bad_dtls_test.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586
  1. /*
  2. * Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * Unit test for Cisco DTLS1_BAD_VER session resume, as used by
  11. * AnyConnect VPN protocol.
  12. *
  13. * This is designed to exercise the code paths in
  14. * http://git.infradead.org/users/dwmw2/openconnect.git/blob/HEAD:/dtls.c
  15. * which have frequently been affected by regressions in DTLS1_BAD_VER
  16. * support.
  17. *
  18. * Note that unlike other SSL tests, we don't test against our own SSL
  19. * server method. Firstly because we don't have one; we *only* support
  20. * DTLS1_BAD_VER as a client. And secondly because even if that were
  21. * fixed up it's the wrong thing to test against - because if changes
  22. * are made in generic DTLS code which don't take DTLS1_BAD_VER into
  23. * account, there's plenty of scope for making those changes such that
  24. * they break *both* the client and the server in the same way.
  25. *
  26. * So we handle the server side manually. In a session resume there isn't
  27. * much to be done anyway.
  28. */
  29. #include <string.h>
  30. #include <openssl/opensslconf.h>
  31. #include <openssl/bio.h>
  32. #include <openssl/crypto.h>
  33. #include <openssl/evp.h>
  34. #include <openssl/ssl.h>
  35. #include <openssl/err.h>
  36. #include <openssl/rand.h>
  37. #include <openssl/kdf.h>
  38. #include "../ssl/packet_locl.h"
  39. #include "internal/nelem.h"
  40. #include "testutil.h"
  41. /* For DTLS1_BAD_VER packets the MAC doesn't include the handshake header */
  42. #define MAC_OFFSET (DTLS1_RT_HEADER_LENGTH + DTLS1_HM_HEADER_LENGTH)
  43. static unsigned char client_random[SSL3_RANDOM_SIZE];
  44. static unsigned char server_random[SSL3_RANDOM_SIZE];
  45. /* These are all generated locally, sized purely according to our own whim */
  46. static unsigned char session_id[32];
  47. static unsigned char master_secret[48];
  48. static unsigned char cookie[20];
  49. /* We've hard-coded the cipher suite; we know it's 104 bytes */
  50. static unsigned char key_block[104];
  51. #define mac_key (key_block + 20)
  52. #define dec_key (key_block + 40)
  53. #define enc_key (key_block + 56)
  54. static EVP_MD_CTX *handshake_md;
  55. static int do_PRF(const void *seed1, int seed1_len,
  56. const void *seed2, int seed2_len,
  57. const void *seed3, int seed3_len,
  58. unsigned char *out, int olen)
  59. {
  60. EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_TLS1_PRF, NULL);
  61. size_t outlen = olen;
  62. /* No error handling. If it all screws up, the test will fail anyway */
  63. EVP_PKEY_derive_init(pctx);
  64. EVP_PKEY_CTX_set_tls1_prf_md(pctx, EVP_md5_sha1());
  65. EVP_PKEY_CTX_set1_tls1_prf_secret(pctx, master_secret, sizeof(master_secret));
  66. EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed1, seed1_len);
  67. EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed2, seed2_len);
  68. EVP_PKEY_CTX_add1_tls1_prf_seed(pctx, seed3, seed3_len);
  69. EVP_PKEY_derive(pctx, out, &outlen);
  70. EVP_PKEY_CTX_free(pctx);
  71. return 1;
  72. }
  73. static SSL_SESSION *client_session(void)
  74. {
  75. static unsigned char session_asn1[] = {
  76. 0x30, 0x5F, /* SEQUENCE, length 0x5F */
  77. 0x02, 0x01, 0x01, /* INTEGER, SSL_SESSION_ASN1_VERSION */
  78. 0x02, 0x02, 0x01, 0x00, /* INTEGER, DTLS1_BAD_VER */
