ssl_test_ctx.h 8.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262
  1. /*
  2. * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #ifndef OSSL_TEST_SSL_TEST_CTX_H
  10. #define OSSL_TEST_SSL_TEST_CTX_H
  11. #include <openssl/conf.h>
  12. #include <openssl/ssl.h>
  13. typedef enum {
  14. SSL_TEST_SUCCESS = 0, /* Default */
  15. SSL_TEST_SERVER_FAIL,
  16. SSL_TEST_CLIENT_FAIL,
  17. SSL_TEST_INTERNAL_ERROR,
  18. /* Couldn't test resumption/renegotiation: original handshake failed. */
  19. SSL_TEST_FIRST_HANDSHAKE_FAILED
  20. } ssl_test_result_t;
  21. typedef enum {
  22. SSL_TEST_VERIFY_NONE = 0, /* Default */
  23. SSL_TEST_VERIFY_ACCEPT_ALL,
  24. SSL_TEST_VERIFY_RETRY_ONCE,
  25. SSL_TEST_VERIFY_REJECT_ALL
  26. } ssl_verify_callback_t;
  27. typedef enum {
  28. SSL_TEST_SERVERNAME_NONE = 0, /* Default */
  29. SSL_TEST_SERVERNAME_SERVER1,
  30. SSL_TEST_SERVERNAME_SERVER2,
  31. SSL_TEST_SERVERNAME_INVALID
  32. } ssl_servername_t;
  33. typedef enum {
  34. SSL_TEST_SERVERNAME_CB_NONE = 0, /* Default */
  35. SSL_TEST_SERVERNAME_IGNORE_MISMATCH,
  36. SSL_TEST_SERVERNAME_REJECT_MISMATCH,
  37. SSL_TEST_SERVERNAME_CLIENT_HELLO_IGNORE_MISMATCH,
  38. SSL_TEST_SERVERNAME_CLIENT_HELLO_REJECT_MISMATCH,
  39. SSL_TEST_SERVERNAME_CLIENT_HELLO_NO_V12
  40. } ssl_servername_callback_t;
  41. typedef enum {
  42. SSL_TEST_SESSION_TICKET_IGNORE = 0, /* Default */
  43. SSL_TEST_SESSION_TICKET_YES,
  44. SSL_TEST_SESSION_TICKET_NO,
  45. SSL_TEST_SESSION_TICKET_BROKEN /* Special test */
  46. } ssl_session_ticket_t;
  47. typedef enum {
  48. SSL_TEST_COMPRESSION_NO = 0, /* Default */
  49. SSL_TEST_COMPRESSION_YES
  50. } ssl_compression_t;
  51. typedef enum {
  52. SSL_TEST_SESSION_ID_IGNORE = 0, /* Default */
  53. SSL_TEST_SESSION_ID_YES,
  54. SSL_TEST_SESSION_ID_NO
  55. } ssl_session_id_t;
  56. typedef enum {
  57. SSL_TEST_METHOD_TLS = 0, /* Default */
  58. SSL_TEST_METHOD_DTLS,
  59. SSL_TEST_METHOD_QUIC
  60. } ssl_test_method_t;
  61. typedef enum {
  62. SSL_TEST_HANDSHAKE_SIMPLE = 0, /* Default */
  63. SSL_TEST_HANDSHAKE_RESUME,
  64. SSL_TEST_HANDSHAKE_RENEG_SERVER,
  65. SSL_TEST_HANDSHAKE_RENEG_CLIENT,
  66. SSL_TEST_HANDSHAKE_KEY_UPDATE_SERVER,
  67. SSL_TEST_HANDSHAKE_KEY_UPDATE_CLIENT,
  68. SSL_TEST_HANDSHAKE_POST_HANDSHAKE_AUTH
  69. } ssl_handshake_mode_t;
  70. typedef enum {
  71. SSL_TEST_CT_VALIDATION_NONE = 0, /* Default */
  72. SSL_TEST_CT_VALIDATION_PERMISSIVE,
  73. SSL_TEST_CT_VALIDATION_STRICT
  74. } ssl_ct_validation_t;
  75. typedef enum {
  76. SSL_TEST_CERT_STATUS_NONE = 0, /* Default */
  77. SSL_TEST_CERT_STATUS_GOOD_RESPONSE,
  78. SSL_TEST_CERT_STATUS_BAD_RESPONSE
  79. } ssl_cert_status_t;
  80. /*
  81. * Server/client settings that aren't supported by the SSL CONF library,
  82. * such as callbacks.
  83. */
  84. typedef struct {
  85. /* One of a number of predefined custom callbacks. */
  86. ssl_verify_callback_t verify_callback;
  87. /* One of a number of predefined server names use by the client */
  88. ssl_servername_t servername;
  89. /* Maximum Fragment Length extension mode */
  90. int max_fragment_len_mode;
  91. /* Supported NPN and ALPN protocols. A comma-separated list. */
  92. char *npn_protocols;
  93. char *alpn_protocols;
  94. ssl_ct_validation_t ct_validation;
  95. /* Ciphersuites to set on a renegotiation */
  96. char *reneg_ciphers;
  97. char *srp_user;
  98. char *srp_password;
  99. /* PHA enabled */
  100. int enable_pha;
  101. /* Do not send extms on renegotiation */
  102. int no_extms_on_reneg;
  103. } SSL_TEST_CLIENT_CONF;
  104. typedef struct {
  105. /* SNI callback (server-side). */
  106. ssl_servername_callback_t servername_callback;
  107. /* Supported NPN and ALPN protocols. A comma-separated list. */
  108. char *npn_protocols;
  109. char *alpn_protocols;
  110. /* Whether to set a broken session ticket callback. */
  111. int broken_session_ticket;
  112. /* Should we send a CertStatus message? */
  113. ssl_cert_status_t cert_status;
  114. /* An SRP user known to the server. */
  115. char *srp_user;
  116. char *srp_password;
  117. /* Forced PHA */
  118. int force_pha;
  119. char *session_ticket_app_data;
  120. } SSL_TEST_SERVER_CONF;
  121. typedef struct {
  122. SSL_TEST_CLIENT_CONF client;
  123. SSL_TEST_SERVER_CONF server;
  124. SSL_TEST_SERVER_CONF server2;
  125. } SSL_TEST_EXTRA_CONF;
  126. typedef struct {
  127. /*
  128. * Global test configuration. Does not change between handshakes.
  129. */
  130. /* Whether the server/client CTX should use DTLS or TLS. */
  131. ssl_test_method_t method;
  132. /* Whether to test a resumed/renegotiated handshake. */
  133. ssl_handshake_mode_t handshake_mode;
  134. /*
  135. * How much application data to exchange (default is 256 bytes).
  136. * Both peers will send |app_data_size| bytes interleaved.
  137. */
  138. int app_data_size;
  139. /* Maximum send fragment size. */
  140. int max_fragment_size;
  141. /* KeyUpdate type */
  142. int key_update_type;
  143. /*
  144. * Extra server/client configurations. Per-handshake.
  145. */
  146. /* First handshake. */
  147. SSL_TEST_EXTRA_CONF extra;
  148. /* Resumed handshake. */
  149. SSL_TEST_EXTRA_CONF resume_extra;
  150. /*
  151. * Test expectations. These apply to the LAST handshake.
  152. */
  153. /* Defaults to SUCCESS. */
  154. ssl_test_result_t expected_result;
  155. /* Alerts. 0 if no expectation. */
  156. /* See ssl.h for alert codes. */
  157. /* Alert sent by the client / received by the server. */
  158. int expected_client_alert;
  159. /* Alert sent by the server / received by the client. */
  160. int expected_server_alert;
  161. /* Negotiated protocol version. 0 if no expectation. */
  162. /* See ssl.h for protocol versions. */
  163. int expected_protocol;
  164. /*
  165. * The expected SNI context to use.
  166. * We test server-side that the server switched to the expected context.
  167. * Set by the callback upon success, so if the callback wasn't called or
  168. * terminated with an alert, the servername will match with
  169. * SSL_TEST_SERVERNAME_NONE.
  170. * Note: in the event that the servername was accepted, the client should
  171. * also receive an empty SNI extension back but we have no way of probing
  172. * client-side via the API that this was the case.
  173. */
  174. ssl_servername_t expected_servername;
  175. ssl_session_ticket_t session_ticket_expected;
  176. int compression_expected;
  177. /* The expected NPN/ALPN protocol to negotiate. */
  178. char *expected_npn_protocol;
  179. char *expected_alpn_protocol;
  180. /* Whether the second handshake is resumed or a full handshake (boolean). */
  181. int resumption_expected;
  182. /* Expected temporary key type */
  183. int expected_tmp_key_type;
  184. /* Expected server certificate key type */
  185. int expected_server_cert_type;
  186. /* Expected server signing hash */
  187. int expected_server_sign_hash;
  188. /* Expected server signature type */
  189. int expected_server_sign_type;
  190. /* Expected server CA names */
  191. STACK_OF(X509_NAME) *expected_server_ca_names;
  192. /* Expected client certificate key type */
  193. int expected_client_cert_type;
  194. /* Expected client signing hash */
  195. int expected_client_sign_hash;
  196. /* Expected client signature type */
  197. int expected_client_sign_type;
  198. /* Expected CA names for client auth */
  199. STACK_OF(X509_NAME) *expected_client_ca_names;
  200. /* Whether to use SCTP for the transport */
  201. int use_sctp;
  202. /* Whether to pre-compress server certificates */
  203. int compress_certificates;
  204. /* Enable SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG on client side */
  205. int enable_client_sctp_label_bug;
  206. /* Enable SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG on server side */
  207. int enable_server_sctp_label_bug;
  208. /* Whether to expect a session id from the server */
  209. ssl_session_id_t session_id_expected;
  210. char *expected_cipher;
  211. /* Expected Session Ticket Application Data */
  212. char *expected_session_ticket_app_data;
  213. OSSL_LIB_CTX *libctx;
  214. } SSL_TEST_CTX;
  215. const char *ssl_test_result_name(ssl_test_result_t result);
  216. const char *ssl_alert_name(int alert);
  217. const char *ssl_protocol_name(int protocol);
  218. const char *ssl_verify_callback_name(ssl_verify_callback_t verify_callback);
  219. const char *ssl_servername_name(ssl_servername_t server);
  220. const char *ssl_servername_callback_name(ssl_servername_callback_t
  221. servername_callback);
  222. const char *ssl_session_ticket_name(ssl_session_ticket_t server);
  223. const char *ssl_session_id_name(ssl_session_id_t server);
  224. const char *ssl_test_method_name(ssl_test_method_t method);
  225. const char *ssl_handshake_mode_name(ssl_handshake_mode_t mode);
  226. const char *ssl_ct_validation_name(ssl_ct_validation_t mode);
  227. const char *ssl_certstatus_name(ssl_cert_status_t cert_status);
  228. const char *ssl_max_fragment_len_name(int MFL_mode);
  229. /*
  230. * Load the test case context from |conf|.
  231. * See test/README.ssltest.md for details on the conf file format.
  232. */
  233. SSL_TEST_CTX *SSL_TEST_CTX_create(const CONF *conf, const char *test_section,
  234. OSSL_LIB_CTX *libctx);
  235. SSL_TEST_CTX *SSL_TEST_CTX_new(OSSL_LIB_CTX *libctx);
  236. void SSL_TEST_CTX_free(SSL_TEST_CTX *ctx);
  237. #endif /* OSSL_TEST_SSL_TEST_CTX_H */