blob: e4dc7ea3c7821b5bb3a7e4b639b2020e48b7784d [file] [log] [blame]
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +01001#!/bin/sh
2
3# Test various options that are not covered by compat.sh
4#
5# Here the goal is not to cover every ciphersuite/version, but
6# rather specific options (max fragment length, truncated hmac, etc)
7# or procedures (session resumption from cache or ticket, renego, etc).
8#
9# Assumes all options are compiled in.
10
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +010011set -u
12
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +010013# default values, can be overriden by the environment
14: ${P_SRV:=../programs/ssl/ssl_server2}
15: ${P_CLI:=../programs/ssl/ssl_client2}
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +010016: ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +020017: ${GNUTLS_CLI:=gnutls-cli}
18: ${GNUTLS_SERV:=gnutls-serv}
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +010019
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +010020O_SRV="$OPENSSL_CMD s_server -www -cert data_files/server5.crt -key data_files/server5.key"
21O_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_CMD s_client"
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +020022G_SRV="$GNUTLS_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key"
23G_CLI="$GNUTLS_CLI"
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +010024
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +010025TESTS=0
26FAILS=0
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020027SKIPS=0
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +010028
Manuel Pégourié-Gonnard83d8c732014-04-07 13:24:21 +020029CONFIG_H='../include/polarssl/config.h'
30
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010031MEMCHECK=0
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +010032FILTER='.*'
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020033EXCLUDE='^$'
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010034
35print_usage() {
36 echo "Usage: $0 [options]"
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +010037 echo -e " -h|--help\tPrint this help."
38 echo -e " -m|--memcheck\tCheck memory leaks and errors."
39 echo -e " -f|--filter\tOnly matching tests are executed (default: '$FILTER')"
40 echo -e " -e|--exclude\tMatching tests are excluded (default: '$EXCLUDE')"
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010041}
42
43get_options() {
44 while [ $# -gt 0 ]; do
45 case "$1" in
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +010046 -f|--filter)
47 shift; FILTER=$1
48 ;;
49 -e|--exclude)
50 shift; EXCLUDE=$1
51 ;;
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010052 -m|--memcheck)
53 MEMCHECK=1
54 ;;
55 -h|--help)
56 print_usage
57 exit 0
58 ;;
59 *)
Paul Bakker1ebc0c52014-05-22 15:47:58 +020060 echo "Unknown argument: '$1'"
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +010061 print_usage
62 exit 1
63 ;;
64 esac
65 shift
66 done
67}
68
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020069# skip next test if OpenSSL can't send SSLv2 ClientHello
70requires_openssl_with_sslv2() {
71 if [ -z "${OPENSSL_HAS_SSL2:-}" ]; then
Manuel Pégourié-Gonnarda4afadf2014-08-30 22:09:36 +020072 if $OPENSSL_CMD ciphers -ssl2 >/dev/null 2>&1; then
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +020073 OPENSSL_HAS_SSL2="YES"
74 else
75 OPENSSL_HAS_SSL2="NO"
76 fi
77 fi
78 if [ "$OPENSSL_HAS_SSL2" = "NO" ]; then
79 SKIP_NEXT="YES"
80 fi
81}
82
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +020083# skip next test if OpenSSL doesn't support FALLBACK_SCSV
84requires_openssl_with_fallback_scsv() {
85 if [ -z "${OPENSSL_HAS_FBSCSV:-}" ]; then
86 if $OPENSSL_CMD s_client -help 2>&1 | grep fallback_scsv >/dev/null
87 then
88 OPENSSL_HAS_FBSCSV="YES"
89 else
90 OPENSSL_HAS_FBSCSV="NO"
91 fi
92 fi
93 if [ "$OPENSSL_HAS_FBSCSV" = "NO" ]; then
94 SKIP_NEXT="YES"
95 fi
96}
97
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +020098# skip next test if GnuTLS isn't available
99requires_gnutls() {
100 if [ -z "${GNUTLS_AVAILABLE:-}" ]; then
101 if ( which "$GNUTLS_CLI" && which "$GNUTLS_SERV" ) >/dev/null; then
102 GNUTLS_AVAILABLE="YES"
103 else
104 GNUTLS_AVAILABLE="NO"
105 fi
106 fi
107 if [ "$GNUTLS_AVAILABLE" = "NO" ]; then
108 SKIP_NEXT="YES"
109 fi
110}
111
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100112# print_name <name>
113print_name() {
114 echo -n "$1 "
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200115 LEN=$(( 72 - `echo "$1" | wc -c` ))
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100116 for i in `seq 1 $LEN`; do echo -n '.'; done
117 echo -n ' '
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100118
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200119 TESTS=$(( $TESTS + 1 ))
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100120}
121
122# fail <message>
123fail() {
124 echo "FAIL"
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100125 echo " ! $1"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100126
Manuel Pégourié-Gonnardc2b00922014-08-31 16:46:04 +0200127 mv $SRV_OUT o-srv-${TESTS}.log
128 mv $CLI_OUT o-cli-${TESTS}.log
Manuel Pégourié-Gonnard3eec6042014-02-27 15:37:24 +0100129 echo " ! outputs saved to o-srv-${TESTS}.log and o-cli-${TESTS}.log"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100130
Manuel Pégourié-Gonnard7fa67722014-08-31 17:42:53 +0200131 if [ "X${USER:-}" = Xbuildbot -o "X${LOGNAME:-}" = Xbuildbot ]; then
132 echo " ! server output:"
133 cat o-srv-${TESTS}.log
134 echo " ! ============================================================"
135 echo " ! client output:"
136 cat o-cli-${TESTS}.log
137 fi
138
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200139 FAILS=$(( $FAILS + 1 ))
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100140}
141
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100142# is_polar <cmd_line>
143is_polar() {
144 echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null
145}
146
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100147# has_mem_err <log_file_name>
148has_mem_err() {
149 if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" &&
150 grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null
151 then
152 return 1 # false: does not have errors
153 else
154 return 0 # true: has errors
155 fi
156}
157
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200158# wait for server to start: two versions depending on lsof availability
159wait_server_start() {
160 if which lsof >/dev/null; then
161 # make sure we don't loop forever
162 ( sleep "$DOG_DELAY"; echo "SERVERSTART TIMEOUT"; kill $MAIN_PID ) &
163 WATCHDOG_PID=$!
164
165 # make a tight loop, server usually takes less than 1 sec to start
166 until lsof -nbi TCP:"$PORT" | grep LISTEN >/dev/null; do :; done
167
168 kill $WATCHDOG_PID
169 wait $WATCHDOG_PID
170 else
171 sleep "$START_DELAY"
172 fi
173}
174
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200175# wait for client to terminate and set CLI_EXIT
176# must be called right after starting the client
177wait_client_done() {
178 CLI_PID=$!
179
180 ( sleep "$DOG_DELAY"; echo "TIMEOUT" >> $CLI_OUT; kill $CLI_PID ) &
181 WATCHDOG_PID=$!
182
183 wait $CLI_PID
184 CLI_EXIT=$?
185
186 kill $WATCHDOG_PID
187 wait $WATCHDOG_PID
188
189 echo "EXIT: $CLI_EXIT" >> $CLI_OUT
190}
191
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100192# Usage: run_test name srv_cmd cli_cmd cli_exit [option [...]]
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100193# Options: -s pattern pattern that must be present in server output
194# -c pattern pattern that must be present in client output
195# -S pattern pattern that must be absent in server output
196# -C pattern pattern that must be absent in client output
197run_test() {
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100198 NAME="$1"
199 SRV_CMD="$2"
200 CLI_CMD="$3"
201 CLI_EXPECT="$4"
202 shift 4
203
Manuel Pégourié-Gonnard417d46c2014-03-13 19:17:53 +0100204 if echo "$NAME" | grep "$FILTER" | grep -v "$EXCLUDE" >/dev/null; then :
205 else
206 return
207 fi
208
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100209 print_name "$NAME"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100210
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200211 # should we skip?
212 if [ "X$SKIP_NEXT" = "XYES" ]; then
213 SKIP_NEXT="NO"
214 echo "SKIP"
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +0200215 SKIPS=$(( $SKIPS + 1 ))
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200216 return
217 fi
218
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100219 # prepend valgrind to our commands if active
220 if [ "$MEMCHECK" -gt 0 ]; then
221 if is_polar "$SRV_CMD"; then
222 SRV_CMD="valgrind --leak-check=full $SRV_CMD"
223 fi
224 if is_polar "$CLI_CMD"; then
225 CLI_CMD="valgrind --leak-check=full $CLI_CMD"
226 fi
227 fi
228
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100229 # run the commands
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200230 echo "$SRV_CMD" > $SRV_OUT
231 $SRV_CMD >> $SRV_OUT 2>&1 &
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100232 SRV_PID=$!
