tests/suite/testcompat-main

   1 #!/bin/sh
   2
   3 # Copyright (C) 2010-2012 Free Software Foundation, Inc.
   4 #
   5 # Author: Nikos Mavrogiannopoulos
   6 #
   7 # This file is part of GnuTLS.
   8 #
   9 # GnuTLS is free software; you can redistribute it and/or modify it
  10 # under the terms of the GNU General Public License as published by the
  11 # Free Software Foundation; either version 3 of the License, or (at
  12 # your option) any later version.
  13 #
  14 # GnuTLS is distributed in the hope that it will be useful, but
  15 # WITHOUT ANY WARRANTY; without even the implied warranty of
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17 # General Public License for more details.
  18 #
  19 # You should have received a copy of the GNU General Public License
  20 # along with GnuTLS; if not, write to the Free Software Foundation,
  21 # Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  22
  23 srcdir="${srcdir:-.}"
  24 CLI="${CLI:-../../src/gnutls-cli$EXEEXT}"
  25 PORT="${PORT:-5558}"
  26 unset RETCODE
  27
  28 if test "${WINDIR}" != "";then
  29   exit 77
  30 fi
  31
  32 . $srcdir/../scripts/common.sh
  33
  34 SERV=openssl
  35 OPENSSL_CLI="openssl"
  36
  37 echo "Compatibility checks using "`$SERV version`
  38 $SERV version|grep -e 1\.0 >/dev/null 2>&1
  39 SV=$?
  40 if test $SV != 0;then
  41   echo "OpenSSL 1.0.0 is required for ECDH and DTLS tests"
  42   exit 77
  43 fi
  44
  45 $SERV version|grep -e 1\.0\.1 >/dev/null 2>&1
  46 SV2=$?
  47
  48 DSA_CERT=$srcdir/../dsa/cert.dsa.1024.pem
  49 DSA_KEY=$srcdir/../dsa/dsa.1024.pem
  50
  51 RSA_CERT=$srcdir/../certs/cert-rsa-2432.pem
  52 RSA_KEY=$srcdir/../certs/rsa-2432.pem
  53
  54 CA_CERT=$srcdir/../../doc/credentials/x509/ca.pem
  55 CLI_CERT=$srcdir/../../doc/credentials/x509/clicert.pem
  56 CLI_KEY=$srcdir/../../doc/credentials/x509/clikey.pem
  57
  58 CA_ECC_CERT=$srcdir/../certs/ca-cert-ecc.pem
  59 ECC224_CERT=$srcdir/../certs/cert-ecc.pem
  60 ECC224_KEY=$srcdir/../certs/ecc.pem
  61
  62 ECC256_CERT=$srcdir/../certs/cert-ecc256.pem
  63 ECC256_KEY=$srcdir/../certs/ecc256.pem
  64
  65 ECC521_CERT=$srcdir/../certs/cert-ecc521.pem
  66 ECC521_KEY=$srcdir/../certs/ecc521.pem
  67
  68 ECC384_CERT=$srcdir/../certs/cert-ecc384.pem
  69 ECC384_KEY=$srcdir/../certs/ecc384.pem
  70
  71 SERV_CERT=$srcdir/../../doc/credentials/x509/cert-rsa.pem
  72 SERV_KEY=$srcdir/../../doc/credentials/x509/key-rsa.pem
  73 SERV_DSA_CERT=$srcdir/../../doc/credentials/x509/cert-dsa.pem
  74 SERV_DSA_KEY=$srcdir/../../doc/credentials/x509/key-dsa.pem
  75
  76 echo "#####################"
  77 echo "# Client mode tests #"
  78 echo "#####################"
  79
  80
  81 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -ssl3 -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -dkey $DSA_KEY -dcert $DSA_CERT -Verify 1 -CAfile $CA_CERT &
  82 PID=$!
  83 wait_server $PID
  84
  85 # Test SSL 3.0 with RSA ciphersuite
  86 echo "Checking SSL 3.0 with RSA..."
