mirror of
https://git.suyu.dev/suyu/mbedtls.git
synced 2026-01-03 13:15:42 +01:00
Merge remote-tracking branch 'public/pr/1939' into development
This commit is contained in:
Simon Butcher
commit
1846e406c8
9 changed files with 1242 additions and 105 deletions
776
tests/ssl-opt.sh
776
tests/ssl-opt.sh
|
|
@ -41,6 +41,28 @@ G_SRV="$GNUTLS_SERV --x509certfile data_files/server5.crt --x509keyfile data_fil
|
|||
G_CLI="echo 'GET / HTTP/1.0' | $GNUTLS_CLI --x509cafile data_files/test-ca_cat12.crt"
|
||||
TCP_CLIENT="$PERL scripts/tcp_client.pl"
|
||||
|
||||
# alternative versions of OpenSSL and GnuTLS (no default path)
|
||||
|
||||
if [ -n "${OPENSSL_LEGACY:-}" ]; then
|
||||
O_LEGACY_SRV="$OPENSSL_LEGACY s_server -www -cert data_files/server5.crt -key data_files/server5.key"
|
||||
O_LEGACY_CLI="echo 'GET / HTTP/1.0' | $OPENSSL_LEGACY s_client"
|
||||
else
|
||||
O_LEGACY_SRV=false
|
||||
O_LEGACY_CLI=false
|
||||
fi
|
||||
|
||||
if [ -n "${GNUTLS_NEXT_SERV:-}" ]; then
|
||||
G_NEXT_SRV="$GNUTLS_NEXT_SERV --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key"
|
||||
else
|
||||
G_NEXT_SRV=false
|
||||
fi
|
||||
|
||||
if [ -n "${GNUTLS_NEXT_CLI:-}" ]; then
|
||||
G_NEXT_CLI="echo 'GET / HTTP/1.0' | $GNUTLS_NEXT_CLI --x509cafile data_files/test-ca_cat12.crt"
|
||||
else
|
||||
G_NEXT_CLI=false
|
||||
fi
|
||||
|
||||
TESTS=0
|
||||
FAILS=0
|
||||
SKIPS=0
|
||||
|
|
@ -163,6 +185,34 @@ requires_gnutls() {
|
|||
fi
|
||||
}
|
||||
|
||||
# skip next test if GnuTLS-next isn't available
|
||||
requires_gnutls_next() {
|
||||
if [ -z "${GNUTLS_NEXT_AVAILABLE:-}" ]; then
|
||||
if ( which "${GNUTLS_NEXT_CLI:-}" && which "${GNUTLS_NEXT_SERV:-}" ) >/dev/null 2>&1; then
|
||||
GNUTLS_NEXT_AVAILABLE="YES"
|
||||
else
|
||||
GNUTLS_NEXT_AVAILABLE="NO"
|
||||
fi
|
||||
fi
|
||||
if [ "$GNUTLS_NEXT_AVAILABLE" = "NO" ]; then
|
||||
SKIP_NEXT="YES"
|
||||
fi
|
||||
}
|
||||
|
||||
# skip next test if OpenSSL-legacy isn't available
|
||||
requires_openssl_legacy() {
|
||||
if [ -z "${OPENSSL_LEGACY_AVAILABLE:-}" ]; then
|
||||
if which "${OPENSSL_LEGACY:-}" >/dev/null 2>&1; then
|
||||
OPENSSL_LEGACY_AVAILABLE="YES"
|
||||
else
|
||||
OPENSSL_LEGACY_AVAILABLE="NO"
|
||||
fi
|
||||
fi
|
||||
if [ "$OPENSSL_LEGACY_AVAILABLE" = "NO" ]; then
|
||||
SKIP_NEXT="YES"
|
||||
fi
|
||||
}
|
||||
|
||||
# skip next test if IPv6 isn't available on this host
|
||||
requires_ipv6() {
|
||||
if [ -z "${HAS_IPV6:-}" ]; then
|
||||
|
|
@ -718,7 +768,20 @@ P_PXY="$P_PXY server_addr=127.0.0.1 server_port=$SRV_PORT listen_addr=127.0.0.1
|
|||
O_SRV="$O_SRV -accept $SRV_PORT -dhparam data_files/dhparams.pem"
|
||||
O_CLI="$O_CLI -connect localhost:+SRV_PORT"
