xref: /openbsd-src/regress/lib/libssl/ciphers/cipherstest.c (revision a75d20e9016c589fdb3065e4bed83101c6167e79)

/*
 * Copyright (c) 2015, 2020 Joel Sing <jsing@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include <openssl/evp.h>
#include <openssl/objects.h>
#include <openssl/ssl.h>

#include <err.h>
#include <stdio.h>
#include <string.h>

int ssl3_num_ciphers(void);
const SSL_CIPHER *ssl3_get_cipher_by_index(int idx);

int ssl_parse_ciphersuites(STACK_OF(SSL_CIPHER) **out_ciphers, const char *str);

static inline int
ssl_aes_is_accelerated(void)
{
	return (OPENSSL_cpu_caps() & CRYPTO_CPU_CAPS_ACCELERATED_AES) != 0;
}

static int
check_cipher_order(void)
{
	unsigned long id, prev_id = 0;
	const SSL_CIPHER *cipher;
	int num_ciphers;
	int i;

	num_ciphers = ssl3_num_ciphers();

	for (i = 0; i < num_ciphers; i++) {
		if ((cipher = ssl3_get_cipher_by_index(i)) == NULL) {
			fprintf(stderr, "FAIL: ssl3_get_cipher(%d) returned "
			    "NULL\n", i);
			return 1;
		}
		if ((id = SSL_CIPHER_get_id(cipher)) <= prev_id) {
			fprintf(stderr, "FAIL: ssl3_ciphers is not sorted by "
			    "id - cipher %d (%lx) <= cipher %d (%lx)\n",
			    i, id, i - 1, prev_id);
			return 1;
		}
		prev_id = id;
	}

	return 0;
}

struct ssl_cipher_test {
	uint16_t value;
	int auth_nid;
	int cipher_nid;
	int digest_nid;
	int handshake_digest_nid;
	int kx_nid;
	int strength_bits;
	int symmetric_bits;
	int is_aead;
};

