ssl: Run relevant tests for all SSL/TLS versions

5 files changed, 411 insertions, 601 deletions

diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 24b41124c6..1cfe8d0367 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -27,9 +27,11 @@
 -include_lib("common_test/include/ct.hrl").
 -include_lib("public_key/include/public_key.hrl").
 
+-include("ssl_internal.hrl").
 -include("ssl_alert.hrl").
 -include("ssl_internal.hrl").
 -include("ssl_record.hrl").
+-include("ssl_handshake.hrl").
 
 -define('24H_in_sec', 86400).  
 -define(TIMEOUT, 60000).
@@ -54,7 +56,6 @@ init_per_suite(Config0) ->
     try crypto:start() of
 	ok ->
 	    application:start(public_key),
-	    ssl:start(),
 
 	    %% make rsa certs using oppenssl
 	    Result =
@@ -91,46 +92,28 @@ end_per_suite(_Config) ->
 %% variable, but should NOT alter/remove any existing entries.
 %% Description: Initialization before each test case
 %%--------------------------------------------------------------------
-init_per_testcase(session_cache_process_list, Config) ->
-    init_customized_session_cache(list, Config);
-
-init_per_testcase(session_cache_process_mnesia, Config) ->
-    mnesia:start(),
-    init_customized_session_cache(mnesia, Config);
-
-init_per_testcase(reuse_session_expired, Config0) ->
-    Config = lists:keydelete(watchdog, 1, Config0),
-    Dog = ssl_test_lib:timetrap(?EXPIRE * 1000 * 5),
-    ssl:stop(),
-    application:load(ssl),
-    application:set_env(ssl, session_lifetime, ?EXPIRE),
-    ssl:start(),
-    [{watchdog, Dog} | Config];
-
 init_per_testcase(no_authority_key_identifier, Config) ->
     %% Clear cach so that root cert will not
     %% be found.
-    ssl:stop(),
-    ssl:start(), 
+    ssl:clear_pem_cache(),
     Config;
 
-init_per_testcase(TestCase, Config) when TestCase == ciphers_rsa_signed_certs_ssl3; 
-					 TestCase == ciphers_rsa_signed_certs_openssl_names_ssl3;
-					 TestCase == ciphers_dsa_signed_certs_ssl3; 
-					 TestCase == ciphers_dsa_signed_certs_openssl_names_ssl3 ->
+init_per_testcase(protocol_versions, Config)  ->
     ssl:stop(),
     application:load(ssl),
-    application:set_env(ssl, protocol_version, sslv3),
+    %% For backwards compatibility sslv2 should be filtered out.
+    application:set_env(ssl, protocol_version, [sslv2, sslv3, tlsv1]),
     ssl:start(),
     Config;
 
-init_per_testcase(protocol_versions, Config)  ->
+init_per_testcase(reuse_session_expired, Config0) ->
+    Config = lists:keydelete(watchdog, 1, Config0),
+    Dog = ssl_test_lib:timetrap(?EXPIRE * 1000 * 5),
     ssl:stop(),
     application:load(ssl),
-    %% For backwards compatibility sslv2 should be filtered out.
-    application:set_env(ssl, protocol_version, [sslv2, sslv3, tlsv1]),
+    application:set_env(ssl, session_lifetime, ?EXPIRE),
     ssl:start(),
-    Config;
+    [{watchdog, Dog} | Config];
 
 init_per_testcase(empty_protocol_versions, Config)  ->
     ssl:stop(),
@@ -139,24 +122,15 @@ init_per_testcase(empty_protocol_versions, Config)  ->
     ssl:start(),
     Config;
 
-init_per_testcase(different_ca_peer_sign, Config0) ->
-    ssl_test_lib:make_mix_cert(Config0);
+%% init_per_testcase(different_ca_peer_sign, Config0) ->
+%%     ssl_test_lib:make_mix_cert(Config0);
 
 init_per_testcase(_TestCase, Config0) ->
+    test_server:format("TLS/SSL version ~p~n ", [ssl_record:supported_protocol_versions()]),
     Config = lists:keydelete(watchdog, 1, Config0),
     Dog = test_server:timetrap(?TIMEOUT),
    [{watchdog, Dog} | Config].
 
-init_customized_session_cache(Type, Config0) ->
-    Config = lists:keydelete(watchdog, 1, Config0),
-    Dog = test_server:timetrap(?TIMEOUT),
-    ssl:stop(),
-    application:load(ssl),
-    application:set_env(ssl, session_cb, ?MODULE),
-    application:set_env(ssl, session_cb_init_args, [Type]),
-    ssl:start(),
-    [{watchdog, Dog} | Config].
-
 %%--------------------------------------------------------------------
 %% Function: end_per_testcase(TestCase, Config) -> _
 %% Case - atom()
@@ -165,27 +139,10 @@ init_customized_session_cache(Type, Config0) ->
 %%   A list of key/value pairs, holding the test case configuration.
 %% Description: Cleanup after each test case
 %%--------------------------------------------------------------------
-end_per_testcase(session_cache_process_list, Config) ->
-    application:unset_env(ssl, session_cb),
-    end_per_testcase(default_action, Config);
-end_per_testcase(session_cache_process_mnesia, Config) ->
-    application:unset_env(ssl, session_cb),
-    application:unset_env(ssl, session_cb_init_args),
-    mnesia:stop(),
-    ssl:stop(),
-    ssl:start(),
-    end_per_testcase(default_action, Config);
 end_per_testcase(reuse_session_expired, Config) ->
     application:unset_env(ssl, session_lifetime),
     end_per_testcase(default_action, Config);
-end_per_testcase(TestCase, Config) when TestCase == ciphers_rsa_signed_certs_ssl3; 
-					TestCase == ciphers_rsa_signed_certs_openssl_names_ssl3;
-					TestCase == ciphers_dsa_signed_certs_ssl3; 
-					TestCase == ciphers_dsa_signed_certs_openssl_names_ssl3;
-					TestCase == protocol_versions;
-					TestCase == empty_protocol_versions->
-    application:unset_env(ssl, protocol_version),
-    end_per_testcase(default_action, Config);
+
 end_per_testcase(_TestCase, Config) ->
     Dog = ?config(watchdog, Config),
     case Dog of 
@@ -206,74 +163,163 @@ end_per_testcase(_TestCase, Config) ->
 suite() -> [{ct_hooks,[ts_install_cth]}].
 
 all() -> 
-    [app, alerts, connection_info, protocol_versions,
-     empty_protocol_versions, controlling_process,
-     controller_dies, client_closes_socket,
-     connect_dist, peername, peercert, sockname, socket_options,
-     invalid_inet_get_option, invalid_inet_get_option_not_list,
+    [
+     {group, basic},
+     {group, options},
+     {group, session},
+     {group, 'tlsv1.2'},
+     {group, 'tlsv1.1'},
+     {group, 'tlsv1'},
+     {group, 'sslv3'}
+    ].
+
+groups() ->
+    [{basic, [], basic_tests()},
+     {options, [], options_tests()},
+     {'tlsv1.2', [], all_versions_groups()},
+     {'tlsv1.1', [], all_versions_groups()},
+     {'tlsv1', [], all_versions_groups() ++ rizzo_tests()},
+     {'sslv3', [], all_versions_groups() ++ rizzo_tests()},
+     {api,[], api_tests()},
+     {certificate_verify, [], certificate_verify_tests()},
+     {session, [], session_tests()},
+     {renegotiate, [], renegotiate_tests()},
+     {ciphers, [], cipher_tests()},
+     {error_handling_tests, [], error_handling_tests()}
+    ].
+
+all_versions_groups ()->
+    [{group, api},
+     {group, certificate_verify},
+     {group, renegotiate},
+     {group, ciphers},
+     {group, error_handling_tests}].
+
+init_per_group(GroupName, Config) ->
+    case ssl_test_lib:is_tls_version(GroupName) of
+	true ->
+	    ssl_test_lib:init_tls_version(GroupName);
+	_ ->
+	    ssl:start()
+    end,
+    Config.
+
+end_per_group(_GroupName, Config) ->
+    Config.
+
+basic_tests() ->
+    [app,
+     alerts,
+     send_close,
+     connect_twice,
+     connect_dist
+    ].
+
+options_tests() ->
+    [der_input,
+     misc_ssl_options,
+     socket_options,
+     invalid_inet_get_option,
+     invalid_inet_get_option_not_list,
      invalid_inet_get_option_improper_list,
-     invalid_inet_set_option, invalid_inet_set_option_not_list,
+     invalid_inet_set_option,
+     invalid_inet_set_option_not_list,
      invalid_inet_set_option_improper_list,
-     misc_ssl_options, versions, cipher_suites, upgrade,
-     upgrade_with_timeout, tcp_connect, tcp_connect_big, ipv6, ekeyfile,
-     ecertfile, ecacertfile, eoptions, shutdown,
-     shutdown_write, shutdown_both, shutdown_error,
-     ciphers_rsa_signed_certs, ciphers_rsa_signed_certs_ssl3,
-     ciphers_rsa_signed_certs_openssl_names,
-     ciphers_rsa_signed_certs_openssl_names_ssl3,
-     ciphers_dsa_signed_certs, ciphers_dsa_signed_certs_ssl3,
-     ciphers_dsa_signed_certs_openssl_names,
-     ciphers_dsa_signed_certs_openssl_names_ssl3,
-     anonymous_cipher_suites,
-     default_reject_anonymous,
-     send_close,
-     close_transport_accept, dh_params,
-     server_verify_peer_passive, server_verify_peer_active,
+     dh_params,
+     ecertfile,
+     ecacertfile,
+     ekeyfile,
+     eoptions,
+     protocol_versions,
+     empty_protocol_versions,
+     ipv6,
+     reuseaddr].
+
+api_tests() ->
+    [connection_info,
+     peername,
+     peercert,
+     sockname,
+     versions,
+     controlling_process,
+     upgrade,
+     upgrade_with_timeout,
+     shutdown,
+     shutdown_write,
+     shutdown_both,
+     shutdown_error,
+     hibernate
+    ].
+
+certificate_verify_tests() ->
+    [server_verify_peer_passive,
+     server_verify_peer_active,
      server_verify_peer_active_once,
-     server_verify_none_passive, server_verify_none_active,
+     server_verify_none_passive,
+     server_verify_none_active,
      server_verify_none_active_once,
-     server_verify_no_cacerts, server_require_peer_cert_ok,
+     server_verify_no_cacerts,
+     server_require_peer_cert_ok,
      server_require_peer_cert_fail,
      server_verify_client_once_passive,
      server_verify_client_once_active,
      server_verify_client_once_active_once,
-     client_verify_none_passive, client_verify_none_active,
+     client_verify_none_passive,
+     client_verify_none_active,
      client_verify_none_active_once,
-     reuse_session,
-     reuse_session_expired,
-     server_does_not_want_to_reuse_session,
-     client_renegotiate, server_renegotiate,
-     client_renegotiate_reused_session,
-     server_renegotiate_reused_session,
-     client_no_wrap_sequence_number,
-     server_no_wrap_sequence_number, extended_key_usage_verify_peer,
+     extended_key_usage_verify_peer,
      extended_key_usage_verify_none,
-     no_authority_key_identifier, invalid_signature_client,
-     invalid_signature_server, cert_expired,
+     invalid_signature_client,
+     invalid_signature_server,
+     cert_expired,
      client_with_cert_cipher_suites_handshake,
      verify_fun_always_run_client,
      verify_fun_always_run_server,
-     unknown_server_ca_fail, der_input,
+     unknown_server_ca_fail,
      unknown_server_ca_accept_verify_none,
      unknown_server_ca_accept_verify_peer,
      unknown_server_ca_accept_backwardscompatibility,
-     %%different_ca_peer_sign,
-     no_reuses_session_server_restart_new_cert,
-     no_reuses_session_server_restart_new_cert_file, reuseaddr,
-     hibernate, connect_twice, renegotiate_dos_mitigate_active,
-     renegotiate_dos_mitigate_passive,
-     tcp_error_propagation_in_active_mode, rizzo, no_rizzo_rc4,
-     recv_error_handling
+     no_authority_key_identifier
     ].
 
-groups() -> 
-    [].
+session_tests() ->
+    [reuse_session,
+     reuse_session_expired,
+     server_does_not_want_to_reuse_session,
+     no_reuses_session_server_restart_new_cert,
+     no_reuses_session_server_restart_new_cert_file].
 
-init_per_group(_GroupName, Config) ->
-    Config.
+renegotiate_tests() ->
+    [client_renegotiate,
+     server_renegotiate,
+     client_renegotiate_reused_session,
+     server_renegotiate_reused_session,
+     client_no_wrap_sequence_number,
+     server_no_wrap_sequence_number,
+     renegotiate_dos_mitigate_active,
+     renegotiate_dos_mitigate_passive].
 
-end_per_group(_GroupName, Config) ->
-    Config.
+cipher_tests() ->
+    [cipher_suites,
+     ciphers_rsa_signed_certs,
+     ciphers_rsa_signed_certs_openssl_names,
+     ciphers_dsa_signed_certs,
+     ciphers_dsa_signed_certs_openssl_names,
+     anonymous_cipher_suites,
+     default_reject_anonymous].
+
+error_handling_tests()->
+    [controller_dies,
+     client_closes_socket,
+     tcp_error_propagation_in_active_mode,
+     tcp_connect,
+     tcp_connect_big,
+     close_transport_accept
+    ].
+
+rizzo_tests() ->
+    [rizzo,
+     no_rizzo_rc4].
 
 %% Test cases starts here.
 %%--------------------------------------------------------------------
@@ -1726,21 +1772,7 @@ ciphers_rsa_signed_certs(Config) when is_list(Config) ->
 	ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
 
     Ciphers = ssl_test_lib:rsa_suites(),
-    test_server:format("tls1 erlang cipher suites ~p~n", [Ciphers]),
-    run_suites(Ciphers, Version, Config, rsa).
-
-ciphers_rsa_signed_certs_ssl3(doc) -> 
-    ["Test all rsa ssl cipher suites in ssl3"];
-       
-ciphers_rsa_signed_certs_ssl3(suite) -> 
-    [];
-
-ciphers_rsa_signed_certs_ssl3(Config) when is_list(Config) ->
-    Version = 
-	ssl_record:protocol_version({3,0}),
-
-    Ciphers = ssl_test_lib:rsa_suites(),
-    test_server:format("ssl3 erlang cipher suites ~p~n", [Ciphers]),
+    test_server:format("~p erlang cipher suites ~p~n", [Version, Ciphers]),
     run_suites(Ciphers, Version, Config, rsa).
 
 ciphers_rsa_signed_certs_openssl_names(doc) -> 
@@ -1757,18 +1789,6 @@ ciphers_rsa_signed_certs_openssl_names(Config) when is_list(Config) ->
     run_suites(Ciphers, Version, Config, rsa).
 
 
-ciphers_rsa_signed_certs_openssl_names_ssl3(doc) -> 
-    ["Test all dsa ssl cipher suites in ssl3"];
-       
-ciphers_rsa_signed_certs_openssl_names_ssl3(suite) -> 
-    [];
-
-ciphers_rsa_signed_certs_openssl_names_ssl3(Config) when is_list(Config) ->
-    Version = ssl_record:protocol_version({3,0}),
-    Ciphers = ssl_test_lib:openssl_rsa_suites(),
-    run_suites(Ciphers, Version, Config, rsa).
-
-
 ciphers_dsa_signed_certs(doc) -> 
     ["Test all dsa ssl cipher suites in highest support ssl/tls version"];
        
@@ -1780,24 +1800,9 @@ ciphers_dsa_signed_certs(Config) when is_list(Config) ->
 	ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
 
     Ciphers = ssl_test_lib:dsa_suites(),
-    test_server:format("tls1 erlang cipher suites ~p~n", [Ciphers]),
+    test_server:format("~p erlang cipher suites ~p~n", [Version, Ciphers]),
     run_suites(Ciphers, Version, Config, dsa).
 
-ciphers_dsa_signed_certs_ssl3(doc) -> 
-    ["Test all dsa ssl cipher suites in ssl3"];
-       
-ciphers_dsa_signed_certs_ssl3(suite) -> 
-    [];
-
-ciphers_dsa_signed_certs_ssl3(Config) when is_list(Config) ->
-    Version = 
-	ssl_record:protocol_version({3,0}),
-
-    Ciphers = ssl_test_lib:dsa_suites(),
-    test_server:format("ssl3 erlang cipher suites ~p~n", [Ciphers]),  
-    run_suites(Ciphers, Version, Config, dsa).
-    
-
 ciphers_dsa_signed_certs_openssl_names(doc) -> 
     ["Test all dsa ssl cipher suites in highest support ssl/tls version"];
        
@@ -1812,18 +1817,6 @@ ciphers_dsa_signed_certs_openssl_names(Config) when is_list(Config) ->
     test_server:format("tls1 openssl cipher suites ~p~n", [Ciphers]),
     run_suites(Ciphers, Version, Config, dsa).
 
-
-ciphers_dsa_signed_certs_openssl_names_ssl3(doc) -> 
-    ["Test all dsa ssl cipher suites in ssl3"];
-       
-ciphers_dsa_signed_certs_openssl_names_ssl3(suite) -> 
-    [];
-
-ciphers_dsa_signed_certs_openssl_names_ssl3(Config) when is_list(Config) ->
-    Version = ssl_record:protocol_version({3,0}),
-    Ciphers = ssl_test_lib:openssl_dsa_suites(),
-    run_suites(Ciphers, Version, Config, dsa).
-
 anonymous_cipher_suites(doc)->
     ["Test the anonymous ciphersuites"];
 anonymous_cipher_suites(suite) ->
@@ -2087,7 +2080,9 @@ reuse_session_expired(Config) when is_list(Config) ->
     Server ! listen,
 
     %% Make sure session is unregistered due to expiration
-    test_server:sleep((?EXPIRE+1) * 1000),
+    test_server:sleep((?EXPIRE+1)),
+    [{session_id, Id} |_] = SessionInfo,
+    make_sure_expired(Hostname, Port, Id),
     
     Client2 =
 	ssl_test_lib:start_client([{node, ClientNode}, 
@@ -2106,6 +2101,22 @@ reuse_session_expired(Config) when is_list(Config) ->
     ssl_test_lib:close(Client1),
     ssl_test_lib:close(Client2).
 
+make_sure_expired(Host, Port, Id) ->
+    {status, _, _, StatusInfo} = sys:get_status(whereis(ssl_manager)),
+    [_, _,_, _, Prop] = StatusInfo,
+    State = ssl_test_lib:state(Prop),
+    Cache = element(2, State),
+    case ssl_session_cache:lookup(Cache, {{Host, Port}, Id}) of
+	undefined ->
+	    ok;
+	#session{is_resumable = false} ->
+	    ok;
+	_ ->
+	    test_server:sleep(100),
+	    make_sure_expired(Host, Port, Id)
+    end.
+
+
 %%--------------------------------------------------------------------
 server_does_not_want_to_reuse_session(doc) -> 
     ["Test reuse of sessions (short handshake)"];
@@ -3912,7 +3923,7 @@ recv_error_handling(Config) when is_list(Config) ->
 					  {mfa, {?MODULE, recv_close, []}},
 					 {options, [{active, false} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
-    {Client, #sslsocket{pid=Pid} = SslSocket} = ssl_test_lib:start_client([return_socket,
+    {_Client, #sslsocket{} = SslSocket} = ssl_test_lib:start_client([return_socket,
 									   {node, ClientNode}, {port, Port},
 									   {host, Hostname},
 									   {from, self()},
diff --git a/lib/ssl/test/ssl_packet_SUITE.erl b/lib/ssl/test/ssl_packet_SUITE.erl
index 593b1fda5e..9238dcadf9 100644
--- a/lib/ssl/test/ssl_packet_SUITE.erl
+++ b/lib/ssl/test/ssl_packet_SUITE.erl
@@ -169,6 +169,7 @@ groups() ->
 		    header_decode_two_bytes_two_sent]}].
 
 init_per_group(header, Config) ->
+    %% Does not work when N < 2 due to rizzo/duong countermeasure
     case ssl_record:highest_protocol_version(ssl_record:supported_protocol_versions()) of
 	{3, N} when N < 2 ->
 	    {skip, ""};
diff --git a/lib/ssl/test/ssl_payload_SUITE.erl b/lib/ssl/test/ssl_payload_SUITE.erl
index 02b5516e35..9633942ac3 100644
--- a/lib/ssl/test/ssl_payload_SUITE.erl
+++ b/lib/ssl/test/ssl_payload_SUITE.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2011. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2012. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -103,22 +103,49 @@ end_per_testcase(_TestCase, Config) ->
 suite() -> [{ct_hooks,[ts_install_cth]}].
 
 all() -> 
+    [
+     {group, 'tlsv1.2'},
+     {group, 'tlsv1.1'},
+     {group, 'tlsv1'},
+     {group, 'sslv3'}
+    ].
+
+groups() ->
+    [
+     {'tlsv1.2', [], payload_tests()},
+     {'tlsv1.1', [], payload_tests()},
+     {'tlsv1', [], payload_tests()},
+     {'sslv3', [], payload_tests()}
+    ].
+
+payload_tests() ->
     [server_echos_passive_small,
      server_echos_active_once_small,
-     server_echos_active_small, client_echos_passive_small,
+     server_echos_active_small,
+     client_echos_passive_small,
      client_echos_active_once_small,
-     client_echos_active_small, server_echos_passive_big,
-     server_echos_active_once_big, server_echos_active_big,
-     client_echos_passive_big, client_echos_active_once_big,
-     client_echos_active_big, server_echos_passive_huge,
-     server_echos_active_once_huge, server_echos_active_huge,
+     client_echos_active_small,
+     server_echos_passive_big,
+     server_echos_active_once_big,
+     server_echos_active_big,
+     client_echos_passive_big,
+     client_echos_active_once_big,
+     client_echos_active_big,
+     server_echos_passive_huge,
+     server_echos_active_once_huge,
+     server_echos_active_huge,
      client_echos_passive_huge,
-     client_echos_active_once_huge, client_echos_active_huge].
+     client_echos_active_once_huge,
+     client_echos_active_huge].
 
-groups() -> 
-    [].
 
-init_per_group(_GroupName, Config) ->
+init_per_group(GroupName, Config) ->
+    case ssl_test_lib:is_tls_version(GroupName) of
+	true ->
+	    ssl_test_lib:init_tls_version(GroupName);
+	_ ->
+	    ssl:start()
+    end,
     Config.
 
 end_per_group(_GroupName, Config) ->
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index fa8a1826f2..905801fe3d 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2011. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2012. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -708,3 +708,20 @@ state([{data,[{"StateData", State}]} | _]) ->
     State;
 state([_ | Rest]) ->
     state(Rest).
+
+is_tls_version('tlsv1.2') ->
+    true;
+is_tls_version('tlsv1.1') ->
+    true;
+is_tls_version('tlsv1') ->
+    true;
+is_tls_version('sslv3') ->
+    true;
+is_tls_version(_) ->
+    false.
+
+init_tls_version(Version) ->
+    ssl:stop(),
+    application:load(ssl),
+    application:set_env(ssl, protocol_version, Version),
+    ssl:start().
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index 72090c1db0..e5f8d4ae4e 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -106,8 +106,7 @@ init_per_testcase(TestCase, Config0) ->
 
 special_init(TestCase, Config) 
   when TestCase == erlang_client_openssl_server_renegotiate;
-       TestCase == erlang_client_openssl_server_no_wrap_sequence_number;
-       TestCase == erlang_server_openssl_client_no_wrap_sequence_number ->
+       TestCase == erlang_client_openssl_server_no_wrap_sequence_number  ->
     check_sane_openssl_renegotaite(Config);
 
 special_init(ssl2_erlang_server_openssl_client, Config) ->
@@ -153,37 +152,59 @@ end_per_testcase(_, Config) ->
 suite() -> [{ct_hooks,[ts_install_cth]}].
 
 all() -> 
-    [erlang_client_openssl_server,
+    [
+     {group, basic},
+     {group, 'tlsv1.2'},
+     {group, 'tlsv1.1'},
+     {group, 'tlsv1'},
+     {group, 'sslv3'}
+    ].
+
+groups() ->
+    [{basic, [], basic_tests()},
+     {'tlsv1.2', [], all_versions_tests()},
+     {'tlsv1.1', [], all_versions_tests()},
+     {'tlsv1', [], all_versions_tests()},
+     {'sslv3', [], all_versions_tests()}].
+
+basic_tests() ->
+    [basic_erlang_client_openssl_server,
+     basic_erlang_server_openssl_client,
+     expired_session].
+
+all_versions_tests() ->
+    [
+     erlang_client_openssl_server,
      erlang_server_openssl_client,
-     tls1_erlang_client_openssl_server_dsa_cert,
-     tls1_erlang_server_openssl_client_dsa_cert,
-     ssl3_erlang_client_openssl_server_dsa_cert,
-     ssl3_erlang_server_openssl_client_dsa_cert,
+     erlang_client_openssl_server_dsa_cert,
+     erlang_server_openssl_client_dsa_cert,
      erlang_server_openssl_client_reuse_session,
      erlang_client_openssl_server_renegotiate,
      erlang_client_openssl_server_no_wrap_sequence_number,
      erlang_server_openssl_client_no_wrap_sequence_number,
      erlang_client_openssl_server_no_server_ca_cert,
-     ssl3_erlang_client_openssl_server,
-     ssl3_erlang_server_openssl_client,
-     ssl3_erlang_client_openssl_server_client_cert,
-     ssl3_erlang_server_openssl_client_client_cert,
-     ssl3_erlang_server_erlang_client_client_cert,
-     tls1_erlang_client_openssl_server,
-     tls1_erlang_server_openssl_client,
-     tls1_erlang_client_openssl_server_client_cert,
-     tls1_erlang_server_openssl_client_client_cert,
-     tls1_erlang_server_erlang_client_client_cert,
-     ciphers_rsa_signed_certs, ciphers_dsa_signed_certs,
+     erlang_client_openssl_server_client_cert,
+     erlang_server_openssl_client_client_cert,
+     ciphers_rsa_signed_certs,
+     ciphers_dsa_signed_certs,
      erlang_client_bad_openssl_server,
-     expired_session,
-     ssl2_erlang_server_openssl_client].
+     ssl2_erlang_server_openssl_client
+    ].
 
-groups() -> 
-    [].
-
-init_per_group(_GroupName, Config) ->
-    Config.
+init_per_group(GroupName, Config) ->
+    case ssl_test_lib:is_tls_version(GroupName) of
+	true ->
+	    case check_sane_openssl_version(GroupName) of
+		true ->
+		    ssl_test_lib:init_tls_version(GroupName),
+		    Config;
+		false ->
+		    {skip, openssl_does_not_support_version}
+	    end;
+	_ ->
+	    ssl:start(),
+	    Config
+    end.
 
 end_per_group(_GroupName, Config) ->
     Config.
@@ -191,12 +212,11 @@ end_per_group(_GroupName, Config) ->
 
 %% Test cases starts here.
 %%--------------------------------------------------------------------
-
-erlang_client_openssl_server(doc) ->
+basic_erlang_client_openssl_server(doc) ->
     ["Test erlang client with openssl server"];
-erlang_client_openssl_server(suite) ->
+basic_erlang_client_openssl_server(suite) ->
     [];
-erlang_client_openssl_server(Config) when is_list(Config) ->
+basic_erlang_client_openssl_server(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ServerOpts = ?config(server_opts, Config),  
     ClientOpts = ?config(client_opts, Config),  
@@ -208,8 +228,8 @@ erlang_client_openssl_server(Config) when is_list(Config) ->
     Port = ssl_test_lib:inet_port(node()),
     CertFile = proplists:get_value(certfile, ServerOpts),
     KeyFile = proplists:get_value(keyfile, ServerOpts),
-   
-    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
+
+    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++
 	" -cert " ++ CertFile  ++ " -key " ++ KeyFile, 
     
     test_server:format("openssl cmd: ~p~n", [Cmd]),
@@ -234,13 +254,12 @@ erlang_client_openssl_server(Config) when is_list(Config) ->
     process_flag(trap_exit, false),
     ok.
 
-
 %%--------------------------------------------------------------------    
-erlang_server_openssl_client(doc) ->
+basic_erlang_server_openssl_client(doc) ->
     ["Test erlang server with openssl client"];
-erlang_server_openssl_client(suite) ->
+basic_erlang_server_openssl_client(suite) ->
     [];
-erlang_server_openssl_client(Config) when is_list(Config) ->
+basic_erlang_server_openssl_client(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ServerOpts = ?config(server_opts, Config),  
 
@@ -253,8 +272,8 @@ erlang_server_openssl_client(Config) when is_list(Config) ->
 			   {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
 			   {options, ServerOpts}]),
     Port = ssl_test_lib:inet_port(Server),
-    
-    Cmd = "openssl s_client -port " ++ integer_to_list(Port)  ++ 
+
+    Cmd = "openssl s_client -port " ++ integer_to_list(Port) ++
 	" -host localhost",
 
     test_server:format("openssl cmd: ~p~n", [Cmd]),
@@ -269,30 +288,26 @@ erlang_server_openssl_client(Config) when is_list(Config) ->
     close_port(OpenSslPort),
     process_flag(trap_exit, false),
     ok.
-
-%%-------------------------------------------------------------------- 
-
-tls1_erlang_client_openssl_server_dsa_cert(doc) ->
-    ["Test erlang server with openssl client"];
-tls1_erlang_client_openssl_server_dsa_cert(suite) ->
+%%--------------------------------------------------------------------
+erlang_client_openssl_server(doc) ->
+    ["Test erlang client with openssl server"];
+erlang_client_openssl_server(suite) ->
     [];
-tls1_erlang_client_openssl_server_dsa_cert(Config) when is_list(Config) ->
+erlang_client_openssl_server(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ClientOpts = ?config(client_dsa_opts, Config),  
-    ServerOpts = ?config(server_dsa_opts, Config),  
+    ServerOpts = ?config(server_opts, Config),
+    ClientOpts = ?config(client_opts, Config),
 
     {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
-  
+
     Data = "From openssl to erlang",
 
     Port = ssl_test_lib:inet_port(node()),
-    CaCertFile =  proplists:get_value(cacertfile, ServerOpts),
     CertFile = proplists:get_value(certfile, ServerOpts),
     KeyFile = proplists:get_value(keyfile, ServerOpts),
-   
-    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
-	" -cert " ++ CertFile ++ " -CAfile " ++ CaCertFile  
-	++ " -key " ++ KeyFile ++ " -Verify 2 -tls1 -msg", 
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++  version_flag(Version) ++
+	" -cert " ++ CertFile  ++ " -key " ++ KeyFile,
     
     test_server:format("openssl cmd: ~p~n", [Cmd]),
 
@@ -306,44 +321,39 @@ tls1_erlang_client_openssl_server_dsa_cert(Config) when is_list(Config) ->
 					{mfa, {?MODULE, 
 					       erlang_ssl_receive, [Data]}},
 					{options, ClientOpts}]),
-
     port_command(OpensslPort, Data),
     
-    ssl_test_lib:check_result(Client, ok), 
-   
+    ssl_test_lib:check_result(Client, ok),
+
     %% Clean close down!   Server needs to be closed first !!
     close_port(OpensslPort),
     ssl_test_lib:close(Client),
     process_flag(trap_exit, false),
     ok.
 
-%%-------------------------------------------------------------------- 
 
-tls1_erlang_server_openssl_client_dsa_cert(doc) ->
+%%--------------------------------------------------------------------
+erlang_server_openssl_client(doc) ->
     ["Test erlang server with openssl client"];
-tls1_erlang_server_openssl_client_dsa_cert(suite) ->
+erlang_server_openssl_client(suite) ->
     [];
-tls1_erlang_server_openssl_client_dsa_cert(Config) when is_list(Config) ->
+erlang_server_openssl_client(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
-    ClientOpts = ?config(client_dsa_opts, Config),
-    ServerOpts = ?config(server_dsa_verify_opts, Config),  
+    ServerOpts = ?config(server_opts, Config),
 
     {_, ServerNode, _} = ssl_test_lib:run_where(Config),
     
     Data = "From openssl to erlang",
-    CaCertFile =  proplists:get_value(cacertfile, ClientOpts),
-    CertFile = proplists:get_value(certfile, ClientOpts),
-    KeyFile = proplists:get_value(keyfile, ClientOpts),
-    
+
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
 					{from, self()}, 
 			   {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
 			   {options, ServerOpts}]),
     Port = ssl_test_lib:inet_port(Server),
-    
-    Cmd = "openssl s_client -port " ++ integer_to_list(Port)  ++ 
-	" -host localhost " ++	" -cert " ++ CertFile ++ " -CAfile " ++ CaCertFile  
-	++ " -key " ++ KeyFile ++ " -tls1 -msg",
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+
+    Cmd = "openssl s_client -port " ++ integer_to_list(Port)  ++ version_flag(Version) ++
+	" -host localhost",
 
     test_server:format("openssl cmd: ~p~n", [Cmd]),
     
@@ -351,7 +361,7 @@ tls1_erlang_server_openssl_client_dsa_cert(Config) when is_list(Config) ->
     port_command(OpenSslPort, Data),
     
     ssl_test_lib:check_result(Server, ok),
-    
+
     %% Clean close down!   Server needs to be closed first !!
     ssl_test_lib:close(Server),
     close_port(OpenSslPort),
@@ -360,11 +370,11 @@ tls1_erlang_server_openssl_client_dsa_cert(Config) when is_list(Config) ->
 
 %%-------------------------------------------------------------------- 
 
-ssl3_erlang_client_openssl_server_dsa_cert(doc) ->
+erlang_client_openssl_server_dsa_cert(doc) ->
     ["Test erlang server with openssl client"];
-ssl3_erlang_client_openssl_server_dsa_cert(suite) ->
+erlang_client_openssl_server_dsa_cert(suite) ->
     [];
-ssl3_erlang_client_openssl_server_dsa_cert(Config) when is_list(Config) ->
+erlang_client_openssl_server_dsa_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ClientOpts = ?config(client_dsa_opts, Config),  
     ServerOpts = ?config(server_dsa_opts, Config),  
@@ -377,10 +387,11 @@ ssl3_erlang_client_openssl_server_dsa_cert(Config) when is_list(Config) ->
     CaCertFile =  proplists:get_value(cacertfile, ServerOpts),
     CertFile = proplists:get_value(certfile, ServerOpts),
     KeyFile = proplists:get_value(keyfile, ServerOpts),
-   
-    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+
+    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++  version_flag(Version) ++
 	" -cert " ++ CertFile ++ " -CAfile " ++ CaCertFile  
-	++ " -key " ++ KeyFile ++ " -Verify 2 -ssl3 -msg", 
+	++ " -key " ++ KeyFile ++ " -Verify 2 -msg",
     
     test_server:format("openssl cmd: ~p~n", [Cmd]),
 
@@ -404,49 +415,46 @@ ssl3_erlang_client_openssl_server_dsa_cert(Config) when is_list(Config) ->
     ssl_test_lib:close(Client),
     process_flag(trap_exit, false),
     ok.
-
-%%-------------------------------------------------------------------- 
-
-ssl3_erlang_server_openssl_client_dsa_cert(doc) ->
+%%--------------------------------------------------------------------
+erlang_server_openssl_client_dsa_cert(doc) ->
     ["Test erlang server with openssl client"];
-ssl3_erlang_server_openssl_client_dsa_cert(suite) ->
+erlang_server_openssl_client_dsa_cert(suite) ->
     [];
-ssl3_erlang_server_openssl_client_dsa_cert(Config) when is_list(Config) ->
+erlang_server_openssl_client_dsa_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ClientOpts = ?config(client_dsa_opts, Config),
-    ServerOpts = ?config(server_dsa_verify_opts, Config),  
+    ServerOpts = ?config(server_dsa_verify_opts, Config),
 
     {_, ServerNode, _} = ssl_test_lib:run_where(Config),
-    
+
     Data = "From openssl to erlang",
     CaCertFile =  proplists:get_value(cacertfile, ClientOpts),
     CertFile = proplists:get_value(certfile, ClientOpts),
     KeyFile = proplists:get_value(keyfile, ClientOpts),
-    
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-			   {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
-			   {options, ServerOpts}]),
+
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+                                       {from, self()},
+                          {mfa, {?MODULE, erlang_ssl_receive, [Data]}},
+                          {options, ServerOpts}]),
     Port = ssl_test_lib:inet_port(Server),
-    
-    Cmd = "openssl s_client -port " ++ integer_to_list(Port)  ++ 
-	" -host localhost " ++	" -cert " ++ CertFile ++ " -CAfile " ++ CaCertFile  
-	++ " -key " ++ KeyFile ++ " -ssl3 -msg",
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+    Cmd = "openssl s_client -port " ++ integer_to_list(Port)  ++ version_flag(Version) ++
+       " -host localhost " ++  " -cert " ++ CertFile ++ " -CAfile " ++ CaCertFile
+       ++ " -key " ++ KeyFile ++ " -msg",
 
     test_server:format("openssl cmd: ~p~n", [Cmd]),
-    
-    OpenSslPort =  open_port({spawn, Cmd}, [stderr_to_stdout]), 
+
+    OpenSslPort =  open_port({spawn, Cmd}, [stderr_to_stdout]),
     port_command(OpenSslPort, Data),
-    
+
     ssl_test_lib:check_result(Server, ok),
-    
+
     %% Clean close down!   Server needs to be closed first !!
     ssl_test_lib:close(Server),
     close_port(OpenSslPort),
     process_flag(trap_exit, false),
     ok.
 
-
 %%-------------------------------------------------------------------- 
 
 erlang_server_openssl_client_reuse_session(doc) ->
@@ -468,8 +476,8 @@ erlang_server_openssl_client_reuse_session(Config) when is_list(Config) ->
 			   {reconnect_times, 5},		
 			   {options, ServerOpts}]),
     Port = ssl_test_lib:inet_port(Server),
-    
-    Cmd = "openssl s_client -port " ++ integer_to_list(Port)  ++ 
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+    Cmd = "openssl s_client -port " ++ integer_to_list(Port)  ++ version_flag(Version) ++
 	" -host localhost -reconnect",
 
     test_server:format("openssl cmd: ~p~n", [Cmd]),
@@ -505,8 +513,9 @@ erlang_client_openssl_server_renegotiate(Config) when is_list(Config) ->
     Port = ssl_test_lib:inet_port(node()),
     CertFile = proplists:get_value(certfile, ServerOpts),
     KeyFile = proplists:get_value(keyfile, ServerOpts),
-   
-    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+
+    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ version_flag(Version) ++
 	" -cert " ++ CertFile ++ " -key " ++ KeyFile ++ " -msg", 
     
     test_server:format("openssl cmd: ~p~n", [Cmd]),
@@ -556,8 +565,8 @@ erlang_client_openssl_server_no_wrap_sequence_number(Config) when is_list(Config
     Port = ssl_test_lib:inet_port(node()),
     CertFile = proplists:get_value(certfile, ServerOpts),
     KeyFile = proplists:get_value(keyfile, ServerOpts),
-   
-    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ version_flag(Version) ++
 	" -cert " ++ CertFile ++ " -key " ++ KeyFile ++ " -msg", 
     
     test_server:format("openssl cmd: ~p~n", [Cmd]),
@@ -606,8 +615,8 @@ erlang_server_openssl_client_no_wrap_sequence_number(Config) when is_list(Config
 					       trigger_renegotiate, [[Data, N+2]]}},
 					{options, [{renegotiate_at, N}, {reuse_sessions, false} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
-    
-    Cmd = "openssl s_client -port " ++ integer_to_list(Port)  ++ 
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+    Cmd = "openssl s_client -port " ++ integer_to_list(Port)  ++ version_flag(Version) ++
 	" -host localhost -msg",
 
     test_server:format("openssl cmd: ~p~n", [Cmd]),
@@ -643,8 +652,8 @@ erlang_client_openssl_server_no_server_ca_cert(Config) when is_list(Config) ->
     Port = ssl_test_lib:inet_port(node()),
     CertFile = proplists:get_value(certfile, ServerOpts),
     KeyFile = proplists:get_value(keyfile, ServerOpts),
-   
-    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ version_flag(Version) ++
 	" -cert " ++ CertFile ++ " -key " ++ KeyFile ++ " -msg", 
     
     test_server:format("openssl cmd: ~p~n", [Cmd]),
@@ -671,85 +680,11 @@ erlang_client_openssl_server_no_server_ca_cert(Config) when is_list(Config) ->
     ok.
 
 %%--------------------------------------------------------------------
-ssl3_erlang_client_openssl_server(doc) ->
-    ["Test erlang client with openssl server"];
-ssl3_erlang_client_openssl_server(suite) ->
-    [];
-ssl3_erlang_client_openssl_server(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
-    ServerOpts = ?config(server_opts, Config),  
-    ClientOpts = ?config(client_opts, Config),  
-
-    {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
-    
-    Port = ssl_test_lib:inet_port(node()),
-    CertFile = proplists:get_value(certfile, ServerOpts),
-    KeyFile = proplists:get_value(keyfile, ServerOpts),
-   
-    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
-	" -cert " ++ CertFile ++ " -key " ++ KeyFile ++ " -ssl3", 
-    
-    test_server:format("openssl cmd: ~p~n", [Cmd]),
-
-    OpensslPort =  open_port({spawn, Cmd}, [stderr_to_stdout]), 
-
-    wait_for_openssl_server(),
-
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, 
-					       connection_info, [sslv3]}},
-					{options, 
-					 [{versions, [sslv3]} | ClientOpts]}]),
-    ssl_test_lib:check_result(Client, ok),
-
-    %% Clean close down!   Server needs to be closed first !!
-    close_port(OpensslPort),
-    ssl_test_lib:close(Client),
-    process_flag(trap_exit, false),
-    ok.
-
-%%--------------------------------------------------------------------
- 
-ssl3_erlang_server_openssl_client(doc) ->
-    ["Test erlang server with openssl client"];
-ssl3_erlang_server_openssl_client(suite) ->
-    [];
-ssl3_erlang_server_openssl_client(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
-    ServerOpts = ?config(server_opts, Config),  
-    
-    {_, ServerNode, _} = ssl_test_lib:run_where(Config),
-    
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{mfa, 
-					 {?MODULE, connection_info, [sslv3]}},
-					{options, 
-					 [{versions, [sslv3]} | ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    
-    Cmd = "openssl s_client -port " ++ integer_to_list(Port)  ++ 
-	" -host localhost -ssl3",
-
-    test_server:format("openssl cmd: ~p~n", [Cmd]),
-    
-    OpenSslPort =  open_port({spawn, Cmd}, [stderr_to_stdout]), 
-
-    ssl_test_lib:check_result(Server, ok),
-    %% Clean close down!   Server needs to be closed first !!
-    ssl_test_lib:close(Server),
-    close_port(OpenSslPort),
-    process_flag(trap_exit, false),
-    ok.
-
-%%--------------------------------------------------------------------
-ssl3_erlang_client_openssl_server_client_cert(doc) ->
+erlang_client_openssl_server_client_cert(doc) ->
     ["Test erlang client with openssl server when client sends cert"];
-ssl3_erlang_client_openssl_server_client_cert(suite) ->
+erlang_client_openssl_server_client_cert(suite) ->
     [];
-ssl3_erlang_client_openssl_server_client_cert(Config) when is_list(Config) ->
+erlang_client_openssl_server_client_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ServerOpts = ?config(server_verification_opts, Config),  
     ClientOpts = ?config(client_verification_opts, Config),  
@@ -762,10 +697,10 @@ ssl3_erlang_client_openssl_server_client_cert(Config) when is_list(Config) ->
     CertFile = proplists:get_value(certfile, ServerOpts),
     CaCertFile = proplists:get_value(cacertfile, ServerOpts),
     KeyFile = proplists:get_value(keyfile, ServerOpts),
-   
-    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ version_flag(Version) ++
 	" -cert " ++ CertFile ++ " -CAfile " ++ CaCertFile 
-	++ " -key " ++ KeyFile ++ " -Verify 2 -ssl3", 
+	++ " -key " ++ KeyFile ++ " -Verify 2",
     
     test_server:format("openssl cmd: ~p~n", [Cmd]),
 
@@ -791,11 +726,11 @@ ssl3_erlang_client_openssl_server_client_cert(Config) when is_list(Config) ->
 
 %%--------------------------------------------------------------------  
 
-ssl3_erlang_server_openssl_client_client_cert(doc) ->
+erlang_server_openssl_client_client_cert(doc) ->
     ["Test erlang server with openssl client when client sends cert"];
-ssl3_erlang_server_openssl_client_client_cert(suite) ->
+erlang_server_openssl_client_client_cert(suite) ->
     [];
-ssl3_erlang_server_openssl_client_client_cert(Config) when is_list(Config) ->
+erlang_server_openssl_client_client_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ServerOpts = ?config(server_verification_opts, Config),  
     ClientOpts = ?config(client_verification_opts, Config),  
@@ -816,10 +751,10 @@ ssl3_erlang_server_openssl_client_client_cert(Config) when is_list(Config) ->
     CaCertFile = proplists:get_value(cacertfile, ClientOpts),
     CertFile = proplists:get_value(certfile, ClientOpts),
     KeyFile = proplists:get_value(keyfile, ClientOpts),
-    
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
     Cmd = "openssl s_client -cert " ++ CertFile  ++ " -CAfile " ++ CaCertFile 
-	++ " -key " ++ KeyFile ++ " -port " ++ integer_to_list(Port)  ++ 
-	" -host localhost -ssl3",
+	++ " -key " ++ KeyFile ++ " -port " ++ integer_to_list(Port)  ++ version_flag(Version) ++
+	" -host localhost",
 
     test_server:format("openssl cmd: ~p~n", [Cmd]),
     
@@ -837,15 +772,15 @@ ssl3_erlang_server_openssl_client_client_cert(Config) when is_list(Config) ->
 
 %%--------------------------------------------------------------------  
 
-ssl3_erlang_server_erlang_client_client_cert(doc) ->
+erlang_server_erlang_client_client_cert(doc) ->
     ["Test erlang server with erlang client when client sends cert"];
-ssl3_erlang_server_erlang_client_client_cert(suite) ->
+erlang_server_erlang_client_client_cert(suite) ->
     [];
-ssl3_erlang_server_erlang_client_client_cert(Config) when is_list(Config) ->
+erlang_server_erlang_client_client_cert(Config) when is_list(Config) ->
     process_flag(trap_exit, true),
     ServerOpts = ?config(server_verification_opts, Config),  
     ClientOpts = ?config(client_verification_opts, Config),  
-
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     
     Data = "From erlang to erlang",
@@ -867,7 +802,7 @@ ssl3_erlang_server_erlang_client_client_cert(Config) when is_list(Config) ->
 					%% Due to 1/n-1 splitting countermeasure Rizzo/Duong-Beast
 					{mfa, {ssl, send, [Data]}},
 					{options, 
-					 [{versions, [sslv3]} | ClientOpts]}]),
+					 [{versions, [Version]} | ClientOpts]}]),
     
     ssl_test_lib:check_result(Server, ok, Client, ok),
     
@@ -875,215 +810,8 @@ ssl3_erlang_server_erlang_client_client_cert(Config) when is_list(Config) ->
     ssl_test_lib:close(Client),
     process_flag(trap_exit, false),
     ok.
-
-
-%%--------------------------------------------------------------------
-
-tls1_erlang_client_openssl_server(doc) ->
-    ["Test erlang client with openssl server"];
-tls1_erlang_client_openssl_server(suite) ->
-    [];
-tls1_erlang_client_openssl_server(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
-    ServerOpts = ?config(server_opts, Config),  
-    ClientOpts = ?config(client_opts, Config),  
-
-
-    test_server:format("Server Opts", [ServerOpts]),
-
-    {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
-    
-    Port = ssl_test_lib:inet_port(node()),
-    CertFile = proplists:get_value(certfile, ServerOpts),
-    KeyFile = proplists:get_value(keyfile, ServerOpts),
-
-    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
-	" -cert " ++ CertFile ++ " -key " ++ KeyFile ++ " -tls1", 
-    
-    test_server:format("openssl cmd: ~p~n", [Cmd]),
-
-    OpensslPort =  open_port({spawn, Cmd}, [stderr_to_stdout]), 
-
-    wait_for_openssl_server(),
-    
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, 
-					       connection_info, [tlsv1]}},
-					{options, 
-					 [{versions, [tlsv1]} | ClientOpts]}]),
-    
-    ssl_test_lib:check_result(Client, ok),
-
-    %% Clean close down!   Server needs to be closed first !!
-    close_port(OpensslPort),
-    ssl_test_lib:close(Client),
-    process_flag(trap_exit, false),
-    ok.
-
-%%--------------------------------------------------------------------
-
-tls1_erlang_server_openssl_client(doc) ->
-    ["Test erlang server with openssl client"];
-tls1_erlang_server_openssl_client(suite) ->
-    [];
-tls1_erlang_server_openssl_client(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
-    ServerOpts = ?config(server_opts, Config),  
-
-    {_, ServerNode, _} = ssl_test_lib:run_where(Config),
-    
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{mfa, 
-					 {?MODULE, connection_info, [tlsv1]}},
-					{options, 
-					 [{versions, [tlsv1]} | ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-
-    Cmd = "openssl s_client -port " ++ integer_to_list(Port)  ++ 
-	" -host localhost -tls1",
-
-    test_server:format("openssl cmd: ~p~n", [Cmd]),
-    
-    OpenSslPort =  open_port({spawn, Cmd}, [stderr_to_stdout]), 
-     
-    ssl_test_lib:check_result(Server, ok),
-    
-    %% Clean close down!   Server needs to be closed first !!
-    ssl_test_lib:close(Server),
-    close_port(OpenSslPort),
-    process_flag(trap_exit, false),
-    ok.
-
-%%--------------------------------------------------------------------
-
-tls1_erlang_client_openssl_server_client_cert(doc) ->
-    ["Test erlang client with openssl server when client sends cert"];
-tls1_erlang_client_openssl_server_client_cert(suite) ->
-    [];
-tls1_erlang_client_openssl_server_client_cert(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
-    ServerOpts = ?config(server_verification_opts, Config),  
-    ClientOpts = ?config(client_verification_opts, Config),  
-
-    {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
-    
-    Data = "From openssl to erlang",
-    
-    Port = ssl_test_lib:inet_port(node()),
-    CaCertFile = proplists:get_value(cacertfile, ServerOpts),
-    CertFile = proplists:get_value(certfile, ServerOpts),
-    KeyFile = proplists:get_value(keyfile, ServerOpts),
-   
-    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
-	" -cert " ++ CertFile ++ " -CAfile " ++ CaCertFile 
-	++ " -key " ++ KeyFile ++ " -Verify 2 -tls1", 
-    
-    test_server:format("openssl cmd: ~p~n", [Cmd]),
-
-    OpensslPort =  open_port({spawn, Cmd}, [stderr_to_stdout]), 
-
-    wait_for_openssl_server(),
-
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, 
-					       erlang_ssl_receive, [Data]}},
-					{options, ClientOpts}]),
-    port_command(OpensslPort, Data),
-    
-    ssl_test_lib:check_result(Client, ok),
-  
-    %% Clean close down!   Server needs to be closed first !!
-    close_port(OpensslPort),
-    ssl_test_lib:close(Client),
-    process_flag(trap_exit, false),
-    ok.
-
 %%--------------------------------------------------------------------  
 
-tls1_erlang_server_openssl_client_client_cert(doc) ->
-    ["Test erlang server with openssl client when client sends cert"];
-tls1_erlang_server_openssl_client_client_cert(suite) ->
-    [];
-tls1_erlang_server_openssl_client_client_cert(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
-    ServerOpts = ?config(server_verification_opts, Config),  
-    ClientOpts = ?config(client_verification_opts, Config),  
-
-    {_, ServerNode, _} = ssl_test_lib:run_where(Config),
-    
-    Data = "From openssl to erlang",
-
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{mfa, {?MODULE, 
-					       erlang_ssl_receive, [Data]}},
-					{options, 
-					 [{verify , verify_peer} 
-					  | ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    
-    CaCertFile = proplists:get_value(cacertfile, ClientOpts),
-    CertFile = proplists:get_value(certfile, ClientOpts),
-    KeyFile = proplists:get_value(keyfile, ClientOpts),
-    
-    Cmd = "openssl s_client -cert " ++ CertFile ++ " -CAfile " ++ CaCertFile 
-	++ " -key " ++ KeyFile ++ " -port " ++ integer_to_list(Port)  ++ 
-	" -host localhost -tls1",
-
-    test_server:format("openssl cmd: ~p~n", [Cmd]),
-    
-    OpenSslPort =  open_port({spawn, Cmd}, [stderr_to_stdout]), 
-    port_command(OpenSslPort, Data),
-    
-    ssl_test_lib:check_result(Server, ok),
-    
-    %% Clean close down!   Server needs to be closed first !!
-    ssl_test_lib:close(Server),
-    close_port(OpenSslPort),
-    process_flag(trap_exit, false),
-    ok.
-
-%%--------------------------------------------------------------------
-tls1_erlang_server_erlang_client_client_cert(doc) ->
-    ["Test erlang server with erlang client when client sends cert"];
-tls1_erlang_server_erlang_client_client_cert(suite) ->
-    [];
-tls1_erlang_server_erlang_client_client_cert(Config) when is_list(Config) ->
-    process_flag(trap_exit, true),
-    ServerOpts = ?config(server_verification_opts, Config),  
-    ClientOpts = ?config(client_verification_opts, Config),  
-
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    
-    Data = "From erlang to erlang",
-
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{mfa, {?MODULE, 
-					       erlang_ssl_receive, [Data]}},
-					{options, 
-					 [{verify , verify_peer} 
-					  | ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {ssl, send, [Data]}},
-					{options, 
-					 [{versions, [tlsv1]} | ClientOpts]}]),
-    
-    ssl_test_lib:check_result(Server, ok, Client, ok),
-    ssl_test_lib:close(Server),
-    process_flag(trap_exit, false),
-    ok.
-%%--------------------------------------------------------------------
-
 ciphers_rsa_signed_certs(doc) -> 
     ["Test cipher suites that uses rsa certs"];
        
@@ -1190,16 +918,6 @@ cipher(CipherSuite, Version, Config, ClientOpts, ServerOpts) ->
     process_flag(trap_exit, false),
     Return.
 
-
-version_flag(tlsv1) ->
-    " -tls1 ";
-version_flag('tlsv1.1') ->
-    " -tls1_1 ";
-version_flag('tlsv1.2') ->
-    " -tls1_2 ";
-version_flag(sslv3) ->
-    " -ssl3 ".
-
 %%--------------------------------------------------------------------
 erlang_client_bad_openssl_server(doc) ->
     [""];
@@ -1215,8 +933,8 @@ erlang_client_bad_openssl_server(Config) when is_list(Config) ->
     Port = ssl_test_lib:inet_port(node()),
     CertFile = proplists:get_value(certfile, ServerOpts),
     KeyFile = proplists:get_value(keyfile, ServerOpts),
-
-    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++  version_flag(Version) ++
  	" -cert " ++ CertFile ++ " -key " ++ KeyFile ++ "",
 
     test_server:format("openssl cmd: ~p~n", [Cmd]),
@@ -1230,7 +948,7 @@ erlang_client_bad_openssl_server(Config) when is_list(Config) ->
 					 {from, self()}, 
  					{mfa, {?MODULE, server_sent_garbage, []}},
 					 {options,
-					  [{versions, [tlsv1]} | ClientOpts]}]),
+					  [{versions, [Version]} | ClientOpts]}]),
     
     %% Send garbage
     port_command(OpensslPort, ?OPENSSL_GARBAGE),
@@ -1249,7 +967,7 @@ erlang_client_bad_openssl_server(Config) when is_list(Config) ->
  					 {from, self()},
  					 {mfa, {ssl_test_lib, no_result_msg, []}},
  					 {options,
- 					  [{versions, [tlsv1]} | ClientOpts]}]),
+					  [{versions, [Version]} | ClientOpts]}]),
 
     %% Clean close down!   Server needs to be closed first !!
     close_port(OpensslPort),
@@ -1275,8 +993,8 @@ expired_session(Config) when is_list(Config) ->
     Port = ssl_test_lib:inet_port(node()),
     CertFile = proplists:get_value(certfile, ServerOpts),
     KeyFile = proplists:get_value(keyfile, ServerOpts),
-   
-    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
+
+    Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++
 	" -cert " ++ CertFile ++ " -key " ++ KeyFile ++ "", 
     
     test_server:format("openssl cmd: ~p~n", [Cmd]),
@@ -1441,15 +1159,35 @@ wait_for_openssl_server() ->
 	    %% more so than sleep!)
 	    test_server:sleep(?SLEEP)
     end.
+
+version_flag(tlsv1) ->
+    " -tls1 ";
+version_flag('tlsv1.1') ->
+    " -tls1_1 ";
+version_flag('tlsv1.2') ->
+    " -tls1_2 ";
+version_flag(sslv3) ->
+    " -ssl3 ".
 	    
+check_sane_openssl_tls_client_renegotaite(Config) ->
+    case proplists:get_value(name, ?config(tc_group_properties, Config)) of
+	Version when Version == 'tlsv1.2'; Version == 'tlsv1.1' ->
+	    case os:cmd("openssl version") of
+		"OpenSSL 1.0.1 " ++ _ ->
+		    {skip, "Known renegotiation bug in OpenSSL"};
+		_ ->
+		    Config
+	    end
+    end.
+
 check_sane_openssl_renegotaite(Config) ->
     case os:cmd("openssl version") of
 	"OpenSSL 0.9.8" ++ _ ->
-	    {skip, "Known renegotiation bug in OppenSSL"};
+	    {skip, "Known renegotiation bug in OpenSSL"};
 	"OpenSSL 0.9.7" ++ _ ->
-	    {skip, "Known renegotiation bug in OppenSSL"};
+	    {skip, "Known renegotiation bug in OpenSSL"};
 	"OpenSSL 1.0.1c" ++ _ -> 
-	    {skip, "Known renegotiation bug in OppenSSL"};
+	    {skip, "Known renegotiation bug in OpenSSL"};
 	_ ->
 	    Config
     end.
@@ -1465,7 +1203,23 @@ check_sane_openssl_sslv2(Config) ->
 check_sane_openssl_dsa(Config) ->
     case os:cmd("openssl version") of
 	"OpenSSL 1.0.1" ++ _ ->
-	    {skip, "known dsa bug in openssl"};
+	    {skip, "known dsa bug in OpenSSL"};
 	_ ->
 	    Config
     end.
+
+check_sane_openssl_version(Version) ->
+    case {Version, os:cmd("openssl version")} of
+	{_, "OpenSSL 1.0.1" ++ _} ->
+	    true;
+	{'tlsv1.2', "OpenSSL 1.0" ++ _} ->
+	    false;
+	{'tlsv1.1', "OpenSSL 1.0" ++ _} ->
+	    false;
+	{'tlsv1.2', "OpenSSL 0" ++ _} ->
+	    false;
+	{'tlsv1.1', "OpenSSL 0" ++ _} ->
+	    false;
+	{_, _} ->
+	    true
+    end.