" \ |
| 7633 | "$P_SRV debug_level=3 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 \ |
| 7634 | force_ciphersuite=TLS-DHE-PSK-WITH-AES-128-CBC-SHA extended_ms=1" \ |
| 7635 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-128-CBC-SHA \ |
| 7636 | psk_identity=foo psk=abc123 extended_ms=1" \ |
| 7637 | 0 \ |
| 7638 | -c "session hash for extended master secret"\ |
| 7639 | -s "session hash for extended master secret"\ |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7640 | -S "SSL - The handshake negotiation failed" \ |
| 7641 | -S "SSL - Unknown identity received" \ |
| 7642 | -S "SSL - Verification of the message MAC failed" |
| 7643 | |
| 7644 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7645 | run_test "PSK callback: raw dhe-psk on client, static opaque on server, no callback, EMS, SHA384" \ |
| 7646 | "$P_SRV debug_level=3 psk=abc123 psk_identity=foo psk_opaque=1 min_version=tls12 \ |
| 7647 | force_ciphersuite=TLS-DHE-PSK-WITH-AES-256-CBC-SHA384 extended_ms=1" \ |
| 7648 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7649 | psk_identity=foo psk=abc123 extended_ms=1" \ |
| 7650 | 0 \ |
| 7651 | -c "session hash for extended master secret"\ |
| 7652 | -s "session hash for extended master secret"\ |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7653 | -S "SSL - The handshake negotiation failed" \ |
| 7654 | -S "SSL - Unknown identity received" \ |
| 7655 | -S "SSL - Verification of the message MAC failed" |
| 7656 | |
| 7657 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7658 | run_test "PSK callback: raw psk on client, no static PSK on server, opaque PSK from callback" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7659 | "$P_SRV extended_ms=0 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
| 7660 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7661 | psk_identity=def psk=beef" \ |
| 7662 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7663 | -C "session hash for extended master secret"\ |
| 7664 | -S "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7665 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7666 | -S "SSL - Unknown identity received" \ |
| 7667 | -S "SSL - Verification of the message MAC failed" |
| 7668 | |
| 7669 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7670 | run_test "PSK callback: raw psk on client, no static PSK on server, opaque PSK from callback, SHA-384" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7671 | "$P_SRV extended_ms=0 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384" \ |
| 7672 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7673 | psk_identity=def psk=beef" \ |
| 7674 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7675 | -C "session hash for extended master secret"\ |
| 7676 | -S "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7677 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7678 | -S "SSL - Unknown identity received" \ |
| 7679 | -S "SSL - Verification of the message MAC failed" |
| 7680 | |
| 7681 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7682 | run_test "PSK callback: raw psk on client, no static PSK on server, opaque PSK from callback, EMS" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7683 | "$P_SRV debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7684 | force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA extended_ms=1" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7685 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7686 | psk_identity=abc psk=dead extended_ms=1" \ |
| 7687 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7688 | -c "session hash for extended master secret"\ |
| 7689 | -s "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7690 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7691 | -S "SSL - Unknown identity received" \ |
| 7692 | -S "SSL - Verification of the message MAC failed" |
| 7693 | |
| 7694 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7695 | run_test "PSK callback: raw psk on client, no static PSK on server, opaque PSK from callback, EMS, SHA384" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7696 | "$P_SRV debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7697 | force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 extended_ms=1" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7698 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-256-CBC-SHA384 \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7699 | psk_identity=abc psk=dead extended_ms=1" \ |
| 7700 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7701 | -c "session hash for extended master secret"\ |
| 7702 | -s "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7703 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7704 | -S "SSL - Unknown identity received" \ |
| 7705 | -S "SSL - Verification of the message MAC failed" |
| 7706 | |
| 7707 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7708 | run_test "PSK callback: raw rsa-psk on client, no static RSA-PSK on server, opaque RSA-PSK from callback" \ |
| 7709 | "$P_SRV extended_ms=0 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA" \ |
| 7710 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA \ |
| 7711 | psk_identity=def psk=beef" \ |
| 7712 | 0 \ |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7713 | -C "session hash for extended master secret"\ |
| 7714 | -S "session hash for extended master secret"\ |
| 7715 | -S "SSL - The handshake negotiation failed" \ |
| 7716 | -S "SSL - Unknown identity received" \ |
| 7717 | -S "SSL - Verification of the message MAC failed" |
| 7718 | |
| 7719 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7720 | run_test "PSK callback: raw rsa-psk on client, no static RSA-PSK on server, opaque RSA-PSK from callback, SHA-384" \ |
| 7721 | "$P_SRV extended_ms=0 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-256-CBC-SHA384" \ |
| 7722 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7723 | psk_identity=def psk=beef" \ |
| 7724 | 0 \ |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7725 | -C "session hash for extended master secret"\ |
| 7726 | -S "session hash for extended master secret"\ |
| 7727 | -S "SSL - The handshake negotiation failed" \ |
| 7728 | -S "SSL - Unknown identity received" \ |
| 7729 | -S "SSL - Verification of the message MAC failed" |
| 7730 | |
| 7731 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7732 | run_test "PSK callback: raw rsa-psk on client, no static RSA-PSK on server, opaque RSA-PSK from callback, EMS" \ |
| 7733 | "$P_SRV debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 \ |
| 7734 | force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA extended_ms=1" \ |
| 7735 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA \ |
| 7736 | psk_identity=abc psk=dead extended_ms=1" \ |
| 7737 | 0 \ |
| 7738 | -c "session hash for extended master secret"\ |
| 7739 | -s "session hash for extended master secret"\ |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7740 | -S "SSL - The handshake negotiation failed" \ |
| 7741 | -S "SSL - Unknown identity received" \ |
| 7742 | -S "SSL - Verification of the message MAC failed" |
| 7743 | |
| 7744 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7745 | run_test "PSK callback: raw rsa-psk on client, no static RSA-PSK on server, opaque RSA-PSK from callback, EMS, SHA384" \ |
| 7746 | "$P_SRV debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 \ |
| 7747 | force_ciphersuite=TLS-RSA-PSK-WITH-AES-256-CBC-SHA384 extended_ms=1" \ |
| 7748 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-RSA-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7749 | psk_identity=abc psk=dead extended_ms=1" \ |
| 7750 | 0 \ |
| 7751 | -c "session hash for extended master secret"\ |
| 7752 | -s "session hash for extended master secret"\ |
Przemek Stekiel | b270b56 | 2022-04-06 13:12:48 +0200 | [diff] [blame] | 7753 | -S "SSL - The handshake negotiation failed" \ |
| 7754 | -S "SSL - Unknown identity received" \ |
| 7755 | -S "SSL - Verification of the message MAC failed" |
| 7756 | |
| 7757 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7758 | run_test "PSK callback: raw ecdhe-psk on client, no static ECDHE-PSK on server, opaque ECDHE-PSK from callback" \ |
| 7759 | "$P_SRV extended_ms=0 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA" \ |
| 7760 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA \ |
| 7761 | psk_identity=def psk=beef" \ |
| 7762 | 0 \ |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7763 | -C "session hash for extended master secret"\ |
| 7764 | -S "session hash for extended master secret"\ |
| 7765 | -S "SSL - The handshake negotiation failed" \ |
| 7766 | -S "SSL - Unknown identity received" \ |
| 7767 | -S "SSL - Verification of the message MAC failed" |
| 7768 | |
| 7769 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7770 | run_test "PSK callback: raw ecdhe-psk on client, no static ECDHE-PSK on server, opaque ECDHE-PSK from callback, SHA-384" \ |
| 7771 | "$P_SRV extended_ms=0 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384" \ |
| 7772 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7773 | psk_identity=def psk=beef" \ |
| 7774 | 0 \ |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7775 | -C "session hash for extended master secret"\ |
| 7776 | -S "session hash for extended master secret"\ |
| 7777 | -S "SSL - The handshake negotiation failed" \ |
| 7778 | -S "SSL - Unknown identity received" \ |
| 7779 | -S "SSL - Verification of the message MAC failed" |
| 7780 | |
| 7781 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7782 | run_test "PSK callback: raw ecdhe-psk on client, no static ECDHE-PSK on server, opaque ECDHE-PSK from callback, EMS" \ |
| 7783 | "$P_SRV debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 \ |
| 7784 | force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA extended_ms=1" \ |
| 7785 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA \ |
| 7786 | psk_identity=abc psk=dead extended_ms=1" \ |
| 7787 | 0 \ |
| 7788 | -c "session hash for extended master secret"\ |
| 7789 | -s "session hash for extended master secret"\ |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7790 | -S "SSL - The handshake negotiation failed" \ |
| 7791 | -S "SSL - Unknown identity received" \ |
| 7792 | -S "SSL - Verification of the message MAC failed" |
| 7793 | |
| 7794 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7795 | run_test "PSK callback: raw ecdhe-psk on client, no static ECDHE-PSK on server, opaque ECDHE-PSK from callback, EMS, SHA384" \ |
| 7796 | "$P_SRV debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 \ |
| 7797 | force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384 extended_ms=1" \ |
| 7798 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7799 | psk_identity=abc psk=dead extended_ms=1" \ |
| 7800 | 0 \ |
| 7801 | -c "session hash for extended master secret"\ |
| 7802 | -s "session hash for extended master secret"\ |
Przemek Stekiel | b6a0503 | 2022-04-14 10:22:18 +0200 | [diff] [blame] | 7803 | -S "SSL - The handshake negotiation failed" \ |
| 7804 | -S "SSL - Unknown identity received" \ |
| 7805 | -S "SSL - Verification of the message MAC failed" |
| 7806 | |
| 7807 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7808 | run_test "PSK callback: raw dhe-psk on client, no static DHE-PSK on server, opaque DHE-PSK from callback" \ |
| 7809 | "$P_SRV extended_ms=0 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-128-CBC-SHA" \ |
| 7810 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-128-CBC-SHA \ |
| 7811 | psk_identity=def psk=beef" \ |
| 7812 | 0 \ |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7813 | -C "session hash for extended master secret"\ |
| 7814 | -S "session hash for extended master secret"\ |
| 7815 | -S "SSL - The handshake negotiation failed" \ |
| 7816 | -S "SSL - Unknown identity received" \ |
| 7817 | -S "SSL - Verification of the message MAC failed" |
| 7818 | |
| 7819 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7820 | run_test "PSK callback: raw dhe-psk on client, no static DHE-PSK on server, opaque DHE-PSK from callback, SHA-384" \ |
| 7821 | "$P_SRV extended_ms=0 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-256-CBC-SHA384" \ |
| 7822 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7823 | psk_identity=def psk=beef" \ |
| 7824 | 0 \ |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7825 | -C "session hash for extended master secret"\ |
| 7826 | -S "session hash for extended master secret"\ |
| 7827 | -S "SSL - The handshake negotiation failed" \ |
| 7828 | -S "SSL - Unknown identity received" \ |
| 7829 | -S "SSL - Verification of the message MAC failed" |
| 7830 | |
| 7831 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7832 | run_test "PSK callback: raw dhe-psk on client, no static DHE-PSK on server, opaque DHE-PSK from callback, EMS" \ |
| 7833 | "$P_SRV debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 \ |
| 7834 | force_ciphersuite=TLS-DHE-PSK-WITH-AES-128-CBC-SHA extended_ms=1" \ |
| 7835 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-128-CBC-SHA \ |
| 7836 | psk_identity=abc psk=dead extended_ms=1" \ |
| 7837 | 0 \ |
| 7838 | -c "session hash for extended master secret"\ |
| 7839 | -s "session hash for extended master secret"\ |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7840 | -S "SSL - The handshake negotiation failed" \ |
| 7841 | -S "SSL - Unknown identity received" \ |
| 7842 | -S "SSL - Verification of the message MAC failed" |
| 7843 | |
| 7844 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7845 | run_test "PSK callback: raw dhe-psk on client, no static DHE-PSK on server, opaque DHE-PSK from callback, EMS, SHA384" \ |
| 7846 | "$P_SRV debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 \ |
| 7847 | force_ciphersuite=TLS-DHE-PSK-WITH-AES-256-CBC-SHA384 extended_ms=1" \ |
| 7848 | "$P_CLI debug_level=3 min_version=tls12 force_ciphersuite=TLS-DHE-PSK-WITH-AES-256-CBC-SHA384 \ |
| 7849 | psk_identity=abc psk=dead extended_ms=1" \ |
| 7850 | 0 \ |
| 7851 | -c "session hash for extended master secret"\ |
| 7852 | -s "session hash for extended master secret"\ |
Przemek Stekiel | 85d46fe | 2022-04-19 12:47:48 +0200 | [diff] [blame] | 7853 | -S "SSL - The handshake negotiation failed" \ |
| 7854 | -S "SSL - Unknown identity received" \ |
| 7855 | -S "SSL - Verification of the message MAC failed" |
| 7856 | |
| 7857 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7858 | run_test "PSK callback: raw psk on client, mismatching static raw PSK on server, opaque PSK from callback" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7859 | "$P_SRV extended_ms=0 psk_identity=foo psk=abc123 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
| 7860 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7861 | psk_identity=def psk=beef" \ |
| 7862 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7863 | -C "session hash for extended master secret"\ |
| 7864 | -S "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7865 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7866 | -S "SSL - Unknown identity received" \ |
| 7867 | -S "SSL - Verification of the message MAC failed" |
| 7868 | |
| 7869 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7870 | run_test "PSK callback: raw psk on client, mismatching static opaque PSK on server, opaque PSK from callback" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7871 | "$P_SRV extended_ms=0 psk_opaque=1 psk_identity=foo psk=abc123 debug_level=3 psk_list=abc,dead,def,beef psk_list_opaque=1 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
| 7872 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7873 | psk_identity=def psk=beef" \ |
| 7874 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7875 | -C "session hash for extended master secret"\ |
| 7876 | -S "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7877 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7878 | -S "SSL - Unknown identity received" \ |
| 7879 | -S "SSL - Verification of the message MAC failed" |
| 7880 | |
| 7881 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7882 | run_test "PSK callback: raw psk on client, mismatching static opaque PSK on server, raw PSK from callback" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7883 | "$P_SRV extended_ms=0 psk_opaque=1 psk_identity=foo psk=abc123 debug_level=3 psk_list=abc,dead,def,beef min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
| 7884 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7885 | psk_identity=def psk=beef" \ |
| 7886 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7887 | -C "session hash for extended master secret"\ |
| 7888 | -S "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7889 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7890 | -S "SSL - Unknown identity received" \ |
| 7891 | -S "SSL - Verification of the message MAC failed" |
| 7892 | |
| 7893 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7894 | run_test "PSK callback: raw psk on client, id-matching but wrong raw PSK on server, opaque PSK from callback" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7895 | "$P_SRV extended_ms=0 psk_opaque=1 psk_identity=def psk=abc123 debug_level=3 psk_list=abc,dead,def,beef min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
| 7896 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7897 | psk_identity=def psk=beef" \ |
| 7898 | 0 \ |
Manuel Pégourié-Gonnard | 8faa70e | 2019-05-20 12:09:50 +0200 | [diff] [blame] | 7899 | -C "session hash for extended master secret"\ |
| 7900 | -S "session hash for extended master secret"\ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7901 | -S "SSL - The handshake negotiation failed" \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7902 | -S "SSL - Unknown identity received" \ |
| 7903 | -S "SSL - Verification of the message MAC failed" |
| 7904 | |
| 7905 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 7906 | run_test "PSK callback: raw psk on client, matching opaque PSK on server, wrong opaque PSK from callback" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 7907 | "$P_SRV extended_ms=0 psk_opaque=1 psk_identity=def psk=beef debug_level=3 psk_list=abc,dead,def,abc123 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA" \ |
| 7908 | "$P_CLI extended_ms=0 debug_level=3 min_version=tls12 force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
Hanno Becker | 28c79dc | 2018-10-26 13:15:08 +0100 | [diff] [blame] | 7909 | psk_identity=def psk=beef" \ |
| 7910 | 1 \ |
| 7911 | -s "SSL - Verification of the message MAC failed" |
| 7912 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7913 | run_test "PSK callback: no psk, no callback" \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 7914 | "$P_SRV" \ |
| 7915 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 7916 | psk_identity=foo psk=abc123" \ |
| 7917 | 1 \ |
Dave Rodgman | 6ce10be | 2021-06-29 14:20:31 +0100 | [diff] [blame] | 7918 | -s "SSL - The handshake negotiation failed" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 7919 | -S "SSL - Unknown identity received" \ |
| 7920 | -S "SSL - Verification of the message MAC failed" |
| 7921 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7922 | run_test "PSK callback: callback overrides other settings" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 7923 | "$P_SRV psk=abc123 psk_identity=foo psk_list=abc,dead,def,beef" \ |
| 7924 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 7925 | psk_identity=foo psk=abc123" \ |
| 7926 | 1 \ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7927 | -S "SSL - The handshake negotiation failed" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 7928 | -s "SSL - Unknown identity received" \ |
| 7929 | -S "SSL - Verification of the message MAC failed" |
| 7930 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7931 | run_test "PSK callback: first id matches" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 7932 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 7933 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 7934 | psk_identity=abc psk=dead" \ |
| 7935 | 0 \ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7936 | -S "SSL - The handshake negotiation failed" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 7937 | -S "SSL - Unknown identity received" \ |
| 7938 | -S "SSL - Verification of the message MAC failed" |
| 7939 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7940 | run_test "PSK callback: second id matches" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 7941 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 7942 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 7943 | psk_identity=def psk=beef" \ |
| 7944 | 0 \ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7945 | -S "SSL - The handshake negotiation failed" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 7946 | -S "SSL - Unknown identity received" \ |
| 7947 | -S "SSL - Verification of the message MAC failed" |
| 7948 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7949 | run_test "PSK callback: no match" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 7950 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 7951 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 7952 | psk_identity=ghi psk=beef" \ |
| 7953 | 1 \ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7954 | -S "SSL - The handshake negotiation failed" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 7955 | -s "SSL - Unknown identity received" \ |
| 7956 | -S "SSL - Verification of the message MAC failed" |
| 7957 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 7958 | run_test "PSK callback: wrong key" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 7959 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 7960 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 7961 | psk_identity=abc psk=beef" \ |
| 7962 | 1 \ |
Dave Rodgman | e5b828c | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 7963 | -S "SSL - The handshake negotiation failed" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 7964 | -S "SSL - Unknown identity received" \ |
| 7965 | -s "SSL - Verification of the message MAC failed" |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 7966 | |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 7967 | # Tests for EC J-PAKE |
| 7968 | |
Hanno Becker | fa452c4 | 2020-08-14 15:42:49 +0100 | [diff] [blame] | 7969 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 7970 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 7971 | run_test "ECJPAKE: client not configured" \ |
| 7972 | "$P_SRV debug_level=3" \ |
| 7973 | "$P_CLI debug_level=3" \ |
| 7974 | 0 \ |
Hanno Becker | ee63af6 | 2020-08-14 15:41:23 +0100 | [diff] [blame] | 7975 | -C "add ciphersuite: 0xc0ff" \ |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 7976 | -C "adding ecjpake_kkpp extension" \ |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 7977 | -S "found ecjpake kkpp extension" \ |
| 7978 | -S "skip ecjpake kkpp extension" \ |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 7979 | -S "ciphersuite mismatch: ecjpake not configured" \ |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 7980 | -S "server hello, ecjpake kkpp extension" \ |
Manuel Pégourié-Gonnard | 0a1324a | 2015-09-16 16:01:00 +0200 | [diff] [blame] | 7981 | -C "found ecjpake_kkpp extension" \ |
Dave Rodgman | 737237f | 2021-06-29 19:07:57 +0100 | [diff] [blame] | 7982 | -S "SSL - The handshake negotiation failed" |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 7983 | |
Hanno Becker | fa452c4 | 2020-08-14 15:42:49 +0100 | [diff] [blame] | 7984 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 7985 | run_test "ECJPAKE: server not configured" \ |
| 7986 | "$P_SRV debug_level=3" \ |
| 7987 | "$P_CLI debug_level=3 ecjpake_pw=bla \ |
| 7988 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 7989 | 1 \ |
Ronald Cron | 7320e64 | 2022-03-08 13:34:49 +0100 | [diff] [blame] | 7990 | -c "add ciphersuite: c0ff" \ |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 7991 | -c "adding ecjpake_kkpp extension" \ |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 7992 | -s "found ecjpake kkpp extension" \ |
| 7993 | -s "skip ecjpake kkpp extension" \ |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 7994 | -s "ciphersuite mismatch: ecjpake not configured" \ |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 7995 | -S "server hello, ecjpake kkpp extension" \ |
Manuel Pégourié-Gonnard | 0a1324a | 2015-09-16 16:01:00 +0200 | [diff] [blame] | 7996 | -C "found ecjpake_kkpp extension" \ |
Dave Rodgman | 737237f | 2021-06-29 19:07:57 +0100 | [diff] [blame] | 7997 | -s "SSL - The handshake negotiation failed" |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 7998 | |
Valerio Setti | f11e05a | 2022-12-07 15:41:05 +0100 | [diff] [blame] | 7999 | # Note: if the name of this test is changed, then please adjust the corresponding |
| 8000 | # filtering label in "test_tls1_2_ecjpake_compatibility" (in "all.sh") |
Hanno Becker | fa452c4 | 2020-08-14 15:42:49 +0100 | [diff] [blame] | 8001 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 8002 | run_test "ECJPAKE: working, TLS" \ |
| 8003 | "$P_SRV debug_level=3 ecjpake_pw=bla" \ |
| 8004 | "$P_CLI debug_level=3 ecjpake_pw=bla \ |
| 8005 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
Manuel Pégourié-Gonnard | 0f1660a | 2015-09-16 22:41:06 +0200 | [diff] [blame] | 8006 | 0 \ |
Ronald Cron | 7320e64 | 2022-03-08 13:34:49 +0100 | [diff] [blame] | 8007 | -c "add ciphersuite: c0ff" \ |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 8008 | -c "adding ecjpake_kkpp extension" \ |
Manuel Pégourié-Gonnard | d0d8cb3 | 2015-09-17 14:16:30 +0200 | [diff] [blame] | 8009 | -C "re-using cached ecjpake parameters" \ |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 8010 | -s "found ecjpake kkpp extension" \ |
| 8011 | -S "skip ecjpake kkpp extension" \ |
| 8012 | -S "ciphersuite mismatch: ecjpake not configured" \ |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 8013 | -s "server hello, ecjpake kkpp extension" \ |
Manuel Pégourié-Gonnard | 0a1324a | 2015-09-16 16:01:00 +0200 | [diff] [blame] | 8014 | -c "found ecjpake_kkpp extension" \ |
Dave Rodgman | 737237f | 2021-06-29 19:07:57 +0100 | [diff] [blame] | 8015 | -S "SSL - The handshake negotiation failed" \ |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 8016 | -S "SSL - Verification of the message MAC failed" |
| 8017 | |
Valerio Setti | d572a82 | 2022-11-28 18:27:51 +0100 | [diff] [blame] | 8018 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Valerio Setti | a6b69da | 2022-11-30 16:44:49 +0100 | [diff] [blame] | 8019 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Valerio Setti | 70e0290 | 2022-12-02 16:21:56 +0100 | [diff] [blame] | 8020 | run_test "ECJPAKE: opaque password client+server, working, TLS" \ |
Valerio Setti | d572a82 | 2022-11-28 18:27:51 +0100 | [diff] [blame] | 8021 | "$P_SRV debug_level=3 ecjpake_pw=bla ecjpake_pw_opaque=1" \ |
| 8022 | "$P_CLI debug_level=3 ecjpake_pw=bla ecjpake_pw_opaque=1\ |
| 8023 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 8024 | 0 \ |
| 8025 | -c "add ciphersuite: c0ff" \ |
| 8026 | -c "adding ecjpake_kkpp extension" \ |
Valerio Setti | 661b9bc | 2022-11-29 17:19:25 +0100 | [diff] [blame] | 8027 | -c "using opaque password" \ |
| 8028 | -s "using opaque password" \ |
Valerio Setti | d572a82 | 2022-11-28 18:27:51 +0100 | [diff] [blame] | 8029 | -C "re-using cached ecjpake parameters" \ |
| 8030 | -s "found ecjpake kkpp extension" \ |
| 8031 | -S "skip ecjpake kkpp extension" \ |
| 8032 | -S "ciphersuite mismatch: ecjpake not configured" \ |
| 8033 | -s "server hello, ecjpake kkpp extension" \ |
| 8034 | -c "found ecjpake_kkpp extension" \ |
| 8035 | -S "SSL - The handshake negotiation failed" \ |
| 8036 | -S "SSL - Verification of the message MAC failed" |
| 8037 | |
Valerio Setti | f11e05a | 2022-12-07 15:41:05 +0100 | [diff] [blame] | 8038 | # Note: if the name of this test is changed, then please adjust the corresponding |
| 8039 | # filtering label in "test_tls1_2_ecjpake_compatibility" (in "all.sh") |
Valerio Setti | b287ddf | 2022-12-01 16:18:12 +0100 | [diff] [blame] | 8040 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
| 8041 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Valerio Setti | 70e0290 | 2022-12-02 16:21:56 +0100 | [diff] [blame] | 8042 | run_test "ECJPAKE: opaque password client only, working, TLS" \ |
Valerio Setti | b287ddf | 2022-12-01 16:18:12 +0100 | [diff] [blame] | 8043 | "$P_SRV debug_level=3 ecjpake_pw=bla" \ |
| 8044 | "$P_CLI debug_level=3 ecjpake_pw=bla ecjpake_pw_opaque=1\ |
| 8045 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 8046 | 0 \ |
| 8047 | -c "add ciphersuite: c0ff" \ |
| 8048 | -c "adding ecjpake_kkpp extension" \ |
| 8049 | -c "using opaque password" \ |
| 8050 | -S "using opaque password" \ |
| 8051 | -C "re-using cached ecjpake parameters" \ |
| 8052 | -s "found ecjpake kkpp extension" \ |
| 8053 | -S "skip ecjpake kkpp extension" \ |
| 8054 | -S "ciphersuite mismatch: ecjpake not configured" \ |
| 8055 | -s "server hello, ecjpake kkpp extension" \ |
| 8056 | -c "found ecjpake_kkpp extension" \ |
| 8057 | -S "SSL - The handshake negotiation failed" \ |
| 8058 | -S "SSL - Verification of the message MAC failed" |
| 8059 | |
Valerio Setti | f11e05a | 2022-12-07 15:41:05 +0100 | [diff] [blame] | 8060 | # Note: if the name of this test is changed, then please adjust the corresponding |
| 8061 | # filtering label in "test_tls1_2_ecjpake_compatibility" (in "all.sh") |
Valerio Setti | b287ddf | 2022-12-01 16:18:12 +0100 | [diff] [blame] | 8062 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
| 8063 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Valerio Setti | 70e0290 | 2022-12-02 16:21:56 +0100 | [diff] [blame] | 8064 | run_test "ECJPAKE: opaque password server only, working, TLS" \ |
Valerio Setti | b287ddf | 2022-12-01 16:18:12 +0100 | [diff] [blame] | 8065 | "$P_SRV debug_level=3 ecjpake_pw=bla ecjpake_pw_opaque=1" \ |
| 8066 | "$P_CLI debug_level=3 ecjpake_pw=bla\ |
| 8067 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 8068 | 0 \ |
| 8069 | -c "add ciphersuite: c0ff" \ |
| 8070 | -c "adding ecjpake_kkpp extension" \ |
| 8071 | -C "using opaque password" \ |
| 8072 | -s "using opaque password" \ |
| 8073 | -C "re-using cached ecjpake parameters" \ |
| 8074 | -s "found ecjpake kkpp extension" \ |
| 8075 | -S "skip ecjpake kkpp extension" \ |
| 8076 | -S "ciphersuite mismatch: ecjpake not configured" \ |
| 8077 | -s "server hello, ecjpake kkpp extension" \ |
| 8078 | -c "found ecjpake_kkpp extension" \ |
| 8079 | -S "SSL - The handshake negotiation failed" \ |
| 8080 | -S "SSL - Verification of the message MAC failed" |
| 8081 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 8082 | server_needs_more_time 1 |
Dave Rodgman | bec7caf | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 8083 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 8084 | run_test "ECJPAKE: password mismatch, TLS" \ |
| 8085 | "$P_SRV debug_level=3 ecjpake_pw=bla" \ |
| 8086 | "$P_CLI debug_level=3 ecjpake_pw=bad \ |
| 8087 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 8088 | 1 \ |
Manuel Pégourié-Gonnard | d0d8cb3 | 2015-09-17 14:16:30 +0200 | [diff] [blame] | 8089 | -C "re-using cached ecjpake parameters" \ |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 8090 | -s "SSL - Verification of the message MAC failed" |
| 8091 | |
Valerio Setti | b287ddf | 2022-12-01 16:18:12 +0100 | [diff] [blame] | 8092 | server_needs_more_time 1 |
| 8093 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
| 8094 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Valerio Setti | b287ddf | 2022-12-01 16:18:12 +0100 | [diff] [blame] | 8095 | run_test "ECJPAKE_OPAQUE_PW: opaque password mismatch, TLS" \ |
| 8096 | "$P_SRV debug_level=3 ecjpake_pw=bla ecjpake_pw_opaque=1" \ |
| 8097 | "$P_CLI debug_level=3 ecjpake_pw=bad ecjpake_pw_opaque=1 \ |
| 8098 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 8099 | 1 \ |
| 8100 | -c "using opaque password" \ |
| 8101 | -s "using opaque password" \ |
| 8102 | -C "re-using cached ecjpake parameters" \ |
| 8103 | -s "SSL - Verification of the message MAC failed" |
| 8104 | |
Dave Rodgman | bec7caf | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 8105 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 8106 | run_test "ECJPAKE: working, DTLS" \ |
| 8107 | "$P_SRV debug_level=3 dtls=1 ecjpake_pw=bla" \ |
| 8108 | "$P_CLI debug_level=3 dtls=1 ecjpake_pw=bla \ |
| 8109 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 8110 | 0 \ |
Manuel Pégourié-Gonnard | d0d8cb3 | 2015-09-17 14:16:30 +0200 | [diff] [blame] | 8111 | -c "re-using cached ecjpake parameters" \ |
| 8112 | -S "SSL - Verification of the message MAC failed" |
| 8113 | |
Dave Rodgman | bec7caf | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 8114 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | d0d8cb3 | 2015-09-17 14:16:30 +0200 | [diff] [blame] | 8115 | run_test "ECJPAKE: working, DTLS, no cookie" \ |
| 8116 | "$P_SRV debug_level=3 dtls=1 ecjpake_pw=bla cookies=0" \ |
| 8117 | "$P_CLI debug_level=3 dtls=1 ecjpake_pw=bla \ |
| 8118 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 8119 | 0 \ |
| 8120 | -C "re-using cached ecjpake parameters" \ |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 8121 | -S "SSL - Verification of the message MAC failed" |
| 8122 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 8123 | server_needs_more_time 1 |
Dave Rodgman | bec7caf | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 8124 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 8125 | run_test "ECJPAKE: password mismatch, DTLS" \ |
| 8126 | "$P_SRV debug_level=3 dtls=1 ecjpake_pw=bla" \ |
| 8127 | "$P_CLI debug_level=3 dtls=1 ecjpake_pw=bad \ |
| 8128 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 8129 | 1 \ |
Manuel Pégourié-Gonnard | d0d8cb3 | 2015-09-17 14:16:30 +0200 | [diff] [blame] | 8130 | -c "re-using cached ecjpake parameters" \ |
Manuel Pégourié-Gonnard | 921f2d0 | 2015-09-16 22:52:18 +0200 | [diff] [blame] | 8131 | -s "SSL - Verification of the message MAC failed" |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 8132 | |
Manuel Pégourié-Gonnard | ca700b2 | 2015-10-20 14:47:00 +0200 | [diff] [blame] | 8133 | # for tests with configs/config-thread.h |
Dave Rodgman | bec7caf | 2021-06-29 19:05:34 +0100 | [diff] [blame] | 8134 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
Manuel Pégourié-Gonnard | ca700b2 | 2015-10-20 14:47:00 +0200 | [diff] [blame] | 8135 | run_test "ECJPAKE: working, DTLS, nolog" \ |
| 8136 | "$P_SRV dtls=1 ecjpake_pw=bla" \ |
| 8137 | "$P_CLI dtls=1 ecjpake_pw=bla \ |
| 8138 | force_ciphersuite=TLS-ECJPAKE-WITH-AES-128-CCM-8" \ |
| 8139 | 0 |
| 8140 | |
Manuel Pégourié-Gonnard | 4cc8c63 | 2015-07-23 12:24:03 +0200 | [diff] [blame] | 8141 | # Test for ClientHello without extensions |
| 8142 | |
Manuel Pégourié-Gonnard | d55bc20 | 2015-08-04 16:22:30 +0200 | [diff] [blame] | 8143 | requires_gnutls |
Manuel Pégourié-Gonnard | bc4da29 | 2020-01-30 12:45:14 +0100 | [diff] [blame] | 8144 | run_test "ClientHello without extensions" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 8145 | "$P_SRV force_version=tls12 debug_level=3" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 8146 | "$G_CLI --priority=NORMAL:%NO_EXTENSIONS:%DISABLE_SAFE_RENEGOTIATION localhost" \ |
Gilles Peskine | 5d2511c | 2017-05-12 13:16:40 +0200 | [diff] [blame] | 8147 | 0 \ |
| 8148 | -s "dumping 'client hello extensions' (0 bytes)" |
| 8149 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 8150 | # Tests for mbedtls_ssl_get_bytes_avail() |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 8151 | |
Gilles Peskine | d2d90af | 2022-04-06 23:35:56 +0200 | [diff] [blame] | 8152 | # The server first reads buffer_size-1 bytes, then reads the remainder. |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 8153 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 8154 | run_test "mbedtls_ssl_get_bytes_avail: no extra data" \ |
Gilles Peskine | d2d90af | 2022-04-06 23:35:56 +0200 | [diff] [blame] | 8155 | "$P_SRV buffer_size=100" \ |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 8156 | "$P_CLI request_size=100" \ |
| 8157 | 0 \ |
| 8158 | -s "Read from client: 100 bytes read$" |
| 8159 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 8160 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Gilles Peskine | d2d90af | 2022-04-06 23:35:56 +0200 | [diff] [blame] | 8161 | run_test "mbedtls_ssl_get_bytes_avail: extra data (+1)" \ |
| 8162 | "$P_SRV buffer_size=100" \ |
| 8163 | "$P_CLI request_size=101" \ |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 8164 | 0 \ |
Gilles Peskine | d2d90af | 2022-04-06 23:35:56 +0200 | [diff] [blame] | 8165 | -s "Read from client: 101 bytes read (100 + 1)" |
| 8166 | |
| 8167 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
| 8168 | requires_max_content_len 200 |
| 8169 | run_test "mbedtls_ssl_get_bytes_avail: extra data (*2)" \ |
| 8170 | "$P_SRV buffer_size=100" \ |
| 8171 | "$P_CLI request_size=200" \ |
| 8172 | 0 \ |
| 8173 | -s "Read from client: 200 bytes read (100 + 100)" |
| 8174 | |
| 8175 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
| 8176 | run_test "mbedtls_ssl_get_bytes_avail: extra data (max)" \ |
| 8177 | "$P_SRV buffer_size=100" \ |
| 8178 | "$P_CLI request_size=$MAX_CONTENT_LEN" \ |
| 8179 | 0 \ |
| 8180 | -s "Read from client: $MAX_CONTENT_LEN bytes read (100 + $((MAX_CONTENT_LEN - 100)))" |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 8181 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8182 | # Tests for small client packets |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 8183 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8184 | run_test "Small client packet TLS 1.2 BlockCipher" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8185 | "$P_SRV force_version=tls12" \ |
| 8186 | "$P_CLI request_size=1 \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 8187 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 8188 | 0 \ |
| 8189 | -s "Read from client: 1 bytes read" |
| 8190 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8191 | run_test "Small client packet TLS 1.2 BlockCipher, without EtM" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8192 | "$P_SRV force_version=tls12" \ |
| 8193 | "$P_CLI request_size=1 \ |
Hanno Becker | 909f9a3 | 2017-11-21 17:10:12 +0000 | [diff] [blame] | 8194 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA etm=0" \ |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 8195 | 0 \ |
| 8196 | -s "Read from client: 1 bytes read" |
| 8197 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8198 | run_test "Small client packet TLS 1.2 BlockCipher larger MAC" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8199 | "$P_SRV force_version=tls12" \ |
| 8200 | "$P_CLI request_size=1 \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 8201 | force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 8202 | 0 \ |
| 8203 | -s "Read from client: 1 bytes read" |
| 8204 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8205 | run_test "Small client packet TLS 1.2 AEAD" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8206 | "$P_SRV force_version=tls12" \ |
| 8207 | "$P_CLI request_size=1 \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 8208 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 8209 | 0 \ |
| 8210 | -s "Read from client: 1 bytes read" |
| 8211 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8212 | run_test "Small client packet TLS 1.2 AEAD shorter tag" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8213 | "$P_SRV force_version=tls12" \ |
| 8214 | "$P_CLI request_size=1 \ |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 8215 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 8216 | 0 \ |
| 8217 | -s "Read from client: 1 bytes read" |
| 8218 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 8219 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8220 | run_test "Small client packet TLS 1.3 AEAD" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 8221 | "$P_SRV" \ |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8222 | "$P_CLI request_size=1 \ |
| 8223 | force_ciphersuite=TLS1-3-AES-128-CCM-SHA256" \ |
| 8224 | 0 \ |
| 8225 | -s "Read from client: 1 bytes read" |
| 8226 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 8227 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8228 | run_test "Small client packet TLS 1.3 AEAD shorter tag" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 8229 | "$P_SRV" \ |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8230 | "$P_CLI request_size=1 \ |
| 8231 | force_ciphersuite=TLS1-3-AES-128-CCM-8-SHA256" \ |
| 8232 | 0 \ |
| 8233 | -s "Read from client: 1 bytes read" |
| 8234 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8235 | # Tests for small client packets in DTLS |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 8236 | |
| 8237 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8238 | run_test "Small client packet DTLS 1.2" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 8239 | "$P_SRV dtls=1 force_version=dtls12" \ |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 8240 | "$P_CLI dtls=1 request_size=1 \ |
| 8241 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 8242 | 0 \ |
| 8243 | -s "Read from client: 1 bytes read" |
| 8244 | |
| 8245 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8246 | run_test "Small client packet DTLS 1.2, without EtM" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 8247 | "$P_SRV dtls=1 force_version=dtls12 etm=0" \ |
Hanno Becker | e214804 | 2017-11-10 08:59:18 +0000 | [diff] [blame] | 8248 | "$P_CLI dtls=1 request_size=1 \ |
| 8249 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 8250 | 0 \ |
| 8251 | -s "Read from client: 1 bytes read" |
| 8252 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8253 | # Tests for small server packets |
| 8254 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8255 | run_test "Small server packet TLS 1.2 BlockCipher" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8256 | "$P_SRV response_size=1 force_version=tls12" \ |
| 8257 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8258 | 0 \ |
| 8259 | -c "Read from server: 1 bytes read" |
| 8260 | |
| 8261 | run_test "Small server packet TLS 1.2 BlockCipher, without EtM" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8262 | "$P_SRV response_size=1 force_version=tls12" \ |
| 8263 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA etm=0" \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8264 | 0 \ |
| 8265 | -c "Read from server: 1 bytes read" |
| 8266 | |
| 8267 | run_test "Small server packet TLS 1.2 BlockCipher larger MAC" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8268 | "$P_SRV response_size=1 force_version=tls12" \ |
| 8269 | "$P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8270 | 0 \ |
| 8271 | -c "Read from server: 1 bytes read" |
| 8272 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8273 | run_test "Small server packet TLS 1.2 AEAD" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8274 | "$P_SRV response_size=1 force_version=tls12" \ |
| 8275 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8276 | 0 \ |
| 8277 | -c "Read from server: 1 bytes read" |
| 8278 | |
| 8279 | run_test "Small server packet TLS 1.2 AEAD shorter tag" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8280 | "$P_SRV response_size=1 force_version=tls12" \ |
| 8281 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8282 | 0 \ |
| 8283 | -c "Read from server: 1 bytes read" |
| 8284 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 8285 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8286 | run_test "Small server packet TLS 1.3 AEAD" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 8287 | "$P_SRV response_size=1" \ |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8288 | "$P_CLI force_ciphersuite=TLS1-3-AES-128-CCM-SHA256" \ |
| 8289 | 0 \ |
| 8290 | -c "Read from server: 1 bytes read" |
| 8291 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 8292 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8293 | run_test "Small server packet TLS 1.3 AEAD shorter tag" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 8294 | "$P_SRV response_size=1" \ |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8295 | "$P_CLI force_ciphersuite=TLS1-3-AES-128-CCM-8-SHA256" \ |
| 8296 | 0 \ |
| 8297 | -c "Read from server: 1 bytes read" |
| 8298 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8299 | # Tests for small server packets in DTLS |
| 8300 | |
| 8301 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8302 | run_test "Small server packet DTLS 1.2" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 8303 | "$P_SRV dtls=1 response_size=1 force_version=dtls12" \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8304 | "$P_CLI dtls=1 \ |
| 8305 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 8306 | 0 \ |
| 8307 | -c "Read from server: 1 bytes read" |
| 8308 | |
| 8309 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 8310 | run_test "Small server packet DTLS 1.2, without EtM" \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 8311 | "$P_SRV dtls=1 response_size=1 force_version=dtls12 etm=0" \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8312 | "$P_CLI dtls=1 \ |
| 8313 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 8314 | 0 \ |
| 8315 | -c "Read from server: 1 bytes read" |
| 8316 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 8317 | # Test for large client packets |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 8318 | |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 8319 | # How many fragments do we expect to write $1 bytes? |
| 8320 | fragments_for_write() { |
| 8321 | echo "$(( ( $1 + $MAX_OUT_LEN - 1 ) / $MAX_OUT_LEN ))" |
| 8322 | } |
| 8323 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 8324 | run_test "Large client packet TLS 1.2 BlockCipher" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8325 | "$P_SRV force_version=tls12" \ |
| 8326 | "$P_CLI request_size=16384 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 8327 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 8328 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 8329 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 8330 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 8331 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 8332 | run_test "Large client packet TLS 1.2 BlockCipher, without EtM" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8333 | "$P_SRV force_version=tls12" \ |
| 8334 | "$P_CLI request_size=16384 etm=0 \ |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 8335 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 8336 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 8337 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Hanno Becker | 278fc7a | 2017-11-10 09:16:28 +0000 | [diff] [blame] | 8338 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 8339 | run_test "Large client packet TLS 1.2 BlockCipher larger MAC" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8340 | "$P_SRV force_version=tls12" \ |
| 8341 | "$P_CLI request_size=16384 \ |
Manuel Pégourié-Gonnard | c82ee35 | 2015-01-07 16:35:25 +0100 | [diff] [blame] | 8342 | force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 8343 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 8344 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 8345 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 8346 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 8347 | run_test "Large client packet TLS 1.2 AEAD" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8348 | "$P_SRV force_version=tls12" \ |
| 8349 | "$P_CLI request_size=16384 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 8350 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 8351 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 8352 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 8353 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 8354 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 8355 | run_test "Large client packet TLS 1.2 AEAD shorter tag" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8356 | "$P_SRV force_version=tls12" \ |
| 8357 | "$P_CLI request_size=16384 \ |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 8358 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 8359 | 0 \ |
Angus Gratton | c4dd073 | 2018-04-11 16:28:39 +1000 | [diff] [blame] | 8360 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 8361 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 8362 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 8363 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8364 | run_test "Large client packet TLS 1.3 AEAD" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 8365 | "$P_SRV" \ |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8366 | "$P_CLI request_size=16384 \ |
| 8367 | force_ciphersuite=TLS1-3-AES-128-CCM-SHA256" \ |
| 8368 | 0 \ |
| 8369 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 8370 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
| 8371 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 8372 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8373 | run_test "Large client packet TLS 1.3 AEAD shorter tag" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 8374 | "$P_SRV" \ |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8375 | "$P_CLI request_size=16384 \ |
| 8376 | force_ciphersuite=TLS1-3-AES-128-CCM-8-SHA256" \ |
| 8377 | 0 \ |
| 8378 | -c "16384 bytes written in $(fragments_for_write 16384) fragments" \ |
| 8379 | -s "Read from client: $MAX_CONTENT_LEN bytes read" |
| 8380 | |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 8381 | # The tests below fail when the server's OUT_CONTENT_LEN is less than 16384. |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 8382 | run_test "Large server packet TLS 1.2 BlockCipher" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8383 | "$P_SRV response_size=16384 force_version=tls12" \ |
| 8384 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 8385 | 0 \ |
| 8386 | -c "Read from server: 16384 bytes read" |
| 8387 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8388 | run_test "Large server packet TLS 1.2 BlockCipher, without EtM" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8389 | "$P_SRV response_size=16384 force_version=tls12" \ |
| 8390 | "$P_CLI etm=0 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8391 | 0 \ |
