mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-03-28 19:21:08 +00:00
e6fd7d57ca
dtls_client connects to "localhost", which is usually IPv6 on modern systems. On our CI, $OPENSSL is OpenSSL 1.0.2g which doesn't support IPv6. Pitching dtls_client against $OPENSSL works on the CI at the moment, but only because the CI runs in Docker with default network settings which has IPv6 disabled. This would stop working if we changed the CI's Docker setup, and the test case is likely to fail on a developer machine. So switch the test case to using $OPENSSL_NEXT (which is a version of OpenSSL that has IPv6 support). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
383 lines
13 KiB
Bash
383 lines
13 KiB
Bash
# Test that SSL sample programs can interoperate with each other
|
|
# and with OpenSSL and GnuTLS.
|
|
|
|
# Copyright The Mbed TLS Contributors
|
|
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
|
|
|
: ${PROGRAMS_DIR:=../programs/ssl}
|
|
|
|
run_test "Sample: ssl_client1, ssl_server2" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_server2" \
|
|
"$PROGRAMS_DIR/ssl_client1" \
|
|
0 \
|
|
-s "[1-9][0-9]* bytes read" \
|
|
-s "[1-9][0-9]* bytes written" \
|
|
-c "[1-9][0-9]* bytes read" \
|
|
-c "[1-9][0-9]* bytes written" \
|
|
-S "error" \
|
|
-C "error"
|
|
|
|
requires_protocol_version tls12
|
|
run_test "Sample: ssl_client1, openssl server, TLS 1.2" \
|
|
-P 4433 \
|
|
"$O_SRV -tls1_2" \
|
|
"$PROGRAMS_DIR/ssl_client1" \
|
|
0 \
|
|
-c "Protocol.*TLSv1.2" \
|
|
-S "ERROR" \
|
|
-C "error"
|
|
|
|
requires_protocol_version tls12
|
|
run_test "Sample: ssl_client1, gnutls server, TLS 1.2" \
|
|
-P 4433 \
|
|
"$G_SRV --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.2" \
|
|
"$PROGRAMS_DIR/ssl_client1" \
|
|
0 \
|
|
-s "Version: TLS1.2" \
|
|
-c "<TD>Protocol version:</TD><TD>TLS1.2</TD>" \
|
|
-S "Error" \
|
|
-C "error"
|
|
|
|
requires_protocol_version tls13
|
|
requires_openssl_tls1_3
|
|
run_test "Sample: ssl_client1, openssl server, TLS 1.3" \
|
|
-P 4433 \
|
|
"$O_NEXT_SRV -tls1_3" \
|
|
"$PROGRAMS_DIR/ssl_client1" \
|
|
0 \
|
|
-c "New, TLSv1.3, Cipher is" \
|
|
-S "ERROR" \
|
|
-C "error"
|
|
|
|
requires_protocol_version tls13
|
|
requires_gnutls_tls1_3
|
|
run_test "Sample: ssl_client1, gnutls server, TLS 1.3" \
|
|
-P 4433 \
|
|
"$G_NEXT_SRV --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.3" \
|
|
"$PROGRAMS_DIR/ssl_client1" \
|
|
0 \
|
|
-s "Version: TLS1.3" \
|
|
-c "<TD>Protocol version:</TD><TD>TLS1.3</TD>" \
|
|
-S "Error" \
|
|
-C "error"
|
|
|
|
# The server complains of extra data after it closes the connection
|
|
# because the client keeps sending data, so the server receives
|
|
# more application data when it expects a new handshake. We consider
|
|
# the test a success if both sides have sent and received application
|
|
# data, no matter what happens afterwards.
|
|
run_test "Sample: dtls_client, ssl_server2" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_server2 dtls=1 server_addr=localhost" \
|
|
"$PROGRAMS_DIR/dtls_client" \
|
|
0 \
|
|
-s "[1-9][0-9]* bytes read" \
|
|
-s "[1-9][0-9]* bytes written" \
|
|
-c "[1-9][0-9]* bytes read" \
|
|
-c "[1-9][0-9]* bytes written" \
|
|
-C "error"
