1#!/bin/sh 2 3# context-info.sh 4# 5# Copyright The Mbed TLS Contributors 6# SPDX-License-Identifier: Apache-2.0 7# 8# Licensed under the Apache License, Version 2.0 (the "License"); you may 9# not use this file except in compliance with the License. 10# You may obtain a copy of the License at 11# 12# http://www.apache.org/licenses/LICENSE-2.0 13# 14# Unless required by applicable law or agreed to in writing, software 15# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 16# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 17# See the License for the specific language governing permissions and 18# limitations under the License. 19# 20# This program is intended for testing the ssl_context_info program 21# 22 23set -eu 24 25if ! cd "$(dirname "$0")"; then 26 exit 125 27fi 28 29# Variables 30 31THIS_SCRIPT_NAME=$(basename "$0") 32PROG_PATH="../programs/ssl/ssl_context_info" 33OUT_FILE="ssl_context_info.log" 34IN_DIR="data_files/base64" 35 36USE_VALGRIND=0 37 38T_COUNT=0 39T_PASSED=0 40T_FAILED=0 41 42 43# Functions 44 45print_usage() { 46 echo "Usage: $0 [options]" 47 printf " -h|--help\tPrint this help.\n" 48 printf " -m|--memcheck\tUse valgrind to check the memory.\n" 49} 50 51# Print test name <name> 52print_name() { 53 printf "%s %.*s " "$1" $(( 71 - ${#1} )) \ 54 "........................................................................" 55} 56 57# Print header to the test output file <test name> <file path> <test command> 58print_header() 59{ 60 date="$(date)" 61 echo "******************************************************************" > $2 62 echo "* File created by: $THIS_SCRIPT_NAME" >> $2 63 echo "* Test name: $1" >> $2 64 echo "* Date: $date" >> $2 65 echo "* Command: $3" >> $2 66 echo "******************************************************************" >> $2 67 echo "" >> $2 68} 69 70# Print footer at the end of file <file path> 71print_footer() 72{ 73 echo "" >> $1 74 echo "******************************************************************" >> $1 75 echo "* End command" >> $1 76 echo "******************************************************************" >> $1 77 echo "" >> $1 78} 79 80# Use the arguments of this script 81get_options() { 82 while [ $# -gt 0 ]; do 83 case "$1" in 84 -h|--help) 85 print_usage 86 exit 0 87 ;; 88 -m|--memcheck) 89 USE_VALGRIND=1 90 ;; 91 *) 92 echo "Unknown argument: '$1'" 93 print_usage 94 exit 1 95 ;; 96 esac 97 shift 98 done 99} 100 101# Current test failed 102fail() 103{ 104 T_FAILED=$(( $T_FAILED + 1)) 105 FAIL_OUT="Fail.$T_FAILED""_$OUT_FILE" 106 107 echo "FAIL" 108 echo " Error: $1" 109 110 cp -f "$OUT_FILE" "$FAIL_OUT" 111 echo "Error: $1" >> "$FAIL_OUT" 112} 113 114# Current test passed 115pass() 116{ 117 T_PASSED=$(( $T_PASSED + 1)) 118 echo "PASS" 119} 120 121# Usage: run_test <name> <input file with b64 code> [ -arg <extra arguments for tested program> ] [option [...]] 122# Options: -m <pattern that MUST be present in the output of tested program> 123# -n <pattern that must NOT be present in the output of tested program> 124# -u <pattern that must be UNIQUE in the output of tested program> 125run_test() 126{ 127 TEST_NAME="$1" 128 RUN_CMD="$PROG_PATH -f $IN_DIR/$2" 129 130 if [ "-arg" = "$3" ]; then 131 RUN_CMD="$RUN_CMD $4" 132 shift 4 133 else 134 shift 2 135 fi 136 137 # prepend valgrind to our commands if active 138 if [ "$USE_VALGRIND" -gt 0 ]; then 139 RUN_CMD="valgrind --leak-check=full $RUN_CMD" 140 fi 141 142 T_COUNT=$(( $T_COUNT + 1)) 143 print_name "$TEST_NAME" 144 145 # run tested program 146 print_header "$TEST_NAME" "$OUT_FILE" "$RUN_CMD" 147 eval "$RUN_CMD" >> "$OUT_FILE" 2>&1 148 print_footer "$OUT_FILE" 149 150 # check valgrind's results 151 if [ "$USE_VALGRIND" -gt 0 ]; then 152 if ! ( grep -F 'All heap blocks were freed -- no leaks are possible' "$OUT_FILE" && 153 grep -F 'ERROR SUMMARY: 0 errors from 0 contexts' "$OUT_FILE" ) > /dev/null 154 then 155 fail "Memory error detected" 156 return 157 fi 158 fi 159 160 # check other assertions 161 # lines beginning with == are added by valgrind, ignore them, because we already checked them before 162 # lines with 'Serious error when reading debug info', are valgrind issues as well 163 # lines beginning with * are added by this script, ignore too 164 while [ $# -gt 0 ] 165 do 166 case $1 in 167 "-m") 168 if grep -v '^==' "$OUT_FILE" | grep -v 'Serious error when reading debug info' | grep -v "^*" | grep "$2" >/dev/null; then :; else 169 fail "pattern '$2' MUST be present in the output" 170 return 171 fi 172 ;; 173 174 "-n") 175 if grep -v '^==' "$OUT_FILE" | grep -v 'Serious error when reading debug info' | grep -v "^*" | grep "$2" >/dev/null; then 176 fail "pattern '$2' MUST NOT be present in the output" 177 return 178 fi 179 ;; 180 181 "-u") 182 if [ $(grep -v '^==' "$OUT_FILE"| grep -v 'Serious error when reading debug info' | grep -v "^*" | grep "$2" | wc -l) -ne 1 ]; then 183 fail "lines following pattern '$2' must be once in the output" 184 return 185 fi 186 ;; 187 188 *) 189 echo "Unknown test: $1" >&2 190 exit 1 191 esac 192 shift 2 193 done 194 195 rm -f "$OUT_FILE" 196 197 pass 198} 199 200get_options "$@" 201 202# Tests 203 204run_test "Default configuration, server" \ 205 "srv_def.txt" \ 206 -n "ERROR" \ 207 -u "major.* 2$" \ 208 -u "minor.* 21$" \ 209 -u "path.* 0$" \ 210 -u "MBEDTLS_HAVE_TIME$" \ 211 -u "MBEDTLS_X509_CRT_PARSE_C$" \ 212 -u "MBEDTLS_SSL_MAX_FRAGMENT_LENGTH$" \ 213 -u "MBEDTLS_SSL_ENCRYPT_THEN_MAC$" \ 214 -u "MBEDTLS_SSL_SESSION_TICKETS$" \ 215 -u "MBEDTLS_SSL_SESSION_TICKETS and client$" \ 216 -u "MBEDTLS_SSL_DTLS_ANTI_REPLAY$" \ 217 -u "MBEDTLS_SSL_ALPN$" \ 218 -u "ciphersuite.* TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256$" \ 219 -u "cipher flags.* 0x00$" \ 220 -u "Message-Digest.* SHA256$" \ 221 -u "compression.* disabled$" \ 222 -u "DTLS datagram packing.* enabled$" \ 223 -n "Certificate" \ 224 -n "bytes left to analyze from context" 225 226run_test "Default configuration, client" \ 227 "cli_def.txt" \ 228 -n "ERROR" \ 229 -u "major.* 2$" \ 230 -u "minor.* 21$" \ 231 -u "path.* 0$" \ 232 -u "MBEDTLS_HAVE_TIME$" \ 233 -u "MBEDTLS_X509_CRT_PARSE_C$" \ 234 -u "MBEDTLS_SSL_MAX_FRAGMENT_LENGTH$" \ 235 -u "MBEDTLS_SSL_ENCRYPT_THEN_MAC$" \ 236 -u "MBEDTLS_SSL_SESSION_TICKETS$" \ 237 -u "MBEDTLS_SSL_SESSION_TICKETS and client$" \ 238 -u "MBEDTLS_SSL_DTLS_ANTI_REPLAY$" \ 239 -u "MBEDTLS_SSL_ALPN$" \ 240 -u "ciphersuite.* TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256$" \ 241 -u "cipher flags.* 0x00$" \ 242 -u "Message-Digest.* SHA256$" \ 243 -u "compression.* disabled$" \ 244 -u "DTLS datagram packing.* enabled$" \ 245 -u "cert. version .* 3$" \ 246 -u "serial number.* 02$" \ 247 -u "issuer name.* C=NL, O=PolarSSL, CN=PolarSSL Test CA$" \ 248 -u "subject name.* C=NL, O=PolarSSL, CN=localhost$" \ 249 -u "issued on.* 2019-02-10 14:44:06$" \ 250 -u "expires on.* 2029-02-10 14:44:06$" \ 251 -u "signed using.* RSA with SHA-256$" \ 252 -u "RSA key size.* 2048 bits$" \ 253 -u "basic constraints.* CA=false$" \ 254 -n "bytes left to analyze from context" 255 256run_test "Ciphersuite TLS-RSA-WITH-AES-256-CCM-8, server" \ 257 "srv_ciphersuite.txt" \ 258 -n "ERROR" \ 259 -u "ciphersuite.* TLS-RSA-WITH-AES-256-CCM-8$" \ 260 261run_test "Ciphersuite TLS-RSA-WITH-AES-256-CCM-8, client" \ 262 "cli_ciphersuite.txt" \ 263 -n "ERROR" \ 264 -u "ciphersuite.* TLS-RSA-WITH-AES-256-CCM-8$" \ 265 266run_test "No packing, server" \ 267 "srv_no_packing.txt" \ 268 -n "ERROR" \ 269 -u "DTLS datagram packing.* disabled" 270 271run_test "No packing, client" \ 272 "cli_no_packing.txt" \ 273 -n "ERROR" \ 274 -u "DTLS datagram packing.* disabled" 275 276run_test "DTLS CID, server" \ 277 "srv_cid.txt" \ 278 -n "ERROR" \ 279 -u "in CID.* DE AD" \ 280 -u "out CID.* BE EF" 281 282run_test "DTLS CID, client" \ 283 "cli_cid.txt" \ 284 -n "ERROR" \ 285 -u "in CID.* BE EF" \ 286 -u "out CID.* DE AD" 287 288run_test "No MBEDTLS_SSL_MAX_FRAGMENT_LENGTH, server" \ 289 "srv_no_mfl.txt" \ 290 -n "ERROR" \ 291 -n "MBEDTLS_SSL_MAX_FRAGMENT_LENGTH" 292 293run_test "No MBEDTLS_SSL_MAX_FRAGMENT_LENGTH, client" \ 294 "cli_no_mfl.txt" \ 295 -n "ERROR" \ 296 -n "MBEDTLS_SSL_MAX_FRAGMENT_LENGTH" 297 298run_test "No MBEDTLS_SSL_ALPN, server" \ 299 "srv_no_alpn.txt" \ 300 -n "ERROR" \ 301 -n "MBEDTLS_SSL_ALPN" 302 303run_test "No MBEDTLS_SSL_ALPN, client" \ 304 "cli_no_alpn.txt" \ 305 -n "ERROR" \ 306 -n "MBEDTLS_SSL_ALPN" 307 308run_test "No MBEDTLS_SSL_KEEP_PEER_CERTIFICATE, server" \ 309 "srv_no_keep_cert.txt" \ 310 -arg "--keep-peer-cert=0" \ 311 -u "ciphersuite.* TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256$" \ 312 -u "cipher flags.* 0x00" \ 313 -u "compression.* disabled" \ 314 -u "DTLS datagram packing.* enabled" \ 315 -n "ERROR" 316 317run_test "No MBEDTLS_SSL_KEEP_PEER_CERTIFICATE, client" \ 318 "cli_no_keep_cert.txt" \ 319 -arg "--keep-peer-cert=0" \ 320 -u "ciphersuite.* TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256$" \ 321 -u "cipher flags.* 0x00" \ 322 -u "compression.* disabled" \ 323 -u "DTLS datagram packing.* enabled" \ 324 -n "ERROR" 325 326run_test "No MBEDTLS_SSL_KEEP_PEER_CERTIFICATE, negative, server" \ 327 "srv_no_keep_cert.txt" \ 328 -m "Deserializing" \ 329 -m "ERROR" 330 331run_test "No MBEDTLS_SSL_KEEP_PEER_CERTIFICATE, negative, client" \ 332 "cli_no_keep_cert.txt" \ 333 -m "Deserializing" \ 334 -m "ERROR" 335 336run_test "Minimal configuration, server" \ 337 "srv_min_cfg.txt" \ 338 -n "ERROR" \ 339 -n "MBEDTLS_SSL_MAX_FRAGMENT_LENGTH$" \ 340 -n "MBEDTLS_SSL_ENCRYPT_THEN_MAC$" \ 341 -n "MBEDTLS_SSL_SESSION_TICKETS$" \ 342 -n "MBEDTLS_SSL_SESSION_TICKETS and client$" \ 343 -n "MBEDTLS_SSL_DTLS_ANTI_REPLAY$" \ 344 -n "MBEDTLS_SSL_ALPN$" \ 345 346run_test "Minimal configuration, client" \ 347 "cli_min_cfg.txt" \ 348 -n "ERROR" \ 349 -n "MBEDTLS_SSL_MAX_FRAGMENT_LENGTH$" \ 350 -n "MBEDTLS_SSL_ENCRYPT_THEN_MAC$" \ 351 -n "MBEDTLS_SSL_SESSION_TICKETS$" \ 352 -n "MBEDTLS_SSL_SESSION_TICKETS and client$" \ 353 -n "MBEDTLS_SSL_DTLS_ANTI_REPLAY$" \ 354 -n "MBEDTLS_SSL_ALPN$" \ 355 356run_test "MTU=10000" \ 357 "mtu_10000.txt" \ 358 -n "ERROR" \ 359 -u "MTU.* 10000$" 360 361run_test "MFL=1024" \ 362 "mfl_1024.txt" \ 363 -n "ERROR" \ 364 -u "MFL.* 1024$" 365 366run_test "Older version (v2.19.1)" \ 367 "v2.19.1.txt" \ 368 -n "ERROR" \ 369 -u "major.* 2$" \ 370 -u "minor.* 19$" \ 371 -u "path.* 1$" \ 372 -u "ciphersuite.* TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8$" \ 373 -u "Message-Digest.* SHA256$" \ 374 -u "compression.* disabled$" \ 375 -u "serial number.* 01:70:AF:40:B4:E6$" \ 376 -u "issuer name.* CN=ca$" \ 377 -u "subject name.* L=160001, OU=acc1, CN=device01$" \ 378 -u "issued on.* 2020-03-06 09:50:18$" \ 379 -u "expires on.* 2056-02-26 09:50:18$" \ 380 -u "signed using.* ECDSA with SHA256$" \ 381 -u "lifetime.* 0 sec.$" \ 382 -u "MFL.* none$" \ 383 -u "negotiate truncated HMAC.* disabled$" \ 384 -u "Encrypt-then-MAC.* enabled$" \ 385 -u "DTLS datagram packing.* enabled$" \ 386 -u "verify result.* 0x00000000$" \ 387 -n "bytes left to analyze from context" 388 389run_test "Wrong base64 format" \ 390 "def_bad_b64.txt" \ 391 -m "ERROR" \ 392 -u "The length of the base64 code found should be a multiple of 4" \ 393 -n "bytes left to analyze from context" 394 395run_test "Too much data at the beginning of base64 code" \ 396 "def_b64_too_big_1.txt" \ 397 -m "ERROR" \ 398 -n "The length of the base64 code found should be a multiple of 4" \ 399 400run_test "Too much data in the middle of base64 code" \ 401 "def_b64_too_big_2.txt" \ 402 -m "ERROR" \ 403 -n "The length of the base64 code found should be a multiple of 4" \ 404 405run_test "Too much data at the end of base64 code" \ 406 "def_b64_too_big_3.txt" \ 407 -m "ERROR" \ 408 -n "The length of the base64 code found should be a multiple of 4" \ 409 -u "bytes left to analyze from context" 410 411run_test "Empty file as input" \ 412 "empty.txt" \ 413 -u "Finished. No valid base64 code found" 414 415run_test "Not empty file without base64 code" \ 416 "../../context-info.sh" \ 417 -n "Deserializing" 418 419run_test "Binary file instead of text file" \ 420 "../../../programs/ssl/ssl_context_info" \ 421 -m "ERROR" \ 422 -u "Too many bad symbols detected. File check aborted" \ 423 -n "Deserializing" 424 425run_test "Decoder continues past 0xff character" \ 426 "def_b64_ff.bin" \ 427 -n "No valid base64" \ 428 -u "ciphersuite.* TLS-" 429 430 431# End of tests 432 433echo 434if [ $T_FAILED -eq 0 ]; then 435 echo "PASSED ( $T_COUNT tests )" 436else 437 echo "FAILED ( $T_FAILED / $T_COUNT tests )" 438fi 439 440exit $T_FAILED 441