Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 1 | #!/bin/sh |
| 2 | |
| 3 | # Test various options that are not covered by compat.sh |
| 4 | # |
| 5 | # Here the goal is not to cover every ciphersuite/version, but |
| 6 | # rather specific options (max fragment length, truncated hmac, etc) |
| 7 | # or procedures (session resumption from cache or ticket, renego, etc). |
| 8 | # |
| 9 | # Assumes all options are compiled in. |
| 10 | |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 11 | set -u |
| 12 | |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 13 | # default values, can be overriden by the environment |
| 14 | : ${P_SRV:=../programs/ssl/ssl_server2} |
| 15 | : ${P_CLI:=../programs/ssl/ssl_client2} |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 16 | : ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 17 | : ${GNUTLS_CLI:=gnutls-cli} |
| 18 | : ${GNUTLS_SERV:=gnutls-serv} |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 19 | |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 20 | O_SRV="$OPENSSL_CMD s_server -www -cert data_files/server5.crt -key data_files/server5.key" |
| 21 | O_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_CMD s_client" |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 22 | G_SRV="$GNUTLS_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key" |
| 23 | G_CLI="$GNUTLS_CLI" |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 24 | |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 25 | TESTS=0 |
| 26 | FAILS=0 |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 27 | SKIPS=0 |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 28 | |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 29 | CONFIG_H='../include/polarssl/config.h' |
| 30 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 31 | MEMCHECK=0 |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 32 | FILTER='.*' |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 33 | EXCLUDE='^$' |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 34 | |
| 35 | print_usage() { |
| 36 | echo "Usage: $0 [options]" |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 37 | echo -e " -h|--help\tPrint this help." |
| 38 | echo -e " -m|--memcheck\tCheck memory leaks and errors." |
| 39 | echo -e " -f|--filter\tOnly matching tests are executed (default: '$FILTER')" |
| 40 | echo -e " -e|--exclude\tMatching tests are excluded (default: '$EXCLUDE')" |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 41 | } |
| 42 | |
| 43 | get_options() { |
| 44 | while [ $# -gt 0 ]; do |
| 45 | case "$1" in |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 46 | -f|--filter) |
| 47 | shift; FILTER=$1 |
| 48 | ;; |
| 49 | -e|--exclude) |
| 50 | shift; EXCLUDE=$1 |
| 51 | ;; |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 52 | -m|--memcheck) |
| 53 | MEMCHECK=1 |
| 54 | ;; |
| 55 | -h|--help) |
| 56 | print_usage |
| 57 | exit 0 |
| 58 | ;; |
| 59 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 60 | echo "Unknown argument: '$1'" |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 61 | print_usage |
| 62 | exit 1 |
| 63 | ;; |
| 64 | esac |
| 65 | shift |
| 66 | done |
| 67 | } |
| 68 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 69 | # skip next test if OpenSSL can't send SSLv2 ClientHello |
| 70 | requires_openssl_with_sslv2() { |
| 71 | if [ -z "${OPENSSL_HAS_SSL2:-}" ]; then |
Manuel Pégourié-Gonnard | a4afadf | 2014-08-30 22:09:36 +0200 | [diff] [blame] | 72 | if $OPENSSL_CMD ciphers -ssl2 >/dev/null 2>&1; then |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 73 | OPENSSL_HAS_SSL2="YES" |
| 74 | else |
| 75 | OPENSSL_HAS_SSL2="NO" |
| 76 | fi |
| 77 | fi |
| 78 | if [ "$OPENSSL_HAS_SSL2" = "NO" ]; then |
| 79 | SKIP_NEXT="YES" |
| 80 | fi |
| 81 | } |
| 82 | |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 83 | # skip next test if OpenSSL doesn't support FALLBACK_SCSV |
| 84 | requires_openssl_with_fallback_scsv() { |
| 85 | if [ -z "${OPENSSL_HAS_FBSCSV:-}" ]; then |
| 86 | if $OPENSSL_CMD s_client -help 2>&1 | grep fallback_scsv >/dev/null |
| 87 | then |
| 88 | OPENSSL_HAS_FBSCSV="YES" |
| 89 | else |
| 90 | OPENSSL_HAS_FBSCSV="NO" |
| 91 | fi |
| 92 | fi |
| 93 | if [ "$OPENSSL_HAS_FBSCSV" = "NO" ]; then |
| 94 | SKIP_NEXT="YES" |
| 95 | fi |
| 96 | } |
| 97 | |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 98 | # skip next test if GnuTLS isn't available |
| 99 | requires_gnutls() { |
| 100 | if [ -z "${GNUTLS_AVAILABLE:-}" ]; then |
| 101 | if ( which "$GNUTLS_CLI" && which "$GNUTLS_SERV" ) >/dev/null; then |
| 102 | GNUTLS_AVAILABLE="YES" |
| 103 | else |
| 104 | GNUTLS_AVAILABLE="NO" |
| 105 | fi |
| 106 | fi |
| 107 | if [ "$GNUTLS_AVAILABLE" = "NO" ]; then |
| 108 | SKIP_NEXT="YES" |
| 109 | fi |
| 110 | } |
| 111 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 112 | # print_name <name> |
| 113 | print_name() { |
| 114 | echo -n "$1 " |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 115 | LEN=$(( 72 - `echo "$1" | wc -c` )) |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 116 | for i in `seq 1 $LEN`; do echo -n '.'; done |
| 117 | echo -n ' ' |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 118 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 119 | TESTS=$(( $TESTS + 1 )) |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 120 | } |
| 121 | |
| 122 | # fail <message> |
| 123 | fail() { |
| 124 | echo "FAIL" |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 125 | echo " ! $1" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 126 | |
Manuel Pégourié-Gonnard | c2b0092 | 2014-08-31 16:46:04 +0200 | [diff] [blame] | 127 | mv $SRV_OUT o-srv-${TESTS}.log |
| 128 | mv $CLI_OUT o-cli-${TESTS}.log |
Manuel Pégourié-Gonnard | 3eec604 | 2014-02-27 15:37:24 +0100 | [diff] [blame] | 129 | echo " ! outputs saved to o-srv-${TESTS}.log and o-cli-${TESTS}.log" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 130 | |
Manuel Pégourié-Gonnard | 7fa6772 | 2014-08-31 17:42:53 +0200 | [diff] [blame] | 131 | if [ "X${USER:-}" = Xbuildbot -o "X${LOGNAME:-}" = Xbuildbot ]; then |
| 132 | echo " ! server output:" |
| 133 | cat o-srv-${TESTS}.log |
| 134 | echo " ! ============================================================" |
| 135 | echo " ! client output:" |
| 136 | cat o-cli-${TESTS}.log |
| 137 | fi |
| 138 | |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 139 | FAILS=$(( $FAILS + 1 )) |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 140 | } |
| 141 | |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 142 | # is_polar <cmd_line> |
| 143 | is_polar() { |
| 144 | echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null |
| 145 | } |
| 146 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 147 | # has_mem_err <log_file_name> |
| 148 | has_mem_err() { |
| 149 | if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" && |
| 150 | grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null |
| 151 | then |
| 152 | return 1 # false: does not have errors |
| 153 | else |
| 154 | return 0 # true: has errors |
| 155 | fi |
| 156 | } |
| 157 | |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 158 | # wait for server to start: two versions depending on lsof availability |
| 159 | wait_server_start() { |
| 160 | if which lsof >/dev/null; then |
| 161 | # make sure we don't loop forever |
| 162 | ( sleep "$DOG_DELAY"; echo "SERVERSTART TIMEOUT"; kill $MAIN_PID ) & |
| 163 | WATCHDOG_PID=$! |
| 164 | |
| 165 | # make a tight loop, server usually takes less than 1 sec to start |
| 166 | until lsof -nbi TCP:"$PORT" | grep LISTEN >/dev/null; do :; done |
| 167 | |
| 168 | kill $WATCHDOG_PID |
| 169 | wait $WATCHDOG_PID |
| 170 | else |
| 171 | sleep "$START_DELAY" |
| 172 | fi |
| 173 | } |
| 174 | |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 175 | # wait for client to terminate and set CLI_EXIT |
| 176 | # must be called right after starting the client |
| 177 | wait_client_done() { |
| 178 | CLI_PID=$! |
| 179 | |
| 180 | ( sleep "$DOG_DELAY"; echo "TIMEOUT" >> $CLI_OUT; kill $CLI_PID ) & |
| 181 | WATCHDOG_PID=$! |
| 182 | |
| 183 | wait $CLI_PID |
| 184 | CLI_EXIT=$? |
| 185 | |
| 186 | kill $WATCHDOG_PID |
| 187 | wait $WATCHDOG_PID |
| 188 | |
| 189 | echo "EXIT: $CLI_EXIT" >> $CLI_OUT |
| 190 | } |
| 191 | |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 192 | # Usage: run_test name srv_cmd cli_cmd cli_exit [option [...]] |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 193 | # Options: -s pattern pattern that must be present in server output |
| 194 | # -c pattern pattern that must be present in client output |
| 195 | # -S pattern pattern that must be absent in server output |
| 196 | # -C pattern pattern that must be absent in client output |
| 197 | run_test() { |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 198 | NAME="$1" |
| 199 | SRV_CMD="$2" |
| 200 | CLI_CMD="$3" |
| 201 | CLI_EXPECT="$4" |
| 202 | shift 4 |
| 203 | |
Manuel Pégourié-Gonnard | 417d46c | 2014-03-13 19:17:53 +0100 | [diff] [blame] | 204 | if echo "$NAME" | grep "$FILTER" | grep -v "$EXCLUDE" >/dev/null; then : |
| 205 | else |
| 206 | return |
| 207 | fi |
| 208 | |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 209 | print_name "$NAME" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 210 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 211 | # should we skip? |
| 212 | if [ "X$SKIP_NEXT" = "XYES" ]; then |
| 213 | SKIP_NEXT="NO" |
| 214 | echo "SKIP" |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 215 | SKIPS=$(( $SKIPS + 1 )) |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 216 | return |
| 217 | fi |
| 218 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 219 | # prepend valgrind to our commands if active |
| 220 | if [ "$MEMCHECK" -gt 0 ]; then |
| 221 | if is_polar "$SRV_CMD"; then |
| 222 | SRV_CMD="valgrind --leak-check=full $SRV_CMD" |
| 223 | fi |
| 224 | if is_polar "$CLI_CMD"; then |
| 225 | CLI_CMD="valgrind --leak-check=full $CLI_CMD" |
| 226 | fi |
| 227 | fi |
| 228 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 229 | # run the commands |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 230 | echo "$SRV_CMD" > $SRV_OUT |
| 231 | $SRV_CMD >> $SRV_OUT 2>&1 & |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 232 | SRV_PID=$! |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 233 | wait_server_start |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 234 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 235 | echo "$CLI_CMD" > $CLI_OUT |
Manuel Pégourié-Gonnard | c0f6a69 | 2014-08-30 22:41:47 +0200 | [diff] [blame] | 236 | eval "$CLI_CMD" >> $CLI_OUT 2>&1 & |
| 237 | wait_client_done |
Manuel Pégourié-Gonnard | e01af4c | 2014-03-25 14:16:44 +0100 | [diff] [blame] | 238 | |
Manuel Pégourié-Gonnard | 74b1170 | 2014-08-14 15:47:33 +0200 | [diff] [blame] | 239 | # kill the server |
| 240 | kill $SRV_PID |
| 241 | wait $SRV_PID |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 242 | |
| 243 | # check if the client and server went at least to the handshake stage |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 244 | # (useful to avoid tests with only negative assertions and non-zero |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 245 | # expected client exit to incorrectly succeed in case of catastrophic |
| 246 | # failure) |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 247 | if is_polar "$SRV_CMD"; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 248 | if grep "Performing the SSL/TLS handshake" $SRV_OUT >/dev/null; then :; |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 249 | else |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 250 | fail "server or client failed to reach handshake stage" |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 251 | return |
| 252 | fi |
| 253 | fi |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 254 | if is_polar "$CLI_CMD"; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 255 | if grep "Performing the SSL/TLS handshake" $CLI_OUT >/dev/null; then :; |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 256 | else |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 257 | fail "server or client failed to reach handshake stage" |
Manuel Pégourié-Gonnard | 677884d | 2014-02-25 16:42:31 +0100 | [diff] [blame] | 258 | return |
| 259 | fi |
| 260 | fi |
| 261 | |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 262 | # check server exit code |
| 263 | if [ $? != 0 ]; then |
| 264 | fail "server fail" |
| 265 | return |
| 266 | fi |
| 267 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 268 | # check client exit code |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 269 | if [ \( "$CLI_EXPECT" = 0 -a "$CLI_EXIT" != 0 \) -o \ |
| 270 | \( "$CLI_EXPECT" != 0 -a "$CLI_EXIT" = 0 \) ] |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 271 | then |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 272 | fail "bad client exit code" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 273 | return |
| 274 | fi |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 275 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 276 | # check other assertions |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 277 | # lines beginning with == are added by valgrind, ignore them |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 278 | while [ $# -gt 0 ] |
| 279 | do |
| 280 | case $1 in |
| 281 | "-s") |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 282 | if grep -v '^==' $SRV_OUT | grep "$2" >/dev/null; then :; else |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 283 | fail "-s $2" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 284 | return |
| 285 | fi |
| 286 | ;; |
| 287 | |
| 288 | "-c") |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 289 | if grep -v '^==' $CLI_OUT | grep "$2" >/dev/null; then :; else |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 290 | fail "-c $2" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 291 | return |
| 292 | fi |
| 293 | ;; |
| 294 | |
| 295 | "-S") |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 296 | if grep -v '^==' $SRV_OUT | grep "$2" >/dev/null; then |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 297 | fail "-S $2" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 298 | return |