|
||||
G_SRV="$G_SRV -p $SRV_PORT"
|
||||
G_CLI="$G_CLI -p +SRV_PORT localhost"
|
||||
G_CLI="$G_CLI -p +SRV_PORT"
|
||||
|
||||
if [ -n "${OPENSSL_LEGACY:-}" ]; then
|
||||
O_LEGACY_SRV="$O_LEGACY_SRV -accept $SRV_PORT -dhparam data_files/dhparams.pem"
|
||||
O_LEGACY_CLI="$O_LEGACY_CLI -connect localhost:+SRV_PORT"
|
||||
fi
|
||||
|
||||
if [ -n "${GNUTLS_NEXT_SERV:-}" ]; then
|
||||
G_NEXT_SRV="$G_NEXT_SRV -p $SRV_PORT"
|
||||
fi
|
||||
|
||||
if [ -n "${GNUTLS_NEXT_CLI:-}" ]; then
|
||||
G_NEXT_CLI="$G_NEXT_CLI -p +SRV_PORT"
|
||||
fi
|
||||
|
||||
# Allow SHA-1, because many of our test certificates use it
|
||||
P_SRV="$P_SRV allow_sha1=1"
|
||||
|
|
@ -2074,7 +2137,7 @@ run_test "Renego ext: gnutls server unsafe, client break legacy" \
|
|||
requires_gnutls
|
||||
run_test "Renego ext: gnutls client strict, server default" \
|
||||
"$P_SRV debug_level=3" \
|
||||
"$G_CLI --priority=NORMAL:%SAFE_RENEGOTIATION" \
|
||||
"$G_CLI --priority=NORMAL:%SAFE_RENEGOTIATION localhost" \
|
||||
0 \
|
||||
-s "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \
|
||||
-s "server hello, secure renegotiation extension"
|
||||
|
|
@ -2082,7 +2145,7 @@ run_test "Renego ext: gnutls client strict, server default" \
|
|||
requires_gnutls
|
||||
run_test "Renego ext: gnutls client unsafe, server default" \
|
||||
"$P_SRV debug_level=3" \
|
||||
"$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
|
||||
"$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION localhost" \
|
||||
0 \
|
||||
-S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \
|
||||
-S "server hello, secure renegotiation extension"
|
||||
|
|
@ -2090,7 +2153,7 @@ run_test "Renego ext: gnutls client unsafe, server default" \
|
|||
requires_gnutls
|
||||
run_test "Renego ext: gnutls client unsafe, server break legacy" \
|
||||
"$P_SRV debug_level=3 allow_legacy=-1" \
|
||||
"$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION" \
|
||||
"$G_CLI --priority=NORMAL:%DISABLE_SAFE_RENEGOTIATION localhost" \
|
||||
1 \
|
||||
-S "received TLS_EMPTY_RENEGOTIATION_INFO\|found renegotiation extension" \
|
||||
-S "server hello, secure renegotiation extension"
|
||||
|
|
@ -2101,7 +2164,7 @@ requires_gnutls
|
|||
run_test "DER format: no trailing bytes" \
|
||||
"$P_SRV crt_file=data_files/server5-der0.crt \
|
||||
key_file=data_files/server5.key" \
|
||||
"$G_CLI " \
|
||||
"$G_CLI localhost" \
|
||||
0 \
|
||||
-c "Handshake was completed" \
|
||||
|
||||
|
|
@ -2109,7 +2172,7 @@ requires_gnutls
|
|||
run_test "DER format: with a trailing zero byte" \
|
||||
"$P_SRV crt_file=data_files/server5-der1a.crt \
|
||||
key_file=data_files/server5.key" \
