mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-03-24 01:43:33 +00:00
ssl-opt.sh: TLS 1.3: Run tests with middlebox compatibility enabled
Run tests with middlebox compatibility enabled but tests dedicated to middlebox compatibility disabled. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
This commit is contained in:
Ronald Cron
parent
7e38cba993
commit
fdb0e3f381
File diff suppressed because it is too large
Load Diff
@ -2725,8 +2725,22 @@ component_build_armcc () {
|
||||
|
||||
component_test_tls13_experimental () {
|
||||
msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL enabled, without padding"
|
||||
scripts/config.pl set MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
scripts/config.pl set MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY 1
|
||||
scripts/config.py set MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
scripts/config.py set MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
scripts/config.py set MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY 1
|
||||
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
msg "test: default config with MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL enabled, without padding"
|
||||
make test
|
||||
msg "ssl-opt.sh (TLS 1.3 experimental)"
|
||||
if_build_succeeded tests/ssl-opt.sh
|
||||
}
|
||||
|
||||
component_test_tls13_experimental_no_compatibility_mode () {
|
||||
msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL enabled, without padding"
|
||||
scripts/config.py set MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
scripts/config.py unset MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
scripts/config.py set MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY 1
|
||||
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
msg "test: default config with MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL enabled, without padding"
|
||||
@ -2737,8 +2751,9 @@ component_test_tls13_experimental () {
|
||||
|
||||
component_test_tls13_experimental_with_padding () {
|
||||
msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL enabled, with padding"
|
||||
scripts/config.pl set MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
scripts/config.pl set MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY 16
|
||||
scripts/config.py set MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
scripts/config.py set MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
scripts/config.py set MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY 16
|
||||
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
msg "test: default config with MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL enabled, with padding"
|
||||
@ -2750,6 +2765,7 @@ component_test_tls13_experimental_with_padding () {
|
||||
component_test_tls13_experimental_with_ecp_restartable () {
|
||||
msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL enabled, with ecp_restartable"
|
||||
scripts/config.py set MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
scripts/config.py set MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
scripts/config.py set MBEDTLS_ECP_RESTARTABLE
|
||||
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
@ -2762,6 +2778,7 @@ component_test_tls13_experimental_with_ecp_restartable () {
|
||||
component_test_tls13_experimental_with_everest () {
|
||||
msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL enabled, with Everest"
|
||||
scripts/config.py set MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
scripts/config.py set MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
scripts/config.py set MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED
|
||||
scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
|
||||
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
|
||||
@ -138,7 +138,7 @@ class OpenSSLServ(TLSProgram):
|
||||
"-sigalgs {signature_algorithms}".format(
|
||||
signature_algorithms=signature_algorithms),
|
||||
"-groups {named_groups}".format(named_groups=named_groups)]
|
||||
ret += ['-msg -tls1_3 -no_middlebox -num_tickets 0 -no_resume_ephemeral -no_cache']