| 8392 | -s "16384 bytes written in 1 fragments" \ |
| 8393 | -c "Read from server: 16384 bytes read" |
| 8394 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 8395 | run_test "Large server packet TLS 1.2 BlockCipher larger MAC" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8396 | "$P_SRV response_size=16384 force_version=tls12" \ |
| 8397 | "$P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 8398 | 0 \ |
| 8399 | -c "Read from server: 16384 bytes read" |
| 8400 | |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8401 | run_test "Large server packet TLS 1.2 BlockCipher, without EtM, truncated MAC" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8402 | "$P_SRV response_size=16384 trunc_hmac=1 force_version=tls12" \ |
| 8403 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA trunc_hmac=1 etm=0" \ |
Andrzej Kurek | c19fc55 | 2018-06-19 09:37:30 -0400 | [diff] [blame] | 8404 | 0 \ |
| 8405 | -s "16384 bytes written in 1 fragments" \ |
| 8406 | -c "Read from server: 16384 bytes read" |
| 8407 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 8408 | run_test "Large server packet TLS 1.2 AEAD" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8409 | "$P_SRV response_size=16384 force_version=tls12" \ |
| 8410 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 8411 | 0 \ |
| 8412 | -c "Read from server: 16384 bytes read" |
| 8413 | |
| 8414 | run_test "Large server packet TLS 1.2 AEAD shorter tag" \ |
Ronald Cron | f3b425b | 2022-03-17 16:45:09 +0100 | [diff] [blame] | 8415 | "$P_SRV response_size=16384 force_version=tls12" \ |
| 8416 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 8417 | 0 \ |
| 8418 | -c "Read from server: 16384 bytes read" |
| 8419 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 8420 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8421 | run_test "Large server packet TLS 1.3 AEAD" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 8422 | "$P_SRV response_size=16384" \ |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8423 | "$P_CLI force_ciphersuite=TLS1-3-AES-128-CCM-SHA256" \ |
| 8424 | 0 \ |
| 8425 | -c "Read from server: 16384 bytes read" |
| 8426 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 8427 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8428 | run_test "Large server packet TLS 1.3 AEAD shorter tag" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 8429 | "$P_SRV response_size=16384" \ |
Ronald Cron | a4417c1 | 2022-06-23 16:06:28 +0200 | [diff] [blame] | 8430 | "$P_CLI force_ciphersuite=TLS1-3-AES-128-CCM-8-SHA256" \ |
| 8431 | 0 \ |
| 8432 | -c "Read from server: 16384 bytes read" |
| 8433 | |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8434 | # Tests for restartable ECC |
| 8435 | |
Gilles Peskine | 4a02cef | 2021-06-03 11:12:40 +0200 | [diff] [blame] | 8436 | # Force the use of a curve that supports restartable ECC (secp256r1). |
| 8437 | |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8438 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
Gilles Peskine | 4a02cef | 2021-06-03 11:12:40 +0200 | [diff] [blame] | 8439 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8440 | run_test "EC restart: TLS, default" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8441 | "$P_SRV groups=secp256r1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8442 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 8443 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8444 | debug_level=1" \ |
| 8445 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 8446 | -C "x509_verify_cert.*4b00" \ |
| 8447 | -C "mbedtls_pk_verify.*4b00" \ |
| 8448 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 8449 | -C "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8450 | |
| 8451 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
Gilles Peskine | 4a02cef | 2021-06-03 11:12:40 +0200 | [diff] [blame] | 8452 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8453 | run_test "EC restart: TLS, max_ops=0" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8454 | "$P_SRV groups=secp256r1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8455 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 8456 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8457 | debug_level=1 ec_max_ops=0" \ |
| 8458 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 8459 | -C "x509_verify_cert.*4b00" \ |
| 8460 | -C "mbedtls_pk_verify.*4b00" \ |
| 8461 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 8462 | -C "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8463 | |
| 8464 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
Gilles Peskine | 4a02cef | 2021-06-03 11:12:40 +0200 | [diff] [blame] | 8465 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8466 | run_test "EC restart: TLS, max_ops=65535" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8467 | "$P_SRV groups=secp256r1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8468 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 8469 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8470 | debug_level=1 ec_max_ops=65535" \ |
| 8471 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 8472 | -C "x509_verify_cert.*4b00" \ |
| 8473 | -C "mbedtls_pk_verify.*4b00" \ |
| 8474 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 8475 | -C "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8476 | |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8477 | # With USE_PSA disabled we expect full restartable behaviour. |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8478 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
Gilles Peskine | 4a02cef | 2021-06-03 11:12:40 +0200 | [diff] [blame] | 8479 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8480 | requires_config_disabled MBEDTLS_USE_PSA_CRYPTO |
| 8481 | run_test "EC restart: TLS, max_ops=1000 (no USE_PSA)" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8482 | "$P_SRV groups=secp256r1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8483 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 8484 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8485 | debug_level=1 ec_max_ops=1000" \ |
| 8486 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 8487 | -c "x509_verify_cert.*4b00" \ |
| 8488 | -c "mbedtls_pk_verify.*4b00" \ |
| 8489 | -c "mbedtls_ecdh_make_public.*4b00" \ |
| 8490 | -c "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8491 | |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8492 | # With USE_PSA enabled we expect only partial restartable behaviour: |
| 8493 | # everything except ECDH (where TLS calls PSA directly). |
| 8494 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
| 8495 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8496 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 8497 | run_test "EC restart: TLS, max_ops=1000 (USE_PSA)" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8498 | "$P_SRV groups=secp256r1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8499 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 8500 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8501 | debug_level=1 ec_max_ops=1000" \ |
| 8502 | 0 \ |
| 8503 | -c "x509_verify_cert.*4b00" \ |
| 8504 | -c "mbedtls_pk_verify.*4b00" \ |
| 8505 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 8506 | -c "mbedtls_pk_sign.*4b00" |
| 8507 | |
| 8508 | # This works the same with & without USE_PSA as we never get to ECDH: |
| 8509 | # we abort as soon as we determined the cert is bad. |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8510 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
Gilles Peskine | 4a02cef | 2021-06-03 11:12:40 +0200 | [diff] [blame] | 8511 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 8512 | run_test "EC restart: TLS, max_ops=1000, badsign" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8513 | "$P_SRV groups=secp256r1 auth_mode=required \ |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 8514 | crt_file=data_files/server5-badsign.crt \ |
| 8515 | key_file=data_files/server5.key" \ |
| 8516 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 8517 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8518 | debug_level=1 ec_max_ops=1000" \ |
| 8519 | 1 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 8520 | -c "x509_verify_cert.*4b00" \ |
| 8521 | -C "mbedtls_pk_verify.*4b00" \ |
| 8522 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 8523 | -C "mbedtls_pk_sign.*4b00" \ |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 8524 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 8525 | -c "! mbedtls_ssl_handshake returned" \ |
| 8526 | -c "X509 - Certificate verification failed" |
| 8527 | |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8528 | # With USE_PSA disabled we expect full restartable behaviour. |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 8529 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
Gilles Peskine | 4a02cef | 2021-06-03 11:12:40 +0200 | [diff] [blame] | 8530 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8531 | requires_config_disabled MBEDTLS_USE_PSA_CRYPTO |
| 8532 | run_test "EC restart: TLS, max_ops=1000, auth_mode=optional badsign (no USE_PSA)" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8533 | "$P_SRV groups=secp256r1 auth_mode=required \ |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 8534 | crt_file=data_files/server5-badsign.crt \ |
| 8535 | key_file=data_files/server5.key" \ |
| 8536 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 8537 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8538 | debug_level=1 ec_max_ops=1000 auth_mode=optional" \ |
| 8539 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 8540 | -c "x509_verify_cert.*4b00" \ |
| 8541 | -c "mbedtls_pk_verify.*4b00" \ |
| 8542 | -c "mbedtls_ecdh_make_public.*4b00" \ |
| 8543 | -c "mbedtls_pk_sign.*4b00" \ |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 8544 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 8545 | -C "! mbedtls_ssl_handshake returned" \ |
| 8546 | -C "X509 - Certificate verification failed" |
| 8547 | |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8548 | # With USE_PSA enabled we expect only partial restartable behaviour: |
| 8549 | # everything except ECDH (where TLS calls PSA directly). |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 8550 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
Gilles Peskine | 4a02cef | 2021-06-03 11:12:40 +0200 | [diff] [blame] | 8551 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8552 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 8553 | run_test "EC restart: TLS, max_ops=1000, auth_mode=optional badsign (USE_PSA)" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8554 | "$P_SRV groups=secp256r1 auth_mode=required \ |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8555 | crt_file=data_files/server5-badsign.crt \ |
| 8556 | key_file=data_files/server5.key" \ |
| 8557 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 8558 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8559 | debug_level=1 ec_max_ops=1000 auth_mode=optional" \ |
| 8560 | 0 \ |
| 8561 | -c "x509_verify_cert.*4b00" \ |
| 8562 | -c "mbedtls_pk_verify.*4b00" \ |
| 8563 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 8564 | -c "mbedtls_pk_sign.*4b00" \ |
| 8565 | -c "! The certificate is not correctly signed by the trusted CA" \ |
| 8566 | -C "! mbedtls_ssl_handshake returned" \ |
| 8567 | -C "X509 - Certificate verification failed" |
| 8568 | |
| 8569 | # With USE_PSA disabled we expect full restartable behaviour. |
| 8570 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
| 8571 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8572 | requires_config_disabled MBEDTLS_USE_PSA_CRYPTO |
| 8573 | run_test "EC restart: TLS, max_ops=1000, auth_mode=none badsign (no USE_PSA)" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8574 | "$P_SRV groups=secp256r1 auth_mode=required \ |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 8575 | crt_file=data_files/server5-badsign.crt \ |
| 8576 | key_file=data_files/server5.key" \ |
| 8577 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 8578 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8579 | debug_level=1 ec_max_ops=1000 auth_mode=none" \ |
| 8580 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 8581 | -C "x509_verify_cert.*4b00" \ |
| 8582 | -c "mbedtls_pk_verify.*4b00" \ |
| 8583 | -c "mbedtls_ecdh_make_public.*4b00" \ |
| 8584 | -c "mbedtls_pk_sign.*4b00" \ |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 8585 | -C "! The certificate is not correctly signed by the trusted CA" \ |
| 8586 | -C "! mbedtls_ssl_handshake returned" \ |
| 8587 | -C "X509 - Certificate verification failed" |
| 8588 | |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8589 | # With USE_PSA enabled we expect only partial restartable behaviour: |
| 8590 | # everything except ECDH (where TLS calls PSA directly). |
Manuel Pégourié-Gonnard | 3bf49c4 | 2017-08-15 13:47:06 +0200 | [diff] [blame] | 8591 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
Gilles Peskine | 4a02cef | 2021-06-03 11:12:40 +0200 | [diff] [blame] | 8592 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8593 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 8594 | run_test "EC restart: TLS, max_ops=1000, auth_mode=none badsign (USE_PSA)" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8595 | "$P_SRV groups=secp256r1 auth_mode=required \ |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8596 | crt_file=data_files/server5-badsign.crt \ |
| 8597 | key_file=data_files/server5.key" \ |
| 8598 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 8599 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8600 | debug_level=1 ec_max_ops=1000 auth_mode=none" \ |
| 8601 | 0 \ |
| 8602 | -C "x509_verify_cert.*4b00" \ |
| 8603 | -c "mbedtls_pk_verify.*4b00" \ |
| 8604 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 8605 | -c "mbedtls_pk_sign.*4b00" \ |
| 8606 | -C "! The certificate is not correctly signed by the trusted CA" \ |
| 8607 | -C "! mbedtls_ssl_handshake returned" \ |
| 8608 | -C "X509 - Certificate verification failed" |
| 8609 | |
| 8610 | # With USE_PSA disabled we expect full restartable behaviour. |
| 8611 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
| 8612 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8613 | requires_config_disabled MBEDTLS_USE_PSA_CRYPTO |
| 8614 | run_test "EC restart: DTLS, max_ops=1000 (no USE_PSA)" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8615 | "$P_SRV groups=secp256r1 auth_mode=required dtls=1" \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8616 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 862cde5 | 2017-05-17 11:56:15 +0200 | [diff] [blame] | 8617 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8618 | dtls=1 debug_level=1 ec_max_ops=1000" \ |
| 8619 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 8620 | -c "x509_verify_cert.*4b00" \ |
| 8621 | -c "mbedtls_pk_verify.*4b00" \ |
| 8622 | -c "mbedtls_ecdh_make_public.*4b00" \ |
| 8623 | -c "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 2350b4e | 2017-05-16 09:26:48 +0200 | [diff] [blame] | 8624 | |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8625 | # With USE_PSA enabled we expect only partial restartable behaviour: |
| 8626 | # everything except ECDH (where TLS calls PSA directly). |
Manuel Pégourié-Gonnard | 32033da | 2017-05-18 12:49:27 +0200 | [diff] [blame] | 8627 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
Gilles Peskine | 4a02cef | 2021-06-03 11:12:40 +0200 | [diff] [blame] | 8628 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8629 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 8630 | run_test "EC restart: DTLS, max_ops=1000 (USE_PSA)" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8631 | "$P_SRV groups=secp256r1 auth_mode=required dtls=1" \ |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8632 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 8633 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8634 | dtls=1 debug_level=1 ec_max_ops=1000" \ |
| 8635 | 0 \ |
| 8636 | -c "x509_verify_cert.*4b00" \ |
| 8637 | -c "mbedtls_pk_verify.*4b00" \ |
| 8638 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 8639 | -c "mbedtls_pk_sign.*4b00" |
| 8640 | |
| 8641 | # With USE_PSA disabled we expect full restartable behaviour. |
| 8642 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
| 8643 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8644 | requires_config_disabled MBEDTLS_USE_PSA_CRYPTO |
| 8645 | run_test "EC restart: TLS, max_ops=1000 no client auth (no USE_PSA)" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8646 | "$P_SRV groups=secp256r1" \ |
Manuel Pégourié-Gonnard | 32033da | 2017-05-18 12:49:27 +0200 | [diff] [blame] | 8647 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 8648 | debug_level=1 ec_max_ops=1000" \ |
| 8649 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 8650 | -c "x509_verify_cert.*4b00" \ |
| 8651 | -c "mbedtls_pk_verify.*4b00" \ |
| 8652 | -c "mbedtls_ecdh_make_public.*4b00" \ |
| 8653 | -C "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 32033da | 2017-05-18 12:49:27 +0200 | [diff] [blame] | 8654 | |
Manuel Pégourié-Gonnard | 2b7ad64 | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 8655 | |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8656 | # With USE_PSA enabled we expect only partial restartable behaviour: |
| 8657 | # everything except ECDH (where TLS calls PSA directly). |
Manuel Pégourié-Gonnard | 32033da | 2017-05-18 12:49:27 +0200 | [diff] [blame] | 8658 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
Gilles Peskine | 4a02cef | 2021-06-03 11:12:40 +0200 | [diff] [blame] | 8659 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8660 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
| 8661 | run_test "EC restart: TLS, max_ops=1000 no client auth (USE_PSA)" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8662 | "$P_SRV groups=secp256r1" \ |
Manuel Pégourié-Gonnard | 55a188b | 2022-12-06 12:00:33 +0100 | [diff] [blame] | 8663 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 8664 | debug_level=1 ec_max_ops=1000" \ |
| 8665 | 0 \ |
| 8666 | -c "x509_verify_cert.*4b00" \ |
| 8667 | -c "mbedtls_pk_verify.*4b00" \ |
| 8668 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 8669 | -C "mbedtls_pk_sign.*4b00" |
| 8670 | |
Manuel Pégourié-Gonnard | 2b7ad64 | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 8671 | # Restartable is only for ECDHE-ECDSA, with another ciphersuite we expect no |
| 8672 | # restartable behaviour at all (not even client auth). |
| 8673 | # This is the same as "EC restart: TLS, max_ops=1000" except with ECDHE-RSA, |
| 8674 | # and all 4 assertions negated. |
Manuel Pégourié-Gonnard | 32033da | 2017-05-18 12:49:27 +0200 | [diff] [blame] | 8675 | requires_config_enabled MBEDTLS_ECP_RESTARTABLE |
| 8676 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Manuel Pégourié-Gonnard | 2b7ad64 | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 8677 | run_test "EC restart: TLS, max_ops=1000, ECDHE-RSA" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 8678 | "$P_SRV groups=secp256r1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 2b7ad64 | 2022-12-06 10:42:44 +0100 | [diff] [blame] | 8679 | "$P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256 \ |
| 8680 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8681 | debug_level=1 ec_max_ops=1000" \ |
Manuel Pégourié-Gonnard | 32033da | 2017-05-18 12:49:27 +0200 | [diff] [blame] | 8682 | 0 \ |
Manuel Pégourié-Gonnard | b5d668a | 2018-06-13 11:22:01 +0200 | [diff] [blame] | 8683 | -C "x509_verify_cert.*4b00" \ |
| 8684 | -C "mbedtls_pk_verify.*4b00" \ |
| 8685 | -C "mbedtls_ecdh_make_public.*4b00" \ |
| 8686 | -C "mbedtls_pk_sign.*4b00" |
Manuel Pégourié-Gonnard | 32033da | 2017-05-18 12:49:27 +0200 | [diff] [blame] | 8687 | |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8688 | # Tests of asynchronous private key support in SSL |
| 8689 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8690 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8691 | run_test "SSL async private: sign, delay=0" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 8692 | "$P_SRV force_version=tls12 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8693 | async_operations=s async_private_delay1=0 async_private_delay2=0" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8694 | "$P_CLI" \ |
| 8695 | 0 \ |
| 8696 | -s "Async sign callback: using key slot " \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8697 | -s "Async resume (slot [0-9]): sign done, status=0" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8698 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8699 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8700 | run_test "SSL async private: sign, delay=1" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 8701 | "$P_SRV force_version=tls12 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8702 | async_operations=s async_private_delay1=1 async_private_delay2=1" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8703 | "$P_CLI" \ |
| 8704 | 0 \ |
| 8705 | -s "Async sign callback: using key slot " \ |
| 8706 | -s "Async resume (slot [0-9]): call 0 more times." \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8707 | -s "Async resume (slot [0-9]): sign done, status=0" |
| 8708 | |
Gilles Peskine | 12d0cc1 | 2018-04-26 15:06:56 +0200 | [diff] [blame] | 8709 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
| 8710 | run_test "SSL async private: sign, delay=2" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 8711 | "$P_SRV force_version=tls12 \ |
Gilles Peskine | 12d0cc1 | 2018-04-26 15:06:56 +0200 | [diff] [blame] | 8712 | async_operations=s async_private_delay1=2 async_private_delay2=2" \ |
| 8713 | "$P_CLI" \ |
| 8714 | 0 \ |
| 8715 | -s "Async sign callback: using key slot " \ |
| 8716 | -U "Async sign callback: using key slot " \ |
| 8717 | -s "Async resume (slot [0-9]): call 1 more times." \ |
| 8718 | -s "Async resume (slot [0-9]): call 0 more times." \ |
| 8719 | -s "Async resume (slot [0-9]): sign done, status=0" |
| 8720 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8721 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Hanno Becker | c5722d1 | 2020-10-09 11:10:42 +0100 | [diff] [blame] | 8722 | requires_config_disabled MBEDTLS_X509_REMOVE_INFO |
Gilles Peskine | 807d74a | 2018-04-30 10:30:49 +0200 | [diff] [blame] | 8723 | run_test "SSL async private: sign, SNI" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 8724 | "$P_SRV force_version=tls12 debug_level=3 \ |
Gilles Peskine | 807d74a | 2018-04-30 10:30:49 +0200 | [diff] [blame] | 8725 | async_operations=s async_private_delay1=0 async_private_delay2=0 \ |
| 8726 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
| 8727 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
| 8728 | "$P_CLI server_name=polarssl.example" \ |
| 8729 | 0 \ |
| 8730 | -s "Async sign callback: using key slot " \ |
| 8731 | -s "Async resume (slot [0-9]): sign done, status=0" \ |
| 8732 | -s "parse ServerName extension" \ |
| 8733 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 8734 | -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example" |
| 8735 | |
| 8736 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8737 | run_test "SSL async private: decrypt, delay=0" \ |
| 8738 | "$P_SRV \ |
| 8739 | async_operations=d async_private_delay1=0 async_private_delay2=0" \ |
| 8740 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8741 | 0 \ |
| 8742 | -s "Async decrypt callback: using key slot " \ |
| 8743 | -s "Async resume (slot [0-9]): decrypt done, status=0" |
| 8744 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8745 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8746 | run_test "SSL async private: decrypt, delay=1" \ |
| 8747 | "$P_SRV \ |
| 8748 | async_operations=d async_private_delay1=1 async_private_delay2=1" \ |
| 8749 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8750 | 0 \ |
| 8751 | -s "Async decrypt callback: using key slot " \ |
| 8752 | -s "Async resume (slot [0-9]): call 0 more times." \ |
| 8753 | -s "Async resume (slot [0-9]): decrypt done, status=0" |
| 8754 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8755 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8756 | run_test "SSL async private: decrypt RSA-PSK, delay=0" \ |
| 8757 | "$P_SRV psk=abc123 \ |
| 8758 | async_operations=d async_private_delay1=0 async_private_delay2=0" \ |
| 8759 | "$P_CLI psk=abc123 \ |
| 8760 | force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA256" \ |
| 8761 | 0 \ |
| 8762 | -s "Async decrypt callback: using key slot " \ |
| 8763 | -s "Async resume (slot [0-9]): decrypt done, status=0" |
| 8764 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8765 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8766 | run_test "SSL async private: decrypt RSA-PSK, delay=1" \ |
| 8767 | "$P_SRV psk=abc123 \ |
| 8768 | async_operations=d async_private_delay1=1 async_private_delay2=1" \ |
| 8769 | "$P_CLI psk=abc123 \ |
| 8770 | force_ciphersuite=TLS-RSA-PSK-WITH-AES-128-CBC-SHA256" \ |
| 8771 | 0 \ |
| 8772 | -s "Async decrypt callback: using key slot " \ |
| 8773 | -s "Async resume (slot [0-9]): call 0 more times." \ |
| 8774 | -s "Async resume (slot [0-9]): decrypt done, status=0" |
| 8775 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8776 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8777 | run_test "SSL async private: sign callback not present" \ |
| 8778 | "$P_SRV \ |
| 8779 | async_operations=d async_private_delay1=1 async_private_delay2=1" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 8780 | "$P_CLI force_version=tls12; [ \$? -eq 1 ] && |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8781 | $P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8782 | 0 \ |
| 8783 | -S "Async sign callback" \ |
| 8784 | -s "! mbedtls_ssl_handshake returned" \ |
| 8785 | -s "The own private key or pre-shared key is not set, but needed" \ |
| 8786 | -s "Async resume (slot [0-9]): decrypt done, status=0" \ |
| 8787 | -s "Successful connection" |
| 8788 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8789 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8790 | run_test "SSL async private: decrypt callback not present" \ |
| 8791 | "$P_SRV debug_level=1 \ |
| 8792 | async_operations=s async_private_delay1=1 async_private_delay2=1" \ |
| 8793 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA; |
Ronald Cron | c564938 | 2023-04-04 15:33:42 +0200 | [diff] [blame] | 8794 | [ \$? -eq 1 ] && $P_CLI force_version=tls12" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8795 | 0 \ |
| 8796 | -S "Async decrypt callback" \ |
| 8797 | -s "! mbedtls_ssl_handshake returned" \ |
| 8798 | -s "got no RSA private key" \ |
| 8799 | -s "Async resume (slot [0-9]): sign done, status=0" \ |
| 8800 | -s "Successful connection" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8801 | |
| 8802 | # key1: ECDSA, key2: RSA; use key1 from slot 0 |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8803 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8804 | run_test "SSL async private: slot 0 used with key1" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8805 | "$P_SRV \ |
| 8806 | async_operations=s async_private_delay1=1 \ |
| 8807 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8808 | key_file2=data_files/server2.key crt_file2=data_files/server2.crt" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8809 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 8810 | 0 \ |
| 8811 | -s "Async sign callback: using key slot 0," \ |
| 8812 | -s "Async resume (slot 0): call 0 more times." \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8813 | -s "Async resume (slot 0): sign done, status=0" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8814 | |
| 8815 | # key1: ECDSA, key2: RSA; use key2 from slot 0 |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8816 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8817 | run_test "SSL async private: slot 0 used with key2" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8818 | "$P_SRV \ |
| 8819 | async_operations=s async_private_delay2=1 \ |
| 8820 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8821 | key_file2=data_files/server2.key crt_file2=data_files/server2.crt" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8822 | "$P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256" \ |
| 8823 | 0 \ |
| 8824 | -s "Async sign callback: using key slot 0," \ |
| 8825 | -s "Async resume (slot 0): call 0 more times." \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8826 | -s "Async resume (slot 0): sign done, status=0" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8827 | |
| 8828 | # key1: ECDSA, key2: RSA; use key2 from slot 1 |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8829 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | ad28bf0 | 2018-04-26 00:19:16 +0200 | [diff] [blame] | 8830 | run_test "SSL async private: slot 1 used with key2" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8831 | "$P_SRV \ |
Gilles Peskine | 168dae8 | 2018-04-25 23:35:42 +0200 | [diff] [blame] | 8832 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8833 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8834 | key_file2=data_files/server2.key crt_file2=data_files/server2.crt" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8835 | "$P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256" \ |
| 8836 | 0 \ |
| 8837 | -s "Async sign callback: using key slot 1," \ |
| 8838 | -s "Async resume (slot 1): call 0 more times." \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8839 | -s "Async resume (slot 1): sign done, status=0" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8840 | |
| 8841 | # key1: ECDSA, key2: RSA; use key2 directly |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8842 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8843 | run_test "SSL async private: fall back to transparent key" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8844 | "$P_SRV \ |
| 8845 | async_operations=s async_private_delay1=1 \ |
| 8846 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8847 | key_file2=data_files/server2.key crt_file2=data_files/server2.crt " \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8848 | "$P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256" \ |
| 8849 | 0 \ |
| 8850 | -s "Async sign callback: no key matches this certificate." |
| 8851 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8852 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 725f1cb | 2018-06-12 15:06:40 +0200 | [diff] [blame] | 8853 | run_test "SSL async private: sign, error in start" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 8854 | "$P_SRV force_version=tls12 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8855 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
| 8856 | async_private_error=1" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8857 | "$P_CLI" \ |
| 8858 | 1 \ |
| 8859 | -s "Async sign callback: injected error" \ |
| 8860 | -S "Async resume" \ |
Gilles Peskine | 37289cd | 2018-04-27 11:50:14 +0200 | [diff] [blame] | 8861 | -S "Async cancel" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8862 | -s "! mbedtls_ssl_handshake returned" |
| 8863 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8864 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 725f1cb | 2018-06-12 15:06:40 +0200 | [diff] [blame] | 8865 | run_test "SSL async private: sign, cancel after start" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 8866 | "$P_SRV force_version=tls12 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8867 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
| 8868 | async_private_error=2" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8869 | "$P_CLI" \ |
| 8870 | 1 \ |
| 8871 | -s "Async sign callback: using key slot " \ |
| 8872 | -S "Async resume" \ |
| 8873 | -s "Async cancel" |
| 8874 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8875 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 725f1cb | 2018-06-12 15:06:40 +0200 | [diff] [blame] | 8876 | run_test "SSL async private: sign, error in resume" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 8877 | "$P_SRV force_version=tls12 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8878 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
| 8879 | async_private_error=3" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8880 | "$P_CLI" \ |
| 8881 | 1 \ |
| 8882 | -s "Async sign callback: using key slot " \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8883 | -s "Async resume callback: sign done but injected error" \ |
Gilles Peskine | 37289cd | 2018-04-27 11:50:14 +0200 | [diff] [blame] | 8884 | -S "Async cancel" \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8885 | -s "! mbedtls_ssl_handshake returned" |
| 8886 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8887 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 725f1cb | 2018-06-12 15:06:40 +0200 | [diff] [blame] | 8888 | run_test "SSL async private: decrypt, error in start" \ |
| 8889 | "$P_SRV \ |
| 8890 | async_operations=d async_private_delay1=1 async_private_delay2=1 \ |
| 8891 | async_private_error=1" \ |
| 8892 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8893 | 1 \ |
| 8894 | -s "Async decrypt callback: injected error" \ |
| 8895 | -S "Async resume" \ |
| 8896 | -S "Async cancel" \ |
| 8897 | -s "! mbedtls_ssl_handshake returned" |
| 8898 | |
| 8899 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
| 8900 | run_test "SSL async private: decrypt, cancel after start" \ |
| 8901 | "$P_SRV \ |
| 8902 | async_operations=d async_private_delay1=1 async_private_delay2=1 \ |
| 8903 | async_private_error=2" \ |
| 8904 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8905 | 1 \ |
| 8906 | -s "Async decrypt callback: using key slot " \ |
| 8907 | -S "Async resume" \ |
| 8908 | -s "Async cancel" |
| 8909 | |
| 8910 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
| 8911 | run_test "SSL async private: decrypt, error in resume" \ |
| 8912 | "$P_SRV \ |
| 8913 | async_operations=d async_private_delay1=1 async_private_delay2=1 \ |
| 8914 | async_private_error=3" \ |
| 8915 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 8916 | 1 \ |
| 8917 | -s "Async decrypt callback: using key slot " \ |
| 8918 | -s "Async resume callback: decrypt done but injected error" \ |
| 8919 | -S "Async cancel" \ |
| 8920 | -s "! mbedtls_ssl_handshake returned" |
| 8921 | |
| 8922 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8923 | run_test "SSL async private: cancel after start then operate correctly" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 8924 | "$P_SRV force_version=tls12 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8925 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
| 8926 | async_private_error=-2" \ |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8927 | "$P_CLI; [ \$? -eq 1 ] && $P_CLI" \ |
| 8928 | 0 \ |
| 8929 | -s "Async cancel" \ |
| 8930 | -s "! mbedtls_ssl_handshake returned" \ |
| 8931 | -s "Async resume" \ |
| 8932 | -s "Successful connection" |
| 8933 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8934 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8935 | run_test "SSL async private: error in resume then operate correctly" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 8936 | "$P_SRV force_version=tls12 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8937 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
| 8938 | async_private_error=-3" \ |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8939 | "$P_CLI; [ \$? -eq 1 ] && $P_CLI" \ |
| 8940 | 0 \ |
| 8941 | -s "! mbedtls_ssl_handshake returned" \ |
| 8942 | -s "Async resume" \ |
| 8943 | -s "Successful connection" |
| 8944 | |
| 8945 | # key1: ECDSA, key2: RSA; use key1 through async, then key2 directly |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8946 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Valerio Setti | 3f2309f | 2023-02-23 13:47:30 +0100 | [diff] [blame] | 8947 | # Note: the function "detect_required_features()" is not able to detect more than |
| 8948 | # one "force_ciphersuite" per client/server and it only picks the 2nd one. |
| 8949 | # Therefore the 1st one is added explicitly here |
Valerio Setti | d1f991c | 2023-02-22 12:54:13 +0100 | [diff] [blame] | 8950 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8951 | run_test "SSL async private: cancel after start then fall back to transparent key" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8952 | "$P_SRV \ |
| 8953 | async_operations=s async_private_delay1=1 async_private_error=-2 \ |
| 8954 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8955 | key_file2=data_files/server2.key crt_file2=data_files/server2.crt" \ |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8956 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256; |
| 8957 | [ \$? -eq 1 ] && |
| 8958 | $P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256" \ |
| 8959 | 0 \ |
Gilles Peskine | deda75a | 2018-04-30 10:02:45 +0200 | [diff] [blame] | 8960 | -s "Async sign callback: using key slot 0" \ |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8961 | -S "Async resume" \ |
| 8962 | -s "Async cancel" \ |
| 8963 | -s "! mbedtls_ssl_handshake returned" \ |
| 8964 | -s "Async sign callback: no key matches this certificate." \ |
| 8965 | -s "Successful connection" |
| 8966 | |
| 8967 | # key1: ECDSA, key2: RSA; use key1 through async, then key2 directly |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8968 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Valerio Setti | 3f2309f | 2023-02-23 13:47:30 +0100 | [diff] [blame] | 8969 | # Note: the function "detect_required_features()" is not able to detect more than |
| 8970 | # one "force_ciphersuite" per client/server and it only picks the 2nd one. |
| 8971 | # Therefore the 1st one is added explicitly here |
Valerio Setti | d1f991c | 2023-02-22 12:54:13 +0100 | [diff] [blame] | 8972 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
Gilles Peskine | 725f1cb | 2018-06-12 15:06:40 +0200 | [diff] [blame] | 8973 | run_test "SSL async private: sign, error in resume then fall back to transparent key" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8974 | "$P_SRV \ |
| 8975 | async_operations=s async_private_delay1=1 async_private_error=-3 \ |
| 8976 | key_file=data_files/server5.key crt_file=data_files/server5.crt \ |
| 8977 | key_file2=data_files/server2.key crt_file2=data_files/server2.crt" \ |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 8978 | "$P_CLI force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256; |
| 8979 | [ \$? -eq 1 ] && |
| 8980 | $P_CLI force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256" \ |
| 8981 | 0 \ |
| 8982 | -s "Async resume" \ |
| 8983 | -s "! mbedtls_ssl_handshake returned" \ |
| 8984 | -s "Async sign callback: no key matches this certificate." \ |
| 8985 | -s "Successful connection" |
| 8986 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8987 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8988 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Gilles Peskine | 654bab7 | 2019-09-16 15:19:20 +0200 | [diff] [blame] | 8989 | run_test "SSL async private: renegotiation: client-initiated, sign" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 8990 | "$P_SRV force_version=tls12 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8991 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8992 | exchanges=2 renegotiation=1" \ |
| 8993 | "$P_CLI exchanges=2 renegotiation=1 renegotiate=1" \ |
| 8994 | 0 \ |
| 8995 | -s "Async sign callback: using key slot " \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 8996 | -s "Async resume (slot [0-9]): sign done, status=0" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8997 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 8998 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 8999 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Gilles Peskine | 654bab7 | 2019-09-16 15:19:20 +0200 | [diff] [blame] | 9000 | run_test "SSL async private: renegotiation: server-initiated, sign" \ |
Ronald Cron | fd4c6af | 2023-03-11 10:46:01 +0100 | [diff] [blame] | 9001 | "$P_SRV force_version=tls12 \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 9002 | async_operations=s async_private_delay1=1 async_private_delay2=1 \ |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 9003 | exchanges=2 renegotiation=1 renegotiate=1" \ |
| 9004 | "$P_CLI exchanges=2 renegotiation=1" \ |
| 9005 | 0 \ |
| 9006 | -s "Async sign callback: using key slot " \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 9007 | -s "Async resume (slot [0-9]): sign done, status=0" |
| 9008 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 9009 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 9010 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Gilles Peskine | 654bab7 | 2019-09-16 15:19:20 +0200 | [diff] [blame] | 9011 | run_test "SSL async private: renegotiation: client-initiated, decrypt" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 9012 | "$P_SRV \ |
| 9013 | async_operations=d async_private_delay1=1 async_private_delay2=1 \ |
| 9014 | exchanges=2 renegotiation=1" \ |
| 9015 | "$P_CLI exchanges=2 renegotiation=1 renegotiate=1 \ |
| 9016 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 9017 | 0 \ |
| 9018 | -s "Async decrypt callback: using key slot " \ |
| 9019 | -s "Async resume (slot [0-9]): decrypt done, status=0" |
| 9020 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 9021 | requires_config_enabled MBEDTLS_SSL_ASYNC_PRIVATE |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 9022 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Gilles Peskine | 654bab7 | 2019-09-16 15:19:20 +0200 | [diff] [blame] | 9023 | run_test "SSL async private: renegotiation: server-initiated, decrypt" \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 9024 | "$P_SRV \ |
| 9025 | async_operations=d async_private_delay1=1 async_private_delay2=1 \ |
| 9026 | exchanges=2 renegotiation=1 renegotiate=1" \ |
| 9027 | "$P_CLI exchanges=2 renegotiation=1 \ |
| 9028 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 9029 | 0 \ |
| 9030 | -s "Async decrypt callback: using key slot " \ |
| 9031 | -s "Async resume (slot [0-9]): decrypt done, status=0" |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 9032 | |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 9033 | # Tests for ECC extensions (rfc 4492) |
| 9034 | |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 9035 | requires_config_enabled MBEDTLS_AES_C |
| 9036 | requires_config_enabled MBEDTLS_CIPHER_MODE_CBC |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 9037 | requires_hash_alg SHA_256 |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 9038 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_RSA_ENABLED |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 9039 | run_test "Force a non ECC ciphersuite in the client side" \ |
| 9040 | "$P_SRV debug_level=3" \ |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 9041 | "$P_CLI debug_level=3 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA256" \ |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 9042 | 0 \ |
Jerry Yu | 136320b | 2021-12-21 17:09:00 +0800 | [diff] [blame] | 9043 | -C "client hello, adding supported_groups extension" \ |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 9044 | -C "client hello, adding supported_point_formats extension" \ |
| 9045 | -S "found supported elliptic curves extension" \ |
| 9046 | -S "found supported point formats extension" |
| 9047 | |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 9048 | requires_config_enabled MBEDTLS_AES_C |
| 9049 | requires_config_enabled MBEDTLS_CIPHER_MODE_CBC |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 9050 | requires_hash_alg SHA_256 |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 9051 | requires_config_enabled MBEDTLS_KEY_EXCHANGE_RSA_ENABLED |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 9052 | run_test "Force a non ECC ciphersuite in the server side" \ |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 9053 | "$P_SRV debug_level=3 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA256" \ |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 9054 | "$P_CLI debug_level=3" \ |
| 9055 | 0 \ |
| 9056 | -C "found supported_point_formats extension" \ |
| 9057 | -S "server hello, supported_point_formats extension" |
| 9058 | |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 9059 | requires_config_enabled MBEDTLS_AES_C |
| 9060 | requires_config_enabled MBEDTLS_CIPHER_MODE_CBC |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 9061 | requires_hash_alg SHA_256 |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 9062 | run_test "Force an ECC ciphersuite in the client side" \ |
| 9063 | "$P_SRV debug_level=3" \ |
| 9064 | "$P_CLI debug_level=3 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 9065 | 0 \ |
Jerry Yu | 136320b | 2021-12-21 17:09:00 +0800 | [diff] [blame] | 9066 | -c "client hello, adding supported_groups extension" \ |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 9067 | -c "client hello, adding supported_point_formats extension" \ |
| 9068 | -s "found supported elliptic curves extension" \ |
| 9069 | -s "found supported point formats extension" |
| 9070 | |
Ron Eldor | 643df7c | 2018-06-28 16:17:00 +0300 | [diff] [blame] | 9071 | requires_config_enabled MBEDTLS_AES_C |
| 9072 | requires_config_enabled MBEDTLS_CIPHER_MODE_CBC |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 9073 | requires_hash_alg SHA_256 |
Ron Eldor | 58093c8 | 2018-06-28 13:22:05 +0300 | [diff] [blame] | 9074 | run_test "Force an ECC ciphersuite in the server side" \ |
| 9075 | "$P_SRV debug_level=3 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ |
| 9076 | "$P_CLI debug_level=3" \ |
| 9077 | 0 \ |
| 9078 | -c "found supported_point_formats extension" \ |
| 9079 | -s "server hello, supported_point_formats extension" |
| 9080 | |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 9081 | # Tests for DTLS HelloVerifyRequest |
| 9082 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9083 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 9084 | run_test "DTLS cookie: enabled" \ |
| 9085 | "$P_SRV dtls=1 debug_level=2" \ |
| 9086 | "$P_CLI dtls=1 debug_level=2" \ |
| 9087 | 0 \ |
| 9088 | -s "cookie verification failed" \ |
| 9089 | -s "cookie verification passed" \ |
| 9090 | -S "cookie verification skipped" \ |
| 9091 | -c "received hello verify request" \ |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 9092 | -s "hello verification requested" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 9093 | -S "SSL - The requested feature is not available" |
| 9094 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9095 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 9096 | run_test "DTLS cookie: disabled" \ |
| 9097 | "$P_SRV dtls=1 debug_level=2 cookies=0" \ |
| 9098 | "$P_CLI dtls=1 debug_level=2" \ |
| 9099 | 0 \ |
| 9100 | -S "cookie verification failed" \ |
| 9101 | -S "cookie verification passed" \ |
| 9102 | -s "cookie verification skipped" \ |
| 9103 | -C "received hello verify request" \ |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 9104 | -S "hello verification requested" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 9105 | -S "SSL - The requested feature is not available" |
| 9106 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9107 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 9108 | run_test "DTLS cookie: default (failing)" \ |
| 9109 | "$P_SRV dtls=1 debug_level=2 cookies=-1" \ |
| 9110 | "$P_CLI dtls=1 debug_level=2 hs_timeout=100-400" \ |
| 9111 | 1 \ |
| 9112 | -s "cookie verification failed" \ |
| 9113 | -S "cookie verification passed" \ |
| 9114 | -S "cookie verification skipped" \ |
| 9115 | -C "received hello verify request" \ |
| 9116 | -S "hello verification requested" \ |
| 9117 | -s "SSL - The requested feature is not available" |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 9118 | |
| 9119 | requires_ipv6 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9120 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 9121 | run_test "DTLS cookie: enabled, IPv6" \ |
| 9122 | "$P_SRV dtls=1 debug_level=2 server_addr=::1" \ |
| 9123 | "$P_CLI dtls=1 debug_level=2 server_addr=::1" \ |
| 9124 | 0 \ |
| 9125 | -s "cookie verification failed" \ |
| 9126 | -s "cookie verification passed" \ |
| 9127 | -S "cookie verification skipped" \ |
| 9128 | -c "received hello verify request" \ |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 9129 | -s "hello verification requested" \ |
Manuel Pégourié-Gonnard | 0eb6cab | 2014-07-23 20:17:47 +0200 | [diff] [blame] | 9130 | -S "SSL - The requested feature is not available" |
| 9131 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9132 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 579950c | 2014-09-29 17:47:33 +0200 | [diff] [blame] | 9133 | run_test "DTLS cookie: enabled, nbio" \ |
| 9134 | "$P_SRV dtls=1 nbio=2 debug_level=2" \ |
| 9135 | "$P_CLI dtls=1 nbio=2 debug_level=2" \ |
| 9136 | 0 \ |
| 9137 | -s "cookie verification failed" \ |
| 9138 | -s "cookie verification passed" \ |
| 9139 | -S "cookie verification skipped" \ |
| 9140 | -c "received hello verify request" \ |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 9141 | -s "hello verification requested" \ |
Manuel Pégourié-Gonnard | 579950c | 2014-09-29 17:47:33 +0200 | [diff] [blame] | 9142 | -S "SSL - The requested feature is not available" |
| 9143 | |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 9144 | # Tests for client reconnecting from the same port with DTLS |
| 9145 | |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 9146 | not_with_valgrind # spurious resend |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9147 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 9148 | run_test "DTLS client reconnect from same port: reference" \ |
Manuel Pégourié-Gonnard | b692989 | 2019-09-09 11:14:37 +0200 | [diff] [blame] | 9149 | "$P_SRV dtls=1 exchanges=2 read_timeout=20000 hs_timeout=10000-20000" \ |
| 9150 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=10000-20000" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 9151 | 0 \ |
| 9152 | -C "resend" \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 9153 | -S "The operation timed out" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 9154 | -S "Client initiated reconnection from same port" |