|
||||
"$G_CLI " \
|
||||
"$G_CLI localhost" \
|
||||
0 \
|
||||
-c "Handshake was completed" \
|
||||
|
||||
|
|
@ -2117,7 +2180,7 @@ requires_gnutls
|
|||
run_test "DER format: with a trailing random byte" \
|
||||
"$P_SRV crt_file=data_files/server5-der1b.crt \
|
||||
key_file=data_files/server5.key" \
|
||||
"$G_CLI " \
|
||||
"$G_CLI localhost" \
|
||||
0 \
|
||||
-c "Handshake was completed" \
|
||||
|
||||
|
|
@ -2125,7 +2188,7 @@ requires_gnutls
|
|||
run_test "DER format: with 2 trailing random bytes" \
|
||||
"$P_SRV crt_file=data_files/server5-der2.crt \
|
||||
key_file=data_files/server5.key" \
|
||||
"$G_CLI " \
|
||||
"$G_CLI localhost" \
|
||||
0 \
|
||||
-c "Handshake was completed" \
|
||||
|
||||
|
|
@ -2133,7 +2196,7 @@ requires_gnutls
|
|||
run_test "DER format: with 4 trailing random bytes" \
|
||||
"$P_SRV crt_file=data_files/server5-der4.crt \
|
||||
key_file=data_files/server5.key" \
|
||||
"$G_CLI " \
|
||||
"$G_CLI localhost" \
|
||||
0 \
|
||||
-c "Handshake was completed" \
|
||||
|
||||
|
|
@ -2141,7 +2204,7 @@ requires_gnutls
|
|||
run_test "DER format: with 8 trailing random bytes" \
|
||||
"$P_SRV crt_file=data_files/server5-der8.crt \
|
||||
key_file=data_files/server5.key" \
|
||||
"$G_CLI " \
|
||||
"$G_CLI localhost" \
|
||||
0 \
|
||||
-c "Handshake was completed" \
|
||||
|
||||
|
|
@ -2149,7 +2212,7 @@ requires_gnutls
|
|||
run_test "DER format: with 9 trailing random bytes" \
|
||||
"$P_SRV crt_file=data_files/server5-der9.crt \
|
||||
key_file=data_files/server5.key" \
|
||||
"$G_CLI " \
|
||||
"$G_CLI localhost" \
|
||||
0 \
|
||||
-c "Handshake was completed" \
|
||||
|
||||
|
|
@ -3714,14 +3777,14 @@ run_test "Per-version suites: TLS 1.2" \
|
|||
requires_gnutls
|
||||
run_test "ClientHello without extensions, SHA-1 allowed" \
|
||||
"$P_SRV debug_level=3" \
|
||||
"$G_CLI --priority=NORMAL:%NO_EXTENSIONS:%DISABLE_SAFE_RENEGOTIATION" \
|
||||
"$G_CLI --priority=NORMAL:%NO_EXTENSIONS:%DISABLE_SAFE_RENEGOTIATION localhost" \
|
||||
0 \
|
||||
-s "dumping 'client hello extensions' (0 bytes)"
|
||||
|
||||
requires_gnutls
|
||||
run_test "ClientHello without extensions, SHA-1 forbidden in certificates on server" \
|
||||
"$P_SRV debug_level=3 key_file=data_files/server2.key crt_file=data_files/server2.crt allow_sha1=0" \
|
||||
"$G_CLI --priority=NORMAL:%NO_EXTENSIONS:%DISABLE_SAFE_RENEGOTIATION" \
|
||||
"$G_CLI --priority=NORMAL:%NO_EXTENSIONS:%DISABLE_SAFE_RENEGOTIATION localhost" \
|
||||
0 \
|
||||
-s "dumping 'client hello extensions' (0 bytes)"
|
||||
|
||||
|
|
@ -4896,6 +4959,693 @@ run_test "DTLS reassembly: fragmentation, nbio (openssl server)" \
