sslapitest.c 385 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929393039313932393339343935393639373938393939403941394239433944394539463947394839493950395139523953395439553956395739583959396039613962396339643965396639673968396939703971397239733974397539763977397839793980398139823983398439853986398739883989399039913992399339943995399639973998399940004001400240034004400540064007400840094010401140124013401440154016401740184019402040214022402340244025402640274028402940304031403240334034403540364037403840394040404140424043404440454046404740484049405040514052405340544055405640574058405940604061406240634064406540664067406840694070407140724073407440754076407740784079408040814082408340844085408640874088408940904091409240934094409540964097409840994100410141024103410441054106410741084109411041114112411341144115411641174118411941204121412241234124412541264127412841294130413141324133413441354136413741384139414041414142414341444145414641474148414941504151415241534154415541564157415841594160416141624163416441654166416741684169417041714172417341744175417641774178417941804181418241834184418541864187418841894190419141924193419441954196419741984199420042014202420342044205420642074208420942104211421242134214421542164217421842194220422142224223422442254226422742284229423042314232423342344235423642374238423942404241424242434244424542464247424842494250425142524253425442554256425742584259426042614262426342644265426642674268426942704271427242734274427542764277427842794280428142824283428442854286428742884289429042914292429342944295429642974298429943004301430243034304430543064307430843094310431143124313431443154316431743184319432043214322432343244325432643274328432943304331433243334334433543364337433843394340434143424343434443454346434743484349435043514352435343544355435643574358435943604361436243634364436543664367436843694370437143724373437443754376437743784379438043814382438343844385438643874388438943904391439243934394439543964397439843994400440144024403440444054406440744084409441044114412441344144415441644174418441944204421442244234424442544264427442844294430443144324433443444354436443744384439444044414442444344444445444644474448444944504451445244534454445544564457445844594460446144624463446444654466446744684469447044714472447344744475447644774478447944804481448244834484448544864487448844894490449144924493449444954496449744984499450045014502450345044505450645074508450945104511451245134514451545164517451845194520452145224523452445254526452745284529453045314532453345344535453645374538453945404541454245434544454545464547454845494550455145524553455445554556455745584559456045614562456345644565456645674568456945704571457245734574457545764577457845794580458145824583458445854586458745884589459045914592459345944595459645974598459946004601460246034604460546064607460846094610461146124613461446154616461746184619462046214622462346244625462646274628462946304631463246334634463546364637463846394640464146424643464446454646464746484649465046514652465346544655465646574658465946604661466246634664466546664667466846694670467146724673467446754676467746784679468046814682468346844685468646874688468946904691469246934694469546964697469846994700470147024703470447054706470747084709471047114712471347144715471647174718471947204721472247234724472547264727472847294730473147324733473447354736473747384739474047414742474347444745474647474748474947504751475247534754475547564757475847594760476147624763476447654766476747684769477047714772477347744775477647774778477947804781478247834784478547864787478847894790479147924793479447954796479747984799480048014802480348044805480648074808480948104811481248134814481548164817481848194820482148224823482448254826482748284829483048314832483348344835483648374838483948404841484248434844484548464847484848494850485148524853485448554856485748584859486048614862486348644865486648674868486948704871487248734874487548764877487848794880488148824883488448854886488748884889489048914892489348944895489648974898489949004901490249034904490549064907490849094910491149124913491449154916491749184919492049214922492349244925492649274928492949304931493249334934493549364937493849394940494149424943494449454946494749484949495049514952495349544955495649574958495949604961496249634964496549664967496849694970497149724973497449754976497749784979498049814982498349844985498649874988498949904991499249934994499549964997499849995000500150025003500450055006500750085009501050115012501350145015501650175018501950205021502250235024502550265027502850295030503150325033503450355036503750385039504050415042504350445045504650475048504950505051505250535054505550565057505850595060506150625063506450655066506750685069507050715072507350745075507650775078507950805081508250835084508550865087508850895090509150925093509450955096509750985099510051015102510351045105510651075108510951105111511251135114511551165117511851195120512151225123512451255126512751285129513051315132513351345135513651375138513951405141514251435144514551465147514851495150515151525153515451555156515751585159516051615162516351645165516651675168516951705171517251735174517551765177517851795180518151825183518451855186518751885189519051915192519351945195519651975198519952005201520252035204520552065207520852095210521152125213521452155216521752185219522052215222522352245225522652275228522952305231523252335234523552365237523852395240524152425243524452455246524752485249525052515252525352545255525652575258525952605261526252635264526552665267526852695270527152725273527452755276527752785279528052815282528352845285528652875288528952905291529252935294529552965297529852995300530153025303530453055306530753085309531053115312531353145315531653175318531953205321532253235324532553265327532853295330533153325333533453355336533753385339534053415342534353445345534653475348534953505351535253535354535553565357535853595360536153625363536453655366536753685369537053715372537353745375537653775378537953805381538253835384538553865387538853895390539153925393539453955396539753985399540054015402540354045405540654075408540954105411541254135414541554165417541854195420542154225423542454255426542754285429543054315432543354345435543654375438543954405441544254435444544554465447544854495450545154525453545454555456545754585459546054615462546354645465546654675468546954705471547254735474547554765477547854795480548154825483548454855486548754885489549054915492549354945495549654975498549955005501550255035504550555065507550855095510551155125513551455155516551755185519552055215522552355245525552655275528552955305531553255335534553555365537553855395540554155425543554455455546554755485549555055515552555355545555555655575558555955605561556255635564556555665567556855695570557155725573557455755576557755785579558055815582558355845585558655875588558955905591559255935594559555965597559855995600560156025603560456055606560756085609561056115612561356145615561656175618561956205621562256235624562556265627562856295630563156325633563456355636563756385639564056415642564356445645564656475648564956505651565256535654565556565657565856595660566156625663566456655666566756685669567056715672567356745675567656775678567956805681568256835684568556865687568856895690569156925693569456955696569756985699570057015702570357045705570657075708570957105711571257135714571557165717571857195720572157225723572457255726572757285729573057315732573357345735573657375738573957405741574257435744574557465747574857495750575157525753575457555756575757585759576057615762576357645765576657675768576957705771577257735774577557765777577857795780578157825783578457855786578757885789579057915792579357945795579657975798579958005801580258035804580558065807580858095810581158125813581458155816581758185819582058215822582358245825582658275828582958305831583258335834583558365837583858395840584158425843584458455846584758485849585058515852585358545855585658575858585958605861586258635864586558665867586858695870587158725873587458755876587758785879588058815882588358845885588658875888588958905891589258935894589558965897589858995900590159025903590459055906590759085909591059115912591359145915591659175918591959205921592259235924592559265927592859295930593159325933593459355936593759385939594059415942594359445945594659475948594959505951595259535954595559565957595859595960596159625963596459655966596759685969597059715972597359745975597659775978597959805981598259835984598559865987598859895990599159925993599459955996599759985999600060016002600360046005600660076008600960106011601260136014601560166017601860196020602160226023602460256026602760286029603060316032603360346035603660376038603960406041604260436044604560466047604860496050605160526053605460556056605760586059606060616062606360646065606660676068606960706071607260736074607560766077607860796080608160826083608460856086608760886089609060916092609360946095609660976098609961006101610261036104610561066107610861096110611161126113611461156116611761186119612061216122612361246125612661276128612961306131613261336134613561366137613861396140614161426143614461456146614761486149615061516152615361546155615661576158615961606161616261636164616561666167616861696170617161726173617461756176617761786179618061816182618361846185618661876188618961906191619261936194619561966197619861996200620162026203620462056206620762086209621062116212621362146215621662176218621962206221622262236224622562266227622862296230623162326233623462356236623762386239624062416242624362446245624662476248624962506251625262536254625562566257625862596260626162626263626462656266626762686269627062716272627362746275627662776278627962806281628262836284628562866287628862896290629162926293629462956296629762986299630063016302630363046305630663076308630963106311631263136314631563166317631863196320632163226323632463256326632763286329633063316332633363346335633663376338633963406341634263436344634563466347634863496350635163526353635463556356635763586359636063616362636363646365636663676368636963706371637263736374637563766377637863796380638163826383638463856386638763886389639063916392639363946395639663976398639964006401640264036404640564066407640864096410641164126413641464156416641764186419642064216422642364246425642664276428642964306431643264336434643564366437643864396440644164426443644464456446644764486449645064516452645364546455645664576458645964606461646264636464646564666467646864696470647164726473647464756476647764786479648064816482648364846485648664876488648964906491649264936494649564966497649864996500650165026503650465056506650765086509651065116512651365146515651665176518651965206521652265236524652565266527652865296530653165326533653465356536653765386539654065416542654365446545654665476548654965506551655265536554655565566557655865596560656165626563656465656566656765686569657065716572657365746575657665776578657965806581658265836584658565866587658865896590659165926593659465956596659765986599660066016602660366046605660666076608660966106611661266136614661566166617661866196620662166226623662466256626662766286629663066316632663366346635663666376638663966406641664266436644664566466647664866496650665166526653665466556656665766586659666066616662666366646665666666676668666966706671667266736674667566766677667866796680668166826683668466856686668766886689669066916692669366946695669666976698669967006701670267036704670567066707670867096710671167126713671467156716671767186719672067216722672367246725672667276728672967306731673267336734673567366737673867396740674167426743674467456746674767486749675067516752675367546755675667576758675967606761676267636764676567666767676867696770677167726773677467756776677767786779678067816782678367846785678667876788678967906791679267936794679567966797679867996800680168026803680468056806680768086809681068116812681368146815681668176818681968206821682268236824682568266827682868296830683168326833683468356836683768386839684068416842684368446845684668476848684968506851685268536854685568566857685868596860686168626863686468656866686768686869687068716872687368746875687668776878687968806881688268836884688568866887688868896890689168926893689468956896689768986899690069016902690369046905690669076908690969106911691269136914691569166917691869196920692169226923692469256926692769286929693069316932693369346935693669376938693969406941694269436944694569466947694869496950695169526953695469556956695769586959696069616962696369646965696669676968696969706971697269736974697569766977697869796980698169826983698469856986698769886989699069916992699369946995699669976998699970007001700270037004700570067007700870097010701170127013701470157016701770187019702070217022702370247025702670277028702970307031703270337034703570367037703870397040704170427043704470457046704770487049705070517052705370547055705670577058705970607061706270637064706570667067706870697070707170727073707470757076707770787079708070817082708370847085708670877088708970907091709270937094709570967097709870997100710171027103710471057106710771087109711071117112711371147115711671177118711971207121712271237124712571267127712871297130713171327133713471357136713771387139714071417142714371447145714671477148714971507151715271537154715571567157715871597160716171627163716471657166716771687169717071717172717371747175717671777178717971807181718271837184718571867187718871897190719171927193719471957196719771987199720072017202720372047205720672077208720972107211721272137214721572167217721872197220722172227223722472257226722772287229723072317232723372347235723672377238723972407241724272437244724572467247724872497250725172527253725472557256725772587259726072617262726372647265726672677268726972707271727272737274727572767277727872797280728172827283728472857286728772887289729072917292729372947295729672977298729973007301730273037304730573067307730873097310731173127313731473157316731773187319732073217322732373247325732673277328732973307331733273337334733573367337733873397340734173427343734473457346734773487349735073517352735373547355735673577358735973607361736273637364736573667367736873697370737173727373737473757376737773787379738073817382738373847385738673877388738973907391739273937394739573967397739873997400740174027403740474057406740774087409741074117412741374147415741674177418741974207421742274237424742574267427742874297430743174327433743474357436743774387439744074417442744374447445744674477448744974507451745274537454745574567457745874597460746174627463746474657466746774687469747074717472747374747475747674777478747974807481748274837484748574867487748874897490749174927493749474957496749774987499750075017502750375047505750675077508750975107511751275137514751575167517751875197520752175227523752475257526752775287529753075317532753375347535753675377538753975407541754275437544754575467547754875497550755175527553755475557556755775587559756075617562756375647565756675677568756975707571757275737574757575767577757875797580758175827583758475857586758775887589759075917592759375947595759675977598759976007601760276037604760576067607760876097610761176127613761476157616761776187619762076217622762376247625762676277628762976307631763276337634763576367637763876397640764176427643764476457646764776487649765076517652765376547655765676577658765976607661766276637664766576667667766876697670767176727673767476757676767776787679768076817682768376847685768676877688768976907691769276937694769576967697769876997700770177027703770477057706770777087709771077117712771377147715771677177718771977207721772277237724772577267727772877297730773177327733773477357736773777387739774077417742774377447745774677477748774977507751775277537754775577567757775877597760776177627763776477657766776777687769777077717772777377747775777677777778777977807781778277837784778577867787778877897790779177927793779477957796779777987799780078017802780378047805780678077808780978107811781278137814781578167817781878197820782178227823782478257826782778287829783078317832783378347835783678377838783978407841784278437844784578467847784878497850785178527853785478557856785778587859786078617862786378647865786678677868786978707871787278737874787578767877787878797880788178827883788478857886788778887889789078917892789378947895789678977898789979007901790279037904790579067907790879097910791179127913791479157916791779187919792079217922792379247925792679277928792979307931793279337934793579367937793879397940794179427943794479457946794779487949795079517952795379547955795679577958795979607961796279637964796579667967796879697970797179727973797479757976797779787979798079817982798379847985798679877988798979907991799279937994799579967997799879998000800180028003800480058006800780088009801080118012801380148015801680178018801980208021802280238024802580268027802880298030803180328033803480358036803780388039804080418042804380448045804680478048804980508051805280538054805580568057805880598060806180628063806480658066806780688069807080718072807380748075807680778078807980808081808280838084808580868087808880898090809180928093809480958096809780988099810081018102810381048105810681078108810981108111811281138114811581168117811881198120812181228123812481258126812781288129813081318132813381348135813681378138813981408141814281438144814581468147814881498150815181528153815481558156815781588159816081618162816381648165816681678168816981708171817281738174817581768177817881798180818181828183818481858186818781888189819081918192819381948195819681978198819982008201820282038204820582068207820882098210821182128213821482158216821782188219822082218222822382248225822682278228822982308231823282338234823582368237823882398240824182428243824482458246824782488249825082518252825382548255825682578258825982608261826282638264826582668267826882698270827182728273827482758276827782788279828082818282828382848285828682878288828982908291829282938294829582968297829882998300830183028303830483058306830783088309831083118312831383148315831683178318831983208321832283238324832583268327832883298330833183328333833483358336833783388339834083418342834383448345834683478348834983508351835283538354835583568357835883598360836183628363836483658366836783688369837083718372837383748375837683778378837983808381838283838384838583868387838883898390839183928393839483958396839783988399840084018402840384048405840684078408840984108411841284138414841584168417841884198420842184228423842484258426842784288429843084318432843384348435843684378438843984408441844284438444844584468447844884498450845184528453845484558456845784588459846084618462846384648465846684678468846984708471847284738474847584768477847884798480848184828483848484858486848784888489849084918492849384948495849684978498849985008501850285038504850585068507850885098510851185128513851485158516851785188519852085218522852385248525852685278528852985308531853285338534853585368537853885398540854185428543854485458546854785488549855085518552855385548555855685578558855985608561856285638564856585668567856885698570857185728573857485758576857785788579858085818582858385848585858685878588858985908591859285938594859585968597859885998600860186028603860486058606860786088609861086118612861386148615861686178618861986208621862286238624862586268627862886298630863186328633863486358636863786388639864086418642864386448645864686478648864986508651865286538654865586568657865886598660866186628663866486658666866786688669867086718672867386748675867686778678867986808681868286838684868586868687868886898690869186928693869486958696869786988699870087018702870387048705870687078708870987108711871287138714871587168717871887198720872187228723872487258726872787288729873087318732873387348735873687378738873987408741874287438744874587468747874887498750875187528753875487558756875787588759876087618762876387648765876687678768876987708771877287738774877587768777877887798780878187828783878487858786878787888789879087918792879387948795879687978798879988008801880288038804880588068807880888098810881188128813881488158816881788188819882088218822882388248825882688278828882988308831883288338834883588368837883888398840884188428843884488458846884788488849885088518852885388548855885688578858885988608861886288638864886588668867886888698870887188728873887488758876887788788879888088818882888388848885888688878888888988908891889288938894889588968897889888998900890189028903890489058906890789088909891089118912891389148915891689178918891989208921892289238924892589268927892889298930893189328933893489358936893789388939894089418942894389448945894689478948894989508951895289538954895589568957895889598960896189628963896489658966896789688969897089718972897389748975897689778978897989808981898289838984898589868987898889898990899189928993899489958996899789988999900090019002900390049005900690079008900990109011901290139014901590169017901890199020902190229023902490259026902790289029903090319032903390349035903690379038903990409041904290439044904590469047904890499050905190529053905490559056905790589059906090619062906390649065906690679068906990709071907290739074907590769077907890799080908190829083908490859086908790889089909090919092909390949095909690979098909991009101910291039104910591069107910891099110911191129113911491159116911791189119912091219122912391249125912691279128912991309131913291339134913591369137913891399140914191429143914491459146914791489149915091519152915391549155915691579158915991609161916291639164916591669167916891699170917191729173917491759176917791789179918091819182918391849185918691879188918991909191919291939194919591969197919891999200920192029203920492059206920792089209921092119212921392149215921692179218921992209221922292239224922592269227922892299230923192329233923492359236923792389239924092419242924392449245924692479248924992509251925292539254925592569257925892599260926192629263926492659266926792689269927092719272927392749275927692779278927992809281928292839284928592869287928892899290929192929293929492959296929792989299930093019302930393049305930693079308930993109311931293139314931593169317931893199320932193229323932493259326932793289329933093319332933393349335933693379338933993409341934293439344934593469347934893499350935193529353935493559356935793589359936093619362936393649365936693679368936993709371937293739374937593769377937893799380938193829383938493859386938793889389939093919392939393949395939693979398939994009401940294039404940594069407940894099410941194129413941494159416941794189419942094219422942394249425942694279428942994309431943294339434943594369437943894399440944194429443944494459446944794489449945094519452945394549455945694579458945994609461946294639464946594669467946894699470947194729473947494759476947794789479948094819482948394849485948694879488948994909491949294939494949594969497949894999500950195029503950495059506950795089509951095119512951395149515951695179518951995209521952295239524952595269527952895299530953195329533953495359536953795389539954095419542954395449545954695479548954995509551955295539554955595569557955895599560956195629563956495659566956795689569957095719572957395749575957695779578957995809581958295839584958595869587958895899590959195929593959495959596959795989599960096019602960396049605960696079608960996109611961296139614961596169617961896199620962196229623962496259626962796289629963096319632963396349635963696379638963996409641964296439644964596469647964896499650965196529653965496559656965796589659966096619662966396649665966696679668966996709671967296739674967596769677967896799680968196829683968496859686968796889689969096919692969396949695969696979698969997009701970297039704970597069707970897099710971197129713971497159716971797189719972097219722972397249725972697279728972997309731973297339734973597369737973897399740974197429743974497459746974797489749975097519752975397549755975697579758975997609761976297639764976597669767976897699770977197729773977497759776977797789779978097819782978397849785978697879788978997909791979297939794979597969797979897999800980198029803980498059806980798089809981098119812981398149815981698179818981998209821982298239824982598269827982898299830983198329833983498359836983798389839984098419842984398449845984698479848984998509851985298539854985598569857985898599860986198629863986498659866986798689869987098719872987398749875987698779878987998809881988298839884988598869887988898899890989198929893989498959896989798989899990099019902990399049905990699079908990999109911991299139914991599169917991899199920992199229923992499259926992799289929993099319932993399349935993699379938993999409941994299439944994599469947994899499950995199529953995499559956995799589959996099619962996399649965996699679968996999709971997299739974997599769977997899799980998199829983998499859986998799889989999099919992999399949995999699979998999910000100011000210003100041000510006100071000810009100101001110012100131001410015100161001710018100191002010021100221002310024100251002610027100281002910030100311003210033100341003510036100371003810039100401004110042100431004410045100461004710048100491005010051100521005310054100551005610057100581005910060100611006210063100641006510066100671006810069100701007110072100731007410075100761007710078100791008010081100821008310084100851008610087100881008910090100911009210093100941009510096100971009810099101001010110102101031010410105101061010710108101091011010111101121011310114101151011610117101181011910120101211012210123101241012510126101271012810129101301013110132101331013410135101361013710138101391014010141101421014310144101451014610147101481014910150101511015210153101541015510156101571015810159101601016110162101631016410165101661016710168101691017010171101721017310174101751017610177101781017910180101811018210183101841018510186101871018810189101901019110192101931019410195101961019710198101991020010201102021020310204102051020610207102081020910210102111021210213102141021510216102171021810219102201022110222102231022410225102261022710228102291023010231102321023310234102351023610237102381023910240102411024210243102441024510246102471024810249102501025110252102531025410255102561025710258102591026010261102621026310264102651026610267102681026910270102711027210273102741027510276102771027810279102801028110282102831028410285102861028710288102891029010291102921029310294102951029610297102981029910300103011030210303103041030510306103071030810309103101031110312103131031410315103161031710318103191032010321103221032310324103251032610327103281032910330103311033210333103341033510336103371033810339103401034110342103431034410345103461034710348103491035010351103521035310354103551035610357103581035910360103611036210363103641036510366103671036810369103701037110372103731037410375103761037710378103791038010381103821038310384103851038610387103881038910390103911039210393103941039510396103971039810399104001040110402104031040410405104061040710408104091041010411104121041310414104151041610417104181041910420104211042210423104241042510426104271042810429104301043110432104331043410435104361043710438104391044010441104421044310444104451044610447104481044910450104511045210453104541045510456104571045810459104601046110462104631046410465104661046710468104691047010471104721047310474104751047610477104781047910480104811048210483104841048510486104871048810489104901049110492104931049410495104961049710498104991050010501105021050310504105051050610507105081050910510105111051210513105141051510516105171051810519105201052110522105231052410525105261052710528105291053010531105321053310534105351053610537105381053910540105411054210543105441054510546105471054810549105501055110552105531055410555105561055710558105591056010561105621056310564105651056610567105681056910570105711057210573105741057510576105771057810579105801058110582105831058410585105861058710588105891059010591105921059310594105951059610597105981059910600106011060210603106041060510606106071060810609106101061110612106131061410615106161061710618106191062010621106221062310624106251062610627106281062910630106311063210633106341063510636106371063810639106401064110642106431064410645106461064710648106491065010651106521065310654106551065610657106581065910660106611066210663106641066510666106671066810669106701067110672106731067410675106761067710678106791068010681106821068310684106851068610687106881068910690106911069210693106941069510696106971069810699107001070110702107031070410705107061070710708107091071010711107121071310714107151071610717107181071910720107211072210723107241072510726107271072810729107301073110732107331073410735107361073710738107391074010741107421074310744107451074610747107481074910750107511075210753107541075510756107571075810759107601076110762107631076410765107661076710768107691077010771107721077310774107751077610777107781077910780107811078210783107841078510786107871078810789107901079110792107931079410795107961079710798107991080010801108021080310804108051080610807108081080910810108111081210813108141081510816108171081810819108201082110822108231082410825108261082710828108291083010831108321083310834108351083610837108381083910840108411084210843108441084510846108471084810849108501085110852108531085410855108561085710858108591086010861108621086310864108651086610867108681086910870108711087210873108741087510876108771087810879108801088110882108831088410885108861088710888108891089010891108921089310894108951089610897108981089910900109011090210903109041090510906109071090810909109101091110912109131091410915109161091710918109191092010921109221092310924109251092610927109281092910930109311093210933109341093510936109371093810939109401094110942109431094410945109461094710948109491095010951109521095310954109551095610957109581095910960109611096210963109641096510966109671096810969109701097110972109731097410975109761097710978109791098010981109821098310984109851098610987109881098910990109911099210993109941099510996109971099810999110001100111002110031100411005110061100711008110091101011011110121101311014110151101611017110181101911020110211102211023110241102511026110271102811029110301103111032110331103411035110361103711038110391104011041110421104311044110451104611047110481104911050110511105211053110541105511056110571105811059110601106111062110631106411065110661106711068110691107011071110721107311074110751107611077110781107911080110811108211083110841108511086110871108811089110901109111092110931109411095110961109711098110991110011101111021110311104111051110611107111081110911110111111111211113111141111511116111171111811119111201112111122111231112411125111261112711128111291113011131111321113311134111351113611137111381113911140111411114211143111441114511146111471114811149111501115111152111531115411155111561115711158111591116011161111621116311164111651116611167111681116911170111711117211173111741117511176111771117811179111801118111182111831118411185111861118711188111891119011191111921119311194111951119611197111981119911200112011120211203112041120511206112071120811209112101121111212112131121411215112161121711218112191122011221112221122311224112251122611227112281122911230112311123211233112341123511236112371123811239112401124111242112431124411245112461124711248112491125011251112521125311254112551125611257112581125911260112611126211263112641126511266112671126811269112701127111272112731127411275112761127711278112791128011281112821128311284112851128611287112881128911290112911129211293112941129511296112971129811299113001130111302113031130411305113061130711308113091131011311113121131311314113151131611317113181131911320113211132211323113241132511326113271132811329113301133111332113331133411335113361133711338113391134011341113421134311344113451134611347113481134911350113511135211353113541135511356113571135811359113601136111362113631136411365113661136711368113691137011371113721137311374113751137611377113781137911380113811138211383113841138511386113871138811389113901139111392113931139411395113961139711398113991140011401114021140311404114051140611407114081140911410114111141211413114141141511416114171141811419114201142111422114231142411425114261142711428114291143011431114321143311434114351143611437114381143911440114411144211443114441144511446114471144811449114501145111452114531145411455114561145711458114591146011461114621146311464114651146611467114681146911470114711147211473114741147511476114771147811479114801148111482114831148411485114861148711488114891149011491114921149311494114951149611497114981149911500115011150211503115041150511506115071150811509115101151111512115131151411515115161151711518115191152011521115221152311524115251152611527115281152911530115311153211533115341153511536115371153811539115401154111542115431154411545115461154711548115491155011551
  1. /*
  2. * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * We need access to the deprecated low level HMAC APIs for legacy purposes
  11. * when the deprecated calls are not hidden
  12. */
  13. #ifndef OPENSSL_NO_DEPRECATED_3_0
  14. # define OPENSSL_SUPPRESS_DEPRECATED
  15. #endif
  16. #include <stdio.h>
  17. #include <string.h>
  18. #include <openssl/opensslconf.h>
  19. #include <openssl/bio.h>
  20. #include <openssl/crypto.h>
  21. #include <openssl/ssl.h>
  22. #include <openssl/ocsp.h>
  23. #include <openssl/srp.h>
  24. #include <openssl/txt_db.h>
  25. #include <openssl/aes.h>
  26. #include <openssl/rand.h>
  27. #include <openssl/core_names.h>
  28. #include <openssl/core_dispatch.h>
  29. #include <openssl/provider.h>
  30. #include <openssl/param_build.h>
  31. #include <openssl/x509v3.h>
  32. #include <openssl/dh.h>
  33. #include <openssl/engine.h>
  34. #include "helpers/ssltestlib.h"
  35. #include "testutil.h"
  36. #include "testutil/output.h"
  37. #include "internal/nelem.h"
  38. #include "internal/ktls.h"
  39. #include "../ssl/ssl_local.h"
  40. #include "../ssl/record/methods/recmethod_local.h"
  41. #include "filterprov.h"
  42. #undef OSSL_NO_USABLE_TLS1_3
  43. #if defined(OPENSSL_NO_TLS1_3) \
  44. || (defined(OPENSSL_NO_EC) && defined(OPENSSL_NO_DH))
  45. /*
  46. * If we don't have ec or dh then there are no built-in groups that are usable
  47. * with TLSv1.3
  48. */
  49. # define OSSL_NO_USABLE_TLS1_3
  50. #endif
  51. /* Defined in tls-provider.c */
  52. int tls_provider_init(const OSSL_CORE_HANDLE *handle,
  53. const OSSL_DISPATCH *in,
  54. const OSSL_DISPATCH **out,
  55. void **provctx);
  56. static OSSL_LIB_CTX *libctx = NULL;
  57. static OSSL_PROVIDER *defctxnull = NULL;
  58. #ifndef OSSL_NO_USABLE_TLS1_3
  59. static SSL_SESSION *clientpsk = NULL;
  60. static SSL_SESSION *serverpsk = NULL;
  61. static const char *pskid = "Identity";
  62. static const char *srvid;
  63. static int use_session_cb(SSL *ssl, const EVP_MD *md, const unsigned char **id,
  64. size_t *idlen, SSL_SESSION **sess);
  65. static int find_session_cb(SSL *ssl, const unsigned char *identity,
  66. size_t identity_len, SSL_SESSION **sess);
  67. static int use_session_cb_cnt = 0;
  68. static int find_session_cb_cnt = 0;
  69. #endif
  70. static char *certsdir = NULL;
  71. static char *cert = NULL;
  72. static char *privkey = NULL;
  73. static char *cert2 = NULL;
  74. static char *privkey2 = NULL;
  75. static char *cert1024 = NULL;
  76. static char *privkey1024 = NULL;
  77. static char *cert3072 = NULL;
  78. static char *privkey3072 = NULL;
  79. static char *cert4096 = NULL;
  80. static char *privkey4096 = NULL;
  81. static char *cert8192 = NULL;
  82. static char *privkey8192 = NULL;
  83. static char *srpvfile = NULL;
  84. static char *tmpfilename = NULL;
  85. static char *dhfile = NULL;
  86. static int is_fips = 0;
  87. static int fips_ems_check = 0;
  88. #define LOG_BUFFER_SIZE 2048
  89. static char server_log_buffer[LOG_BUFFER_SIZE + 1] = {0};
  90. static size_t server_log_buffer_index = 0;
  91. static char client_log_buffer[LOG_BUFFER_SIZE + 1] = {0};
  92. static size_t client_log_buffer_index = 0;
  93. static int error_writing_log = 0;
  94. #ifndef OPENSSL_NO_OCSP
  95. static const unsigned char orespder[] = "Dummy OCSP Response";
  96. static int ocsp_server_called = 0;
  97. static int ocsp_client_called = 0;
  98. static int cdummyarg = 1;
  99. static X509 *ocspcert = NULL;
  100. #endif
  101. #define CLIENT_VERSION_LEN 2
  102. /*
  103. * This structure is used to validate that the correct number of log messages
  104. * of various types are emitted when emitting secret logs.
  105. */
  106. struct sslapitest_log_counts {
  107. unsigned int rsa_key_exchange_count;
  108. unsigned int master_secret_count;
  109. unsigned int client_early_secret_count;
  110. unsigned int client_handshake_secret_count;
  111. unsigned int server_handshake_secret_count;
  112. unsigned int client_application_secret_count;
  113. unsigned int server_application_secret_count;
  114. unsigned int early_exporter_secret_count;
  115. unsigned int exporter_secret_count;
  116. };
  117. static int hostname_cb(SSL *s, int *al, void *arg)
  118. {
  119. const char *hostname = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
  120. if (hostname != NULL && (strcmp(hostname, "goodhost") == 0
  121. || strcmp(hostname, "altgoodhost") == 0))
  122. return SSL_TLSEXT_ERR_OK;
  123. return SSL_TLSEXT_ERR_NOACK;
  124. }
  125. static void client_keylog_callback(const SSL *ssl, const char *line)
  126. {
  127. int line_length = strlen(line);
  128. /* If the log doesn't fit, error out. */
  129. if (client_log_buffer_index + line_length > sizeof(client_log_buffer) - 1) {
  130. TEST_info("Client log too full");
  131. error_writing_log = 1;
  132. return;
  133. }
  134. strcat(client_log_buffer, line);
  135. client_log_buffer_index += line_length;
  136. client_log_buffer[client_log_buffer_index++] = '\n';
  137. }
  138. static void server_keylog_callback(const SSL *ssl, const char *line)
  139. {
  140. int line_length = strlen(line);
  141. /* If the log doesn't fit, error out. */
  142. if (server_log_buffer_index + line_length > sizeof(server_log_buffer) - 1) {
  143. TEST_info("Server log too full");
  144. error_writing_log = 1;
  145. return;
  146. }
  147. strcat(server_log_buffer, line);
  148. server_log_buffer_index += line_length;
  149. server_log_buffer[server_log_buffer_index++] = '\n';
  150. }
  151. static int compare_hex_encoded_buffer(const char *hex_encoded,
  152. size_t hex_length,
  153. const uint8_t *raw,
  154. size_t raw_length)
  155. {
  156. size_t i, j;
  157. char hexed[3];
  158. if (!TEST_size_t_eq(raw_length * 2, hex_length))
  159. return 1;
  160. for (i = j = 0; i < raw_length && j + 1 < hex_length; i++, j += 2) {
  161. sprintf(hexed, "%02x", raw[i]);
  162. if (!TEST_int_eq(hexed[0], hex_encoded[j])
  163. || !TEST_int_eq(hexed[1], hex_encoded[j + 1]))
  164. return 1;
  165. }
  166. return 0;
  167. }
  168. static int test_keylog_output(char *buffer, const SSL *ssl,
  169. const SSL_SESSION *session,
  170. struct sslapitest_log_counts *expected)
  171. {
  172. char *token = NULL;
  173. unsigned char actual_client_random[SSL3_RANDOM_SIZE] = {0};
  174. size_t client_random_size = SSL3_RANDOM_SIZE;
  175. unsigned char actual_master_key[SSL_MAX_MASTER_KEY_LENGTH] = {0};
  176. size_t master_key_size = SSL_MAX_MASTER_KEY_LENGTH;
  177. unsigned int rsa_key_exchange_count = 0;
  178. unsigned int master_secret_count = 0;
  179. unsigned int client_early_secret_count = 0;
  180. unsigned int client_handshake_secret_count = 0;
  181. unsigned int server_handshake_secret_count = 0;
  182. unsigned int client_application_secret_count = 0;
  183. unsigned int server_application_secret_count = 0;
  184. unsigned int early_exporter_secret_count = 0;
  185. unsigned int exporter_secret_count = 0;
  186. for (token = strtok(buffer, " \n"); token != NULL;
  187. token = strtok(NULL, " \n")) {
  188. if (strcmp(token, "RSA") == 0) {
  189. /*
  190. * Premaster secret. Tokens should be: 16 ASCII bytes of
  191. * hex-encoded encrypted secret, then the hex-encoded pre-master
  192. * secret.
  193. */
  194. if (!TEST_ptr(token = strtok(NULL, " \n")))
  195. return 0;
  196. if (!TEST_size_t_eq(strlen(token), 16))
  197. return 0;
  198. if (!TEST_ptr(token = strtok(NULL, " \n")))
  199. return 0;
  200. /*
  201. * We can't sensibly check the log because the premaster secret is
  202. * transient, and OpenSSL doesn't keep hold of it once the master
  203. * secret is generated.
  204. */
  205. rsa_key_exchange_count++;
  206. } else if (strcmp(token, "CLIENT_RANDOM") == 0) {
  207. /*
  208. * Master secret. Tokens should be: 64 ASCII bytes of hex-encoded
  209. * client random, then the hex-encoded master secret.
  210. */
  211. client_random_size = SSL_get_client_random(ssl,
  212. actual_client_random,
  213. SSL3_RANDOM_SIZE);
  214. if (!TEST_size_t_eq(client_random_size, SSL3_RANDOM_SIZE))
  215. return 0;
  216. if (!TEST_ptr(token = strtok(NULL, " \n")))
  217. return 0;
  218. if (!TEST_size_t_eq(strlen(token), 64))
  219. return 0;
  220. if (!TEST_false(compare_hex_encoded_buffer(token, 64,
  221. actual_client_random,
  222. client_random_size)))
  223. return 0;
  224. if (!TEST_ptr(token = strtok(NULL, " \n")))
  225. return 0;
  226. master_key_size = SSL_SESSION_get_master_key(session,
  227. actual_master_key,
  228. master_key_size);
  229. if (!TEST_size_t_ne(master_key_size, 0))
  230. return 0;
  231. if (!TEST_false(compare_hex_encoded_buffer(token, strlen(token),
  232. actual_master_key,
  233. master_key_size)))
  234. return 0;
  235. master_secret_count++;
  236. } else if (strcmp(token, "CLIENT_EARLY_TRAFFIC_SECRET") == 0
  237. || strcmp(token, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0
  238. || strcmp(token, "SERVER_HANDSHAKE_TRAFFIC_SECRET") == 0
  239. || strcmp(token, "CLIENT_TRAFFIC_SECRET_0") == 0
  240. || strcmp(token, "SERVER_TRAFFIC_SECRET_0") == 0
  241. || strcmp(token, "EARLY_EXPORTER_SECRET") == 0
  242. || strcmp(token, "EXPORTER_SECRET") == 0) {
  243. /*
  244. * TLSv1.3 secret. Tokens should be: 64 ASCII bytes of hex-encoded
  245. * client random, and then the hex-encoded secret. In this case,
  246. * we treat all of these secrets identically and then just
  247. * distinguish between them when counting what we saw.
  248. */
  249. if (strcmp(token, "CLIENT_EARLY_TRAFFIC_SECRET") == 0)
  250. client_early_secret_count++;
  251. else if (strcmp(token, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0)
  252. client_handshake_secret_count++;
  253. else if (strcmp(token, "SERVER_HANDSHAKE_TRAFFIC_SECRET") == 0)
  254. server_handshake_secret_count++;
  255. else if (strcmp(token, "CLIENT_TRAFFIC_SECRET_0") == 0)
  256. client_application_secret_count++;
  257. else if (strcmp(token, "SERVER_TRAFFIC_SECRET_0") == 0)
  258. server_application_secret_count++;
  259. else if (strcmp(token, "EARLY_EXPORTER_SECRET") == 0)
  260. early_exporter_secret_count++;
  261. else if (strcmp(token, "EXPORTER_SECRET") == 0)
  262. exporter_secret_count++;
  263. client_random_size = SSL_get_client_random(ssl,
  264. actual_client_random,
  265. SSL3_RANDOM_SIZE);
  266. if (!TEST_size_t_eq(client_random_size, SSL3_RANDOM_SIZE))
  267. return 0;
  268. if (!TEST_ptr(token = strtok(NULL, " \n")))
  269. return 0;
  270. if (!TEST_size_t_eq(strlen(token), 64))
  271. return 0;
  272. if (!TEST_false(compare_hex_encoded_buffer(token, 64,
  273. actual_client_random,
  274. client_random_size)))
  275. return 0;
  276. if (!TEST_ptr(token = strtok(NULL, " \n")))
  277. return 0;
  278. } else {
  279. TEST_info("Unexpected token %s\n", token);
  280. return 0;
  281. }
  282. }
  283. /* Got what we expected? */
  284. if (!TEST_size_t_eq(rsa_key_exchange_count,
  285. expected->rsa_key_exchange_count)
  286. || !TEST_size_t_eq(master_secret_count,
  287. expected->master_secret_count)
  288. || !TEST_size_t_eq(client_early_secret_count,
  289. expected->client_early_secret_count)
  290. || !TEST_size_t_eq(client_handshake_secret_count,
  291. expected->client_handshake_secret_count)
  292. || !TEST_size_t_eq(server_handshake_secret_count,
  293. expected->server_handshake_secret_count)
  294. || !TEST_size_t_eq(client_application_secret_count,
  295. expected->client_application_secret_count)
  296. || !TEST_size_t_eq(server_application_secret_count,
  297. expected->server_application_secret_count)
  298. || !TEST_size_t_eq(early_exporter_secret_count,
  299. expected->early_exporter_secret_count)
  300. || !TEST_size_t_eq(exporter_secret_count,
  301. expected->exporter_secret_count))
  302. return 0;
  303. return 1;
  304. }
  305. #if !defined(OPENSSL_NO_TLS1_2) || defined(OSSL_NO_USABLE_TLS1_3)
  306. static int test_keylog(void)
  307. {
  308. SSL_CTX *cctx = NULL, *sctx = NULL;
  309. SSL *clientssl = NULL, *serverssl = NULL;
  310. int testresult = 0;
  311. struct sslapitest_log_counts expected;
  312. /* Clean up logging space */
  313. memset(&expected, 0, sizeof(expected));
  314. memset(client_log_buffer, 0, sizeof(client_log_buffer));
  315. memset(server_log_buffer, 0, sizeof(server_log_buffer));
  316. client_log_buffer_index = 0;
  317. server_log_buffer_index = 0;
  318. error_writing_log = 0;
  319. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  320. TLS_client_method(),
  321. TLS1_VERSION, 0,
  322. &sctx, &cctx, cert, privkey)))
  323. return 0;
  324. /* We cannot log the master secret for TLSv1.3, so we should forbid it. */
  325. SSL_CTX_set_options(cctx, SSL_OP_NO_TLSv1_3);
  326. SSL_CTX_set_options(sctx, SSL_OP_NO_TLSv1_3);
  327. /* We also want to ensure that we use RSA-based key exchange. */
  328. if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "RSA")))
  329. goto end;
  330. if (!TEST_true(SSL_CTX_get_keylog_callback(cctx) == NULL)
  331. || !TEST_true(SSL_CTX_get_keylog_callback(sctx) == NULL))
  332. goto end;
  333. SSL_CTX_set_keylog_callback(cctx, client_keylog_callback);
  334. if (!TEST_true(SSL_CTX_get_keylog_callback(cctx)
  335. == client_keylog_callback))
  336. goto end;
  337. SSL_CTX_set_keylog_callback(sctx, server_keylog_callback);
  338. if (!TEST_true(SSL_CTX_get_keylog_callback(sctx)
  339. == server_keylog_callback))
  340. goto end;
  341. /* Now do a handshake and check that the logs have been written to. */
  342. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  343. &clientssl, NULL, NULL))
  344. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  345. SSL_ERROR_NONE))
  346. || !TEST_false(error_writing_log)
  347. || !TEST_int_gt(client_log_buffer_index, 0)
  348. || !TEST_int_gt(server_log_buffer_index, 0))
  349. goto end;
  350. /*
  351. * Now we want to test that our output data was vaguely sensible. We
  352. * do that by using strtok and confirming that we have more or less the
  353. * data we expect. For both client and server, we expect to see one master
  354. * secret. The client should also see an RSA key exchange.
  355. */
  356. expected.rsa_key_exchange_count = 1;
  357. expected.master_secret_count = 1;
  358. if (!TEST_true(test_keylog_output(client_log_buffer, clientssl,
  359. SSL_get_session(clientssl), &expected)))
  360. goto end;
  361. expected.rsa_key_exchange_count = 0;
  362. if (!TEST_true(test_keylog_output(server_log_buffer, serverssl,
  363. SSL_get_session(serverssl), &expected)))
  364. goto end;
  365. testresult = 1;
  366. end:
  367. SSL_free(serverssl);
  368. SSL_free(clientssl);
  369. SSL_CTX_free(sctx);
  370. SSL_CTX_free(cctx);
  371. return testresult;
  372. }
  373. #endif
  374. #ifndef OSSL_NO_USABLE_TLS1_3
  375. static int test_keylog_no_master_key(void)
  376. {
  377. SSL_CTX *cctx = NULL, *sctx = NULL;
  378. SSL *clientssl = NULL, *serverssl = NULL;
  379. SSL_SESSION *sess = NULL;
  380. int testresult = 0;
  381. struct sslapitest_log_counts expected;
  382. unsigned char buf[1];
  383. size_t readbytes, written;
  384. /* Clean up logging space */
  385. memset(&expected, 0, sizeof(expected));
  386. memset(client_log_buffer, 0, sizeof(client_log_buffer));
  387. memset(server_log_buffer, 0, sizeof(server_log_buffer));
  388. client_log_buffer_index = 0;
  389. server_log_buffer_index = 0;
  390. error_writing_log = 0;
  391. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  392. TLS_client_method(), TLS1_VERSION, 0,
  393. &sctx, &cctx, cert, privkey))
  394. || !TEST_true(SSL_CTX_set_max_early_data(sctx,
  395. SSL3_RT_MAX_PLAIN_LENGTH)))
  396. return 0;
  397. if (!TEST_true(SSL_CTX_get_keylog_callback(cctx) == NULL)
  398. || !TEST_true(SSL_CTX_get_keylog_callback(sctx) == NULL))
  399. goto end;
  400. SSL_CTX_set_keylog_callback(cctx, client_keylog_callback);
  401. if (!TEST_true(SSL_CTX_get_keylog_callback(cctx)
  402. == client_keylog_callback))
  403. goto end;
  404. SSL_CTX_set_keylog_callback(sctx, server_keylog_callback);
  405. if (!TEST_true(SSL_CTX_get_keylog_callback(sctx)
  406. == server_keylog_callback))
  407. goto end;
  408. /* Now do a handshake and check that the logs have been written to. */
  409. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  410. &clientssl, NULL, NULL))
  411. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  412. SSL_ERROR_NONE))
  413. || !TEST_false(error_writing_log))
  414. goto end;
  415. /*
  416. * Now we want to test that our output data was vaguely sensible. For this
  417. * test, we expect no CLIENT_RANDOM entry because it doesn't make sense for
  418. * TLSv1.3, but we do expect both client and server to emit keys.