static const struct ssl_cipher_test ssl_cipher_tests[] = {
	{
		.value = 0x0004,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_rc4,
		.digest_nid = NID_md5,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_rsa,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x0005,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_rc4,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_rsa,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x000a,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_des_ede3_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_rsa,
		.strength_bits = 112,
		.symmetric_bits = 168,
	},
	{
		.value = 0x0016,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_des_ede3_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 112,
		.symmetric_bits = 168,
	},
	{
		.value = 0x0018,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_rc4,
		.digest_nid = NID_md5,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x001b,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_des_ede3_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 112,
		.symmetric_bits = 168,
	},
	{
		.value = 0x002f,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_128_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_rsa,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x0033,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_128_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x0034,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_aes_128_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x0035,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_256_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_rsa,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0x0039,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_256_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0x003a,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_aes_256_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0x003c,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_128_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_rsa,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x003d,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_256_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_rsa,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0x0041,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_camellia_128_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_rsa,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x0045,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_camellia_128_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x0046,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_camellia_128_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x0067,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_128_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x006b,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_256_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0x006c,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_aes_128_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x006d,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_aes_256_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0x0084,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_camellia_256_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_rsa,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0x0088,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_camellia_256_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0x0089,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_camellia_256_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0x009c,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_128_gcm,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_rsa,
		.strength_bits = 128,
		.symmetric_bits = 128,
		.is_aead = 1,
	},
	{
		.value = 0x009d,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_256_gcm,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha384,
		.kx_nid = NID_kx_rsa,
		.strength_bits = 256,
		.symmetric_bits = 256,
		.is_aead = 1,
	},
	{
		.value = 0x009e,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_128_gcm,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
		.is_aead = 1,
	},
	{
		.value = 0x009f,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_256_gcm,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha384,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
		.is_aead = 1,
	},
	{
		.value = 0x00a6,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_aes_128_gcm,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
		.is_aead = 1,
	},
	{
		.value = 0x00a7,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_aes_256_gcm,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha384,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
		.is_aead = 1,
	},
	{
		.value = 0x00ba,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_camellia_128_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_rsa,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x00be,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_camellia_128_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x00bf,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_camellia_128_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0x00c0,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_camellia_256_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_rsa,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0x00c4,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_camellia_256_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0x00c5,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_camellia_256_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0x1301,
		.auth_nid = NID_undef,
		.cipher_nid = NID_aes_128_gcm,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_undef,
		.strength_bits = 128,
		.symmetric_bits = 128,
		.is_aead = 1,
	},
	{
		.value = 0x1302,
		.auth_nid = NID_undef,
		.cipher_nid = NID_aes_256_gcm,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha384,
		.kx_nid = NID_undef,
		.strength_bits = 256,
		.symmetric_bits = 256,
		.is_aead = 1,
	},
	{
		.value = 0x1303,
		.auth_nid = NID_undef,
		.cipher_nid = NID_chacha20_poly1305,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_undef,
		.strength_bits = 256,
		.symmetric_bits = 256,
		.is_aead = 1,
	},
	{
		.value = 0xc007,
		.auth_nid = NID_auth_ecdsa,
		.cipher_nid = NID_rc4,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0xc008,
		.auth_nid = NID_auth_ecdsa,
		.cipher_nid = NID_des_ede3_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 112,
		.symmetric_bits = 168,
	},
	{
		.value = 0xc009,
		.auth_nid = NID_auth_ecdsa,
		.cipher_nid = NID_aes_128_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0xc00a,
		.auth_nid = NID_auth_ecdsa,
		.cipher_nid = NID_aes_256_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0xc011,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_rc4,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0xc012,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_des_ede3_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 112,
		.symmetric_bits = 168,
	},
	{
		.value = 0xc013,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_128_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0xc014,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_256_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0xc016,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_rc4,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0xc017,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_des_ede3_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 112,
		.symmetric_bits = 168,
	},
	{
		.value = 0xc018,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_aes_128_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0xc019,
		.auth_nid = NID_auth_null,
		.cipher_nid = NID_aes_256_cbc,
		.digest_nid = NID_sha1,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0xc023,
		.auth_nid = NID_auth_ecdsa,
		.cipher_nid = NID_aes_128_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0xc024,
		.auth_nid = NID_auth_ecdsa,
		.cipher_nid = NID_aes_256_cbc,
		.digest_nid = NID_sha384,
		.handshake_digest_nid = NID_sha384,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0xc027,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_128_cbc,
		.digest_nid = NID_sha256,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
	},
	{
		.value = 0xc028,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_256_cbc,
		.digest_nid = NID_sha384,
		.handshake_digest_nid = NID_sha384,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
	},
	{
		.value = 0xc02b,
		.auth_nid = NID_auth_ecdsa,
		.cipher_nid = NID_aes_128_gcm,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
		.is_aead = 1,
	},
	{
		.value = 0xc02c,
		.auth_nid = NID_auth_ecdsa,
		.cipher_nid = NID_aes_256_gcm,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha384,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
		.is_aead = 1,
	},
	{
		.value = 0xc02f,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_128_gcm,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 128,
		.symmetric_bits = 128,
		.is_aead = 1,
	},
	{
		.value = 0xc030,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_aes_256_gcm,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha384,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
		.is_aead = 1,
	},
	{
		.value = 0xcca8,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_chacha20_poly1305,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
		.is_aead = 1,
	},
	{
		.value = 0xcca9,
		.auth_nid = NID_auth_ecdsa,
		.cipher_nid = NID_chacha20_poly1305,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_ecdhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
		.is_aead = 1,
	},
	{
		.value = 0xccaa,
		.auth_nid = NID_auth_rsa,
		.cipher_nid = NID_chacha20_poly1305,
		.digest_nid = NID_undef,
		.handshake_digest_nid = NID_sha256,
		.kx_nid = NID_kx_dhe,
		.strength_bits = 256,
		.symmetric_bits = 256,
		.is_aead = 1,
	},
};

#define N_SSL_CIPHER_TESTS (sizeof(ssl_cipher_tests) / sizeof(ssl_cipher_tests[0]))

static int
test_ssl_ciphers(void)
{
	int i, strength_bits, symmetric_bits;
	const struct ssl_cipher_test *sct;
	STACK_OF(SSL_CIPHER) *ciphers;
	const SSL_CIPHER *cipher;
	const EVP_MD *digest;
	unsigned char buf[2];
	const char *description;
	char desc_buf[256];
	SSL_CTX *ssl_ctx = NULL;
	SSL *ssl = NULL;
	size_t j;
	int ret = 1;

	if ((ssl_ctx = SSL_CTX_new(TLS_method())) == NULL) {
		fprintf(stderr, "SSL_CTX_new() returned NULL\n");
		goto failure;
	}
	if ((ssl = SSL_new(ssl_ctx)) == NULL) {
		fprintf(stderr, "SSL_new() returned NULL\n");
		goto failure;
	}
	if (!SSL_set_cipher_list(ssl, "ALL")) {
		fprintf(stderr, "SSL_set_cipher_list failed\n");
		goto failure;
	}

	if ((ciphers = SSL_get_ciphers(ssl)) == NULL) {
		fprintf(stderr, "no ciphers\n");
		goto failure;
	}

	if (sk_SSL_CIPHER_num(ciphers) != N_SSL_CIPHER_TESTS) {
		fprintf(stderr, "number of ciphers mismatch (%d != %zu)\n",
		    sk_SSL_CIPHER_num(ciphers), N_SSL_CIPHER_TESTS);
		goto failure;
	}

	for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
		uint16_t cipher_value;

		cipher = sk_SSL_CIPHER_value(ciphers, i);
		cipher_value = SSL_CIPHER_get_value(cipher);

		buf[0] = cipher_value >> 8;
		buf[1] = cipher_value & 0xff;

		if ((cipher = SSL_CIPHER_find(ssl, buf)) == NULL) {
			fprintf(stderr, "SSL_CIPHER_find() returned NULL for %s\n",
			    SSL_CIPHER_get_name(cipher));
			goto failure;
		}
		if (SSL_CIPHER_get_value(cipher) != cipher_value) {
			fprintf(stderr, "got cipher with value 0x%04x, want 0x%04x\n",
			    SSL_CIPHER_get_value(cipher), cipher_value);
			goto failure;
		}
		if (SSL_CIPHER_get_id(cipher) != (0x03000000UL | cipher_value)) {
			fprintf(stderr, "got cipher id 0x%08lx, want 0x%08lx\n",
			    SSL_CIPHER_get_id(cipher), (0x03000000UL | cipher_value));
			goto failure;
		}

		sct = NULL;
		for (j = 0; j < N_SSL_CIPHER_TESTS; j++) {
			if (ssl_cipher_tests[j].value == cipher_value) {
				sct = &ssl_cipher_tests[j];
				break;
			}
		}
		if (sct == NULL) {
			fprintf(stderr, "cipher '%s' (0x%04x) not found in test "
			    "table\n", SSL_CIPHER_get_name(cipher), cipher_value);
			goto failure;
		}

		if (SSL_CIPHER_get_auth_nid(cipher) != sct->auth_nid) {
			fprintf(stderr, "cipher '%s' (0x%04x) - got auth nid %d, "
			    "want %d\n", SSL_CIPHER_get_name(cipher), cipher_value,
			    SSL_CIPHER_get_auth_nid(cipher), sct->auth_nid);
			goto failure;
		}
		if (SSL_CIPHER_get_cipher_nid(cipher) != sct->cipher_nid) {
			fprintf(stderr, "cipher '%s' (0x%04x) - got cipher nid %d, "
			    "want %d\n", SSL_CIPHER_get_name(cipher), cipher_value,
			    SSL_CIPHER_get_cipher_nid(cipher), sct->cipher_nid);
			goto failure;
		}
		if (SSL_CIPHER_get_digest_nid(cipher) != sct->digest_nid) {
			fprintf(stderr, "cipher '%s' (0x%04x) - got digest nid %d, "
			    "want %d\n", SSL_CIPHER_get_name(cipher), cipher_value,
			    SSL_CIPHER_get_digest_nid(cipher), sct->digest_nid);
			goto failure;
		}
		if (SSL_CIPHER_get_kx_nid(cipher) != sct->kx_nid) {
			fprintf(stderr, "cipher '%s' (0x%04x) - got kx nid %d, "
			    "want %d\n", SSL_CIPHER_get_name(cipher), cipher_value,
			    SSL_CIPHER_get_kx_nid(cipher), sct->kx_nid);
			goto failure;
		}

		/* Having API consistency is a wonderful thing... */
		digest = SSL_CIPHER_get_handshake_digest(cipher);
		if (EVP_MD_nid(digest) != sct->handshake_digest_nid) {
			fprintf(stderr, "cipher '%s' (0x%04x) - got handshake "
			    "digest nid %d, want %d\n", SSL_CIPHER_get_name(cipher),
			    cipher_value, EVP_MD_nid(digest), sct->handshake_digest_nid);
			goto failure;
		}

		strength_bits = SSL_CIPHER_get_bits(cipher, &symmetric_bits);
		if (strength_bits != sct->strength_bits) {
			fprintf(stderr, "cipher '%s' (0x%04x) - got strength bits "
			    "%d, want %d\n", SSL_CIPHER_get_name(cipher),
			    cipher_value, strength_bits, sct->strength_bits);
			goto failure;
		}
		if (symmetric_bits != sct->symmetric_bits) {
			fprintf(stderr, "cipher '%s' (0x%04x) - got symmetric bits "
			    "%d, want %d\n", SSL_CIPHER_get_name(cipher),
			    cipher_value, symmetric_bits, sct->symmetric_bits);
			goto failure;
		}
		if (SSL_CIPHER_is_aead(cipher) != sct->is_aead) {
			fprintf(stderr, "cipher '%s' (0x%04x) - got is aead %d, "
			    "want %d\n", SSL_CIPHER_get_name(cipher), cipher_value,
			    SSL_CIPHER_is_aead(cipher), sct->is_aead);
			goto failure;
		}

		if ((description = SSL_CIPHER_description(cipher, desc_buf,
		    sizeof(desc_buf))) != desc_buf) {
			fprintf(stderr, "cipher '%s' (0x%04x) - failed to get "
			    "description\n", SSL_CIPHER_get_name(cipher), cipher_value);
			goto failure;
		}
	}

	ret = 0;

 failure:
	SSL_CTX_free(ssl_ctx);
	SSL_free(ssl);

	return (ret);
}

struct parse_ciphersuites_test {
	const char *str;
	const int want;
	const unsigned long cids[32];
};

struct parse_ciphersuites_test parse_ciphersuites_tests[] = {
	{
		/* LibreSSL names. */
		.str = "AEAD-AES256-GCM-SHA384:AEAD-CHACHA20-POLY1305-SHA256:AEAD-AES128-GCM-SHA256",
		.want = 1,
		.cids = {
			TLS1_3_CK_AES_256_GCM_SHA384,
			TLS1_3_CK_CHACHA20_POLY1305_SHA256,
			TLS1_3_CK_AES_128_GCM_SHA256,
		},
	},
	{
		/* OpenSSL names. */
		.str = "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256",
		.want = 1,
		.cids = {
			TLS1_3_CK_AES_256_GCM_SHA384,
			TLS1_3_CK_CHACHA20_POLY1305_SHA256,
			TLS1_3_CK_AES_128_GCM_SHA256,
		},
	},
	{
		/* Different priority order. */
		.str = "AEAD-AES128-GCM-SHA256:AEAD-AES256-GCM-SHA384:AEAD-CHACHA20-POLY1305-SHA256",
		.want = 1,
		.cids = {
			TLS1_3_CK_AES_128_GCM_SHA256,
			TLS1_3_CK_AES_256_GCM_SHA384,
			TLS1_3_CK_CHACHA20_POLY1305_SHA256,
		},
	},
	{
		/* Known but unsupported names. */
		.str = "AEAD-AES256-GCM-SHA384:AEAD-AES128-CCM-SHA256:AEAD-AES128-CCM-8-SHA256",
		.want = 1,
		.cids = {
			TLS1_3_CK_AES_256_GCM_SHA384,
		},
	},
	{
		/* Empty string means no TLSv1.3 ciphersuites. */
		.str = "",
		.want = 1,
		.cids = { 0 },
	},
	{
		.str = "TLS_CHACHA20_POLY1305_SHA256:TLS_NOT_A_CIPHERSUITE",
		.want = 0,
	},
	{
		.str = "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_GCM_SHA256",
		.want = 0,
	},
};

#define N_PARSE_CIPHERSUITES_TESTS \
    (sizeof(parse_ciphersuites_tests) / sizeof(*parse_ciphersuites_tests))

static int
parse_ciphersuites_test(void)
{
	struct parse_ciphersuites_test *pct;
	STACK_OF(SSL_CIPHER) *ciphers = NULL;
	SSL_CIPHER *cipher;
	int failed = 1;
	int j, ret;
	size_t i;

	for (i = 0; i < N_PARSE_CIPHERSUITES_TESTS; i++) {
		pct = &parse_ciphersuites_tests[i];

		ret = ssl_parse_ciphersuites(&ciphers, pct->str);
		if (ret != pct->want) {
			fprintf(stderr, "FAIL: test %zu - "
			    "ssl_parse_ciphersuites returned %d, want %d\n",
			    i, ret, pct->want);
			goto failed;
		}
		if (ret == 0)
			continue;

		for (j = 0; j < sk_SSL_CIPHER_num(ciphers); j++) {
			cipher = sk_SSL_CIPHER_value(ciphers, j);
			if (SSL_CIPHER_get_id(cipher) == pct->cids[j])
				continue;
			fprintf(stderr, "FAIL: test %zu - got cipher %d with "
			    "id %lx, want %lx\n", i, j,
			    SSL_CIPHER_get_id(cipher), pct->cids[j]);
			goto failed;
		}
		if (pct->cids[j] != 0) {
			fprintf(stderr, "FAIL: test %zu - got %d ciphers, "
			    "expected more", i, sk_SSL_CIPHER_num(ciphers));
			goto failed;
		}
	}

	failed = 0;

 failed:
	sk_SSL_CIPHER_free(ciphers);

	return failed;
}

struct cipher_set_test {
	int ctx_ciphersuites_first;
	const char *ctx_ciphersuites;
	const char *ctx_rulestr;
	int ssl_ciphersuites_first;
	const char *ssl_ciphersuites;
	const char *ssl_rulestr;
	int cids_aes_accel_fixup;
	unsigned long cids[32];
};

struct cipher_set_test cipher_set_tests[] = {
	{
		.ctx_rulestr = "TLSv1.2+ECDHE+AEAD+AES",
		.cids_aes_accel_fixup = 1,
		.cids = {
			TLS1_3_CK_AES_256_GCM_SHA384,
			TLS1_3_CK_CHACHA20_POLY1305_SHA256,
			TLS1_3_CK_AES_128_GCM_SHA256,
			TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
		},
	},
	{
		.ssl_rulestr = "TLSv1.2+ECDHE+AEAD+AES",
		.cids_aes_accel_fixup = 1,
		.cids = {
			TLS1_3_CK_AES_256_GCM_SHA384,
			TLS1_3_CK_CHACHA20_POLY1305_SHA256,
			TLS1_3_CK_AES_128_GCM_SHA256,
			TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
		},
	},
	{
		.ctx_ciphersuites_first = 1,
		.ctx_ciphersuites = "AEAD-AES256-GCM-SHA384:AEAD-CHACHA20-POLY1305-SHA256",
		.ctx_rulestr = "TLSv1.2+ECDHE+AEAD+AES",
		.cids = {
			TLS1_3_CK_AES_256_GCM_SHA384,
			TLS1_3_CK_CHACHA20_POLY1305_SHA256,
			TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
		},
	},
	{
		.ssl_ciphersuites_first = 1,
		.ssl_ciphersuites = "AEAD-AES256-GCM-SHA384:AEAD-CHACHA20-POLY1305-SHA256",
		.ssl_rulestr = "TLSv1.2+ECDHE+AEAD+AES",
		.cids = {
			TLS1_3_CK_AES_256_GCM_SHA384,
			TLS1_3_CK_CHACHA20_POLY1305_SHA256,
			TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
		},
	},
	{
		.ctx_ciphersuites_first = 0,
		.ctx_ciphersuites = "AEAD-AES256-GCM-SHA384:AEAD-CHACHA20-POLY1305-SHA256",
		.ctx_rulestr = "TLSv1.2+ECDHE+AEAD+AES",
		.cids = {
			TLS1_3_CK_AES_256_GCM_SHA384,
			TLS1_3_CK_CHACHA20_POLY1305_SHA256,
			TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
		},
	},
	{
		.ssl_ciphersuites_first = 0,
		.ssl_ciphersuites = "AEAD-AES256-GCM-SHA384:AEAD-CHACHA20-POLY1305-SHA256",
		.ssl_rulestr = "TLSv1.2+ECDHE+AEAD+AES",
		.cids = {
			TLS1_3_CK_AES_256_GCM_SHA384,
			TLS1_3_CK_CHACHA20_POLY1305_SHA256,
			TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
		},
	},
	{
		.ssl_ciphersuites_first = 1,
		.ssl_ciphersuites = "",
		.ssl_rulestr = "TLSv1.2+ECDHE+AEAD+AES",
		.cids = {
			TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
		},
	},
	{
		.ssl_ciphersuites_first = 0,
		.ssl_ciphersuites = "",
		.ssl_rulestr = "TLSv1.2+ECDHE+AEAD+AES",
		.cids = {
			TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
		},
	},
	{
		.ctx_ciphersuites = "AEAD-AES256-GCM-SHA384:AEAD-CHACHA20-POLY1305-SHA256",
		.ssl_rulestr = "TLSv1.2+ECDHE+AEAD+AES",
		.cids = {
			TLS1_3_CK_AES_256_GCM_SHA384,
			TLS1_3_CK_CHACHA20_POLY1305_SHA256,
			TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
		},
	},
	{
		.ctx_rulestr = "TLSv1.2+ECDHE+AEAD+AES",
		.ssl_ciphersuites = "AEAD-AES256-GCM-SHA384:AEAD-CHACHA20-POLY1305-SHA256",
		.cids = {
			TLS1_3_CK_AES_256_GCM_SHA384,
			TLS1_3_CK_CHACHA20_POLY1305_SHA256,
			TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
			TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
		},
	},
};