|
|
|
|
# The dtls_client program connects to localhost. This test case fails on
|
|
# systems where the name "localhost" resolves to an IPv6 address, but
|
|
# the IPv6 connection is not possible. Possible reasons include:
|
|
# * OpenSSL is too old (IPv6 support was added in 1.1.0).
|
|
# * OpenSSL was built without IPv6 support.
|
|
# * A firewall blocks IPv6.
|
|
#
|
|
# To facilitate working with this test case, have it run with $OPENSSL_NEXT
|
|
# which is at least 1.1.1a. At the time it was introduced, this test case
|
|
# passed with OpenSSL 1.0.2g on an environment where IPv6 is disabled.
|
|
requires_protocol_version dtls12
|
|
run_test "Sample: dtls_client, openssl server, DTLS 1.2" \
|
|
-P 4433 \
|
|
"$O_NEXT_SRV -dtls1_2" \
|
|
"$PROGRAMS_DIR/dtls_client" \
|
|
0 \
|
|
-s "Echo this" \
|
|
-c "Echo this" \
|
|
-c "[1-9][0-9]* bytes written" \
|
|
-c "[1-9][0-9]* bytes read" \
|
|
-S "ERROR" \
|
|
-C "error"
|
|
|
|
requires_protocol_version dtls12
|
|
run_test "Sample: dtls_client, gnutls server, DTLS 1.2" \
|
|
-P 4433 \
|
|
"$G_SRV -u --echo --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.2" \
|
|
"$PROGRAMS_DIR/dtls_client" \
|
|
0 \
|
|
-s "Server listening" \
|
|
-s "[1-9][0-9]* bytes command:" \
|
|
-c "Echo this" \
|
|
-c "[1-9][0-9]* bytes written" \
|
|
-c "[1-9][0-9]* bytes read" \
|
|
-S "Error" \
|
|
-C "error"
|
|
|
|
run_test "Sample: ssl_server, ssl_client2" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_server" \
|
|
"$PROGRAMS_DIR/ssl_client2" \
|
|
0 \
|
|
-s "[1-9][0-9]* bytes read" \
|
|
-s "[1-9][0-9]* bytes written" \
|
|
-c "[1-9][0-9]* bytes read" \
|
|
-c "[1-9][0-9]* bytes written" \
|
|
-S "error" \
|
|
-C "error"
|
|
|
|
run_test "Sample: ssl_client1 with ssl_server" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_server" \
|
|
"$PROGRAMS_DIR/ssl_client1" \
|
|
0 \
|
|
-s "[1-9][0-9]* bytes read" \
|
|
-s "[1-9][0-9]* bytes written" \
|
|
-c "[1-9][0-9]* bytes read" \
|
|
-c "[1-9][0-9]* bytes written" \
|
|
-S "error" \
|
|
-C "error"
|
|
|
|
requires_protocol_version tls12
|
|
run_test "Sample: ssl_server, openssl client, TLS 1.2" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_server" \
|
|
"$O_CLI -tls1_2" \
|
|
0 \
|
|
-s "Successful connection using: TLS-" \
|
|
-c "Protocol.*TLSv1.2" \
|
|
-S "error" \
|
|
-C "ERROR"
|
|
|
|
requires_protocol_version tls12
|
|
run_test "Sample: ssl_server, gnutls client, TLS 1.2" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_server" \
|
|
"$G_CLI --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.2 localhost" \
|
|
0 \
|
|
-s "Successful connection using: TLS-" \
|
|
-c "Description:.*TLS1.2" \
|
|
-S "error" \
|
|
-C "ERROR"
|
|
|
|
requires_protocol_version tls13
|
|
requires_openssl_tls1_3
|
|
run_test "Sample: ssl_server, openssl client, TLS 1.3" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_server" \
|
|
"$O_NEXT_CLI -tls1_3" \
|
|
0 \
|
|
-s "Successful connection using: TLS1-3-" \
|
|
-c "New, TLSv1.3, Cipher is" \
|
|
-S "error" \
|
|
-C "ERROR"
|
|
|
|
requires_protocol_version tls13
|
|
requires_gnutls_tls1_3
|
|
run_test "Sample: ssl_server, gnutls client, TLS 1.3" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_server" \
|
|
