Mbed-TLS/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-08-07 19:57:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10603 from ronald-cron-arm/dtls-client-hello-defragmentation-prep-3.6

Browse Source 
Backport 3.6: Some preparatory work for DTLS client hello defragmentation
This commit is contained in:
Bence Szépkúti
2026-02-22 23:30:44 +00:00
committed by GitHub
parent fbfd13e22b d8b97c6a28
commit 34fcd9ae4f
11 changed files with 102 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
framework
+1 -1
Submodule framework updated: 875ec308e7...8ed11c99fe
library/ssl_debug_helpers.h
+2
View File
@@ -38,6 +38,8 @@ const char *mbedtls_ssl_named_group_to_str(uint16_t in);
const char *mbedtls_ssl_get_extension_name(unsigned int extension_type);
const char *mbedtls_ssl_get_hs_msg_name(int hs_msg_type);
void mbedtls_ssl_print_extensions(const mbedtls_ssl_context *ssl,
int level, const char *file, int line,
int hs_msg_type, uint32_t extensions_mask,
library/ssl_msg.c
+6 -2
View File
@@ -19,6 +19,7 @@
#include "mbedtls/ssl.h"
#include "ssl_misc.h"
#include "debug_internal.h"
#include "ssl_debug_helpers.h"
#include "mbedtls/error.h"
#include "mbedtls/platform_util.h"
#include "mbedtls/version.h"
@@ -2618,7 +2619,8 @@ int mbedtls_ssl_flight_transmit(mbedtls_ssl_context *ssl)
max_hs_frag_len : rem_len;
if (frag_off == 0 && cur_hs_frag_len != hs_len) {
MBEDTLS_SSL_DEBUG_MSG(2, ("fragmenting handshake message (%u > %u)",
MBEDTLS_SSL_DEBUG_MSG(2, ("fragmenting %s handshake message (%u > %u)",
mbedtls_ssl_get_hs_msg_name(cur->p[0]),
(unsigned) cur_hs_frag_len,
(unsigned) max_hs_frag_len));
}
@@ -4449,7 +4451,9 @@ static int ssl_load_buffered_message(mbedtls_ssl_context *ssl)
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
}
MBEDTLS_SSL_DEBUG_MSG(2, ("Next handshake message has been buffered - load"));
MBEDTLS_SSL_DEBUG_MSG(2, ("%s handshake message has been buffered%s",
mbedtls_ssl_get_hs_msg_name(hs_buf->data[0]),
hs_buf->is_fragmented ? " and reassembled" : ""));
MBEDTLS_SSL_DEBUG_BUF(3, "Buffered handshake message (incl. header)",
hs_buf->data, msg_len + 12);
library/ssl_tls.c
+12 -4
View File
@@ -685,7 +685,7 @@ const char *mbedtls_ssl_get_extension_name(unsigned int extension_type)
mbedtls_ssl_get_extension_id(extension_type)];
}
static const char *ssl_tls13_get_hs_msg_name(int hs_msg_type)
const char *mbedtls_ssl_get_hs_msg_name(int hs_msg_type)
{
switch (hs_msg_type) {
case MBEDTLS_SSL_HS_CLIENT_HELLO:
@@ -700,8 +700,16 @@ static const char *ssl_tls13_get_hs_msg_name(int hs_msg_type)
return "EncryptedExtensions";
case MBEDTLS_SSL_HS_CERTIFICATE:
return "Certificate";
case MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE:
return "ServerKeyExchange";
case MBEDTLS_SSL_HS_CERTIFICATE_REQUEST:
return "CertificateRequest";
case MBEDTLS_SSL_HS_CERTIFICATE_VERIFY:
return "CertificateVerify";
case MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE:
return "ClientKeyExchange";
case MBEDTLS_SSL_HS_FINISHED:
return "Finished";
}
return "Unknown";
}
@@ -716,7 +724,7 @@ void mbedtls_ssl_print_extension(const mbedtls_ssl_context *ssl,
mbedtls_debug_print_msg(
ssl, level, file, line,
"%s: %s(%u) extension %s %s.",
ssl_tls13_get_hs_msg_name(hs_msg_type),
mbedtls_ssl_get_hs_msg_name(hs_msg_type),
mbedtls_ssl_get_extension_name(extension_type),
extension_type,
extra_msg0, extra_msg1);
@@ -727,7 +735,7 @@ void mbedtls_ssl_print_extension(const mbedtls_ssl_context *ssl,
if (extra_msg) {
mbedtls_debug_print_msg(