|
|||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
# Tests for sending fragmented handshake messages with DTLS
|
||||
#
|
||||
# Use client auth when we need the client to send large messages,
|
||||
# and use large cert chains on both sides too (the long chains we have all use
|
||||
# both RSA and ECDSA, but ideally we should have long chains with either).
|
||||
# Sizes reached (UDP payload):
|
||||
# - 2037B for server certificate
|
||||
# - 1542B for client certificate
|
||||
# - 1013B for newsessionticket
|
||||
# - all others below 512B
|
||||
# All those tests assume MAX_CONTENT_LEN is at least 2048
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
|
||||
run_test "DTLS fragmenting: none (for reference)" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
max_frag_len=2048" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
max_frag_len=2048" \
|
||||
0 \
|
||||
-S "found fragmented DTLS handshake message" \
|
||||
-C "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
|
||||
run_test "DTLS fragmenting: server only (max_frag_len)" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
max_frag_len=1024" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
max_frag_len=2048" \
|
||||
0 \
|
||||
-S "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
|
||||
run_test "DTLS fragmenting: server only (more) (max_frag_len)" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
max_frag_len=512" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
max_frag_len=2048" \
|
||||
0 \
|
||||
-S "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
|
||||
run_test "DTLS fragmenting: client-initiated, server only (max_frag_len)" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=none \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
max_frag_len=2048" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
max_frag_len=512" \
|
||||
0 \
|
||||
-S "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
|
||||
run_test "DTLS fragmenting: client-initiated, both (max_frag_len)" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
max_frag_len=2048" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
max_frag_len=512" \
|
||||
0 \
|
||||
-s "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
run_test "DTLS fragmenting: none (for reference) (MTU)" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
mtu=2048" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
mtu=2048" \
|
||||
0 \
|
||||
-S "found fragmented DTLS handshake message" \
|
||||
-C "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
run_test "DTLS fragmenting: client (MTU)" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
mtu=2048" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
mtu=512" \
|
||||
0 \
|
||||
-s "found fragmented DTLS handshake message" \
|
||||
-C "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
run_test "DTLS fragmenting: server (MTU)" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
mtu=512" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
mtu=2048" \
|
||||
0 \
|
||||
-S "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
run_test "DTLS fragmenting: both (MTU)" \
|
||||
-p "$P_PXY mtu=512" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
mtu=512" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
mtu=512" \
|
||||
0 \
|
||||
-s "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
# the proxy shouldn't drop or mess up anything, so we shouldn't need to resend
|
||||
# OTOH the client might resend if the server is to slow to reset after sending
|
||||
# a HelloVerifyRequest, so only check for no retransmission server-side
|
||||
not_with_valgrind # spurious resend due to timeout
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
run_test "DTLS fragmenting: proxy MTU, simple handshake" \
|
||||
-p "$P_PXY mtu=512" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
mtu=512" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
mtu=512" \
|
||||
0 \
|
||||
-S "resend" \
|
||||
-s "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
not_with_valgrind # spurious resend due to timeout
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
run_test "DTLS fragmenting: proxy MTU, simple handshake, nbio" \
|
||||
-p "$P_PXY mtu=512" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
mtu=512 nbio=2" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
mtu=512 nbio=2" \
|
||||
0 \
|
||||
-S "resend" \
|
||||
-s "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
# This ensures things still work after session_reset(),
|
||||
# for example it would have caught #1941.
|
||||
# It also exercises the "resumed hanshake" flow.
|
||||
# Since we don't support reading fragmented ClientHello yet,
|
