mirror of
https://github.com/yuzu-emu/mbedtls.git
synced 2024-11-26 18:05:37 +01:00
Detect mismatching compile-time and cmd line config in ssl-opt.sh
This commit is contained in:
Hanno Becker
parent
aa9fc6dd33
commit
af5ab918d9
@ -503,6 +503,49 @@ detect_dtls() {
|
||||
fi
|
||||
}
|
||||
|
||||
# Strip off a particular parameter from the command line
|
||||
# and return its value.
|
||||
# Parameter 1: Command line parameter to strip off
|
||||
# ENV I/O: CMD command line to search and modify
|
||||
extract_cmdline_argument() {
|
||||
__ARG=$(echo "$CMD" | sed -n "s/^.* $1=\([^ ]*\).*$/\1/p")
|
||||
CMD=$(echo "$CMD" | sed "s/$1=\([^ ]*\)//")
|
||||
}
|
||||
|
||||
# Check compatibility of the ssl_client2/ssl_server2 command-line
|
||||
# with a particular compile-time configurable option.
|
||||
# Parameter 1: Command-line argument (e.g. extended_ms)
|
||||
# Parameter 2: Corresponding compile-time configuration
|
||||
# (e.g. MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
|
||||
# ENV I/O: CMD command line to search and modify
|
||||
# SKIP_NEXT set to "YES" on a mismatch
|
||||
check_cmdline_param_compat() {
|
||||
__VAL="$( get_config_value_or_default "$2" )"
|
||||
if [ ! -z "$__VAL" ]; then
|
||||
extract_cmdline_argument "$1"
|
||||
if [ ! -z "$__ARG" ] && [ "$__ARG" != "$__VAL" ]; then
|
||||
SKIP_NEXT="YES"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Go through all options that can be hardcoded at compile-time and
|
||||
# detect whether the command line configures them in a conflicting
|
||||
# way. If so, skip the test. Otherwise, remove the corresponding
|
||||
# entry.
|
||||
# Parameter 1: Command line to inspect
|
||||
# Output: Modified command line
|
||||
# ENV I/O: SKIP_TEST set to 1 on mismatch.
|
||||
check_cmdline_compat() {
|
||||
CMD="$1"
|
||||
|
||||
# ExtendedMasterSecret configuration
|
||||
check_cmdline_param_compat "extended_ms" \
|
||||
"MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET"
|
||||
check_cmdline_param_compat "enforce_extended_master_secret" \
|
||||
"MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET"
|
||||
}
|
||||
|
||||
# Usage: run_test name [-p proxy_cmd] srv_cmd cli_cmd cli_exit [option [...]]
|
||||
# Options: -s pattern pattern that must be present in server output
|
||||
# -c pattern pattern that must be present in client output
|
||||
@ -531,14 +574,6 @@ run_test() {
|
||||
SKIP_NEXT="YES"
|
||||
fi
|
||||
|
||||
# should we skip?
|
||||
if [ "X$SKIP_NEXT" = "XYES" ]; then
|
||||
SKIP_NEXT="NO"
|
||||
echo "SKIP"
|
||||
SKIPS=$(( $SKIPS + 1 ))
|
||||
return
|
||||
fi
|
||||
|
||||
# does this test use a proxy?
|
||||
if [ "X$1" = "X-p" ]; then
|
||||
PXY_CMD="$2"
|
||||
@ -553,6 +588,12 @@ run_test() {
|
||||
CLI_EXPECT="$3"
|
||||
shift 3
|
||||
|
||||
check_cmdline_compat "$SRV_CMD"
|
||||
SRV_CMD="$CMD"
|
||||
|
||||
check_cmdline_compat "$CLI_CMD"
|
||||
CLI_CMD="$CMD"
|
||||
|
||||
# Check if test uses files
|
||||
TEST_USES_FILES=$(echo "$SRV_CMD $CLI_CMD" | grep "\.\(key\|crt\|pem\)" )
|
||||
if [ ! -z "$TEST_USES_FILES" ]; then
|
||||
@ -1836,8 +1877,8 @@ run_test "Encrypt then MAC: client enabled, server SSLv3" \
|
||||
# Tests for Extended Master Secret extension
|
||||
|
||||
run_test "Extended Master Secret: default (not enforcing)" \
|
||||
"$P_SRV debug_level=3" \
|
||||
"$P_CLI debug_level=3" \
|
||||
"$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=0 " \
|
||||
"$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
|
||||
0 \
|
||||
-c "client hello, adding extended_master_secret extension" \
|
||||
-s "found extended master secret extension" \
|
||||
@ -1847,8 +1888,8 @@ run_test "Extended Master Secret: default (not enforcing)" \
|
||||
-s "session hash for extended master secret"
|
||||
|
||||
run_test "Extended Master Secret: both enabled, both enforcing" \
|
||||
"$P_SRV debug_level=3 enforce_extended_master_secret=1" \
|
||||
"$P_CLI debug_level=3 enforce_extended_master_secret=1" \
|
||||
"$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
|
||||
"$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
|
||||
0 \
|
||||
-c "client hello, adding extended_master_secret extension" \
|
||||
-s "found extended master secret extension" \
|
||||
@ -1858,8 +1899,8 @@ run_test "Extended Master Secret: both enabled, both enforcing" \
|
||||
-s "session hash for extended master secret"
|
||||
|
||||
run_test "Extended Master Secret: both enabled, client enforcing" \
|
||||
"$P_SRV debug_level=3 enforce_extended_master_secret=0" \
|
||||
"$P_CLI debug_level=3 enforce_extended_master_secret=1" \
|
||||
"$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
|
||||
"$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
|
||||
0 \
|
||||
-c "client hello, adding extended_master_secret extension" \
|
||||
-s "found extended master secret extension" \
|
||||
