Merge branch 'ingela/ssl/continue-test-restructure' into maint

* ingela/ssl/continue-test-restructure:
  ssl: Move alert test to own suite
  ssl: Move der_input and rizzo tests

1 files changed, 9 insertions, 460 deletions

diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 3fd88183ea..542876a1b7 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -49,7 +49,6 @@
 all() -> 
     [
      {group, basic},
-     {group, basic_tls},
      {group, options},
      {group, options_tls},
      {group, 'dtlsv1.2'},
@@ -63,39 +62,31 @@ all() ->
 
 groups() ->
     [{basic, [], basic_tests()},
-     {basic_tls, [], basic_tests_tls()},
      {options, [], options_tests()},
      {options_tls, [], options_tests_tls()},
      {'dtlsv1.2', [], all_versions_groups()},
      {'dtlsv1', [], all_versions_groups()},
      {'tlsv1.2', [], all_versions_groups() ++ tls_versions_groups() ++ [conf_signature_algs, no_common_signature_algs]},
      {'tlsv1.1', [], all_versions_groups() ++ tls_versions_groups()},
-     {'tlsv1', [], all_versions_groups() ++ tls_versions_groups() ++ rizzo_tests()},
-     {'sslv3', [], all_versions_groups() ++ tls_versions_groups() ++ rizzo_tests() -- [tls_ciphersuite_vs_version]},
+     {'tlsv1', [], all_versions_groups() ++ tls_versions_groups()},
+     {'sslv3', [], all_versions_groups() ++ tls_versions_groups() -- [tls_ciphersuite_vs_version]},
      {api,[], api_tests()},
      {api_tls,[], api_tests_tls()},
-     {ciphers, [], cipher_tests()},
-     {error_handling_tests, [], error_handling_tests()},
-     {error_handling_tests_tls, [], error_handling_tests_tls()}
+     {ciphers, [], cipher_tests()}
     ].
 
 tls_versions_groups ()->
     [
-     {group, api_tls},
-     {group, error_handling_tests_tls}].
+     {group, api_tls}].
 
 all_versions_groups ()->
     [{group, api},
-     {group, ciphers},
-     {group, error_handling_tests}].
+     {group, ciphers}].
 
 
 basic_tests() ->
     [app,
-     appup,
-     alerts,
-     alert_details,
-     alert_details_not_too_big,
+     appup,    
      version_option,
      connect_twice,
      connect_dist,
@@ -105,13 +96,8 @@ basic_tests() ->
      cipher_format
     ].
 
-basic_tests_tls() ->
-    [tls_send_close
-    ].
-
 options_tests() ->
     [
-     %%der_input, Move/remove as redundent
      ssl_options_not_proplist,
      raw_ssl_option,
      invalid_inet_get_option,
@@ -123,12 +109,10 @@ options_tests() ->
      invalid_options,
      protocol_versions,
      empty_protocol_versions,
-     ipv6,
      reuseaddr,
      unordered_protocol_versions_server,
      unordered_protocol_versions_client,
-     max_handshake_size
-].
+     max_handshake_size].
 
 options_tests_tls() ->
     [tls_misc_ssl_options,
@@ -154,22 +138,6 @@ cipher_tests() ->
      cipher_suites_mix,     
      default_reject_anonymous].
 
-error_handling_tests()->
-    [
-    ].
-
-error_handling_tests_tls()->
-    [
-    ].
-
-rizzo_tests() ->
-    [rizzo,
-     no_rizzo_rc4,
-     rizzo_one_n_minus_one,
-     rizzo_zero_n,
-     rizzo_disabled].
-
-
 %%--------------------------------------------------------------------
 init_per_suite(Config0) ->
     catch crypto:stop(),
@@ -194,12 +162,10 @@ end_per_suite(_Config) ->
 
 %%--------------------------------------------------------------------
 
-init_per_group(GroupName, Config) when GroupName == basic_tls;
-                                       GroupName == options_tls;
+init_per_group(GroupName, Config) when GroupName == options_tls;
                                        GroupName == options;
                                        GroupName == basic;
-                                       GroupName == session;
-                                       GroupName == error_handling_tests_tls ->
+                                       GroupName == session ->
     ssl_test_lib:clean_tls_version(Config);
 %% Do not automatically configure TLS version for the 'tlsv1.3' group
 init_per_group('tlsv1.3' = GroupName, Config) ->
@@ -271,12 +237,6 @@ init_per_testcase(fallback, Config)  ->
 	    {skip, "Not relevant if highest supported version is less than 3.2"}
     end;
 