| 299 | fi |
| 300 | ;; |
| 301 | |
| 302 | "-C") |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 303 | if grep -v '^==' $CLI_OUT | grep "$2" >/dev/null; then |
Manuel Pégourié-Gonnard | f8bdbb5 | 2014-02-21 09:20:14 +0100 | [diff] [blame] | 304 | fail "-C $2" |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 305 | return |
| 306 | fi |
| 307 | ;; |
| 308 | |
| 309 | *) |
Paul Bakker | 1ebc0c5 | 2014-05-22 15:47:58 +0200 | [diff] [blame] | 310 | echo "Unknown test: $1" >&2 |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 311 | exit 1 |
| 312 | esac |
| 313 | shift 2 |
| 314 | done |
| 315 | |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 316 | # check valgrind's results |
| 317 | if [ "$MEMCHECK" -gt 0 ]; then |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 318 | if is_polar "$SRV_CMD" && has_mem_err $SRV_OUT; then |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 319 | fail "Server has memory errors" |
| 320 | return |
| 321 | fi |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 322 | if is_polar "$CLI_CMD" && has_mem_err $CLI_OUT; then |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 323 | fail "Client has memory errors" |
| 324 | return |
| 325 | fi |
| 326 | fi |
| 327 | |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 328 | # if we're here, everything is ok |
| 329 | echo "PASS" |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 330 | rm -f $SRV_OUT $CLI_OUT |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 331 | } |
| 332 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 333 | cleanup() { |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 334 | rm -f $CLI_OUT $SRV_OUT $SESSION |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 335 | kill $SRV_PID >/dev/null 2>&1 |
| 336 | kill $WATCHDOG_PID >/dev/null 2>&1 |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 337 | exit 1 |
| 338 | } |
| 339 | |
Manuel Pégourié-Gonnard | 9dea8bd | 2014-02-26 18:21:02 +0100 | [diff] [blame] | 340 | # |
| 341 | # MAIN |
| 342 | # |
| 343 | |
Manuel Pégourié-Gonnard | 913030c | 2014-03-28 10:12:38 +0100 | [diff] [blame] | 344 | get_options "$@" |
| 345 | |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 346 | # sanity checks, avoid an avalanche of errors |
| 347 | if [ ! -x "$P_SRV" ]; then |
| 348 | echo "Command '$P_SRV' is not an executable file" |
| 349 | exit 1 |
| 350 | fi |
| 351 | if [ ! -x "$P_CLI" ]; then |
| 352 | echo "Command '$P_CLI' is not an executable file" |
| 353 | exit 1 |
| 354 | fi |
Manuel Pégourié-Gonnard | 74faf3c | 2014-03-13 18:47:44 +0100 | [diff] [blame] | 355 | if which $OPENSSL_CMD >/dev/null 2>&1; then :; else |
| 356 | echo "Command '$OPENSSL_CMD' not found" |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 357 | exit 1 |
| 358 | fi |
| 359 | |
Manuel Pégourié-Gonnard | 32f8f4d | 2014-05-29 11:31:20 +0200 | [diff] [blame] | 360 | # used by watchdog |
| 361 | MAIN_PID="$$" |
| 362 | |
Manuel Pégourié-Gonnard | 0c1ec47 | 2014-06-20 18:41:11 +0200 | [diff] [blame] | 363 | # be more patient with valgrind |
| 364 | if [ "$MEMCHECK" -gt 0 ]; then |
| 365 | START_DELAY=3 |
| 366 | DOG_DELAY=30 |
| 367 | else |
| 368 | START_DELAY=1 |
| 369 | DOG_DELAY=10 |
| 370 | fi |
| 371 | |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 372 | # Pick a "unique" port in the range 10000-19999. |
| 373 | PORT="0000$$" |
Manuel Pégourié-Gonnard | fab2a3c | 2014-06-16 16:54:36 +0200 | [diff] [blame] | 374 | PORT="1$(echo $PORT | tail -c 5)" |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 375 | |
| 376 | # fix commands to use this port |
| 377 | P_SRV="$P_SRV server_port=$PORT" |
| 378 | P_CLI="$P_CLI server_port=$PORT" |
| 379 | O_SRV="$O_SRV -accept $PORT" |
| 380 | O_CLI="$O_CLI -connect localhost:$PORT" |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 381 | G_SRV="$G_SRV -p $PORT" |
| 382 | G_CLI="$G_CLI -p $PORT" |
Manuel Pégourié-Gonnard | 8066b81 | 2014-05-28 22:59:30 +0200 | [diff] [blame] | 383 | |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 384 | # Also pick a unique name for intermediate files |
| 385 | SRV_OUT="srv_out.$$" |
| 386 | CLI_OUT="cli_out.$$" |
| 387 | SESSION="session.$$" |
| 388 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 389 | SKIP_NEXT="NO" |
| 390 | |
Manuel Pégourié-Gonnard | a9062e9 | 2014-02-25 16:21:22 +0100 | [diff] [blame] | 391 | trap cleanup INT TERM HUP |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 392 | |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 393 | # Basic test |
| 394 | |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 395 | # Checks that: |
| 396 | # - things work with all ciphersuites active (used with config-full in all.sh) |
| 397 | # - the expected (highest security) parameters are selected |
| 398 | # ("signature_algorithm ext: 6" means SHA-512 (highest common hash)) |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 399 | run_test "Default" \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 400 | "$P_SRV debug_level=3" \ |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 401 | "$P_CLI" \ |
| 402 | 0 \ |
Manuel Pégourié-Gonnard | 480905d | 2014-08-21 19:38:32 +0200 | [diff] [blame] | 403 | -s "Protocol is TLSv1.2" \ |
| 404 | -s "Ciphersuite is TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" \ |
| 405 | -s "client hello v3, signature_algorithm ext: 6" \ |
| 406 | -s "ECDHE curve: secp521r1" \ |
| 407 | -S "error" \ |
| 408 | -C "error" |
Manuel Pégourié-Gonnard | e73b263 | 2014-07-12 04:00:00 +0200 | [diff] [blame] | 409 | |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 410 | # Test for SSLv2 ClientHello |
| 411 | |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 412 | requires_openssl_with_sslv2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 413 | run_test "SSLv2 ClientHello: reference" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 414 | "$P_SRV debug_level=3" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 415 | "$O_CLI -no_ssl2" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 416 | 0 \ |
| 417 | -S "parse client hello v2" \ |
| 418 | -S "ssl_handshake returned" |
| 419 | |
| 420 | # Adding a SSL2-only suite makes OpenSSL client send SSLv2 ClientHello |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 421 | requires_openssl_with_sslv2 |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 422 | run_test "SSLv2 ClientHello: actual test" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 423 | "$P_SRV debug_level=2" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 424 | "$O_CLI -cipher 'DES-CBC-MD5:ALL'" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 425 | 0 \ |
| 426 | -s "parse client hello v2" \ |
| 427 | -S "ssl_handshake returned" |
| 428 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 429 | # Tests for Truncated HMAC extension |
| 430 | |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame^] | 431 | run_test "Truncated HMAC: client default, server default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 432 | "$P_SRV debug_level=4" \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame^] | 433 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 434 | 0 \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame^] | 435 | -s "dumping 'computed mac' (20 bytes)" \ |
| 436 | -S "dumping 'computed mac' (10 bytes)" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 437 | |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame^] | 438 | run_test "Truncated HMAC: client disabled, server default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 439 | "$P_SRV debug_level=4" \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame^] | 440 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 441 | trunc_hmac=0" \ |
Manuel Pégourié-Gonnard | eaadc50 | 2014-02-20 11:01:30 +0100 | [diff] [blame] | 442 | 0 \ |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame^] | 443 | -s "dumping 'computed mac' (20 bytes)" \ |
| 444 | -S "dumping 'computed mac' (10 bytes)" |
| 445 | |
| 446 | run_test "Truncated HMAC: client enabled, server default" \ |
| 447 | "$P_SRV debug_level=4" \ |
| 448 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 449 | trunc_hmac=1" \ |
| 450 | 0 \ |
| 451 | -S "dumping 'computed mac' (20 bytes)" \ |
| 452 | -s "dumping 'computed mac' (10 bytes)" |
| 453 | |
| 454 | run_test "Truncated HMAC: client enabled, server disabled" \ |
| 455 | "$P_SRV debug_level=4 trunc_hmac=0" \ |
| 456 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 457 | trunc_hmac=1" \ |
| 458 | 0 \ |
| 459 | -s "dumping 'computed mac' (20 bytes)" \ |
| 460 | -S "dumping 'computed mac' (10 bytes)" |
| 461 | |
| 462 | run_test "Truncated HMAC: client enabled, server enabled" \ |
| 463 | "$P_SRV debug_level=4 trunc_hmac=1" \ |
| 464 | "$P_CLI force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA \ |
| 465 | trunc_hmac=1" \ |
| 466 | 0 \ |
| 467 | -S "dumping 'computed mac' (20 bytes)" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 468 | -s "dumping 'computed mac' (10 bytes)" |
| 469 | |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 470 | # Tests for Encrypt-then-MAC extension |
| 471 | |
| 472 | run_test "Encrypt then MAC: default" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 473 | "$P_SRV debug_level=3 \ |
| 474 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 475 | "$P_CLI debug_level=3" \ |
| 476 | 0 \ |
| 477 | -c "client hello, adding encrypt_then_mac extension" \ |
| 478 | -s "found encrypt then mac extension" \ |
| 479 | -s "server hello, adding encrypt then mac extension" \ |
| 480 | -c "found encrypt_then_mac extension" \ |
| 481 | -c "using encrypt then mac" \ |
| 482 | -s "using encrypt then mac" |
| 483 | |
| 484 | run_test "Encrypt then MAC: client enabled, server disabled" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 485 | "$P_SRV debug_level=3 etm=0 \ |
| 486 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 487 | "$P_CLI debug_level=3 etm=1" \ |
| 488 | 0 \ |
| 489 | -c "client hello, adding encrypt_then_mac extension" \ |
| 490 | -s "found encrypt then mac extension" \ |
| 491 | -S "server hello, adding encrypt then mac extension" \ |
| 492 | -C "found encrypt_then_mac extension" \ |
| 493 | -C "using encrypt then mac" \ |
| 494 | -S "using encrypt then mac" |
| 495 | |
Manuel Pégourié-Gonnard | 78e745f | 2014-11-04 15:44:06 +0100 | [diff] [blame] | 496 | run_test "Encrypt then MAC: client enabled, aead cipher" \ |
| 497 | "$P_SRV debug_level=3 etm=1 \ |
| 498 | force_ciphersuite=TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 499 | "$P_CLI debug_level=3 etm=1" \ |
| 500 | 0 \ |
| 501 | -c "client hello, adding encrypt_then_mac extension" \ |
| 502 | -s "found encrypt then mac extension" \ |
| 503 | -S "server hello, adding encrypt then mac extension" \ |
| 504 | -C "found encrypt_then_mac extension" \ |
| 505 | -C "using encrypt then mac" \ |
| 506 | -S "using encrypt then mac" |
| 507 | |
| 508 | run_test "Encrypt then MAC: client enabled, stream cipher" \ |
| 509 | "$P_SRV debug_level=3 etm=1 \ |
| 510 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 511 | "$P_CLI debug_level=3 etm=1" \ |
| 512 | 0 \ |
| 513 | -c "client hello, adding encrypt_then_mac extension" \ |
| 514 | -s "found encrypt then mac extension" \ |
| 515 | -S "server hello, adding encrypt then mac extension" \ |
| 516 | -C "found encrypt_then_mac extension" \ |
| 517 | -C "using encrypt then mac" \ |
| 518 | -S "using encrypt then mac" |
| 519 | |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 520 | run_test "Encrypt then MAC: client disabled, server enabled" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 521 | "$P_SRV debug_level=3 etm=1 \ |
| 522 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 523 | "$P_CLI debug_level=3 etm=0" \ |
| 524 | 0 \ |
| 525 | -C "client hello, adding encrypt_then_mac extension" \ |
| 526 | -S "found encrypt then mac extension" \ |
| 527 | -S "server hello, adding encrypt then mac extension" \ |
| 528 | -C "found encrypt_then_mac extension" \ |
| 529 | -C "using encrypt then mac" \ |
| 530 | -S "using encrypt then mac" |
| 531 | |
| 532 | run_test "Encrypt then MAC: client SSLv3, server enabled" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 533 | "$P_SRV debug_level=3 \ |
| 534 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 535 | "$P_CLI debug_level=3 force_version=ssl3" \ |
| 536 | 0 \ |
| 537 | -C "client hello, adding encrypt_then_mac extension" \ |
| 538 | -S "found encrypt then mac extension" \ |
| 539 | -S "server hello, adding encrypt then mac extension" \ |
| 540 | -C "found encrypt_then_mac extension" \ |
| 541 | -C "using encrypt then mac" \ |
| 542 | -S "using encrypt then mac" |
| 543 | |
| 544 | run_test "Encrypt then MAC: client enabled, server SSLv3" \ |
Manuel Pégourié-Gonnard | 0098e7d | 2014-10-28 13:08:59 +0100 | [diff] [blame] | 545 | "$P_SRV debug_level=3 force_version=ssl3 \ |
| 546 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 547 | "$P_CLI debug_level=3" \ |
| 548 | 0 \ |
| 549 | -c "client hello, adding encrypt_then_mac extension" \ |
| 550 | -s "found encrypt then mac extension" \ |
| 551 | -S "server hello, adding encrypt then mac extension" \ |
| 552 | -C "found encrypt_then_mac extension" \ |
| 553 | -C "using encrypt then mac" \ |
| 554 | -S "using encrypt then mac" |
| 555 | |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 556 | # Tests for Extended Master Secret extension |
| 557 | |
| 558 | run_test "Extended Master Secret: default" \ |
| 559 | "$P_SRV debug_level=3" \ |
| 560 | "$P_CLI debug_level=3" \ |
| 561 | 0 \ |
| 562 | -c "client hello, adding extended_master_secret extension" \ |
| 563 | -s "found extended master secret extension" \ |
| 564 | -s "server hello, adding extended master secret extension" \ |
| 565 | -c "found extended_master_secret extension" \ |
| 566 | -c "using extended master secret" \ |
| 567 | -s "using extended master secret" |
| 568 | |
| 569 | run_test "Extended Master Secret: client enabled, server disabled" \ |
| 570 | "$P_SRV debug_level=3 extended_ms=0" \ |
| 571 | "$P_CLI debug_level=3 extended_ms=1" \ |
| 572 | 0 \ |
| 573 | -c "client hello, adding extended_master_secret extension" \ |