| 9155 | |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 9156 | not_with_valgrind # spurious resend |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9157 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 9158 | run_test "DTLS client reconnect from same port: reconnect" \ |
Manuel Pégourié-Gonnard | b692989 | 2019-09-09 11:14:37 +0200 | [diff] [blame] | 9159 | "$P_SRV dtls=1 exchanges=2 read_timeout=20000 hs_timeout=10000-20000" \ |
| 9160 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=10000-20000 reconnect_hard=1" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 9161 | 0 \ |
| 9162 | -C "resend" \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 9163 | -S "The operation timed out" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 9164 | -s "Client initiated reconnection from same port" |
| 9165 | |
Paul Bakker | 362689d | 2016-05-13 10:33:25 +0100 | [diff] [blame] | 9166 | not_with_valgrind # server/client too slow to respond in time (next test has higher timeouts) |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9167 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Paul Bakker | 362689d | 2016-05-13 10:33:25 +0100 | [diff] [blame] | 9168 | run_test "DTLS client reconnect from same port: reconnect, nbio, no valgrind" \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 9169 | "$P_SRV dtls=1 exchanges=2 read_timeout=1000 nbio=2" \ |
| 9170 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=500-1000 reconnect_hard=1" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 9171 | 0 \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 9172 | -S "The operation timed out" \ |
Manuel Pégourié-Gonnard | d745a1a | 2015-09-08 12:40:43 +0200 | [diff] [blame] | 9173 | -s "Client initiated reconnection from same port" |
| 9174 | |
Paul Bakker | 362689d | 2016-05-13 10:33:25 +0100 | [diff] [blame] | 9175 | only_with_valgrind # Only with valgrind, do previous test but with higher read_timeout and hs_timeout |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9176 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Paul Bakker | 362689d | 2016-05-13 10:33:25 +0100 | [diff] [blame] | 9177 | run_test "DTLS client reconnect from same port: reconnect, nbio, valgrind" \ |
| 9178 | "$P_SRV dtls=1 exchanges=2 read_timeout=2000 nbio=2 hs_timeout=1500-6000" \ |
| 9179 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=1500-3000 reconnect_hard=1" \ |
| 9180 | 0 \ |
| 9181 | -S "The operation timed out" \ |
| 9182 | -s "Client initiated reconnection from same port" |
| 9183 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9184 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 9185 | run_test "DTLS client reconnect from same port: no cookies" \ |
| 9186 | "$P_SRV dtls=1 exchanges=2 read_timeout=1000 cookies=0" \ |
Manuel Pégourié-Gonnard | 6ad23b9 | 2015-09-15 12:57:46 +0200 | [diff] [blame] | 9187 | "$P_CLI dtls=1 exchanges=2 debug_level=2 hs_timeout=500-8000 reconnect_hard=1" \ |
| 9188 | 0 \ |
Manuel Pégourié-Gonnard | 259db91 | 2015-09-09 11:37:17 +0200 | [diff] [blame] | 9189 | -s "The operation timed out" \ |
| 9190 | -S "Client initiated reconnection from same port" |
| 9191 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9192 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | baad2de | 2020-03-13 11:11:02 +0100 | [diff] [blame] | 9193 | run_test "DTLS client reconnect from same port: attacker-injected" \ |
| 9194 | -p "$P_PXY inject_clihlo=1" \ |
| 9195 | "$P_SRV dtls=1 exchanges=2 debug_level=1" \ |
| 9196 | "$P_CLI dtls=1 exchanges=2" \ |
| 9197 | 0 \ |
| 9198 | -s "possible client reconnect from the same port" \ |
| 9199 | -S "Client initiated reconnection from same port" |
| 9200 | |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 9201 | # Tests for various cases of client authentication with DTLS |
| 9202 | # (focused on handshake flows and message parsing) |
| 9203 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9204 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 9205 | run_test "DTLS client auth: required" \ |
| 9206 | "$P_SRV dtls=1 auth_mode=required" \ |
| 9207 | "$P_CLI dtls=1" \ |
| 9208 | 0 \ |
| 9209 | -s "Verifying peer X.509 certificate... ok" |
| 9210 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9211 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 9212 | run_test "DTLS client auth: optional, client has no cert" \ |
| 9213 | "$P_SRV dtls=1 auth_mode=optional" \ |
| 9214 | "$P_CLI dtls=1 crt_file=none key_file=none" \ |
| 9215 | 0 \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 9216 | -s "! Certificate was missing" |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 9217 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9218 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 9219 | run_test "DTLS client auth: none, client has no cert" \ |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 9220 | "$P_SRV dtls=1 auth_mode=none" \ |
| 9221 | "$P_CLI dtls=1 crt_file=none key_file=none debug_level=2" \ |
| 9222 | 0 \ |
| 9223 | -c "skip write certificate$" \ |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 9224 | -s "! Certificate verification was skipped" |
Manuel Pégourié-Gonnard | 08a1d4b | 2014-09-26 10:35:50 +0200 | [diff] [blame] | 9225 | |
Manuel Pégourié-Gonnard | 0a88574 | 2015-08-04 12:08:35 +0200 | [diff] [blame] | 9226 | run_test "DTLS wrong PSK: badmac alert" \ |
| 9227 | "$P_SRV dtls=1 psk=abc123 force_ciphersuite=TLS-PSK-WITH-AES-128-GCM-SHA256" \ |
| 9228 | "$P_CLI dtls=1 psk=abc124" \ |
| 9229 | 1 \ |
| 9230 | -s "SSL - Verification of the message MAC failed" \ |
| 9231 | -c "SSL - A fatal alert message was received from our peer" |
| 9232 | |
Manuel Pégourié-Gonnard | 502bf30 | 2014-08-20 13:12:58 +0200 | [diff] [blame] | 9233 | # Tests for receiving fragmented handshake messages with DTLS |
| 9234 | |
| 9235 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9236 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 502bf30 | 2014-08-20 13:12:58 +0200 | [diff] [blame] | 9237 | run_test "DTLS reassembly: no fragmentation (gnutls server)" \ |
| 9238 | "$G_SRV -u --mtu 2048 -a" \ |
| 9239 | "$P_CLI dtls=1 debug_level=2" \ |
| 9240 | 0 \ |
| 9241 | -C "found fragmented DTLS handshake message" \ |
| 9242 | -C "error" |
| 9243 | |
| 9244 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9245 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 502bf30 | 2014-08-20 13:12:58 +0200 | [diff] [blame] | 9246 | run_test "DTLS reassembly: some fragmentation (gnutls server)" \ |
| 9247 | "$G_SRV -u --mtu 512" \ |
| 9248 | "$P_CLI dtls=1 debug_level=2" \ |
| 9249 | 0 \ |
| 9250 | -c "found fragmented DTLS handshake message" \ |
| 9251 | -C "error" |
| 9252 | |
| 9253 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9254 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 502bf30 | 2014-08-20 13:12:58 +0200 | [diff] [blame] | 9255 | run_test "DTLS reassembly: more fragmentation (gnutls server)" \ |
| 9256 | "$G_SRV -u --mtu 128" \ |
| 9257 | "$P_CLI dtls=1 debug_level=2" \ |
| 9258 | 0 \ |
| 9259 | -c "found fragmented DTLS handshake message" \ |
| 9260 | -C "error" |
| 9261 | |
| 9262 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9263 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 502bf30 | 2014-08-20 13:12:58 +0200 | [diff] [blame] | 9264 | run_test "DTLS reassembly: more fragmentation, nbio (gnutls server)" \ |
| 9265 | "$G_SRV -u --mtu 128" \ |
| 9266 | "$P_CLI dtls=1 nbio=2 debug_level=2" \ |
| 9267 | 0 \ |
| 9268 | -c "found fragmented DTLS handshake message" \ |
| 9269 | -C "error" |
| 9270 | |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 9271 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 9272 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9273 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 9274 | run_test "DTLS reassembly: fragmentation, renego (gnutls server)" \ |
| 9275 | "$G_SRV -u --mtu 256" \ |
| 9276 | "$P_CLI debug_level=3 dtls=1 renegotiation=1 renegotiate=1" \ |
| 9277 | 0 \ |
| 9278 | -c "found fragmented DTLS handshake message" \ |
| 9279 | -c "client hello, adding renegotiation extension" \ |
| 9280 | -c "found renegotiation extension" \ |
| 9281 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 9282 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 9283 | -C "error" \ |
| 9284 | -s "Extra-header:" |
| 9285 | |
| 9286 | requires_gnutls |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 9287 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9288 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 9289 | run_test "DTLS reassembly: fragmentation, nbio, renego (gnutls server)" \ |
| 9290 | "$G_SRV -u --mtu 256" \ |
| 9291 | "$P_CLI debug_level=3 nbio=2 dtls=1 renegotiation=1 renegotiate=1" \ |
| 9292 | 0 \ |
| 9293 | -c "found fragmented DTLS handshake message" \ |
| 9294 | -c "client hello, adding renegotiation extension" \ |
| 9295 | -c "found renegotiation extension" \ |
| 9296 | -c "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 9297 | -C "mbedtls_ssl_handshake returned" \ |
Manuel Pégourié-Gonnard | 0c4cbc7 | 2014-09-02 14:47:31 +0200 | [diff] [blame] | 9298 | -C "error" \ |
| 9299 | -s "Extra-header:" |
| 9300 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9301 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 9302 | run_test "DTLS reassembly: no fragmentation (openssl server)" \ |
| 9303 | "$O_SRV -dtls -mtu 2048" \ |
| 9304 | "$P_CLI dtls=1 debug_level=2" \ |
| 9305 | 0 \ |
| 9306 | -C "found fragmented DTLS handshake message" \ |
| 9307 | -C "error" |
| 9308 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9309 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 9310 | run_test "DTLS reassembly: some fragmentation (openssl server)" \ |
Valerio Setti | 6ba247c | 2023-03-14 17:13:43 +0100 | [diff] [blame] | 9311 | "$O_SRV -dtls -mtu 256" \ |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 9312 | "$P_CLI dtls=1 debug_level=2" \ |
| 9313 | 0 \ |
| 9314 | -c "found fragmented DTLS handshake message" \ |
| 9315 | -C "error" |
| 9316 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9317 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 9318 | run_test "DTLS reassembly: more fragmentation (openssl server)" \ |
| 9319 | "$O_SRV -dtls -mtu 256" \ |
| 9320 | "$P_CLI dtls=1 debug_level=2" \ |
| 9321 | 0 \ |
| 9322 | -c "found fragmented DTLS handshake message" \ |
| 9323 | -C "error" |
| 9324 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9325 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 9326 | run_test "DTLS reassembly: fragmentation, nbio (openssl server)" \ |
| 9327 | "$O_SRV -dtls -mtu 256" \ |
| 9328 | "$P_CLI dtls=1 nbio=2 debug_level=2" \ |
| 9329 | 0 \ |
| 9330 | -c "found fragmented DTLS handshake message" \ |
| 9331 | -C "error" |
| 9332 | |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9333 | # Tests for sending fragmented handshake messages with DTLS |
| 9334 | # |
| 9335 | # Use client auth when we need the client to send large messages, |
| 9336 | # and use large cert chains on both sides too (the long chains we have all use |
| 9337 | # both RSA and ECDSA, but ideally we should have long chains with either). |
| 9338 | # Sizes reached (UDP payload): |
| 9339 | # - 2037B for server certificate |
| 9340 | # - 1542B for client certificate |
| 9341 | # - 1013B for newsessionticket |
| 9342 | # - all others below 512B |
| 9343 | # All those tests assume MAX_CONTENT_LEN is at least 2048 |
| 9344 | |
| 9345 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9346 | requires_config_enabled MBEDTLS_RSA_C |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9347 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9348 | requires_max_content_len 4096 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9349 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9350 | run_test "DTLS fragmenting: none (for reference)" \ |
| 9351 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9352 | crt_file=data_files/server7_int-ca.crt \ |
| 9353 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9354 | hs_timeout=2500-60000 \ |
Hanno Becker | 12405e7 | 2018-08-13 16:45:46 +0100 | [diff] [blame] | 9355 | max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9356 | "$P_CLI dtls=1 debug_level=2 \ |
| 9357 | crt_file=data_files/server8_int-ca2.crt \ |
| 9358 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9359 | hs_timeout=2500-60000 \ |
Hanno Becker | 12405e7 | 2018-08-13 16:45:46 +0100 | [diff] [blame] | 9360 | max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9361 | 0 \ |
| 9362 | -S "found fragmented DTLS handshake message" \ |
| 9363 | -C "found fragmented DTLS handshake message" \ |
| 9364 | -C "error" |
| 9365 | |
| 9366 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9367 | requires_config_enabled MBEDTLS_RSA_C |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9368 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9369 | requires_max_content_len 2048 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9370 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9371 | run_test "DTLS fragmenting: server only (max_frag_len)" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9372 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9373 | crt_file=data_files/server7_int-ca.crt \ |
| 9374 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9375 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9376 | max_frag_len=1024" \ |
| 9377 | "$P_CLI dtls=1 debug_level=2 \ |
| 9378 | crt_file=data_files/server8_int-ca2.crt \ |
| 9379 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9380 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9381 | max_frag_len=2048" \ |
| 9382 | 0 \ |
| 9383 | -S "found fragmented DTLS handshake message" \ |
| 9384 | -c "found fragmented DTLS handshake message" \ |
| 9385 | -C "error" |
| 9386 | |
Hanno Becker | 69ca0ad | 2018-08-24 12:11:35 +0100 | [diff] [blame] | 9387 | # With the MFL extension, the server has no way of forcing |
| 9388 | # the client to not exceed a certain MTU; hence, the following |
| 9389 | # test can't be replicated with an MTU proxy such as the one |
| 9390 | # `client-initiated, server only (max_frag_len)` below. |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9391 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9392 | requires_config_enabled MBEDTLS_RSA_C |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9393 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9394 | requires_max_content_len 4096 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9395 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9396 | run_test "DTLS fragmenting: server only (more) (max_frag_len)" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9397 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9398 | crt_file=data_files/server7_int-ca.crt \ |
| 9399 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9400 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9401 | max_frag_len=512" \ |
| 9402 | "$P_CLI dtls=1 debug_level=2 \ |
| 9403 | crt_file=data_files/server8_int-ca2.crt \ |
| 9404 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9405 | hs_timeout=2500-60000 \ |
Hanno Becker | 69ca0ad | 2018-08-24 12:11:35 +0100 | [diff] [blame] | 9406 | max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9407 | 0 \ |
| 9408 | -S "found fragmented DTLS handshake message" \ |
| 9409 | -c "found fragmented DTLS handshake message" \ |
| 9410 | -C "error" |
| 9411 | |
| 9412 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9413 | requires_config_enabled MBEDTLS_RSA_C |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9414 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9415 | requires_max_content_len 2048 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9416 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9417 | run_test "DTLS fragmenting: client-initiated, server only (max_frag_len)" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9418 | "$P_SRV dtls=1 debug_level=2 auth_mode=none \ |
| 9419 | crt_file=data_files/server7_int-ca.crt \ |
| 9420 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9421 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9422 | max_frag_len=2048" \ |
| 9423 | "$P_CLI dtls=1 debug_level=2 \ |
| 9424 | crt_file=data_files/server8_int-ca2.crt \ |
| 9425 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9426 | hs_timeout=2500-60000 \ |
| 9427 | max_frag_len=1024" \ |
| 9428 | 0 \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9429 | -S "found fragmented DTLS handshake message" \ |
| 9430 | -c "found fragmented DTLS handshake message" \ |
| 9431 | -C "error" |
| 9432 | |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 9433 | # While not required by the standard defining the MFL extension |
| 9434 | # (according to which it only applies to records, not to datagrams), |
| 9435 | # Mbed TLS will never send datagrams larger than MFL + { Max record expansion }, |
| 9436 | # as otherwise there wouldn't be any means to communicate MTU restrictions |
| 9437 | # to the peer. |
| 9438 | # The next test checks that no datagrams significantly larger than the |
| 9439 | # negotiated MFL are sent. |
| 9440 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9441 | requires_config_enabled MBEDTLS_RSA_C |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 9442 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9443 | requires_max_content_len 2048 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9444 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 9445 | run_test "DTLS fragmenting: client-initiated, server only (max_frag_len), proxy MTU" \ |
Andrzej Kurek | 0fc9cf4 | 2018-10-09 03:09:41 -0400 | [diff] [blame] | 9446 | -p "$P_PXY mtu=1110" \ |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 9447 | "$P_SRV dtls=1 debug_level=2 auth_mode=none \ |
| 9448 | crt_file=data_files/server7_int-ca.crt \ |
| 9449 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9450 | hs_timeout=2500-60000 \ |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 9451 | max_frag_len=2048" \ |
| 9452 | "$P_CLI dtls=1 debug_level=2 \ |
| 9453 | crt_file=data_files/server8_int-ca2.crt \ |
| 9454 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9455 | hs_timeout=2500-60000 \ |
| 9456 | max_frag_len=1024" \ |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 9457 | 0 \ |
| 9458 | -S "found fragmented DTLS handshake message" \ |
| 9459 | -c "found fragmented DTLS handshake message" \ |
| 9460 | -C "error" |
| 9461 | |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9462 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9463 | requires_config_enabled MBEDTLS_RSA_C |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9464 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9465 | requires_max_content_len 2048 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9466 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9467 | run_test "DTLS fragmenting: client-initiated, both (max_frag_len)" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9468 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9469 | crt_file=data_files/server7_int-ca.crt \ |
| 9470 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9471 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9472 | max_frag_len=2048" \ |
| 9473 | "$P_CLI dtls=1 debug_level=2 \ |
| 9474 | crt_file=data_files/server8_int-ca2.crt \ |
| 9475 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9476 | hs_timeout=2500-60000 \ |
| 9477 | max_frag_len=1024" \ |
Manuel Pégourié-Gonnard | 2cb17e2 | 2017-09-19 13:00:47 +0200 | [diff] [blame] | 9478 | 0 \ |
| 9479 | -s "found fragmented DTLS handshake message" \ |
| 9480 | -c "found fragmented DTLS handshake message" \ |
| 9481 | -C "error" |
| 9482 | |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 9483 | # While not required by the standard defining the MFL extension |
| 9484 | # (according to which it only applies to records, not to datagrams), |
| 9485 | # Mbed TLS will never send datagrams larger than MFL + { Max record expansion }, |
| 9486 | # as otherwise there wouldn't be any means to communicate MTU restrictions |
| 9487 | # to the peer. |
| 9488 | # The next test checks that no datagrams significantly larger than the |
| 9489 | # negotiated MFL are sent. |
| 9490 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9491 | requires_config_enabled MBEDTLS_RSA_C |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 9492 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9493 | requires_max_content_len 2048 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9494 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 9495 | run_test "DTLS fragmenting: client-initiated, both (max_frag_len), proxy MTU" \ |
Andrzej Kurek | 0fc9cf4 | 2018-10-09 03:09:41 -0400 | [diff] [blame] | 9496 | -p "$P_PXY mtu=1110" \ |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 9497 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9498 | crt_file=data_files/server7_int-ca.crt \ |
| 9499 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9500 | hs_timeout=2500-60000 \ |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 9501 | max_frag_len=2048" \ |
| 9502 | "$P_CLI dtls=1 debug_level=2 \ |
| 9503 | crt_file=data_files/server8_int-ca2.crt \ |
| 9504 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9505 | hs_timeout=2500-60000 \ |
| 9506 | max_frag_len=1024" \ |
Hanno Becker | c92b5c8 | 2018-08-24 11:48:01 +0100 | [diff] [blame] | 9507 | 0 \ |
| 9508 | -s "found fragmented DTLS handshake message" \ |
| 9509 | -c "found fragmented DTLS handshake message" \ |
| 9510 | -C "error" |
| 9511 | |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9512 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9513 | requires_config_enabled MBEDTLS_RSA_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9514 | requires_max_content_len 4096 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9515 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9516 | run_test "DTLS fragmenting: none (for reference) (MTU)" \ |
| 9517 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9518 | crt_file=data_files/server7_int-ca.crt \ |
| 9519 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9520 | hs_timeout=2500-60000 \ |
Hanno Becker | 12405e7 | 2018-08-13 16:45:46 +0100 | [diff] [blame] | 9521 | mtu=4096" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9522 | "$P_CLI dtls=1 debug_level=2 \ |
| 9523 | crt_file=data_files/server8_int-ca2.crt \ |
| 9524 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9525 | hs_timeout=2500-60000 \ |
Hanno Becker | 12405e7 | 2018-08-13 16:45:46 +0100 | [diff] [blame] | 9526 | mtu=4096" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9527 | 0 \ |
| 9528 | -S "found fragmented DTLS handshake message" \ |
| 9529 | -C "found fragmented DTLS handshake message" \ |
| 9530 | -C "error" |
| 9531 | |
| 9532 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9533 | requires_config_enabled MBEDTLS_RSA_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9534 | requires_max_content_len 4096 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9535 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9536 | run_test "DTLS fragmenting: client (MTU)" \ |
| 9537 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9538 | crt_file=data_files/server7_int-ca.crt \ |
| 9539 | key_file=data_files/server7.key \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 9540 | hs_timeout=3500-60000 \ |
Hanno Becker | 12405e7 | 2018-08-13 16:45:46 +0100 | [diff] [blame] | 9541 | mtu=4096" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9542 | "$P_CLI dtls=1 debug_level=2 \ |
| 9543 | crt_file=data_files/server8_int-ca2.crt \ |
| 9544 | key_file=data_files/server8.key \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 9545 | hs_timeout=3500-60000 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9546 | mtu=1024" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9547 | 0 \ |
| 9548 | -s "found fragmented DTLS handshake message" \ |
| 9549 | -C "found fragmented DTLS handshake message" \ |
| 9550 | -C "error" |
| 9551 | |
| 9552 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9553 | requires_config_enabled MBEDTLS_RSA_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9554 | requires_max_content_len 2048 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9555 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9556 | run_test "DTLS fragmenting: server (MTU)" \ |
| 9557 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9558 | crt_file=data_files/server7_int-ca.crt \ |
| 9559 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9560 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9561 | mtu=512" \ |
| 9562 | "$P_CLI dtls=1 debug_level=2 \ |
| 9563 | crt_file=data_files/server8_int-ca2.crt \ |
| 9564 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9565 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9566 | mtu=2048" \ |
| 9567 | 0 \ |
| 9568 | -S "found fragmented DTLS handshake message" \ |
| 9569 | -c "found fragmented DTLS handshake message" \ |
| 9570 | -C "error" |
| 9571 | |
| 9572 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9573 | requires_config_enabled MBEDTLS_RSA_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9574 | requires_max_content_len 2048 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9575 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9576 | run_test "DTLS fragmenting: both (MTU=1024)" \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9577 | -p "$P_PXY mtu=1024" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9578 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9579 | crt_file=data_files/server7_int-ca.crt \ |
| 9580 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9581 | hs_timeout=2500-60000 \ |
Andrzej Kurek | 9580528 | 2018-10-11 08:55:37 -0400 | [diff] [blame] | 9582 | mtu=1024" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9583 | "$P_CLI dtls=1 debug_level=2 \ |
| 9584 | crt_file=data_files/server8_int-ca2.crt \ |
| 9585 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9586 | hs_timeout=2500-60000 \ |
| 9587 | mtu=1024" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 9588 | 0 \ |
| 9589 | -s "found fragmented DTLS handshake message" \ |
| 9590 | -c "found fragmented DTLS handshake message" \ |
| 9591 | -C "error" |
| 9592 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 9593 | # Forcing ciphersuite for this test to fit the MTU of 512 with full config. |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9594 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9595 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 9596 | requires_hash_alg SHA_256 |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9597 | requires_config_enabled MBEDTLS_AES_C |
| 9598 | requires_config_enabled MBEDTLS_GCM_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9599 | requires_max_content_len 2048 |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9600 | run_test "DTLS fragmenting: both (MTU=512)" \ |
Hanno Becker | 8d83218 | 2018-03-15 10:14:19 +0000 | [diff] [blame] | 9601 | -p "$P_PXY mtu=512" \ |
Hanno Becker | 72a4f03 | 2017-11-15 16:39:20 +0000 | [diff] [blame] | 9602 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9603 | crt_file=data_files/server7_int-ca.crt \ |
| 9604 | key_file=data_files/server7.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9605 | hs_timeout=2500-60000 \ |
Hanno Becker | 72a4f03 | 2017-11-15 16:39:20 +0000 | [diff] [blame] | 9606 | mtu=512" \ |
| 9607 | "$P_CLI dtls=1 debug_level=2 \ |
| 9608 | crt_file=data_files/server8_int-ca2.crt \ |
| 9609 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9610 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 9611 | hs_timeout=2500-60000 \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 9612 | mtu=512" \ |
Manuel Pégourié-Gonnard | 63eca93 | 2014-09-08 16:39:08 +0200 | [diff] [blame] | 9613 | 0 \ |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 9614 | -s "found fragmented DTLS handshake message" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 9615 | -c "found fragmented DTLS handshake message" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 9616 | -C "error" |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 9617 | |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9618 | # Test for automatic MTU reduction on repeated resend. |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 9619 | # Forcing ciphersuite for this test to fit the MTU of 508 with full config. |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9620 | # The ratio of max/min timeout should ideally equal 4 to accept two |
| 9621 | # retransmissions, but in some cases (like both the server and client using |
| 9622 | # fragmentation and auto-reduction) an extra retransmission might occur, |
| 9623 | # hence the ratio of 8. |
Hanno Becker | 37029eb | 2018-08-29 17:01:40 +0100 | [diff] [blame] | 9624 | not_with_valgrind |
Manuel Pégourié-Gonnard | b8eec19 | 2018-08-20 09:34:02 +0200 | [diff] [blame] | 9625 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9626 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9627 | requires_config_enabled MBEDTLS_AES_C |
| 9628 | requires_config_enabled MBEDTLS_GCM_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9629 | requires_max_content_len 2048 |
Gilles Peskine | 0d8b86a | 2019-09-20 18:03:11 +0200 | [diff] [blame] | 9630 | run_test "DTLS fragmenting: proxy MTU: auto-reduction (not valgrind)" \ |
Manuel Pégourié-Gonnard | b8eec19 | 2018-08-20 09:34:02 +0200 | [diff] [blame] | 9631 | -p "$P_PXY mtu=508" \ |
| 9632 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9633 | crt_file=data_files/server7_int-ca.crt \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9634 | key_file=data_files/server7.key \ |
| 9635 | hs_timeout=400-3200" \ |
Manuel Pégourié-Gonnard | b8eec19 | 2018-08-20 09:34:02 +0200 | [diff] [blame] | 9636 | "$P_CLI dtls=1 debug_level=2 \ |
| 9637 | crt_file=data_files/server8_int-ca2.crt \ |
| 9638 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9639 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 9640 | hs_timeout=400-3200" \ |
Manuel Pégourié-Gonnard | b8eec19 | 2018-08-20 09:34:02 +0200 | [diff] [blame] | 9641 | 0 \ |
| 9642 | -s "found fragmented DTLS handshake message" \ |
| 9643 | -c "found fragmented DTLS handshake message" \ |
| 9644 | -C "error" |
| 9645 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 9646 | # Forcing ciphersuite for this test to fit the MTU of 508 with full config. |
Hanno Becker | 108992e | 2018-08-29 17:04:18 +0100 | [diff] [blame] | 9647 | only_with_valgrind |
| 9648 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9649 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9650 | requires_config_enabled MBEDTLS_AES_C |
| 9651 | requires_config_enabled MBEDTLS_GCM_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9652 | requires_max_content_len 2048 |
Gilles Peskine | 0d8b86a | 2019-09-20 18:03:11 +0200 | [diff] [blame] | 9653 | run_test "DTLS fragmenting: proxy MTU: auto-reduction (with valgrind)" \ |
Hanno Becker | 108992e | 2018-08-29 17:04:18 +0100 | [diff] [blame] | 9654 | -p "$P_PXY mtu=508" \ |
| 9655 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9656 | crt_file=data_files/server7_int-ca.crt \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9657 | key_file=data_files/server7.key \ |
Hanno Becker | 108992e | 2018-08-29 17:04:18 +0100 | [diff] [blame] | 9658 | hs_timeout=250-10000" \ |
| 9659 | "$P_CLI dtls=1 debug_level=2 \ |
| 9660 | crt_file=data_files/server8_int-ca2.crt \ |
| 9661 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9662 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Hanno Becker | 108992e | 2018-08-29 17:04:18 +0100 | [diff] [blame] | 9663 | hs_timeout=250-10000" \ |
| 9664 | 0 \ |
| 9665 | -s "found fragmented DTLS handshake message" \ |
| 9666 | -c "found fragmented DTLS handshake message" \ |
| 9667 | -C "error" |
| 9668 | |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9669 | # the proxy shouldn't drop or mess up anything, so we shouldn't need to resend |
Manuel Pégourié-Gonnard | 3d183ce | 2018-08-22 09:56:22 +0200 | [diff] [blame] | 9670 | # OTOH the client might resend if the server is to slow to reset after sending |
| 9671 | # a HelloVerifyRequest, so only check for no retransmission server-side |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9672 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9673 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9674 | requires_config_enabled MBEDTLS_RSA_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9675 | requires_max_content_len 2048 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9676 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9677 | run_test "DTLS fragmenting: proxy MTU, simple handshake (MTU=1024)" \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9678 | -p "$P_PXY mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9679 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9680 | crt_file=data_files/server7_int-ca.crt \ |
| 9681 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9682 | hs_timeout=10000-60000 \ |
| 9683 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9684 | "$P_CLI dtls=1 debug_level=2 \ |
| 9685 | crt_file=data_files/server8_int-ca2.crt \ |
| 9686 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9687 | hs_timeout=10000-60000 \ |
| 9688 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9689 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9690 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9691 | -s "found fragmented DTLS handshake message" \ |
| 9692 | -c "found fragmented DTLS handshake message" \ |
| 9693 | -C "error" |
| 9694 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 9695 | # Forcing ciphersuite for this test to fit the MTU of 512 with full config. |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9696 | # the proxy shouldn't drop or mess up anything, so we shouldn't need to resend |
| 9697 | # OTOH the client might resend if the server is to slow to reset after sending |
| 9698 | # a HelloVerifyRequest, so only check for no retransmission server-side |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9699 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 9700 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9701 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9702 | requires_config_enabled MBEDTLS_AES_C |
| 9703 | requires_config_enabled MBEDTLS_GCM_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9704 | requires_max_content_len 2048 |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9705 | run_test "DTLS fragmenting: proxy MTU, simple handshake (MTU=512)" \ |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 9706 | -p "$P_PXY mtu=512" \ |
| 9707 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9708 | crt_file=data_files/server7_int-ca.crt \ |
| 9709 | key_file=data_files/server7.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9710 | hs_timeout=10000-60000 \ |
| 9711 | mtu=512" \ |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 9712 | "$P_CLI dtls=1 debug_level=2 \ |
| 9713 | crt_file=data_files/server8_int-ca2.crt \ |
| 9714 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9715 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 9716 | hs_timeout=10000-60000 \ |
| 9717 | mtu=512" \ |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 9718 | 0 \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9719 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 9720 | -s "found fragmented DTLS handshake message" \ |
| 9721 | -c "found fragmented DTLS handshake message" \ |
| 9722 | -C "error" |
| 9723 | |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9724 | not_with_valgrind # spurious autoreduction due to timeout |
| 9725 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9726 | requires_config_enabled MBEDTLS_RSA_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9727 | requires_max_content_len 2048 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 9728 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9729 | run_test "DTLS fragmenting: proxy MTU, simple handshake, nbio (MTU=1024)" \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9730 | -p "$P_PXY mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9731 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9732 | crt_file=data_files/server7_int-ca.crt \ |
| 9733 | key_file=data_files/server7.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9734 | hs_timeout=10000-60000 \ |
| 9735 | mtu=1024 nbio=2" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9736 | "$P_CLI dtls=1 debug_level=2 \ |
| 9737 | crt_file=data_files/server8_int-ca2.crt \ |
| 9738 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9739 | hs_timeout=10000-60000 \ |
| 9740 | mtu=1024 nbio=2" \ |
| 9741 | 0 \ |
| 9742 | -S "autoreduction" \ |
| 9743 | -s "found fragmented DTLS handshake message" \ |
| 9744 | -c "found fragmented DTLS handshake message" \ |
| 9745 | -C "error" |
| 9746 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 9747 | # Forcing ciphersuite for this test to fit the MTU of 512 with full config. |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9748 | not_with_valgrind # spurious autoreduction due to timeout |
| 9749 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9750 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9751 | requires_config_enabled MBEDTLS_AES_C |
| 9752 | requires_config_enabled MBEDTLS_GCM_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9753 | requires_max_content_len 2048 |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9754 | run_test "DTLS fragmenting: proxy MTU, simple handshake, nbio (MTU=512)" \ |
| 9755 | -p "$P_PXY mtu=512" \ |
| 9756 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9757 | crt_file=data_files/server7_int-ca.crt \ |
| 9758 | key_file=data_files/server7.key \ |
| 9759 | hs_timeout=10000-60000 \ |
| 9760 | mtu=512 nbio=2" \ |
| 9761 | "$P_CLI dtls=1 debug_level=2 \ |
| 9762 | crt_file=data_files/server8_int-ca2.crt \ |
| 9763 | key_file=data_files/server8.key \ |
| 9764 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
| 9765 | hs_timeout=10000-60000 \ |
| 9766 | mtu=512 nbio=2" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9767 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9768 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9769 | -s "found fragmented DTLS handshake message" \ |
| 9770 | -c "found fragmented DTLS handshake message" \ |
| 9771 | -C "error" |
| 9772 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 9773 | # Forcing ciphersuite for this test to fit the MTU of 1450 with full config. |
Hanno Becker | b841b4f | 2018-08-28 10:25:51 +0100 | [diff] [blame] | 9774 | # This ensures things still work after session_reset(). |
| 9775 | # It also exercises the "resumed handshake" flow. |
Manuel Pégourié-Gonnard | 19c62f9 | 2018-08-16 10:50:39 +0200 | [diff] [blame] | 9776 | # Since we don't support reading fragmented ClientHello yet, |
| 9777 | # up the MTU to 1450 (larger than ClientHello with session ticket, |
| 9778 | # but still smaller than client's Certificate to ensure fragmentation). |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9779 | # An autoreduction on the client-side might happen if the server is |
| 9780 | # slow to reset, therefore omitting '-C "autoreduction"' below. |
Manuel Pégourié-Gonnard | 2f2d902 | 2018-08-21 12:17:54 +0200 | [diff] [blame] | 9781 | # reco_delay avoids races where the client reconnects before the server has |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9782 | # resumed listening, which would result in a spurious autoreduction. |
| 9783 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 19c62f9 | 2018-08-16 10:50:39 +0200 | [diff] [blame] | 9784 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9785 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9786 | requires_config_enabled MBEDTLS_AES_C |
| 9787 | requires_config_enabled MBEDTLS_GCM_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9788 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 19c62f9 | 2018-08-16 10:50:39 +0200 | [diff] [blame] | 9789 | run_test "DTLS fragmenting: proxy MTU, resumed handshake" \ |
| 9790 | -p "$P_PXY mtu=1450" \ |
| 9791 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9792 | crt_file=data_files/server7_int-ca.crt \ |
| 9793 | key_file=data_files/server7.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9794 | hs_timeout=10000-60000 \ |
Manuel Pégourié-Gonnard | 19c62f9 | 2018-08-16 10:50:39 +0200 | [diff] [blame] | 9795 | mtu=1450" \ |
| 9796 | "$P_CLI dtls=1 debug_level=2 \ |
| 9797 | crt_file=data_files/server8_int-ca2.crt \ |
| 9798 | key_file=data_files/server8.key \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9799 | hs_timeout=10000-60000 \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9800 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Jerry Yu | a15af37 | 2022-12-05 15:55:24 +0800 | [diff] [blame] | 9801 | mtu=1450 reconnect=1 skip_close_notify=1 reco_delay=1000" \ |
Manuel Pégourié-Gonnard | 19c62f9 | 2018-08-16 10:50:39 +0200 | [diff] [blame] | 9802 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9803 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 19c62f9 | 2018-08-16 10:50:39 +0200 | [diff] [blame] | 9804 | -s "found fragmented DTLS handshake message" \ |
| 9805 | -c "found fragmented DTLS handshake message" \ |
| 9806 | -C "error" |
| 9807 | |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9808 | # An autoreduction on the client-side might happen if the server is |
| 9809 | # slow to reset, therefore omitting '-C "autoreduction"' below. |
| 9810 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9811 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9812 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 9813 | requires_hash_alg SHA_256 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9814 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 9815 | requires_config_enabled MBEDTLS_CHACHAPOLY_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9816 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9817 | run_test "DTLS fragmenting: proxy MTU, ChachaPoly renego" \ |
| 9818 | -p "$P_PXY mtu=512" \ |
| 9819 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9820 | crt_file=data_files/server7_int-ca.crt \ |
| 9821 | key_file=data_files/server7.key \ |
| 9822 | exchanges=2 renegotiation=1 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9823 | hs_timeout=10000-60000 \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9824 | mtu=512" \ |
| 9825 | "$P_CLI dtls=1 debug_level=2 \ |
| 9826 | crt_file=data_files/server8_int-ca2.crt \ |
| 9827 | key_file=data_files/server8.key \ |
| 9828 | exchanges=2 renegotiation=1 renegotiate=1 \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9829 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9830 | hs_timeout=10000-60000 \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9831 | mtu=512" \ |
| 9832 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9833 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9834 | -s "found fragmented DTLS handshake message" \ |
| 9835 | -c "found fragmented DTLS handshake message" \ |
| 9836 | -C "error" |
| 9837 | |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9838 | # An autoreduction on the client-side might happen if the server is |
| 9839 | # slow to reset, therefore omitting '-C "autoreduction"' below. |
| 9840 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9841 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9842 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 9843 | requires_hash_alg SHA_256 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9844 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 9845 | requires_config_enabled MBEDTLS_AES_C |
| 9846 | requires_config_enabled MBEDTLS_GCM_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9847 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9848 | run_test "DTLS fragmenting: proxy MTU, AES-GCM renego" \ |
| 9849 | -p "$P_PXY mtu=512" \ |
| 9850 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9851 | crt_file=data_files/server7_int-ca.crt \ |
| 9852 | key_file=data_files/server7.key \ |
| 9853 | exchanges=2 renegotiation=1 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9854 | hs_timeout=10000-60000 \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9855 | mtu=512" \ |
| 9856 | "$P_CLI dtls=1 debug_level=2 \ |
| 9857 | crt_file=data_files/server8_int-ca2.crt \ |
| 9858 | key_file=data_files/server8.key \ |
| 9859 | exchanges=2 renegotiation=1 renegotiate=1 \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9860 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9861 | hs_timeout=10000-60000 \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9862 | mtu=512" \ |
| 9863 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9864 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9865 | -s "found fragmented DTLS handshake message" \ |
| 9866 | -c "found fragmented DTLS handshake message" \ |
| 9867 | -C "error" |
| 9868 | |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9869 | # An autoreduction on the client-side might happen if the server is |
| 9870 | # slow to reset, therefore omitting '-C "autoreduction"' below. |
| 9871 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9872 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9873 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 9874 | requires_hash_alg SHA_256 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9875 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 9876 | requires_config_enabled MBEDTLS_AES_C |
| 9877 | requires_config_enabled MBEDTLS_CCM_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9878 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9879 | run_test "DTLS fragmenting: proxy MTU, AES-CCM renego" \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9880 | -p "$P_PXY mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9881 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9882 | crt_file=data_files/server7_int-ca.crt \ |
| 9883 | key_file=data_files/server7.key \ |
| 9884 | exchanges=2 renegotiation=1 \ |
| 9885 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9886 | hs_timeout=10000-60000 \ |
| 9887 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9888 | "$P_CLI dtls=1 debug_level=2 \ |
| 9889 | crt_file=data_files/server8_int-ca2.crt \ |
| 9890 | key_file=data_files/server8.key \ |
| 9891 | exchanges=2 renegotiation=1 renegotiate=1 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9892 | hs_timeout=10000-60000 \ |
| 9893 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9894 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9895 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9896 | -s "found fragmented DTLS handshake message" \ |
| 9897 | -c "found fragmented DTLS handshake message" \ |
| 9898 | -C "error" |
| 9899 | |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9900 | # An autoreduction on the client-side might happen if the server is |
| 9901 | # slow to reset, therefore omitting '-C "autoreduction"' below. |
| 9902 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9903 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9904 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 9905 | requires_hash_alg SHA_256 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9906 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 9907 | requires_config_enabled MBEDTLS_AES_C |
| 9908 | requires_config_enabled MBEDTLS_CIPHER_MODE_CBC |
| 9909 | requires_config_enabled MBEDTLS_SSL_ENCRYPT_THEN_MAC |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9910 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9911 | run_test "DTLS fragmenting: proxy MTU, AES-CBC EtM renego" \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9912 | -p "$P_PXY mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9913 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9914 | crt_file=data_files/server7_int-ca.crt \ |
| 9915 | key_file=data_files/server7.key \ |
| 9916 | exchanges=2 renegotiation=1 \ |
| 9917 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9918 | hs_timeout=10000-60000 \ |
| 9919 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9920 | "$P_CLI dtls=1 debug_level=2 \ |
| 9921 | crt_file=data_files/server8_int-ca2.crt \ |
| 9922 | key_file=data_files/server8.key \ |
| 9923 | exchanges=2 renegotiation=1 renegotiate=1 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9924 | hs_timeout=10000-60000 \ |
| 9925 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9926 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9927 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9928 | -s "found fragmented DTLS handshake message" \ |
| 9929 | -c "found fragmented DTLS handshake message" \ |
| 9930 | -C "error" |
| 9931 | |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9932 | # An autoreduction on the client-side might happen if the server is |
| 9933 | # slow to reset, therefore omitting '-C "autoreduction"' below. |
| 9934 | not_with_valgrind # spurious autoreduction due to timeout |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9935 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9936 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 934e9cd | 2022-09-05 14:44:46 -0400 | [diff] [blame] | 9937 | requires_hash_alg SHA_256 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9938 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
| 9939 | requires_config_enabled MBEDTLS_AES_C |
| 9940 | requires_config_enabled MBEDTLS_CIPHER_MODE_CBC |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9941 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9942 | run_test "DTLS fragmenting: proxy MTU, AES-CBC non-EtM renego" \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9943 | -p "$P_PXY mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9944 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9945 | crt_file=data_files/server7_int-ca.crt \ |
| 9946 | key_file=data_files/server7.key \ |
| 9947 | exchanges=2 renegotiation=1 \ |
| 9948 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 etm=0 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9949 | hs_timeout=10000-60000 \ |
| 9950 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9951 | "$P_CLI dtls=1 debug_level=2 \ |
| 9952 | crt_file=data_files/server8_int-ca2.crt \ |
| 9953 | key_file=data_files/server8.key \ |
| 9954 | exchanges=2 renegotiation=1 renegotiate=1 \ |
Andrzej Kurek | 52f8491 | 2018-10-05 07:53:40 -0400 | [diff] [blame] | 9955 | hs_timeout=10000-60000 \ |
| 9956 | mtu=1024" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9957 | 0 \ |