||||
# up the MTU to 1450 (larger than ClientHello with session ticket,
|
||||
# but still smaller than client's Certificate to ensure fragmentation).
|
||||
# reco_delay avoids races where the client reconnects before the server has
|
||||
# resumed listening, which would result in a spurious resend.
|
||||
not_with_valgrind # spurious resend due to timeout
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
run_test "DTLS fragmenting: proxy MTU, resumed handshake" \
|
||||
-p "$P_PXY mtu=1450" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
mtu=1450" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
mtu=1450 reconnect=1 reco_delay=1" \
|
||||
0 \
|
||||
-S "resend" \
|
||||
-s "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
not_with_valgrind # spurious resend due to timeout
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SHA256_C
|
||||
requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA
|
||||
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
|
||||
requires_config_enabled MBEDTLS_CHACHAPOLY_C
|
||||
run_test "DTLS fragmenting: proxy MTU, ChachaPoly renego" \
|
||||
-p "$P_PXY mtu=512" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
exchanges=2 renegotiation=1 \
|
||||
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256 \
|
||||
mtu=512" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
exchanges=2 renegotiation=1 renegotiate=1 \
|
||||
mtu=512" \
|
||||
0 \
|
||||
-S "resend" \
|
||||
-s "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
not_with_valgrind # spurious resend due to timeout
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SHA256_C
|
||||
requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA
|
||||
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
|
||||
requires_config_enabled MBEDTLS_AES_C
|
||||
requires_config_enabled MBEDTLS_GCM_C
|
||||
run_test "DTLS fragmenting: proxy MTU, AES-GCM renego" \
|
||||
-p "$P_PXY mtu=512" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
exchanges=2 renegotiation=1 \
|
||||
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \
|
||||
mtu=512" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
exchanges=2 renegotiation=1 renegotiate=1 \
|
||||
mtu=512" \
|
||||
0 \
|
||||
-S "resend" \
|
||||
-s "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
not_with_valgrind # spurious resend due to timeout
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SHA256_C
|
||||
requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA
|
||||
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
|
||||
requires_config_enabled MBEDTLS_AES_C
|
||||
requires_config_enabled MBEDTLS_CCM_C
|
||||
run_test "DTLS fragmenting: proxy MTU, AES-CCM renego" \
|
||||
-p "$P_PXY mtu=512" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
exchanges=2 renegotiation=1 \
|
||||
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8 \
|
||||
mtu=512" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
exchanges=2 renegotiation=1 renegotiate=1 \
|
||||
mtu=512" \
|
||||
0 \
|
||||
-S "resend" \
|
||||
-s "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
not_with_valgrind # spurious resend due to timeout
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SHA256_C
|
||||
requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA
|
||||
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
|
||||
requires_config_enabled MBEDTLS_AES_C
|
||||
requires_config_enabled MBEDTLS_CIPHER_MODE_CBC
|
||||
requires_config_enabled MBEDTLS_SSL_ENCRYPT_THEN_MAC
|
||||
run_test "DTLS fragmenting: proxy MTU, AES-CBC EtM renego" \
|
||||
-p "$P_PXY mtu=512" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
exchanges=2 renegotiation=1 \
|
||||
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 \
|
||||
mtu=512" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
exchanges=2 renegotiation=1 renegotiate=1 \
|
||||
mtu=512" \
|
||||
0 \
|
||||
-S "resend" \
|
||||
-s "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
not_with_valgrind # spurious resend due to timeout
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SHA256_C
|
||||
requires_config_enabled MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA
|
||||
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
|
||||
requires_config_enabled MBEDTLS_AES_C
|
||||
requires_config_enabled MBEDTLS_CIPHER_MODE_CBC
|
||||
run_test "DTLS fragmenting: proxy MTU, AES-CBC non-EtM renego" \
|
||||
-p "$P_PXY mtu=512" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
exchanges=2 renegotiation=1 \
|
||||
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 etm=0 \
|
||||
mtu=512" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
exchanges=2 renegotiation=1 renegotiate=1 \