-init_per_testcase(TestCase, Config) when TestCase == versions_option;
-					 TestCase == tls_tcp_connect_big ->
-    ssl_test_lib:ct_log_supported_protocol_versions(Config),
-    ct:timetrap({seconds, 60}),
-    Config;
-
 init_per_testcase(version_option, Config) ->
     ssl_test_lib:ct_log_supported_protocol_versions(Config),
     ct:timetrap({seconds, 10}),
@@ -287,30 +247,6 @@ init_per_testcase(reuse_session, Config) ->
     ct:timetrap({seconds, 10}),
     Config;
 
-init_per_testcase(rizzo, Config) ->
-    ssl_test_lib:ct_log_supported_protocol_versions(Config),
-    ct:timetrap({seconds, 60}),
-    Config;
-
-init_per_testcase(no_rizzo_rc4, Config) ->
-    ssl_test_lib:ct_log_supported_protocol_versions(Config),
-    ct:timetrap({seconds, 60}),
-    Config;
-
-init_per_testcase(rizzo_one_n_minus_one, Config) ->
-    ct:log("TLS/SSL version ~p~n ", [tls_record:supported_protocol_versions()]),
-    ct:timetrap({seconds, 60}),
-    rizzo_add_mitigation_option(one_n_minus_one, Config);
-
-init_per_testcase(rizzo_zero_n, Config) ->
-    ct:log("TLS/SSL version ~p~n ", [tls_record:supported_protocol_versions()]),
-    ct:timetrap({seconds, 60}),
-    rizzo_add_mitigation_option(zero_n, Config);
-
-init_per_testcase(rizzo_disabled, Config) ->
-    ct:log("TLS/SSL version ~p~n ", [tls_record:supported_protocol_versions()]),
-    ct:timetrap({seconds, 60}),
-    rizzo_add_mitigation_option(disabled, Config);
 
 init_per_testcase(TestCase, Config) when TestCase == clear_pem_cache;
 						TestCase == der_input;
@@ -392,58 +328,6 @@ appup() ->
 appup(Config) when is_list(Config) ->
     ok = ?t:appup_test(ssl).
 %%--------------------------------------------------------------------
-alerts() ->
-    [{doc, "Test ssl_alert:alert_txt/1"}].
-alerts(Config) when is_list(Config) ->
-    Descriptions = [?CLOSE_NOTIFY, ?UNEXPECTED_MESSAGE, ?BAD_RECORD_MAC,
-		    ?DECRYPTION_FAILED_RESERVED, ?RECORD_OVERFLOW, ?DECOMPRESSION_FAILURE,
-		    ?HANDSHAKE_FAILURE, ?BAD_CERTIFICATE, ?UNSUPPORTED_CERTIFICATE,
-		    ?CERTIFICATE_REVOKED,?CERTIFICATE_EXPIRED, ?CERTIFICATE_UNKNOWN,
-		    ?ILLEGAL_PARAMETER, ?UNKNOWN_CA, ?ACCESS_DENIED, ?DECODE_ERROR,
-		    ?DECRYPT_ERROR, ?EXPORT_RESTRICTION, ?PROTOCOL_VERSION, 
-		    ?INSUFFICIENT_SECURITY, ?INTERNAL_ERROR, ?USER_CANCELED,
-		    ?NO_RENEGOTIATION, ?UNSUPPORTED_EXTENSION, ?CERTIFICATE_UNOBTAINABLE,
-		    ?UNRECOGNISED_NAME, ?BAD_CERTIFICATE_STATUS_RESPONSE,
-		    ?BAD_CERTIFICATE_HASH_VALUE, ?UNKNOWN_PSK_IDENTITY, 
-		    255 %% Unsupported/unknow alert will result in a description too
-		   ],
-    Alerts = [?ALERT_REC(?WARNING, ?CLOSE_NOTIFY) | 
-	      [?ALERT_REC(?FATAL, Desc) || Desc <- Descriptions]],
-    lists:foreach(fun(Alert) ->
-                          try ssl_alert:alert_txt(Alert)
-                          catch
-			    C:E:T ->
-                                  ct:fail({unexpected, {C, E, T}})
-			end 
-		  end, Alerts).
-%%--------------------------------------------------------------------
-alert_details() ->
-    [{doc, "Test that ssl_alert:alert_txt/1 result contains extendend error description"}].
-alert_details(Config) when is_list(Config) ->
-    Unique = make_ref(),
-    UniqueStr = lists:flatten(io_lib:format("~w", [Unique])),
-    Alert = ?ALERT_REC(?WARNING, ?CLOSE_NOTIFY, Unique),
-    case string:str(ssl_alert:alert_txt(Alert), UniqueStr) of
-        0 ->
-            ct:fail(error_details_missing);
-        _ ->
-            ok
-    end.
-
-%%--------------------------------------------------------------------
-alert_details_not_too_big() ->
-    [{doc, "Test that ssl_alert:alert_txt/1 limits printed depth of extended error description"}].
-alert_details_not_too_big(Config) when is_list(Config) ->
-    Reason = lists:duplicate(10, lists:duplicate(10, lists:duplicate(10, {some, data}))),
-    Alert = ?ALERT_REC(?WARNING, ?CLOSE_NOTIFY, Reason),
-    case length(ssl_alert:alert_txt(Alert)) < 1000 of
-        true ->
-            ok;
-        false ->
-            ct:fail(ssl_alert_text_too_big)
-    end.
-
-%%--------------------------------------------------------------------
 new_options_in_accept() ->
     [{doc,"Test that you can set ssl options in ssl_accept/3 and not only in tcp upgrade"}].
 new_options_in_accept(Config) when is_list(Config) -> 
@@ -571,10 +455,6 @@ getstat(Config) when is_list(Config) ->
 