  87 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-SSL3.0:+RSA" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
  88   fail $PID "Failed"
  89
  90 # Test SSL 3.0 with DHE-RSA ciphersuite
  91 echo "Checking SSL 3.0 with DHE-RSA..."
  92 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-SSL3.0:+DHE-RSA" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
  93   fail $PID "Failed"
  94
  95 # Test SSL 3.0 with DHE-DSS ciphersuite
  96 echo "Checking SSL 3.0 with DHE-DSS..."
  97 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-SSL3.0:+DHE-DSS" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
  98   fail $PID "Failed"
  99
 100 kill $PID
 101 wait
 102
 103 #-cipher RSA-NULL
 104 launch_bare_server $$ s_server -cipher NULL -quiet -www -accept $PORT -keyform pem -certform pem -tls1 -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -Verify 1 -CAfile $CA_CERT &
 105 PID=$!
 106 wait_server $PID
 107
 108 # Test TLS 1.0 with RSA-NULL ciphersuite
 109 echo "Checking TLS 1.0 with RSA-NULL..."
 110 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+NULL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+RSA" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
 111   fail $PID "Failed"
 112
 113 kill $PID
 114 wait
 115
 116 #-cipher RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA
 117 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1 -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -dkey $DSA_KEY -dcert $DSA_CERT -Verify 1 -CAfile $CA_CERT &
 118 PID=$!
 119 wait_server $PID
 120
 121 # Test TLS 1.0 with RSA ciphersuite
 122 echo "Checking TLS 1.0 with RSA..."
 123 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+RSA" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
 124   fail $PID "Failed"
 125
 126 # Test TLS 1.0 with DHE-RSA ciphersuite
 127 echo "Checking TLS 1.0 with DHE-RSA..."
 128 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+DHE-RSA" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
 129   fail $PID "Failed"
 130
 131 # Test TLS 1.0 with DHE-RSA ciphersuite
 132 echo "Checking TLS 1.0 with ECDHE-RSA..."
 133 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-RSA:+CURVE-ALL" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
 134   fail $PID "Failed"
 135
 136 # Test TLS 1.0 with DHE-DSS ciphersuite
 137 echo "Checking TLS 1.0 with DHE-DSS..."
 138 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+DHE-DSS" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
 139   fail $PID "Failed"
 140
 141 kill $PID
 142 wait
 143
 144 #-cipher ECDHE-ECDSA-AES128-SHA
 145 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1 -key $ECC224_KEY -cert $ECC224_CERT -Verify 1 -named_curve secp224r1 -CAfile $CA_ECC_CERT &
 146 PID=$!
 147 wait_server $PID
 148
 149 # Test TLS 1.0 with ECDHE-ECDSA ciphersuite
 150 echo "Checking TLS 1.0 with ECDHE-ECDSA (SECP224R1)..."
 151 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL" --insecure --x509certfile $ECC224_CERT --x509keyfile $ECC224_KEY </dev/null >/dev/null || \
 152   fail $PID "Failed"
 153
 154 kill $PID
 155 wait
 156
 157 #-cipher ECDHE-ECDSA-AES128-SHA
 158 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1 -key $ECC384_KEY -cert $ECC384_CERT -Verify 1 -named_curve secp384r1 -CAfile $CA_ECC_CERT &
 159 PID=$!
 160 wait_server $PID
 161
 162 # Test TLS 1.0 with ECDHE-ECDSA ciphersuite
 163 echo "Checking TLS 1.0 with ECDHE-ECDSA (SECP384R1)..."
 164 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL" --insecure --x509certfile $ECC384_CERT --x509keyfile $ECC384_KEY </dev/null >/dev/null || \
 165   fail $PID "Failed"
 166
 167 kill $PID
 168 wait
 169
 170 #-cipher ECDHE-ECDSA-AES128-SHA
 171 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1 -key $ECC521_KEY -cert $ECC521_CERT -Verify 1 -named_curve secp521r1 -CAfile $CA_ECC_CERT &
 172 PID=$!
 173 wait_server $PID
 174
 175 # Test TLS 1.0 with ECDHE-ECDSA ciphersuite
 176 echo "Checking TLS 1.0 with ECDHE-ECDSA (SECP521R1)..."
 177 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL" --insecure --x509certfile $ECC521_CERT --x509keyfile $ECC521_KEY </dev/null >/dev/null || \
 178   fail $PID "Failed"
 179
 180 kill $PID
 181 wait
 182
 183
 184 if test $SV2 = 0;then
 185 # Tests requiring openssl 1.0.1 - TLS 1.2
 186 #-cipher RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA
 187 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1_2 -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -dkey $DSA_KEY -dcert $DSA_CERT -Verify 1 -CAfile $CA_CERT &
 188 PID=$!
 189 wait_server $PID
 190
 191 echo "Checking TLS 1.2 with RSA..."
 192 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+RSA" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
 193   fail $PID "Failed"
 194
 195 echo "Checking TLS 1.2 with DHE-RSA..."
 196 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+DHE-RSA" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
 197   fail $PID "Failed"
 198
 199 echo "Checking TLS 1.2 with ECDHE-RSA..."
 200 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-RSA:+CURVE-ALL" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
 201   fail $PID "Failed"
 202
 203 echo "Checking TLS 1.2 with DHE-DSS..."
 204 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+DHE-DSS" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
 205   fail $PID "Failed"
 206
 207 kill $PID
 208 wait
 209
 210 #-cipher ECDHE-ECDSA-AES128-SHA
 211 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1_2 -key $ECC224_KEY -cert $ECC224_CERT -Verify 1 -named_curve secp224r1 -CAfile $CA_ECC_CERT &
 212 PID=$!
 213 wait_server $PID
 214
 215 echo "Checking TLS 1.2 with ECDHE-ECDSA... (SECP224R1)"
 216 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL" --insecure --x509certfile $ECC224_CERT --x509keyfile $ECC224_KEY </dev/null >/dev/null || \
 217   fail $PID "Failed"
 218
 219 kill $PID
 220 wait
 221
 222 #-cipher ECDHE-ECDSA-AES128-SHA
 223 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1_2 -key $ECC384_KEY -cert $ECC384_CERT -Verify 1 -named_curve secp384r1 -CAfile $CA_ECC_CERT &
 224 PID=$!
 225 wait_server $PID
 226
 227 echo "Checking TLS 1.2 with ECDHE-ECDSA... (SECP384R1)"
 228 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL" --insecure --x509certfile $ECC384_CERT --x509keyfile $ECC384_KEY </dev/null >/dev/null || \
 229   fail $PID "Failed"
 230
 231 kill $PID
 232 wait
 233
 234 #-cipher ECDHE-ECDSA-AES128-SHA
 235 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1_2 -key $ECC521_KEY -cert $ECC521_CERT -Verify 1 -named_curve secp521r1 -CAfile $CA_ECC_CERT &
 236 PID=$!
 237 wait_server $PID
 238
 239 echo "Checking TLS 1.2 with ECDHE-ECDSA... (SECP521R1)"
 240 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL" --insecure --x509certfile $ECC521_CERT --x509keyfile $ECC521_KEY </dev/null >/dev/null || \
 241   fail $PID "Failed"
 242
 243 kill $PID
 244 wait
 245
 246 fi #SV2
 247
 248 launch_bare_server $$ s_server -quiet -accept $PORT -keyform pem -certform pem -dtls1 -timeout -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -dkey $DSA_KEY -dcert $DSA_CERT -Verify 1 -CAfile $CA_CERT &
 249 PID=$!
 250 wait_server $PID
 251
 252 # Test DTLS 1.0 with RSA ciphersuite
 253 echo "Checking DTLS 1.0 with RSA..."
 254 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-DTLS1.0:+RSA" --udp --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
 255   fail $PID "Failed"
 256
 257 kill $PID
 258 wait
 259
 260 launch_bare_server $$ s_server -quiet -accept $PORT -keyform pem -certform pem -dtls1 -timeout -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -dkey $DSA_KEY -dcert $DSA_CERT -Verify 1 -CAfile $CA_CERT &
 261 PID=$!
 262 wait_server $PID
 263
 264 # Test DTLS 1.0 with DHE-RSA ciphersuite
 265 echo "Checking DTLS 1.0 with DHE-RSA..."