| 574 | -s "found extended master secret extension" \ |
| 575 | -S "server hello, adding extended master secret extension" \ |
| 576 | -C "found extended_master_secret extension" \ |
| 577 | -C "using extended master secret" \ |
| 578 | -S "using extended master secret" |
| 579 | |
| 580 | run_test "Extended Master Secret: client disabled, server enabled" \ |
| 581 | "$P_SRV debug_level=3 extended_ms=1" \ |
| 582 | "$P_CLI debug_level=3 extended_ms=0" \ |
| 583 | 0 \ |
| 584 | -C "client hello, adding extended_master_secret extension" \ |
| 585 | -S "found extended master secret extension" \ |
| 586 | -S "server hello, adding extended master secret extension" \ |
| 587 | -C "found extended_master_secret extension" \ |
| 588 | -C "using extended master secret" \ |
| 589 | -S "using extended master secret" |
| 590 | |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 591 | run_test "Extended Master Secret: client SSLv3, server enabled" \ |
| 592 | "$P_SRV debug_level=3" \ |
| 593 | "$P_CLI debug_level=3 force_version=ssl3" \ |
| 594 | 0 \ |
| 595 | -C "client hello, adding extended_master_secret extension" \ |
| 596 | -S "found extended master secret extension" \ |
| 597 | -S "server hello, adding extended master secret extension" \ |
| 598 | -C "found extended_master_secret extension" \ |
| 599 | -C "using extended master secret" \ |
| 600 | -S "using extended master secret" |
| 601 | |
| 602 | run_test "Extended Master Secret: client enabled, server SSLv3" \ |
| 603 | "$P_SRV debug_level=3 force_version=ssl3" \ |
| 604 | "$P_CLI debug_level=3" \ |
| 605 | 0 \ |
| 606 | -c "client hello, adding extended_master_secret extension" \ |
| 607 | -s "found extended master secret extension" \ |
| 608 | -S "server hello, adding extended master secret extension" \ |
| 609 | -C "found extended_master_secret extension" \ |
| 610 | -C "using extended master secret" \ |
| 611 | -S "using extended master secret" |
| 612 | |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 613 | # Tests for FALLBACK_SCSV |
| 614 | |
| 615 | run_test "Fallback SCSV: default" \ |
| 616 | "$P_SRV" \ |
| 617 | "$P_CLI debug_level=3 force_version=tls1_1" \ |
| 618 | 0 \ |
| 619 | -C "adding FALLBACK_SCSV" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 620 | -S "received FALLBACK_SCSV" \ |
| 621 | -S "inapropriate fallback" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 622 | -C "is a fatal alert message (msg 86)" |
| 623 | |
| 624 | run_test "Fallback SCSV: explicitly disabled" \ |
| 625 | "$P_SRV" \ |
| 626 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \ |
| 627 | 0 \ |
| 628 | -C "adding FALLBACK_SCSV" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 629 | -S "received FALLBACK_SCSV" \ |
| 630 | -S "inapropriate fallback" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 631 | -C "is a fatal alert message (msg 86)" |
| 632 | |
| 633 | run_test "Fallback SCSV: enabled" \ |
| 634 | "$P_SRV" \ |
| 635 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 636 | 1 \ |
| 637 | -c "adding FALLBACK_SCSV" \ |
| 638 | -s "received FALLBACK_SCSV" \ |
| 639 | -s "inapropriate fallback" \ |
| 640 | -c "is a fatal alert message (msg 86)" |
| 641 | |
| 642 | run_test "Fallback SCSV: enabled, max version" \ |
| 643 | "$P_SRV" \ |
| 644 | "$P_CLI debug_level=3 fallback=1" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 645 | 0 \ |
| 646 | -c "adding FALLBACK_SCSV" \ |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 647 | -s "received FALLBACK_SCSV" \ |
| 648 | -S "inapropriate fallback" \ |
Manuel Pégourié-Gonnard | 1cbd39d | 2014-10-20 13:34:59 +0200 | [diff] [blame] | 649 | -C "is a fatal alert message (msg 86)" |
| 650 | |
| 651 | requires_openssl_with_fallback_scsv |
| 652 | run_test "Fallback SCSV: default, openssl server" \ |
| 653 | "$O_SRV" \ |
| 654 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=0" \ |
| 655 | 0 \ |
| 656 | -C "adding FALLBACK_SCSV" \ |
| 657 | -C "is a fatal alert message (msg 86)" |
| 658 | |
| 659 | requires_openssl_with_fallback_scsv |
| 660 | run_test "Fallback SCSV: enabled, openssl server" \ |
| 661 | "$O_SRV" \ |
| 662 | "$P_CLI debug_level=3 force_version=tls1_1 fallback=1" \ |
| 663 | 1 \ |
| 664 | -c "adding FALLBACK_SCSV" \ |
| 665 | -c "is a fatal alert message (msg 86)" |
| 666 | |
Manuel Pégourié-Gonnard | 01b2699 | 2014-10-20 14:05:28 +0200 | [diff] [blame] | 667 | requires_openssl_with_fallback_scsv |
| 668 | run_test "Fallback SCSV: disabled, openssl client" \ |
| 669 | "$P_SRV" \ |
| 670 | "$O_CLI -tls1_1" \ |
| 671 | 0 \ |
| 672 | -S "received FALLBACK_SCSV" \ |
| 673 | -S "inapropriate fallback" |
| 674 | |
| 675 | requires_openssl_with_fallback_scsv |
| 676 | run_test "Fallback SCSV: enabled, openssl client" \ |
| 677 | "$P_SRV" \ |
| 678 | "$O_CLI -tls1_1 -fallback_scsv" \ |
| 679 | 1 \ |
| 680 | -s "received FALLBACK_SCSV" \ |
| 681 | -s "inapropriate fallback" |
| 682 | |
| 683 | requires_openssl_with_fallback_scsv |
| 684 | run_test "Fallback SCSV: enabled, max version, openssl client" \ |
| 685 | "$P_SRV" \ |
| 686 | "$O_CLI -fallback_scsv" \ |
| 687 | 0 \ |
| 688 | -s "received FALLBACK_SCSV" \ |
| 689 | -S "inapropriate fallback" |
| 690 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 691 | # Tests for Session Tickets |
| 692 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 693 | run_test "Session resume using tickets: basic" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 694 | "$P_SRV debug_level=3 tickets=1" \ |
| 695 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 696 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 697 | -c "client hello, adding session ticket extension" \ |
| 698 | -s "found session ticket extension" \ |
| 699 | -s "server hello, adding session ticket extension" \ |
| 700 | -c "found session_ticket extension" \ |
| 701 | -c "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 702 | -S "session successfully restored from cache" \ |
| 703 | -s "session successfully restored from ticket" \ |
| 704 | -s "a session has been resumed" \ |
| 705 | -c "a session has been resumed" |
| 706 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 707 | run_test "Session resume using tickets: cache disabled" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 708 | "$P_SRV debug_level=3 tickets=1 cache_max=0" \ |
| 709 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 710 | 0 \ |
| 711 | -c "client hello, adding session ticket extension" \ |
| 712 | -s "found session ticket extension" \ |
| 713 | -s "server hello, adding session ticket extension" \ |
| 714 | -c "found session_ticket extension" \ |
| 715 | -c "parse new session ticket" \ |
| 716 | -S "session successfully restored from cache" \ |
| 717 | -s "session successfully restored from ticket" \ |
| 718 | -s "a session has been resumed" \ |
| 719 | -c "a session has been resumed" |
| 720 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 721 | run_test "Session resume using tickets: timeout" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 722 | "$P_SRV debug_level=3 tickets=1 cache_max=0 ticket_timeout=1" \ |
| 723 | "$P_CLI debug_level=3 tickets=1 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 724 | 0 \ |
| 725 | -c "client hello, adding session ticket extension" \ |
| 726 | -s "found session ticket extension" \ |
| 727 | -s "server hello, adding session ticket extension" \ |
| 728 | -c "found session_ticket extension" \ |
| 729 | -c "parse new session ticket" \ |
| 730 | -S "session successfully restored from cache" \ |
| 731 | -S "session successfully restored from ticket" \ |
| 732 | -S "a session has been resumed" \ |
| 733 | -C "a session has been resumed" |
| 734 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 735 | run_test "Session resume using tickets: openssl server" \ |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 736 | "$O_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 737 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 738 | 0 \ |
| 739 | -c "client hello, adding session ticket extension" \ |
| 740 | -c "found session_ticket extension" \ |
| 741 | -c "parse new session ticket" \ |
| 742 | -c "a session has been resumed" |
| 743 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 744 | run_test "Session resume using tickets: openssl client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 745 | "$P_SRV debug_level=3 tickets=1" \ |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 746 | "( $O_CLI -sess_out $SESSION; \ |
| 747 | $O_CLI -sess_in $SESSION; \ |
| 748 | rm -f $SESSION )" \ |
Manuel Pégourié-Gonnard | fccd325 | 2014-02-25 17:14:15 +0100 | [diff] [blame] | 749 | 0 \ |
| 750 | -s "found session ticket extension" \ |
| 751 | -s "server hello, adding session ticket extension" \ |
| 752 | -S "session successfully restored from cache" \ |
| 753 | -s "session successfully restored from ticket" \ |
| 754 | -s "a session has been resumed" |
| 755 | |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 756 | # Tests for Session Resume based on session-ID and cache |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 757 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 758 | run_test "Session resume using cache: tickets enabled on client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 759 | "$P_SRV debug_level=3 tickets=0" \ |
| 760 | "$P_CLI debug_level=3 tickets=1 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 761 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 762 | -c "client hello, adding session ticket extension" \ |
| 763 | -s "found session ticket extension" \ |
| 764 | -S "server hello, adding session ticket extension" \ |
| 765 | -C "found session_ticket extension" \ |
| 766 | -C "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 767 | -s "session successfully restored from cache" \ |
| 768 | -S "session successfully restored from ticket" \ |
| 769 | -s "a session has been resumed" \ |
| 770 | -c "a session has been resumed" |
| 771 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 772 | run_test "Session resume using cache: tickets enabled on server" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 773 | "$P_SRV debug_level=3 tickets=1" \ |
| 774 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 775 | 0 \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 776 | -C "client hello, adding session ticket extension" \ |
| 777 | -S "found session ticket extension" \ |
| 778 | -S "server hello, adding session ticket extension" \ |
| 779 | -C "found session_ticket extension" \ |
| 780 | -C "parse new session ticket" \ |
Manuel Pégourié-Gonnard | f7c5201 | 2014-02-20 11:43:46 +0100 | [diff] [blame] | 781 | -s "session successfully restored from cache" \ |
| 782 | -S "session successfully restored from ticket" \ |
| 783 | -s "a session has been resumed" \ |
| 784 | -c "a session has been resumed" |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 785 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 786 | run_test "Session resume using cache: cache_max=0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 787 | "$P_SRV debug_level=3 tickets=0 cache_max=0" \ |
| 788 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 789 | 0 \ |
| 790 | -S "session successfully restored from cache" \ |
| 791 | -S "session successfully restored from ticket" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 792 | -S "a session has been resumed" \ |
| 793 | -C "a session has been resumed" |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 794 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 795 | run_test "Session resume using cache: cache_max=1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 796 | "$P_SRV debug_level=3 tickets=0 cache_max=1" \ |
| 797 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 798 | 0 \ |
| 799 | -s "session successfully restored from cache" \ |
| 800 | -S "session successfully restored from ticket" \ |
| 801 | -s "a session has been resumed" \ |
| 802 | -c "a session has been resumed" |
| 803 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 804 | run_test "Session resume using cache: timemout > delay" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 805 | "$P_SRV debug_level=3 tickets=0" \ |
| 806 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=0" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 807 | 0 \ |
| 808 | -s "session successfully restored from cache" \ |
| 809 | -S "session successfully restored from ticket" \ |
| 810 | -s "a session has been resumed" \ |
| 811 | -c "a session has been resumed" |
| 812 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 813 | run_test "Session resume using cache: timeout < delay" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 814 | "$P_SRV debug_level=3 tickets=0 cache_timeout=1" \ |
| 815 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 816 | 0 \ |
| 817 | -S "session successfully restored from cache" \ |
| 818 | -S "session successfully restored from ticket" \ |
| 819 | -S "a session has been resumed" \ |
| 820 | -C "a session has been resumed" |
| 821 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 822 | run_test "Session resume using cache: no timeout" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 823 | "$P_SRV debug_level=3 tickets=0 cache_timeout=0" \ |
| 824 | "$P_CLI debug_level=3 tickets=0 reconnect=1 reco_delay=2" \ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 825 | 0 \ |
| 826 | -s "session successfully restored from cache" \ |
| 827 | -S "session successfully restored from ticket" \ |
| 828 | -s "a session has been resumed" \ |
| 829 | -c "a session has been resumed" |
| 830 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 831 | run_test "Session resume using cache: openssl client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 832 | "$P_SRV debug_level=3 tickets=0" \ |
Manuel Pégourié-Gonnard | bc3b16c | 2014-05-28 23:06:50 +0200 | [diff] [blame] | 833 | "( $O_CLI -sess_out $SESSION; \ |
| 834 | $O_CLI -sess_in $SESSION; \ |
| 835 | rm -f $SESSION )" \ |
Manuel Pégourié-Gonnard | db735f6 | 2014-02-25 17:57:59 +0100 | [diff] [blame] | 836 | 0 \ |
| 837 | -s "found session ticket extension" \ |
| 838 | -S "server hello, adding session ticket extension" \ |