ssl, level, file, line,
"%s: %s(%u) extension %s.", ssl_tls13_get_hs_msg_name(hs_msg_type),
"%s: %s(%u) extension %s.", mbedtls_ssl_get_hs_msg_name(hs_msg_type),
mbedtls_ssl_get_extension_name(extension_type), extension_type,
extra_msg);
return;
@@ -735,7 +743,7 @@ void mbedtls_ssl_print_extension(const mbedtls_ssl_context *ssl,
mbedtls_debug_print_msg(
ssl, level, file, line,
"%s: %s(%u) extension.", ssl_tls13_get_hs_msg_name(hs_msg_type),
"%s: %s(%u) extension.", mbedtls_ssl_get_hs_msg_name(hs_msg_type),
mbedtls_ssl_get_extension_name(extension_type), extension_type);
}
programs/ssl/ssl_server2.c
+8
View File
@@ -3592,6 +3592,7 @@ handshake:
* 5. Verify the client certificate
*/
mbedtls_printf(" . Verifying peer X.509 certificate...");
fflush(stdout);
if ((flags = mbedtls_ssl_get_verify_result(&ssl)) != 0) {
char vrfy_buf[512];
@@ -3609,6 +3610,7 @@ handshake:
char crt_buf[512];
mbedtls_printf(" . Peer certificate information ...\n");
fflush(stdout);
mbedtls_x509_crt_info(crt_buf, sizeof(crt_buf), " ",
mbedtls_ssl_get_peer_cert(&ssl));
mbedtls_printf("%s\n", crt_buf);
@@ -4061,6 +4063,7 @@ data_exchange:
size_t buf_len;
mbedtls_printf(" . Serializing live connection...");
fflush(stdout);
ret = mbedtls_ssl_context_save(&ssl, NULL, 0, &buf_len);
if (ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL) {
@@ -4095,6 +4098,7 @@ data_exchange:
size_t b64_len;
mbedtls_printf(" . Save serialized context to a file... ");
fflush(stdout);
mbedtls_base64_encode(NULL, 0, &b64_len, context_buf, buf_len);
@@ -4143,6 +4147,7 @@ data_exchange:
if (opt.serialize == 1) {
/* nothing to do here, done by context_save() already */
mbedtls_printf(" . Context has been reset... ok\n");
fflush(stdout);
}
/*
@@ -4155,6 +4160,7 @@ data_exchange:
*/
if (opt.serialize == 2) {
mbedtls_printf(" . Freeing and reinitializing context...");
fflush(stdout);
mbedtls_ssl_free(&ssl);
@@ -4191,6 +4197,7 @@ data_exchange:
}
mbedtls_printf(" . Deserializing connection...");
fflush(stdout);
if ((ret = mbedtls_ssl_context_load(&ssl, context_buf,
buf_len)) != 0) {
@@ -4220,6 +4227,7 @@ data_exchange:
*/
close_notify:
mbedtls_printf(" . Closing the connection...");
fflush(stdout);
/* No error checking, the connection might be closed already */
do {
scripts/generate_tls_handshake_tests.py
Executable
+17
View File
@@ -0,0 +1,17 @@
#!/usr/bin/env python3
"""
Generate miscellaneous TLS test cases relating to the handshake.
"""
# Copyright The Mbed TLS Contributors
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
import sys
import framework_scripts_path # pylint: disable=unused-import
from mbedtls_framework import tls_handshake_tests
if __name__ == '__main__':
sys.argv[1:1] = ["--no-tls12-client-hello-defragmentation-support"]
tls_handshake_tests.main()
scripts/make_generated_files.bat
+1 -1
View File
@@ -25,7 +25,7 @@ python framework\scripts\generate_ecp_tests.py || exit /b 1
python framework\scripts\generate_psa_tests.py || exit /b 1
python framework\scripts\generate_test_keys.py --output tests\include\test\test_keys.h || exit /b 1
python framework\scripts\generate_test_cert_macros.py --output tests\include\test\test_certs.h || exit /b 1
python framework\scripts\generate_tls_handshake_tests.py || exit /b 1
python scripts\generate_tls_handshake_tests.py || exit /b 1
python framework\scripts\generate_tls13_compat_tests.py || exit /b 1
@rem @@@@ Build @@@@
tests/CMakeLists.txt
+2 -2
View File
@@ -132,10 +132,10 @@ if(GEN_FILES)
${CMAKE_CURRENT_SOURCE_DIR}/..
