generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Extend ciphersuite test coverage.

Browse Source 
Add support for testing ECDSA and DSA ciphersuites.

Reviewed-by: Matt Caswell <matt@openssl.org>
This commit is contained in:
Dr. Stephen Henson 2015-08-26 14:28:38 +01:00
parent 04dc8b36ef
commit cf170f558b
1 changed files with 24 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
test/testssl
View File

@ -124,7 +124,8 @@ test_cipher() {
if [ $2 = "SSLv3" ] ; then if [ $2 = "SSLv3" ] ; then
prot="-ssl3" prot="-ssl3"
fi fi
$ssltest -cipher $_cipher $prot _exarg=$3
$ssltest $_exarg -cipher $_cipher $prot
if [ $? -ne 0 ] ; then if [ $? -ne 0 ] ; then
echo "Failed $_cipher" echo "Failed $_cipher"
exit 1 exit 1
@ -132,17 +133,31 @@ test_cipher() {
} }
echo "Testing ciphersuites" echo "Testing ciphersuites"
exkeys=""
ciphers="-EXP:-PSK:-SRP:-kDH:-kECDHe"
if ../util/shlib_wrap.sh ../apps/openssl no-dhparam >/dev/null; then
echo "skipping DHE tests"
ciphers="$ciphers:-kDHE"
fi
if ../util/shlib_wrap.sh ../apps/openssl no-dsa >/dev/null; then
echo "skipping DSA tests"
ciphers="$ciphers:-aDSA"
else
exkeys="$exkeys -s_cert certD.ss -s_key keyD.ss"
fi
if ../util/shlib_wrap.sh ../apps/openssl no-ec >/dev/null; then
echo "skipping EC tests"
ciphers="$ciphers:!aECDSA:!kECDH"
else
exkeys="$exkeys -s_cert certE.ss -s_key keyE.ss"
fi
for protocol in TLSv1.2 SSLv3; do for protocol in TLSv1.2 SSLv3; do
echo "Testing ciphersuites for $protocol" echo "Testing ciphersuites for $protocol"
for cipher in `../util/shlib_wrap.sh ../apps/openssl ciphers "RSA+$protocol" | tr ':' ' '`; do for cipher in `../util/shlib_wrap.sh ../apps/openssl ciphers "$protocol:$ciphers" | tr ':' ' '`; do
test_cipher $cipher $protocol test_cipher $cipher $protocol "$exkeys"
done done
if ../util/shlib_wrap.sh ../apps/openssl no-dhparam; then
echo "skipping RSA+DHE tests"
else
for cipher in `../util/shlib_wrap.sh ../apps/openssl ciphers "EDH+aRSA+$protocol:-EXP" | tr ':' ' '`; do
test_cipher $cipher $protocol
done
echo "testing connection with weak DH, expecting failure" echo "testing connection with weak DH, expecting failure"
if [ $protocol = "SSLv3" ] ; then if [ $protocol = "SSLv3" ] ; then
$ssltest -s_cipher "EDH" -c_cipher "EDH:@SECLEVEL=1" -dhe512 -ssl3 $ssltest -s_cipher "EDH" -c_cipher "EDH:@SECLEVEL=1" -dhe512 -ssl3
@ -153,14 +168,6 @@ for protocol in TLSv1.2 SSLv3; do
echo "FAIL: connection with weak DH succeeded" echo "FAIL: connection with weak DH succeeded"
exit 1 exit 1
fi fi
fi
if ../util/shlib_wrap.sh ../apps/openssl no-ec; then
echo "skipping RSA+ECDHE tests"
else
for cipher in `../util/shlib_wrap.sh ../apps/openssl ciphers "EECDH+aRSA+$protocol:-EXP" | tr ':' ' '`; do
test_cipher $cipher $protocol
done
fi
done done
############################################################################# #############################################################################