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200233 wait_server_start
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200234
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200235 echo "$CLI_CMD" > $CLI_OUT
Manuel Pégourié-Gonnardc0f6a692014-08-30 22:41:47 +0200236 eval "$CLI_CMD" >> $CLI_OUT 2>&1 &
237 wait_client_done
Manuel Pégourié-Gonnarde01af4c2014-03-25 14:16:44 +0100238
Manuel Pégourié-Gonnard74b11702014-08-14 15:47:33 +0200239 # kill the server
240 kill $SRV_PID
241 wait $SRV_PID
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100242
243 # check if the client and server went at least to the handshake stage
Paul Bakker1ebc0c52014-05-22 15:47:58 +0200244 # (useful to avoid tests with only negative assertions and non-zero
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100245 # expected client exit to incorrectly succeed in case of catastrophic
246 # failure)
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100247 if is_polar "$SRV_CMD"; then
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200248 if grep "Performing the SSL/TLS handshake" $SRV_OUT >/dev/null; then :;
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100249 else
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100250 fail "server or client failed to reach handshake stage"
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100251 return
252 fi
253 fi
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100254 if is_polar "$CLI_CMD"; then
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200255 if grep "Performing the SSL/TLS handshake" $CLI_OUT >/dev/null; then :;
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100256 else
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100257 fail "server or client failed to reach handshake stage"
Manuel Pégourié-Gonnard677884d2014-02-25 16:42:31 +0100258 return
259 fi
260 fi
261
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100262 # check server exit code
263 if [ $? != 0 ]; then
264 fail "server fail"
265 return
266 fi
267
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100268 # check client exit code
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100269 if [ \( "$CLI_EXPECT" = 0 -a "$CLI_EXIT" != 0 \) -o \
270 \( "$CLI_EXPECT" != 0 -a "$CLI_EXIT" = 0 \) ]
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100271 then
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +0100272 fail "bad client exit code"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100273 return
274 fi
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100275
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100276 # check other assertions
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200277 # lines beginning with == are added by valgrind, ignore them
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100278 while [ $# -gt 0 ]
279 do
280 case $1 in
281 "-s")
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200282 if grep -v '^==' $SRV_OUT | grep "$2" >/dev/null; then :; else
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100283 fail "-s $2"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100284 return
285 fi
286 ;;
287
288 "-c")
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200289 if grep -v '^==' $CLI_OUT | grep "$2" >/dev/null; then :; else
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100290 fail "-c $2"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100291 return
292 fi
293 ;;
294
295 "-S")
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200296 if grep -v '^==' $SRV_OUT | grep "$2" >/dev/null; then
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100297 fail "-S $2"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100298 return
299 fi
300 ;;
301
302 "-C")
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200303 if grep -v '^==' $CLI_OUT | grep "$2" >/dev/null; then
Manuel Pégourié-Gonnardf8bdbb52014-02-21 09:20:14 +0100304 fail "-C $2"
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100305 return
306 fi
307 ;;
308
309 *)
Paul Bakker1ebc0c52014-05-22 15:47:58 +0200310 echo "Unknown test: $1" >&2
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100311 exit 1
312 esac
313 shift 2
314 done
315
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100316 # check valgrind's results
317 if [ "$MEMCHECK" -gt 0 ]; then
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200318 if is_polar "$SRV_CMD" && has_mem_err $SRV_OUT; then
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100319 fail "Server has memory errors"
320 return
321 fi
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200322 if is_polar "$CLI_CMD" && has_mem_err $CLI_OUT; then
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100323 fail "Client has memory errors"
324 return
325 fi
326 fi
327
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100328 # if we're here, everything is ok
329 echo "PASS"
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200330 rm -f $SRV_OUT $CLI_OUT
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100331}
332
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100333cleanup() {
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200334 rm -f $CLI_OUT $SRV_OUT $SESSION
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200335 kill $SRV_PID >/dev/null 2>&1
336 kill $WATCHDOG_PID >/dev/null 2>&1
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100337 exit 1
338}
339
Manuel Pégourié-Gonnard9dea8bd2014-02-26 18:21:02 +0100340#
341# MAIN
342#
343
Manuel Pégourié-Gonnard913030c2014-03-28 10:12:38 +0100344get_options "$@"
345
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100346# sanity checks, avoid an avalanche of errors
347if [ ! -x "$P_SRV" ]; then
348 echo "Command '$P_SRV' is not an executable file"
349 exit 1
350fi
351if [ ! -x "$P_CLI" ]; then
352 echo "Command '$P_CLI' is not an executable file"
353 exit 1
354fi
Manuel Pégourié-Gonnard74faf3c2014-03-13 18:47:44 +0100355if which $OPENSSL_CMD >/dev/null 2>&1; then :; else
356 echo "Command '$OPENSSL_CMD' not found"
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100357 exit 1
358fi
359
Manuel Pégourié-Gonnard32f8f4d2014-05-29 11:31:20 +0200360# used by watchdog
361MAIN_PID="$$"
362
Manuel Pégourié-Gonnard0c1ec472014-06-20 18:41:11 +0200363# be more patient with valgrind
364if [ "$MEMCHECK" -gt 0 ]; then
365 START_DELAY=3
366 DOG_DELAY=30
367else
368 START_DELAY=1
369 DOG_DELAY=10
370fi
371
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +0200372# Pick a "unique" port in the range 10000-19999.
373PORT="0000$$"
Manuel Pégourié-Gonnardfab2a3c2014-06-16 16:54:36 +0200374PORT="1$(echo $PORT | tail -c 5)"
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +0200375
376# fix commands to use this port
377P_SRV="$P_SRV server_port=$PORT"
378P_CLI="$P_CLI server_port=$PORT"
379O_SRV="$O_SRV -accept $PORT"
380O_CLI="$O_CLI -connect localhost:$PORT"
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +0200381G_SRV="$G_SRV -p $PORT"
382G_CLI="$G_CLI -p $PORT"
Manuel Pégourié-Gonnard8066b812014-05-28 22:59:30 +0200383
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200384# Also pick a unique name for intermediate files
385SRV_OUT="srv_out.$$"
386CLI_OUT="cli_out.$$"
387SESSION="session.$$"
388
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200389SKIP_NEXT="NO"
390
Manuel Pégourié-Gonnarda9062e92014-02-25 16:21:22 +0100391trap cleanup INT TERM HUP
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100392
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200393# Basic test
394
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200395# Checks that:
396# - things work with all ciphersuites active (used with config-full in all.sh)
397# - the expected (highest security) parameters are selected
398# ("signature_algorithm ext: 6" means SHA-512 (highest common hash))
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200399run_test "Default" \
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200400 "$P_SRV debug_level=3" \
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200401 "$P_CLI" \
402 0 \
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200403 -s "Protocol is TLSv1.2" \
404 -s "Ciphersuite is TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \
405 -s "client hello v3, signature_algorithm ext: 6" \
406 -s "ECDHE curve: secp521r1" \
407 -S "error" \
408 -C "error"
Manuel Pégourié-Gonnarde73b2632014-07-12 04:00:00 +0200409
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100410# Test for SSLv2 ClientHello
411
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200412requires_openssl_with_sslv2
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200413run_test "SSLv2 ClientHello: reference" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100414 "$P_SRV debug_level=3" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +0100415 "$O_CLI -no_ssl2" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100416 0 \
417 -S "parse client hello v2" \
418 -S "ssl_handshake returned"
419
420# Adding a SSL2-only suite makes OpenSSL client send SSLv2 ClientHello
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +0200421requires_openssl_with_sslv2
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200422run_test "SSLv2 ClientHello: actual test" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200423 "$P_SRV debug_level=2" \
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100424 "$O_CLI -cipher 'DES-CBC-MD5:ALL'" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +0100425 0 \
426 -s "parse client hello v2" \
427 -S "ssl_handshake returned"
428
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100429# Tests for Truncated HMAC extension
430
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100431run_test "Truncated HMAC: client default, server default" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200432 "$P_SRV debug_level=4" \
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100433 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100434 0 \
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100435 -s "dumping 'computed mac' (20 bytes)" \
436 -S "dumping 'computed mac' (10 bytes)"
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100437
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100438run_test "Truncated HMAC: client disabled, server default" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200439 "$P_SRV debug_level=4" \
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100440 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
441 trunc_hmac=0" \
Manuel Pégourié-Gonnardeaadc502014-02-20 11:01:30 +0100442 0 \
Manuel Pégourié-Gonnarde117a8f2015-01-09 12:39:35 +0100443 -s "dumping 'computed mac' (20 bytes)" \
444 -S "dumping 'computed mac' (10 bytes)"
445
446run_test "Truncated HMAC: client enabled, server default" \
447 "$P_SRV debug_level=4" \
448 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
449 trunc_hmac=1" \
450 0 \
451 -S "dumping 'computed mac' (20 bytes)" \
452 -s "dumping 'computed mac' (10 bytes)"
453
454run_test "Truncated HMAC: client enabled, server disabled" \
455 "$P_SRV debug_level=4 trunc_hmac=0" \
456 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
457 trunc_hmac=1" \
458 0 \
459 -s "dumping 'computed mac' (20 bytes)" \
460 -S "dumping 'computed mac' (10 bytes)"
461
462run_test "Truncated HMAC: client enabled, server enabled" \
463 "$P_SRV debug_level=4 trunc_hmac=1" \
464 "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \
465 trunc_hmac=1" \
466 0 \
467 -S "dumping 'computed mac' (20 bytes)" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100468 -s "dumping 'computed mac' (10 bytes)"
469
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100470# Tests for Encrypt-then-MAC extension
471
472run_test "Encrypt then MAC: default" \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100473 "$P_SRV debug_level=3 \
474 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100475 "$P_CLI debug_level=3" \
476 0 \
477 -c "client hello, adding encrypt_then_mac extension" \
478 -s "found encrypt then mac extension" \
479 -s "server hello, adding encrypt then mac extension" \
480 -c "found encrypt_then_mac extension" \
481 -c "using encrypt then mac" \
482 -s "using encrypt then mac"
483
484run_test "Encrypt then MAC: client enabled, server disabled" \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100485 "$P_SRV debug_level=3 etm=0 \
486 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100487 "$P_CLI debug_level=3 etm=1" \
488 0 \
489 -c "client hello, adding encrypt_then_mac extension" \
490 -s "found encrypt then mac extension" \
491 -S "server hello, adding encrypt then mac extension" \
492 -C "found encrypt_then_mac extension" \
493 -C "using encrypt then mac" \
494 -S "using encrypt then mac"
495
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +0100496run_test "Encrypt then MAC: client enabled, aead cipher" \
497 "$P_SRV debug_level=3 etm=1 \
498 force_ciphersuite=TLS-RSA-WITH-AES-128-GCM-SHA256" \
499 "$P_CLI debug_level=3 etm=1" \
500 0 \
501 -c "client hello, adding encrypt_then_mac extension" \
502 -s "found encrypt then mac extension" \
503 -S "server hello, adding encrypt then mac extension" \
504 -C "found encrypt_then_mac extension" \
505 -C "using encrypt then mac" \
506 -S "using encrypt then mac"
507
508run_test "Encrypt then MAC: client enabled, stream cipher" \
509 "$P_SRV debug_level=3 etm=1 \
510 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
511 "$P_CLI debug_level=3 etm=1" \
512 0 \
513 -c "client hello, adding encrypt_then_mac extension" \