     ok.
 
-
-
-
-
 %%--------------------------------------------------------------------
 connect_dist() ->
     [{doc,"Test a simple connect as is used by distribution"}].
@@ -1173,31 +1053,6 @@ send_recv(Config) when is_list(Config) ->
     ssl_test_lib:close(Client).
 
 %%--------------------------------------------------------------------
-tls_send_close() ->
-    [{doc,""}].
-tls_send_close(Config) when is_list(Config) -> 
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Server = 
-	ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-				   {from, self()}, 
-				   {mfa, {ssl_test_lib, send_recv_result, []}},
-				   {options,  [{active, false} | ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    {ok, TcpS} = rpc:call(ClientNode, gen_tcp, connect, 
-			  [Hostname,Port,[binary, {active, false}]]),
-    {ok, SslS} = rpc:call(ClientNode, ssl, connect, 
-			  [TcpS,[{active, false}|ClientOpts]]),
-    
-    ct:log("Testcase ~p, Client ~p  Server ~p ~n",
-		       [self(), self(), Server]),
-    ok = ssl:send(SslS, "Hello world"),      
-    {ok,<<"Hello world">>} = ssl:recv(SslS, 11),    
-    gen_tcp:close(TcpS),    
-    {error, _} = ssl:send(SslS, "Hello world").
-
-%%--------------------------------------------------------------------
 version_option() ->
     [{doc, "Use version option and do no specify ciphers list. Bug specified incorrect ciphers"}].
 version_option(Config) when is_list(Config) ->
@@ -1229,46 +1084,6 @@ internal_active_1(Config) when is_list(Config) ->
     
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
-
-
-%%--------------------------------------------------------------------
-ipv6() ->
-    [{require, ipv6_hosts},
-     {doc,"Test ipv6."}].
-ipv6(Config) when is_list(Config) ->
-    {ok, Hostname0} = inet:gethostname(),
-    
-    case lists:member(list_to_atom(Hostname0), ct:get_config(ipv6_hosts)) of
-	true ->
-	    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-	    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-	    {ClientNode, ServerNode, Hostname} = 
-		ssl_test_lib:run_where(Config, ipv6),
-	    Server = ssl_test_lib:start_server([{node, ServerNode}, 
-				   {port, 0}, {from, self()}, 
-				   {mfa, {ssl_test_lib, send_recv_result, []}},
-				   {options,  
-				    [inet6, {active, false} | ServerOpts]}]),
-	    Port = ssl_test_lib:inet_port(Server), 
-	    Client = ssl_test_lib:start_client([{node, ClientNode}, 
-				   {port, Port}, {host, Hostname},
-				   {from, self()}, 
-				   {mfa, {ssl_test_lib, send_recv_result, []}},
-				   {options, 
-				    [inet6, {active, false} | ClientOpts]}]),
-	    
-	    ct:log("Testcase ~p, Client ~p  Server ~p ~n",
-			       [self(), Client, Server]),
-	    
-	    ssl_test_lib:check_result(Server, ok, Client, ok),
-	    
-	    ssl_test_lib:close(Server),
-	    ssl_test_lib:close(Client);
-	false ->
-	    {skip, "Host does not support IPv6"}
-    end.
-
-
     
 
 %%--------------------------------------------------------------------
@@ -1356,68 +1171,6 @@ default_reject_anonymous(Config) when is_list(Config) ->
 
     ssl_test_lib:check_server_alert(Server, Client, insufficient_security).
 
-
-%%--------------------------------------------------------------------
-der_input() ->
-    [{doc,"Test to input certs and key as der"}].
-
-der_input(Config) when is_list(Config) ->
-    DataDir = proplists:get_value(data_dir, Config),
-    DHParamFile = filename:join(DataDir, "dHParam.pem"),
-
-    {status, _, _, StatusInfo} = sys:get_status(whereis(ssl_manager)),
-    [_, _,_, _, Prop] = StatusInfo,
-    State = ssl_test_lib:state(Prop),
-    [CADb | _] = element(6, State),
-
-    Size = ets:info(CADb, size),
-
-    SeverVerifyOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
-    {ServerCert, ServerKey, ServerCaCerts, DHParams} = der_input_opts([{dhfile, DHParamFile} |
-								       SeverVerifyOpts]),
-    ClientVerifyOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
-    {ClientCert, ClientKey, ClientCaCerts, DHParams} = der_input_opts([{dhfile, DHParamFile} |
-								       ClientVerifyOpts]),
-    ServerOpts = [{verify, verify_peer}, {fail_if_no_peer_cert, true},
-		  {dh, DHParams},
-		  {cert, ServerCert}, {key, ServerKey}, {cacerts, ServerCaCerts}],
-    ClientOpts = [{verify, verify_peer}, {fail_if_no_peer_cert, true},
-		  {dh, DHParams},
-		  {cert, ClientCert}, {key, ClientKey}, {cacerts, ClientCaCerts}],
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-					{from, self()},
-					{mfa, {ssl_test_lib, send_recv_result, []}},
-					{options, [{active, false} | ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-					{host, Hostname},
-					{from, self()},
-					{mfa, {ssl_test_lib, send_recv_result, []}},
-					{options, [{active, false} | ClientOpts]}]),
-
-    ssl_test_lib:check_result(Server, ok, Client, ok),
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
-    Size = ets:info(CADb, size).
-
-%%--------------------------------------------------------------------
-der_input_opts(Opts) ->
-    Certfile = proplists:get_value(certfile, Opts),
-    CaCertsfile = proplists:get_value(cacertfile, Opts),
-    Keyfile = proplists:get_value(keyfile, Opts),
-    Dhfile = proplists:get_value(dhfile, Opts),
-    [{_, Cert, _}] = ssl_test_lib:pem_to_der(Certfile),
-    [{Asn1Type, Key, _}]  = ssl_test_lib:pem_to_der(Keyfile),
-    [{_, DHParams, _}]  = ssl_test_lib:pem_to_der(Dhfile),
-    CaCerts =
-	lists:map(fun(Entry) ->
-			  {_, CaCert, _} = Entry,
-			  CaCert
-		  end, ssl_test_lib:pem_to_der(CaCertsfile)),
-    {Cert, {Asn1Type, Key}, CaCerts, DHParams}.
-
-
 %%--------------------------------------------------------------------
 defaults(Config) when is_list(Config)->
     Versions = ssl:versions(),
@@ -1653,113 +1406,6 @@ connect_twice(Config) when is_list(Config) ->
     ssl_test_lib:close(Client1).
 
 %%--------------------------------------------------------------------
-
-rizzo() ->
-    [{doc, "Test that there is a 1/n-1-split for non RC4 in 'TLS < 1.1' as it is
-    vunrable to Rizzo/Dungon attack"}].
-
-rizzo(Config) when is_list(Config) ->
-    Prop = proplists:get_value(tc_group_properties, Config),
-    Version = proplists:get_value(name, Prop),
-    NVersion = ssl_test_lib:protocol_version(Config, tuple),
-    Ciphers  = ssl:filter_cipher_suites(ssl:cipher_suites(all, NVersion),  
-                                        [{key_exchange, 
-                                          fun(Alg) when Alg == ecdh_rsa; Alg == ecdhe_rsa-> 
-                                                  true;
-                                             (_) -> 
-                                                  false 
-                                          end},
-                                         {cipher, 
-                                          fun(rc4_128) -> 
-                                                  false;
-                                             (chacha20_poly1305) ->
-                                                  false;
-                                             (_) -> 
-                                                  true 
-                                          end}]),
-
-    run_send_recv_rizzo(Ciphers, Config, Version,
-			 {?MODULE, send_recv_result_active_rizzo, []}).
-%%--------------------------------------------------------------------
-no_rizzo_rc4() ->
-    [{doc,"Test that there is no 1/n-1-split for RC4 as it is not vunrable to Rizzo/Dungon attack"}].
-
-no_rizzo_rc4(Config) when is_list(Config) ->
-    Prop = proplists:get_value(tc_group_properties, Config),
-    Version = proplists:get_value(name, Prop),
-    NVersion = ssl_test_lib:protocol_version(Config, tuple),
-    %% Test uses RSA certs
-    Ciphers  = ssl:filter_cipher_suites(ssl_test_lib:rc4_suites(NVersion),  
-                                        [{key_exchange, 
-                                          fun(Alg) when Alg == ecdh_rsa; Alg == ecdhe_rsa-> 
-                                                  true;
-                                             (_) -> 
-                                                  false 
-                                          end}]),
-    run_send_recv_rizzo(Ciphers, Config, Version,
-			{?MODULE, send_recv_result_active_no_rizzo, []}).
-
-rizzo_one_n_minus_one() ->
-    [{doc,"Test that the 1/n-1-split mitigation of Rizzo/Dungon attack can be explicitly selected"}].
-
-rizzo_one_n_minus_one(Config) when is_list(Config) ->
-    Prop = proplists:get_value(tc_group_properties, Config),
-    Version = proplists:get_value(name, Prop),
-    NVersion = ssl_test_lib:protocol_version(Config, tuple),
-    Ciphers  = ssl:filter_cipher_suites(ssl:cipher_suites(all, NVersion),
-                                        [{key_exchange, 
-                                          fun(Alg) when Alg == ecdh_rsa; Alg == ecdhe_rsa-> 
-                                                  true;
-                                             (_) -> 
-                                                  false 
-                                          end}, 
-                                         {cipher, 
-                                          fun(rc4_128) ->
-                                                  false;
-                                             %% TODO: remove this clause when chacha is fixed!
-                                             (chacha20_poly1305) ->
-                                                  false;
-                                             (_) -> 
-                                                  true 
-                                          end}]),
-    run_send_recv_rizzo(Ciphers, Config, Version,
-                        {?MODULE, send_recv_result_active_rizzo, []}).
-
-rizzo_zero_n() ->
-    [{doc,"Test that the 0/n-split mitigation of Rizzo/Dungon attack can be explicitly selected"}].
-
-rizzo_zero_n(Config) when is_list(Config) ->
-    Prop = proplists:get_value(tc_group_properties, Config),
-    Version = proplists:get_value(name, Prop),
-    NVersion = ssl_test_lib:protocol_version(Config, tuple),
-    Ciphers  = ssl:filter_cipher_suites(ssl:cipher_suites(default, NVersion),
-                                        [{cipher, 
-                                          fun(rc4_128) ->
-                                                  false;
-                                             (_) -> 
-                                                  true 
-                                          end}]),
-    run_send_recv_rizzo(Ciphers, Config, Version,
-			 {?MODULE, send_recv_result_active_no_rizzo, []}).
-
-rizzo_disabled() ->
-    [{doc,"Test that the mitigation of Rizzo/Dungon attack can be explicitly disabled"}].
-
-rizzo_disabled(Config) when is_list(Config) ->
-    Prop = proplists:get_value(tc_group_properties, Config),
-    Version = proplists:get_value(name, Prop),
-    NVersion = ssl_test_lib:protocol_version(Config, tuple),
-    Ciphers  = ssl:filter_cipher_suites(ssl:cipher_suites(default, NVersion),
-                                        [{cipher, 
-                                          fun(rc4_128) ->
-                                                  false;
-                                             (_) -> 
-                                                  true 
-                                          end}]),
-    run_send_recv_rizzo(Ciphers, Config, Version,
-			 {?MODULE, send_recv_result_active_no_rizzo, []}).
-
-%%--------------------------------------------------------------------
 new_server_wants_peer_cert() ->
     [{doc, "Test that server configured to do client certification does"
       " not reuse session without a client certificate."}].
@@ -2027,104 +1673,9 @@ basic_test(Config) ->
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
 
-
-
-
-
-send_recv_result_active_rizzo(Socket) ->
-    ssl:send(Socket, "Hello world"),
-    "Hello world" = ssl_test_lib:active_recv(Socket, 11),
-    ok.
-
-send_recv_result_active_no_rizzo(Socket) ->
-    ssl:send(Socket, "Hello world"),
-    "Hello world" = ssl_test_lib:active_recv(Socket, 11),
-    ok.
-
 result_ok(_Socket) ->
     ok.
 
-rizzo_add_mitigation_option(Value, Config) ->
-    lists:foldl(fun(Opt, Acc) ->
-                    case proplists:get_value(Opt, Acc) of
-                      undefined -> Acc;
-                      C ->
-                        N = lists:keystore(beast_mitigation, 1, C,
-                                           {beast_mitigation, Value}),
-                        lists:keystore(Opt, 1, Acc, {Opt, N})
-                    end
-                end, Config,
-                [client_opts, client_dsa_opts, server_opts, server_dsa_opts,
-                 server_ecdsa_opts, server_ecdh_rsa_opts]).
-    
-
-erlang_ssl_receive(Socket, Data) ->
-    case ssl_test_lib:active_recv(Socket, length(Data)) of
-        Data ->
-            ok;
-        Other ->
-            ct:fail({{expected, Data}, {got, Other}})
-    end.
-
-
-
-run_send_recv_rizzo(Ciphers, Config, Version, Mfa) ->
-    Result =  lists:map(fun(Cipher) ->
-				rizzo_test(Cipher, Config, Version, Mfa) end,
-			Ciphers),
-    case lists:flatten(Result) of
-	[] ->
-	    ok;
-	Error ->
-	    ct:log("Cipher suite errors: ~p~n", [Error]),
-	    ct:fail(cipher_suite_failed_see_test_case_log)
-    end.
-
-
-
-rizzo_test(Cipher, Config, Version, Mfa) ->
-   {ClientOpts, ServerOpts} = client_server_opts(Cipher, Config),
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-					{from, self()},
-			   {mfa, Mfa},
-			   {options, [{active, true}, {ciphers, [Cipher]},
-				       {versions, [Version]}
-				      | ServerOpts]}]),
-    Port  = ssl_test_lib:inet_port(Server),
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-					{host, Hostname},
-			   {from, self()},
-			   {mfa, Mfa},
-			   {options, [{active, true}, {ciphers, [Cipher]}| ClientOpts]}]),
-
-    Result = ssl_test_lib:check_result(Server, ok, Client, ok),
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
-    case Result of
-	ok ->
-	    [];
-	Error ->
-	    [{Cipher, Error}]
-    end.
-
-client_server_opts(#{key_exchange := KeyAlgo}, Config)
-  when KeyAlgo == rsa orelse
-       KeyAlgo == dhe_rsa orelse
-       KeyAlgo == ecdhe_rsa orelse
-       KeyAlgo == rsa_psk orelse
-       KeyAlgo == srp_rsa ->
-    {ssl_test_lib:ssl_options(client_opts, Config),
-     ssl_test_lib:ssl_options(server_opts, Config)};
-client_server_opts(#{key_exchange := KeyAlgo}, Config) when KeyAlgo == dss orelse KeyAlgo == dhe_dss ->
-    {ssl_test_lib:ssl_options(client_dsa_opts, Config),
-     ssl_test_lib:ssl_options(server_dsa_opts, Config)};
-client_server_opts(#{key_exchange := KeyAlgo}, Config) when KeyAlgo == ecdh_ecdsa orelse KeyAlgo == ecdhe_ecdsa ->
-    {ssl_test_lib:ssl_options(client_opts, Config),
-     ssl_test_lib:ssl_options(server_ecdsa_opts, Config)};
-client_server_opts(#{key_exchange := KeyAlgo}, Config) when KeyAlgo == ecdh_rsa ->
-    {ssl_test_lib:ssl_options(client_opts, Config),
-     ssl_test_lib:ssl_options(server_ecdh_rsa_opts, Config)}.
 
 protocol_info_result(Socket) ->
     {ok, [{protocol, PVersion}]} = ssl:connection_information(Socket, [protocol]),
@@ -2145,8 +1696,6 @@ connect_dist_c(S) ->
     ok.
 
 
-
-
 get_invalid_inet_option(Socket) ->
     {error, {options, {socket_options, foo, _}}} = ssl:getopts(Socket, [foo]),
     ok.