Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 785169 - Change tools to use a version range for SSL/TLS versions + adjust the test suite

Browse Source 
r=wtc


git-svn-id: svn://10.0.0.236/trunk@264264 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
kaie%kuix.de
2012-09-27 17:13:36 +00:00
parent a3711bd9e7
commit 46bc676332
8 changed files with 357 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files

113
mozilla/security/nss/cmd/lib/secutil.c
View File

@@ -52,6 +52,7 @@ static char consoleName[] = {
#include "nssutil.h"
#include "ssl.h"
#include "sslproto.h"
static void
@@ -3557,4 +3558,116 @@ SECU_FindCertByNicknameOrFilename(CERTCertDBHandle *handle,
return the_cert;
}
/* Convert a SSL/TLS protocol version string into the respective numeric value
* defined by the SSL_LIBRARY_VERSION_* constants,
* while accepting a flexible set of case-insensitive identifiers.
*
* Caller must specify bufLen, allowing the function to operate on substrings.
*/
static SECStatus
SECU_GetSSLVersionFromName(const char *buf, size_t bufLen, PRUint16 *version)
{
if (!buf || !version) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
if (!PL_strncasecmp(buf, "ssl2", bufLen)) {
*version = SSL_LIBRARY_VERSION_2;
return SECSuccess;
}
if (!PL_strncasecmp(buf, "ssl3", bufLen)) {
*version = SSL_LIBRARY_VERSION_3_0;
return SECSuccess;
}
if (!PL_strncasecmp(buf, "tls1.0", bufLen)) {
*version = SSL_LIBRARY_VERSION_TLS_1_0;
return SECSuccess;
}
if (!PL_strncasecmp(buf, "tls1.1", bufLen)) {
*version = SSL_LIBRARY_VERSION_TLS_1_1;
return SECSuccess;
}
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
SECStatus
SECU_ParseSSLVersionRangeString(const char *input,
const SSLVersionRange defaultVersionRange,
const PRBool defaultEnableSSL2,
SSLVersionRange *vrange, PRBool *enableSSL2)
{
const char *colonPos;
size_t colonIndex;
const char *maxStr;
if (!input || !vrange || !enableSSL2) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
if (!strcmp(input, ":")) {
/* special value, use default */
*enableSSL2 = defaultEnableSSL2;
*vrange = defaultVersionRange;
return SECSuccess;
}
colonPos = strchr(input, ':');
if (!colonPos) {
return SECFailure;
PORT_SetError(SEC_ERROR_INVALID_ARGS);
}
colonIndex = colonPos - input;
maxStr = colonPos + 1;
if (!colonIndex) {
/* colon was first character, min version is empty */
*enableSSL2 = defaultEnableSSL2;
vrange->min = defaultVersionRange.min;
} else {
PRUint16 version;
/* colonIndex is equivalent to the length of the min version substring */
if (SECU_GetSSLVersionFromName(input, colonIndex, &version) != SECSuccess) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
if (version == SSL_LIBRARY_VERSION_2) {
*enableSSL2 = PR_TRUE;
vrange->min = defaultVersionRange.min;
} else {
*enableSSL2 = PR_FALSE;
vrange->min = version;
}
}
if (!*maxStr) {
vrange->max = defaultVersionRange.max;
} else {
PRUint16 version;
/* if max version is empty, then maxStr points to the string terminator */
if (SECU_GetSSLVersionFromName(maxStr, strlen(maxStr), &version)
!= SECSuccess) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
if (version == SSL_LIBRARY_VERSION_2) {
/* consistency checking, require that min allows enableSSL2, too */
if (!*enableSSL2) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
/* we use 0 because SSL_LIBRARY_VERSION_NONE is private: */
vrange->min = 0;
vrange->max = 0;
} else {
vrange->max = version;
}
}
return SECSuccess;
}

28
mozilla/security/nss/cmd/lib/secutil.h
View File

@@ -17,6 +17,7 @@
#include "basicutil.h"
#include "sslerr.h"
#include "sslt.h"
#define SEC_CT_PRIVATE_KEY "private-key"
@@ -370,6 +371,33 @@ SECU_SECItemToHex(const SECItem * item, char * dst);
SECStatus
SECU_SECItemHexStringToBinary(SECItem* srcdest);
/* Parse a version range string, with "min" and "max" version numbers,
* separated by colon (":"), and return the result in vr and v2.
*
* Both min and max values are optional.
* The following syntax is used to specify the enabled protocol versions:
* A string with only a max value is expected as ":{max}",
* and all implemented versions less than or equal to max will be enabled.
* A string with only a min value is expected as "{min}:",
* and all implemented versions greater than or equal to min will be enabled.
* A string consisting of a colon only means "all versions enabled".
*
* Because output parameter type SSLVersionRange doesn't allow to set
* version 2 values, we use a separate boolean output parameter
* to return whether SSL 2 is enabled.
*
* In order to avoid a link dependency from libsectool to libssl,
* the caller must provide the desired default values for the min/max values,
* by providing defaultEnableSSL2 and defaultVersionRange
* (which can be obtained from libssl by calling SSL_VersionRangeGetSupported).
*/
SECStatus
SECU_ParseSSLVersionRangeString(const char *input,
const SSLVersionRange defaultVersionRange,
const PRBool defaultEnableSSL2,
SSLVersionRange *vrange,
PRBool *enableSSL2);
/*
*
* Error messaging

98
mozilla/security/nss/cmd/selfserv/selfserv.c
View File

@@ -136,22 +136,29 @@ static PRLogModuleInfo *lm;
#define VLOG(arg) PR_LOG(lm,PR_LOG_DEBUG,arg)
static void
Usage(const char *progName)
PrintUsageHeader(const char *progName)
{
fprintf(stderr,
"Usage: %s -n rsa_nickname -p port [-3BDENRSTbjlmrsuvx] [-w password]\n"
" [-t threads] [-i pid_file] [-c ciphers] [-d dbdir] [-g numblocks]\n"
"Usage: %s -n rsa_nickname -p port [-BDENRbjlmrsuvx] [-w password]\n"
" [-t threads] [-i pid_file] [-c ciphers] [-Y] [-d dbdir] [-g numblocks]\n"
" [-f password_file] [-L [seconds]] [-M maxProcs] [-P dbprefix]\n"
" [-a sni_name]\n"
" [-V [min-version]:[max-version]] [-a sni_name]\n"
#ifdef NSS_ENABLE_ECC
" [-C SSLCacheEntries] [-e ec_nickname]\n"
#else
" [-C SSLCacheEntries]\n"
#endif /* NSS_ENABLE_ECC */
"-S means disable SSL v2\n"
"-3 means disable SSL v3\n"
"-T means disable TLS\n"
,progName);
}
static void
PrintParameterUsage()
{
fputs(
"-V [min]:[max] restricts the set of enabled SSL/TLS protocol versions.\n"
" All versions are enabled by default.\n"
" Possible values for min/max: ssl2 ssl3 tls1.0 tls1.1\n"
" Example: \"-V ssl3:\" enables SSL 3 and newer.\n"
"-B bypasses the PKCS11 layer for SSL encryption and MACing\n"
"-q checks for bypassability\n"
"-D means disable Nagle delays in TCP\n"
@@ -182,6 +189,23 @@ Usage(const char *progName)
"-j means measure TCP throughput (for use with -g option)\n"
"-C SSLCacheEntries sets the maximum number of entries in the SSL\n"
" session cache\n"
"-c Restrict ciphers\n"
"-Y prints cipher values allowed for parameter -c and exits\n"
, stderr);
}
static void
Usage(const char *progName)
{
PrintUsageHeader(progName);
PrintParameterUsage();
}
static void
PrintCipherUsage(const char *progName)
{
PrintUsageHeader(progName);
fputs(
"-c ciphers Letter(s) chosen from the following list\n"
"A SSL2 RC4 128 WITH MD5\n"
"B SSL2 RC4 128 EXPORT40 WITH MD5\n"
@@ -206,7 +230,7 @@ Usage(const char *progName)
"z SSL3 RSA WITH NULL SHA\n"
"\n"
":WXYZ Use cipher with hex code { 0xWX , 0xYZ } in TLS\n"
,progName);
, stderr);
}
static const char *
@@ -756,9 +780,8 @@ logger(void *arg)
**************************************************************************/
PRBool useModelSocket = PR_FALSE;
PRBool disableSSL2 = PR_FALSE;
PRBool disableSSL3 = PR_FALSE;
PRBool disableTLS = PR_FALSE;
static SSLVersionRange enabledVersions;
PRBool enableSSL2 = PR_TRUE;
PRBool disableRollBack = PR_FALSE;
PRBool NoReuse = PR_FALSE;
PRBool hasSidCache = PR_FALSE;
@@ -1618,27 +1641,22 @@ server_main(
}
/* do SSL configuration. */
rv = SSL_OptionSet(model_sock, SSL_SECURITY,
!(disableSSL2 && disableSSL3 && disableTLS));
rv = SSL_OptionSet(model_sock, SSL_SECURITY,
enableSSL2 || enabledVersions.min != 0);
if (rv < 0) {
errExit("SSL_OptionSet SSL_SECURITY");
}
rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL3, !disableSSL3);
rv = SSL_VersionRangeSet(model_sock, &enabledVersions);
if (rv != SECSuccess) {
errExit("error enabling SSLv3 ");
errExit("error setting SSL/TLS version range ");
}
rv = SSL_OptionSet(model_sock, SSL_ENABLE_TLS, !disableTLS);
rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL2, enableSSL2);
if (rv != SECSuccess) {
errExit("error enabling TLS ");
errExit("error enabling SSLv2 ");
}
rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL2, !disableSSL2);
if (rv != SECSuccess) {
errExit("error enabling SSLv2 ");
}
rv = SSL_OptionSet(model_sock, SSL_ROLLBACK_DETECTION, !disableRollBack);
if (rv != SECSuccess) {
errExit("error enabling RollBack detection ");
@@ -1914,19 +1932,18 @@ main(int argc, char **argv)
progName = progName ? progName + 1 : tmp;
PR_Init( PR_SYSTEM_THREAD, PR_PRIORITY_NORMAL, 1);
SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledVersions);
/* please keep this list of options in ASCII collating sequence.
** numbers, then capital letters, then lower case, alphabetical.
*/
optstate = PL_CreateOptState(argc, argv,
"2:3BC:DEL:M:NP:RSTa:bc:d:e:f:g:hi:jk:lmn:op:qrst:uvw:xyz");
"2:BC:DEL:M:NP:RV:Ya:bc:d:e:f:g:hi:jk:lmn:op:qrst:uvw:xyz");
while ((status = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
++optionsFound;
switch(optstate->option) {
case '2': fileName = optstate->value; break;
case '3': disableSSL3 = PR_TRUE; break;
case 'B': bypassPKCS11 = PR_TRUE; break;
case 'C': if (optstate->value) NumSidCacheEntries = PORT_Atoi(optstate->value); break;
@@ -1953,11 +1970,16 @@ main(int argc, char **argv)
case 'N': NoReuse = PR_TRUE; break;
case 'R': disableRollBack = PR_TRUE; break;
case 'V': if (SECU_ParseSSLVersionRangeString(optstate->value,
enabledVersions, enableSSL2,
&enabledVersions, &enableSSL2) != SECSuccess) {
Usage(progName);
}
break;
case 'Y': PrintCipherUsage(progName); exit(0); break;
case 'S': disableSSL2 = PR_TRUE; break;
case 'T': disableTLS = PR_TRUE; break;
case 'a': if (virtServerNameIndex >= MAX_VIRT_SERVER_NAME_ARRAY_INDEX) {
Usage(progName);
}
@@ -2258,8 +2280,20 @@ main(int argc, char **argv)
&& enabled)
savecipher(*cipherSuites);
}
protos = (disableTLS ? 0 : SSL_CBP_TLS1_0) +
(disableSSL3 ? 0 : SSL_CBP_SSL3);
protos = 0;
if (enabledVersions.min <= SSL_LIBRARY_VERSION_3_0 &&
enabledVersions.max >= SSL_LIBRARY_VERSION_3_0) {
protos |= SSL_CBP_SSL3;
}
if (enabledVersions.min <= SSL_LIBRARY_VERSION_TLS_1_0 &&
enabledVersions.max >= SSL_LIBRARY_VERSION_TLS_1_0) {
protos |= SSL_CBP_TLS1_0;
}
/* TLS 1.1 has the same SSL Bypass mode requirements as TLS 1.0 */
if (enabledVersions.min <= SSL_LIBRARY_VERSION_TLS_1_1 &&
enabledVersions.max >= SSL_LIBRARY_VERSION_TLS_1_1) {
protos |= SSL_CBP_TLS1_0;
}
}
if (nickName) {

53
mozilla/security/nss/cmd/strsclnt/strsclnt.c
View File

@@ -5,6 +5,7 @@
#include <string.h>
#include "secutil.h"
#include "basicutil.h"
#if defined(XP_UNIX)
#include <unistd.h>
@@ -122,9 +123,8 @@ static PRInt32 numUsed;
static SSL3Statistics * ssl3stats;
static int failed_already = 0;
static PRBool disableSSL2 = PR_FALSE;
static PRBool disableSSL3 = PR_FALSE;
static PRBool disableTLS = PR_FALSE;
static SSLVersionRange enabledVersions;
static PRBool enableSSL2 = PR_TRUE;
static PRBool bypassPKCS11 = PR_FALSE;
static PRBool disableLocking = PR_FALSE;
static PRBool ignoreErrors = PR_FALSE;
@@ -150,9 +150,9 @@ Usage(const char *progName)
{
fprintf(stderr,
"Usage: %s [-n nickname] [-p port] [-d dbdir] [-c connections]\n"
" [-23BDNTovqs] [-f filename] [-N | -P percentage]\n"
" [-BDNovqs] [-f filename] [-N | -P percentage]\n"
" [-w dbpasswd] [-C cipher(s)] [-t threads] [-W pwfile]\n"
" [-a sniHostName] hostname\n"
" [-V [min-version]:[max-version]] [-a sniHostName] hostname\n"
" where -v means verbose\n"
" -o flag is interpreted as follows:\n"
" 1 -o means override the result of server certificate validation.\n"
@@ -162,9 +162,10 @@ Usage(const char *progName)
" -s means disable SSL socket locking\n"
" -N means no session reuse\n"
" -P means do a specified percentage of full handshakes (0-100)\n"
" -2 means disable SSL2\n"
" -3 means disable SSL3\n"
" -T means disable TLS\n"
" -V [min]:[max] restricts the set of enabled SSL/TLS protocols versions.\n"
" All versions are enabled by default.\n"
" Possible values for min/max: ssl2 ssl3 tls1.0 tls1.1\n"
" Example: \"-V ssl3:\" enables SSL 3 and newer.\n"
" -U means enable throttling up threads\n"
" -B bypasses the PKCS11 layer for SSL encryption and MACing\n"
" -u enable TLS Session Ticket extension\n"
@@ -1155,29 +1156,24 @@ client_main(
/* do SSL configuration. */
rv = SSL_OptionSet(model_sock, SSL_SECURITY,
!(disableSSL2 && disableSSL3 && disableTLS));
enableSSL2 || enabledVersions.min != 0);
if (rv < 0) {
errExit("SSL_OptionSet SSL_SECURITY");
}
rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL2, !disableSSL2);
rv = SSL_VersionRangeSet(model_sock, &enabledVersions);
if (rv != SECSuccess) {
errExit("error enabling SSLv2 ");
errExit("error setting SSL/TLS version range ");
}
rv = SSL_OptionSet(model_sock, SSL_V2_COMPATIBLE_HELLO, !disableSSL2);
rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL2, enableSSL2);
if (rv != SECSuccess) {
errExit("error enabling SSLv2 compatible hellos ");
errExit("error enabling SSLv2 ");
}
rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL3, !disableSSL3);
rv = SSL_OptionSet(model_sock, SSL_V2_COMPATIBLE_HELLO, enableSSL2);
if (rv != SECSuccess) {
errExit("error enabling SSLv3 ");
}
rv = SSL_OptionSet(model_sock, SSL_ENABLE_TLS, !disableTLS);
if (rv != SECSuccess) {
errExit("error enabling TLS ");
errExit("error enabling SSLv2 compatible hellos ");
}
if (bigBuf.data) { /* doing FDX */
@@ -1329,6 +1325,7 @@ main(int argc, char **argv)
/* Call the NSPR initialization routines */
PR_Init( PR_SYSTEM_THREAD, PR_PRIORITY_NORMAL, 1);
SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledVersions);
tmp = strrchr(argv[0], '/');
tmp = tmp ? tmp + 1 : argv[0];
@@ -1337,14 +1334,9 @@ main(int argc, char **argv)
optstate = PL_CreateOptState(argc, argv,
"23BC:DNP:TUW:a:c:d:f:gin:op:qst:uvw:z");
"BC:DNP:UV:W:a:c:d:f:gin:op:qst:uvw:z");
while ((status = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
switch(optstate->option) {
case '2': disableSSL2 = PR_TRUE; break;
case '3': disableSSL3 = PR_TRUE; break;
case 'B': bypassPKCS11 = PR_TRUE; break;
case 'C': cipherString = optstate->value; break;
@@ -1355,9 +1347,14 @@ main(int argc, char **argv)
case 'P': fullhs = PORT_Atoi(optstate->value); break;
case 'T': disableTLS = PR_TRUE; break;
case 'U': ThrottleUp = PR_TRUE; break;
case 'V': if (SECU_ParseSSLVersionRangeString(optstate->value,
enabledVersions, enableSSL2,
&enabledVersions, &enableSSL2) != SECSuccess) {
Usage(progName);
}
break;
case 'a': sniHostName = PL_strdup(optstate->value); break;

79
mozilla/security/nss/cmd/tstclnt/tstclnt.c
View File

@@ -9,6 +9,7 @@
*/
#include "secutil.h"
#include "basicutil.h"
#if defined(XP_UNIX)
#include <unistd.h>
@@ -159,13 +160,18 @@ handshakeCallback(PRFileDesc *fd, void *client_data)
}
}
static void Usage(const char *progName)
static void PrintUsageHeader(const char *progName)
{
fprintf(stderr,
"Usage: %s -h host [-a 1st_hs_name ] [-a 2nd_hs_name ] [-p port]\n"
"[-d certdir] [-n nickname] [-23BTafosvx] [-c ciphers]\n"
"[-d certdir] [-n nickname] [-Bafosvx] [-c ciphers] [-Y]\n"
"[-V [min-version]:[max-version]]\n"
"[-r N] [-w passwd] [-W pwfile] [-q [-t seconds]]\n",
progName);
}
static void PrintParameterUsage(void)
{
fprintf(stderr, "%-20s Send different SNI name. 1st_hs_name - at first\n"
"%-20s handshake, 2nd_hs_name - at second handshake.\n"
"%-20s Default is host from the -h argument.\n", "-a name",
@@ -179,9 +185,12 @@ static void Usage(const char *progName)
"-n nickname");
fprintf(stderr,
"%-20s Bypass PKCS11 layer for SSL encryption and MACing.\n", "-B");
fprintf(stderr, "%-20s Disable SSL v2.\n", "-2");
fprintf(stderr, "%-20s Disable SSL v3.\n", "-3");
fprintf(stderr, "%-20s Disable TLS (SSL v3.1).\n", "-T");
fprintf(stderr,
"%-20s Restricts the set of enabled SSL/TLS protocols versions.\n"
"%-20s All versions are enabled by default.\n"
"%-20s Possible values for min/max: ssl2 ssl3 tls1.0 tls1.1\n"
"%-20s Example: \"-V ssl3:\" enables SSL 3 and newer.\n",
"-V [min]:[max]", "", "", "");
fprintf(stderr, "%-20s Prints only payload data. Skips HTTP header.\n", "-S");
fprintf(stderr, "%-20s Client speaks first. \n", "-f");
fprintf(stderr, "%-20s Use synchronous certificate validation "
@@ -196,6 +205,20 @@ static void Usage(const char *progName)
fprintf(stderr, "%-20s Enable the session ticket extension.\n", "-u");
fprintf(stderr, "%-20s Enable compression.\n", "-z");
fprintf(stderr, "%-20s Enable false start.\n", "-g");
fprintf(stderr, "%-20s Restrict ciphers\n", "-c ciphers");
fprintf(stderr, "%-20s Print cipher values allowed for parameter -c and exit\n", "-Y");
}
static void Usage(const char *progName)
{
PrintUsageHeader(progName);
PrintParameterUsage();
exit(1);
}
static void PrintCipherUsage(const char *progName)
{
PrintUsageHeader(progName);
fprintf(stderr, "%-20s Letter(s) chosen from the following list\n",
"-c ciphers");
fprintf(stderr,
@@ -545,9 +568,8 @@ int main(int argc, char **argv)
PRInt32 filesReady;
int npds;
int override = 0;
int disableSSL2 = 0;
int disableSSL3 = 0;
int disableTLS = 0;
SSLVersionRange enabledVersions;
PRBool enableSSL2 = PR_TRUE;
int bypassPKCS11 = 0;
int disableLocking = 0;
int useExportPolicy = 0;
@@ -589,24 +611,29 @@ int main(int argc, char **argv)
}
}
SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledVersions);
optstate = PL_CreateOptState(argc, argv,
"23BOSTW:a:c:d:fgh:m:n:op:qr:st:uvw:xz");
"BOSV:W:Ya:c:d:fgh:m:n:op:qr:st:uvw:xz");
while ((optstatus = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
switch (optstate->option) {
case '?':
default : Usage(progName); break;
case '2': disableSSL2 = 1; break;
case '3': disableSSL3 = 1; break;
case 'B': bypassPKCS11 = 1; break;
case 'O': serverCertAuth.shouldPause = PR_FALSE; break;
case 'S': skipProtoHeader = PR_TRUE; break;
case 'T': disableTLS = 1; break;
case 'V': if (SECU_ParseSSLVersionRangeString(optstate->value,
enabledVersions, enableSSL2,
&enabledVersions, &enableSSL2) != SECSuccess) {
Usage(progName);
}
break;
case 'Y': PrintCipherUsage(progName); exit(0); break;
case 'a': if (!hs1SniHostName) {
hs1SniHostName = PORT_Strdup(optstate->value);
@@ -856,28 +883,22 @@ int main(int argc, char **argv)
PORT_Free(cstringSaved);
}
rv = SSL_OptionSet(s, SSL_ENABLE_SSL2, !disableSSL2);
rv = SSL_VersionRangeSet(s, &enabledVersions);
if (rv != SECSuccess) {
SECU_PrintError(progName, "error enabling SSLv2 ");
return 1;
SECU_PrintError(progName, "error setting SSL/TLS version range ");
return 1;
}
rv = SSL_OptionSet(s, SSL_ENABLE_SSL3, !disableSSL3);
rv = SSL_OptionSet(s, SSL_ENABLE_SSL2, enableSSL2);
if (rv != SECSuccess) {
SECU_PrintError(progName, "error enabling SSLv3 ");
return 1;
SECU_PrintError(progName, "error enabling SSLv2 ");
return 1;
}
rv = SSL_OptionSet(s, SSL_ENABLE_TLS, !disableTLS);
rv = SSL_OptionSet(s, SSL_V2_COMPATIBLE_HELLO, enableSSL2);
if (rv != SECSuccess) {
SECU_PrintError(progName, "error enabling TLS ");
return 1;
}
rv = SSL_OptionSet(s, SSL_V2_COMPATIBLE_HELLO, !disableSSL2);
if (rv != SECSuccess) {
SECU_PrintError(progName, "error enabling SSLv2 compatible hellos ");
return 1;
SECU_PrintError(progName, "error enabling SSLv2 compatible hellos ");
return 1;
}
/* enable PKCS11 bypass */

19
mozilla/security/nss/tests/ssl/ssl.sh
View File

@@ -266,6 +266,9 @@ ssl_cov()
mixed=0
start_selfserv # Launch the server
VMIN="ssl2"
VMAX="tls1.0"
exec < ${SSLCOV}
while read ectype tls param testname
@@ -278,11 +281,13 @@ ssl_cov()
if [ "${SSL2}" -eq 0 ] ; then
# We cannot use asynchronous cert verification with SSL2
SSL2_FLAGS=-O
VMIN="ssl2"
else
# Do not enable SSL2 for non-SSL2-specific tests. SSL2 is disabled by
# default in libssl but it is enabled by default in tstclnt; we want
# to test the libssl default whenever possible.
SSL2_FLAGS=-2
SSL2_FLAGS=
VMIN="ssl3"
fi
if [ "$NORM_EXT" = "Extended Test" -a "${SSL2}" -eq 0 ] ; then
@@ -293,9 +298,9 @@ ssl_cov()
echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
elif [ "`echo $ectype | cut -b 1`" != "#" ] ; then
echo "$SCRIPTNAME: running $testname ----------------------------"
TLS_FLAG=-T
VMAX="ssl3"
if [ "$tls" = "TLS" ]; then
TLS_FLAG=""
VMAX="tls1.0"
fi
# These five tests need an EC cert signed with RSA
@@ -326,11 +331,11 @@ ssl_cov()
fi
fi
echo "tstclnt -p ${PORT} -h ${HOSTADDR} -c ${param} ${TLS_FLAG} ${SSL2_FLAGS} ${CLIENT_OPTIONS} \\"
echo "tstclnt -p ${PORT} -h ${HOSTADDR} -c ${param} -V ${VMIN}:${VMAX} ${SSL2_FLAGS} ${CLIENT_OPTIONS} \\"
echo " -f -d ${P_R_CLIENTDIR} -v -w nss < ${REQUEST_FILE}"
rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
${PROFTOOL} ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} -c ${param} ${TLS_FLAG} ${SSL2_FLAGS} ${CLIENT_OPTIONS} -f \
${PROFTOOL} ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} -c ${param} -V ${VMIN}:${VMAX} ${SSL2_FLAGS} ${CLIENT_OPTIONS} -f \
-d ${P_R_CLIENTDIR} -v -w nss < ${REQUEST_FILE} \
>${TMP}/$HOST.tmp.$$ 2>&1
ret=$?
@@ -617,13 +622,13 @@ load_group_crl() {
echo "================= Reloading ${eccomment}CRL for group $grpBegin - $grpEnd ============="
echo "tstclnt -p ${PORT} -h ${HOSTADDR} -f -d ${R_CLIENTDIR} -v \\"
echo " -2 -w nss -n TestUser${UNREVOKED_CERT_GRP_1}${ecsuffix}"
echo " -V ssl3: -w nss -n TestUser${UNREVOKED_CERT_GRP_1}${ecsuffix}"
echo "Request:"
echo "GET crl://${SERVERDIR}/root.crl_${grpBegin}-${grpEnd}${ecsuffix}"
echo ""
echo "RELOAD time $i"
${PROFTOOL} ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} -f \
-d ${R_CLIENTDIR} -v -2 -w nss -n TestUser${UNREVOKED_CERT_GRP_1}${ecsuffix} \
-d ${R_CLIENTDIR} -v -V ssl3: -w nss -n TestUser${UNREVOKED_CERT_GRP_1}${ecsuffix} \
>${OUTFILE_TMP} 2>&1 <<_EOF_REQUEST_
GET crl://${SERVERDIR}/root.crl_${grpBegin}-${grpEnd}${ecsuffix}

80
mozilla/security/nss/tests/ssl/sslauth.txt
View File

@@ -14,24 +14,24 @@
noECC 254 -r_-r -w_nss_-n_none TLS Require client auth (client does not provide auth)
noECC 254 -r_-r -w_bogus_-n_TestUser TLS Require client auth (bad password)
noECC 0 -r_-r -w_nss_-n_TestUser_ TLS Require client auth (client auth)
noECC 0 -r -T_-w_nss_-n_none SSL3 Request don't require client auth (client does not provide auth)
noECC 0 -r -T_-n_TestUser_-w_bogus SSL3 Request don't require client auth (bad password)
noECC 0 -r -T_-n_TestUser_-w_nss SSL3 Request don't require client auth (client auth)
noECC 254 -r_-r -T_-w_nss_-n_none SSL3 Require client auth (client does not provide auth)
noECC 254 -r_-r -T_-n_TestUser_-w_bogus SSL3 Require client auth (bad password)
noECC 0 -r_-r -T_-n_TestUser_-w_nss SSL3 Require client auth (client auth)
noECC 0 -r_-r_-r -2_-w_nss_-n_none TLS Request don't require client auth on 2nd hs (client does not provide auth)
noECC 0 -r_-r_-r -2_-w_bogus_-n_TestUser TLS Request don't require client auth on 2nd hs (bad password)
noECC 0 -r_-r_-r -2_-w_nss_-n_TestUser TLS Request don't require client auth on 2nd hs (client auth)
noECC 1 -r_-r_-r_-r -2_-w_nss_-n_none TLS Require client auth on 2nd hs (client does not provide auth)
noECC 1 -r_-r_-r_-r -2_-w_bogus_-n_TestUser TLS Require client auth on 2nd hs (bad password)
noECC 0 -r_-r_-r_-r -2_-w_nss_-n_TestUser TLS Require client auth on 2nd hs (client auth)
noECC 0 -r_-r_-r -2_-T_-w_nss_-n_none SSL3 Request don't require client auth on 2nd hs (client does not provide auth)
noECC 0 -r_-r_-r -2_-T_-n_TestUser_-w_bogus SSL3 Request don't require client auth on 2nd hs (bad password)
noECC 0 -r_-r_-r -2_-T_-n_TestUser_-w_nss SSL3 Request don't require client auth on 2nd hs (client auth)
noECC 1 -r_-r_-r_-r -2_-T_-w_nss_-n_none SSL3 Require client auth on 2nd hs (client does not provide auth)
noECC 1 -r_-r_-r_-r -2_-T_-n_TestUser_-w_bogus SSL3 Require client auth on 2nd hs (bad password)
noECC 0 -r_-r_-r_-r -2_-T_-n_TestUser_-w_nss SSL3 Require client auth on 2nd hs (client auth)
noECC 0 -r -V_:ssl3_-w_nss_-n_none SSL3 Request don't require client auth (client does not provide auth)
noECC 0 -r -V_:ssl3_-n_TestUser_-w_bogus SSL3 Request don't require client auth (bad password)
noECC 0 -r -V_:ssl3_-n_TestUser_-w_nss SSL3 Request don't require client auth (client auth)
noECC 254 -r_-r -V_:ssl3_-w_nss_-n_none SSL3 Require client auth (client does not provide auth)
noECC 254 -r_-r -V_:ssl3_-n_TestUser_-w_bogus SSL3 Require client auth (bad password)
noECC 0 -r_-r -V_:ssl3_-n_TestUser_-w_nss SSL3 Require client auth (client auth)
noECC 0 -r_-r_-r -V_ssl3:_-w_nss_-n_none TLS Request don't require client auth on 2nd hs (client does not provide auth)
noECC 0 -r_-r_-r -V_ssl3:_-w_bogus_-n_TestUser TLS Request don't require client auth on 2nd hs (bad password)
noECC 0 -r_-r_-r -V_ssl3:_-w_nss_-n_TestUser TLS Request don't require client auth on 2nd hs (client auth)
noECC 1 -r_-r_-r_-r -V_ssl3:_-w_nss_-n_none TLS Require client auth on 2nd hs (client does not provide auth)
noECC 1 -r_-r_-r_-r -V_ssl3:_-w_bogus_-n_TestUser TLS Require client auth on 2nd hs (bad password)
noECC 0 -r_-r_-r_-r -V_ssl3:_-w_nss_-n_TestUser TLS Require client auth on 2nd hs (client auth)
noECC 0 -r_-r_-r -V_ssl3:ssl3_-w_nss_-n_none SSL3 Request don't require client auth on 2nd hs (client does not provide auth)
noECC 0 -r_-r_-r -V_ssl3:ssl3_-n_TestUser_-w_bogus SSL3 Request don't require client auth on 2nd hs (bad password)
noECC 0 -r_-r_-r -V_ssl3:ssl3_-n_TestUser_-w_nss SSL3 Request don't require client auth on 2nd hs (client auth)
noECC 1 -r_-r_-r_-r -V_ssl3:ssl3_-w_nss_-n_none SSL3 Require client auth on 2nd hs (client does not provide auth)
noECC 1 -r_-r_-r_-r -V_ssl3:ssl3_-n_TestUser_-w_bogus SSL3 Require client auth on 2nd hs (bad password)
noECC 0 -r_-r_-r_-r -V_ssl3:ssl3_-n_TestUser_-w_nss SSL3 Require client auth on 2nd hs (client auth)
#
# Use EC cert for client authentication
#
@@ -39,28 +39,28 @@
ECC 0 -r -w_nss_-n_TestUser-ec TLS Request don't require client auth (EC) (client auth)
ECC 254 -r_-r -w_bogus_-n_TestUser-ec TLS Require client auth (EC) (bad password)
ECC 0 -r_-r -w_nss_-n_TestUser-ec_ TLS Require client auth (EC) (client auth)
ECC 0 -r -T_-n_TestUser-ec_-w_bogus SSL3 Request don't require client auth (EC) (bad password)
ECC 0 -r -T_-n_TestUser-ec_-w_nss SSL3 Request don't require client auth (EC) (client auth)
ECC 254 -r_-r -T_-n_TestUser-ec_-w_bogus SSL3 Require client auth (EC) (bad password)
ECC 0 -r_-r -T_-n_TestUser-ec_-w_nss SSL3 Require client auth (EC) (client auth)
ECC 0 -r_-r_-r -2_-w_bogus_-n_TestUser-ec TLS Request don't require client auth on 2nd hs (EC) (bad password)
ECC 0 -r_-r_-r -2_-w_nss_-n_TestUser-ec TLS Request don't require client auth on 2nd hs (EC) (client auth)
ECC 1 -r_-r_-r_-r -2_-w_bogus_-n_TestUser-ec TLS Require client auth on 2nd hs (EC) (bad password)
ECC 0 -r_-r_-r_-r -2_-w_nss_-n_TestUser-ec_ TLS Require client auth on 2nd hs (EC) (client auth)
ECC 0 -r_-r_-r -2_-T_-n_TestUser-ec_-w_bogus SSL3 Request don't require client auth on 2nd hs (EC) (bad password)
ECC 0 -r_-r_-r -2_-T_-n_TestUser-ec_-w_nss SSL3 Request don't require client auth on 2nd hs (EC) (client auth)
ECC 1 -r_-r_-r_-r -2_-T_-n_TestUser-ec_-w_bogus SSL3 Require client auth on 2nd hs (EC) (bad password)
ECC 0 -r_-r_-r_-r -2_-T_-n_TestUser-ec_-w_nss SSL3 Require client auth on 2nd hs (EC) (client auth)
ECC 0 -r -V_:ssl3_-n_TestUser-ec_-w_bogus SSL3 Request don't require client auth (EC) (bad password)
ECC 0 -r -V_:ssl3_-n_TestUser-ec_-w_nss SSL3 Request don't require client auth (EC) (client auth)
ECC 254 -r_-r -V_:ssl3_-n_TestUser-ec_-w_bogus SSL3 Require client auth (EC) (bad password)
ECC 0 -r_-r -V_:ssl3_-n_TestUser-ec_-w_nss SSL3 Require client auth (EC) (client auth)
ECC 0 -r_-r_-r -V_ssl3:_-w_bogus_-n_TestUser-ec TLS Request don't require client auth on 2nd hs (EC) (bad password)
ECC 0 -r_-r_-r -V_ssl3:_-w_nss_-n_TestUser-ec TLS Request don't require client auth on 2nd hs (EC) (client auth)
ECC 1 -r_-r_-r_-r -V_ssl3:_-w_bogus_-n_TestUser-ec TLS Require client auth on 2nd hs (EC) (bad password)
ECC 0 -r_-r_-r_-r -V_ssl3:_-w_nss_-n_TestUser-ec_ TLS Require client auth on 2nd hs (EC) (client auth)
ECC 0 -r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_bogus SSL3 Request don't require client auth on 2nd hs (EC) (bad password)
ECC 0 -r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_nss SSL3 Request don't require client auth on 2nd hs (EC) (client auth)
ECC 1 -r_-r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_bogus SSL3 Require client auth on 2nd hs (EC) (bad password)
ECC 0 -r_-r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_nss SSL3 Require client auth on 2nd hs (EC) (client auth)
#
# SNI Tests
#
SNI 0 -r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser TLS Server hello response without SNI
SNI 0 -r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser_-a_Host-sni.Dom TLS Server hello response with SNI
SNI 1 -r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser_-a_Host-sni1.Dom TLS Server response with alert
SNI 0 -r_-a_Host-sni.Dom -2_-T_-w_nss_-n_TestUser SSL3 Server hello response without SNI
SNI 1 -r_-a_Host-sni.Dom -2_-T_-w_nss_-n_TestUser_-a_Host-sni.Dom SSL3 Server hello response with SNI: SSL don't have SH extensions
SNI 0 -r_-r_-r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser TLS Server hello response without SNI
SNI 0 -r_-r_-r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser_-a_Host-sni.Dom TLS Server hello response with SNI
SNI 1 -r_-r_-r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser_-a_Host-sni.Dom_-a_Host.Dom TLS Server hello response with SNI: Change name on 2d HS
SNI 1 -r_-r_-r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser_-a_Host-sni.Dom_-a_Host-sni1.Dom TLS Server hello response with SNI: Change name to invalid 2d HS
SNI 1 -r_-r_-r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser_-a_Host-sni1.Dom TLS Server response with alert
SNI 0 -r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser TLS Server hello response without SNI
SNI 0 -r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser_-a_Host-sni.Dom TLS Server hello response with SNI
SNI 1 -r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser_-a_Host-sni1.Dom TLS Server response with alert
SNI 0 -r_-a_Host-sni.Dom -V_ssl3:ssl3_-w_nss_-n_TestUser SSL3 Server hello response without SNI
SNI 1 -r_-a_Host-sni.Dom -V_ssl3:ssl3_-w_nss_-n_TestUser_-a_Host-sni.Dom SSL3 Server hello response with SNI: SSL don't have SH extensions
SNI 0 -r_-r_-r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser TLS Server hello response without SNI
SNI 0 -r_-r_-r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser_-a_Host-sni.Dom TLS Server hello response with SNI
SNI 1 -r_-r_-r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser_-a_Host-sni.Dom_-a_Host.Dom TLS Server hello response with SNI: Change name on 2d HS
SNI 1 -r_-r_-r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser_-a_Host-sni.Dom_-a_Host-sni1.Dom TLS Server hello response with SNI: Change name to invalid 2d HS
SNI 1 -r_-r_-r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser_-a_Host-sni1.Dom TLS Server response with alert

46
mozilla/security/nss/tests/ssl/sslstress.txt
View File

@@ -9,44 +9,44 @@
# ECC value params params
# ------- ------ ------ ------ ---------------
noECC 0 _ -c_1000_-C_A Stress SSL2 RC4 128 with MD5
noECC 0 _ -c_1000_-C_c_-T Stress SSL3 RC4 128 with MD5
noECC 0 _ -c_1000_-C_c_-V_:ssl3 Stress SSL3 RC4 128 with MD5
noECC 0 _ -c_1000_-C_c Stress TLS RC4 128 with MD5
noECC 0 _ -c_1000_-C_c_-g Stress TLS RC4 128 with MD5 (false start)
noECC 0 -u -2_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket)
noECC 0 -z -2_-c_1000_-C_c_-z Stress TLS RC4 128 with MD5 (compression)
noECC 0 -u_-z -2_-c_1000_-C_c_-u_-z Stress TLS RC4 128 with MD5 (session ticket, compression)
noECC 0 -u_-z -2_-c_1000_-C_c_-u_-z_-g Stress TLS RC4 128 with MD5 (session ticket, compression, false start)
SNI 0 -u_-a_Host-sni.Dom -2_-3_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket, SNI)
noECC 0 -u -V_ssl3:_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket)
noECC 0 -z -V_ssl3:_-c_1000_-C_c_-z Stress TLS RC4 128 with MD5 (compression)
noECC 0 -u_-z -V_ssl3:_-c_1000_-C_c_-u_-z Stress TLS RC4 128 with MD5 (session ticket, compression)
noECC 0 -u_-z -V_ssl3:_-c_1000_-C_c_-u_-z_-g Stress TLS RC4 128 with MD5 (session ticket, compression, false start)
SNI 0 -u_-a_Host-sni.Dom -V_tls1.0:_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket, SNI)
#
# add client auth versions here...
#
noECC 0 -r_-r -c_100_-C_A_-N_-n_TestUser Stress SSL2 RC4 128 with MD5 (no reuse, client auth)
noECC 0 -r_-r -c_100_-C_c_-T_-N_-n_TestUser Stress SSL3 RC4 128 with MD5 (no reuse, client auth)
noECC 0 -r_-r -c_100_-C_c_-V_:ssl3_-N_-n_TestUser Stress SSL3 RC4 128 with MD5 (no reuse, client auth)
noECC 0 -r_-r -c_100_-C_c_-N_-n_TestUser Stress TLS RC4 128 with MD5 (no reuse, client auth)
noECC 0 -r_-r_-u -2_-c_100_-C_c_-n_TestUser_-u Stress TLS RC4 128 with MD5 (session ticket, client auth)
noECC 0 -r_-r_-z -2_-c_100_-C_c_-n_TestUser_-z Stress TLS RC4 128 with MD5 (compression, client auth)
noECC 0 -r_-r_-z -2_-c_100_-C_c_-n_TestUser_-z_-g Stress TLS RC4 128 with MD5 (compression, client auth, false start)
noECC 0 -r_-r_-u_-z -2_-c_100_-C_c_-n_TestUser_-u_-z Stress TLS RC4 128 with MD5 (session ticket, compression, client auth)
noECC 0 -r_-r_-u_-z -2_-c_100_-C_c_-n_TestUser_-u_-z_-g Stress TLS RC4 128 with MD5 (session ticket, compression, client auth, false start)
SNI 0 -r_-r_-u_-a_Host-sni.Dom -2_-3_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket, SNI, client auth, default virt host)
SNI 0 -r_-r_-u_-a_Host-sni.Dom_-k_Host-sni.Dom -2_-3_-c_1000_-C_c_-u_-a_Host-sni.Dom Stress TLS RC4 128 with MD5 (session ticket, SNI, client auth, change virt host)
noECC 0 -r_-r_-u -V_ssl3:_-c_100_-C_c_-n_TestUser_-u Stress TLS RC4 128 with MD5 (session ticket, client auth)
noECC 0 -r_-r_-z -V_ssl3:_-c_100_-C_c_-n_TestUser_-z Stress TLS RC4 128 with MD5 (compression, client auth)
noECC 0 -r_-r_-z -V_ssl3:_-c_100_-C_c_-n_TestUser_-z_-g Stress TLS RC4 128 with MD5 (compression, client auth, false start)
noECC 0 -r_-r_-u_-z -V_ssl3:_-c_100_-C_c_-n_TestUser_-u_-z Stress TLS RC4 128 with MD5 (session ticket, compression, client auth)
noECC 0 -r_-r_-u_-z -V_ssl3:_-c_100_-C_c_-n_TestUser_-u_-z_-g Stress TLS RC4 128 with MD5 (session ticket, compression, client auth, false start)
SNI 0 -r_-r_-u_-a_Host-sni.Dom -V_tls1.0:_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket, SNI, client auth, default virt host)
SNI 0 -r_-r_-u_-a_Host-sni.Dom_-k_Host-sni.Dom -V_tls1.0:_-c_1000_-C_c_-u_-a_Host-sni.Dom Stress TLS RC4 128 with MD5 (session ticket, SNI, client auth, change virt host)
#
# ############################ ECC ciphers ############################
#
ECC 0 -c_:C009 -c_100_-C_:C009_-N_-T Stress SSL3 ECDHE-ECDSA AES 128 CBC with SHA (no reuse)
ECC 0 -c_:C013 -c_1000_-C_:C013_-T Stress SSL3 ECDHE-RSA AES 128 CBC with SHA
ECC 0 -c_:C004 -2_-c_100_-C_:C004_-N Stress TLS ECDH-ECDSA AES 128 CBC with SHA (no reuse)
ECC 0 -c_:C00E -2_-c_100_-C_:C00E_-N Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse)
ECC 0 -c_:C013 -2_-c_1000_-C_:C013 Stress TLS ECDHE-RSA AES 128 CBC with SHA
ECC 0 -c_:C004_-u -2_-c_1000_-C_:C004_-u Stress TLS ECDH-ECDSA AES 128 CBC with SHA (session ticket)
ECC 0 -c_:C009 -c_100_-C_:C009_-N_-V_:ssl3 Stress SSL3 ECDHE-ECDSA AES 128 CBC with SHA (no reuse)
ECC 0 -c_:C013 -c_1000_-C_:C013_-V_:ssl3 Stress SSL3 ECDHE-RSA AES 128 CBC with SHA
ECC 0 -c_:C004 -V_ssl3:_-c_100_-C_:C004_-N Stress TLS ECDH-ECDSA AES 128 CBC with SHA (no reuse)
ECC 0 -c_:C00E -V_ssl3:_-c_100_-C_:C00E_-N Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse)
ECC 0 -c_:C013 -V_ssl3:_-c_1000_-C_:C013 Stress TLS ECDHE-RSA AES 128 CBC with SHA
ECC 0 -c_:C004_-u -V_ssl3:_-c_1000_-C_:C004_-u Stress TLS ECDH-ECDSA AES 128 CBC with SHA (session ticket)
#
# add client auth versions here...
#
ECC 0 -r_-r_-c_:C009 -c_10_-C_:C009_-N_-T_-n_TestUser-ec Stress SSL3 ECDHE-ECDSA AES 128 CBC with SHA (no reuse, client auth)
ECC 0 -r_-r_-c_:C013 -c_100_-C_:C013_-T_-n_TestUser-ec Stress SSL3 ECDHE-RSA AES 128 CBC with SHA (client auth)
ECC 0 -r_-r_-c_:C009 -c_10_-C_:C009_-N_-V_:ssl3_-n_TestUser-ec Stress SSL3 ECDHE-ECDSA AES 128 CBC with SHA (no reuse, client auth)
ECC 0 -r_-r_-c_:C013 -c_100_-C_:C013_-V_:ssl3_-n_TestUser-ec Stress SSL3 ECDHE-RSA AES 128 CBC with SHA (client auth)
ECC 0 -r_-r_-c_:C004 -c_10_-C_:C004_-N_-n_TestUser-ec Stress TLS ECDH-ECDSA AES 128 CBC with SHA (no reuse, client auth)
ECC 0 -r_-r_-c_:C00E -c_10_-C_:C00E_-N_-n_TestUser-ecmixed Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse, client auth)
ECC 0 -r_-r_-c_:C013 -c_100_-C_:C013_-n_TestUser-ec Stress TLS ECDHE-RSA AES 128 CBC with SHA(client auth)
ECC 0 -r_-r_-c_:C013_-u -2_-c_100_-C_:C013_-n_TestUser-ec_-u Stress TLS ECDHE-RSA AES 128 CBC with SHA(session ticket, client auth)
ECC 0 -r_-r_-c_:C013_-u -V_ssl3:_-c_100_-C_:C013_-n_TestUser-ec_-u Stress TLS ECDHE-RSA AES 128 CBC with SHA(session ticket, client auth)