514 -s "found encrypt then mac extension" \
515 -S "server hello, adding encrypt then mac extension" \
516 -C "found encrypt_then_mac extension" \
517 -C "using encrypt then mac" \
518 -S "using encrypt then mac"
519
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100520run_test "Encrypt then MAC: client disabled, server enabled" \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100521 "$P_SRV debug_level=3 etm=1 \
522 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100523 "$P_CLI debug_level=3 etm=0" \
524 0 \
525 -C "client hello, adding encrypt_then_mac extension" \
526 -S "found encrypt then mac extension" \
527 -S "server hello, adding encrypt then mac extension" \
528 -C "found encrypt_then_mac extension" \
529 -C "using encrypt then mac" \
530 -S "using encrypt then mac"
531
532run_test "Encrypt then MAC: client SSLv3, server enabled" \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100533 "$P_SRV debug_level=3 \
534 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100535 "$P_CLI debug_level=3 force_version=ssl3" \
536 0 \
537 -C "client hello, adding encrypt_then_mac extension" \
538 -S "found encrypt then mac extension" \
539 -S "server hello, adding encrypt then mac extension" \
540 -C "found encrypt_then_mac extension" \
541 -C "using encrypt then mac" \
542 -S "using encrypt then mac"
543
544run_test "Encrypt then MAC: client enabled, server SSLv3" \
Manuel Pégourié-Gonnard0098e7d2014-10-28 13:08:59 +0100545 "$P_SRV debug_level=3 force_version=ssl3 \
546 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100547 "$P_CLI debug_level=3" \
548 0 \
549 -c "client hello, adding encrypt_then_mac extension" \
550 -s "found encrypt then mac extension" \
551 -S "server hello, adding encrypt then mac extension" \
552 -C "found encrypt_then_mac extension" \
553 -C "using encrypt then mac" \
554 -S "using encrypt then mac"
555
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200556# Tests for Extended Master Secret extension
557
558run_test "Extended Master Secret: default" \
559 "$P_SRV debug_level=3" \
560 "$P_CLI debug_level=3" \
561 0 \
562 -c "client hello, adding extended_master_secret extension" \
563 -s "found extended master secret extension" \
564 -s "server hello, adding extended master secret extension" \
565 -c "found extended_master_secret extension" \
566 -c "using extended master secret" \
567 -s "using extended master secret"
568
569run_test "Extended Master Secret: client enabled, server disabled" \
570 "$P_SRV debug_level=3 extended_ms=0" \
571 "$P_CLI debug_level=3 extended_ms=1" \
572 0 \
573 -c "client hello, adding extended_master_secret extension" \
574 -s "found extended master secret extension" \
575 -S "server hello, adding extended master secret extension" \
576 -C "found extended_master_secret extension" \
577 -C "using extended master secret" \
578 -S "using extended master secret"
579
580run_test "Extended Master Secret: client disabled, server enabled" \
581 "$P_SRV debug_level=3 extended_ms=1" \
582 "$P_CLI debug_level=3 extended_ms=0" \
583 0 \
584 -C "client hello, adding extended_master_secret extension" \
585 -S "found extended master secret extension" \
586 -S "server hello, adding extended master secret extension" \
587 -C "found extended_master_secret extension" \
588 -C "using extended master secret" \
589 -S "using extended master secret"
590
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200591run_test "Extended Master Secret: client SSLv3, server enabled" \
592 "$P_SRV debug_level=3" \
593 "$P_CLI debug_level=3 force_version=ssl3" \
594 0 \
595 -C "client hello, adding extended_master_secret extension" \
596 -S "found extended master secret extension" \
597 -S "server hello, adding extended master secret extension" \
598 -C "found extended_master_secret extension" \
599 -C "using extended master secret" \
600 -S "using extended master secret"
601
602run_test "Extended Master Secret: client enabled, server SSLv3" \
603 "$P_SRV debug_level=3 force_version=ssl3" \
604 "$P_CLI debug_level=3" \
605 0 \
606 -c "client hello, adding extended_master_secret extension" \
607 -s "found extended master secret extension" \
608 -S "server hello, adding extended master secret extension" \
609 -C "found extended_master_secret extension" \
610 -C "using extended master secret" \
611 -S "using extended master secret"
612
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200613# Tests for FALLBACK_SCSV
614
615run_test "Fallback SCSV: default" \
616 "$P_SRV" \
617 "$P_CLI debug_level=3 force_version=tls1_1" \
618 0 \
619 -C "adding FALLBACK_SCSV" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200620 -S "received FALLBACK_SCSV" \
621 -S "inapropriate fallback" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200622 -C "is a fatal alert message (msg 86)"
623
624run_test "Fallback SCSV: explicitly disabled" \
625 "$P_SRV" \
626 "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \
627 0 \
628 -C "adding FALLBACK_SCSV" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200629 -S "received FALLBACK_SCSV" \
630 -S "inapropriate fallback" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200631 -C "is a fatal alert message (msg 86)"
632
633run_test "Fallback SCSV: enabled" \
634 "$P_SRV" \
635 "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200636 1 \
637 -c "adding FALLBACK_SCSV" \
638 -s "received FALLBACK_SCSV" \
639 -s "inapropriate fallback" \
640 -c "is a fatal alert message (msg 86)"
641
642run_test "Fallback SCSV: enabled, max version" \
643 "$P_SRV" \
644 "$P_CLI debug_level=3 fallback=1" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200645 0 \
646 -c "adding FALLBACK_SCSV" \
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200647 -s "received FALLBACK_SCSV" \
648 -S "inapropriate fallback" \
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +0200649 -C "is a fatal alert message (msg 86)"
650
651requires_openssl_with_fallback_scsv
652run_test "Fallback SCSV: default, openssl server" \
653 "$O_SRV" \
654 "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \
655 0 \
656 -C "adding FALLBACK_SCSV" \
657 -C "is a fatal alert message (msg 86)"
658
659requires_openssl_with_fallback_scsv
660run_test "Fallback SCSV: enabled, openssl server" \
661 "$O_SRV" \
662 "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \
663 1 \
664 -c "adding FALLBACK_SCSV" \
665 -c "is a fatal alert message (msg 86)"
666
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200667requires_openssl_with_fallback_scsv
668run_test "Fallback SCSV: disabled, openssl client" \
669 "$P_SRV" \
670 "$O_CLI -tls1_1" \
671 0 \
672 -S "received FALLBACK_SCSV" \
673 -S "inapropriate fallback"
674
675requires_openssl_with_fallback_scsv
676run_test "Fallback SCSV: enabled, openssl client" \
677 "$P_SRV" \
678 "$O_CLI -tls1_1 -fallback_scsv" \
679 1 \
680 -s "received FALLBACK_SCSV" \
681 -s "inapropriate fallback"
682
683requires_openssl_with_fallback_scsv
684run_test "Fallback SCSV: enabled, max version, openssl client" \
685 "$P_SRV" \
686 "$O_CLI -fallback_scsv" \
687 0 \
688 -s "received FALLBACK_SCSV" \
689 -S "inapropriate fallback"
690
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100691# Tests for Session Tickets
692
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200693run_test "Session resume using tickets: basic" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200694 "$P_SRV debug_level=3 tickets=1" \
695 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100696 0 \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100697 -c "client hello, adding session ticket extension" \
698 -s "found session ticket extension" \
699 -s "server hello, adding session ticket extension" \
700 -c "found session_ticket extension" \
701 -c "parse new session ticket" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100702 -S "session successfully restored from cache" \
703 -s "session successfully restored from ticket" \
704 -s "a session has been resumed" \
705 -c "a session has been resumed"
706
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200707run_test "Session resume using tickets: cache disabled" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200708 "$P_SRV debug_level=3 tickets=1 cache_max=0" \
709 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnarddbe1ee12014-02-21 09:18:13 +0100710 0 \
711 -c "client hello, adding session ticket extension" \
712 -s "found session ticket extension" \
713 -s "server hello, adding session ticket extension" \
714 -c "found session_ticket extension" \
715 -c "parse new session ticket" \
716 -S "session successfully restored from cache" \
717 -s "session successfully restored from ticket" \
718 -s "a session has been resumed" \
719 -c "a session has been resumed"
720
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200721run_test "Session resume using tickets: timeout" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200722 "$P_SRV debug_level=3 tickets=1 cache_max=0 ticket_timeout=1" \
723 "$P_CLI debug_level=3 tickets=1 reconnect=1 reco_delay=2" \
Manuel Pégourié-Gonnarddbe1ee12014-02-21 09:18:13 +0100724 0 \
725 -c "client hello, adding session ticket extension" \
726 -s "found session ticket extension" \
727 -s "server hello, adding session ticket extension" \
728 -c "found session_ticket extension" \
729 -c "parse new session ticket" \
730 -S "session successfully restored from cache" \
731 -S "session successfully restored from ticket" \
732 -S "a session has been resumed" \
733 -C "a session has been resumed"
734
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200735run_test "Session resume using tickets: openssl server" \
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100736 "$O_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200737 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100738 0 \
739 -c "client hello, adding session ticket extension" \
740 -c "found session_ticket extension" \
741 -c "parse new session ticket" \
742 -c "a session has been resumed"
743
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200744run_test "Session resume using tickets: openssl client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200745 "$P_SRV debug_level=3 tickets=1" \
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200746 "( $O_CLI -sess_out $SESSION; \
747 $O_CLI -sess_in $SESSION; \
748 rm -f $SESSION )" \
Manuel Pégourié-Gonnardfccd3252014-02-25 17:14:15 +0100749 0 \
750 -s "found session ticket extension" \
751 -s "server hello, adding session ticket extension" \
752 -S "session successfully restored from cache" \
753 -s "session successfully restored from ticket" \
754 -s "a session has been resumed"
755
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100756# Tests for Session Resume based on session-ID and cache
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100757
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200758run_test "Session resume using cache: tickets enabled on client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200759 "$P_SRV debug_level=3 tickets=0" \
760 "$P_CLI debug_level=3 tickets=1 reconnect=1" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100761 0 \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100762 -c "client hello, adding session ticket extension" \
763 -s "found session ticket extension" \
764 -S "server hello, adding session ticket extension" \
765 -C "found session_ticket extension" \
766 -C "parse new session ticket" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100767 -s "session successfully restored from cache" \
768 -S "session successfully restored from ticket" \
769 -s "a session has been resumed" \
770 -c "a session has been resumed"
771
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200772run_test "Session resume using cache: tickets enabled on server" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200773 "$P_SRV debug_level=3 tickets=1" \
774 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100775 0 \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100776 -C "client hello, adding session ticket extension" \
777 -S "found session ticket extension" \
778 -S "server hello, adding session ticket extension" \
779 -C "found session_ticket extension" \
780 -C "parse new session ticket" \
Manuel Pégourié-Gonnardf7c52012014-02-20 11:43:46 +0100781 -s "session successfully restored from cache" \
782 -S "session successfully restored from ticket" \
783 -s "a session has been resumed" \
784 -c "a session has been resumed"
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +0100785
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200786run_test "Session resume using cache: cache_max=0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200787 "$P_SRV debug_level=3 tickets=0 cache_max=0" \
788 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100789 0 \
790 -S "session successfully restored from cache" \
791 -S "session successfully restored from ticket" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100792 -S "a session has been resumed" \
793 -C "a session has been resumed"
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100794
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200795run_test "Session resume using cache: cache_max=1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200796 "$P_SRV debug_level=3 tickets=0 cache_max=1" \
797 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100798 0 \
799 -s "session successfully restored from cache" \
800 -S "session successfully restored from ticket" \
801 -s "a session has been resumed" \