|
||||
ret += ['-msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache']
|
||||
return ' '.join(ret)
|
||||
|
||||
def pre_checks(self):
|
||||
@ -221,7 +221,7 @@ class GnuTLSServ(TLSProgram):
|
||||
priority_string_list = ['NONE'] + sorted(priority_string_list) + ['VERS-TLS1.3']
|
||||
|
||||
priority_string = ':+'.join(priority_string_list)
|
||||
priority_string += ':%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE'
|
||||
priority_string += ':%NO_TICKETS'
|
||||
ret += ['--priority={priority_string}'.format(
|
||||
priority_string=priority_string)]
|
||||
ret = ' '.join(ret)
|
||||
@ -272,6 +272,7 @@ class MbedTLSCli(TLSProgram):
|
||||
ret = ['requires_config_enabled MBEDTLS_DEBUG_C',
|
||||
'requires_config_enabled MBEDTLS_SSL_CLI_C',
|
||||
'requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL',
|
||||
'requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE',
|
||||
'requires_config_disabled MBEDTLS_USE_PSA_CRYPTO']
|
||||
if 'rsa_pss_rsae_sha256' in self._sig_algs:
|
||||
ret.append(
|
||||
|
||||
@ -8814,9 +8814,10 @@ run_test "TLS 1.3: handshake dispatch test: tls13 only" \
|
||||
|
||||
requires_openssl_tls1_3
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_disabled MBEDTLS_USE_PSA_CRYPTO
|
||||
run_test "TLS 1.3: minimal feature sets - openssl" \
|
||||
"$O_NEXT_SRV -msg -tls1_3 -no_middlebox -num_tickets 0 -no_resume_ephemeral -no_cache" \
|
||||
"$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache" \
|
||||
"$P_CLI debug_level=3 min_version=tls13 max_version=tls13" \
|
||||
0 \
|
||||
-c "tls13 client state: 0" \
|
||||
@ -8843,11 +8844,11 @@ run_test "TLS 1.3: minimal feature sets - openssl" \
|
||||
|
||||
requires_gnutls_tls1_3
|
||||
requires_gnutls_next_no_ticket
|
||||
requires_gnutls_next_disable_tls13_compat
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_disabled MBEDTLS_USE_PSA_CRYPTO
|
||||
run_test "TLS 1.3: minimal feature sets - gnutls" \
|
||||
"$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE --disable-client-cert" \
|
||||
"$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS --disable-client-cert" \
|
||||
"$P_CLI debug_level=3 min_version=tls13 max_version=tls13" \
|
||||
0 \
|
||||
-s "SERVER HELLO was queued" \
|
||||
@ -8874,6 +8875,7 @@ run_test "TLS 1.3: minimal feature sets - gnutls" \
|
||||
-c "HTTP/1.0 200 OK"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
skip_handshake_stage_check
|
||||
requires_gnutls_tls1_3
|
||||
run_test "TLS 1.3:Not supported version check:gnutls: srv max TLS 1.0" \
|
||||
@ -8886,6 +8888,7 @@ run_test "TLS 1.3:Not supported version check:gnutls: srv max TLS 1.0" \
|
||||
-C "Protocol is TLSv1.0"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
skip_handshake_stage_check
|
||||
requires_gnutls_tls1_3
|
||||
run_test "TLS 1.3:Not supported version check:gnutls: srv max TLS 1.1" \
|
||||
@ -8898,6 +8901,7 @@ run_test "TLS 1.3:Not supported version check:gnutls: srv max TLS 1.1" \
|
||||
-C "Protocol is TLSv1.1"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
skip_handshake_stage_check
|
||||
requires_gnutls_tls1_3
|
||||
run_test "TLS 1.3:Not supported version check:gnutls: srv max TLS 1.2" \
|
||||
@ -8910,6 +8914,7 @@ run_test "TLS 1.3:Not supported version check:gnutls: srv max TLS 1.2" \
|
||||
-C "Protocol is TLSv1.2"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
skip_handshake_stage_check
|
||||
requires_openssl_next
|
||||
run_test "TLS 1.3:Not supported version check:openssl: srv max TLS 1.0" \
|
||||
@ -8922,6 +8927,7 @@ run_test "TLS 1.3:Not supported version check:openssl: srv max TLS 1.0" \
|
||||
-C "Protocol : TLSv1.0"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
skip_handshake_stage_check
|
||||
requires_openssl_next
|
||||
run_test "TLS 1.3:Not supported version check:openssl: srv max TLS 1.1" \
|
||||
@ -8934,6 +8940,7 @@ run_test "TLS 1.3:Not supported version check:openssl: srv max TLS 1.1" \
|
||||
-C "Protocol : TLSv1.1"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
skip_handshake_stage_check
|
||||