COMMAND
"${MBEDTLS_PYTHON_EXECUTABLE}"
"${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/generate_tls_handshake_tests.py"
"${PROJECT_SOURCE_DIR}/scripts/generate_tls_handshake_tests.py"
DEPENDS
${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/mbedtls_framework/tls_test_case.py
${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/generate_tls_handshake_tests.py
${PROJECT_SOURCE_DIR}/scripts/generate_tls_handshake_tests.py
)
add_custom_target(handshake-generated.sh
DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/opt-testcases/handshake-generated.sh)
tests/Makefile
+2 -2
View File
@@ -59,9 +59,9 @@ GENERATED_FILES += include/test/test_keys.h include/test/test_certs.h
.PHONY: ssl-opt
opt-testcases/handshake-generated.sh: ../framework/scripts/mbedtls_framework/tls_test_case.py
opt-testcases/handshake-generated.sh: ../framework/scripts/generate_tls_handshake_tests.py
opt-testcases/handshake-generated.sh: ../scripts/generate_tls_handshake_tests.py
echo " Gen $@"
$(PYTHON) ../framework/scripts/generate_tls_handshake_tests.py -o $@
$(PYTHON) ../scripts/generate_tls_handshake_tests.py -o $@
GENERATED_FILES += opt-testcases/handshake-generated.sh
ssl-opt: opt-testcases/handshake-generated.sh
tests/scripts/check-generated-files.sh
+1 -1
View File
@@ -135,7 +135,7 @@ if in_mbedtls_repo; then
check scripts/generate_query_config.pl programs/test/query_config.c
check scripts/generate_features.pl library/version_features.c
check framework/scripts/generate_ssl_debug_helpers.py library/ssl_debug_helpers_generated.c
check framework/scripts/generate_tls_handshake_tests.py tests/opt-testcases/handshake-generated.sh
check scripts/generate_tls_handshake_tests.py tests/opt-testcases/handshake-generated.sh
check framework/scripts/generate_tls13_compat_tests.py tests/opt-testcases/tls13-compat.sh
check framework/scripts/generate_test_cert_macros.py tests/include/test/test_certs.h
# generate_visualc_files enumerates source files (library/*.c). It doesn't
tests/ssl-opt.sh
+50 -50
View File
@@ -10925,6 +10925,7 @@ run_test "DTLS reassembly: some fragmentation (gnutls server)" \
"$P_CLI dtls=1 debug_level=2" \
0 \
-c "found fragmented DTLS handshake message" \
-c "Certificate handshake message has been buffered and reassembled" \
-C "error"
requires_gnutls
@@ -10934,6 +10935,8 @@ run_test "DTLS reassembly: more fragmentation (gnutls server)" \
"$P_CLI dtls=1 debug_level=2" \
0 \
-c "found fragmented DTLS handshake message" \
-c "Certificate handshake message has been buffered and reassembled" \
-c "ServerKeyExchange handshake message has been buffered and reassembled" \
-C "error"
requires_gnutls
@@ -10943,6 +10946,8 @@ run_test "DTLS reassembly: more fragmentation, nbio (gnutls server)" \
"$P_CLI dtls=1 nbio=2 debug_level=2" \
0 \
-c "found fragmented DTLS handshake message" \
-c "Certificate handshake message has been buffered and reassembled" \
-c "ServerKeyExchange handshake message has been buffered and reassembled" \
-C "error"
requires_gnutls
@@ -10953,6 +10958,7 @@ run_test "DTLS reassembly: fragmentation, renego (gnutls server)" \
"$P_CLI debug_level=3 dtls=1 renegotiation=1 renegotiate=1" \
0 \
-c "found fragmented DTLS handshake message" \
-c "Certificate handshake message has been buffered and reassembled" \
-c "client hello, adding renegotiation extension" \
-c "found renegotiation extension" \
-c "=> renegotiate" \
@@ -10968,6 +10974,7 @@ run_test "DTLS reassembly: fragmentation, nbio, renego (gnutls server)" \
"$P_CLI debug_level=3 nbio=2 dtls=1 renegotiation=1 renegotiate=1" \
0 \
-c "found fragmented DTLS handshake message" \
-c "Certificate handshake message has been buffered and reassembled" \
-c "client hello, adding renegotiation extension" \
-c "found renegotiation extension" \
-c "=> renegotiate" \
@@ -10983,20 +10990,17 @@ run_test "DTLS reassembly: no fragmentation (openssl server)" \
-C "found fragmented DTLS handshake message" \
-C "error"
# Minimum possible MTU for OpenSSL server: 256 bytes.
# We expect the server Certificate handshake to be fragmented and verify that
# this is the case. Depending on the configuration, other handshake messages may
# also be fragmented.
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "DTLS reassembly: some fragmentation (openssl server)" \
"$O_SRV -dtls -mtu 256" \
"$P_CLI dtls=1 debug_level=2" \
0 \
-c "found fragmented DTLS handshake message" \
-C "error"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "DTLS reassembly: more fragmentation (openssl server)" \
run_test "DTLS reassembly: fragmentation (openssl server)" \
"$O_SRV -dtls -mtu 256" \
"$P_CLI dtls=1 debug_level=2" \
0 \
-c "found fragmented DTLS handshake message" \
-c "Certificate handshake message has been buffered and reassembled" \
-C "error"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
@@ -11005,6 +11009,7 @@ run_test "DTLS reassembly: fragmentation, nbio (openssl server)" \
"$P_CLI dtls=1 nbio=2 debug_level=2" \
0 \
-c "found fragmented DTLS handshake message" \
-c "Certificate handshake message has been buffered and reassembled" \
-C "error"
# Tests for sending fragmented handshake messages with DTLS
@@ -11673,7 +11678,7 @@ run_test "DTLS fragmenting: gnutls server, DTLS 1.2" \
key_file=$DATA_FILES_PATH/server8.key \
mtu=512 force_version=dtls12" \
0 \
-c "fragmenting handshake message" \
-c "fragmenting Certificate handshake message" \
-C "error"
# We use --insecure for the GnuTLS client because it expects
@@ -11695,7 +11700,7 @@ run_test "DTLS fragmenting: gnutls client, DTLS 1.2" \
mtu=512 force_version=dtls12" \
"$G_CLI -u --insecure 127.0.0.1" \
0 \
-s "fragmenting handshake message"
-s "fragmenting Certificate handshake message"
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C
@@ -11707,7 +11712,7 @@ run_test "DTLS fragmenting: openssl server, DTLS 1.2" \
key_file=$DATA_FILES_PATH/server8.key \
mtu=512 force_version=dtls12" \
0 \
-c "fragmenting handshake message" \
-c "fragmenting Certificate handshake message" \
-C "error"
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
@@ -11720,7 +11725,7 @@ run_test "DTLS fragmenting: openssl client, DTLS 1.2" \
mtu=512 force_version=dtls12" \
"$O_CLI -dtls1_2" \
0 \
-s "fragmenting handshake message"
-s "fragmenting Certificate handshake message"
# interop tests for DTLS fragmentating with unreliable connection
#
@@ -11739,7 +11744,7 @@ run_test "DTLS fragmenting: 3d, gnutls server, DTLS 1.2" \
key_file=$DATA_FILES_PATH/server8.key \
hs_timeout=250-60000 mtu=512 force_version=dtls12" \
0 \
-c "fragmenting handshake message" \
-c "fragmenting Certificate handshake message" \
-C "error"
requires_gnutls_next
@@ -11755,7 +11760,7 @@ run_test "DTLS fragmenting: 3d, gnutls client, DTLS 1.2" \
hs_timeout=250-60000 mtu=512 force_version=dtls12" \
"$G_NEXT_CLI -u --insecure 127.0.0.1" \
0 \
-s "fragmenting handshake message"
-s "fragmenting Certificate handshake message"
## The test below requires 1.1.1a or higher version of openssl, otherwise
## it might trigger a bug due to openssl server (https://github.com/openssl/openssl/issues/6902)
@@ -11772,7 +11777,7 @@ run_test "DTLS fragmenting: 3d, openssl server, DTLS 1.2" \
key_file=$DATA_FILES_PATH/server8.key \
hs_timeout=250-60000 mtu=512 force_version=dtls12" \
0 \
-c "fragmenting handshake message" \
-c "fragmenting Certificate handshake message" \
-C "error"
## the test below will time out with certain seed.
@@ -11790,7 +11795,7 @@ run_test "DTLS fragmenting: 3d, openssl client, DTLS 1.2" \
hs_timeout=250-60000 mtu=512 force_version=dtls12" \
"$O_CLI -dtls1_2" \
0 \
-s "fragmenting handshake message"
-s "fragmenting Certificate handshake message"
# Tests for DTLS-SRTP (RFC 5764)
requires_config_enabled MBEDTLS_SSL_DTLS_SRTP
@@ -12507,9 +12512,9 @@ run_test "DTLS reordering: Buffer out-of-order handshake message on client" \
hs_timeout=2500-60000" \
0 \
-c "Buffering HS message" \
-c "Next handshake message has been buffered - load"\
-c "Certificate handshake message has been buffered$"\
-S "Buffering HS message" \
-S "Next handshake message has been buffered - load"\
-S "handshake message has been buffered"\
-C "Injecting buffered CCS message" \
-C "Remember CCS message" \
-S "Injecting buffered CCS message" \
@@ -12527,9 +12532,9 @@ run_test "DTLS reordering: Buffer out-of-order handshake message fragment on
-c "Buffering HS message" \
-c "found fragmented DTLS handshake message"\
-c "Next handshake message 1 not or only partially buffered" \
-c "Next handshake message has been buffered - load"\
-c "Certificate handshake message has been buffered and reassembled"\
-S "Buffering HS message" \
-S "Next handshake message has been buffered - load"\
-S "handshake message has been buffered" \
-C "Injecting buffered CCS message" \
-C "Remember CCS message" \
-S "Injecting buffered CCS message" \
@@ -12550,10 +12555,11 @@ run_test "DTLS reordering: Buffer out-of-order hs msg before reassembling nex
hs_timeout=2500-60000" \
0 \
-c "Buffering HS message" \
-c "Next handshake message has been buffered - load"\
-c "Certificate handshake message has been buffered and reassembled"\
-c "ServerKeyExchange handshake message has been buffered$"\
-C "attempt to make space by freeing buffered messages" \
-S "Buffering HS message" \
-S "Next handshake message has been buffered - load"\
-S "handshake message has been buffered" \
-C "Injecting buffered CCS message" \
-C "Remember CCS message" \
-S "Injecting buffered CCS message" \
@@ -12577,7 +12583,7 @@ run_test "DTLS reordering: Buffer out-of-order hs msg before reassembling nex
-c "attempt to make space by freeing buffered future messages" \
-c "Enough space available after freeing buffered HS messages" \
-S "Buffering HS message" \
-S "Next handshake message has been buffered - load"\
-S "handshake message has been buffered" \
-C "Injecting buffered CCS message" \
-C "Remember CCS message" \
-S "Injecting buffered CCS message" \
@@ -12593,9 +12599,9 @@ run_test "DTLS reordering: Buffer out-of-order handshake message on server" \
hs_timeout=2500-60000" \
0 \
-C "Buffering HS message" \
-C "Next handshake message has been buffered - load"\
-C "handshake message has been buffered" \
-s "Buffering HS message" \
-s "Next handshake message has been buffered - load" \
-s "ClientKeyExchange handshake message has been buffered$" \
-C "Injecting buffered CCS message" \
-C "Remember CCS message" \
-S "Injecting buffered CCS message" \
@@ -12612,9 +12618,9 @@ run_test "DTLS reordering: Buffer out-of-order CCS message on client"\
hs_timeout=2500-60000" \
0 \
-C "Buffering HS message" \
-C "Next handshake message has been buffered - load"\
-C "handshake message has been buffered" \
-S "Buffering HS message" \
-S "Next handshake message has been buffered - load" \
-S "handshake message has been buffered" \
-c "Injecting buffered CCS message" \
-c "Remember CCS message" \
-S "Injecting buffered CCS message" \