  419. */
  420. expected.client_handshake_secret_count = 1;
  421. expected.server_handshake_secret_count = 1;
  422. expected.client_application_secret_count = 1;
  423. expected.server_application_secret_count = 1;
  424. expected.exporter_secret_count = 1;
  425. if (!TEST_true(test_keylog_output(client_log_buffer, clientssl,
  426. SSL_get_session(clientssl), &expected))
  427. || !TEST_true(test_keylog_output(server_log_buffer, serverssl,
  428. SSL_get_session(serverssl),
  429. &expected)))
  430. goto end;
  431. /* Terminate old session and resume with early data. */
  432. sess = SSL_get1_session(clientssl);
  433. SSL_shutdown(clientssl);
  434. SSL_shutdown(serverssl);
  435. SSL_free(serverssl);
  436. SSL_free(clientssl);
  437. serverssl = clientssl = NULL;
  438. /* Reset key log */
  439. memset(client_log_buffer, 0, sizeof(client_log_buffer));
  440. memset(server_log_buffer, 0, sizeof(server_log_buffer));
  441. client_log_buffer_index = 0;
  442. server_log_buffer_index = 0;
  443. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  444. &clientssl, NULL, NULL))
  445. || !TEST_true(SSL_set_session(clientssl, sess))
  446. /* Here writing 0 length early data is enough. */
  447. || !TEST_true(SSL_write_early_data(clientssl, NULL, 0, &written))
  448. || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  449. &readbytes),
  450. SSL_READ_EARLY_DATA_ERROR)
  451. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  452. SSL_EARLY_DATA_ACCEPTED)
  453. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  454. SSL_ERROR_NONE))
  455. || !TEST_true(SSL_session_reused(clientssl)))
  456. goto end;
  457. /* In addition to the previous entries, expect early secrets. */
  458. expected.client_early_secret_count = 1;
  459. expected.early_exporter_secret_count = 1;
  460. if (!TEST_true(test_keylog_output(client_log_buffer, clientssl,
  461. SSL_get_session(clientssl), &expected))
  462. || !TEST_true(test_keylog_output(server_log_buffer, serverssl,
  463. SSL_get_session(serverssl),
  464. &expected)))
  465. goto end;
  466. testresult = 1;
  467. end:
  468. SSL_SESSION_free(sess);
  469. SSL_free(serverssl);
  470. SSL_free(clientssl);
  471. SSL_CTX_free(sctx);
  472. SSL_CTX_free(cctx);
  473. return testresult;
  474. }
  475. #endif
  476. static int verify_retry_cb(X509_STORE_CTX *ctx, void *arg)
  477. {
  478. int res = X509_verify_cert(ctx);
  479. int idx = SSL_get_ex_data_X509_STORE_CTX_idx();
  480. SSL *ssl;
  481. /* this should not happen but check anyway */
  482. if (idx < 0
  483. || (ssl = X509_STORE_CTX_get_ex_data(ctx, idx)) == NULL)
  484. return 0;
  485. if (res == 0 && X509_STORE_CTX_get_error(ctx) ==
  486. X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY)
  487. /* indicate SSL_ERROR_WANT_RETRY_VERIFY */
  488. return SSL_set_retry_verify(ssl);
  489. return res;
  490. }
  491. static int test_client_cert_verify_cb(void)
  492. {
  493. /* server key, cert, chain, and root */
  494. char *skey = test_mk_file_path(certsdir, "leaf.key");
  495. char *leaf = test_mk_file_path(certsdir, "leaf.pem");
  496. char *int2 = test_mk_file_path(certsdir, "subinterCA.pem");
  497. char *int1 = test_mk_file_path(certsdir, "interCA.pem");
  498. char *root = test_mk_file_path(certsdir, "rootCA.pem");
  499. X509 *crt1 = NULL, *crt2 = NULL;
  500. STACK_OF(X509) *server_chain;
  501. SSL_CTX *cctx = NULL, *sctx = NULL;
  502. SSL *clientssl = NULL, *serverssl = NULL;
  503. int testresult = 0;
  504. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  505. TLS_client_method(), TLS1_VERSION, 0,
  506. &sctx, &cctx, NULL, NULL)))
  507. goto end;
  508. if (!TEST_int_eq(SSL_CTX_use_certificate_chain_file(sctx, leaf), 1)
  509. || !TEST_int_eq(SSL_CTX_use_PrivateKey_file(sctx, skey,
  510. SSL_FILETYPE_PEM), 1)
  511. || !TEST_int_eq(SSL_CTX_check_private_key(sctx), 1))
  512. goto end;
  513. if (!TEST_true(SSL_CTX_load_verify_locations(cctx, root, NULL)))
  514. goto end;
  515. SSL_CTX_set_verify(cctx, SSL_VERIFY_PEER, NULL);
  516. SSL_CTX_set_cert_verify_callback(cctx, verify_retry_cb, NULL);
  517. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  518. &clientssl, NULL, NULL)))
  519. goto end;
  520. /* attempt SSL_connect() with incomplete server chain */
  521. if (!TEST_false(create_ssl_connection(serverssl, clientssl,
  522. SSL_ERROR_WANT_RETRY_VERIFY)))
  523. goto end;
  524. /* application provides intermediate certs needed to verify server cert */
  525. if (!TEST_ptr((crt1 = load_cert_pem(int1, libctx)))
  526. || !TEST_ptr((crt2 = load_cert_pem(int2, libctx)))
  527. || !TEST_ptr((server_chain = SSL_get_peer_cert_chain(clientssl))))
  528. goto end;
  529. /* add certs in reverse order to demonstrate real chain building */
  530. if (!TEST_true(sk_X509_push(server_chain, crt1)))
  531. goto end;
  532. crt1 = NULL;
  533. if (!TEST_true(sk_X509_push(server_chain, crt2)))
  534. goto end;
  535. crt2 = NULL;
  536. /* continue SSL_connect(), must now succeed with completed server chain */
  537. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  538. SSL_ERROR_NONE)))
  539. goto end;
  540. testresult = 1;
  541. end:
  542. X509_free(crt1);
  543. X509_free(crt2);
  544. if (clientssl != NULL) {
  545. SSL_shutdown(clientssl);
  546. SSL_free(clientssl);
  547. }
  548. if (serverssl != NULL) {
  549. SSL_shutdown(serverssl);
  550. SSL_free(serverssl);
  551. }
  552. SSL_CTX_free(sctx);
  553. SSL_CTX_free(cctx);
  554. OPENSSL_free(skey);
  555. OPENSSL_free(leaf);
  556. OPENSSL_free(int2);
  557. OPENSSL_free(int1);
  558. OPENSSL_free(root);
  559. return testresult;
  560. }
  561. static int test_ssl_build_cert_chain(void)
  562. {
  563. int ret = 0;
  564. SSL_CTX *ssl_ctx = NULL;
  565. SSL *ssl = NULL;
  566. char *skey = test_mk_file_path(certsdir, "leaf.key");
  567. char *leaf_chain = test_mk_file_path(certsdir, "leaf-chain.pem");
  568. if (!TEST_ptr(ssl_ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method())))
  569. goto end;
  570. if (!TEST_ptr(ssl = SSL_new(ssl_ctx)))
  571. goto end;
  572. /* leaf_chain contains leaf + subinterCA + interCA + rootCA */
  573. if (!TEST_int_eq(SSL_use_certificate_chain_file(ssl, leaf_chain), 1)
  574. || !TEST_int_eq(SSL_use_PrivateKey_file(ssl, skey, SSL_FILETYPE_PEM), 1)
  575. || !TEST_int_eq(SSL_check_private_key(ssl), 1))
  576. goto end;
  577. if (!TEST_true(SSL_build_cert_chain(ssl, SSL_BUILD_CHAIN_FLAG_NO_ROOT
  578. | SSL_BUILD_CHAIN_FLAG_CHECK)))
  579. goto end;
  580. ret = 1;
  581. end:
  582. SSL_free(ssl);
  583. SSL_CTX_free(ssl_ctx);
  584. OPENSSL_free(leaf_chain);
  585. OPENSSL_free(skey);
  586. return ret;
  587. }
  588. static int get_password_cb(char *buf, int size, int rw_flag, void *userdata)
  589. {
  590. static const char pass[] = "testpass";
  591. if (!TEST_int_eq(size, PEM_BUFSIZE))
  592. return -1;
  593. memcpy(buf, pass, sizeof(pass) - 1);
  594. return sizeof(pass) - 1;
  595. }
  596. static int test_ssl_ctx_build_cert_chain(void)
  597. {
  598. int ret = 0;
  599. SSL_CTX *ctx = NULL;
  600. char *skey = test_mk_file_path(certsdir, "leaf-encrypted.key");
  601. char *leaf_chain = test_mk_file_path(certsdir, "leaf-chain.pem");
  602. if (!TEST_ptr(ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method())))
  603. goto end;
  604. SSL_CTX_set_default_passwd_cb(ctx, get_password_cb);
  605. /* leaf_chain contains leaf + subinterCA + interCA + rootCA */
  606. if (!TEST_int_eq(SSL_CTX_use_certificate_chain_file(ctx, leaf_chain), 1)
  607. || !TEST_int_eq(SSL_CTX_use_PrivateKey_file(ctx, skey,
  608. SSL_FILETYPE_PEM), 1)
  609. || !TEST_int_eq(SSL_CTX_check_private_key(ctx), 1))
  610. goto end;
  611. if (!TEST_true(SSL_CTX_build_cert_chain(ctx, SSL_BUILD_CHAIN_FLAG_NO_ROOT
  612. | SSL_BUILD_CHAIN_FLAG_CHECK)))
  613. goto end;
  614. ret = 1;
  615. end:
  616. SSL_CTX_free(ctx);
  617. OPENSSL_free(leaf_chain);
  618. OPENSSL_free(skey);
  619. return ret;
  620. }
  621. #ifndef OPENSSL_NO_TLS1_2
  622. static int full_client_hello_callback(SSL *s, int *al, void *arg)
  623. {
  624. int *ctr = arg;
  625. const unsigned char *p;
  626. int *exts;
  627. /* We only configure two ciphers, but the SCSV is added automatically. */
  628. #ifdef OPENSSL_NO_EC
  629. const unsigned char expected_ciphers[] = {0x00, 0x9d, 0x00, 0xff};
  630. #else
  631. const unsigned char expected_ciphers[] = {0x00, 0x9d, 0xc0,
  632. 0x2c, 0x00, 0xff};
  633. #endif
  634. const int expected_extensions[] = {
  635. #ifndef OPENSSL_NO_EC
  636. 11, 10,
  637. #endif
  638. 35, 22, 23, 13};
  639. size_t len;
  640. /* Make sure we can defer processing and get called back. */
  641. if ((*ctr)++ == 0)
  642. return SSL_CLIENT_HELLO_RETRY;
  643. len = SSL_client_hello_get0_ciphers(s, &p);
  644. if (!TEST_mem_eq(p, len, expected_ciphers, sizeof(expected_ciphers))
  645. || !TEST_size_t_eq(
  646. SSL_client_hello_get0_compression_methods(s, &p), 1)
  647. || !TEST_int_eq(*p, 0))
  648. return SSL_CLIENT_HELLO_ERROR;
  649. if (!SSL_client_hello_get1_extensions_present(s, &exts, &len))
  650. return SSL_CLIENT_HELLO_ERROR;
  651. if (len != OSSL_NELEM(expected_extensions) ||
  652. memcmp(exts, expected_extensions, len * sizeof(*exts)) != 0) {
  653. printf("ClientHello callback expected extensions mismatch\n");
  654. OPENSSL_free(exts);
  655. return SSL_CLIENT_HELLO_ERROR;
  656. }
  657. OPENSSL_free(exts);
  658. return SSL_CLIENT_HELLO_SUCCESS;
  659. }
  660. static int test_client_hello_cb(void)
  661. {
  662. SSL_CTX *cctx = NULL, *sctx = NULL;
  663. SSL *clientssl = NULL, *serverssl = NULL;
  664. int testctr = 0, testresult = 0;
  665. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  666. TLS_client_method(), TLS1_VERSION, 0,
  667. &sctx, &cctx, cert, privkey)))
  668. goto end;
  669. SSL_CTX_set_client_hello_cb(sctx, full_client_hello_callback, &testctr);
  670. /* The gimpy cipher list we configure can't do TLS 1.3. */
  671. SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION);
  672. if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
  673. "AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384"))
  674. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  675. &clientssl, NULL, NULL))
  676. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  677. SSL_ERROR_WANT_CLIENT_HELLO_CB))
  678. /*
  679. * Passing a -1 literal is a hack since
  680. * the real value was lost.
  681. * */
  682. || !TEST_int_eq(SSL_get_error(serverssl, -1),
  683. SSL_ERROR_WANT_CLIENT_HELLO_CB)
  684. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  685. SSL_ERROR_NONE)))
  686. goto end;
  687. testresult = 1;
  688. end:
  689. SSL_free(serverssl);
  690. SSL_free(clientssl);
  691. SSL_CTX_free(sctx);
  692. SSL_CTX_free(cctx);
  693. return testresult;
  694. }
  695. static int test_no_ems(void)
  696. {
  697. SSL_CTX *cctx = NULL, *sctx = NULL;
  698. SSL *clientssl = NULL, *serverssl = NULL;
  699. int testresult = 0, status;
  700. if (!create_ssl_ctx_pair(libctx, TLS_server_method(), TLS_client_method(),
  701. TLS1_VERSION, TLS1_2_VERSION,
  702. &sctx, &cctx, cert, privkey)) {
  703. printf("Unable to create SSL_CTX pair\n");
  704. goto end;
  705. }
  706. SSL_CTX_set_options(sctx, SSL_OP_NO_EXTENDED_MASTER_SECRET);
  707. if (!create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL, NULL)) {
  708. printf("Unable to create SSL objects\n");
  709. goto end;
  710. }
  711. status = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE);
  712. if (fips_ems_check) {
  713. if (status == 1) {
  714. printf("When FIPS uses the EMS check a connection that doesn't use EMS should fail\n");
  715. goto end;
  716. }
  717. } else {
  718. if (!status) {
  719. printf("Creating SSL connection failed\n");
  720. goto end;
  721. }
  722. if (SSL_get_extms_support(serverssl)) {
  723. printf("Server reports Extended Master Secret support\n");
  724. goto end;
  725. }
  726. if (SSL_get_extms_support(clientssl)) {
  727. printf("Client reports Extended Master Secret support\n");
  728. goto end;
  729. }
  730. }
  731. testresult = 1;
  732. end:
  733. SSL_free(serverssl);
  734. SSL_free(clientssl);
  735. SSL_CTX_free(sctx);
  736. SSL_CTX_free(cctx);
  737. return testresult;
  738. }
  739. /*
  740. * Very focused test to exercise a single case in the server-side state
  741. * machine, when the ChangeCipherState message needs to actually change
  742. * from one cipher to a different cipher (i.e., not changing from null
  743. * encryption to real encryption).
  744. */
  745. static int test_ccs_change_cipher(void)
  746. {
  747. SSL_CTX *cctx = NULL, *sctx = NULL;
  748. SSL *clientssl = NULL, *serverssl = NULL;
  749. SSL_SESSION *sess = NULL, *sesspre, *sesspost;
  750. int testresult = 0;
  751. int i;
  752. unsigned char buf;
  753. size_t readbytes;
  754. /*
  755. * Create a connection so we can resume and potentially (but not) use
  756. * a different cipher in the second connection.
  757. */
  758. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  759. TLS_client_method(),
  760. TLS1_VERSION, TLS1_2_VERSION,
  761. &sctx, &cctx, cert, privkey))
  762. || !TEST_true(SSL_CTX_set_options(sctx, SSL_OP_NO_TICKET))
  763. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  764. NULL, NULL))
  765. || !TEST_true(SSL_set_cipher_list(clientssl, "AES128-GCM-SHA256"))
  766. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  767. SSL_ERROR_NONE))
  768. || !TEST_ptr(sesspre = SSL_get0_session(serverssl))
  769. || !TEST_ptr(sess = SSL_get1_session(clientssl)))
  770. goto end;
  771. shutdown_ssl_connection(serverssl, clientssl);
  772. serverssl = clientssl = NULL;
  773. /* Resume, preferring a different cipher. Our server will force the
  774. * same cipher to be used as the initial handshake. */
  775. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  776. NULL, NULL))
  777. || !TEST_true(SSL_set_session(clientssl, sess))
  778. || !TEST_true(SSL_set_cipher_list(clientssl, "AES256-GCM-SHA384:AES128-GCM-SHA256"))
  779. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  780. SSL_ERROR_NONE))
  781. || !TEST_true(SSL_session_reused(clientssl))
  782. || !TEST_true(SSL_session_reused(serverssl))
  783. || !TEST_ptr(sesspost = SSL_get0_session(serverssl))
  784. || !TEST_ptr_eq(sesspre, sesspost)
  785. || !TEST_int_eq(TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
  786. SSL_CIPHER_get_id(SSL_get_current_cipher(clientssl))))
  787. goto end;
  788. shutdown_ssl_connection(serverssl, clientssl);
  789. serverssl = clientssl = NULL;
  790. /*
  791. * Now create a fresh connection and try to renegotiate a different
  792. * cipher on it.
  793. */
  794. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  795. NULL, NULL))
  796. || !TEST_true(SSL_set_cipher_list(clientssl, "AES128-GCM-SHA256"))
  797. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  798. SSL_ERROR_NONE))
  799. || !TEST_ptr(sesspre = SSL_get0_session(serverssl))
  800. || !TEST_true(SSL_set_cipher_list(clientssl, "AES256-GCM-SHA384"))
  801. || !TEST_true(SSL_renegotiate(clientssl))
  802. || !TEST_true(SSL_renegotiate_pending(clientssl)))
  803. goto end;
  804. /* Actually drive the renegotiation. */
  805. for (i = 0; i < 3; i++) {
  806. if (SSL_read_ex(clientssl, &buf, sizeof(buf), &readbytes) > 0) {
  807. if (!TEST_ulong_eq(readbytes, 0))
  808. goto end;
  809. } else if (!TEST_int_eq(SSL_get_error(clientssl, 0),
  810. SSL_ERROR_WANT_READ)) {
  811. goto end;
  812. }
  813. if (SSL_read_ex(serverssl, &buf, sizeof(buf), &readbytes) > 0) {
  814. if (!TEST_ulong_eq(readbytes, 0))
  815. goto end;
  816. } else if (!TEST_int_eq(SSL_get_error(serverssl, 0),
  817. SSL_ERROR_WANT_READ)) {
  818. goto end;
  819. }
  820. }
  821. /* sesspre and sesspost should be different since the cipher changed. */
  822. if (!TEST_false(SSL_renegotiate_pending(clientssl))
  823. || !TEST_false(SSL_session_reused(clientssl))
  824. || !TEST_false(SSL_session_reused(serverssl))
  825. || !TEST_ptr(sesspost = SSL_get0_session(serverssl))
  826. || !TEST_ptr_ne(sesspre, sesspost)
  827. || !TEST_int_eq(TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
  828. SSL_CIPHER_get_id(SSL_get_current_cipher(clientssl))))
  829. goto end;
  830. shutdown_ssl_connection(serverssl, clientssl);
  831. serverssl = clientssl = NULL;
  832. testresult = 1;
  833. end:
  834. SSL_free(serverssl);
  835. SSL_free(clientssl);
  836. SSL_CTX_free(sctx);
  837. SSL_CTX_free(cctx);
  838. SSL_SESSION_free(sess);
  839. return testresult;
  840. }
  841. #endif
  842. static int execute_test_large_message(const SSL_METHOD *smeth,
  843. const SSL_METHOD *cmeth,
  844. int min_version, int max_version,
  845. int read_ahead)
  846. {
  847. SSL_CTX *cctx = NULL, *sctx = NULL;
  848. SSL *clientssl = NULL, *serverssl = NULL;
  849. int testresult = 0;
  850. if (!TEST_true(create_ssl_ctx_pair(libctx, smeth, cmeth, min_version,
  851. max_version, &sctx, &cctx, cert,
  852. privkey)))
  853. goto end;
  854. #ifdef OPENSSL_NO_DTLS1_2
  855. if (smeth == DTLS_server_method()) {
  856. /*
  857. * Default sigalgs are SHA1 based in <DTLS1.2 which is in security
  858. * level 0
  859. */
  860. if (!TEST_true(SSL_CTX_set_cipher_list(sctx, "DEFAULT:@SECLEVEL=0"))
  861. || !TEST_true(SSL_CTX_set_cipher_list(cctx,
  862. "DEFAULT:@SECLEVEL=0")))
  863. goto end;
  864. }
  865. #endif
  866. if (read_ahead) {
  867. /*
  868. * Test that read_ahead works correctly when dealing with large
  869. * records
  870. */
  871. SSL_CTX_set_read_ahead(cctx, 1);
  872. }
  873. if (!ssl_ctx_add_large_cert_chain(libctx, sctx, cert))
  874. goto end;
  875. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  876. NULL, NULL))
  877. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  878. SSL_ERROR_NONE)))
  879. goto end;
  880. /*
  881. * Calling SSL_clear() first is not required but this tests that SSL_clear()
  882. * doesn't leak.
  883. */
  884. if (!TEST_true(SSL_clear(serverssl)))
  885. goto end;
  886. testresult = 1;
  887. end:
  888. SSL_free(serverssl);
  889. SSL_free(clientssl);
  890. SSL_CTX_free(sctx);
  891. SSL_CTX_free(cctx);
  892. return testresult;
  893. }
  894. #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_KTLS) && \
  895. !(defined(OSSL_NO_USABLE_TLS1_3) && defined(OPENSSL_NO_TLS1_2))
  896. /* sock must be connected */
  897. static int ktls_chk_platform(int sock)
  898. {
  899. if (!ktls_enable(sock))
  900. return 0;
  901. return 1;
  902. }
  903. static int ping_pong_query(SSL *clientssl, SSL *serverssl)
  904. {
  905. static char count = 1;
  906. unsigned char cbuf[16000] = {0};
  907. unsigned char sbuf[16000];
  908. size_t err = 0;
  909. char crec_wseq_before[SEQ_NUM_SIZE];
  910. char crec_wseq_after[SEQ_NUM_SIZE];
  911. char crec_rseq_before[SEQ_NUM_SIZE];
  912. char crec_rseq_after[SEQ_NUM_SIZE];
  913. char srec_wseq_before[SEQ_NUM_SIZE];
  914. char srec_wseq_after[SEQ_NUM_SIZE];
  915. char srec_rseq_before[SEQ_NUM_SIZE];
  916. char srec_rseq_after[SEQ_NUM_SIZE];
  917. SSL_CONNECTION *clientsc, *serversc;
  918. if (!TEST_ptr(clientsc = SSL_CONNECTION_FROM_SSL_ONLY(clientssl))
  919. || !TEST_ptr(serversc = SSL_CONNECTION_FROM_SSL_ONLY(serverssl)))
  920. goto end;
  921. cbuf[0] = count++;
  922. memcpy(crec_wseq_before, &clientsc->rlayer.wrl->sequence, SEQ_NUM_SIZE);
  923. memcpy(srec_wseq_before, &serversc->rlayer.wrl->sequence, SEQ_NUM_SIZE);
  924. memcpy(crec_rseq_before, &clientsc->rlayer.rrl->sequence, SEQ_NUM_SIZE);
  925. memcpy(srec_rseq_before, &serversc->rlayer.rrl->sequence, SEQ_NUM_SIZE);
  926. if (!TEST_true(SSL_write(clientssl, cbuf, sizeof(cbuf)) == sizeof(cbuf)))
  927. goto end;
  928. while ((err = SSL_read(serverssl, &sbuf, sizeof(sbuf))) != sizeof(sbuf)) {
  929. if (SSL_get_error(serverssl, err) != SSL_ERROR_WANT_READ) {
  930. goto end;
  931. }
  932. }
  933. if (!TEST_true(SSL_write(serverssl, sbuf, sizeof(sbuf)) == sizeof(sbuf)))
  934. goto end;
  935. while ((err = SSL_read(clientssl, &cbuf, sizeof(cbuf))) != sizeof(cbuf)) {
  936. if (SSL_get_error(clientssl, err) != SSL_ERROR_WANT_READ) {
  937. goto end;
  938. }
  939. }
  940. memcpy(crec_wseq_after, &clientsc->rlayer.wrl->sequence, SEQ_NUM_SIZE);
  941. memcpy(srec_wseq_after, &serversc->rlayer.wrl->sequence, SEQ_NUM_SIZE);
  942. memcpy(crec_rseq_after, &clientsc->rlayer.rrl->sequence, SEQ_NUM_SIZE);
  943. memcpy(srec_rseq_after, &serversc->rlayer.rrl->sequence, SEQ_NUM_SIZE);
  944. /* verify the payload */
  945. if (!TEST_mem_eq(cbuf, sizeof(cbuf), sbuf, sizeof(sbuf)))
  946. goto end;
  947. /*
  948. * If ktls is used then kernel sequences are used instead of
  949. * OpenSSL sequences
  950. */
  951. if (!BIO_get_ktls_send(clientsc->wbio)) {
  952. if (!TEST_mem_ne(crec_wseq_before, SEQ_NUM_SIZE,
  953. crec_wseq_after, SEQ_NUM_SIZE))
  954. goto end;
  955. } else {
  956. if (!TEST_mem_eq(crec_wseq_before, SEQ_NUM_SIZE,
  957. crec_wseq_after, SEQ_NUM_SIZE))
  958. goto end;
  959. }
  960. if (!BIO_get_ktls_send(serversc->wbio)) {
  961. if (!TEST_mem_ne(srec_wseq_before, SEQ_NUM_SIZE,
  962. srec_wseq_after, SEQ_NUM_SIZE))
  963. goto end;
  964. } else {
  965. if (!TEST_mem_eq(srec_wseq_before, SEQ_NUM_SIZE,
  966. srec_wseq_after, SEQ_NUM_SIZE))
  967. goto end;
  968. }
  969. if (!BIO_get_ktls_recv(clientsc->wbio)) {
  970. if (!TEST_mem_ne(crec_rseq_before, SEQ_NUM_SIZE,
  971. crec_rseq_after, SEQ_NUM_SIZE))
  972. goto end;
  973. } else {
  974. if (!TEST_mem_eq(crec_rseq_before, SEQ_NUM_SIZE,
  975. crec_rseq_after, SEQ_NUM_SIZE))
  976. goto end;
  977. }
  978. if (!BIO_get_ktls_recv(serversc->wbio)) {
  979. if (!TEST_mem_ne(srec_rseq_before, SEQ_NUM_SIZE,
  980. srec_rseq_after, SEQ_NUM_SIZE))
  981. goto end;
  982. } else {
  983. if (!TEST_mem_eq(srec_rseq_before, SEQ_NUM_SIZE,
  984. srec_rseq_after, SEQ_NUM_SIZE))
  985. goto end;
  986. }
  987. return 1;
  988. end:
  989. return 0;
  990. }
  991. static int execute_test_ktls(int cis_ktls, int sis_ktls,
  992. int tls_version, const char *cipher)
  993. {
  994. SSL_CTX *cctx = NULL, *sctx = NULL;
  995. SSL *clientssl = NULL, *serverssl = NULL;
  996. int ktls_used = 0, testresult = 0;
  997. int cfd = -1, sfd = -1;
  998. int rx_supported;
  999. SSL_CONNECTION *clientsc, *serversc;
  1000. if (!TEST_true(create_test_sockets(&cfd, &sfd, SOCK_STREAM, NULL)))
  1001. goto end;
  1002. /* Skip this test if the platform does not support ktls */
  1003. if (!ktls_chk_platform(cfd)) {
  1004. testresult = TEST_skip("Kernel does not support KTLS");
  1005. goto end;
  1006. }
  1007. if (is_fips && strstr(cipher, "CHACHA") != NULL) {
  1008. testresult = TEST_skip("CHACHA is not supported in FIPS");
  1009. goto end;
  1010. }
  1011. /* Create a session based on SHA-256 */
  1012. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  1013. TLS_client_method(),
  1014. tls_version, tls_version,
  1015. &sctx, &cctx, cert, privkey)))
  1016. goto end;
  1017. if (tls_version == TLS1_3_VERSION) {
  1018. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, cipher))
  1019. || !TEST_true(SSL_CTX_set_ciphersuites(sctx, cipher)))
  1020. goto end;
  1021. } else {
  1022. if (!TEST_true(SSL_CTX_set_cipher_list(cctx, cipher))
  1023. || !TEST_true(SSL_CTX_set_cipher_list(sctx, cipher)))
  1024. goto end;
  1025. }
  1026. if (!TEST_true(create_ssl_objects2(sctx, cctx, &serverssl,
  1027. &clientssl, sfd, cfd)))
  1028. goto end;
  1029. if (!TEST_ptr(clientsc = SSL_CONNECTION_FROM_SSL_ONLY(clientssl))
  1030. || !TEST_ptr(serversc = SSL_CONNECTION_FROM_SSL_ONLY(serverssl)))
  1031. goto end;
  1032. if (cis_ktls) {
  1033. if (!TEST_true(SSL_set_options(clientssl, SSL_OP_ENABLE_KTLS)))
  1034. goto end;
  1035. }
  1036. if (sis_ktls) {
  1037. if (!TEST_true(SSL_set_options(serverssl, SSL_OP_ENABLE_KTLS)))
  1038. goto end;
  1039. }
  1040. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  1041. goto end;
  1042. /*
  1043. * The running kernel may not support a given cipher suite
  1044. * or direction, so just check that KTLS isn't used when it
  1045. * isn't enabled.
  1046. */
  1047. if (!cis_ktls) {
  1048. if (!TEST_false(BIO_get_ktls_send(clientsc->wbio)))
  1049. goto end;
  1050. } else {
  1051. if (BIO_get_ktls_send(clientsc->wbio))
  1052. ktls_used = 1;
  1053. }
  1054. if (!sis_ktls) {
  1055. if (!TEST_false(BIO_get_ktls_send(serversc->wbio)))
  1056. goto end;
  1057. } else {
  1058. if (BIO_get_ktls_send(serversc->wbio))
  1059. ktls_used = 1;
  1060. }
  1061. #if defined(OPENSSL_NO_KTLS_RX)
  1062. rx_supported = 0;
  1063. #else
  1064. rx_supported = 1;
  1065. #endif
  1066. if (!cis_ktls || !rx_supported) {
  1067. if (!TEST_false(BIO_get_ktls_recv(clientsc->rbio)))
  1068. goto end;
  1069. } else {
  1070. if (BIO_get_ktls_send(clientsc->rbio))
  1071. ktls_used = 1;
  1072. }
  1073. if (!sis_ktls || !rx_supported) {
  1074. if (!TEST_false(BIO_get_ktls_recv(serversc->rbio)))
  1075. goto end;
  1076. } else {
  1077. if (BIO_get_ktls_send(serversc->rbio))
  1078. ktls_used = 1;
  1079. }
  1080. if ((cis_ktls || sis_ktls) && !ktls_used) {
  1081. testresult = TEST_skip("KTLS not supported for %s cipher %s",
  1082. tls_version == TLS1_3_VERSION ? "TLS 1.3" :
  1083. "TLS 1.2", cipher);
  1084. goto end;
  1085. }
  1086. if (!TEST_true(ping_pong_query(clientssl, serverssl)))
  1087. goto end;
  1088. testresult = 1;
  1089. end:
  1090. if (clientssl) {
  1091. SSL_shutdown(clientssl);
  1092. SSL_free(clientssl);
  1093. }
  1094. if (serverssl) {
  1095. SSL_shutdown(serverssl);
  1096. SSL_free(serverssl);
  1097. }
  1098. SSL_CTX_free(sctx);
  1099. SSL_CTX_free(cctx);
  1100. serverssl = clientssl = NULL;
  1101. if (cfd != -1)
  1102. close(cfd);
  1103. if (sfd != -1)
  1104. close(sfd);
  1105. return testresult;
  1106. }
  1107. #define SENDFILE_SZ (16 * 4096)
  1108. #define SENDFILE_CHUNK (4 * 4096)
  1109. #define min(a,b) ((a) > (b) ? (b) : (a))
  1110. static int execute_test_ktls_sendfile(int tls_version, const char *cipher,
  1111. int zerocopy)
  1112. {
  1113. SSL_CTX *cctx = NULL, *sctx = NULL;
  1114. SSL *clientssl = NULL, *serverssl = NULL;
  1115. unsigned char *buf, *buf_dst;
  1116. BIO *out = NULL, *in = NULL;
  1117. int cfd = -1, sfd = -1, ffd, err;
  1118. ssize_t chunk_size = 0;
  1119. off_t chunk_off = 0;
  1120. int testresult = 0;
  1121. FILE *ffdp;
  1122. SSL_CONNECTION *serversc;
  1123. buf = OPENSSL_zalloc(SENDFILE_SZ);
  1124. buf_dst = OPENSSL_zalloc(SENDFILE_SZ);
  1125. if (!TEST_ptr(buf) || !TEST_ptr(buf_dst)
  1126. || !TEST_true(create_test_sockets(&cfd, &sfd, SOCK_STREAM, NULL)))
  1127. goto end;
  1128. /* Skip this test if the platform does not support ktls */
  1129. if (!ktls_chk_platform(sfd)) {
  1130. testresult = TEST_skip("Kernel does not support KTLS");
  1131. goto end;
  1132. }
  1133. if (is_fips && strstr(cipher, "CHACHA") != NULL) {
  1134. testresult = TEST_skip("CHACHA is not supported in FIPS");
  1135. goto end;
  1136. }
  1137. /* Create a session based on SHA-256 */
  1138. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  1139. TLS_client_method(),
  1140. tls_version, tls_version,
  1141. &sctx, &cctx, cert, privkey)))
  1142. goto end;
  1143. if (tls_version == TLS1_3_VERSION) {
  1144. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, cipher))
  1145. || !TEST_true(SSL_CTX_set_ciphersuites(sctx, cipher)))
  1146. goto end;
  1147. } else {
  1148. if (!TEST_true(SSL_CTX_set_cipher_list(cctx, cipher))
  1149. || !TEST_true(SSL_CTX_set_cipher_list(sctx, cipher)))
  1150. goto end;
  1151. }
  1152. if (!TEST_true(create_ssl_objects2(sctx, cctx, &serverssl,
  1153. &clientssl, sfd, cfd)))
  1154. goto end;
  1155. if (!TEST_ptr(serversc = SSL_CONNECTION_FROM_SSL_ONLY(serverssl)))
  1156. goto end;
  1157. if (!TEST_true(SSL_set_options(serverssl, SSL_OP_ENABLE_KTLS)))
  1158. goto end;
  1159. if (zerocopy) {
  1160. if (!TEST_true(SSL_set_options(serverssl,
  1161. SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE)))
  1162. goto end;
  1163. }
  1164. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  1165. SSL_ERROR_NONE)))
  1166. goto end;
  1167. if (!BIO_get_ktls_send(serversc->wbio)) {
  1168. testresult = TEST_skip("Failed to enable KTLS for %s cipher %s",
  1169. tls_version == TLS1_3_VERSION ? "TLS 1.3" :
  1170. "TLS 1.2", cipher);
  1171. goto end;
  1172. }
  1173. if (!TEST_int_gt(RAND_bytes_ex(libctx, buf, SENDFILE_SZ, 0), 0))
  1174. goto end;
  1175. out = BIO_new_file(tmpfilename, "wb");
  1176. if (!TEST_ptr(out))
  1177. goto end;
  1178. if (BIO_write(out, buf, SENDFILE_SZ) != SENDFILE_SZ)
  1179. goto end;
  1180. BIO_free(out);
  1181. out = NULL;
  1182. in = BIO_new_file(tmpfilename, "rb");
  1183. BIO_get_fp(in, &ffdp);
  1184. ffd = fileno(ffdp);
  1185. while (chunk_off < SENDFILE_SZ) {
  1186. chunk_size = min(SENDFILE_CHUNK, SENDFILE_SZ - chunk_off);
  1187. while ((err = SSL_sendfile(serverssl,
  1188. ffd,
  1189. chunk_off,
  1190. chunk_size,
  1191. 0)) != chunk_size) {
  1192. if (SSL_get_error(serverssl, err) != SSL_ERROR_WANT_WRITE)
  1193. goto end;
  1194. }
  1195. while ((err = SSL_read(clientssl,
  1196. buf_dst + chunk_off,
  1197. chunk_size)) != chunk_size) {
  1198. if (SSL_get_error(clientssl, err) != SSL_ERROR_WANT_READ)
  1199. goto end;
  1200. }
  1201. /* verify the payload */
  1202. if (!TEST_mem_eq(buf_dst + chunk_off,
  1203. chunk_size,
  1204. buf + chunk_off,
  1205. chunk_size))
  1206. goto end;
  1207. chunk_off += chunk_size;
  1208. }
  1209. testresult = 1;
  1210. end:
  1211. if (clientssl) {
  1212. SSL_shutdown(clientssl);
  1213. SSL_free(clientssl);
  1214. }
  1215. if (serverssl) {
  1216. SSL_shutdown(serverssl);
  1217. SSL_free(serverssl);
  1218. }
  1219. SSL_CTX_free(sctx);
  1220. SSL_CTX_free(cctx);
  1221. serverssl = clientssl = NULL;
  1222. BIO_free(out);
  1223. BIO_free(in);
  1224. if (cfd != -1)
  1225. close(cfd);
  1226. if (sfd != -1)
  1227. close(sfd);
  1228. OPENSSL_free(buf);
  1229. OPENSSL_free(buf_dst);
  1230. return testresult;
  1231. }
  1232. static struct ktls_test_cipher {
  1233. int tls_version;
  1234. const char *cipher;
  1235. } ktls_test_ciphers[] = {
  1236. # if !defined(OPENSSL_NO_TLS1_2)
  1237. # ifdef OPENSSL_KTLS_AES_GCM_128
  1238. { TLS1_2_VERSION, "AES128-GCM-SHA256" },
  1239. # endif
  1240. # ifdef OPENSSL_KTLS_AES_CCM_128
  1241. { TLS1_2_VERSION, "AES128-CCM"},
  1242. # endif
  1243. # ifdef OPENSSL_KTLS_AES_GCM_256
  1244. { TLS1_2_VERSION, "AES256-GCM-SHA384"},
  1245. # endif
  1246. # ifdef OPENSSL_KTLS_CHACHA20_POLY1305
  1247. # ifndef OPENSSL_NO_EC
  1248. { TLS1_2_VERSION, "ECDHE-RSA-CHACHA20-POLY1305"},
  1249. # endif
  1250. # endif
  1251. # endif
  1252. # if !defined(OSSL_NO_USABLE_TLS1_3)
  1253. # ifdef OPENSSL_KTLS_AES_GCM_128
  1254. { TLS1_3_VERSION, "TLS_AES_128_GCM_SHA256" },
  1255. # endif
  1256. # ifdef OPENSSL_KTLS_AES_CCM_128
  1257. { TLS1_3_VERSION, "TLS_AES_128_CCM_SHA256" },
  1258. # endif
  1259. # ifdef OPENSSL_KTLS_AES_GCM_256
  1260. { TLS1_3_VERSION, "TLS_AES_256_GCM_SHA384" },
  1261. # endif
  1262. # ifdef OPENSSL_KTLS_CHACHA20_POLY1305
  1263. { TLS1_3_VERSION, "TLS_CHACHA20_POLY1305_SHA256" },
  1264. # endif
  1265. # endif
  1266. };
  1267. #define NUM_KTLS_TEST_CIPHERS \
  1268. (sizeof(ktls_test_ciphers) / sizeof(ktls_test_ciphers[0]))
  1269. static int test_ktls(int test)
  1270. {
  1271. struct ktls_test_cipher *cipher;
  1272. int cis_ktls, sis_ktls;
  1273. OPENSSL_assert(test / 4 < (int)NUM_KTLS_TEST_CIPHERS);
  1274. cipher = &ktls_test_ciphers[test / 4];
  1275. cis_ktls = (test & 1) != 0;
  1276. sis_ktls = (test & 2) != 0;
  1277. return execute_test_ktls(cis_ktls, sis_ktls, cipher->tls_version,
  1278. cipher->cipher);
  1279. }
  1280. static int test_ktls_sendfile(int test)
  1281. {
  1282. struct ktls_test_cipher *cipher;
  1283. int tst = test >> 1;
  1284. OPENSSL_assert(tst < (int)NUM_KTLS_TEST_CIPHERS);
  1285. cipher = &ktls_test_ciphers[tst];
  1286. return execute_test_ktls_sendfile(cipher->tls_version, cipher->cipher,
  1287. test & 1);
  1288. }
  1289. #endif
  1290. static int test_large_message_tls(void)
  1291. {
  1292. return execute_test_large_message(TLS_server_method(), TLS_client_method(),
  1293. TLS1_VERSION, 0, 0);
  1294. }
  1295. static int test_large_message_tls_read_ahead(void)
  1296. {
  1297. return execute_test_large_message(TLS_server_method(), TLS_client_method(),
  1298. TLS1_VERSION, 0, 1);
  1299. }
  1300. #ifndef OPENSSL_NO_DTLS
  1301. static int test_large_message_dtls(void)
  1302. {
  1303. # ifdef OPENSSL_NO_DTLS1_2
  1304. /* Not supported in the FIPS provider */
  1305. if (is_fips)
  1306. return 1;
  1307. # endif
  1308. /*
  1309. * read_ahead is not relevant to DTLS because DTLS always acts as if
  1310. * read_ahead is set.
  1311. */
  1312. return execute_test_large_message(DTLS_server_method(),
  1313. DTLS_client_method(),
  1314. DTLS1_VERSION, 0, 0);
  1315. }
  1316. #endif
  1317. /*
  1318. * Test we can successfully send the maximum amount of application data. We
  1319. * test each protocol version individually, each with and without EtM enabled.
  1320. * TLSv1.3 doesn't use EtM so technically it is redundant to test both but it is
  1321. * simpler this way. We also test all combinations with and without the
  1322. * SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS option which affects the size of the
  1323. * underlying buffer.
  1324. */
  1325. static int test_large_app_data(int tst)
  1326. {
  1327. SSL_CTX *cctx = NULL, *sctx = NULL;
  1328. SSL *clientssl = NULL, *serverssl = NULL;
  1329. int testresult = 0, prot;
  1330. unsigned char *msg, *buf = NULL;
  1331. size_t written, readbytes;
  1332. const SSL_METHOD *smeth = TLS_server_method();
  1333. const SSL_METHOD *cmeth = TLS_client_method();
  1334. switch (tst >> 2) {
  1335. case 0:
  1336. #ifndef OSSL_NO_USABLE_TLS1_3
  1337. prot = TLS1_3_VERSION;
  1338. break;
  1339. #else
  1340. return 1;
  1341. #endif
  1342. case 1:
  1343. #ifndef OPENSSL_NO_TLS1_2
  1344. prot = TLS1_2_VERSION;
  1345. break;
  1346. #else
  1347. return 1;
  1348. #endif
  1349. case 2:
  1350. #ifndef OPENSSL_NO_TLS1_1
  1351. prot = TLS1_1_VERSION;
  1352. break;
  1353. #else
  1354. return 1;
  1355. #endif
  1356. case 3:
  1357. #ifndef OPENSSL_NO_TLS1
  1358. prot = TLS1_VERSION;
  1359. break;
  1360. #else
  1361. return 1;
  1362. #endif
  1363. case 4:
  1364. #ifndef OPENSSL_NO_SSL3
  1365. prot = SSL3_VERSION;
  1366. break;
  1367. #else
  1368. return 1;
  1369. #endif
  1370. case 5:
  1371. #ifndef OPENSSL_NO_DTLS1_2
  1372. prot = DTLS1_2_VERSION;
  1373. smeth = DTLS_server_method();
  1374. cmeth = DTLS_client_method();
  1375. break;
  1376. #else
  1377. return 1;
  1378. #endif
  1379. case 6:
  1380. #ifndef OPENSSL_NO_DTLS1
  1381. prot = DTLS1_VERSION;
  1382. smeth = DTLS_server_method();
  1383. cmeth = DTLS_client_method();
  1384. break;
  1385. #else
  1386. return 1;
  1387. #endif
  1388. default:
  1389. /* Shouldn't happen */
  1390. return 0;
  1391. }
  1392. if ((prot < TLS1_2_VERSION || prot == DTLS1_VERSION) && is_fips)
  1393. return 1;
  1394. /* Maximal sized message of zeros */
  1395. msg = OPENSSL_zalloc(SSL3_RT_MAX_PLAIN_LENGTH);
  1396. if (!TEST_ptr(msg))
  1397. goto end;
  1398. buf = OPENSSL_malloc(SSL3_RT_MAX_PLAIN_LENGTH + 1);
  1399. if (!TEST_ptr(buf))
  1400. goto end;
  1401. /* Set whole buffer to all bits set */
  1402. memset(buf, 0xff, SSL3_RT_MAX_PLAIN_LENGTH + 1);
  1403. if (!TEST_true(create_ssl_ctx_pair(libctx, smeth, cmeth, prot, prot,
  1404. &sctx, &cctx, cert, privkey)))
  1405. goto end;
  1406. if (prot < TLS1_2_VERSION || prot == DTLS1_VERSION) {
  1407. /* Older protocol versions need SECLEVEL=0 due to SHA1 usage */
  1408. if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "DEFAULT:@SECLEVEL=0"))
  1409. || !TEST_true(SSL_CTX_set_cipher_list(sctx,
  1410. "DEFAULT:@SECLEVEL=0")))
  1411. goto end;
  1412. }
  1413. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  1414. &clientssl, NULL, NULL)))
  1415. goto end;
  1416. if ((tst & 1) != 0) {
  1417. /* Setting this option gives us a minimally sized underlying buffer */
  1418. if (!TEST_true(SSL_set_options(serverssl,
  1419. SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
  1420. || !TEST_true(SSL_set_options(clientssl,
  1421. SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)))
  1422. goto end;
  1423. }
  1424. if ((tst & 2) != 0) {
  1425. /*
  1426. * Setting this option means the MAC is added before encryption
  1427. * giving us a larger record for the encryption process
  1428. */
  1429. if (!TEST_true(SSL_set_options(serverssl, SSL_OP_NO_ENCRYPT_THEN_MAC))
  1430. || !TEST_true(SSL_set_options(clientssl,
  1431. SSL_OP_NO_ENCRYPT_THEN_MAC)))
  1432. goto end;
  1433. }
  1434. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  1435. goto end;
  1436. if (!TEST_true(SSL_write_ex(clientssl, msg, SSL3_RT_MAX_PLAIN_LENGTH,
  1437. &written))
  1438. || !TEST_size_t_eq(written, SSL3_RT_MAX_PLAIN_LENGTH))
  1439. goto end;
  1440. /* We provide a buffer slightly larger than what we are actually expecting */
  1441. if (!TEST_true(SSL_read_ex(serverssl, buf, SSL3_RT_MAX_PLAIN_LENGTH + 1,
  1442. &readbytes)))
  1443. goto end;
  1444. if (!TEST_mem_eq(msg, written, buf, readbytes))
  1445. goto end;
  1446. testresult = 1;
  1447. end:
  1448. OPENSSL_free(msg);
  1449. OPENSSL_free(buf);
  1450. SSL_free(serverssl);
  1451. SSL_free(clientssl);
  1452. SSL_CTX_free(sctx);
  1453. SSL_CTX_free(cctx);
  1454. return testresult;
  1455. }
  1456. #if !defined(OPENSSL_NO_TLS1_2) || !defined(OSSL_NO_USABLE_TLS1_3) \
  1457. || !defined(OPENSSL_NO_DTLS)
  1458. static int execute_cleanse_plaintext(const SSL_METHOD *smeth,
  1459. const SSL_METHOD *cmeth,
  1460. int min_version, int max_version)
  1461. {
  1462. size_t i;
  1463. SSL_CTX *cctx = NULL, *sctx = NULL;
  1464. SSL *clientssl = NULL, *serverssl = NULL;
  1465. int testresult = 0;
  1466. const unsigned char *zbuf;
  1467. SSL_CONNECTION *serversc;
  1468. TLS_RECORD *rr;
  1469. static unsigned char cbuf[16000];
  1470. static unsigned char sbuf[16000];
  1471. if (!TEST_true(create_ssl_ctx_pair(libctx,
  1472. smeth, cmeth,
  1473. min_version, max_version,
  1474. &sctx, &cctx, cert,
  1475. privkey)))
  1476. goto end;
  1477. # ifdef OPENSSL_NO_DTLS1_2
  1478. if (smeth == DTLS_server_method()) {
  1479. /* Not supported in the FIPS provider */
  1480. if (is_fips) {
  1481. testresult = 1;
  1482. goto end;
  1483. };
  1484. /*
  1485. * Default sigalgs are SHA1 based in <DTLS1.2 which is in security
  1486. * level 0
  1487. */
  1488. if (!TEST_true(SSL_CTX_set_cipher_list(sctx, "DEFAULT:@SECLEVEL=0"))
  1489. || !TEST_true(SSL_CTX_set_cipher_list(cctx,
  1490. "DEFAULT:@SECLEVEL=0")))
  1491. goto end;
  1492. }
  1493. # endif
  1494. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  1495. NULL, NULL)))
  1496. goto end;
  1497. if (!TEST_true(SSL_set_options(serverssl, SSL_OP_CLEANSE_PLAINTEXT)))
  1498. goto end;
  1499. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  1500. SSL_ERROR_NONE)))
  1501. goto end;
  1502. for (i = 0; i < sizeof(cbuf); i++) {
  1503. cbuf[i] = i & 0xff;
  1504. }
  1505. if (!TEST_int_eq(SSL_write(clientssl, cbuf, sizeof(cbuf)), sizeof(cbuf)))
  1506. goto end;
  1507. if (!TEST_int_eq(SSL_peek(serverssl, &sbuf, sizeof(sbuf)), sizeof(sbuf)))
  1508. goto end;
  1509. if (!TEST_mem_eq(cbuf, sizeof(cbuf), sbuf, sizeof(sbuf)))
  1510. goto end;
  1511. /*
  1512. * Since we called SSL_peek(), we know the data in the record
  1513. * layer is a plaintext record. We can gather the pointer to check
  1514. * for zeroization after SSL_read().
  1515. */
  1516. if (!TEST_ptr(serversc = SSL_CONNECTION_FROM_SSL_ONLY(serverssl)))
  1517. goto end;
  1518. rr = serversc->rlayer.tlsrecs;
  1519. zbuf = &rr->data[rr->off];
  1520. if (!TEST_int_eq(rr->length, sizeof(cbuf)))
  1521. goto end;
  1522. /*
  1523. * After SSL_peek() the plaintext must still be stored in the
  1524. * record.