802 -c "a session has been resumed"
803
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200804run_test "Session resume using cache: timemout > delay" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200805 "$P_SRV debug_level=3 tickets=0" \
806 "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=0" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100807 0 \
808 -s "session successfully restored from cache" \
809 -S "session successfully restored from ticket" \
810 -s "a session has been resumed" \
811 -c "a session has been resumed"
812
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200813run_test "Session resume using cache: timeout < delay" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200814 "$P_SRV debug_level=3 tickets=0 cache_timeout=1" \
815 "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \
Manuel Pégourié-Gonnardc55a5b72014-02-20 22:50:56 +0100816 0 \
817 -S "session successfully restored from cache" \
818 -S "session successfully restored from ticket" \
819 -S "a session has been resumed" \
820 -C "a session has been resumed"
821
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200822run_test "Session resume using cache: no timeout" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200823 "$P_SRV debug_level=3 tickets=0 cache_timeout=0" \
824 "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \
Manuel Pégourié-Gonnard4c883452014-02-20 21:32:41 +0100825 0 \
826 -s "session successfully restored from cache" \
827 -S "session successfully restored from ticket" \
828 -s "a session has been resumed" \
829 -c "a session has been resumed"
830
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200831run_test "Session resume using cache: openssl client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200832 "$P_SRV debug_level=3 tickets=0" \
Manuel Pégourié-Gonnardbc3b16c2014-05-28 23:06:50 +0200833 "( $O_CLI -sess_out $SESSION; \
834 $O_CLI -sess_in $SESSION; \
835 rm -f $SESSION )" \
Manuel Pégourié-Gonnarddb735f62014-02-25 17:57:59 +0100836 0 \
837 -s "found session ticket extension" \
838 -S "server hello, adding session ticket extension" \
839 -s "session successfully restored from cache" \
840 -S "session successfully restored from ticket" \
841 -s "a session has been resumed"
842
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200843run_test "Session resume using cache: openssl server" \
Manuel Pégourié-Gonnardf7a26902014-02-27 12:25:54 +0100844 "$O_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200845 "$P_CLI debug_level=3 tickets=0 reconnect=1" \
Manuel Pégourié-Gonnarddb735f62014-02-25 17:57:59 +0100846 0 \
847 -C "found session_ticket extension" \
848 -C "parse new session ticket" \
849 -c "a session has been resumed"
850
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100851# Tests for Max Fragment Length extension
852
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200853run_test "Max fragment length: not used, reference" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200854 "$P_SRV debug_level=3" \
855 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +0100856 0 \
857 -C "client hello, adding max_fragment_length extension" \
858 -S "found max fragment length extension" \
859 -S "server hello, max_fragment_length extension" \
860 -C "found max_fragment_length extension"
861
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200862run_test "Max fragment length: used by client" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200863 "$P_SRV debug_level=3" \
864 "$P_CLI debug_level=3 max_frag_len=4096" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +0100865 0 \
866 -c "client hello, adding max_fragment_length extension" \
867 -s "found max fragment length extension" \
868 -s "server hello, max_fragment_length extension" \
869 -c "found max_fragment_length extension"
870
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200871run_test "Max fragment length: used by server" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200872 "$P_SRV debug_level=3 max_frag_len=4096" \
873 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardde143782014-02-20 14:50:42 +0100874 0 \
875 -C "client hello, adding max_fragment_length extension" \
876 -S "found max fragment length extension" \
877 -S "server hello, max_fragment_length extension" \
878 -C "found max_fragment_length extension"
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100879
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200880requires_gnutls
881run_test "Max fragment length: gnutls server" \
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +0200882 "$G_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200883 "$P_CLI debug_level=3 max_frag_len=4096" \
Manuel Pégourié-Gonnardbaa7f072014-08-20 20:15:53 +0200884 0 \
885 -c "client hello, adding max_fragment_length extension" \
886 -c "found max_fragment_length extension"
887
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100888# Tests for renegotiation
889
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200890run_test "Renegotiation: none, for reference" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200891 "$P_SRV debug_level=3 exchanges=2" \
892 "$P_CLI debug_level=3 exchanges=2" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100893 0 \
894 -C "client hello, adding renegotiation extension" \
895 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
896 -S "found renegotiation extension" \
897 -s "server hello, secure renegotiation extension" \
898 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100899 -C "=> renegotiate" \
900 -S "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100901 -S "write hello request"
902
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200903run_test "Renegotiation: client-initiated" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200904 "$P_SRV debug_level=3 exchanges=2 renegotiation=1" \
905 "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100906 0 \
907 -c "client hello, adding renegotiation extension" \
908 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
909 -s "found renegotiation extension" \
910 -s "server hello, secure renegotiation extension" \
911 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100912 -c "=> renegotiate" \
913 -s "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100914 -S "write hello request"
915
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200916run_test "Renegotiation: server-initiated" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200917 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
918 "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100919 0 \
920 -c "client hello, adding renegotiation extension" \
921 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
922 -s "found renegotiation extension" \
923 -s "server hello, secure renegotiation extension" \
924 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100925 -c "=> renegotiate" \
926 -s "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100927 -s "write hello request"
928
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200929run_test "Renegotiation: double" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200930 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
931 "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100932 0 \
933 -c "client hello, adding renegotiation extension" \
934 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
935 -s "found renegotiation extension" \
936 -s "server hello, secure renegotiation extension" \
937 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100938 -c "=> renegotiate" \
939 -s "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100940 -s "write hello request"
941
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200942run_test "Renegotiation: client-initiated, server-rejected" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200943 "$P_SRV debug_level=3 exchanges=2 renegotiation=0" \
944 "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100945 1 \
946 -c "client hello, adding renegotiation extension" \
947 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
948 -S "found renegotiation extension" \
949 -s "server hello, secure renegotiation extension" \
950 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100951 -c "=> renegotiate" \
952 -S "=> renegotiate" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200953 -S "write hello request" \
Manuel Pégourié-Gonnard65919622014-08-19 12:50:30 +0200954 -c "SSL - Unexpected message at ServerHello in renegotiation" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200955 -c "failed"
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100956
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200957run_test "Renegotiation: server-initiated, client-rejected, default" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200958 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
959 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100960 0 \
961 -C "client hello, adding renegotiation extension" \
962 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
963 -S "found renegotiation extension" \
964 -s "server hello, secure renegotiation extension" \
965 -c "found renegotiation extension" \
Manuel Pégourié-Gonnardc73339f2014-02-26 16:35:27 +0100966 -C "=> renegotiate" \
967 -S "=> renegotiate" \
Manuel Pégourié-Gonnard780d6712014-02-20 17:19:59 +0100968 -s "write hello request" \
Manuel Pégourié-Gonnarda9964db2014-07-03 19:29:16 +0200969 -S "SSL - An unexpected message was received from our peer" \
970 -S "failed"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +0100971
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200972run_test "Renegotiation: server-initiated, client-rejected, not enforced" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200973 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200974 renego_delay=-1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200975 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200976 0 \
977 -C "client hello, adding renegotiation extension" \
978 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
979 -S "found renegotiation extension" \
980 -s "server hello, secure renegotiation extension" \
981 -c "found renegotiation extension" \
982 -C "=> renegotiate" \
983 -S "=> renegotiate" \
984 -s "write hello request" \
985 -S "SSL - An unexpected message was received from our peer" \
986 -S "failed"
987
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +0200988# delay 2 for 1 alert record + 1 application data record
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +0200989run_test "Renegotiation: server-initiated, client-rejected, delay 2" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200990 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +0200991 renego_delay=2" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +0200992 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +0200993 0 \
994 -C "client hello, adding renegotiation extension" \
995 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
996 -S "found renegotiation extension" \
997 -s "server hello, secure renegotiation extension" \
998 -c "found renegotiation extension" \
999 -C "=> renegotiate" \
1000 -S "=> renegotiate" \
1001 -s "write hello request" \
1002 -S "SSL - An unexpected message was received from our peer" \
1003 -S "failed"
1004
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001005run_test "Renegotiation: server-initiated, client-rejected, delay 0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001006 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001007 renego_delay=0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001008 "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001009 0 \
1010 -C "client hello, adding renegotiation extension" \
1011 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1012 -S "found renegotiation extension" \
1013 -s "server hello, secure renegotiation extension" \
1014 -c "found renegotiation extension" \
1015 -C "=> renegotiate" \
1016 -S "=> renegotiate" \
1017 -s "write hello request" \
Manuel Pégourié-Gonnarda8c0a0d2014-08-15 12:07:38 +02001018 -s "SSL - An unexpected message was received from our peer"
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001019
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001020run_test "Renegotiation: server-initiated, client-accepted, delay 0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001021 "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001022 renego_delay=0" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001023 "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \
Manuel Pégourié-Gonnardfae355e2014-07-04 14:32:27 +02001024 0 \
1025 -c "client hello, adding renegotiation extension" \
1026 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1027 -s "found renegotiation extension" \
1028 -s "server hello, secure renegotiation extension" \
1029 -c "found renegotiation extension" \
1030 -c "=> renegotiate" \
1031 -s "=> renegotiate" \
1032 -s "write hello request" \
1033 -S "SSL - An unexpected message was received from our peer" \
1034 -S "failed"
1035
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001036run_test "Renegotiation: nbio, client-initiated" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001037 "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1" \
1038 "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02001039 0 \
1040 -c "client hello, adding renegotiation extension" \
1041 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1042 -s "found renegotiation extension" \
1043 -s "server hello, secure renegotiation extension" \
1044 -c "found renegotiation extension" \
1045 -c "=> renegotiate" \
1046 -s "=> renegotiate" \
1047 -S "write hello request"
1048
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001049run_test "Renegotiation: nbio, server-initiated" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001050 "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \
1051 "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1" \
Manuel Pégourié-Gonnardf07f4212014-08-15 19:04:47 +02001052 0 \
1053 -c "client hello, adding renegotiation extension" \
1054 -s "received TLS_EMPTY_RENEGOTIATION_INFO" \
1055 -s "found renegotiation extension" \
1056 -s "server hello, secure renegotiation extension" \
1057 -c "found renegotiation extension" \
1058 -c "=> renegotiate" \
1059 -s "=> renegotiate" \
1060 -s "write hello request"
1061
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001062run_test "Renegotiation: openssl server, client-initiated" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +02001063 "$O_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001064 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +02001065 0 \
1066 -c "client hello, adding renegotiation extension" \
1067 -c "found renegotiation extension" \
1068 -c "=> renegotiate" \
1069 -C "ssl_handshake returned" \
1070 -C "error" \
1071 -c "HTTP/1.0 200 [Oo][Kk]"
1072
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001073run_test "Renegotiation: gnutls server, client-initiated" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +02001074 "$G_SRV" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001075 "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \
Manuel Pégourié-Gonnard51362962014-08-30 21:22:47 +02001076 0 \
1077 -c "client hello, adding renegotiation extension" \
1078 -c "found renegotiation extension" \
1079 -c "=> renegotiate" \
1080 -C "ssl_handshake returned" \
1081 -C "error" \
1082 -c "HTTP/1.0 200 [Oo][Kk]"
1083
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001084# Tests for auth_mode
1085
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001086run_test "Authentication: server badcert, client required" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001087 "$P_SRV crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001088 key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001089 "$P_CLI debug_level=1 auth_mode=required" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001090 1 \
1091 -c "x509_verify_cert() returned" \
1092 -c "! self-signed or not signed by a trusted CA" \
1093 -c "! ssl_handshake returned" \
1094 -c "X509 - Certificate verification failed"
1095
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001096run_test "Authentication: server badcert, client optional" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001097 "$P_SRV crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001098 key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001099 "$P_CLI debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001100 0 \
1101 -c "x509_verify_cert() returned" \
1102 -c "! self-signed or not signed by a trusted CA" \
1103 -C "! ssl_handshake returned" \
1104 -C "X509 - Certificate verification failed"
1105
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001106run_test "Authentication: server badcert, client none" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001107 "$P_SRV crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001108 key_file=data_files/server5.key" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001109 "$P_CLI debug_level=1 auth_mode=none" \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001110 0 \
1111 -C "x509_verify_cert() returned" \
1112 -C "! self-signed or not signed by a trusted CA" \
1113 -C "! ssl_handshake returned" \
1114 -C "X509 - Certificate verification failed"
1115
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001116run_test "Authentication: client badcert, server required" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001117 "$P_SRV debug_level=3 auth_mode=required" \
1118 "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001119 key_file=data_files/server5.key" \
1120 1 \
1121 -S "skip write certificate request" \
1122 -C "skip parse certificate request" \
1123 -c "got a certificate request" \
1124 -C "skip write certificate" \
1125 -C "skip write certificate verify" \
1126 -S "skip parse certificate verify" \
1127 -s "x509_verify_cert() returned" \
1128 -S "! self-signed or not signed by a trusted CA" \
1129 -s "! ssl_handshake returned" \
1130 -c "! ssl_handshake returned" \
1131 -s "X509 - Certificate verification failed"
1132
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001133run_test "Authentication: client badcert, server optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001134 "$P_SRV debug_level=3 auth_mode=optional" \
1135 "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001136 key_file=data_files/server5.key" \
1137 0 \
1138 -S "skip write certificate request" \
1139 -C "skip parse certificate request" \
1140 -c "got a certificate request" \
1141 -C "skip write certificate" \
1142 -C "skip write certificate verify" \
1143 -S "skip parse certificate verify" \
1144 -s "x509_verify_cert() returned" \
1145 -s "! self-signed or not signed by a trusted CA" \
1146 -S "! ssl_handshake returned" \
1147 -C "! ssl_handshake returned" \
1148 -S "X509 - Certificate verification failed"
1149
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001150run_test "Authentication: client badcert, server none" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001151 "$P_SRV debug_level=3 auth_mode=none" \
1152 "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01001153 key_file=data_files/server5.key" \
1154 0 \
1155 -s "skip write certificate request" \
1156 -C "skip parse certificate request" \
1157 -c "got no certificate request" \
1158 -c "skip write certificate" \
1159 -c "skip write certificate verify" \
1160 -s "skip parse certificate verify" \
1161 -S "x509_verify_cert() returned" \
1162 -S "! self-signed or not signed by a trusted CA" \
1163 -S "! ssl_handshake returned" \
1164 -C "! ssl_handshake returned" \
1165 -S "X509 - Certificate verification failed"
1166
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001167run_test "Authentication: client no cert, server optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001168 "$P_SRV debug_level=3 auth_mode=optional" \
1169 "$P_CLI debug_level=3 crt_file=none key_file=none" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001170 0 \
1171 -S "skip write certificate request" \
1172 -C "skip parse certificate request" \
1173 -c "got a certificate request" \
1174 -C "skip write certificate$" \
1175 -C "got no certificate to send" \
1176 -S "SSLv3 client has no certificate" \
1177 -c "skip write certificate verify" \
1178 -s "skip parse certificate verify" \
1179 -s "! no client certificate sent" \
1180 -S "! ssl_handshake returned" \
1181 -C "! ssl_handshake returned" \
1182 -S "X509 - Certificate verification failed"
1183
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001184run_test "Authentication: openssl client no cert, server optional" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001185 "$P_SRV debug_level=3 auth_mode=optional" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001186 "$O_CLI" \
1187 0 \
1188 -S "skip write certificate request" \
1189 -s "skip parse certificate verify" \
1190 -s "! no client certificate sent" \
1191 -S "! ssl_handshake returned" \
1192 -S "X509 - Certificate verification failed"
1193
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001194run_test "Authentication: client no cert, openssl server optional" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001195 "$O_SRV -verify 10" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001196 "$P_CLI debug_level=3 crt_file=none key_file=none" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001197 0 \
1198 -C "skip parse certificate request" \
1199 -c "got a certificate request" \
1200 -C "skip write certificate$" \
1201 -c "skip write certificate verify" \
1202 -C "! ssl_handshake returned"
1203
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001204run_test "Authentication: client no cert, ssl3" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001205 "$P_SRV debug_level=3 auth_mode=optional force_version=ssl3" \
1206 "$P_CLI debug_level=3 crt_file=none key_file=none" \
Manuel Pégourié-Gonnardde515cc2014-02-27 14:58:26 +01001207 0 \
1208 -S "skip write certificate request" \
1209 -C "skip parse certificate request" \
1210 -c "got a certificate request" \
1211 -C "skip write certificate$" \
1212 -c "skip write certificate verify" \
1213 -c "got no certificate to send" \
1214 -s "SSLv3 client has no certificate" \
1215 -s "skip parse certificate verify" \
1216 -s "! no client certificate sent" \
1217 -S "! ssl_handshake returned" \
1218 -C "! ssl_handshake returned" \
1219 -S "X509 - Certificate verification failed"
1220
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001221# tests for SNI
1222
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001223run_test "SNI: no SNI callback" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001224 "$P_SRV debug_level=3 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001225 crt_file=data_files/server5.crt key_file=data_files/server5.key" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001226 "$P_CLI debug_level=0 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001227 server_name=localhost" \
1228 0 \
1229 -S "parse ServerName extension" \
1230 -c "issuer name *: C=NL, O=PolarSSL, CN=Polarssl Test EC CA" \
1231 -c "subject name *: C=NL, O=PolarSSL, CN=localhost"
1232
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001233run_test "SNI: matching cert 1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001234 "$P_SRV debug_level=3 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001235 crt_file=data_files/server5.crt key_file=data_files/server5.key \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001236 sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001237 "$P_CLI debug_level=0 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001238 server_name=localhost" \
1239 0 \
1240 -s "parse ServerName extension" \
1241 -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \
1242 -c "subject name *: C=NL, O=PolarSSL, CN=localhost"
1243
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001244run_test "SNI: matching cert 2" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001245 "$P_SRV debug_level=3 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001246 crt_file=data_files/server5.crt key_file=data_files/server5.key \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001247 sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001248 "$P_CLI debug_level=0 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001249 server_name=polarssl.example" \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001250 0 \
1251 -s "parse ServerName extension" \
1252 -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001253 -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example"
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001254
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001255run_test "SNI: no matching cert" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001256 "$P_SRV debug_level=3 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001257 crt_file=data_files/server5.crt key_file=data_files/server5.key \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001258 sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \
Manuel Pégourié-Gonnardc1da6642014-02-25 14:18:30 +01001259 "$P_CLI debug_level=0 server_addr=127.0.0.1 \
Manuel Pégourié-Gonnard76b8ab72014-03-26 09:31:35 +01001260 server_name=nonesuch.example" \
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +01001261 1 \
1262 -s "parse ServerName extension" \
1263 -s "ssl_sni_wrapper() returned" \
1264 -s "ssl_handshake returned" \
1265 -c "ssl_handshake returned" \
1266 -c "SSL - A fatal alert message was received from our peer"
1267
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001268# Tests for non-blocking I/O: exercise a variety of handshake flows
1269
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001270run_test "Non-blocking I/O: basic handshake" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001271 "$P_SRV nbio=2 tickets=0 auth_mode=none" \
1272 "$P_CLI nbio=2 tickets=0" \
1273 0 \
1274 -S "ssl_handshake returned" \
1275 -C "ssl_handshake returned" \
1276 -c "Read from server: .* bytes read"
1277
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001278run_test "Non-blocking I/O: client auth" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001279 "$P_SRV nbio=2 tickets=0 auth_mode=required" \
1280 "$P_CLI nbio=2 tickets=0" \
1281 0 \
1282 -S "ssl_handshake returned" \
1283 -C "ssl_handshake returned" \
1284 -c "Read from server: .* bytes read"
1285
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001286run_test "Non-blocking I/O: ticket" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001287 "$P_SRV nbio=2 tickets=1 auth_mode=none" \
1288 "$P_CLI nbio=2 tickets=1" \
1289 0 \
1290 -S "ssl_handshake returned" \
1291 -C "ssl_handshake returned" \
1292 -c "Read from server: .* bytes read"
1293
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001294run_test "Non-blocking I/O: ticket + client auth" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001295 "$P_SRV nbio=2 tickets=1 auth_mode=required" \