  79. 0x04, 0x02, 0x00, 0x2F, /* OCTET_STRING, AES128-SHA */
  80. 0x04, 0x20, /* OCTET_STRING, session id */
  81. #define SS_SESSID_OFS 15 /* Session ID goes here */
  82. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  83. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  84. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  85. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  86. 0x04, 0x30, /* OCTET_STRING, master secret */
  87. #define SS_SECRET_OFS 49 /* Master secret goes here */
  88. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  89. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  90. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  91. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  92. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  93. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  94. };
  95. const unsigned char *p = session_asn1;
  96. /* Copy the randomly-generated fields into the above ASN1 */
  97. memcpy(session_asn1 + SS_SESSID_OFS, session_id, sizeof(session_id));
  98. memcpy(session_asn1 + SS_SECRET_OFS, master_secret, sizeof(master_secret));
  99. return d2i_SSL_SESSION(NULL, &p, sizeof(session_asn1));
  100. }
  101. /* Returns 1 for initial ClientHello, 2 for ClientHello with cookie */
  102. static int validate_client_hello(BIO *wbio)
  103. {
  104. PACKET pkt, pkt2;
  105. long len;
  106. unsigned char *data;
  107. int cookie_found = 0;
  108. unsigned int u = 0;
  109. len = BIO_get_mem_data(wbio, (char **)&data);
  110. if (!PACKET_buf_init(&pkt, data, len))
  111. return 0;
  112. /* Check record header type */
  113. if (!PACKET_get_1(&pkt, &u) || u != SSL3_RT_HANDSHAKE)
  114. return 0;
  115. /* Version */
  116. if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)
  117. return 0;
  118. /* Skip the rest of the record header */
  119. if (!PACKET_forward(&pkt, DTLS1_RT_HEADER_LENGTH - 3))
  120. return 0;
  121. /* Check it's a ClientHello */
  122. if (!PACKET_get_1(&pkt, &u) || u != SSL3_MT_CLIENT_HELLO)
  123. return 0;
  124. /* Skip the rest of the handshake message header */
  125. if (!PACKET_forward(&pkt, DTLS1_HM_HEADER_LENGTH - 1))
  126. return 0;
  127. /* Check client version */
  128. if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)
  129. return 0;
  130. /* Store random */
  131. if (!PACKET_copy_bytes(&pkt, client_random, SSL3_RANDOM_SIZE))
  132. return 0;
  133. /* Check session id length and content */
  134. if (!PACKET_get_length_prefixed_1(&pkt, &pkt2) ||
  135. !PACKET_equal(&pkt2, session_id, sizeof(session_id)))
  136. return 0;
  137. /* Check cookie */
  138. if (!PACKET_get_length_prefixed_1(&pkt, &pkt2))
  139. return 0;
  140. if (PACKET_remaining(&pkt2)) {
  141. if (!PACKET_equal(&pkt2, cookie, sizeof(cookie)))
  142. return 0;
  143. cookie_found = 1;
  144. }
  145. /* Skip ciphers */
  146. if (!PACKET_get_net_2(&pkt, &u) || !PACKET_forward(&pkt, u))
  147. return 0;
  148. /* Skip compression */
  149. if (!PACKET_get_1(&pkt, &u) || !PACKET_forward(&pkt, u))
  150. return 0;
  151. /* Skip extensions */
  152. if (!PACKET_get_net_2(&pkt, &u) || !PACKET_forward(&pkt, u))
  153. return 0;
  154. /* Now we are at the end */
  155. if (PACKET_remaining(&pkt))
  156. return 0;
  157. /* Update handshake MAC for second ClientHello (with cookie) */
  158. if (cookie_found && !EVP_DigestUpdate(handshake_md, data + MAC_OFFSET,