#define N_CIPHER_SET_TESTS \
    (sizeof(cipher_set_tests) / sizeof(*cipher_set_tests))

static int
cipher_set_test(void)
{
	struct cipher_set_test *cst;
	STACK_OF(SSL_CIPHER) *ciphers = NULL;
	SSL_CIPHER *cipher;
	SSL_CTX *ctx = NULL;
	SSL *ssl = NULL;
	int failed = 0;
	size_t i;
	int j;

	for (i = 0; i < N_CIPHER_SET_TESTS; i++) {
		cst = &cipher_set_tests[i];

		if (!ssl_aes_is_accelerated() && cst->cids_aes_accel_fixup) {
			cst->cids[0] = TLS1_3_CK_CHACHA20_POLY1305_SHA256;
			cst->cids[1] = TLS1_3_CK_AES_256_GCM_SHA384;
		}

		if ((ctx = SSL_CTX_new(TLS_method())) == NULL)
			errx(1, "SSL_CTX_new");

		if (cst->ctx_ciphersuites_first && cst->ctx_ciphersuites != NULL) {
			if (!SSL_CTX_set_ciphersuites(ctx, cst->ctx_ciphersuites))
				errx(1, "SSL_CTX_set_ciphersuites");
		}
		if (cst->ctx_rulestr != NULL) {
			if (!SSL_CTX_set_cipher_list(ctx, cst->ctx_rulestr))
				errx(1, "SSL_CTX_set_cipher_list");
		}
		if (!cst->ctx_ciphersuites_first && cst->ctx_ciphersuites != NULL) {
			if (!SSL_CTX_set_ciphersuites(ctx, cst->ctx_ciphersuites))
				errx(1, "SSL_CTX_set_ciphersuites");
		}

		/* XXX - check SSL_CTX_get_ciphers(ctx) */

		if ((ssl = SSL_new(ctx)) == NULL)
			errx(1, "SSL_new");

		if (cst->ssl_ciphersuites_first && cst->ssl_ciphersuites != NULL) {
			if (!SSL_set_ciphersuites(ssl, cst->ssl_ciphersuites))
				errx(1, "SSL_set_ciphersuites");
		}
		if (cst->ssl_rulestr != NULL) {
			if (!SSL_set_cipher_list(ssl, cst->ssl_rulestr))
				errx(1, "SSL_set_cipher_list");
		}
		if (!cst->ssl_ciphersuites_first && cst->ssl_ciphersuites != NULL) {
			if (!SSL_set_ciphersuites(ssl, cst->ssl_ciphersuites))
				errx(1, "SSL_set_ciphersuites");
		}

		ciphers = SSL_get_ciphers(ssl);

		for (j = 0; j < sk_SSL_CIPHER_num(ciphers); j++) {
			cipher = sk_SSL_CIPHER_value(ciphers, j);
			if (SSL_CIPHER_get_id(cipher) == cst->cids[j])
				continue;
			fprintf(stderr, "FAIL: test %zu - got cipher %d with "
			    "id %lx, want %lx\n", i, j,
			    SSL_CIPHER_get_id(cipher), cst->cids[j]);
			failed |= 1;
		}
		if (cst->cids[j] != 0) {
			fprintf(stderr, "FAIL: test %zu - got %d ciphers, "
			    "expected more", i, sk_SSL_CIPHER_num(ciphers));
			failed |= 1;
		}

		SSL_CTX_free(ctx);
		SSL_free(ssl);
	}

	return failed;
}

int
main(int argc, char **argv)
{
	int failed = 0;

	failed |= check_cipher_order();

	failed |= test_ssl_ciphers();

	failed |= parse_ciphersuites_test();
	failed |= cipher_set_test();

	return (failed);
}