2014-08-31 08:22:11 +00:00
|
|
|
#!/bin/sh
|
2013-07-19 11:41:51 +00:00
|
|
|
|
2016-09-04 21:31:09 +00:00
|
|
|
# compat.sh
|
|
|
|
#
|
|
|
|
# Copyright (c) 2012-2016, ARM Limited, All Rights Reserved
|
Update license headers to Apache-2.0 OR GPL-2.0-or-later
This will allow us to ship the LTS branches in a single archive
This commit was generated using the following script:
# ========================
#!/bin/sh
header1='\ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later\
*\
* This file is provided under the Apache License 2.0, or the\
* GNU General Public License v2.0 or later.\
*\
* **********\
* Apache License 2.0:\
*\
* Licensed under the Apache License, Version 2.0 (the "License"); you may\
* not use this file except in compliance with the License.\
* You may obtain a copy of the License at\
*\
* http://www.apache.org/licenses/LICENSE-2.0\
*\
* Unless required by applicable law or agreed to in writing, software\
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT\
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\
* See the License for the specific language governing permissions and\
* limitations under the License.\
*\
* **********\
*\
* **********\
* GNU General Public License v2.0 or later:\
*\
* This program is free software; you can redistribute it and/or modify\
* it under the terms of the GNU General Public License as published by\
* the Free Software Foundation; either version 2 of the License, or\
* (at your option) any later version.\
*\
* This program is distributed in the hope that it will be useful,\
* but WITHOUT ANY WARRANTY; without even the implied warranty of\
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\
* GNU General Public License for more details.\
*\
* You should have received a copy of the GNU General Public License along\
* with this program; if not, write to the Free Software Foundation, Inc.,\
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.\
*\
* **********'
find -path './.git' -prune -o '(' -name '*.c' -o -name '*.cpp' -o -name '*.fmt' -o -name '*.h' ')' -print | xargs sed -i "
# Normalize the first line of the copyright headers (no text on the first line of a block comment)
/^\/\*.*Copyright.*Arm/I s/\/\*/&\n */
# Insert new copyright header
/SPDX-License-Identifier/ i\
$header1
# Delete old copyright header
/SPDX-License-Identifier/,$ {
# Delete lines until the one preceding the mbedtls declaration
N
1,/This file is part of/ {
/This file is part of/! D
}
}
"
# Format copyright header for inclusion into scripts
header2=$(echo "$header1" | sed 's/^\\\? \* \?/#/')
find -path './.git' -prune -o '(' -name '*.gdb' -o -name '*.pl' -o -name '*.py' -o -name '*.sh' ')' -print | xargs sed -i "
# Insert new copyright header
/SPDX-License-Identifier/ i\
$header2
# Delete old copyright header
/SPDX-License-Identifier/,$ {
# Delete lines until the one preceding the mbedtls declaration
N
1,/This file is part of/ {
/This file is part of/! D
}
}
"
# ========================
Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-06-05 11:02:18 +00:00
|
|
|
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
|
|
|
#
|
|
|
|
# This file is provided under the Apache License 2.0, or the
|
|
|
|
# GNU General Public License v2.0 or later.
|
|
|
|
#
|
|
|
|
# **********
|
|
|
|
# Apache License 2.0:
|
2020-05-25 23:54:15 +00:00
|
|
|
#
|
|
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
|
|
# not use this file except in compliance with the License.
|
|
|
|
# You may obtain a copy of the License at
|
|
|
|
#
|
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
#
|
|
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
# See the License for the specific language governing permissions and
|
|
|
|
# limitations under the License.
|
|
|
|
#
|
Update license headers to Apache-2.0 OR GPL-2.0-or-later
This will allow us to ship the LTS branches in a single archive
This commit was generated using the following script:
# ========================
#!/bin/sh
header1='\ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later\
*\
* This file is provided under the Apache License 2.0, or the\
* GNU General Public License v2.0 or later.\
*\
* **********\
* Apache License 2.0:\
*\
* Licensed under the Apache License, Version 2.0 (the "License"); you may\
* not use this file except in compliance with the License.\
* You may obtain a copy of the License at\
*\
* http://www.apache.org/licenses/LICENSE-2.0\
*\
* Unless required by applicable law or agreed to in writing, software\
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT\
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\
* See the License for the specific language governing permissions and\
* limitations under the License.\
*\
* **********\
*\
* **********\
* GNU General Public License v2.0 or later:\
*\
* This program is free software; you can redistribute it and/or modify\
* it under the terms of the GNU General Public License as published by\
* the Free Software Foundation; either version 2 of the License, or\
* (at your option) any later version.\
*\
* This program is distributed in the hope that it will be useful,\
* but WITHOUT ANY WARRANTY; without even the implied warranty of\
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\
* GNU General Public License for more details.\
*\
* You should have received a copy of the GNU General Public License along\
* with this program; if not, write to the Free Software Foundation, Inc.,\
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.\
*\
* **********'
find -path './.git' -prune -o '(' -name '*.c' -o -name '*.cpp' -o -name '*.fmt' -o -name '*.h' ')' -print | xargs sed -i "
# Normalize the first line of the copyright headers (no text on the first line of a block comment)
/^\/\*.*Copyright.*Arm/I s/\/\*/&\n */
# Insert new copyright header
/SPDX-License-Identifier/ i\
$header1
# Delete old copyright header
/SPDX-License-Identifier/,$ {
# Delete lines until the one preceding the mbedtls declaration
N
1,/This file is part of/ {
/This file is part of/! D
}
}
"
# Format copyright header for inclusion into scripts
header2=$(echo "$header1" | sed 's/^\\\? \* \?/#/')
find -path './.git' -prune -o '(' -name '*.gdb' -o -name '*.pl' -o -name '*.py' -o -name '*.sh' ')' -print | xargs sed -i "
# Insert new copyright header
/SPDX-License-Identifier/ i\
$header2
# Delete old copyright header
/SPDX-License-Identifier/,$ {
# Delete lines until the one preceding the mbedtls declaration
N
1,/This file is part of/ {
/This file is part of/! D
}
}
"
# ========================
Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-06-05 11:02:18 +00:00
|
|
|
# **********
|
|
|
|
#
|
|
|
|
# **********
|
|
|
|
# GNU General Public License v2.0 or later:
|
|
|
|
#
|
|
|
|
# This program is free software; you can redistribute it and/or modify
|
|
|
|
# it under the terms of the GNU General Public License as published by
|
|
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
|
|
# (at your option) any later version.
|
|
|
|
#
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License along
|
|
|
|
# with this program; if not, write to the Free Software Foundation, Inc.,
|
|
|
|
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
|
|
#
|
|
|
|
# **********
|
|
|
|
#
|
2020-05-25 23:54:15 +00:00
|
|
|
# This file is part of Mbed TLS (https://tls.mbed.org)
|
2016-09-04 21:31:09 +00:00
|
|
|
#
|
|
|
|
# Purpose
|
|
|
|
#
|
|
|
|
# Test interoperbility with OpenSSL, GnuTLS as well as itself.
|
2014-03-25 18:07:28 +00:00
|
|
|
#
|
|
|
|
# Check each common ciphersuite, with each version, both ways (client/server),
|
|
|
|
# with and without client authentication.
|
2014-02-20 10:01:30 +00:00
|
|
|
|
2014-03-28 09:12:38 +00:00
|
|
|
set -u
|
|
|
|
|
2019-07-03 12:51:04 +00:00
|
|
|
# Limit the size of each log to 10 GiB, in case of failures with this script
|
|
|
|
# where it may output seemingly unlimited length error logs.
|
|
|
|
ulimit -f 20971520
|
|
|
|
|
2014-03-25 17:04:59 +00:00
|
|
|
# initialise counters
|
2014-08-31 08:22:11 +00:00
|
|
|
TESTS=0
|
|
|
|
FAILED=0
|
|
|
|
SKIPPED=0
|
|
|
|
SRVMEM=0
|
2013-08-27 20:00:47 +00:00
|
|
|
|
2019-01-23 14:24:37 +00:00
|
|
|
# default commands, can be overridden by the environment
|
2016-09-04 21:31:09 +00:00
|
|
|
: ${M_SRV:=../programs/ssl/ssl_server2}
|
|
|
|
: ${M_CLI:=../programs/ssl/ssl_client2}
|
2014-03-13 17:47:44 +00:00
|
|
|
: ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system
|
|
|
|
: ${GNUTLS_CLI:=gnutls-cli}
|
|
|
|
: ${GNUTLS_SERV:=gnutls-serv}
|
2014-02-27 11:25:54 +00:00
|
|
|
|
2014-08-31 14:20:58 +00:00
|
|
|
# do we have a recent enough GnuTLS?
|
2015-06-26 13:45:30 +00:00
|
|
|
if ( which $GNUTLS_CLI && which $GNUTLS_SERV ) >/dev/null 2>&1; then
|
2014-10-24 10:57:37 +00:00
|
|
|
G_VER="$( $GNUTLS_CLI --version | head -n1 )"
|
|
|
|
if echo "$G_VER" | grep '@VERSION@' > /dev/null; then # git version
|
2014-08-31 14:20:58 +00:00
|
|
|
PEER_GNUTLS=" GnuTLS"
|
2014-10-24 10:57:37 +00:00
|
|
|
else
|
|
|
|
eval $( echo $G_VER | sed 's/.* \([0-9]*\)\.\([0-9]\)*\.\([0-9]*\)$/MAJOR="\1" MINOR="\2" PATCH="\3"/' )
|
|
|
|
if [ $MAJOR -lt 3 -o \
|
|
|
|
\( $MAJOR -eq 3 -a $MINOR -lt 2 \) -o \
|
|
|
|
\( $MAJOR -eq 3 -a $MINOR -eq 2 -a $PATCH -lt 15 \) ]
|
|
|
|
then
|
|
|
|
PEER_GNUTLS=""
|
|
|
|
else
|
|
|
|
PEER_GNUTLS=" GnuTLS"
|
|
|
|
fi
|
2014-08-31 14:20:58 +00:00
|
|
|
fi
|
|
|
|
else
|
|
|
|
PEER_GNUTLS=""
|
|
|
|
fi
|
|
|
|
|
2014-03-25 17:04:59 +00:00
|
|
|
# default values for options
|
2016-03-07 23:22:10 +00:00
|
|
|
MODES="tls1 tls1_1 tls1_2 dtls1 dtls1_2"
|
2012-11-23 13:25:34 +00:00
|
|
|
VERIFIES="NO YES"
|
2013-08-27 19:03:33 +00:00
|
|
|
TYPES="ECDSA RSA PSK"
|
2013-07-19 11:41:51 +00:00
|
|
|
FILTER=""
|
2019-01-08 21:42:27 +00:00
|
|
|
# exclude:
|
|
|
|
# - NULL: excluded from our default config
|
|
|
|
# - RC4, single-DES: requires legacy OpenSSL/GnuTLS versions
|
|
|
|
# avoid plain DES but keep 3DES-EDE-CBC (mbedTLS), DES-CBC3 (OpenSSL)
|
2019-02-11 21:47:30 +00:00
|
|
|
# - 3DES: not in default config
|
2019-02-19 20:20:57 +00:00
|
|
|
EXCLUDE='NULL\|DES\|RC4\|ARCFOUR'
|
2013-07-19 11:41:51 +00:00
|
|
|
VERBOSE=""
|
2014-02-27 14:37:24 +00:00
|
|
|
MEMCHECK=0
|
2015-01-22 16:43:54 +00:00
|
|
|
PEERS="OpenSSL$PEER_GNUTLS mbedTLS"
|
2013-07-19 11:41:51 +00:00
|
|
|
|
2015-08-04 14:43:37 +00:00
|
|
|
# hidden option: skip DTLS with OpenSSL
|
|
|
|
# (travis CI has a version that doesn't work for us)
|
|
|
|
: ${OSSL_NO_DTLS:=0}
|
|
|
|
|
2014-02-26 17:21:02 +00:00
|
|
|
print_usage() {
|
|
|
|
echo "Usage: $0"
|
2014-12-11 10:51:28 +00:00
|
|
|
printf " -h|--help\tPrint this help.\n"
|
|
|
|
printf " -f|--filter\tOnly matching ciphersuites are tested (Default: '$FILTER')\n"
|
|
|
|
printf " -e|--exclude\tMatching ciphersuites are excluded (Default: '$EXCLUDE')\n"
|
|
|
|
printf " -m|--modes\tWhich modes to perform (Default: '$MODES')\n"
|
|
|
|
printf " -t|--types\tWhich key exchange type to perform (Default: '$TYPES')\n"
|
|
|
|
printf " -V|--verify\tWhich verification modes to perform (Default: '$VERIFIES')\n"
|
|
|
|
printf " -p|--peers\tWhich peers to use (Default: '$PEERS')\n"
|
|
|
|
printf " \tAlso available: GnuTLS (needs v3.2.15 or higher)\n"
|
|
|
|
printf " -M|--memcheck\tCheck memory leaks and errors.\n"
|
|
|
|
printf " -v|--verbose\tSet verbose output.\n"
|
2014-02-26 17:21:02 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
get_options() {
|
|
|
|
while [ $# -gt 0 ]; do
|
|
|
|
case "$1" in
|
|
|
|
-f|--filter)
|
|
|
|
shift; FILTER=$1
|
|
|
|
;;
|
2014-03-13 16:45:35 +00:00
|
|
|
-e|--exclude)
|
|
|
|
shift; EXCLUDE=$1
|
|
|
|
;;
|
2014-02-26 17:21:02 +00:00
|
|
|
-m|--modes)
|
|
|
|
shift; MODES=$1
|
|
|
|
;;
|
|
|
|
-t|--types)
|
|
|
|
shift; TYPES=$1
|
|
|
|
;;
|
|
|
|
-V|--verify)
|
|
|
|
shift; VERIFIES=$1
|
|
|
|
;;
|
2014-03-13 16:45:35 +00:00
|
|
|
-p|--peers)
|
|
|
|
shift; PEERS=$1
|
|
|
|
;;
|
2014-02-26 17:21:02 +00:00
|
|
|
-v|--verbose)
|
|
|
|
VERBOSE=1
|
|
|
|
;;
|
2014-02-27 14:37:24 +00:00
|
|
|
-M|--memcheck)
|
|
|
|
MEMCHECK=1
|
|
|
|
;;
|
2014-02-26 17:21:02 +00:00
|
|
|
-h|--help)
|
|
|
|
print_usage
|
|
|
|
exit 0
|
|
|
|
;;
|
|
|
|
*)
|
|
|
|
echo "Unknown argument: '$1'"
|
|
|
|
print_usage
|
|
|
|
exit 1
|
|
|
|
;;
|
|
|
|
esac
|
|
|
|
shift
|
|
|
|
done
|
2014-10-24 10:47:26 +00:00
|
|
|
|
|
|
|
# sanitize some options (modes checked later)
|
|
|
|
VERIFIES="$( echo $VERIFIES | tr [a-z] [A-Z] )"
|
|
|
|
TYPES="$( echo $TYPES | tr [a-z] [A-Z] )"
|
2014-02-26 17:21:02 +00:00
|
|
|
}
|
2013-07-19 11:41:51 +00:00
|
|
|
|
2014-02-19 14:29:38 +00:00
|
|
|
log() {
|
2013-07-19 11:41:51 +00:00
|
|
|
if [ "X" != "X$VERBOSE" ]; then
|
2014-03-26 14:30:16 +00:00
|
|
|
echo ""
|
2013-07-19 11:41:51 +00:00
|
|
|
echo "$@"
|
|
|
|
fi
|
|
|
|
}
|
2012-04-12 21:26:34 +00:00
|
|
|
|
2014-03-26 14:30:16 +00:00
|
|
|
# is_dtls <mode>
|
|
|
|
is_dtls()
|
|
|
|
{
|
|
|
|
test "$1" = "dtls1" -o "$1" = "dtls1_2"
|
|
|
|
}
|
|
|
|
|
|
|
|
# minor_ver <mode>
|
|
|
|
minor_ver()
|
|
|
|
{
|
|
|
|
case "$1" in
|
|
|
|
ssl3)
|
|
|
|
echo 0
|
|
|
|
;;
|
|
|
|
tls1)
|
|
|
|
echo 1
|
|
|
|
;;
|
|
|
|
tls1_1|dtls1)
|
|
|
|
echo 2
|
|
|
|
;;
|
|
|
|
tls1_2|dtls1_2)
|
|
|
|
echo 3
|
|
|
|
;;
|
|
|
|
*)
|
|
|
|
echo "error: invalid mode: $MODE" >&2
|
|
|
|
# exiting is no good here, typically called in a subshell
|
|
|
|
echo -1
|
|
|
|
esac
|
|
|
|
}
|
|
|
|
|
2013-08-27 18:48:40 +00:00
|
|
|
filter()
|
|
|
|
{
|
2014-03-13 16:45:35 +00:00
|
|
|
LIST="$1"
|
2013-08-27 18:48:40 +00:00
|
|
|
NEW_LIST=""
|
|
|
|
|
2014-03-26 14:30:16 +00:00
|
|
|
if is_dtls "$MODE"; then
|
2014-07-10 18:12:56 +00:00
|
|
|
EXCLMODE="$EXCLUDE"'\|RC4\|ARCFOUR'
|
2014-03-26 14:30:16 +00:00
|
|
|
else
|
|
|
|
EXCLMODE="$EXCLUDE"
|
|
|
|
fi
|
|
|
|
|
2013-08-27 18:48:40 +00:00
|
|
|
for i in $LIST;
|
|
|
|
do
|
2014-03-26 14:30:16 +00:00
|
|
|
NEW_LIST="$NEW_LIST $( echo "$i" | grep "$FILTER" | grep -v "$EXCLMODE" )"
|
2013-08-27 18:48:40 +00:00
|
|
|
done
|
|
|
|
|
2014-02-27 10:50:40 +00:00
|
|
|
# normalize whitespace
|
2014-12-11 10:51:28 +00:00
|
|
|
echo "$NEW_LIST" | sed -e 's/[[:space:]][[:space:]]*/ /g' -e 's/^ //' -e 's/ $//'
|
2013-08-27 18:48:40 +00:00
|
|
|
}
|
|
|
|
|
2014-07-11 15:41:24 +00:00
|
|
|
# OpenSSL 1.0.1h with -Verify wants a ClientCertificate message even for
|
|
|
|
# PSK ciphersuites with DTLS, which is incorrect, so disable them for now
|
|
|
|
check_openssl_server_bug()
|
|
|
|
{
|
|
|
|
if test "X$VERIFY" = "XYES" && is_dtls "$MODE" && \
|
|
|
|
echo "$1" | grep "^TLS-PSK" >/dev/null;
|
|
|
|
then
|
|
|
|
SKIP_NEXT="YES"
|
|
|
|
fi
|
|
|
|
}
|
|
|
|
|
2014-02-28 11:42:57 +00:00
|
|
|
filter_ciphersuites()
|
|
|
|
{
|
2014-03-13 16:45:35 +00:00
|
|
|
if [ "X" != "X$FILTER" -o "X" != "X$EXCLUDE" ];
|
2014-02-28 11:42:57 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
# Ciphersuite for mbed TLS
|
|
|
|
M_CIPHERS=$( filter "$M_CIPHERS" )
|
|
|
|
|
|
|
|
# Ciphersuite for OpenSSL
|
2014-03-13 16:45:35 +00:00
|
|
|
O_CIPHERS=$( filter "$O_CIPHERS" )
|
2016-09-04 21:31:09 +00:00
|
|
|
|
|
|
|
# Ciphersuite for GnuTLS
|
2014-03-13 16:45:35 +00:00
|
|
|
G_CIPHERS=$( filter "$G_CIPHERS" )
|
2014-02-28 11:42:57 +00:00
|
|
|
fi
|
2014-07-10 18:12:56 +00:00
|
|
|
|
2019-08-10 15:38:34 +00:00
|
|
|
# OpenSSL <1.0.2 doesn't support DTLS 1.2. Check what OpenSSL
|
|
|
|
# supports from the s_server help. (The s_client help isn't
|
|
|
|
# accurate as of 1.0.2g: it supports DTLS 1.2 but doesn't list it.
|
|
|
|
# But the s_server help seems to be accurate.)
|
|
|
|
if ! $OPENSSL_CMD s_server -help 2>&1 | grep -q "^ *-$MODE "; then
|
|
|
|
M_CIPHERS=""
|
2014-07-10 18:12:56 +00:00
|
|
|
O_CIPHERS=""
|
|
|
|
fi
|
|
|
|
|
2015-01-23 11:33:38 +00:00
|
|
|
# For GnuTLS client -> mbed TLS server,
|
2014-07-11 15:01:06 +00:00
|
|
|
# we need to force IPv4 by connecting to 127.0.0.1 but then auth fails
|
2014-07-10 18:12:56 +00:00
|
|
|
if [ "X$VERIFY" = "XYES" ] && is_dtls "$MODE"; then
|
|
|
|
G_CIPHERS=""
|
|
|
|
fi
|
2014-02-28 11:42:57 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
reset_ciphersuites()
|
2014-02-19 12:51:58 +00:00
|
|
|
{
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS=""
|
2014-02-19 12:51:58 +00:00
|
|
|
O_CIPHERS=""
|
2014-02-28 11:42:57 +00:00
|
|
|
G_CIPHERS=""
|
|
|
|
}
|
2014-02-19 12:51:58 +00:00
|
|
|
|
2014-03-25 18:07:28 +00:00
|
|
|
add_common_ciphersuites()
|
2014-02-28 11:42:57 +00:00
|
|
|
{
|
2014-02-19 12:51:58 +00:00
|
|
|
case $TYPE in
|
|
|
|
|
|
|
|
"ECDSA")
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -gt 0 ]
|
2014-02-19 12:51:58 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-19 12:51:58 +00:00
|
|
|
TLS-ECDHE-ECDSA-WITH-NULL-SHA \
|
|
|
|
TLS-ECDHE-ECDSA-WITH-RC4-128-SHA \
|
|
|
|
TLS-ECDHE-ECDSA-WITH-3DES-EDE-CBC-SHA \
|
|
|
|
TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA \
|
|
|
|
TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA \
|
2014-03-25 18:07:28 +00:00
|
|
|
"
|
|
|
|
G_CIPHERS="$G_CIPHERS \
|
|
|
|
+ECDHE-ECDSA:+NULL:+SHA1 \
|
|
|
|
+ECDHE-ECDSA:+ARCFOUR-128:+SHA1 \
|
|
|
|
+ECDHE-ECDSA:+3DES-CBC:+SHA1 \
|
|
|
|
+ECDHE-ECDSA:+AES-128-CBC:+SHA1 \
|
|
|
|
+ECDHE-ECDSA:+AES-256-CBC:+SHA1 \
|
2014-02-19 12:51:58 +00:00
|
|
|
"
|
|
|
|
O_CIPHERS="$O_CIPHERS \
|
|
|
|
ECDHE-ECDSA-NULL-SHA \
|
|
|
|
ECDHE-ECDSA-RC4-SHA \
|
|
|
|
ECDHE-ECDSA-DES-CBC3-SHA \
|
|
|
|
ECDHE-ECDSA-AES128-SHA \
|
|
|
|
ECDHE-ECDSA-AES256-SHA \
|
|
|
|
"
|
|
|
|
fi
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -ge 3 ]
|
2014-02-19 12:51:58 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-19 12:51:58 +00:00
|
|
|
TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256 \
|
|
|
|
TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384 \
|
|
|
|
TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \
|
|
|
|
TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 \
|
2014-03-25 18:07:28 +00:00
|
|
|
"
|
|
|
|
G_CIPHERS="$G_CIPHERS \
|
|
|
|
+ECDHE-ECDSA:+AES-128-CBC:+SHA256 \
|
|
|
|
+ECDHE-ECDSA:+AES-256-CBC:+SHA384 \
|
|
|
|
+ECDHE-ECDSA:+AES-128-GCM:+AEAD \
|
|
|
|
+ECDHE-ECDSA:+AES-256-GCM:+AEAD \
|
2014-02-19 12:51:58 +00:00
|
|
|
"
|
|
|
|
O_CIPHERS="$O_CIPHERS \
|
|
|
|
ECDHE-ECDSA-AES128-SHA256 \
|
|
|
|
ECDHE-ECDSA-AES256-SHA384 \
|
|
|
|
ECDHE-ECDSA-AES128-GCM-SHA256 \
|
|
|
|
ECDHE-ECDSA-AES256-GCM-SHA384 \
|
|
|
|
"
|
|
|
|
fi
|
|
|
|
;;
|
|
|
|
|
|
|
|
"RSA")
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-19 12:51:58 +00:00
|
|
|
TLS-DHE-RSA-WITH-AES-128-CBC-SHA \
|
|
|
|
TLS-DHE-RSA-WITH-AES-256-CBC-SHA \
|
|
|
|
TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA \
|
|
|
|
TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA \
|
|
|
|
TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA \
|
|
|
|
TLS-RSA-WITH-AES-256-CBC-SHA \
|
|
|
|
TLS-RSA-WITH-CAMELLIA-256-CBC-SHA \
|
|
|
|
TLS-RSA-WITH-AES-128-CBC-SHA \
|
|
|
|
TLS-RSA-WITH-CAMELLIA-128-CBC-SHA \
|
|
|
|
TLS-RSA-WITH-3DES-EDE-CBC-SHA \
|
|
|
|
TLS-RSA-WITH-RC4-128-SHA \
|
|
|
|
TLS-RSA-WITH-RC4-128-MD5 \
|
|
|
|
TLS-RSA-WITH-NULL-MD5 \
|
|
|
|
TLS-RSA-WITH-NULL-SHA \
|
2014-03-25 18:07:28 +00:00
|
|
|
"
|
|
|
|
G_CIPHERS="$G_CIPHERS \
|
|
|
|
+DHE-RSA:+AES-128-CBC:+SHA1 \
|
|
|
|
+DHE-RSA:+AES-256-CBC:+SHA1 \
|
|
|
|
+DHE-RSA:+CAMELLIA-128-CBC:+SHA1 \
|
|
|
|
+DHE-RSA:+CAMELLIA-256-CBC:+SHA1 \
|
|
|
|
+DHE-RSA:+3DES-CBC:+SHA1 \
|
|
|
|
+RSA:+AES-256-CBC:+SHA1 \
|
|
|
|
+RSA:+CAMELLIA-256-CBC:+SHA1 \
|
|
|
|
+RSA:+AES-128-CBC:+SHA1 \
|
|
|
|
+RSA:+CAMELLIA-128-CBC:+SHA1 \
|
|
|
|
+RSA:+3DES-CBC:+SHA1 \
|
|
|
|
+RSA:+ARCFOUR-128:+SHA1 \
|
|
|
|
+RSA:+ARCFOUR-128:+MD5 \
|
|
|
|
+RSA:+NULL:+MD5 \
|
|
|
|
+RSA:+NULL:+SHA1 \
|
2014-02-19 12:51:58 +00:00
|
|
|
"
|
|
|
|
O_CIPHERS="$O_CIPHERS \
|
|
|
|
DHE-RSA-AES128-SHA \
|
|
|
|
DHE-RSA-AES256-SHA \
|
|
|
|
DHE-RSA-CAMELLIA128-SHA \
|
|
|
|
DHE-RSA-CAMELLIA256-SHA \
|
|
|
|
EDH-RSA-DES-CBC3-SHA \
|
|
|
|
AES256-SHA \
|
|
|
|
CAMELLIA256-SHA \
|
|
|
|
AES128-SHA \
|
|
|
|
CAMELLIA128-SHA \
|
|
|
|
DES-CBC3-SHA \
|
|
|
|
RC4-SHA \
|
|
|
|
RC4-MD5 \
|
|
|
|
NULL-MD5 \
|
|
|
|
NULL-SHA \
|
|
|
|
"
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -gt 0 ]
|
2014-02-19 12:51:58 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-19 12:51:58 +00:00
|
|
|
TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA \
|
|
|
|
TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA \
|
|
|
|
TLS-ECDHE-RSA-WITH-3DES-EDE-CBC-SHA \
|
|
|
|
TLS-ECDHE-RSA-WITH-RC4-128-SHA \
|
|
|
|
TLS-ECDHE-RSA-WITH-NULL-SHA \
|
|
|
|
"
|
2014-03-25 18:07:28 +00:00
|
|
|
G_CIPHERS="$G_CIPHERS \
|
|
|
|
+ECDHE-RSA:+AES-128-CBC:+SHA1 \
|
|
|
|
+ECDHE-RSA:+AES-256-CBC:+SHA1 \
|
|
|
|
+ECDHE-RSA:+3DES-CBC:+SHA1 \
|
|
|
|
+ECDHE-RSA:+ARCFOUR-128:+SHA1 \
|
|
|
|
+ECDHE-RSA:+NULL:+SHA1 \
|
|
|
|
"
|
2014-02-19 12:51:58 +00:00
|
|
|
O_CIPHERS="$O_CIPHERS \
|
|
|
|
ECDHE-RSA-AES256-SHA \
|
|
|
|
ECDHE-RSA-AES128-SHA \
|
|
|
|
ECDHE-RSA-DES-CBC3-SHA \
|
|
|
|
ECDHE-RSA-RC4-SHA \
|
|
|
|
ECDHE-RSA-NULL-SHA \
|
|
|
|
"
|
|
|
|
fi
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -ge 3 ]
|
2014-02-19 12:51:58 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-19 12:51:58 +00:00
|
|
|
TLS-RSA-WITH-AES-128-CBC-SHA256 \
|
|
|
|
TLS-DHE-RSA-WITH-AES-128-CBC-SHA256 \
|
|
|
|
TLS-RSA-WITH-AES-256-CBC-SHA256 \
|
|
|
|
TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 \
|
|
|
|
TLS-ECDHE-RSA-WITH-AES-128-CBC-SHA256 \
|
|
|
|
TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384 \
|
|
|
|
TLS-RSA-WITH-AES-128-GCM-SHA256 \
|
|
|
|
TLS-RSA-WITH-AES-256-GCM-SHA384 \
|
|
|
|
TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 \
|
|
|
|
TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 \
|
|
|
|
TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256 \
|
|
|
|
TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 \
|
|
|
|
"
|
2014-03-25 18:07:28 +00:00
|
|
|
G_CIPHERS="$G_CIPHERS \
|
|
|
|
+RSA:+AES-128-CBC:+SHA256 \
|
|
|
|
+DHE-RSA:+AES-128-CBC:+SHA256 \
|
|
|
|
+RSA:+AES-256-CBC:+SHA256 \
|
|
|
|
+DHE-RSA:+AES-256-CBC:+SHA256 \
|
|
|
|
+ECDHE-RSA:+AES-128-CBC:+SHA256 \
|
|
|
|
+ECDHE-RSA:+AES-256-CBC:+SHA384 \
|
|
|
|
+RSA:+AES-128-GCM:+AEAD \
|
|
|
|
+RSA:+AES-256-GCM:+AEAD \
|
|
|
|
+DHE-RSA:+AES-128-GCM:+AEAD \
|
|
|
|
+DHE-RSA:+AES-256-GCM:+AEAD \
|
|
|
|
+ECDHE-RSA:+AES-128-GCM:+AEAD \
|
|
|
|
+ECDHE-RSA:+AES-256-GCM:+AEAD \
|
|
|
|
"
|
2014-02-19 12:51:58 +00:00
|
|
|
O_CIPHERS="$O_CIPHERS \
|
|
|
|
NULL-SHA256 \
|
|
|
|
AES128-SHA256 \
|
|
|
|
DHE-RSA-AES128-SHA256 \
|
|
|
|
AES256-SHA256 \
|
|
|
|
DHE-RSA-AES256-SHA256 \
|
|
|
|
ECDHE-RSA-AES128-SHA256 \
|
|
|
|
ECDHE-RSA-AES256-SHA384 \
|
|
|
|
AES128-GCM-SHA256 \
|
|
|
|
DHE-RSA-AES128-GCM-SHA256 \
|
|
|
|
AES256-GCM-SHA384 \
|
|
|
|
DHE-RSA-AES256-GCM-SHA384 \
|
|
|
|
ECDHE-RSA-AES128-GCM-SHA256 \
|
|
|
|
ECDHE-RSA-AES256-GCM-SHA384 \
|
|
|
|
"
|
|
|
|
fi
|
|
|
|
;;
|
|
|
|
|
|
|
|
"PSK")
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-19 12:51:58 +00:00
|
|
|
TLS-PSK-WITH-RC4-128-SHA \
|
|
|
|
TLS-PSK-WITH-3DES-EDE-CBC-SHA \
|
|
|
|
TLS-PSK-WITH-AES-128-CBC-SHA \
|
|
|
|
TLS-PSK-WITH-AES-256-CBC-SHA \
|
|
|
|
"
|
2014-03-25 18:07:28 +00:00
|
|
|
G_CIPHERS="$G_CIPHERS \
|
|
|
|
+PSK:+ARCFOUR-128:+SHA1 \
|
|
|
|
+PSK:+3DES-CBC:+SHA1 \
|
|
|
|
+PSK:+AES-128-CBC:+SHA1 \
|
|
|
|
+PSK:+AES-256-CBC:+SHA1 \
|
|
|
|
"
|
2014-02-19 12:51:58 +00:00
|
|
|
O_CIPHERS="$O_CIPHERS \
|
|
|
|
PSK-RC4-SHA \
|
|
|
|
PSK-3DES-EDE-CBC-SHA \
|
|
|
|
PSK-AES128-CBC-SHA \
|
|
|
|
PSK-AES256-CBC-SHA \
|
|
|
|
"
|
|
|
|
;;
|
|
|
|
esac
|
|
|
|
}
|
|
|
|
|
2014-03-25 18:07:28 +00:00
|
|
|
add_openssl_ciphersuites()
|
|
|
|
{
|
|
|
|
case $TYPE in
|
|
|
|
|
|
|
|
"ECDSA")
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -gt 0 ]
|
2014-03-25 18:07:28 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-03-25 18:07:28 +00:00
|
|
|
TLS-ECDH-ECDSA-WITH-NULL-SHA \
|
|
|
|
TLS-ECDH-ECDSA-WITH-RC4-128-SHA \
|
|
|
|
TLS-ECDH-ECDSA-WITH-3DES-EDE-CBC-SHA \
|
|
|
|
TLS-ECDH-ECDSA-WITH-AES-128-CBC-SHA \
|
|
|
|
TLS-ECDH-ECDSA-WITH-AES-256-CBC-SHA \
|
|
|
|
"
|
|
|
|
O_CIPHERS="$O_CIPHERS \
|
|
|
|
ECDH-ECDSA-NULL-SHA \
|
|
|
|
ECDH-ECDSA-RC4-SHA \
|
|
|
|
ECDH-ECDSA-DES-CBC3-SHA \
|
|
|
|
ECDH-ECDSA-AES128-SHA \
|
|
|
|
ECDH-ECDSA-AES256-SHA \
|
|
|
|
"
|
|
|
|
fi
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -ge 3 ]
|
2014-03-25 18:07:28 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-03-25 18:07:28 +00:00
|
|
|
TLS-ECDH-ECDSA-WITH-AES-128-CBC-SHA256 \
|
|
|
|
TLS-ECDH-ECDSA-WITH-AES-256-CBC-SHA384 \
|
|
|
|
TLS-ECDH-ECDSA-WITH-AES-128-GCM-SHA256 \
|
|
|
|
TLS-ECDH-ECDSA-WITH-AES-256-GCM-SHA384 \
|
|
|
|
"
|
|
|
|
O_CIPHERS="$O_CIPHERS \
|
|
|
|
ECDH-ECDSA-AES128-SHA256 \
|
|
|
|
ECDH-ECDSA-AES256-SHA384 \
|
|
|
|
ECDH-ECDSA-AES128-GCM-SHA256 \
|
|
|
|
ECDH-ECDSA-AES256-GCM-SHA384 \
|
|
|
|
"
|
|
|
|
fi
|
|
|
|
;;
|
|
|
|
|
|
|
|
"RSA")
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-03-25 18:07:28 +00:00
|
|
|
TLS-RSA-WITH-DES-CBC-SHA \
|
|
|
|
TLS-DHE-RSA-WITH-DES-CBC-SHA \
|
|
|
|
"
|
|
|
|
O_CIPHERS="$O_CIPHERS \
|
|
|
|
DES-CBC-SHA \
|
|
|
|
EDH-RSA-DES-CBC-SHA \
|
|
|
|
"
|
|
|
|
;;
|
|
|
|
|
|
|
|
"PSK")
|
|
|
|
;;
|
|
|
|
esac
|
|
|
|
}
|
|
|
|
|
2014-02-28 11:42:57 +00:00
|
|
|
add_gnutls_ciphersuites()
|
2014-02-19 12:51:58 +00:00
|
|
|
{
|
|
|
|
case $TYPE in
|
|
|
|
|
|
|
|
"ECDSA")
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -ge 3 ]
|
2014-02-19 12:51:58 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-19 12:51:58 +00:00
|
|
|
TLS-ECDHE-ECDSA-WITH-CAMELLIA-128-CBC-SHA256 \
|
|
|
|
TLS-ECDHE-ECDSA-WITH-CAMELLIA-256-CBC-SHA384 \
|
|
|
|
TLS-ECDHE-ECDSA-WITH-CAMELLIA-128-GCM-SHA256 \
|
|
|
|
TLS-ECDHE-ECDSA-WITH-CAMELLIA-256-GCM-SHA384 \
|
2014-03-13 15:21:59 +00:00
|
|
|
"
|
|
|
|
G_CIPHERS="$G_CIPHERS \
|
|
|
|
+ECDHE-ECDSA:+CAMELLIA-128-CBC:+SHA256 \
|
|
|
|
+ECDHE-ECDSA:+CAMELLIA-256-CBC:+SHA384 \
|
|
|
|
+ECDHE-ECDSA:+CAMELLIA-128-GCM:+AEAD \
|
|
|
|
+ECDHE-ECDSA:+CAMELLIA-256-GCM:+AEAD \
|
|
|
|
"
|
2014-02-19 12:51:58 +00:00
|
|
|
fi
|
|
|
|
;;
|
|
|
|
|
|
|
|
"RSA")
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -gt 0 ]
|
2014-07-13 11:57:24 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-07-13 11:57:24 +00:00
|
|
|
TLS-RSA-WITH-NULL-SHA256 \
|
|
|
|
"
|
|
|
|
G_CIPHERS="$G_CIPHERS \
|
|
|
|
+RSA:+NULL:+SHA256 \
|
|
|
|
"
|
|
|
|
fi
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -ge 3 ]
|
2014-02-19 12:51:58 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-19 12:51:58 +00:00
|
|
|
TLS-ECDHE-RSA-WITH-CAMELLIA-128-CBC-SHA256 \
|
|
|
|
TLS-ECDHE-RSA-WITH-CAMELLIA-256-CBC-SHA384 \
|
|
|
|
TLS-RSA-WITH-CAMELLIA-128-CBC-SHA256 \
|
|
|
|
TLS-RSA-WITH-CAMELLIA-256-CBC-SHA256 \
|
|
|
|
TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA256 \
|
|
|
|
TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA256 \
|
|
|
|
TLS-ECDHE-RSA-WITH-CAMELLIA-128-GCM-SHA256 \
|
|
|
|
TLS-ECDHE-RSA-WITH-CAMELLIA-256-GCM-SHA384 \
|
|
|
|
TLS-DHE-RSA-WITH-CAMELLIA-128-GCM-SHA256 \
|
|
|
|
TLS-DHE-RSA-WITH-CAMELLIA-256-GCM-SHA384 \
|
|
|
|
TLS-RSA-WITH-CAMELLIA-128-GCM-SHA256 \
|
|
|
|
TLS-RSA-WITH-CAMELLIA-256-GCM-SHA384 \
|
2014-03-13 15:21:59 +00:00
|
|
|
"
|
|
|
|
G_CIPHERS="$G_CIPHERS \
|
|
|
|
+ECDHE-RSA:+CAMELLIA-128-CBC:+SHA256 \
|
|
|
|
+ECDHE-RSA:+CAMELLIA-256-CBC:+SHA384 \
|
|
|
|
+RSA:+CAMELLIA-128-CBC:+SHA256 \
|
|
|
|
+RSA:+CAMELLIA-256-CBC:+SHA256 \
|
|
|
|
+DHE-RSA:+CAMELLIA-128-CBC:+SHA256 \
|
|
|
|
+DHE-RSA:+CAMELLIA-256-CBC:+SHA256 \
|
|
|
|
+ECDHE-RSA:+CAMELLIA-128-GCM:+AEAD \
|
|
|
|
+ECDHE-RSA:+CAMELLIA-256-GCM:+AEAD \
|
|
|
|
+DHE-RSA:+CAMELLIA-128-GCM:+AEAD \
|
|
|
|
+DHE-RSA:+CAMELLIA-256-GCM:+AEAD \
|
|
|
|
+RSA:+CAMELLIA-128-GCM:+AEAD \
|
|
|
|
+RSA:+CAMELLIA-256-GCM:+AEAD \
|
2014-02-19 12:51:58 +00:00
|
|
|
"
|
|
|
|
fi
|
|
|
|
;;
|
|
|
|
|
|
|
|
"PSK")
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-07-13 13:44:19 +00:00
|
|
|
TLS-DHE-PSK-WITH-3DES-EDE-CBC-SHA \
|
|
|
|
TLS-DHE-PSK-WITH-AES-128-CBC-SHA \
|
|
|
|
TLS-DHE-PSK-WITH-AES-256-CBC-SHA \
|
|
|
|
TLS-DHE-PSK-WITH-RC4-128-SHA \
|
|
|
|
"
|
|
|
|
G_CIPHERS="$G_CIPHERS \
|
|
|
|
+DHE-PSK:+3DES-CBC:+SHA1 \
|
|
|
|
+DHE-PSK:+AES-128-CBC:+SHA1 \
|
|
|
|
+DHE-PSK:+AES-256-CBC:+SHA1 \
|
|
|
|
+DHE-PSK:+ARCFOUR-128:+SHA1 \
|
|
|
|
"
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -gt 0 ]
|
2014-02-19 12:51:58 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-19 12:51:58 +00:00
|
|
|
TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA \
|
|
|
|
TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA \
|
|
|
|
TLS-ECDHE-PSK-WITH-3DES-EDE-CBC-SHA \
|
2014-07-13 13:44:19 +00:00
|
|
|
TLS-ECDHE-PSK-WITH-RC4-128-SHA \
|
2014-02-28 11:42:57 +00:00
|
|
|
TLS-RSA-PSK-WITH-3DES-EDE-CBC-SHA \
|
|
|
|
TLS-RSA-PSK-WITH-AES-256-CBC-SHA \
|
|
|
|
TLS-RSA-PSK-WITH-AES-128-CBC-SHA \
|
2014-07-13 13:44:19 +00:00
|
|
|
TLS-RSA-PSK-WITH-RC4-128-SHA \
|
2014-03-13 15:21:59 +00:00
|
|
|
"
|
|
|
|
G_CIPHERS="$G_CIPHERS \
|
|
|
|
+ECDHE-PSK:+3DES-CBC:+SHA1 \
|
2014-07-13 13:44:19 +00:00
|
|
|
+ECDHE-PSK:+AES-128-CBC:+SHA1 \
|
|
|
|
+ECDHE-PSK:+AES-256-CBC:+SHA1 \
|
|
|
|
+ECDHE-PSK:+ARCFOUR-128:+SHA1 \
|
2014-03-13 15:21:59 +00:00
|
|
|
+RSA-PSK:+3DES-CBC:+SHA1 \
|
|
|
|
+RSA-PSK:+AES-256-CBC:+SHA1 \
|
|
|
|
+RSA-PSK:+AES-128-CBC:+SHA1 \
|
2014-07-13 13:44:19 +00:00
|
|
|
+RSA-PSK:+ARCFOUR-128:+SHA1 \
|
2014-02-28 11:42:57 +00:00
|
|
|
"
|
|
|
|
fi
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -ge 3 ]
|
2014-02-28 11:42:57 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-19 12:51:58 +00:00
|
|
|
TLS-ECDHE-PSK-WITH-AES-256-CBC-SHA384 \
|
|
|
|
TLS-ECDHE-PSK-WITH-CAMELLIA-256-CBC-SHA384 \
|
|
|
|
TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 \
|
|
|
|
TLS-ECDHE-PSK-WITH-CAMELLIA-128-CBC-SHA256 \
|
|
|
|
TLS-ECDHE-PSK-WITH-NULL-SHA384 \
|
|
|
|
TLS-ECDHE-PSK-WITH-NULL-SHA256 \
|
2014-02-28 11:42:57 +00:00
|
|
|
TLS-PSK-WITH-AES-128-CBC-SHA256 \
|
|
|
|
TLS-PSK-WITH-AES-256-CBC-SHA384 \
|
|
|
|
TLS-DHE-PSK-WITH-AES-128-CBC-SHA256 \
|
|
|
|
TLS-DHE-PSK-WITH-AES-256-CBC-SHA384 \
|
|
|
|
TLS-PSK-WITH-NULL-SHA256 \
|
|
|
|
TLS-PSK-WITH-NULL-SHA384 \
|
|
|
|
TLS-DHE-PSK-WITH-NULL-SHA256 \
|
|
|
|
TLS-DHE-PSK-WITH-NULL-SHA384 \
|
|
|
|
TLS-RSA-PSK-WITH-AES-256-CBC-SHA384 \
|
|
|
|
TLS-RSA-PSK-WITH-AES-128-CBC-SHA256 \
|
|
|
|
TLS-RSA-PSK-WITH-NULL-SHA256 \
|
|
|
|
TLS-RSA-PSK-WITH-NULL-SHA384 \
|
|
|
|
TLS-DHE-PSK-WITH-CAMELLIA-128-CBC-SHA256 \
|
|
|
|
TLS-DHE-PSK-WITH-CAMELLIA-256-CBC-SHA384 \
|
|
|
|
TLS-PSK-WITH-CAMELLIA-128-CBC-SHA256 \
|
|
|
|
TLS-PSK-WITH-CAMELLIA-256-CBC-SHA384 \
|
|
|
|
TLS-RSA-PSK-WITH-CAMELLIA-256-CBC-SHA384 \
|
|
|
|
TLS-RSA-PSK-WITH-CAMELLIA-128-CBC-SHA256 \
|
2014-02-19 12:51:58 +00:00
|
|
|
TLS-PSK-WITH-AES-128-GCM-SHA256 \
|
|
|
|
TLS-PSK-WITH-AES-256-GCM-SHA384 \
|
|
|
|
TLS-DHE-PSK-WITH-AES-128-GCM-SHA256 \
|
|
|
|
TLS-DHE-PSK-WITH-AES-256-GCM-SHA384 \
|
|
|
|
TLS-RSA-PSK-WITH-CAMELLIA-128-GCM-SHA256 \
|
|
|
|
TLS-RSA-PSK-WITH-CAMELLIA-256-GCM-SHA384 \
|
|
|
|
TLS-PSK-WITH-CAMELLIA-128-GCM-SHA256 \
|
|
|
|
TLS-PSK-WITH-CAMELLIA-256-GCM-SHA384 \
|
|
|
|
TLS-DHE-PSK-WITH-CAMELLIA-128-GCM-SHA256 \
|
|
|
|
TLS-DHE-PSK-WITH-CAMELLIA-256-GCM-SHA384 \
|
|
|
|
TLS-RSA-PSK-WITH-AES-256-GCM-SHA384 \
|
|
|
|
TLS-RSA-PSK-WITH-AES-128-GCM-SHA256 \
|
|
|
|
"
|
2014-03-13 15:21:59 +00:00
|
|
|
G_CIPHERS="$G_CIPHERS \
|
|
|
|
+ECDHE-PSK:+AES-256-CBC:+SHA384 \
|
|
|
|
+ECDHE-PSK:+CAMELLIA-256-CBC:+SHA384 \
|
|
|
|
+ECDHE-PSK:+AES-128-CBC:+SHA256 \
|
|
|
|
+ECDHE-PSK:+CAMELLIA-128-CBC:+SHA256 \
|
|
|
|
+PSK:+AES-128-CBC:+SHA256 \
|
|
|
|
+PSK:+AES-256-CBC:+SHA384 \
|
|
|
|
+DHE-PSK:+AES-128-CBC:+SHA256 \
|
|
|
|
+DHE-PSK:+AES-256-CBC:+SHA384 \
|
|
|
|
+RSA-PSK:+AES-256-CBC:+SHA384 \
|
|
|
|
+RSA-PSK:+AES-128-CBC:+SHA256 \
|
|
|
|
+DHE-PSK:+CAMELLIA-128-CBC:+SHA256 \
|
|
|
|
+DHE-PSK:+CAMELLIA-256-CBC:+SHA384 \
|
|
|
|
+PSK:+CAMELLIA-128-CBC:+SHA256 \
|
|
|
|
+PSK:+CAMELLIA-256-CBC:+SHA384 \
|
|
|
|
+RSA-PSK:+CAMELLIA-256-CBC:+SHA384 \
|
|
|
|
+RSA-PSK:+CAMELLIA-128-CBC:+SHA256 \
|
|
|
|
+PSK:+AES-128-GCM:+AEAD \
|
|
|
|
+PSK:+AES-256-GCM:+AEAD \
|
|
|
|
+DHE-PSK:+AES-128-GCM:+AEAD \
|
|
|
|
+DHE-PSK:+AES-256-GCM:+AEAD \
|
|
|
|
+RSA-PSK:+CAMELLIA-128-GCM:+AEAD \
|
|
|
|
+RSA-PSK:+CAMELLIA-256-GCM:+AEAD \
|
|
|
|
+PSK:+CAMELLIA-128-GCM:+AEAD \
|
|
|
|
+PSK:+CAMELLIA-256-GCM:+AEAD \
|
|
|
|
+DHE-PSK:+CAMELLIA-128-GCM:+AEAD \
|
|
|
|
+DHE-PSK:+CAMELLIA-256-GCM:+AEAD \
|
|
|
|
+RSA-PSK:+AES-256-GCM:+AEAD \
|
|
|
|
+RSA-PSK:+AES-128-GCM:+AEAD \
|
2014-03-13 16:45:35 +00:00
|
|
|
+ECDHE-PSK:+NULL:+SHA384 \
|
|
|
|
+ECDHE-PSK:+NULL:+SHA256 \
|
|
|
|
+PSK:+NULL:+SHA256 \
|
|
|
|
+PSK:+NULL:+SHA384 \
|
|
|
|
+DHE-PSK:+NULL:+SHA256 \
|
|
|
|
+DHE-PSK:+NULL:+SHA384 \
|
|
|
|
+RSA-PSK:+NULL:+SHA256 \
|
|
|
|
+RSA-PSK:+NULL:+SHA384 \
|
2014-03-13 15:21:59 +00:00
|
|
|
"
|
2014-02-19 12:51:58 +00:00
|
|
|
fi
|
|
|
|
;;
|
|
|
|
esac
|
2014-02-28 11:42:57 +00:00
|
|
|
}
|
2014-02-19 12:51:58 +00:00
|
|
|
|
2015-04-08 10:49:31 +00:00
|
|
|
add_mbedtls_ciphersuites()
|
2014-02-28 11:42:57 +00:00
|
|
|
{
|
|
|
|
case $TYPE in
|
|
|
|
|
|
|
|
"ECDSA")
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -gt 0 ]
|
2014-02-28 11:42:57 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-28 11:42:57 +00:00
|
|
|
TLS-ECDH-ECDSA-WITH-CAMELLIA-128-CBC-SHA256 \
|
|
|
|
TLS-ECDH-ECDSA-WITH-CAMELLIA-256-CBC-SHA384 \
|
|
|
|
"
|
|
|
|
fi
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -ge 3 ]
|
2014-02-28 11:42:57 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-28 11:42:57 +00:00
|
|
|
TLS-ECDH-ECDSA-WITH-CAMELLIA-128-GCM-SHA256 \
|
|
|
|
TLS-ECDH-ECDSA-WITH-CAMELLIA-256-GCM-SHA384 \
|
2014-05-22 12:36:02 +00:00
|
|
|
TLS-ECDHE-ECDSA-WITH-AES-128-CCM \
|
|
|
|
TLS-ECDHE-ECDSA-WITH-AES-256-CCM \
|
|
|
|
TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8 \
|
|
|
|
TLS-ECDHE-ECDSA-WITH-AES-256-CCM-8 \
|
2014-02-28 11:42:57 +00:00
|
|
|
"
|
|
|
|
fi
|
|
|
|
;;
|
|
|
|
|
|
|
|
"RSA")
|
2014-05-22 12:36:02 +00:00
|
|
|
if [ "$MODE" = "tls1_2" ];
|
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-05-22 12:36:02 +00:00
|
|
|
TLS-RSA-WITH-AES-128-CCM \
|
|
|
|
TLS-RSA-WITH-AES-256-CCM \
|
|
|
|
TLS-DHE-RSA-WITH-AES-128-CCM \
|
|
|
|
TLS-DHE-RSA-WITH-AES-256-CCM \
|
|
|
|
TLS-RSA-WITH-AES-128-CCM-8 \
|
|
|
|
TLS-RSA-WITH-AES-256-CCM-8 \
|
|
|
|
TLS-DHE-RSA-WITH-AES-128-CCM-8 \
|
|
|
|
TLS-DHE-RSA-WITH-AES-256-CCM-8 \
|
|
|
|
"
|
|
|
|
fi
|
2014-02-28 11:42:57 +00:00
|
|
|
;;
|
|
|
|
|
|
|
|
"PSK")
|
2015-07-07 09:54:14 +00:00
|
|
|
# *PSK-NULL-SHA suites supported by GnuTLS 3.3.5 but not 3.2.15
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-28 11:42:57 +00:00
|
|
|
TLS-PSK-WITH-NULL-SHA \
|
|
|
|
TLS-DHE-PSK-WITH-NULL-SHA \
|
|
|
|
"
|
2014-03-26 14:30:16 +00:00
|
|
|
if [ `minor_ver "$MODE"` -gt 0 ]
|
2014-02-28 11:42:57 +00:00
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-02-28 11:42:57 +00:00
|
|
|
TLS-ECDHE-PSK-WITH-NULL-SHA \
|
2014-07-13 13:44:19 +00:00
|
|
|
TLS-RSA-PSK-WITH-NULL-SHA \
|
2014-02-28 11:42:57 +00:00
|
|
|
"
|
|
|
|
fi
|
2014-05-22 12:36:02 +00:00
|
|
|
if [ "$MODE" = "tls1_2" ];
|
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CIPHERS="$M_CIPHERS \
|
2014-05-22 12:36:02 +00:00
|
|
|
TLS-PSK-WITH-AES-128-CCM \
|
|
|
|
TLS-PSK-WITH-AES-256-CCM \
|
|
|
|
TLS-DHE-PSK-WITH-AES-128-CCM \
|
|
|
|
TLS-DHE-PSK-WITH-AES-256-CCM \
|
|
|
|
TLS-PSK-WITH-AES-128-CCM-8 \
|
|
|
|
TLS-PSK-WITH-AES-256-CCM-8 \
|
|
|
|
TLS-DHE-PSK-WITH-AES-128-CCM-8 \
|
|
|
|
TLS-DHE-PSK-WITH-AES-256-CCM-8 \
|
|
|
|
"
|
|
|
|
fi
|
2014-02-28 11:42:57 +00:00
|
|
|
;;
|
|
|
|
esac
|
2014-02-19 12:51:58 +00:00
|
|
|
}
|
|
|
|
|
2014-02-19 12:35:52 +00:00
|
|
|
setup_arguments()
|
|
|
|
{
|
2014-03-26 14:30:16 +00:00
|
|
|
G_MODE=""
|
|
|
|
case "$MODE" in
|
2014-02-28 11:42:57 +00:00
|
|
|
"ssl3")
|
|
|
|
G_PRIO_MODE="+VERS-SSL3.0"
|
|
|
|
;;
|
|
|
|
"tls1")
|
|
|
|
G_PRIO_MODE="+VERS-TLS1.0"
|
|
|
|
;;
|
|
|
|
"tls1_1")
|
|
|
|
G_PRIO_MODE="+VERS-TLS1.1"
|
|
|
|
;;
|
|
|
|
"tls1_2")
|
|
|
|
G_PRIO_MODE="+VERS-TLS1.2"
|
2014-02-19 13:24:24 +00:00
|
|
|
;;
|
2014-03-26 14:30:16 +00:00
|
|
|
"dtls1")
|
|
|
|
G_PRIO_MODE="+VERS-DTLS1.0"
|
2014-09-26 14:33:45 +00:00
|
|
|
G_MODE="-u"
|
2014-03-26 14:30:16 +00:00
|
|
|
;;
|
|
|
|
"dtls1_2")
|
|
|
|
G_PRIO_MODE="+VERS-DTLS1.2"
|
2014-09-26 14:33:45 +00:00
|
|
|
G_MODE="-u"
|
2014-03-26 14:30:16 +00:00
|
|
|
;;
|
2014-02-19 13:24:24 +00:00
|
|
|
*)
|
|
|
|
echo "error: invalid mode: $MODE" >&2
|
|
|
|
exit 1;
|
|
|
|
esac
|
|
|
|
|
2016-09-04 21:31:09 +00:00
|
|
|
M_SERVER_ARGS="server_port=$PORT server_addr=0.0.0.0 force_version=$MODE arc4=1"
|
2015-06-18 15:54:58 +00:00
|
|
|
O_SERVER_ARGS="-accept $PORT -cipher NULL,ALL -$MODE -dhparam data_files/dhparams.pem"
|
2014-03-26 14:30:16 +00:00
|
|
|
G_SERVER_ARGS="-p $PORT --http $G_MODE"
|
2015-04-30 10:15:16 +00:00
|
|
|
G_SERVER_PRIO="NORMAL:+ARCFOUR-128:+NULL:+MD5:+PSK:+DHE-PSK:+ECDHE-PSK:+RSA-PSK:-VERS-TLS-ALL:$G_PRIO_MODE"
|
2014-02-28 11:42:57 +00:00
|
|
|
|
2014-07-11 15:01:06 +00:00
|
|
|
# with OpenSSL 1.0.1h, -www, -WWW and -HTTP break DTLS handshakes
|
|
|
|
if is_dtls "$MODE"; then
|
2014-09-26 14:33:45 +00:00
|
|
|
O_SERVER_ARGS="$O_SERVER_ARGS"
|
2014-07-11 15:01:06 +00:00
|
|
|
else
|
|
|
|
O_SERVER_ARGS="$O_SERVER_ARGS -www"
|
|
|
|
fi
|
|
|
|
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CLIENT_ARGS="server_port=$PORT server_addr=127.0.0.1 force_version=$MODE"
|
2014-05-28 20:59:30 +00:00
|
|
|
O_CLIENT_ARGS="-connect localhost:$PORT -$MODE"
|
2014-03-26 14:30:16 +00:00
|
|
|
G_CLIENT_ARGS="-p $PORT --debug 3 $G_MODE"
|
2014-03-13 15:21:59 +00:00
|
|
|
G_CLIENT_PRIO="NONE:$G_PRIO_MODE:+COMP-NULL:+CURVE-ALL:+SIGN-ALL"
|
2014-02-19 13:24:24 +00:00
|
|
|
|
2014-02-19 12:35:52 +00:00
|
|
|
if [ "X$VERIFY" = "XYES" ];
|
|
|
|
then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_SERVER_ARGS="$M_SERVER_ARGS ca_file=data_files/test-ca_cat12.crt auth_mode=required"
|
2014-02-19 13:24:24 +00:00
|
|
|
O_SERVER_ARGS="$O_SERVER_ARGS -CAfile data_files/test-ca_cat12.crt -Verify 10"
|
2014-02-28 11:42:57 +00:00
|
|
|
G_SERVER_ARGS="$G_SERVER_ARGS --x509cafile data_files/test-ca_cat12.crt --require-client-cert"
|
|
|
|
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CLIENT_ARGS="$M_CLIENT_ARGS ca_file=data_files/test-ca_cat12.crt auth_mode=required"
|
2014-02-21 09:10:20 +00:00
|
|
|
O_CLIENT_ARGS="$O_CLIENT_ARGS -CAfile data_files/test-ca_cat12.crt -verify 10"
|
2014-03-13 15:21:59 +00:00
|
|
|
G_CLIENT_ARGS="$G_CLIENT_ARGS --x509cafile data_files/test-ca_cat12.crt"
|
2014-02-21 09:10:20 +00:00
|
|
|
else
|
2014-02-28 11:42:57 +00:00
|
|
|
# don't request a client cert at all
|
2016-09-04 21:31:09 +00:00
|
|
|
M_SERVER_ARGS="$M_SERVER_ARGS ca_file=none auth_mode=none"
|
2014-02-28 11:42:57 +00:00
|
|
|
G_SERVER_ARGS="$G_SERVER_ARGS --disable-client-cert"
|
|
|
|
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CLIENT_ARGS="$M_CLIENT_ARGS ca_file=none auth_mode=none"
|
2014-03-19 16:34:52 +00:00
|
|
|
O_CLIENT_ARGS="$O_CLIENT_ARGS"
|
|
|
|
G_CLIENT_ARGS="$G_CLIENT_ARGS --insecure"
|
2014-02-19 12:35:52 +00:00
|
|
|
fi
|
|
|
|
|
|
|
|
case $TYPE in
|
|
|
|
"ECDSA")
|
2016-09-04 21:31:09 +00:00
|
|
|
M_SERVER_ARGS="$M_SERVER_ARGS crt_file=data_files/server5.crt key_file=data_files/server5.key"
|
2014-02-19 13:24:24 +00:00
|
|
|
O_SERVER_ARGS="$O_SERVER_ARGS -cert data_files/server5.crt -key data_files/server5.key"
|
2014-02-28 11:42:57 +00:00
|
|
|
G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server5.crt --x509keyfile data_files/server5.key"
|
|
|
|
|
2014-02-27 13:38:29 +00:00
|
|
|
if [ "X$VERIFY" = "XYES" ]; then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=data_files/server6.crt key_file=data_files/server6.key"
|
2014-02-27 13:38:29 +00:00
|
|
|
O_CLIENT_ARGS="$O_CLIENT_ARGS -cert data_files/server6.crt -key data_files/server6.key"
|
2014-03-13 15:21:59 +00:00
|
|
|
G_CLIENT_ARGS="$G_CLIENT_ARGS --x509certfile data_files/server6.crt --x509keyfile data_files/server6.key"
|
2014-02-27 13:38:29 +00:00
|
|
|
else
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=none key_file=none"
|
2014-02-27 13:38:29 +00:00
|
|
|
fi
|
2014-02-19 12:35:52 +00:00
|
|
|
;;
|
|
|
|
|
|
|
|
"RSA")
|
2016-09-04 21:31:09 +00:00
|
|
|
M_SERVER_ARGS="$M_SERVER_ARGS crt_file=data_files/server2.crt key_file=data_files/server2.key"
|
2014-02-21 09:10:20 +00:00
|
|
|
O_SERVER_ARGS="$O_SERVER_ARGS -cert data_files/server2.crt -key data_files/server2.key"
|
2014-02-28 11:42:57 +00:00
|
|
|
G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server2.crt --x509keyfile data_files/server2.key"
|
|
|
|
|
2014-02-27 13:38:29 +00:00
|
|
|
if [ "X$VERIFY" = "XYES" ]; then
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=data_files/server1.crt key_file=data_files/server1.key"
|
2014-02-27 13:38:29 +00:00
|
|
|
O_CLIENT_ARGS="$O_CLIENT_ARGS -cert data_files/server1.crt -key data_files/server1.key"
|
2014-03-13 15:21:59 +00:00
|
|
|
G_CLIENT_ARGS="$G_CLIENT_ARGS --x509certfile data_files/server1.crt --x509keyfile data_files/server1.key"
|
2014-02-27 13:38:29 +00:00
|
|
|
else
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CLIENT_ARGS="$M_CLIENT_ARGS crt_file=none key_file=none"
|
2014-02-27 13:38:29 +00:00
|
|
|
fi
|
2017-05-10 08:13:59 +00:00
|
|
|
|
|
|
|
# Allow SHA-1. It's disabled by default for security reasons but
|
|
|
|
# our tests still use certificates signed with it.
|
|
|
|
M_SERVER_ARGS="$M_SERVER_ARGS allow_sha1=1"
|
|
|
|
M_CLIENT_ARGS="$M_CLIENT_ARGS allow_sha1=1"
|
2014-02-19 12:35:52 +00:00
|
|
|
;;
|
|
|
|
|
|
|
|
"PSK")
|
2014-02-28 11:42:57 +00:00
|
|
|
# give RSA-PSK-capable server a RSA cert
|
2014-02-27 13:38:29 +00:00
|
|
|
# (should be a separate type, but harder to close with openssl)
|
2016-09-04 21:31:09 +00:00
|
|
|
M_SERVER_ARGS="$M_SERVER_ARGS psk=6162636465666768696a6b6c6d6e6f70 ca_file=none crt_file=data_files/server2.crt key_file=data_files/server2.key"
|
2014-02-27 13:38:29 +00:00
|
|
|
O_SERVER_ARGS="$O_SERVER_ARGS -psk 6162636465666768696a6b6c6d6e6f70 -nocert"
|
2014-02-28 11:42:57 +00:00
|
|
|
G_SERVER_ARGS="$G_SERVER_ARGS --x509certfile data_files/server2.crt --x509keyfile data_files/server2.key --pskpasswd data_files/passwd.psk"
|
|
|
|
|
2016-09-04 21:31:09 +00:00
|
|
|
M_CLIENT_ARGS="$M_CLIENT_ARGS psk=6162636465666768696a6b6c6d6e6f70 crt_file=none key_file=none"
|
2014-02-19 13:24:24 +00:00
|
|
|
O_CLIENT_ARGS="$O_CLIENT_ARGS -psk 6162636465666768696a6b6c6d6e6f70"
|
2014-03-13 15:21:59 +00:00
|
|
|
G_CLIENT_ARGS="$G_CLIENT_ARGS --pskusername Client_identity --pskkey=6162636465666768696a6b6c6d6e6f70"
|
2017-05-10 08:13:59 +00:00
|
|
|
|
|
|
|
# Allow SHA-1. It's disabled by default for security reasons but
|
|
|
|
# our tests still use certificates signed with it.
|
|
|
|
M_SERVER_ARGS="$M_SERVER_ARGS allow_sha1=1"
|
|
|
|
M_CLIENT_ARGS="$M_CLIENT_ARGS allow_sha1=1"
|
2014-02-19 12:35:52 +00:00
|
|
|
;;
|
|
|
|
esac
|
|
|
|
}
|
|
|
|
|
2016-09-04 21:31:09 +00:00
|
|
|
# is_mbedtls <cmd_line>
|
|
|
|
is_mbedtls() {
|
2014-02-27 14:37:24 +00:00
|
|
|
echo "$1" | grep 'ssl_server2\|ssl_client2' > /dev/null
|
|
|
|
}
|
|
|
|
|
|
|
|
# has_mem_err <log_file_name>
|
|
|
|
has_mem_err() {
|
|
|
|
if ( grep -F 'All heap blocks were freed -- no leaks are possible' "$1" &&
|
|
|
|
grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$1" ) > /dev/null
|
|
|
|
then
|
|
|
|
return 1 # false: does not have errors
|
|
|
|
else
|
|
|
|
return 0 # true: has errors
|
|
|
|
fi
|
|
|
|
}
|
|
|
|
|
2017-12-14 18:02:00 +00:00
|
|
|
# Wait for process $2 to be listening on port $1
|
|
|
|
if type lsof >/dev/null 2>/dev/null; then
|
|
|
|
wait_server_start() {
|
|
|
|
START_TIME=$(date +%s)
|
|
|
|
if is_dtls "$MODE"; then
|
|
|
|
proto=UDP
|
|
|
|
else
|
|
|
|
proto=TCP
|
|
|
|
fi
|
|
|
|
while ! lsof -a -n -b -i "$proto:$1" -p "$2" >/dev/null 2>/dev/null; do
|
|
|
|
if [ $(( $(date +%s) - $START_TIME )) -gt $DOG_DELAY ]; then
|
|
|
|
echo "SERVERSTART TIMEOUT"
|
|
|
|
echo "SERVERSTART TIMEOUT" >> $SRV_OUT
|
|
|
|
break
|
|
|
|
fi
|
|
|
|
# Linux and *BSD support decimal arguments to sleep. On other
|
|
|
|
# OSes this may be a tight loop.
|
|
|
|
sleep 0.1 2>/dev/null || true
|
|
|
|
done
|
|
|
|
}
|
|
|
|
else
|
2018-01-08 11:38:15 +00:00
|
|
|
echo "Warning: lsof not available, wait_server_start = sleep"
|
2017-12-14 18:02:00 +00:00
|
|
|
wait_server_start() {
|
2018-01-22 09:22:09 +00:00
|
|
|
sleep 2
|
2017-12-14 18:02:00 +00:00
|
|
|
}
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
2014-02-19 13:45:00 +00:00
|
|
|
# start_server <name>
|
|
|
|
# also saves name and command
|
|
|
|
start_server() {
|
|
|
|
case $1 in
|
|
|
|
[Oo]pen*)
|
2014-03-13 17:47:44 +00:00
|
|
|
SERVER_CMD="$OPENSSL_CMD s_server $O_SERVER_ARGS"
|
2014-02-19 13:45:00 +00:00
|
|
|
;;
|
2014-02-28 11:42:57 +00:00
|
|
|
[Gg]nu*)
|
2014-03-13 17:47:44 +00:00
|
|
|
SERVER_CMD="$GNUTLS_SERV $G_SERVER_ARGS --priority $G_SERVER_PRIO"
|
2014-02-28 11:42:57 +00:00
|
|
|
;;
|
2015-01-22 17:05:05 +00:00
|
|
|
mbed*)
|
2016-09-04 21:31:09 +00:00
|
|
|
SERVER_CMD="$M_SRV $M_SERVER_ARGS"
|
2014-02-27 14:37:24 +00:00
|
|
|
if [ "$MEMCHECK" -gt 0 ]; then
|
|
|
|
SERVER_CMD="valgrind --leak-check=full $SERVER_CMD"
|
|
|
|
fi
|
2014-02-19 13:45:00 +00:00
|
|
|
;;
|
|
|
|
*)
|
|
|
|
echo "error: invalid server name: $1" >&2
|
|
|
|
exit 1
|
|
|
|
;;
|
|
|
|
esac
|
|
|
|
SERVER_NAME=$1
|
|
|
|
|
|
|
|
log "$SERVER_CMD"
|
2014-05-28 21:06:50 +00:00
|
|
|
echo "$SERVER_CMD" > $SRV_OUT
|
2014-07-11 15:01:06 +00:00
|
|
|
# for servers without -www or equivalent
|
2015-02-09 13:05:54 +00:00
|
|
|
while :; do echo bla; sleep 1; done | $SERVER_CMD >> $SRV_OUT 2>&1 &
|
2014-02-19 13:45:00 +00:00
|
|
|
PROCESS_ID=$!
|
|
|
|
|
2017-12-14 18:02:00 +00:00
|
|
|
wait_server_start "$PORT" "$PROCESS_ID"
|
2014-02-19 13:45:00 +00:00
|
|
|
}
|
|
|
|
|
2014-08-31 08:37:14 +00:00
|
|
|
# terminate the running server
|
2014-02-19 14:29:38 +00:00
|
|
|
stop_server() {
|
2014-08-14 13:47:33 +00:00
|
|
|
kill $PROCESS_ID 2>/dev/null
|
|
|
|
wait $PROCESS_ID 2>/dev/null
|
2014-02-27 14:37:24 +00:00
|
|
|
|
|
|
|
if [ "$MEMCHECK" -gt 0 ]; then
|
2016-09-04 21:31:09 +00:00
|
|
|
if is_mbedtls "$SERVER_CMD" && has_mem_err $SRV_OUT; then
|
2014-02-27 14:37:24 +00:00
|
|
|
echo " ! Server had memory errors"
|
2014-08-31 08:22:11 +00:00
|
|
|
SRVMEM=$(( $SRVMEM + 1 ))
|
2014-02-27 14:37:24 +00:00
|
|
|
return
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
|
2014-05-28 21:06:50 +00:00
|
|
|
rm -f $SRV_OUT
|
2014-02-19 14:29:38 +00:00
|
|
|
}
|
|
|
|
|
2014-02-25 15:21:22 +00:00
|
|
|
# kill the running server (used when killed by signal)
|
|
|
|
cleanup() {
|
2014-05-28 21:06:50 +00:00
|
|
|
rm -f $SRV_OUT $CLI_OUT
|
2014-08-31 08:37:14 +00:00
|
|
|
kill $PROCESS_ID >/dev/null 2>&1
|
|
|
|
kill $WATCHDOG_PID >/dev/null 2>&1
|
2014-02-25 15:21:22 +00:00
|
|
|
exit 1
|
|
|
|
}
|
|
|
|
|
2014-08-30 20:41:47 +00:00
|
|
|
# wait for client to terminate and set EXIT
|
|
|
|
# must be called right after starting the client
|
|
|
|
wait_client_done() {
|
|
|
|
CLI_PID=$!
|
|
|
|
|
|
|
|
( sleep "$DOG_DELAY"; echo "TIMEOUT" >> $CLI_OUT; kill $CLI_PID ) &
|
|
|
|
WATCHDOG_PID=$!
|
|
|
|
|
|
|
|
wait $CLI_PID
|
|
|
|
EXIT=$?
|
|
|
|
|
|
|
|
kill $WATCHDOG_PID
|
|
|
|
wait $WATCHDOG_PID
|
|
|
|
|
|
|
|
echo "EXIT: $EXIT" >> $CLI_OUT
|
|
|
|
}
|
|
|
|
|
2014-02-19 14:23:21 +00:00
|
|
|
# run_client <name> <cipher>
|
|
|
|
run_client() {
|
2014-02-27 10:12:30 +00:00
|
|
|
# announce what we're going to do
|
2014-08-31 08:22:11 +00:00
|
|
|
TESTS=$(( $TESTS + 1 ))
|
2014-02-27 10:12:30 +00:00
|
|
|
VERIF=$(echo $VERIFY | tr '[:upper:]' '[:lower:]')
|
2014-08-31 08:22:11 +00:00
|
|
|
TITLE="`echo $1 | head -c1`->`echo $SERVER_NAME | head -c1`"
|
|
|
|
TITLE="$TITLE $MODE,$VERIF $2"
|
2014-12-11 10:51:28 +00:00
|
|
|
printf "$TITLE "
|
2014-08-31 08:22:11 +00:00
|
|
|
LEN=$(( 72 - `echo "$TITLE" | wc -c` ))
|
2014-12-11 10:51:28 +00:00
|
|
|
for i in `seq 1 $LEN`; do printf '.'; done; printf ' '
|
2014-02-27 10:12:30 +00:00
|
|
|
|
2014-07-11 15:41:24 +00:00
|
|
|
# should we skip?
|
|
|
|
if [ "X$SKIP_NEXT" = "XYES" ]; then
|
|
|
|
SKIP_NEXT="NO"
|
|
|
|
echo "SKIP"
|
|
|
|
SKIPPED=$(( $SKIPPED + 1 ))
|
|
|
|
return
|
|
|
|
fi
|
|
|
|
|
2014-02-19 14:23:21 +00:00
|
|
|
# run the command and interpret result
|
|
|
|
case $1 in
|
|
|
|
[Oo]pen*)
|
2014-03-13 17:47:44 +00:00
|
|
|
CLIENT_CMD="$OPENSSL_CMD s_client $O_CLIENT_ARGS -cipher $2"
|
2014-02-19 14:23:21 +00:00
|
|
|
log "$CLIENT_CMD"
|
2014-05-28 21:06:50 +00:00
|
|
|
echo "$CLIENT_CMD" > $CLI_OUT
|
2015-08-04 15:15:13 +00:00
|
|
|
printf 'GET HTTP/1.0\r\n\r\n' | $CLIENT_CMD >> $CLI_OUT 2>&1 &
|
2014-08-30 20:41:47 +00:00
|
|
|
wait_client_done
|
2014-02-19 14:23:21 +00:00
|
|
|
|
2014-08-31 08:22:11 +00:00
|
|
|
if [ $EXIT -eq 0 ]; then
|
2014-02-19 14:23:21 +00:00
|
|
|
RESULT=0
|
|
|
|
else
|
2018-06-08 10:14:43 +00:00
|
|
|
# If the cipher isn't supported...
|
2014-05-28 21:06:50 +00:00
|
|
|
if grep 'Cipher is (NONE)' $CLI_OUT >/dev/null; then
|
2014-02-19 14:23:21 +00:00
|
|
|
RESULT=1
|
|
|
|
else
|
|
|
|
RESULT=2
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
;;
|
|
|
|
|
2014-03-13 15:21:59 +00:00
|
|
|
[Gg]nu*)
|
2014-07-10 18:12:56 +00:00
|
|
|
# need to force IPv4 with UDP, but keep localhost for auth
|
|
|
|
if is_dtls "$MODE"; then
|
|
|
|
G_HOST="127.0.0.1"
|
|
|
|
else
|
|
|
|
G_HOST="localhost"
|
|
|
|
fi
|
|
|
|
CLIENT_CMD="$GNUTLS_CLI $G_CLIENT_ARGS --priority $G_PRIO_MODE:$2 $G_HOST"
|
2014-03-13 15:21:59 +00:00
|
|
|
log "$CLIENT_CMD"
|
2014-05-28 21:06:50 +00:00
|
|
|
echo "$CLIENT_CMD" > $CLI_OUT
|
2015-08-04 15:15:13 +00:00
|
|
|
printf 'GET HTTP/1.0\r\n\r\n' | $CLIENT_CMD >> $CLI_OUT 2>&1 &
|
2014-08-30 20:41:47 +00:00
|
|
|
wait_client_done
|
2014-03-13 15:21:59 +00:00
|
|
|
|
2014-08-31 08:22:11 +00:00
|
|
|
if [ $EXIT -eq 0 ]; then
|
2014-03-13 15:21:59 +00:00
|
|
|
RESULT=0
|
|
|
|
else
|
2014-03-13 16:45:35 +00:00
|
|
|
RESULT=2
|
|
|
|
# interpret early failure, with a handshake_failure alert
|
|
|
|
# before the server hello, as "no ciphersuite in common"
|
2014-05-28 21:06:50 +00:00
|
|
|
if grep -F 'Received alert [40]: Handshake failed' $CLI_OUT; then
|
|
|
|
if grep -i 'SERVER HELLO .* was received' $CLI_OUT; then :
|
2014-03-13 16:45:35 +00:00
|
|
|
else
|
|
|
|
RESULT=1
|
|
|
|
fi
|
|
|
|
fi >/dev/null
|
2014-03-13 15:21:59 +00:00
|
|
|
fi
|
|
|
|
;;
|
|
|
|
|
2015-01-22 17:05:05 +00:00
|
|
|
mbed*)
|
2016-09-04 21:31:09 +00:00
|
|
|
CLIENT_CMD="$M_CLI $M_CLIENT_ARGS force_ciphersuite=$2"
|
2014-02-27 14:37:24 +00:00
|
|
|
if [ "$MEMCHECK" -gt 0 ]; then
|
|
|
|
CLIENT_CMD="valgrind --leak-check=full $CLIENT_CMD"
|
|
|
|
fi
|
2014-02-19 14:23:21 +00:00
|
|
|
log "$CLIENT_CMD"
|
2014-05-28 21:06:50 +00:00
|
|
|
echo "$CLIENT_CMD" > $CLI_OUT
|
2014-08-30 20:41:47 +00:00
|
|
|
$CLIENT_CMD >> $CLI_OUT 2>&1 &
|
|
|
|
wait_client_done
|
2014-02-19 14:23:21 +00:00
|
|
|
|
|
|
|
case $EXIT in
|
2016-09-04 21:31:09 +00:00
|
|
|
# Success
|
2014-02-19 14:23:21 +00:00
|
|
|
"0") RESULT=0 ;;
|
2016-09-04 21:31:09 +00:00
|
|
|
|
|
|
|
# Ciphersuite not supported
|
2014-02-19 14:23:21 +00:00
|
|
|
"2") RESULT=1 ;;
|
2016-09-04 21:31:09 +00:00
|
|
|
|
|
|
|
# Error
|
2014-02-19 14:23:21 +00:00
|
|
|
*) RESULT=2 ;;
|
|
|
|
esac
|
2014-02-27 14:37:24 +00:00
|
|
|
|
|
|
|
if [ "$MEMCHECK" -gt 0 ]; then
|
2016-09-04 21:31:09 +00:00
|
|
|
if is_mbedtls "$CLIENT_CMD" && has_mem_err $CLI_OUT; then
|
2014-02-27 14:37:24 +00:00
|
|
|
RESULT=2
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
|
2014-02-19 14:23:21 +00:00
|
|
|
;;
|
|
|
|
|
|
|
|
*)
|
|
|
|
echo "error: invalid client name: $1" >&2
|
|
|
|
exit 1
|
|
|
|
;;
|
|
|
|
esac
|
|
|
|
|
2014-05-28 21:06:50 +00:00
|
|
|
echo "EXIT: $EXIT" >> $CLI_OUT
|
2014-03-25 13:16:44 +00:00
|
|
|
|
2014-02-19 14:23:21 +00:00
|
|
|
# report and count result
|
|
|
|
case $RESULT in
|
|
|
|
"0")
|
2014-02-24 12:20:14 +00:00
|
|
|
echo PASS
|
2014-02-19 14:23:21 +00:00
|
|
|
;;
|
|
|
|
"1")
|
2014-02-24 12:20:14 +00:00
|
|
|
echo SKIP
|
2014-08-31 08:22:11 +00:00
|
|
|
SKIPPED=$(( $SKIPPED + 1 ))
|
2014-02-19 14:23:21 +00:00
|
|
|
;;
|
|
|
|
"2")
|
2014-02-24 12:20:14 +00:00
|
|
|
echo FAIL
|
2014-08-31 08:22:11 +00:00
|
|
|
cp $SRV_OUT c-srv-${TESTS}.log
|
|
|
|
cp $CLI_OUT c-cli-${TESTS}.log
|
|
|
|
echo " ! outputs saved to c-srv-${TESTS}.log, c-cli-${TESTS}.log"
|
2014-08-31 15:42:53 +00:00
|
|
|
|
2018-03-29 10:04:20 +00:00
|
|
|
if [ "X${USER:-}" = Xbuildbot -o "X${LOGNAME:-}" = Xbuildbot -o "${LOG_FAILURE_ON_STDOUT:-0}" != 0 ]; then
|
2014-08-31 15:42:53 +00:00
|
|
|
echo " ! server output:"
|
|
|
|
cat c-srv-${TESTS}.log
|
|
|
|
echo " ! ==================================================="
|
|
|
|
echo " ! client output:"
|
|
|
|
cat c-cli-${TESTS}.log
|
|
|
|
fi
|
|
|
|
|
2014-08-31 08:22:11 +00:00
|
|
|
FAILED=$(( $FAILED + 1 ))
|
2014-02-19 14:23:21 +00:00
|
|
|
;;
|
|
|
|
esac
|
2014-02-27 10:12:30 +00:00
|
|
|
|
2014-05-28 21:06:50 +00:00
|
|
|
rm -f $CLI_OUT
|
2014-02-19 14:23:21 +00:00
|
|
|
}
|
|
|
|
|
2014-02-26 17:21:02 +00:00
|
|
|
#
|
|
|
|
# MAIN
|
|
|
|
#
|
|
|
|
|
2015-03-10 13:41:04 +00:00
|
|
|
if cd $( dirname $0 ); then :; else
|
|
|
|
echo "cd $( dirname $0 ) failed" >&2
|
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
|
2014-03-14 17:13:53 +00:00
|
|
|
get_options "$@"
|
|
|
|
|
2014-02-27 11:25:54 +00:00
|
|
|
# sanity checks, avoid an avalanche of errors
|
2016-09-04 21:31:09 +00:00
|
|
|
if [ ! -x "$M_SRV" ]; then
|
|
|
|
echo "Command '$M_SRV' is not an executable file" >&2
|
2014-02-27 11:25:54 +00:00
|
|
|
exit 1
|
|
|
|
fi
|
2016-09-04 21:31:09 +00:00
|
|
|
if [ ! -x "$M_CLI" ]; then
|
|
|
|
echo "Command '$M_CLI' is not an executable file" >&2
|
2014-02-27 11:25:54 +00:00
|
|
|
exit 1
|
|
|
|
fi
|
2014-03-14 17:13:53 +00:00
|
|
|
|
|
|
|
if echo "$PEERS" | grep -i openssl > /dev/null; then
|
|
|
|
if which "$OPENSSL_CMD" >/dev/null 2>&1; then :; else
|
|
|
|
echo "Command '$OPENSSL_CMD' not found" >&2
|
2014-03-13 17:47:44 +00:00
|
|
|
exit 1
|
|
|
|
fi
|
2014-03-14 17:13:53 +00:00
|
|
|
fi
|
2014-02-27 11:25:54 +00:00
|
|
|
|
2014-03-14 17:13:53 +00:00
|
|
|
if echo "$PEERS" | grep -i gnutls > /dev/null; then
|
|
|
|
for CMD in "$GNUTLS_CLI" "$GNUTLS_SERV"; do
|
|
|
|
if which "$CMD" >/dev/null 2>&1; then :; else
|
|
|
|
echo "Command '$CMD' not found" >&2
|
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
done
|
|
|
|
fi
|
|
|
|
|
|
|
|
for PEER in $PEERS; do
|
|
|
|
case "$PEER" in
|
2015-01-22 17:05:05 +00:00
|
|
|
mbed*|[Oo]pen*|[Gg]nu*)
|
2014-03-14 17:13:53 +00:00
|
|
|
;;
|
|
|
|
*)
|
|
|
|
echo "Unknown peers: $PEER" >&2
|
|
|
|
exit 1
|
|
|
|
esac
|
|
|
|
done
|
2014-02-26 17:21:02 +00:00
|
|
|
|
2014-05-28 20:59:30 +00:00
|
|
|
# Pick a "unique" port in the range 10000-19999.
|
|
|
|
PORT="0000$$"
|
2014-06-16 14:54:36 +00:00
|
|
|
PORT="1$(echo $PORT | tail -c 5)"
|
2014-05-28 20:59:30 +00:00
|
|
|
|
2014-05-28 21:06:50 +00:00
|
|
|
# Also pick a unique name for intermediate files
|
|
|
|
SRV_OUT="srv_out.$$"
|
|
|
|
CLI_OUT="cli_out.$$"
|
|
|
|
|
2014-08-30 20:41:47 +00:00
|
|
|
# client timeout delay: be more patient with valgrind
|
|
|
|
if [ "$MEMCHECK" -gt 0 ]; then
|
|
|
|
DOG_DELAY=30
|
|
|
|
else
|
|
|
|
DOG_DELAY=10
|
|
|
|
fi
|
|
|
|
|
2014-07-11 15:41:24 +00:00
|
|
|
SKIP_NEXT="NO"
|
|
|
|
|
2014-02-25 15:21:22 +00:00
|
|
|
trap cleanup INT TERM HUP
|
|
|
|
|
2014-02-19 14:29:38 +00:00
|
|
|
for VERIFY in $VERIFIES; do
|
|
|
|
for MODE in $MODES; do
|
|
|
|
for TYPE in $TYPES; do
|
2014-03-13 16:45:35 +00:00
|
|
|
for PEER in $PEERS; do
|
2013-04-17 17:27:58 +00:00
|
|
|
|
2014-02-19 14:29:38 +00:00
|
|
|
setup_arguments
|
2014-02-28 11:42:57 +00:00
|
|
|
|
2014-03-13 16:45:35 +00:00
|
|
|
case "$PEER" in
|
|
|
|
|
|
|
|
[Oo]pen*)
|
|
|
|
|
2015-08-04 14:43:37 +00:00
|
|
|
if test "$OSSL_NO_DTLS" -gt 0 && is_dtls "$MODE"; then
|
|
|
|
continue;
|
|
|
|
fi
|
|
|
|
|
2014-03-13 16:45:35 +00:00
|
|
|
reset_ciphersuites
|
2014-03-25 18:07:28 +00:00
|
|
|
add_common_ciphersuites
|
2014-03-13 16:45:35 +00:00
|
|
|
add_openssl_ciphersuites
|
|
|
|
filter_ciphersuites
|
|
|
|
|
2016-09-04 21:31:09 +00:00
|
|
|
if [ "X" != "X$M_CIPHERS" ]; then
|
2014-03-13 16:45:35 +00:00
|
|
|
start_server "OpenSSL"
|
2016-09-04 21:31:09 +00:00
|
|
|
for i in $M_CIPHERS; do
|
2014-07-11 15:41:24 +00:00
|
|
|
check_openssl_server_bug $i
|
2015-01-22 16:43:54 +00:00
|
|
|
run_client mbedTLS $i
|
2014-03-13 16:45:35 +00:00
|
|
|
done
|
|
|
|
stop_server
|
|
|
|
fi
|
|
|
|
|
|
|
|
if [ "X" != "X$O_CIPHERS" ]; then
|
2015-01-22 16:43:54 +00:00
|
|
|
start_server "mbedTLS"
|
2014-03-13 16:45:35 +00:00
|
|
|
for i in $O_CIPHERS; do
|
|
|
|
run_client OpenSSL $i
|
|
|
|
done
|
|
|
|
stop_server
|
|
|
|
fi
|
|
|
|
|
|
|
|
;;
|
|
|
|
|
|
|
|
[Gg]nu*)
|
|
|
|
|
|
|
|
reset_ciphersuites
|
2014-03-25 18:07:28 +00:00
|
|
|
add_common_ciphersuites
|
2014-03-13 16:45:35 +00:00
|
|
|
add_gnutls_ciphersuites
|
|
|
|
filter_ciphersuites
|
|
|
|
|
2016-09-04 21:31:09 +00:00
|
|
|
if [ "X" != "X$M_CIPHERS" ]; then
|
2014-03-13 16:45:35 +00:00
|
|
|
start_server "GnuTLS"
|
2016-09-04 21:31:09 +00:00
|
|
|
for i in $M_CIPHERS; do
|
2015-01-22 16:43:54 +00:00
|
|
|
run_client mbedTLS $i
|
2014-03-13 16:45:35 +00:00
|
|
|
done
|
|
|
|
stop_server
|
|
|
|
fi
|
|
|
|
|
|
|
|
if [ "X" != "X$G_CIPHERS" ]; then
|
2015-01-22 16:43:54 +00:00
|
|
|
start_server "mbedTLS"
|
2014-03-13 16:45:35 +00:00
|
|
|
for i in $G_CIPHERS; do
|
|
|
|
run_client GnuTLS $i
|
|
|
|
done
|
|
|
|
stop_server
|
|
|
|
fi
|
|
|
|
|
|
|
|
;;
|
|
|
|
|
2015-01-22 17:05:05 +00:00
|
|
|
mbed*)
|
2014-03-13 16:45:35 +00:00
|
|
|
|
|
|
|
reset_ciphersuites
|
2014-03-25 18:07:28 +00:00
|
|
|
add_common_ciphersuites
|
2014-03-13 16:45:35 +00:00
|
|
|
add_openssl_ciphersuites
|
|
|
|
add_gnutls_ciphersuites
|
2015-04-08 10:49:31 +00:00
|
|
|
add_mbedtls_ciphersuites
|
2014-03-13 16:45:35 +00:00
|
|
|
filter_ciphersuites
|
|
|
|
|
2016-09-04 21:31:09 +00:00
|
|
|
if [ "X" != "X$M_CIPHERS" ]; then
|
2015-01-22 16:43:54 +00:00
|
|
|
start_server "mbedTLS"
|
2016-09-04 21:31:09 +00:00
|
|
|
for i in $M_CIPHERS; do
|
2015-01-22 16:43:54 +00:00
|
|
|
run_client mbedTLS $i
|
2014-03-13 16:45:35 +00:00
|
|
|
done
|
|
|
|
stop_server
|
|
|
|
fi
|
|
|
|
|
|
|
|
;;
|
|
|
|
|
2014-03-25 17:04:59 +00:00
|
|
|
*)
|
2014-05-22 13:47:58 +00:00
|
|
|
echo "Unknown peer: $PEER" >&2
|
2014-03-25 17:04:59 +00:00
|
|
|
exit 1
|
|
|
|
;;
|
|
|
|
|
2014-03-13 16:45:35 +00:00
|
|
|
esac
|
|
|
|
|
|
|
|
done
|
2014-02-19 14:29:38 +00:00
|
|
|
done
|
|
|
|
done
|
2013-08-27 17:57:15 +00:00
|
|
|
done
|
2013-08-27 20:00:47 +00:00
|
|
|
|
2014-02-24 12:20:14 +00:00
|
|
|
echo "------------------------------------------------------------------------"
|
2013-08-27 20:00:47 +00:00
|
|
|
|
2014-08-31 08:22:11 +00:00
|
|
|
if [ $FAILED -ne 0 -o $SRVMEM -ne 0 ];
|
2013-08-27 20:00:47 +00:00
|
|
|
then
|
2014-12-11 10:51:28 +00:00
|
|
|
printf "FAILED"
|
2013-08-27 20:00:47 +00:00
|
|
|
else
|
2014-12-11 10:51:28 +00:00
|
|
|
printf "PASSED"
|
2013-08-27 20:00:47 +00:00
|
|
|
fi
|
|
|
|
|
2014-03-13 16:57:45 +00:00
|
|
|
if [ "$MEMCHECK" -gt 0 ]; then
|
2014-08-31 08:22:11 +00:00
|
|
|
MEMREPORT=", $SRVMEM server memory errors"
|
2014-03-13 16:57:45 +00:00
|
|
|
else
|
|
|
|
MEMREPORT=""
|
|
|
|
fi
|
|
|
|
|
2014-08-31 08:22:11 +00:00
|
|
|
PASSED=$(( $TESTS - $FAILED ))
|
|
|
|
echo " ($PASSED / $TESTS tests ($SKIPPED skipped$MEMREPORT))"
|
2013-08-27 20:00:47 +00:00
|
|
|
|
2014-08-31 08:22:11 +00:00
|
|
|
FAILED=$(( $FAILED + $SRVMEM ))
|
|
|
|
exit $FAILED
|