diff --git a/mozilla/security/nss/cmd/lib/secutil.c b/mozilla/security/nss/cmd/lib/secutil.c index 958ea64c3c1..0730b5711db 100644 --- a/mozilla/security/nss/cmd/lib/secutil.c +++ b/mozilla/security/nss/cmd/lib/secutil.c @@ -52,6 +52,7 @@ static char consoleName[] = { #include "nssutil.h" #include "ssl.h" +#include "sslproto.h" static void @@ -3557,4 +3558,116 @@ SECU_FindCertByNicknameOrFilename(CERTCertDBHandle *handle, return the_cert; } +/* Convert a SSL/TLS protocol version string into the respective numeric value + * defined by the SSL_LIBRARY_VERSION_* constants, + * while accepting a flexible set of case-insensitive identifiers. + * + * Caller must specify bufLen, allowing the function to operate on substrings. + */ +static SECStatus +SECU_GetSSLVersionFromName(const char *buf, size_t bufLen, PRUint16 *version) +{ + if (!buf || !version) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + if (!PL_strncasecmp(buf, "ssl2", bufLen)) { + *version = SSL_LIBRARY_VERSION_2; + return SECSuccess; + } + if (!PL_strncasecmp(buf, "ssl3", bufLen)) { + *version = SSL_LIBRARY_VERSION_3_0; + return SECSuccess; + } + if (!PL_strncasecmp(buf, "tls1.0", bufLen)) { + *version = SSL_LIBRARY_VERSION_TLS_1_0; + return SECSuccess; + } + if (!PL_strncasecmp(buf, "tls1.1", bufLen)) { + *version = SSL_LIBRARY_VERSION_TLS_1_1; + return SECSuccess; + } + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; +} + +SECStatus +SECU_ParseSSLVersionRangeString(const char *input, + const SSLVersionRange defaultVersionRange, + const PRBool defaultEnableSSL2, + SSLVersionRange *vrange, PRBool *enableSSL2) +{ + const char *colonPos; + size_t colonIndex; + const char *maxStr; + + if (!input || !vrange || !enableSSL2) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (!strcmp(input, ":")) { + /* special value, use default */ + *enableSSL2 = defaultEnableSSL2; + *vrange = defaultVersionRange; + return SECSuccess; + } + + colonPos = strchr(input, ':'); + if (!colonPos) { + return SECFailure; + PORT_SetError(SEC_ERROR_INVALID_ARGS); + } + + colonIndex = colonPos - input; + maxStr = colonPos + 1; + + if (!colonIndex) { + /* colon was first character, min version is empty */ + *enableSSL2 = defaultEnableSSL2; + vrange->min = defaultVersionRange.min; + } else { + PRUint16 version; + /* colonIndex is equivalent to the length of the min version substring */ + if (SECU_GetSSLVersionFromName(input, colonIndex, &version) != SECSuccess) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (version == SSL_LIBRARY_VERSION_2) { + *enableSSL2 = PR_TRUE; + vrange->min = defaultVersionRange.min; + } else { + *enableSSL2 = PR_FALSE; + vrange->min = version; + } + } + + if (!*maxStr) { + vrange->max = defaultVersionRange.max; + } else { + PRUint16 version; + /* if max version is empty, then maxStr points to the string terminator */ + if (SECU_GetSSLVersionFromName(maxStr, strlen(maxStr), &version) + != SECSuccess) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (version == SSL_LIBRARY_VERSION_2) { + /* consistency checking, require that min allows enableSSL2, too */ + if (!*enableSSL2) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + /* we use 0 because SSL_LIBRARY_VERSION_NONE is private: */ + vrange->min = 0; + vrange->max = 0; + } else { + vrange->max = version; + } + } + + return SECSuccess; +} diff --git a/mozilla/security/nss/cmd/lib/secutil.h b/mozilla/security/nss/cmd/lib/secutil.h index 22c1fdd2524..f5d9c4b270d 100644 --- a/mozilla/security/nss/cmd/lib/secutil.h +++ b/mozilla/security/nss/cmd/lib/secutil.h @@ -17,6 +17,7 @@ #include "basicutil.h" #include "sslerr.h" +#include "sslt.h" #define SEC_CT_PRIVATE_KEY "private-key" @@ -370,6 +371,33 @@ SECU_SECItemToHex(const SECItem * item, char * dst); SECStatus SECU_SECItemHexStringToBinary(SECItem* srcdest); +/* Parse a version range string, with "min" and "max" version numbers, + * separated by colon (":"), and return the result in vr and v2. + * + * Both min and max values are optional. + * The following syntax is used to specify the enabled protocol versions: + * A string with only a max value is expected as ":{max}", + * and all implemented versions less than or equal to max will be enabled. + * A string with only a min value is expected as "{min}:", + * and all implemented versions greater than or equal to min will be enabled. + * A string consisting of a colon only means "all versions enabled". + * + * Because output parameter type SSLVersionRange doesn't allow to set + * version 2 values, we use a separate boolean output parameter + * to return whether SSL 2 is enabled. + * + * In order to avoid a link dependency from libsectool to libssl, + * the caller must provide the desired default values for the min/max values, + * by providing defaultEnableSSL2 and defaultVersionRange + * (which can be obtained from libssl by calling SSL_VersionRangeGetSupported). + */ +SECStatus +SECU_ParseSSLVersionRangeString(const char *input, + const SSLVersionRange defaultVersionRange, + const PRBool defaultEnableSSL2, + SSLVersionRange *vrange, + PRBool *enableSSL2); + /* * * Error messaging diff --git a/mozilla/security/nss/cmd/selfserv/selfserv.c b/mozilla/security/nss/cmd/selfserv/selfserv.c index 010d85fa57b..cc17d0d53cc 100644 --- a/mozilla/security/nss/cmd/selfserv/selfserv.c +++ b/mozilla/security/nss/cmd/selfserv/selfserv.c @@ -136,22 +136,29 @@ static PRLogModuleInfo *lm; #define VLOG(arg) PR_LOG(lm,PR_LOG_DEBUG,arg) static void -Usage(const char *progName) +PrintUsageHeader(const char *progName) { fprintf(stderr, - -"Usage: %s -n rsa_nickname -p port [-3BDENRSTbjlmrsuvx] [-w password]\n" -" [-t threads] [-i pid_file] [-c ciphers] [-d dbdir] [-g numblocks]\n" +"Usage: %s -n rsa_nickname -p port [-BDENRbjlmrsuvx] [-w password]\n" +" [-t threads] [-i pid_file] [-c ciphers] [-Y] [-d dbdir] [-g numblocks]\n" " [-f password_file] [-L [seconds]] [-M maxProcs] [-P dbprefix]\n" -" [-a sni_name]\n" +" [-V [min-version]:[max-version]] [-a sni_name]\n" #ifdef NSS_ENABLE_ECC " [-C SSLCacheEntries] [-e ec_nickname]\n" #else " [-C SSLCacheEntries]\n" #endif /* NSS_ENABLE_ECC */ -"-S means disable SSL v2\n" -"-3 means disable SSL v3\n" -"-T means disable TLS\n" + ,progName); +} + +static void +PrintParameterUsage() +{ + fputs( +"-V [min]:[max] restricts the set of enabled SSL/TLS protocol versions.\n" +" All versions are enabled by default.\n" +" Possible values for min/max: ssl2 ssl3 tls1.0 tls1.1\n" +" Example: \"-V ssl3:\" enables SSL 3 and newer.\n" "-B bypasses the PKCS11 layer for SSL encryption and MACing\n" "-q checks for bypassability\n" "-D means disable Nagle delays in TCP\n" @@ -182,6 +189,23 @@ Usage(const char *progName) "-j means measure TCP throughput (for use with -g option)\n" "-C SSLCacheEntries sets the maximum number of entries in the SSL\n" " session cache\n" +"-c Restrict ciphers\n" +"-Y prints cipher values allowed for parameter -c and exits\n" + , stderr); +} + +static void +Usage(const char *progName) +{ + PrintUsageHeader(progName); + PrintParameterUsage(); +} + +static void +PrintCipherUsage(const char *progName) +{ + PrintUsageHeader(progName); + fputs( "-c ciphers Letter(s) chosen from the following list\n" "A SSL2 RC4 128 WITH MD5\n" "B SSL2 RC4 128 EXPORT40 WITH MD5\n" @@ -206,7 +230,7 @@ Usage(const char *progName) "z SSL3 RSA WITH NULL SHA\n" "\n" ":WXYZ Use cipher with hex code { 0xWX , 0xYZ } in TLS\n" - ,progName); + , stderr); } static const char * @@ -756,9 +780,8 @@ logger(void *arg) **************************************************************************/ PRBool useModelSocket = PR_FALSE; -PRBool disableSSL2 = PR_FALSE; -PRBool disableSSL3 = PR_FALSE; -PRBool disableTLS = PR_FALSE; +static SSLVersionRange enabledVersions; +PRBool enableSSL2 = PR_TRUE; PRBool disableRollBack = PR_FALSE; PRBool NoReuse = PR_FALSE; PRBool hasSidCache = PR_FALSE; @@ -1618,27 +1641,22 @@ server_main( } /* do SSL configuration. */ - rv = SSL_OptionSet(model_sock, SSL_SECURITY, - !(disableSSL2 && disableSSL3 && disableTLS)); + rv = SSL_OptionSet(model_sock, SSL_SECURITY, + enableSSL2 || enabledVersions.min != 0); if (rv < 0) { errExit("SSL_OptionSet SSL_SECURITY"); } - rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL3, !disableSSL3); + rv = SSL_VersionRangeSet(model_sock, &enabledVersions); if (rv != SECSuccess) { - errExit("error enabling SSLv3 "); + errExit("error setting SSL/TLS version range "); } - rv = SSL_OptionSet(model_sock, SSL_ENABLE_TLS, !disableTLS); + rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL2, enableSSL2); if (rv != SECSuccess) { - errExit("error enabling TLS "); + errExit("error enabling SSLv2 "); } - rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL2, !disableSSL2); - if (rv != SECSuccess) { - errExit("error enabling SSLv2 "); - } - rv = SSL_OptionSet(model_sock, SSL_ROLLBACK_DETECTION, !disableRollBack); if (rv != SECSuccess) { errExit("error enabling RollBack detection "); @@ -1914,19 +1932,18 @@ main(int argc, char **argv) progName = progName ? progName + 1 : tmp; PR_Init( PR_SYSTEM_THREAD, PR_PRIORITY_NORMAL, 1); + SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledVersions); /* please keep this list of options in ASCII collating sequence. ** numbers, then capital letters, then lower case, alphabetical. */ optstate = PL_CreateOptState(argc, argv, - "2:3BC:DEL:M:NP:RSTa:bc:d:e:f:g:hi:jk:lmn:op:qrst:uvw:xyz"); + "2:BC:DEL:M:NP:RV:Ya:bc:d:e:f:g:hi:jk:lmn:op:qrst:uvw:xyz"); while ((status = PL_GetNextOpt(optstate)) == PL_OPT_OK) { ++optionsFound; switch(optstate->option) { case '2': fileName = optstate->value; break; - case '3': disableSSL3 = PR_TRUE; break; - case 'B': bypassPKCS11 = PR_TRUE; break; case 'C': if (optstate->value) NumSidCacheEntries = PORT_Atoi(optstate->value); break; @@ -1953,11 +1970,16 @@ main(int argc, char **argv) case 'N': NoReuse = PR_TRUE; break; case 'R': disableRollBack = PR_TRUE; break; + + case 'V': if (SECU_ParseSSLVersionRangeString(optstate->value, + enabledVersions, enableSSL2, + &enabledVersions, &enableSSL2) != SECSuccess) { + Usage(progName); + } + break; + + case 'Y': PrintCipherUsage(progName); exit(0); break; - case 'S': disableSSL2 = PR_TRUE; break; - - case 'T': disableTLS = PR_TRUE; break; - case 'a': if (virtServerNameIndex >= MAX_VIRT_SERVER_NAME_ARRAY_INDEX) { Usage(progName); } @@ -2258,8 +2280,20 @@ main(int argc, char **argv) && enabled) savecipher(*cipherSuites); } - protos = (disableTLS ? 0 : SSL_CBP_TLS1_0) + - (disableSSL3 ? 0 : SSL_CBP_SSL3); + protos = 0; + if (enabledVersions.min <= SSL_LIBRARY_VERSION_3_0 && + enabledVersions.max >= SSL_LIBRARY_VERSION_3_0) { + protos |= SSL_CBP_SSL3; + } + if (enabledVersions.min <= SSL_LIBRARY_VERSION_TLS_1_0 && + enabledVersions.max >= SSL_LIBRARY_VERSION_TLS_1_0) { + protos |= SSL_CBP_TLS1_0; + } + /* TLS 1.1 has the same SSL Bypass mode requirements as TLS 1.0 */ + if (enabledVersions.min <= SSL_LIBRARY_VERSION_TLS_1_1 && + enabledVersions.max >= SSL_LIBRARY_VERSION_TLS_1_1) { + protos |= SSL_CBP_TLS1_0; + } } if (nickName) { diff --git a/mozilla/security/nss/cmd/strsclnt/strsclnt.c b/mozilla/security/nss/cmd/strsclnt/strsclnt.c index 12d9954ad15..bbe9d86345d 100644 --- a/mozilla/security/nss/cmd/strsclnt/strsclnt.c +++ b/mozilla/security/nss/cmd/strsclnt/strsclnt.c @@ -5,6 +5,7 @@ #include #include "secutil.h" +#include "basicutil.h" #if defined(XP_UNIX) #include @@ -122,9 +123,8 @@ static PRInt32 numUsed; static SSL3Statistics * ssl3stats; static int failed_already = 0; -static PRBool disableSSL2 = PR_FALSE; -static PRBool disableSSL3 = PR_FALSE; -static PRBool disableTLS = PR_FALSE; +static SSLVersionRange enabledVersions; +static PRBool enableSSL2 = PR_TRUE; static PRBool bypassPKCS11 = PR_FALSE; static PRBool disableLocking = PR_FALSE; static PRBool ignoreErrors = PR_FALSE; @@ -150,9 +150,9 @@ Usage(const char *progName) { fprintf(stderr, "Usage: %s [-n nickname] [-p port] [-d dbdir] [-c connections]\n" - " [-23BDNTovqs] [-f filename] [-N | -P percentage]\n" + " [-BDNovqs] [-f filename] [-N | -P percentage]\n" " [-w dbpasswd] [-C cipher(s)] [-t threads] [-W pwfile]\n" - " [-a sniHostName] hostname\n" + " [-V [min-version]:[max-version]] [-a sniHostName] hostname\n" " where -v means verbose\n" " -o flag is interpreted as follows:\n" " 1 -o means override the result of server certificate validation.\n" @@ -162,9 +162,10 @@ Usage(const char *progName) " -s means disable SSL socket locking\n" " -N means no session reuse\n" " -P means do a specified percentage of full handshakes (0-100)\n" - " -2 means disable SSL2\n" - " -3 means disable SSL3\n" - " -T means disable TLS\n" + " -V [min]:[max] restricts the set of enabled SSL/TLS protocols versions.\n" + " All versions are enabled by default.\n" + " Possible values for min/max: ssl2 ssl3 tls1.0 tls1.1\n" + " Example: \"-V ssl3:\" enables SSL 3 and newer.\n" " -U means enable throttling up threads\n" " -B bypasses the PKCS11 layer for SSL encryption and MACing\n" " -u enable TLS Session Ticket extension\n" @@ -1155,29 +1156,24 @@ client_main( /* do SSL configuration. */ rv = SSL_OptionSet(model_sock, SSL_SECURITY, - !(disableSSL2 && disableSSL3 && disableTLS)); + enableSSL2 || enabledVersions.min != 0); if (rv < 0) { errExit("SSL_OptionSet SSL_SECURITY"); } - rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL2, !disableSSL2); + rv = SSL_VersionRangeSet(model_sock, &enabledVersions); if (rv != SECSuccess) { - errExit("error enabling SSLv2 "); + errExit("error setting SSL/TLS version range "); } - rv = SSL_OptionSet(model_sock, SSL_V2_COMPATIBLE_HELLO, !disableSSL2); + rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL2, enableSSL2); if (rv != SECSuccess) { - errExit("error enabling SSLv2 compatible hellos "); + errExit("error enabling SSLv2 "); } - rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL3, !disableSSL3); + rv = SSL_OptionSet(model_sock, SSL_V2_COMPATIBLE_HELLO, enableSSL2); if (rv != SECSuccess) { - errExit("error enabling SSLv3 "); - } - - rv = SSL_OptionSet(model_sock, SSL_ENABLE_TLS, !disableTLS); - if (rv != SECSuccess) { - errExit("error enabling TLS "); + errExit("error enabling SSLv2 compatible hellos "); } if (bigBuf.data) { /* doing FDX */ @@ -1329,6 +1325,7 @@ main(int argc, char **argv) /* Call the NSPR initialization routines */ PR_Init( PR_SYSTEM_THREAD, PR_PRIORITY_NORMAL, 1); + SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledVersions); tmp = strrchr(argv[0], '/'); tmp = tmp ? tmp + 1 : argv[0]; @@ -1337,14 +1334,9 @@ main(int argc, char **argv) optstate = PL_CreateOptState(argc, argv, - "23BC:DNP:TUW:a:c:d:f:gin:op:qst:uvw:z"); + "BC:DNP:UV:W:a:c:d:f:gin:op:qst:uvw:z"); while ((status = PL_GetNextOpt(optstate)) == PL_OPT_OK) { switch(optstate->option) { - - case '2': disableSSL2 = PR_TRUE; break; - - case '3': disableSSL3 = PR_TRUE; break; - case 'B': bypassPKCS11 = PR_TRUE; break; case 'C': cipherString = optstate->value; break; @@ -1355,9 +1347,14 @@ main(int argc, char **argv) case 'P': fullhs = PORT_Atoi(optstate->value); break; - case 'T': disableTLS = PR_TRUE; break; - case 'U': ThrottleUp = PR_TRUE; break; + + case 'V': if (SECU_ParseSSLVersionRangeString(optstate->value, + enabledVersions, enableSSL2, + &enabledVersions, &enableSSL2) != SECSuccess) { + Usage(progName); + } + break; case 'a': sniHostName = PL_strdup(optstate->value); break; diff --git a/mozilla/security/nss/cmd/tstclnt/tstclnt.c b/mozilla/security/nss/cmd/tstclnt/tstclnt.c index c01a4f530e1..56df75233d3 100644 --- a/mozilla/security/nss/cmd/tstclnt/tstclnt.c +++ b/mozilla/security/nss/cmd/tstclnt/tstclnt.c @@ -9,6 +9,7 @@ */ #include "secutil.h" +#include "basicutil.h" #if defined(XP_UNIX) #include @@ -159,13 +160,18 @@ handshakeCallback(PRFileDesc *fd, void *client_data) } } -static void Usage(const char *progName) +static void PrintUsageHeader(const char *progName) { fprintf(stderr, "Usage: %s -h host [-a 1st_hs_name ] [-a 2nd_hs_name ] [-p port]\n" - "[-d certdir] [-n nickname] [-23BTafosvx] [-c ciphers]\n" + "[-d certdir] [-n nickname] [-Bafosvx] [-c ciphers] [-Y]\n" + "[-V [min-version]:[max-version]]\n" "[-r N] [-w passwd] [-W pwfile] [-q [-t seconds]]\n", progName); +} + +static void PrintParameterUsage(void) +{ fprintf(stderr, "%-20s Send different SNI name. 1st_hs_name - at first\n" "%-20s handshake, 2nd_hs_name - at second handshake.\n" "%-20s Default is host from the -h argument.\n", "-a name", @@ -179,9 +185,12 @@ static void Usage(const char *progName) "-n nickname"); fprintf(stderr, "%-20s Bypass PKCS11 layer for SSL encryption and MACing.\n", "-B"); - fprintf(stderr, "%-20s Disable SSL v2.\n", "-2"); - fprintf(stderr, "%-20s Disable SSL v3.\n", "-3"); - fprintf(stderr, "%-20s Disable TLS (SSL v3.1).\n", "-T"); + fprintf(stderr, + "%-20s Restricts the set of enabled SSL/TLS protocols versions.\n" + "%-20s All versions are enabled by default.\n" + "%-20s Possible values for min/max: ssl2 ssl3 tls1.0 tls1.1\n" + "%-20s Example: \"-V ssl3:\" enables SSL 3 and newer.\n", + "-V [min]:[max]", "", "", ""); fprintf(stderr, "%-20s Prints only payload data. Skips HTTP header.\n", "-S"); fprintf(stderr, "%-20s Client speaks first. \n", "-f"); fprintf(stderr, "%-20s Use synchronous certificate validation " @@ -196,6 +205,20 @@ static void Usage(const char *progName) fprintf(stderr, "%-20s Enable the session ticket extension.\n", "-u"); fprintf(stderr, "%-20s Enable compression.\n", "-z"); fprintf(stderr, "%-20s Enable false start.\n", "-g"); + fprintf(stderr, "%-20s Restrict ciphers\n", "-c ciphers"); + fprintf(stderr, "%-20s Print cipher values allowed for parameter -c and exit\n", "-Y"); +} + +static void Usage(const char *progName) +{ + PrintUsageHeader(progName); + PrintParameterUsage(); + exit(1); +} + +static void PrintCipherUsage(const char *progName) +{ + PrintUsageHeader(progName); fprintf(stderr, "%-20s Letter(s) chosen from the following list\n", "-c ciphers"); fprintf(stderr, @@ -545,9 +568,8 @@ int main(int argc, char **argv) PRInt32 filesReady; int npds; int override = 0; - int disableSSL2 = 0; - int disableSSL3 = 0; - int disableTLS = 0; + SSLVersionRange enabledVersions; + PRBool enableSSL2 = PR_TRUE; int bypassPKCS11 = 0; int disableLocking = 0; int useExportPolicy = 0; @@ -589,24 +611,29 @@ int main(int argc, char **argv) } } + SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledVersions); + optstate = PL_CreateOptState(argc, argv, - "23BOSTW:a:c:d:fgh:m:n:op:qr:st:uvw:xz"); + "BOSV:W:Ya:c:d:fgh:m:n:op:qr:st:uvw:xz"); while ((optstatus = PL_GetNextOpt(optstate)) == PL_OPT_OK) { switch (optstate->option) { case '?': default : Usage(progName); break; - case '2': disableSSL2 = 1; break; - - case '3': disableSSL3 = 1; break; - case 'B': bypassPKCS11 = 1; break; case 'O': serverCertAuth.shouldPause = PR_FALSE; break; case 'S': skipProtoHeader = PR_TRUE; break; - case 'T': disableTLS = 1; break; + case 'V': if (SECU_ParseSSLVersionRangeString(optstate->value, + enabledVersions, enableSSL2, + &enabledVersions, &enableSSL2) != SECSuccess) { + Usage(progName); + } + break; + + case 'Y': PrintCipherUsage(progName); exit(0); break; case 'a': if (!hs1SniHostName) { hs1SniHostName = PORT_Strdup(optstate->value); @@ -856,28 +883,22 @@ int main(int argc, char **argv) PORT_Free(cstringSaved); } - rv = SSL_OptionSet(s, SSL_ENABLE_SSL2, !disableSSL2); + rv = SSL_VersionRangeSet(s, &enabledVersions); if (rv != SECSuccess) { - SECU_PrintError(progName, "error enabling SSLv2 "); - return 1; + SECU_PrintError(progName, "error setting SSL/TLS version range "); + return 1; } - rv = SSL_OptionSet(s, SSL_ENABLE_SSL3, !disableSSL3); + rv = SSL_OptionSet(s, SSL_ENABLE_SSL2, enableSSL2); if (rv != SECSuccess) { - SECU_PrintError(progName, "error enabling SSLv3 "); - return 1; + SECU_PrintError(progName, "error enabling SSLv2 "); + return 1; } - rv = SSL_OptionSet(s, SSL_ENABLE_TLS, !disableTLS); + rv = SSL_OptionSet(s, SSL_V2_COMPATIBLE_HELLO, enableSSL2); if (rv != SECSuccess) { - SECU_PrintError(progName, "error enabling TLS "); - return 1; - } - - rv = SSL_OptionSet(s, SSL_V2_COMPATIBLE_HELLO, !disableSSL2); - if (rv != SECSuccess) { - SECU_PrintError(progName, "error enabling SSLv2 compatible hellos "); - return 1; + SECU_PrintError(progName, "error enabling SSLv2 compatible hellos "); + return 1; } /* enable PKCS11 bypass */ diff --git a/mozilla/security/nss/tests/ssl/ssl.sh b/mozilla/security/nss/tests/ssl/ssl.sh index b8b7972373b..17b12968ee3 100755 --- a/mozilla/security/nss/tests/ssl/ssl.sh +++ b/mozilla/security/nss/tests/ssl/ssl.sh @@ -266,6 +266,9 @@ ssl_cov() mixed=0 start_selfserv # Launch the server + + VMIN="ssl2" + VMAX="tls1.0" exec < ${SSLCOV} while read ectype tls param testname @@ -278,11 +281,13 @@ ssl_cov() if [ "${SSL2}" -eq 0 ] ; then # We cannot use asynchronous cert verification with SSL2 SSL2_FLAGS=-O + VMIN="ssl2" else # Do not enable SSL2 for non-SSL2-specific tests. SSL2 is disabled by # default in libssl but it is enabled by default in tstclnt; we want # to test the libssl default whenever possible. - SSL2_FLAGS=-2 + SSL2_FLAGS= + VMIN="ssl3" fi if [ "$NORM_EXT" = "Extended Test" -a "${SSL2}" -eq 0 ] ; then @@ -293,9 +298,9 @@ ssl_cov() echo "$SCRIPTNAME: skipping $testname (non-FIPS only)" elif [ "`echo $ectype | cut -b 1`" != "#" ] ; then echo "$SCRIPTNAME: running $testname ----------------------------" - TLS_FLAG=-T + VMAX="ssl3" if [ "$tls" = "TLS" ]; then - TLS_FLAG="" + VMAX="tls1.0" fi # These five tests need an EC cert signed with RSA @@ -326,11 +331,11 @@ ssl_cov() fi fi - echo "tstclnt -p ${PORT} -h ${HOSTADDR} -c ${param} ${TLS_FLAG} ${SSL2_FLAGS} ${CLIENT_OPTIONS} \\" + echo "tstclnt -p ${PORT} -h ${HOSTADDR} -c ${param} -V ${VMIN}:${VMAX} ${SSL2_FLAGS} ${CLIENT_OPTIONS} \\" echo " -f -d ${P_R_CLIENTDIR} -v -w nss < ${REQUEST_FILE}" rm ${TMP}/$HOST.tmp.$$ 2>/dev/null - ${PROFTOOL} ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} -c ${param} ${TLS_FLAG} ${SSL2_FLAGS} ${CLIENT_OPTIONS} -f \ + ${PROFTOOL} ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} -c ${param} -V ${VMIN}:${VMAX} ${SSL2_FLAGS} ${CLIENT_OPTIONS} -f \ -d ${P_R_CLIENTDIR} -v -w nss < ${REQUEST_FILE} \ >${TMP}/$HOST.tmp.$$ 2>&1 ret=$? @@ -617,13 +622,13 @@ load_group_crl() { echo "================= Reloading ${eccomment}CRL for group $grpBegin - $grpEnd =============" echo "tstclnt -p ${PORT} -h ${HOSTADDR} -f -d ${R_CLIENTDIR} -v \\" - echo " -2 -w nss -n TestUser${UNREVOKED_CERT_GRP_1}${ecsuffix}" + echo " -V ssl3: -w nss -n TestUser${UNREVOKED_CERT_GRP_1}${ecsuffix}" echo "Request:" echo "GET crl://${SERVERDIR}/root.crl_${grpBegin}-${grpEnd}${ecsuffix}" echo "" echo "RELOAD time $i" ${PROFTOOL} ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} -f \ - -d ${R_CLIENTDIR} -v -2 -w nss -n TestUser${UNREVOKED_CERT_GRP_1}${ecsuffix} \ + -d ${R_CLIENTDIR} -v -V ssl3: -w nss -n TestUser${UNREVOKED_CERT_GRP_1}${ecsuffix} \ >${OUTFILE_TMP} 2>&1 <<_EOF_REQUEST_ GET crl://${SERVERDIR}/root.crl_${grpBegin}-${grpEnd}${ecsuffix} diff --git a/mozilla/security/nss/tests/ssl/sslauth.txt b/mozilla/security/nss/tests/ssl/sslauth.txt index 16cf3be58ee..4ccc49f9fcc 100644 --- a/mozilla/security/nss/tests/ssl/sslauth.txt +++ b/mozilla/security/nss/tests/ssl/sslauth.txt @@ -14,24 +14,24 @@ noECC 254 -r_-r -w_nss_-n_none TLS Require client auth (client does not provide auth) noECC 254 -r_-r -w_bogus_-n_TestUser TLS Require client auth (bad password) noECC 0 -r_-r -w_nss_-n_TestUser_ TLS Require client auth (client auth) - noECC 0 -r -T_-w_nss_-n_none SSL3 Request don't require client auth (client does not provide auth) - noECC 0 -r -T_-n_TestUser_-w_bogus SSL3 Request don't require client auth (bad password) - noECC 0 -r -T_-n_TestUser_-w_nss SSL3 Request don't require client auth (client auth) - noECC 254 -r_-r -T_-w_nss_-n_none SSL3 Require client auth (client does not provide auth) - noECC 254 -r_-r -T_-n_TestUser_-w_bogus SSL3 Require client auth (bad password) - noECC 0 -r_-r -T_-n_TestUser_-w_nss SSL3 Require client auth (client auth) - noECC 0 -r_-r_-r -2_-w_nss_-n_none TLS Request don't require client auth on 2nd hs (client does not provide auth) - noECC 0 -r_-r_-r -2_-w_bogus_-n_TestUser TLS Request don't require client auth on 2nd hs (bad password) - noECC 0 -r_-r_-r -2_-w_nss_-n_TestUser TLS Request don't require client auth on 2nd hs (client auth) - noECC 1 -r_-r_-r_-r -2_-w_nss_-n_none TLS Require client auth on 2nd hs (client does not provide auth) - noECC 1 -r_-r_-r_-r -2_-w_bogus_-n_TestUser TLS Require client auth on 2nd hs (bad password) - noECC 0 -r_-r_-r_-r -2_-w_nss_-n_TestUser TLS Require client auth on 2nd hs (client auth) - noECC 0 -r_-r_-r -2_-T_-w_nss_-n_none SSL3 Request don't require client auth on 2nd hs (client does not provide auth) - noECC 0 -r_-r_-r -2_-T_-n_TestUser_-w_bogus SSL3 Request don't require client auth on 2nd hs (bad password) - noECC 0 -r_-r_-r -2_-T_-n_TestUser_-w_nss SSL3 Request don't require client auth on 2nd hs (client auth) - noECC 1 -r_-r_-r_-r -2_-T_-w_nss_-n_none SSL3 Require client auth on 2nd hs (client does not provide auth) - noECC 1 -r_-r_-r_-r -2_-T_-n_TestUser_-w_bogus SSL3 Require client auth on 2nd hs (bad password) - noECC 0 -r_-r_-r_-r -2_-T_-n_TestUser_-w_nss SSL3 Require client auth on 2nd hs (client auth) + noECC 0 -r -V_:ssl3_-w_nss_-n_none SSL3 Request don't require client auth (client does not provide auth) + noECC 0 -r -V_:ssl3_-n_TestUser_-w_bogus SSL3 Request don't require client auth (bad password) + noECC 0 -r -V_:ssl3_-n_TestUser_-w_nss SSL3 Request don't require client auth (client auth) + noECC 254 -r_-r -V_:ssl3_-w_nss_-n_none SSL3 Require client auth (client does not provide auth) + noECC 254 -r_-r -V_:ssl3_-n_TestUser_-w_bogus SSL3 Require client auth (bad password) + noECC 0 -r_-r -V_:ssl3_-n_TestUser_-w_nss SSL3 Require client auth (client auth) + noECC 0 -r_-r_-r -V_ssl3:_-w_nss_-n_none TLS Request don't require client auth on 2nd hs (client does not provide auth) + noECC 0 -r_-r_-r -V_ssl3:_-w_bogus_-n_TestUser TLS Request don't require client auth on 2nd hs (bad password) + noECC 0 -r_-r_-r -V_ssl3:_-w_nss_-n_TestUser TLS Request don't require client auth on 2nd hs (client auth) + noECC 1 -r_-r_-r_-r -V_ssl3:_-w_nss_-n_none TLS Require client auth on 2nd hs (client does not provide auth) + noECC 1 -r_-r_-r_-r -V_ssl3:_-w_bogus_-n_TestUser TLS Require client auth on 2nd hs (bad password) + noECC 0 -r_-r_-r_-r -V_ssl3:_-w_nss_-n_TestUser TLS Require client auth on 2nd hs (client auth) + noECC 0 -r_-r_-r -V_ssl3:ssl3_-w_nss_-n_none SSL3 Request don't require client auth on 2nd hs (client does not provide auth) + noECC 0 -r_-r_-r -V_ssl3:ssl3_-n_TestUser_-w_bogus SSL3 Request don't require client auth on 2nd hs (bad password) + noECC 0 -r_-r_-r -V_ssl3:ssl3_-n_TestUser_-w_nss SSL3 Request don't require client auth on 2nd hs (client auth) + noECC 1 -r_-r_-r_-r -V_ssl3:ssl3_-w_nss_-n_none SSL3 Require client auth on 2nd hs (client does not provide auth) + noECC 1 -r_-r_-r_-r -V_ssl3:ssl3_-n_TestUser_-w_bogus SSL3 Require client auth on 2nd hs (bad password) + noECC 0 -r_-r_-r_-r -V_ssl3:ssl3_-n_TestUser_-w_nss SSL3 Require client auth on 2nd hs (client auth) # # Use EC cert for client authentication # @@ -39,28 +39,28 @@ ECC 0 -r -w_nss_-n_TestUser-ec TLS Request don't require client auth (EC) (client auth) ECC 254 -r_-r -w_bogus_-n_TestUser-ec TLS Require client auth (EC) (bad password) ECC 0 -r_-r -w_nss_-n_TestUser-ec_ TLS Require client auth (EC) (client auth) - ECC 0 -r -T_-n_TestUser-ec_-w_bogus SSL3 Request don't require client auth (EC) (bad password) - ECC 0 -r -T_-n_TestUser-ec_-w_nss SSL3 Request don't require client auth (EC) (client auth) - ECC 254 -r_-r -T_-n_TestUser-ec_-w_bogus SSL3 Require client auth (EC) (bad password) - ECC 0 -r_-r -T_-n_TestUser-ec_-w_nss SSL3 Require client auth (EC) (client auth) - ECC 0 -r_-r_-r -2_-w_bogus_-n_TestUser-ec TLS Request don't require client auth on 2nd hs (EC) (bad password) - ECC 0 -r_-r_-r -2_-w_nss_-n_TestUser-ec TLS Request don't require client auth on 2nd hs (EC) (client auth) - ECC 1 -r_-r_-r_-r -2_-w_bogus_-n_TestUser-ec TLS Require client auth on 2nd hs (EC) (bad password) - ECC 0 -r_-r_-r_-r -2_-w_nss_-n_TestUser-ec_ TLS Require client auth on 2nd hs (EC) (client auth) - ECC 0 -r_-r_-r -2_-T_-n_TestUser-ec_-w_bogus SSL3 Request don't require client auth on 2nd hs (EC) (bad password) - ECC 0 -r_-r_-r -2_-T_-n_TestUser-ec_-w_nss SSL3 Request don't require client auth on 2nd hs (EC) (client auth) - ECC 1 -r_-r_-r_-r -2_-T_-n_TestUser-ec_-w_bogus SSL3 Require client auth on 2nd hs (EC) (bad password) - ECC 0 -r_-r_-r_-r -2_-T_-n_TestUser-ec_-w_nss SSL3 Require client auth on 2nd hs (EC) (client auth) + ECC 0 -r -V_:ssl3_-n_TestUser-ec_-w_bogus SSL3 Request don't require client auth (EC) (bad password) + ECC 0 -r -V_:ssl3_-n_TestUser-ec_-w_nss SSL3 Request don't require client auth (EC) (client auth) + ECC 254 -r_-r -V_:ssl3_-n_TestUser-ec_-w_bogus SSL3 Require client auth (EC) (bad password) + ECC 0 -r_-r -V_:ssl3_-n_TestUser-ec_-w_nss SSL3 Require client auth (EC) (client auth) + ECC 0 -r_-r_-r -V_ssl3:_-w_bogus_-n_TestUser-ec TLS Request don't require client auth on 2nd hs (EC) (bad password) + ECC 0 -r_-r_-r -V_ssl3:_-w_nss_-n_TestUser-ec TLS Request don't require client auth on 2nd hs (EC) (client auth) + ECC 1 -r_-r_-r_-r -V_ssl3:_-w_bogus_-n_TestUser-ec TLS Require client auth on 2nd hs (EC) (bad password) + ECC 0 -r_-r_-r_-r -V_ssl3:_-w_nss_-n_TestUser-ec_ TLS Require client auth on 2nd hs (EC) (client auth) + ECC 0 -r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_bogus SSL3 Request don't require client auth on 2nd hs (EC) (bad password) + ECC 0 -r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_nss SSL3 Request don't require client auth on 2nd hs (EC) (client auth) + ECC 1 -r_-r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_bogus SSL3 Require client auth on 2nd hs (EC) (bad password) + ECC 0 -r_-r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_nss SSL3 Require client auth on 2nd hs (EC) (client auth) # # SNI Tests # - SNI 0 -r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser TLS Server hello response without SNI - SNI 0 -r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser_-a_Host-sni.Dom TLS Server hello response with SNI - SNI 1 -r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser_-a_Host-sni1.Dom TLS Server response with alert - SNI 0 -r_-a_Host-sni.Dom -2_-T_-w_nss_-n_TestUser SSL3 Server hello response without SNI - SNI 1 -r_-a_Host-sni.Dom -2_-T_-w_nss_-n_TestUser_-a_Host-sni.Dom SSL3 Server hello response with SNI: SSL don't have SH extensions - SNI 0 -r_-r_-r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser TLS Server hello response without SNI - SNI 0 -r_-r_-r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser_-a_Host-sni.Dom TLS Server hello response with SNI - SNI 1 -r_-r_-r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser_-a_Host-sni.Dom_-a_Host.Dom TLS Server hello response with SNI: Change name on 2d HS - SNI 1 -r_-r_-r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser_-a_Host-sni.Dom_-a_Host-sni1.Dom TLS Server hello response with SNI: Change name to invalid 2d HS - SNI 1 -r_-r_-r_-a_Host-sni.Dom -2_-w_nss_-n_TestUser_-a_Host-sni1.Dom TLS Server response with alert + SNI 0 -r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser TLS Server hello response without SNI + SNI 0 -r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser_-a_Host-sni.Dom TLS Server hello response with SNI + SNI 1 -r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser_-a_Host-sni1.Dom TLS Server response with alert + SNI 0 -r_-a_Host-sni.Dom -V_ssl3:ssl3_-w_nss_-n_TestUser SSL3 Server hello response without SNI + SNI 1 -r_-a_Host-sni.Dom -V_ssl3:ssl3_-w_nss_-n_TestUser_-a_Host-sni.Dom SSL3 Server hello response with SNI: SSL don't have SH extensions + SNI 0 -r_-r_-r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser TLS Server hello response without SNI + SNI 0 -r_-r_-r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser_-a_Host-sni.Dom TLS Server hello response with SNI + SNI 1 -r_-r_-r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser_-a_Host-sni.Dom_-a_Host.Dom TLS Server hello response with SNI: Change name on 2d HS + SNI 1 -r_-r_-r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser_-a_Host-sni.Dom_-a_Host-sni1.Dom TLS Server hello response with SNI: Change name to invalid 2d HS + SNI 1 -r_-r_-r_-a_Host-sni.Dom -V_ssl3:_-w_nss_-n_TestUser_-a_Host-sni1.Dom TLS Server response with alert diff --git a/mozilla/security/nss/tests/ssl/sslstress.txt b/mozilla/security/nss/tests/ssl/sslstress.txt index ca8a618417b..855f89a3c2b 100644 --- a/mozilla/security/nss/tests/ssl/sslstress.txt +++ b/mozilla/security/nss/tests/ssl/sslstress.txt @@ -9,44 +9,44 @@ # ECC value params params # ------- ------ ------ ------ --------------- noECC 0 _ -c_1000_-C_A Stress SSL2 RC4 128 with MD5 - noECC 0 _ -c_1000_-C_c_-T Stress SSL3 RC4 128 with MD5 + noECC 0 _ -c_1000_-C_c_-V_:ssl3 Stress SSL3 RC4 128 with MD5 noECC 0 _ -c_1000_-C_c Stress TLS RC4 128 with MD5 noECC 0 _ -c_1000_-C_c_-g Stress TLS RC4 128 with MD5 (false start) - noECC 0 -u -2_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket) - noECC 0 -z -2_-c_1000_-C_c_-z Stress TLS RC4 128 with MD5 (compression) - noECC 0 -u_-z -2_-c_1000_-C_c_-u_-z Stress TLS RC4 128 with MD5 (session ticket, compression) - noECC 0 -u_-z -2_-c_1000_-C_c_-u_-z_-g Stress TLS RC4 128 with MD5 (session ticket, compression, false start) - SNI 0 -u_-a_Host-sni.Dom -2_-3_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket, SNI) + noECC 0 -u -V_ssl3:_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket) + noECC 0 -z -V_ssl3:_-c_1000_-C_c_-z Stress TLS RC4 128 with MD5 (compression) + noECC 0 -u_-z -V_ssl3:_-c_1000_-C_c_-u_-z Stress TLS RC4 128 with MD5 (session ticket, compression) + noECC 0 -u_-z -V_ssl3:_-c_1000_-C_c_-u_-z_-g Stress TLS RC4 128 with MD5 (session ticket, compression, false start) + SNI 0 -u_-a_Host-sni.Dom -V_tls1.0:_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket, SNI) # # add client auth versions here... # noECC 0 -r_-r -c_100_-C_A_-N_-n_TestUser Stress SSL2 RC4 128 with MD5 (no reuse, client auth) - noECC 0 -r_-r -c_100_-C_c_-T_-N_-n_TestUser Stress SSL3 RC4 128 with MD5 (no reuse, client auth) + noECC 0 -r_-r -c_100_-C_c_-V_:ssl3_-N_-n_TestUser Stress SSL3 RC4 128 with MD5 (no reuse, client auth) noECC 0 -r_-r -c_100_-C_c_-N_-n_TestUser Stress TLS RC4 128 with MD5 (no reuse, client auth) - noECC 0 -r_-r_-u -2_-c_100_-C_c_-n_TestUser_-u Stress TLS RC4 128 with MD5 (session ticket, client auth) - noECC 0 -r_-r_-z -2_-c_100_-C_c_-n_TestUser_-z Stress TLS RC4 128 with MD5 (compression, client auth) - noECC 0 -r_-r_-z -2_-c_100_-C_c_-n_TestUser_-z_-g Stress TLS RC4 128 with MD5 (compression, client auth, false start) - noECC 0 -r_-r_-u_-z -2_-c_100_-C_c_-n_TestUser_-u_-z Stress TLS RC4 128 with MD5 (session ticket, compression, client auth) - noECC 0 -r_-r_-u_-z -2_-c_100_-C_c_-n_TestUser_-u_-z_-g Stress TLS RC4 128 with MD5 (session ticket, compression, client auth, false start) - SNI 0 -r_-r_-u_-a_Host-sni.Dom -2_-3_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket, SNI, client auth, default virt host) - SNI 0 -r_-r_-u_-a_Host-sni.Dom_-k_Host-sni.Dom -2_-3_-c_1000_-C_c_-u_-a_Host-sni.Dom Stress TLS RC4 128 with MD5 (session ticket, SNI, client auth, change virt host) + noECC 0 -r_-r_-u -V_ssl3:_-c_100_-C_c_-n_TestUser_-u Stress TLS RC4 128 with MD5 (session ticket, client auth) + noECC 0 -r_-r_-z -V_ssl3:_-c_100_-C_c_-n_TestUser_-z Stress TLS RC4 128 with MD5 (compression, client auth) + noECC 0 -r_-r_-z -V_ssl3:_-c_100_-C_c_-n_TestUser_-z_-g Stress TLS RC4 128 with MD5 (compression, client auth, false start) + noECC 0 -r_-r_-u_-z -V_ssl3:_-c_100_-C_c_-n_TestUser_-u_-z Stress TLS RC4 128 with MD5 (session ticket, compression, client auth) + noECC 0 -r_-r_-u_-z -V_ssl3:_-c_100_-C_c_-n_TestUser_-u_-z_-g Stress TLS RC4 128 with MD5 (session ticket, compression, client auth, false start) + SNI 0 -r_-r_-u_-a_Host-sni.Dom -V_tls1.0:_-c_1000_-C_c_-u Stress TLS RC4 128 with MD5 (session ticket, SNI, client auth, default virt host) + SNI 0 -r_-r_-u_-a_Host-sni.Dom_-k_Host-sni.Dom -V_tls1.0:_-c_1000_-C_c_-u_-a_Host-sni.Dom Stress TLS RC4 128 with MD5 (session ticket, SNI, client auth, change virt host) # # ############################ ECC ciphers ############################ # - ECC 0 -c_:C009 -c_100_-C_:C009_-N_-T Stress SSL3 ECDHE-ECDSA AES 128 CBC with SHA (no reuse) - ECC 0 -c_:C013 -c_1000_-C_:C013_-T Stress SSL3 ECDHE-RSA AES 128 CBC with SHA - ECC 0 -c_:C004 -2_-c_100_-C_:C004_-N Stress TLS ECDH-ECDSA AES 128 CBC with SHA (no reuse) - ECC 0 -c_:C00E -2_-c_100_-C_:C00E_-N Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse) - ECC 0 -c_:C013 -2_-c_1000_-C_:C013 Stress TLS ECDHE-RSA AES 128 CBC with SHA - ECC 0 -c_:C004_-u -2_-c_1000_-C_:C004_-u Stress TLS ECDH-ECDSA AES 128 CBC with SHA (session ticket) + ECC 0 -c_:C009 -c_100_-C_:C009_-N_-V_:ssl3 Stress SSL3 ECDHE-ECDSA AES 128 CBC with SHA (no reuse) + ECC 0 -c_:C013 -c_1000_-C_:C013_-V_:ssl3 Stress SSL3 ECDHE-RSA AES 128 CBC with SHA + ECC 0 -c_:C004 -V_ssl3:_-c_100_-C_:C004_-N Stress TLS ECDH-ECDSA AES 128 CBC with SHA (no reuse) + ECC 0 -c_:C00E -V_ssl3:_-c_100_-C_:C00E_-N Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse) + ECC 0 -c_:C013 -V_ssl3:_-c_1000_-C_:C013 Stress TLS ECDHE-RSA AES 128 CBC with SHA + ECC 0 -c_:C004_-u -V_ssl3:_-c_1000_-C_:C004_-u Stress TLS ECDH-ECDSA AES 128 CBC with SHA (session ticket) # # add client auth versions here... # - ECC 0 -r_-r_-c_:C009 -c_10_-C_:C009_-N_-T_-n_TestUser-ec Stress SSL3 ECDHE-ECDSA AES 128 CBC with SHA (no reuse, client auth) - ECC 0 -r_-r_-c_:C013 -c_100_-C_:C013_-T_-n_TestUser-ec Stress SSL3 ECDHE-RSA AES 128 CBC with SHA (client auth) + ECC 0 -r_-r_-c_:C009 -c_10_-C_:C009_-N_-V_:ssl3_-n_TestUser-ec Stress SSL3 ECDHE-ECDSA AES 128 CBC with SHA (no reuse, client auth) + ECC 0 -r_-r_-c_:C013 -c_100_-C_:C013_-V_:ssl3_-n_TestUser-ec Stress SSL3 ECDHE-RSA AES 128 CBC with SHA (client auth) ECC 0 -r_-r_-c_:C004 -c_10_-C_:C004_-N_-n_TestUser-ec Stress TLS ECDH-ECDSA AES 128 CBC with SHA (no reuse, client auth) ECC 0 -r_-r_-c_:C00E -c_10_-C_:C00E_-N_-n_TestUser-ecmixed Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse, client auth) ECC 0 -r_-r_-c_:C013 -c_100_-C_:C013_-n_TestUser-ec Stress TLS ECDHE-RSA AES 128 CBC with SHA(client auth) - ECC 0 -r_-r_-c_:C013_-u -2_-c_100_-C_:C013_-n_TestUser-ec_-u Stress TLS ECDHE-RSA AES 128 CBC with SHA(session ticket, client auth) + ECC 0 -r_-r_-c_:C013_-u -V_ssl3:_-c_100_-C_:C013_-n_TestUser-ec_-u Stress TLS ECDHE-RSA AES 128 CBC with SHA(session ticket, client auth)