 266 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-DTLS1.0:+DHE-RSA" --udp --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
 267   fail $PID "Failed"
 268
 269 kill $PID
 270 wait
 271
 272 launch_bare_server $$ s_server -quiet -accept $PORT -keyform pem -certform pem -dtls1 -timeout -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -dkey $DSA_KEY -dcert $DSA_CERT -Verify 1 -CAfile $CA_CERT &
 273 PID=$!
 274 wait_server $PID
 275
 276 # Test DTLS 1.0 with DHE-DSS ciphersuite
 277 echo "Checking DTLS 1.0 with DHE-DSS..."
 278 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-DTLS1.0:+DHE-DSS" --udp --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \
 279   fail $PID "Failed"
 280
 281 kill $PID
 282 wait
 283
 284
 285
 286 echo "Client mode tests were successfully completed"
 287 echo ""
 288 echo "#####################"
 289 echo "# Server mode tests #"
 290 echo "#####################"
 291 SERV="../../src/gnutls-serv$EXEEXT -q"
 292 PORT="5559"
 293
 294 # Note that openssl s_client does not return error code on failure
 295
 296 echo "Check SSL 3.0 with RSA ciphersuite"
 297 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-SSL3.0:+RSA" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh  & PID=$!
 298 wait_server $PID
 299
 300 $OPENSSL_CLI s_client  -host localhost -port $PORT -ssl3 -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 301   fail $PID "Failed"
 302
 303 kill $PID
 304 wait
 305
 306 echo "Check SSL 3.0 with DHE-RSA ciphersuite"
 307 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-SSL3.0:+DHE-RSA" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh  & PID=$!
 308 wait_server $PID
 309
 310 $OPENSSL_CLI s_client  -host localhost -port $PORT -ssl3 -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 311   fail $PID "Failed"
 312
 313 kill $PID
 314 wait
 315
 316 echo "Check SSL 3.0 with DHE-DSS ciphersuite"
 317 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-SSL3.0:+DHE-DSS" --x509certfile $SERV_DSA_CERT --x509keyfile $SERV_DSA_KEY --dhparams params.dh  & PID=$!
 318 wait_server $PID
 319
 320 $OPENSSL_CLI s_client  -host localhost -port $PORT -ssl3 -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 321   fail $PID "Failed"
 322
 323 kill $PID
 324 wait
 325
 326 #TLS 1.0
 327
 328 # This test was disabled because it doesn't work as expected with openssl 1.0.0d
 329 #echo "Check TLS 1.0 with RSA ciphersuite (SSLv2 hello)"
 330 #launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+RSA" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh & PID=$!
 331 #wait_server $PID
 332 #
 333 #$OPENSSL_CLI s_client  -host localhost -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 334 #  fail $PID "Failed"
 335 #
 336 #kill $PID
 337 #wait
 338
 339 echo "Check TLS 1.0 with RSA-NULL ciphersuite"
 340 launch_server $$  --priority "NONE:+NULL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+RSA:+DHE-RSA" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh  & PID=$!
 341 wait_server $PID
 342
 343 $OPENSSL_CLI s_client -cipher NULL-SHA -host localhost -tls1 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 344   fail $PID "Failed"
 345
 346 kill $PID
 347 wait
 348
 349 echo "Check TLS 1.0 with DHE-RSA ciphersuite"
 350 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+DHE-RSA" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh  & PID=$!
 351 wait_server $PID
 352
 353 $OPENSSL_CLI s_client  -host localhost -tls1 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 354   fail $PID "Failed"
 355
 356 kill $PID
 357 wait
 358
 359 echo "Check TLS 1.0 with DHE-DSS ciphersuite"
 360 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+DHE-DSS" --x509certfile $SERV_DSA_CERT --x509keyfile $SERV_DSA_KEY --dhparams params.dh  & PID=$!