1296 "$P_CLI nbio=2 tickets=1" \
1297 0 \
1298 -S "ssl_handshake returned" \
1299 -C "ssl_handshake returned" \
1300 -c "Read from server: .* bytes read"
1301
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001302run_test "Non-blocking I/O: ticket + client auth + resume" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001303 "$P_SRV nbio=2 tickets=1 auth_mode=required" \
1304 "$P_CLI nbio=2 tickets=1 reconnect=1" \
1305 0 \
1306 -S "ssl_handshake returned" \
1307 -C "ssl_handshake returned" \
1308 -c "Read from server: .* bytes read"
1309
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001310run_test "Non-blocking I/O: ticket + resume" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001311 "$P_SRV nbio=2 tickets=1 auth_mode=none" \
1312 "$P_CLI nbio=2 tickets=1 reconnect=1" \
1313 0 \
1314 -S "ssl_handshake returned" \
1315 -C "ssl_handshake returned" \
1316 -c "Read from server: .* bytes read"
1317
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001318run_test "Non-blocking I/O: session-id resume" \
Manuel Pégourié-Gonnard0b6609b2014-02-26 14:45:12 +01001319 "$P_SRV nbio=2 tickets=0 auth_mode=none" \
1320 "$P_CLI nbio=2 tickets=0 reconnect=1" \
1321 0 \
1322 -S "ssl_handshake returned" \
1323 -C "ssl_handshake returned" \
1324 -c "Read from server: .* bytes read"
1325
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001326# Tests for version negotiation
1327
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001328run_test "Version check: all -> 1.2" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001329 "$P_SRV" \
1330 "$P_CLI" \
1331 0 \
1332 -S "ssl_handshake returned" \
1333 -C "ssl_handshake returned" \
1334 -s "Protocol is TLSv1.2" \
1335 -c "Protocol is TLSv1.2"
1336
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001337run_test "Version check: cli max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001338 "$P_SRV" \
1339 "$P_CLI max_version=tls1_1" \
1340 0 \
1341 -S "ssl_handshake returned" \
1342 -C "ssl_handshake returned" \
1343 -s "Protocol is TLSv1.1" \
1344 -c "Protocol is TLSv1.1"
1345
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001346run_test "Version check: srv max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001347 "$P_SRV max_version=tls1_1" \
1348 "$P_CLI" \
1349 0 \
1350 -S "ssl_handshake returned" \
1351 -C "ssl_handshake returned" \
1352 -s "Protocol is TLSv1.1" \
1353 -c "Protocol is TLSv1.1"
1354
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001355run_test "Version check: cli+srv max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001356 "$P_SRV max_version=tls1_1" \
1357 "$P_CLI max_version=tls1_1" \
1358 0 \
1359 -S "ssl_handshake returned" \
1360 -C "ssl_handshake returned" \
1361 -s "Protocol is TLSv1.1" \
1362 -c "Protocol is TLSv1.1"
1363
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001364run_test "Version check: cli max 1.1, srv min 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001365 "$P_SRV min_version=tls1_1" \
1366 "$P_CLI max_version=tls1_1" \
1367 0 \
1368 -S "ssl_handshake returned" \
1369 -C "ssl_handshake returned" \
1370 -s "Protocol is TLSv1.1" \
1371 -c "Protocol is TLSv1.1"
1372
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001373run_test "Version check: cli min 1.1, srv max 1.1 -> 1.1" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001374 "$P_SRV max_version=tls1_1" \
1375 "$P_CLI min_version=tls1_1" \
1376 0 \
1377 -S "ssl_handshake returned" \
1378 -C "ssl_handshake returned" \
1379 -s "Protocol is TLSv1.1" \
1380 -c "Protocol is TLSv1.1"
1381
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001382run_test "Version check: cli min 1.2, srv max 1.1 -> fail" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001383 "$P_SRV max_version=tls1_1" \
1384 "$P_CLI min_version=tls1_2" \
1385 1 \
1386 -s "ssl_handshake returned" \
1387 -c "ssl_handshake returned" \
1388 -c "SSL - Handshake protocol not within min/max boundaries"
1389
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001390run_test "Version check: srv min 1.2, cli max 1.1 -> fail" \
Manuel Pégourié-Gonnarda3d808e2014-02-26 16:33:03 +01001391 "$P_SRV min_version=tls1_2" \
1392 "$P_CLI max_version=tls1_1" \
1393 1 \
1394 -s "ssl_handshake returned" \
1395 -c "ssl_handshake returned" \
1396 -s "SSL - Handshake protocol not within min/max boundaries"
1397
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001398# Tests for ALPN extension
1399
Manuel Pégourié-Gonnard83d8c732014-04-07 13:24:21 +02001400if grep '^#define POLARSSL_SSL_ALPN' $CONFIG_H >/dev/null; then
1401
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001402run_test "ALPN: none" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001403 "$P_SRV debug_level=3" \
1404 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001405 0 \
1406 -C "client hello, adding alpn extension" \
1407 -S "found alpn extension" \
1408 -C "got an alert message, type: \\[2:120]" \
1409 -S "server hello, adding alpn extension" \
1410 -C "found alpn extension " \
1411 -C "Application Layer Protocol is" \
1412 -S "Application Layer Protocol is"
1413
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001414run_test "ALPN: client only" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001415 "$P_SRV debug_level=3" \
1416 "$P_CLI debug_level=3 alpn=abc,1234" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001417 0 \
1418 -c "client hello, adding alpn extension" \
1419 -s "found alpn extension" \
1420 -C "got an alert message, type: \\[2:120]" \
1421 -S "server hello, adding alpn extension" \
1422 -C "found alpn extension " \
1423 -c "Application Layer Protocol is (none)" \
1424 -S "Application Layer Protocol is"
1425
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001426run_test "ALPN: server only" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001427 "$P_SRV debug_level=3 alpn=abc,1234" \
1428 "$P_CLI debug_level=3" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001429 0 \
1430 -C "client hello, adding alpn extension" \
1431 -S "found alpn extension" \
1432 -C "got an alert message, type: \\[2:120]" \
1433 -S "server hello, adding alpn extension" \
1434 -C "found alpn extension " \
1435 -C "Application Layer Protocol is" \
1436 -s "Application Layer Protocol is (none)"
1437
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001438run_test "ALPN: both, common cli1-srv1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001439 "$P_SRV debug_level=3 alpn=abc,1234" \
1440 "$P_CLI debug_level=3 alpn=abc,1234" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001441 0 \
1442 -c "client hello, adding alpn extension" \
1443 -s "found alpn extension" \
1444 -C "got an alert message, type: \\[2:120]" \
1445 -s "server hello, adding alpn extension" \
1446 -c "found alpn extension" \
1447 -c "Application Layer Protocol is abc" \
1448 -s "Application Layer Protocol is abc"
1449
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001450run_test "ALPN: both, common cli2-srv1" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001451 "$P_SRV debug_level=3 alpn=abc,1234" \
1452 "$P_CLI debug_level=3 alpn=1234,abc" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001453 0 \
1454 -c "client hello, adding alpn extension" \
1455 -s "found alpn extension" \
1456 -C "got an alert message, type: \\[2:120]" \
1457 -s "server hello, adding alpn extension" \
1458 -c "found alpn extension" \
1459 -c "Application Layer Protocol is abc" \
1460 -s "Application Layer Protocol is abc"
1461
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001462run_test "ALPN: both, common cli1-srv2" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001463 "$P_SRV debug_level=3 alpn=abc,1234" \
1464 "$P_CLI debug_level=3 alpn=1234,abcde" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001465 0 \
1466 -c "client hello, adding alpn extension" \
1467 -s "found alpn extension" \
1468 -C "got an alert message, type: \\[2:120]" \
1469 -s "server hello, adding alpn extension" \
1470 -c "found alpn extension" \
1471 -c "Application Layer Protocol is 1234" \
1472 -s "Application Layer Protocol is 1234"
1473
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001474run_test "ALPN: both, no common" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001475 "$P_SRV debug_level=3 alpn=abc,123" \
1476 "$P_CLI debug_level=3 alpn=1234,abcde" \
Manuel Pégourié-Gonnardf6521de2014-04-07 12:42:04 +02001477 1 \
1478 -c "client hello, adding alpn extension" \
1479 -s "found alpn extension" \
1480 -c "got an alert message, type: \\[2:120]" \
1481 -S "server hello, adding alpn extension" \
1482 -C "found alpn extension" \
1483 -C "Application Layer Protocol is 1234" \
1484 -S "Application Layer Protocol is 1234"
1485
Manuel Pégourié-Gonnard83d8c732014-04-07 13:24:21 +02001486fi
1487
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001488# Tests for keyUsage in leaf certificates, part 1:
1489# server-side certificate/suite selection
1490
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001491run_test "keyUsage srv: RSA, digitalSignature -> (EC)DHE-RSA" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001492 "$P_SRV key_file=data_files/server2.key \
1493 crt_file=data_files/server2.ku-ds.crt" \
1494 "$P_CLI" \
1495 0 \
Manuel Pégourié-Gonnard17cde5f2014-05-22 14:42:39 +02001496 -c "Ciphersuite is TLS-[EC]*DHE-RSA-WITH-"
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001497
1498
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001499run_test "keyUsage srv: RSA, keyEncipherment -> RSA" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001500 "$P_SRV key_file=data_files/server2.key \
1501 crt_file=data_files/server2.ku-ke.crt" \
1502 "$P_CLI" \
1503 0 \
1504 -c "Ciphersuite is TLS-RSA-WITH-"
1505
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001506run_test "keyUsage srv: RSA, keyAgreement -> fail" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02001507 "$P_SRV key_file=data_files/server2.key \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001508 crt_file=data_files/server2.ku-ka.crt" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02001509 "$P_CLI" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001510 1 \
1511 -C "Ciphersuite is "
1512
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001513run_test "keyUsage srv: ECDSA, digitalSignature -> ECDHE-ECDSA" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001514 "$P_SRV key_file=data_files/server5.key \
1515 crt_file=data_files/server5.ku-ds.crt" \
1516 "$P_CLI" \
1517 0 \
1518 -c "Ciphersuite is TLS-ECDHE-ECDSA-WITH-"
1519
1520
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001521run_test "keyUsage srv: ECDSA, keyAgreement -> ECDH-" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001522 "$P_SRV key_file=data_files/server5.key \
1523 crt_file=data_files/server5.ku-ka.crt" \
1524 "$P_CLI" \
1525 0 \
1526 -c "Ciphersuite is TLS-ECDH-"
1527
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001528run_test "keyUsage srv: ECDSA, keyEncipherment -> fail" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02001529 "$P_SRV key_file=data_files/server5.key \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001530 crt_file=data_files/server5.ku-ke.crt" \
Manuel Pégourié-Gonnardf2629b92014-08-30 14:20:14 +02001531 "$P_CLI" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001532 1 \
1533 -C "Ciphersuite is "
1534
1535# Tests for keyUsage in leaf certificates, part 2:
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001536# client-side checking of server cert
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001537
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001538run_test "keyUsage cli: DigitalSignature+KeyEncipherment, RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001539 "$O_SRV -key data_files/server2.key \
1540 -cert data_files/server2.ku-ds_ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001541 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001542 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
1543 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001544 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001545 -C "Processing of the Certificate handshake message failed" \
1546 -c "Ciphersuite is TLS-"
1547
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001548run_test "keyUsage cli: DigitalSignature+KeyEncipherment, DHE-RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001549 "$O_SRV -key data_files/server2.key \
1550 -cert data_files/server2.ku-ds_ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001551 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001552 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
1553 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001554 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001555 -C "Processing of the Certificate handshake message failed" \
1556 -c "Ciphersuite is TLS-"
1557
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001558run_test "keyUsage cli: KeyEncipherment, RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001559 "$O_SRV -key data_files/server2.key \
1560 -cert data_files/server2.ku-ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001561 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001562 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
1563 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001564 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001565 -C "Processing of the Certificate handshake message failed" \