@ -1869,8 +1910,8 @@ run_test "Extended Master Secret: both enabled, client enforcing" \
|
||||
-s "session hash for extended master secret"
|
||||
|
||||
run_test "Extended Master Secret: both enabled, server enforcing" \
|
||||
"$P_SRV debug_level=3 enforce_extended_master_secret=1" \
|
||||
"$P_CLI debug_level=3 enforce_extended_master_secret=0" \
|
||||
"$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
|
||||
"$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
|
||||
0 \
|
||||
-c "client hello, adding extended_master_secret extension" \
|
||||
-s "found extended master secret extension" \
|
||||
@ -1880,7 +1921,7 @@ run_test "Extended Master Secret: both enabled, server enforcing" \
|
||||
-s "session hash for extended master secret"
|
||||
|
||||
run_test "Extended Master Secret: client enabled, server disabled, client enforcing" \
|
||||
"$P_SRV debug_level=3 extended_ms=0" \
|
||||
"$P_SRV debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
|
||||
"$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
|
||||
1 \
|
||||
-c "client hello, adding extended_master_secret extension" \
|
||||
@ -1891,7 +1932,7 @@ run_test "Extended Master Secret: client enabled, server disabled, client enf
|
||||
|
||||
run_test "Extended Master Secret enforced: client disabled, server enabled, server enforcing" \
|
||||
"$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
|
||||
"$P_CLI debug_level=3 extended_ms=0" \
|
||||
"$P_CLI debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
|
||||
1 \
|
||||
-C "client hello, adding extended_master_secret extension" \
|
||||
-S "found extended master secret extension" \
|
||||
@ -1900,8 +1941,8 @@ run_test "Extended Master Secret enforced: client disabled, server enabled, s
|
||||
-s "Peer not offering extended master secret, while it is enforced"
|
||||
|
||||
run_test "Extended Master Secret: client enabled, server disabled, not enforcing" \
|
||||
"$P_SRV debug_level=3 extended_ms=0" \
|
||||
"$P_CLI debug_level=3 extended_ms=1" \
|
||||
"$P_SRV debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
|
||||
"$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
|
||||
0 \
|
||||
-c "client hello, adding extended_master_secret extension" \
|
||||
-s "found extended master secret extension" \
|
||||
@ -1911,8 +1952,8 @@ run_test "Extended Master Secret: client enabled, server disabled, not enforc
|
||||
-S "session hash for extended master secret"
|
||||
|
||||
run_test "Extended Master Secret: client disabled, server enabled, not enforcing" \
|
||||
"$P_SRV debug_level=3 extended_ms=1" \
|
||||
"$P_CLI debug_level=3 extended_ms=0" \
|
||||
"$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
|
||||
"$P_CLI debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
|
||||
0 \
|
||||
-C "client hello, adding extended_master_secret extension" \
|
||||
-S "found extended master secret extension" \
|
||||
@ -1922,8 +1963,8 @@ run_test "Extended Master Secret: client disabled, server enabled, not enforc
|
||||
-S "session hash for extended master secret"
|
||||
|
||||
run_test "Extended Master Secret: client disabled, server disabled" \
|
||||
"$P_SRV debug_level=3 extended_ms=0" \
|
||||
"$P_CLI debug_level=3 extended_ms=0" \
|
||||
"$P_SRV debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
|
||||
"$P_CLI debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
|
||||
0 \
|
||||
-C "client hello, adding extended_master_secret extension" \
|
||||
-S "found extended master secret extension" \
|
||||
@ -1934,8 +1975,8 @@ run_test "Extended Master Secret: client disabled, server disabled" \
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
|
||||
run_test "Extended Master Secret: client SSLv3, server enabled" \
|
||||
"$P_SRV debug_level=3 min_version=ssl3" \
|
||||
"$P_CLI debug_level=3 force_version=ssl3" \
|
||||
"$P_SRV debug_level=3 min_version=ssl3 extended_ms=1 enforce_extended_master_secret=0" \
|
||||
"$P_CLI debug_level=3 force_version=ssl3 extended_ms=1 enforce_extended_master_secret=0" \
|
||||
0 \
|
||||
-C "client hello, adding extended_master_secret extension" \
|
||||
-S "found extended master secret extension" \
|
||||
@ -1946,8 +1987,8 @@ run_test "Extended Master Secret: client SSLv3, server enabled" \
|
||||
|
||||
requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
|
||||
run_test "Extended Master Secret: client enabled, server SSLv3" \
|
||||
"$P_SRV debug_level=3 force_version=ssl3" \
|
||||
"$P_CLI debug_level=3 min_version=ssl3" \
|
||||
"$P_SRV debug_level=3 force_version=ssl3 extended_ms=1 enforce_extended_master_secret=0" \
|
||||
"$P_CLI debug_level=3 min_version=ssl3 extended_ms=1 enforce_extended_master_secret=0" \
|
||||
0 \
|
||||
-c "client hello, adding extended_master_secret extension" \
|
||||
-S "found extended master secret extension" \
|
||||
|
||||
Loading…
Reference in New Issue
Block a user