Andrzej Kurek | 35f2f30 | 2018-10-09 08:52:14 -0400 | [diff] [blame] | 9958 | -S "autoreduction" \ |
Manuel Pégourié-Gonnard | 72c2707 | 2018-08-13 12:37:51 +0200 | [diff] [blame] | 9959 | -s "found fragmented DTLS handshake message" \ |
| 9960 | -c "found fragmented DTLS handshake message" \ |
| 9961 | -C "error" |
| 9962 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 9963 | # Forcing ciphersuite for this test to fit the MTU of 512 with full config. |
Manuel Pégourié-Gonnard | 2d56f0d | 2018-08-16 11:09:03 +0200 | [diff] [blame] | 9964 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9965 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9966 | requires_config_enabled MBEDTLS_AES_C |
| 9967 | requires_config_enabled MBEDTLS_GCM_C |
Manuel Pégourié-Gonnard | 2d56f0d | 2018-08-16 11:09:03 +0200 | [diff] [blame] | 9968 | client_needs_more_time 2 |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9969 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 2d56f0d | 2018-08-16 11:09:03 +0200 | [diff] [blame] | 9970 | run_test "DTLS fragmenting: proxy MTU + 3d" \ |
| 9971 | -p "$P_PXY mtu=512 drop=8 delay=8 duplicate=8" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 9972 | "$P_SRV dgram_packing=0 dtls=1 debug_level=2 auth_mode=required \ |
Manuel Pégourié-Gonnard | 2d56f0d | 2018-08-16 11:09:03 +0200 | [diff] [blame] | 9973 | crt_file=data_files/server7_int-ca.crt \ |
| 9974 | key_file=data_files/server7.key \ |
Manuel Pégourié-Gonnard | 02f3a8a | 2018-08-20 10:49:28 +0200 | [diff] [blame] | 9975 | hs_timeout=250-10000 mtu=512" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 9976 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 2d56f0d | 2018-08-16 11:09:03 +0200 | [diff] [blame] | 9977 | crt_file=data_files/server8_int-ca2.crt \ |
| 9978 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9979 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | 02f3a8a | 2018-08-20 10:49:28 +0200 | [diff] [blame] | 9980 | hs_timeout=250-10000 mtu=512" \ |
Manuel Pégourié-Gonnard | 2d56f0d | 2018-08-16 11:09:03 +0200 | [diff] [blame] | 9981 | 0 \ |
| 9982 | -s "found fragmented DTLS handshake message" \ |
| 9983 | -c "found fragmented DTLS handshake message" \ |
| 9984 | -C "error" |
| 9985 | |
Andrzej Kurek | 7782605 | 2018-10-11 07:34:08 -0400 | [diff] [blame] | 9986 | # Forcing ciphersuite for this test to fit the MTU of 512 with full config. |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 9987 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 9988 | requires_config_enabled MBEDTLS_RSA_C |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 9989 | requires_config_enabled MBEDTLS_AES_C |
| 9990 | requires_config_enabled MBEDTLS_GCM_C |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 9991 | client_needs_more_time 2 |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 9992 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 9993 | run_test "DTLS fragmenting: proxy MTU + 3d, nbio" \ |
| 9994 | -p "$P_PXY mtu=512 drop=8 delay=8 duplicate=8" \ |
| 9995 | "$P_SRV dtls=1 debug_level=2 auth_mode=required \ |
| 9996 | crt_file=data_files/server7_int-ca.crt \ |
| 9997 | key_file=data_files/server7.key \ |
| 9998 | hs_timeout=250-10000 mtu=512 nbio=2" \ |
| 9999 | "$P_CLI dtls=1 debug_level=2 \ |
| 10000 | crt_file=data_files/server8_int-ca2.crt \ |
| 10001 | key_file=data_files/server8.key \ |
Andrzej Kurek | 7311c78 | 2018-10-11 06:49:41 -0400 | [diff] [blame] | 10002 | force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ |
Manuel Pégourié-Gonnard | c1d54b7 | 2018-08-22 10:02:59 +0200 | [diff] [blame] | 10003 | hs_timeout=250-10000 mtu=512 nbio=2" \ |
| 10004 | 0 \ |
| 10005 | -s "found fragmented DTLS handshake message" \ |
| 10006 | -c "found fragmented DTLS handshake message" \ |
| 10007 | -C "error" |
| 10008 | |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 10009 | # interop tests for DTLS fragmentating with reliable connection |
| 10010 | # |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 10011 | # here and below we just want to test that the we fragment in a way that |
| 10012 | # pleases other implementations, so we don't need the peer to fragment |
| 10013 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 10014 | requires_config_enabled MBEDTLS_RSA_C |
Manuel Pégourié-Gonnard | 6151298 | 2018-08-21 09:40:07 +0200 | [diff] [blame] | 10015 | requires_gnutls |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 10016 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 10017 | run_test "DTLS fragmenting: gnutls server, DTLS 1.2" \ |
| 10018 | "$G_SRV -u" \ |
| 10019 | "$P_CLI dtls=1 debug_level=2 \ |
| 10020 | crt_file=data_files/server8_int-ca2.crt \ |
| 10021 | key_file=data_files/server8.key \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 10022 | mtu=512 force_version=dtls12" \ |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 10023 | 0 \ |
| 10024 | -c "fragmenting handshake message" \ |
| 10025 | -C "error" |
| 10026 | |
Hanno Becker | b9a0086 | 2018-08-28 10:20:22 +0100 | [diff] [blame] | 10027 | # We use --insecure for the GnuTLS client because it expects |
| 10028 | # the hostname / IP it connects to to be the name used in the |
| 10029 | # certificate obtained from the server. Here, however, it |
| 10030 | # connects to 127.0.0.1 while our test certificates use 'localhost' |
| 10031 | # as the server name in the certificate. This will make the |
Shaun Case | 8b0ecbc | 2021-12-20 21:14:10 -0800 | [diff] [blame] | 10032 | # certificate validation fail, but passing --insecure makes |
Hanno Becker | b9a0086 | 2018-08-28 10:20:22 +0100 | [diff] [blame] | 10033 | # GnuTLS continue the connection nonetheless. |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 10034 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 10035 | requires_config_enabled MBEDTLS_RSA_C |
Manuel Pégourié-Gonnard | 6151298 | 2018-08-21 09:40:07 +0200 | [diff] [blame] | 10036 | requires_gnutls |
Andrzej Kurek | b459346 | 2018-10-11 08:43:30 -0400 | [diff] [blame] | 10037 | requires_not_i686 |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 10038 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 10039 | run_test "DTLS fragmenting: gnutls client, DTLS 1.2" \ |
Valerio Setti | 3b2c028 | 2023-03-08 10:22:29 +0100 | [diff] [blame] | 10040 | "$P_SRV dtls=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 10041 | crt_file=data_files/server7_int-ca.crt \ |
| 10042 | key_file=data_files/server7.key \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 10043 | mtu=512 force_version=dtls12" \ |
Manuel Pégourié-Gonnard | 34aa187 | 2018-08-23 19:07:15 +0200 | [diff] [blame] | 10044 | "$G_CLI -u --insecure 127.0.0.1" \ |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 10045 | 0 \ |
| 10046 | -s "fragmenting handshake message" |
| 10047 | |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 10048 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 10049 | requires_config_enabled MBEDTLS_RSA_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 10050 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 10051 | run_test "DTLS fragmenting: openssl server, DTLS 1.2" \ |
| 10052 | "$O_SRV -dtls1_2 -verify 10" \ |
| 10053 | "$P_CLI dtls=1 debug_level=2 \ |
| 10054 | crt_file=data_files/server8_int-ca2.crt \ |
| 10055 | key_file=data_files/server8.key \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 10056 | mtu=512 force_version=dtls12" \ |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 10057 | 0 \ |
| 10058 | -c "fragmenting handshake message" \ |
| 10059 | -C "error" |
| 10060 | |
| 10061 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 10062 | requires_config_enabled MBEDTLS_RSA_C |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 10063 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 10064 | run_test "DTLS fragmenting: openssl client, DTLS 1.2" \ |
| 10065 | "$P_SRV dtls=1 debug_level=2 \ |
| 10066 | crt_file=data_files/server7_int-ca.crt \ |
| 10067 | key_file=data_files/server7.key \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 10068 | mtu=512 force_version=dtls12" \ |
Manuel Pégourié-Gonnard | 1218bc0 | 2018-08-17 10:51:26 +0200 | [diff] [blame] | 10069 | "$O_CLI -dtls1_2" \ |
| 10070 | 0 \ |
| 10071 | -s "fragmenting handshake message" |
| 10072 | |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 10073 | # interop tests for DTLS fragmentating with unreliable connection |
| 10074 | # |
| 10075 | # again we just want to test that the we fragment in a way that |
| 10076 | # pleases other implementations, so we don't need the peer to fragment |
| 10077 | requires_gnutls_next |
| 10078 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 10079 | requires_config_enabled MBEDTLS_RSA_C |
Manuel Pégourié-Gonnard | 02f3a8a | 2018-08-20 10:49:28 +0200 | [diff] [blame] | 10080 | client_needs_more_time 4 |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 10081 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 10082 | run_test "DTLS fragmenting: 3d, gnutls server, DTLS 1.2" \ |
| 10083 | -p "$P_PXY drop=8 delay=8 duplicate=8" \ |
| 10084 | "$G_NEXT_SRV -u" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10085 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 10086 | crt_file=data_files/server8_int-ca2.crt \ |
| 10087 | key_file=data_files/server8.key \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 10088 | hs_timeout=250-60000 mtu=512 force_version=dtls12" \ |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 10089 | 0 \ |
| 10090 | -c "fragmenting handshake message" \ |
| 10091 | -C "error" |
| 10092 | |
| 10093 | requires_gnutls_next |
| 10094 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 10095 | requires_config_enabled MBEDTLS_RSA_C |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 10096 | client_needs_more_time 4 |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 10097 | requires_max_content_len 2048 |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 10098 | run_test "DTLS fragmenting: 3d, gnutls client, DTLS 1.2" \ |
| 10099 | -p "$P_PXY drop=8 delay=8 duplicate=8" \ |
| 10100 | "$P_SRV dtls=1 debug_level=2 \ |
| 10101 | crt_file=data_files/server7_int-ca.crt \ |
| 10102 | key_file=data_files/server7.key \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 10103 | hs_timeout=250-60000 mtu=512 force_version=dtls12" \ |
k-stachowiak | 17a38d3 | 2019-02-18 15:29:56 +0100 | [diff] [blame] | 10104 | "$G_NEXT_CLI -u --insecure 127.0.0.1" \ |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 10105 | 0 \ |
| 10106 | -s "fragmenting handshake message" |
| 10107 | |
Zhangsen Wang | 9138512 | 2022-07-12 01:48:17 +0000 | [diff] [blame] | 10108 | ## The test below requires 1.1.1a or higher version of openssl, otherwise |
| 10109 | ## it might trigger a bug due to openssl server (https://github.com/openssl/openssl/issues/6902) |
Zhangsen Wang | 87a9c86 | 2022-06-28 06:10:35 +0000 | [diff] [blame] | 10110 | requires_openssl_next |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 10111 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 10112 | requires_config_enabled MBEDTLS_RSA_C |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 10113 | client_needs_more_time 4 |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 10114 | requires_max_content_len 2048 |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 10115 | run_test "DTLS fragmenting: 3d, openssl server, DTLS 1.2" \ |
| 10116 | -p "$P_PXY drop=8 delay=8 duplicate=8" \ |
Zhangsen Wang | 87a9c86 | 2022-06-28 06:10:35 +0000 | [diff] [blame] | 10117 | "$O_NEXT_SRV -dtls1_2 -verify 10" \ |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 10118 | "$P_CLI dtls=1 debug_level=2 \ |
| 10119 | crt_file=data_files/server8_int-ca2.crt \ |
| 10120 | key_file=data_files/server8.key \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 10121 | hs_timeout=250-60000 mtu=512 force_version=dtls12" \ |
Hanno Becker | 3b8b40c | 2018-08-28 10:25:41 +0100 | [diff] [blame] | 10122 | 0 \ |
| 10123 | -c "fragmenting handshake message" \ |
| 10124 | -C "error" |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 10125 | |
Zhangsen Wang | d5e8a48 | 2022-07-29 07:53:36 +0000 | [diff] [blame] | 10126 | ## the test below will time out with certain seed. |
Zhangsen Wang | baeffbb | 2022-07-29 06:34:47 +0000 | [diff] [blame] | 10127 | ## The cause is an openssl bug (https://github.com/openssl/openssl/issues/18887) |
| 10128 | skip_next_test |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 10129 | requires_config_enabled MBEDTLS_SSL_PROTO_DTLS |
| 10130 | requires_config_enabled MBEDTLS_RSA_C |
Manuel Pégourié-Gonnard | c1eda67 | 2018-09-03 10:41:49 +0200 | [diff] [blame] | 10131 | client_needs_more_time 4 |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 10132 | requires_max_content_len 2048 |
Manuel Pégourié-Gonnard | c1eda67 | 2018-09-03 10:41:49 +0200 | [diff] [blame] | 10133 | run_test "DTLS fragmenting: 3d, openssl client, DTLS 1.2" \ |
| 10134 | -p "$P_PXY drop=8 delay=8 duplicate=8" \ |
| 10135 | "$P_SRV dtls=1 debug_level=2 \ |
| 10136 | crt_file=data_files/server7_int-ca.crt \ |
| 10137 | key_file=data_files/server7.key \ |
Xiaofei Bai | 8b5c382 | 2021-12-02 08:43:35 +0000 | [diff] [blame] | 10138 | hs_timeout=250-60000 mtu=512 force_version=dtls12" \ |
Manuel Pégourié-Gonnard | c1eda67 | 2018-09-03 10:41:49 +0200 | [diff] [blame] | 10139 | "$O_CLI -dtls1_2" \ |
| 10140 | 0 \ |
| 10141 | -s "fragmenting handshake message" |
Manuel Pégourié-Gonnard | 38110df | 2018-08-17 12:44:54 +0200 | [diff] [blame] | 10142 | |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10143 | # Tests for DTLS-SRTP (RFC 5764) |
| 10144 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10145 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10146 | run_test "DTLS-SRTP all profiles supported" \ |
| 10147 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
| 10148 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 10149 | 0 \ |
| 10150 | -s "found use_srtp extension" \ |
| 10151 | -s "found srtp profile" \ |
| 10152 | -s "selected srtp profile" \ |
| 10153 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10154 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10155 | -c "client hello, adding use_srtp extension" \ |
| 10156 | -c "found use_srtp extension" \ |
| 10157 | -c "found srtp profile" \ |
| 10158 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10159 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 10160 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10161 | -C "error" |
| 10162 | |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 10163 | |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10164 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10165 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10166 | run_test "DTLS-SRTP server supports all profiles. Client supports one profile." \ |
| 10167 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10168 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=5 debug_level=3" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10169 | 0 \ |
| 10170 | -s "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10171 | -s "found srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80" \ |
| 10172 | -s "selected srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10173 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10174 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10175 | -c "client hello, adding use_srtp extension" \ |
| 10176 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10177 | -c "found srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10178 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10179 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 10180 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10181 | -C "error" |
| 10182 | |
| 10183 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10184 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10185 | run_test "DTLS-SRTP server supports one profile. Client supports all profiles." \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10186 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=6 debug_level=3" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10187 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 10188 | 0 \ |
| 10189 | -s "found use_srtp extension" \ |
| 10190 | -s "found srtp profile" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10191 | -s "selected srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10192 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10193 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10194 | -c "client hello, adding use_srtp extension" \ |
| 10195 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10196 | -c "found srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10197 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10198 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 10199 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10200 | -C "error" |
| 10201 | |
| 10202 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10203 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10204 | run_test "DTLS-SRTP server and Client support only one matching profile." \ |
| 10205 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 10206 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 10207 | 0 \ |
| 10208 | -s "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10209 | -s "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
| 10210 | -s "selected srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10211 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10212 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10213 | -c "client hello, adding use_srtp extension" \ |
| 10214 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10215 | -c "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10216 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10217 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 10218 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10219 | -C "error" |
| 10220 | |
| 10221 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10222 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10223 | run_test "DTLS-SRTP server and Client support only one different profile." \ |
| 10224 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10225 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=6 debug_level=3" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10226 | 0 \ |
| 10227 | -s "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10228 | -s "found srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32" \ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10229 | -S "selected srtp profile" \ |
| 10230 | -S "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10231 | -S "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10232 | -c "client hello, adding use_srtp extension" \ |
| 10233 | -C "found use_srtp extension" \ |
| 10234 | -C "found srtp profile" \ |
| 10235 | -C "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10236 | -C "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10237 | -C "error" |
| 10238 | |
| 10239 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10240 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10241 | run_test "DTLS-SRTP server doesn't support use_srtp extension." \ |
| 10242 | "$P_SRV dtls=1 debug_level=3" \ |
| 10243 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 10244 | 0 \ |
| 10245 | -s "found use_srtp extension" \ |
| 10246 | -S "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10247 | -S "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10248 | -c "client hello, adding use_srtp extension" \ |
| 10249 | -C "found use_srtp extension" \ |
| 10250 | -C "found srtp profile" \ |
| 10251 | -C "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10252 | -C "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10253 | -C "error" |
| 10254 | |
| 10255 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10256 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10257 | run_test "DTLS-SRTP all profiles supported. mki used" \ |
| 10258 | "$P_SRV dtls=1 use_srtp=1 support_mki=1 debug_level=3" \ |
| 10259 | "$P_CLI dtls=1 use_srtp=1 mki=542310ab34290481 debug_level=3" \ |
| 10260 | 0 \ |
| 10261 | -s "found use_srtp extension" \ |
| 10262 | -s "found srtp profile" \ |
| 10263 | -s "selected srtp profile" \ |
| 10264 | -s "server hello, adding use_srtp extension" \ |
| 10265 | -s "dumping 'using mki' (8 bytes)" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10266 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10267 | -c "client hello, adding use_srtp extension" \ |
| 10268 | -c "found use_srtp extension" \ |
| 10269 | -c "found srtp profile" \ |
| 10270 | -c "selected srtp profile" \ |
| 10271 | -c "dumping 'sending mki' (8 bytes)" \ |
| 10272 | -c "dumping 'received mki' (8 bytes)" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10273 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 10274 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Johan Pascal | 20c7db3 | 2020-10-26 22:45:58 +0100 | [diff] [blame] | 10275 | -g "find_in_both '^ *DTLS-SRTP mki value: [0-9A-F]*$'"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10276 | -C "error" |
| 10277 | |
| 10278 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10279 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10280 | run_test "DTLS-SRTP all profiles supported. server doesn't support mki." \ |
| 10281 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
| 10282 | "$P_CLI dtls=1 use_srtp=1 mki=542310ab34290481 debug_level=3" \ |
| 10283 | 0 \ |
| 10284 | -s "found use_srtp extension" \ |
| 10285 | -s "found srtp profile" \ |
| 10286 | -s "selected srtp profile" \ |
| 10287 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10288 | -s "DTLS-SRTP key material is"\ |
Johan Pascal | 5ef72d2 | 2020-10-28 17:05:47 +0100 | [diff] [blame] | 10289 | -s "DTLS-SRTP no mki value negotiated"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10290 | -S "dumping 'using mki' (8 bytes)" \ |
| 10291 | -c "client hello, adding use_srtp extension" \ |
| 10292 | -c "found use_srtp extension" \ |
| 10293 | -c "found srtp profile" \ |
| 10294 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10295 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 5ef72d2 | 2020-10-28 17:05:47 +0100 | [diff] [blame] | 10296 | -c "DTLS-SRTP no mki value negotiated"\ |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 10297 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 10298 | -c "dumping 'sending mki' (8 bytes)" \ |
| 10299 | -C "dumping 'received mki' (8 bytes)" \ |
| 10300 | -C "error" |
| 10301 | |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10302 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10303 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10304 | run_test "DTLS-SRTP all profiles supported. openssl client." \ |
| 10305 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
| 10306 | "$O_CLI -dtls -use_srtp SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10307 | 0 \ |
| 10308 | -s "found use_srtp extension" \ |
| 10309 | -s "found srtp profile" \ |
| 10310 | -s "selected srtp profile" \ |
| 10311 | -s "server hello, adding use_srtp extension" \ |
| 10312 | -s "DTLS-SRTP key material is"\ |
| 10313 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
| 10314 | -c "SRTP Extension negotiated, profile=SRTP_AES128_CM_SHA1_80" |
| 10315 | |
| 10316 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10317 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10318 | run_test "DTLS-SRTP server supports all profiles. Client supports all profiles, in different order. openssl client." \ |
| 10319 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
| 10320 | "$O_CLI -dtls -use_srtp SRTP_AES128_CM_SHA1_32:SRTP_AES128_CM_SHA1_80 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10321 | 0 \ |
| 10322 | -s "found use_srtp extension" \ |
| 10323 | -s "found srtp profile" \ |
| 10324 | -s "selected srtp profile" \ |
| 10325 | -s "server hello, adding use_srtp extension" \ |
| 10326 | -s "DTLS-SRTP key material is"\ |
| 10327 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
| 10328 | -c "SRTP Extension negotiated, profile=SRTP_AES128_CM_SHA1_32" |
| 10329 | |
| 10330 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10331 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10332 | run_test "DTLS-SRTP server supports all profiles. Client supports one profile. openssl client." \ |
| 10333 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
| 10334 | "$O_CLI -dtls -use_srtp SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10335 | 0 \ |
| 10336 | -s "found use_srtp extension" \ |
| 10337 | -s "found srtp profile" \ |
| 10338 | -s "selected srtp profile" \ |
| 10339 | -s "server hello, adding use_srtp extension" \ |
| 10340 | -s "DTLS-SRTP key material is"\ |
| 10341 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
| 10342 | -c "SRTP Extension negotiated, profile=SRTP_AES128_CM_SHA1_32" |
| 10343 | |
| 10344 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10345 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10346 | run_test "DTLS-SRTP server supports one profile. Client supports all profiles. openssl client." \ |
| 10347 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 10348 | "$O_CLI -dtls -use_srtp SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10349 | 0 \ |
| 10350 | -s "found use_srtp extension" \ |
| 10351 | -s "found srtp profile" \ |
| 10352 | -s "selected srtp profile" \ |
| 10353 | -s "server hello, adding use_srtp extension" \ |
| 10354 | -s "DTLS-SRTP key material is"\ |
| 10355 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
| 10356 | -c "SRTP Extension negotiated, profile=SRTP_AES128_CM_SHA1_32" |
| 10357 | |
| 10358 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10359 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10360 | run_test "DTLS-SRTP server and Client support only one matching profile. openssl client." \ |
| 10361 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 10362 | "$O_CLI -dtls -use_srtp SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10363 | 0 \ |
| 10364 | -s "found use_srtp extension" \ |
| 10365 | -s "found srtp profile" \ |
| 10366 | -s "selected srtp profile" \ |
| 10367 | -s "server hello, adding use_srtp extension" \ |
| 10368 | -s "DTLS-SRTP key material is"\ |
| 10369 | -g "find_in_both '^ *Keying material: [0-9A-F]*$'"\ |
| 10370 | -c "SRTP Extension negotiated, profile=SRTP_AES128_CM_SHA1_32" |
| 10371 | |
| 10372 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10373 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10374 | run_test "DTLS-SRTP server and Client support only one different profile. openssl client." \ |
| 10375 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=1 debug_level=3" \ |
| 10376 | "$O_CLI -dtls -use_srtp SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10377 | 0 \ |
| 10378 | -s "found use_srtp extension" \ |
| 10379 | -s "found srtp profile" \ |
| 10380 | -S "selected srtp profile" \ |
| 10381 | -S "server hello, adding use_srtp extension" \ |
| 10382 | -S "DTLS-SRTP key material is"\ |
| 10383 | -C "SRTP Extension negotiated, profile" |
| 10384 | |
| 10385 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10386 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10387 | run_test "DTLS-SRTP server doesn't support use_srtp extension. openssl client" \ |
| 10388 | "$P_SRV dtls=1 debug_level=3" \ |
| 10389 | "$O_CLI -dtls -use_srtp SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10390 | 0 \ |
| 10391 | -s "found use_srtp extension" \ |
| 10392 | -S "server hello, adding use_srtp extension" \ |
| 10393 | -S "DTLS-SRTP key material is"\ |
| 10394 | -C "SRTP Extension negotiated, profile" |
| 10395 | |
| 10396 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10397 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10398 | run_test "DTLS-SRTP all profiles supported. openssl server" \ |
| 10399 | "$O_SRV -dtls -verify 0 -use_srtp SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10400 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 10401 | 0 \ |
| 10402 | -c "client hello, adding use_srtp extension" \ |
| 10403 | -c "found use_srtp extension" \ |
| 10404 | -c "found srtp profile" \ |
| 10405 | -c "selected srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80" \ |
| 10406 | -c "DTLS-SRTP key material is"\ |
| 10407 | -C "error" |
| 10408 | |
| 10409 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10410 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10411 | run_test "DTLS-SRTP server supports all profiles. Client supports all profiles, in different order. openssl server." \ |
| 10412 | "$O_SRV -dtls -verify 0 -use_srtp SRTP_AES128_CM_SHA1_32:SRTP_AES128_CM_SHA1_80 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10413 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 10414 | 0 \ |
| 10415 | -c "client hello, adding use_srtp extension" \ |
| 10416 | -c "found use_srtp extension" \ |
| 10417 | -c "found srtp profile" \ |
| 10418 | -c "selected srtp profile" \ |
| 10419 | -c "DTLS-SRTP key material is"\ |
| 10420 | -C "error" |
| 10421 | |
| 10422 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10423 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10424 | run_test "DTLS-SRTP server supports all profiles. Client supports one profile. openssl server." \ |
| 10425 | "$O_SRV -dtls -verify 0 -use_srtp SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10426 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 10427 | 0 \ |
| 10428 | -c "client hello, adding use_srtp extension" \ |
| 10429 | -c "found use_srtp extension" \ |
| 10430 | -c "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
| 10431 | -c "selected srtp profile" \ |
| 10432 | -c "DTLS-SRTP key material is"\ |
| 10433 | -C "error" |
| 10434 | |
| 10435 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10436 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10437 | run_test "DTLS-SRTP server supports one profile. Client supports all profiles. openssl server." \ |
| 10438 | "$O_SRV -dtls -verify 0 -use_srtp SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10439 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 10440 | 0 \ |
| 10441 | -c "client hello, adding use_srtp extension" \ |
| 10442 | -c "found use_srtp extension" \ |
| 10443 | -c "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
| 10444 | -c "selected srtp profile" \ |
| 10445 | -c "DTLS-SRTP key material is"\ |
| 10446 | -C "error" |
| 10447 | |
| 10448 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10449 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10450 | run_test "DTLS-SRTP server and Client support only one matching profile. openssl server." \ |
| 10451 | "$O_SRV -dtls -verify 0 -use_srtp SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10452 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 10453 | 0 \ |
| 10454 | -c "client hello, adding use_srtp extension" \ |
| 10455 | -c "found use_srtp extension" \ |
| 10456 | -c "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
| 10457 | -c "selected srtp profile" \ |
| 10458 | -c "DTLS-SRTP key material is"\ |
| 10459 | -C "error" |
| 10460 | |
| 10461 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10462 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10463 | run_test "DTLS-SRTP server and Client support only one different profile. openssl server." \ |
| 10464 | "$O_SRV -dtls -verify 0 -use_srtp SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10465 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=6 debug_level=3" \ |
| 10466 | 0 \ |
| 10467 | -c "client hello, adding use_srtp extension" \ |
| 10468 | -C "found use_srtp extension" \ |
| 10469 | -C "found srtp profile" \ |
| 10470 | -C "selected srtp profile" \ |
| 10471 | -C "DTLS-SRTP key material is"\ |
| 10472 | -C "error" |
| 10473 | |
| 10474 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10475 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10476 | run_test "DTLS-SRTP server doesn't support use_srtp extension. openssl server" \ |
| 10477 | "$O_SRV -dtls" \ |
| 10478 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 10479 | 0 \ |
| 10480 | -c "client hello, adding use_srtp extension" \ |
| 10481 | -C "found use_srtp extension" \ |
| 10482 | -C "found srtp profile" \ |
| 10483 | -C "selected srtp profile" \ |
| 10484 | -C "DTLS-SRTP key material is"\ |
| 10485 | -C "error" |
| 10486 | |
| 10487 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10488 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 10489 | run_test "DTLS-SRTP all profiles supported. server doesn't support mki. openssl server." \ |
| 10490 | "$O_SRV -dtls -verify 0 -use_srtp SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32 -keymatexport 'EXTRACTOR-dtls_srtp' -keymatexportlen 60" \ |
| 10491 | "$P_CLI dtls=1 use_srtp=1 mki=542310ab34290481 debug_level=3" \ |
| 10492 | 0 \ |
| 10493 | -c "client hello, adding use_srtp extension" \ |
| 10494 | -c "found use_srtp extension" \ |
| 10495 | -c "found srtp profile" \ |
| 10496 | -c "selected srtp profile" \ |
| 10497 | -c "DTLS-SRTP key material is"\ |
| 10498 | -c "DTLS-SRTP no mki value negotiated"\ |
| 10499 | -c "dumping 'sending mki' (8 bytes)" \ |
| 10500 | -C "dumping 'received mki' (8 bytes)" \ |
| 10501 | -C "error" |
| 10502 | |
| 10503 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10504 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10505 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10506 | run_test "DTLS-SRTP all profiles supported. gnutls client." \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10507 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
| 10508 | "$G_CLI -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_80:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10509 | 0 \ |
| 10510 | -s "found use_srtp extension" \ |
| 10511 | -s "found srtp profile" \ |
| 10512 | -s "selected srtp profile" \ |
| 10513 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10514 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10515 | -c "SRTP profile: SRTP_AES128_CM_HMAC_SHA1_80" |
| 10516 | |
| 10517 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10518 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10519 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10520 | run_test "DTLS-SRTP server supports all profiles. Client supports all profiles, in different order. gnutls client." \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10521 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
| 10522 | "$G_CLI -u --srtp-profiles=SRTP_NULL_HMAC_SHA1_80:SRTP_AES128_CM_HMAC_SHA1_80:SRTP_NULL_SHA1_32:SRTP_AES128_CM_HMAC_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10523 | 0 \ |
| 10524 | -s "found use_srtp extension" \ |
| 10525 | -s "found srtp profile" \ |
| 10526 | -s "selected srtp profile" \ |
| 10527 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10528 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10529 | -c "SRTP profile: SRTP_NULL_HMAC_SHA1_80" |
| 10530 | |
| 10531 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10532 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10533 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10534 | run_test "DTLS-SRTP server supports all profiles. Client supports one profile. gnutls client." \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10535 | "$P_SRV dtls=1 use_srtp=1 debug_level=3" \ |
| 10536 | "$G_CLI -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10537 | 0 \ |
| 10538 | -s "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10539 | -s "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
| 10540 | -s "selected srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10541 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10542 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10543 | -c "SRTP profile: SRTP_AES128_CM_HMAC_SHA1_32" |
| 10544 | |
| 10545 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10546 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10547 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10548 | run_test "DTLS-SRTP server supports one profile. Client supports all profiles. gnutls client." \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10549 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=6 debug_level=3" \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10550 | "$G_CLI -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_80:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10551 | 0 \ |
| 10552 | -s "found use_srtp extension" \ |
| 10553 | -s "found srtp profile" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10554 | -s "selected srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10555 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10556 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10557 | -c "SRTP profile: SRTP_NULL_SHA1_32" |
| 10558 | |
| 10559 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10560 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10561 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10562 | run_test "DTLS-SRTP server and Client support only one matching profile. gnutls client." \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10563 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 10564 | "$G_CLI -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10565 | 0 \ |
| 10566 | -s "found use_srtp extension" \ |
| 10567 | -s "found srtp profile" \ |
| 10568 | -s "selected srtp profile" \ |
| 10569 | -s "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10570 | -s "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10571 | -c "SRTP profile: SRTP_AES128_CM_HMAC_SHA1_32" |
| 10572 | |
| 10573 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10574 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10575 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10576 | run_test "DTLS-SRTP server and Client support only one different profile. gnutls client." \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10577 | "$P_SRV dtls=1 use_srtp=1 srtp_force_profile=1 debug_level=3" \ |
| 10578 | "$G_CLI -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10579 | 0 \ |
| 10580 | -s "found use_srtp extension" \ |
| 10581 | -s "found srtp profile" \ |
| 10582 | -S "selected srtp profile" \ |
| 10583 | -S "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10584 | -S "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10585 | -C "SRTP profile:" |
| 10586 | |
| 10587 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10588 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10589 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10590 | run_test "DTLS-SRTP server doesn't support use_srtp extension. gnutls client" \ |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10591 | "$P_SRV dtls=1 debug_level=3" \ |
| 10592 | "$G_CLI -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_80:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32 --insecure 127.0.0.1" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10593 | 0 \ |
| 10594 | -s "found use_srtp extension" \ |
| 10595 | -S "server hello, adding use_srtp extension" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10596 | -S "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10597 | -C "SRTP profile:" |
| 10598 | |
| 10599 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10600 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10601 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10602 | run_test "DTLS-SRTP all profiles supported. gnutls server" \ |
| 10603 | "$G_SRV -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_80:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32" \ |
| 10604 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 10605 | 0 \ |
| 10606 | -c "client hello, adding use_srtp extension" \ |
| 10607 | -c "found use_srtp extension" \ |
| 10608 | -c "found srtp profile" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10609 | -c "selected srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10610 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10611 | -C "error" |
| 10612 | |
| 10613 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10614 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10615 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10616 | run_test "DTLS-SRTP server supports all profiles. Client supports all profiles, in different order. gnutls server." \ |
| 10617 | "$G_SRV -u --srtp-profiles=SRTP_NULL_SHA1_32:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_AES128_CM_HMAC_SHA1_80:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32" \ |
| 10618 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 10619 | 0 \ |
| 10620 | -c "client hello, adding use_srtp extension" \ |
| 10621 | -c "found use_srtp extension" \ |
| 10622 | -c "found srtp profile" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10623 | -c "selected srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10624 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10625 | -C "error" |
| 10626 | |
| 10627 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10628 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10629 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10630 | run_test "DTLS-SRTP server supports all profiles. Client supports one profile. gnutls server." \ |
| 10631 | "$G_SRV -u --srtp-profiles=SRTP_NULL_SHA1_32:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_AES128_CM_HMAC_SHA1_80:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32" \ |
| 10632 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 10633 | 0 \ |
| 10634 | -c "client hello, adding use_srtp extension" \ |
| 10635 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10636 | -c "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10637 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10638 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10639 | -C "error" |
| 10640 | |
| 10641 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10642 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10643 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10644 | run_test "DTLS-SRTP server supports one profile. Client supports all profiles. gnutls server." \ |
| 10645 | "$G_SRV -u --srtp-profiles=SRTP_NULL_HMAC_SHA1_80" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10646 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10647 | 0 \ |
| 10648 | -c "client hello, adding use_srtp extension" \ |
| 10649 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10650 | -c "found srtp profile: MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10651 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10652 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10653 | -C "error" |
| 10654 | |
| 10655 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10656 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10657 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10658 | run_test "DTLS-SRTP server and Client support only one matching profile. gnutls server." \ |
| 10659 | "$G_SRV -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_32" \ |
| 10660 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=2 debug_level=3" \ |
| 10661 | 0 \ |
| 10662 | -c "client hello, adding use_srtp extension" \ |
| 10663 | -c "found use_srtp extension" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10664 | -c "found srtp profile: MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10665 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10666 | -c "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10667 | -C "error" |
| 10668 | |
| 10669 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10670 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10671 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10672 | run_test "DTLS-SRTP server and Client support only one different profile. gnutls server." \ |
| 10673 | "$G_SRV -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_32" \ |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 10674 | "$P_CLI dtls=1 use_srtp=1 srtp_force_profile=6 debug_level=3" \ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10675 | 0 \ |
| 10676 | -c "client hello, adding use_srtp extension" \ |
| 10677 | -C "found use_srtp extension" \ |
| 10678 | -C "found srtp profile" \ |
| 10679 | -C "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10680 | -C "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10681 | -C "error" |
| 10682 | |
| 10683 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10684 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10685 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10686 | run_test "DTLS-SRTP server doesn't support use_srtp extension. gnutls server" \ |
| 10687 | "$G_SRV -u" \ |
| 10688 | "$P_CLI dtls=1 use_srtp=1 debug_level=3" \ |
| 10689 | 0 \ |
| 10690 | -c "client hello, adding use_srtp extension" \ |
| 10691 | -C "found use_srtp extension" \ |
| 10692 | -C "found srtp profile" \ |
| 10693 | -C "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10694 | -C "DTLS-SRTP key material is"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10695 | -C "error" |
| 10696 | |
| 10697 | requires_config_enabled MBEDTLS_SSL_DTLS_SRTP |
Ron Eldor | 5d991c9 | 2019-01-15 18:54:03 +0200 | [diff] [blame] | 10698 | requires_gnutls |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10699 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10700 | run_test "DTLS-SRTP all profiles supported. mki used. gnutls server." \ |
| 10701 | "$G_SRV -u --srtp-profiles=SRTP_AES128_CM_HMAC_SHA1_80:SRTP_AES128_CM_HMAC_SHA1_32:SRTP_NULL_HMAC_SHA1_80:SRTP_NULL_SHA1_32" \ |
| 10702 | "$P_CLI dtls=1 use_srtp=1 mki=542310ab34290481 debug_level=3" \ |
| 10703 | 0 \ |
| 10704 | -c "client hello, adding use_srtp extension" \ |
| 10705 | -c "found use_srtp extension" \ |
| 10706 | -c "found srtp profile" \ |
| 10707 | -c "selected srtp profile" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 10708 | -c "DTLS-SRTP key material is"\ |
Johan Pascal | 20c7db3 | 2020-10-26 22:45:58 +0100 | [diff] [blame] | 10709 | -c "DTLS-SRTP mki value:"\ |
Ron Eldor | 3c6a44b | 2018-07-10 10:32:10 +0300 | [diff] [blame] | 10710 | -c "dumping 'sending mki' (8 bytes)" \ |
| 10711 | -c "dumping 'received mki' (8 bytes)" \ |
| 10712 | -C "error" |
| 10713 | |
Manuel Pégourié-Gonnard | 64dffc5 | 2014-09-02 13:39:16 +0200 | [diff] [blame] | 10714 | # Tests for specific things with "unreliable" UDP connection |
| 10715 | |
| 10716 | not_with_valgrind # spurious resend due to timeout |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10717 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 64dffc5 | 2014-09-02 13:39:16 +0200 | [diff] [blame] | 10718 | run_test "DTLS proxy: reference" \ |
| 10719 | -p "$P_PXY" \ |
Manuel Pégourié-Gonnard | b692989 | 2019-09-09 11:14:37 +0200 | [diff] [blame] | 10720 | "$P_SRV dtls=1 debug_level=2 hs_timeout=10000-20000" \ |
| 10721 | "$P_CLI dtls=1 debug_level=2 hs_timeout=10000-20000" \ |
Manuel Pégourié-Gonnard | 64dffc5 | 2014-09-02 13:39:16 +0200 | [diff] [blame] | 10722 | 0 \ |
| 10723 | -C "replayed record" \ |
| 10724 | -S "replayed record" \ |
Hanno Becker | b2a86c3 | 2019-07-19 15:43:09 +0100 | [diff] [blame] | 10725 | -C "Buffer record from epoch" \ |
| 10726 | -S "Buffer record from epoch" \ |
| 10727 | -C "ssl_buffer_message" \ |
| 10728 | -S "ssl_buffer_message" \ |
Manuel Pégourié-Gonnard | a775617 | 2014-08-31 18:37:01 +0200 | [diff] [blame] | 10729 | -C "discarding invalid record" \ |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 10730 | -S "discarding invalid record" \ |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 10731 | -S "resend" \ |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 10732 | -s "Extra-header:" \ |
Manuel Pégourié-Gonnard | be9eb87 | 2014-09-05 17:45:19 +0200 | [diff] [blame] | 10733 | -c "HTTP/1.0 200 OK" |
| 10734 | |
| 10735 | not_with_valgrind # spurious resend due to timeout |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10736 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 10737 | run_test "DTLS proxy: duplicate every packet" \ |
| 10738 | -p "$P_PXY duplicate=1" \ |
Manuel Pégourié-Gonnard | b692989 | 2019-09-09 11:14:37 +0200 | [diff] [blame] | 10739 | "$P_SRV dtls=1 dgram_packing=0 debug_level=2 hs_timeout=10000-20000" \ |
| 10740 | "$P_CLI dtls=1 dgram_packing=0 debug_level=2 hs_timeout=10000-20000" \ |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 10741 | 0 \ |
| 10742 | -c "replayed record" \ |
| 10743 | -s "replayed record" \ |
| 10744 | -c "record from another epoch" \ |
| 10745 | -s "record from another epoch" \ |
| 10746 | -S "resend" \ |
| 10747 | -s "Extra-header:" \ |
| 10748 | -c "HTTP/1.0 200 OK" |
| 10749 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10750 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 990f9e4 | 2014-09-06 12:27:02 +0200 | [diff] [blame] | 10751 | run_test "DTLS proxy: duplicate every packet, server anti-replay off" \ |
| 10752 | -p "$P_PXY duplicate=1" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10753 | "$P_SRV dtls=1 dgram_packing=0 debug_level=2 anti_replay=0" \ |
| 10754 | "$P_CLI dtls=1 dgram_packing=0 debug_level=2" \ |
Manuel Pégourié-Gonnard | 63eca93 | 2014-09-08 16:39:08 +0200 | [diff] [blame] | 10755 | 0 \ |
| 10756 | -c "replayed record" \ |
| 10757 | -S "replayed record" \ |
| 10758 | -c "record from another epoch" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10759 | -s "record from another epoch" \ |
| 10760 | -c "resend" \ |
| 10761 | -s "resend" \ |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 10762 | -s "Extra-header:" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10763 | -c "HTTP/1.0 200 OK" |
| 10764 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10765 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 10766 | run_test "DTLS proxy: multiple records in same datagram" \ |
| 10767 | -p "$P_PXY pack=50" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10768 | "$P_SRV dtls=1 dgram_packing=0 debug_level=2" \ |
| 10769 | "$P_CLI dtls=1 dgram_packing=0 debug_level=2" \ |
Manuel Pégourié-Gonnard | 63eca93 | 2014-09-08 16:39:08 +0200 | [diff] [blame] | 10770 | 0 \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10771 | -c "next record in same datagram" \ |
| 10772 | -s "next record in same datagram" |
| 10773 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10774 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10775 | run_test "DTLS proxy: multiple records in same datagram, duplicate every packet" \ |