1566 -c "Ciphersuite is TLS-"
1567
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001568run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001569 "$O_SRV -key data_files/server2.key \
1570 -cert data_files/server2.ku-ke.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001571 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001572 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
1573 1 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001574 -c "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001575 -c "Processing of the Certificate handshake message failed" \
1576 -C "Ciphersuite is TLS-"
1577
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001578run_test "keyUsage cli: DigitalSignature, DHE-RSA: OK" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001579 "$O_SRV -key data_files/server2.key \
1580 -cert data_files/server2.ku-ds.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001581 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001582 force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \
1583 0 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001584 -C "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001585 -C "Processing of the Certificate handshake message failed" \
1586 -c "Ciphersuite is TLS-"
1587
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001588run_test "keyUsage cli: DigitalSignature, RSA: fail" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001589 "$O_SRV -key data_files/server2.key \
1590 -cert data_files/server2.ku-ds.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001591 "$P_CLI debug_level=1 \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001592 force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \
1593 1 \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001594 -c "bad certificate (usage extensions)" \
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +02001595 -c "Processing of the Certificate handshake message failed" \
1596 -C "Ciphersuite is TLS-"
1597
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001598# Tests for keyUsage in leaf certificates, part 3:
1599# server-side checking of client cert
1600
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001601run_test "keyUsage cli-auth: RSA, DigitalSignature: OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001602 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001603 "$O_CLI -key data_files/server2.key \
1604 -cert data_files/server2.ku-ds.crt" \
1605 0 \
1606 -S "bad certificate (usage extensions)" \
1607 -S "Processing of the Certificate handshake message failed"
1608
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001609run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (soft)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001610 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001611 "$O_CLI -key data_files/server2.key \
1612 -cert data_files/server2.ku-ke.crt" \
1613 0 \
1614 -s "bad certificate (usage extensions)" \
1615 -S "Processing of the Certificate handshake message failed"
1616
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001617run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (hard)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001618 "$P_SRV debug_level=1 auth_mode=required" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001619 "$O_CLI -key data_files/server2.key \
1620 -cert data_files/server2.ku-ke.crt" \
1621 1 \
1622 -s "bad certificate (usage extensions)" \
1623 -s "Processing of the Certificate handshake message failed"
1624
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001625run_test "keyUsage cli-auth: ECDSA, DigitalSignature: OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001626 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001627 "$O_CLI -key data_files/server5.key \
1628 -cert data_files/server5.ku-ds.crt" \
1629 0 \
1630 -S "bad certificate (usage extensions)" \
1631 -S "Processing of the Certificate handshake message failed"
1632
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001633run_test "keyUsage cli-auth: ECDSA, KeyAgreement: fail (soft)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001634 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnarda9db85d2014-04-09 14:53:05 +02001635 "$O_CLI -key data_files/server5.key \
1636 -cert data_files/server5.ku-ka.crt" \
1637 0 \
1638 -s "bad certificate (usage extensions)" \
1639 -S "Processing of the Certificate handshake message failed"
1640
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001641# Tests for extendedKeyUsage, part 1: server-side certificate/suite selection
1642
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001643run_test "extKeyUsage srv: serverAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001644 "$P_SRV key_file=data_files/server5.key \
1645 crt_file=data_files/server5.eku-srv.crt" \
1646 "$P_CLI" \
1647 0
1648
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001649run_test "extKeyUsage srv: serverAuth,clientAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001650 "$P_SRV key_file=data_files/server5.key \
1651 crt_file=data_files/server5.eku-srv.crt" \
1652 "$P_CLI" \
1653 0
1654
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001655run_test "extKeyUsage srv: codeSign,anyEKU -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001656 "$P_SRV key_file=data_files/server5.key \
1657 crt_file=data_files/server5.eku-cs_any.crt" \
1658 "$P_CLI" \
1659 0
1660
1661# add psk to leave an option for client to send SERVERQUIT
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001662run_test "extKeyUsage srv: codeSign -> fail" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001663 "$P_SRV psk=abc123 key_file=data_files/server5.key \
1664 crt_file=data_files/server5.eku-cli.crt" \
1665 "$P_CLI psk=badbad" \
1666 1
1667
1668# Tests for extendedKeyUsage, part 2: client-side checking of server cert
1669
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001670run_test "extKeyUsage cli: serverAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001671 "$O_SRV -key data_files/server5.key \
1672 -cert data_files/server5.eku-srv.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001673 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001674 0 \
1675 -C "bad certificate (usage extensions)" \
1676 -C "Processing of the Certificate handshake message failed" \
1677 -c "Ciphersuite is TLS-"
1678
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001679run_test "extKeyUsage cli: serverAuth,clientAuth -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001680 "$O_SRV -key data_files/server5.key \
1681 -cert data_files/server5.eku-srv_cli.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001682 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001683 0 \
1684 -C "bad certificate (usage extensions)" \
1685 -C "Processing of the Certificate handshake message failed" \
1686 -c "Ciphersuite is TLS-"
1687
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001688run_test "extKeyUsage cli: codeSign,anyEKU -> OK" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001689 "$O_SRV -key data_files/server5.key \
1690 -cert data_files/server5.eku-cs_any.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001691 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001692 0 \
1693 -C "bad certificate (usage extensions)" \
1694 -C "Processing of the Certificate handshake message failed" \
1695 -c "Ciphersuite is TLS-"
1696
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001697run_test "extKeyUsage cli: codeSign -> fail" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001698 "$O_SRV -key data_files/server5.key \
1699 -cert data_files/server5.eku-cs.crt" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001700 "$P_CLI debug_level=1" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001701 1 \
1702 -c "bad certificate (usage extensions)" \
1703 -c "Processing of the Certificate handshake message failed" \
1704 -C "Ciphersuite is TLS-"
1705
1706# Tests for extendedKeyUsage, part 3: server-side checking of client cert
1707
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001708run_test "extKeyUsage cli-auth: clientAuth -> OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001709 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001710 "$O_CLI -key data_files/server5.key \
1711 -cert data_files/server5.eku-cli.crt" \
1712 0 \
1713 -S "bad certificate (usage extensions)" \
1714 -S "Processing of the Certificate handshake message failed"
1715
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001716run_test "extKeyUsage cli-auth: serverAuth,clientAuth -> OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001717 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001718 "$O_CLI -key data_files/server5.key \
1719 -cert data_files/server5.eku-srv_cli.crt" \
1720 0 \
1721 -S "bad certificate (usage extensions)" \
1722 -S "Processing of the Certificate handshake message failed"
1723
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001724run_test "extKeyUsage cli-auth: codeSign,anyEKU -> OK" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001725 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001726 "$O_CLI -key data_files/server5.key \
1727 -cert data_files/server5.eku-cs_any.crt" \
1728 0 \
1729 -S "bad certificate (usage extensions)" \
1730 -S "Processing of the Certificate handshake message failed"
1731
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001732run_test "extKeyUsage cli-auth: codeSign -> fail (soft)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001733 "$P_SRV debug_level=1 auth_mode=optional" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001734 "$O_CLI -key data_files/server5.key \
1735 -cert data_files/server5.eku-cs.crt" \
1736 0 \
1737 -s "bad certificate (usage extensions)" \
1738 -S "Processing of the Certificate handshake message failed"
1739
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001740run_test "extKeyUsage cli-auth: codeSign -> fail (hard)" \
Manuel Pégourié-Gonnard644e8f32014-08-30 21:59:31 +02001741 "$P_SRV debug_level=1 auth_mode=required" \
Manuel Pégourié-Gonnard0408fd12014-04-11 11:06:22 +02001742 "$O_CLI -key data_files/server5.key \
1743 -cert data_files/server5.eku-cs.crt" \
1744 1 \
1745 -s "bad certificate (usage extensions)" \
1746 -s "Processing of the Certificate handshake message failed"
1747
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02001748# Tests for DHM parameters loading
1749
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001750run_test "DHM parameters: reference" \
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02001751 "$P_SRV" \
1752 "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
1753 debug_level=3" \
1754 0 \
1755 -c "value of 'DHM: P ' (2048 bits)" \
1756 -c "value of 'DHM: G ' (2048 bits)"
1757
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001758run_test "DHM parameters: other parameters" \
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02001759 "$P_SRV dhm_file=data_files/dhparams.pem" \
1760 "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
1761 debug_level=3" \
1762 0 \
1763 -c "value of 'DHM: P ' (1024 bits)" \
1764 -c "value of 'DHM: G ' (2 bits)"
1765
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001766# Tests for PSK callback
1767
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001768run_test "PSK callback: psk, no callback" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001769 "$P_SRV psk=abc123 psk_identity=foo" \
1770 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1771 psk_identity=foo psk=abc123" \
1772 0 \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001773 -S "SSL - The server has no ciphersuites in common" \
1774 -S "SSL - Unknown identity received" \
1775 -S "SSL - Verification of the message MAC failed"
1776
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001777run_test "PSK callback: no psk, no callback" \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001778 "$P_SRV" \
1779 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1780 psk_identity=foo psk=abc123" \
1781 1 \
1782 -s "SSL - The server has no ciphersuites in common" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001783 -S "SSL - Unknown identity received" \
1784 -S "SSL - Verification of the message MAC failed"
1785
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001786run_test "PSK callback: callback overrides other settings" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001787 "$P_SRV psk=abc123 psk_identity=foo psk_list=abc,dead,def,beef" \
1788 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1789 psk_identity=foo psk=abc123" \
1790 1 \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001791 -S "SSL - The server has no ciphersuites in common" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001792 -s "SSL - Unknown identity received" \
1793 -S "SSL - Verification of the message MAC failed"
1794
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001795run_test "PSK callback: first id matches" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001796 "$P_SRV psk_list=abc,dead,def,beef" \
1797 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1798 psk_identity=abc psk=dead" \
1799 0 \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001800 -S "SSL - The server has no ciphersuites in common" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001801 -S "SSL - Unknown identity received" \
1802 -S "SSL - Verification of the message MAC failed"
1803