  1525. */
  1526. if (!TEST_mem_eq(cbuf, sizeof(cbuf), zbuf, sizeof(cbuf)))
  1527. goto end;
  1528. memset(sbuf, 0, sizeof(sbuf));
  1529. if (!TEST_int_eq(SSL_read(serverssl, &sbuf, sizeof(sbuf)), sizeof(sbuf)))
  1530. goto end;
  1531. if (!TEST_mem_eq(cbuf, sizeof(cbuf), sbuf, sizeof(cbuf)))
  1532. goto end;
  1533. /* Check if rbuf is cleansed */
  1534. memset(cbuf, 0, sizeof(cbuf));
  1535. if (!TEST_mem_eq(cbuf, sizeof(cbuf), zbuf, sizeof(cbuf)))
  1536. goto end;
  1537. testresult = 1;
  1538. end:
  1539. SSL_free(serverssl);
  1540. SSL_free(clientssl);
  1541. SSL_CTX_free(sctx);
  1542. SSL_CTX_free(cctx);
  1543. return testresult;
  1544. }
  1545. #endif /*
  1546. * !defined(OPENSSL_NO_TLS1_2) || !defined(OSSL_NO_USABLE_TLS1_3)
  1547. * || !defined(OPENSSL_NO_DTLS)
  1548. */
  1549. static int test_cleanse_plaintext(void)
  1550. {
  1551. #if !defined(OPENSSL_NO_TLS1_2)
  1552. if (!TEST_true(execute_cleanse_plaintext(TLS_server_method(),
  1553. TLS_client_method(),
  1554. TLS1_2_VERSION,
  1555. TLS1_2_VERSION)))
  1556. return 0;
  1557. #endif
  1558. #if !defined(OSSL_NO_USABLE_TLS1_3)
  1559. if (!TEST_true(execute_cleanse_plaintext(TLS_server_method(),
  1560. TLS_client_method(),
  1561. TLS1_3_VERSION,
  1562. TLS1_3_VERSION)))
  1563. return 0;
  1564. #endif
  1565. #if !defined(OPENSSL_NO_DTLS)
  1566. if (!TEST_true(execute_cleanse_plaintext(DTLS_server_method(),
  1567. DTLS_client_method(),
  1568. DTLS1_VERSION,
  1569. 0)))
  1570. return 0;
  1571. #endif
  1572. return 1;
  1573. }
  1574. #ifndef OPENSSL_NO_OCSP
  1575. static int ocsp_server_cb(SSL *s, void *arg)
  1576. {
  1577. int *argi = (int *)arg;
  1578. unsigned char *copy = NULL;
  1579. STACK_OF(OCSP_RESPID) *ids = NULL;
  1580. OCSP_RESPID *id = NULL;
  1581. if (*argi == 2) {
  1582. /* In this test we are expecting exactly 1 OCSP_RESPID */
  1583. SSL_get_tlsext_status_ids(s, &ids);
  1584. if (ids == NULL || sk_OCSP_RESPID_num(ids) != 1)
  1585. return SSL_TLSEXT_ERR_ALERT_FATAL;
  1586. id = sk_OCSP_RESPID_value(ids, 0);
  1587. if (id == NULL || !OCSP_RESPID_match_ex(id, ocspcert, libctx, NULL))
  1588. return SSL_TLSEXT_ERR_ALERT_FATAL;
  1589. } else if (*argi != 1) {
  1590. return SSL_TLSEXT_ERR_ALERT_FATAL;
  1591. }
  1592. if (!TEST_ptr(copy = OPENSSL_memdup(orespder, sizeof(orespder))))
  1593. return SSL_TLSEXT_ERR_ALERT_FATAL;
  1594. if (!TEST_true(SSL_set_tlsext_status_ocsp_resp(s, copy,
  1595. sizeof(orespder)))) {
  1596. OPENSSL_free(copy);
  1597. return SSL_TLSEXT_ERR_ALERT_FATAL;
  1598. }
  1599. ocsp_server_called = 1;
  1600. return SSL_TLSEXT_ERR_OK;
  1601. }
  1602. static int ocsp_client_cb(SSL *s, void *arg)
  1603. {
  1604. int *argi = (int *)arg;
  1605. const unsigned char *respderin;
  1606. size_t len;
  1607. if (*argi != 1 && *argi != 2)
  1608. return 0;
  1609. len = SSL_get_tlsext_status_ocsp_resp(s, &respderin);
  1610. if (!TEST_mem_eq(orespder, len, respderin, len))
  1611. return 0;
  1612. ocsp_client_called = 1;
  1613. return 1;
  1614. }
  1615. static int test_tlsext_status_type(void)
  1616. {
  1617. SSL_CTX *cctx = NULL, *sctx = NULL;
  1618. SSL *clientssl = NULL, *serverssl = NULL;
  1619. int testresult = 0;
  1620. STACK_OF(OCSP_RESPID) *ids = NULL;
  1621. OCSP_RESPID *id = NULL;
  1622. BIO *certbio = NULL;
  1623. if (!create_ssl_ctx_pair(libctx, TLS_server_method(), TLS_client_method(),
  1624. TLS1_VERSION, 0,
  1625. &sctx, &cctx, cert, privkey))
  1626. return 0;
  1627. if (SSL_CTX_get_tlsext_status_type(cctx) != -1)
  1628. goto end;
  1629. /* First just do various checks getting and setting tlsext_status_type */
  1630. clientssl = SSL_new(cctx);
  1631. if (!TEST_int_eq(SSL_get_tlsext_status_type(clientssl), -1)
  1632. || !TEST_true(SSL_set_tlsext_status_type(clientssl,
  1633. TLSEXT_STATUSTYPE_ocsp))
  1634. || !TEST_int_eq(SSL_get_tlsext_status_type(clientssl),
  1635. TLSEXT_STATUSTYPE_ocsp))
  1636. goto end;
  1637. SSL_free(clientssl);
  1638. clientssl = NULL;
  1639. if (!SSL_CTX_set_tlsext_status_type(cctx, TLSEXT_STATUSTYPE_ocsp)
  1640. || SSL_CTX_get_tlsext_status_type(cctx) != TLSEXT_STATUSTYPE_ocsp)
  1641. goto end;
  1642. clientssl = SSL_new(cctx);
  1643. if (SSL_get_tlsext_status_type(clientssl) != TLSEXT_STATUSTYPE_ocsp)
  1644. goto end;
  1645. SSL_free(clientssl);
  1646. clientssl = NULL;
  1647. /*
  1648. * Now actually do a handshake and check OCSP information is exchanged and
  1649. * the callbacks get called
  1650. */
  1651. SSL_CTX_set_tlsext_status_cb(cctx, ocsp_client_cb);
  1652. SSL_CTX_set_tlsext_status_arg(cctx, &cdummyarg);
  1653. SSL_CTX_set_tlsext_status_cb(sctx, ocsp_server_cb);
  1654. SSL_CTX_set_tlsext_status_arg(sctx, &cdummyarg);
  1655. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  1656. &clientssl, NULL, NULL))
  1657. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  1658. SSL_ERROR_NONE))
  1659. || !TEST_true(ocsp_client_called)
  1660. || !TEST_true(ocsp_server_called))
  1661. goto end;
  1662. SSL_free(serverssl);
  1663. SSL_free(clientssl);
  1664. serverssl = NULL;
  1665. clientssl = NULL;
  1666. /* Try again but this time force the server side callback to fail */
  1667. ocsp_client_called = 0;
  1668. ocsp_server_called = 0;
  1669. cdummyarg = 0;
  1670. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  1671. &clientssl, NULL, NULL))
  1672. /* This should fail because the callback will fail */
  1673. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  1674. SSL_ERROR_NONE))
  1675. || !TEST_false(ocsp_client_called)
  1676. || !TEST_false(ocsp_server_called))
  1677. goto end;
  1678. SSL_free(serverssl);
  1679. SSL_free(clientssl);
  1680. serverssl = NULL;
  1681. clientssl = NULL;
  1682. /*
  1683. * This time we'll get the client to send an OCSP_RESPID that it will
  1684. * accept.
  1685. */
  1686. ocsp_client_called = 0;
  1687. ocsp_server_called = 0;
  1688. cdummyarg = 2;
  1689. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  1690. &clientssl, NULL, NULL)))
  1691. goto end;
  1692. /*
  1693. * We'll just use any old cert for this test - it doesn't have to be an OCSP
  1694. * specific one. We'll use the server cert.
  1695. */
  1696. if (!TEST_ptr(certbio = BIO_new_file(cert, "r"))
  1697. || !TEST_ptr(id = OCSP_RESPID_new())
  1698. || !TEST_ptr(ids = sk_OCSP_RESPID_new_null())
  1699. || !TEST_ptr(ocspcert = X509_new_ex(libctx, NULL))
  1700. || !TEST_ptr(PEM_read_bio_X509(certbio, &ocspcert, NULL, NULL))
  1701. || !TEST_true(OCSP_RESPID_set_by_key_ex(id, ocspcert, libctx, NULL))
  1702. || !TEST_true(sk_OCSP_RESPID_push(ids, id)))
  1703. goto end;
  1704. id = NULL;
  1705. SSL_set_tlsext_status_ids(clientssl, ids);
  1706. /* Control has been transferred */
  1707. ids = NULL;
  1708. BIO_free(certbio);
  1709. certbio = NULL;
  1710. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  1711. SSL_ERROR_NONE))
  1712. || !TEST_true(ocsp_client_called)
  1713. || !TEST_true(ocsp_server_called))
  1714. goto end;
  1715. testresult = 1;
  1716. end:
  1717. SSL_free(serverssl);
  1718. SSL_free(clientssl);
  1719. SSL_CTX_free(sctx);
  1720. SSL_CTX_free(cctx);
  1721. sk_OCSP_RESPID_pop_free(ids, OCSP_RESPID_free);
  1722. OCSP_RESPID_free(id);
  1723. BIO_free(certbio);
  1724. X509_free(ocspcert);
  1725. ocspcert = NULL;
  1726. return testresult;
  1727. }
  1728. #endif
  1729. #if !defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
  1730. static int new_called, remove_called, get_called;
  1731. static int new_session_cb(SSL *ssl, SSL_SESSION *sess)
  1732. {
  1733. new_called++;
  1734. /*
  1735. * sess has been up-refed for us, but we don't actually need it so free it
  1736. * immediately.
  1737. */
  1738. SSL_SESSION_free(sess);
  1739. return 1;
  1740. }
  1741. static void remove_session_cb(SSL_CTX *ctx, SSL_SESSION *sess)
  1742. {
  1743. remove_called++;
  1744. }
  1745. static SSL_SESSION *get_sess_val = NULL;
  1746. static SSL_SESSION *get_session_cb(SSL *ssl, const unsigned char *id, int len,
  1747. int *copy)
  1748. {
  1749. get_called++;
  1750. *copy = 1;
  1751. return get_sess_val;
  1752. }
  1753. static int execute_test_session(int maxprot, int use_int_cache,
  1754. int use_ext_cache, long s_options)
  1755. {
  1756. SSL_CTX *sctx = NULL, *cctx = NULL;
  1757. SSL *serverssl1 = NULL, *clientssl1 = NULL;
  1758. SSL *serverssl2 = NULL, *clientssl2 = NULL;
  1759. # ifndef OPENSSL_NO_TLS1_1
  1760. SSL *serverssl3 = NULL, *clientssl3 = NULL;
  1761. # endif
  1762. SSL_SESSION *sess1 = NULL, *sess2 = NULL;
  1763. int testresult = 0, numnewsesstick = 1;
  1764. new_called = remove_called = 0;
  1765. /* TLSv1.3 sends 2 NewSessionTickets */
  1766. if (maxprot == TLS1_3_VERSION)
  1767. numnewsesstick = 2;
  1768. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  1769. TLS_client_method(), TLS1_VERSION, 0,
  1770. &sctx, &cctx, cert, privkey)))
  1771. return 0;
  1772. /*
  1773. * Only allow the max protocol version so we can force a connection failure
  1774. * later
  1775. */
  1776. SSL_CTX_set_min_proto_version(cctx, maxprot);
  1777. SSL_CTX_set_max_proto_version(cctx, maxprot);
  1778. /* Set up session cache */
  1779. if (use_ext_cache) {
  1780. SSL_CTX_sess_set_new_cb(cctx, new_session_cb);
  1781. SSL_CTX_sess_set_remove_cb(cctx, remove_session_cb);
  1782. }
  1783. if (use_int_cache) {
  1784. /* Also covers instance where both are set */
  1785. SSL_CTX_set_session_cache_mode(cctx, SSL_SESS_CACHE_CLIENT);
  1786. } else {
  1787. SSL_CTX_set_session_cache_mode(cctx,
  1788. SSL_SESS_CACHE_CLIENT
  1789. | SSL_SESS_CACHE_NO_INTERNAL_STORE);
  1790. }
  1791. if (s_options) {
  1792. SSL_CTX_set_options(sctx, s_options);
  1793. }
  1794. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl1, &clientssl1,
  1795. NULL, NULL))
  1796. || !TEST_true(create_ssl_connection(serverssl1, clientssl1,
  1797. SSL_ERROR_NONE))
  1798. || !TEST_ptr(sess1 = SSL_get1_session(clientssl1)))
  1799. goto end;
  1800. /* Should fail because it should already be in the cache */
  1801. if (use_int_cache && !TEST_false(SSL_CTX_add_session(cctx, sess1)))
  1802. goto end;
  1803. if (use_ext_cache
  1804. && (!TEST_int_eq(new_called, numnewsesstick)
  1805. || !TEST_int_eq(remove_called, 0)))
  1806. goto end;
  1807. new_called = remove_called = 0;
  1808. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl2,
  1809. &clientssl2, NULL, NULL))
  1810. || !TEST_true(SSL_set_session(clientssl2, sess1))
  1811. || !TEST_true(create_ssl_connection(serverssl2, clientssl2,
  1812. SSL_ERROR_NONE))
  1813. || !TEST_true(SSL_session_reused(clientssl2)))
  1814. goto end;
  1815. if (maxprot == TLS1_3_VERSION) {
  1816. /*
  1817. * In TLSv1.3 we should have created a new session even though we have
  1818. * resumed. Since we attempted a resume we should also have removed the
  1819. * old ticket from the cache so that we try to only use tickets once.
  1820. */
  1821. if (use_ext_cache
  1822. && (!TEST_int_eq(new_called, 1)
  1823. || !TEST_int_eq(remove_called, 1)))
  1824. goto end;
  1825. } else {
  1826. /*
  1827. * In TLSv1.2 we expect to have resumed so no sessions added or
  1828. * removed.
  1829. */
  1830. if (use_ext_cache
  1831. && (!TEST_int_eq(new_called, 0)
  1832. || !TEST_int_eq(remove_called, 0)))
  1833. goto end;
  1834. }
  1835. SSL_SESSION_free(sess1);
  1836. if (!TEST_ptr(sess1 = SSL_get1_session(clientssl2)))
  1837. goto end;
  1838. shutdown_ssl_connection(serverssl2, clientssl2);
  1839. serverssl2 = clientssl2 = NULL;
  1840. new_called = remove_called = 0;
  1841. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl2,
  1842. &clientssl2, NULL, NULL))
  1843. || !TEST_true(create_ssl_connection(serverssl2, clientssl2,
  1844. SSL_ERROR_NONE)))
  1845. goto end;
  1846. if (!TEST_ptr(sess2 = SSL_get1_session(clientssl2)))
  1847. goto end;
  1848. if (use_ext_cache
  1849. && (!TEST_int_eq(new_called, numnewsesstick)
  1850. || !TEST_int_eq(remove_called, 0)))
  1851. goto end;
  1852. new_called = remove_called = 0;
  1853. /*
  1854. * This should clear sess2 from the cache because it is a "bad" session.
  1855. * See SSL_set_session() documentation.
  1856. */
  1857. if (!TEST_true(SSL_set_session(clientssl2, sess1)))
  1858. goto end;
  1859. if (use_ext_cache
  1860. && (!TEST_int_eq(new_called, 0) || !TEST_int_eq(remove_called, 1)))
  1861. goto end;
  1862. if (!TEST_ptr_eq(SSL_get_session(clientssl2), sess1))
  1863. goto end;
  1864. if (use_int_cache) {
  1865. /* Should succeeded because it should not already be in the cache */
  1866. if (!TEST_true(SSL_CTX_add_session(cctx, sess2))
  1867. || !TEST_true(SSL_CTX_remove_session(cctx, sess2)))
  1868. goto end;
  1869. }
  1870. new_called = remove_called = 0;
  1871. /* This shouldn't be in the cache so should fail */
  1872. if (!TEST_false(SSL_CTX_remove_session(cctx, sess2)))
  1873. goto end;
  1874. if (use_ext_cache
  1875. && (!TEST_int_eq(new_called, 0) || !TEST_int_eq(remove_called, 1)))
  1876. goto end;
  1877. # if !defined(OPENSSL_NO_TLS1_1)
  1878. new_called = remove_called = 0;
  1879. /* Force a connection failure */
  1880. SSL_CTX_set_max_proto_version(sctx, TLS1_1_VERSION);
  1881. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl3,
  1882. &clientssl3, NULL, NULL))
  1883. || !TEST_true(SSL_set_session(clientssl3, sess1))
  1884. /* This should fail because of the mismatched protocol versions */
  1885. || !TEST_false(create_ssl_connection(serverssl3, clientssl3,
  1886. SSL_ERROR_NONE)))
  1887. goto end;
  1888. /* We should have automatically removed the session from the cache */
  1889. if (use_ext_cache
  1890. && (!TEST_int_eq(new_called, 0) || !TEST_int_eq(remove_called, 1)))
  1891. goto end;
  1892. /* Should succeed because it should not already be in the cache */
  1893. if (use_int_cache && !TEST_true(SSL_CTX_add_session(cctx, sess2)))
  1894. goto end;
  1895. # endif
  1896. /* Now do some tests for server side caching */
  1897. if (use_ext_cache) {
  1898. SSL_CTX_sess_set_new_cb(cctx, NULL);
  1899. SSL_CTX_sess_set_remove_cb(cctx, NULL);
  1900. SSL_CTX_sess_set_new_cb(sctx, new_session_cb);
  1901. SSL_CTX_sess_set_remove_cb(sctx, remove_session_cb);
  1902. SSL_CTX_sess_set_get_cb(sctx, get_session_cb);
  1903. get_sess_val = NULL;
  1904. }
  1905. SSL_CTX_set_session_cache_mode(cctx, 0);
  1906. /* Internal caching is the default on the server side */
  1907. if (!use_int_cache)
  1908. SSL_CTX_set_session_cache_mode(sctx,
  1909. SSL_SESS_CACHE_SERVER
  1910. | SSL_SESS_CACHE_NO_INTERNAL_STORE);
  1911. SSL_free(serverssl1);
  1912. SSL_free(clientssl1);
  1913. serverssl1 = clientssl1 = NULL;
  1914. SSL_free(serverssl2);
  1915. SSL_free(clientssl2);
  1916. serverssl2 = clientssl2 = NULL;
  1917. SSL_SESSION_free(sess1);
  1918. sess1 = NULL;
  1919. SSL_SESSION_free(sess2);
  1920. sess2 = NULL;
  1921. SSL_CTX_set_max_proto_version(sctx, maxprot);
  1922. if (maxprot == TLS1_2_VERSION)
  1923. SSL_CTX_set_options(sctx, SSL_OP_NO_TICKET);
  1924. new_called = remove_called = get_called = 0;
  1925. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl1, &clientssl1,
  1926. NULL, NULL))
  1927. || !TEST_true(create_ssl_connection(serverssl1, clientssl1,
  1928. SSL_ERROR_NONE))
  1929. || !TEST_ptr(sess1 = SSL_get1_session(clientssl1))
  1930. || !TEST_ptr(sess2 = SSL_get1_session(serverssl1)))
  1931. goto end;
  1932. if (use_int_cache) {
  1933. if (maxprot == TLS1_3_VERSION && !use_ext_cache) {
  1934. /*
  1935. * In TLSv1.3 it should not have been added to the internal cache,
  1936. * except in the case where we also have an external cache (in that
  1937. * case it gets added to the cache in order to generate remove
  1938. * events after timeout).
  1939. */
  1940. if (!TEST_false(SSL_CTX_remove_session(sctx, sess2)))
  1941. goto end;
  1942. } else {
  1943. /* Should fail because it should already be in the cache */
  1944. if (!TEST_false(SSL_CTX_add_session(sctx, sess2)))
  1945. goto end;
  1946. }
  1947. }
  1948. if (use_ext_cache) {
  1949. SSL_SESSION *tmp = sess2;
  1950. if (!TEST_int_eq(new_called, numnewsesstick)
  1951. || !TEST_int_eq(remove_called, 0)
  1952. || !TEST_int_eq(get_called, 0))
  1953. goto end;
  1954. /*
  1955. * Delete the session from the internal cache to force a lookup from
  1956. * the external cache. We take a copy first because
  1957. * SSL_CTX_remove_session() also marks the session as non-resumable.
  1958. */
  1959. if (use_int_cache && maxprot != TLS1_3_VERSION) {
  1960. if (!TEST_ptr(tmp = SSL_SESSION_dup(sess2))
  1961. || !TEST_true(sess2->owner != NULL)
  1962. || !TEST_true(tmp->owner == NULL)
  1963. || !TEST_true(SSL_CTX_remove_session(sctx, sess2)))
  1964. goto end;
  1965. SSL_SESSION_free(sess2);
  1966. }
  1967. sess2 = tmp;
  1968. }
  1969. new_called = remove_called = get_called = 0;
  1970. get_sess_val = sess2;
  1971. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl2,
  1972. &clientssl2, NULL, NULL))
  1973. || !TEST_true(SSL_set_session(clientssl2, sess1))
  1974. || !TEST_true(create_ssl_connection(serverssl2, clientssl2,
  1975. SSL_ERROR_NONE))
  1976. || !TEST_true(SSL_session_reused(clientssl2)))
  1977. goto end;
  1978. if (use_ext_cache) {
  1979. if (!TEST_int_eq(remove_called, 0))
  1980. goto end;
  1981. if (maxprot == TLS1_3_VERSION) {
  1982. if (!TEST_int_eq(new_called, 1)
  1983. || !TEST_int_eq(get_called, 0))
  1984. goto end;
  1985. } else {
  1986. if (!TEST_int_eq(new_called, 0)
  1987. || !TEST_int_eq(get_called, 1))
  1988. goto end;
  1989. }
  1990. }
  1991. /*
  1992. * Make a small cache, force out all other sessions but
  1993. * sess2, try to add sess1, which should succeed. Then
  1994. * make sure it's there by checking the owners. Despite
  1995. * the timeouts, sess1 should have kicked out sess2
  1996. */
  1997. /* Make sess1 expire before sess2 */
  1998. if (!TEST_long_gt(SSL_SESSION_set_time(sess1, 1000), 0)
  1999. || !TEST_long_gt(SSL_SESSION_set_timeout(sess1, 1000), 0)
  2000. || !TEST_long_gt(SSL_SESSION_set_time(sess2, 2000), 0)
  2001. || !TEST_long_gt(SSL_SESSION_set_timeout(sess2, 2000), 0))
  2002. goto end;
  2003. if (!TEST_long_ne(SSL_CTX_sess_set_cache_size(sctx, 1), 0))
  2004. goto end;
  2005. /* Don't care about results - cache should only be sess2 at end */
  2006. SSL_CTX_add_session(sctx, sess1);
  2007. SSL_CTX_add_session(sctx, sess2);
  2008. /* Now add sess1, and make sure it remains, despite timeout */
  2009. if (!TEST_true(SSL_CTX_add_session(sctx, sess1))
  2010. || !TEST_ptr(sess1->owner)
  2011. || !TEST_ptr_null(sess2->owner))
  2012. goto end;
  2013. testresult = 1;
  2014. end:
  2015. SSL_free(serverssl1);
  2016. SSL_free(clientssl1);
  2017. SSL_free(serverssl2);
  2018. SSL_free(clientssl2);
  2019. # ifndef OPENSSL_NO_TLS1_1
  2020. SSL_free(serverssl3);
  2021. SSL_free(clientssl3);
  2022. # endif
  2023. SSL_SESSION_free(sess1);
  2024. SSL_SESSION_free(sess2);
  2025. SSL_CTX_free(sctx);
  2026. SSL_CTX_free(cctx);
  2027. return testresult;
  2028. }
  2029. #endif /* !defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2) */
  2030. static int test_session_with_only_int_cache(void)
  2031. {
  2032. #ifndef OSSL_NO_USABLE_TLS1_3
  2033. if (!execute_test_session(TLS1_3_VERSION, 1, 0, 0))
  2034. return 0;
  2035. #endif
  2036. #ifndef OPENSSL_NO_TLS1_2
  2037. return execute_test_session(TLS1_2_VERSION, 1, 0, 0);
  2038. #else
  2039. return 1;
  2040. #endif
  2041. }
  2042. static int test_session_with_only_ext_cache(void)
  2043. {
  2044. #ifndef OSSL_NO_USABLE_TLS1_3
  2045. if (!execute_test_session(TLS1_3_VERSION, 0, 1, 0))
  2046. return 0;
  2047. #endif
  2048. #ifndef OPENSSL_NO_TLS1_2
  2049. return execute_test_session(TLS1_2_VERSION, 0, 1, 0);
  2050. #else
  2051. return 1;
  2052. #endif
  2053. }
  2054. static int test_session_with_both_cache(void)
  2055. {
  2056. #ifndef OSSL_NO_USABLE_TLS1_3
  2057. if (!execute_test_session(TLS1_3_VERSION, 1, 1, 0))
  2058. return 0;
  2059. #endif
  2060. #ifndef OPENSSL_NO_TLS1_2
  2061. return execute_test_session(TLS1_2_VERSION, 1, 1, 0);
  2062. #else
  2063. return 1;
  2064. #endif
  2065. }
  2066. static int test_session_wo_ca_names(void)
  2067. {
  2068. #ifndef OSSL_NO_USABLE_TLS1_3
  2069. if (!execute_test_session(TLS1_3_VERSION, 1, 0, SSL_OP_DISABLE_TLSEXT_CA_NAMES))
  2070. return 0;
  2071. #endif
  2072. #ifndef OPENSSL_NO_TLS1_2
  2073. return execute_test_session(TLS1_2_VERSION, 1, 0, SSL_OP_DISABLE_TLSEXT_CA_NAMES);
  2074. #else
  2075. return 1;
  2076. #endif
  2077. }
  2078. #ifndef OSSL_NO_USABLE_TLS1_3
  2079. static SSL_SESSION *sesscache[6];
  2080. static int do_cache;
  2081. static int new_cachesession_cb(SSL *ssl, SSL_SESSION *sess)
  2082. {
  2083. if (do_cache) {
  2084. sesscache[new_called] = sess;
  2085. } else {
  2086. /* We don't need the reference to the session, so free it */
  2087. SSL_SESSION_free(sess);
  2088. }
  2089. new_called++;
  2090. return 1;
  2091. }
  2092. static int post_handshake_verify(SSL *sssl, SSL *cssl)
  2093. {
  2094. SSL_set_verify(sssl, SSL_VERIFY_PEER, NULL);
  2095. if (!TEST_true(SSL_verify_client_post_handshake(sssl)))
  2096. return 0;
  2097. /* Start handshake on the server and client */
  2098. if (!TEST_int_eq(SSL_do_handshake(sssl), 1)
  2099. || !TEST_int_le(SSL_read(cssl, NULL, 0), 0)
  2100. || !TEST_int_le(SSL_read(sssl, NULL, 0), 0)
  2101. || !TEST_true(create_ssl_connection(sssl, cssl,
  2102. SSL_ERROR_NONE)))
  2103. return 0;
  2104. return 1;
  2105. }
  2106. static int setup_ticket_test(int stateful, int idx, SSL_CTX **sctx,
  2107. SSL_CTX **cctx)
  2108. {
  2109. int sess_id_ctx = 1;
  2110. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  2111. TLS_client_method(), TLS1_VERSION, 0,
  2112. sctx, cctx, cert, privkey))
  2113. || !TEST_true(SSL_CTX_set_num_tickets(*sctx, idx))
  2114. || !TEST_true(SSL_CTX_set_session_id_context(*sctx,
  2115. (void *)&sess_id_ctx,
  2116. sizeof(sess_id_ctx))))
  2117. return 0;
  2118. if (stateful)
  2119. SSL_CTX_set_options(*sctx, SSL_OP_NO_TICKET);
  2120. SSL_CTX_set_session_cache_mode(*cctx, SSL_SESS_CACHE_CLIENT
  2121. | SSL_SESS_CACHE_NO_INTERNAL_STORE);
  2122. SSL_CTX_sess_set_new_cb(*cctx, new_cachesession_cb);
  2123. return 1;
  2124. }
  2125. static int check_resumption(int idx, SSL_CTX *sctx, SSL_CTX *cctx, int succ)
  2126. {
  2127. SSL *serverssl = NULL, *clientssl = NULL;
  2128. int i;
  2129. /* Test that we can resume with all the tickets we got given */
  2130. for (i = 0; i < idx * 2; i++) {
  2131. new_called = 0;
  2132. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  2133. &clientssl, NULL, NULL))
  2134. || !TEST_true(SSL_set_session(clientssl, sesscache[i])))
  2135. goto end;
  2136. SSL_set_post_handshake_auth(clientssl, 1);
  2137. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  2138. SSL_ERROR_NONE)))
  2139. goto end;
  2140. /*
  2141. * Following a successful resumption we only get 1 ticket. After a
  2142. * failed one we should get idx tickets.
  2143. */
  2144. if (succ) {
  2145. if (!TEST_true(SSL_session_reused(clientssl))
  2146. || !TEST_int_eq(new_called, 1))
  2147. goto end;
  2148. } else {
  2149. if (!TEST_false(SSL_session_reused(clientssl))
  2150. || !TEST_int_eq(new_called, idx))
  2151. goto end;
  2152. }
  2153. new_called = 0;
  2154. /* After a post-handshake authentication we should get 1 new ticket */
  2155. if (succ
  2156. && (!post_handshake_verify(serverssl, clientssl)
  2157. || !TEST_int_eq(new_called, 1)))
  2158. goto end;
  2159. SSL_shutdown(clientssl);
  2160. SSL_shutdown(serverssl);
  2161. SSL_free(serverssl);
  2162. SSL_free(clientssl);
  2163. serverssl = clientssl = NULL;
  2164. SSL_SESSION_free(sesscache[i]);
  2165. sesscache[i] = NULL;
  2166. }
  2167. return 1;
  2168. end:
  2169. SSL_free(clientssl);
  2170. SSL_free(serverssl);
  2171. return 0;
  2172. }
  2173. static int test_tickets(int stateful, int idx)
  2174. {
  2175. SSL_CTX *sctx = NULL, *cctx = NULL;
  2176. SSL *serverssl = NULL, *clientssl = NULL;
  2177. int testresult = 0;
  2178. size_t j;
  2179. /* idx is the test number, but also the number of tickets we want */
  2180. new_called = 0;
  2181. do_cache = 1;
  2182. if (!setup_ticket_test(stateful, idx, &sctx, &cctx))
  2183. goto end;
  2184. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  2185. &clientssl, NULL, NULL)))
  2186. goto end;
  2187. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  2188. SSL_ERROR_NONE))
  2189. /* Check we got the number of tickets we were expecting */
  2190. || !TEST_int_eq(idx, new_called))
  2191. goto end;
  2192. SSL_shutdown(clientssl);
  2193. SSL_shutdown(serverssl);
  2194. SSL_free(serverssl);
  2195. SSL_free(clientssl);
  2196. SSL_CTX_free(sctx);
  2197. SSL_CTX_free(cctx);
  2198. clientssl = serverssl = NULL;
  2199. sctx = cctx = NULL;
  2200. /*
  2201. * Now we try to resume with the tickets we previously created. The
  2202. * resumption attempt is expected to fail (because we're now using a new
  2203. * SSL_CTX). We should see idx number of tickets issued again.
  2204. */
  2205. /* Stop caching sessions - just count them */
  2206. do_cache = 0;
  2207. if (!setup_ticket_test(stateful, idx, &sctx, &cctx))
  2208. goto end;
  2209. if (!check_resumption(idx, sctx, cctx, 0))
  2210. goto end;
  2211. /* Start again with caching sessions */
  2212. new_called = 0;
  2213. do_cache = 1;
  2214. SSL_CTX_free(sctx);
  2215. SSL_CTX_free(cctx);
  2216. sctx = cctx = NULL;
  2217. if (!setup_ticket_test(stateful, idx, &sctx, &cctx))
  2218. goto end;
  2219. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  2220. &clientssl, NULL, NULL)))
  2221. goto end;
  2222. SSL_set_post_handshake_auth(clientssl, 1);
  2223. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  2224. SSL_ERROR_NONE))
  2225. /* Check we got the number of tickets we were expecting */
  2226. || !TEST_int_eq(idx, new_called))
  2227. goto end;
  2228. /* After a post-handshake authentication we should get new tickets issued */
  2229. if (!post_handshake_verify(serverssl, clientssl)
  2230. || !TEST_int_eq(idx * 2, new_called))
  2231. goto end;
  2232. SSL_shutdown(clientssl);
  2233. SSL_shutdown(serverssl);
  2234. SSL_free(serverssl);
  2235. SSL_free(clientssl);
  2236. serverssl = clientssl = NULL;
  2237. /* Stop caching sessions - just count them */
  2238. do_cache = 0;
  2239. /*
  2240. * Check we can resume with all the tickets we created. This time around the
  2241. * resumptions should all be successful.
  2242. */
  2243. if (!check_resumption(idx, sctx, cctx, 1))
  2244. goto end;
  2245. testresult = 1;
  2246. end:
  2247. SSL_free(serverssl);
  2248. SSL_free(clientssl);
  2249. for (j = 0; j < OSSL_NELEM(sesscache); j++) {
  2250. SSL_SESSION_free(sesscache[j]);
  2251. sesscache[j] = NULL;
  2252. }
  2253. SSL_CTX_free(sctx);
  2254. SSL_CTX_free(cctx);
  2255. return testresult;
  2256. }
  2257. static int test_stateless_tickets(int idx)
  2258. {
  2259. return test_tickets(0, idx);
  2260. }
  2261. static int test_stateful_tickets(int idx)
  2262. {
  2263. return test_tickets(1, idx);
  2264. }
  2265. static int test_psk_tickets(void)
  2266. {
  2267. SSL_CTX *sctx = NULL, *cctx = NULL;
  2268. SSL *serverssl = NULL, *clientssl = NULL;
  2269. int testresult = 0;
  2270. int sess_id_ctx = 1;
  2271. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  2272. TLS_client_method(), TLS1_VERSION, 0,
  2273. &sctx, &cctx, NULL, NULL))
  2274. || !TEST_true(SSL_CTX_set_session_id_context(sctx,
  2275. (void *)&sess_id_ctx,
  2276. sizeof(sess_id_ctx))))
  2277. goto end;
  2278. SSL_CTX_set_session_cache_mode(cctx, SSL_SESS_CACHE_CLIENT
  2279. | SSL_SESS_CACHE_NO_INTERNAL_STORE);
  2280. SSL_CTX_set_psk_use_session_callback(cctx, use_session_cb);
  2281. SSL_CTX_set_psk_find_session_callback(sctx, find_session_cb);
  2282. SSL_CTX_sess_set_new_cb(cctx, new_session_cb);
  2283. use_session_cb_cnt = 0;
  2284. find_session_cb_cnt = 0;
  2285. srvid = pskid;
  2286. new_called = 0;
  2287. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  2288. NULL, NULL)))
  2289. goto end;
  2290. clientpsk = serverpsk = create_a_psk(clientssl, SHA384_DIGEST_LENGTH);
  2291. if (!TEST_ptr(clientpsk))
  2292. goto end;
  2293. SSL_SESSION_up_ref(clientpsk);
  2294. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  2295. SSL_ERROR_NONE))
  2296. || !TEST_int_eq(1, find_session_cb_cnt)
  2297. || !TEST_int_eq(1, use_session_cb_cnt)
  2298. /* We should always get 1 ticket when using external PSK */
  2299. || !TEST_int_eq(1, new_called))
  2300. goto end;
  2301. testresult = 1;
  2302. end:
  2303. SSL_free(serverssl);
  2304. SSL_free(clientssl);
  2305. SSL_CTX_free(sctx);
  2306. SSL_CTX_free(cctx);
  2307. SSL_SESSION_free(clientpsk);
  2308. SSL_SESSION_free(serverpsk);
  2309. clientpsk = serverpsk = NULL;
  2310. return testresult;
  2311. }
  2312. static int test_extra_tickets(int idx)
  2313. {
  2314. SSL_CTX *sctx = NULL, *cctx = NULL;
  2315. SSL *serverssl = NULL, *clientssl = NULL;
  2316. BIO *bretry = BIO_new(bio_s_always_retry());
  2317. BIO *tmp = NULL;
  2318. int testresult = 0;
  2319. int stateful = 0;
  2320. size_t nbytes;
  2321. unsigned char c, buf[1];
  2322. new_called = 0;
  2323. do_cache = 1;
  2324. if (idx >= 3) {
  2325. idx -= 3;
  2326. stateful = 1;
  2327. }
  2328. if (!TEST_ptr(bretry) || !setup_ticket_test(stateful, idx, &sctx, &cctx))
  2329. goto end;
  2330. SSL_CTX_sess_set_new_cb(sctx, new_session_cb);
  2331. /* setup_ticket_test() uses new_cachesession_cb which we don't need. */
  2332. SSL_CTX_sess_set_new_cb(cctx, new_session_cb);
  2333. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  2334. &clientssl, NULL, NULL)))
  2335. goto end;
  2336. /*
  2337. * Note that we have new_session_cb on both sctx and cctx, so new_called is
  2338. * incremented by both client and server.
  2339. */
  2340. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  2341. SSL_ERROR_NONE))
  2342. /* Check we got the number of tickets we were expecting */
  2343. || !TEST_int_eq(idx * 2, new_called)
  2344. || !TEST_true(SSL_new_session_ticket(serverssl))
  2345. || !TEST_true(SSL_new_session_ticket(serverssl))
  2346. || !TEST_int_eq(idx * 2, new_called))
  2347. goto end;
  2348. /* Now try a (real) write to actually send the tickets */
  2349. c = '1';
  2350. if (!TEST_true(SSL_write_ex(serverssl, &c, 1, &nbytes))
  2351. || !TEST_size_t_eq(1, nbytes)
  2352. || !TEST_int_eq(idx * 2 + 2, new_called)
  2353. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes))
  2354. || !TEST_int_eq(idx * 2 + 4, new_called)
  2355. || !TEST_int_eq(sizeof(buf), nbytes)
  2356. || !TEST_int_eq(c, buf[0])
  2357. || !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes)))
  2358. goto end;
  2359. /* Try with only requesting one new ticket, too */
  2360. c = '2';
  2361. new_called = 0;
  2362. if (!TEST_true(SSL_new_session_ticket(serverssl))
  2363. || !TEST_true(SSL_write_ex(serverssl, &c, sizeof(c), &nbytes))
  2364. || !TEST_size_t_eq(sizeof(c), nbytes)
  2365. || !TEST_int_eq(1, new_called)
  2366. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes))
  2367. || !TEST_int_eq(2, new_called)
  2368. || !TEST_size_t_eq(sizeof(buf), nbytes)
  2369. || !TEST_int_eq(c, buf[0]))
  2370. goto end;
  2371. /* Do it again but use dummy writes to drive the ticket generation */
  2372. c = '3';
  2373. new_called = 0;
  2374. if (!TEST_true(SSL_new_session_ticket(serverssl))
  2375. || !TEST_true(SSL_new_session_ticket(serverssl))
  2376. || !TEST_true(SSL_write_ex(serverssl, &c, 0, &nbytes))
  2377. || !TEST_size_t_eq(0, nbytes)
  2378. || !TEST_int_eq(2, new_called)
  2379. || !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes))
  2380. || !TEST_int_eq(4, new_called))
  2381. goto end;
  2382. /* Once more, but with SSL_do_handshake() to drive the ticket generation */
  2383. c = '4';
  2384. new_called = 0;
  2385. if (!TEST_true(SSL_new_session_ticket(serverssl))
  2386. || !TEST_true(SSL_new_session_ticket(serverssl))
  2387. || !TEST_true(SSL_do_handshake(serverssl))
  2388. || !TEST_int_eq(2, new_called)
  2389. || !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes))
  2390. || !TEST_int_eq(4, new_called))
  2391. goto end;
  2392. /*
  2393. * Use the always-retry BIO to exercise the logic that forces ticket
  2394. * generation to wait until a record boundary.
  2395. */
  2396. c = '5';
  2397. new_called = 0;
  2398. tmp = SSL_get_wbio(serverssl);
  2399. if (!TEST_ptr(tmp) || !TEST_true(BIO_up_ref(tmp))) {
  2400. tmp = NULL;
  2401. goto end;
  2402. }
  2403. SSL_set0_wbio(serverssl, bretry);
  2404. bretry = NULL;
  2405. if (!TEST_false(SSL_write_ex(serverssl, &c, 1, &nbytes))
  2406. || !TEST_int_eq(SSL_get_error(serverssl, 0), SSL_ERROR_WANT_WRITE)
  2407. || !TEST_size_t_eq(nbytes, 0))
  2408. goto end;
  2409. /* Restore a BIO that will let the write succeed */
  2410. SSL_set0_wbio(serverssl, tmp);
  2411. tmp = NULL;
  2412. /*
  2413. * These calls should just queue the request and not send anything
  2414. * even if we explicitly try to hit the state machine.
  2415. */
  2416. if (!TEST_true(SSL_new_session_ticket(serverssl))
  2417. || !TEST_true(SSL_new_session_ticket(serverssl))
  2418. || !TEST_int_eq(0, new_called)
  2419. || !TEST_true(SSL_do_handshake(serverssl))
  2420. || !TEST_int_eq(0, new_called))
  2421. goto end;
  2422. /* Re-do the write; still no tickets sent */
  2423. if (!TEST_true(SSL_write_ex(serverssl, &c, 1, &nbytes))
  2424. || !TEST_size_t_eq(1, nbytes)
  2425. || !TEST_int_eq(0, new_called)
  2426. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes))
  2427. || !TEST_int_eq(0, new_called)
  2428. || !TEST_int_eq(sizeof(buf), nbytes)
  2429. || !TEST_int_eq(c, buf[0])
  2430. || !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes)))
  2431. goto end;
  2432. /* Even trying to hit the state machine now will still not send tickets */
  2433. if (!TEST_true(SSL_do_handshake(serverssl))
  2434. || !TEST_int_eq(0, new_called))
  2435. goto end;
  2436. /* Now the *next* write should send the tickets */
  2437. c = '6';
  2438. if (!TEST_true(SSL_write_ex(serverssl, &c, 1, &nbytes))
  2439. || !TEST_size_t_eq(1, nbytes)
  2440. || !TEST_int_eq(2, new_called)
  2441. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes))
  2442. || !TEST_int_eq(4, new_called)
  2443. || !TEST_int_eq(sizeof(buf), nbytes)
  2444. || !TEST_int_eq(c, buf[0])
  2445. || !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes)))
  2446. goto end;
  2447. SSL_shutdown(clientssl);
  2448. SSL_shutdown(serverssl);
  2449. testresult = 1;
  2450. end:
  2451. BIO_free(bretry);
  2452. BIO_free(tmp);
  2453. SSL_free(serverssl);
  2454. SSL_free(clientssl);
  2455. SSL_CTX_free(sctx);
  2456. SSL_CTX_free(cctx);
  2457. clientssl = serverssl = NULL;
  2458. sctx = cctx = NULL;
  2459. return testresult;
  2460. }
  2461. #endif
  2462. #define USE_NULL 0
  2463. #define USE_BIO_1 1
  2464. #define USE_BIO_2 2
  2465. #define USE_DEFAULT 3
  2466. #define CONNTYPE_CONNECTION_SUCCESS 0
  2467. #define CONNTYPE_CONNECTION_FAIL 1
  2468. #define CONNTYPE_NO_CONNECTION 2
  2469. #define TOTAL_NO_CONN_SSL_SET_BIO_TESTS (3 * 3 * 3 * 3)
  2470. #define TOTAL_CONN_SUCCESS_SSL_SET_BIO_TESTS (2 * 2)
  2471. #if !defined(OSSL_NO_USABLE_TLS1_3) && !defined(OPENSSL_NO_TLS1_2)
  2472. # define TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS (2 * 2)
  2473. #else
  2474. # define TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS 0
  2475. #endif
  2476. #define TOTAL_SSL_SET_BIO_TESTS TOTAL_NO_CONN_SSL_SET_BIO_TESTS \
  2477. + TOTAL_CONN_SUCCESS_SSL_SET_BIO_TESTS \
  2478. + TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS
  2479. static void setupbio(BIO **res, BIO *bio1, BIO *bio2, int type)
  2480. {
  2481. switch (type) {
  2482. case USE_NULL:
  2483. *res = NULL;
  2484. break;
  2485. case USE_BIO_1:
  2486. *res = bio1;
  2487. break;
  2488. case USE_BIO_2:
  2489. *res = bio2;
  2490. break;
  2491. }
  2492. }
  2493. /*
  2494. * Tests calls to SSL_set_bio() under various conditions.
  2495. *
  2496. * For the first 3 * 3 * 3 * 3 = 81 tests we do 2 calls to SSL_set_bio() with
  2497. * various combinations of valid BIOs or NULL being set for the rbio/wbio. We
  2498. * then do more tests where we create a successful connection first using our
  2499. * standard connection setup functions, and then call SSL_set_bio() with
  2500. * various combinations of valid BIOs or NULL. We then repeat these tests
  2501. * following a failed connection. In this last case we are looking to check that
  2502. * SSL_set_bio() functions correctly in the case where s->bbio is not NULL.
  2503. */
  2504. static int test_ssl_set_bio(int idx)
  2505. {
  2506. SSL_CTX *sctx = NULL, *cctx = NULL;
  2507. BIO *bio1 = NULL;
  2508. BIO *bio2 = NULL;
  2509. BIO *irbio = NULL, *iwbio = NULL, *nrbio = NULL, *nwbio = NULL;
  2510. SSL *serverssl = NULL, *clientssl = NULL;
  2511. int initrbio, initwbio, newrbio, newwbio, conntype;
  2512. int testresult = 0;
  2513. if (idx < TOTAL_NO_CONN_SSL_SET_BIO_TESTS) {
  2514. initrbio = idx % 3;
  2515. idx /= 3;
  2516. initwbio = idx % 3;
  2517. idx /= 3;
  2518. newrbio = idx % 3;
  2519. idx /= 3;
  2520. newwbio = idx % 3;
  2521. conntype = CONNTYPE_NO_CONNECTION;
  2522. } else {
  2523. idx -= TOTAL_NO_CONN_SSL_SET_BIO_TESTS;
  2524. initrbio = initwbio = USE_DEFAULT;
  2525. newrbio = idx % 2;
  2526. idx /= 2;
  2527. newwbio = idx % 2;
  2528. idx /= 2;
  2529. conntype = idx % 2;
  2530. }
  2531. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  2532. TLS_client_method(), TLS1_VERSION, 0,
  2533. &sctx, &cctx, cert, privkey)))
  2534. goto end;
  2535. if (conntype == CONNTYPE_CONNECTION_FAIL) {
  2536. /*
  2537. * We won't ever get here if either TLSv1.3 or TLSv1.2 is disabled
  2538. * because we reduced the number of tests in the definition of
  2539. * TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS to avoid this scenario. By setting
  2540. * mismatched protocol versions we will force a connection failure.
  2541. */
  2542. SSL_CTX_set_min_proto_version(sctx, TLS1_3_VERSION);
  2543. SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION);
  2544. }
  2545. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  2546. NULL, NULL)))
  2547. goto end;
  2548. if (initrbio == USE_BIO_1
  2549. || initwbio == USE_BIO_1
  2550. || newrbio == USE_BIO_1
  2551. || newwbio == USE_BIO_1) {
  2552. if (!TEST_ptr(bio1 = BIO_new(BIO_s_mem())))
  2553. goto end;
  2554. }
  2555. if (initrbio == USE_BIO_2
  2556. || initwbio == USE_BIO_2
  2557. || newrbio == USE_BIO_2
  2558. || newwbio == USE_BIO_2) {
  2559. if (!TEST_ptr(bio2 = BIO_new(BIO_s_mem())))
  2560. goto end;
  2561. }
  2562. if (initrbio != USE_DEFAULT) {
  2563. setupbio(&irbio, bio1, bio2, initrbio);
  2564. setupbio(&iwbio, bio1, bio2, initwbio);
  2565. SSL_set_bio(clientssl, irbio, iwbio);
  2566. /*
  2567. * We want to maintain our own refs to these BIO, so do an up ref for
  2568. * each BIO that will have ownership transferred in the SSL_set_bio()
  2569. * call
  2570. */
  2571. if (irbio != NULL)
  2572. BIO_up_ref(irbio);
  2573. if (iwbio != NULL && iwbio != irbio)
  2574. BIO_up_ref(iwbio);
  2575. }
  2576. if (conntype != CONNTYPE_NO_CONNECTION
  2577. && !TEST_true(create_ssl_connection(serverssl, clientssl,
  2578. SSL_ERROR_NONE)
  2579. == (conntype == CONNTYPE_CONNECTION_SUCCESS)))
  2580. goto end;
  2581. setupbio(&nrbio, bio1, bio2, newrbio);
  2582. setupbio(&nwbio, bio1, bio2, newwbio);
  2583. /*
  2584. * We will (maybe) transfer ownership again so do more up refs.
  2585. * SSL_set_bio() has some really complicated ownership rules where BIOs have
  2586. * already been set!
  2587. */
  2588. if (nrbio != NULL
  2589. && nrbio != irbio
  2590. && (nwbio != iwbio || nrbio != nwbio))
  2591. BIO_up_ref(nrbio);
  2592. if (nwbio != NULL
  2593. && nwbio != nrbio
  2594. && (nwbio != iwbio || (nwbio == iwbio && irbio == iwbio)))
  2595. BIO_up_ref(nwbio);
  2596. SSL_set_bio(clientssl, nrbio, nwbio);
  2597. testresult = 1;
  2598. end:
  2599. BIO_free(bio1);
  2600. BIO_free(bio2);
  2601. /*
  2602. * This test is checking that the ref counting for SSL_set_bio is correct.
  2603. * If we get here and we did too many frees then we will fail in the above
  2604. * functions.
  2605. */
  2606. SSL_free(serverssl);
  2607. SSL_free(clientssl);
  2608. SSL_CTX_free(sctx);
  2609. SSL_CTX_free(cctx);
  2610. return testresult;
  2611. }
  2612. typedef enum { NO_BIO_CHANGE, CHANGE_RBIO, CHANGE_WBIO } bio_change_t;
  2613. static int execute_test_ssl_bio(int pop_ssl, bio_change_t change_bio)
  2614. {
  2615. BIO *sslbio = NULL, *membio1 = NULL, *membio2 = NULL;
  2616. SSL_CTX *ctx;
  2617. SSL *ssl = NULL;
  2618. int testresult = 0;
  2619. if (!TEST_ptr(ctx = SSL_CTX_new_ex(libctx, NULL, TLS_method()))
  2620. || !TEST_ptr(ssl = SSL_new(ctx))
  2621. || !TEST_ptr(sslbio = BIO_new(BIO_f_ssl()))
  2622. || !TEST_ptr(membio1 = BIO_new(BIO_s_mem())))
  2623. goto end;
  2624. BIO_set_ssl(sslbio, ssl, BIO_CLOSE);
  2625. /*
  2626. * If anything goes wrong here then we could leak memory.
