summaryrefslogtreecommitdiff
path: root/src/regress/lib/libssl/interop/cipher/Makefile
diff options
context:
space:
mode:
Diffstat (limited to 'src/regress/lib/libssl/interop/cipher/Makefile')
-rw-r--r--src/regress/lib/libssl/interop/cipher/Makefile172
1 files changed, 0 insertions, 172 deletions
diff --git a/src/regress/lib/libssl/interop/cipher/Makefile b/src/regress/lib/libssl/interop/cipher/Makefile
deleted file mode 100644
index 85d927a92d..0000000000
--- a/src/regress/lib/libssl/interop/cipher/Makefile
+++ /dev/null
@@ -1,172 +0,0 @@
1# $OpenBSD: Makefile,v 1.12 2023/04/19 15:34:23 tb Exp $
2
3# Connect a client to a server. Both can be current libressl, or
4# openssl 1.1 or 3.0. Create lists of supported ciphers
5# and pin client and server to one of the ciphers. Use server
6# certificate with compatible type. Check that client and server
7# have used correct cipher by grepping in their session print out.
8
9run-cipher-GOST2001-GOST89-GOST89-client-libressl-server-libressl \
10run-cipher-GOST2012256-GOST89-GOST89-client-libressl-server-libressl \
11client-cipher-GOST2012256-GOST89-GOST89-client-libressl-server-libressl.out \
12client-cipher-GOST2001-GOST89-GOST89-client-libressl-server-libressl.out \
13server-cipher-GOST2001-GOST89-GOST89-client-libressl-server-libressl.out \
14server-cipher-GOST2012256-GOST89-GOST89-client-libressl-server-libressl.out \
15check-cipher-GOST2001-GOST89-GOST89-client-libressl-server-libressl \
16check-cipher-GOST2012256-GOST89-GOST89-client-libressl-server-libressl:
17 # gost does not work with libressl TLS 1.3 right now
18 @echo DISABLED
19
20LIBRARIES = libressl
21.if exists(/usr/local/bin/eopenssl11)
22LIBRARIES += openssl11
23.endif
24.if exists(/usr/local/bin/eopenssl30)
25LIBRARIES += openssl30
26.endif
27
28CLEANFILES = *.tmp *.ciphers ciphers.mk
29
30.for clib in ${LIBRARIES}
31client-${clib}.ciphers:
32 LD_LIBRARY_PATH=/usr/local/lib/e${clib} \
33 ../${clib}/client -l ALL -L >$@.tmp
34 sed -n 's/^cipher //p' <$@.tmp | sort -u >$@
35 rm $@.tmp
36.endfor
37.for slib in ${LIBRARIES}
38server-${slib}.ciphers: 127.0.0.1.crt dsa.crt ec.crt rsa.crt
39 LD_LIBRARY_PATH=/usr/local/lib/e${slib} \
40 ../${slib}/server -l ALL -L >$@.tmp
41 sed -n 's/^cipher //p' <$@.tmp | sort -u >$@
42 rm $@.tmp
43.endfor
44
45.for clib in ${LIBRARIES}
46.for slib in ${LIBRARIES}
47ciphers.mk: client-${clib}-server-${slib}.ciphers
48client-${clib}-server-${slib}.ciphers: \
49 client-${clib}.ciphers server-${slib}.ciphers client-libressl.ciphers
50 # get ciphers shared between client and server
51 sort client-${clib}.ciphers server-${slib}.ciphers >$@.tmp
52 uniq -d <$@.tmp >$@
53 # we are only interested in ciphers supported by libressl
54 sort $@ client-libressl.ciphers >$@.tmp
55. if "${clib}" == "openssl11" || "${slib}" == "openssl11" || \
56 "${clib}" == "openssl30" || "${slib}" == "openssl30"
57 # OpenSSL's SSL_CTX_set_cipher_list doesn't accept TLSv1.3 ciphers
58 sed -i '/^TLS_/d' $@.tmp
59. endif
60 uniq -d <$@.tmp >$@
61 rm $@.tmp
62.endfor
63.endfor
64
65ciphers.mk:
66 rm -f $@ $@.tmp
67.for clib in ${LIBRARIES}
68.for slib in ${LIBRARIES}
69 echo 'CIPHERS_${clib}_${slib} =' >>$@.tmp \
70 `cat client-${clib}-server-${slib}.ciphers`
71.endfor
72.endfor
73 mv $@.tmp $@
74
75# hack to convert generated lists into usable make variables
76.if exists(ciphers.mk)
77.include "ciphers.mk"
78.else
79regress: ciphers.mk
80 ${MAKE} -C ${.CURDIR} regress
81.endif
82
83LEVEL_libressl =
84LEVEL_openssl11 = ,@SECLEVEL=0
85LEVEL_openssl30 = ,@SECLEVEL=0
86
87.for clib in ${LIBRARIES}
88.for slib in ${LIBRARIES}
89.for cipher in ${CIPHERS_${clib}_${slib}}
90
91.if "${cipher:M*-DSS-*}" != ""
92TYPE_${cipher} = dsa
93.elif "${cipher:M*-ECDSA-*}" != ""
94TYPE_${cipher} = ec
95.elif "${cipher:M*-GOST89-*}" != ""
96TYPE_${cipher} = gost
97.elif "${cipher:M*-RSA-*}" != ""
98TYPE_${cipher} = rsa
99.else
100TYPE_${cipher} = 127.0.0.1
101.endif
102
103DHPARAM_${cipher}_${slib} =
104
105.if ("${clib}" == "libressl" || "${slib}" == "libressl")
106REGRESS_TARGETS += run-cipher-${cipher}-client-${clib}-server-${slib}
107.else
108# Don't use REGRESS_SLOW_TARGETS since its handling in bsd.regress.mk is slow.
109SLOW_TARGETS += run-cipher-${cipher}-client-${clib}-server-${slib}
110.endif
111run-cipher-${cipher}-client-${clib}-server-${slib} \
112client-cipher-${cipher}-client-${clib}-server-${slib}.out \
113server-cipher-${cipher}-client-${clib}-server-${slib}.out: dh.param \
114 127.0.0.1.crt ${TYPE_${cipher}}.crt ../${clib}/client ../${slib}/server
115 LD_LIBRARY_PATH=/usr/local/lib/e${slib} \
116 ../${slib}/server >${@:S/^run/server/}.out \
117 -c ${TYPE_${cipher}}.crt -k ${TYPE_${cipher}}.key \
118 -l ${cipher}${LEVEL_${slib}} ${DHPARAM_${cipher}_${slib}} \
119 127.0.0.1 0
120 LD_LIBRARY_PATH=/usr/local/lib/e${clib} \
121 ../${clib}/client >${@:S/^run/client/}.out \
122 -l ${cipher}${LEVEL_${clib}} \
123 `sed -n 's/listen sock: //p' ${@:S/^run/server/}.out`
124 grep -q '^success$$' ${@:S/^run/server/}.out || \
125 { sleep 1; grep -q '^success$$' ${@:S/^run/server/}.out; }
126 grep -q '^success$$' ${@:S/^run/client/}.out
127
128.if ("${clib}" == "libressl" || "${slib}" == "libressl")
129REGRESS_TARGETS += check-cipher-${cipher}-client-${clib}-server-${slib}
130.else
131# Don't use REGRESS_SLOW_TARGETS since its handling in bsd.regress.mk is slow.
132SLOW_TARGETS += check-cipher-${cipher}-client-${clib}-server-${slib}
133.endif
134check-cipher-${cipher}-client-${clib}-server-${slib}: \
135 client-cipher-${cipher}-client-${clib}-server-${slib}.out \
136 server-cipher-${cipher}-client-${clib}-server-${slib}.out
137.if "${cipher:C/TLS_(AES.*_GCM|CHACHA.*_POLY.*)_SHA.*/TLS1_3/}" != TLS1_3
138 # client and server 1.3 capable, not TLS 1.3 cipher
139. if "${clib}" == "libressl"
140 # libressl client may prefer chacha-poly if aes-ni is not supported
141 egrep -q ' Cipher *: TLS_(AES_256_GCM_SHA384|CHACHA20_POLY1305_SHA256)$$' ${@:S/^check/client/}.out
142. else
143 # openssl 1.1 generic client cipher
144 grep -q ' Cipher *: TLS_AES_256_GCM_SHA384$$' ${@:S/^check/client/}.out
145. endif
146. if "${clib}" == "libressl"
147 # libressl client may prefer chacha-poly if aes-ni is not supported
148. if "${slib}" == "openssl11" || "${slib}" == "openssl30"
149 egrep -q ' Cipher *: TLS_(AES_256_GCM_SHA384|CHACHA20_POLY1305_SHA256)$$' ${@:S/^check/server/}.out
150. else
151 egrep -q ' Cipher *: TLS_(AES_256_GCM_SHA384|CHACHA20_POLY1305_SHA256)$$' ${@:S/^check/server/}.out
152. endif
153. else
154 # generic server cipher
155 grep -q ' Cipher *: TLS_AES_256_GCM_SHA384$$' ${@:S/^check/server/}.out
156. endif
157.else
158 grep -q ' Cipher *: ${cipher}$$' ${@:S/^check/client/}.out
159 grep -q ' Cipher *: ${cipher}$$' ${@:S/^check/server/}.out
160.endif
161
162.endfor
163.endfor
164.endfor
165
166.include <bsd.own.mk>
167REGRESS_SKIP_SLOW ?= no
168.if ${REGRESS_SKIP_SLOW:L} != "yes"
169REGRESS_TARGETS += ${SLOW_TARGETS}
170.endif
171
172.include <bsd.regress.mk>
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-02-09 17:40:36 +0000