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001804run_test "PSK callback: second id matches" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001805 "$P_SRV psk_list=abc,dead,def,beef" \
1806 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1807 psk_identity=def psk=beef" \
1808 0 \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001809 -S "SSL - The server has no ciphersuites in common" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001810 -S "SSL - Unknown identity received" \
1811 -S "SSL - Verification of the message MAC failed"
1812
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001813run_test "PSK callback: no match" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001814 "$P_SRV psk_list=abc,dead,def,beef" \
1815 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1816 psk_identity=ghi psk=beef" \
1817 1 \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001818 -S "SSL - The server has no ciphersuites in common" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001819 -s "SSL - Unknown identity received" \
1820 -S "SSL - Verification of the message MAC failed"
1821
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001822run_test "PSK callback: wrong key" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001823 "$P_SRV psk_list=abc,dead,def,beef" \
1824 "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \
1825 psk_identity=abc psk=beef" \
1826 1 \
Manuel Pégourié-Gonnard10c3c9f2014-06-10 15:28:52 +02001827 -S "SSL - The server has no ciphersuites in common" \
Manuel Pégourié-Gonnarda6781c92014-06-10 15:00:46 +02001828 -S "SSL - Unknown identity received" \
1829 -s "SSL - Verification of the message MAC failed"
Manuel Pégourié-Gonnard0cc7e312014-06-09 11:36:47 +02001830
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02001831# Tests for ciphersuites per version
1832
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001833run_test "Per-version suites: SSL3" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02001834 "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
1835 "$P_CLI force_version=ssl3" \
1836 0 \
1837 -c "Ciphersuite is TLS-RSA-WITH-3DES-EDE-CBC-SHA"
1838
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001839run_test "Per-version suites: TLS 1.0" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02001840 "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
1841 "$P_CLI force_version=tls1" \
1842 0 \
1843 -c "Ciphersuite is TLS-RSA-WITH-RC4-128-SHA"
1844
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001845run_test "Per-version suites: TLS 1.1" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02001846 "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
1847 "$P_CLI force_version=tls1_1" \
1848 0 \
1849 -c "Ciphersuite is TLS-RSA-WITH-AES-128-CBC-SHA"
1850
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001851run_test "Per-version suites: TLS 1.2" \
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02001852 "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \
1853 "$P_CLI force_version=tls1_2" \
1854 0 \
1855 -c "Ciphersuite is TLS-RSA-WITH-AES-128-GCM-SHA256"
1856
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +02001857# Tests for ssl_get_bytes_avail()
1858
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001859run_test "ssl_get_bytes_avail: no extra data" \
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +02001860 "$P_SRV" \
1861 "$P_CLI request_size=100" \
1862 0 \
1863 -s "Read from client: 100 bytes read$"
1864
Manuel Pégourié-Gonnard8e03c712014-08-30 21:42:40 +02001865run_test "ssl_get_bytes_avail: extra data" \
Manuel Pégourié-Gonnard95c0a632014-06-11 18:32:36 +02001866 "$P_SRV" \
1867 "$P_CLI request_size=500" \
1868 0 \
1869 -s "Read from client: 500 bytes read (.*+.*)"
Manuel Pégourié-Gonnard90805a82014-06-11 14:06:01 +02001870
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02001871# Tests for small packets
1872
1873run_test "Small packet SSLv3 BlockCipher" \
1874 "$P_SRV" \
1875 "$P_CLI request_size=1 force_version=ssl3 \
1876 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1877 0 \
1878 -s "Read from client: 1 bytes read"
1879
1880run_test "Small packet SSLv3 StreamCipher" \
1881 "$P_SRV" \
1882 "$P_CLI request_size=1 force_version=ssl3 \
1883 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
1884 0 \
1885 -s "Read from client: 1 bytes read"
1886
1887run_test "Small packet TLS 1.0 BlockCipher" \
1888 "$P_SRV" \
1889 "$P_CLI request_size=1 force_version=tls1 \
1890 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1891 0 \
1892 -s "Read from client: 1 bytes read"
1893
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +01001894run_test "Small packet TLS 1.0 BlockCipher without EtM" \
1895 "$P_SRV" \
1896 "$P_CLI request_size=1 force_version=tls1 etm=0 \
1897 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1898 0 \
1899 -s "Read from client: 1 bytes read"
1900
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02001901run_test "Small packet TLS 1.0 BlockCipher truncated MAC" \
1902 "$P_SRV" \
1903 "$P_CLI request_size=1 force_version=tls1 \
1904 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
1905 trunc_hmac=1" \
1906 0 \
1907 -s "Read from client: 1 bytes read"
1908
1909run_test "Small packet TLS 1.0 StreamCipher truncated MAC" \
1910 "$P_SRV" \
1911 "$P_CLI request_size=1 force_version=tls1 \
1912 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
1913 trunc_hmac=1" \
1914 0 \
1915 -s "Read from client: 1 bytes read"
1916
1917run_test "Small packet TLS 1.1 BlockCipher" \
1918 "$P_SRV" \
1919 "$P_CLI request_size=1 force_version=tls1_1 \
1920 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1921 0 \
1922 -s "Read from client: 1 bytes read"
1923
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +01001924run_test "Small packet TLS 1.1 BlockCipher without EtM" \
1925 "$P_SRV" \
1926 "$P_CLI request_size=1 force_version=tls1_1 etm=0 \
1927 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1928 0 \
1929 -s "Read from client: 1 bytes read"
1930
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02001931run_test "Small packet TLS 1.1 StreamCipher" \
1932 "$P_SRV" \
1933 "$P_CLI request_size=1 force_version=tls1_1 \
1934 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
1935 0 \
1936 -s "Read from client: 1 bytes read"
1937
1938run_test "Small packet TLS 1.1 BlockCipher truncated MAC" \
1939 "$P_SRV" \
1940 "$P_CLI request_size=1 force_version=tls1_1 \
1941 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
1942 trunc_hmac=1" \
1943 0 \
1944 -s "Read from client: 1 bytes read"
1945
1946run_test "Small packet TLS 1.1 StreamCipher truncated MAC" \
1947 "$P_SRV" \
1948 "$P_CLI request_size=1 force_version=tls1_1 \
1949 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
1950 trunc_hmac=1" \
1951 0 \
1952 -s "Read from client: 1 bytes read"
1953
1954run_test "Small packet TLS 1.2 BlockCipher" \
1955 "$P_SRV" \
1956 "$P_CLI request_size=1 force_version=tls1_2 \
1957 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1958 0 \
1959 -s "Read from client: 1 bytes read"
1960
Manuel Pégourié-Gonnard169dd6a2014-11-04 16:15:39 +01001961run_test "Small packet TLS 1.2 BlockCipher without EtM" \
1962 "$P_SRV" \
1963 "$P_CLI request_size=1 force_version=tls1_2 etm=0 \
1964 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
1965 0 \
1966 -s "Read from client: 1 bytes read"
1967
Manuel Pégourié-Gonnardee415032014-06-18 15:08:56 +02001968run_test "Small packet TLS 1.2 BlockCipher larger MAC" \
1969 "$P_SRV" \
1970 "$P_CLI request_size=1 force_version=tls1_2 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \
1971 0 \
1972 -s "Read from client: 1 bytes read"
1973
1974run_test "Small packet TLS 1.2 BlockCipher truncated MAC" \
1975 "$P_SRV" \
1976 "$P_CLI request_size=1 force_version=tls1_2 \
1977 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
1978 trunc_hmac=1" \
1979 0 \
1980 -s "Read from client: 1 bytes read"
1981
1982run_test "Small packet TLS 1.2 StreamCipher" \
1983 "$P_SRV" \
1984 "$P_CLI request_size=1 force_version=tls1_2 \
1985 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
1986 0 \
1987 -s "Read from client: 1 bytes read"
1988
1989run_test "Small packet TLS 1.2 StreamCipher truncated MAC" \
1990 "$P_SRV" \
1991 "$P_CLI request_size=1 force_version=tls1_2 \
1992 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
1993 trunc_hmac=1" \
1994 0 \
1995 -s "Read from client: 1 bytes read"
1996
1997run_test "Small packet TLS 1.2 AEAD" \
1998 "$P_SRV" \
1999 "$P_CLI request_size=1 force_version=tls1_2 \
2000 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \
2001 0 \
2002 -s "Read from client: 1 bytes read"
2003
2004run_test "Small packet TLS 1.2 AEAD shorter tag" \
2005 "$P_SRV" \
2006 "$P_CLI request_size=1 force_version=tls1_2 \
2007 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \
2008 0 \
2009 -s "Read from client: 1 bytes read"
2010
Manuel Pégourié-Gonnard8920f692014-06-18 22:05:08 +02002011# Test for large packets
2012
2013run_test "Large packet SSLv3 BlockCipher" \
2014 "$P_SRV" \
2015 "$P_CLI request_size=16384 force_version=ssl3 \
2016 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2017 0 \
2018 -s "Read from client: 16384 bytes read"
2019
2020run_test "Large packet SSLv3 StreamCipher" \
2021 "$P_SRV" \
2022 "$P_CLI request_size=16384 force_version=ssl3 \
2023 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2024 0 \
2025 -s "Read from client: 16384 bytes read"
2026
2027run_test "Large packet TLS 1.0 BlockCipher" \
2028 "$P_SRV" \
2029 "$P_CLI request_size=16384 force_version=tls1 \
2030 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2031 0 \
2032 -s "Read from client: 16384 bytes read"
2033
2034run_test "Large packet TLS 1.0 BlockCipher truncated MAC" \
2035 "$P_SRV" \
2036 "$P_CLI request_size=16384 force_version=tls1 \
2037 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2038 trunc_hmac=1" \
2039 0 \
2040 -s "Read from client: 16384 bytes read"
2041
2042run_test "Large packet TLS 1.0 StreamCipher truncated MAC" \
2043 "$P_SRV" \
2044 "$P_CLI request_size=16384 force_version=tls1 \
2045 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2046 trunc_hmac=1" \
2047 0 \
2048 -s "Read from client: 16384 bytes read"
2049
2050run_test "Large packet TLS 1.1 BlockCipher" \
2051 "$P_SRV" \
2052 "$P_CLI request_size=16384 force_version=tls1_1 \
2053 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2054 0 \
2055 -s "Read from client: 16384 bytes read"
2056
2057run_test "Large packet TLS 1.1 StreamCipher" \
2058 "$P_SRV" \
2059 "$P_CLI request_size=16384 force_version=tls1_1 \
2060 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2061 0 \
2062 -s "Read from client: 16384 bytes read"
2063
2064run_test "Large packet TLS 1.1 BlockCipher truncated MAC" \
2065 "$P_SRV" \
2066 "$P_CLI request_size=16384 force_version=tls1_1 \
2067 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2068 trunc_hmac=1" \
2069 0 \
2070 -s "Read from client: 16384 bytes read"
2071
2072run_test "Large packet TLS 1.1 StreamCipher truncated MAC" \
2073 "$P_SRV" \
2074 "$P_CLI request_size=16384 force_version=tls1_1 \
2075 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2076 trunc_hmac=1" \
2077 0 \
2078 -s "Read from client: 16384 bytes read"
2079
2080run_test "Large packet TLS 1.2 BlockCipher" \
2081 "$P_SRV" \
2082 "$P_CLI request_size=16384 force_version=tls1_2 \
2083 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \
2084 0 \
2085 -s "Read from client: 16384 bytes read"
2086
2087run_test "Large packet TLS 1.2 BlockCipher larger MAC" \
2088 "$P_SRV" \
2089 "$P_CLI request_size=16384 force_version=tls1_2 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \
2090 0 \
2091 -s "Read from client: 16384 bytes read"
2092
2093run_test "Large packet TLS 1.2 BlockCipher truncated MAC" \
2094 "$P_SRV" \
2095 "$P_CLI request_size=16384 force_version=tls1_2 \
2096 force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \
2097 trunc_hmac=1" \
2098 0 \
2099 -s "Read from client: 16384 bytes read"
2100
2101run_test "Large packet TLS 1.2 StreamCipher" \
2102 "$P_SRV" \
2103 "$P_CLI request_size=16384 force_version=tls1_2 \
2104 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \
2105 0 \
2106 -s "Read from client: 16384 bytes read"
2107
2108run_test "Large packet TLS 1.2 StreamCipher truncated MAC" \
2109 "$P_SRV" \
2110 "$P_CLI request_size=16384 force_version=tls1_2 \
2111 force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \
2112 trunc_hmac=1" \
2113 0 \
2114 -s "Read from client: 16384 bytes read"
2115
2116run_test "Large packet TLS 1.2 AEAD" \
2117 "$P_SRV" \
2118 "$P_CLI request_size=16384 force_version=tls1_2 \
2119 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \
2120 0 \
2121 -s "Read from client: 16384 bytes read"
2122
2123run_test "Large packet TLS 1.2 AEAD shorter tag" \
2124 "$P_SRV" \
2125 "$P_CLI request_size=16384 force_version=tls1_2 \
2126 force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \
2127 0 \
2128 -s "Read from client: 16384 bytes read"
2129
Manuel Pégourié-Gonnard8520dac2014-02-21 12:12:23 +01002130# Final report
2131
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01002132echo "------------------------------------------------------------------------"
2133
2134if [ $FAILS = 0 ]; then
2135 echo -n "PASSED"
2136else
2137 echo -n "FAILED"
2138fi
Manuel Pégourié-Gonnard72e51ee2014-08-31 10:22:11 +02002139PASSES=$(( $TESTS - $FAILS ))
Manuel Pégourié-Gonnard6f4fbbb2014-08-14 14:31:29 +02002140echo " ($PASSES / $TESTS tests ($SKIPS skipped))"
Manuel Pégourié-Gonnard33a752e2014-02-21 09:47:37 +01002141
2142exit $FAILS