  2627. */
  2628. BIO_push(sslbio, membio1);
  2629. /* Verify changing the rbio/wbio directly does not cause leaks */
  2630. if (change_bio != NO_BIO_CHANGE) {
  2631. if (!TEST_ptr(membio2 = BIO_new(BIO_s_mem()))) {
  2632. ssl = NULL;
  2633. goto end;
  2634. }
  2635. if (change_bio == CHANGE_RBIO)
  2636. SSL_set0_rbio(ssl, membio2);
  2637. else
  2638. SSL_set0_wbio(ssl, membio2);
  2639. }
  2640. ssl = NULL;
  2641. if (pop_ssl)
  2642. BIO_pop(sslbio);
  2643. else
  2644. BIO_pop(membio1);
  2645. testresult = 1;
  2646. end:
  2647. BIO_free(membio1);
  2648. BIO_free(sslbio);
  2649. SSL_free(ssl);
  2650. SSL_CTX_free(ctx);
  2651. return testresult;
  2652. }
  2653. static int test_ssl_bio_pop_next_bio(void)
  2654. {
  2655. return execute_test_ssl_bio(0, NO_BIO_CHANGE);
  2656. }
  2657. static int test_ssl_bio_pop_ssl_bio(void)
  2658. {
  2659. return execute_test_ssl_bio(1, NO_BIO_CHANGE);
  2660. }
  2661. static int test_ssl_bio_change_rbio(void)
  2662. {
  2663. return execute_test_ssl_bio(0, CHANGE_RBIO);
  2664. }
  2665. static int test_ssl_bio_change_wbio(void)
  2666. {
  2667. return execute_test_ssl_bio(0, CHANGE_WBIO);
  2668. }
  2669. #if !defined(OPENSSL_NO_TLS1_2) || defined(OSSL_NO_USABLE_TLS1_3)
  2670. typedef struct {
  2671. /* The list of sig algs */
  2672. const int *list;
  2673. /* The length of the list */
  2674. size_t listlen;
  2675. /* A sigalgs list in string format */
  2676. const char *liststr;
  2677. /* Whether setting the list should succeed */
  2678. int valid;
  2679. /* Whether creating a connection with the list should succeed */
  2680. int connsuccess;
  2681. } sigalgs_list;
  2682. static const int validlist1[] = {NID_sha256, EVP_PKEY_RSA};
  2683. # ifndef OPENSSL_NO_EC
  2684. static const int validlist2[] = {NID_sha256, EVP_PKEY_RSA, NID_sha512, EVP_PKEY_EC};
  2685. static const int validlist3[] = {NID_sha512, EVP_PKEY_EC};
  2686. # endif
  2687. static const int invalidlist1[] = {NID_undef, EVP_PKEY_RSA};
  2688. static const int invalidlist2[] = {NID_sha256, NID_undef};
  2689. static const int invalidlist3[] = {NID_sha256, EVP_PKEY_RSA, NID_sha256};
  2690. static const int invalidlist4[] = {NID_sha256};
  2691. static const sigalgs_list testsigalgs[] = {
  2692. {validlist1, OSSL_NELEM(validlist1), NULL, 1, 1},
  2693. # ifndef OPENSSL_NO_EC
  2694. {validlist2, OSSL_NELEM(validlist2), NULL, 1, 1},
  2695. {validlist3, OSSL_NELEM(validlist3), NULL, 1, 0},
  2696. # endif
  2697. {NULL, 0, "RSA+SHA256", 1, 1},
  2698. # ifndef OPENSSL_NO_EC
  2699. {NULL, 0, "RSA+SHA256:ECDSA+SHA512", 1, 1},
  2700. {NULL, 0, "ECDSA+SHA512", 1, 0},
  2701. # endif
  2702. {invalidlist1, OSSL_NELEM(invalidlist1), NULL, 0, 0},
  2703. {invalidlist2, OSSL_NELEM(invalidlist2), NULL, 0, 0},
  2704. {invalidlist3, OSSL_NELEM(invalidlist3), NULL, 0, 0},
  2705. {invalidlist4, OSSL_NELEM(invalidlist4), NULL, 0, 0},
  2706. {NULL, 0, "RSA", 0, 0},
  2707. {NULL, 0, "SHA256", 0, 0},
  2708. {NULL, 0, "RSA+SHA256:SHA256", 0, 0},
  2709. {NULL, 0, "Invalid", 0, 0}
  2710. };
  2711. static int test_set_sigalgs(int idx)
  2712. {
  2713. SSL_CTX *cctx = NULL, *sctx = NULL;
  2714. SSL *clientssl = NULL, *serverssl = NULL;
  2715. int testresult = 0;
  2716. const sigalgs_list *curr;
  2717. int testctx;
  2718. /* Should never happen */
  2719. if (!TEST_size_t_le((size_t)idx, OSSL_NELEM(testsigalgs) * 2))
  2720. return 0;
  2721. testctx = ((size_t)idx < OSSL_NELEM(testsigalgs));
  2722. curr = testctx ? &testsigalgs[idx]
  2723. : &testsigalgs[idx - OSSL_NELEM(testsigalgs)];
  2724. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  2725. TLS_client_method(), TLS1_VERSION, 0,
  2726. &sctx, &cctx, cert, privkey)))
  2727. return 0;
  2728. SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION);
  2729. if (testctx) {
  2730. int ret;
  2731. if (curr->list != NULL)
  2732. ret = SSL_CTX_set1_sigalgs(cctx, curr->list, curr->listlen);
  2733. else
  2734. ret = SSL_CTX_set1_sigalgs_list(cctx, curr->liststr);
  2735. if (!ret) {
  2736. if (curr->valid)
  2737. TEST_info("Failure setting sigalgs in SSL_CTX (%d)\n", idx);
  2738. else
  2739. testresult = 1;
  2740. goto end;
  2741. }
  2742. if (!curr->valid) {
  2743. TEST_info("Not-failed setting sigalgs in SSL_CTX (%d)\n", idx);
  2744. goto end;
  2745. }
  2746. }
  2747. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  2748. &clientssl, NULL, NULL)))
  2749. goto end;
  2750. if (!testctx) {
  2751. int ret;
  2752. if (curr->list != NULL)
  2753. ret = SSL_set1_sigalgs(clientssl, curr->list, curr->listlen);
  2754. else
  2755. ret = SSL_set1_sigalgs_list(clientssl, curr->liststr);
  2756. if (!ret) {
  2757. if (curr->valid)
  2758. TEST_info("Failure setting sigalgs in SSL (%d)\n", idx);
  2759. else
  2760. testresult = 1;
  2761. goto end;
  2762. }
  2763. if (!curr->valid)
  2764. goto end;
  2765. }
  2766. if (!TEST_int_eq(create_ssl_connection(serverssl, clientssl,
  2767. SSL_ERROR_NONE),
  2768. curr->connsuccess))
  2769. goto end;
  2770. testresult = 1;
  2771. end:
  2772. SSL_free(serverssl);
  2773. SSL_free(clientssl);
  2774. SSL_CTX_free(sctx);
  2775. SSL_CTX_free(cctx);
  2776. return testresult;
  2777. }
  2778. #endif
  2779. #ifndef OSSL_NO_USABLE_TLS1_3
  2780. static int psk_client_cb_cnt = 0;
  2781. static int psk_server_cb_cnt = 0;
  2782. static int use_session_cb(SSL *ssl, const EVP_MD *md, const unsigned char **id,
  2783. size_t *idlen, SSL_SESSION **sess)
  2784. {
  2785. switch (++use_session_cb_cnt) {
  2786. case 1:
  2787. /* The first call should always have a NULL md */
  2788. if (md != NULL)
  2789. return 0;
  2790. break;
  2791. case 2:
  2792. /* The second call should always have an md */
  2793. if (md == NULL)
  2794. return 0;
  2795. break;
  2796. default:
  2797. /* We should only be called a maximum of twice */
  2798. return 0;
  2799. }
  2800. if (clientpsk != NULL)
  2801. SSL_SESSION_up_ref(clientpsk);
  2802. *sess = clientpsk;
  2803. *id = (const unsigned char *)pskid;
  2804. *idlen = strlen(pskid);
  2805. return 1;
  2806. }
  2807. #ifndef OPENSSL_NO_PSK
  2808. static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *id,
  2809. unsigned int max_id_len,
  2810. unsigned char *psk,
  2811. unsigned int max_psk_len)
  2812. {
  2813. unsigned int psklen = 0;
  2814. psk_client_cb_cnt++;
  2815. if (strlen(pskid) + 1 > max_id_len)
  2816. return 0;
  2817. /* We should only ever be called a maximum of twice per connection */
  2818. if (psk_client_cb_cnt > 2)
  2819. return 0;
  2820. if (clientpsk == NULL)
  2821. return 0;
  2822. /* We'll reuse the PSK we set up for TLSv1.3 */
  2823. if (SSL_SESSION_get_master_key(clientpsk, NULL, 0) > max_psk_len)
  2824. return 0;
  2825. psklen = SSL_SESSION_get_master_key(clientpsk, psk, max_psk_len);
  2826. strncpy(id, pskid, max_id_len);
  2827. return psklen;
  2828. }
  2829. #endif /* OPENSSL_NO_PSK */
  2830. static int find_session_cb(SSL *ssl, const unsigned char *identity,
  2831. size_t identity_len, SSL_SESSION **sess)
  2832. {
  2833. find_session_cb_cnt++;
  2834. /* We should only ever be called a maximum of twice per connection */
  2835. if (find_session_cb_cnt > 2)
  2836. return 0;
  2837. if (serverpsk == NULL)
  2838. return 0;
  2839. /* Identity should match that set by the client */
  2840. if (strlen(srvid) != identity_len
  2841. || strncmp(srvid, (const char *)identity, identity_len) != 0) {
  2842. /* No PSK found, continue but without a PSK */
  2843. *sess = NULL;
  2844. return 1;
  2845. }
  2846. SSL_SESSION_up_ref(serverpsk);
  2847. *sess = serverpsk;
  2848. return 1;
  2849. }
  2850. #ifndef OPENSSL_NO_PSK
  2851. static unsigned int psk_server_cb(SSL *ssl, const char *identity,
  2852. unsigned char *psk, unsigned int max_psk_len)
  2853. {
  2854. unsigned int psklen = 0;
  2855. psk_server_cb_cnt++;
  2856. /* We should only ever be called a maximum of twice per connection */
  2857. if (find_session_cb_cnt > 2)
  2858. return 0;
  2859. if (serverpsk == NULL)
  2860. return 0;
  2861. /* Identity should match that set by the client */
  2862. if (strcmp(srvid, identity) != 0) {
  2863. return 0;
  2864. }
  2865. /* We'll reuse the PSK we set up for TLSv1.3 */
  2866. if (SSL_SESSION_get_master_key(serverpsk, NULL, 0) > max_psk_len)
  2867. return 0;
  2868. psklen = SSL_SESSION_get_master_key(serverpsk, psk, max_psk_len);
  2869. return psklen;
  2870. }
  2871. #endif /* OPENSSL_NO_PSK */
  2872. #define MSG1 "Hello"
  2873. #define MSG2 "World."
  2874. #define MSG3 "This"
  2875. #define MSG4 "is"
  2876. #define MSG5 "a"
  2877. #define MSG6 "test"
  2878. #define MSG7 "message."
  2879. static int artificial_ticket_time = 0;
  2880. static int ed_gen_cb(SSL *s, void *arg)
  2881. {
  2882. SSL_SESSION *sess = SSL_get0_session(s);
  2883. if (sess == NULL)
  2884. return 0;
  2885. /*
  2886. * Artificially give the ticket some age. Just do it for the number of
  2887. * tickets we've been told to do.
  2888. */
  2889. if (artificial_ticket_time == 0)
  2890. return 1;
  2891. artificial_ticket_time--;
  2892. if (SSL_SESSION_set_time(sess, SSL_SESSION_get_time(sess) - 10) == 0)
  2893. return 0;
  2894. return 1;
  2895. }
  2896. /*
  2897. * Helper method to setup objects for early data test. Caller frees objects on
  2898. * error.
  2899. */
  2900. static int setupearly_data_test(SSL_CTX **cctx, SSL_CTX **sctx, SSL **clientssl,
  2901. SSL **serverssl, SSL_SESSION **sess, int idx,
  2902. size_t mdsize)
  2903. {
  2904. int artificial = (artificial_ticket_time > 0);
  2905. if (*sctx == NULL
  2906. && !TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  2907. TLS_client_method(),
  2908. TLS1_VERSION, 0,
  2909. sctx, cctx, cert, privkey)))
  2910. return 0;
  2911. if (artificial)
  2912. SSL_CTX_set_session_ticket_cb(*sctx, ed_gen_cb, NULL, NULL);
  2913. if (!TEST_true(SSL_CTX_set_max_early_data(*sctx, SSL3_RT_MAX_PLAIN_LENGTH)))
  2914. return 0;
  2915. if (idx == 1) {
  2916. /* When idx == 1 we repeat the tests with read_ahead set */
  2917. SSL_CTX_set_read_ahead(*cctx, 1);
  2918. SSL_CTX_set_read_ahead(*sctx, 1);
  2919. } else if (idx == 2) {
  2920. /* When idx == 2 we are doing early_data with a PSK. Set up callbacks */
  2921. SSL_CTX_set_psk_use_session_callback(*cctx, use_session_cb);
  2922. SSL_CTX_set_psk_find_session_callback(*sctx, find_session_cb);
  2923. use_session_cb_cnt = 0;
  2924. find_session_cb_cnt = 0;
  2925. srvid = pskid;
  2926. }
  2927. if (!TEST_true(create_ssl_objects(*sctx, *cctx, serverssl, clientssl,
  2928. NULL, NULL)))
  2929. return 0;
  2930. /*
  2931. * For one of the run throughs (doesn't matter which one), we'll try sending
  2932. * some SNI data in the initial ClientHello. This will be ignored (because
  2933. * there is no SNI cb set up by the server), so it should not impact
  2934. * early_data.
  2935. */
  2936. if (idx == 1
  2937. && !TEST_true(SSL_set_tlsext_host_name(*clientssl, "localhost")))
  2938. return 0;
  2939. if (idx == 2) {
  2940. clientpsk = create_a_psk(*clientssl, mdsize);
  2941. if (!TEST_ptr(clientpsk)
  2942. /*
  2943. * We just choose an arbitrary value for max_early_data which
  2944. * should be big enough for testing purposes.
  2945. */
  2946. || !TEST_true(SSL_SESSION_set_max_early_data(clientpsk,
  2947. 0x100))
  2948. || !TEST_true(SSL_SESSION_up_ref(clientpsk))) {
  2949. SSL_SESSION_free(clientpsk);
  2950. clientpsk = NULL;
  2951. return 0;
  2952. }
  2953. serverpsk = clientpsk;
  2954. if (sess != NULL) {
  2955. if (!TEST_true(SSL_SESSION_up_ref(clientpsk))) {
  2956. SSL_SESSION_free(clientpsk);
  2957. SSL_SESSION_free(serverpsk);
  2958. clientpsk = serverpsk = NULL;
  2959. return 0;
  2960. }
  2961. *sess = clientpsk;
  2962. }
  2963. return 1;
  2964. }
  2965. if (sess == NULL)
  2966. return 1;
  2967. if (!TEST_true(create_ssl_connection(*serverssl, *clientssl,
  2968. SSL_ERROR_NONE)))
  2969. return 0;
  2970. *sess = SSL_get1_session(*clientssl);
  2971. SSL_shutdown(*clientssl);
  2972. SSL_shutdown(*serverssl);
  2973. SSL_free(*serverssl);
  2974. SSL_free(*clientssl);
  2975. *serverssl = *clientssl = NULL;
  2976. /*
  2977. * Artificially give the ticket some age to match the artificial age we
  2978. * gave it on the server side
  2979. */
  2980. if (artificial
  2981. && !TEST_long_gt(SSL_SESSION_set_time(*sess,
  2982. SSL_SESSION_get_time(*sess) - 10), 0))
  2983. return 0;
  2984. if (!TEST_true(create_ssl_objects(*sctx, *cctx, serverssl,
  2985. clientssl, NULL, NULL))
  2986. || !TEST_true(SSL_set_session(*clientssl, *sess)))
  2987. return 0;
  2988. return 1;
  2989. }
  2990. static int test_early_data_read_write(int idx)
  2991. {
  2992. SSL_CTX *cctx = NULL, *sctx = NULL;
  2993. SSL *clientssl = NULL, *serverssl = NULL;
  2994. int testresult = 0;
  2995. SSL_SESSION *sess = NULL;
  2996. unsigned char buf[20], data[1024];
  2997. size_t readbytes, written, eoedlen, rawread, rawwritten;
  2998. BIO *rbio;
  2999. /* Artificially give the next 2 tickets some age for non PSK sessions */
  3000. if (idx != 2)
  3001. artificial_ticket_time = 2;
  3002. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3003. &serverssl, &sess, idx,
  3004. SHA384_DIGEST_LENGTH))) {
  3005. artificial_ticket_time = 0;
  3006. goto end;
  3007. }
  3008. artificial_ticket_time = 0;
  3009. /* Write and read some early data */
  3010. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3011. &written))
  3012. || !TEST_size_t_eq(written, strlen(MSG1))
  3013. || !TEST_int_eq(SSL_read_early_data(serverssl, buf,
  3014. sizeof(buf), &readbytes),
  3015. SSL_READ_EARLY_DATA_SUCCESS)
  3016. || !TEST_mem_eq(MSG1, readbytes, buf, strlen(MSG1))
  3017. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3018. SSL_EARLY_DATA_ACCEPTED))
  3019. goto end;
  3020. /*
  3021. * Server should be able to write data, and client should be able to
  3022. * read it.
  3023. */
  3024. if (!TEST_true(SSL_write_early_data(serverssl, MSG2, strlen(MSG2),
  3025. &written))
  3026. || !TEST_size_t_eq(written, strlen(MSG2))
  3027. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  3028. || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
  3029. goto end;
  3030. /* Even after reading normal data, client should be able write early data */
  3031. if (!TEST_true(SSL_write_early_data(clientssl, MSG3, strlen(MSG3),
  3032. &written))
  3033. || !TEST_size_t_eq(written, strlen(MSG3)))
  3034. goto end;
  3035. /* Server should still be able read early data after writing data */
  3036. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3037. &readbytes),
  3038. SSL_READ_EARLY_DATA_SUCCESS)
  3039. || !TEST_mem_eq(buf, readbytes, MSG3, strlen(MSG3)))
  3040. goto end;
  3041. /* Write more data from server and read it from client */
  3042. if (!TEST_true(SSL_write_early_data(serverssl, MSG4, strlen(MSG4),
  3043. &written))
  3044. || !TEST_size_t_eq(written, strlen(MSG4))
  3045. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  3046. || !TEST_mem_eq(buf, readbytes, MSG4, strlen(MSG4)))
  3047. goto end;
  3048. /*
  3049. * If client writes normal data it should mean writing early data is no
  3050. * longer possible.
  3051. */
  3052. if (!TEST_true(SSL_write_ex(clientssl, MSG5, strlen(MSG5), &written))
  3053. || !TEST_size_t_eq(written, strlen(MSG5))
  3054. || !TEST_int_eq(SSL_get_early_data_status(clientssl),
  3055. SSL_EARLY_DATA_ACCEPTED))
  3056. goto end;
  3057. /*
  3058. * At this point the client has written EndOfEarlyData, ClientFinished and
  3059. * normal (fully protected) data. We are going to cause a delay between the
  3060. * arrival of EndOfEarlyData and ClientFinished. We read out all the data
  3061. * in the read BIO, and then just put back the EndOfEarlyData message.
  3062. */
  3063. rbio = SSL_get_rbio(serverssl);
  3064. if (!TEST_true(BIO_read_ex(rbio, data, sizeof(data), &rawread))
  3065. || !TEST_size_t_lt(rawread, sizeof(data))
  3066. || !TEST_size_t_gt(rawread, SSL3_RT_HEADER_LENGTH))
  3067. goto end;
  3068. /* Record length is in the 4th and 5th bytes of the record header */
  3069. eoedlen = SSL3_RT_HEADER_LENGTH + (data[3] << 8 | data[4]);
  3070. if (!TEST_true(BIO_write_ex(rbio, data, eoedlen, &rawwritten))
  3071. || !TEST_size_t_eq(rawwritten, eoedlen))
  3072. goto end;
  3073. /* Server should be told that there is no more early data */
  3074. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3075. &readbytes),
  3076. SSL_READ_EARLY_DATA_FINISH)
  3077. || !TEST_size_t_eq(readbytes, 0))
  3078. goto end;
  3079. /*
  3080. * Server has not finished init yet, so should still be able to write early
  3081. * data.
  3082. */
  3083. if (!TEST_true(SSL_write_early_data(serverssl, MSG6, strlen(MSG6),
  3084. &written))
  3085. || !TEST_size_t_eq(written, strlen(MSG6)))
  3086. goto end;
  3087. /* Push the ClientFinished and the normal data back into the server rbio */
  3088. if (!TEST_true(BIO_write_ex(rbio, data + eoedlen, rawread - eoedlen,
  3089. &rawwritten))
  3090. || !TEST_size_t_eq(rawwritten, rawread - eoedlen))
  3091. goto end;
  3092. /* Server should be able to read normal data */
  3093. if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3094. || !TEST_size_t_eq(readbytes, strlen(MSG5)))
  3095. goto end;
  3096. /* Client and server should not be able to write/read early data now */
  3097. if (!TEST_false(SSL_write_early_data(clientssl, MSG6, strlen(MSG6),
  3098. &written)))
  3099. goto end;
  3100. ERR_clear_error();
  3101. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3102. &readbytes),
  3103. SSL_READ_EARLY_DATA_ERROR))
  3104. goto end;
  3105. ERR_clear_error();
  3106. /* Client should be able to read the data sent by the server */
  3107. if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  3108. || !TEST_mem_eq(buf, readbytes, MSG6, strlen(MSG6)))
  3109. goto end;
  3110. /*
  3111. * Make sure we process the two NewSessionTickets. These arrive
  3112. * post-handshake. We attempt reads which we do not expect to return any
  3113. * data.
  3114. */
  3115. if (!TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  3116. || !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf),
  3117. &readbytes)))
  3118. goto end;
  3119. /* Server should be able to write normal data */
  3120. if (!TEST_true(SSL_write_ex(serverssl, MSG7, strlen(MSG7), &written))
  3121. || !TEST_size_t_eq(written, strlen(MSG7))
  3122. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  3123. || !TEST_mem_eq(buf, readbytes, MSG7, strlen(MSG7)))
  3124. goto end;
  3125. SSL_SESSION_free(sess);
  3126. sess = SSL_get1_session(clientssl);
  3127. use_session_cb_cnt = 0;
  3128. find_session_cb_cnt = 0;
  3129. SSL_shutdown(clientssl);
  3130. SSL_shutdown(serverssl);
  3131. SSL_free(serverssl);
  3132. SSL_free(clientssl);
  3133. serverssl = clientssl = NULL;
  3134. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  3135. &clientssl, NULL, NULL))
  3136. || !TEST_true(SSL_set_session(clientssl, sess)))
  3137. goto end;
  3138. /* Write and read some early data */
  3139. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3140. &written))
  3141. || !TEST_size_t_eq(written, strlen(MSG1))
  3142. || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3143. &readbytes),
  3144. SSL_READ_EARLY_DATA_SUCCESS)
  3145. || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1)))
  3146. goto end;
  3147. if (!TEST_int_gt(SSL_connect(clientssl), 0)
  3148. || !TEST_int_gt(SSL_accept(serverssl), 0))
  3149. goto end;
  3150. /* Client and server should not be able to write/read early data now */
  3151. if (!TEST_false(SSL_write_early_data(clientssl, MSG6, strlen(MSG6),
  3152. &written)))
  3153. goto end;
  3154. ERR_clear_error();
  3155. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3156. &readbytes),
  3157. SSL_READ_EARLY_DATA_ERROR))
  3158. goto end;
  3159. ERR_clear_error();
  3160. /* Client and server should be able to write/read normal data */
  3161. if (!TEST_true(SSL_write_ex(clientssl, MSG5, strlen(MSG5), &written))
  3162. || !TEST_size_t_eq(written, strlen(MSG5))
  3163. || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3164. || !TEST_size_t_eq(readbytes, strlen(MSG5)))
  3165. goto end;
  3166. testresult = 1;
  3167. end:
  3168. SSL_SESSION_free(sess);
  3169. SSL_SESSION_free(clientpsk);
  3170. SSL_SESSION_free(serverpsk);
  3171. clientpsk = serverpsk = NULL;
  3172. SSL_free(serverssl);
  3173. SSL_free(clientssl);
  3174. SSL_CTX_free(sctx);
  3175. SSL_CTX_free(cctx);
  3176. return testresult;
  3177. }
  3178. static int allow_ed_cb_called = 0;
  3179. static int allow_early_data_cb(SSL *s, void *arg)
  3180. {
  3181. int *usecb = (int *)arg;
  3182. allow_ed_cb_called++;
  3183. if (*usecb == 1)
  3184. return 0;
  3185. return 1;
  3186. }
  3187. /*
  3188. * idx == 0: Standard early_data setup
  3189. * idx == 1: early_data setup using read_ahead
  3190. * usecb == 0: Don't use a custom early data callback
  3191. * usecb == 1: Use a custom early data callback and reject the early data
  3192. * usecb == 2: Use a custom early data callback and accept the early data
  3193. * confopt == 0: Configure anti-replay directly
  3194. * confopt == 1: Configure anti-replay using SSL_CONF
  3195. */
  3196. static int test_early_data_replay_int(int idx, int usecb, int confopt)
  3197. {
  3198. SSL_CTX *cctx = NULL, *sctx = NULL;
  3199. SSL *clientssl = NULL, *serverssl = NULL;
  3200. int testresult = 0;
  3201. SSL_SESSION *sess = NULL;
  3202. size_t readbytes, written;
  3203. unsigned char buf[20];
  3204. allow_ed_cb_called = 0;
  3205. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  3206. TLS_client_method(), TLS1_VERSION, 0,
  3207. &sctx, &cctx, cert, privkey)))
  3208. return 0;
  3209. if (usecb > 0) {
  3210. if (confopt == 0) {
  3211. SSL_CTX_set_options(sctx, SSL_OP_NO_ANTI_REPLAY);
  3212. } else {
  3213. SSL_CONF_CTX *confctx = SSL_CONF_CTX_new();
  3214. if (!TEST_ptr(confctx))
  3215. goto end;
  3216. SSL_CONF_CTX_set_flags(confctx, SSL_CONF_FLAG_FILE
  3217. | SSL_CONF_FLAG_SERVER);
  3218. SSL_CONF_CTX_set_ssl_ctx(confctx, sctx);
  3219. if (!TEST_int_eq(SSL_CONF_cmd(confctx, "Options", "-AntiReplay"),
  3220. 2)) {
  3221. SSL_CONF_CTX_free(confctx);
  3222. goto end;
  3223. }
  3224. SSL_CONF_CTX_free(confctx);
  3225. }
  3226. SSL_CTX_set_allow_early_data_cb(sctx, allow_early_data_cb, &usecb);
  3227. }
  3228. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3229. &serverssl, &sess, idx,
  3230. SHA384_DIGEST_LENGTH)))
  3231. goto end;
  3232. /*
  3233. * The server is configured to accept early data. Create a connection to
  3234. * "use up" the ticket
  3235. */
  3236. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
  3237. || !TEST_true(SSL_session_reused(clientssl)))
  3238. goto end;
  3239. SSL_shutdown(clientssl);
  3240. SSL_shutdown(serverssl);
  3241. SSL_free(serverssl);
  3242. SSL_free(clientssl);
  3243. serverssl = clientssl = NULL;
  3244. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  3245. &clientssl, NULL, NULL))
  3246. || !TEST_true(SSL_set_session(clientssl, sess)))
  3247. goto end;
  3248. /* Write and read some early data */
  3249. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3250. &written))
  3251. || !TEST_size_t_eq(written, strlen(MSG1)))
  3252. goto end;
  3253. if (usecb <= 1) {
  3254. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3255. &readbytes),
  3256. SSL_READ_EARLY_DATA_FINISH)
  3257. /*
  3258. * The ticket was reused, so the we should have rejected the
  3259. * early data
  3260. */
  3261. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3262. SSL_EARLY_DATA_REJECTED))
  3263. goto end;
  3264. } else {
  3265. /* In this case the callback decides to accept the early data */
  3266. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3267. &readbytes),
  3268. SSL_READ_EARLY_DATA_SUCCESS)
  3269. || !TEST_mem_eq(MSG1, strlen(MSG1), buf, readbytes)
  3270. /*
  3271. * Server will have sent its flight so client can now send
  3272. * end of early data and complete its half of the handshake
  3273. */
  3274. || !TEST_int_gt(SSL_connect(clientssl), 0)
  3275. || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3276. &readbytes),
  3277. SSL_READ_EARLY_DATA_FINISH)
  3278. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3279. SSL_EARLY_DATA_ACCEPTED))
  3280. goto end;
  3281. }
  3282. /* Complete the connection */
  3283. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
  3284. || !TEST_int_eq(SSL_session_reused(clientssl), (usecb > 0) ? 1 : 0)
  3285. || !TEST_int_eq(allow_ed_cb_called, usecb > 0 ? 1 : 0))
  3286. goto end;
  3287. testresult = 1;
  3288. end:
  3289. SSL_SESSION_free(sess);
  3290. SSL_SESSION_free(clientpsk);
  3291. SSL_SESSION_free(serverpsk);
  3292. clientpsk = serverpsk = NULL;
  3293. SSL_free(serverssl);
  3294. SSL_free(clientssl);
  3295. SSL_CTX_free(sctx);
  3296. SSL_CTX_free(cctx);
  3297. return testresult;
  3298. }
  3299. static int test_early_data_replay(int idx)
  3300. {
  3301. int ret = 1, usecb, confopt;
  3302. for (usecb = 0; usecb < 3; usecb++) {
  3303. for (confopt = 0; confopt < 2; confopt++)
  3304. ret &= test_early_data_replay_int(idx, usecb, confopt);
  3305. }
  3306. return ret;
  3307. }
  3308. static const char *ciphersuites[] = {
  3309. "TLS_AES_128_CCM_8_SHA256",
  3310. "TLS_AES_128_GCM_SHA256",
  3311. "TLS_AES_256_GCM_SHA384",
  3312. "TLS_AES_128_CCM_SHA256",
  3313. #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
  3314. "TLS_CHACHA20_POLY1305_SHA256"
  3315. #endif
  3316. };
  3317. /*
  3318. * Helper function to test that a server attempting to read early data can
  3319. * handle a connection from a client where the early data should be skipped.
  3320. * testtype: 0 == No HRR
  3321. * testtype: 1 == HRR
  3322. * testtype: 2 == HRR, invalid early_data sent after HRR
  3323. * testtype: 3 == recv_max_early_data set to 0
  3324. */
  3325. static int early_data_skip_helper(int testtype, int cipher, int idx)
  3326. {
  3327. SSL_CTX *cctx = NULL, *sctx = NULL;
  3328. SSL *clientssl = NULL, *serverssl = NULL;
  3329. int testresult = 0;
  3330. SSL_SESSION *sess = NULL;
  3331. unsigned char buf[20];
  3332. size_t readbytes, written;
  3333. if (is_fips && cipher == 4)
  3334. return 1;
  3335. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  3336. TLS_client_method(),
  3337. TLS1_VERSION, 0,
  3338. &sctx, &cctx, cert, privkey)))
  3339. goto end;
  3340. if (cipher == 0) {
  3341. SSL_CTX_set_security_level(sctx, 0);
  3342. SSL_CTX_set_security_level(cctx, 0);
  3343. }
  3344. if (!TEST_true(SSL_CTX_set_ciphersuites(sctx, ciphersuites[cipher]))
  3345. || !TEST_true(SSL_CTX_set_ciphersuites(cctx, ciphersuites[cipher])))
  3346. goto end;
  3347. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3348. &serverssl, &sess, idx,
  3349. cipher == 2 ? SHA384_DIGEST_LENGTH
  3350. : SHA256_DIGEST_LENGTH)))
  3351. goto end;
  3352. if (testtype == 1 || testtype == 2) {
  3353. /* Force an HRR to occur */
  3354. #if defined(OPENSSL_NO_EC)
  3355. if (!TEST_true(SSL_set1_groups_list(serverssl, "ffdhe3072")))
  3356. goto end;
  3357. #else
  3358. if (!TEST_true(SSL_set1_groups_list(serverssl, "P-384")))
  3359. goto end;
  3360. #endif
  3361. } else if (idx == 2) {
  3362. /*
  3363. * We force early_data rejection by ensuring the PSK identity is
  3364. * unrecognised
  3365. */
  3366. srvid = "Dummy Identity";
  3367. } else {
  3368. /*
  3369. * Deliberately corrupt the creation time. We take 20 seconds off the
  3370. * time. It could be any value as long as it is not within tolerance.
  3371. * This should mean the ticket is rejected.
  3372. */
  3373. if (!TEST_true(SSL_SESSION_set_time(sess, (long)(time(NULL) - 20))))
  3374. goto end;
  3375. }
  3376. if (testtype == 3
  3377. && !TEST_true(SSL_set_recv_max_early_data(serverssl, 0)))
  3378. goto end;
  3379. /* Write some early data */
  3380. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3381. &written))
  3382. || !TEST_size_t_eq(written, strlen(MSG1)))
  3383. goto end;
  3384. /* Server should reject the early data */
  3385. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3386. &readbytes),
  3387. SSL_READ_EARLY_DATA_FINISH)
  3388. || !TEST_size_t_eq(readbytes, 0)
  3389. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3390. SSL_EARLY_DATA_REJECTED))
  3391. goto end;
  3392. switch (testtype) {
  3393. case 0:
  3394. /* Nothing to do */
  3395. break;
  3396. case 1:
  3397. /*
  3398. * Finish off the handshake. We perform the same writes and reads as
  3399. * further down but we expect them to fail due to the incomplete
  3400. * handshake.
  3401. */
  3402. if (!TEST_false(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
  3403. || !TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf),
  3404. &readbytes)))
  3405. goto end;
  3406. break;
  3407. case 2:
  3408. {
  3409. BIO *wbio = SSL_get_wbio(clientssl);
  3410. /* A record that will appear as bad early_data */
  3411. const unsigned char bad_early_data[] = {
  3412. 0x17, 0x03, 0x03, 0x00, 0x01, 0x00
  3413. };
  3414. /*
  3415. * We force the client to attempt a write. This will fail because
  3416. * we're still in the handshake. It will cause the second
  3417. * ClientHello to be sent.
  3418. */
  3419. if (!TEST_false(SSL_write_ex(clientssl, MSG2, strlen(MSG2),
  3420. &written)))
  3421. goto end;
  3422. /*
  3423. * Inject some early_data after the second ClientHello. This should
  3424. * cause the server to fail
  3425. */
  3426. if (!TEST_true(BIO_write_ex(wbio, bad_early_data,
  3427. sizeof(bad_early_data), &written)))
  3428. goto end;
  3429. }
  3430. /* fallthrough */
  3431. case 3:
  3432. /*
  3433. * This client has sent more early_data than we are willing to skip
  3434. * (case 3) or sent invalid early_data (case 2) so the connection should
  3435. * abort.
  3436. */
  3437. if (!TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3438. || !TEST_int_eq(SSL_get_error(serverssl, 0), SSL_ERROR_SSL))
  3439. goto end;
  3440. /* Connection has failed - nothing more to do */
  3441. testresult = 1;
  3442. goto end;
  3443. default:
  3444. TEST_error("Invalid test type");
  3445. goto end;
  3446. }
  3447. ERR_clear_error();
  3448. /*
  3449. * Should be able to send normal data despite rejection of early data. The
  3450. * early_data should be skipped.
  3451. */
  3452. if (!TEST_true(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
  3453. || !TEST_size_t_eq(written, strlen(MSG2))
  3454. || !TEST_int_eq(SSL_get_early_data_status(clientssl),
  3455. SSL_EARLY_DATA_REJECTED)
  3456. || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3457. || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
  3458. goto end;
  3459. /*
  3460. * Failure to decrypt early data records should not leave spurious errors
  3461. * on the error stack
  3462. */
  3463. if (!TEST_long_eq(ERR_peek_error(), 0))
  3464. goto end;
  3465. testresult = 1;
  3466. end:
  3467. SSL_SESSION_free(clientpsk);
  3468. SSL_SESSION_free(serverpsk);
  3469. clientpsk = serverpsk = NULL;
  3470. SSL_SESSION_free(sess);
  3471. SSL_free(serverssl);
  3472. SSL_free(clientssl);
  3473. SSL_CTX_free(sctx);
  3474. SSL_CTX_free(cctx);
  3475. return testresult;
  3476. }
  3477. /*
  3478. * Test that a server attempting to read early data can handle a connection
  3479. * from a client where the early data is not acceptable.
  3480. */
  3481. static int test_early_data_skip(int idx)
  3482. {
  3483. return early_data_skip_helper(0,
  3484. idx % OSSL_NELEM(ciphersuites),
  3485. idx / OSSL_NELEM(ciphersuites));
  3486. }
  3487. /*
  3488. * Test that a server attempting to read early data can handle a connection
  3489. * from a client where an HRR occurs.
  3490. */
  3491. static int test_early_data_skip_hrr(int idx)
  3492. {
  3493. return early_data_skip_helper(1,
  3494. idx % OSSL_NELEM(ciphersuites),
  3495. idx / OSSL_NELEM(ciphersuites));
  3496. }
  3497. /*
  3498. * Test that a server attempting to read early data can handle a connection
  3499. * from a client where an HRR occurs and correctly fails if early_data is sent
  3500. * after the HRR
  3501. */
  3502. static int test_early_data_skip_hrr_fail(int idx)
  3503. {
  3504. return early_data_skip_helper(2,
  3505. idx % OSSL_NELEM(ciphersuites),
  3506. idx / OSSL_NELEM(ciphersuites));
  3507. }
  3508. /*
  3509. * Test that a server attempting to read early data will abort if it tries to
  3510. * skip over too much.
  3511. */
  3512. static int test_early_data_skip_abort(int idx)
  3513. {
  3514. return early_data_skip_helper(3,
  3515. idx % OSSL_NELEM(ciphersuites),
  3516. idx / OSSL_NELEM(ciphersuites));
  3517. }
  3518. /*
  3519. * Test that a server attempting to read early data can handle a connection
  3520. * from a client that doesn't send any.
  3521. */
  3522. static int test_early_data_not_sent(int idx)
  3523. {
  3524. SSL_CTX *cctx = NULL, *sctx = NULL;
  3525. SSL *clientssl = NULL, *serverssl = NULL;
  3526. int testresult = 0;
  3527. SSL_SESSION *sess = NULL;
  3528. unsigned char buf[20];
  3529. size_t readbytes, written;
  3530. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3531. &serverssl, &sess, idx,
  3532. SHA384_DIGEST_LENGTH)))
  3533. goto end;
  3534. /* Write some data - should block due to handshake with server */
  3535. SSL_set_connect_state(clientssl);
  3536. if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written)))
  3537. goto end;
  3538. /* Server should detect that early data has not been sent */
  3539. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3540. &readbytes),
  3541. SSL_READ_EARLY_DATA_FINISH)
  3542. || !TEST_size_t_eq(readbytes, 0)
  3543. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3544. SSL_EARLY_DATA_NOT_SENT)
  3545. || !TEST_int_eq(SSL_get_early_data_status(clientssl),
  3546. SSL_EARLY_DATA_NOT_SENT))
  3547. goto end;
  3548. /* Continue writing the message we started earlier */
  3549. if (!TEST_true(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
  3550. || !TEST_size_t_eq(written, strlen(MSG1))
  3551. || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3552. || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
  3553. || !SSL_write_ex(serverssl, MSG2, strlen(MSG2), &written)
  3554. || !TEST_size_t_eq(written, strlen(MSG2)))
  3555. goto end;
  3556. if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  3557. || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
  3558. goto end;
  3559. testresult = 1;
  3560. end:
  3561. SSL_SESSION_free(sess);
  3562. SSL_SESSION_free(clientpsk);
  3563. SSL_SESSION_free(serverpsk);
  3564. clientpsk = serverpsk = NULL;
  3565. SSL_free(serverssl);
  3566. SSL_free(clientssl);
  3567. SSL_CTX_free(sctx);
  3568. SSL_CTX_free(cctx);
  3569. return testresult;
  3570. }
  3571. static const char *servalpn;
  3572. static int alpn_select_cb(SSL *ssl, const unsigned char **out,
  3573. unsigned char *outlen, const unsigned char *in,
  3574. unsigned int inlen, void *arg)
  3575. {
  3576. unsigned int protlen = 0;
  3577. const unsigned char *prot;
  3578. for (prot = in; prot < in + inlen; prot += protlen) {
  3579. protlen = *prot++;
  3580. if (in + inlen < prot + protlen)
  3581. return SSL_TLSEXT_ERR_NOACK;
  3582. if (protlen == strlen(servalpn)
  3583. && memcmp(prot, servalpn, protlen) == 0) {
  3584. *out = prot;
  3585. *outlen = protlen;
  3586. return SSL_TLSEXT_ERR_OK;
  3587. }
  3588. }
  3589. return SSL_TLSEXT_ERR_NOACK;
  3590. }
  3591. /* Test that a PSK can be used to send early_data */
  3592. static int test_early_data_psk(int idx)
  3593. {
  3594. SSL_CTX *cctx = NULL, *sctx = NULL;
  3595. SSL *clientssl = NULL, *serverssl = NULL;
  3596. int testresult = 0;
  3597. SSL_SESSION *sess = NULL;
  3598. unsigned char alpnlist[] = {
  3599. 0x08, 'g', 'o', 'o', 'd', 'a', 'l', 'p', 'n', 0x07, 'b', 'a', 'd', 'a',
  3600. 'l', 'p', 'n'
  3601. };
  3602. #define GOODALPNLEN 9
  3603. #define BADALPNLEN 8
  3604. #define GOODALPN (alpnlist)
  3605. #define BADALPN (alpnlist + GOODALPNLEN)
  3606. int err = 0;
  3607. unsigned char buf[20];
  3608. size_t readbytes, written;
  3609. int readearlyres = SSL_READ_EARLY_DATA_SUCCESS, connectres = 1;
  3610. int edstatus = SSL_EARLY_DATA_ACCEPTED;
  3611. /* We always set this up with a final parameter of "2" for PSK */
  3612. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3613. &serverssl, &sess, 2,
  3614. SHA384_DIGEST_LENGTH)))
  3615. goto end;
  3616. servalpn = "goodalpn";
  3617. /*
  3618. * Note: There is no test for inconsistent SNI with late client detection.
  3619. * This is because servers do not acknowledge SNI even if they are using
  3620. * it in a resumption handshake - so it is not actually possible for a
  3621. * client to detect a problem.
  3622. */
  3623. switch (idx) {
  3624. case 0:
  3625. /* Set inconsistent SNI (early client detection) */
  3626. err = SSL_R_INCONSISTENT_EARLY_DATA_SNI;
  3627. if (!TEST_true(SSL_SESSION_set1_hostname(sess, "goodhost"))
  3628. || !TEST_true(SSL_set_tlsext_host_name(clientssl, "badhost")))
  3629. goto end;
  3630. break;
  3631. case 1:
  3632. /* Set inconsistent ALPN (early client detection) */
  3633. err = SSL_R_INCONSISTENT_EARLY_DATA_ALPN;
  3634. /* SSL_set_alpn_protos returns 0 for success and 1 for failure */
  3635. if (!TEST_true(SSL_SESSION_set1_alpn_selected(sess, GOODALPN,
  3636. GOODALPNLEN))
  3637. || !TEST_false(SSL_set_alpn_protos(clientssl, BADALPN,
  3638. BADALPNLEN)))
  3639. goto end;
  3640. break;
  3641. case 2:
  3642. /*
  3643. * Set invalid protocol version. Technically this affects PSKs without
  3644. * early_data too, but we test it here because it is similar to the
  3645. * SNI/ALPN consistency tests.
  3646. */
  3647. err = SSL_R_BAD_PSK;
  3648. if (!TEST_true(SSL_SESSION_set_protocol_version(sess, TLS1_2_VERSION)))
  3649. goto end;
  3650. break;
  3651. case 3:
  3652. /*
  3653. * Set inconsistent SNI (server side). In this case the connection
  3654. * will succeed and accept early_data. In TLSv1.3 on the server side SNI
  3655. * is associated with each handshake - not the session. Therefore it
  3656. * should not matter that we used a different server name last time.
  3657. */
  3658. SSL_SESSION_free(serverpsk);
  3659. serverpsk = SSL_SESSION_dup(clientpsk);
  3660. if (!TEST_ptr(serverpsk)
  3661. || !TEST_true(SSL_SESSION_set1_hostname(serverpsk, "badhost")))
  3662. goto end;
  3663. /* Fall through */
  3664. case 4:
  3665. /* Set consistent SNI */
  3666. if (!TEST_true(SSL_SESSION_set1_hostname(sess, "goodhost"))
  3667. || !TEST_true(SSL_set_tlsext_host_name(clientssl, "goodhost"))
  3668. || !TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx,
  3669. hostname_cb)))
  3670. goto end;
  3671. break;
  3672. case 5:
  3673. /*
  3674. * Set inconsistent ALPN (server detected). In this case the connection
  3675. * will succeed but reject early_data.
  3676. */
  3677. servalpn = "badalpn";
  3678. edstatus = SSL_EARLY_DATA_REJECTED;
  3679. readearlyres = SSL_READ_EARLY_DATA_FINISH;
  3680. /* Fall through */
  3681. case 6:
  3682. /*
  3683. * Set consistent ALPN.
  3684. * SSL_set_alpn_protos returns 0 for success and 1 for failure. It
  3685. * accepts a list of protos (each one length prefixed).
  3686. * SSL_set1_alpn_selected accepts a single protocol (not length
  3687. * prefixed)
  3688. */
  3689. if (!TEST_true(SSL_SESSION_set1_alpn_selected(sess, GOODALPN + 1,
  3690. GOODALPNLEN - 1))
  3691. || !TEST_false(SSL_set_alpn_protos(clientssl, GOODALPN,
  3692. GOODALPNLEN)))
  3693. goto end;
  3694. SSL_CTX_set_alpn_select_cb(sctx, alpn_select_cb, NULL);
  3695. break;
  3696. case 7:
  3697. /* Set inconsistent ALPN (late client detection) */
  3698. SSL_SESSION_free(serverpsk);
  3699. serverpsk = SSL_SESSION_dup(clientpsk);
  3700. if (!TEST_ptr(serverpsk)
  3701. || !TEST_true(SSL_SESSION_set1_alpn_selected(clientpsk,
  3702. BADALPN + 1,
  3703. BADALPNLEN - 1))
  3704. || !TEST_true(SSL_SESSION_set1_alpn_selected(serverpsk,
  3705. GOODALPN + 1,
  3706. GOODALPNLEN - 1))
  3707. || !TEST_false(SSL_set_alpn_protos(clientssl, alpnlist,
  3708. sizeof(alpnlist))))
  3709. goto end;
  3710. SSL_CTX_set_alpn_select_cb(sctx, alpn_select_cb, NULL);
  3711. edstatus = SSL_EARLY_DATA_ACCEPTED;
  3712. readearlyres = SSL_READ_EARLY_DATA_SUCCESS;
  3713. /* SSL_connect() call should fail */
  3714. connectres = -1;
  3715. break;
  3716. default:
  3717. TEST_error("Bad test index");
  3718. goto end;
  3719. }
  3720. SSL_set_connect_state(clientssl);
  3721. if (err != 0) {
  3722. if (!TEST_false(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3723. &written))
  3724. || !TEST_int_eq(SSL_get_error(clientssl, 0), SSL_ERROR_SSL)
  3725. || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), err))
  3726. goto end;
  3727. } else {
  3728. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3729. &written)))
  3730. goto end;
  3731. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3732. &readbytes), readearlyres)
  3733. || (readearlyres == SSL_READ_EARLY_DATA_SUCCESS
  3734. && !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1)))
  3735. || !TEST_int_eq(SSL_get_early_data_status(serverssl), edstatus)
  3736. || !TEST_int_eq(SSL_connect(clientssl), connectres))
  3737. goto end;
  3738. }
  3739. testresult = 1;
  3740. end:
  3741. SSL_SESSION_free(sess);
  3742. SSL_SESSION_free(clientpsk);
  3743. SSL_SESSION_free(serverpsk);
  3744. clientpsk = serverpsk = NULL;
  3745. SSL_free(serverssl);
  3746. SSL_free(clientssl);
  3747. SSL_CTX_free(sctx);
  3748. SSL_CTX_free(cctx);
  3749. return testresult;
  3750. }
  3751. /*
  3752. * Test TLSv1.3 PSK can be used to send early_data with all 5 ciphersuites
  3753. * idx == 0: Test with TLS1_3_RFC_AES_128_GCM_SHA256
  3754. * idx == 1: Test with TLS1_3_RFC_AES_256_GCM_SHA384
  3755. * idx == 2: Test with TLS1_3_RFC_CHACHA20_POLY1305_SHA256,
  3756. * idx == 3: Test with TLS1_3_RFC_AES_128_CCM_SHA256
  3757. * idx == 4: Test with TLS1_3_RFC_AES_128_CCM_8_SHA256
  3758. */
  3759. static int test_early_data_psk_with_all_ciphers(int idx)
  3760. {
  3761. SSL_CTX *cctx = NULL, *sctx = NULL;
  3762. SSL *clientssl = NULL, *serverssl = NULL;
  3763. int testresult = 0;
  3764. SSL_SESSION *sess = NULL;
  3765. unsigned char buf[20];
  3766. size_t readbytes, written;
  3767. const SSL_CIPHER *cipher;
  3768. const char *cipher_str[] = {
  3769. TLS1_3_RFC_AES_128_GCM_SHA256,
  3770. TLS1_3_RFC_AES_256_GCM_SHA384,
  3771. # if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
  3772. TLS1_3_RFC_CHACHA20_POLY1305_SHA256,
  3773. # else
  3774. NULL,
  3775. # endif
  3776. TLS1_3_RFC_AES_128_CCM_SHA256,
  3777. TLS1_3_RFC_AES_128_CCM_8_SHA256
  3778. };
  3779. const unsigned char *cipher_bytes[] = {
  3780. TLS13_AES_128_GCM_SHA256_BYTES,
  3781. TLS13_AES_256_GCM_SHA384_BYTES,
  3782. # if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
  3783. TLS13_CHACHA20_POLY1305_SHA256_BYTES,
  3784. # else
  3785. NULL,
  3786. # endif
  3787. TLS13_AES_128_CCM_SHA256_BYTES,
  3788. TLS13_AES_128_CCM_8_SHA256_BYTES
  3789. };
  3790. if (cipher_str[idx] == NULL)
  3791. return 1;
  3792. /* Skip ChaCha20Poly1305 as currently FIPS module does not support it */
  3793. if (idx == 2 && is_fips == 1)
  3794. return 1;
  3795. /* We always set this up with a final parameter of "2" for PSK */
  3796. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3797. &serverssl, &sess, 2,
  3798. SHA384_DIGEST_LENGTH)))
  3799. goto end;
  3800. if (idx == 4) {
  3801. /* CCM8 ciphers are considered low security due to their short tag */
  3802. SSL_set_security_level(clientssl, 0);
  3803. SSL_set_security_level(serverssl, 0);
  3804. }
  3805. if (!TEST_true(SSL_set_ciphersuites(clientssl, cipher_str[idx]))
  3806. || !TEST_true(SSL_set_ciphersuites(serverssl, cipher_str[idx])))
  3807. goto end;
  3808. /*
  3809. * 'setupearly_data_test' creates only one instance of SSL_SESSION
  3810. * and assigns to both client and server with incremented reference
  3811. * and the same instance is updated in 'sess'.