| 839 | -s "session successfully restored from cache" \ |
| 840 | -S "session successfully restored from ticket" \ |
| 841 | -s "a session has been resumed" |
| 842 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 843 | run_test "Session resume using cache: openssl server" \ |
Manuel Pégourié-Gonnard | f7a2690 | 2014-02-27 12:25:54 +0100 | [diff] [blame] | 844 | "$O_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 845 | "$P_CLI debug_level=3 tickets=0 reconnect=1" \ |
Manuel Pégourié-Gonnard | db735f6 | 2014-02-25 17:57:59 +0100 | [diff] [blame] | 846 | 0 \ |
| 847 | -C "found session_ticket extension" \ |
| 848 | -C "parse new session ticket" \ |
| 849 | -c "a session has been resumed" |
| 850 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 851 | # Tests for Max Fragment Length extension |
| 852 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 853 | run_test "Max fragment length: not used, reference" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 854 | "$P_SRV debug_level=3" \ |
| 855 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 856 | 0 \ |
| 857 | -C "client hello, adding max_fragment_length extension" \ |
| 858 | -S "found max fragment length extension" \ |
| 859 | -S "server hello, max_fragment_length extension" \ |
| 860 | -C "found max_fragment_length extension" |
| 861 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 862 | run_test "Max fragment length: used by client" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 863 | "$P_SRV debug_level=3" \ |
| 864 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 865 | 0 \ |
| 866 | -c "client hello, adding max_fragment_length extension" \ |
| 867 | -s "found max fragment length extension" \ |
| 868 | -s "server hello, max_fragment_length extension" \ |
| 869 | -c "found max_fragment_length extension" |
| 870 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 871 | run_test "Max fragment length: used by server" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 872 | "$P_SRV debug_level=3 max_frag_len=4096" \ |
| 873 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | de14378 | 2014-02-20 14:50:42 +0100 | [diff] [blame] | 874 | 0 \ |
| 875 | -C "client hello, adding max_fragment_length extension" \ |
| 876 | -S "found max fragment length extension" \ |
| 877 | -S "server hello, max_fragment_length extension" \ |
| 878 | -C "found max_fragment_length extension" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 879 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 880 | requires_gnutls |
| 881 | run_test "Max fragment length: gnutls server" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 882 | "$G_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 883 | "$P_CLI debug_level=3 max_frag_len=4096" \ |
Manuel Pégourié-Gonnard | baa7f07 | 2014-08-20 20:15:53 +0200 | [diff] [blame] | 884 | 0 \ |
| 885 | -c "client hello, adding max_fragment_length extension" \ |
| 886 | -c "found max_fragment_length extension" |
| 887 | |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 888 | # Tests for renegotiation |
| 889 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 890 | run_test "Renegotiation: none, for reference" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 891 | "$P_SRV debug_level=3 exchanges=2" \ |
| 892 | "$P_CLI debug_level=3 exchanges=2" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 893 | 0 \ |
| 894 | -C "client hello, adding renegotiation extension" \ |
| 895 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 896 | -S "found renegotiation extension" \ |
| 897 | -s "server hello, secure renegotiation extension" \ |
| 898 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 899 | -C "=> renegotiate" \ |
| 900 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 901 | -S "write hello request" |
| 902 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 903 | run_test "Renegotiation: client-initiated" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 904 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1" \ |
| 905 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 906 | 0 \ |
| 907 | -c "client hello, adding renegotiation extension" \ |
| 908 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 909 | -s "found renegotiation extension" \ |
| 910 | -s "server hello, secure renegotiation extension" \ |
| 911 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 912 | -c "=> renegotiate" \ |
| 913 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 914 | -S "write hello request" |
| 915 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 916 | run_test "Renegotiation: server-initiated" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 917 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 918 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 919 | 0 \ |
| 920 | -c "client hello, adding renegotiation extension" \ |
| 921 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 922 | -s "found renegotiation extension" \ |
| 923 | -s "server hello, secure renegotiation extension" \ |
| 924 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 925 | -c "=> renegotiate" \ |
| 926 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 927 | -s "write hello request" |
| 928 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 929 | run_test "Renegotiation: double" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 930 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 931 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 932 | 0 \ |
| 933 | -c "client hello, adding renegotiation extension" \ |
| 934 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 935 | -s "found renegotiation extension" \ |
| 936 | -s "server hello, secure renegotiation extension" \ |
| 937 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 938 | -c "=> renegotiate" \ |
| 939 | -s "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 940 | -s "write hello request" |
| 941 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 942 | run_test "Renegotiation: client-initiated, server-rejected" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 943 | "$P_SRV debug_level=3 exchanges=2 renegotiation=0" \ |
| 944 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 945 | 1 \ |
| 946 | -c "client hello, adding renegotiation extension" \ |
| 947 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 948 | -S "found renegotiation extension" \ |
| 949 | -s "server hello, secure renegotiation extension" \ |
| 950 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 951 | -c "=> renegotiate" \ |
| 952 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 953 | -S "write hello request" \ |
Manuel Pégourié-Gonnard | 6591962 | 2014-08-19 12:50:30 +0200 | [diff] [blame] | 954 | -c "SSL - Unexpected message at ServerHello in renegotiation" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 955 | -c "failed" |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 956 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 957 | run_test "Renegotiation: server-initiated, client-rejected, default" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 958 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 959 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 960 | 0 \ |
| 961 | -C "client hello, adding renegotiation extension" \ |
| 962 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 963 | -S "found renegotiation extension" \ |
| 964 | -s "server hello, secure renegotiation extension" \ |
| 965 | -c "found renegotiation extension" \ |
Manuel Pégourié-Gonnard | c73339f | 2014-02-26 16:35:27 +0100 | [diff] [blame] | 966 | -C "=> renegotiate" \ |
| 967 | -S "=> renegotiate" \ |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 968 | -s "write hello request" \ |
Manuel Pégourié-Gonnard | a9964db | 2014-07-03 19:29:16 +0200 | [diff] [blame] | 969 | -S "SSL - An unexpected message was received from our peer" \ |
| 970 | -S "failed" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 971 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 972 | run_test "Renegotiation: server-initiated, client-rejected, not enforced" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 973 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 974 | renego_delay=-1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 975 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 976 | 0 \ |
| 977 | -C "client hello, adding renegotiation extension" \ |
| 978 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 979 | -S "found renegotiation extension" \ |
| 980 | -s "server hello, secure renegotiation extension" \ |
| 981 | -c "found renegotiation extension" \ |
| 982 | -C "=> renegotiate" \ |
| 983 | -S "=> renegotiate" \ |
| 984 | -s "write hello request" \ |
| 985 | -S "SSL - An unexpected message was received from our peer" \ |
| 986 | -S "failed" |
| 987 | |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 988 | # delay 2 for 1 alert record + 1 application data record |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 989 | run_test "Renegotiation: server-initiated, client-rejected, delay 2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 990 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 991 | renego_delay=2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 992 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 993 | 0 \ |
| 994 | -C "client hello, adding renegotiation extension" \ |
| 995 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 996 | -S "found renegotiation extension" \ |
| 997 | -s "server hello, secure renegotiation extension" \ |
| 998 | -c "found renegotiation extension" \ |
| 999 | -C "=> renegotiate" \ |
| 1000 | -S "=> renegotiate" \ |
| 1001 | -s "write hello request" \ |
| 1002 | -S "SSL - An unexpected message was received from our peer" \ |
| 1003 | -S "failed" |
| 1004 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1005 | run_test "Renegotiation: server-initiated, client-rejected, delay 0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1006 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1007 | renego_delay=0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1008 | "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1009 | 0 \ |
| 1010 | -C "client hello, adding renegotiation extension" \ |
| 1011 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1012 | -S "found renegotiation extension" \ |
| 1013 | -s "server hello, secure renegotiation extension" \ |
| 1014 | -c "found renegotiation extension" \ |
| 1015 | -C "=> renegotiate" \ |
| 1016 | -S "=> renegotiate" \ |
| 1017 | -s "write hello request" \ |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 1018 | -s "SSL - An unexpected message was received from our peer" |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1019 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1020 | run_test "Renegotiation: server-initiated, client-accepted, delay 0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1021 | "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1022 | renego_delay=0" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1023 | "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1024 | 0 \ |
| 1025 | -c "client hello, adding renegotiation extension" \ |
| 1026 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1027 | -s "found renegotiation extension" \ |
| 1028 | -s "server hello, secure renegotiation extension" \ |
| 1029 | -c "found renegotiation extension" \ |
| 1030 | -c "=> renegotiate" \ |
| 1031 | -s "=> renegotiate" \ |
| 1032 | -s "write hello request" \ |
| 1033 | -S "SSL - An unexpected message was received from our peer" \ |
| 1034 | -S "failed" |
| 1035 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1036 | run_test "Renegotiation: nbio, client-initiated" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1037 | "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1" \ |
| 1038 | "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | f07f421 | 2014-08-15 19:04:47 +0200 | [diff] [blame] | 1039 | 0 \ |
| 1040 | -c "client hello, adding renegotiation extension" \ |
| 1041 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1042 | -s "found renegotiation extension" \ |
| 1043 | -s "server hello, secure renegotiation extension" \ |
| 1044 | -c "found renegotiation extension" \ |
| 1045 | -c "=> renegotiate" \ |
| 1046 | -s "=> renegotiate" \ |
| 1047 | -S "write hello request" |
| 1048 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1049 | run_test "Renegotiation: nbio, server-initiated" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1050 | "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \ |
| 1051 | "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1" \ |
Manuel Pégourié-Gonnard | f07f421 | 2014-08-15 19:04:47 +0200 | [diff] [blame] | 1052 | 0 \ |
| 1053 | -c "client hello, adding renegotiation extension" \ |
| 1054 | -s "received TLS_EMPTY_RENEGOTIATION_INFO" \ |
| 1055 | -s "found renegotiation extension" \ |
| 1056 | -s "server hello, secure renegotiation extension" \ |
| 1057 | -c "found renegotiation extension" \ |
| 1058 | -c "=> renegotiate" \ |
| 1059 | -s "=> renegotiate" \ |
| 1060 | -s "write hello request" |
| 1061 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1062 | run_test "Renegotiation: openssl server, client-initiated" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 1063 | "$O_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1064 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 1065 | 0 \ |
| 1066 | -c "client hello, adding renegotiation extension" \ |
| 1067 | -c "found renegotiation extension" \ |
| 1068 | -c "=> renegotiate" \ |
| 1069 | -C "ssl_handshake returned" \ |
| 1070 | -C "error" \ |
| 1071 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 1072 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1073 | run_test "Renegotiation: gnutls server, client-initiated" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 1074 | "$G_SRV" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1075 | "$P_CLI debug_level=3 exchanges=1 renegotiation=1 renegotiate=1" \ |
Manuel Pégourié-Gonnard | 5136296 | 2014-08-30 21:22:47 +0200 | [diff] [blame] | 1076 | 0 \ |
| 1077 | -c "client hello, adding renegotiation extension" \ |
| 1078 | -c "found renegotiation extension" \ |