"$G_NEXT_CLI --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.3 localhost" \
|
|
0 \
|
|
-s "Successful connection using: TLS1-3-" \
|
|
-c "Description:.*TLS1.3" \
|
|
-S "error" \
|
|
-C "ERROR"
|
|
|
|
run_test "Sample: ssl_fork_server, ssl_client2" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_fork_server" \
|
|
"$PROGRAMS_DIR/ssl_client2" \
|
|
0 \
|
|
-s "[1-9][0-9]* bytes read" \
|
|
-s "[1-9][0-9]* bytes written" \
|
|
-c "[1-9][0-9]* bytes read" \
|
|
-c "[1-9][0-9]* bytes written" \
|
|
-S "error" \
|
|
-C "error"
|
|
|
|
run_test "Sample: ssl_client1 with ssl_fork_server" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_fork_server" \
|
|
"$PROGRAMS_DIR/ssl_client1" \
|
|
0 \
|
|
-s "[1-9][0-9]* bytes read" \
|
|
-s "[1-9][0-9]* bytes written" \
|
|
-c "[1-9][0-9]* bytes read" \
|
|
-c "[1-9][0-9]* bytes written" \
|
|
-S "error" \
|
|
-C "error"
|
|
|
|
requires_protocol_version tls12
|
|
run_test "Sample: ssl_fork_server, openssl client, TLS 1.2" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_fork_server" \
|
|
"$O_CLI -tls1_2" \
|
|
0 \
|
|
-s "Successful connection using: TLS-" \
|
|
-c "Protocol.*TLSv1.2" \
|
|
-S "error" \
|
|
-C "ERROR"
|
|
|
|
requires_protocol_version tls12
|
|
run_test "Sample: ssl_fork_server, gnutls client, TLS 1.2" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_fork_server" \
|
|
"$G_CLI --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.2 localhost" \
|
|
0 \
|
|
-s "Successful connection using: TLS-" \
|
|
-c "Description:.*TLS1.2" \
|
|
-S "error" \
|
|
-C "ERROR"
|
|
|
|
requires_protocol_version tls13
|
|
requires_openssl_tls1_3
|
|
run_test "Sample: ssl_fork_server, openssl client, TLS 1.3" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_fork_server" \
|
|
"$O_NEXT_CLI -tls1_3" \
|
|
0 \
|
|
-s "Successful connection using: TLS1-3-" \
|
|
-c "New, TLSv1.3, Cipher is" \
|
|
-S "error" \
|
|
-C "ERROR"
|
|
|
|
requires_protocol_version tls13
|
|
requires_gnutls_tls1_3
|
|
run_test "Sample: ssl_fork_server, gnutls client, TLS 1.3" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_fork_server" \
|
|
"$G_NEXT_CLI --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.3 localhost" \
|
|
0 \
|
|
-s "Successful connection using: TLS1-3-" \
|
|
-c "Description:.*TLS1.3" \
|
|
-S "error" \
|
|
-C "ERROR"
|
|
|
|
run_test "Sample: ssl_pthread_server, ssl_client2" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_pthread_server" \
|
|
"$PROGRAMS_DIR/ssl_client2" \
|
|
0 \
|
|
-s "[1-9][0-9]* bytes read" \
|
|
-s "[1-9][0-9]* bytes written" \
|
|
-c "[1-9][0-9]* bytes read" \
|
|
-c "[1-9][0-9]* bytes written" \
|
|
-S "error" \
|
|
-C "error"
|
|
|
|
run_test "Sample: ssl_client1 with ssl_pthread_server" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_pthread_server" \
|
|
"$PROGRAMS_DIR/ssl_client1" \
|
|
0 \
|
|
-s "[1-9][0-9]* bytes read" \
|
|
-s "[1-9][0-9]* bytes written" \
|
|
-c "[1-9][0-9]* bytes read" \
|
|
-c "[1-9][0-9]* bytes written" \
|
|
-S "error" \
|
|
-C "error"
|
|
|
|
requires_protocol_version tls12
|
|
run_test "Sample: ssl_pthread_server, openssl client, TLS 1.2" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_pthread_server" \
|
|
"$O_CLI -tls1_2" \
|
|
0 \
|
|
-s "Successful connection using: TLS-" \