  159. len - MAC_OFFSET))
  160. return 0;
  161. (void)BIO_reset(wbio);
  162. return 1 + cookie_found;
  163. }
  164. static int send_hello_verify(BIO *rbio)
  165. {
  166. static unsigned char hello_verify[] = {
  167. 0x16, /* Handshake */
  168. 0x01, 0x00, /* DTLS1_BAD_VER */
  169. 0x00, 0x00, /* Epoch 0 */
  170. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* Seq# 0 */
  171. 0x00, 0x23, /* Length */
  172. 0x03, /* Hello Verify */
  173. 0x00, 0x00, 0x17, /* Length */
  174. 0x00, 0x00, /* Seq# 0 */
  175. 0x00, 0x00, 0x00, /* Fragment offset */
  176. 0x00, 0x00, 0x17, /* Fragment length */
  177. 0x01, 0x00, /* DTLS1_BAD_VER */
  178. 0x14, /* Cookie length */
  179. #define HV_COOKIE_OFS 28 /* Cookie goes here */
  180. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  181. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  182. 0x00, 0x00, 0x00, 0x00,
  183. };
  184. memcpy(hello_verify + HV_COOKIE_OFS, cookie, sizeof(cookie));
  185. BIO_write(rbio, hello_verify, sizeof(hello_verify));
  186. return 1;
  187. }
  188. static int send_server_hello(BIO *rbio)
  189. {
  190. static unsigned char server_hello[] = {
  191. 0x16, /* Handshake */
  192. 0x01, 0x00, /* DTLS1_BAD_VER */
  193. 0x00, 0x00, /* Epoch 0 */
  194. 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, /* Seq# 1 */
  195. 0x00, 0x52, /* Length */
  196. 0x02, /* Server Hello */
  197. 0x00, 0x00, 0x46, /* Length */
  198. 0x00, 0x01, /* Seq# */
  199. 0x00, 0x00, 0x00, /* Fragment offset */
  200. 0x00, 0x00, 0x46, /* Fragment length */
  201. 0x01, 0x00, /* DTLS1_BAD_VER */
  202. #define SH_RANDOM_OFS 27 /* Server random goes here */
  203. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  204. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  205. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  206. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  207. 0x20, /* Session ID length */
  208. #define SH_SESSID_OFS 60 /* Session ID goes here */
  209. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  210. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  211. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  212. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  213. 0x00, 0x2f, /* Cipher suite AES128-SHA */
  214. 0x00, /* Compression null */
  215. };
  216. static unsigned char change_cipher_spec[] = {
  217. 0x14, /* Change Cipher Spec */
  218. 0x01, 0x00, /* DTLS1_BAD_VER */
  219. 0x00, 0x00, /* Epoch 0 */
  220. 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, /* Seq# 2 */
  221. 0x00, 0x03, /* Length */
  222. 0x01, 0x00, 0x02, /* Message */
  223. };
  224. memcpy(server_hello + SH_RANDOM_OFS, server_random, sizeof(server_random));
  225. memcpy(server_hello + SH_SESSID_OFS, session_id, sizeof(session_id));
  226. if (!EVP_DigestUpdate(handshake_md, server_hello + MAC_OFFSET,
  227. sizeof(server_hello) - MAC_OFFSET))
  228. return 0;
  229. BIO_write(rbio, server_hello, sizeof(server_hello));
  230. BIO_write(rbio, change_cipher_spec, sizeof(change_cipher_spec));
  231. return 1;
  232. }
  233. /* Create header, HMAC, pad, encrypt and send a record */
  234. static int send_record(BIO *rbio, unsigned char type, uint64_t seqnr,
  235. const void *msg, size_t len)
  236. {
  237. /* Note that the order of the record header fields on the wire,
  238. * and in the HMAC, is different. So we just keep them in separate
  239. * variables and handle them individually. */
  240. static unsigned char epoch[2] = { 0x00, 0x01 };
  241. static unsigned char seq[6] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
  242. static unsigned char ver[2] = { 0x01, 0x00 }; /* DTLS1_BAD_VER */
  243. unsigned char lenbytes[2];
  244. HMAC_CTX *ctx;
  245. EVP_CIPHER_CTX *enc_ctx;
  246. unsigned char iv[16];
  247. unsigned char pad;
  248. unsigned char *enc;
  249. seq[0] = (seqnr >> 40) & 0xff;
  250. seq[1] = (seqnr >> 32) & 0xff;
  251. seq[2] = (seqnr >> 24) & 0xff;
  252. seq[3] = (seqnr >> 16) & 0xff;
  253. seq[4] = (seqnr >> 8) & 0xff;
  254. seq[5] = seqnr & 0xff;
  255. pad = 15 - ((len + SHA_DIGEST_LENGTH) % 16);
  256. enc = OPENSSL_malloc(len + SHA_DIGEST_LENGTH + 1 + pad);
  257. if (enc == NULL)
  258. return 0;
  259. /* Copy record to encryption buffer */
  260. memcpy(enc, msg, len);
  261. /* Append HMAC to data */
  262. ctx = HMAC_CTX_new();
  263. HMAC_Init_ex(ctx, mac_key, 20, EVP_sha1(), NULL);
  264. HMAC_Update(ctx, epoch, 2);
  265. HMAC_Update(ctx, seq, 6);
  266. HMAC_Update(ctx, &type, 1);
  267. HMAC_Update(ctx, ver, 2); /* Version */
  268. lenbytes[0] = (unsigned char)(len >> 8);
  269. lenbytes[1] = (unsigned char)(len);
  270. HMAC_Update(ctx, lenbytes, 2); /* Length */
  271. HMAC_Update(ctx, enc, len); /* Finally the data itself */
  272. HMAC_Final(ctx, enc + len, NULL);
  273. HMAC_CTX_free(ctx);
  274. /* Append padding bytes */
  275. len += SHA_DIGEST_LENGTH;
  276. do {
  277. enc[len++] = pad;
  278. } while (len % 16);
  279. /* Generate IV, and encrypt */
  280. RAND_bytes(iv, sizeof(iv));
  281. enc_ctx = EVP_CIPHER_CTX_new();
  282. EVP_CipherInit_ex(enc_ctx, EVP_aes_128_cbc(), NULL, enc_key, iv, 1);
  283. EVP_Cipher(enc_ctx, enc, enc, len);
  284. EVP_CIPHER_CTX_free(enc_ctx);
  285. /* Finally write header (from fragmented variables), IV and encrypted record */
  286. BIO_write(rbio, &type, 1);
  287. BIO_write(rbio, ver, 2);
  288. BIO_write(rbio, epoch, 2);
  289. BIO_write(rbio, seq, 6);
  290. lenbytes[0] = (unsigned char)((len + sizeof(iv)) >> 8);
  291. lenbytes[1] = (unsigned char)(len + sizeof(iv));
  292. BIO_write(rbio, lenbytes, 2);
  293. BIO_write(rbio, iv, sizeof(iv));
  294. BIO_write(rbio, enc, len);
  295. OPENSSL_free(enc);
  296. return 1;
  297. }
  298. static int send_finished(SSL *s, BIO *rbio)
  299. {
  300. static unsigned char finished_msg[DTLS1_HM_HEADER_LENGTH +
  301. TLS1_FINISH_MAC_LENGTH] = {
  302. 0x14, /* Finished */
  303. 0x00, 0x00, 0x0c, /* Length */
  304. 0x00, 0x03, /* Seq# 3 */
  305. 0x00, 0x00, 0x00, /* Fragment offset */
  306. 0x00, 0x00, 0x0c, /* Fragment length */
  307. /* Finished MAC (12 bytes) */
  308. };
  309. unsigned char handshake_hash[EVP_MAX_MD_SIZE];
  310. /* Derive key material */
  311. do_PRF(TLS_MD_KEY_EXPANSION_CONST, TLS_MD_KEY_EXPANSION_CONST_SIZE,
  312. server_random, SSL3_RANDOM_SIZE,
  313. client_random, SSL3_RANDOM_SIZE,
  314. key_block, sizeof(key_block));
  315. /* Generate Finished MAC */
  316. if (!EVP_DigestFinal_ex(handshake_md, handshake_hash, NULL))
  317. return 0;
  318. do_PRF(TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
  319. handshake_hash, EVP_MD_CTX_size(handshake_md),
  320. NULL, 0,
  321. finished_msg + DTLS1_HM_HEADER_LENGTH, TLS1_FINISH_MAC_LENGTH);
  322. return send_record(rbio, SSL3_RT_HANDSHAKE, 0,
  323. finished_msg, sizeof(finished_msg));
  324. }
  325. static int validate_ccs(BIO *wbio)
  326. {
  327. PACKET pkt;
  328. long len;
  329. unsigned char *data;
  330. unsigned int u;
  331. len = BIO_get_mem_data(wbio, (char **)&data);
  332. if (!PACKET_buf_init(&pkt, data, len))
  333. return 0;
  334. /* Check record header type */
  335. if (!PACKET_get_1(&pkt, &u) || u != SSL3_RT_CHANGE_CIPHER_SPEC)
  336. return 0;
  337. /* Version */
  338. if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)
  339. return 0;
  340. /* Skip the rest of the record header */
  341. if (!PACKET_forward(&pkt, DTLS1_RT_HEADER_LENGTH - 3))
  342. return 0;
  343. /* Check ChangeCipherSpec message */
  344. if (!PACKET_get_1(&pkt, &u) || u != SSL3_MT_CCS)
  345. return 0;
  346. /* A DTLS1_BAD_VER ChangeCipherSpec also contains the
  347. * handshake sequence number (which is 2 here) */
  348. if (!PACKET_get_net_2(&pkt, &u) || u != 0x0002)
  349. return 0;
  350. /* Now check the Finished packet */
  351. if (!PACKET_get_1(&pkt, &u) || u != SSL3_RT_HANDSHAKE)
  352. return 0;
  353. if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)
  354. return 0;
  355. /* Check epoch is now 1 */
  356. if (!PACKET_get_net_2(&pkt, &u) || u != 0x0001)
  357. return 0;
  358. /* That'll do for now. If OpenSSL accepted *our* Finished packet
  359. * then it's evidently remembered that DTLS1_BAD_VER doesn't
  360. * include the handshake header in the MAC. There's not a lot of
  361. * point in implementing decryption here, just to check that it
  362. * continues to get it right for one more packet. */
  363. return 1;
  364. }
  365. #define NODROP(x) { x##UL, 0 }
  366. #define DROP(x) { x##UL, 1 }
  367. static struct {
  368. uint64_t seq;
  369. int drop;
  370. } tests[] = {
  371. NODROP(1), NODROP(3), NODROP(2),
  372. NODROP(0x1234), NODROP(0x1230), NODROP(0x1235),
  373. NODROP(0xffff), NODROP(0x10001), NODROP(0xfffe), NODROP(0x10000),
  374. DROP(0x10001), DROP(0xff), NODROP(0x100000), NODROP(0x800000), NODROP(0x7fffe1),
  375. NODROP(0xffffff), NODROP(0x1000000), NODROP(0xfffffe), DROP(0xffffff), NODROP(0x1000010),
  376. NODROP(0xfffffd), NODROP(0x1000011), DROP(0x12), NODROP(0x1000012),
  377. NODROP(0x1ffffff), NODROP(0x2000000), DROP(0x1ff00fe), NODROP(0x2000001),
  378. NODROP(0x20fffff), NODROP(0x2105500), DROP(0x20ffffe), NODROP(0x21054ff),
  379. NODROP(0x211ffff), DROP(0x2110000), NODROP(0x2120000)
  380. /* The last test should be NODROP, because a DROP wouldn't get tested. */
  381. };
  382. static int test_bad_dtls(void)
  383. {
  384. SSL_SESSION *sess = NULL;
  385. SSL_CTX *ctx = NULL;
  386. SSL *con = NULL;
  387. BIO *rbio = NULL;
  388. BIO *wbio = NULL;
  389. time_t now = 0;
  390. int testresult = 0;
  391. int ret;
  392. int i;
  393. RAND_bytes(session_id, sizeof(session_id));
  394. RAND_bytes(master_secret, sizeof(master_secret));
  395. RAND_bytes(cookie, sizeof(cookie));
  396. RAND_bytes(server_random + 4, sizeof(server_random) - 4);
  397. now = time(NULL);
  398. memcpy(server_random, &now, sizeof(now));
  399. sess = client_session();
  400. if (!TEST_ptr(sess))
  401. goto end;
  402. handshake_md = EVP_MD_CTX_new();
  403. if (!TEST_ptr(handshake_md)
  404. || !TEST_true(EVP_DigestInit_ex(handshake_md, EVP_md5_sha1(),
  405. NULL)))
  406. goto end;