|
||||
mtu=512" \
|
||||
0 \
|
||||
-S "resend" \
|
||||
-s "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
client_needs_more_time 2
|
||||
run_test "DTLS fragmenting: proxy MTU + 3d" \
|
||||
-p "$P_PXY mtu=512 drop=8 delay=8 duplicate=8" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
hs_timeout=250-10000 mtu=512" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
hs_timeout=250-10000 mtu=512" \
|
||||
0 \
|
||||
-s "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
client_needs_more_time 2
|
||||
run_test "DTLS fragmenting: proxy MTU + 3d, nbio" \
|
||||
-p "$P_PXY mtu=512 drop=8 delay=8 duplicate=8" \
|
||||
"$P_SRV dtls=1 debug_level=2 auth_mode=required \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
hs_timeout=250-10000 mtu=512 nbio=2" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
hs_timeout=250-10000 mtu=512 nbio=2" \
|
||||
0 \
|
||||
-s "found fragmented DTLS handshake message" \
|
||||
-c "found fragmented DTLS handshake message" \
|
||||
-C "error"
|
||||
|
||||
# interop tests for DTLS fragmentating with reliable connection
|
||||
#
|
||||
# here and below we just want to test that the we fragment in a way that
|
||||
# pleases other implementations, so we don't need the peer to fragment
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
requires_gnutls
|
||||
run_test "DTLS fragmenting: gnutls server, DTLS 1.2" \
|
||||
"$G_SRV -u" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
mtu=512 force_version=dtls1_2" \
|
||||
0 \
|
||||
-c "fragmenting handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1
|
||||
requires_gnutls
|
||||
run_test "DTLS fragmenting: gnutls server, DTLS 1.0" \
|
||||
"$G_SRV -u" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
mtu=512 force_version=dtls1" \
|
||||
0 \
|
||||
-c "fragmenting handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
requires_gnutls
|
||||
run_test "DTLS fragmenting: gnutls client, DTLS 1.2" \
|
||||
"$P_SRV dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
mtu=512 force_version=dtls1_2" \
|
||||
"$G_CLI -u --insecure 127.0.0.1" \
|
||||
0 \
|
||||
-s "fragmenting handshake message"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1
|
||||
requires_gnutls
|
||||
run_test "DTLS fragmenting: gnutls client, DTLS 1.0" \
|
||||
"$P_SRV dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
mtu=512 force_version=dtls1" \
|
||||
"$G_CLI -u --insecure 127.0.0.1" \
|
||||
0 \
|
||||
-s "fragmenting handshake message"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "DTLS fragmenting: openssl server, DTLS 1.2" \
|
||||
"$O_SRV -dtls1_2 -verify 10" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
mtu=512 force_version=dtls1_2" \
|
||||
0 \
|
||||
-c "fragmenting handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1
|
||||
run_test "DTLS fragmenting: openssl server, DTLS 1.0" \
|
||||
"$O_SRV -dtls1 -verify 10" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
mtu=512 force_version=dtls1" \
|
||||
0 \
|
||||
-c "fragmenting handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
run_test "DTLS fragmenting: openssl client, DTLS 1.2" \
|
||||
"$P_SRV dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
mtu=512 force_version=dtls1_2" \
|
||||
"$O_CLI -dtls1_2" \
|
||||
0 \
|
||||
-s "fragmenting handshake message"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1
|
||||
run_test "DTLS fragmenting: openssl client, DTLS 1.0" \
|
||||
"$P_SRV dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
mtu=512 force_version=dtls1" \
|
||||
"$O_CLI -dtls1" \
|
||||
0 \
|
||||
-s "fragmenting handshake message"
|
||||
|
||||
# interop tests for DTLS fragmentating with unreliable connection
|
||||
#
|
||||
# again we just want to test that the we fragment in a way that
|
||||
# pleases other implementations, so we don't need the peer to fragment
|
||||
requires_gnutls_next
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
client_needs_more_time 4
|
||||
run_test "DTLS fragmenting: 3d, gnutls server, DTLS 1.2" \
|
||||
-p "$P_PXY drop=8 delay=8 duplicate=8" \
|
||||
"$G_NEXT_SRV -u" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
hs_timeout=250-60000 mtu=512 force_version=dtls1_2" \
|
||||
0 \
|
||||
-c "fragmenting handshake message" \
|
||||
-C "error"
|
||||
|
||||
requires_gnutls_next
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1
|
||||
client_needs_more_time 4
|
||||
run_test "DTLS fragmenting: 3d, gnutls server, DTLS 1.0" \
|
||||
-p "$P_PXY drop=8 delay=8 duplicate=8" \
|
||||
"$G_NEXT_SRV -u" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
hs_timeout=250-60000 mtu=512 force_version=dtls1" \
|
||||
0 \
|
||||
-c "fragmenting handshake message" \
|
||||
-C "error"