  3812. * So updating ciphersuite in 'sess' which will get reflected in
  3813. * PSK handshake using psk use sess and find sess cb.
  3814. */
  3815. cipher = SSL_CIPHER_find(clientssl, cipher_bytes[idx]);
  3816. if (!TEST_ptr(cipher) || !TEST_true(SSL_SESSION_set_cipher(sess, cipher)))
  3817. goto end;
  3818. SSL_set_connect_state(clientssl);
  3819. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3820. &written)))
  3821. goto end;
  3822. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3823. &readbytes),
  3824. SSL_READ_EARLY_DATA_SUCCESS)
  3825. || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
  3826. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3827. SSL_EARLY_DATA_ACCEPTED)
  3828. || !TEST_int_eq(SSL_connect(clientssl), 1)
  3829. || !TEST_int_eq(SSL_accept(serverssl), 1))
  3830. goto end;
  3831. /* Send some normal data from client to server */
  3832. if (!TEST_true(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
  3833. || !TEST_size_t_eq(written, strlen(MSG2)))
  3834. goto end;
  3835. if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3836. || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
  3837. goto end;
  3838. testresult = 1;
  3839. end:
  3840. SSL_SESSION_free(sess);
  3841. SSL_SESSION_free(clientpsk);
  3842. SSL_SESSION_free(serverpsk);
  3843. clientpsk = serverpsk = NULL;
  3844. if (clientssl != NULL)
  3845. SSL_shutdown(clientssl);
  3846. if (serverssl != NULL)
  3847. SSL_shutdown(serverssl);
  3848. SSL_free(serverssl);
  3849. SSL_free(clientssl);
  3850. SSL_CTX_free(sctx);
  3851. SSL_CTX_free(cctx);
  3852. return testresult;
  3853. }
  3854. /*
  3855. * Test that a server that doesn't try to read early data can handle a
  3856. * client sending some.
  3857. */
  3858. static int test_early_data_not_expected(int idx)
  3859. {
  3860. SSL_CTX *cctx = NULL, *sctx = NULL;
  3861. SSL *clientssl = NULL, *serverssl = NULL;
  3862. int testresult = 0;
  3863. SSL_SESSION *sess = NULL;
  3864. unsigned char buf[20];
  3865. size_t readbytes, written;
  3866. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3867. &serverssl, &sess, idx,
  3868. SHA384_DIGEST_LENGTH)))
  3869. goto end;
  3870. /* Write some early data */
  3871. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3872. &written)))
  3873. goto end;
  3874. /*
  3875. * Server should skip over early data and then block waiting for client to
  3876. * continue handshake
  3877. */
  3878. if (!TEST_int_le(SSL_accept(serverssl), 0)
  3879. || !TEST_int_gt(SSL_connect(clientssl), 0)
  3880. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3881. SSL_EARLY_DATA_REJECTED)
  3882. || !TEST_int_gt(SSL_accept(serverssl), 0)
  3883. || !TEST_int_eq(SSL_get_early_data_status(clientssl),
  3884. SSL_EARLY_DATA_REJECTED))
  3885. goto end;
  3886. /* Send some normal data from client to server */
  3887. if (!TEST_true(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
  3888. || !TEST_size_t_eq(written, strlen(MSG2)))
  3889. goto end;
  3890. if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3891. || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
  3892. goto end;
  3893. testresult = 1;
  3894. end:
  3895. SSL_SESSION_free(sess);
  3896. SSL_SESSION_free(clientpsk);
  3897. SSL_SESSION_free(serverpsk);
  3898. clientpsk = serverpsk = NULL;
  3899. SSL_free(serverssl);
  3900. SSL_free(clientssl);
  3901. SSL_CTX_free(sctx);
  3902. SSL_CTX_free(cctx);
  3903. return testresult;
  3904. }
  3905. # ifndef OPENSSL_NO_TLS1_2
  3906. /*
  3907. * Test that a server attempting to read early data can handle a connection
  3908. * from a TLSv1.2 client.
  3909. */
  3910. static int test_early_data_tls1_2(int idx)
  3911. {
  3912. SSL_CTX *cctx = NULL, *sctx = NULL;
  3913. SSL *clientssl = NULL, *serverssl = NULL;
  3914. int testresult = 0;
  3915. unsigned char buf[20];
  3916. size_t readbytes, written;
  3917. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3918. &serverssl, NULL, idx,
  3919. SHA384_DIGEST_LENGTH)))
  3920. goto end;
  3921. /* Write some data - should block due to handshake with server */
  3922. SSL_set_max_proto_version(clientssl, TLS1_2_VERSION);
  3923. SSL_set_connect_state(clientssl);
  3924. if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written)))
  3925. goto end;
  3926. /*
  3927. * Server should do TLSv1.2 handshake. First it will block waiting for more
  3928. * messages from client after ServerDone. Then SSL_read_early_data should
  3929. * finish and detect that early data has not been sent
  3930. */
  3931. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3932. &readbytes),
  3933. SSL_READ_EARLY_DATA_ERROR))
  3934. goto end;
  3935. /*
  3936. * Continue writing the message we started earlier. Will still block waiting
  3937. * for the CCS/Finished from server
  3938. */
  3939. if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
  3940. || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3941. &readbytes),
  3942. SSL_READ_EARLY_DATA_FINISH)
  3943. || !TEST_size_t_eq(readbytes, 0)
  3944. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3945. SSL_EARLY_DATA_NOT_SENT))
  3946. goto end;
  3947. /* Continue writing the message we started earlier */
  3948. if (!TEST_true(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
  3949. || !TEST_size_t_eq(written, strlen(MSG1))
  3950. || !TEST_int_eq(SSL_get_early_data_status(clientssl),
  3951. SSL_EARLY_DATA_NOT_SENT)
  3952. || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3953. || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
  3954. || !TEST_true(SSL_write_ex(serverssl, MSG2, strlen(MSG2), &written))
  3955. || !TEST_size_t_eq(written, strlen(MSG2))
  3956. || !SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes)
  3957. || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
  3958. goto end;
  3959. testresult = 1;
  3960. end:
  3961. SSL_SESSION_free(clientpsk);
  3962. SSL_SESSION_free(serverpsk);
  3963. clientpsk = serverpsk = NULL;
  3964. SSL_free(serverssl);
  3965. SSL_free(clientssl);
  3966. SSL_CTX_free(sctx);
  3967. SSL_CTX_free(cctx);
  3968. return testresult;
  3969. }
  3970. # endif /* OPENSSL_NO_TLS1_2 */
  3971. /*
  3972. * Test configuring the TLSv1.3 ciphersuites
  3973. *
  3974. * Test 0: Set a default ciphersuite in the SSL_CTX (no explicit cipher_list)
  3975. * Test 1: Set a non-default ciphersuite in the SSL_CTX (no explicit cipher_list)
  3976. * Test 2: Set a default ciphersuite in the SSL (no explicit cipher_list)
  3977. * Test 3: Set a non-default ciphersuite in the SSL (no explicit cipher_list)
  3978. * Test 4: Set a default ciphersuite in the SSL_CTX (SSL_CTX cipher_list)
  3979. * Test 5: Set a non-default ciphersuite in the SSL_CTX (SSL_CTX cipher_list)
  3980. * Test 6: Set a default ciphersuite in the SSL (SSL_CTX cipher_list)
  3981. * Test 7: Set a non-default ciphersuite in the SSL (SSL_CTX cipher_list)
  3982. * Test 8: Set a default ciphersuite in the SSL (SSL cipher_list)
  3983. * Test 9: Set a non-default ciphersuite in the SSL (SSL cipher_list)
  3984. */
  3985. static int test_set_ciphersuite(int idx)
  3986. {
  3987. SSL_CTX *cctx = NULL, *sctx = NULL;
  3988. SSL *clientssl = NULL, *serverssl = NULL;
  3989. int testresult = 0;
  3990. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  3991. TLS_client_method(), TLS1_VERSION, 0,
  3992. &sctx, &cctx, cert, privkey))
  3993. || !TEST_true(SSL_CTX_set_ciphersuites(sctx,
  3994. "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256")))
  3995. goto end;
  3996. if (idx >=4 && idx <= 7) {
  3997. /* SSL_CTX explicit cipher list */
  3998. if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "AES256-GCM-SHA384")))
  3999. goto end;
  4000. }
  4001. if (idx == 0 || idx == 4) {
  4002. /* Default ciphersuite */
  4003. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  4004. "TLS_AES_128_GCM_SHA256")))
  4005. goto end;
  4006. } else if (idx == 1 || idx == 5) {
  4007. /* Non default ciphersuite */
  4008. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  4009. "TLS_AES_128_CCM_SHA256")))
  4010. goto end;
  4011. }
  4012. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  4013. &clientssl, NULL, NULL)))
  4014. goto end;
  4015. if (idx == 8 || idx == 9) {
  4016. /* SSL explicit cipher list */
  4017. if (!TEST_true(SSL_set_cipher_list(clientssl, "AES256-GCM-SHA384")))
  4018. goto end;
  4019. }
  4020. if (idx == 2 || idx == 6 || idx == 8) {
  4021. /* Default ciphersuite */
  4022. if (!TEST_true(SSL_set_ciphersuites(clientssl,
  4023. "TLS_AES_128_GCM_SHA256")))
  4024. goto end;
  4025. } else if (idx == 3 || idx == 7 || idx == 9) {
  4026. /* Non default ciphersuite */
  4027. if (!TEST_true(SSL_set_ciphersuites(clientssl,
  4028. "TLS_AES_128_CCM_SHA256")))
  4029. goto end;
  4030. }
  4031. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  4032. goto end;
  4033. testresult = 1;
  4034. end:
  4035. SSL_free(serverssl);
  4036. SSL_free(clientssl);
  4037. SSL_CTX_free(sctx);
  4038. SSL_CTX_free(cctx);
  4039. return testresult;
  4040. }
  4041. static int test_ciphersuite_change(void)
  4042. {
  4043. SSL_CTX *cctx = NULL, *sctx = NULL;
  4044. SSL *clientssl = NULL, *serverssl = NULL;
  4045. SSL_SESSION *clntsess = NULL;
  4046. int testresult = 0;
  4047. const SSL_CIPHER *aes_128_gcm_sha256 = NULL;
  4048. /* Create a session based on SHA-256 */
  4049. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  4050. TLS_client_method(), TLS1_VERSION, 0,
  4051. &sctx, &cctx, cert, privkey))
  4052. || !TEST_true(SSL_CTX_set_ciphersuites(sctx,
  4053. "TLS_AES_128_GCM_SHA256:"
  4054. "TLS_AES_256_GCM_SHA384:"
  4055. "TLS_AES_128_CCM_SHA256"))
  4056. || !TEST_true(SSL_CTX_set_ciphersuites(cctx,
  4057. "TLS_AES_128_GCM_SHA256")))
  4058. goto end;
  4059. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4060. NULL, NULL))
  4061. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  4062. SSL_ERROR_NONE)))
  4063. goto end;
  4064. clntsess = SSL_get1_session(clientssl);
  4065. /* Save for later */
  4066. aes_128_gcm_sha256 = SSL_SESSION_get0_cipher(clntsess);
  4067. SSL_shutdown(clientssl);
  4068. SSL_shutdown(serverssl);
  4069. SSL_free(serverssl);
  4070. SSL_free(clientssl);
  4071. serverssl = clientssl = NULL;
  4072. /* Check we can resume a session with a different SHA-256 ciphersuite */
  4073. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  4074. "TLS_AES_128_CCM_SHA256"))
  4075. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  4076. &clientssl, NULL, NULL))
  4077. || !TEST_true(SSL_set_session(clientssl, clntsess))
  4078. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  4079. SSL_ERROR_NONE))
  4080. || !TEST_true(SSL_session_reused(clientssl)))
  4081. goto end;
  4082. SSL_SESSION_free(clntsess);
  4083. clntsess = SSL_get1_session(clientssl);
  4084. SSL_shutdown(clientssl);
  4085. SSL_shutdown(serverssl);
  4086. SSL_free(serverssl);
  4087. SSL_free(clientssl);
  4088. serverssl = clientssl = NULL;
  4089. /*
  4090. * Check attempting to resume a SHA-256 session with no SHA-256 ciphersuites
  4091. * succeeds but does not resume.
  4092. */
  4093. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, "TLS_AES_256_GCM_SHA384"))
  4094. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4095. NULL, NULL))
  4096. || !TEST_true(SSL_set_session(clientssl, clntsess))
  4097. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  4098. SSL_ERROR_SSL))
  4099. || !TEST_false(SSL_session_reused(clientssl)))
  4100. goto end;
  4101. SSL_SESSION_free(clntsess);
  4102. clntsess = NULL;
  4103. SSL_shutdown(clientssl);
  4104. SSL_shutdown(serverssl);
  4105. SSL_free(serverssl);
  4106. SSL_free(clientssl);
  4107. serverssl = clientssl = NULL;
  4108. /* Create a session based on SHA384 */
  4109. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, "TLS_AES_256_GCM_SHA384"))
  4110. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  4111. &clientssl, NULL, NULL))
  4112. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  4113. SSL_ERROR_NONE)))
  4114. goto end;
  4115. clntsess = SSL_get1_session(clientssl);
  4116. SSL_shutdown(clientssl);
  4117. SSL_shutdown(serverssl);
  4118. SSL_free(serverssl);
  4119. SSL_free(clientssl);
  4120. serverssl = clientssl = NULL;
  4121. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  4122. "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384"))
  4123. || !TEST_true(SSL_CTX_set_ciphersuites(sctx,
  4124. "TLS_AES_256_GCM_SHA384"))
  4125. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4126. NULL, NULL))
  4127. || !TEST_true(SSL_set_session(clientssl, clntsess))
  4128. /*
  4129. * We use SSL_ERROR_WANT_READ below so that we can pause the
  4130. * connection after the initial ClientHello has been sent to
  4131. * enable us to make some session changes.
  4132. */
  4133. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  4134. SSL_ERROR_WANT_READ)))
  4135. goto end;
  4136. /* Trick the client into thinking this session is for a different digest */
  4137. clntsess->cipher = aes_128_gcm_sha256;
  4138. clntsess->cipher_id = clntsess->cipher->id;
  4139. /*
  4140. * Continue the previously started connection. Server has selected a SHA-384
  4141. * ciphersuite, but client thinks the session is for SHA-256, so it should
  4142. * bail out.
  4143. */
  4144. if (!TEST_false(create_ssl_connection(serverssl, clientssl,
  4145. SSL_ERROR_SSL))
  4146. || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()),
  4147. SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED))
  4148. goto end;
  4149. testresult = 1;
  4150. end:
  4151. SSL_SESSION_free(clntsess);
  4152. SSL_free(serverssl);
  4153. SSL_free(clientssl);
  4154. SSL_CTX_free(sctx);
  4155. SSL_CTX_free(cctx);
  4156. return testresult;
  4157. }
  4158. /*
  4159. * Test TLSv1.3 Key exchange
  4160. * Test 0 = Test all ECDHE Key exchange with TLSv1.3 client and server
  4161. * Test 1 = Test NID_X9_62_prime256v1 with TLSv1.3 client and server
  4162. * Test 2 = Test NID_secp384r1 with TLSv1.3 client and server
  4163. * Test 3 = Test NID_secp521r1 with TLSv1.3 client and server
  4164. * Test 4 = Test NID_X25519 with TLSv1.3 client and server
  4165. * Test 5 = Test NID_X448 with TLSv1.3 client and server
  4166. * Test 6 = Test all FFDHE Key exchange with TLSv1.3 client and server
  4167. * Test 7 = Test NID_ffdhe2048 with TLSv1.3 client and server
  4168. * Test 8 = Test NID_ffdhe3072 with TLSv1.3 client and server
  4169. * Test 9 = Test NID_ffdhe4096 with TLSv1.3 client and server
  4170. * Test 10 = Test NID_ffdhe6144 with TLSv1.3 client and server
  4171. * Test 11 = Test NID_ffdhe8192 with TLSv1.3 client and server
  4172. * Test 12 = Test all ECDHE with TLSv1.2 client and server
  4173. * Test 13 = Test all FFDHE with TLSv1.2 client and server
  4174. */
  4175. # ifndef OPENSSL_NO_EC
  4176. static int ecdhe_kexch_groups[] = {NID_X9_62_prime256v1, NID_secp384r1,
  4177. NID_secp521r1,
  4178. # ifndef OPENSSL_NO_ECX
  4179. NID_X25519, NID_X448
  4180. # endif
  4181. };
  4182. # endif
  4183. # ifndef OPENSSL_NO_DH
  4184. static int ffdhe_kexch_groups[] = {NID_ffdhe2048, NID_ffdhe3072, NID_ffdhe4096,
  4185. NID_ffdhe6144, NID_ffdhe8192};
  4186. # endif
  4187. static int test_key_exchange(int idx)
  4188. {
  4189. SSL_CTX *sctx = NULL, *cctx = NULL;
  4190. SSL *serverssl = NULL, *clientssl = NULL;
  4191. int testresult = 0;
  4192. int kexch_alg;
  4193. int *kexch_groups = &kexch_alg;
  4194. int kexch_groups_size = 1;
  4195. int max_version = TLS1_3_VERSION;
  4196. char *kexch_name0 = NULL;
  4197. switch (idx) {
  4198. # ifndef OPENSSL_NO_EC
  4199. # ifndef OPENSSL_NO_TLS1_2
  4200. case 12:
  4201. max_version = TLS1_2_VERSION;
  4202. # endif
  4203. /* Fall through */
  4204. case 0:
  4205. kexch_groups = ecdhe_kexch_groups;
  4206. kexch_groups_size = OSSL_NELEM(ecdhe_kexch_groups);
  4207. kexch_name0 = "secp256r1";
  4208. break;
  4209. case 1:
  4210. kexch_alg = NID_X9_62_prime256v1;
  4211. kexch_name0 = "secp256r1";
  4212. break;
  4213. case 2:
  4214. kexch_alg = NID_secp384r1;
  4215. kexch_name0 = "secp384r1";
  4216. break;
  4217. case 3:
  4218. kexch_alg = NID_secp521r1;
  4219. kexch_name0 = "secp521r1";
  4220. break;
  4221. # ifndef OPENSSL_NO_ECX
  4222. case 4:
  4223. kexch_alg = NID_X25519;
  4224. kexch_name0 = "x25519";
  4225. break;
  4226. case 5:
  4227. kexch_alg = NID_X448;
  4228. kexch_name0 = "x448";
  4229. break;
  4230. # endif
  4231. # endif
  4232. # ifndef OPENSSL_NO_DH
  4233. # ifndef OPENSSL_NO_TLS1_2
  4234. case 13:
  4235. max_version = TLS1_2_VERSION;
  4236. kexch_name0 = "ffdhe2048";
  4237. # endif
  4238. /* Fall through */
  4239. case 6:
  4240. kexch_groups = ffdhe_kexch_groups;
  4241. kexch_groups_size = OSSL_NELEM(ffdhe_kexch_groups);
  4242. kexch_name0 = "ffdhe2048";
  4243. break;
  4244. case 7:
  4245. kexch_alg = NID_ffdhe2048;
  4246. kexch_name0 = "ffdhe2048";
  4247. break;
  4248. case 8:
  4249. kexch_alg = NID_ffdhe3072;
  4250. kexch_name0 = "ffdhe3072";
  4251. break;
  4252. case 9:
  4253. kexch_alg = NID_ffdhe4096;
  4254. kexch_name0 = "ffdhe4096";
  4255. break;
  4256. case 10:
  4257. kexch_alg = NID_ffdhe6144;
  4258. kexch_name0 = "ffdhe6144";
  4259. break;
  4260. case 11:
  4261. kexch_alg = NID_ffdhe8192;
  4262. kexch_name0 = "ffdhe8192";
  4263. break;
  4264. # endif
  4265. default:
  4266. /* We're skipping this test */
  4267. return 1;
  4268. }
  4269. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  4270. TLS_client_method(), TLS1_VERSION,
  4271. max_version, &sctx, &cctx, cert,
  4272. privkey)))
  4273. goto end;
  4274. if (!TEST_true(SSL_CTX_set_ciphersuites(sctx,
  4275. TLS1_3_RFC_AES_128_GCM_SHA256)))
  4276. goto end;
  4277. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  4278. TLS1_3_RFC_AES_128_GCM_SHA256)))
  4279. goto end;
  4280. if (!TEST_true(SSL_CTX_set_cipher_list(sctx,
  4281. TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ":"
  4282. TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256))
  4283. || !TEST_true(SSL_CTX_set_dh_auto(sctx, 1)))
  4284. goto end;
  4285. /*
  4286. * Must include an EC ciphersuite so that we send supported groups in
  4287. * TLSv1.2
  4288. */
  4289. # ifndef OPENSSL_NO_TLS1_2
  4290. if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
  4291. TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ":"
  4292. TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256)))
  4293. goto end;
  4294. # endif
  4295. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4296. NULL, NULL)))
  4297. goto end;
  4298. if (!TEST_true(SSL_set1_groups(serverssl, kexch_groups, kexch_groups_size))
  4299. || !TEST_true(SSL_set1_groups(clientssl, kexch_groups, kexch_groups_size)))
  4300. goto end;
  4301. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  4302. goto end;
  4303. /*
  4304. * If Handshake succeeds the negotiated kexch alg should be the first one in
  4305. * configured, except in the case of FFDHE groups (idx 13), which are
  4306. * TLSv1.3 only so we expect no shared group to exist.
  4307. */
  4308. if (!TEST_int_eq(SSL_get_shared_group(serverssl, 0),
  4309. idx == 13 ? 0 : kexch_groups[0]))
  4310. goto end;
  4311. if (!TEST_str_eq(SSL_group_to_name(serverssl, kexch_groups[0]),
  4312. kexch_name0))
  4313. goto end;
  4314. /* We don't implement RFC 7919 named groups for TLS 1.2. */
  4315. if (idx != 13) {
  4316. if (!TEST_str_eq(SSL_get0_group_name(serverssl), kexch_name0)
  4317. || !TEST_str_eq(SSL_get0_group_name(clientssl), kexch_name0))
  4318. goto end;
  4319. if (!TEST_int_eq(SSL_get_negotiated_group(serverssl), kexch_groups[0]))
  4320. goto end;
  4321. if (!TEST_int_eq(SSL_get_negotiated_group(clientssl), kexch_groups[0]))
  4322. goto end;
  4323. }
  4324. testresult = 1;
  4325. end:
  4326. SSL_free(serverssl);
  4327. SSL_free(clientssl);
  4328. SSL_CTX_free(sctx);
  4329. SSL_CTX_free(cctx);
  4330. return testresult;
  4331. }
  4332. # if !defined(OPENSSL_NO_TLS1_2) \
  4333. && !defined(OPENSSL_NO_EC) \
  4334. && !defined(OPENSSL_NO_DH)
  4335. static int set_ssl_groups(SSL *serverssl, SSL *clientssl, int clientmulti,
  4336. int isecdhe, int idx)
  4337. {
  4338. int kexch_alg;
  4339. int *kexch_groups = &kexch_alg;
  4340. int numec, numff;
  4341. numec = OSSL_NELEM(ecdhe_kexch_groups);
  4342. numff = OSSL_NELEM(ffdhe_kexch_groups);
  4343. if (isecdhe)
  4344. kexch_alg = ecdhe_kexch_groups[idx];
  4345. else
  4346. kexch_alg = ffdhe_kexch_groups[idx];
  4347. if (clientmulti) {
  4348. if (!TEST_true(SSL_set1_groups(serverssl, kexch_groups, 1)))
  4349. return 0;
  4350. if (isecdhe) {
  4351. if (!TEST_true(SSL_set1_groups(clientssl, ecdhe_kexch_groups,
  4352. numec)))
  4353. return 0;
  4354. } else {
  4355. if (!TEST_true(SSL_set1_groups(clientssl, ffdhe_kexch_groups,
  4356. numff)))
  4357. return 0;
  4358. }
  4359. } else {
  4360. if (!TEST_true(SSL_set1_groups(clientssl, kexch_groups, 1)))
  4361. return 0;
  4362. if (isecdhe) {
  4363. if (!TEST_true(SSL_set1_groups(serverssl, ecdhe_kexch_groups,
  4364. numec)))
  4365. return 0;
  4366. } else {
  4367. if (!TEST_true(SSL_set1_groups(serverssl, ffdhe_kexch_groups,
  4368. numff)))
  4369. return 0;
  4370. }
  4371. }
  4372. return 1;
  4373. }
  4374. /*-
  4375. * Test the SSL_get_negotiated_group() API across a battery of scenarios.
  4376. * Run through both the ECDHE and FFDHE group lists used in the previous
  4377. * test, for both TLS 1.2 and TLS 1.3, negotiating each group in turn,
  4378. * confirming the expected result; then perform a resumption handshake
  4379. * while offering the same group list, and another resumption handshake
  4380. * offering a different group list. The returned value should be the
  4381. * negotiated group for the initial handshake; for TLS 1.3 resumption
  4382. * handshakes the returned value will be negotiated on the resumption
  4383. * handshake itself, but for TLS 1.2 resumption handshakes the value will
  4384. * be cached in the session from the original handshake, regardless of what
  4385. * was offered in the resumption ClientHello.
  4386. *
  4387. * Using E for the number of EC groups and F for the number of FF groups:
  4388. * E tests of ECDHE with TLS 1.3, server only has one group
  4389. * F tests of FFDHE with TLS 1.3, server only has one group
  4390. * E tests of ECDHE with TLS 1.2, server only has one group
  4391. * F tests of FFDHE with TLS 1.2, server only has one group
  4392. * E tests of ECDHE with TLS 1.3, client sends only one group
  4393. * F tests of FFDHE with TLS 1.3, client sends only one group
  4394. * E tests of ECDHE with TLS 1.2, client sends only one group
  4395. * F tests of FFDHE with TLS 1.2, client sends only one group
  4396. */
  4397. static int test_negotiated_group(int idx)
  4398. {
  4399. int clientmulti, istls13, isecdhe, numec, numff, numgroups;
  4400. int expectednid;
  4401. SSL_CTX *sctx = NULL, *cctx = NULL;
  4402. SSL *serverssl = NULL, *clientssl = NULL;
  4403. SSL_SESSION *origsess = NULL;
  4404. int testresult = 0;
  4405. int kexch_alg;
  4406. int max_version = TLS1_3_VERSION;
  4407. numec = OSSL_NELEM(ecdhe_kexch_groups);
  4408. numff = OSSL_NELEM(ffdhe_kexch_groups);
  4409. numgroups = numec + numff;
  4410. clientmulti = (idx < 2 * numgroups);
  4411. idx = idx % (2 * numgroups);
  4412. istls13 = (idx < numgroups);
  4413. idx = idx % numgroups;
  4414. isecdhe = (idx < numec);
  4415. if (!isecdhe)
  4416. idx -= numec;
  4417. /* Now 'idx' is an index into ecdhe_kexch_groups or ffdhe_kexch_groups */
  4418. if (isecdhe)
  4419. kexch_alg = ecdhe_kexch_groups[idx];
  4420. else
  4421. kexch_alg = ffdhe_kexch_groups[idx];
  4422. /* We expect nothing for the unimplemented TLS 1.2 FFDHE named groups */
  4423. if (!istls13 && !isecdhe)
  4424. expectednid = NID_undef;
  4425. else
  4426. expectednid = kexch_alg;
  4427. if (!istls13)
  4428. max_version = TLS1_2_VERSION;
  4429. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  4430. TLS_client_method(), TLS1_VERSION,
  4431. max_version, &sctx, &cctx, cert,
  4432. privkey)))
  4433. goto end;
  4434. /*
  4435. * Force (EC)DHE ciphers for TLS 1.2.
  4436. * Be sure to enable auto tmp DH so that FFDHE can succeed.
  4437. */
  4438. if (!TEST_true(SSL_CTX_set_cipher_list(sctx,
  4439. TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ":"
  4440. TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256))
  4441. || !TEST_true(SSL_CTX_set_dh_auto(sctx, 1)))
  4442. goto end;
  4443. if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
  4444. TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ":"
  4445. TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256)))
  4446. goto end;
  4447. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4448. NULL, NULL)))
  4449. goto end;
  4450. if (!TEST_true(set_ssl_groups(serverssl, clientssl, clientmulti, isecdhe,
  4451. idx)))
  4452. goto end;
  4453. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  4454. goto end;
  4455. /* Initial handshake; always the configured one */
  4456. if (!TEST_uint_eq(SSL_get_negotiated_group(clientssl), expectednid)
  4457. || !TEST_uint_eq(SSL_get_negotiated_group(serverssl), expectednid))
  4458. goto end;
  4459. if (!TEST_ptr((origsess = SSL_get1_session(clientssl))))
  4460. goto end;
  4461. SSL_shutdown(clientssl);
  4462. SSL_shutdown(serverssl);
  4463. SSL_free(serverssl);
  4464. SSL_free(clientssl);
  4465. serverssl = clientssl = NULL;
  4466. /* First resumption attempt; use the same config as initial handshake */
  4467. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4468. NULL, NULL))
  4469. || !TEST_true(SSL_set_session(clientssl, origsess))
  4470. || !TEST_true(set_ssl_groups(serverssl, clientssl, clientmulti,
  4471. isecdhe, idx)))
  4472. goto end;
  4473. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
  4474. || !TEST_true(SSL_session_reused(clientssl)))
  4475. goto end;
  4476. /* Still had better agree, since nothing changed... */
  4477. if (!TEST_uint_eq(SSL_get_negotiated_group(clientssl), expectednid)
  4478. || !TEST_uint_eq(SSL_get_negotiated_group(serverssl), expectednid))
  4479. goto end;
  4480. SSL_shutdown(clientssl);
  4481. SSL_shutdown(serverssl);
  4482. SSL_free(serverssl);
  4483. SSL_free(clientssl);
  4484. serverssl = clientssl = NULL;
  4485. /*-
  4486. * Second resumption attempt
  4487. * The party that picks one group changes it, which we effectuate by
  4488. * changing 'idx' and updating what we expect.
  4489. */
  4490. if (idx == 0)
  4491. idx = 1;
  4492. else
  4493. idx--;
  4494. if (istls13) {
  4495. if (isecdhe)
  4496. expectednid = ecdhe_kexch_groups[idx];
  4497. else
  4498. expectednid = ffdhe_kexch_groups[idx];
  4499. /* Verify that we are changing what we expect. */
  4500. if (!TEST_int_ne(expectednid, kexch_alg))
  4501. goto end;
  4502. } else {
  4503. /* TLS 1.2 only supports named groups for ECDHE. */
  4504. if (isecdhe)
  4505. expectednid = kexch_alg;
  4506. else
  4507. expectednid = 0;
  4508. }
  4509. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4510. NULL, NULL))
  4511. || !TEST_true(SSL_set_session(clientssl, origsess))
  4512. || !TEST_true(set_ssl_groups(serverssl, clientssl, clientmulti,
  4513. isecdhe, idx)))
  4514. goto end;
  4515. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
  4516. || !TEST_true(SSL_session_reused(clientssl)))
  4517. goto end;
  4518. /* Check that we get what we expected */
  4519. if (!TEST_uint_eq(SSL_get_negotiated_group(clientssl), expectednid)
  4520. || !TEST_uint_eq(SSL_get_negotiated_group(serverssl), expectednid))
  4521. goto end;
  4522. testresult = 1;
  4523. end:
  4524. SSL_free(serverssl);
  4525. SSL_free(clientssl);
  4526. SSL_CTX_free(sctx);
  4527. SSL_CTX_free(cctx);
  4528. SSL_SESSION_free(origsess);
  4529. return testresult;
  4530. }
  4531. # endif /* !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_DH) */
  4532. /*
  4533. * Test TLSv1.3 Cipher Suite
  4534. * Test 0 = Set TLS1.3 cipher on context
  4535. * Test 1 = Set TLS1.3 cipher on SSL
  4536. * Test 2 = Set TLS1.3 and TLS1.2 cipher on context
  4537. * Test 3 = Set TLS1.3 and TLS1.2 cipher on SSL
  4538. */
  4539. static int test_tls13_ciphersuite(int idx)
  4540. {
  4541. SSL_CTX *sctx = NULL, *cctx = NULL;
  4542. SSL *serverssl = NULL, *clientssl = NULL;
  4543. static const struct {
  4544. const char *ciphername;
  4545. int fipscapable;
  4546. int low_security;
  4547. } t13_ciphers[] = {
  4548. { TLS1_3_RFC_AES_128_GCM_SHA256, 1, 0 },
  4549. { TLS1_3_RFC_AES_256_GCM_SHA384, 1, 0 },
  4550. { TLS1_3_RFC_AES_128_CCM_SHA256, 1, 0 },
  4551. # if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
  4552. { TLS1_3_RFC_CHACHA20_POLY1305_SHA256, 0, 0 },
  4553. { TLS1_3_RFC_AES_256_GCM_SHA384
  4554. ":" TLS1_3_RFC_CHACHA20_POLY1305_SHA256, 0, 0 },
  4555. # endif
  4556. /* CCM8 ciphers are considered low security due to their short tag */
  4557. { TLS1_3_RFC_AES_128_CCM_8_SHA256
  4558. ":" TLS1_3_RFC_AES_128_CCM_SHA256, 1, 1 }
  4559. };
  4560. const char *t13_cipher = NULL;
  4561. const char *t12_cipher = NULL;
  4562. const char *negotiated_scipher;
  4563. const char *negotiated_ccipher;
  4564. int set_at_ctx = 0;
  4565. int set_at_ssl = 0;
  4566. int testresult = 0;
  4567. int max_ver;
  4568. size_t i;
  4569. switch (idx) {
  4570. case 0:
  4571. set_at_ctx = 1;
  4572. break;
  4573. case 1:
  4574. set_at_ssl = 1;
  4575. break;
  4576. case 2:
  4577. set_at_ctx = 1;
  4578. t12_cipher = TLS1_TXT_RSA_WITH_AES_128_SHA256;
  4579. break;
  4580. case 3:
  4581. set_at_ssl = 1;
  4582. t12_cipher = TLS1_TXT_RSA_WITH_AES_128_SHA256;
  4583. break;
  4584. }
  4585. for (max_ver = TLS1_2_VERSION; max_ver <= TLS1_3_VERSION; max_ver++) {
  4586. # ifdef OPENSSL_NO_TLS1_2
  4587. if (max_ver == TLS1_2_VERSION)
  4588. continue;
  4589. # endif
  4590. for (i = 0; i < OSSL_NELEM(t13_ciphers); i++) {
  4591. if (is_fips && !t13_ciphers[i].fipscapable)
  4592. continue;
  4593. t13_cipher = t13_ciphers[i].ciphername;
  4594. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  4595. TLS_client_method(),
  4596. TLS1_VERSION, max_ver,
  4597. &sctx, &cctx, cert, privkey)))
  4598. goto end;
  4599. if (t13_ciphers[i].low_security) {
  4600. SSL_CTX_set_security_level(sctx, 0);
  4601. SSL_CTX_set_security_level(cctx, 0);
  4602. }
  4603. if (set_at_ctx) {
  4604. if (!TEST_true(SSL_CTX_set_ciphersuites(sctx, t13_cipher))
  4605. || !TEST_true(SSL_CTX_set_ciphersuites(cctx, t13_cipher)))
  4606. goto end;
  4607. if (t12_cipher != NULL) {
  4608. if (!TEST_true(SSL_CTX_set_cipher_list(sctx, t12_cipher))
  4609. || !TEST_true(SSL_CTX_set_cipher_list(cctx,
  4610. t12_cipher)))
  4611. goto end;
  4612. }
  4613. }
  4614. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  4615. &clientssl, NULL, NULL)))
  4616. goto end;
  4617. if (set_at_ssl) {
  4618. if (!TEST_true(SSL_set_ciphersuites(serverssl, t13_cipher))
  4619. || !TEST_true(SSL_set_ciphersuites(clientssl, t13_cipher)))
  4620. goto end;
  4621. if (t12_cipher != NULL) {
  4622. if (!TEST_true(SSL_set_cipher_list(serverssl, t12_cipher))
  4623. || !TEST_true(SSL_set_cipher_list(clientssl,
  4624. t12_cipher)))
  4625. goto end;
  4626. }
  4627. }
  4628. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  4629. SSL_ERROR_NONE)))
  4630. goto end;
  4631. negotiated_scipher = SSL_CIPHER_get_name(SSL_get_current_cipher(
  4632. serverssl));
  4633. negotiated_ccipher = SSL_CIPHER_get_name(SSL_get_current_cipher(
  4634. clientssl));
  4635. if (!TEST_str_eq(negotiated_scipher, negotiated_ccipher))
  4636. goto end;
  4637. /*
  4638. * TEST_strn_eq is used below because t13_cipher can contain
  4639. * multiple ciphersuites
  4640. */
  4641. if (max_ver == TLS1_3_VERSION
  4642. && !TEST_strn_eq(t13_cipher, negotiated_scipher,
  4643. strlen(negotiated_scipher)))
  4644. goto end;
  4645. # ifndef OPENSSL_NO_TLS1_2
  4646. /* Below validation is not done when t12_cipher is NULL */
  4647. if (max_ver == TLS1_2_VERSION && t12_cipher != NULL
  4648. && !TEST_str_eq(t12_cipher, negotiated_scipher))
  4649. goto end;
  4650. # endif
  4651. SSL_free(serverssl);
  4652. serverssl = NULL;
  4653. SSL_free(clientssl);
  4654. clientssl = NULL;
  4655. SSL_CTX_free(sctx);
  4656. sctx = NULL;
  4657. SSL_CTX_free(cctx);
  4658. cctx = NULL;
  4659. }
  4660. }
  4661. testresult = 1;
  4662. end:
  4663. SSL_free(serverssl);
  4664. SSL_free(clientssl);
  4665. SSL_CTX_free(sctx);
  4666. SSL_CTX_free(cctx);
  4667. return testresult;
  4668. }
  4669. /*
  4670. * Test TLSv1.3 PSKs
  4671. * Test 0 = Test new style callbacks
  4672. * Test 1 = Test both new and old style callbacks
  4673. * Test 2 = Test old style callbacks
  4674. * Test 3 = Test old style callbacks with no certificate
  4675. */
  4676. static int test_tls13_psk(int idx)
  4677. {
  4678. SSL_CTX *sctx = NULL, *cctx = NULL;
  4679. SSL *serverssl = NULL, *clientssl = NULL;
  4680. const SSL_CIPHER *cipher = NULL;
  4681. const unsigned char key[] = {
  4682. 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
  4683. 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
  4684. 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
  4685. 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f
  4686. };
  4687. int testresult = 0;
  4688. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  4689. TLS_client_method(), TLS1_VERSION, 0,
  4690. &sctx, &cctx, idx == 3 ? NULL : cert,
  4691. idx == 3 ? NULL : privkey)))
  4692. goto end;
  4693. if (idx != 3) {
  4694. /*
  4695. * We use a ciphersuite with SHA256 to ease testing old style PSK
  4696. * callbacks which will always default to SHA256. This should not be
  4697. * necessary if we have no cert/priv key. In that case the server should
  4698. * prefer SHA256 automatically.
  4699. */
  4700. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  4701. "TLS_AES_128_GCM_SHA256")))
  4702. goto end;
  4703. } else {
  4704. /*
  4705. * As noted above the server should prefer SHA256 automatically. However
  4706. * we are careful not to offer TLS_CHACHA20_POLY1305_SHA256 so this same
  4707. * code works even if we are testing with only the FIPS provider loaded.
  4708. */
  4709. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  4710. "TLS_AES_256_GCM_SHA384:"
  4711. "TLS_AES_128_GCM_SHA256")))
  4712. goto end;
  4713. }
  4714. /*
  4715. * Test 0: New style callbacks only
  4716. * Test 1: New and old style callbacks (only the new ones should be used)
  4717. * Test 2: Old style callbacks only
  4718. */
  4719. if (idx == 0 || idx == 1) {
  4720. SSL_CTX_set_psk_use_session_callback(cctx, use_session_cb);
  4721. SSL_CTX_set_psk_find_session_callback(sctx, find_session_cb);
  4722. }
  4723. #ifndef OPENSSL_NO_PSK
  4724. if (idx >= 1) {
  4725. SSL_CTX_set_psk_client_callback(cctx, psk_client_cb);
  4726. SSL_CTX_set_psk_server_callback(sctx, psk_server_cb);
  4727. }
  4728. #endif
  4729. srvid = pskid;
  4730. use_session_cb_cnt = 0;
  4731. find_session_cb_cnt = 0;
  4732. psk_client_cb_cnt = 0;
  4733. psk_server_cb_cnt = 0;
  4734. if (idx != 3) {
  4735. /*
  4736. * Check we can create a connection if callback decides not to send a
  4737. * PSK
  4738. */
  4739. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4740. NULL, NULL))
  4741. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  4742. SSL_ERROR_NONE))
  4743. || !TEST_false(SSL_session_reused(clientssl))
  4744. || !TEST_false(SSL_session_reused(serverssl)))
  4745. goto end;
  4746. if (idx == 0 || idx == 1) {
  4747. if (!TEST_true(use_session_cb_cnt == 1)
  4748. || !TEST_true(find_session_cb_cnt == 0)
  4749. /*
  4750. * If no old style callback then below should be 0
  4751. * otherwise 1
  4752. */
  4753. || !TEST_true(psk_client_cb_cnt == idx)
  4754. || !TEST_true(psk_server_cb_cnt == 0))
  4755. goto end;
  4756. } else {
  4757. if (!TEST_true(use_session_cb_cnt == 0)
  4758. || !TEST_true(find_session_cb_cnt == 0)
  4759. || !TEST_true(psk_client_cb_cnt == 1)
  4760. || !TEST_true(psk_server_cb_cnt == 0))
  4761. goto end;
  4762. }
  4763. shutdown_ssl_connection(serverssl, clientssl);
  4764. serverssl = clientssl = NULL;
  4765. use_session_cb_cnt = psk_client_cb_cnt = 0;
  4766. }
  4767. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4768. NULL, NULL)))
  4769. goto end;
  4770. /* Create the PSK */
  4771. cipher = SSL_CIPHER_find(clientssl, TLS13_AES_128_GCM_SHA256_BYTES);
  4772. clientpsk = SSL_SESSION_new();
  4773. if (!TEST_ptr(clientpsk)
  4774. || !TEST_ptr(cipher)
  4775. || !TEST_true(SSL_SESSION_set1_master_key(clientpsk, key,
  4776. sizeof(key)))
  4777. || !TEST_true(SSL_SESSION_set_cipher(clientpsk, cipher))
  4778. || !TEST_true(SSL_SESSION_set_protocol_version(clientpsk,
  4779. TLS1_3_VERSION))
  4780. || !TEST_true(SSL_SESSION_up_ref(clientpsk)))
  4781. goto end;
  4782. serverpsk = clientpsk;
  4783. /* Check we can create a connection and the PSK is used */
  4784. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
  4785. || !TEST_true(SSL_session_reused(clientssl))
  4786. || !TEST_true(SSL_session_reused(serverssl)))
  4787. goto end;
  4788. if (idx == 0 || idx == 1) {
  4789. if (!TEST_true(use_session_cb_cnt == 1)
  4790. || !TEST_true(find_session_cb_cnt == 1)
  4791. || !TEST_true(psk_client_cb_cnt == 0)
  4792. || !TEST_true(psk_server_cb_cnt == 0))
  4793. goto end;
  4794. } else {
  4795. if (!TEST_true(use_session_cb_cnt == 0)
  4796. || !TEST_true(find_session_cb_cnt == 0)
  4797. || !TEST_true(psk_client_cb_cnt == 1)
  4798. || !TEST_true(psk_server_cb_cnt == 1))
  4799. goto end;
  4800. }
  4801. shutdown_ssl_connection(serverssl, clientssl);
  4802. serverssl = clientssl = NULL;
  4803. use_session_cb_cnt = find_session_cb_cnt = 0;
  4804. psk_client_cb_cnt = psk_server_cb_cnt = 0;
  4805. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4806. NULL, NULL)))
  4807. goto end;
  4808. /* Force an HRR */
  4809. #if defined(OPENSSL_NO_EC)
  4810. if (!TEST_true(SSL_set1_groups_list(serverssl, "ffdhe3072")))
  4811. goto end;
  4812. #else
  4813. if (!TEST_true(SSL_set1_groups_list(serverssl, "P-384")))
  4814. goto end;
  4815. #endif
  4816. /*
  4817. * Check we can create a connection, the PSK is used and the callbacks are
  4818. * called twice.
  4819. */
  4820. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
  4821. || !TEST_true(SSL_session_reused(clientssl))
  4822. || !TEST_true(SSL_session_reused(serverssl)))
  4823. goto end;
  4824. if (idx == 0 || idx == 1) {
  4825. if (!TEST_true(use_session_cb_cnt == 2)
  4826. || !TEST_true(find_session_cb_cnt == 2)
  4827. || !TEST_true(psk_client_cb_cnt == 0)
  4828. || !TEST_true(psk_server_cb_cnt == 0))
  4829. goto end;
  4830. } else {
  4831. if (!TEST_true(use_session_cb_cnt == 0)
  4832. || !TEST_true(find_session_cb_cnt == 0)
  4833. || !TEST_true(psk_client_cb_cnt == 2)
  4834. || !TEST_true(psk_server_cb_cnt == 2))
  4835. goto end;
  4836. }
  4837. shutdown_ssl_connection(serverssl, clientssl);
  4838. serverssl = clientssl = NULL;
  4839. use_session_cb_cnt = find_session_cb_cnt = 0;
  4840. psk_client_cb_cnt = psk_server_cb_cnt = 0;
  4841. if (idx != 3) {
  4842. /*
  4843. * Check that if the server rejects the PSK we can still connect, but with
  4844. * a full handshake
  4845. */
  4846. srvid = "Dummy Identity";
  4847. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4848. NULL, NULL))
  4849. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  4850. SSL_ERROR_NONE))
  4851. || !TEST_false(SSL_session_reused(clientssl))
  4852. || !TEST_false(SSL_session_reused(serverssl)))
  4853. goto end;
  4854. if (idx == 0 || idx == 1) {
  4855. if (!TEST_true(use_session_cb_cnt == 1)
  4856. || !TEST_true(find_session_cb_cnt == 1)
  4857. || !TEST_true(psk_client_cb_cnt == 0)
  4858. /*
  4859. * If no old style callback then below should be 0
  4860. * otherwise 1
  4861. */
  4862. || !TEST_true(psk_server_cb_cnt == idx))
  4863. goto end;
  4864. } else {
  4865. if (!TEST_true(use_session_cb_cnt == 0)
  4866. || !TEST_true(find_session_cb_cnt == 0)
  4867. || !TEST_true(psk_client_cb_cnt == 1)
  4868. || !TEST_true(psk_server_cb_cnt == 1))
  4869. goto end;
  4870. }
  4871. shutdown_ssl_connection(serverssl, clientssl);
  4872. serverssl = clientssl = NULL;
  4873. }
  4874. testresult = 1;
  4875. end:
  4876. SSL_SESSION_free(clientpsk);
  4877. SSL_SESSION_free(serverpsk);
  4878. clientpsk = serverpsk = NULL;
  4879. SSL_free(serverssl);
  4880. SSL_free(clientssl);
  4881. SSL_CTX_free(sctx);
  4882. SSL_CTX_free(cctx);
  4883. return testresult;
  4884. }
  4885. static unsigned char cookie_magic_value[] = "cookie magic";
  4886. static int generate_cookie_callback(SSL *ssl, unsigned char *cookie,
  4887. unsigned int *cookie_len)
  4888. {
  4889. /*
  4890. * Not suitable as a real cookie generation function but good enough for
  4891. * testing!
  4892. */
  4893. memcpy(cookie, cookie_magic_value, sizeof(cookie_magic_value) - 1);
  4894. *cookie_len = sizeof(cookie_magic_value) - 1;
  4895. return 1;
  4896. }
  4897. static int verify_cookie_callback(SSL *ssl, const unsigned char *cookie,
  4898. unsigned int cookie_len)
  4899. {
  4900. if (cookie_len == sizeof(cookie_magic_value) - 1
  4901. && memcmp(cookie, cookie_magic_value, cookie_len) == 0)
  4902. return 1;
  4903. return 0;
  4904. }
  4905. static int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie,
  4906. size_t *cookie_len)
  4907. {
  4908. unsigned int temp;
  4909. int res = generate_cookie_callback(ssl, cookie, &temp);
  4910. *cookie_len = temp;
  4911. return res;
  4912. }
  4913. static int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie,
  4914. size_t cookie_len)
  4915. {
  4916. return verify_cookie_callback(ssl, cookie, cookie_len);
  4917. }
  4918. static int test_stateless(void)
  4919. {
  4920. SSL_CTX *sctx = NULL, *cctx = NULL;
  4921. SSL *serverssl = NULL, *clientssl = NULL;
  4922. int testresult = 0;
  4923. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  4924. TLS_client_method(), TLS1_VERSION, 0,
  4925. &sctx, &cctx, cert, privkey)))
  4926. goto end;
  4927. /* The arrival of CCS messages can confuse the test */
  4928. SSL_CTX_clear_options(cctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
  4929. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4930. NULL, NULL))
  4931. /* Send the first ClientHello */
  4932. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  4933. SSL_ERROR_WANT_READ))
  4934. /*
  4935. * This should fail with a -1 return because we have no callbacks
  4936. * set up
  4937. */
  4938. || !TEST_int_eq(SSL_stateless(serverssl), -1))
  4939. goto end;
  4940. /* Fatal error so abandon the connection from this client */
  4941. SSL_free(clientssl);
  4942. clientssl = NULL;
  4943. /* Set up the cookie generation and verification callbacks */
  4944. SSL_CTX_set_stateless_cookie_generate_cb(sctx, generate_stateless_cookie_callback);
  4945. SSL_CTX_set_stateless_cookie_verify_cb(sctx, verify_stateless_cookie_callback);
  4946. /*
  4947. * Create a new connection from the client (we can reuse the server SSL
  4948. * object).
  4949. */
  4950. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4951. NULL, NULL))
  4952. /* Send the first ClientHello */
  4953. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  4954. SSL_ERROR_WANT_READ))
  4955. /* This should fail because there is no cookie */
  4956. || !TEST_int_eq(SSL_stateless(serverssl), 0))
  4957. goto end;
  4958. /* Abandon the connection from this client */
  4959. SSL_free(clientssl);
  4960. clientssl = NULL;
  4961. /*
  4962. * Now create a connection from a new client but with the same server SSL
  4963. * object
  4964. */
  4965. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4966. NULL, NULL))
  4967. /* Send the first ClientHello */
  4968. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  4969. SSL_ERROR_WANT_READ))
  4970. /* This should fail because there is no cookie */
  4971. || !TEST_int_eq(SSL_stateless(serverssl), 0)
  4972. /* Send the second ClientHello */
  4973. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  4974. SSL_ERROR_WANT_READ))
  4975. /* This should succeed because a cookie is now present */
  4976. || !TEST_int_eq(SSL_stateless(serverssl), 1)
  4977. /* Complete the connection */
  4978. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  4979. SSL_ERROR_NONE)))
  4980. goto end;
  4981. shutdown_ssl_connection(serverssl, clientssl);
  4982. serverssl = clientssl = NULL;
  4983. testresult = 1;
  4984. end:
  4985. SSL_free(serverssl);
  4986. SSL_free(clientssl);
  4987. SSL_CTX_free(sctx);
  4988. SSL_CTX_free(cctx);
  4989. return testresult;
  4990. }
  4991. #endif /* OSSL_NO_USABLE_TLS1_3 */
  4992. static int clntaddoldcb = 0;
  4993. static int clntparseoldcb = 0;
  4994. static int srvaddoldcb = 0;
  4995. static int srvparseoldcb = 0;
  4996. static int clntaddnewcb = 0;
  4997. static int clntparsenewcb = 0;
  4998. static int srvaddnewcb = 0;
  4999. static int srvparsenewcb = 0;
  5000. static int snicb = 0;
  5001. #define TEST_EXT_TYPE1 0xff00
  5002. static int old_add_cb(SSL *s, unsigned int ext_type, const unsigned char **out,
  5003. size_t *outlen, int *al, void *add_arg)
  5004. {
  5005. int *server = (int *)add_arg;
  5006. unsigned char *data;
  5007. if (SSL_is_server(s))
  5008. srvaddoldcb++;
  5009. else
  5010. clntaddoldcb++;
  5011. if (*server != SSL_is_server(s)
  5012. || (data = OPENSSL_malloc(sizeof(*data))) == NULL)
  5013. return -1;
  5014. *data = 1;
  5015. *out = data;
  5016. *outlen = sizeof(char);
  5017. return 1;
  5018. }
  5019. static void old_free_cb(SSL *s, unsigned int ext_type, const unsigned char *out,
  5020. void *add_arg)
  5021. {
  5022. OPENSSL_free((unsigned char *)out);
  5023. }
  5024. static int old_parse_cb(SSL *s, unsigned int ext_type, const unsigned char *in,
  5025. size_t inlen, int *al, void *parse_arg)
  5026. {
  5027. int *server = (int *)parse_arg;
  5028. if (SSL_is_server(s))
  5029. srvparseoldcb++;
  5030. else
  5031. clntparseoldcb++;
  5032. if (*server != SSL_is_server(s)
  5033. || inlen != sizeof(char)
  5034. || *in != 1)
  5035. return -1;
  5036. return 1;
  5037. }
  5038. static int new_add_cb(SSL *s, unsigned int ext_type, unsigned int context,
  5039. const unsigned char **out, size_t *outlen, X509 *x,
  5040. size_t chainidx, int *al, void *add_arg)
  5041. {
  5042. int *server = (int *)add_arg;
  5043. unsigned char *data;
  5044. if (SSL_is_server(s))
  5045. srvaddnewcb++;
  5046. else
  5047. clntaddnewcb++;
  5048. if (*server != SSL_is_server(s)
  5049. || (data = OPENSSL_malloc(sizeof(*data))) == NULL)
  5050. return -1;
  5051. *data = 1;
  5052. *out = data;
  5053. *outlen = sizeof(*data);
  5054. return 1;
  5055. }
  5056. static void new_free_cb(SSL *s, unsigned int ext_type, unsigned int context,
  5057. const unsigned char *out, void *add_arg)
  5058. {
  5059. OPENSSL_free((unsigned char *)out);
  5060. }
  5061. static int new_parse_cb(SSL *s, unsigned int ext_type, unsigned int context,
  5062. const unsigned char *in, size_t inlen, X509 *x,
  5063. size_t chainidx, int *al, void *parse_arg)
  5064. {
  5065. int *server = (int *)parse_arg;
  5066. if (SSL_is_server(s))
  5067. srvparsenewcb++;
  5068. else
  5069. clntparsenewcb++;
  5070. if (*server != SSL_is_server(s)
  5071. || inlen != sizeof(char) || *in != 1)
  5072. return -1;
  5073. return 1;
  5074. }
  5075. static int sni_cb(SSL *s, int *al, void *arg)
  5076. {
  5077. SSL_CTX *ctx = (SSL_CTX *)arg;
  5078. if (SSL_set_SSL_CTX(s, ctx) == NULL) {
  5079. *al = SSL_AD_INTERNAL_ERROR;
  5080. return SSL_TLSEXT_ERR_ALERT_FATAL;
  5081. }
  5082. snicb++;
  5083. return SSL_TLSEXT_ERR_OK;
  5084. }
  5085. static int verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
  5086. {
  5087. return 1;
  5088. }
  5089. /*
  5090. * Custom call back tests.
  5091. * Test 0: Old style callbacks in TLSv1.2
  5092. * Test 1: New style callbacks in TLSv1.2
  5093. * Test 2: New style callbacks in TLSv1.2 with SNI
  5094. * Test 3: New style callbacks in TLSv1.3. Extensions in CH and EE
  5095. * Test 4: New style callbacks in TLSv1.3. Extensions in CH, SH, EE, Cert + NST
  5096. * Test 5: New style callbacks in TLSv1.3. Extensions in CR + Client Cert
  5097. */
  5098. static int test_custom_exts(int tst)
  5099. {
  5100. SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
  5101. SSL *clientssl = NULL, *serverssl = NULL;
  5102. int testresult = 0;
  5103. static int server = 1;
  5104. static int client = 0;
  5105. SSL_SESSION *sess = NULL;
  5106. unsigned int context;
  5107. #if defined(OPENSSL_NO_TLS1_2) && !defined(OSSL_NO_USABLE_TLS1_3)
  5108. /* Skip tests for TLSv1.2 and below in this case */
  5109. if (tst < 3)
  5110. return 1;
  5111. #endif
  5112. /* Reset callback counters */
  5113. clntaddoldcb = clntparseoldcb = srvaddoldcb = srvparseoldcb = 0;
  5114. clntaddnewcb = clntparsenewcb = srvaddnewcb = srvparsenewcb = 0;
  5115. snicb = 0;
  5116. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5117. TLS_client_method(), TLS1_VERSION, 0,
  5118. &sctx, &cctx, cert, privkey)))
  5119. goto end;
  5120. if (tst == 2
  5121. && !TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(), NULL,
  5122. TLS1_VERSION, 0,
  5123. &sctx2, NULL, cert, privkey)))
  5124. goto end;
  5125. if (tst < 3) {
  5126. SSL_CTX_set_options(cctx, SSL_OP_NO_TLSv1_3);
  5127. SSL_CTX_set_options(sctx, SSL_OP_NO_TLSv1_3);
  5128. if (sctx2 != NULL)
  5129. SSL_CTX_set_options(sctx2, SSL_OP_NO_TLSv1_3);
  5130. }
  5131. if (tst == 5) {
  5132. context = SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
  5133. | SSL_EXT_TLS1_3_CERTIFICATE;
  5134. SSL_CTX_set_verify(sctx,
  5135. SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
  5136. verify_cb);
  5137. if (!TEST_int_eq(SSL_CTX_use_certificate_file(cctx, cert,
  5138. SSL_FILETYPE_PEM), 1)
  5139. || !TEST_int_eq(SSL_CTX_use_PrivateKey_file(cctx, privkey,
  5140. SSL_FILETYPE_PEM), 1)
  5141. || !TEST_int_eq(SSL_CTX_check_private_key(cctx), 1))
  5142. goto end;
  5143. } else if (tst == 4) {
  5144. context = SSL_EXT_CLIENT_HELLO
  5145. | SSL_EXT_TLS1_2_SERVER_HELLO
  5146. | SSL_EXT_TLS1_3_SERVER_HELLO
  5147. | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
  5148. | SSL_EXT_TLS1_3_CERTIFICATE
  5149. | SSL_EXT_TLS1_3_NEW_SESSION_TICKET;
  5150. } else {
  5151. context = SSL_EXT_CLIENT_HELLO
  5152. | SSL_EXT_TLS1_2_SERVER_HELLO
  5153. | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS;
  5154. }
  5155. /* Create a client side custom extension */
  5156. if (tst == 0) {
  5157. if (!TEST_true(SSL_CTX_add_client_custom_ext(cctx, TEST_EXT_TYPE1,
  5158. old_add_cb, old_free_cb,
  5159. &client, old_parse_cb,
  5160. &client)))
  5161. goto end;
  5162. } else {
  5163. if (!TEST_true(SSL_CTX_add_custom_ext(cctx, TEST_EXT_TYPE1, context,
  5164. new_add_cb, new_free_cb,
  5165. &client, new_parse_cb, &client)))
  5166. goto end;
  5167. }
  5168. /* Should not be able to add duplicates */
  5169. if (!TEST_false(SSL_CTX_add_client_custom_ext(cctx, TEST_EXT_TYPE1,
  5170. old_add_cb, old_free_cb,
  5171. &client, old_parse_cb,
  5172. &client))
  5173. || !TEST_false(SSL_CTX_add_custom_ext(cctx, TEST_EXT_TYPE1,
  5174. context, new_add_cb,
  5175. new_free_cb, &client,
  5176. new_parse_cb, &client)))
  5177. goto end;
  5178. /* Create a server side custom extension */
  5179. if (tst == 0) {
  5180. if (!TEST_true(SSL_CTX_add_server_custom_ext(sctx, TEST_EXT_TYPE1,
  5181. old_add_cb, old_free_cb,
  5182. &server, old_parse_cb,
  5183. &server)))
  5184. goto end;
  5185. } else {
  5186. if (!TEST_true(SSL_CTX_add_custom_ext(sctx, TEST_EXT_TYPE1, context,
  5187. new_add_cb, new_free_cb,
  5188. &server, new_parse_cb, &server)))
  5189. goto end;
  5190. if (sctx2 != NULL
  5191. && !TEST_true(SSL_CTX_add_custom_ext(sctx2, TEST_EXT_TYPE1,
  5192. context, new_add_cb,
  5193. new_free_cb, &server,
  5194. new_parse_cb, &server)))
  5195. goto end;
  5196. }
  5197. /* Should not be able to add duplicates */
  5198. if (!TEST_false(SSL_CTX_add_server_custom_ext(sctx, TEST_EXT_TYPE1,
  5199. old_add_cb, old_free_cb,
  5200. &server, old_parse_cb,
  5201. &server))
  5202. || !TEST_false(SSL_CTX_add_custom_ext(sctx, TEST_EXT_TYPE1,
  5203. context, new_add_cb,
  5204. new_free_cb, &server,
  5205. new_parse_cb, &server)))
  5206. goto end;
  5207. if (tst == 2) {
  5208. /* Set up SNI */
  5209. if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx, sni_cb))
  5210. || !TEST_true(SSL_CTX_set_tlsext_servername_arg(sctx, sctx2)))
  5211. goto end;
  5212. }
  5213. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  5214. &clientssl, NULL, NULL))
  5215. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5216. SSL_ERROR_NONE)))
  5217. goto end;
  5218. if (tst == 0) {
  5219. if (clntaddoldcb != 1
  5220. || clntparseoldcb != 1
  5221. || srvaddoldcb != 1
  5222. || srvparseoldcb != 1)
  5223. goto end;
  5224. } else if (tst == 1 || tst == 2 || tst == 3) {
  5225. if (clntaddnewcb != 1
  5226. || clntparsenewcb != 1
  5227. || srvaddnewcb != 1
  5228. || srvparsenewcb != 1
  5229. || (tst != 2 && snicb != 0)
  5230. || (tst == 2 && snicb != 1))
  5231. goto end;
  5232. } else if (tst == 5) {
  5233. if (clntaddnewcb != 1
  5234. || clntparsenewcb != 1
  5235. || srvaddnewcb != 1
  5236. || srvparsenewcb != 1)
  5237. goto end;
  5238. } else {
  5239. /* In this case there 2 NewSessionTicket messages created */
  5240. if (clntaddnewcb != 1
  5241. || clntparsenewcb != 5
  5242. || srvaddnewcb != 5
  5243. || srvparsenewcb != 1)
  5244. goto end;
  5245. }
  5246. sess = SSL_get1_session(clientssl);
  5247. SSL_shutdown(clientssl);
  5248. SSL_shutdown(serverssl);
  5249. SSL_free(serverssl);
  5250. SSL_free(clientssl);
  5251. serverssl = clientssl = NULL;
  5252. if (tst == 3 || tst == 5) {
  5253. /* We don't bother with the resumption aspects for these tests */
  5254. testresult = 1;
  5255. goto end;
  5256. }
  5257. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  5258. NULL, NULL))
  5259. || !TEST_true(SSL_set_session(clientssl, sess))
  5260. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5261. SSL_ERROR_NONE)))
  5262. goto end;
  5263. /*
  5264. * For a resumed session we expect to add the ClientHello extension. For the
  5265. * old style callbacks we ignore it on the server side because they set
  5266. * SSL_EXT_IGNORE_ON_RESUMPTION. The new style callbacks do not ignore
  5267. * them.
  5268. */
  5269. if (tst == 0) {
  5270. if (clntaddoldcb != 2
  5271. || clntparseoldcb != 1
  5272. || srvaddoldcb != 1
  5273. || srvparseoldcb != 1)
  5274. goto end;
  5275. } else if (tst == 1 || tst == 2 || tst == 3) {
  5276. if (clntaddnewcb != 2
  5277. || clntparsenewcb != 2
  5278. || srvaddnewcb != 2
  5279. || srvparsenewcb != 2)
  5280. goto end;
  5281. } else {
  5282. /*
  5283. * No Certificate message extensions in the resumption handshake,
  5284. * 2 NewSessionTickets in the initial handshake, 1 in the resumption
  5285. */
  5286. if (clntaddnewcb != 2
  5287. || clntparsenewcb != 8
  5288. || srvaddnewcb != 8
  5289. || srvparsenewcb != 2)
  5290. goto end;
  5291. }
  5292. testresult = 1;
  5293. end:
  5294. SSL_SESSION_free(sess);
  5295. SSL_free(serverssl);
  5296. SSL_free(clientssl);
  5297. SSL_CTX_free(sctx2);
  5298. SSL_CTX_free(sctx);
  5299. SSL_CTX_free(cctx);
  5300. return testresult;
  5301. }
  5302. #if !defined(OPENSSL_NO_TLS1_2) && !defined(OSSL_NO_USABLE_TLS1_3)
  5303. #define SYNTHV1CONTEXT (SSL_EXT_TLS1_2_AND_BELOW_ONLY \
  5304. | SSL_EXT_CLIENT_HELLO \
  5305. | SSL_EXT_TLS1_2_SERVER_HELLO \
  5306. | SSL_EXT_IGNORE_ON_RESUMPTION)
  5307. #define TLS13CONTEXT (SSL_EXT_TLS1_3_CERTIFICATE \
  5308. | SSL_EXT_TLS1_2_SERVER_HELLO \
  5309. | SSL_EXT_CLIENT_HELLO)
  5310. #define SERVERINFO_CUSTOM \
  5311. 0x00, (char)TLSEXT_TYPE_signed_certificate_timestamp, \
  5312. 0x00, 0x03, \
  5313. 0x04, 0x05, 0x06 \
  5314. static const unsigned char serverinfo_custom_tls13[] = {
  5315. 0x00, 0x00, (TLS13CONTEXT >> 8) & 0xff, TLS13CONTEXT & 0xff,
  5316. SERVERINFO_CUSTOM
  5317. };
  5318. static const unsigned char serverinfo_custom_v2[] = {
  5319. 0x00, 0x00, (SYNTHV1CONTEXT >> 8) & 0xff, SYNTHV1CONTEXT & 0xff,
  5320. SERVERINFO_CUSTOM
  5321. };
  5322. static const unsigned char serverinfo_custom_v1[] = {
  5323. SERVERINFO_CUSTOM
  5324. };
  5325. static const size_t serverinfo_custom_tls13_len = sizeof(serverinfo_custom_tls13);
  5326. static const size_t serverinfo_custom_v2_len = sizeof(serverinfo_custom_v2);
  5327. static const size_t serverinfo_custom_v1_len = sizeof(serverinfo_custom_v1);
  5328. static int serverinfo_custom_parse_cb(SSL *s, unsigned int ext_type,
  5329. unsigned int context,
  5330. const unsigned char *in,
  5331. size_t inlen, X509 *x,
  5332. size_t chainidx, int *al,
  5333. void *parse_arg)
  5334. {
  5335. const size_t len = serverinfo_custom_v1_len;
  5336. const unsigned char *si = &serverinfo_custom_v1[len - 3];
  5337. int *p_cb_result = (int*)parse_arg;
  5338. *p_cb_result = TEST_mem_eq(in, inlen, si, 3);
  5339. return 1;
  5340. }
  5341. static int test_serverinfo_custom(const int idx)
  5342. {
  5343. SSL_CTX *sctx = NULL, *cctx = NULL;
  5344. SSL *clientssl = NULL, *serverssl = NULL;
  5345. int testresult = 0;
  5346. int cb_result = 0;
  5347. /*
  5348. * Following variables are set in the switch statement
  5349. * according to the test iteration.
  5350. * Default values do not make much sense: test would fail with them.
  5351. */
  5352. int serverinfo_version = 0;
  5353. int protocol_version = 0;
  5354. unsigned int extension_context = 0;
  5355. const unsigned char *si = NULL;
  5356. size_t si_len = 0;
  5357. const int call_use_serverinfo_ex = idx > 0;
  5358. switch (idx) {
  5359. case 0: /* FALLTHROUGH */
  5360. case 1:
  5361. serverinfo_version = SSL_SERVERINFOV1;
  5362. protocol_version = TLS1_2_VERSION;
  5363. extension_context = SYNTHV1CONTEXT;
  5364. si = serverinfo_custom_v1;
  5365. si_len = serverinfo_custom_v1_len;
  5366. break;
  5367. case 2:
  5368. serverinfo_version = SSL_SERVERINFOV2;
  5369. protocol_version = TLS1_2_VERSION;
  5370. extension_context = SYNTHV1CONTEXT;
  5371. si = serverinfo_custom_v2;
  5372. si_len = serverinfo_custom_v2_len;
  5373. break;
  5374. case 3:
  5375. serverinfo_version = SSL_SERVERINFOV2;
  5376. protocol_version = TLS1_3_VERSION;
  5377. extension_context = TLS13CONTEXT;
  5378. si = serverinfo_custom_tls13;
  5379. si_len = serverinfo_custom_tls13_len;
  5380. break;
  5381. }
  5382. if (!TEST_true(create_ssl_ctx_pair(libctx,
  5383. TLS_method(),
  5384. TLS_method(),
  5385. protocol_version,
  5386. protocol_version,
  5387. &sctx, &cctx, cert, privkey)))
  5388. goto end;
  5389. if (call_use_serverinfo_ex) {
  5390. if (!TEST_true(SSL_CTX_use_serverinfo_ex(sctx, serverinfo_version,
  5391. si, si_len)))
  5392. goto end;
  5393. } else {
  5394. if (!TEST_true(SSL_CTX_use_serverinfo(sctx, si, si_len)))
  5395. goto end;
  5396. }
  5397. if (!TEST_true(SSL_CTX_add_custom_ext(cctx, TLSEXT_TYPE_signed_certificate_timestamp,
  5398. extension_context,
  5399. NULL, NULL, NULL,
  5400. serverinfo_custom_parse_cb,
  5401. &cb_result))
  5402. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  5403. NULL, NULL))
  5404. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5405. SSL_ERROR_NONE))
  5406. || !TEST_int_eq(SSL_do_handshake(clientssl), 1))
  5407. goto end;
  5408. if (!TEST_true(cb_result))
  5409. goto end;
  5410. testresult = 1;
  5411. end:
  5412. SSL_free(serverssl);
  5413. SSL_free(clientssl);
  5414. SSL_CTX_free(sctx);
  5415. SSL_CTX_free(cctx);
  5416. return testresult;
  5417. }
  5418. #endif
  5419. /*
  5420. * Test that SSL_export_keying_material() produces expected results. There are
  5421. * no test vectors so all we do is test that both sides of the communication
  5422. * produce the same results for different protocol versions.
  5423. */
  5424. #define SMALL_LABEL_LEN 10
  5425. #define LONG_LABEL_LEN 249
  5426. static int test_export_key_mat(int tst)
  5427. {
  5428. int testresult = 0;
  5429. SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
  5430. SSL *clientssl = NULL, *serverssl = NULL;
  5431. const char label[LONG_LABEL_LEN + 1] = "test label";
  5432. const unsigned char context[] = "context";
  5433. const unsigned char *emptycontext = NULL;
  5434. unsigned char longcontext[1280];
  5435. unsigned char ckeymat1[80], ckeymat2[80], ckeymat3[80], ckeymat4[80];
  5436. unsigned char skeymat1[80], skeymat2[80], skeymat3[80], skeymat4[80];
  5437. size_t labellen;
  5438. const int protocols[] = {
  5439. TLS1_VERSION,
  5440. TLS1_1_VERSION,
  5441. TLS1_2_VERSION,
  5442. TLS1_3_VERSION,
  5443. TLS1_3_VERSION,
  5444. TLS1_3_VERSION
  5445. };
  5446. #ifdef OPENSSL_NO_TLS1
  5447. if (tst == 0)
  5448. return 1;
  5449. #endif
  5450. #ifdef OPENSSL_NO_TLS1_1
  5451. if (tst == 1)
  5452. return 1;
  5453. #endif
  5454. if (is_fips && (tst == 0 || tst == 1))
  5455. return 1;
  5456. #ifdef OPENSSL_NO_TLS1_2
  5457. if (tst == 2)
  5458. return 1;
  5459. #endif
  5460. #ifdef OSSL_NO_USABLE_TLS1_3
  5461. if (tst >= 3)
  5462. return 1;
  5463. #endif
  5464. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5465. TLS_client_method(), TLS1_VERSION, 0,
  5466. &sctx, &cctx, cert, privkey)))
  5467. goto end;
  5468. OPENSSL_assert(tst >= 0 && (size_t)tst < OSSL_NELEM(protocols));
  5469. SSL_CTX_set_max_proto_version(cctx, protocols[tst]);
  5470. SSL_CTX_set_min_proto_version(cctx, protocols[tst]);
  5471. if ((protocols[tst] < TLS1_2_VERSION) &&
  5472. (!SSL_CTX_set_cipher_list(cctx, "DEFAULT:@SECLEVEL=0")
  5473. || !SSL_CTX_set_cipher_list(sctx, "DEFAULT:@SECLEVEL=0")))
  5474. goto end;
  5475. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
  5476. NULL)))
  5477. goto end;
  5478. /*
  5479. * Premature call of SSL_export_keying_material should just fail.
  5480. */
  5481. if (!TEST_int_le(SSL_export_keying_material(clientssl, ckeymat1,
  5482. sizeof(ckeymat1), label,
  5483. SMALL_LABEL_LEN + 1, context,
  5484. sizeof(context) - 1, 1), 0))
  5485. goto end;
  5486. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  5487. SSL_ERROR_NONE)))
  5488. goto end;
  5489. if (tst == 5) {
  5490. /*
  5491. * TLSv1.3 imposes a maximum label len of 249 bytes. Check we fail if we
  5492. * go over that.
  5493. */
  5494. if (!TEST_int_le(SSL_export_keying_material(clientssl, ckeymat1,
  5495. sizeof(ckeymat1), label,
  5496. LONG_LABEL_LEN + 1, context,
  5497. sizeof(context) - 1, 1), 0))
  5498. goto end;
  5499. testresult = 1;
  5500. goto end;
  5501. } else if (tst == 4) {
  5502. labellen = LONG_LABEL_LEN;
  5503. } else {
  5504. labellen = SMALL_LABEL_LEN;
  5505. }
  5506. memset(longcontext, 1, sizeof(longcontext));
  5507. if (!TEST_int_eq(SSL_export_keying_material(clientssl, ckeymat1,
  5508. sizeof(ckeymat1), label,
  5509. labellen, context,
  5510. sizeof(context) - 1, 1), 1)
  5511. || !TEST_int_eq(SSL_export_keying_material(clientssl, ckeymat2,
  5512. sizeof(ckeymat2), label,
  5513. labellen,
  5514. emptycontext,
  5515. 0, 1), 1)
  5516. || !TEST_int_eq(SSL_export_keying_material(clientssl, ckeymat3,
  5517. sizeof(ckeymat3), label,
  5518. labellen,
  5519. NULL, 0, 0), 1)
  5520. || !TEST_int_eq(SSL_export_keying_material(clientssl, ckeymat4,
  5521. sizeof(ckeymat4), label,
  5522. labellen,
  5523. longcontext,
  5524. sizeof(longcontext), 1),
  5525. 1)
  5526. || !TEST_int_eq(SSL_export_keying_material(serverssl, skeymat1,
  5527. sizeof(skeymat1), label,
  5528. labellen,
  5529. context,
  5530. sizeof(context) -1, 1),
  5531. 1)
  5532. || !TEST_int_eq(SSL_export_keying_material(serverssl, skeymat2,
  5533. sizeof(skeymat2), label,
  5534. labellen,
  5535. emptycontext,
  5536. 0, 1), 1)
  5537. || !TEST_int_eq(SSL_export_keying_material(serverssl, skeymat3,
  5538. sizeof(skeymat3), label,
  5539. labellen,
  5540. NULL, 0, 0), 1)
  5541. || !TEST_int_eq(SSL_export_keying_material(serverssl, skeymat4,
  5542. sizeof(skeymat4), label,
  5543. labellen,
  5544. longcontext,
  5545. sizeof(longcontext), 1),
  5546. 1)
  5547. /*
  5548. * Check that both sides created the same key material with the
  5549. * same context.
  5550. */
  5551. || !TEST_mem_eq(ckeymat1, sizeof(ckeymat1), skeymat1,
  5552. sizeof(skeymat1))
  5553. /*
  5554. * Check that both sides created the same key material with an
  5555. * empty context.
  5556. */
  5557. || !TEST_mem_eq(ckeymat2, sizeof(ckeymat2), skeymat2,
  5558. sizeof(skeymat2))
  5559. /*
  5560. * Check that both sides created the same key material without a
  5561. * context.
  5562. */
  5563. || !TEST_mem_eq(ckeymat3, sizeof(ckeymat3), skeymat3,
  5564. sizeof(skeymat3))
  5565. /*
  5566. * Check that both sides created the same key material with a
  5567. * long context.
  5568. */
  5569. || !TEST_mem_eq(ckeymat4, sizeof(ckeymat4), skeymat4,
  5570. sizeof(skeymat4))
  5571. /* Different contexts should produce different results */
  5572. || !TEST_mem_ne(ckeymat1, sizeof(ckeymat1), ckeymat2,
  5573. sizeof(ckeymat2)))
  5574. goto end;
  5575. /*
  5576. * Check that an empty context and no context produce different results in
  5577. * protocols less than TLSv1.3. In TLSv1.3 they should be the same.
  5578. */
  5579. if ((tst < 3 && !TEST_mem_ne(ckeymat2, sizeof(ckeymat2), ckeymat3,
  5580. sizeof(ckeymat3)))
  5581. || (tst >= 3 && !TEST_mem_eq(ckeymat2, sizeof(ckeymat2), ckeymat3,
  5582. sizeof(ckeymat3))))
  5583. goto end;
  5584. testresult = 1;
  5585. end:
  5586. SSL_free(serverssl);
  5587. SSL_free(clientssl);
  5588. SSL_CTX_free(sctx2);
  5589. SSL_CTX_free(sctx);
  5590. SSL_CTX_free(cctx);
  5591. return testresult;
  5592. }
  5593. #ifndef OSSL_NO_USABLE_TLS1_3
  5594. /*
  5595. * Test that SSL_export_keying_material_early() produces expected
  5596. * results. There are no test vectors so all we do is test that both
  5597. * sides of the communication produce the same results for different
  5598. * protocol versions.
  5599. */
  5600. static int test_export_key_mat_early(int idx)
  5601. {
  5602. static const char label[] = "test label";
  5603. static const unsigned char context[] = "context";
  5604. int testresult = 0;
  5605. SSL_CTX *cctx = NULL, *sctx = NULL;
  5606. SSL *clientssl = NULL, *serverssl = NULL;
  5607. SSL_SESSION *sess = NULL;
  5608. const unsigned char *emptycontext = NULL;
  5609. unsigned char ckeymat1[80], ckeymat2[80];
  5610. unsigned char skeymat1[80], skeymat2[80];
  5611. unsigned char buf[1];
  5612. size_t readbytes, written;
  5613. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl, &serverssl,
  5614. &sess, idx, SHA384_DIGEST_LENGTH)))
  5615. goto end;
  5616. /* Here writing 0 length early data is enough. */
  5617. if (!TEST_true(SSL_write_early_data(clientssl, NULL, 0, &written))
  5618. || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  5619. &readbytes),
  5620. SSL_READ_EARLY_DATA_ERROR)
  5621. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  5622. SSL_EARLY_DATA_ACCEPTED))
  5623. goto end;
  5624. if (!TEST_int_eq(SSL_export_keying_material_early(
  5625. clientssl, ckeymat1, sizeof(ckeymat1), label,
  5626. sizeof(label) - 1, context, sizeof(context) - 1), 1)
  5627. || !TEST_int_eq(SSL_export_keying_material_early(
  5628. clientssl, ckeymat2, sizeof(ckeymat2), label,
  5629. sizeof(label) - 1, emptycontext, 0), 1)
  5630. || !TEST_int_eq(SSL_export_keying_material_early(
  5631. serverssl, skeymat1, sizeof(skeymat1), label,
  5632. sizeof(label) - 1, context, sizeof(context) - 1), 1)
  5633. || !TEST_int_eq(SSL_export_keying_material_early(
  5634. serverssl, skeymat2, sizeof(skeymat2), label,
  5635. sizeof(label) - 1, emptycontext, 0), 1)
  5636. /*
  5637. * Check that both sides created the same key material with the
  5638. * same context.
  5639. */
  5640. || !TEST_mem_eq(ckeymat1, sizeof(ckeymat1), skeymat1,
  5641. sizeof(skeymat1))
  5642. /*
  5643. * Check that both sides created the same key material with an
  5644. * empty context.
  5645. */
  5646. || !TEST_mem_eq(ckeymat2, sizeof(ckeymat2), skeymat2,
  5647. sizeof(skeymat2))
  5648. /* Different contexts should produce different results */
  5649. || !TEST_mem_ne(ckeymat1, sizeof(ckeymat1), ckeymat2,
  5650. sizeof(ckeymat2)))
  5651. goto end;
  5652. testresult = 1;
  5653. end:
  5654. SSL_SESSION_free(sess);
  5655. SSL_SESSION_free(clientpsk);
  5656. SSL_SESSION_free(serverpsk);
  5657. clientpsk = serverpsk = NULL;
  5658. SSL_free(serverssl);
  5659. SSL_free(clientssl);
  5660. SSL_CTX_free(sctx);
  5661. SSL_CTX_free(cctx);
  5662. return testresult;
  5663. }
  5664. #define NUM_KEY_UPDATE_MESSAGES 40
  5665. /*
  5666. * Test KeyUpdate.
  5667. */
  5668. static int test_key_update(void)
  5669. {
  5670. SSL_CTX *cctx = NULL, *sctx = NULL;
  5671. SSL *clientssl = NULL, *serverssl = NULL;
  5672. int testresult = 0, i, j;
  5673. char buf[20];
  5674. static char *mess = "A test message";
  5675. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5676. TLS_client_method(),
  5677. TLS1_3_VERSION,
  5678. 0,
  5679. &sctx, &cctx, cert, privkey))
  5680. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  5681. NULL, NULL))
  5682. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5683. SSL_ERROR_NONE)))
  5684. goto end;
  5685. for (j = 0; j < 2; j++) {
  5686. /* Send lots of KeyUpdate messages */
  5687. for (i = 0; i < NUM_KEY_UPDATE_MESSAGES; i++) {
  5688. if (!TEST_true(SSL_key_update(clientssl,
  5689. (j == 0)
  5690. ? SSL_KEY_UPDATE_NOT_REQUESTED
  5691. : SSL_KEY_UPDATE_REQUESTED))
  5692. || !TEST_true(SSL_do_handshake(clientssl)))
  5693. goto end;
  5694. }
  5695. /* Check that sending and receiving app data is ok */
  5696. if (!TEST_int_eq(SSL_write(clientssl, mess, strlen(mess)), strlen(mess))
  5697. || !TEST_int_eq(SSL_read(serverssl, buf, sizeof(buf)),
  5698. strlen(mess)))
  5699. goto end;
  5700. if (!TEST_int_eq(SSL_write(serverssl, mess, strlen(mess)), strlen(mess))
  5701. || !TEST_int_eq(SSL_read(clientssl, buf, sizeof(buf)),
  5702. strlen(mess)))
  5703. goto end;
  5704. }
  5705. testresult = 1;
  5706. end:
  5707. SSL_free(serverssl);
  5708. SSL_free(clientssl);
  5709. SSL_CTX_free(sctx);
  5710. SSL_CTX_free(cctx);
  5711. return testresult;
  5712. }
  5713. /*
  5714. * Test we can handle a KeyUpdate (update requested) message while
  5715. * write data is pending in peer.
  5716. * Test 0: Client sends KeyUpdate while Server is writing
  5717. * Test 1: Server sends KeyUpdate while Client is writing
  5718. */
  5719. static int test_key_update_peer_in_write(int tst)
  5720. {
  5721. SSL_CTX *cctx = NULL, *sctx = NULL;
  5722. SSL *clientssl = NULL, *serverssl = NULL;
  5723. int testresult = 0;
  5724. char buf[20];
  5725. static char *mess = "A test message";
  5726. BIO *bretry = BIO_new(bio_s_always_retry());
  5727. BIO *tmp = NULL;
  5728. SSL *peerupdate = NULL, *peerwrite = NULL;
  5729. if (!TEST_ptr(bretry)
  5730. || !TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5731. TLS_client_method(),
  5732. TLS1_3_VERSION,
  5733. 0,
  5734. &sctx, &cctx, cert, privkey))
  5735. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  5736. NULL, NULL))
  5737. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5738. SSL_ERROR_NONE)))
  5739. goto end;
  5740. peerupdate = tst == 0 ? clientssl : serverssl;
  5741. peerwrite = tst == 0 ? serverssl : clientssl;
  5742. if (!TEST_true(SSL_key_update(peerupdate, SSL_KEY_UPDATE_REQUESTED))
  5743. || !TEST_int_eq(SSL_do_handshake(peerupdate), 1))
  5744. goto end;
  5745. /* Swap the writing endpoint's write BIO to force a retry */
  5746. tmp = SSL_get_wbio(peerwrite);
  5747. if (!TEST_ptr(tmp) || !TEST_true(BIO_up_ref(tmp))) {
  5748. tmp = NULL;
  5749. goto end;
  5750. }
  5751. SSL_set0_wbio(peerwrite, bretry);
  5752. bretry = NULL;
  5753. /* Write data that we know will fail with SSL_ERROR_WANT_WRITE */
  5754. if (!TEST_int_eq(SSL_write(peerwrite, mess, strlen(mess)), -1)
  5755. || !TEST_int_eq(SSL_get_error(peerwrite, 0), SSL_ERROR_WANT_WRITE)
  5756. || !TEST_true(SSL_want_write(peerwrite))
  5757. || !TEST_true(SSL_net_write_desired(peerwrite)))
  5758. goto end;
  5759. /* Reinstate the original writing endpoint's write BIO */
  5760. SSL_set0_wbio(peerwrite, tmp);
  5761. tmp = NULL;
  5762. /* Now read some data - we will read the key update */
  5763. if (!TEST_int_eq(SSL_read(peerwrite, buf, sizeof(buf)), -1)
  5764. || !TEST_int_eq(SSL_get_error(peerwrite, 0), SSL_ERROR_WANT_READ)
  5765. || !TEST_true(SSL_want_read(peerwrite))
  5766. || !TEST_true(SSL_net_read_desired(peerwrite)))
  5767. goto end;
  5768. /*
  5769. * Complete the write we started previously and read it from the other
  5770. * endpoint
  5771. */
  5772. if (!TEST_int_eq(SSL_write(peerwrite, mess, strlen(mess)), strlen(mess))
  5773. || !TEST_int_eq(SSL_read(peerupdate, buf, sizeof(buf)), strlen(mess)))
  5774. goto end;
  5775. /* Write more data to ensure we send the KeyUpdate message back */
  5776. if (!TEST_int_eq(SSL_write(peerwrite, mess, strlen(mess)), strlen(mess))
  5777. || !TEST_int_eq(SSL_read(peerupdate, buf, sizeof(buf)), strlen(mess)))
  5778. goto end;
  5779. if (!TEST_false(SSL_net_read_desired(peerwrite))
  5780. || !TEST_false(SSL_net_write_desired(peerwrite))
  5781. || !TEST_int_eq(SSL_want(peerwrite), SSL_NOTHING))
  5782. goto end;
  5783. testresult = 1;
  5784. end:
  5785. SSL_free(serverssl);
  5786. SSL_free(clientssl);
  5787. SSL_CTX_free(sctx);
  5788. SSL_CTX_free(cctx);
  5789. BIO_free(bretry);
  5790. BIO_free(tmp);
  5791. return testresult;
  5792. }
  5793. /*
  5794. * Test we can handle a KeyUpdate (update requested) message while
  5795. * peer read data is pending after peer accepted keyupdate(the msg header
  5796. * had been read 5 bytes).
  5797. * Test 0: Client sends KeyUpdate while Server is reading
  5798. * Test 1: Server sends KeyUpdate while Client is reading
  5799. */
  5800. static int test_key_update_peer_in_read(int tst)
  5801. {
  5802. SSL_CTX *cctx = NULL, *sctx = NULL;
  5803. SSL *clientssl = NULL, *serverssl = NULL;
  5804. int testresult = 0;
  5805. char prbuf[515], lwbuf[515] = {0};
  5806. static char *mess = "A test message";
  5807. BIO *lbio = NULL, *pbio = NULL;
  5808. SSL *local = NULL, *peer = NULL;
  5809. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5810. TLS_client_method(),
  5811. TLS1_3_VERSION,
  5812. 0,
  5813. &sctx, &cctx, cert, privkey))
  5814. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  5815. NULL, NULL))
  5816. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5817. SSL_ERROR_NONE)))
  5818. goto end;
  5819. local = tst == 0 ? clientssl : serverssl;
  5820. peer = tst == 0 ? serverssl : clientssl;
  5821. if (!TEST_int_eq(BIO_new_bio_pair(&lbio, 512, &pbio, 512), 1))
  5822. goto end;
  5823. SSL_set_bio(local, lbio, lbio);
  5824. SSL_set_bio(peer, pbio, pbio);
  5825. /*
  5826. * we first write keyupdate msg then appdata in local
  5827. * write data in local will fail with SSL_ERROR_WANT_WRITE,because
  5828. * lwbuf app data msg size + key updata msg size > 512(the size of
  5829. * the bio pair buffer)
  5830. */
  5831. if (!TEST_true(SSL_key_update(local, SSL_KEY_UPDATE_REQUESTED))
  5832. || !TEST_int_eq(SSL_write(local, lwbuf, sizeof(lwbuf)), -1)
  5833. || !TEST_int_eq(SSL_get_error(local, -1), SSL_ERROR_WANT_WRITE))
  5834. goto end;
  5835. /*
  5836. * first read keyupdate msg in peer in peer
  5837. * then read appdata that we know will fail with SSL_ERROR_WANT_READ
  5838. */
  5839. if (!TEST_int_eq(SSL_read(peer, prbuf, sizeof(prbuf)), -1)
  5840. || !TEST_int_eq(SSL_get_error(peer, -1), SSL_ERROR_WANT_READ))
  5841. goto end;
  5842. /* Now write some data in peer - we will write the key update */
  5843. if (!TEST_int_eq(SSL_write(peer, mess, strlen(mess)), strlen(mess)))
  5844. goto end;
  5845. /*
  5846. * write data in local previously that we will complete
  5847. * read data in peer previously that we will complete
  5848. */
  5849. if (!TEST_int_eq(SSL_write(local, lwbuf, sizeof(lwbuf)), sizeof(lwbuf))
  5850. || !TEST_int_eq(SSL_read(peer, prbuf, sizeof(prbuf)), sizeof(prbuf)))
  5851. goto end;
  5852. /* check that sending and receiving appdata ok */
  5853. if (!TEST_int_eq(SSL_write(local, mess, strlen(mess)), strlen(mess))
  5854. || !TEST_int_eq(SSL_read(peer, prbuf, sizeof(prbuf)), strlen(mess)))
  5855. goto end;
  5856. testresult = 1;
  5857. end:
  5858. SSL_free(serverssl);
  5859. SSL_free(clientssl);
  5860. SSL_CTX_free(sctx);
  5861. SSL_CTX_free(cctx);
  5862. return testresult;
  5863. }
  5864. /*
  5865. * Test we can't send a KeyUpdate (update requested) message while
  5866. * local write data is pending.
  5867. * Test 0: Client sends KeyUpdate while Client is writing
  5868. * Test 1: Server sends KeyUpdate while Server is writing
  5869. */
  5870. static int test_key_update_local_in_write(int tst)
  5871. {
  5872. SSL_CTX *cctx = NULL, *sctx = NULL;
  5873. SSL *clientssl = NULL, *serverssl = NULL;
  5874. int testresult = 0;
  5875. char buf[20];
  5876. static char *mess = "A test message";
  5877. BIO *bretry = BIO_new(bio_s_always_retry());
  5878. BIO *tmp = NULL;
  5879. SSL *local = NULL, *peer = NULL;
  5880. if (!TEST_ptr(bretry)
  5881. || !TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5882. TLS_client_method(),
  5883. TLS1_3_VERSION,
  5884. 0,
  5885. &sctx, &cctx, cert, privkey))
  5886. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  5887. NULL, NULL))
  5888. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5889. SSL_ERROR_NONE)))
  5890. goto end;
  5891. local = tst == 0 ? clientssl : serverssl;
  5892. peer = tst == 0 ? serverssl : clientssl;
  5893. /* Swap the writing endpoint's write BIO to force a retry */
  5894. tmp = SSL_get_wbio(local);
  5895. if (!TEST_ptr(tmp) || !TEST_true(BIO_up_ref(tmp))) {
  5896. tmp = NULL;
  5897. goto end;
  5898. }
  5899. SSL_set0_wbio(local, bretry);
  5900. bretry = NULL;
  5901. /* write data in local will fail with SSL_ERROR_WANT_WRITE */
  5902. if (!TEST_int_eq(SSL_write(local, mess, strlen(mess)), -1)
  5903. || !TEST_int_eq(SSL_get_error(local, -1), SSL_ERROR_WANT_WRITE))
  5904. goto end;
  5905. /* Reinstate the original writing endpoint's write BIO */
  5906. SSL_set0_wbio(local, tmp);
  5907. tmp = NULL;
  5908. /* SSL_key_update will fail, because writing in local*/
  5909. if (!TEST_false(SSL_key_update(local, SSL_KEY_UPDATE_REQUESTED))
  5910. || !TEST_int_eq(ERR_GET_REASON(ERR_peek_error()), SSL_R_BAD_WRITE_RETRY))
  5911. goto end;
  5912. ERR_clear_error();
  5913. /* write data in local previously that we will complete */
  5914. if (!TEST_int_eq(SSL_write(local, mess, strlen(mess)), strlen(mess)))
  5915. goto end;
  5916. /* SSL_key_update will succeed because there is no pending write data */
  5917. if (!TEST_true(SSL_key_update(local, SSL_KEY_UPDATE_REQUESTED))
  5918. || !TEST_int_eq(SSL_do_handshake(local), 1))
  5919. goto end;
  5920. /*
  5921. * we write some appdata in local
  5922. * read data in peer - we will read the keyupdate msg
  5923. */
  5924. if (!TEST_int_eq(SSL_write(local, mess, strlen(mess)), strlen(mess))
  5925. || !TEST_int_eq(SSL_read(peer, buf, sizeof(buf)), strlen(mess)))
  5926. goto end;
  5927. /* Write more peer more data to ensure we send the keyupdate message back */
  5928. if (!TEST_int_eq(SSL_write(peer, mess, strlen(mess)), strlen(mess))
  5929. || !TEST_int_eq(SSL_read(local, buf, sizeof(buf)), strlen(mess)))
  5930. goto end;
  5931. testresult = 1;
  5932. end:
  5933. SSL_free(serverssl);
  5934. SSL_free(clientssl);
  5935. SSL_CTX_free(sctx);
  5936. SSL_CTX_free(cctx);
  5937. BIO_free(bretry);
  5938. BIO_free(tmp);
  5939. return testresult;
  5940. }
  5941. /*
  5942. * Test we can handle a KeyUpdate (update requested) message while
  5943. * local read data is pending(the msg header had been read 5 bytes).
  5944. * Test 0: Client sends KeyUpdate while Client is reading
  5945. * Test 1: Server sends KeyUpdate while Server is reading
  5946. */
  5947. static int test_key_update_local_in_read(int tst)
  5948. {
  5949. SSL_CTX *cctx = NULL, *sctx = NULL;
  5950. SSL *clientssl = NULL, *serverssl = NULL;
  5951. int testresult = 0;
  5952. char lrbuf[515], pwbuf[515] = {0}, prbuf[20];
  5953. static char *mess = "A test message";
  5954. BIO *lbio = NULL, *pbio = NULL;
  5955. SSL *local = NULL, *peer = NULL;
  5956. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5957. TLS_client_method(),
  5958. TLS1_3_VERSION,
  5959. 0,
  5960. &sctx, &cctx, cert, privkey))
  5961. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  5962. NULL, NULL))
  5963. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5964. SSL_ERROR_NONE)))
  5965. goto end;
  5966. local = tst == 0 ? clientssl : serverssl;
  5967. peer = tst == 0 ? serverssl : clientssl;
  5968. if (!TEST_int_eq(BIO_new_bio_pair(&lbio, 512, &pbio, 512), 1))
  5969. goto end;
  5970. SSL_set_bio(local, lbio, lbio);
  5971. SSL_set_bio(peer, pbio, pbio);
  5972. /* write app data in peer will fail with SSL_ERROR_WANT_WRITE */
  5973. if (!TEST_int_eq(SSL_write(peer, pwbuf, sizeof(pwbuf)), -1)
  5974. || !TEST_int_eq(SSL_get_error(peer, -1), SSL_ERROR_WANT_WRITE))
  5975. goto end;
  5976. /* read appdata in local will fail with SSL_ERROR_WANT_READ */
  5977. if (!TEST_int_eq(SSL_read(local, lrbuf, sizeof(lrbuf)), -1)
  5978. || !TEST_int_eq(SSL_get_error(local, -1), SSL_ERROR_WANT_READ))
  5979. goto end;
  5980. /* SSL_do_handshake will send keyupdate msg */
  5981. if (!TEST_true(SSL_key_update(local, SSL_KEY_UPDATE_REQUESTED))
  5982. || !TEST_int_eq(SSL_do_handshake(local), 1))
  5983. goto end;
  5984. /*
  5985. * write data in peer previously that we will complete
  5986. * read data in local previously that we will complete
  5987. */
  5988. if (!TEST_int_eq(SSL_write(peer, pwbuf, sizeof(pwbuf)), sizeof(pwbuf))
  5989. || !TEST_int_eq(SSL_read(local, lrbuf, sizeof(lrbuf)), sizeof(lrbuf)))
  5990. goto end;
  5991. /*
  5992. * write data in local
  5993. * read data in peer - we will read the key update
  5994. */
  5995. if (!TEST_int_eq(SSL_write(local, mess, strlen(mess)), strlen(mess))
  5996. || !TEST_int_eq(SSL_read(peer, prbuf, sizeof(prbuf)), strlen(mess)))
  5997. goto end;
  5998. /* Write more peer data to ensure we send the keyupdate message back */
  5999. if (!TEST_int_eq(SSL_write(peer, mess, strlen(mess)), strlen(mess))
  6000. || !TEST_int_eq(SSL_read(local, lrbuf, sizeof(lrbuf)), strlen(mess)))
  6001. goto end;
  6002. testresult = 1;
  6003. end:
  6004. SSL_free(serverssl);
  6005. SSL_free(clientssl);
  6006. SSL_CTX_free(sctx);
  6007. SSL_CTX_free(cctx);
  6008. return testresult;
  6009. }
  6010. #endif /* OSSL_NO_USABLE_TLS1_3 */
  6011. static int test_ssl_clear(int idx)
  6012. {
  6013. SSL_CTX *cctx = NULL, *sctx = NULL;
  6014. SSL *clientssl = NULL, *serverssl = NULL;
  6015. int testresult = 0;
  6016. #ifdef OPENSSL_NO_TLS1_2
  6017. if (idx == 1)
  6018. return 1;
  6019. #endif
  6020. /* Create an initial connection */
  6021. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6022. TLS_client_method(), TLS1_VERSION, 0,
  6023. &sctx, &cctx, cert, privkey))
  6024. || (idx == 1
  6025. && !TEST_true(SSL_CTX_set_max_proto_version(cctx,
  6026. TLS1_2_VERSION)))
  6027. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  6028. &clientssl, NULL, NULL))
  6029. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  6030. SSL_ERROR_NONE)))
  6031. goto end;
  6032. SSL_shutdown(clientssl);
  6033. SSL_shutdown(serverssl);
  6034. SSL_free(serverssl);
  6035. serverssl = NULL;
  6036. /* Clear clientssl - we're going to reuse the object */
  6037. if (!TEST_true(SSL_clear(clientssl)))
  6038. goto end;
  6039. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  6040. NULL, NULL))
  6041. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  6042. SSL_ERROR_NONE))
  6043. || !TEST_true(SSL_session_reused(clientssl)))
  6044. goto end;
  6045. SSL_shutdown(clientssl);
  6046. SSL_shutdown(serverssl);
  6047. testresult = 1;
  6048. end:
  6049. SSL_free(serverssl);
  6050. SSL_free(clientssl);
  6051. SSL_CTX_free(sctx);
  6052. SSL_CTX_free(cctx);
  6053. return testresult;
  6054. }
  6055. /* Parse CH and retrieve any MFL extension value if present */
  6056. static int get_MFL_from_client_hello(BIO *bio, int *mfl_codemfl_code)
  6057. {
  6058. long len;
  6059. unsigned char *data;
  6060. PACKET pkt, pkt2, pkt3;
  6061. unsigned int MFL_code = 0, type = 0;
  6062. if (!TEST_uint_gt(len = BIO_get_mem_data(bio, (char **) &data), 0))
  6063. goto end;
  6064. memset(&pkt, 0, sizeof(pkt));
  6065. memset(&pkt2, 0, sizeof(pkt2));
  6066. memset(&pkt3, 0, sizeof(pkt3));
  6067. if (!TEST_long_gt(len, 0)
  6068. || !TEST_true(PACKET_buf_init(&pkt, data, len))
  6069. /* Skip the record header */
  6070. || !PACKET_forward(&pkt, SSL3_RT_HEADER_LENGTH)
  6071. /* Skip the handshake message header */
  6072. || !TEST_true(PACKET_forward(&pkt, SSL3_HM_HEADER_LENGTH))
  6073. /* Skip client version and random */
  6074. || !TEST_true(PACKET_forward(&pkt, CLIENT_VERSION_LEN
  6075. + SSL3_RANDOM_SIZE))
  6076. /* Skip session id */
  6077. || !TEST_true(PACKET_get_length_prefixed_1(&pkt, &pkt2))
  6078. /* Skip ciphers */
  6079. || !TEST_true(PACKET_get_length_prefixed_2(&pkt, &pkt2))
  6080. /* Skip compression */
  6081. || !TEST_true(PACKET_get_length_prefixed_1(&pkt, &pkt2))
  6082. /* Extensions len */
  6083. || !TEST_true(PACKET_as_length_prefixed_2(&pkt, &pkt2)))
  6084. goto end;
  6085. /* Loop through all extensions */
  6086. while (PACKET_remaining(&pkt2)) {
  6087. if (!TEST_true(PACKET_get_net_2(&pkt2, &type))
  6088. || !TEST_true(PACKET_get_length_prefixed_2(&pkt2, &pkt3)))
  6089. goto end;
  6090. if (type == TLSEXT_TYPE_max_fragment_length) {
  6091. if (!TEST_uint_ne(PACKET_remaining(&pkt3), 0)
  6092. || !TEST_true(PACKET_get_1(&pkt3, &MFL_code)))
  6093. goto end;
  6094. *mfl_codemfl_code = MFL_code;
  6095. return 1;
  6096. }
  6097. }
  6098. end:
  6099. return 0;
  6100. }
  6101. /* Maximum-Fragment-Length TLS extension mode to test */
  6102. static const unsigned char max_fragment_len_test[] = {
  6103. TLSEXT_max_fragment_length_512,
  6104. TLSEXT_max_fragment_length_1024,
  6105. TLSEXT_max_fragment_length_2048,
  6106. TLSEXT_max_fragment_length_4096
  6107. };
  6108. static int test_max_fragment_len_ext(int idx_tst)
  6109. {
  6110. SSL_CTX *ctx = NULL;
  6111. SSL *con = NULL;
  6112. int testresult = 0, MFL_mode = 0;
  6113. BIO *rbio, *wbio;
  6114. if (!TEST_true(create_ssl_ctx_pair(libctx, NULL, TLS_client_method(),
  6115. TLS1_VERSION, 0, NULL, &ctx, NULL,
  6116. NULL)))
  6117. return 0;
  6118. if (!TEST_true(SSL_CTX_set_tlsext_max_fragment_length(
  6119. ctx, max_fragment_len_test[idx_tst])))
  6120. goto end;
  6121. con = SSL_new(ctx);
  6122. if (!TEST_ptr(con))
  6123. goto end;
  6124. rbio = BIO_new(BIO_s_mem());
  6125. wbio = BIO_new(BIO_s_mem());
  6126. if (!TEST_ptr(rbio)|| !TEST_ptr(wbio)) {
  6127. BIO_free(rbio);
  6128. BIO_free(wbio);
  6129. goto end;
  6130. }
  6131. SSL_set_bio(con, rbio, wbio);
  6132. if (!TEST_int_le(SSL_connect(con), 0)) {
  6133. /* This shouldn't succeed because we don't have a server! */
  6134. goto end;
  6135. }
  6136. if (!TEST_true(get_MFL_from_client_hello(wbio, &MFL_mode)))
  6137. /* no MFL in client hello */
  6138. goto end;
  6139. if (!TEST_true(max_fragment_len_test[idx_tst] == MFL_mode))
  6140. goto end;
  6141. testresult = 1;
  6142. end:
  6143. SSL_free(con);
  6144. SSL_CTX_free(ctx);
  6145. return testresult;
  6146. }
  6147. #ifndef OSSL_NO_USABLE_TLS1_3
  6148. static int test_pha_key_update(void)
  6149. {
  6150. SSL_CTX *cctx = NULL, *sctx = NULL;
  6151. SSL *clientssl = NULL, *serverssl = NULL;
  6152. int testresult = 0;
  6153. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6154. TLS_client_method(), TLS1_VERSION, 0,
  6155. &sctx, &cctx, cert, privkey)))
  6156. return 0;
  6157. if (!TEST_true(SSL_CTX_set_min_proto_version(sctx, TLS1_3_VERSION))
  6158. || !TEST_true(SSL_CTX_set_max_proto_version(sctx, TLS1_3_VERSION))
  6159. || !TEST_true(SSL_CTX_set_min_proto_version(cctx, TLS1_3_VERSION))
  6160. || !TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_3_VERSION)))
  6161. goto end;
  6162. SSL_CTX_set_post_handshake_auth(cctx, 1);
  6163. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  6164. NULL, NULL)))
  6165. goto end;
  6166. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  6167. SSL_ERROR_NONE)))
  6168. goto end;
  6169. SSL_set_verify(serverssl, SSL_VERIFY_PEER, NULL);
  6170. if (!TEST_true(SSL_verify_client_post_handshake(serverssl)))
  6171. goto end;
  6172. if (!TEST_true(SSL_key_update(clientssl, SSL_KEY_UPDATE_NOT_REQUESTED)))
  6173. goto end;
  6174. /* Start handshake on the server */
  6175. if (!TEST_int_eq(SSL_do_handshake(serverssl), 1))
  6176. goto end;
  6177. /* Starts with SSL_connect(), but it's really just SSL_do_handshake() */
  6178. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  6179. SSL_ERROR_NONE)))
  6180. goto end;
  6181. SSL_shutdown(clientssl);
  6182. SSL_shutdown(serverssl);
  6183. testresult = 1;
  6184. end:
  6185. SSL_free(serverssl);
  6186. SSL_free(clientssl);
  6187. SSL_CTX_free(sctx);
  6188. SSL_CTX_free(cctx);
  6189. return testresult;
  6190. }
  6191. #endif
  6192. #if !defined(OPENSSL_NO_SRP) && !defined(OPENSSL_NO_TLS1_2)
  6193. static SRP_VBASE *vbase = NULL;
  6194. static int ssl_srp_cb(SSL *s, int *ad, void *arg)
  6195. {
  6196. int ret = SSL3_AL_FATAL;
  6197. char *username;
  6198. SRP_user_pwd *user = NULL;
  6199. username = SSL_get_srp_username(s);
  6200. if (username == NULL) {
  6201. *ad = SSL_AD_INTERNAL_ERROR;
  6202. goto err;
  6203. }
  6204. user = SRP_VBASE_get1_by_user(vbase, username);
  6205. if (user == NULL) {
  6206. *ad = SSL_AD_INTERNAL_ERROR;
  6207. goto err;
  6208. }
  6209. if (SSL_set_srp_server_param(s, user->N, user->g, user->s, user->v,
  6210. user->info) <= 0) {
  6211. *ad = SSL_AD_INTERNAL_ERROR;
  6212. goto err;
  6213. }
  6214. ret = 0;
  6215. err:
  6216. SRP_user_pwd_free(user);
  6217. return ret;
  6218. }
  6219. static int create_new_vfile(char *userid, char *password, const char *filename)
  6220. {
  6221. char *gNid = NULL;
  6222. OPENSSL_STRING *row = OPENSSL_zalloc(sizeof(row) * (DB_NUMBER + 1));
  6223. TXT_DB *db = NULL;
  6224. int ret = 0;
  6225. BIO *out = NULL, *dummy = BIO_new_mem_buf("", 0);
  6226. size_t i;
  6227. if (!TEST_ptr(dummy) || !TEST_ptr(row))
  6228. goto end;
  6229. gNid = SRP_create_verifier_ex(userid, password, &row[DB_srpsalt],
  6230. &row[DB_srpverifier], NULL, NULL, libctx, NULL);
  6231. if (!TEST_ptr(gNid))
  6232. goto end;
  6233. /*
  6234. * The only way to create an empty TXT_DB is to provide a BIO with no data
  6235. * in it!
  6236. */
  6237. db = TXT_DB_read(dummy, DB_NUMBER);
  6238. if (!TEST_ptr(db))
  6239. goto end;
  6240. out = BIO_new_file(filename, "w");
  6241. if (!TEST_ptr(out))
  6242. goto end;
  6243. row[DB_srpid] = OPENSSL_strdup(userid);
  6244. row[DB_srptype] = OPENSSL_strdup("V");
  6245. row[DB_srpgN] = OPENSSL_strdup(gNid);
  6246. if (!TEST_ptr(row[DB_srpid])
  6247. || !TEST_ptr(row[DB_srptype])
  6248. || !TEST_ptr(row[DB_srpgN])
  6249. || !TEST_true(TXT_DB_insert(db, row)))
  6250. goto end;
  6251. row = NULL;
  6252. if (TXT_DB_write(out, db) <= 0)
  6253. goto end;
  6254. ret = 1;
  6255. end:
  6256. if (row != NULL) {
  6257. for (i = 0; i < DB_NUMBER; i++)
  6258. OPENSSL_free(row[i]);
  6259. }
  6260. OPENSSL_free(row);
  6261. BIO_free(dummy);
  6262. BIO_free(out);
  6263. TXT_DB_free(db);
  6264. return ret;
  6265. }
  6266. static int create_new_vbase(char *userid, char *password)
  6267. {
  6268. BIGNUM *verifier = NULL, *salt = NULL;
  6269. const SRP_gN *lgN = NULL;
  6270. SRP_user_pwd *user_pwd = NULL;
  6271. int ret = 0;
  6272. lgN = SRP_get_default_gN(NULL);
  6273. if (!TEST_ptr(lgN))
  6274. goto end;
  6275. if (!TEST_true(SRP_create_verifier_BN_ex(userid, password, &salt, &verifier,
  6276. lgN->N, lgN->g, libctx, NULL)))
  6277. goto end;
  6278. user_pwd = OPENSSL_zalloc(sizeof(*user_pwd));
  6279. if (!TEST_ptr(user_pwd))
  6280. goto end;
  6281. user_pwd->N = lgN->N;
  6282. user_pwd->g = lgN->g;
  6283. user_pwd->id = OPENSSL_strdup(userid);
  6284. if (!TEST_ptr(user_pwd->id))
  6285. goto end;
  6286. user_pwd->v = verifier;
  6287. user_pwd->s = salt;
  6288. verifier = salt = NULL;
  6289. if (sk_SRP_user_pwd_insert(vbase->users_pwd, user_pwd, 0) == 0)
  6290. goto end;
  6291. user_pwd = NULL;
  6292. ret = 1;
  6293. end:
  6294. SRP_user_pwd_free(user_pwd);
  6295. BN_free(salt);
  6296. BN_free(verifier);
  6297. return ret;
  6298. }
  6299. /*
  6300. * SRP tests
  6301. *
  6302. * Test 0: Simple successful SRP connection, new vbase
  6303. * Test 1: Connection failure due to bad password, new vbase
  6304. * Test 2: Simple successful SRP connection, vbase loaded from existing file
  6305. * Test 3: Connection failure due to bad password, vbase loaded from existing
  6306. * file
  6307. * Test 4: Simple successful SRP connection, vbase loaded from new file
  6308. * Test 5: Connection failure due to bad password, vbase loaded from new file
  6309. */
  6310. static int test_srp(int tst)
  6311. {
  6312. char *userid = "test", *password = "password", *tstsrpfile;
  6313. SSL_CTX *cctx = NULL, *sctx = NULL;
  6314. SSL *clientssl = NULL, *serverssl = NULL;
  6315. int ret, testresult = 0;
  6316. vbase = SRP_VBASE_new(NULL);
  6317. if (!TEST_ptr(vbase))
  6318. goto end;
  6319. if (tst == 0 || tst == 1) {
  6320. if (!TEST_true(create_new_vbase(userid, password)))
  6321. goto end;
  6322. } else {
  6323. if (tst == 4 || tst == 5) {
  6324. if (!TEST_true(create_new_vfile(userid, password, tmpfilename)))
  6325. goto end;
  6326. tstsrpfile = tmpfilename;
  6327. } else {
  6328. tstsrpfile = srpvfile;
  6329. }
  6330. if (!TEST_int_eq(SRP_VBASE_init(vbase, tstsrpfile), SRP_NO_ERROR))
  6331. goto end;
  6332. }
  6333. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6334. TLS_client_method(), TLS1_VERSION, 0,
  6335. &sctx, &cctx, cert, privkey)))
  6336. goto end;
  6337. if (!TEST_int_gt(SSL_CTX_set_srp_username_callback(sctx, ssl_srp_cb), 0)
  6338. || !TEST_true(SSL_CTX_set_cipher_list(cctx, "SRP-AES-128-CBC-SHA"))
  6339. || !TEST_true(SSL_CTX_set_max_proto_version(sctx, TLS1_2_VERSION))
  6340. || !TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION))
  6341. || !TEST_int_gt(SSL_CTX_set_srp_username(cctx, userid), 0))
  6342. goto end;
  6343. if (tst % 2 == 1) {
  6344. if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, "badpass"), 0))
  6345. goto end;
  6346. } else {
  6347. if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, password), 0))
  6348. goto end;
  6349. }
  6350. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  6351. NULL, NULL)))
  6352. goto end;
  6353. ret = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE);
  6354. if (ret) {
  6355. if (!TEST_true(tst % 2 == 0))
  6356. goto end;
  6357. } else {
  6358. if (!TEST_true(tst % 2 == 1))
  6359. goto end;
  6360. }
  6361. testresult = 1;
  6362. end:
  6363. SRP_VBASE_free(vbase);
  6364. vbase = NULL;
  6365. SSL_free(serverssl);
  6366. SSL_free(clientssl);
  6367. SSL_CTX_free(sctx);
  6368. SSL_CTX_free(cctx);
  6369. return testresult;
  6370. }
  6371. #endif
  6372. static int info_cb_failed = 0;
  6373. static int info_cb_offset = 0;
  6374. static int info_cb_this_state = -1;
  6375. static struct info_cb_states_st {
  6376. int where;
  6377. const char *statestr;
  6378. } info_cb_states[][60] = {
  6379. {
  6380. /* TLSv1.2 server followed by resumption */
  6381. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT"},
  6382. {SSL_CB_LOOP, "PINIT"}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
  6383. {SSL_CB_LOOP, "TWSC"}, {SSL_CB_LOOP, "TWSKE"}, {SSL_CB_LOOP, "TWSD"},
  6384. {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWSD"}, {SSL_CB_LOOP, "TRCKE"},
  6385. {SSL_CB_LOOP, "TRCCS"}, {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWST"},
  6386. {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
  6387. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
  6388. {SSL_CB_ALERT, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
  6389. {SSL_CB_LOOP, "PINIT"}, {SSL_CB_LOOP, "PINIT"}, {SSL_CB_LOOP, "TRCH"},
  6390. {SSL_CB_LOOP, "TWSH"}, {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
  6391. {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_LOOP, "TRCCS"},
  6392. {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
  6393. {SSL_CB_EXIT, NULL}, {0, NULL},
  6394. }, {
  6395. /* TLSv1.2 client followed by resumption */
  6396. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT"},
  6397. {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWCH"},
  6398. {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TRSC"}, {SSL_CB_LOOP, "TRSKE"},
  6399. {SSL_CB_LOOP, "TRSD"}, {SSL_CB_LOOP, "TWCKE"}, {SSL_CB_LOOP, "TWCCS"},
  6400. {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWFIN"},
  6401. {SSL_CB_LOOP, "TRST"}, {SSL_CB_LOOP, "TRCCS"}, {SSL_CB_LOOP, "TRFIN"},
  6402. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL}, {SSL_CB_ALERT, NULL},
  6403. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT"},
  6404. {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWCH"},
  6405. {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TRCCS"}, {SSL_CB_LOOP, "TRFIN"},
  6406. {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
  6407. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL}, {0, NULL},
  6408. }, {
  6409. /* TLSv1.3 server followed by resumption */
  6410. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT"},
  6411. {SSL_CB_LOOP, "PINIT"}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
  6412. {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"}, {SSL_CB_LOOP, "TWSC"},
  6413. {SSL_CB_LOOP, "TWSCV"}, {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_LOOP, "TED"},
  6414. {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TRFIN"},
  6415. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_LOOP, "TWST"},
  6416. {SSL_CB_LOOP, "TWST"}, {SSL_CB_EXIT, NULL}, {SSL_CB_ALERT, NULL},
  6417. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT"},
  6418. {SSL_CB_LOOP, "PINIT"}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
  6419. {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"}, {SSL_CB_LOOP, "TWFIN"},
  6420. {SSL_CB_LOOP, "TED"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TED"},
  6421. {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
  6422. {SSL_CB_LOOP, "TWST"}, {SSL_CB_EXIT, NULL}, {0, NULL},
  6423. }, {
  6424. /* TLSv1.3 client followed by resumption */
  6425. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT"},
  6426. {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWCH"},
  6427. {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"}, {SSL_CB_LOOP, "TRSC"},
  6428. {SSL_CB_LOOP, "TRSCV"}, {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWCCS"},
  6429. {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
  6430. {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "SSLOK"}, {SSL_CB_LOOP, "SSLOK"},
  6431. {SSL_CB_LOOP, "TRST"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "SSLOK"},
  6432. {SSL_CB_LOOP, "SSLOK"}, {SSL_CB_LOOP, "TRST"}, {SSL_CB_EXIT, NULL},
  6433. {SSL_CB_ALERT, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
  6434. {SSL_CB_LOOP, "PINIT"}, {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL},
  6435. {SSL_CB_LOOP, "TWCH"}, {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"},
  6436. {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
  6437. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
  6438. {SSL_CB_LOOP, "SSLOK"}, {SSL_CB_LOOP, "SSLOK"}, {SSL_CB_LOOP, "TRST"},
  6439. {SSL_CB_EXIT, NULL}, {0, NULL},
  6440. }, {
  6441. /* TLSv1.3 server, early_data */
  6442. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT"},
  6443. {SSL_CB_LOOP, "PINIT"}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
  6444. {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"}, {SSL_CB_LOOP, "TWFIN"},
  6445. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
  6446. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "TED"},
  6447. {SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TWEOED"}, {SSL_CB_LOOP, "TRFIN"},
  6448. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_LOOP, "TWST"},
  6449. {SSL_CB_EXIT, NULL}, {0, NULL},
  6450. }, {
  6451. /* TLSv1.3 client, early_data */
  6452. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT"},
  6453. {SSL_CB_LOOP, "TWCH"}, {SSL_CB_LOOP, "TWCCS"},
  6454. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
  6455. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "TED"},
  6456. {SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"},
  6457. {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TPEDE"}, {SSL_CB_LOOP, "TWEOED"},
  6458. {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
  6459. {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "SSLOK"}, {SSL_CB_LOOP, "SSLOK"},
  6460. {SSL_CB_LOOP, "TRST"}, {SSL_CB_EXIT, NULL}, {0, NULL},
  6461. }, {
  6462. /* TLSv1.3 server, certificate compression, followed by resumption */
  6463. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT"},
  6464. {SSL_CB_LOOP, "PINIT"}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
  6465. {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"}, {SSL_CB_LOOP, "TWSCC"},
  6466. {SSL_CB_LOOP, "TWSCV"}, {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_LOOP, "TED"},
  6467. {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TRFIN"},
  6468. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_LOOP, "TWST"},
  6469. {SSL_CB_LOOP, "TWST"}, {SSL_CB_EXIT, NULL}, {SSL_CB_ALERT, NULL},
  6470. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT"},
  6471. {SSL_CB_LOOP, "PINIT"}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
  6472. {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"}, {SSL_CB_LOOP, "TWFIN"},
  6473. {SSL_CB_LOOP, "TED"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TED"},
  6474. {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
  6475. {SSL_CB_LOOP, "TWST"}, {SSL_CB_EXIT, NULL}, {0, NULL},
  6476. }, {
  6477. /* TLSv1.3 client, certificate compression, followed by resumption */
  6478. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT"},
  6479. {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWCH"},
  6480. {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"}, {SSL_CB_LOOP, "TRSCC"},
  6481. {SSL_CB_LOOP, "TRSCV"}, {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWCCS"},
  6482. {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
  6483. {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "SSLOK"}, {SSL_CB_LOOP, "SSLOK"},
  6484. {SSL_CB_LOOP, "TRST"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "SSLOK"},
  6485. {SSL_CB_LOOP, "SSLOK"}, {SSL_CB_LOOP, "TRST"}, {SSL_CB_EXIT, NULL},
  6486. {SSL_CB_ALERT, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
  6487. {SSL_CB_LOOP, "PINIT"}, {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL},
  6488. {SSL_CB_LOOP, "TWCH"}, {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"},
  6489. {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
  6490. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
  6491. {SSL_CB_LOOP, "SSLOK"}, {SSL_CB_LOOP, "SSLOK"}, {SSL_CB_LOOP, "TRST"},
  6492. {SSL_CB_EXIT, NULL}, {0, NULL},
  6493. }, {
  6494. {0, NULL},
  6495. }
  6496. };
  6497. static void sslapi_info_callback(const SSL *s, int where, int ret)
  6498. {
  6499. struct info_cb_states_st *state = info_cb_states[info_cb_offset];
  6500. /* We do not ever expect a connection to fail in this test */
  6501. if (!TEST_false(ret == 0)) {
  6502. info_cb_failed = 1;
  6503. return;
  6504. }
  6505. /*
  6506. * Do some sanity checks. We never expect these things to happen in this
  6507. * test
  6508. */
  6509. if (!TEST_false((SSL_is_server(s) && (where & SSL_ST_CONNECT) != 0))
  6510. || !TEST_false(!SSL_is_server(s) && (where & SSL_ST_ACCEPT) != 0)
  6511. || !TEST_int_ne(state[++info_cb_this_state].where, 0)) {
  6512. info_cb_failed = 1;
  6513. return;
  6514. }
  6515. /* Now check we're in the right state */
  6516. if (!TEST_true((where & state[info_cb_this_state].where) != 0)) {
  6517. info_cb_failed = 1;
  6518. return;
  6519. }
  6520. if ((where & SSL_CB_LOOP) != 0
  6521. && !TEST_int_eq(strcmp(SSL_state_string(s),
  6522. state[info_cb_this_state].statestr), 0)) {
  6523. info_cb_failed = 1;
  6524. return;
  6525. }
  6526. /*
  6527. * Check that, if we've got SSL_CB_HANDSHAKE_DONE we are not in init
  6528. */
  6529. if ((where & SSL_CB_HANDSHAKE_DONE)
  6530. && SSL_in_init((SSL *)s) != 0) {
  6531. info_cb_failed = 1;
  6532. return;
  6533. }
  6534. }
  6535. /*
  6536. * Test the info callback gets called when we expect it to.
  6537. *
  6538. * Test 0: TLSv1.2, server
  6539. * Test 1: TLSv1.2, client
  6540. * Test 2: TLSv1.3, server
  6541. * Test 3: TLSv1.3, client
  6542. * Test 4: TLSv1.3, server, early_data
  6543. * Test 5: TLSv1.3, client, early_data
  6544. * Test 6: TLSv1.3, server, compressed certificate
  6545. * Test 7: TLSv1.3, client, compressed certificate
  6546. */
  6547. static int test_info_callback(int tst)
  6548. {
  6549. SSL_CTX *cctx = NULL, *sctx = NULL;
  6550. SSL *clientssl = NULL, *serverssl = NULL;
  6551. SSL_SESSION *clntsess = NULL;
  6552. int testresult = 0;
  6553. int tlsvers;
  6554. if (tst < 2) {
  6555. /* We need either ECDHE or DHE for the TLSv1.2 test to work */
  6556. #if !defined(OPENSSL_NO_TLS1_2) && (!defined(OPENSSL_NO_EC) \
  6557. || !defined(OPENSSL_NO_DH))
  6558. tlsvers = TLS1_2_VERSION;
  6559. #else
  6560. return 1;
  6561. #endif
  6562. } else {
  6563. #ifndef OSSL_NO_USABLE_TLS1_3
  6564. tlsvers = TLS1_3_VERSION;
  6565. #else
  6566. return 1;
  6567. #endif
  6568. }
  6569. /* Reset globals */
  6570. info_cb_failed = 0;
  6571. info_cb_this_state = -1;
  6572. info_cb_offset = tst;
  6573. #ifndef OSSL_NO_USABLE_TLS1_3
  6574. if (tst >= 4 && tst < 6) {
  6575. SSL_SESSION *sess = NULL;
  6576. size_t written, readbytes;
  6577. unsigned char buf[80];
  6578. /* early_data tests */
  6579. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  6580. &serverssl, &sess, 0,
  6581. SHA384_DIGEST_LENGTH)))
  6582. goto end;
  6583. /* We don't actually need this reference */
  6584. SSL_SESSION_free(sess);
  6585. SSL_set_info_callback((tst % 2) == 0 ? serverssl : clientssl,
  6586. sslapi_info_callback);
  6587. /* Write and read some early data and then complete the connection */
  6588. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  6589. &written))
  6590. || !TEST_size_t_eq(written, strlen(MSG1))
  6591. || !TEST_int_eq(SSL_read_early_data(serverssl, buf,
  6592. sizeof(buf), &readbytes),
  6593. SSL_READ_EARLY_DATA_SUCCESS)
  6594. || !TEST_mem_eq(MSG1, readbytes, buf, strlen(MSG1))
  6595. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  6596. SSL_EARLY_DATA_ACCEPTED)
  6597. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  6598. SSL_ERROR_NONE))
  6599. || !TEST_false(info_cb_failed))
  6600. goto end;
  6601. testresult = 1;
  6602. goto end;
  6603. }
  6604. #endif
  6605. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6606. TLS_client_method(),
  6607. tlsvers, tlsvers, &sctx, &cctx, cert,
  6608. privkey)))
  6609. goto end;
  6610. if (!TEST_true(SSL_CTX_set_dh_auto(sctx, 1)))
  6611. goto end;
  6612. /*
  6613. * For even numbered tests we check the server callbacks. For odd numbers we
  6614. * check the client.
  6615. */
  6616. SSL_CTX_set_info_callback((tst % 2) == 0 ? sctx : cctx,
  6617. sslapi_info_callback);
  6618. if (tst >= 6) {
  6619. if (!SSL_CTX_compress_certs(sctx, 0))
  6620. goto end;
  6621. }
  6622. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  6623. &clientssl, NULL, NULL))
  6624. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  6625. SSL_ERROR_NONE))
  6626. || !TEST_false(info_cb_failed))
  6627. goto end;
  6628. clntsess = SSL_get1_session(clientssl);
  6629. SSL_shutdown(clientssl);
  6630. SSL_shutdown(serverssl);
  6631. SSL_free(serverssl);
  6632. SSL_free(clientssl);
  6633. serverssl = clientssl = NULL;
  6634. /* Now do a resumption */
  6635. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
  6636. NULL))
  6637. || !TEST_true(SSL_set_session(clientssl, clntsess))
  6638. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  6639. SSL_ERROR_NONE))
  6640. || !TEST_true(SSL_session_reused(clientssl))
  6641. || !TEST_false(info_cb_failed))
  6642. goto end;
  6643. testresult = 1;
  6644. end:
  6645. SSL_free(serverssl);
  6646. SSL_free(clientssl);
  6647. SSL_SESSION_free(clntsess);
  6648. SSL_CTX_free(sctx);
  6649. SSL_CTX_free(cctx);
  6650. return testresult;
  6651. }
  6652. static int test_ssl_pending(int tst)
  6653. {
  6654. SSL_CTX *cctx = NULL, *sctx = NULL;
  6655. SSL *clientssl = NULL, *serverssl = NULL;
  6656. int testresult = 0;
  6657. char msg[] = "A test message";
  6658. char buf[5];
  6659. size_t written, readbytes;
  6660. if (tst == 0) {
  6661. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6662. TLS_client_method(),
  6663. TLS1_VERSION, 0,
  6664. &sctx, &cctx, cert, privkey)))
  6665. goto end;
  6666. } else {
  6667. #ifndef OPENSSL_NO_DTLS
  6668. if (!TEST_true(create_ssl_ctx_pair(libctx, DTLS_server_method(),
  6669. DTLS_client_method(),
  6670. DTLS1_VERSION, 0,
  6671. &sctx, &cctx, cert, privkey)))
  6672. goto end;
  6673. # ifdef OPENSSL_NO_DTLS1_2
  6674. /* Not supported in the FIPS provider */
  6675. if (is_fips) {
  6676. testresult = 1;
  6677. goto end;
  6678. };
  6679. /*
  6680. * Default sigalgs are SHA1 based in <DTLS1.2 which is in security
  6681. * level 0
  6682. */
  6683. if (!TEST_true(SSL_CTX_set_cipher_list(sctx, "DEFAULT:@SECLEVEL=0"))
  6684. || !TEST_true(SSL_CTX_set_cipher_list(cctx,
  6685. "DEFAULT:@SECLEVEL=0")))
  6686. goto end;
  6687. # endif
  6688. #else
  6689. return 1;
  6690. #endif
  6691. }
  6692. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  6693. NULL, NULL))
  6694. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  6695. SSL_ERROR_NONE)))
  6696. goto end;
  6697. if (!TEST_int_eq(SSL_pending(clientssl), 0)
  6698. || !TEST_false(SSL_has_pending(clientssl))
  6699. || !TEST_int_eq(SSL_pending(serverssl), 0)
  6700. || !TEST_false(SSL_has_pending(serverssl))
  6701. || !TEST_true(SSL_write_ex(serverssl, msg, sizeof(msg), &written))
  6702. || !TEST_size_t_eq(written, sizeof(msg))
  6703. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  6704. || !TEST_size_t_eq(readbytes, sizeof(buf))
  6705. || !TEST_int_eq(SSL_pending(clientssl), (int)(written - readbytes))
  6706. || !TEST_true(SSL_has_pending(clientssl)))
  6707. goto end;
  6708. testresult = 1;
  6709. end:
  6710. SSL_free(serverssl);
  6711. SSL_free(clientssl);
  6712. SSL_CTX_free(sctx);
  6713. SSL_CTX_free(cctx);
  6714. return testresult;
  6715. }
  6716. static struct {
  6717. unsigned int maxprot;
  6718. const char *clntciphers;
  6719. const char *clnttls13ciphers;
  6720. const char *srvrciphers;
  6721. const char *srvrtls13ciphers;
  6722. const char *shared;
  6723. const char *fipsshared;
  6724. } shared_ciphers_data[] = {
  6725. /*
  6726. * We can't establish a connection (even in TLSv1.1) with these ciphersuites if
  6727. * TLSv1.3 is enabled but TLSv1.2 is disabled.
  6728. */
  6729. #if defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
  6730. {
  6731. TLS1_2_VERSION,
  6732. "AES128-SHA:AES256-SHA",
  6733. NULL,
  6734. "AES256-SHA:DHE-RSA-AES128-SHA",
  6735. NULL,
  6736. "AES256-SHA",
  6737. "AES256-SHA"
  6738. },
  6739. # if !defined(OPENSSL_NO_CHACHA) \
  6740. && !defined(OPENSSL_NO_POLY1305) \
  6741. && !defined(OPENSSL_NO_EC)
  6742. {
  6743. TLS1_2_VERSION,
  6744. "AES128-SHA:ECDHE-RSA-CHACHA20-POLY1305",
  6745. NULL,
  6746. "AES128-SHA:ECDHE-RSA-CHACHA20-POLY1305",
  6747. NULL,
  6748. "AES128-SHA:ECDHE-RSA-CHACHA20-POLY1305",
  6749. "AES128-SHA"
  6750. },
  6751. # endif
  6752. {
  6753. TLS1_2_VERSION,
  6754. "AES128-SHA:DHE-RSA-AES128-SHA:AES256-SHA",
  6755. NULL,
  6756. "AES128-SHA:DHE-RSA-AES256-SHA:AES256-SHA",
  6757. NULL,
  6758. "AES128-SHA:AES256-SHA",
  6759. "AES128-SHA:AES256-SHA"
  6760. },
  6761. {
  6762. TLS1_2_VERSION,
  6763. "AES128-SHA:AES256-SHA",
  6764. NULL,
  6765. "AES128-SHA:DHE-RSA-AES128-SHA",
  6766. NULL,
  6767. "AES128-SHA",
  6768. "AES128-SHA"
  6769. },
  6770. #endif
  6771. /*
  6772. * This test combines TLSv1.3 and TLSv1.2 ciphersuites so they must both be
  6773. * enabled.
  6774. */
  6775. #if !defined(OSSL_NO_USABLE_TLS1_3) && !defined(OPENSSL_NO_TLS1_2) \
  6776. && !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
  6777. {
  6778. TLS1_3_VERSION,
  6779. "AES128-SHA:AES256-SHA",
  6780. NULL,
  6781. "AES256-SHA:AES128-SHA256",
  6782. NULL,
  6783. "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:"
  6784. "TLS_AES_128_GCM_SHA256:AES256-SHA",
  6785. "TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:AES256-SHA"
  6786. },
  6787. #endif
  6788. #ifndef OSSL_NO_USABLE_TLS1_3
  6789. {
  6790. TLS1_3_VERSION,
  6791. "AES128-SHA",
  6792. "TLS_AES_256_GCM_SHA384",
  6793. "AES256-SHA",
  6794. "TLS_AES_256_GCM_SHA384",
  6795. "TLS_AES_256_GCM_SHA384",
  6796. "TLS_AES_256_GCM_SHA384"
  6797. },
  6798. #endif
  6799. };
  6800. static int int_test_ssl_get_shared_ciphers(int tst, int clnt)
  6801. {
  6802. SSL_CTX *cctx = NULL, *sctx = NULL;
  6803. SSL *clientssl = NULL, *serverssl = NULL;
  6804. int testresult = 0;
  6805. char buf[1024];
  6806. OSSL_LIB_CTX *tmplibctx = OSSL_LIB_CTX_new();
  6807. if (!TEST_ptr(tmplibctx))
  6808. goto end;
  6809. /*
  6810. * Regardless of whether we're testing with the FIPS provider loaded into
  6811. * libctx, we want one peer to always use the full set of ciphersuites
  6812. * available. Therefore we use a separate libctx with the default provider
  6813. * loaded into it. We run the same tests twice - once with the client side
  6814. * having the full set of ciphersuites and once with the server side.
  6815. */
  6816. if (clnt) {
  6817. cctx = SSL_CTX_new_ex(tmplibctx, NULL, TLS_client_method());
  6818. if (!TEST_ptr(cctx))
  6819. goto end;
  6820. } else {
  6821. sctx = SSL_CTX_new_ex(tmplibctx, NULL, TLS_server_method());
  6822. if (!TEST_ptr(sctx))
  6823. goto end;
  6824. }
  6825. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6826. TLS_client_method(),
  6827. TLS1_VERSION,
  6828. shared_ciphers_data[tst].maxprot,
  6829. &sctx, &cctx, cert, privkey)))
  6830. goto end;
  6831. if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
  6832. shared_ciphers_data[tst].clntciphers))
  6833. || (shared_ciphers_data[tst].clnttls13ciphers != NULL
  6834. && !TEST_true(SSL_CTX_set_ciphersuites(cctx,
  6835. shared_ciphers_data[tst].clnttls13ciphers)))
  6836. || !TEST_true(SSL_CTX_set_cipher_list(sctx,
  6837. shared_ciphers_data[tst].srvrciphers))
  6838. || (shared_ciphers_data[tst].srvrtls13ciphers != NULL
  6839. && !TEST_true(SSL_CTX_set_ciphersuites(sctx,
  6840. shared_ciphers_data[tst].srvrtls13ciphers))))
  6841. goto end;
  6842. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  6843. NULL, NULL))
  6844. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  6845. SSL_ERROR_NONE)))
  6846. goto end;
  6847. if (!TEST_ptr(SSL_get_shared_ciphers(serverssl, buf, sizeof(buf)))
  6848. || !TEST_int_eq(strcmp(buf,
  6849. is_fips
  6850. ? shared_ciphers_data[tst].fipsshared
  6851. : shared_ciphers_data[tst].shared),
  6852. 0)) {
  6853. TEST_info("Shared ciphers are: %s\n", buf);
  6854. goto end;
  6855. }
  6856. testresult = 1;
  6857. end:
  6858. SSL_free(serverssl);
  6859. SSL_free(clientssl);
  6860. SSL_CTX_free(sctx);
  6861. SSL_CTX_free(cctx);
  6862. OSSL_LIB_CTX_free(tmplibctx);
  6863. return testresult;
  6864. }
  6865. static int test_ssl_get_shared_ciphers(int tst)
  6866. {
  6867. return int_test_ssl_get_shared_ciphers(tst, 0)
  6868. && int_test_ssl_get_shared_ciphers(tst, 1);
  6869. }
  6870. static const char *appdata = "Hello World";
  6871. static int gen_tick_called, dec_tick_called, tick_key_cb_called;
  6872. static int tick_key_renew = 0;
  6873. static SSL_TICKET_RETURN tick_dec_ret = SSL_TICKET_RETURN_ABORT;
  6874. static int gen_tick_cb(SSL *s, void *arg)
  6875. {
  6876. gen_tick_called = 1;
  6877. return SSL_SESSION_set1_ticket_appdata(SSL_get_session(s), appdata,
  6878. strlen(appdata));
  6879. }
  6880. static SSL_TICKET_RETURN dec_tick_cb(SSL *s, SSL_SESSION *ss,
  6881. const unsigned char *keyname,
  6882. size_t keyname_length,
  6883. SSL_TICKET_STATUS status,
  6884. void *arg)
  6885. {
  6886. void *tickdata;
  6887. size_t tickdlen;
  6888. dec_tick_called = 1;
  6889. if (status == SSL_TICKET_EMPTY)
  6890. return SSL_TICKET_RETURN_IGNORE_RENEW;
  6891. if (!TEST_true(status == SSL_TICKET_SUCCESS
  6892. || status == SSL_TICKET_SUCCESS_RENEW))
  6893. return SSL_TICKET_RETURN_ABORT;
  6894. if (!TEST_true(SSL_SESSION_get0_ticket_appdata(ss, &tickdata,
  6895. &tickdlen))
  6896. || !TEST_size_t_eq(tickdlen, strlen(appdata))
  6897. || !TEST_int_eq(memcmp(tickdata, appdata, tickdlen), 0))
  6898. return SSL_TICKET_RETURN_ABORT;
  6899. if (tick_key_cb_called) {
  6900. /* Don't change what the ticket key callback wanted to do */
  6901. switch (status) {
  6902. case SSL_TICKET_NO_DECRYPT:
  6903. return SSL_TICKET_RETURN_IGNORE_RENEW;
  6904. case SSL_TICKET_SUCCESS:
  6905. return SSL_TICKET_RETURN_USE;
  6906. case SSL_TICKET_SUCCESS_RENEW:
  6907. return SSL_TICKET_RETURN_USE_RENEW;
  6908. default:
  6909. return SSL_TICKET_RETURN_ABORT;
  6910. }
  6911. }
  6912. return tick_dec_ret;
  6913. }
  6914. #ifndef OPENSSL_NO_DEPRECATED_3_0
  6915. static int tick_key_cb(SSL *s, unsigned char key_name[16],
  6916. unsigned char iv[EVP_MAX_IV_LENGTH], EVP_CIPHER_CTX *ctx,
  6917. HMAC_CTX *hctx, int enc)
  6918. {
  6919. const unsigned char tick_aes_key[16] = "0123456789abcdef";
  6920. const unsigned char tick_hmac_key[16] = "0123456789abcdef";
  6921. EVP_CIPHER *aes128cbc;
  6922. EVP_MD *sha256;
  6923. int ret;
  6924. tick_key_cb_called = 1;
  6925. if (tick_key_renew == -1)
  6926. return 0;
  6927. aes128cbc = EVP_CIPHER_fetch(libctx, "AES-128-CBC", NULL);
  6928. if (!TEST_ptr(aes128cbc))
  6929. return 0;
  6930. sha256 = EVP_MD_fetch(libctx, "SHA-256", NULL);
  6931. if (!TEST_ptr(sha256)) {
  6932. EVP_CIPHER_free(aes128cbc);
  6933. return 0;
  6934. }
  6935. memset(iv, 0, AES_BLOCK_SIZE);
  6936. memset(key_name, 0, 16);
  6937. if (aes128cbc == NULL
  6938. || sha256 == NULL
  6939. || !EVP_CipherInit_ex(ctx, aes128cbc, NULL, tick_aes_key, iv, enc)
  6940. || !HMAC_Init_ex(hctx, tick_hmac_key, sizeof(tick_hmac_key), sha256,
  6941. NULL))
  6942. ret = -1;
  6943. else
  6944. ret = tick_key_renew ? 2 : 1;
  6945. EVP_CIPHER_free(aes128cbc);
  6946. EVP_MD_free(sha256);
  6947. return ret;
  6948. }
  6949. #endif
  6950. static int tick_key_evp_cb(SSL *s, unsigned char key_name[16],
  6951. unsigned char iv[EVP_MAX_IV_LENGTH],
  6952. EVP_CIPHER_CTX *ctx, EVP_MAC_CTX *hctx, int enc)
  6953. {
  6954. const unsigned char tick_aes_key[16] = "0123456789abcdef";
  6955. unsigned char tick_hmac_key[16] = "0123456789abcdef";
  6956. OSSL_PARAM params[2];
  6957. EVP_CIPHER *aes128cbc;
  6958. int ret;
  6959. tick_key_cb_called = 1;
  6960. if (tick_key_renew == -1)
  6961. return 0;
  6962. aes128cbc = EVP_CIPHER_fetch(libctx, "AES-128-CBC", NULL);
  6963. if (!TEST_ptr(aes128cbc))
  6964. return 0;
  6965. memset(iv, 0, AES_BLOCK_SIZE);
  6966. memset(key_name, 0, 16);
  6967. params[0] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
  6968. "SHA256", 0);
  6969. params[1] = OSSL_PARAM_construct_end();
  6970. if (aes128cbc == NULL
  6971. || !EVP_CipherInit_ex(ctx, aes128cbc, NULL, tick_aes_key, iv, enc)
  6972. || !EVP_MAC_init(hctx, tick_hmac_key, sizeof(tick_hmac_key),
  6973. params))
  6974. ret = -1;
  6975. else
  6976. ret = tick_key_renew ? 2 : 1;
  6977. EVP_CIPHER_free(aes128cbc);
  6978. return ret;
  6979. }
  6980. /*
  6981. * Test the various ticket callbacks
  6982. * Test 0: TLSv1.2, no ticket key callback, no ticket, no renewal
  6983. * Test 1: TLSv1.3, no ticket key callback, no ticket, no renewal
  6984. * Test 2: TLSv1.2, no ticket key callback, no ticket, renewal
  6985. * Test 3: TLSv1.3, no ticket key callback, no ticket, renewal
  6986. * Test 4: TLSv1.2, no ticket key callback, ticket, no renewal
  6987. * Test 5: TLSv1.3, no ticket key callback, ticket, no renewal
  6988. * Test 6: TLSv1.2, no ticket key callback, ticket, renewal
  6989. * Test 7: TLSv1.3, no ticket key callback, ticket, renewal
  6990. * Test 8: TLSv1.2, old ticket key callback, ticket, no renewal
  6991. * Test 9: TLSv1.3, old ticket key callback, ticket, no renewal
  6992. * Test 10: TLSv1.2, old ticket key callback, ticket, renewal
  6993. * Test 11: TLSv1.3, old ticket key callback, ticket, renewal
  6994. * Test 12: TLSv1.2, old ticket key callback, no ticket
  6995. * Test 13: TLSv1.3, old ticket key callback, no ticket
  6996. * Test 14: TLSv1.2, ticket key callback, ticket, no renewal
  6997. * Test 15: TLSv1.3, ticket key callback, ticket, no renewal
  6998. * Test 16: TLSv1.2, ticket key callback, ticket, renewal
  6999. * Test 17: TLSv1.3, ticket key callback, ticket, renewal
  7000. * Test 18: TLSv1.2, ticket key callback, no ticket
  7001. * Test 19: TLSv1.3, ticket key callback, no ticket
  7002. */
  7003. static int test_ticket_callbacks(int tst)
  7004. {
  7005. SSL_CTX *cctx = NULL, *sctx = NULL;
  7006. SSL *clientssl = NULL, *serverssl = NULL;
  7007. SSL_SESSION *clntsess = NULL;
  7008. int testresult = 0;
  7009. #ifdef OPENSSL_NO_TLS1_2
  7010. if (tst % 2 == 0)
  7011. return 1;
  7012. #endif
  7013. #ifdef OSSL_NO_USABLE_TLS1_3
  7014. if (tst % 2 == 1)
  7015. return 1;
  7016. #endif
  7017. #ifdef OPENSSL_NO_DEPRECATED_3_0
  7018. if (tst >= 8 && tst <= 13)
  7019. return 1;
  7020. #endif
  7021. gen_tick_called = dec_tick_called = tick_key_cb_called = 0;
  7022. /* Which tests the ticket key callback should request renewal for */
  7023. if (tst == 10 || tst == 11 || tst == 16 || tst == 17)
  7024. tick_key_renew = 1;
  7025. else if (tst == 12 || tst == 13 || tst == 18 || tst == 19)
  7026. tick_key_renew = -1; /* abort sending the ticket/0-length ticket */
  7027. else
  7028. tick_key_renew = 0;
  7029. /* Which tests the decrypt ticket callback should request renewal for */
  7030. switch (tst) {
  7031. case 0:
  7032. case 1:
  7033. tick_dec_ret = SSL_TICKET_RETURN_IGNORE;
  7034. break;
  7035. case 2:
  7036. case 3:
  7037. tick_dec_ret = SSL_TICKET_RETURN_IGNORE_RENEW;
  7038. break;
  7039. case 4:
  7040. case 5:
  7041. tick_dec_ret = SSL_TICKET_RETURN_USE;
  7042. break;
  7043. case 6:
  7044. case 7:
  7045. tick_dec_ret = SSL_TICKET_RETURN_USE_RENEW;
  7046. break;
  7047. default:
  7048. tick_dec_ret = SSL_TICKET_RETURN_ABORT;
  7049. }
  7050. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7051. TLS_client_method(),
  7052. TLS1_VERSION,
  7053. ((tst % 2) == 0) ? TLS1_2_VERSION
  7054. : TLS1_3_VERSION,
  7055. &sctx, &cctx, cert, privkey)))
  7056. goto end;
  7057. /*
  7058. * We only want sessions to resume from tickets - not the session cache. So
  7059. * switch the cache off.