| 10776 | -p "$P_PXY pack=50 duplicate=1" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10777 | "$P_SRV dtls=1 dgram_packing=0 debug_level=2" \ |
| 10778 | "$P_CLI dtls=1 dgram_packing=0 debug_level=2" \ |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 10779 | 0 \ |
| 10780 | -c "next record in same datagram" \ |
| 10781 | -s "next record in same datagram" |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10782 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10783 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 63eca93 | 2014-09-08 16:39:08 +0200 | [diff] [blame] | 10784 | run_test "DTLS proxy: inject invalid AD record, default badmac_limit" \ |
| 10785 | -p "$P_PXY bad_ad=1" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10786 | "$P_SRV dtls=1 dgram_packing=0 debug_level=1" \ |
| 10787 | "$P_CLI dtls=1 dgram_packing=0 debug_level=1 read_timeout=100" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10788 | 0 \ |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 10789 | -c "discarding invalid record (mac)" \ |
| 10790 | -s "discarding invalid record (mac)" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10791 | -s "Extra-header:" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10792 | -c "HTTP/1.0 200 OK" \ |
| 10793 | -S "too many records with bad MAC" \ |
| 10794 | -S "Verification of the message MAC failed" |
| 10795 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10796 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10797 | run_test "DTLS proxy: inject invalid AD record, badmac_limit 1" \ |
| 10798 | -p "$P_PXY bad_ad=1" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10799 | "$P_SRV dtls=1 dgram_packing=0 debug_level=1 badmac_limit=1" \ |
| 10800 | "$P_CLI dtls=1 dgram_packing=0 debug_level=1 read_timeout=100" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10801 | 1 \ |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 10802 | -C "discarding invalid record (mac)" \ |
| 10803 | -S "discarding invalid record (mac)" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10804 | -S "Extra-header:" \ |
| 10805 | -C "HTTP/1.0 200 OK" \ |
| 10806 | -s "too many records with bad MAC" \ |
| 10807 | -s "Verification of the message MAC failed" |
| 10808 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10809 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10810 | run_test "DTLS proxy: inject invalid AD record, badmac_limit 2" \ |
| 10811 | -p "$P_PXY bad_ad=1" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10812 | "$P_SRV dtls=1 dgram_packing=0 debug_level=1 badmac_limit=2" \ |
| 10813 | "$P_CLI dtls=1 dgram_packing=0 debug_level=1 read_timeout=100" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10814 | 0 \ |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 10815 | -c "discarding invalid record (mac)" \ |
| 10816 | -s "discarding invalid record (mac)" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10817 | -s "Extra-header:" \ |
| 10818 | -c "HTTP/1.0 200 OK" \ |
| 10819 | -S "too many records with bad MAC" \ |
| 10820 | -S "Verification of the message MAC failed" |
| 10821 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10822 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10823 | run_test "DTLS proxy: inject invalid AD record, badmac_limit 2, exchanges 2"\ |
| 10824 | -p "$P_PXY bad_ad=1" \ |
Hanno Becker | 1c9a24c | 2018-08-14 13:46:33 +0100 | [diff] [blame] | 10825 | "$P_SRV dtls=1 dgram_packing=0 debug_level=1 badmac_limit=2 exchanges=2" \ |
| 10826 | "$P_CLI dtls=1 dgram_packing=0 debug_level=1 read_timeout=100 exchanges=2" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10827 | 1 \ |
Manuel Pégourié-Gonnard | 74a1378 | 2014-10-14 22:34:08 +0200 | [diff] [blame] | 10828 | -c "discarding invalid record (mac)" \ |
| 10829 | -s "discarding invalid record (mac)" \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 10830 | -s "Extra-header:" \ |
| 10831 | -c "HTTP/1.0 200 OK" \ |
| 10832 | -s "too many records with bad MAC" \ |
| 10833 | -s "Verification of the message MAC failed" |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10834 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10835 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10836 | run_test "DTLS proxy: delay ChangeCipherSpec" \ |
| 10837 | -p "$P_PXY delay_ccs=1" \ |
Hanno Becker | c430523 | 2018-08-14 13:41:21 +0100 | [diff] [blame] | 10838 | "$P_SRV dtls=1 debug_level=1 dgram_packing=0" \ |
| 10839 | "$P_CLI dtls=1 debug_level=1 dgram_packing=0" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10840 | 0 \ |
Manuel Pégourié-Gonnard | 246c13a | 2014-09-24 13:56:09 +0200 | [diff] [blame] | 10841 | -c "record from another epoch" \ |
| 10842 | -s "record from another epoch" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 10843 | -s "Extra-header:" \ |
| 10844 | -c "HTTP/1.0 200 OK" |
| 10845 | |
Hanno Becker | aa5d0c4 | 2018-08-16 13:15:19 +0100 | [diff] [blame] | 10846 | # Tests for reordering support with DTLS |
| 10847 | |
Gilles Peskine | 6f160ca | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10848 | requires_certificate_authentication |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10849 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10850 | run_test "DTLS reordering: Buffer out-of-order handshake message on client" \ |
| 10851 | -p "$P_PXY delay_srv=ServerHello" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10852 | "$P_SRV dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10853 | hs_timeout=2500-60000" \ |
| 10854 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10855 | hs_timeout=2500-60000" \ |
Hanno Becker | e384221 | 2018-08-16 15:28:59 +0100 | [diff] [blame] | 10856 | 0 \ |
| 10857 | -c "Buffering HS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10858 | -c "Next handshake message has been buffered - load"\ |
| 10859 | -S "Buffering HS message" \ |
| 10860 | -S "Next handshake message has been buffered - load"\ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10861 | -C "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10862 | -C "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10863 | -S "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10864 | -S "Remember CCS message" |
Hanno Becker | e384221 | 2018-08-16 15:28:59 +0100 | [diff] [blame] | 10865 | |
Gilles Peskine | 6f160ca | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10866 | requires_certificate_authentication |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10867 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | dc1e950 | 2018-08-28 16:02:33 +0100 | [diff] [blame] | 10868 | run_test "DTLS reordering: Buffer out-of-order handshake message fragment on client" \ |
| 10869 | -p "$P_PXY delay_srv=ServerHello" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10870 | "$P_SRV mtu=512 dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10871 | hs_timeout=2500-60000" \ |
| 10872 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10873 | hs_timeout=2500-60000" \ |
Hanno Becker | dc1e950 | 2018-08-28 16:02:33 +0100 | [diff] [blame] | 10874 | 0 \ |
| 10875 | -c "Buffering HS message" \ |
| 10876 | -c "found fragmented DTLS handshake message"\ |
| 10877 | -c "Next handshake message 1 not or only partially bufffered" \ |
| 10878 | -c "Next handshake message has been buffered - load"\ |
| 10879 | -S "Buffering HS message" \ |
| 10880 | -S "Next handshake message has been buffered - load"\ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10881 | -C "Injecting buffered CCS message" \ |
Hanno Becker | dc1e950 | 2018-08-28 16:02:33 +0100 | [diff] [blame] | 10882 | -C "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10883 | -S "Injecting buffered CCS message" \ |
Hanno Becker | aa5d0c4 | 2018-08-16 13:15:19 +0100 | [diff] [blame] | 10884 | -S "Remember CCS message" |
| 10885 | |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10886 | # The client buffers the ServerKeyExchange before receiving the fragmented |
| 10887 | # Certificate message; at the time of writing, together these are aroudn 1200b |
| 10888 | # in size, so that the bound below ensures that the certificate can be reassembled |
| 10889 | # while keeping the ServerKeyExchange. |
Gilles Peskine | 6f160ca | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10890 | requires_certificate_authentication |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10891 | requires_config_value_at_least "MBEDTLS_SSL_DTLS_MAX_BUFFERING" 1300 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10892 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10893 | run_test "DTLS reordering: Buffer out-of-order hs msg before reassembling next" \ |
Hanno Becker | e356705 | 2018-08-21 16:50:43 +0100 | [diff] [blame] | 10894 | -p "$P_PXY delay_srv=Certificate delay_srv=Certificate" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10895 | "$P_SRV mtu=512 dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10896 | hs_timeout=2500-60000" \ |
| 10897 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10898 | hs_timeout=2500-60000" \ |
Hanno Becker | e356705 | 2018-08-21 16:50:43 +0100 | [diff] [blame] | 10899 | 0 \ |
| 10900 | -c "Buffering HS message" \ |
| 10901 | -c "Next handshake message has been buffered - load"\ |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10902 | -C "attempt to make space by freeing buffered messages" \ |
| 10903 | -S "Buffering HS message" \ |
| 10904 | -S "Next handshake message has been buffered - load"\ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10905 | -C "Injecting buffered CCS message" \ |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10906 | -C "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10907 | -S "Injecting buffered CCS message" \ |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10908 | -S "Remember CCS message" |
| 10909 | |
| 10910 | # The size constraints ensure that the delayed certificate message can't |
| 10911 | # be reassembled while keeping the ServerKeyExchange message, but it can |
| 10912 | # when dropping it first. |
Gilles Peskine | 6f160ca | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10913 | requires_certificate_authentication |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10914 | requires_config_value_at_least "MBEDTLS_SSL_DTLS_MAX_BUFFERING" 900 |
| 10915 | requires_config_value_at_most "MBEDTLS_SSL_DTLS_MAX_BUFFERING" 1299 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10916 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10917 | run_test "DTLS reordering: Buffer out-of-order hs msg before reassembling next, free buffered msg" \ |
| 10918 | -p "$P_PXY delay_srv=Certificate delay_srv=Certificate" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10919 | "$P_SRV mtu=512 dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10920 | hs_timeout=2500-60000" \ |
| 10921 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10922 | hs_timeout=2500-60000" \ |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10923 | 0 \ |
| 10924 | -c "Buffering HS message" \ |
| 10925 | -c "attempt to make space by freeing buffered future messages" \ |
| 10926 | -c "Enough space available after freeing buffered HS messages" \ |
Hanno Becker | e356705 | 2018-08-21 16:50:43 +0100 | [diff] [blame] | 10927 | -S "Buffering HS message" \ |
| 10928 | -S "Next handshake message has been buffered - load"\ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10929 | -C "Injecting buffered CCS message" \ |
Hanno Becker | e356705 | 2018-08-21 16:50:43 +0100 | [diff] [blame] | 10930 | -C "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10931 | -S "Injecting buffered CCS message" \ |
Hanno Becker | e356705 | 2018-08-21 16:50:43 +0100 | [diff] [blame] | 10932 | -S "Remember CCS message" |
| 10933 | |
Gilles Peskine | 6f160ca | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10934 | requires_certificate_authentication |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10935 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10936 | run_test "DTLS reordering: Buffer out-of-order handshake message on server" \ |
| 10937 | -p "$P_PXY delay_cli=Certificate" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10938 | "$P_SRV dgram_packing=0 auth_mode=required cookies=0 dtls=1 debug_level=2 \ |
| 10939 | hs_timeout=2500-60000" \ |
| 10940 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10941 | hs_timeout=2500-60000" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10942 | 0 \ |
| 10943 | -C "Buffering HS message" \ |
| 10944 | -C "Next handshake message has been buffered - load"\ |
| 10945 | -s "Buffering HS message" \ |
| 10946 | -s "Next handshake message has been buffered - load" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10947 | -C "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10948 | -C "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10949 | -S "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10950 | -S "Remember CCS message" |
| 10951 | |
Gilles Peskine | 6f160ca | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10952 | requires_certificate_authentication |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10953 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10954 | run_test "DTLS reordering: Buffer out-of-order CCS message on client"\ |
| 10955 | -p "$P_PXY delay_srv=NewSessionTicket" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10956 | "$P_SRV dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10957 | hs_timeout=2500-60000" \ |
| 10958 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10959 | hs_timeout=2500-60000" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10960 | 0 \ |
| 10961 | -C "Buffering HS message" \ |
| 10962 | -C "Next handshake message has been buffered - load"\ |
| 10963 | -S "Buffering HS message" \ |
| 10964 | -S "Next handshake message has been buffered - load" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10965 | -c "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10966 | -c "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10967 | -S "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10968 | -S "Remember CCS message" |
| 10969 | |
Gilles Peskine | 6f160ca | 2022-03-14 18:21:24 +0100 | [diff] [blame] | 10970 | requires_certificate_authentication |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10971 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10972 | run_test "DTLS reordering: Buffer out-of-order CCS message on server"\ |
| 10973 | -p "$P_PXY delay_cli=ClientKeyExchange" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10974 | "$P_SRV dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10975 | hs_timeout=2500-60000" \ |
| 10976 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10977 | hs_timeout=2500-60000" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10978 | 0 \ |
| 10979 | -C "Buffering HS message" \ |
| 10980 | -C "Next handshake message has been buffered - load"\ |
| 10981 | -S "Buffering HS message" \ |
| 10982 | -S "Next handshake message has been buffered - load" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10983 | -C "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10984 | -C "Remember CCS message" \ |
Hanno Becker | 39b8bc9 | 2018-08-28 17:17:13 +0100 | [diff] [blame] | 10985 | -s "Injecting buffered CCS message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10986 | -s "Remember CCS message" |
| 10987 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 10988 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 10989 | run_test "DTLS reordering: Buffer encrypted Finished message" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10990 | -p "$P_PXY delay_ccs=1" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 10991 | "$P_SRV dgram_packing=0 cookies=0 dtls=1 debug_level=2 \ |
| 10992 | hs_timeout=2500-60000" \ |
| 10993 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 \ |
| 10994 | hs_timeout=2500-60000" \ |
Hanno Becker | b34149c | 2018-08-16 15:29:06 +0100 | [diff] [blame] | 10995 | 0 \ |
| 10996 | -s "Buffer record from epoch 1" \ |
Hanno Becker | 56cdfd1 | 2018-08-17 13:42:15 +0100 | [diff] [blame] | 10997 | -s "Found buffered record from current epoch - load" \ |
| 10998 | -c "Buffer record from epoch 1" \ |
| 10999 | -c "Found buffered record from current epoch - load" |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 11000 | |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 11001 | # In this test, both the fragmented NewSessionTicket and the ChangeCipherSpec |
| 11002 | # from the server are delayed, so that the encrypted Finished message |
| 11003 | # is received and buffered. When the fragmented NewSessionTicket comes |
| 11004 | # in afterwards, the encrypted Finished message must be freed in order |
| 11005 | # to make space for the NewSessionTicket to be reassembled. |
| 11006 | # This works only in very particular circumstances: |
| 11007 | # - MBEDTLS_SSL_DTLS_MAX_BUFFERING must be large enough to allow buffering |
| 11008 | # of the NewSessionTicket, but small enough to also allow buffering of |
| 11009 | # the encrypted Finished message. |
| 11010 | # - The MTU setting on the server must be so small that the NewSessionTicket |
| 11011 | # needs to be fragmented. |
| 11012 | # - All messages sent by the server must be small enough to be either sent |
| 11013 | # without fragmentation or be reassembled within the bounds of |
| 11014 | # MBEDTLS_SSL_DTLS_MAX_BUFFERING. Achieve this by testing with a PSK-based |
| 11015 | # handshake, omitting CRTs. |
Manuel Pégourié-Gonnard | eef4c75 | 2019-05-28 10:21:30 +0200 | [diff] [blame] | 11016 | requires_config_value_at_least "MBEDTLS_SSL_DTLS_MAX_BUFFERING" 190 |
| 11017 | requires_config_value_at_most "MBEDTLS_SSL_DTLS_MAX_BUFFERING" 230 |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 11018 | run_test "DTLS reordering: Buffer encrypted Finished message, drop for fragmented NewSessionTicket" \ |
| 11019 | -p "$P_PXY delay_srv=NewSessionTicket delay_srv=NewSessionTicket delay_ccs=1" \ |
Manuel Pégourié-Gonnard | eef4c75 | 2019-05-28 10:21:30 +0200 | [diff] [blame] | 11020 | "$P_SRV mtu=140 response_size=90 dgram_packing=0 psk=abc123 psk_identity=foo cookies=0 dtls=1 debug_level=2" \ |
Hanno Becker | a1adcca | 2018-08-24 14:41:07 +0100 | [diff] [blame] | 11021 | "$P_CLI dgram_packing=0 dtls=1 debug_level=2 force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8 psk=abc123 psk_identity=foo" \ |
| 11022 | 0 \ |
| 11023 | -s "Buffer record from epoch 1" \ |
| 11024 | -s "Found buffered record from current epoch - load" \ |
| 11025 | -c "Buffer record from epoch 1" \ |
| 11026 | -C "Found buffered record from current epoch - load" \ |
| 11027 | -c "Enough space available after freeing future epoch record" |
| 11028 | |
Manuel Pégourié-Gonnard | a071972 | 2014-09-20 12:46:27 +0200 | [diff] [blame] | 11029 | # Tests for "randomly unreliable connection": try a variety of flows and peers |
| 11030 | |
| 11031 | client_needs_more_time 2 |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 11032 | run_test "DTLS proxy: 3d (drop, delay, duplicate), \"short\" PSK handshake" \ |
| 11033 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11034 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 11035 | psk=abc123" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11036 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=abc123 \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 11037 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 11038 | 0 \ |
| 11039 | -s "Extra-header:" \ |
| 11040 | -c "HTTP/1.0 200 OK" |
| 11041 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11042 | client_needs_more_time 2 |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 11043 | run_test "DTLS proxy: 3d, \"short\" RSA handshake" \ |
| 11044 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11045 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none" \ |
| 11046 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 11047 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 11048 | 0 \ |
| 11049 | -s "Extra-header:" \ |
| 11050 | -c "HTTP/1.0 200 OK" |
| 11051 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11052 | client_needs_more_time 2 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 11053 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 11054 | run_test "DTLS proxy: 3d, \"short\" (no ticket, no cli_auth) FS handshake" \ |
| 11055 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11056 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none" \ |
| 11057 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0" \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 11058 | 0 \ |
| 11059 | -s "Extra-header:" \ |
| 11060 | -c "HTTP/1.0 200 OK" |
| 11061 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11062 | client_needs_more_time 2 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 11063 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 11064 | run_test "DTLS proxy: 3d, FS, client auth" \ |
| 11065 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11066 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=required" \ |
| 11067 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0" \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 11068 | 0 \ |
| 11069 | -s "Extra-header:" \ |
| 11070 | -c "HTTP/1.0 200 OK" |
| 11071 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11072 | client_needs_more_time 2 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 11073 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 11074 | run_test "DTLS proxy: 3d, FS, ticket" \ |
| 11075 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11076 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=1 auth_mode=none" \ |
| 11077 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=1" \ |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 11078 | 0 \ |
| 11079 | -s "Extra-header:" \ |
| 11080 | -c "HTTP/1.0 200 OK" |
| 11081 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11082 | client_needs_more_time 2 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 11083 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 18e519a | 2014-09-24 19:09:17 +0200 | [diff] [blame] | 11084 | run_test "DTLS proxy: 3d, max handshake (FS, ticket + client auth)" \ |
| 11085 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11086 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=1 auth_mode=required" \ |
| 11087 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=1" \ |
Manuel Pégourié-Gonnard | 825a49e | 2014-09-23 11:00:37 +0200 | [diff] [blame] | 11088 | 0 \ |
| 11089 | -s "Extra-header:" \ |
| 11090 | -c "HTTP/1.0 200 OK" |
| 11091 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11092 | client_needs_more_time 2 |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 11093 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 11094 | run_test "DTLS proxy: 3d, max handshake, nbio" \ |
| 11095 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11096 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 nbio=2 tickets=1 \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 11097 | auth_mode=required" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11098 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 nbio=2 tickets=1" \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 11099 | 0 \ |
| 11100 | -s "Extra-header:" \ |
| 11101 | -c "HTTP/1.0 200 OK" |
| 11102 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11103 | client_needs_more_time 4 |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 11104 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 7a26d73 | 2014-10-02 14:50:46 +0200 | [diff] [blame] | 11105 | run_test "DTLS proxy: 3d, min handshake, resumption" \ |
| 11106 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11107 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Manuel Pégourié-Gonnard | 7a26d73 | 2014-10-02 14:50:46 +0200 | [diff] [blame] | 11108 | psk=abc123 debug_level=3" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11109 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=abc123 \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 11110 | debug_level=3 reconnect=1 skip_close_notify=1 read_timeout=1000 max_resend=10 \ |
Manuel Pégourié-Gonnard | 7a26d73 | 2014-10-02 14:50:46 +0200 | [diff] [blame] | 11111 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 11112 | 0 \ |
| 11113 | -s "a session has been resumed" \ |
| 11114 | -c "a session has been resumed" \ |
| 11115 | -s "Extra-header:" \ |
| 11116 | -c "HTTP/1.0 200 OK" |
| 11117 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11118 | client_needs_more_time 4 |
Gilles Peskine | 2fe796f | 2022-02-25 19:51:52 +0100 | [diff] [blame] | 11119 | requires_config_enabled MBEDTLS_SSL_CACHE_C |
Manuel Pégourié-Gonnard | 85beb30 | 2014-10-02 17:59:19 +0200 | [diff] [blame] | 11120 | run_test "DTLS proxy: 3d, min handshake, resumption, nbio" \ |
| 11121 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11122 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Manuel Pégourié-Gonnard | 85beb30 | 2014-10-02 17:59:19 +0200 | [diff] [blame] | 11123 | psk=abc123 debug_level=3 nbio=2" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11124 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=abc123 \ |
Manuel Pégourié-Gonnard | 56941fe | 2020-02-17 11:04:33 +0100 | [diff] [blame] | 11125 | debug_level=3 reconnect=1 skip_close_notify=1 read_timeout=1000 max_resend=10 \ |
Manuel Pégourié-Gonnard | 85beb30 | 2014-10-02 17:59:19 +0200 | [diff] [blame] | 11126 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8 nbio=2" \ |
| 11127 | 0 \ |
| 11128 | -s "a session has been resumed" \ |
| 11129 | -c "a session has been resumed" \ |
| 11130 | -s "Extra-header:" \ |
| 11131 | -c "HTTP/1.0 200 OK" |
| 11132 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11133 | client_needs_more_time 4 |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 11134 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 11135 | run_test "DTLS proxy: 3d, min handshake, client-initiated renego" \ |
Manuel Pégourié-Gonnard | 1b753f1 | 2014-09-25 16:09:36 +0200 | [diff] [blame] | 11136 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11137 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 11138 | psk=abc123 renegotiation=1 debug_level=2" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11139 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=abc123 \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 11140 | renegotiate=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 1b753f1 | 2014-09-25 16:09:36 +0200 | [diff] [blame] | 11141 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 11142 | 0 \ |
| 11143 | -c "=> renegotiate" \ |
| 11144 | -s "=> renegotiate" \ |
| 11145 | -s "Extra-header:" \ |
| 11146 | -c "HTTP/1.0 200 OK" |
| 11147 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11148 | client_needs_more_time 4 |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 11149 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 11150 | run_test "DTLS proxy: 3d, min handshake, client-initiated renego, nbio" \ |
| 11151 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11152 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 11153 | psk=abc123 renegotiation=1 debug_level=2" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11154 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=abc123 \ |
Manuel Pégourié-Gonnard | 37a4de2 | 2014-10-01 16:38:03 +0200 | [diff] [blame] | 11155 | renegotiate=1 debug_level=2 \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 11156 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 11157 | 0 \ |
| 11158 | -c "=> renegotiate" \ |
| 11159 | -s "=> renegotiate" \ |
| 11160 | -s "Extra-header:" \ |
| 11161 | -c "HTTP/1.0 200 OK" |
| 11162 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11163 | client_needs_more_time 4 |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 11164 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 11165 | run_test "DTLS proxy: 3d, min handshake, server-initiated renego" \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 11166 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11167 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 11168 | psk=abc123 renegotiate=1 renegotiation=1 exchanges=4 \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 11169 | debug_level=2" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11170 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=abc123 \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 11171 | renegotiation=1 exchanges=4 debug_level=2 \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 11172 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 11173 | 0 \ |
| 11174 | -c "=> renegotiate" \ |
| 11175 | -s "=> renegotiate" \ |
| 11176 | -s "Extra-header:" \ |
| 11177 | -c "HTTP/1.0 200 OK" |
| 11178 | |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11179 | client_needs_more_time 4 |
Hanno Becker | 6a24364 | 2017-10-12 15:18:45 +0100 | [diff] [blame] | 11180 | requires_config_enabled MBEDTLS_SSL_RENEGOTIATION |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 11181 | run_test "DTLS proxy: 3d, min handshake, server-initiated renego, nbio" \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 11182 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11183 | "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 auth_mode=none \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 11184 | psk=abc123 renegotiate=1 renegotiation=1 exchanges=4 \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 11185 | debug_level=2 nbio=2" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11186 | "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 tickets=0 psk=abc123 \ |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 11187 | renegotiation=1 exchanges=4 debug_level=2 nbio=2 \ |
Manuel Pégourié-Gonnard | ba958b8 | 2014-10-09 16:13:44 +0200 | [diff] [blame] | 11188 | force_ciphersuite=TLS-PSK-WITH-AES-128-CCM-8" \ |
| 11189 | 0 \ |
| 11190 | -c "=> renegotiate" \ |
| 11191 | -s "=> renegotiate" \ |
| 11192 | -s "Extra-header:" \ |
| 11193 | -c "HTTP/1.0 200 OK" |
| 11194 | |
Zhangsen Wang | 87a9c86 | 2022-06-28 06:10:35 +0000 | [diff] [blame] | 11195 | ## The three tests below require 1.1.1a or higher version of openssl, otherwise |
| 11196 | ## it might trigger a bug due to openssl (https://github.com/openssl/openssl/issues/6902) |
| 11197 | ## Besides, openssl should use dtls1_2 or dtls, otherwise it will cause "SSL alert number 70" error |
| 11198 | requires_openssl_next |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11199 | client_needs_more_time 6 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 11200 | not_with_valgrind # risk of non-mbedtls peer timing out |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 11201 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 11202 | run_test "DTLS proxy: 3d, openssl server" \ |
Manuel Pégourié-Gonnard | d0fd1da | 2014-09-25 17:00:27 +0200 | [diff] [blame] | 11203 | -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \ |
Valerio Setti | 2f8eb62 | 2023-03-16 13:04:44 +0100 | [diff] [blame] | 11204 | "$O_NEXT_SRV -dtls1_2 -mtu 2048" \ |
| 11205 | "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 tickets=0" \ |
Manuel Pégourié-Gonnard | d0fd1da | 2014-09-25 17:00:27 +0200 | [diff] [blame] | 11206 | 0 \ |
Manuel Pégourié-Gonnard | d0fd1da | 2014-09-25 17:00:27 +0200 | [diff] [blame] | 11207 | -c "HTTP/1.0 200 OK" |
| 11208 | |
Zhangsen Wang | 87a9c86 | 2022-06-28 06:10:35 +0000 | [diff] [blame] | 11209 | requires_openssl_next |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11210 | client_needs_more_time 8 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 11211 | not_with_valgrind # risk of non-mbedtls peer timing out |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 11212 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 11213 | run_test "DTLS proxy: 3d, openssl server, fragmentation" \ |
| 11214 | -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \ |
Zhangsen Wang | 87a9c86 | 2022-06-28 06:10:35 +0000 | [diff] [blame] | 11215 | "$O_NEXT_SRV -dtls1_2 -mtu 768" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11216 | "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 tickets=0" \ |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 11217 | 0 \ |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 11218 | -c "HTTP/1.0 200 OK" |
| 11219 | |
Zhangsen Wang | 87a9c86 | 2022-06-28 06:10:35 +0000 | [diff] [blame] | 11220 | requires_openssl_next |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11221 | client_needs_more_time 8 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 11222 | not_with_valgrind # risk of non-mbedtls peer timing out |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 11223 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 11224 | run_test "DTLS proxy: 3d, openssl server, fragmentation, nbio" \ |
| 11225 | -p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \ |
Zhangsen Wang | 87a9c86 | 2022-06-28 06:10:35 +0000 | [diff] [blame] | 11226 | "$O_NEXT_SRV -dtls1_2 -mtu 768" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11227 | "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 nbio=2 tickets=0" \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 11228 | 0 \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 11229 | -c "HTTP/1.0 200 OK" |
| 11230 | |
Manuel Pégourié-Gonnard | 9699996 | 2015-02-17 16:02:37 +0000 | [diff] [blame] | 11231 | requires_gnutls |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11232 | client_needs_more_time 6 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 11233 | not_with_valgrind # risk of non-mbedtls peer timing out |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 11234 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 11235 | run_test "DTLS proxy: 3d, gnutls server" \ |
| 11236 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
| 11237 | "$G_SRV -u --mtu 2048 -a" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11238 | "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000" \ |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 11239 | 0 \ |
| 11240 | -s "Extra-header:" \ |
| 11241 | -c "Extra-header:" |
| 11242 | |
k-stachowiak | 17a38d3 | 2019-02-18 15:29:56 +0100 | [diff] [blame] | 11243 | requires_gnutls_next |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11244 | client_needs_more_time 8 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 11245 | not_with_valgrind # risk of non-mbedtls peer timing out |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 11246 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 11247 | run_test "DTLS proxy: 3d, gnutls server, fragmentation" \ |
| 11248 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
k-stachowiak | 17a38d3 | 2019-02-18 15:29:56 +0100 | [diff] [blame] | 11249 | "$G_NEXT_SRV -u --mtu 512" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11250 | "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000" \ |
Manuel Pégourié-Gonnard | 9590e0a | 2014-09-26 16:27:59 +0200 | [diff] [blame] | 11251 | 0 \ |
| 11252 | -s "Extra-header:" \ |
| 11253 | -c "Extra-header:" |
| 11254 | |
k-stachowiak | 17a38d3 | 2019-02-18 15:29:56 +0100 | [diff] [blame] | 11255 | requires_gnutls_next |
Janos Follath | 74537a6 | 2016-09-02 13:45:28 +0100 | [diff] [blame] | 11256 | client_needs_more_time 8 |
Manuel Pégourié-Gonnard | d68434e | 2015-08-31 12:48:22 +0200 | [diff] [blame] | 11257 | not_with_valgrind # risk of non-mbedtls peer timing out |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 11258 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 11259 | run_test "DTLS proxy: 3d, gnutls server, fragmentation, nbio" \ |
| 11260 | -p "$P_PXY drop=5 delay=5 duplicate=5" \ |
k-stachowiak | 17a38d3 | 2019-02-18 15:29:56 +0100 | [diff] [blame] | 11261 | "$G_NEXT_SRV -u --mtu 512" \ |
Andrzej Kurek | 948fe80 | 2018-10-05 15:42:44 -0400 | [diff] [blame] | 11262 | "$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 nbio=2" \ |
Manuel Pégourié-Gonnard | 6093d81 | 2014-09-29 17:52:57 +0200 | [diff] [blame] | 11263 | 0 \ |
| 11264 | -s "Extra-header:" \ |
| 11265 | -c "Extra-header:" |
| 11266 | |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 11267 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Ron Eldor | f75e252 | 2019-05-14 20:38:49 +0300 | [diff] [blame] | 11268 | run_test "export keys functionality" \ |
| 11269 | "$P_SRV eap_tls=1 debug_level=3" \ |
Ronald Cron | f95d169 | 2023-03-14 17:19:42 +0100 | [diff] [blame] | 11270 | "$P_CLI force_version=tls12 eap_tls=1 debug_level=3" \ |
Ron Eldor | f75e252 | 2019-05-14 20:38:49 +0300 | [diff] [blame] | 11271 | 0 \ |
Ron Eldor | 65d8c26 | 2019-06-04 13:05:36 +0300 | [diff] [blame] | 11272 | -c "EAP-TLS key material is:"\ |
| 11273 | -s "EAP-TLS key material is:"\ |
| 11274 | -c "EAP-TLS IV is:" \ |
| 11275 | -s "EAP-TLS IV is:" |
Ron Eldor | f75e252 | 2019-05-14 20:38:49 +0300 | [diff] [blame] | 11276 | |
Jerry Yu | 0402979 | 2021-08-10 16:45:37 +0800 | [diff] [blame] | 11277 | # openssl feature tests: check if tls1.3 exists. |
| 11278 | requires_openssl_tls1_3 |
Jerry Yu | c502dff | 2021-12-03 10:04:08 +0800 | [diff] [blame] | 11279 | run_test "TLS 1.3: Test openssl tls1_3 feature" \ |
Jerry Yu | 0402979 | 2021-08-10 16:45:37 +0800 | [diff] [blame] | 11280 | "$O_NEXT_SRV -tls1_3 -msg" \ |
| 11281 | "$O_NEXT_CLI -tls1_3 -msg" \ |
| 11282 | 0 \ |
| 11283 | -c "TLS 1.3" \ |
| 11284 | -s "TLS 1.3" |
| 11285 | |
Jerry Yu | 75261df | 2021-09-02 17:40:08 +0800 | [diff] [blame] | 11286 | # gnutls feature tests: check if TLS 1.3 is supported as well as the NO_TICKETS and DISABLE_TLS13_COMPAT_MODE options. |
Jerry Yu | 0402979 | 2021-08-10 16:45:37 +0800 | [diff] [blame] | 11287 | requires_gnutls_tls1_3 |
Jerry Yu | b12d81d | 2021-08-17 10:56:08 +0800 | [diff] [blame] | 11288 | requires_gnutls_next_no_ticket |
| 11289 | requires_gnutls_next_disable_tls13_compat |
Jerry Yu | c502dff | 2021-12-03 10:04:08 +0800 | [diff] [blame] | 11290 | run_test "TLS 1.3: Test gnutls tls1_3 feature" \ |
Jerry Yu | 937ac67 | 2021-10-28 17:39:28 +0800 | [diff] [blame] | 11291 | "$G_NEXT_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE --disable-client-cert " \ |
Jerry Yu | b12d81d | 2021-08-17 10:56:08 +0800 | [diff] [blame] | 11292 | "$G_NEXT_CLI localhost --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE -V" \ |
Jerry Yu | 0402979 | 2021-08-10 16:45:37 +0800 | [diff] [blame] | 11293 | 0 \ |
| 11294 | -s "Version: TLS1.3" \ |
| 11295 | -c "Version: TLS1.3" |
| 11296 | |
Jerry Yu | c46e9b4 | 2021-08-06 11:22:24 +0800 | [diff] [blame] | 11297 | # TLS1.3 test cases |
Ronald Cron | b18c67a | 2023-02-16 16:57:16 +0100 | [diff] [blame] | 11298 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
| 11299 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | 4bb6773 | 2023-02-16 15:51:18 +0100 | [diff] [blame] | 11300 | requires_ciphersuite_enabled TLS1-3-CHACHA20-POLY1305-SHA256 |
Ronald Cron | b18c67a | 2023-02-16 16:57:16 +0100 | [diff] [blame] | 11301 | requires_config_enabled MBEDTLS_ECP_DP_CURVE25519_ENABLED |
| 11302 | requires_config_enabled MBEDTLS_ECP_DP_SECP256R1_ENABLED |
Ronald Cron | b18c67a | 2023-02-16 16:57:16 +0100 | [diff] [blame] | 11303 | run_test "TLS 1.3: Default" \ |
| 11304 | "$P_SRV allow_sha1=0 debug_level=3 crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13" \ |
| 11305 | "$P_CLI allow_sha1=0" \ |
| 11306 | 0 \ |
| 11307 | -s "Protocol is TLSv1.3" \ |
Ronald Cron | 4bb6773 | 2023-02-16 15:51:18 +0100 | [diff] [blame] | 11308 | -s "Ciphersuite is TLS1-3-CHACHA20-POLY1305-SHA256" \ |
Przemek Stekiel | 1f5c2ba | 2023-06-15 17:04:44 +0200 | [diff] [blame] | 11309 | -s "ECDH/FFDH group: " \ |
Ronald Cron | b18c67a | 2023-02-16 16:57:16 +0100 | [diff] [blame] | 11310 | -s "selected signature algorithm ecdsa_secp256r1_sha256" |
| 11311 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11312 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 7c0185f | 2021-11-30 09:16:24 +0100 | [diff] [blame] | 11313 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11314 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11315 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11316 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | c502dff | 2021-12-03 10:04:08 +0800 | [diff] [blame] | 11317 | run_test "TLS 1.3: minimal feature sets - openssl" \ |
Ronald Cron | fdb0e3f | 2021-12-09 10:39:19 +0100 | [diff] [blame] | 11318 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11319 | "$P_CLI debug_level=3" \ |
Jerry Yu | e1b1e2d | 2021-10-29 17:46:32 +0800 | [diff] [blame] | 11320 | 0 \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 11321 | -c "client state: MBEDTLS_SSL_HELLO_REQUEST" \ |
| 11322 | -c "client state: MBEDTLS_SSL_SERVER_HELLO" \ |
| 11323 | -c "client state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
| 11324 | -c "client state: MBEDTLS_SSL_CERTIFICATE_REQUEST" \ |
| 11325 | -c "client state: MBEDTLS_SSL_SERVER_CERTIFICATE" \ |
| 11326 | -c "client state: MBEDTLS_SSL_CERTIFICATE_VERIFY" \ |
| 11327 | -c "client state: MBEDTLS_SSL_SERVER_FINISHED" \ |
| 11328 | -c "client state: MBEDTLS_SSL_CLIENT_FINISHED" \ |
| 11329 | -c "client state: MBEDTLS_SSL_FLUSH_BUFFERS" \ |
| 11330 | -c "client state: MBEDTLS_SSL_HANDSHAKE_WRAPUP" \ |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 11331 | -c "<= ssl_tls13_process_server_hello" \ |
Ronald Cron | 4bb6773 | 2023-02-16 15:51:18 +0100 | [diff] [blame] | 11332 | -c "server hello, chosen ciphersuite: ( 1303 ) - TLS1-3-CHACHA20-POLY1305-SHA256" \ |
Przemek Stekiel | 1f5c2ba | 2023-06-15 17:04:44 +0200 | [diff] [blame] | 11333 | -c "DHE group name: " \ |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 11334 | -c "=> ssl_tls13_process_server_hello" \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 11335 | -c "<= parse encrypted extensions" \ |
Jerry Yu | 834886d | 2021-10-30 13:26:15 +0800 | [diff] [blame] | 11336 | -c "Certificate verification flags clear" \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 11337 | -c "=> parse certificate verify" \ |
| 11338 | -c "<= parse certificate verify" \ |
XiaokangQian | d0aa3e9 | 2021-11-10 06:17:40 +0000 | [diff] [blame] | 11339 | -c "mbedtls_ssl_tls13_process_certificate_verify() returned 0" \ |
Jerry Yu | 6d38c19 | 2021-11-15 14:01:04 +0800 | [diff] [blame] | 11340 | -c "<= parse finished message" \ |
Gilles Peskine | c63a1e0 | 2022-01-13 01:10:24 +0100 | [diff] [blame] | 11341 | -c "Protocol is TLSv1.3" \ |
Jerry Yu | 6d38c19 | 2021-11-15 14:01:04 +0800 | [diff] [blame] | 11342 | -c "HTTP/1.0 200 ok" |
Jerry Yu | ed2ef2d | 2021-08-19 18:11:43 +0800 | [diff] [blame] | 11343 | |
Jerry Yu | 76e31ec | 2021-09-22 21:16:27 +0800 | [diff] [blame] | 11344 | requires_gnutls_tls1_3 |
Jerry Yu | 937ac67 | 2021-10-28 17:39:28 +0800 | [diff] [blame] | 11345 | requires_gnutls_next_no_ticket |
Ronald Cron | 7c0185f | 2021-11-30 09:16:24 +0100 | [diff] [blame] | 11346 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11347 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11348 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11349 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | c502dff | 2021-12-03 10:04:08 +0800 | [diff] [blame] | 11350 | run_test "TLS 1.3: minimal feature sets - gnutls" \ |
Ronald Cron | fdb0e3f | 2021-12-09 10:39:19 +0100 | [diff] [blame] | 11351 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS --disable-client-cert" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11352 | "$P_CLI debug_level=3" \ |
Jerry Yu | e1b1e2d | 2021-10-29 17:46:32 +0800 | [diff] [blame] | 11353 | 0 \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 11354 | -s "SERVER HELLO was queued" \ |
| 11355 | -c "client state: MBEDTLS_SSL_HELLO_REQUEST" \ |
| 11356 | -c "client state: MBEDTLS_SSL_SERVER_HELLO" \ |
| 11357 | -c "client state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
| 11358 | -c "client state: MBEDTLS_SSL_CERTIFICATE_REQUEST" \ |
| 11359 | -c "client state: MBEDTLS_SSL_SERVER_CERTIFICATE" \ |
| 11360 | -c "client state: MBEDTLS_SSL_CERTIFICATE_VERIFY" \ |
| 11361 | -c "client state: MBEDTLS_SSL_SERVER_FINISHED" \ |
| 11362 | -c "client state: MBEDTLS_SSL_CLIENT_FINISHED" \ |
| 11363 | -c "client state: MBEDTLS_SSL_FLUSH_BUFFERS" \ |
| 11364 | -c "client state: MBEDTLS_SSL_HANDSHAKE_WRAPUP" \ |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 11365 | -c "<= ssl_tls13_process_server_hello" \ |
Ronald Cron | 4bb6773 | 2023-02-16 15:51:18 +0100 | [diff] [blame] | 11366 | -c "server hello, chosen ciphersuite: ( 1303 ) - TLS1-3-CHACHA20-POLY1305-SHA256" \ |
Przemek Stekiel | 1f5c2ba | 2023-06-15 17:04:44 +0200 | [diff] [blame] | 11367 | -c "DHE group name: " \ |
Xiaofei Bai | 746f948 | 2021-11-12 08:53:56 +0000 | [diff] [blame] | 11368 | -c "=> ssl_tls13_process_server_hello" \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 11369 | -c "<= parse encrypted extensions" \ |
Jerry Yu | 834886d | 2021-10-30 13:26:15 +0800 | [diff] [blame] | 11370 | -c "Certificate verification flags clear" \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 11371 | -c "=> parse certificate verify" \ |
| 11372 | -c "<= parse certificate verify" \ |
XiaokangQian | d0aa3e9 | 2021-11-10 06:17:40 +0000 | [diff] [blame] | 11373 | -c "mbedtls_ssl_tls13_process_certificate_verify() returned 0" \ |
Jerry Yu | 6d38c19 | 2021-11-15 14:01:04 +0800 | [diff] [blame] | 11374 | -c "<= parse finished message" \ |
Gilles Peskine | 860429f | 2022-02-12 00:44:48 +0100 | [diff] [blame] | 11375 | -c "Protocol is TLSv1.3" \ |
Jerry Yu | 6d38c19 | 2021-11-15 14:01:04 +0800 | [diff] [blame] | 11376 | -c "HTTP/1.0 200 OK" |
XiaokangQian | d0aa3e9 | 2021-11-10 06:17:40 +0000 | [diff] [blame] | 11377 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11378 | requires_openssl_tls1_3_with_compatible_ephemeral |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11379 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11380 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11381 | requires_config_enabled MBEDTLS_SSL_ALPN |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11382 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11383 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11384 | run_test "TLS 1.3: alpn - openssl" \ |
| 11385 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -alpn h2" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11386 | "$P_CLI debug_level=3 alpn=h2" \ |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11387 | 0 \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 11388 | -c "client state: MBEDTLS_SSL_HELLO_REQUEST" \ |
| 11389 | -c "client state: MBEDTLS_SSL_SERVER_HELLO" \ |
| 11390 | -c "client state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
| 11391 | -c "client state: MBEDTLS_SSL_CERTIFICATE_REQUEST" \ |
| 11392 | -c "client state: MBEDTLS_SSL_SERVER_CERTIFICATE" \ |
| 11393 | -c "client state: MBEDTLS_SSL_CERTIFICATE_VERIFY" \ |
| 11394 | -c "client state: MBEDTLS_SSL_SERVER_FINISHED" \ |
| 11395 | -c "client state: MBEDTLS_SSL_CLIENT_FINISHED" \ |
| 11396 | -c "client state: MBEDTLS_SSL_FLUSH_BUFFERS" \ |
| 11397 | -c "client state: MBEDTLS_SSL_HANDSHAKE_WRAPUP" \ |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11398 | -c "<= ssl_tls13_process_server_hello" \ |
Ronald Cron | 4bb6773 | 2023-02-16 15:51:18 +0100 | [diff] [blame] | 11399 | -c "server hello, chosen ciphersuite: ( 1303 ) - TLS1-3-CHACHA20-POLY1305-SHA256" \ |
Przemek Stekiel | 1f5c2ba | 2023-06-15 17:04:44 +0200 | [diff] [blame] | 11400 | -c "DHE group name: " \ |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11401 | -c "=> ssl_tls13_process_server_hello" \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 11402 | -c "<= parse encrypted extensions" \ |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11403 | -c "Certificate verification flags clear" \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 11404 | -c "=> parse certificate verify" \ |
| 11405 | -c "<= parse certificate verify" \ |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11406 | -c "mbedtls_ssl_tls13_process_certificate_verify() returned 0" \ |
| 11407 | -c "<= parse finished message" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11408 | -c "Protocol is TLSv1.3" \ |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11409 | -c "HTTP/1.0 200 ok" \ |
| 11410 | -c "Application Layer Protocol is h2" |
| 11411 | |
| 11412 | requires_gnutls_tls1_3 |
| 11413 | requires_gnutls_next_no_ticket |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11414 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11415 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11416 | requires_config_enabled MBEDTLS_SSL_ALPN |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11417 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11418 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11419 | run_test "TLS 1.3: alpn - gnutls" \ |
| 11420 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS --disable-client-cert --alpn=h2" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11421 | "$P_CLI debug_level=3 alpn=h2" \ |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11422 | 0 \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 11423 | -s "SERVER HELLO was queued" \ |
| 11424 | -c "client state: MBEDTLS_SSL_HELLO_REQUEST" \ |
| 11425 | -c "client state: MBEDTLS_SSL_SERVER_HELLO" \ |
| 11426 | -c "client state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
| 11427 | -c "client state: MBEDTLS_SSL_CERTIFICATE_REQUEST" \ |
| 11428 | -c "client state: MBEDTLS_SSL_SERVER_CERTIFICATE" \ |
| 11429 | -c "client state: MBEDTLS_SSL_CERTIFICATE_VERIFY" \ |
| 11430 | -c "client state: MBEDTLS_SSL_SERVER_FINISHED" \ |
| 11431 | -c "client state: MBEDTLS_SSL_CLIENT_FINISHED" \ |
| 11432 | -c "client state: MBEDTLS_SSL_FLUSH_BUFFERS" \ |
| 11433 | -c "client state: MBEDTLS_SSL_HANDSHAKE_WRAPUP" \ |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11434 | -c "<= ssl_tls13_process_server_hello" \ |
Ronald Cron | 4bb6773 | 2023-02-16 15:51:18 +0100 | [diff] [blame] | 11435 | -c "server hello, chosen ciphersuite: ( 1303 ) - TLS1-3-CHACHA20-POLY1305-SHA256" \ |
Przemek Stekiel | 1f5c2ba | 2023-06-15 17:04:44 +0200 | [diff] [blame] | 11436 | -c "DHE group name: " \ |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11437 | -c "=> ssl_tls13_process_server_hello" \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 11438 | -c "<= parse encrypted extensions" \ |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11439 | -c "Certificate verification flags clear" \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 11440 | -c "=> parse certificate verify" \ |