|
||||
|
||||
## The two tests below are disabled due to a bug in GnuTLS client that causes
|
||||
## handshake failures when the NewSessionTicket message is lost, see
|
||||
## https://gitlab.com/gnutls/gnutls/issues/543
|
||||
## We can re-enable them when a fixed version fo GnuTLS is available
|
||||
## and installed in our CI system.
|
||||
##
|
||||
## requires_gnutls
|
||||
## requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
## requires_config_enabled MBEDTLS_RSA_C
|
||||
## requires_config_enabled MBEDTLS_ECDSA_C
|
||||
## requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
## client_needs_more_time 4
|
||||
## run_test "DTLS fragmenting: 3d, gnutls client, DTLS 1.2" \
|
||||
## -p "$P_PXY drop=8 delay=8 duplicate=8" \
|
||||
## "$P_SRV dtls=1 debug_level=2 \
|
||||
## crt_file=data_files/server7_int-ca.crt \
|
||||
## key_file=data_files/server7.key \
|
||||
## hs_timeout=250-60000 mtu=512 force_version=dtls1_2" \
|
||||
## "$G_CLI -u --insecure 127.0.0.1" \
|
||||
## 0 \
|
||||
## -s "fragmenting handshake message"
|
||||
##
|
||||
## requires_gnutls
|
||||
## requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
## requires_config_enabled MBEDTLS_RSA_C
|
||||
## requires_config_enabled MBEDTLS_ECDSA_C
|
||||
## requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1
|
||||
## client_needs_more_time 4
|
||||
## run_test "DTLS fragmenting: 3d, gnutls client, DTLS 1.0" \
|
||||
## -p "$P_PXY drop=8 delay=8 duplicate=8" \
|
||||
## "$P_SRV dtls=1 debug_level=2 \
|
||||
## crt_file=data_files/server7_int-ca.crt \
|
||||
## key_file=data_files/server7.key \
|
||||
## hs_timeout=250-60000 mtu=512 force_version=dtls1" \
|
||||
## "$G_CLI -u --insecure 127.0.0.1" \
|
||||
## 0 \
|
||||
## -s "fragmenting handshake message"
|
||||
|
||||
## Interop test with OpenSSL might triger a bug in recent versions (that
|
||||
## probably won't be fixed before 1.1.1X), so we use an old version that
|
||||
## doesn't have this bug, but unfortunately it doesn't have support for DTLS
|
||||
## 1.2 either, so the DTLS 1.2 tests are commented for now.
|
||||
## Bug report: https://github.com/openssl/openssl/issues/6902
|
||||
## They should be re-enabled (and the DTLS 1.0 switched back to a non-legacy
|
||||
## version of OpenSSL once a fixed version of OpenSSL is available)
|
||||
##
|
||||
## requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
## requires_config_enabled MBEDTLS_RSA_C
|
||||
## requires_config_enabled MBEDTLS_ECDSA_C
|
||||
## requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
## client_needs_more_time 4
|
||||
## run_test "DTLS fragmenting: 3d, openssl server, DTLS 1.2" \
|
||||
## -p "$P_PXY drop=8 delay=8 duplicate=8" \
|
||||
## "$O_SRV -dtls1_2 -verify 10" \
|
||||
## "$P_CLI dtls=1 debug_level=2 \
|
||||
## crt_file=data_files/server8_int-ca2.crt \
|
||||
## key_file=data_files/server8.key \
|
||||
## hs_timeout=250-60000 mtu=512 force_version=dtls1_2" \
|
||||
## 0 \
|
||||
## -c "fragmenting handshake message" \
|
||||
## -C "error"
|
||||
|
||||
requires_openssl_legacy
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1
|
||||
client_needs_more_time 4
|
||||
run_test "DTLS fragmenting: 3d, openssl server, DTLS 1.0" \
|
||||
-p "$P_PXY drop=8 delay=8 duplicate=8" \
|
||||
"$O_LEGACY_SRV -dtls1 -verify 10" \
|
||||
"$P_CLI dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server8_int-ca2.crt \
|
||||
key_file=data_files/server8.key \
|
||||
hs_timeout=250-60000 mtu=512 force_version=dtls1" \
|
||||
0 \
|
||||
-c "fragmenting handshake message" \
|
||||
-C "error"
|
||||
|
||||
## see comment on the previous-previous test
|
||||
## requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
## requires_config_enabled MBEDTLS_RSA_C
|
||||
## requires_config_enabled MBEDTLS_ECDSA_C
|
||||
## requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
|
||||
## client_needs_more_time 4
|
||||
## run_test "DTLS fragmenting: 3d, openssl client, DTLS 1.2" \
|
||||
## -p "$P_PXY drop=8 delay=8 duplicate=8" \
|
||||
## "$P_SRV dtls=1 debug_level=2 \
|
||||
## crt_file=data_files/server7_int-ca.crt \
|
||||
## key_file=data_files/server7.key \
|
||||
## hs_timeout=250-60000 mtu=512 force_version=dtls1_2" \
|
||||
## "$O_CLI -dtls1_2" \
|
||||
## 0 \
|
||||
## -s "fragmenting handshake message"
|
||||
|
||||
# -nbio is added to prevent s_client from blocking in case of duplicated
|
||||
# messages at the end of the handshake
|
||||
requires_openssl_legacy
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
|
||||
requires_config_enabled MBEDTLS_RSA_C
|
||||
requires_config_enabled MBEDTLS_ECDSA_C
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_1
|
||||
client_needs_more_time 4
|
||||
run_test "DTLS fragmenting: 3d, openssl client, DTLS 1.0" \
|
||||
-p "$P_PXY drop=8 delay=8 duplicate=8" \
|
||||
"$P_SRV dtls=1 debug_level=2 \
|
||||
crt_file=data_files/server7_int-ca.crt \
|
||||
key_file=data_files/server7.key \
|
||||
hs_timeout=250-60000 mtu=512 force_version=dtls1" \
|
||||
"$O_LEGACY_CLI -nbio -dtls1" \
|
||||
0 \
|
||||
-s "fragmenting handshake message"
|
||||
|
||||
# Tests for specific things with "unreliable" UDP connection
|
||||
|
||||
not_with_valgrind # spurious resend due to timeout
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue