Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport 3.6: test sample programs in ssl-opt.sh #9541

Open
wants to merge 32 commits into
base: mbedtls-3.6
Choose a base branch
from
Open

Backport 3.6: test sample programs in ssl-opt.sh #9541

Changes from 1 commit
Commits
Show all changes
32 commits
Select commit Hold shift + click to select a range
ab84fe8
opt-testcases/*.sh are not executable
gilles-peskine-arm Sep 13, 2024
8a742b8
Avoid multiline requires_all_configs_xxx
gilles-peskine-arm Sep 13, 2024
26fb456
Separate accepting TLS 1.3 middlebox compatibility from sending it
gilles-peskine-arm Sep 13, 2024
152fa2d
Adapt middlebox compatibility tests for always-on acceptance
gilles-peskine-arm Sep 13, 2024
4b5f619
Remove mid-stanza blank lines
gilles-peskine-arm Sep 13, 2024
c36f883
Remove obsolete requirements on middlebox compatibility mode: manual
gilles-peskine-arm Sep 13, 2024
2009670
Remove obsolete requirements on middlebox compatibility mode: generated
gilles-peskine-arm Sep 13, 2024
3024761
generate_tls13_compat_tests: change default mode to all
gilles-peskine-arm Sep 13, 2024
1feb2cf
Automatically generate tests/opt-testcases/tls13-compat.sh
gilles-peskine-arm Sep 13, 2024
6c3f5a5
Fix sensitivity of tls13-compat.sh to the exact generation method
gilles-peskine-arm Sep 13, 2024
4ab3d55
Changelog entry: fix #9551
gilles-peskine-arm Sep 13, 2024
625f3e1
Remove transitional always-on internal option
gilles-peskine-arm Sep 13, 2024
1ef9071
Reduce level of non-error debug message
gilles-peskine-arm Sep 13, 2024
9cb98c7
ssl_client1: Exit with an error status if the TLS connection failed
gilles-peskine-arm Aug 27, 2024
4959cd0
Prepare to test SSL sample programs
gilles-peskine-arm Sep 4, 2024
b3fd659
Allow test cases to use a specific port
gilles-peskine-arm Sep 4, 2024
b9dbbd8
Test ssl_client1
gilles-peskine-arm Sep 4, 2024
d416cdf
Test dtls_client
gilles-peskine-arm Sep 4, 2024
3bfe32a
Test ssl_server
gilles-peskine-arm Sep 4, 2024
2ce68ec
Test ssl_pthread_server
gilles-peskine-arm Sep 4, 2024
20a3c38
Test ssl_fork_server
gilles-peskine-arm Sep 4, 2024
a3f3ca0
Test dtls_server
gilles-peskine-arm Sep 4, 2024
186d4a5
Declare OpenSSL version dependency for TLS 1.3 test cases
gilles-peskine-arm Sep 4, 2024
ea8cea6
Declare GnuTLS version dependency for TLS 1.3 test cases
gilles-peskine-arm Sep 5, 2024
1270ba7
Compatibiliy with older OpenSSL and GnuTLS
gilles-peskine-arm Sep 4, 2024
2730bd3
ssl_server: Allow the client to close the connection first
gilles-peskine-arm Sep 4, 2024
0911956
dtls_client: don't force the use of IPv6
gilles-peskine-arm Sep 5, 2024
6e8aab9
Test SSL sample programs against each other and ssl_client2, ssl_server2
gilles-peskine-arm Sep 9, 2024
e2f3052
Note known issue about test cases skipped in TLS 1.3-only builds
gilles-peskine-arm Sep 11, 2024
4960386
Use OPENSSL_NEXT for a test case that uses IPv6 when available
gilles-peskine-arm Sep 13, 2024
01d25cf
test-ref-configs: keep going after failures
gilles-peskine-arm Sep 12, 2024
58ebd1c
Skip ssl_server in config-suite-b
gilles-peskine-arm Sep 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
135 changes: 134 additions & 1 deletion tests/opt-testcases/sample.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,23 @@
# Test that SSL sample programs can interoperate with OpenSSL and GnuTLS.
# Test that SSL sample programs can interoperate with each other
# and with OpenSSL and GnuTLS.