| 11441 | -c "<= parse certificate verify" \ |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11442 | -c "mbedtls_ssl_tls13_process_certificate_verify() returned 0" \ |
| 11443 | -c "<= parse finished message" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11444 | -c "Protocol is TLSv1.3" \ |
lhuang04 | 86cacac | 2022-01-21 07:34:27 -0800 | [diff] [blame] | 11445 | -c "HTTP/1.0 200 OK" \ |
| 11446 | -c "Application Layer Protocol is h2" |
| 11447 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11448 | requires_openssl_tls1_3_with_compatible_ephemeral |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 11449 | requires_config_enabled MBEDTLS_DEBUG_C |
XiaokangQian | 95d5f54 | 2022-06-24 02:29:26 +0000 | [diff] [blame] | 11450 | requires_config_enabled MBEDTLS_SSL_SRV_C |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 11451 | requires_config_enabled MBEDTLS_SSL_ALPN |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 11452 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 11453 | run_test "TLS 1.3: server alpn - openssl" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 11454 | "$P_SRV debug_level=3 tickets=0 crt_file=data_files/server5.crt key_file=data_files/server5.key alpn=h2" \ |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 11455 | "$O_NEXT_CLI -msg -tls1_3 -no_middlebox -alpn h2" \ |
| 11456 | 0 \ |
XiaokangQian | c740345 | 2022-06-23 03:24:12 +0000 | [diff] [blame] | 11457 | -s "found alpn extension" \ |
| 11458 | -s "server side, adding alpn extension" \ |
| 11459 | -s "Protocol is TLSv1.3" \ |
| 11460 | -s "HTTP/1.0 200 OK" \ |
| 11461 | -s "Application Layer Protocol is h2" |
| 11462 | |
| 11463 | requires_gnutls_tls1_3 |
XiaokangQian | c740345 | 2022-06-23 03:24:12 +0000 | [diff] [blame] | 11464 | requires_config_enabled MBEDTLS_DEBUG_C |
XiaokangQian | 95d5f54 | 2022-06-24 02:29:26 +0000 | [diff] [blame] | 11465 | requires_config_enabled MBEDTLS_SSL_SRV_C |
XiaokangQian | c740345 | 2022-06-23 03:24:12 +0000 | [diff] [blame] | 11466 | requires_config_enabled MBEDTLS_SSL_ALPN |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 11467 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
XiaokangQian | c740345 | 2022-06-23 03:24:12 +0000 | [diff] [blame] | 11468 | run_test "TLS 1.3: server alpn - gnutls" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 11469 | "$P_SRV debug_level=3 tickets=0 crt_file=data_files/server5.crt key_file=data_files/server5.key alpn=h2" \ |
XiaokangQian | c740345 | 2022-06-23 03:24:12 +0000 | [diff] [blame] | 11470 | "$G_NEXT_CLI localhost -d 4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE -V --alpn h2" \ |
| 11471 | 0 \ |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 11472 | -s "found alpn extension" \ |
| 11473 | -s "server side, adding alpn extension" \ |
| 11474 | -s "Protocol is TLSv1.3" \ |
| 11475 | -s "HTTP/1.0 200 OK" \ |
| 11476 | -s "Application Layer Protocol is h2" |
| 11477 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 11478 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
Ronald Cron | 7c0185f | 2021-11-30 09:16:24 +0100 | [diff] [blame] | 11479 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11480 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11481 | skip_handshake_stage_check |
| 11482 | requires_gnutls_tls1_3 |
Ronald Cron | df5f868 | 2022-04-05 16:01:03 +0200 | [diff] [blame] | 11483 | run_test "TLS 1.3: Not supported version check:gnutls: srv max TLS 1.0" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11484 | "$G_NEXT_SRV --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.0 -d 4" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11485 | "$P_CLI debug_level=4" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11486 | 1 \ |
| 11487 | -s "Client's version: 3.3" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11488 | -S "Version: TLS1.0" \ |
| 11489 | -C "Protocol is TLSv1.0" |
| 11490 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 11491 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
Ronald Cron | 7c0185f | 2021-11-30 09:16:24 +0100 | [diff] [blame] | 11492 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11493 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11494 | skip_handshake_stage_check |
| 11495 | requires_gnutls_tls1_3 |
Ronald Cron | df5f868 | 2022-04-05 16:01:03 +0200 | [diff] [blame] | 11496 | run_test "TLS 1.3: Not supported version check:gnutls: srv max TLS 1.1" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11497 | "$G_NEXT_SRV --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.1 -d 4" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11498 | "$P_CLI debug_level=4" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11499 | 1 \ |
| 11500 | -s "Client's version: 3.3" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11501 | -S "Version: TLS1.1" \ |
| 11502 | -C "Protocol is TLSv1.1" |
| 11503 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 11504 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
Ronald Cron | 7c0185f | 2021-11-30 09:16:24 +0100 | [diff] [blame] | 11505 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11506 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11507 | skip_handshake_stage_check |
| 11508 | requires_gnutls_tls1_3 |
Ronald Cron | df5f868 | 2022-04-05 16:01:03 +0200 | [diff] [blame] | 11509 | run_test "TLS 1.3: Not supported version check:gnutls: srv max TLS 1.2" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11510 | "$G_NEXT_SRV --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.2 -d 4" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11511 | "$P_CLI force_version=tls13 debug_level=4" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11512 | 1 \ |
| 11513 | -s "Client's version: 3.3" \ |
| 11514 | -c "is a fatal alert message (msg 40)" \ |
| 11515 | -S "Version: TLS1.2" \ |
| 11516 | -C "Protocol is TLSv1.2" |
| 11517 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 11518 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
Ronald Cron | 7c0185f | 2021-11-30 09:16:24 +0100 | [diff] [blame] | 11519 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11520 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11521 | skip_handshake_stage_check |
| 11522 | requires_openssl_next |
Ronald Cron | df5f868 | 2022-04-05 16:01:03 +0200 | [diff] [blame] | 11523 | run_test "TLS 1.3: Not supported version check:openssl: srv max TLS 1.0" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11524 | "$O_NEXT_SRV -msg -tls1" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11525 | "$P_CLI debug_level=4" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11526 | 1 \ |
| 11527 | -s "fatal protocol_version" \ |
| 11528 | -c "is a fatal alert message (msg 70)" \ |
| 11529 | -S "Version: TLS1.0" \ |
| 11530 | -C "Protocol : TLSv1.0" |
| 11531 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 11532 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
Ronald Cron | 7c0185f | 2021-11-30 09:16:24 +0100 | [diff] [blame] | 11533 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11534 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11535 | skip_handshake_stage_check |
| 11536 | requires_openssl_next |
Ronald Cron | df5f868 | 2022-04-05 16:01:03 +0200 | [diff] [blame] | 11537 | run_test "TLS 1.3: Not supported version check:openssl: srv max TLS 1.1" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11538 | "$O_NEXT_SRV -msg -tls1_1" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11539 | "$P_CLI debug_level=4" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11540 | 1 \ |
| 11541 | -s "fatal protocol_version" \ |
| 11542 | -c "is a fatal alert message (msg 70)" \ |
| 11543 | -S "Version: TLS1.1" \ |
| 11544 | -C "Protocol : TLSv1.1" |
| 11545 | |
Ronald Cron | 6f135e1 | 2021-12-08 16:57:54 +0100 | [diff] [blame] | 11546 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
Ronald Cron | 7c0185f | 2021-11-30 09:16:24 +0100 | [diff] [blame] | 11547 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11548 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11549 | skip_handshake_stage_check |
| 11550 | requires_openssl_next |
Ronald Cron | df5f868 | 2022-04-05 16:01:03 +0200 | [diff] [blame] | 11551 | run_test "TLS 1.3: Not supported version check:openssl: srv max TLS 1.2" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11552 | "$O_NEXT_SRV -msg -tls1_2" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11553 | "$P_CLI force_version=tls13 debug_level=4" \ |
Jerry Yu | 8f9d7db | 2021-11-22 17:28:01 +0800 | [diff] [blame] | 11554 | 1 \ |
| 11555 | -s "fatal protocol_version" \ |
| 11556 | -c "is a fatal alert message (msg 70)" \ |
| 11557 | -S "Version: TLS1.2" \ |
| 11558 | -C "Protocol : TLSv1.2" |
| 11559 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11560 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | aa6214a | 2022-01-30 19:53:28 +0800 | [diff] [blame] | 11561 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11562 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11563 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11564 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11565 | run_test "TLS 1.3: Client authentication, no client certificate - openssl" \ |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11566 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -verify 10" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11567 | "$P_CLI debug_level=4 crt_file=none key_file=none" \ |
Jerry Yu | aa6214a | 2022-01-30 19:53:28 +0800 | [diff] [blame] | 11568 | 0 \ |
Jerry Yu | aa6214a | 2022-01-30 19:53:28 +0800 | [diff] [blame] | 11569 | -c "got a certificate request" \ |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11570 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11571 | -s "TLS 1.3" \ |
Jerry Yu | 562a0fd | 2022-02-18 15:35:11 +0800 | [diff] [blame] | 11572 | -c "HTTP/1.0 200 ok" \ |
| 11573 | -c "Protocol is TLSv1.3" |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11574 | |
| 11575 | requires_gnutls_tls1_3 |
| 11576 | requires_gnutls_next_no_ticket |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11577 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11578 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11579 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11580 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11581 | run_test "TLS 1.3: Client authentication, no client certificate - gnutls" \ |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11582 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS --verify-client-cert" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11583 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11584 | 0 \ |
| 11585 | -c "got a certificate request" \ |
| 11586 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE"\ |
| 11587 | -s "Version: TLS1.3" \ |
Jerry Yu | 562a0fd | 2022-02-18 15:35:11 +0800 | [diff] [blame] | 11588 | -c "HTTP/1.0 200 OK" \ |
| 11589 | -c "Protocol is TLSv1.3" |
| 11590 | |
Jerry Yu | aa6214a | 2022-01-30 19:53:28 +0800 | [diff] [blame] | 11591 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11592 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | 960bc28 | 2022-01-26 11:12:34 +0800 | [diff] [blame] | 11593 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11594 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 11595 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11596 | run_test "TLS 1.3: Client authentication, no server middlebox compat - openssl" \ |
Jerry Yu | 960bc28 | 2022-01-26 11:12:34 +0800 | [diff] [blame] | 11597 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10 -no_middlebox" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11598 | "$P_CLI debug_level=4 crt_file=data_files/cli2.crt key_file=data_files/cli2.key" \ |
Jerry Yu | c19884f | 2022-01-29 10:44:44 +0800 | [diff] [blame] | 11599 | 0 \ |
Jerry Yu | 960bc28 | 2022-01-26 11:12:34 +0800 | [diff] [blame] | 11600 | -c "got a certificate request" \ |
Jerry Yu | 200b47b | 2022-01-28 14:26:30 +0800 | [diff] [blame] | 11601 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
Jerry Yu | 562a0fd | 2022-02-18 15:35:11 +0800 | [diff] [blame] | 11602 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11603 | -c "Protocol is TLSv1.3" |
Jerry Yu | 960bc28 | 2022-01-26 11:12:34 +0800 | [diff] [blame] | 11604 | |
| 11605 | requires_gnutls_tls1_3 |
| 11606 | requires_gnutls_next_no_ticket |
Jerry Yu | 960bc28 | 2022-01-26 11:12:34 +0800 | [diff] [blame] | 11607 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11608 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 11609 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11610 | run_test "TLS 1.3: Client authentication, no server middlebox compat - gnutls" \ |
Jerry Yu | 960bc28 | 2022-01-26 11:12:34 +0800 | [diff] [blame] | 11611 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11612 | "$P_CLI debug_level=3 crt_file=data_files/cli2.crt \ |
Jerry Yu | 25e0ddc | 2022-01-29 10:33:13 +0800 | [diff] [blame] | 11613 | key_file=data_files/cli2.key" \ |
Jerry Yu | c19884f | 2022-01-29 10:44:44 +0800 | [diff] [blame] | 11614 | 0 \ |
Jerry Yu | 960bc28 | 2022-01-26 11:12:34 +0800 | [diff] [blame] | 11615 | -c "got a certificate request" \ |
Jerry Yu | 200b47b | 2022-01-28 14:26:30 +0800 | [diff] [blame] | 11616 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
Jerry Yu | 562a0fd | 2022-02-18 15:35:11 +0800 | [diff] [blame] | 11617 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11618 | -c "Protocol is TLSv1.3" |
Jerry Yu | 200b47b | 2022-01-28 14:26:30 +0800 | [diff] [blame] | 11619 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11620 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | 200b47b | 2022-01-28 14:26:30 +0800 | [diff] [blame] | 11621 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11622 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11623 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11624 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11625 | run_test "TLS 1.3: Client authentication, ecdsa_secp256r1_sha256 - openssl" \ |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11626 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11627 | "$P_CLI debug_level=4 crt_file=data_files/ecdsa_secp256r1.crt \ |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11628 | key_file=data_files/ecdsa_secp256r1.key" \ |
| 11629 | 0 \ |
| 11630 | -c "got a certificate request" \ |
| 11631 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
Jerry Yu | 562a0fd | 2022-02-18 15:35:11 +0800 | [diff] [blame] | 11632 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11633 | -c "Protocol is TLSv1.3" |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11634 | |
| 11635 | requires_gnutls_tls1_3 |
| 11636 | requires_gnutls_next_no_ticket |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11637 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11638 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11639 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11640 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11641 | run_test "TLS 1.3: Client authentication, ecdsa_secp256r1_sha256 - gnutls" \ |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11642 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11643 | "$P_CLI debug_level=3 crt_file=data_files/ecdsa_secp256r1.crt \ |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11644 | key_file=data_files/ecdsa_secp256r1.key" \ |
| 11645 | 0 \ |
| 11646 | -c "got a certificate request" \ |
| 11647 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
Jerry Yu | 562a0fd | 2022-02-18 15:35:11 +0800 | [diff] [blame] | 11648 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11649 | -c "Protocol is TLSv1.3" |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11650 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11651 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11652 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11653 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11654 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11655 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11656 | run_test "TLS 1.3: Client authentication, ecdsa_secp384r1_sha384 - openssl" \ |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11657 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11658 | "$P_CLI debug_level=4 crt_file=data_files/ecdsa_secp384r1.crt \ |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11659 | key_file=data_files/ecdsa_secp384r1.key" \ |
| 11660 | 0 \ |
| 11661 | -c "got a certificate request" \ |
| 11662 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
Jerry Yu | 562a0fd | 2022-02-18 15:35:11 +0800 | [diff] [blame] | 11663 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11664 | -c "Protocol is TLSv1.3" |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11665 | |
| 11666 | requires_gnutls_tls1_3 |
| 11667 | requires_gnutls_next_no_ticket |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11668 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11669 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11670 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11671 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11672 | run_test "TLS 1.3: Client authentication, ecdsa_secp384r1_sha384 - gnutls" \ |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11673 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11674 | "$P_CLI debug_level=3 crt_file=data_files/ecdsa_secp384r1.crt \ |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11675 | key_file=data_files/ecdsa_secp384r1.key" \ |
| 11676 | 0 \ |
| 11677 | -c "got a certificate request" \ |
| 11678 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
Jerry Yu | 562a0fd | 2022-02-18 15:35:11 +0800 | [diff] [blame] | 11679 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11680 | -c "Protocol is TLSv1.3" |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11681 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11682 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11683 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11684 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11685 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11686 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11687 | run_test "TLS 1.3: Client authentication, ecdsa_secp521r1_sha512 - openssl" \ |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11688 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11689 | "$P_CLI debug_level=4 crt_file=data_files/ecdsa_secp521r1.crt \ |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11690 | key_file=data_files/ecdsa_secp521r1.key" \ |
| 11691 | 0 \ |
| 11692 | -c "got a certificate request" \ |
| 11693 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
Jerry Yu | 562a0fd | 2022-02-18 15:35:11 +0800 | [diff] [blame] | 11694 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11695 | -c "Protocol is TLSv1.3" |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11696 | |
| 11697 | requires_gnutls_tls1_3 |
| 11698 | requires_gnutls_next_no_ticket |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11699 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11700 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11701 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11702 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11703 | run_test "TLS 1.3: Client authentication, ecdsa_secp521r1_sha512 - gnutls" \ |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11704 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11705 | "$P_CLI debug_level=3 crt_file=data_files/ecdsa_secp521r1.crt \ |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11706 | key_file=data_files/ecdsa_secp521r1.key" \ |
| 11707 | 0 \ |
| 11708 | -c "got a certificate request" \ |
| 11709 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
Jerry Yu | 562a0fd | 2022-02-18 15:35:11 +0800 | [diff] [blame] | 11710 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11711 | -c "Protocol is TLSv1.3" |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11712 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11713 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11714 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11715 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11716 | requires_config_enabled MBEDTLS_RSA_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11717 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11718 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11719 | run_test "TLS 1.3: Client authentication, rsa_pss_rsae_sha256 - openssl" \ |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11720 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11721 | "$P_CLI debug_level=4 crt_file=data_files/cert_sha256.crt \ |
Jerry Yu | 2ff6ba1 | 2022-02-23 10:38:25 +0800 | [diff] [blame] | 11722 | key_file=data_files/server1.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha256" \ |
Jerry Yu | 919130c | 2022-02-23 10:40:19 +0800 | [diff] [blame] | 11723 | 0 \ |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11724 | -c "got a certificate request" \ |
| 11725 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
Jerry Yu | 562a0fd | 2022-02-18 15:35:11 +0800 | [diff] [blame] | 11726 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
Jerry Yu | 919130c | 2022-02-23 10:40:19 +0800 | [diff] [blame] | 11727 | -c "Protocol is TLSv1.3" |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11728 | |
| 11729 | requires_gnutls_tls1_3 |
| 11730 | requires_gnutls_next_no_ticket |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11731 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11732 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11733 | requires_config_enabled MBEDTLS_RSA_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11734 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11735 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11736 | run_test "TLS 1.3: Client authentication, rsa_pss_rsae_sha256 - gnutls" \ |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11737 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11738 | "$P_CLI debug_level=3 crt_file=data_files/server2-sha256.crt \ |
Jerry Yu | 2ff6ba1 | 2022-02-23 10:38:25 +0800 | [diff] [blame] | 11739 | key_file=data_files/server2.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha256" \ |
Jerry Yu | 919130c | 2022-02-23 10:40:19 +0800 | [diff] [blame] | 11740 | 0 \ |
Jerry Yu | 6c3d821 | 2022-02-18 15:23:23 +0800 | [diff] [blame] | 11741 | -c "got a certificate request" \ |
| 11742 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
Jerry Yu | 562a0fd | 2022-02-18 15:35:11 +0800 | [diff] [blame] | 11743 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
Jerry Yu | 919130c | 2022-02-23 10:40:19 +0800 | [diff] [blame] | 11744 | -c "Protocol is TLSv1.3" |
Jerry Yu | 960bc28 | 2022-01-26 11:12:34 +0800 | [diff] [blame] | 11745 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11746 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | 2124d05 | 2022-02-18 21:07:18 +0800 | [diff] [blame] | 11747 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11748 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11749 | requires_config_enabled MBEDTLS_RSA_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11750 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11751 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 3a58b46 | 2022-02-22 16:42:29 +0800 | [diff] [blame] | 11752 | run_test "TLS 1.3: Client authentication, rsa_pss_rsae_sha384 - openssl" \ |
| 11753 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 11754 | "$P_CLI debug_level=4 crt_file=data_files/cert_sha256.crt \ |
Jerry Yu | 3a58b46 | 2022-02-22 16:42:29 +0800 | [diff] [blame] | 11755 | key_file=data_files/server1.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha384" \ |
| 11756 | 0 \ |
| 11757 | -c "got a certificate request" \ |
| 11758 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11759 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11760 | -c "Protocol is TLSv1.3" |
| 11761 | |
| 11762 | requires_gnutls_tls1_3 |
| 11763 | requires_gnutls_next_no_ticket |
Jerry Yu | 3a58b46 | 2022-02-22 16:42:29 +0800 | [diff] [blame] | 11764 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11765 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11766 | requires_config_enabled MBEDTLS_RSA_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11767 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11768 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 3a58b46 | 2022-02-22 16:42:29 +0800 | [diff] [blame] | 11769 | run_test "TLS 1.3: Client authentication, rsa_pss_rsae_sha384 - gnutls" \ |
| 11770 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 11771 | "$P_CLI debug_level=3 crt_file=data_files/server2-sha256.crt \ |
Jerry Yu | 3a58b46 | 2022-02-22 16:42:29 +0800 | [diff] [blame] | 11772 | key_file=data_files/server2.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha384" \ |
| 11773 | 0 \ |
| 11774 | -c "got a certificate request" \ |
| 11775 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11776 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11777 | -c "Protocol is TLSv1.3" |
| 11778 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11779 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | 3a58b46 | 2022-02-22 16:42:29 +0800 | [diff] [blame] | 11780 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11781 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11782 | requires_config_enabled MBEDTLS_RSA_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11783 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11784 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 3a58b46 | 2022-02-22 16:42:29 +0800 | [diff] [blame] | 11785 | run_test "TLS 1.3: Client authentication, rsa_pss_rsae_sha512 - openssl" \ |
| 11786 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 11787 | "$P_CLI debug_level=4 crt_file=data_files/cert_sha256.crt \ |
Jerry Yu | 3a58b46 | 2022-02-22 16:42:29 +0800 | [diff] [blame] | 11788 | key_file=data_files/server1.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha512" \ |
| 11789 | 0 \ |
| 11790 | -c "got a certificate request" \ |
| 11791 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11792 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11793 | -c "Protocol is TLSv1.3" |
| 11794 | |
| 11795 | requires_gnutls_tls1_3 |
| 11796 | requires_gnutls_next_no_ticket |
Jerry Yu | 3a58b46 | 2022-02-22 16:42:29 +0800 | [diff] [blame] | 11797 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11798 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11799 | requires_config_enabled MBEDTLS_RSA_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11800 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11801 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 3a58b46 | 2022-02-22 16:42:29 +0800 | [diff] [blame] | 11802 | run_test "TLS 1.3: Client authentication, rsa_pss_rsae_sha512 - gnutls" \ |
| 11803 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 11804 | "$P_CLI debug_level=3 crt_file=data_files/server2-sha256.crt \ |
Jerry Yu | 3a58b46 | 2022-02-22 16:42:29 +0800 | [diff] [blame] | 11805 | key_file=data_files/server2.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha512" \ |
| 11806 | 0 \ |
| 11807 | -c "got a certificate request" \ |
| 11808 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11809 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11810 | -c "Protocol is TLSv1.3" |
| 11811 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11812 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | 3a58b46 | 2022-02-22 16:42:29 +0800 | [diff] [blame] | 11813 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11814 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11815 | requires_config_enabled MBEDTLS_RSA_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11816 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11817 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | ccb005e | 2022-02-22 17:38:34 +0800 | [diff] [blame] | 11818 | run_test "TLS 1.3: Client authentication, client alg not in server list - openssl" \ |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11819 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10 |
Jerry Yu | 2124d05 | 2022-02-18 21:07:18 +0800 | [diff] [blame] | 11820 | -sigalgs ecdsa_secp256r1_sha256" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11821 | "$P_CLI debug_level=3 crt_file=data_files/ecdsa_secp521r1.crt \ |
Jerry Yu | 2ff6ba1 | 2022-02-23 10:38:25 +0800 | [diff] [blame] | 11822 | key_file=data_files/ecdsa_secp521r1.key sig_algs=ecdsa_secp256r1_sha256,ecdsa_secp521r1_sha512" \ |
Jerry Yu | 2124d05 | 2022-02-18 21:07:18 +0800 | [diff] [blame] | 11823 | 1 \ |
| 11824 | -c "got a certificate request" \ |
| 11825 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11826 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
Xiaokang Qian | ea3d933 | 2022-12-07 06:19:49 +0000 | [diff] [blame] | 11827 | -c "no suitable signature algorithm" |
Jerry Yu | 2124d05 | 2022-02-18 21:07:18 +0800 | [diff] [blame] | 11828 | |
| 11829 | requires_gnutls_tls1_3 |
| 11830 | requires_gnutls_next_no_ticket |
Jerry Yu | 2124d05 | 2022-02-18 21:07:18 +0800 | [diff] [blame] | 11831 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11832 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11833 | requires_config_enabled MBEDTLS_RSA_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11834 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11835 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 819f297 | 2022-02-22 10:14:24 +0800 | [diff] [blame] | 11836 | run_test "TLS 1.3: Client authentication, client alg not in server list - gnutls" \ |
| 11837 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:-SIGN-ALL:+SIGN-ECDSA-SECP256R1-SHA256:%NO_TICKETS" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 11838 | "$P_CLI debug_level=3 crt_file=data_files/ecdsa_secp521r1.crt \ |
Jerry Yu | 2ff6ba1 | 2022-02-23 10:38:25 +0800 | [diff] [blame] | 11839 | key_file=data_files/ecdsa_secp521r1.key sig_algs=ecdsa_secp256r1_sha256,ecdsa_secp521r1_sha512" \ |
Jerry Yu | 2124d05 | 2022-02-18 21:07:18 +0800 | [diff] [blame] | 11840 | 1 \ |
| 11841 | -c "got a certificate request" \ |
| 11842 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11843 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
Xiaokang Qian | ea3d933 | 2022-12-07 06:19:49 +0000 | [diff] [blame] | 11844 | -c "no suitable signature algorithm" |
Jerry Yu | 2124d05 | 2022-02-18 21:07:18 +0800 | [diff] [blame] | 11845 | |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11846 | # Test using an opaque private key for client authentication |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11847 | requires_openssl_tls1_3_with_compatible_ephemeral |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11848 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11849 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11850 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 11851 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11852 | run_test "TLS 1.3: Client authentication - opaque key, no server middlebox compat - openssl" \ |
| 11853 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10 -no_middlebox" \ |
| 11854 | "$P_CLI debug_level=4 crt_file=data_files/cli2.crt key_file=data_files/cli2.key key_opaque=1" \ |
| 11855 | 0 \ |
| 11856 | -c "got a certificate request" \ |
| 11857 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11858 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11859 | -c "Protocol is TLSv1.3" |
| 11860 | |
| 11861 | requires_gnutls_tls1_3 |
| 11862 | requires_gnutls_next_no_ticket |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11863 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11864 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11865 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 11866 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11867 | run_test "TLS 1.3: Client authentication - opaque key, no server middlebox compat - gnutls" \ |
| 11868 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE" \ |
| 11869 | "$P_CLI debug_level=3 crt_file=data_files/cli2.crt \ |
| 11870 | key_file=data_files/cli2.key key_opaque=1" \ |
| 11871 | 0 \ |
| 11872 | -c "got a certificate request" \ |
| 11873 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11874 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11875 | -c "Protocol is TLSv1.3" |
| 11876 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11877 | requires_openssl_tls1_3_with_compatible_ephemeral |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11878 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11879 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11880 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11881 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11882 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11883 | run_test "TLS 1.3: Client authentication - opaque key, ecdsa_secp256r1_sha256 - openssl" \ |
| 11884 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \ |
| 11885 | "$P_CLI debug_level=4 crt_file=data_files/ecdsa_secp256r1.crt \ |
| 11886 | key_file=data_files/ecdsa_secp256r1.key key_opaque=1" \ |
| 11887 | 0 \ |
| 11888 | -c "got a certificate request" \ |
| 11889 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11890 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11891 | -c "Protocol is TLSv1.3" |
| 11892 | |
| 11893 | requires_gnutls_tls1_3 |
| 11894 | requires_gnutls_next_no_ticket |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11895 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11896 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11897 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11898 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11899 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11900 | run_test "TLS 1.3: Client authentication - opaque key, ecdsa_secp256r1_sha256 - gnutls" \ |
| 11901 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \ |
| 11902 | "$P_CLI debug_level=3 crt_file=data_files/ecdsa_secp256r1.crt \ |
| 11903 | key_file=data_files/ecdsa_secp256r1.key key_opaque=1" \ |
| 11904 | 0 \ |
| 11905 | -c "got a certificate request" \ |
| 11906 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11907 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11908 | -c "Protocol is TLSv1.3" |
| 11909 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11910 | requires_openssl_tls1_3_with_compatible_ephemeral |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11911 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11912 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11913 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11914 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11915 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11916 | run_test "TLS 1.3: Client authentication - opaque key, ecdsa_secp384r1_sha384 - openssl" \ |
| 11917 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \ |
| 11918 | "$P_CLI debug_level=4 crt_file=data_files/ecdsa_secp384r1.crt \ |
| 11919 | key_file=data_files/ecdsa_secp384r1.key key_opaque=1" \ |
| 11920 | 0 \ |
| 11921 | -c "got a certificate request" \ |
| 11922 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11923 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11924 | -c "Protocol is TLSv1.3" |
| 11925 | |
| 11926 | requires_gnutls_tls1_3 |
| 11927 | requires_gnutls_next_no_ticket |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11928 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11929 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11930 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11931 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11932 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11933 | run_test "TLS 1.3: Client authentication - opaque key, ecdsa_secp384r1_sha384 - gnutls" \ |
| 11934 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \ |
| 11935 | "$P_CLI debug_level=3 crt_file=data_files/ecdsa_secp384r1.crt \ |
| 11936 | key_file=data_files/ecdsa_secp384r1.key key_opaque=1" \ |
| 11937 | 0 \ |
| 11938 | -c "got a certificate request" \ |
| 11939 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11940 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11941 | -c "Protocol is TLSv1.3" |
| 11942 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11943 | requires_openssl_tls1_3_with_compatible_ephemeral |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11944 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11945 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11946 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11947 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11948 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11949 | run_test "TLS 1.3: Client authentication - opaque key, ecdsa_secp521r1_sha512 - openssl" \ |
| 11950 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \ |
| 11951 | "$P_CLI debug_level=4 crt_file=data_files/ecdsa_secp521r1.crt \ |
| 11952 | key_file=data_files/ecdsa_secp521r1.key key_opaque=1" \ |
| 11953 | 0 \ |
| 11954 | -c "got a certificate request" \ |
| 11955 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11956 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11957 | -c "Protocol is TLSv1.3" |
| 11958 | |
| 11959 | requires_gnutls_tls1_3 |
| 11960 | requires_gnutls_next_no_ticket |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11961 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11962 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11963 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11964 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11965 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11966 | run_test "TLS 1.3: Client authentication - opaque key, ecdsa_secp521r1_sha512 - gnutls" \ |
| 11967 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \ |
| 11968 | "$P_CLI debug_level=3 crt_file=data_files/ecdsa_secp521r1.crt \ |
| 11969 | key_file=data_files/ecdsa_secp521r1.key key_opaque=1" \ |
| 11970 | 0 \ |
| 11971 | -c "got a certificate request" \ |
| 11972 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11973 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11974 | -c "Protocol is TLSv1.3" |
| 11975 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 11976 | requires_openssl_tls1_3_with_compatible_ephemeral |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11977 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11978 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11979 | requires_config_enabled MBEDTLS_RSA_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11980 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11981 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 11982 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11983 | run_test "TLS 1.3: Client authentication - opaque key, rsa_pss_rsae_sha256 - openssl" \ |
| 11984 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \ |
| 11985 | "$P_CLI debug_level=4 crt_file=data_files/cert_sha256.crt \ |
| 11986 | key_file=data_files/server1.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha256 key_opaque=1" \ |
| 11987 | 0 \ |
| 11988 | -c "got a certificate request" \ |
| 11989 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 11990 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 11991 | -c "Protocol is TLSv1.3" |
| 11992 | |
| 11993 | requires_gnutls_tls1_3 |
| 11994 | requires_gnutls_next_no_ticket |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11995 | requires_config_enabled MBEDTLS_DEBUG_C |
| 11996 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 11997 | requires_config_enabled MBEDTLS_RSA_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 11998 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 11999 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12000 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12001 | run_test "TLS 1.3: Client authentication - opaque key, rsa_pss_rsae_sha256 - gnutls" \ |
| 12002 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \ |
| 12003 | "$P_CLI debug_level=3 crt_file=data_files/server2-sha256.crt \ |
| 12004 | key_file=data_files/server2.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha256 key_opaque=1" \ |
| 12005 | 0 \ |
| 12006 | -c "got a certificate request" \ |
| 12007 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 12008 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 12009 | -c "Protocol is TLSv1.3" |
| 12010 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12011 | requires_openssl_tls1_3_with_compatible_ephemeral |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12012 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12013 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 12014 | requires_config_enabled MBEDTLS_RSA_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12015 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12016 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12017 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12018 | run_test "TLS 1.3: Client authentication - opaque key, rsa_pss_rsae_sha384 - openssl" \ |
| 12019 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 12020 | "$P_CLI debug_level=4 crt_file=data_files/cert_sha256.crt \ |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12021 | key_file=data_files/server1.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha384 key_opaque=1" \ |
| 12022 | 0 \ |
| 12023 | -c "got a certificate request" \ |
| 12024 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 12025 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 12026 | -c "Protocol is TLSv1.3" |
| 12027 | |
| 12028 | requires_gnutls_tls1_3 |
| 12029 | requires_gnutls_next_no_ticket |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12030 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12031 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 12032 | requires_config_enabled MBEDTLS_RSA_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12033 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12034 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12035 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12036 | run_test "TLS 1.3: Client authentication - opaque key, rsa_pss_rsae_sha384 - gnutls" \ |
| 12037 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 12038 | "$P_CLI debug_level=3 crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12039 | key_file=data_files/server2.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha384 key_opaque=1" \ |
| 12040 | 0 \ |
| 12041 | -c "got a certificate request" \ |
| 12042 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 12043 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 12044 | -c "Protocol is TLSv1.3" |
| 12045 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12046 | requires_openssl_tls1_3_with_compatible_ephemeral |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12047 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12048 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 12049 | requires_config_enabled MBEDTLS_RSA_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12050 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12051 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12052 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12053 | run_test "TLS 1.3: Client authentication - opaque key, rsa_pss_rsae_sha512 - openssl" \ |
| 12054 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 12055 | "$P_CLI debug_level=4 crt_file=data_files/cert_sha256.crt \ |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12056 | key_file=data_files/server1.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha512 key_opaque=1" \ |
| 12057 | 0 \ |
| 12058 | -c "got a certificate request" \ |
| 12059 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 12060 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 12061 | -c "Protocol is TLSv1.3" |
| 12062 | |
| 12063 | requires_gnutls_tls1_3 |
| 12064 | requires_gnutls_next_no_ticket |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12065 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12066 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 12067 | requires_config_enabled MBEDTLS_RSA_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12068 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12069 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12070 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12071 | run_test "TLS 1.3: Client authentication - opaque key, rsa_pss_rsae_sha512 - gnutls" \ |
| 12072 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 12073 | "$P_CLI debug_level=3 crt_file=data_files/server2-sha256.crt \ |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12074 | key_file=data_files/server2.key sig_algs=ecdsa_secp256r1_sha256,rsa_pss_rsae_sha512 key_opaque=1" \ |
| 12075 | 0 \ |
| 12076 | -c "got a certificate request" \ |
| 12077 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 12078 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
| 12079 | -c "Protocol is TLSv1.3" |
| 12080 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12081 | requires_openssl_tls1_3_with_compatible_ephemeral |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12082 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12083 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 12084 | requires_config_enabled MBEDTLS_RSA_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12085 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12086 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12087 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12088 | run_test "TLS 1.3: Client authentication - opaque key, client alg not in server list - openssl" \ |
| 12089 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10 |
| 12090 | -sigalgs ecdsa_secp256r1_sha256" \ |
| 12091 | "$P_CLI debug_level=3 crt_file=data_files/ecdsa_secp521r1.crt \ |
| 12092 | key_file=data_files/ecdsa_secp521r1.key sig_algs=ecdsa_secp256r1_sha256,ecdsa_secp521r1_sha512 key_opaque=1" \ |
| 12093 | 1 \ |
| 12094 | -c "got a certificate request" \ |
| 12095 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 12096 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
Xiaokang Qian | ea3d933 | 2022-12-07 06:19:49 +0000 | [diff] [blame] | 12097 | -c "no suitable signature algorithm" |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12098 | |
| 12099 | requires_gnutls_tls1_3 |
| 12100 | requires_gnutls_next_no_ticket |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12101 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12102 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 12103 | requires_config_enabled MBEDTLS_RSA_C |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12104 | requires_config_enabled MBEDTLS_USE_PSA_CRYPTO |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12105 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12106 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12107 | run_test "TLS 1.3: Client authentication - opaque key, client alg not in server list - gnutls" \ |
| 12108 | "$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:-SIGN-ALL:+SIGN-ECDSA-SECP256R1-SHA256:%NO_TICKETS" \ |
| 12109 | "$P_CLI debug_level=3 crt_file=data_files/ecdsa_secp521r1.crt \ |
| 12110 | key_file=data_files/ecdsa_secp521r1.key sig_algs=ecdsa_secp256r1_sha256,ecdsa_secp521r1_sha512 key_opaque=1" \ |
| 12111 | 1 \ |
| 12112 | -c "got a certificate request" \ |
| 12113 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE" \ |
| 12114 | -c "client state: MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY" \ |
Xiaokang Qian | ea3d933 | 2022-12-07 06:19:49 +0000 | [diff] [blame] | 12115 | -c "no suitable signature algorithm" |
Neil Armstrong | 7f6f672 | 2022-04-15 10:09:11 +0200 | [diff] [blame] | 12116 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12117 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | 7c0185f | 2021-11-30 09:16:24 +0100 | [diff] [blame] | 12118 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12119 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12120 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12121 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | df5f868 | 2022-04-05 16:01:03 +0200 | [diff] [blame] | 12122 | run_test "TLS 1.3: HRR check, ciphersuite TLS_AES_128_GCM_SHA256 - openssl" \ |
XiaokangQian | 7bae3b6 | 2022-01-26 06:31:39 +0000 | [diff] [blame] | 12123 | "$O_NEXT_SRV -ciphersuites TLS_AES_128_GCM_SHA256 -sigalgs ecdsa_secp256r1_sha256 -groups P-256 -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 12124 | "$P_CLI debug_level=4" \ |
XiaokangQian | 7bae3b6 | 2022-01-26 06:31:39 +0000 | [diff] [blame] | 12125 | 0 \ |
| 12126 | -c "received HelloRetryRequest message" \ |
XiaokangQian | a909061 | 2022-01-27 03:48:27 +0000 | [diff] [blame] | 12127 | -c "<= ssl_tls13_process_server_hello ( HelloRetryRequest )" \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 12128 | -c "client state: MBEDTLS_SSL_CLIENT_HELLO" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 12129 | -c "Protocol is TLSv1.3" \ |
XiaokangQian | 7bae3b6 | 2022-01-26 06:31:39 +0000 | [diff] [blame] | 12130 | -c "HTTP/1.0 200 ok" |
| 12131 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12132 | requires_openssl_tls1_3_with_compatible_ephemeral |
XiaokangQian | 7bae3b6 | 2022-01-26 06:31:39 +0000 | [diff] [blame] | 12133 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12134 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12135 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12136 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | df5f868 | 2022-04-05 16:01:03 +0200 | [diff] [blame] | 12137 | run_test "TLS 1.3: HRR check, ciphersuite TLS_AES_256_GCM_SHA384 - openssl" \ |
Ronald Cron | fdb0e3f | 2021-12-09 10:39:19 +0100 | [diff] [blame] | 12138 | "$O_NEXT_SRV -ciphersuites TLS_AES_256_GCM_SHA384 -sigalgs ecdsa_secp256r1_sha256 -groups P-256 -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 12139 | "$P_CLI debug_level=4" \ |
XiaokangQian | 6db08dd | 2022-01-18 06:36:23 +0000 | [diff] [blame] | 12140 | 0 \ |
Jerry Yu | 8c5559d | 2021-11-22 21:15:41 +0800 | [diff] [blame] | 12141 | -c "received HelloRetryRequest message" \ |
XiaokangQian | a909061 | 2022-01-27 03:48:27 +0000 | [diff] [blame] | 12142 | -c "<= ssl_tls13_process_server_hello ( HelloRetryRequest )" \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 12143 | -c "client state: MBEDTLS_SSL_CLIENT_HELLO" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 12144 | -c "Protocol is TLSv1.3" \ |