requires_openssl_next
|
||||
run_test "TLS 1.3:Not supported version check:openssl: srv max TLS 1.2" \
|
||||
@ -8947,29 +8954,31 @@ run_test "TLS 1.3:Not supported version check:openssl: srv max TLS 1.2" \
|
||||
|
||||
requires_openssl_tls1_3
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_disabled MBEDTLS_USE_PSA_CRYPTO
|
||||
run_test "TLS 1.3: CertificateRequest check - openssl" \
|
||||
"$O_NEXT_SRV -msg -tls1_3 -no_middlebox -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \
|
||||
"$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache -Verify 10" \
|
||||
"$P_CLI debug_level=4 force_version=tls13 " \
|
||||
1 \
|
||||
-c "CertificateRequest not supported"
|
||||
|
||||
requires_gnutls_tls1_3
|
||||
requires_gnutls_next_no_ticket
|
||||
requires_gnutls_next_disable_tls13_compat
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_disabled MBEDTLS_USE_PSA_CRYPTO
|
||||
run_test "TLS 1.3: CertificateRequest check - gnutls" \
|
||||
"$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE" \
|
||||
"$G_NEXT_SRV --debug=4 --priority=NORMAL:-VERS-ALL:+VERS-TLS1.3:+CIPHER-ALL:%NO_TICKETS" \
|
||||
"$P_CLI debug_level=3 min_version=tls13 max_version=tls13" \
|
||||
1 \
|
||||
-c "CertificateRequest not supported"
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_disabled MBEDTLS_USE_PSA_CRYPTO
|
||||
requires_openssl_tls1_3
|
||||
run_test "TLS 1.3: HelloRetryRequest check - openssl" \
|
||||
"$O_NEXT_SRV -ciphersuites TLS_AES_256_GCM_SHA384 -sigalgs ecdsa_secp256r1_sha256 -groups P-256 -msg -tls1_3 -no_middlebox -num_tickets 0 -no_resume_ephemeral -no_cache" \
|
||||
"$O_NEXT_SRV -ciphersuites TLS_AES_256_GCM_SHA384 -sigalgs ecdsa_secp256r1_sha256 -groups P-256 -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache" \
|
||||
"$P_CLI debug_level=4 force_version=tls13" \
|
||||
1 \
|
||||
-c "received HelloRetryRequest message" \
|
||||
@ -8978,22 +8987,43 @@ run_test "TLS 1.3: HelloRetryRequest check - openssl" \
|
||||
|
||||
requires_gnutls_tls1_3
|
||||
requires_gnutls_next_no_ticket
|
||||
requires_gnutls_next_disable_tls13_compat
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_disabled MBEDTLS_USE_PSA_CRYPTO
|
||||
run_test "TLS 1.3: HelloRetryRequest check - gnutls" \
|
||||
"$G_NEXT_SRV -d 4 --priority=NONE:+GROUP-SECP256R1:+AES-256-GCM:+SHA384:+AEAD:+SIGN-ECDSA-SECP256R1-SHA256:+VERS-TLS1.3:%NO_TICKETS:%DISABLE_TLS13_COMPAT_MODE" \
|
||||
"$G_NEXT_SRV -d 4 --priority=NONE:+GROUP-SECP256R1:+AES-256-GCM:+SHA384:+AEAD:+SIGN-ECDSA-SECP256R1-SHA256:+VERS-TLS1.3:%NO_TICKETS" \
|
||||
"$P_CLI debug_level=4 force_version=tls13" \
|
||||
1 \
|
||||
-c "received HelloRetryRequest message" \
|
||||
-c "HRR not supported" \
|
||||
-c "Last error was: -0x6E00 - SSL - The handshake negotiation failed" \
|
||||
-s "HELLO RETRY REQUEST was queued"
|
||||
|
||||
for i in $(ls opt-testcases/*.sh)
|
||||
do
|
||||
. $i
|
||||
done
|
||||
|
||||
requires_openssl_tls1_3
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_disabled MBEDTLS_USE_PSA_CRYPTO
|
||||
run_test "TLS 1.3: client and server do not support middlebox compatibility" \
|
||||
"$O_NEXT_SRV -msg -tls1_3 -no_middlebox -num_tickets 0 -no_resume_ephemeral -no_cache" \
|
||||
"$P_CLI debug_level=3 min_version=tls13 max_version=tls13" \
|
||||
0 \
|
||||
-c "HTTP/1.0 200 ok"
|
||||
|
||||
requires_openssl_tls1_3
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL
|
||||
requires_config_disabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||||
requires_config_disabled MBEDTLS_USE_PSA_CRYPTO
|
||||
run_test "TLS 1.3: client does not support middlebox compatibility but server does" \
|
||||
"$O_NEXT_SRV -msg -tls1_3 -num_tickets 0 -no_resume_ephemeral -no_cache" \
|
||||
"$P_CLI debug_level=3 min_version=tls13 max_version=tls13" \
|
||||
1 \
|
||||
-c "ChangeCipherSpec invalid in TLS 1.3 without compatibility mode"
|
||||
|
||||
# Test heap memory usage after handshake
|
||||
requires_config_enabled MBEDTLS_MEMORY_DEBUG
|
||||
requires_config_enabled MBEDTLS_MEMORY_BUFFER_ALLOC_C
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user