  407. ctx = SSL_CTX_new(DTLS_client_method());
  408. if (!TEST_ptr(ctx)
  409. || !TEST_true(SSL_CTX_set_min_proto_version(ctx, DTLS1_BAD_VER))
  410. || !TEST_true(SSL_CTX_set_max_proto_version(ctx, DTLS1_BAD_VER))
  411. || !TEST_true(SSL_CTX_set_cipher_list(ctx, "AES128-SHA")))
  412. goto end;
  413. con = SSL_new(ctx);
  414. if (!TEST_ptr(con)
  415. || !TEST_true(SSL_set_session(con, sess)))
  416. goto end;
  417. SSL_SESSION_free(sess);
  418. rbio = BIO_new(BIO_s_mem());
  419. wbio = BIO_new(BIO_s_mem());
  420. if (!TEST_ptr(rbio)
  421. || !TEST_ptr(wbio))
  422. goto end;
  423. SSL_set_bio(con, rbio, wbio);
  424. if (!TEST_true(BIO_up_ref(rbio))) {
  425. /*
  426. * We can't up-ref but we assigned ownership to con, so we shouldn't
  427. * free in the "end" block
  428. */
  429. rbio = wbio = NULL;
  430. goto end;
  431. }
  432. if (!TEST_true(BIO_up_ref(wbio))) {
  433. wbio = NULL;
  434. goto end;
  435. }
  436. SSL_set_connect_state(con);
  437. /* Send initial ClientHello */
  438. ret = SSL_do_handshake(con);
  439. if (!TEST_int_le(ret, 0)
  440. || !TEST_int_eq(SSL_get_error(con, ret), SSL_ERROR_WANT_READ)
  441. || !TEST_int_eq(validate_client_hello(wbio), 1)
  442. || !TEST_true(send_hello_verify(rbio)))
  443. goto end;
  444. ret = SSL_do_handshake(con);
  445. if (!TEST_int_le(ret, 0)
  446. || !TEST_int_eq(SSL_get_error(con, ret), SSL_ERROR_WANT_READ)
  447. || !TEST_int_eq(validate_client_hello(wbio), 2)
  448. || !TEST_true(send_server_hello(rbio)))
  449. goto end;
  450. ret = SSL_do_handshake(con);
  451. if (!TEST_int_le(ret, 0)
  452. || !TEST_int_eq(SSL_get_error(con, ret), SSL_ERROR_WANT_READ)
  453. || !TEST_true(send_finished(con, rbio)))
  454. goto end;
  455. ret = SSL_do_handshake(con);
  456. if (!TEST_int_gt(ret, 0)
  457. || !TEST_true(validate_ccs(wbio)))
  458. goto end;
  459. /* While we're here and crafting packets by hand, we might as well do a
  460. bit of a stress test on the DTLS record replay handling. Not Cisco-DTLS
  461. specific but useful anyway for the general case. It's been broken
  462. before, and in fact was broken even for a basic 0, 2, 1 test case
  463. when this test was first added.... */
  464. for (i = 0; i < (int)OSSL_NELEM(tests); i++) {
  465. uint64_t recv_buf[2];
  466. if (!TEST_true(send_record(rbio, SSL3_RT_APPLICATION_DATA, tests[i].seq,
  467. &tests[i].seq, sizeof(uint64_t)))) {
  468. TEST_error("Failed to send data seq #0x%x%08x (%d)\n",
  469. (unsigned int)(tests[i].seq >> 32), (unsigned int)tests[i].seq, i);
  470. goto end;
  471. }
  472. if (tests[i].drop)
  473. continue;
  474. ret = SSL_read(con, recv_buf, 2 * sizeof(uint64_t));
  475. if (!TEST_int_eq(ret, (int)sizeof(uint64_t))) {
  476. TEST_error("SSL_read failed or wrong size on seq#0x%x%08x (%d)\n",
  477. (unsigned int)(tests[i].seq >> 32), (unsigned int)tests[i].seq, i);
  478. goto end;
  479. }
  480. if (!TEST_true(recv_buf[0] == tests[i].seq))
  481. goto end;
  482. }
  483. /* The last test cannot be DROP() */
  484. if (!TEST_false(tests[i-1].drop))
  485. goto end;
  486. testresult = 1;
  487. end:
  488. BIO_free(rbio);
  489. BIO_free(wbio);
  490. SSL_free(con);
  491. SSL_CTX_free(ctx);
  492. EVP_MD_CTX_free(handshake_md);
  493. return testresult;
  494. }
  495. int setup_tests(void)
  496. {
  497. ADD_TEST(test_bad_dtls);
  498. return 1;
  499. }