| 1079 | -c "=> renegotiate" \ |
| 1080 | -C "ssl_handshake returned" \ |
| 1081 | -C "error" \ |
| 1082 | -c "HTTP/1.0 200 [Oo][Kk]" |
| 1083 | |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1084 | # Tests for auth_mode |
| 1085 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1086 | run_test "Authentication: server badcert, client required" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1087 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1088 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1089 | "$P_CLI debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1090 | 1 \ |
| 1091 | -c "x509_verify_cert() returned" \ |
| 1092 | -c "! self-signed or not signed by a trusted CA" \ |
| 1093 | -c "! ssl_handshake returned" \ |
| 1094 | -c "X509 - Certificate verification failed" |
| 1095 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1096 | run_test "Authentication: server badcert, client optional" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1097 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1098 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1099 | "$P_CLI debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1100 | 0 \ |
| 1101 | -c "x509_verify_cert() returned" \ |
| 1102 | -c "! self-signed or not signed by a trusted CA" \ |
| 1103 | -C "! ssl_handshake returned" \ |
| 1104 | -C "X509 - Certificate verification failed" |
| 1105 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1106 | run_test "Authentication: server badcert, client none" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1107 | "$P_SRV crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1108 | key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1109 | "$P_CLI debug_level=1 auth_mode=none" \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1110 | 0 \ |
| 1111 | -C "x509_verify_cert() returned" \ |
| 1112 | -C "! self-signed or not signed by a trusted CA" \ |
| 1113 | -C "! ssl_handshake returned" \ |
| 1114 | -C "X509 - Certificate verification failed" |
| 1115 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1116 | run_test "Authentication: client badcert, server required" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1117 | "$P_SRV debug_level=3 auth_mode=required" \ |
| 1118 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1119 | key_file=data_files/server5.key" \ |
| 1120 | 1 \ |
| 1121 | -S "skip write certificate request" \ |
| 1122 | -C "skip parse certificate request" \ |
| 1123 | -c "got a certificate request" \ |
| 1124 | -C "skip write certificate" \ |
| 1125 | -C "skip write certificate verify" \ |
| 1126 | -S "skip parse certificate verify" \ |
| 1127 | -s "x509_verify_cert() returned" \ |
| 1128 | -S "! self-signed or not signed by a trusted CA" \ |
| 1129 | -s "! ssl_handshake returned" \ |
| 1130 | -c "! ssl_handshake returned" \ |
| 1131 | -s "X509 - Certificate verification failed" |
| 1132 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1133 | run_test "Authentication: client badcert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1134 | "$P_SRV debug_level=3 auth_mode=optional" \ |
| 1135 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1136 | key_file=data_files/server5.key" \ |
| 1137 | 0 \ |
| 1138 | -S "skip write certificate request" \ |
| 1139 | -C "skip parse certificate request" \ |
| 1140 | -c "got a certificate request" \ |
| 1141 | -C "skip write certificate" \ |
| 1142 | -C "skip write certificate verify" \ |
| 1143 | -S "skip parse certificate verify" \ |
| 1144 | -s "x509_verify_cert() returned" \ |
| 1145 | -s "! self-signed or not signed by a trusted CA" \ |
| 1146 | -S "! ssl_handshake returned" \ |
| 1147 | -C "! ssl_handshake returned" \ |
| 1148 | -S "X509 - Certificate verification failed" |
| 1149 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1150 | run_test "Authentication: client badcert, server none" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1151 | "$P_SRV debug_level=3 auth_mode=none" \ |
| 1152 | "$P_CLI debug_level=3 crt_file=data_files/server5-badsign.crt \ |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 1153 | key_file=data_files/server5.key" \ |
| 1154 | 0 \ |
| 1155 | -s "skip write certificate request" \ |
| 1156 | -C "skip parse certificate request" \ |
| 1157 | -c "got no certificate request" \ |
| 1158 | -c "skip write certificate" \ |
| 1159 | -c "skip write certificate verify" \ |
| 1160 | -s "skip parse certificate verify" \ |
| 1161 | -S "x509_verify_cert() returned" \ |
| 1162 | -S "! self-signed or not signed by a trusted CA" \ |
| 1163 | -S "! ssl_handshake returned" \ |
| 1164 | -C "! ssl_handshake returned" \ |
| 1165 | -S "X509 - Certificate verification failed" |
| 1166 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1167 | run_test "Authentication: client no cert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1168 | "$P_SRV debug_level=3 auth_mode=optional" \ |
| 1169 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1170 | 0 \ |
| 1171 | -S "skip write certificate request" \ |
| 1172 | -C "skip parse certificate request" \ |
| 1173 | -c "got a certificate request" \ |
| 1174 | -C "skip write certificate$" \ |
| 1175 | -C "got no certificate to send" \ |
| 1176 | -S "SSLv3 client has no certificate" \ |
| 1177 | -c "skip write certificate verify" \ |
| 1178 | -s "skip parse certificate verify" \ |
| 1179 | -s "! no client certificate sent" \ |
| 1180 | -S "! ssl_handshake returned" \ |
| 1181 | -C "! ssl_handshake returned" \ |
| 1182 | -S "X509 - Certificate verification failed" |
| 1183 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1184 | run_test "Authentication: openssl client no cert, server optional" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1185 | "$P_SRV debug_level=3 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1186 | "$O_CLI" \ |
| 1187 | 0 \ |
| 1188 | -S "skip write certificate request" \ |
| 1189 | -s "skip parse certificate verify" \ |
| 1190 | -s "! no client certificate sent" \ |
| 1191 | -S "! ssl_handshake returned" \ |
| 1192 | -S "X509 - Certificate verification failed" |
| 1193 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1194 | run_test "Authentication: client no cert, openssl server optional" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1195 | "$O_SRV -verify 10" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1196 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1197 | 0 \ |
| 1198 | -C "skip parse certificate request" \ |
| 1199 | -c "got a certificate request" \ |
| 1200 | -C "skip write certificate$" \ |
| 1201 | -c "skip write certificate verify" \ |
| 1202 | -C "! ssl_handshake returned" |
| 1203 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1204 | run_test "Authentication: client no cert, ssl3" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1205 | "$P_SRV debug_level=3 auth_mode=optional force_version=ssl3" \ |
| 1206 | "$P_CLI debug_level=3 crt_file=none key_file=none" \ |
Manuel Pégourié-Gonnard | de515cc | 2014-02-27 14:58:26 +0100 | [diff] [blame] | 1207 | 0 \ |
| 1208 | -S "skip write certificate request" \ |
| 1209 | -C "skip parse certificate request" \ |
| 1210 | -c "got a certificate request" \ |
| 1211 | -C "skip write certificate$" \ |
| 1212 | -c "skip write certificate verify" \ |
| 1213 | -c "got no certificate to send" \ |
| 1214 | -s "SSLv3 client has no certificate" \ |
| 1215 | -s "skip parse certificate verify" \ |
| 1216 | -s "! no client certificate sent" \ |
| 1217 | -S "! ssl_handshake returned" \ |
| 1218 | -C "! ssl_handshake returned" \ |
| 1219 | -S "X509 - Certificate verification failed" |
| 1220 | |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1221 | # tests for SNI |
| 1222 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1223 | run_test "SNI: no SNI callback" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1224 | "$P_SRV debug_level=3 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1225 | crt_file=data_files/server5.crt key_file=data_files/server5.key" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1226 | "$P_CLI debug_level=0 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1227 | server_name=localhost" \ |
| 1228 | 0 \ |
| 1229 | -S "parse ServerName extension" \ |
| 1230 | -c "issuer name *: C=NL, O=PolarSSL, CN=Polarssl Test EC CA" \ |
| 1231 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
| 1232 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1233 | run_test "SNI: matching cert 1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1234 | "$P_SRV debug_level=3 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1235 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1236 | sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1237 | "$P_CLI debug_level=0 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1238 | server_name=localhost" \ |
| 1239 | 0 \ |
| 1240 | -s "parse ServerName extension" \ |
| 1241 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
| 1242 | -c "subject name *: C=NL, O=PolarSSL, CN=localhost" |
| 1243 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1244 | run_test "SNI: matching cert 2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1245 | "$P_SRV debug_level=3 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1246 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1247 | sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1248 | "$P_CLI debug_level=0 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1249 | server_name=polarssl.example" \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1250 | 0 \ |
| 1251 | -s "parse ServerName extension" \ |
| 1252 | -c "issuer name *: C=NL, O=PolarSSL, CN=PolarSSL Test CA" \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1253 | -c "subject name *: C=NL, O=PolarSSL, CN=polarssl.example" |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1254 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1255 | run_test "SNI: no matching cert" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1256 | "$P_SRV debug_level=3 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1257 | crt_file=data_files/server5.crt key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1258 | sni=localhost,data_files/server2.crt,data_files/server2.key,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key" \ |
Manuel Pégourié-Gonnard | c1da664 | 2014-02-25 14:18:30 +0100 | [diff] [blame] | 1259 | "$P_CLI debug_level=0 server_addr=127.0.0.1 \ |
Manuel Pégourié-Gonnard | 76b8ab7 | 2014-03-26 09:31:35 +0100 | [diff] [blame] | 1260 | server_name=nonesuch.example" \ |
Manuel Pégourié-Gonnard | 96ea2f2 | 2014-02-25 12:26:29 +0100 | [diff] [blame] | 1261 | 1 \ |
| 1262 | -s "parse ServerName extension" \ |
| 1263 | -s "ssl_sni_wrapper() returned" \ |
| 1264 | -s "ssl_handshake returned" \ |
| 1265 | -c "ssl_handshake returned" \ |
| 1266 | -c "SSL - A fatal alert message was received from our peer" |
| 1267 | |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1268 | # Tests for non-blocking I/O: exercise a variety of handshake flows |
| 1269 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1270 | run_test "Non-blocking I/O: basic handshake" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1271 | "$P_SRV nbio=2 tickets=0 auth_mode=none" \ |
| 1272 | "$P_CLI nbio=2 tickets=0" \ |
| 1273 | 0 \ |
| 1274 | -S "ssl_handshake returned" \ |
| 1275 | -C "ssl_handshake returned" \ |
| 1276 | -c "Read from server: .* bytes read" |
| 1277 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1278 | run_test "Non-blocking I/O: client auth" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1279 | "$P_SRV nbio=2 tickets=0 auth_mode=required" \ |
| 1280 | "$P_CLI nbio=2 tickets=0" \ |
| 1281 | 0 \ |
| 1282 | -S "ssl_handshake returned" \ |
| 1283 | -C "ssl_handshake returned" \ |
| 1284 | -c "Read from server: .* bytes read" |
| 1285 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1286 | run_test "Non-blocking I/O: ticket" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1287 | "$P_SRV nbio=2 tickets=1 auth_mode=none" \ |
| 1288 | "$P_CLI nbio=2 tickets=1" \ |
| 1289 | 0 \ |
| 1290 | -S "ssl_handshake returned" \ |
| 1291 | -C "ssl_handshake returned" \ |
| 1292 | -c "Read from server: .* bytes read" |
| 1293 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1294 | run_test "Non-blocking I/O: ticket + client auth" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1295 | "$P_SRV nbio=2 tickets=1 auth_mode=required" \ |
| 1296 | "$P_CLI nbio=2 tickets=1" \ |
| 1297 | 0 \ |
| 1298 | -S "ssl_handshake returned" \ |
| 1299 | -C "ssl_handshake returned" \ |
| 1300 | -c "Read from server: .* bytes read" |
| 1301 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1302 | run_test "Non-blocking I/O: ticket + client auth + resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1303 | "$P_SRV nbio=2 tickets=1 auth_mode=required" \ |
| 1304 | "$P_CLI nbio=2 tickets=1 reconnect=1" \ |
| 1305 | 0 \ |
| 1306 | -S "ssl_handshake returned" \ |
| 1307 | -C "ssl_handshake returned" \ |
| 1308 | -c "Read from server: .* bytes read" |
| 1309 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1310 | run_test "Non-blocking I/O: ticket + resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1311 | "$P_SRV nbio=2 tickets=1 auth_mode=none" \ |
| 1312 | "$P_CLI nbio=2 tickets=1 reconnect=1" \ |
| 1313 | 0 \ |
| 1314 | -S "ssl_handshake returned" \ |
| 1315 | -C "ssl_handshake returned" \ |
| 1316 | -c "Read from server: .* bytes read" |
| 1317 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1318 | run_test "Non-blocking I/O: session-id resume" \ |
Manuel Pégourié-Gonnard | 0b6609b | 2014-02-26 14:45:12 +0100 | [diff] [blame] | 1319 | "$P_SRV nbio=2 tickets=0 auth_mode=none" \ |
| 1320 | "$P_CLI nbio=2 tickets=0 reconnect=1" \ |
| 1321 | 0 \ |
| 1322 | -S "ssl_handshake returned" \ |
| 1323 | -C "ssl_handshake returned" \ |
| 1324 | -c "Read from server: .* bytes read" |
| 1325 | |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1326 | # Tests for version negotiation |
| 1327 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1328 | run_test "Version check: all -> 1.2" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1329 | "$P_SRV" \ |
| 1330 | "$P_CLI" \ |
| 1331 | 0 \ |
| 1332 | -S "ssl_handshake returned" \ |
| 1333 | -C "ssl_handshake returned" \ |
| 1334 | -s "Protocol is TLSv1.2" \ |
| 1335 | -c "Protocol is TLSv1.2" |
| 1336 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1337 | run_test "Version check: cli max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1338 | "$P_SRV" \ |
| 1339 | "$P_CLI max_version=tls1_1" \ |
| 1340 | 0 \ |
| 1341 | -S "ssl_handshake returned" \ |
| 1342 | -C "ssl_handshake returned" \ |
| 1343 | -s "Protocol is TLSv1.1" \ |
| 1344 | -c "Protocol is TLSv1.1" |
| 1345 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1346 | run_test "Version check: srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1347 | "$P_SRV max_version=tls1_1" \ |
| 1348 | "$P_CLI" \ |
| 1349 | 0 \ |
| 1350 | -S "ssl_handshake returned" \ |
| 1351 | -C "ssl_handshake returned" \ |
| 1352 | -s "Protocol is TLSv1.1" \ |
| 1353 | -c "Protocol is TLSv1.1" |
| 1354 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1355 | run_test "Version check: cli+srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1356 | "$P_SRV max_version=tls1_1" \ |
| 1357 | "$P_CLI max_version=tls1_1" \ |
| 1358 | 0 \ |
| 1359 | -S "ssl_handshake returned" \ |
| 1360 | -C "ssl_handshake returned" \ |
| 1361 | -s "Protocol is TLSv1.1" \ |
| 1362 | -c "Protocol is TLSv1.1" |
| 1363 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1364 | run_test "Version check: cli max 1.1, srv min 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1365 | "$P_SRV min_version=tls1_1" \ |
| 1366 | "$P_CLI max_version=tls1_1" \ |
| 1367 | 0 \ |
| 1368 | -S "ssl_handshake returned" \ |
| 1369 | -C "ssl_handshake returned" \ |
| 1370 | -s "Protocol is TLSv1.1" \ |
| 1371 | -c "Protocol is TLSv1.1" |
| 1372 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1373 | run_test "Version check: cli min 1.1, srv max 1.1 -> 1.1" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1374 | "$P_SRV max_version=tls1_1" \ |
| 1375 | "$P_CLI min_version=tls1_1" \ |
| 1376 | 0 \ |
| 1377 | -S "ssl_handshake returned" \ |
| 1378 | -C "ssl_handshake returned" \ |
| 1379 | -s "Protocol is TLSv1.1" \ |
| 1380 | -c "Protocol is TLSv1.1" |
| 1381 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1382 | run_test "Version check: cli min 1.2, srv max 1.1 -> fail" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1383 | "$P_SRV max_version=tls1_1" \ |
| 1384 | "$P_CLI min_version=tls1_2" \ |
| 1385 | 1 \ |
| 1386 | -s "ssl_handshake returned" \ |
| 1387 | -c "ssl_handshake returned" \ |
| 1388 | -c "SSL - Handshake protocol not within min/max boundaries" |
| 1389 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1390 | run_test "Version check: srv min 1.2, cli max 1.1 -> fail" \ |
Manuel Pégourié-Gonnard | a3d808e | 2014-02-26 16:33:03 +0100 | [diff] [blame] | 1391 | "$P_SRV min_version=tls1_2" \ |
| 1392 | "$P_CLI max_version=tls1_1" \ |
| 1393 | 1 \ |
| 1394 | -s "ssl_handshake returned" \ |
| 1395 | -c "ssl_handshake returned" \ |
| 1396 | -s "SSL - Handshake protocol not within min/max boundaries" |
| 1397 | |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1398 | # Tests for ALPN extension |
| 1399 | |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 1400 | if grep '^#define POLARSSL_SSL_ALPN' $CONFIG_H >/dev/null; then |
| 1401 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1402 | run_test "ALPN: none" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1403 | "$P_SRV debug_level=3" \ |
| 1404 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1405 | 0 \ |
| 1406 | -C "client hello, adding alpn extension" \ |
| 1407 | -S "found alpn extension" \ |
| 1408 | -C "got an alert message, type: \\[2:120]" \ |
| 1409 | -S "server hello, adding alpn extension" \ |
| 1410 | -C "found alpn extension " \ |
| 1411 | -C "Application Layer Protocol is" \ |
| 1412 | -S "Application Layer Protocol is" |
| 1413 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1414 | run_test "ALPN: client only" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1415 | "$P_SRV debug_level=3" \ |
| 1416 | "$P_CLI debug_level=3 alpn=abc,1234" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1417 | 0 \ |
| 1418 | -c "client hello, adding alpn extension" \ |
| 1419 | -s "found alpn extension" \ |
| 1420 | -C "got an alert message, type: \\[2:120]" \ |
| 1421 | -S "server hello, adding alpn extension" \ |
| 1422 | -C "found alpn extension " \ |
| 1423 | -c "Application Layer Protocol is (none)" \ |
| 1424 | -S "Application Layer Protocol is" |
| 1425 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1426 | run_test "ALPN: server only" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1427 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 1428 | "$P_CLI debug_level=3" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1429 | 0 \ |
| 1430 | -C "client hello, adding alpn extension" \ |
| 1431 | -S "found alpn extension" \ |
| 1432 | -C "got an alert message, type: \\[2:120]" \ |
| 1433 | -S "server hello, adding alpn extension" \ |
| 1434 | -C "found alpn extension " \ |
| 1435 | -C "Application Layer Protocol is" \ |
| 1436 | -s "Application Layer Protocol is (none)" |
| 1437 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1438 | run_test "ALPN: both, common cli1-srv1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1439 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 1440 | "$P_CLI debug_level=3 alpn=abc,1234" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1441 | 0 \ |
| 1442 | -c "client hello, adding alpn extension" \ |
| 1443 | -s "found alpn extension" \ |
| 1444 | -C "got an alert message, type: \\[2:120]" \ |
| 1445 | -s "server hello, adding alpn extension" \ |
| 1446 | -c "found alpn extension" \ |
| 1447 | -c "Application Layer Protocol is abc" \ |
| 1448 | -s "Application Layer Protocol is abc" |
| 1449 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1450 | run_test "ALPN: both, common cli2-srv1" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1451 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 1452 | "$P_CLI debug_level=3 alpn=1234,abc" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1453 | 0 \ |
| 1454 | -c "client hello, adding alpn extension" \ |
| 1455 | -s "found alpn extension" \ |
| 1456 | -C "got an alert message, type: \\[2:120]" \ |
| 1457 | -s "server hello, adding alpn extension" \ |
| 1458 | -c "found alpn extension" \ |
| 1459 | -c "Application Layer Protocol is abc" \ |
| 1460 | -s "Application Layer Protocol is abc" |
| 1461 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1462 | run_test "ALPN: both, common cli1-srv2" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1463 | "$P_SRV debug_level=3 alpn=abc,1234" \ |
| 1464 | "$P_CLI debug_level=3 alpn=1234,abcde" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1465 | 0 \ |
| 1466 | -c "client hello, adding alpn extension" \ |
| 1467 | -s "found alpn extension" \ |
| 1468 | -C "got an alert message, type: \\[2:120]" \ |
| 1469 | -s "server hello, adding alpn extension" \ |
| 1470 | -c "found alpn extension" \ |
| 1471 | -c "Application Layer Protocol is 1234" \ |
| 1472 | -s "Application Layer Protocol is 1234" |
| 1473 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1474 | run_test "ALPN: both, no common" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1475 | "$P_SRV debug_level=3 alpn=abc,123" \ |
| 1476 | "$P_CLI debug_level=3 alpn=1234,abcde" \ |
Manuel Pégourié-Gonnard | f6521de | 2014-04-07 12:42:04 +0200 | [diff] [blame] | 1477 | 1 \ |
| 1478 | -c "client hello, adding alpn extension" \ |
| 1479 | -s "found alpn extension" \ |
| 1480 | -c "got an alert message, type: \\[2:120]" \ |
| 1481 | -S "server hello, adding alpn extension" \ |
| 1482 | -C "found alpn extension" \ |
| 1483 | -C "Application Layer Protocol is 1234" \ |
| 1484 | -S "Application Layer Protocol is 1234" |
| 1485 | |
Manuel Pégourié-Gonnard | 83d8c73 | 2014-04-07 13:24:21 +0200 | [diff] [blame] | 1486 | fi |
| 1487 | |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1488 | # Tests for keyUsage in leaf certificates, part 1: |
| 1489 | # server-side certificate/suite selection |
| 1490 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1491 | run_test "keyUsage srv: RSA, digitalSignature -> (EC)DHE-RSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1492 | "$P_SRV key_file=data_files/server2.key \ |
| 1493 | crt_file=data_files/server2.ku-ds.crt" \ |
| 1494 | "$P_CLI" \ |
| 1495 | 0 \ |
Manuel Pégourié-Gonnard | 17cde5f | 2014-05-22 14:42:39 +0200 | [diff] [blame] | 1496 | -c "Ciphersuite is TLS-[EC]*DHE-RSA-WITH-" |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1497 | |
| 1498 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1499 | run_test "keyUsage srv: RSA, keyEncipherment -> RSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1500 | "$P_SRV key_file=data_files/server2.key \ |
| 1501 | crt_file=data_files/server2.ku-ke.crt" \ |
| 1502 | "$P_CLI" \ |
| 1503 | 0 \ |
| 1504 | -c "Ciphersuite is TLS-RSA-WITH-" |
| 1505 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1506 | run_test "keyUsage srv: RSA, keyAgreement -> fail" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 1507 | "$P_SRV key_file=data_files/server2.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1508 | crt_file=data_files/server2.ku-ka.crt" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 1509 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1510 | 1 \ |
| 1511 | -C "Ciphersuite is " |
| 1512 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1513 | run_test "keyUsage srv: ECDSA, digitalSignature -> ECDHE-ECDSA" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1514 | "$P_SRV key_file=data_files/server5.key \ |
| 1515 | crt_file=data_files/server5.ku-ds.crt" \ |
| 1516 | "$P_CLI" \ |
| 1517 | 0 \ |
| 1518 | -c "Ciphersuite is TLS-ECDHE-ECDSA-WITH-" |
| 1519 | |
| 1520 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1521 | run_test "keyUsage srv: ECDSA, keyAgreement -> ECDH-" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1522 | "$P_SRV key_file=data_files/server5.key \ |
| 1523 | crt_file=data_files/server5.ku-ka.crt" \ |
| 1524 | "$P_CLI" \ |
| 1525 | 0 \ |
| 1526 | -c "Ciphersuite is TLS-ECDH-" |
| 1527 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1528 | run_test "keyUsage srv: ECDSA, keyEncipherment -> fail" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 1529 | "$P_SRV key_file=data_files/server5.key \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1530 | crt_file=data_files/server5.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | f2629b9 | 2014-08-30 14:20:14 +0200 | [diff] [blame] | 1531 | "$P_CLI" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1532 | 1 \ |
| 1533 | -C "Ciphersuite is " |
| 1534 | |
| 1535 | # Tests for keyUsage in leaf certificates, part 2: |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1536 | # client-side checking of server cert |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1537 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1538 | run_test "keyUsage cli: DigitalSignature+KeyEncipherment, RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1539 | "$O_SRV -key data_files/server2.key \ |
| 1540 | -cert data_files/server2.ku-ds_ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1541 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1542 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 1543 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1544 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1545 | -C "Processing of the Certificate handshake message failed" \ |
| 1546 | -c "Ciphersuite is TLS-" |
| 1547 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1548 | run_test "keyUsage cli: DigitalSignature+KeyEncipherment, DHE-RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1549 | "$O_SRV -key data_files/server2.key \ |
| 1550 | -cert data_files/server2.ku-ds_ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1551 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1552 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 1553 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1554 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1555 | -C "Processing of the Certificate handshake message failed" \ |
| 1556 | -c "Ciphersuite is TLS-" |
| 1557 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1558 | run_test "keyUsage cli: KeyEncipherment, RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1559 | "$O_SRV -key data_files/server2.key \ |
| 1560 | -cert data_files/server2.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1561 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1562 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 1563 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1564 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1565 | -C "Processing of the Certificate handshake message failed" \ |
| 1566 | -c "Ciphersuite is TLS-" |
| 1567 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1568 | run_test "keyUsage cli: KeyEncipherment, DHE-RSA: fail" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1569 | "$O_SRV -key data_files/server2.key \ |
| 1570 | -cert data_files/server2.ku-ke.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1571 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1572 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 1573 | 1 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1574 | -c "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1575 | -c "Processing of the Certificate handshake message failed" \ |
| 1576 | -C "Ciphersuite is TLS-" |
| 1577 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1578 | run_test "keyUsage cli: DigitalSignature, DHE-RSA: OK" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1579 | "$O_SRV -key data_files/server2.key \ |
| 1580 | -cert data_files/server2.ku-ds.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1581 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1582 | force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA" \ |
| 1583 | 0 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1584 | -C "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1585 | -C "Processing of the Certificate handshake message failed" \ |
| 1586 | -c "Ciphersuite is TLS-" |
| 1587 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1588 | run_test "keyUsage cli: DigitalSignature, RSA: fail" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1589 | "$O_SRV -key data_files/server2.key \ |
| 1590 | -cert data_files/server2.ku-ds.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1591 | "$P_CLI debug_level=1 \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1592 | force_ciphersuite=TLS-RSA-WITH-AES-128-CBC-SHA" \ |
| 1593 | 1 \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1594 | -c "bad certificate (usage extensions)" \ |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 1595 | -c "Processing of the Certificate handshake message failed" \ |
| 1596 | -C "Ciphersuite is TLS-" |
| 1597 | |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1598 | # Tests for keyUsage in leaf certificates, part 3: |
| 1599 | # server-side checking of client cert |
| 1600 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1601 | run_test "keyUsage cli-auth: RSA, DigitalSignature: OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1602 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1603 | "$O_CLI -key data_files/server2.key \ |
| 1604 | -cert data_files/server2.ku-ds.crt" \ |
| 1605 | 0 \ |
| 1606 | -S "bad certificate (usage extensions)" \ |
| 1607 | -S "Processing of the Certificate handshake message failed" |
| 1608 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1609 | run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1610 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1611 | "$O_CLI -key data_files/server2.key \ |
| 1612 | -cert data_files/server2.ku-ke.crt" \ |
| 1613 | 0 \ |
| 1614 | -s "bad certificate (usage extensions)" \ |
| 1615 | -S "Processing of the Certificate handshake message failed" |
| 1616 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1617 | run_test "keyUsage cli-auth: RSA, KeyEncipherment: fail (hard)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1618 | "$P_SRV debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1619 | "$O_CLI -key data_files/server2.key \ |
| 1620 | -cert data_files/server2.ku-ke.crt" \ |
| 1621 | 1 \ |
| 1622 | -s "bad certificate (usage extensions)" \ |
| 1623 | -s "Processing of the Certificate handshake message failed" |
| 1624 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1625 | run_test "keyUsage cli-auth: ECDSA, DigitalSignature: OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1626 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1627 | "$O_CLI -key data_files/server5.key \ |
| 1628 | -cert data_files/server5.ku-ds.crt" \ |
| 1629 | 0 \ |
| 1630 | -S "bad certificate (usage extensions)" \ |
| 1631 | -S "Processing of the Certificate handshake message failed" |
| 1632 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1633 | run_test "keyUsage cli-auth: ECDSA, KeyAgreement: fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1634 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | a9db85d | 2014-04-09 14:53:05 +0200 | [diff] [blame] | 1635 | "$O_CLI -key data_files/server5.key \ |
| 1636 | -cert data_files/server5.ku-ka.crt" \ |
| 1637 | 0 \ |
| 1638 | -s "bad certificate (usage extensions)" \ |
| 1639 | -S "Processing of the Certificate handshake message failed" |
| 1640 | |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1641 | # Tests for extendedKeyUsage, part 1: server-side certificate/suite selection |
| 1642 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1643 | run_test "extKeyUsage srv: serverAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1644 | "$P_SRV key_file=data_files/server5.key \ |
| 1645 | crt_file=data_files/server5.eku-srv.crt" \ |
| 1646 | "$P_CLI" \ |
| 1647 | 0 |
| 1648 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1649 | run_test "extKeyUsage srv: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1650 | "$P_SRV key_file=data_files/server5.key \ |
| 1651 | crt_file=data_files/server5.eku-srv.crt" \ |
| 1652 | "$P_CLI" \ |
| 1653 | 0 |
| 1654 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1655 | run_test "extKeyUsage srv: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1656 | "$P_SRV key_file=data_files/server5.key \ |
| 1657 | crt_file=data_files/server5.eku-cs_any.crt" \ |
| 1658 | "$P_CLI" \ |
| 1659 | 0 |
| 1660 | |
| 1661 | # add psk to leave an option for client to send SERVERQUIT |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1662 | run_test "extKeyUsage srv: codeSign -> fail" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1663 | "$P_SRV psk=abc123 key_file=data_files/server5.key \ |
| 1664 | crt_file=data_files/server5.eku-cli.crt" \ |
| 1665 | "$P_CLI psk=badbad" \ |
| 1666 | 1 |
| 1667 | |
| 1668 | # Tests for extendedKeyUsage, part 2: client-side checking of server cert |
| 1669 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1670 | run_test "extKeyUsage cli: serverAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1671 | "$O_SRV -key data_files/server5.key \ |
| 1672 | -cert data_files/server5.eku-srv.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1673 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1674 | 0 \ |
| 1675 | -C "bad certificate (usage extensions)" \ |
| 1676 | -C "Processing of the Certificate handshake message failed" \ |
| 1677 | -c "Ciphersuite is TLS-" |
| 1678 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1679 | run_test "extKeyUsage cli: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1680 | "$O_SRV -key data_files/server5.key \ |
| 1681 | -cert data_files/server5.eku-srv_cli.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1682 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1683 | 0 \ |
| 1684 | -C "bad certificate (usage extensions)" \ |
| 1685 | -C "Processing of the Certificate handshake message failed" \ |
| 1686 | -c "Ciphersuite is TLS-" |
| 1687 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1688 | run_test "extKeyUsage cli: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1689 | "$O_SRV -key data_files/server5.key \ |
| 1690 | -cert data_files/server5.eku-cs_any.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1691 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1692 | 0 \ |
| 1693 | -C "bad certificate (usage extensions)" \ |
| 1694 | -C "Processing of the Certificate handshake message failed" \ |
| 1695 | -c "Ciphersuite is TLS-" |
| 1696 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1697 | run_test "extKeyUsage cli: codeSign -> fail" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1698 | "$O_SRV -key data_files/server5.key \ |
| 1699 | -cert data_files/server5.eku-cs.crt" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1700 | "$P_CLI debug_level=1" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1701 | 1 \ |
| 1702 | -c "bad certificate (usage extensions)" \ |
| 1703 | -c "Processing of the Certificate handshake message failed" \ |
| 1704 | -C "Ciphersuite is TLS-" |
| 1705 | |
| 1706 | # Tests for extendedKeyUsage, part 3: server-side checking of client cert |
| 1707 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1708 | run_test "extKeyUsage cli-auth: clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1709 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1710 | "$O_CLI -key data_files/server5.key \ |
| 1711 | -cert data_files/server5.eku-cli.crt" \ |
| 1712 | 0 \ |
| 1713 | -S "bad certificate (usage extensions)" \ |
| 1714 | -S "Processing of the Certificate handshake message failed" |
| 1715 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1716 | run_test "extKeyUsage cli-auth: serverAuth,clientAuth -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1717 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1718 | "$O_CLI -key data_files/server5.key \ |
| 1719 | -cert data_files/server5.eku-srv_cli.crt" \ |
| 1720 | 0 \ |
| 1721 | -S "bad certificate (usage extensions)" \ |
| 1722 | -S "Processing of the Certificate handshake message failed" |
| 1723 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1724 | run_test "extKeyUsage cli-auth: codeSign,anyEKU -> OK" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1725 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1726 | "$O_CLI -key data_files/server5.key \ |
| 1727 | -cert data_files/server5.eku-cs_any.crt" \ |
| 1728 | 0 \ |
| 1729 | -S "bad certificate (usage extensions)" \ |
| 1730 | -S "Processing of the Certificate handshake message failed" |
| 1731 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1732 | run_test "extKeyUsage cli-auth: codeSign -> fail (soft)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1733 | "$P_SRV debug_level=1 auth_mode=optional" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1734 | "$O_CLI -key data_files/server5.key \ |
| 1735 | -cert data_files/server5.eku-cs.crt" \ |
| 1736 | 0 \ |
| 1737 | -s "bad certificate (usage extensions)" \ |
| 1738 | -S "Processing of the Certificate handshake message failed" |
| 1739 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1740 | run_test "extKeyUsage cli-auth: codeSign -> fail (hard)" \ |
Manuel Pégourié-Gonnard | 644e8f3 | 2014-08-30 21:59:31 +0200 | [diff] [blame] | 1741 | "$P_SRV debug_level=1 auth_mode=required" \ |
Manuel Pégourié-Gonnard | 0408fd1 | 2014-04-11 11:06:22 +0200 | [diff] [blame] | 1742 | "$O_CLI -key data_files/server5.key \ |
| 1743 | -cert data_files/server5.eku-cs.crt" \ |
| 1744 | 1 \ |
| 1745 | -s "bad certificate (usage extensions)" \ |
| 1746 | -s "Processing of the Certificate handshake message failed" |
| 1747 | |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 1748 | # Tests for DHM parameters loading |
| 1749 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1750 | run_test "DHM parameters: reference" \ |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 1751 | "$P_SRV" \ |
| 1752 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 1753 | debug_level=3" \ |
| 1754 | 0 \ |
| 1755 | -c "value of 'DHM: P ' (2048 bits)" \ |
| 1756 | -c "value of 'DHM: G ' (2048 bits)" |
| 1757 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1758 | run_test "DHM parameters: other parameters" \ |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 1759 | "$P_SRV dhm_file=data_files/dhparams.pem" \ |
| 1760 | "$P_CLI force_ciphersuite=TLS-DHE-RSA-WITH-AES-128-CBC-SHA \ |
| 1761 | debug_level=3" \ |
| 1762 | 0 \ |
| 1763 | -c "value of 'DHM: P ' (1024 bits)" \ |
| 1764 | -c "value of 'DHM: G ' (2 bits)" |
| 1765 | |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1766 | # Tests for PSK callback |
| 1767 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1768 | run_test "PSK callback: psk, no callback" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1769 | "$P_SRV psk=abc123 psk_identity=foo" \ |
| 1770 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1771 | psk_identity=foo psk=abc123" \ |
| 1772 | 0 \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1773 | -S "SSL - The server has no ciphersuites in common" \ |
| 1774 | -S "SSL - Unknown identity received" \ |
| 1775 | -S "SSL - Verification of the message MAC failed" |
| 1776 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1777 | run_test "PSK callback: no psk, no callback" \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1778 | "$P_SRV" \ |
| 1779 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1780 | psk_identity=foo psk=abc123" \ |
| 1781 | 1 \ |
| 1782 | -s "SSL - The server has no ciphersuites in common" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1783 | -S "SSL - Unknown identity received" \ |
| 1784 | -S "SSL - Verification of the message MAC failed" |
| 1785 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1786 | run_test "PSK callback: callback overrides other settings" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1787 | "$P_SRV psk=abc123 psk_identity=foo psk_list=abc,dead,def,beef" \ |
| 1788 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1789 | psk_identity=foo psk=abc123" \ |
| 1790 | 1 \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1791 | -S "SSL - The server has no ciphersuites in common" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1792 | -s "SSL - Unknown identity received" \ |
| 1793 | -S "SSL - Verification of the message MAC failed" |
| 1794 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1795 | run_test "PSK callback: first id matches" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1796 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 1797 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1798 | psk_identity=abc psk=dead" \ |
| 1799 | 0 \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1800 | -S "SSL - The server has no ciphersuites in common" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1801 | -S "SSL - Unknown identity received" \ |
| 1802 | -S "SSL - Verification of the message MAC failed" |
| 1803 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1804 | run_test "PSK callback: second id matches" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1805 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 1806 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1807 | psk_identity=def psk=beef" \ |
| 1808 | 0 \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1809 | -S "SSL - The server has no ciphersuites in common" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1810 | -S "SSL - Unknown identity received" \ |
| 1811 | -S "SSL - Verification of the message MAC failed" |
| 1812 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1813 | run_test "PSK callback: no match" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1814 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 1815 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1816 | psk_identity=ghi psk=beef" \ |
| 1817 | 1 \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1818 | -S "SSL - The server has no ciphersuites in common" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1819 | -s "SSL - Unknown identity received" \ |
| 1820 | -S "SSL - Verification of the message MAC failed" |
| 1821 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1822 | run_test "PSK callback: wrong key" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1823 | "$P_SRV psk_list=abc,dead,def,beef" \ |
| 1824 | "$P_CLI force_ciphersuite=TLS-PSK-WITH-AES-128-CBC-SHA \ |