# Copyright The Mbed TLS Contributors
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later

: ${PROGRAMS_DIR:=../programs/ssl}

run_test "Sample: ssl_client1, ssl_server2" \
-P 4433 \
"$PROGRAMS_DIR/ssl_server2" \
"$PROGRAMS_DIR/ssl_client1" \
0 \
-s "[1-9][0-9]* bytes read" \
-s "[1-9][0-9]* bytes written" \
-c "[1-9][0-9]* bytes read" \
-c "[1-9][0-9]* bytes written" \
-S "error" \
-C "error"

requires_protocol_version tls12
run_test "Sample: ssl_client1, openssl server, TLS 1.2" \
-P 4433 \
Expand Down Expand Up @@ -49,6 +62,22 @@ run_test "Sample: ssl_client1, gnutls server, TLS 1.3" \
-S "Error" \
-C "error"

# The server complains of extra data after it closes the connection
# because the client keeps sending data, so the server receives
# more application data when it expects a new handshake. We consider
# the test a success if both sides have sent and received application
# data, no matter what happens afterwards.
run_test "Sample: dtls_client, ssl_server2" \
-P 4433 \
"$PROGRAMS_DIR/ssl_server2 dtls=1 server_addr=localhost" \
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Out of curiosity: why do we need server_addr=localhost here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By default, on my machine, ssl_server2 only listens on IPv4. I actually don't understand why: I would have thought it would prioritize IPv6. dtls_client connects to localhost, whatever it is. I remember it took me a little while to find something that would minimize changes in the test programs, have the tests pass on my machine (where localhost resolves to ::1), and have the tests pass on the CI (where IPv6 is disabled).

I don't know why this isn't necessary for ssl_client1.

"$PROGRAMS_DIR/dtls_client" \
0 \
-s "[1-9][0-9]* bytes read" \
-s "[1-9][0-9]* bytes written" \
-c "[1-9][0-9]* bytes read" \
-c "[1-9][0-9]* bytes written" \
-C "error"

requires_protocol_version dtls12
run_test "Sample: dtls_client, openssl server, DTLS 1.2" \
-P 4433 \
Expand Down Expand Up @@ -76,6 +105,30 @@ run_test "Sample: dtls_client, gnutls server, DTLS 1.2" \
-S "Error" \
-C "error"

run_test "Sample: ssl_server, ssl_client2" \
-P 4433 \
"$PROGRAMS_DIR/ssl_server" \
"$PROGRAMS_DIR/ssl_client2" \
0 \
-s "[1-9][0-9]* bytes read" \
-s "[1-9][0-9]* bytes written" \
-c "[1-9][0-9]* bytes read" \
-c "[1-9][0-9]* bytes written" \
-S "error" \
-C "error"

run_test "Sample: ssl_client1 with ssl_server" \
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: naming is inconsistent. Not sure it matters though.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are two naming patterns: “Sample: PROGRAM, PEER” for testing a sample program against a peer that isn't a sample program (OpenSSL, GnuTLS or Mbed TLS's fancy programs), and “Sample: PROGRAM1 with PROGRAM2” for testing two sample programs against each other. I'm open to other naming conventions if you have suggestions.