 361 wait_server $PID
 362
 363 $OPENSSL_CLI s_client  -host localhost -tls1 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 364   fail $PID "Failed"
 365
 366 kill $PID
 367 wait
 368
 369 echo "Check TLS 1.0 with ECDHE-RSA ciphersuite"
 370 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-RSA:+CURVE-ALL" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT & PID=$!
 371 wait_server $PID
 372
 373 #-cipher ECDHE-RSA-AES128-SHA
 374 $OPENSSL_CLI s_client  -host localhost -tls1 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 375   fail $PID "Failed"
 376
 377 kill $PID
 378 wait
 379
 380 echo "Check TLS 1.0 with ECDHE-ECDSA ciphersuite (SECP224R1)"
 381 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL" --x509certfile $ECC224_CERT --x509keyfile $ECC224_KEY --x509cafile $CA_ECC_CERT & PID=$!
 382 wait_server $PID
 383
 384 #-cipher ECDHE-ECDSA-AES128-SHA
 385 $OPENSSL_CLI s_client  -host localhost -tls1 -port $PORT -cert $ECC224_CERT -key $ECC224_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \
 386   fail $PID "Failed"
 387
 388 kill $PID
 389 wait
 390
 391 echo "Check TLS 1.0 with ECDHE-ECDSA ciphersuite (SECP256R1)"
 392 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL" --x509certfile $ECC256_CERT --x509keyfile $ECC256_KEY --x509cafile $CA_ECC_CERT & PID=$!
 393 wait_server $PID
 394
 395 #-cipher ECDHE-ECDSA-AES128-SHA
 396 $OPENSSL_CLI s_client  -host localhost -tls1 -port $PORT -cert $ECC256_CERT -key $ECC256_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \
 397   fail $PID "Failed"
 398
 399 kill $PID
 400 wait
 401
 402 echo "Check TLS 1.0 with ECDHE-ECDSA ciphersuite (SECP384R1)"
 403 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL" --x509certfile $ECC384_CERT --x509keyfile $ECC384_KEY --x509cafile $CA_ECC_CERT & PID=$!
 404 wait_server $PID
 405
 406 #-cipher ECDHE-ECDSA-AES128-SHA
 407 $OPENSSL_CLI s_client  -host localhost -tls1 -port $PORT -cert $ECC384_CERT -key $ECC384_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \
 408   fail $PID "Failed"
 409
 410 kill $PID
 411 wait
 412
 413 echo "Check TLS 1.0 with ECDHE-ECDSA ciphersuite (SECP521R1)"
 414 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL" --x509certfile $ECC521_CERT --x509keyfile $ECC521_KEY --x509cafile $CA_ECC_CERT & PID=$!
 415 wait_server $PID
 416
 417 #-cipher ECDHE-ECDSA-AES128-SHA
 418 $OPENSSL_CLI s_client  -host localhost -tls1 -port $PORT -cert $ECC521_CERT -key $ECC521_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \
 419   fail $PID "Failed"
 420
 421 kill $PID
 422 wait
 423
 424 if test $SV2 = 0;then
 425
 426 echo "Check TLS 1.2 with DHE-RSA ciphersuite"
 427 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+DHE-RSA" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh  & PID=$!
 428 wait_server $PID
 429
 430 $OPENSSL_CLI s_client  -host localhost -tls1_2 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 431   fail $PID "Failed"
 432
 433 kill $PID
 434 wait
 435
 436 echo "Check TLS 1.2 with DHE-DSS ciphersuite"
 437 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+DHE-DSS" --x509certfile $SERV_DSA_CERT --x509keyfile $SERV_DSA_KEY --dhparams params.dh  & PID=$!
 438 wait_server $PID
 439
 440 $OPENSSL_CLI s_client  -host localhost -tls1_2 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 441   fail $PID "Failed"
 442
 443 kill $PID
 444 wait
 445
 446 echo "Check TLS 1.2 with ECDHE-RSA ciphersuite"
 447 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-RSA:+CURVE-ALL" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT & PID=$!