| 1825 | psk_identity=abc psk=beef" \ |
| 1826 | 1 \ |
Manuel Pégourié-Gonnard | 10c3c9f | 2014-06-10 15:28:52 +0200 | [diff] [blame] | 1827 | -S "SSL - The server has no ciphersuites in common" \ |
Manuel Pégourié-Gonnard | a6781c9 | 2014-06-10 15:00:46 +0200 | [diff] [blame] | 1828 | -S "SSL - Unknown identity received" \ |
| 1829 | -s "SSL - Verification of the message MAC failed" |
Manuel Pégourié-Gonnard | 0cc7e31 | 2014-06-09 11:36:47 +0200 | [diff] [blame] | 1830 | |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 1831 | # Tests for ciphersuites per version |
| 1832 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1833 | run_test "Per-version suites: SSL3" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 1834 | "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 1835 | "$P_CLI force_version=ssl3" \ |
| 1836 | 0 \ |
| 1837 | -c "Ciphersuite is TLS-RSA-WITH-3DES-EDE-CBC-SHA" |
| 1838 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1839 | run_test "Per-version suites: TLS 1.0" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 1840 | "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 1841 | "$P_CLI force_version=tls1" \ |
| 1842 | 0 \ |
| 1843 | -c "Ciphersuite is TLS-RSA-WITH-RC4-128-SHA" |
| 1844 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1845 | run_test "Per-version suites: TLS 1.1" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 1846 | "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 1847 | "$P_CLI force_version=tls1_1" \ |
| 1848 | 0 \ |
| 1849 | -c "Ciphersuite is TLS-RSA-WITH-AES-128-CBC-SHA" |
| 1850 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1851 | run_test "Per-version suites: TLS 1.2" \ |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 1852 | "$P_SRV version_suites=TLS-RSA-WITH-3DES-EDE-CBC-SHA,TLS-RSA-WITH-RC4-128-SHA,TLS-RSA-WITH-AES-128-CBC-SHA,TLS-RSA-WITH-AES-128-GCM-SHA256" \ |
| 1853 | "$P_CLI force_version=tls1_2" \ |
| 1854 | 0 \ |
| 1855 | -c "Ciphersuite is TLS-RSA-WITH-AES-128-GCM-SHA256" |
| 1856 | |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 1857 | # Tests for ssl_get_bytes_avail() |
| 1858 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1859 | run_test "ssl_get_bytes_avail: no extra data" \ |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 1860 | "$P_SRV" \ |
| 1861 | "$P_CLI request_size=100" \ |
| 1862 | 0 \ |
| 1863 | -s "Read from client: 100 bytes read$" |
| 1864 | |
Manuel Pégourié-Gonnard | 8e03c71 | 2014-08-30 21:42:40 +0200 | [diff] [blame] | 1865 | run_test "ssl_get_bytes_avail: extra data" \ |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 1866 | "$P_SRV" \ |
| 1867 | "$P_CLI request_size=500" \ |
| 1868 | 0 \ |
| 1869 | -s "Read from client: 500 bytes read (.*+.*)" |
Manuel Pégourié-Gonnard | 90805a8 | 2014-06-11 14:06:01 +0200 | [diff] [blame] | 1870 | |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 1871 | # Tests for small packets |
| 1872 | |
| 1873 | run_test "Small packet SSLv3 BlockCipher" \ |
| 1874 | "$P_SRV" \ |
| 1875 | "$P_CLI request_size=1 force_version=ssl3 \ |
| 1876 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1877 | 0 \ |
| 1878 | -s "Read from client: 1 bytes read" |
| 1879 | |
| 1880 | run_test "Small packet SSLv3 StreamCipher" \ |
| 1881 | "$P_SRV" \ |
| 1882 | "$P_CLI request_size=1 force_version=ssl3 \ |
| 1883 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 1884 | 0 \ |
| 1885 | -s "Read from client: 1 bytes read" |
| 1886 | |
| 1887 | run_test "Small packet TLS 1.0 BlockCipher" \ |
| 1888 | "$P_SRV" \ |
| 1889 | "$P_CLI request_size=1 force_version=tls1 \ |
| 1890 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1891 | 0 \ |
| 1892 | -s "Read from client: 1 bytes read" |
| 1893 | |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 1894 | run_test "Small packet TLS 1.0 BlockCipher without EtM" \ |
| 1895 | "$P_SRV" \ |
| 1896 | "$P_CLI request_size=1 force_version=tls1 etm=0 \ |
| 1897 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1898 | 0 \ |
| 1899 | -s "Read from client: 1 bytes read" |
| 1900 | |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 1901 | run_test "Small packet TLS 1.0 BlockCipher truncated MAC" \ |
| 1902 | "$P_SRV" \ |
| 1903 | "$P_CLI request_size=1 force_version=tls1 \ |
| 1904 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 1905 | trunc_hmac=1" \ |
| 1906 | 0 \ |
| 1907 | -s "Read from client: 1 bytes read" |
| 1908 | |
| 1909 | run_test "Small packet TLS 1.0 StreamCipher truncated MAC" \ |
| 1910 | "$P_SRV" \ |
| 1911 | "$P_CLI request_size=1 force_version=tls1 \ |
| 1912 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 1913 | trunc_hmac=1" \ |
| 1914 | 0 \ |
| 1915 | -s "Read from client: 1 bytes read" |
| 1916 | |
| 1917 | run_test "Small packet TLS 1.1 BlockCipher" \ |
| 1918 | "$P_SRV" \ |
| 1919 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 1920 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1921 | 0 \ |
| 1922 | -s "Read from client: 1 bytes read" |
| 1923 | |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 1924 | run_test "Small packet TLS 1.1 BlockCipher without EtM" \ |
| 1925 | "$P_SRV" \ |
| 1926 | "$P_CLI request_size=1 force_version=tls1_1 etm=0 \ |
| 1927 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1928 | 0 \ |
| 1929 | -s "Read from client: 1 bytes read" |
| 1930 | |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 1931 | run_test "Small packet TLS 1.1 StreamCipher" \ |
| 1932 | "$P_SRV" \ |
| 1933 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 1934 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 1935 | 0 \ |
| 1936 | -s "Read from client: 1 bytes read" |
| 1937 | |
| 1938 | run_test "Small packet TLS 1.1 BlockCipher truncated MAC" \ |
| 1939 | "$P_SRV" \ |
| 1940 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 1941 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 1942 | trunc_hmac=1" \ |
| 1943 | 0 \ |
| 1944 | -s "Read from client: 1 bytes read" |
| 1945 | |
| 1946 | run_test "Small packet TLS 1.1 StreamCipher truncated MAC" \ |
| 1947 | "$P_SRV" \ |
| 1948 | "$P_CLI request_size=1 force_version=tls1_1 \ |
| 1949 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 1950 | trunc_hmac=1" \ |
| 1951 | 0 \ |
| 1952 | -s "Read from client: 1 bytes read" |
| 1953 | |
| 1954 | run_test "Small packet TLS 1.2 BlockCipher" \ |
| 1955 | "$P_SRV" \ |
| 1956 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 1957 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1958 | 0 \ |
| 1959 | -s "Read from client: 1 bytes read" |
| 1960 | |
Manuel Pégourié-Gonnard | 169dd6a | 2014-11-04 16:15:39 +0100 | [diff] [blame] | 1961 | run_test "Small packet TLS 1.2 BlockCipher without EtM" \ |
| 1962 | "$P_SRV" \ |
| 1963 | "$P_CLI request_size=1 force_version=tls1_2 etm=0 \ |
| 1964 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 1965 | 0 \ |
| 1966 | -s "Read from client: 1 bytes read" |
| 1967 | |
Manuel Pégourié-Gonnard | ee41503 | 2014-06-18 15:08:56 +0200 | [diff] [blame] | 1968 | run_test "Small packet TLS 1.2 BlockCipher larger MAC" \ |
| 1969 | "$P_SRV" \ |
| 1970 | "$P_CLI request_size=1 force_version=tls1_2 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
| 1971 | 0 \ |
| 1972 | -s "Read from client: 1 bytes read" |
| 1973 | |
| 1974 | run_test "Small packet TLS 1.2 BlockCipher truncated MAC" \ |
| 1975 | "$P_SRV" \ |
| 1976 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 1977 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 1978 | trunc_hmac=1" \ |
| 1979 | 0 \ |
| 1980 | -s "Read from client: 1 bytes read" |
| 1981 | |
| 1982 | run_test "Small packet TLS 1.2 StreamCipher" \ |
| 1983 | "$P_SRV" \ |
| 1984 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 1985 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 1986 | 0 \ |
| 1987 | -s "Read from client: 1 bytes read" |
| 1988 | |
| 1989 | run_test "Small packet TLS 1.2 StreamCipher truncated MAC" \ |
| 1990 | "$P_SRV" \ |
| 1991 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 1992 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 1993 | trunc_hmac=1" \ |
| 1994 | 0 \ |
| 1995 | -s "Read from client: 1 bytes read" |
| 1996 | |
| 1997 | run_test "Small packet TLS 1.2 AEAD" \ |
| 1998 | "$P_SRV" \ |
| 1999 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 2000 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 2001 | 0 \ |
| 2002 | -s "Read from client: 1 bytes read" |
| 2003 | |
| 2004 | run_test "Small packet TLS 1.2 AEAD shorter tag" \ |
| 2005 | "$P_SRV" \ |
| 2006 | "$P_CLI request_size=1 force_version=tls1_2 \ |
| 2007 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 2008 | 0 \ |
| 2009 | -s "Read from client: 1 bytes read" |
| 2010 | |
Manuel Pégourié-Gonnard | 8920f69 | 2014-06-18 22:05:08 +0200 | [diff] [blame] | 2011 | # Test for large packets |
| 2012 | |
| 2013 | run_test "Large packet SSLv3 BlockCipher" \ |
| 2014 | "$P_SRV" \ |
| 2015 | "$P_CLI request_size=16384 force_version=ssl3 \ |
| 2016 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2017 | 0 \ |
| 2018 | -s "Read from client: 16384 bytes read" |
| 2019 | |
| 2020 | run_test "Large packet SSLv3 StreamCipher" \ |
| 2021 | "$P_SRV" \ |
| 2022 | "$P_CLI request_size=16384 force_version=ssl3 \ |
| 2023 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 2024 | 0 \ |
| 2025 | -s "Read from client: 16384 bytes read" |
| 2026 | |
| 2027 | run_test "Large packet TLS 1.0 BlockCipher" \ |
| 2028 | "$P_SRV" \ |
| 2029 | "$P_CLI request_size=16384 force_version=tls1 \ |
| 2030 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2031 | 0 \ |
| 2032 | -s "Read from client: 16384 bytes read" |
| 2033 | |
| 2034 | run_test "Large packet TLS 1.0 BlockCipher truncated MAC" \ |
| 2035 | "$P_SRV" \ |
| 2036 | "$P_CLI request_size=16384 force_version=tls1 \ |
| 2037 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 2038 | trunc_hmac=1" \ |
| 2039 | 0 \ |
| 2040 | -s "Read from client: 16384 bytes read" |
| 2041 | |
| 2042 | run_test "Large packet TLS 1.0 StreamCipher truncated MAC" \ |
| 2043 | "$P_SRV" \ |
| 2044 | "$P_CLI request_size=16384 force_version=tls1 \ |
| 2045 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 2046 | trunc_hmac=1" \ |
| 2047 | 0 \ |
| 2048 | -s "Read from client: 16384 bytes read" |
| 2049 | |
| 2050 | run_test "Large packet TLS 1.1 BlockCipher" \ |
| 2051 | "$P_SRV" \ |
| 2052 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 2053 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2054 | 0 \ |
| 2055 | -s "Read from client: 16384 bytes read" |
| 2056 | |
| 2057 | run_test "Large packet TLS 1.1 StreamCipher" \ |
| 2058 | "$P_SRV" \ |
| 2059 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 2060 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 2061 | 0 \ |
| 2062 | -s "Read from client: 16384 bytes read" |
| 2063 | |
| 2064 | run_test "Large packet TLS 1.1 BlockCipher truncated MAC" \ |
| 2065 | "$P_SRV" \ |
| 2066 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 2067 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 2068 | trunc_hmac=1" \ |
| 2069 | 0 \ |
| 2070 | -s "Read from client: 16384 bytes read" |
| 2071 | |
| 2072 | run_test "Large packet TLS 1.1 StreamCipher truncated MAC" \ |
| 2073 | "$P_SRV" \ |
| 2074 | "$P_CLI request_size=16384 force_version=tls1_1 \ |
| 2075 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 2076 | trunc_hmac=1" \ |
| 2077 | 0 \ |
| 2078 | -s "Read from client: 16384 bytes read" |
| 2079 | |
| 2080 | run_test "Large packet TLS 1.2 BlockCipher" \ |
| 2081 | "$P_SRV" \ |
| 2082 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 2083 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA" \ |
| 2084 | 0 \ |
| 2085 | -s "Read from client: 16384 bytes read" |
| 2086 | |
| 2087 | run_test "Large packet TLS 1.2 BlockCipher larger MAC" \ |
| 2088 | "$P_SRV" \ |
| 2089 | "$P_CLI request_size=16384 force_version=tls1_2 force_ciphersuite=TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" \ |
| 2090 | 0 \ |
| 2091 | -s "Read from client: 16384 bytes read" |
| 2092 | |
| 2093 | run_test "Large packet TLS 1.2 BlockCipher truncated MAC" \ |
| 2094 | "$P_SRV" \ |
| 2095 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 2096 | force_ciphersuite=TLS-RSA-WITH-AES-256-CBC-SHA \ |
| 2097 | trunc_hmac=1" \ |
| 2098 | 0 \ |
| 2099 | -s "Read from client: 16384 bytes read" |
| 2100 | |
| 2101 | run_test "Large packet TLS 1.2 StreamCipher" \ |
| 2102 | "$P_SRV" \ |
| 2103 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 2104 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA" \ |
| 2105 | 0 \ |
| 2106 | -s "Read from client: 16384 bytes read" |
| 2107 | |
| 2108 | run_test "Large packet TLS 1.2 StreamCipher truncated MAC" \ |
| 2109 | "$P_SRV" \ |
| 2110 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 2111 | force_ciphersuite=TLS-RSA-WITH-RC4-128-SHA \ |
| 2112 | trunc_hmac=1" \ |
| 2113 | 0 \ |
| 2114 | -s "Read from client: 16384 bytes read" |
| 2115 | |
| 2116 | run_test "Large packet TLS 1.2 AEAD" \ |
| 2117 | "$P_SRV" \ |
| 2118 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 2119 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM" \ |
| 2120 | 0 \ |
| 2121 | -s "Read from client: 16384 bytes read" |
| 2122 | |
| 2123 | run_test "Large packet TLS 1.2 AEAD shorter tag" \ |
| 2124 | "$P_SRV" \ |
| 2125 | "$P_CLI request_size=16384 force_version=tls1_2 \ |
| 2126 | force_ciphersuite=TLS-RSA-WITH-AES-256-CCM-8" \ |
| 2127 | 0 \ |
| 2128 | -s "Read from client: 16384 bytes read" |
| 2129 | |
Manuel Pégourié-Gonnard | 8520dac | 2014-02-21 12:12:23 +0100 | [diff] [blame] | 2130 | # Final report |
| 2131 | |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 2132 | echo "------------------------------------------------------------------------" |
| 2133 | |
| 2134 | if [ $FAILS = 0 ]; then |
| 2135 | echo -n "PASSED" |
| 2136 | else |
| 2137 | echo -n "FAILED" |
| 2138 | fi |
Manuel Pégourié-Gonnard | 72e51ee | 2014-08-31 10:22:11 +0200 | [diff] [blame] | 2139 | PASSES=$(( $TESTS - $FAILS )) |
Manuel Pégourié-Gonnard | 6f4fbbb | 2014-08-14 14:31:29 +0200 | [diff] [blame] | 2140 | echo " ($PASSES / $TESTS tests ($SKIPS skipped))" |
Manuel Pégourié-Gonnard | 33a752e | 2014-02-21 09:47:37 +0100 | [diff] [blame] | 2141 | |
| 2142 | exit $FAILS |