@@ -12630,9 +12636,9 @@ run_test "DTLS reordering: Buffer out-of-order CCS message on server"\
hs_timeout=2500-60000" \
0 \
-C "Buffering HS message" \
-C "Next handshake message has been buffered - load"\
-C "handshake message has been buffered" \
-S "Buffering HS message" \
-S "Next handshake message has been buffered - load" \
-S "handshake message has been buffered" \
-C "Injecting buffered CCS message" \
-C "Remember CCS message" \
-s "Injecting buffered CCS message" \
@@ -12868,10 +12874,11 @@ not_with_valgrind # risk of non-mbedtls peer timing out
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "DTLS proxy: 3d, openssl server, fragmentation" \
-p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \
"$O_NEXT_SRV -dtls1_2 -mtu 768" \
"$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 tickets=0" \
"$O_NEXT_SRV -dtls1_2 -mtu 256" \
"$P_CLI dgram_packing=0 dtls=1 debug_level=2 hs_timeout=500-60000 tickets=0" \
0 \
-c "HTTP/1.0 200 OK"
-c "HTTP/1.0 200 OK" \
-c "Certificate handshake message has been buffered and reassembled"
requires_openssl_next
client_needs_more_time 8
@@ -12879,10 +12886,11 @@ not_with_valgrind # risk of non-mbedtls peer timing out
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "DTLS proxy: 3d, openssl server, fragmentation, nbio" \
-p "$P_PXY drop=5 delay=5 duplicate=5 protect_hvr=1" \
"$O_NEXT_SRV -dtls1_2 -mtu 768" \
"$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 nbio=2 tickets=0" \
"$O_NEXT_SRV -dtls1_2 -mtu 256" \
"$P_CLI dgram_packing=0 dtls=1 debug_level=2 hs_timeout=500-60000 nbio=2 tickets=0" \
0 \
-c "HTTP/1.0 200 OK"
-c "HTTP/1.0 200 OK" \
-c "Certificate handshake message has been buffered and reassembled"
requires_gnutls
client_needs_more_time 6
@@ -12903,10 +12911,11 @@ requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "DTLS proxy: 3d, gnutls server, fragmentation" \
-p "$P_PXY drop=5 delay=5 duplicate=5" \
"$G_NEXT_SRV -u --mtu 512" \
"$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000" \
"$P_CLI dgram_packing=0 dtls=1 debug_level=2 hs_timeout=500-60000" \
0 \
-s "Extra-header:" \
-c "Extra-header:"
-c "Extra-header:" \
-c "Certificate handshake message has been buffered and reassembled"
requires_gnutls_next
client_needs_more_time 8
@@ -12915,10 +12924,11 @@ requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "DTLS proxy: 3d, gnutls server, fragmentation, nbio" \
-p "$P_PXY drop=5 delay=5 duplicate=5" \
"$G_NEXT_SRV -u --mtu 512" \
"$P_CLI dgram_packing=0 dtls=1 hs_timeout=500-60000 nbio=2" \
"$P_CLI dgram_packing=0 dtls=1 debug_level=2 hs_timeout=500-60000 nbio=2" \
0 \
-s "Extra-header:" \
-c "Extra-header:"
-c "Extra-header:" \
-c "Certificate handshake message has been buffered and reassembled"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "export keys functionality" \
@@ -14793,16 +14803,6 @@ run_test "TLS 1.2 ClientHello indicating support for deflate compression meth
# Most test cases are in opt-testcases/handshake-generated.sh
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_certificate_authentication
run_test "Handshake defragmentation on server: len=32, TLS 1.2 ClientHello (unsupported)" \
"$P_SRV debug_level=4 force_version=tls12 auth_mode=required" \
"$O_NEXT_CLI -tls1_2 -split_send_frag 32 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
1 \
-s "The SSL configuration is tls12 only" \
-s "bad client hello message" \
-s "SSL - A message could not be parsed due to a syntactic error"
# Test server-side buffer resizing with fragmented handshake on TLS1.2
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH