coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-11-09 14:50:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add tests demonstrating badmac_seen_or_in_hsfraglen confusion on the server

Browse Source 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine 2026-05-28 20:52:38 +02:00
parent 305bab2bbc
commit 397db25dc3
1 changed files with 92 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

92
tests/ssl-opt.sh
View File

@ -12789,6 +12789,25 @@ run_test "DTLS proxy: client: get invalid AD record then reject renego" \
-C "Verification of the message MAC failed" \
-C "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: server: get invalid AD record then reject renego (cli)" \
-p "$P_PXY bad_ad_cli_once=1" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=0 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 renegotiate=2 exchanges=4 badmac_limit=99 debug_level=3" \
1 \
-s "discarding invalid record (mac)" \
-c "=> renegotiate" \
-S "=> renegotiate" \
-s "refusing renegotiation" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-S "too many records with bad MAC" \
-S "Verification of the message MAC failed" \
-S "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: client: get invalid AD record then accept renego" \
-p "$P_PXY bad_ad_srv_once=1" \
@ -12807,6 +12826,42 @@ run_test "DTLS proxy: client: get invalid AD record then accept renego" \
-C "Verification of the message MAC failed" \
-C "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: server: get invalid AD record then accept renego (srv)" \
-p "$P_PXY bad_ad_cli_once=1" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiate=1 renegotiation=1 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 exchanges=4 badmac_limit=99 debug_level=3" \
0 \
-s "discarding invalid record (mac)" \
-s "=> renegotiate" \
-c "=> renegotiate" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-S "too many records with bad MAC" \
-S "Verification of the message MAC failed" \
-S "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: server: get invalid AD record then accept renego (cli)" \
-p "$P_PXY bad_ad_cli_once=1" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 renegotiate=2 exchanges=4 badmac_limit=99 debug_level=3" \
0 \
-s "discarding invalid record (mac)" \
-c "=> renegotiate" \
-s "=> renegotiate" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-S "too many records with bad MAC" \
-S "Verification of the message MAC failed" \
-S "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: client: get invalid AD record then reject early renego" \
-p "$P_PXY bad_ad_srv_once=1 delay_encrypted_hs_srv=3" \
@ -12849,6 +12904,43 @@ run_test "DTLS proxy: client: get invalid AD record then accept early renego"
-C "Verification of the message MAC failed" \
-C "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: server: get invalid AD record then reject early renego (cli)" \
-p "$P_PXY bad_ad_cli_once=1 delay_encrypted_hs_cli=2" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=0 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 renegotiate=2 exchanges=4 badmac_limit=99 debug_level=3" \
1 \
-s "discarding invalid record (mac)" \
-c "=> renegotiate" \
-S "=> renegotiate" \
-s "refusing renegotiation" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-S "too many records with bad MAC" \
-S "Verification of the message MAC failed" \
-S "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: server: get invalid AD record then accept early renego (cli)" \
-p "$P_PXY bad_ad_cli_once=1 delay_encrypted_hs_cli=2" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 renegotiate=2 exchanges=4 badmac_limit=99 debug_level=3" \
0 \
-s "discarding invalid record (mac)" \
-c "=> renegotiate" \
-s "=> renegotiate" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-S "too many records with bad MAC" \
-S "Verification of the message MAC failed" \
-S "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "DTLS proxy: delay ChangeCipherSpec" \
-p "$P_PXY delay_ccs=1" \