-P 4433 \
"$PROGRAMS_DIR/ssl_server" \
"$PROGRAMS_DIR/ssl_client1" \
0 \
-s "[1-9][0-9]* bytes read" \
-s "[1-9][0-9]* bytes written" \
-c "[1-9][0-9]* bytes read" \
-c "[1-9][0-9]* bytes written" \
-S "error" \
-C "error"

requires_protocol_version tls12
run_test "Sample: ssl_server, openssl client, TLS 1.2" \
-P 4433 \
Expand Down Expand Up @@ -122,6 +175,30 @@ run_test "Sample: ssl_server, gnutls client, TLS 1.3" \
-S "error" \
-C "ERROR"

run_test "Sample: ssl_fork_server, ssl_client2" \
-P 4433 \
"$PROGRAMS_DIR/ssl_fork_server" \
"$PROGRAMS_DIR/ssl_client2" \
0 \
-s "[1-9][0-9]* bytes read" \
-s "[1-9][0-9]* bytes written" \
-c "[1-9][0-9]* bytes read" \
-c "[1-9][0-9]* bytes written" \
-S "error" \
-C "error"

run_test "Sample: ssl_client1 with ssl_fork_server" \
-P 4433 \
"$PROGRAMS_DIR/ssl_fork_server" \
"$PROGRAMS_DIR/ssl_client1" \
0 \
-s "[1-9][0-9]* bytes read" \
-s "[1-9][0-9]* bytes written" \
-c "[1-9][0-9]* bytes read" \
-c "[1-9][0-9]* bytes written" \
-S "error" \
-C "error"

requires_protocol_version tls12
run_test "Sample: ssl_fork_server, openssl client, TLS 1.2" \
-P 4433 \
Expand Down Expand Up @@ -168,6 +245,30 @@ run_test "Sample: ssl_fork_server, gnutls client, TLS 1.3" \
-S "error" \
-C "ERROR"

run_test "Sample: ssl_pthread_server, ssl_client2" \
-P 4433 \
"$PROGRAMS_DIR/ssl_pthread_server" \
"$PROGRAMS_DIR/ssl_client2" \
0 \
-s "[1-9][0-9]* bytes read" \
-s "[1-9][0-9]* bytes written" \
-c "[1-9][0-9]* bytes read" \
-c "[1-9][0-9]* bytes written" \
-S "error" \
-C "error"

run_test "Sample: ssl_client1 with ssl_pthread_server" \
-P 4433 \
"$PROGRAMS_DIR/ssl_pthread_server" \
"$PROGRAMS_DIR/ssl_client1" \
0 \
-s "[1-9][0-9]* bytes read" \
-s "[1-9][0-9]* bytes written" \
-c "[1-9][0-9]* bytes read" \
-c "[1-9][0-9]* bytes written" \
-S "error" \
-C "error"

requires_protocol_version tls12
run_test "Sample: ssl_pthread_server, openssl client, TLS 1.2" \
-P 4433 \
Expand Down Expand Up @@ -214,6 +315,38 @@ run_test "Sample: ssl_pthread_server, gnutls client, TLS 1.3" \
-S "error" \
-C "ERROR"

# The server complains of extra data after it closes the connection
# because the client keeps sending data, so the server receives
# more application data when it expects a new handshake. We consider
# the test a success if both sides have sent and received application
# data, no matter what happens afterwards.
run_test "Sample: dtls_client with dtls_server" \
-P 4433 \
"$PROGRAMS_DIR/dtls_server" \
"$PROGRAMS_DIR/dtls_client" \
0 \
-s "[1-9][0-9]* bytes read" \
-s "[1-9][0-9]* bytes written" \
-c "[1-9][0-9]* bytes read" \
-c "[1-9][0-9]* bytes written" \
-C "error"

# The server complains of extra data after it closes the connection
# because the client keeps sending data, so the server receives
# more application data when it expects a new handshake. We consider
# the test a success if both sides have sent and received application
# data, no matter what happens afterwards.
run_test "Sample: ssl_client2, dtls_server" \
-P 4433 \
"$PROGRAMS_DIR/dtls_server" \
"$PROGRAMS_DIR/ssl_client2 dtls=1" \
0 \
-s "[1-9][0-9]* bytes read" \
-s "[1-9][0-9]* bytes written" \
-c "[1-9][0-9]* bytes read" \
-c "[1-9][0-9]* bytes written" \
-C "error"

requires_protocol_version dtls12
run_test "Sample: dtls_server, openssl client, DTLS 1.2" \
-P 4433 \
Expand Down