XiaokangQian | 6db08dd | 2022-01-18 06:36:23 +0000 | [diff] [blame] | 12145 | -c "HTTP/1.0 200 ok" |
Jerry Yu | 8c5559d | 2021-11-22 21:15:41 +0800 | [diff] [blame] | 12146 | |
| 12147 | requires_gnutls_tls1_3 |
| 12148 | requires_gnutls_next_no_ticket |
Ronald Cron | 7c0185f | 2021-11-30 09:16:24 +0100 | [diff] [blame] | 12149 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12150 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Przemek Stekiel | c31a798 | 2023-06-27 10:53:33 +0200 | [diff] [blame] | 12151 | requires_config_enabled PSA_WANT_ALG_ECDH |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12152 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12153 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | df5f868 | 2022-04-05 16:01:03 +0200 | [diff] [blame] | 12154 | run_test "TLS 1.3: HRR check, ciphersuite TLS_AES_128_GCM_SHA256 - gnutls" \ |
XiaokangQian | 7bae3b6 | 2022-01-26 06:31:39 +0000 | [diff] [blame] | 12155 | "$G_NEXT_SRV -d 4 --priority=NONE:+GROUP-SECP256R1:+AES-128-GCM:+SHA256:+AEAD:+SIGN-ECDSA-SECP256R1-SHA256:+VERS-TLS1.3:%NO_TICKETS --disable-client-cert" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 12156 | "$P_CLI debug_level=4" \ |
XiaokangQian | 7bae3b6 | 2022-01-26 06:31:39 +0000 | [diff] [blame] | 12157 | 0 \ |
| 12158 | -c "received HelloRetryRequest message" \ |
XiaokangQian | a909061 | 2022-01-27 03:48:27 +0000 | [diff] [blame] | 12159 | -c "<= ssl_tls13_process_server_hello ( HelloRetryRequest )" \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 12160 | -c "client state: MBEDTLS_SSL_CLIENT_HELLO" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 12161 | -c "Protocol is TLSv1.3" \ |
XiaokangQian | 7bae3b6 | 2022-01-26 06:31:39 +0000 | [diff] [blame] | 12162 | -c "HTTP/1.0 200 OK" |
| 12163 | |
| 12164 | requires_gnutls_tls1_3 |
| 12165 | requires_gnutls_next_no_ticket |
XiaokangQian | 7bae3b6 | 2022-01-26 06:31:39 +0000 | [diff] [blame] | 12166 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12167 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Przemek Stekiel | c31a798 | 2023-06-27 10:53:33 +0200 | [diff] [blame] | 12168 | requires_config_enabled PSA_WANT_ALG_ECDH |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12169 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12170 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | df5f868 | 2022-04-05 16:01:03 +0200 | [diff] [blame] | 12171 | run_test "TLS 1.3: HRR check, ciphersuite TLS_AES_256_GCM_SHA384 - gnutls" \ |
XiaokangQian | 355e09a | 2022-01-20 11:14:50 +0000 | [diff] [blame] | 12172 | "$G_NEXT_SRV -d 4 --priority=NONE:+GROUP-SECP256R1:+AES-256-GCM:+SHA384:+AEAD:+SIGN-ECDSA-SECP256R1-SHA256:+VERS-TLS1.3:%NO_TICKETS --disable-client-cert" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 12173 | "$P_CLI debug_level=4" \ |
XiaokangQian | 355e09a | 2022-01-20 11:14:50 +0000 | [diff] [blame] | 12174 | 0 \ |
Jerry Yu | 8c5559d | 2021-11-22 21:15:41 +0800 | [diff] [blame] | 12175 | -c "received HelloRetryRequest message" \ |
XiaokangQian | a909061 | 2022-01-27 03:48:27 +0000 | [diff] [blame] | 12176 | -c "<= ssl_tls13_process_server_hello ( HelloRetryRequest )" \ |
Ronald Cron | 27c85e7 | 2022-03-08 11:37:55 +0100 | [diff] [blame] | 12177 | -c "client state: MBEDTLS_SSL_CLIENT_HELLO" \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 12178 | -c "Protocol is TLSv1.3" \ |
XiaokangQian | 355e09a | 2022-01-20 11:14:50 +0000 | [diff] [blame] | 12179 | -c "HTTP/1.0 200 OK" |
Ronald Cron | fdb0e3f | 2021-12-09 10:39:19 +0100 | [diff] [blame] | 12180 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12181 | requires_openssl_tls1_3_with_compatible_ephemeral |
XiaokangQian | 5e4528c | 2022-02-17 07:51:12 +0000 | [diff] [blame] | 12182 | requires_config_enabled MBEDTLS_DEBUG_C |
XiaokangQian | e8ff350 | 2022-04-22 02:34:40 +0000 | [diff] [blame] | 12183 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12184 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
XiaokangQian | 318dc76 | 2022-04-20 09:43:51 +0000 | [diff] [blame] | 12185 | run_test "TLS 1.3: Server side check - openssl" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12186 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
Jerry Yu | 6622049 | 2022-04-23 13:53:36 +0800 | [diff] [blame] | 12187 | "$O_NEXT_CLI -msg -debug -tls1_3 -no_middlebox" \ |
Jerry Yu | 4d8567f | 2022-04-17 10:57:57 +0800 | [diff] [blame] | 12188 | 0 \ |
Jerry Yu | abf20c7 | 2022-04-14 18:36:14 +0800 | [diff] [blame] | 12189 | -s "tls13 server state: MBEDTLS_SSL_CLIENT_HELLO" \ |
| 12190 | -s "tls13 server state: MBEDTLS_SSL_SERVER_HELLO" \ |
| 12191 | -s "tls13 server state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
Jerry Yu | cef55db | 2022-04-23 11:02:05 +0800 | [diff] [blame] | 12192 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CERTIFICATE" \ |
Jerry Yu | c8bdbf7 | 2022-04-23 12:37:35 +0800 | [diff] [blame] | 12193 | -s "tls13 server state: MBEDTLS_SSL_CERTIFICATE_VERIFY" \ |
| 12194 | -s "tls13 server state: MBEDTLS_SSL_SERVER_FINISHED" \ |
Jerry Yu | 6622049 | 2022-04-23 13:53:36 +0800 | [diff] [blame] | 12195 | -s "tls13 server state: MBEDTLS_SSL_CLIENT_FINISHED" \ |
Jerry Yu | 155493d | 2022-04-25 13:30:18 +0800 | [diff] [blame] | 12196 | -s "tls13 server state: MBEDTLS_SSL_HANDSHAKE_WRAPUP" |
XiaokangQian | 5e4528c | 2022-02-17 07:51:12 +0000 | [diff] [blame] | 12197 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12198 | requires_openssl_tls1_3_with_compatible_ephemeral |
XiaokangQian | 2f150e1 | 2022-04-29 02:01:19 +0000 | [diff] [blame] | 12199 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12200 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12201 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
XiaokangQian | a987e1d | 2022-05-07 01:25:58 +0000 | [diff] [blame] | 12202 | run_test "TLS 1.3: Server side check - openssl with client authentication" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12203 | "$P_SRV debug_level=4 auth_mode=required crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
Jerry Yu | 7eaadae | 2022-05-23 14:53:27 +0800 | [diff] [blame] | 12204 | "$O_NEXT_CLI -msg -debug -cert data_files/server5.crt -key data_files/server5.key -tls1_3 -no_middlebox" \ |
XiaokangQian | 9a4e1dd | 2022-05-26 00:58:11 +0000 | [diff] [blame] | 12205 | 0 \ |
XiaokangQian | 2f150e1 | 2022-04-29 02:01:19 +0000 | [diff] [blame] | 12206 | -s "tls13 server state: MBEDTLS_SSL_CLIENT_HELLO" \ |
| 12207 | -s "tls13 server state: MBEDTLS_SSL_SERVER_HELLO" \ |
| 12208 | -s "tls13 server state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
| 12209 | -s "tls13 server state: MBEDTLS_SSL_CERTIFICATE_REQUEST" \ |
| 12210 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CERTIFICATE" \ |
Jerry Yu | c450566 | 2022-05-10 20:39:21 +0800 | [diff] [blame] | 12211 | -s "tls13 server state: MBEDTLS_SSL_CERTIFICATE_VERIFY" \ |
| 12212 | -s "tls13 server state: MBEDTLS_SSL_SERVER_FINISHED" \ |
XiaokangQian | a987e1d | 2022-05-07 01:25:58 +0000 | [diff] [blame] | 12213 | -s "=> write certificate request" \ |
XiaokangQian | 2f150e1 | 2022-04-29 02:01:19 +0000 | [diff] [blame] | 12214 | -s "=> parse client hello" \ |
| 12215 | -s "<= parse client hello" |
| 12216 | |
XiaokangQian | 5e4528c | 2022-02-17 07:51:12 +0000 | [diff] [blame] | 12217 | requires_gnutls_tls1_3 |
| 12218 | requires_gnutls_next_no_ticket |
XiaokangQian | 5e4528c | 2022-02-17 07:51:12 +0000 | [diff] [blame] | 12219 | requires_config_enabled MBEDTLS_DEBUG_C |
XiaokangQian | e8ff350 | 2022-04-22 02:34:40 +0000 | [diff] [blame] | 12220 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12221 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
XiaokangQian | 318dc76 | 2022-04-20 09:43:51 +0000 | [diff] [blame] | 12222 | run_test "TLS 1.3: Server side check - gnutls" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12223 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
XiaokangQian | 3f84d5d | 2022-04-19 06:36:17 +0000 | [diff] [blame] | 12224 | "$G_NEXT_CLI localhost -d 4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE -V" \ |
Jerry Yu | 6622049 | 2022-04-23 13:53:36 +0800 | [diff] [blame] | 12225 | 0 \ |
Jerry Yu | abf20c7 | 2022-04-14 18:36:14 +0800 | [diff] [blame] | 12226 | -s "tls13 server state: MBEDTLS_SSL_CLIENT_HELLO" \ |
| 12227 | -s "tls13 server state: MBEDTLS_SSL_SERVER_HELLO" \ |
| 12228 | -s "tls13 server state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
Jerry Yu | cef55db | 2022-04-23 11:02:05 +0800 | [diff] [blame] | 12229 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CERTIFICATE" \ |
Jerry Yu | c8bdbf7 | 2022-04-23 12:37:35 +0800 | [diff] [blame] | 12230 | -s "tls13 server state: MBEDTLS_SSL_CERTIFICATE_VERIFY" \ |
| 12231 | -s "tls13 server state: MBEDTLS_SSL_SERVER_FINISHED" \ |
Jerry Yu | 6622049 | 2022-04-23 13:53:36 +0800 | [diff] [blame] | 12232 | -s "tls13 server state: MBEDTLS_SSL_CLIENT_FINISHED" \ |
| 12233 | -s "tls13 server state: MBEDTLS_SSL_HANDSHAKE_WRAPUP" \ |
| 12234 | -c "HTTP/1.0 200 OK" |
XiaokangQian | 5e4528c | 2022-02-17 07:51:12 +0000 | [diff] [blame] | 12235 | |
XiaokangQian | 2f150e1 | 2022-04-29 02:01:19 +0000 | [diff] [blame] | 12236 | requires_gnutls_tls1_3 |
| 12237 | requires_gnutls_next_no_ticket |
XiaokangQian | 2f150e1 | 2022-04-29 02:01:19 +0000 | [diff] [blame] | 12238 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12239 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12240 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
XiaokangQian | a987e1d | 2022-05-07 01:25:58 +0000 | [diff] [blame] | 12241 | run_test "TLS 1.3: Server side check - gnutls with client authentication" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12242 | "$P_SRV debug_level=4 auth_mode=required crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
XiaokangQian | 2f150e1 | 2022-04-29 02:01:19 +0000 | [diff] [blame] | 12243 | "$G_NEXT_CLI localhost -d 4 --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE -V" \ |
XiaokangQian | c3017f6 | 2022-05-13 05:55:41 +0000 | [diff] [blame] | 12244 | 0 \ |
XiaokangQian | 2f150e1 | 2022-04-29 02:01:19 +0000 | [diff] [blame] | 12245 | -s "tls13 server state: MBEDTLS_SSL_CLIENT_HELLO" \ |
| 12246 | -s "tls13 server state: MBEDTLS_SSL_SERVER_HELLO" \ |
| 12247 | -s "tls13 server state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
| 12248 | -s "tls13 server state: MBEDTLS_SSL_CERTIFICATE_REQUEST" \ |
| 12249 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CERTIFICATE" \ |
Jerry Yu | c450566 | 2022-05-10 20:39:21 +0800 | [diff] [blame] | 12250 | -s "tls13 server state: MBEDTLS_SSL_CERTIFICATE_VERIFY" \ |
| 12251 | -s "tls13 server state: MBEDTLS_SSL_SERVER_FINISHED" \ |
XiaokangQian | a987e1d | 2022-05-07 01:25:58 +0000 | [diff] [blame] | 12252 | -s "=> write certificate request" \ |
XiaokangQian | 2f150e1 | 2022-04-29 02:01:19 +0000 | [diff] [blame] | 12253 | -s "=> parse client hello" \ |
| 12254 | -s "<= parse client hello" |
| 12255 | |
Jerry Yu | 8b9fd37 | 2022-04-14 20:55:12 +0800 | [diff] [blame] | 12256 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12257 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Jerry Yu | 955ddd7 | 2022-04-22 22:27:33 +0800 | [diff] [blame] | 12258 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12259 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | 8b9fd37 | 2022-04-14 20:55:12 +0800 | [diff] [blame] | 12260 | run_test "TLS 1.3: Server side check - mbedtls" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12261 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 12262 | "$P_CLI debug_level=4" \ |
XiaokangQian | c3017f6 | 2022-05-13 05:55:41 +0000 | [diff] [blame] | 12263 | 0 \ |
Jerry Yu | 8b9fd37 | 2022-04-14 20:55:12 +0800 | [diff] [blame] | 12264 | -s "tls13 server state: MBEDTLS_SSL_CLIENT_HELLO" \ |
| 12265 | -s "tls13 server state: MBEDTLS_SSL_SERVER_HELLO" \ |
| 12266 | -s "tls13 server state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
Jerry Yu | a7abc5e | 2022-05-11 13:32:03 +0800 | [diff] [blame] | 12267 | -s "tls13 server state: MBEDTLS_SSL_CERTIFICATE_REQUEST" \ |
Jerry Yu | cef55db | 2022-04-23 11:02:05 +0800 | [diff] [blame] | 12268 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CERTIFICATE" \ |
Jerry Yu | a7abc5e | 2022-05-11 13:32:03 +0800 | [diff] [blame] | 12269 | -s "tls13 server state: MBEDTLS_SSL_CERTIFICATE_VERIFY" \ |
| 12270 | -s "tls13 server state: MBEDTLS_SSL_SERVER_FINISHED" \ |
| 12271 | -s "tls13 server state: MBEDTLS_SSL_CLIENT_FINISHED" \ |
| 12272 | -s "tls13 server state: MBEDTLS_SSL_HANDSHAKE_WRAPUP" \ |
| 12273 | -c "HTTP/1.0 200 OK" |
Jerry Yu | 8b9fd37 | 2022-04-14 20:55:12 +0800 | [diff] [blame] | 12274 | |
XiaokangQian | 45c2220 | 2022-05-06 06:54:09 +0000 | [diff] [blame] | 12275 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12276 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 12277 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12278 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
XiaokangQian | a987e1d | 2022-05-07 01:25:58 +0000 | [diff] [blame] | 12279 | run_test "TLS 1.3: Server side check - mbedtls with client authentication" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12280 | "$P_SRV debug_level=4 auth_mode=required crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 12281 | "$P_CLI debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
XiaokangQian | c3017f6 | 2022-05-13 05:55:41 +0000 | [diff] [blame] | 12282 | 0 \ |
XiaokangQian | 45c2220 | 2022-05-06 06:54:09 +0000 | [diff] [blame] | 12283 | -s "tls13 server state: MBEDTLS_SSL_CLIENT_HELLO" \ |
| 12284 | -s "tls13 server state: MBEDTLS_SSL_SERVER_HELLO" \ |
| 12285 | -s "tls13 server state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
| 12286 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CERTIFICATE" \ |
Jerry Yu | a7abc5e | 2022-05-11 13:32:03 +0800 | [diff] [blame] | 12287 | -s "=> write certificate request" \ |
XiaokangQian | 45c2220 | 2022-05-06 06:54:09 +0000 | [diff] [blame] | 12288 | -c "client state: MBEDTLS_SSL_CERTIFICATE_REQUEST" \ |
XiaokangQian | 45c2220 | 2022-05-06 06:54:09 +0000 | [diff] [blame] | 12289 | -s "=> parse client hello" \ |
| 12290 | -s "<= parse client hello" |
| 12291 | |
XiaokangQian | aca9048 | 2022-05-19 07:19:31 +0000 | [diff] [blame] | 12292 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12293 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 12294 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12295 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
XiaokangQian | aca9048 | 2022-05-19 07:19:31 +0000 | [diff] [blame] | 12296 | run_test "TLS 1.3: Server side check - mbedtls with client empty certificate" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12297 | "$P_SRV debug_level=4 auth_mode=required crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 12298 | "$P_CLI debug_level=4 crt_file=none key_file=none" \ |
XiaokangQian | aca9048 | 2022-05-19 07:19:31 +0000 | [diff] [blame] | 12299 | 1 \ |
| 12300 | -s "tls13 server state: MBEDTLS_SSL_CLIENT_HELLO" \ |
| 12301 | -s "tls13 server state: MBEDTLS_SSL_SERVER_HELLO" \ |
| 12302 | -s "tls13 server state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
| 12303 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CERTIFICATE" \ |
| 12304 | -s "=> write certificate request" \ |
| 12305 | -s "SSL - No client certification received from the client, but required by the authentication mode" \ |
| 12306 | -c "client state: MBEDTLS_SSL_CERTIFICATE_REQUEST" \ |
| 12307 | -s "=> parse client hello" \ |
| 12308 | -s "<= parse client hello" |
| 12309 | |
XiaokangQian | aca9048 | 2022-05-19 07:19:31 +0000 | [diff] [blame] | 12310 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12311 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 12312 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12313 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
XiaokangQian | aca9048 | 2022-05-19 07:19:31 +0000 | [diff] [blame] | 12314 | run_test "TLS 1.3: Server side check - mbedtls with optional client authentication" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12315 | "$P_SRV debug_level=4 auth_mode=optional crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 12316 | "$P_CLI debug_level=4 crt_file=none key_file=none" \ |
XiaokangQian | aca9048 | 2022-05-19 07:19:31 +0000 | [diff] [blame] | 12317 | 0 \ |
| 12318 | -s "tls13 server state: MBEDTLS_SSL_CLIENT_HELLO" \ |
| 12319 | -s "tls13 server state: MBEDTLS_SSL_SERVER_HELLO" \ |
| 12320 | -s "tls13 server state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
| 12321 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CERTIFICATE" \ |
| 12322 | -s "=> write certificate request" \ |
| 12323 | -c "client state: MBEDTLS_SSL_CERTIFICATE_REQUEST" \ |
| 12324 | -s "=> parse client hello" \ |
| 12325 | -s "<= parse client hello" |
Jerry Yu | ede50ea | 2022-05-05 11:21:20 +0800 | [diff] [blame] | 12326 | |
| 12327 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12328 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 12329 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12330 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Przemek Stekiel | c31a798 | 2023-06-27 10:53:33 +0200 | [diff] [blame] | 12331 | requires_config_enabled PSA_WANT_ALG_ECDH |
Jerry Yu | ede50ea | 2022-05-05 11:21:20 +0800 | [diff] [blame] | 12332 | run_test "TLS 1.3: server: HRR check - mbedtls" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12333 | "$P_SRV debug_level=4 groups=secp384r1" \ |
| 12334 | "$P_CLI debug_level=4 groups=secp256r1,secp384r1" \ |
Jerry Yu | 36becb1 | 2022-05-12 16:57:20 +0800 | [diff] [blame] | 12335 | 0 \ |
Jerry Yu | ede50ea | 2022-05-05 11:21:20 +0800 | [diff] [blame] | 12336 | -s "tls13 server state: MBEDTLS_SSL_CLIENT_HELLO" \ |
| 12337 | -s "tls13 server state: MBEDTLS_SSL_SERVER_HELLO" \ |
| 12338 | -s "tls13 server state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
| 12339 | -s "tls13 server state: MBEDTLS_SSL_HELLO_RETRY_REQUEST" \ |
| 12340 | -c "client state: MBEDTLS_SSL_ENCRYPTED_EXTENSIONS" \ |
| 12341 | -s "selected_group: secp384r1" \ |
Jerry Yu | ede50ea | 2022-05-05 11:21:20 +0800 | [diff] [blame] | 12342 | -s "=> write hello retry request" \ |
| 12343 | -s "<= write hello retry request" |
| 12344 | |
Jerry Yu | b89125b | 2022-05-13 15:45:49 +0800 | [diff] [blame] | 12345 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12346 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 12347 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12348 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | b89125b | 2022-05-13 15:45:49 +0800 | [diff] [blame] | 12349 | run_test "TLS 1.3: Server side check, no server certificate available" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12350 | "$P_SRV debug_level=4 crt_file=none key_file=none" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 12351 | "$P_CLI debug_level=4" \ |
Jerry Yu | b89125b | 2022-05-13 15:45:49 +0800 | [diff] [blame] | 12352 | 1 \ |
| 12353 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CERTIFICATE" \ |
| 12354 | -s "No certificate available." |
| 12355 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12356 | requires_openssl_tls1_3_with_compatible_ephemeral |
XiaokangQian | f2a9420 | 2022-05-20 06:44:24 +0000 | [diff] [blame] | 12357 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12358 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12359 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12360 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
XiaokangQian | 2ccd97b | 2022-05-31 08:30:17 +0000 | [diff] [blame] | 12361 | run_test "TLS 1.3: Server side check - openssl with sni" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12362 | "$P_SRV debug_level=4 auth_mode=required crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0 \ |
XiaokangQian | 23c5be6 | 2022-06-07 02:04:34 +0000 | [diff] [blame] | 12363 | sni=localhost,data_files/server5.crt,data_files/server5.key,data_files/test-ca_cat12.crt,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
XiaokangQian | f2a9420 | 2022-05-20 06:44:24 +0000 | [diff] [blame] | 12364 | "$O_NEXT_CLI -msg -debug -servername localhost -CAfile data_files/test-ca_cat12.crt -cert data_files/server5.crt -key data_files/server5.key -tls1_3" \ |
| 12365 | 0 \ |
XiaokangQian | f2a9420 | 2022-05-20 06:44:24 +0000 | [diff] [blame] | 12366 | -s "parse ServerName extension" \ |
XiaokangQian | 129aeb9 | 2022-06-02 09:29:18 +0000 | [diff] [blame] | 12367 | -s "HTTP/1.0 200 OK" |
XiaokangQian | f2a9420 | 2022-05-20 06:44:24 +0000 | [diff] [blame] | 12368 | |
XiaokangQian | ac41edf | 2022-05-31 13:22:13 +0000 | [diff] [blame] | 12369 | requires_gnutls_tls1_3 |
XiaokangQian | f2a9420 | 2022-05-20 06:44:24 +0000 | [diff] [blame] | 12370 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12371 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12372 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12373 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
XiaokangQian | 2ccd97b | 2022-05-31 08:30:17 +0000 | [diff] [blame] | 12374 | run_test "TLS 1.3: Server side check - gnutls with sni" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12375 | "$P_SRV debug_level=4 auth_mode=required crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0 \ |
XiaokangQian | 23c5be6 | 2022-06-07 02:04:34 +0000 | [diff] [blame] | 12376 | sni=localhost,data_files/server5.crt,data_files/server5.key,data_files/test-ca_cat12.crt,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
XiaokangQian | f2a9420 | 2022-05-20 06:44:24 +0000 | [diff] [blame] | 12377 | "$G_NEXT_CLI localhost -d 4 --sni-hostname=localhost --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:%NO_TICKETS -V" \ |
| 12378 | 0 \ |
XiaokangQian | f2a9420 | 2022-05-20 06:44:24 +0000 | [diff] [blame] | 12379 | -s "parse ServerName extension" \ |
XiaokangQian | 129aeb9 | 2022-06-02 09:29:18 +0000 | [diff] [blame] | 12380 | -s "HTTP/1.0 200 OK" |
XiaokangQian | f2a9420 | 2022-05-20 06:44:24 +0000 | [diff] [blame] | 12381 | |
XiaokangQian | 40a3523 | 2022-05-07 09:02:40 +0000 | [diff] [blame] | 12382 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12383 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 12384 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12385 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12386 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
XiaokangQian | 2ccd97b | 2022-05-31 08:30:17 +0000 | [diff] [blame] | 12387 | run_test "TLS 1.3: Server side check - mbedtls with sni" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12388 | "$P_SRV debug_level=4 auth_mode=required crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0 \ |
XiaokangQian | 40a3523 | 2022-05-07 09:02:40 +0000 | [diff] [blame] | 12389 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
Ronald Cron | 65f9029 | 2023-03-13 17:38:12 +0100 | [diff] [blame] | 12390 | "$P_CLI debug_level=4 server_name=localhost crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
XiaokangQian | f2a9420 | 2022-05-20 06:44:24 +0000 | [diff] [blame] | 12391 | 0 \ |
XiaokangQian | f2a9420 | 2022-05-20 06:44:24 +0000 | [diff] [blame] | 12392 | -s "parse ServerName extension" \ |
XiaokangQian | 129aeb9 | 2022-06-02 09:29:18 +0000 | [diff] [blame] | 12393 | -s "HTTP/1.0 200 OK" |
XiaokangQian | 40a3523 | 2022-05-07 09:02:40 +0000 | [diff] [blame] | 12394 | |
Gilles Peskine | 2baaf60 | 2022-01-07 15:46:12 +0100 | [diff] [blame] | 12395 | for i in opt-testcases/*.sh |
Jerry Yu | cdcb683 | 2021-11-29 16:50:13 +0800 | [diff] [blame] | 12396 | do |
Gilles Peskine | 5eb2b02 | 2022-01-07 15:47:02 +0100 | [diff] [blame] | 12397 | TEST_SUITE_NAME=${i##*/} |
| 12398 | TEST_SUITE_NAME=${TEST_SUITE_NAME%.*} |
| 12399 | . "$i" |
Jerry Yu | cdcb683 | 2021-11-29 16:50:13 +0800 | [diff] [blame] | 12400 | done |
Gilles Peskine | 5eb2b02 | 2022-01-07 15:47:02 +0100 | [diff] [blame] | 12401 | unset TEST_SUITE_NAME |
Jerry Yu | 305bfc3 | 2021-11-24 16:04:47 +0800 | [diff] [blame] | 12402 | |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12403 | # Test 1.3 compatibility mode |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12404 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 12405 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12406 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 12407 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12408 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12409 | run_test "TLS 1.3 m->m both peers do not support middlebox compatibility" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12410 | "$P_SRV debug_level=4 tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12411 | "$P_CLI debug_level=4" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12412 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12413 | -s "Protocol is TLSv1.3" \ |
| 12414 | -c "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12415 | -S "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO" \ |
| 12416 | -C "Ignore ChangeCipherSpec in TLS 1.3 compatibility mode" |
| 12417 | |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12418 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12419 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 12420 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12421 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12422 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12423 | run_test "TLS 1.3 m->m both with middlebox compat support" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12424 | "$P_SRV debug_level=4 tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12425 | "$P_CLI debug_level=4" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12426 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12427 | -s "Protocol is TLSv1.3" \ |
| 12428 | -c "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12429 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO" \ |
| 12430 | -c "Ignore ChangeCipherSpec in TLS 1.3 compatibility mode" |
| 12431 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12432 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | fdb0e3f | 2021-12-09 10:39:19 +0100 | [diff] [blame] | 12433 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
Ronald Cron | 7c0185f | 2021-11-30 09:16:24 +0100 | [diff] [blame] | 12434 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12435 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12436 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | a55c5a1 | 2021-11-30 09:32:47 +0100 | [diff] [blame] | 12437 | run_test "TLS 1.3 m->O both peers do not support middlebox compatibility" \ |
Ronald Cron | fdb0e3f | 2021-12-09 10:39:19 +0100 | [diff] [blame] | 12438 | "$O_NEXT_SRV -msg -tls1_3 -no_middlebox -num_tickets 0 -no_resume_ephemeral -no_cache" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12439 | "$P_CLI debug_level=4" \ |
Ronald Cron | fdb0e3f | 2021-12-09 10:39:19 +0100 | [diff] [blame] | 12440 | 0 \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 12441 | -c "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12442 | -C "ChangeCipherSpec invalid in TLS 1.3 without compatibility mode" \ |
| 12443 | -C "Ignore ChangeCipherSpec in TLS 1.3 compatibility mode" |
Ronald Cron | fdb0e3f | 2021-12-09 10:39:19 +0100 | [diff] [blame] | 12444 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12445 | requires_openssl_tls1_3_with_compatible_ephemeral |
Ronald Cron | fdb0e3f | 2021-12-09 10:39:19 +0100 | [diff] [blame] | 12446 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
Ronald Cron | 7c0185f | 2021-11-30 09:16:24 +0100 | [diff] [blame] | 12447 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12448 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12449 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | a55c5a1 | 2021-11-30 09:32:47 +0100 | [diff] [blame] | 12450 | run_test "TLS 1.3 m->O server with middlebox compat support, not client" \ |
Ronald Cron | fdb0e3f | 2021-12-09 10:39:19 +0100 | [diff] [blame] | 12451 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12452 | "$P_CLI debug_level=4" \ |
Ronald Cron | fdb0e3f | 2021-12-09 10:39:19 +0100 | [diff] [blame] | 12453 | 1 \ |
| 12454 | -c "ChangeCipherSpec invalid in TLS 1.3 without compatibility mode" |
| 12455 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12456 | requires_openssl_tls1_3_with_compatible_ephemeral |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12457 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12458 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12459 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12460 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12461 | run_test "TLS 1.3 m->O both with middlebox compat support" \ |
| 12462 | "$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12463 | "$P_CLI debug_level=4" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12464 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12465 | -c "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12466 | -c "Ignore ChangeCipherSpec in TLS 1.3 compatibility mode" |
| 12467 | |
Ronald Cron | a55c5a1 | 2021-11-30 09:32:47 +0100 | [diff] [blame] | 12468 | requires_gnutls_tls1_3 |
| 12469 | requires_gnutls_next_no_ticket |
| 12470 | requires_gnutls_next_disable_tls13_compat |
Ronald Cron | a55c5a1 | 2021-11-30 09:32:47 +0100 | [diff] [blame] | 12471 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 12472 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12473 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12474 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | a55c5a1 | 2021-11-30 09:32:47 +0100 | [diff] [blame] | 12475 | run_test "TLS 1.3 m->G both peers do not support middlebox compatibility" \ |
| 12476 | "$G_NEXT_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE --disable-client-cert" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12477 | "$P_CLI debug_level=4" \ |
Ronald Cron | a55c5a1 | 2021-11-30 09:32:47 +0100 | [diff] [blame] | 12478 | 0 \ |
Ronald Cron | a1b8f6e | 2022-03-18 14:04:12 +0100 | [diff] [blame] | 12479 | -c "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12480 | -C "ChangeCipherSpec invalid in TLS 1.3 without compatibility mode" \ |
| 12481 | -C "Ignore ChangeCipherSpec in TLS 1.3 compatibility mode" |
Ronald Cron | a55c5a1 | 2021-11-30 09:32:47 +0100 | [diff] [blame] | 12482 | |
| 12483 | requires_gnutls_tls1_3 |
| 12484 | requires_gnutls_next_no_ticket |
Ronald Cron | a55c5a1 | 2021-11-30 09:32:47 +0100 | [diff] [blame] | 12485 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 12486 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12487 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12488 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Ronald Cron | a55c5a1 | 2021-11-30 09:32:47 +0100 | [diff] [blame] | 12489 | run_test "TLS 1.3 m->G server with middlebox compat support, not client" \ |
| 12490 | "$G_NEXT_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS --disable-client-cert" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12491 | "$P_CLI debug_level=4" \ |
Ronald Cron | a55c5a1 | 2021-11-30 09:32:47 +0100 | [diff] [blame] | 12492 | 1 \ |
| 12493 | -c "ChangeCipherSpec invalid in TLS 1.3 without compatibility mode" |
| 12494 | |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12495 | requires_gnutls_tls1_3 |
| 12496 | requires_gnutls_next_no_ticket |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12497 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12498 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12499 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12500 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12501 | run_test "TLS 1.3 m->G both with middlebox compat support" \ |
| 12502 | "$G_NEXT_SRV --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS --disable-client-cert" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12503 | "$P_CLI debug_level=4" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12504 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12505 | -c "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12506 | -c "Ignore ChangeCipherSpec in TLS 1.3 compatibility mode" |
| 12507 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12508 | requires_openssl_tls1_3_with_compatible_ephemeral |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12509 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 12510 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12511 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12512 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12513 | run_test "TLS 1.3 O->m both peers do not support middlebox compatibility" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12514 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12515 | "$O_NEXT_CLI -msg -debug -no_middlebox" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12516 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12517 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12518 | -S "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO" \ |
| 12519 | -C "14 03 03 00 01" |
| 12520 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12521 | requires_openssl_tls1_3_with_compatible_ephemeral |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12522 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12523 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12524 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12525 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12526 | run_test "TLS 1.3 O->m server with middlebox compat support, not client" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12527 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12528 | "$O_NEXT_CLI -msg -debug -no_middlebox" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12529 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12530 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12531 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO" |
| 12532 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12533 | requires_openssl_tls1_3_with_compatible_ephemeral |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12534 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12535 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12536 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12537 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12538 | run_test "TLS 1.3 O->m both with middlebox compat support" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12539 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12540 | "$O_NEXT_CLI -msg -debug" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12541 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12542 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12543 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO" \ |
| 12544 | -c "14 03 03 00 01" |
| 12545 | |
| 12546 | requires_gnutls_tls1_3 |
| 12547 | requires_gnutls_next_no_ticket |
| 12548 | requires_gnutls_next_disable_tls13_compat |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12549 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 12550 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12551 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12552 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12553 | run_test "TLS 1.3 G->m both peers do not support middlebox compatibility" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12554 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12555 | "$G_NEXT_CLI localhost --priority=NORMAL:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE -V" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12556 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12557 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12558 | -S "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO" \ |
| 12559 | -C "SSL 3.3 ChangeCipherSpec packet received" |
| 12560 | |
| 12561 | requires_gnutls_tls1_3 |
| 12562 | requires_gnutls_next_no_ticket |
| 12563 | requires_gnutls_next_disable_tls13_compat |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12564 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12565 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12566 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12567 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12568 | run_test "TLS 1.3 G->m server with middlebox compat support, not client" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12569 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12570 | "$G_NEXT_CLI localhost --debug=10 --priority=NORMAL:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE -V" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12571 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12572 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12573 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO" \ |
| 12574 | -c "SSL 3.3 ChangeCipherSpec packet received" \ |
| 12575 | -c "discarding change cipher spec in TLS1.3" |
| 12576 | |
| 12577 | requires_gnutls_tls1_3 |
| 12578 | requires_gnutls_next_no_ticket |
| 12579 | requires_gnutls_next_disable_tls13_compat |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12580 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12581 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12582 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12583 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12584 | run_test "TLS 1.3 G->m both with middlebox compat support" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12585 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12586 | "$G_NEXT_CLI localhost --debug=10 --priority=NORMAL:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE -V" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12587 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12588 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12589 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO" \ |
| 12590 | -c "SSL 3.3 ChangeCipherSpec packet received" |
| 12591 | |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12592 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 12593 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12594 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 12595 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12596 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12597 | run_test "TLS 1.3 m->m HRR both peers do not support middlebox compatibility" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12598 | "$P_SRV debug_level=4 groups=secp384r1 tickets=0" \ |
| 12599 | "$P_CLI debug_level=4 groups=secp256r1,secp384r1" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12600 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12601 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12602 | -c "Protocol is TLSv1.3" \ |
| 12603 | -s "tls13 server state: MBEDTLS_SSL_HELLO_RETRY_REQUEST" \ |
Gabor Mezei | f7044ea | 2022-06-28 16:01:49 +0200 | [diff] [blame] | 12604 | -S "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12605 | -C "Ignore ChangeCipherSpec in TLS 1.3 compatibility mode" |
| 12606 | |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12607 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12608 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 12609 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Przemek Stekiel | c31a798 | 2023-06-27 10:53:33 +0200 | [diff] [blame] | 12610 | requires_config_enabled PSA_WANT_ALG_ECDH |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12611 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12612 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12613 | run_test "TLS 1.3 m->m HRR both with middlebox compat support" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12614 | "$P_SRV debug_level=4 groups=secp384r1 tickets=0" \ |
| 12615 | "$P_CLI debug_level=4 groups=secp256r1,secp384r1" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12616 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12617 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12618 | -c "Protocol is TLSv1.3" \ |
| 12619 | -s "tls13 server state: MBEDTLS_SSL_HELLO_RETRY_REQUEST" \ |
Gabor Mezei | f7044ea | 2022-06-28 16:01:49 +0200 | [diff] [blame] | 12620 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12621 | -c "Ignore ChangeCipherSpec in TLS 1.3 compatibility mode" |
| 12622 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12623 | requires_openssl_tls1_3_with_compatible_ephemeral |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12624 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 12625 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12626 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12627 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12628 | run_test "TLS 1.3 m->O HRR both peers do not support middlebox compatibility" \ |
| 12629 | "$O_NEXT_SRV -msg -tls1_3 -groups P-384 -no_middlebox -num_tickets 0 -no_cache" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12630 | "$P_CLI debug_level=4 groups=secp256r1,secp384r1" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12631 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12632 | -c "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12633 | -c "received HelloRetryRequest message" \ |
| 12634 | -C "ChangeCipherSpec invalid in TLS 1.3 without compatibility mode" \ |
| 12635 | -C "Ignore ChangeCipherSpec in TLS 1.3 compatibility mode" |
| 12636 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12637 | requires_openssl_tls1_3_with_compatible_ephemeral |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12638 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 12639 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12640 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12641 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12642 | run_test "TLS 1.3 m->O HRR server with middlebox compat support, not client" \ |
| 12643 | "$O_NEXT_SRV -msg -tls1_3 -groups P-384 -num_tickets 0 -no_cache" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12644 | "$P_CLI debug_level=4 groups=secp256r1,secp384r1" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12645 | 1 \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12646 | -c "received HelloRetryRequest message" \ |
| 12647 | -c "ChangeCipherSpec invalid in TLS 1.3 without compatibility mode" |
| 12648 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12649 | requires_openssl_tls1_3_with_compatible_ephemeral |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12650 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12651 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12652 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12653 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12654 | run_test "TLS 1.3 m->O HRR both with middlebox compat support" \ |
| 12655 | "$O_NEXT_SRV -msg -tls1_3 -groups P-384 -num_tickets 0 -no_resume_ephemeral -no_cache" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12656 | "$P_CLI debug_level=4 groups=secp256r1,secp384r1" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12657 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12658 | -c "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12659 | -c "Ignore ChangeCipherSpec in TLS 1.3 compatibility mode" |
| 12660 | |
| 12661 | requires_gnutls_tls1_3 |
| 12662 | requires_gnutls_next_no_ticket |
| 12663 | requires_gnutls_next_disable_tls13_compat |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12664 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 12665 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12666 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12667 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12668 | run_test "TLS 1.3 m->G HRR both peers do not support middlebox compatibility" \ |
| 12669 | "$G_NEXT_SRV --priority=NORMAL:-GROUP-ALL:+GROUP-SECP384R1:-VERS-ALL:+VERS-TLS1.3:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE --disable-client-cert" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12670 | "$P_CLI debug_level=4 groups=secp256r1,secp384r1" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12671 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12672 | -c "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12673 | -c "received HelloRetryRequest message" \ |
| 12674 | -C "ChangeCipherSpec invalid in TLS 1.3 without compatibility mode" \ |
| 12675 | -C "Ignore ChangeCipherSpec in TLS 1.3 compatibility mode" |
| 12676 | |
| 12677 | requires_gnutls_tls1_3 |
| 12678 | requires_gnutls_next_no_ticket |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12679 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 12680 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12681 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12682 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12683 | run_test "TLS 1.3 m->G HRR server with middlebox compat support, not client" \ |
| 12684 | "$G_NEXT_SRV --priority=NORMAL:-GROUP-ALL:+GROUP-SECP384R1:-VERS-ALL:+VERS-TLS1.3:%NO_TICKETS --disable-client-cert" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12685 | "$P_CLI debug_level=4 groups=secp256r1,secp384r1" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12686 | 1 \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12687 | -c "received HelloRetryRequest message" \ |
| 12688 | -c "ChangeCipherSpec invalid in TLS 1.3 without compatibility mode" |
| 12689 | |
| 12690 | requires_gnutls_tls1_3 |
| 12691 | requires_gnutls_next_no_ticket |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12692 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12693 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Przemek Stekiel | c31a798 | 2023-06-27 10:53:33 +0200 | [diff] [blame] | 12694 | requires_config_enabled PSA_WANT_ALG_ECDH |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12695 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12696 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12697 | run_test "TLS 1.3 m->G HRR both with middlebox compat support" \ |
| 12698 | "$G_NEXT_SRV --priority=NORMAL:-GROUP-ALL:+GROUP-SECP384R1:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS --disable-client-cert" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12699 | "$P_CLI debug_level=4 groups=secp256r1,secp384r1" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12700 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12701 | -c "Protocol is TLSv1.3" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12702 | -c "Ignore ChangeCipherSpec in TLS 1.3 compatibility mode" |
| 12703 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12704 | requires_openssl_tls1_3_with_compatible_ephemeral |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12705 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 12706 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12707 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12708 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12709 | run_test "TLS 1.3 O->m HRR both peers do not support middlebox compatibility" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12710 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key groups=secp384r1 tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12711 | "$O_NEXT_CLI -msg -debug -groups P-256:P-384 -no_middlebox" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12712 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12713 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | f7044ea | 2022-06-28 16:01:49 +0200 | [diff] [blame] | 12714 | -S "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12715 | -C "14 03 03 00 01" |
| 12716 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12717 | requires_openssl_tls1_3_with_compatible_ephemeral |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12718 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12719 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12720 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12721 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12722 | run_test "TLS 1.3 O->m HRR server with middlebox compat support, not client" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12723 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key groups=secp384r1 tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12724 | "$O_NEXT_CLI -msg -debug -groups P-256:P-384 -no_middlebox" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12725 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12726 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | f7044ea | 2022-06-28 16:01:49 +0200 | [diff] [blame] | 12727 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12728 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12729 | requires_openssl_tls1_3_with_compatible_ephemeral |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12730 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12731 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12732 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12733 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12734 | run_test "TLS 1.3 O->m HRR both with middlebox compat support" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12735 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key groups=secp384r1 tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12736 | "$O_NEXT_CLI -msg -debug -groups P-256:P-384" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12737 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12738 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | f7044ea | 2022-06-28 16:01:49 +0200 | [diff] [blame] | 12739 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12740 | -c "14 03 03 00 01" |
| 12741 | |
| 12742 | requires_gnutls_tls1_3 |
| 12743 | requires_gnutls_next_no_ticket |
| 12744 | requires_gnutls_next_disable_tls13_compat |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12745 | requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 12746 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12747 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 12748 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12749 | run_test "TLS 1.3 G->m HRR both peers do not support middlebox compatibility" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12750 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key groups=secp384r1 tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12751 | "$G_NEXT_CLI localhost --priority=NORMAL:-GROUP-ALL:+GROUP-SECP256R1:+GROUP-SECP384R1:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE -V" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12752 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12753 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | f7044ea | 2022-06-28 16:01:49 +0200 | [diff] [blame] | 12754 | -S "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12755 | -C "SSL 3.3 ChangeCipherSpec packet received" |