|
|
-c "Protocol.*TLSv1.2" \
|
|
-S "error" \
|
|
-C "ERROR"
|
|
|
|
requires_protocol_version tls12
|
|
run_test "Sample: ssl_pthread_server, gnutls client, TLS 1.2" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_pthread_server" \
|
|
"$G_CLI --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.2 localhost" \
|
|
0 \
|
|
-s "Successful connection using: TLS-" \
|
|
-c "Description:.*TLS1.2" \
|
|
-S "error" \
|
|
-C "ERROR"
|
|
|
|
requires_protocol_version tls13
|
|
requires_openssl_tls1_3
|
|
run_test "Sample: ssl_pthread_server, openssl client, TLS 1.3" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_pthread_server" \
|
|
"$O_NEXT_CLI -tls1_3" \
|
|
0 \
|
|
-s "Successful connection using: TLS1-3-" \
|
|
-c "New, TLSv1.3, Cipher is" \
|
|
-S "error" \
|
|
-C "ERROR"
|
|
|
|
requires_protocol_version tls13
|
|
requires_gnutls_tls1_3
|
|
run_test "Sample: ssl_pthread_server, gnutls client, TLS 1.3" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/ssl_pthread_server" \
|
|
"$G_NEXT_CLI --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.3 localhost" \
|
|
0 \
|
|
-s "Successful connection using: TLS1-3-" \
|
|
-c "Description:.*TLS1.3" \
|
|
-S "error" \
|
|
-C "ERROR"
|
|
|
|
# The server complains of extra data after it closes the connection
|
|
# because the client keeps sending data, so the server receives
|
|
# more application data when it expects a new handshake. We consider
|
|
# the test a success if both sides have sent and received application
|
|
# data, no matter what happens afterwards.
|
|
run_test "Sample: dtls_client with dtls_server" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/dtls_server" \
|
|
"$PROGRAMS_DIR/dtls_client" \
|
|
0 \
|
|
-s "[1-9][0-9]* bytes read" \
|
|
-s "[1-9][0-9]* bytes written" \
|
|
-c "[1-9][0-9]* bytes read" \
|
|
-c "[1-9][0-9]* bytes written" \
|
|
-C "error"
|
|
|
|
# The server complains of extra data after it closes the connection
|
|
# because the client keeps sending data, so the server receives
|
|
# more application data when it expects a new handshake. We consider
|
|
# the test a success if both sides have sent and received application
|
|
# data, no matter what happens afterwards.
|
|
run_test "Sample: ssl_client2, dtls_server" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/dtls_server" \
|
|
"$PROGRAMS_DIR/ssl_client2 dtls=1" \
|
|
0 \
|
|
-s "[1-9][0-9]* bytes read" \
|
|
-s "[1-9][0-9]* bytes written" \
|
|
-c "[1-9][0-9]* bytes read" \
|
|
-c "[1-9][0-9]* bytes written" \
|
|
-C "error"
|
|
|
|
requires_protocol_version dtls12
|
|
run_test "Sample: dtls_server, openssl client, DTLS 1.2" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/dtls_server" \
|
|
"$O_CLI -dtls1_2" \
|
|
0 \
|
|
-s "[1-9][0-9]* bytes read" \
|
|
-s "[1-9][0-9]* bytes written" \
|
|
-c "Protocol.*TLSv1.2" \
|
|
-S "error" \
|
|
-C "ERROR"
|
|
|
|
requires_protocol_version dtls12
|
|
run_test "Sample: dtls_server, gnutls client, DTLS 1.2" \
|
|
-P 4433 \
|
|
"$PROGRAMS_DIR/dtls_server" \
|
|
"$G_CLI -u --priority=NORMAL:-VERS-TLS-ALL:+VERS-TLS1.2 localhost" \
|
|
0 \
|
|
-s "[1-9][0-9]* bytes read" \
|
|
-s "[1-9][0-9]* bytes written" \
|
|
-c "Description:.*DTLS1.2" \
|
|
-S "error" \
|
|
-C "ERROR"
|