 448 wait_server $PID
 449
 450 #-cipher ECDHE-RSA-AES128-SHA
 451 $OPENSSL_CLI s_client  -host localhost -tls1_2 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 452   fail $PID "Failed"
 453
 454 kill $PID
 455 wait
 456
 457 echo "Check TLS 1.2 with ECDHE-ECDSA ciphersuite (SECP224R1)"
 458 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL" --x509certfile $ECC224_CERT --x509keyfile $ECC224_KEY --x509cafile $CA_ECC_CERT & PID=$!
 459 wait_server $PID
 460
 461 #-cipher ECDHE-ECDSA-AES128-SHA
 462 $OPENSSL_CLI s_client  -host localhost -tls1_2 -port $PORT -cert $ECC224_CERT -key $ECC224_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \
 463   fail $PID "Failed"
 464
 465 kill $PID
 466 wait
 467
 468 echo "Check TLS 1.2 with ECDHE-ECDSA ciphersuite (SECP256R1)"
 469 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL" --x509certfile $ECC256_CERT --x509keyfile $ECC256_KEY --x509cafile $CA_ECC_CERT & PID=$!
 470 wait_server $PID
 471
 472 #-cipher ECDHE-ECDSA-AES128-SHA
 473 $OPENSSL_CLI s_client  -host localhost -tls1_2 -port $PORT -cert $ECC256_CERT -key $ECC256_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \
 474   fail $PID "Failed"
 475
 476 kill $PID
 477 wait
 478
 479 echo "Check TLS 1.2 with ECDHE-ECDSA ciphersuite (SECP384R1)"
 480 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL" --x509certfile $ECC384_CERT --x509keyfile $ECC384_KEY --x509cafile $CA_ECC_CERT & PID=$!
 481 wait_server $PID
 482
 483 #-cipher ECDHE-ECDSA-AES128-SHA
 484 $OPENSSL_CLI s_client  -host localhost -tls1_2 -port $PORT -cert $ECC384_CERT -key $ECC384_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \
 485   fail $PID "Failed"
 486
 487 kill $PID
 488 wait
 489
 490 echo "Check TLS 1.2 with ECDHE-ECDSA ciphersuite (SECP521R1)"
 491 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL" --x509certfile $ECC521_CERT --x509keyfile $ECC521_KEY --x509cafile $CA_ECC_CERT & PID=$!
 492 wait_server $PID
 493
 494 #-cipher ECDHE-ECDSA-AES128-SHA
 495 $OPENSSL_CLI s_client  -host localhost -tls1_2 -port $PORT -cert $ECC521_CERT -key $ECC521_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \
 496   fail $PID "Failed"
 497
 498 kill $PID
 499 wait
 500
 501
 502 fi #SV2
 503
 504 # DTLS
 505 echo "Check DTLS 1.0 with RSA ciphersuite"
 506 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-DTLS1.0:+RSA" --udp --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh  & PID=$!
 507 wait_server $PID
 508
 509 $OPENSSL_CLI s_client  -host localhost -port $PORT -dtls1 -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 510   fail $PID "Failed"
 511
 512 kill $PID
 513 wait
 514
 515 echo "Check DTLS 1.0 with DHE-RSA ciphersuite"
 516 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-DTLS1.0:+DHE-RSA" --udp --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh  & PID=$!
 517 wait_server $PID
 518
 519 $CLI s_client  -host localhost -port $PORT -dtls1 -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 520   fail $PID "Failed"
 521
 522 kill $PID
 523 wait
 524
 525 echo "Check DTLS 1.0 with DHE-DSS ciphersuite"
 526 launch_server $$  --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-DTLS1.0:+DHE-DSS" --udp --x509certfile $SERV_DSA_CERT --x509keyfile $SERV_DSA_KEY --dhparams params.dh  & PID=$!
 527 wait_server $PID
 528
 529 $CLI s_client  -host localhost -port $PORT -dtls1 -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \
 530   fail $PID "Failed"
 531
 532 kill $PID
 533 wait
 534
 535 exit 0