| 12756 | |
| 12757 | requires_gnutls_tls1_3 |
| 12758 | requires_gnutls_next_no_ticket |
| 12759 | requires_gnutls_next_disable_tls13_compat |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12760 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12761 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Przemek Stekiel | c31a798 | 2023-06-27 10:53:33 +0200 | [diff] [blame] | 12762 | requires_config_enabled PSA_WANT_ALG_ECDH |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12763 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12764 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12765 | run_test "TLS 1.3 G->m HRR server with middlebox compat support, not client" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12766 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key groups=secp384r1 tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12767 | "$G_NEXT_CLI localhost --debug=10 --priority=NORMAL:-GROUP-ALL:+GROUP-SECP256R1:+GROUP-SECP384R1:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE -V" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12768 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12769 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | f7044ea | 2022-06-28 16:01:49 +0200 | [diff] [blame] | 12770 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12771 | -c "SSL 3.3 ChangeCipherSpec packet received" \ |
| 12772 | -c "discarding change cipher spec in TLS1.3" |
| 12773 | |
| 12774 | requires_gnutls_tls1_3 |
| 12775 | requires_gnutls_next_no_ticket |
| 12776 | requires_gnutls_next_disable_tls13_compat |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12777 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12778 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Przemek Stekiel | c31a798 | 2023-06-27 10:53:33 +0200 | [diff] [blame] | 12779 | requires_config_enabled PSA_WANT_ALG_ECDH |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12780 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12781 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12782 | run_test "TLS 1.3 G->m HRR both with middlebox compat support" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 12783 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key groups=secp384r1 tickets=0" \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12784 | "$G_NEXT_CLI localhost --debug=10 --priority=NORMAL:-GROUP-ALL:+GROUP-SECP256R1:+GROUP-SECP384R1:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE -V" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12785 | 0 \ |
Gabor Mezei | 9e4b7bd | 2022-06-28 16:22:14 +0200 | [diff] [blame] | 12786 | -s "Protocol is TLSv1.3" \ |
Gabor Mezei | f7044ea | 2022-06-28 16:01:49 +0200 | [diff] [blame] | 12787 | -s "tls13 server state: MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST" \ |
Gabor Mezei | 7e2dbaf | 2022-05-24 16:05:29 +0200 | [diff] [blame] | 12788 | -c "SSL 3.3 ChangeCipherSpec packet received" |
| 12789 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12790 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12791 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12792 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12793 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12794 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12795 | run_test "TLS 1.3: Check signature algorithm order, m->O" \ |
| 12796 | "$O_NEXT_SRV_NO_CERT -cert data_files/server2-sha256.crt -key data_files/server2.key |
| 12797 | -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache |
| 12798 | -Verify 10 -sigalgs rsa_pkcs1_sha512:rsa_pss_rsae_sha512:rsa_pss_rsae_sha384:ecdsa_secp256r1_sha256" \ |
| 12799 | "$P_CLI debug_level=4 crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key \ |
Jerry Yu | 7ac0d49 | 2022-07-01 19:29:30 +0800 | [diff] [blame] | 12800 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,ecdsa_secp256r1_sha256" \ |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12801 | 0 \ |
| 12802 | -c "Protocol is TLSv1.3" \ |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 12803 | -c "CertificateVerify signature with rsa_pss_rsae_sha512" \ |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12804 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 12805 | |
| 12806 | requires_gnutls_tls1_3 |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12807 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12808 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12809 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12810 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12811 | run_test "TLS 1.3: Check signature algorithm order, m->G" \ |
| 12812 | "$G_NEXT_SRV_NO_CERT --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key |
| 12813 | -d 4 |
| 12814 | --priority=NORMAL:-VERS-ALL:-SIGN-ALL:+SIGN-RSA-SHA512:+SIGN-RSA-PSS-RSAE-SHA512:+SIGN-RSA-PSS-RSAE-SHA384:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS " \ |
| 12815 | "$P_CLI debug_level=4 crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key \ |
Jerry Yu | 7ac0d49 | 2022-07-01 19:29:30 +0800 | [diff] [blame] | 12816 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,ecdsa_secp256r1_sha256" \ |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12817 | 0 \ |
| 12818 | -c "Protocol is TLSv1.3" \ |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 12819 | -c "CertificateVerify signature with rsa_pss_rsae_sha512" \ |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12820 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 12821 | |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12822 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12823 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 12824 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12825 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12826 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12827 | run_test "TLS 1.3: Check signature algorithm order, m->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12828 | "$P_SRV debug_level=4 auth_mode=required |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12829 | crt_file2=data_files/server2-sha256.crt key_file2=data_files/server2.key |
| 12830 | crt_file=data_files/server5.crt key_file=data_files/server5.key |
| 12831 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,ecdsa_secp256r1_sha256 " \ |
| 12832 | "$P_CLI debug_level=4 crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key \ |
Jerry Yu | 7ac0d49 | 2022-07-01 19:29:30 +0800 | [diff] [blame] | 12833 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,ecdsa_secp256r1_sha256" \ |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12834 | 0 \ |
| 12835 | -c "Protocol is TLSv1.3" \ |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 12836 | -c "CertificateVerify signature with rsa_pss_rsae_sha512" \ |
| 12837 | -s "CertificateVerify signature with rsa_pss_rsae_sha512" \ |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12838 | -s "ssl_tls13_pick_key_cert:selected signature algorithm rsa_pss_rsae_sha512" \ |
| 12839 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 12840 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12841 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12842 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12843 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12844 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12845 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12846 | run_test "TLS 1.3: Check signature algorithm order, O->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12847 | "$P_SRV debug_level=4 auth_mode=required |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12848 | crt_file2=data_files/server2-sha256.crt key_file2=data_files/server2.key |
| 12849 | crt_file=data_files/server5.crt key_file=data_files/server5.key |
| 12850 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,ecdsa_secp256r1_sha256 " \ |
| 12851 | "$O_NEXT_CLI_NO_CERT -msg -CAfile data_files/test-ca_cat12.crt \ |
| 12852 | -cert data_files/server2-sha256.crt -key data_files/server2.key \ |
| 12853 | -sigalgs rsa_pkcs1_sha512:rsa_pss_rsae_sha512:rsa_pss_rsae_sha384:ecdsa_secp256r1_sha256" \ |
| 12854 | 0 \ |
| 12855 | -c "TLSv1.3" \ |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 12856 | -s "CertificateVerify signature with rsa_pss_rsae_sha512" \ |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12857 | -s "ssl_tls13_pick_key_cert:selected signature algorithm rsa_pss_rsae_sha512" |
| 12858 | |
| 12859 | requires_gnutls_tls1_3 |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12860 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12861 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12862 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12863 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12864 | run_test "TLS 1.3: Check signature algorithm order, G->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12865 | "$P_SRV debug_level=4 auth_mode=required |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12866 | crt_file2=data_files/server2-sha256.crt key_file2=data_files/server2.key |
| 12867 | crt_file=data_files/server5.crt key_file=data_files/server5.key |
| 12868 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,ecdsa_secp256r1_sha256 " \ |
| 12869 | "$G_NEXT_CLI_NO_CERT localhost -d 4 --x509cafile data_files/test-ca_cat12.crt \ |
| 12870 | --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key \ |
| 12871 | --priority=NORMAL:-SIGN-ALL:+SIGN-RSA-SHA512:+SIGN-RSA-PSS-RSAE-SHA512:+SIGN-RSA-PSS-RSAE-SHA384" \ |
| 12872 | 0 \ |
| 12873 | -c "Negotiated version: 3.4" \ |
| 12874 | -c "HTTP/1.0 200 [Oo][Kk]" \ |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 12875 | -s "CertificateVerify signature with rsa_pss_rsae_sha512" \ |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12876 | -s "ssl_tls13_pick_key_cert:selected signature algorithm rsa_pss_rsae_sha512" |
| 12877 | |
| 12878 | requires_gnutls_tls1_3 |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12879 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12880 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12881 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12882 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12883 | run_test "TLS 1.3: Check server no suitable signature algorithm, G->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12884 | "$P_SRV debug_level=4 auth_mode=required |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12885 | crt_file2=data_files/server2-sha256.crt key_file2=data_files/server2.key |
| 12886 | crt_file=data_files/server5.crt key_file=data_files/server5.key |
| 12887 | sig_algs=rsa_pkcs1_sha512,ecdsa_secp256r1_sha256 " \ |
| 12888 | "$G_NEXT_CLI_NO_CERT localhost -d 4 --x509cafile data_files/test-ca_cat12.crt \ |
| 12889 | --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key \ |
| 12890 | --priority=NORMAL:-SIGN-ALL:+SIGN-RSA-SHA512:+SIGN-RSA-PSS-RSAE-SHA512:+SIGN-ECDSA-SECP521R1-SHA512" \ |
| 12891 | 1 \ |
Ronald Cron | 67ea254 | 2022-09-15 17:34:42 +0200 | [diff] [blame] | 12892 | -S "ssl_tls13_pick_key_cert:check signature algorithm" |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12893 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12894 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12895 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12896 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12897 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12898 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12899 | run_test "TLS 1.3: Check server no suitable signature algorithm, O->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12900 | "$P_SRV debug_level=4 auth_mode=required |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12901 | crt_file2=data_files/server2-sha256.crt key_file2=data_files/server2.key |
| 12902 | crt_file=data_files/server5.crt key_file=data_files/server5.key |
| 12903 | sig_algs=rsa_pkcs1_sha512,ecdsa_secp256r1_sha256" \ |
| 12904 | "$O_NEXT_CLI_NO_CERT -msg -CAfile data_files/test-ca_cat12.crt \ |
| 12905 | -cert data_files/server2-sha256.crt -key data_files/server2.key \ |
| 12906 | -sigalgs rsa_pkcs1_sha512:rsa_pss_rsae_sha512:ecdsa_secp521r1_sha512" \ |
| 12907 | 1 \ |
Ronald Cron | 67ea254 | 2022-09-15 17:34:42 +0200 | [diff] [blame] | 12908 | -S "ssl_tls13_pick_key_cert:check signature algorithm" |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12909 | |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12910 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12911 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 12912 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12913 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12914 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12915 | run_test "TLS 1.3: Check server no suitable signature algorithm, m->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12916 | "$P_SRV debug_level=4 auth_mode=required |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12917 | crt_file2=data_files/server2-sha256.crt key_file2=data_files/server2.key |
| 12918 | crt_file=data_files/server5.crt key_file=data_files/server5.key |
| 12919 | sig_algs=rsa_pkcs1_sha512,ecdsa_secp256r1_sha256 " \ |
| 12920 | "$P_CLI allow_sha1=0 debug_level=4 crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key \ |
Jerry Yu | 7ac0d49 | 2022-07-01 19:29:30 +0800 | [diff] [blame] | 12921 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,ecdsa_secp521r1_sha512" \ |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12922 | 1 \ |
Ronald Cron | 67ea254 | 2022-09-15 17:34:42 +0200 | [diff] [blame] | 12923 | -S "ssl_tls13_pick_key_cert:check signature algorithm" |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12924 | |
| 12925 | requires_gnutls_tls1_3 |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12926 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12927 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12928 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12929 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12930 | run_test "TLS 1.3: Check server no suitable certificate, G->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12931 | "$P_SRV debug_level=4 |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12932 | crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key |
| 12933 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,ecdsa_secp256r1_sha256 " \ |
| 12934 | "$G_NEXT_CLI_NO_CERT localhost -d 4 --x509cafile data_files/test-ca_cat12.crt \ |
| 12935 | --priority=NORMAL:-SIGN-ALL:+SIGN-ECDSA-SECP521R1-SHA512:+SIGN-ECDSA-SECP256R1-SHA256" \ |
| 12936 | 1 \ |
| 12937 | -s "ssl_tls13_pick_key_cert:no suitable certificate found" |
| 12938 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12939 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12940 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12941 | requires_config_enabled MBEDTLS_SSL_SRV_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12942 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12943 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12944 | run_test "TLS 1.3: Check server no suitable certificate, O->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12945 | "$P_SRV debug_level=4 |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12946 | crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key |
| 12947 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,ecdsa_secp256r1_sha256 " \ |
| 12948 | "$O_NEXT_CLI_NO_CERT -msg -CAfile data_files/test-ca_cat12.crt \ |
| 12949 | -sigalgs ecdsa_secp521r1_sha512:ecdsa_secp256r1_sha256" \ |
| 12950 | 1 \ |
| 12951 | -s "ssl_tls13_pick_key_cert:no suitable certificate found" |
| 12952 | |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12953 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12954 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 12955 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12956 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12957 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12958 | run_test "TLS 1.3: Check server no suitable certificate, m->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 12959 | "$P_SRV debug_level=4 |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12960 | crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key |
| 12961 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,ecdsa_secp256r1_sha256 " \ |
| 12962 | "$P_CLI allow_sha1=0 debug_level=4 \ |
Jerry Yu | 7ac0d49 | 2022-07-01 19:29:30 +0800 | [diff] [blame] | 12963 | sig_algs=ecdsa_secp521r1_sha512,ecdsa_secp256r1_sha256" \ |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12964 | 1 \ |
| 12965 | -s "ssl_tls13_pick_key_cert:no suitable certificate found" |
| 12966 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 12967 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12968 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12969 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12970 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12971 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12972 | run_test "TLS 1.3: Check client no signature algorithm, m->O" \ |
| 12973 | "$O_NEXT_SRV_NO_CERT -cert data_files/server2-sha256.crt -key data_files/server2.key |
| 12974 | -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache |
| 12975 | -Verify 10 -sigalgs rsa_pkcs1_sha512:rsa_pss_rsae_sha512:rsa_pss_rsae_sha384:ecdsa_secp521r1_sha512" \ |
| 12976 | "$P_CLI debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Jerry Yu | 7ac0d49 | 2022-07-01 19:29:30 +0800 | [diff] [blame] | 12977 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,ecdsa_secp256r1_sha256" \ |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12978 | 1 \ |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 12979 | -c "no suitable signature algorithm" |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12980 | |
| 12981 | requires_gnutls_tls1_3 |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12982 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12983 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12984 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12985 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12986 | run_test "TLS 1.3: Check client no signature algorithm, m->G" \ |
| 12987 | "$G_NEXT_SRV_NO_CERT --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key |
| 12988 | -d 4 |
| 12989 | --priority=NORMAL:-VERS-ALL:-SIGN-ALL:+SIGN-RSA-SHA512:+SIGN-RSA-PSS-RSAE-SHA512:+SIGN-RSA-PSS-RSAE-SHA384:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS " \ |
| 12990 | "$P_CLI debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Jerry Yu | 7ac0d49 | 2022-07-01 19:29:30 +0800 | [diff] [blame] | 12991 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,ecdsa_secp256r1_sha256" \ |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12992 | 1 \ |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 12993 | -c "no suitable signature algorithm" |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12994 | |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 12995 | requires_config_enabled MBEDTLS_DEBUG_C |
| 12996 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 12997 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 12998 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 12999 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 13000 | run_test "TLS 1.3: Check client no signature algorithm, m->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 13001 | "$P_SRV debug_level=4 auth_mode=required |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 13002 | crt_file2=data_files/server2-sha256.crt key_file2=data_files/server2.key |
| 13003 | crt_file=data_files/server5.crt key_file=data_files/server5.key |
| 13004 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,ecdsa_secp521r1_sha512" \ |
| 13005 | "$P_CLI debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Jerry Yu | 7ac0d49 | 2022-07-01 19:29:30 +0800 | [diff] [blame] | 13006 | sig_algs=rsa_pkcs1_sha512,rsa_pss_rsae_sha512,rsa_pss_rsae_sha384,ecdsa_secp256r1_sha256" \ |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 13007 | 1 \ |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 13008 | -c "no suitable signature algorithm" |
Jerry Yu | aae28f1 | 2022-06-29 16:21:32 +0800 | [diff] [blame] | 13009 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 13010 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | 29ab32d | 2022-07-07 11:33:35 +0000 | [diff] [blame] | 13011 | requires_config_enabled MBEDTLS_DEBUG_C |
| 13012 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 13013 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 13014 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \ |
| 13015 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
Jerry Yu | 29ab32d | 2022-07-07 11:33:35 +0000 | [diff] [blame] | 13016 | run_test "TLS 1.3: NewSessionTicket: Basic check, m->O" \ |
Jerry Yu | e976492 | 2022-08-03 14:34:24 +0800 | [diff] [blame] | 13017 | "$O_NEXT_SRV -msg -tls1_3 -no_resume_ephemeral -no_cache --num_tickets 4" \ |
| 13018 | "$P_CLI debug_level=1 reco_mode=1 reconnect=1" \ |
Jerry Yu | 29ab32d | 2022-07-07 11:33:35 +0000 | [diff] [blame] | 13019 | 0 \ |
| 13020 | -c "Protocol is TLSv1.3" \ |
Jerry Yu | 29ab32d | 2022-07-07 11:33:35 +0000 | [diff] [blame] | 13021 | -c "got new session ticket." \ |
Jerry Yu | 24e3855 | 2022-07-15 16:35:26 +0800 | [diff] [blame] | 13022 | -c "Saving session for reuse... ok" \ |
Jerry Yu | e976492 | 2022-08-03 14:34:24 +0800 | [diff] [blame] | 13023 | -c "Reconnecting with saved session" \ |
Jerry Yu | 29ab32d | 2022-07-07 11:33:35 +0000 | [diff] [blame] | 13024 | -c "HTTP/1.0 200 ok" |
| 13025 | |
| 13026 | requires_gnutls_tls1_3 |
Jerry Yu | 29ab32d | 2022-07-07 11:33:35 +0000 | [diff] [blame] | 13027 | requires_config_enabled MBEDTLS_DEBUG_C |
| 13028 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 13029 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 13030 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \ |
| 13031 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
Jerry Yu | 29ab32d | 2022-07-07 11:33:35 +0000 | [diff] [blame] | 13032 | run_test "TLS 1.3: NewSessionTicket: Basic check, m->G" \ |
Ronald Cron | a709a0f | 2022-09-27 16:46:11 +0200 | [diff] [blame] | 13033 | "$G_NEXT_SRV -d 10 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3 --disable-client-cert" \ |
Jerry Yu | e976492 | 2022-08-03 14:34:24 +0800 | [diff] [blame] | 13034 | "$P_CLI debug_level=1 reco_mode=1 reconnect=1" \ |
Jerry Yu | 29ab32d | 2022-07-07 11:33:35 +0000 | [diff] [blame] | 13035 | 0 \ |
| 13036 | -c "Protocol is TLSv1.3" \ |
Jerry Yu | 29ab32d | 2022-07-07 11:33:35 +0000 | [diff] [blame] | 13037 | -c "got new session ticket." \ |
Jerry Yu | 24e3855 | 2022-07-15 16:35:26 +0800 | [diff] [blame] | 13038 | -c "Saving session for reuse... ok" \ |
Jerry Yu | e976492 | 2022-08-03 14:34:24 +0800 | [diff] [blame] | 13039 | -c "Reconnecting with saved session" \ |
| 13040 | -c "HTTP/1.0 200 OK" \ |
| 13041 | -s "This is a resumed session" |
Jerry Yu | f7b5b59 | 2022-07-07 07:55:53 +0000 | [diff] [blame] | 13042 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 13043 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | 7a51305 | 2022-08-09 13:34:21 +0800 | [diff] [blame] | 13044 | requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS |
| 13045 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 13046 | requires_config_enabled MBEDTLS_DEBUG_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 13047 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 13048 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \ |
| 13049 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
Jerry Yu | 7a51305 | 2022-08-09 13:34:21 +0800 | [diff] [blame] | 13050 | # https://github.com/openssl/openssl/issues/10714 |
| 13051 | # Until now, OpenSSL client does not support reconnect. |
| 13052 | skip_next_test |
| 13053 | run_test "TLS 1.3: NewSessionTicket: Basic check, O->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 13054 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=4" \ |
Jerry Yu | 7a51305 | 2022-08-09 13:34:21 +0800 | [diff] [blame] | 13055 | "$O_NEXT_CLI -msg -debug -tls1_3 -reconnect" \ |
| 13056 | 0 \ |
| 13057 | -s "=> write NewSessionTicket msg" \ |
Jerry Yu | a8d3c50 | 2022-10-30 14:51:23 +0800 | [diff] [blame] | 13058 | -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \ |
| 13059 | -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH" |
Jerry Yu | 7a51305 | 2022-08-09 13:34:21 +0800 | [diff] [blame] | 13060 | |
Jerry Yu | f7b5b59 | 2022-07-07 07:55:53 +0000 | [diff] [blame] | 13061 | requires_gnutls_tls1_3 |
Jerry Yu | f7b5b59 | 2022-07-07 07:55:53 +0000 | [diff] [blame] | 13062 | requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS |
| 13063 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 13064 | requires_config_enabled MBEDTLS_DEBUG_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 13065 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 13066 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \ |
| 13067 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
Jerry Yu | f7b5b59 | 2022-07-07 07:55:53 +0000 | [diff] [blame] | 13068 | run_test "TLS 1.3: NewSessionTicket: Basic check, G->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 13069 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=4" \ |
Jerry Yu | 7a51305 | 2022-08-09 13:34:21 +0800 | [diff] [blame] | 13070 | "$G_NEXT_CLI localhost -d 4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3 -V -r" \ |
Jerry Yu | f7b5b59 | 2022-07-07 07:55:53 +0000 | [diff] [blame] | 13071 | 0 \ |
Jerry Yu | e976492 | 2022-08-03 14:34:24 +0800 | [diff] [blame] | 13072 | -c "Connecting again- trying to resume previous session" \ |
| 13073 | -c "NEW SESSION TICKET (4) was received" \ |
Jerry Yu | f7b5b59 | 2022-07-07 07:55:53 +0000 | [diff] [blame] | 13074 | -s "=> write NewSessionTicket msg" \ |
Jerry Yu | a8d3c50 | 2022-10-30 14:51:23 +0800 | [diff] [blame] | 13075 | -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \ |
| 13076 | -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH" \ |
Jerry Yu | e976492 | 2022-08-03 14:34:24 +0800 | [diff] [blame] | 13077 | -s "key exchange mode: ephemeral" \ |
| 13078 | -s "key exchange mode: psk_ephemeral" \ |
| 13079 | -s "found pre_shared_key extension" |
Jerry Yu | f7b5b59 | 2022-07-07 07:55:53 +0000 | [diff] [blame] | 13080 | |
Ronald Cron | 0a1c504 | 2023-02-20 10:44:22 +0100 | [diff] [blame] | 13081 | requires_gnutls_tls1_3 |
| 13082 | requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS |
| 13083 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 13084 | requires_config_enabled MBEDTLS_DEBUG_C |
| 13085 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 13086 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \ |
| 13087 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
Ronald Cron | d89360b | 2023-02-21 08:53:33 +0100 | [diff] [blame] | 13088 | # Test the session resumption when the cipher suite for the original session is |
| 13089 | # TLS1-3-AES-256-GCM-SHA384. In that case, the PSK is 384 bits long and not |
| 13090 | # 256 bits long as with all the other TLS 1.3 cipher suites. |
Ronald Cron | 0a1c504 | 2023-02-20 10:44:22 +0100 | [diff] [blame] | 13091 | requires_ciphersuite_enabled TLS1-3-AES-256-GCM-SHA384 |
| 13092 | run_test "TLS 1.3: NewSessionTicket: Basic check with AES-256-GCM only, G->m" \ |
| 13093 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=4" \ |
| 13094 | "$G_NEXT_CLI localhost -d 4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM -V -r" \ |
| 13095 | 0 \ |
| 13096 | -c "Connecting again- trying to resume previous session" \ |
| 13097 | -c "NEW SESSION TICKET (4) was received" \ |
| 13098 | -s "Ciphersuite is TLS1-3-AES-256-GCM-SHA384" \ |
| 13099 | -s "=> write NewSessionTicket msg" \ |
| 13100 | -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \ |
| 13101 | -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH" \ |
| 13102 | -s "key exchange mode: ephemeral" \ |
| 13103 | -s "key exchange mode: psk_ephemeral" \ |
| 13104 | -s "found pre_shared_key extension" |
Jerry Yu | f7b5b59 | 2022-07-07 07:55:53 +0000 | [diff] [blame] | 13105 | |
Jerry Yu | f7b5b59 | 2022-07-07 07:55:53 +0000 | [diff] [blame] | 13106 | requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS |
| 13107 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 13108 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 13109 | requires_config_enabled MBEDTLS_DEBUG_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 13110 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 13111 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \ |
| 13112 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
Jerry Yu | f7b5b59 | 2022-07-07 07:55:53 +0000 | [diff] [blame] | 13113 | run_test "TLS 1.3: NewSessionTicket: Basic check, m->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 13114 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=4" \ |
Jerry Yu | 24e3855 | 2022-07-15 16:35:26 +0800 | [diff] [blame] | 13115 | "$P_CLI debug_level=4 reco_mode=1 reconnect=1" \ |
Jerry Yu | f7b5b59 | 2022-07-07 07:55:53 +0000 | [diff] [blame] | 13116 | 0 \ |
| 13117 | -c "Protocol is TLSv1.3" \ |
Jerry Yu | 7a51305 | 2022-08-09 13:34:21 +0800 | [diff] [blame] | 13118 | -c "got new session ticket ( 3 )" \ |
Jerry Yu | 24e3855 | 2022-07-15 16:35:26 +0800 | [diff] [blame] | 13119 | -c "Saving session for reuse... ok" \ |
Jerry Yu | e976492 | 2022-08-03 14:34:24 +0800 | [diff] [blame] | 13120 | -c "Reconnecting with saved session" \ |
Jerry Yu | f7b5b59 | 2022-07-07 07:55:53 +0000 | [diff] [blame] | 13121 | -c "HTTP/1.0 200 OK" \ |
| 13122 | -s "=> write NewSessionTicket msg" \ |
Jerry Yu | a8d3c50 | 2022-10-30 14:51:23 +0800 | [diff] [blame] | 13123 | -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \ |
| 13124 | -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH" \ |
Jerry Yu | e976492 | 2022-08-03 14:34:24 +0800 | [diff] [blame] | 13125 | -s "key exchange mode: ephemeral" \ |
| 13126 | -s "key exchange mode: psk_ephemeral" \ |
| 13127 | -s "found pre_shared_key extension" |
| 13128 | |
Przemek Stekiel | 8bfe897 | 2023-06-26 12:59:45 +0200 | [diff] [blame] | 13129 | requires_openssl_tls1_3_with_compatible_ephemeral |
Jerry Yu | 6455b68 | 2022-06-27 14:18:29 +0800 | [diff] [blame] | 13130 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
| 13131 | requires_config_enabled MBEDTLS_DEBUG_C |
| 13132 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Jerry Yu | eec4f03 | 2022-07-23 11:31:51 +0800 | [diff] [blame] | 13133 | run_test "TLS 1.2: Check rsa_pss_rsae compatibility issue, m->O" \ |
Jerry Yu | 6455b68 | 2022-06-27 14:18:29 +0800 | [diff] [blame] | 13134 | "$O_NEXT_SRV_NO_CERT -cert data_files/server2-sha256.crt -key data_files/server2.key |
| 13135 | -msg -tls1_2 |
| 13136 | -Verify 10 " \ |
| 13137 | "$P_CLI debug_level=4 crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key |
| 13138 | sig_algs=rsa_pss_rsae_sha512,rsa_pkcs1_sha512 |
| 13139 | min_version=tls12 max_version=tls13 " \ |
| 13140 | 0 \ |
| 13141 | -c "Protocol is TLSv1.2" \ |
| 13142 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 13143 | |
| 13144 | |
| 13145 | requires_gnutls_tls1_3 |
| 13146 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
| 13147 | requires_config_enabled MBEDTLS_DEBUG_C |
| 13148 | requires_config_enabled MBEDTLS_SSL_CLI_C |
Jerry Yu | eec4f03 | 2022-07-23 11:31:51 +0800 | [diff] [blame] | 13149 | run_test "TLS 1.2: Check rsa_pss_rsae compatibility issue, m->G" \ |
Jerry Yu | 6455b68 | 2022-06-27 14:18:29 +0800 | [diff] [blame] | 13150 | "$G_NEXT_SRV_NO_CERT --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key |
| 13151 | -d 4 |
| 13152 | --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2" \ |
| 13153 | "$P_CLI debug_level=4 crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key |
| 13154 | sig_algs=rsa_pss_rsae_sha512,rsa_pkcs1_sha512 |
| 13155 | min_version=tls12 max_version=tls13 " \ |
| 13156 | 0 \ |
| 13157 | -c "Protocol is TLSv1.2" \ |
| 13158 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 13159 | |
Xiaokang Qian | 281fd1b | 2022-09-20 11:35:41 +0000 | [diff] [blame] | 13160 | requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS |
| 13161 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 13162 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 13163 | requires_config_enabled MBEDTLS_DEBUG_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 13164 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 13165 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \ |
| 13166 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
Xiaokang Qian | 281fd1b | 2022-09-20 11:35:41 +0000 | [diff] [blame] | 13167 | run_test "TLS 1.3: NewSessionTicket: servername check, m->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 13168 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=4 \ |
Xiaokang Qian | 281fd1b | 2022-09-20 11:35:41 +0000 | [diff] [blame] | 13169 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
| 13170 | "$P_CLI debug_level=4 server_name=localhost reco_mode=1 reconnect=1" \ |
| 13171 | 0 \ |
| 13172 | -c "Protocol is TLSv1.3" \ |
| 13173 | -c "got new session ticket." \ |
| 13174 | -c "Saving session for reuse... ok" \ |
| 13175 | -c "Reconnecting with saved session" \ |
| 13176 | -c "HTTP/1.0 200 OK" \ |
| 13177 | -s "=> write NewSessionTicket msg" \ |
Jerry Yu | a8d3c50 | 2022-10-30 14:51:23 +0800 | [diff] [blame] | 13178 | -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \ |
| 13179 | -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH" \ |
Xiaokang Qian | 281fd1b | 2022-09-20 11:35:41 +0000 | [diff] [blame] | 13180 | -s "key exchange mode: ephemeral" \ |
| 13181 | -s "key exchange mode: psk_ephemeral" \ |
| 13182 | -s "found pre_shared_key extension" |
| 13183 | |
Xiaokang Qian | 281fd1b | 2022-09-20 11:35:41 +0000 | [diff] [blame] | 13184 | requires_config_enabled MBEDTLS_SSL_SESSION_TICKETS |
| 13185 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 13186 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 13187 | requires_config_enabled MBEDTLS_DEBUG_C |
Ronald Cron | 70ed417 | 2022-10-20 15:48:19 +0200 | [diff] [blame] | 13188 | requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE \ |
| 13189 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \ |
| 13190 | MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
Xiaokang Qian | 281fd1b | 2022-09-20 11:35:41 +0000 | [diff] [blame] | 13191 | run_test "TLS 1.3: NewSessionTicket: servername negative check, m->m" \ |
Ronald Cron | 50ae84e | 2023-03-14 08:59:56 +0100 | [diff] [blame] | 13192 | "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key tickets=4 \ |
Xiaokang Qian | 281fd1b | 2022-09-20 11:35:41 +0000 | [diff] [blame] | 13193 | sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ |
Jerry Yu | ad9e99b | 2022-10-28 12:18:52 +0800 | [diff] [blame] | 13194 | "$P_CLI debug_level=4 server_name=localhost reco_server_name=remote reco_mode=1 reconnect=1" \ |
Xiaokang Qian | 281fd1b | 2022-09-20 11:35:41 +0000 | [diff] [blame] | 13195 | 1 \ |
| 13196 | -c "Protocol is TLSv1.3" \ |
| 13197 | -c "got new session ticket." \ |
| 13198 | -c "Saving session for reuse... ok" \ |
| 13199 | -c "Reconnecting with saved session" \ |
Xiaokang Qian | ed0620c | 2022-10-12 06:58:13 +0000 | [diff] [blame] | 13200 | -c "Hostname mismatch the session ticket, disable session resumption." \ |
Xiaokang Qian | 281fd1b | 2022-09-20 11:35:41 +0000 | [diff] [blame] | 13201 | -s "=> write NewSessionTicket msg" \ |
Jerry Yu | a8d3c50 | 2022-10-30 14:51:23 +0800 | [diff] [blame] | 13202 | -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET" \ |
| 13203 | -s "server state: MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH" |
Xiaokang Qian | 281fd1b | 2022-09-20 11:35:41 +0000 | [diff] [blame] | 13204 | |
Przemek Stekiel | 3484db4 | 2023-06-28 13:31:38 +0200 | [diff] [blame] | 13205 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 13206 | requires_config_enabled MBEDTLS_DEBUG_C |
| 13207 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 13208 | requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 13209 | requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT |
| 13210 | requires_config_enabled PSA_WANT_ALG_FFDH |
| 13211 | requires_gnutls_tls1_3 |
| 13212 | requires_gnutls_next_no_ticket |
| 13213 | requires_gnutls_next_disable_tls13_compat |
| 13214 | run_test "TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe3072,rsa_pss_rsae_sha256" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 13215 | "$P_SRV crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 groups=ffdhe3072 tls13_kex_modes=ephemeral cookies=0 tickets=0" \ |
Przemek Stekiel | 3484db4 | 2023-06-28 13:31:38 +0200 | [diff] [blame] | 13216 | "$G_NEXT_CLI_NO_CERT --debug=4 --single-key-share --x509cafile data_files/test-ca_cat12.crt --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE3072:+VERS-TLS1.3:%NO_TICKETS" \ |
| 13217 | 0 \ |
| 13218 | -s "Protocol is TLSv1.3" \ |
| 13219 | -s "server hello, chosen ciphersuite: TLS1-3-AES-128-GCM-SHA256 ( id=4865 )" \ |
| 13220 | -s "received signature algorithm: 0x804" \ |
| 13221 | -s "got named group: ffdhe3072(0101)" \ |
| 13222 | -s "Certificate verification was skipped" \ |
| 13223 | -C "received HelloRetryRequest message" |
| 13224 | |
| 13225 | |
| 13226 | requires_gnutls_tls1_3 |
| 13227 | requires_gnutls_next_no_ticket |
| 13228 | requires_gnutls_next_disable_tls13_compat |
| 13229 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 13230 | requires_config_enabled MBEDTLS_DEBUG_C |
| 13231 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 13232 | requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 13233 | requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT |
| 13234 | requires_config_enabled PSA_WANT_ALG_FFDH |
| 13235 | run_test "TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe3072,rsa_pss_rsae_sha256" \ |
| 13236 | "$G_NEXT_SRV_NO_CERT --http --disable-client-cert --debug=4 --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE3072:+VERS-TLS1.3:%NO_TICKETS" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 13237 | "$P_CLI ca_file=data_files/test-ca_cat12.crt debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 groups=ffdhe3072" \ |
Przemek Stekiel | 3484db4 | 2023-06-28 13:31:38 +0200 | [diff] [blame] | 13238 | 0 \ |
| 13239 | -c "HTTP/1.0 200 OK" \ |
| 13240 | -c "Protocol is TLSv1.3" \ |
| 13241 | -c "server hello, chosen ciphersuite: ( 1301 ) - TLS1-3-AES-128-GCM-SHA256" \ |
| 13242 | -c "Certificate Verify: Signature algorithm ( 0804 )" \ |
| 13243 | -c "NamedGroup: ffdhe3072 ( 101 )" \ |
| 13244 | -c "Verifying peer X.509 certificate... ok" \ |
| 13245 | -C "received HelloRetryRequest message" |
| 13246 | |
| 13247 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 13248 | requires_config_enabled MBEDTLS_DEBUG_C |
| 13249 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 13250 | requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 13251 | requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT |
| 13252 | requires_config_enabled PSA_WANT_ALG_FFDH |
| 13253 | requires_gnutls_tls1_3 |
| 13254 | requires_gnutls_next_no_ticket |
| 13255 | requires_gnutls_next_disable_tls13_compat |
| 13256 | run_test "TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe4096,rsa_pss_rsae_sha256" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 13257 | "$P_SRV crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 groups=ffdhe4096 tls13_kex_modes=ephemeral cookies=0 tickets=0" \ |
Przemek Stekiel | 3484db4 | 2023-06-28 13:31:38 +0200 | [diff] [blame] | 13258 | "$G_NEXT_CLI_NO_CERT --debug=4 --single-key-share --x509cafile data_files/test-ca_cat12.crt --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE4096:+VERS-TLS1.3:%NO_TICKETS" \ |
| 13259 | 0 \ |
| 13260 | -s "Protocol is TLSv1.3" \ |
| 13261 | -s "server hello, chosen ciphersuite: TLS1-3-AES-128-GCM-SHA256 ( id=4865 )" \ |
| 13262 | -s "received signature algorithm: 0x804" \ |
| 13263 | -s "got named group: ffdhe4096(0102)" \ |
| 13264 | -s "Certificate verification was skipped" \ |
| 13265 | -C "received HelloRetryRequest message" |
| 13266 | |
| 13267 | |
| 13268 | requires_gnutls_tls1_3 |
| 13269 | requires_gnutls_next_no_ticket |
| 13270 | requires_gnutls_next_disable_tls13_compat |
| 13271 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 13272 | requires_config_enabled MBEDTLS_DEBUG_C |
| 13273 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 13274 | requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 13275 | requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT |
| 13276 | requires_config_enabled PSA_WANT_ALG_FFDH |
| 13277 | run_test "TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe4096,rsa_pss_rsae_sha256" \ |
| 13278 | "$G_NEXT_SRV_NO_CERT --http --disable-client-cert --debug=4 --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE4096:+VERS-TLS1.3:%NO_TICKETS" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 13279 | "$P_CLI ca_file=data_files/test-ca_cat12.crt debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 groups=ffdhe4096" \ |
Przemek Stekiel | 3484db4 | 2023-06-28 13:31:38 +0200 | [diff] [blame] | 13280 | 0 \ |
| 13281 | -c "HTTP/1.0 200 OK" \ |
| 13282 | -c "Protocol is TLSv1.3" \ |
| 13283 | -c "server hello, chosen ciphersuite: ( 1301 ) - TLS1-3-AES-128-GCM-SHA256" \ |
| 13284 | -c "Certificate Verify: Signature algorithm ( 0804 )" \ |
| 13285 | -c "NamedGroup: ffdhe4096 ( 102 )" \ |
| 13286 | -c "Verifying peer X.509 certificate... ok" \ |
| 13287 | -C "received HelloRetryRequest message" |
| 13288 | |
| 13289 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 13290 | requires_config_enabled MBEDTLS_DEBUG_C |
| 13291 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 13292 | requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 13293 | requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT |
| 13294 | requires_config_enabled PSA_WANT_ALG_FFDH |
| 13295 | requires_gnutls_tls1_3 |
| 13296 | requires_gnutls_next_no_ticket |
| 13297 | requires_gnutls_next_disable_tls13_compat |
| 13298 | run_test "TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe6144,rsa_pss_rsae_sha256" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 13299 | "$P_SRV crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 groups=ffdhe6144 tls13_kex_modes=ephemeral cookies=0 tickets=0" \ |
Przemek Stekiel | 3484db4 | 2023-06-28 13:31:38 +0200 | [diff] [blame] | 13300 | "$G_NEXT_CLI_NO_CERT --debug=4 --single-key-share --x509cafile data_files/test-ca_cat12.crt --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE6144:+VERS-TLS1.3:%NO_TICKETS" \ |
| 13301 | 0 \ |
| 13302 | -s "Protocol is TLSv1.3" \ |
| 13303 | -s "server hello, chosen ciphersuite: TLS1-3-AES-128-GCM-SHA256 ( id=4865 )" \ |
| 13304 | -s "received signature algorithm: 0x804" \ |
| 13305 | -s "got named group: ffdhe6144(0103)" \ |
| 13306 | -s "Certificate verification was skipped" \ |
| 13307 | -C "received HelloRetryRequest message" |
| 13308 | |
| 13309 | requires_gnutls_tls1_3 |
| 13310 | requires_gnutls_next_no_ticket |
| 13311 | requires_gnutls_next_disable_tls13_compat |
| 13312 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 13313 | requires_config_enabled MBEDTLS_DEBUG_C |
| 13314 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 13315 | requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 13316 | requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT |
| 13317 | requires_config_enabled PSA_WANT_ALG_FFDH |
| 13318 | run_test "TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe6144,rsa_pss_rsae_sha256" \ |
| 13319 | "$G_NEXT_SRV_NO_CERT --http --disable-client-cert --debug=4 --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE6144:+VERS-TLS1.3:%NO_TICKETS" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 13320 | "$P_CLI ca_file=data_files/test-ca_cat12.crt debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 groups=ffdhe6144" \ |
Przemek Stekiel | 3484db4 | 2023-06-28 13:31:38 +0200 | [diff] [blame] | 13321 | 0 \ |
| 13322 | -c "HTTP/1.0 200 OK" \ |
| 13323 | -c "Protocol is TLSv1.3" \ |
| 13324 | -c "server hello, chosen ciphersuite: ( 1301 ) - TLS1-3-AES-128-GCM-SHA256" \ |
| 13325 | -c "Certificate Verify: Signature algorithm ( 0804 )" \ |
| 13326 | -c "NamedGroup: ffdhe6144 ( 103 )" \ |
| 13327 | -c "Verifying peer X.509 certificate... ok" \ |
| 13328 | -C "received HelloRetryRequest message" |
| 13329 | |
| 13330 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 13331 | requires_config_enabled MBEDTLS_DEBUG_C |
| 13332 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 13333 | requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 13334 | requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT |
| 13335 | requires_config_enabled PSA_WANT_ALG_FFDH |
| 13336 | requires_gnutls_tls1_3 |
| 13337 | requires_gnutls_next_no_ticket |
| 13338 | requires_gnutls_next_disable_tls13_compat |
| 13339 | client_needs_more_time 4 |
| 13340 | run_test "TLS 1.3 G->m: AES_128_GCM_SHA256,ffdhe8192,rsa_pss_rsae_sha256" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 13341 | "$P_SRV crt_file=data_files/server2-sha256.crt key_file=data_files/server2.key debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 groups=ffdhe8192 tls13_kex_modes=ephemeral cookies=0 tickets=0" \ |
Przemek Stekiel | 3484db4 | 2023-06-28 13:31:38 +0200 | [diff] [blame] | 13342 | "$G_NEXT_CLI_NO_CERT --debug=4 --single-key-share --x509cafile data_files/test-ca_cat12.crt --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE8192:+VERS-TLS1.3:%NO_TICKETS" \ |
| 13343 | 0 \ |
| 13344 | -s "Protocol is TLSv1.3" \ |
| 13345 | -s "server hello, chosen ciphersuite: TLS1-3-AES-128-GCM-SHA256 ( id=4865 )" \ |
| 13346 | -s "received signature algorithm: 0x804" \ |
| 13347 | -s "got named group: ffdhe8192(0104)" \ |
| 13348 | -s "Certificate verification was skipped" \ |
| 13349 | -C "received HelloRetryRequest message" |
| 13350 | |
| 13351 | requires_gnutls_tls1_3 |
| 13352 | requires_gnutls_next_no_ticket |
| 13353 | requires_gnutls_next_disable_tls13_compat |
| 13354 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 13355 | requires_config_enabled MBEDTLS_DEBUG_C |
| 13356 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 13357 | requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE |
| 13358 | requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT |
| 13359 | requires_config_enabled PSA_WANT_ALG_FFDH |
| 13360 | client_needs_more_time 4 |
| 13361 | run_test "TLS 1.3 m->G: AES_128_GCM_SHA256,ffdhe8192,rsa_pss_rsae_sha256" \ |
| 13362 | "$G_NEXT_SRV_NO_CERT --http --disable-client-cert --debug=4 --x509certfile data_files/server2-sha256.crt --x509keyfile data_files/server2.key --priority=NONE:+AES-128-GCM:+SHA256:+AEAD:+SIGN-RSA-PSS-RSAE-SHA256:+GROUP-FFDHE8192:+VERS-TLS1.3:%NO_TICKETS" \ |
Przemek Stekiel | 45255e4 | 2023-06-29 13:56:36 +0200 | [diff] [blame] | 13363 | "$P_CLI ca_file=data_files/test-ca_cat12.crt debug_level=4 force_ciphersuite=TLS1-3-AES-128-GCM-SHA256 sig_algs=rsa_pss_rsae_sha256 groups=ffdhe8192" \ |
Przemek Stekiel | 3484db4 | 2023-06-28 13:31:38 +0200 | [diff] [blame] | 13364 | 0 \ |
| 13365 | -c "HTTP/1.0 200 OK" \ |
| 13366 | -c "Protocol is TLSv1.3" \ |
| 13367 | -c "server hello, chosen ciphersuite: ( 1301 ) - TLS1-3-AES-128-GCM-SHA256" \ |
| 13368 | -c "Certificate Verify: Signature algorithm ( 0804 )" \ |
| 13369 | -c "NamedGroup: ffdhe8192 ( 104 )" \ |
| 13370 | -c "Verifying peer X.509 certificate... ok" \ |
| 13371 | -C "received HelloRetryRequest message" |
| 13372 | |
Ronald Cron | 8a74f07 | 2023-06-14 17:59:29 +0200 | [diff] [blame] | 13373 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 |
| 13374 | requires_config_enabled MBEDTLS_SSL_SRV_C |
| 13375 | requires_config_enabled MBEDTLS_SSL_CLI_C |
| 13376 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED |
| 13377 | requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| 13378 | run_test "TLS 1.3: no HRR in case of PSK key exchange mode" \ |
Gilles Peskine | b387fcf | 2023-07-11 09:19:13 +0200 | [diff] [blame] | 13379 | "$P_SRV nbio=2 psk=010203 psk_identity=0a0b0c tls13_kex_modes=psk groups=none" \ |
Ronald Cron | 8a74f07 | 2023-06-14 17:59:29 +0200 | [diff] [blame] | 13380 | "$P_CLI nbio=2 debug_level=3 psk=010203 psk_identity=0a0b0c tls13_kex_modes=all" \ |
| 13381 | 0 \ |
| 13382 | -C "received HelloRetryRequest message" \ |
| 13383 | -c "Selected key exchange mode: psk$" \ |
| 13384 | -c "HTTP/1.0 200 OK" |
| 13385 | |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 13386 | # Test heap memory usage after handshake |
Jerry Yu | ab08290 | 2021-12-23 18:02:22 +0800 | [diff] [blame] | 13387 | requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 13388 | requires_config_enabled MBEDTLS_MEMORY_DEBUG |
| 13389 | requires_config_enabled MBEDTLS_MEMORY_BUFFER_ALLOC_C |
| 13390 | requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH |
Yuto Takano | bc87b1d | 2021-07-08 15:56:33 +0100 | [diff] [blame] | 13391 | requires_max_content_len 16384 |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 13392 | run_tests_memory_after_hanshake |
| 13393 | |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 13394 | # Final report |
| 13395 | |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 13396 | echo "------------------------------------------------------------------------" |
| 13397 | |
| 13398 | if [ $FAILS = 0 ]; then |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 13399 | printf "PASSED" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 13400 | else |
Manuel Pégourié-Gonnard | f46f128 | 2014-12-11 11:51:28 +0100 | [diff] [blame] | 13401 | printf "FAILED" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 13402 | fi |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 13403 | PASSES=$(( $TESTS - $FAILS )) |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 13404 | echo " ($PASSES / $TESTS tests ($SKIPS skipped))" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 13405 | |
Tom Cosgrove | fc0e79e | 2023-01-13 12:13:41 +0000 | [diff] [blame] | 13406 | if [ $FAILS -gt 255 ]; then |
| 13407 | # Clamp at 255 as caller gets exit code & 0xFF |
| 13408 | # (so 256 would be 0, or success, etc) |
| 13409 | FAILS=255 |
| 13410 | fi |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 13411 | exit $FAILS |