  7060. */
  7061. if (!TEST_true(SSL_CTX_set_session_cache_mode(sctx, SSL_SESS_CACHE_OFF)))
  7062. goto end;
  7063. if (!TEST_true(SSL_CTX_set_session_ticket_cb(sctx, gen_tick_cb, dec_tick_cb,
  7064. NULL)))
  7065. goto end;
  7066. if (tst >= 14) {
  7067. if (!TEST_true(SSL_CTX_set_tlsext_ticket_key_evp_cb(sctx, tick_key_evp_cb)))
  7068. goto end;
  7069. #ifndef OPENSSL_NO_DEPRECATED_3_0
  7070. } else if (tst >= 8) {
  7071. if (!TEST_true(SSL_CTX_set_tlsext_ticket_key_cb(sctx, tick_key_cb)))
  7072. goto end;
  7073. #endif
  7074. }
  7075. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7076. NULL, NULL))
  7077. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  7078. SSL_ERROR_NONE)))
  7079. goto end;
  7080. /*
  7081. * The decrypt ticket key callback in TLSv1.2 should be called even though
  7082. * we have no ticket yet, because it gets called with a status of
  7083. * SSL_TICKET_EMPTY (the client indicates support for tickets but does not
  7084. * actually send any ticket data). This does not happen in TLSv1.3 because
  7085. * it is not valid to send empty ticket data in TLSv1.3.
  7086. */
  7087. if (!TEST_int_eq(gen_tick_called, 1)
  7088. || !TEST_int_eq(dec_tick_called, ((tst % 2) == 0) ? 1 : 0))
  7089. goto end;
  7090. gen_tick_called = dec_tick_called = 0;
  7091. clntsess = SSL_get1_session(clientssl);
  7092. SSL_shutdown(clientssl);
  7093. SSL_shutdown(serverssl);
  7094. SSL_free(serverssl);
  7095. SSL_free(clientssl);
  7096. serverssl = clientssl = NULL;
  7097. /* Now do a resumption */
  7098. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
  7099. NULL))
  7100. || !TEST_true(SSL_set_session(clientssl, clntsess))
  7101. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  7102. SSL_ERROR_NONE)))
  7103. goto end;
  7104. if (tick_dec_ret == SSL_TICKET_RETURN_IGNORE
  7105. || tick_dec_ret == SSL_TICKET_RETURN_IGNORE_RENEW
  7106. || tick_key_renew == -1) {
  7107. if (!TEST_false(SSL_session_reused(clientssl)))
  7108. goto end;
  7109. } else {
  7110. if (!TEST_true(SSL_session_reused(clientssl)))
  7111. goto end;
  7112. }
  7113. if (!TEST_int_eq(gen_tick_called,
  7114. (tick_key_renew
  7115. || tick_dec_ret == SSL_TICKET_RETURN_IGNORE_RENEW
  7116. || tick_dec_ret == SSL_TICKET_RETURN_USE_RENEW)
  7117. ? 1 : 0)
  7118. /* There is no ticket to decrypt in tests 13 and 19 */
  7119. || !TEST_int_eq(dec_tick_called, (tst == 13 || tst == 19) ? 0 : 1))
  7120. goto end;
  7121. testresult = 1;
  7122. end:
  7123. SSL_SESSION_free(clntsess);
  7124. SSL_free(serverssl);
  7125. SSL_free(clientssl);
  7126. SSL_CTX_free(sctx);
  7127. SSL_CTX_free(cctx);
  7128. return testresult;
  7129. }
  7130. /*
  7131. * Test incorrect shutdown.
  7132. * Test 0: client does not shutdown properly,
  7133. * server does not set SSL_OP_IGNORE_UNEXPECTED_EOF,
  7134. * server should get SSL_ERROR_SSL
  7135. * Test 1: client does not shutdown properly,
  7136. * server sets SSL_OP_IGNORE_UNEXPECTED_EOF,
  7137. * server should get SSL_ERROR_ZERO_RETURN
  7138. */
  7139. static int test_incorrect_shutdown(int tst)
  7140. {
  7141. SSL_CTX *cctx = NULL, *sctx = NULL;
  7142. SSL *clientssl = NULL, *serverssl = NULL;
  7143. int testresult = 0;
  7144. char buf[80];
  7145. BIO *c2s;
  7146. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7147. TLS_client_method(), 0, 0,
  7148. &sctx, &cctx, cert, privkey)))
  7149. goto end;
  7150. if (tst == 1)
  7151. SSL_CTX_set_options(sctx, SSL_OP_IGNORE_UNEXPECTED_EOF);
  7152. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7153. NULL, NULL)))
  7154. goto end;
  7155. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  7156. SSL_ERROR_NONE)))
  7157. goto end;
  7158. c2s = SSL_get_rbio(serverssl);
  7159. BIO_set_mem_eof_return(c2s, 0);
  7160. if (!TEST_false(SSL_read(serverssl, buf, sizeof(buf))))
  7161. goto end;
  7162. if (tst == 0 && !TEST_int_eq(SSL_get_error(serverssl, 0), SSL_ERROR_SSL) )
  7163. goto end;
  7164. if (tst == 1 && !TEST_int_eq(SSL_get_error(serverssl, 0), SSL_ERROR_ZERO_RETURN) )
  7165. goto end;
  7166. testresult = 1;
  7167. end:
  7168. SSL_free(serverssl);
  7169. SSL_free(clientssl);
  7170. SSL_CTX_free(sctx);
  7171. SSL_CTX_free(cctx);
  7172. return testresult;
  7173. }
  7174. /*
  7175. * Test bi-directional shutdown.
  7176. * Test 0: TLSv1.2
  7177. * Test 1: TLSv1.2, server continues to read/write after client shutdown
  7178. * Test 2: TLSv1.3, no pending NewSessionTicket messages
  7179. * Test 3: TLSv1.3, pending NewSessionTicket messages
  7180. * Test 4: TLSv1.3, server continues to read/write after client shutdown, server
  7181. * sends key update, client reads it
  7182. * Test 5: TLSv1.3, server continues to read/write after client shutdown, server
  7183. * sends CertificateRequest, client reads and ignores it
  7184. * Test 6: TLSv1.3, server continues to read/write after client shutdown, client
  7185. * doesn't read it
  7186. */
  7187. static int test_shutdown(int tst)
  7188. {
  7189. SSL_CTX *cctx = NULL, *sctx = NULL;
  7190. SSL *clientssl = NULL, *serverssl = NULL;
  7191. int testresult = 0;
  7192. char msg[] = "A test message";
  7193. char buf[80];
  7194. size_t written, readbytes;
  7195. SSL_SESSION *sess;
  7196. #ifdef OPENSSL_NO_TLS1_2
  7197. if (tst <= 1)
  7198. return 1;
  7199. #endif
  7200. #ifdef OSSL_NO_USABLE_TLS1_3
  7201. if (tst >= 2)
  7202. return 1;
  7203. #endif
  7204. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7205. TLS_client_method(),
  7206. TLS1_VERSION,
  7207. (tst <= 1) ? TLS1_2_VERSION
  7208. : TLS1_3_VERSION,
  7209. &sctx, &cctx, cert, privkey)))
  7210. goto end;
  7211. if (tst == 5)
  7212. SSL_CTX_set_post_handshake_auth(cctx, 1);
  7213. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7214. NULL, NULL)))
  7215. goto end;
  7216. if (tst == 3) {
  7217. if (!TEST_true(create_bare_ssl_connection(serverssl, clientssl,
  7218. SSL_ERROR_NONE, 1, 0))
  7219. || !TEST_ptr_ne(sess = SSL_get_session(clientssl), NULL)
  7220. || !TEST_false(SSL_SESSION_is_resumable(sess)))
  7221. goto end;
  7222. } else if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  7223. SSL_ERROR_NONE))
  7224. || !TEST_ptr_ne(sess = SSL_get_session(clientssl), NULL)
  7225. || !TEST_true(SSL_SESSION_is_resumable(sess))) {
  7226. goto end;
  7227. }
  7228. if (!TEST_int_eq(SSL_shutdown(clientssl), 0))
  7229. goto end;
  7230. if (tst >= 4) {
  7231. /*
  7232. * Reading on the server after the client has sent close_notify should
  7233. * fail and provide SSL_ERROR_ZERO_RETURN
  7234. */
  7235. if (!TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  7236. || !TEST_int_eq(SSL_get_error(serverssl, 0),
  7237. SSL_ERROR_ZERO_RETURN)
  7238. || !TEST_int_eq(SSL_get_shutdown(serverssl),
  7239. SSL_RECEIVED_SHUTDOWN)
  7240. /*
  7241. * Even though we're shutdown on receive we should still be
  7242. * able to write.
  7243. */
  7244. || !TEST_true(SSL_write(serverssl, msg, sizeof(msg))))
  7245. goto end;
  7246. if (tst == 4
  7247. && !TEST_true(SSL_key_update(serverssl,
  7248. SSL_KEY_UPDATE_REQUESTED)))
  7249. goto end;
  7250. if (tst == 5) {
  7251. SSL_set_verify(serverssl, SSL_VERIFY_PEER, NULL);
  7252. if (!TEST_true(SSL_verify_client_post_handshake(serverssl)))
  7253. goto end;
  7254. }
  7255. if ((tst == 4 || tst == 5)
  7256. && !TEST_true(SSL_write(serverssl, msg, sizeof(msg))))
  7257. goto end;
  7258. if (!TEST_int_eq(SSL_shutdown(serverssl), 1))
  7259. goto end;
  7260. if (tst == 4 || tst == 5) {
  7261. /* Should still be able to read data from server */
  7262. if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf),
  7263. &readbytes))
  7264. || !TEST_size_t_eq(readbytes, sizeof(msg))
  7265. || !TEST_int_eq(memcmp(msg, buf, readbytes), 0)
  7266. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf),
  7267. &readbytes))
  7268. || !TEST_size_t_eq(readbytes, sizeof(msg))
  7269. || !TEST_int_eq(memcmp(msg, buf, readbytes), 0))
  7270. goto end;
  7271. }
  7272. }
  7273. /* Writing on the client after sending close_notify shouldn't be possible */
  7274. if (!TEST_false(SSL_write_ex(clientssl, msg, sizeof(msg), &written)))
  7275. goto end;
  7276. if (tst < 4) {
  7277. /*
  7278. * For these tests the client has sent close_notify but it has not yet
  7279. * been received by the server. The server has not sent close_notify
  7280. * yet.
  7281. */
  7282. if (!TEST_int_eq(SSL_shutdown(serverssl), 0)
  7283. /*
  7284. * Writing on the server after sending close_notify shouldn't
  7285. * be possible.
  7286. */
  7287. || !TEST_false(SSL_write_ex(serverssl, msg, sizeof(msg), &written))
  7288. || !TEST_int_eq(SSL_shutdown(clientssl), 1)
  7289. || !TEST_ptr_ne(sess = SSL_get_session(clientssl), NULL)
  7290. || !TEST_true(SSL_SESSION_is_resumable(sess))
  7291. || !TEST_int_eq(SSL_shutdown(serverssl), 1))
  7292. goto end;
  7293. } else if (tst == 4 || tst == 5) {
  7294. /*
  7295. * In this test the client has sent close_notify and it has been
  7296. * received by the server which has responded with a close_notify. The
  7297. * client needs to read the close_notify sent by the server.
  7298. */
  7299. if (!TEST_int_eq(SSL_shutdown(clientssl), 1)
  7300. || !TEST_ptr_ne(sess = SSL_get_session(clientssl), NULL)
  7301. || !TEST_true(SSL_SESSION_is_resumable(sess)))
  7302. goto end;
  7303. } else {
  7304. /*
  7305. * tst == 6
  7306. *
  7307. * The client has sent close_notify and is expecting a close_notify
  7308. * back, but instead there is application data first. The shutdown
  7309. * should fail with a fatal error.
  7310. */
  7311. if (!TEST_int_eq(SSL_shutdown(clientssl), -1)
  7312. || !TEST_int_eq(SSL_get_error(clientssl, -1), SSL_ERROR_SSL))
  7313. goto end;
  7314. }
  7315. testresult = 1;
  7316. end:
  7317. SSL_free(serverssl);
  7318. SSL_free(clientssl);
  7319. SSL_CTX_free(sctx);
  7320. SSL_CTX_free(cctx);
  7321. return testresult;
  7322. }
  7323. /*
  7324. * Test that sending close_notify alerts works correctly in the case of a
  7325. * retryable write failure.
  7326. */
  7327. static int test_async_shutdown(void)
  7328. {
  7329. SSL_CTX *cctx = NULL, *sctx = NULL;
  7330. SSL *clientssl = NULL, *serverssl = NULL;
  7331. int testresult = 0;
  7332. BIO *bretry = BIO_new(bio_s_always_retry()), *tmp = NULL;
  7333. if (!TEST_ptr(bretry))
  7334. goto end;
  7335. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7336. TLS_client_method(),
  7337. 0, 0,
  7338. &sctx, &cctx, cert, privkey)))
  7339. goto end;
  7340. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
  7341. NULL)))
  7342. goto end;
  7343. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  7344. goto end;
  7345. /* Close write side of clientssl */
  7346. if (!TEST_int_eq(SSL_shutdown(clientssl), 0))
  7347. goto end;
  7348. tmp = SSL_get_wbio(serverssl);
  7349. if (!TEST_true(BIO_up_ref(tmp))) {
  7350. tmp = NULL;
  7351. goto end;
  7352. }
  7353. SSL_set0_wbio(serverssl, bretry);
  7354. bretry = NULL;
  7355. /* First server shutdown should fail because of a retrable write failure */
  7356. if (!TEST_int_eq(SSL_shutdown(serverssl), -1)
  7357. || !TEST_int_eq(SSL_get_error(serverssl, -1), SSL_ERROR_WANT_WRITE))
  7358. goto end;
  7359. /* Second server shutdown should fail for the same reason */
  7360. if (!TEST_int_eq(SSL_shutdown(serverssl), -1)
  7361. || !TEST_int_eq(SSL_get_error(serverssl, -1), SSL_ERROR_WANT_WRITE))
  7362. goto end;
  7363. SSL_set0_wbio(serverssl, tmp);
  7364. tmp = NULL;
  7365. /* Third server shutdown should send close_notify */
  7366. if (!TEST_int_eq(SSL_shutdown(serverssl), 0))
  7367. goto end;
  7368. /* Fourth server shutdown should read close_notify from client and finish */
  7369. if (!TEST_int_eq(SSL_shutdown(serverssl), 1))
  7370. goto end;
  7371. /* Client should also successfully fully shutdown */
  7372. if (!TEST_int_eq(SSL_shutdown(clientssl), 1))
  7373. goto end;
  7374. testresult = 1;
  7375. end:
  7376. SSL_free(serverssl);
  7377. SSL_free(clientssl);
  7378. SSL_CTX_free(sctx);
  7379. SSL_CTX_free(cctx);
  7380. BIO_free(bretry);
  7381. BIO_free(tmp);
  7382. return testresult;
  7383. }
  7384. #if !defined(OPENSSL_NO_TLS1_2) || !defined(OSSL_NO_USABLE_TLS1_3)
  7385. static int cert_cb_cnt;
  7386. static int cert_cb(SSL *s, void *arg)
  7387. {
  7388. SSL_CTX *ctx = (SSL_CTX *)arg;
  7389. BIO *in = NULL;
  7390. EVP_PKEY *pkey = NULL;
  7391. X509 *x509 = NULL, *rootx = NULL;
  7392. STACK_OF(X509) *chain = NULL;
  7393. char *rootfile = NULL, *ecdsacert = NULL, *ecdsakey = NULL;
  7394. int ret = 0;
  7395. if (cert_cb_cnt == 0) {
  7396. /* Suspend the handshake */
  7397. cert_cb_cnt++;
  7398. return -1;
  7399. } else if (cert_cb_cnt == 1) {
  7400. /*
  7401. * Update the SSL_CTX, set the certificate and private key and then
  7402. * continue the handshake normally.
  7403. */
  7404. if (ctx != NULL && !TEST_ptr(SSL_set_SSL_CTX(s, ctx)))
  7405. return 0;
  7406. if (!TEST_true(SSL_use_certificate_file(s, cert, SSL_FILETYPE_PEM))
  7407. || !TEST_true(SSL_use_PrivateKey_file(s, privkey,
  7408. SSL_FILETYPE_PEM))
  7409. || !TEST_true(SSL_check_private_key(s)))
  7410. return 0;
  7411. cert_cb_cnt++;
  7412. return 1;
  7413. } else if (cert_cb_cnt == 3) {
  7414. int rv;
  7415. rootfile = test_mk_file_path(certsdir, "rootcert.pem");
  7416. ecdsacert = test_mk_file_path(certsdir, "server-ecdsa-cert.pem");
  7417. ecdsakey = test_mk_file_path(certsdir, "server-ecdsa-key.pem");
  7418. if (!TEST_ptr(rootfile) || !TEST_ptr(ecdsacert) || !TEST_ptr(ecdsakey))
  7419. goto out;
  7420. chain = sk_X509_new_null();
  7421. if (!TEST_ptr(chain))
  7422. goto out;
  7423. if (!TEST_ptr(in = BIO_new(BIO_s_file()))
  7424. || !TEST_int_gt(BIO_read_filename(in, rootfile), 0)
  7425. || !TEST_ptr(rootx = X509_new_ex(libctx, NULL))
  7426. || !TEST_ptr(PEM_read_bio_X509(in, &rootx, NULL, NULL))
  7427. || !TEST_true(sk_X509_push(chain, rootx)))
  7428. goto out;
  7429. rootx = NULL;
  7430. BIO_free(in);
  7431. if (!TEST_ptr(in = BIO_new(BIO_s_file()))
  7432. || !TEST_int_gt(BIO_read_filename(in, ecdsacert), 0)
  7433. || !TEST_ptr(x509 = X509_new_ex(libctx, NULL))
  7434. || !TEST_ptr(PEM_read_bio_X509(in, &x509, NULL, NULL)))
  7435. goto out;
  7436. BIO_free(in);
  7437. if (!TEST_ptr(in = BIO_new(BIO_s_file()))
  7438. || !TEST_int_gt(BIO_read_filename(in, ecdsakey), 0)
  7439. || !TEST_ptr(pkey = PEM_read_bio_PrivateKey_ex(in, NULL,
  7440. NULL, NULL,
  7441. libctx, NULL)))
  7442. goto out;
  7443. rv = SSL_check_chain(s, x509, pkey, chain);
  7444. /*
  7445. * If the cert doesn't show as valid here (e.g., because we don't
  7446. * have any shared sigalgs), then we will not set it, and there will
  7447. * be no certificate at all on the SSL or SSL_CTX. This, in turn,
  7448. * will cause tls_choose_sigalgs() to fail the connection.
  7449. */
  7450. if ((rv & (CERT_PKEY_VALID | CERT_PKEY_CA_SIGNATURE))
  7451. == (CERT_PKEY_VALID | CERT_PKEY_CA_SIGNATURE)) {
  7452. if (!SSL_use_cert_and_key(s, x509, pkey, NULL, 1))
  7453. goto out;
  7454. }
  7455. ret = 1;
  7456. }
  7457. /* Abort the handshake */
  7458. out:
  7459. OPENSSL_free(ecdsacert);
  7460. OPENSSL_free(ecdsakey);
  7461. OPENSSL_free(rootfile);
  7462. BIO_free(in);
  7463. EVP_PKEY_free(pkey);
  7464. X509_free(x509);
  7465. X509_free(rootx);
  7466. OSSL_STACK_OF_X509_free(chain);
  7467. return ret;
  7468. }
  7469. /*
  7470. * Test the certificate callback.
  7471. * Test 0: Callback fails
  7472. * Test 1: Success - no SSL_set_SSL_CTX() in the callback
  7473. * Test 2: Success - SSL_set_SSL_CTX() in the callback
  7474. * Test 3: Success - Call SSL_check_chain from the callback
  7475. * Test 4: Failure - SSL_check_chain fails from callback due to bad cert in the
  7476. * chain
  7477. * Test 5: Failure - SSL_check_chain fails from callback due to bad ee cert
  7478. */
  7479. static int test_cert_cb_int(int prot, int tst)
  7480. {
  7481. SSL_CTX *cctx = NULL, *sctx = NULL, *snictx = NULL;
  7482. SSL *clientssl = NULL, *serverssl = NULL;
  7483. int testresult = 0, ret;
  7484. #ifdef OPENSSL_NO_EC
  7485. /* We use an EC cert in these tests, so we skip in a no-ec build */
  7486. if (tst >= 3)
  7487. return 1;
  7488. #endif
  7489. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7490. TLS_client_method(),
  7491. TLS1_VERSION,
  7492. prot,
  7493. &sctx, &cctx, NULL, NULL)))
  7494. goto end;
  7495. if (tst == 0)
  7496. cert_cb_cnt = -1;
  7497. else if (tst >= 3)
  7498. cert_cb_cnt = 3;
  7499. else
  7500. cert_cb_cnt = 0;
  7501. if (tst == 2) {
  7502. snictx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
  7503. if (!TEST_ptr(snictx))
  7504. goto end;
  7505. }
  7506. SSL_CTX_set_cert_cb(sctx, cert_cb, snictx);
  7507. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7508. NULL, NULL)))
  7509. goto end;
  7510. if (tst == 4) {
  7511. /*
  7512. * We cause SSL_check_chain() to fail by specifying sig_algs that
  7513. * the chain doesn't meet (the root uses an RSA cert)
  7514. */
  7515. if (!TEST_true(SSL_set1_sigalgs_list(clientssl,
  7516. "ecdsa_secp256r1_sha256")))
  7517. goto end;
  7518. } else if (tst == 5) {
  7519. /*
  7520. * We cause SSL_check_chain() to fail by specifying sig_algs that
  7521. * the ee cert doesn't meet (the ee uses an ECDSA cert)
  7522. */
  7523. if (!TEST_true(SSL_set1_sigalgs_list(clientssl,
  7524. "rsa_pss_rsae_sha256:rsa_pkcs1_sha256")))
  7525. goto end;
  7526. }
  7527. ret = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE);
  7528. if (!TEST_true(tst == 0 || tst == 4 || tst == 5 ? !ret : ret)
  7529. || (tst > 0
  7530. && !TEST_int_eq((cert_cb_cnt - 2) * (cert_cb_cnt - 3), 0))) {
  7531. goto end;
  7532. }
  7533. testresult = 1;
  7534. end:
  7535. SSL_free(serverssl);
  7536. SSL_free(clientssl);
  7537. SSL_CTX_free(sctx);
  7538. SSL_CTX_free(cctx);
  7539. SSL_CTX_free(snictx);
  7540. return testresult;
  7541. }
  7542. #endif
  7543. static int test_cert_cb(int tst)
  7544. {
  7545. int testresult = 1;
  7546. #ifndef OPENSSL_NO_TLS1_2
  7547. testresult &= test_cert_cb_int(TLS1_2_VERSION, tst);
  7548. #endif
  7549. #ifndef OSSL_NO_USABLE_TLS1_3
  7550. testresult &= test_cert_cb_int(TLS1_3_VERSION, tst);
  7551. #endif
  7552. return testresult;
  7553. }
  7554. static int client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
  7555. {
  7556. X509 *xcert;
  7557. EVP_PKEY *privpkey;
  7558. BIO *in = NULL;
  7559. BIO *priv_in = NULL;
  7560. /* Check that SSL_get0_peer_certificate() returns something sensible */
  7561. if (!TEST_ptr(SSL_get0_peer_certificate(ssl)))
  7562. return 0;
  7563. in = BIO_new_file(cert, "r");
  7564. if (!TEST_ptr(in))
  7565. return 0;
  7566. if (!TEST_ptr(xcert = X509_new_ex(libctx, NULL))
  7567. || !TEST_ptr(PEM_read_bio_X509(in, &xcert, NULL, NULL))
  7568. || !TEST_ptr(priv_in = BIO_new_file(privkey, "r"))
  7569. || !TEST_ptr(privpkey = PEM_read_bio_PrivateKey_ex(priv_in, NULL,
  7570. NULL, NULL,
  7571. libctx, NULL)))
  7572. goto err;
  7573. *x509 = xcert;
  7574. *pkey = privpkey;
  7575. BIO_free(in);
  7576. BIO_free(priv_in);
  7577. return 1;
  7578. err:
  7579. X509_free(xcert);
  7580. BIO_free(in);
  7581. BIO_free(priv_in);
  7582. return 0;
  7583. }
  7584. static int test_client_cert_cb(int tst)
  7585. {
  7586. SSL_CTX *cctx = NULL, *sctx = NULL;
  7587. SSL *clientssl = NULL, *serverssl = NULL;
  7588. int testresult = 0;
  7589. #ifdef OPENSSL_NO_TLS1_2
  7590. if (tst == 0)
  7591. return 1;
  7592. #endif
  7593. #ifdef OSSL_NO_USABLE_TLS1_3
  7594. if (tst == 1)
  7595. return 1;
  7596. #endif
  7597. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7598. TLS_client_method(),
  7599. TLS1_VERSION,
  7600. tst == 0 ? TLS1_2_VERSION
  7601. : TLS1_3_VERSION,
  7602. &sctx, &cctx, cert, privkey)))
  7603. goto end;
  7604. /*
  7605. * Test that setting a client_cert_cb results in a client certificate being
  7606. * sent.
  7607. */
  7608. SSL_CTX_set_client_cert_cb(cctx, client_cert_cb);
  7609. SSL_CTX_set_verify(sctx,
  7610. SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
  7611. verify_cb);
  7612. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7613. NULL, NULL))
  7614. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  7615. SSL_ERROR_NONE)))
  7616. goto end;
  7617. testresult = 1;
  7618. end:
  7619. SSL_free(serverssl);
  7620. SSL_free(clientssl);
  7621. SSL_CTX_free(sctx);
  7622. SSL_CTX_free(cctx);
  7623. return testresult;
  7624. }
  7625. #if !defined(OPENSSL_NO_TLS1_2) || !defined(OSSL_NO_USABLE_TLS1_3)
  7626. /*
  7627. * Test setting certificate authorities on both client and server.
  7628. *
  7629. * Test 0: SSL_CTX_set0_CA_list() only
  7630. * Test 1: Both SSL_CTX_set0_CA_list() and SSL_CTX_set_client_CA_list()
  7631. * Test 2: Only SSL_CTX_set_client_CA_list()
  7632. */
  7633. static int test_ca_names_int(int prot, int tst)
  7634. {
  7635. SSL_CTX *cctx = NULL, *sctx = NULL;
  7636. SSL *clientssl = NULL, *serverssl = NULL;
  7637. int testresult = 0;
  7638. size_t i;
  7639. X509_NAME *name[] = { NULL, NULL, NULL, NULL };
  7640. char *strnames[] = { "Jack", "Jill", "John", "Joanne" };
  7641. STACK_OF(X509_NAME) *sk1 = NULL, *sk2 = NULL;
  7642. const STACK_OF(X509_NAME) *sktmp = NULL;
  7643. for (i = 0; i < OSSL_NELEM(name); i++) {
  7644. name[i] = X509_NAME_new();
  7645. if (!TEST_ptr(name[i])
  7646. || !TEST_true(X509_NAME_add_entry_by_txt(name[i], "CN",
  7647. MBSTRING_ASC,
  7648. (unsigned char *)
  7649. strnames[i],
  7650. -1, -1, 0)))
  7651. goto end;
  7652. }
  7653. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7654. TLS_client_method(),
  7655. TLS1_VERSION,
  7656. prot,
  7657. &sctx, &cctx, cert, privkey)))
  7658. goto end;
  7659. SSL_CTX_set_verify(sctx, SSL_VERIFY_PEER, NULL);
  7660. if (tst == 0 || tst == 1) {
  7661. if (!TEST_ptr(sk1 = sk_X509_NAME_new_null())
  7662. || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[0])))
  7663. || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[1])))
  7664. || !TEST_ptr(sk2 = sk_X509_NAME_new_null())
  7665. || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[0])))
  7666. || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[1]))))
  7667. goto end;
  7668. SSL_CTX_set0_CA_list(sctx, sk1);
  7669. SSL_CTX_set0_CA_list(cctx, sk2);
  7670. sk1 = sk2 = NULL;
  7671. }
  7672. if (tst == 1 || tst == 2) {
  7673. if (!TEST_ptr(sk1 = sk_X509_NAME_new_null())
  7674. || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[2])))
  7675. || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[3])))
  7676. || !TEST_ptr(sk2 = sk_X509_NAME_new_null())
  7677. || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[2])))
  7678. || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[3]))))
  7679. goto end;
  7680. SSL_CTX_set_client_CA_list(sctx, sk1);
  7681. SSL_CTX_set_client_CA_list(cctx, sk2);
  7682. sk1 = sk2 = NULL;
  7683. }
  7684. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7685. NULL, NULL))
  7686. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  7687. SSL_ERROR_NONE)))
  7688. goto end;
  7689. /*
  7690. * We only expect certificate authorities to have been sent to the server
  7691. * if we are using TLSv1.3 and SSL_set0_CA_list() was used
  7692. */
  7693. sktmp = SSL_get0_peer_CA_list(serverssl);
  7694. if (prot == TLS1_3_VERSION
  7695. && (tst == 0 || tst == 1)) {
  7696. if (!TEST_ptr(sktmp)
  7697. || !TEST_int_eq(sk_X509_NAME_num(sktmp), 2)
  7698. || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 0),
  7699. name[0]), 0)
  7700. || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 1),
  7701. name[1]), 0))
  7702. goto end;
  7703. } else if (!TEST_ptr_null(sktmp)) {
  7704. goto end;
  7705. }
  7706. /*
  7707. * In all tests we expect certificate authorities to have been sent to the
  7708. * client. However, SSL_set_client_CA_list() should override
  7709. * SSL_set0_CA_list()
  7710. */
  7711. sktmp = SSL_get0_peer_CA_list(clientssl);
  7712. if (!TEST_ptr(sktmp)
  7713. || !TEST_int_eq(sk_X509_NAME_num(sktmp), 2)
  7714. || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 0),
  7715. name[tst == 0 ? 0 : 2]), 0)
  7716. || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 1),
  7717. name[tst == 0 ? 1 : 3]), 0))
  7718. goto end;
  7719. testresult = 1;
  7720. end:
  7721. SSL_free(serverssl);
  7722. SSL_free(clientssl);
  7723. SSL_CTX_free(sctx);
  7724. SSL_CTX_free(cctx);
  7725. for (i = 0; i < OSSL_NELEM(name); i++)
  7726. X509_NAME_free(name[i]);
  7727. sk_X509_NAME_pop_free(sk1, X509_NAME_free);
  7728. sk_X509_NAME_pop_free(sk2, X509_NAME_free);
  7729. return testresult;
  7730. }
  7731. #endif
  7732. static int test_ca_names(int tst)
  7733. {
  7734. int testresult = 1;
  7735. #ifndef OPENSSL_NO_TLS1_2
  7736. testresult &= test_ca_names_int(TLS1_2_VERSION, tst);
  7737. #endif
  7738. #ifndef OSSL_NO_USABLE_TLS1_3
  7739. testresult &= test_ca_names_int(TLS1_3_VERSION, tst);
  7740. #endif
  7741. return testresult;
  7742. }
  7743. #ifndef OPENSSL_NO_TLS1_2
  7744. static const char *multiblock_cipherlist_data[]=
  7745. {
  7746. "AES128-SHA",
  7747. "AES128-SHA256",
  7748. "AES256-SHA",
  7749. "AES256-SHA256",
  7750. };
  7751. /* Reduce the fragment size - so the multiblock test buffer can be small */
  7752. # define MULTIBLOCK_FRAGSIZE 512
  7753. static int test_multiblock_write(int test_index)
  7754. {
  7755. static const char *fetchable_ciphers[]=
  7756. {
  7757. "AES-128-CBC-HMAC-SHA1",
  7758. "AES-128-CBC-HMAC-SHA256",
  7759. "AES-256-CBC-HMAC-SHA1",
  7760. "AES-256-CBC-HMAC-SHA256"
  7761. };
  7762. const char *cipherlist = multiblock_cipherlist_data[test_index];
  7763. const SSL_METHOD *smeth = TLS_server_method();
  7764. const SSL_METHOD *cmeth = TLS_client_method();
  7765. int min_version = TLS1_VERSION;
  7766. int max_version = TLS1_2_VERSION; /* Don't select TLS1_3 */
  7767. SSL_CTX *cctx = NULL, *sctx = NULL;
  7768. SSL *clientssl = NULL, *serverssl = NULL;
  7769. int testresult = 0;
  7770. /*
  7771. * Choose a buffer large enough to perform a multi-block operation
  7772. * i.e: write_len >= 4 * frag_size
  7773. * 9 * is chosen so that multiple multiblocks are used + some leftover.
  7774. */
  7775. unsigned char msg[MULTIBLOCK_FRAGSIZE * 9];
  7776. unsigned char buf[sizeof(msg)], *p = buf;
  7777. size_t readbytes, written, len;
  7778. EVP_CIPHER *ciph = NULL;
  7779. /*
  7780. * Check if the cipher exists before attempting to use it since it only has
  7781. * a hardware specific implementation.
  7782. */
  7783. ciph = EVP_CIPHER_fetch(libctx, fetchable_ciphers[test_index], "");
  7784. if (ciph == NULL) {
  7785. TEST_skip("Multiblock cipher is not available for %s", cipherlist);
  7786. return 1;
  7787. }
  7788. EVP_CIPHER_free(ciph);
  7789. /* Set up a buffer with some data that will be sent to the client */
  7790. RAND_bytes(msg, sizeof(msg));
  7791. if (!TEST_true(create_ssl_ctx_pair(libctx, smeth, cmeth, min_version,
  7792. max_version, &sctx, &cctx, cert,
  7793. privkey)))
  7794. goto end;
  7795. if (!TEST_true(SSL_CTX_set_max_send_fragment(sctx, MULTIBLOCK_FRAGSIZE)))
  7796. goto end;
  7797. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7798. NULL, NULL)))
  7799. goto end;
  7800. /* settings to force it to use AES-CBC-HMAC_SHA */
  7801. SSL_set_options(serverssl, SSL_OP_NO_ENCRYPT_THEN_MAC);
  7802. if (!TEST_true(SSL_CTX_set_cipher_list(cctx, cipherlist)))
  7803. goto end;
  7804. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  7805. goto end;
  7806. if (!TEST_true(SSL_write_ex(serverssl, msg, sizeof(msg), &written))
  7807. || !TEST_size_t_eq(written, sizeof(msg)))
  7808. goto end;
  7809. len = written;
  7810. while (len > 0) {
  7811. if (!TEST_true(SSL_read_ex(clientssl, p, MULTIBLOCK_FRAGSIZE, &readbytes)))
  7812. goto end;
  7813. p += readbytes;
  7814. len -= readbytes;
  7815. }
  7816. if (!TEST_mem_eq(msg, sizeof(msg), buf, sizeof(buf)))
  7817. goto end;
  7818. testresult = 1;
  7819. end:
  7820. SSL_free(serverssl);
  7821. SSL_free(clientssl);
  7822. SSL_CTX_free(sctx);
  7823. SSL_CTX_free(cctx);
  7824. return testresult;
  7825. }
  7826. #endif /* OPENSSL_NO_TLS1_2 */
  7827. static int test_session_timeout(int test)
  7828. {
  7829. /*
  7830. * Test session ordering and timeout
  7831. * Can't explicitly test performance of the new code,
  7832. * but can test to see if the ordering of the sessions
  7833. * are correct, and they are removed as expected
  7834. */
  7835. SSL_SESSION *early = NULL;
  7836. SSL_SESSION *middle = NULL;
  7837. SSL_SESSION *late = NULL;
  7838. SSL_CTX *ctx;
  7839. int testresult = 0;
  7840. long now = (long)time(NULL);
  7841. #define TIMEOUT 10
  7842. if (!TEST_ptr(ctx = SSL_CTX_new_ex(libctx, NULL, TLS_method()))
  7843. || !TEST_ptr(early = SSL_SESSION_new())
  7844. || !TEST_ptr(middle = SSL_SESSION_new())
  7845. || !TEST_ptr(late = SSL_SESSION_new()))
  7846. goto end;
  7847. /* assign unique session ids */
  7848. early->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
  7849. memset(early->session_id, 1, SSL3_SSL_SESSION_ID_LENGTH);
  7850. middle->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
  7851. memset(middle->session_id, 2, SSL3_SSL_SESSION_ID_LENGTH);
  7852. late->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
  7853. memset(late->session_id, 3, SSL3_SSL_SESSION_ID_LENGTH);
  7854. if (!TEST_int_eq(SSL_CTX_add_session(ctx, early), 1)
  7855. || !TEST_int_eq(SSL_CTX_add_session(ctx, middle), 1)
  7856. || !TEST_int_eq(SSL_CTX_add_session(ctx, late), 1))
  7857. goto end;
  7858. /* Make sure they are all added */
  7859. if (!TEST_ptr(early->prev)
  7860. || !TEST_ptr(middle->prev)
  7861. || !TEST_ptr(late->prev))
  7862. goto end;
  7863. if (!TEST_int_ne(SSL_SESSION_set_time(early, now - 10), 0)
  7864. || !TEST_int_ne(SSL_SESSION_set_time(middle, now), 0)
  7865. || !TEST_int_ne(SSL_SESSION_set_time(late, now + 10), 0))
  7866. goto end;
  7867. if (!TEST_int_ne(SSL_SESSION_set_timeout(early, TIMEOUT), 0)
  7868. || !TEST_int_ne(SSL_SESSION_set_timeout(middle, TIMEOUT), 0)
  7869. || !TEST_int_ne(SSL_SESSION_set_timeout(late, TIMEOUT), 0))
  7870. goto end;
  7871. /* Make sure they are all still there */
  7872. if (!TEST_ptr(early->prev)
  7873. || !TEST_ptr(middle->prev)
  7874. || !TEST_ptr(late->prev))
  7875. goto end;
  7876. /* Make sure they are in the expected order */
  7877. if (!TEST_ptr_eq(late->next, middle)
  7878. || !TEST_ptr_eq(middle->next, early)
  7879. || !TEST_ptr_eq(early->prev, middle)
  7880. || !TEST_ptr_eq(middle->prev, late))
  7881. goto end;
  7882. /* This should remove "early" */
  7883. SSL_CTX_flush_sessions(ctx, now + TIMEOUT - 1);
  7884. if (!TEST_ptr_null(early->prev)
  7885. || !TEST_ptr(middle->prev)
  7886. || !TEST_ptr(late->prev))
  7887. goto end;
  7888. /* This should remove "middle" */
  7889. SSL_CTX_flush_sessions(ctx, now + TIMEOUT + 1);
  7890. if (!TEST_ptr_null(early->prev)
  7891. || !TEST_ptr_null(middle->prev)
  7892. || !TEST_ptr(late->prev))
  7893. goto end;
  7894. /* This should remove "late" */
  7895. SSL_CTX_flush_sessions(ctx, now + TIMEOUT + 11);
  7896. if (!TEST_ptr_null(early->prev)
  7897. || !TEST_ptr_null(middle->prev)
  7898. || !TEST_ptr_null(late->prev))
  7899. goto end;
  7900. /* Add them back in again */
  7901. if (!TEST_int_eq(SSL_CTX_add_session(ctx, early), 1)
  7902. || !TEST_int_eq(SSL_CTX_add_session(ctx, middle), 1)
  7903. || !TEST_int_eq(SSL_CTX_add_session(ctx, late), 1))
  7904. goto end;
  7905. /* Make sure they are all added */
  7906. if (!TEST_ptr(early->prev)
  7907. || !TEST_ptr(middle->prev)
  7908. || !TEST_ptr(late->prev))
  7909. goto end;
  7910. /* This should remove all of them */
  7911. SSL_CTX_flush_sessions(ctx, 0);
  7912. if (!TEST_ptr_null(early->prev)
  7913. || !TEST_ptr_null(middle->prev)
  7914. || !TEST_ptr_null(late->prev))
  7915. goto end;
  7916. (void)SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_UPDATE_TIME
  7917. | SSL_CTX_get_session_cache_mode(ctx));
  7918. /* make sure |now| is NOT equal to the current time */
  7919. now -= 10;
  7920. if (!TEST_int_ne(SSL_SESSION_set_time(early, now), 0)
  7921. || !TEST_int_eq(SSL_CTX_add_session(ctx, early), 1)
  7922. || !TEST_long_ne(SSL_SESSION_get_time(early), now))
  7923. goto end;
  7924. testresult = 1;
  7925. end:
  7926. SSL_CTX_free(ctx);
  7927. SSL_SESSION_free(early);
  7928. SSL_SESSION_free(middle);
  7929. SSL_SESSION_free(late);
  7930. return testresult;
  7931. }
  7932. /*
  7933. * Test 0: Client sets servername and server acknowledges it (TLSv1.2)
  7934. * Test 1: Client sets servername and server does not acknowledge it (TLSv1.2)
  7935. * Test 2: Client sets inconsistent servername on resumption (TLSv1.2)
  7936. * Test 3: Client does not set servername on initial handshake (TLSv1.2)
  7937. * Test 4: Client does not set servername on resumption handshake (TLSv1.2)
  7938. * Test 5: Client sets servername and server acknowledges it (TLSv1.3)
  7939. * Test 6: Client sets servername and server does not acknowledge it (TLSv1.3)
  7940. * Test 7: Client sets inconsistent servername on resumption (TLSv1.3)
  7941. * Test 8: Client does not set servername on initial handshake(TLSv1.3)
  7942. * Test 9: Client does not set servername on resumption handshake (TLSv1.3)
  7943. */
  7944. static int test_servername(int tst)
  7945. {
  7946. SSL_CTX *cctx = NULL, *sctx = NULL;
  7947. SSL *clientssl = NULL, *serverssl = NULL;
  7948. int testresult = 0;
  7949. SSL_SESSION *sess = NULL;
  7950. const char *sexpectedhost = NULL, *cexpectedhost = NULL;
  7951. #ifdef OPENSSL_NO_TLS1_2
  7952. if (tst <= 4)
  7953. return 1;
  7954. #endif
  7955. #ifdef OSSL_NO_USABLE_TLS1_3
  7956. if (tst >= 5)
  7957. return 1;
  7958. #endif
  7959. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7960. TLS_client_method(),
  7961. TLS1_VERSION,
  7962. (tst <= 4) ? TLS1_2_VERSION
  7963. : TLS1_3_VERSION,
  7964. &sctx, &cctx, cert, privkey))
  7965. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7966. NULL, NULL)))
  7967. goto end;
  7968. if (tst != 1 && tst != 6) {
  7969. if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx,
  7970. hostname_cb)))
  7971. goto end;
  7972. }
  7973. if (tst != 3 && tst != 8) {
  7974. if (!TEST_true(SSL_set_tlsext_host_name(clientssl, "goodhost")))
  7975. goto end;
  7976. sexpectedhost = cexpectedhost = "goodhost";
  7977. }
  7978. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  7979. goto end;
  7980. if (!TEST_str_eq(SSL_get_servername(clientssl, TLSEXT_NAMETYPE_host_name),
  7981. cexpectedhost)
  7982. || !TEST_str_eq(SSL_get_servername(serverssl,
  7983. TLSEXT_NAMETYPE_host_name),
  7984. sexpectedhost))
  7985. goto end;
  7986. /* Now repeat with a resumption handshake */
  7987. if (!TEST_int_eq(SSL_shutdown(clientssl), 0)
  7988. || !TEST_ptr_ne(sess = SSL_get1_session(clientssl), NULL)
  7989. || !TEST_true(SSL_SESSION_is_resumable(sess))
  7990. || !TEST_int_eq(SSL_shutdown(serverssl), 0))
  7991. goto end;
  7992. SSL_free(clientssl);
  7993. SSL_free(serverssl);
  7994. clientssl = serverssl = NULL;
  7995. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
  7996. NULL)))
  7997. goto end;
  7998. if (!TEST_true(SSL_set_session(clientssl, sess)))
  7999. goto end;
  8000. sexpectedhost = cexpectedhost = "goodhost";
  8001. if (tst == 2 || tst == 7) {
  8002. /* Set an inconsistent hostname */
  8003. if (!TEST_true(SSL_set_tlsext_host_name(clientssl, "altgoodhost")))
  8004. goto end;
  8005. /*
  8006. * In TLSv1.2 we expect the hostname from the original handshake, in
  8007. * TLSv1.3 we expect the hostname from this handshake
  8008. */
  8009. if (tst == 7)
  8010. sexpectedhost = cexpectedhost = "altgoodhost";
  8011. if (!TEST_str_eq(SSL_get_servername(clientssl,
  8012. TLSEXT_NAMETYPE_host_name),
  8013. "altgoodhost"))
  8014. goto end;
  8015. } else if (tst == 4 || tst == 9) {
  8016. /*
  8017. * A TLSv1.3 session does not associate a session with a servername,
  8018. * but a TLSv1.2 session does.
  8019. */
  8020. if (tst == 9)
  8021. sexpectedhost = cexpectedhost = NULL;
  8022. if (!TEST_str_eq(SSL_get_servername(clientssl,
  8023. TLSEXT_NAMETYPE_host_name),
  8024. cexpectedhost))
  8025. goto end;
  8026. } else {
  8027. if (!TEST_true(SSL_set_tlsext_host_name(clientssl, "goodhost")))
  8028. goto end;
  8029. /*
  8030. * In a TLSv1.2 resumption where the hostname was not acknowledged
  8031. * we expect the hostname on the server to be empty. On the client we
  8032. * return what was requested in this case.
  8033. *
  8034. * Similarly if the client didn't set a hostname on an original TLSv1.2
  8035. * session but is now, the server hostname will be empty, but the client
  8036. * is as we set it.
  8037. */
  8038. if (tst == 1 || tst == 3)
  8039. sexpectedhost = NULL;
  8040. if (!TEST_str_eq(SSL_get_servername(clientssl,
  8041. TLSEXT_NAMETYPE_host_name),
  8042. "goodhost"))
  8043. goto end;
  8044. }
  8045. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  8046. goto end;
  8047. if (!TEST_true(SSL_session_reused(clientssl))
  8048. || !TEST_true(SSL_session_reused(serverssl))
  8049. || !TEST_str_eq(SSL_get_servername(clientssl,
  8050. TLSEXT_NAMETYPE_host_name),
  8051. cexpectedhost)
  8052. || !TEST_str_eq(SSL_get_servername(serverssl,
  8053. TLSEXT_NAMETYPE_host_name),
  8054. sexpectedhost))
  8055. goto end;
  8056. testresult = 1;
  8057. end:
  8058. SSL_SESSION_free(sess);
  8059. SSL_free(serverssl);
  8060. SSL_free(clientssl);
  8061. SSL_CTX_free(sctx);
  8062. SSL_CTX_free(cctx);
  8063. return testresult;
  8064. }
  8065. #if !defined(OPENSSL_NO_EC) \
  8066. && (!defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2))
  8067. /*
  8068. * Test that if signature algorithms are not available, then we do not offer or
  8069. * accept them.
  8070. * Test 0: Two RSA sig algs available: both RSA sig algs shared
  8071. * Test 1: The client only has SHA2-256: only SHA2-256 algorithms shared
  8072. * Test 2: The server only has SHA2-256: only SHA2-256 algorithms shared
  8073. * Test 3: An RSA and an ECDSA sig alg available: both sig algs shared
  8074. * Test 4: The client only has an ECDSA sig alg: only ECDSA algorithms shared
  8075. * Test 5: The server only has an ECDSA sig alg: only ECDSA algorithms shared
  8076. */
  8077. static int test_sigalgs_available(int idx)
  8078. {
  8079. SSL_CTX *cctx = NULL, *sctx = NULL;
  8080. SSL *clientssl = NULL, *serverssl = NULL;
  8081. int testresult = 0;
  8082. OSSL_LIB_CTX *tmpctx = OSSL_LIB_CTX_new();
  8083. OSSL_LIB_CTX *clientctx = libctx, *serverctx = libctx;
  8084. OSSL_PROVIDER *filterprov = NULL;
  8085. int sig, hash;
  8086. if (!TEST_ptr(tmpctx))
  8087. goto end;
  8088. if (idx != 0 && idx != 3) {
  8089. if (!TEST_true(OSSL_PROVIDER_add_builtin(tmpctx, "filter",
  8090. filter_provider_init)))
  8091. goto end;
  8092. filterprov = OSSL_PROVIDER_load(tmpctx, "filter");
  8093. if (!TEST_ptr(filterprov))
  8094. goto end;
  8095. if (idx < 3) {
  8096. /*
  8097. * Only enable SHA2-256 so rsa_pss_rsae_sha384 should not be offered
  8098. * or accepted for the peer that uses this libctx. Note that libssl
  8099. * *requires* SHA2-256 to be available so we cannot disable that. We
  8100. * also need SHA1 for our certificate.
  8101. */
  8102. if (!TEST_true(filter_provider_set_filter(OSSL_OP_DIGEST,
  8103. "SHA2-256:SHA1")))
  8104. goto end;
  8105. } else {
  8106. if (!TEST_true(filter_provider_set_filter(OSSL_OP_SIGNATURE,
  8107. "ECDSA"))
  8108. # ifdef OPENSSL_NO_ECX
  8109. || !TEST_true(filter_provider_set_filter(OSSL_OP_KEYMGMT, "EC"))
  8110. # else
  8111. || !TEST_true(filter_provider_set_filter(OSSL_OP_KEYMGMT,
  8112. "EC:X25519:X448"))
  8113. # endif
  8114. )
  8115. goto end;
  8116. }
  8117. if (idx == 1 || idx == 4)
  8118. clientctx = tmpctx;
  8119. else
  8120. serverctx = tmpctx;
  8121. }
  8122. cctx = SSL_CTX_new_ex(clientctx, NULL, TLS_client_method());
  8123. sctx = SSL_CTX_new_ex(serverctx, NULL, TLS_server_method());
  8124. if (!TEST_ptr(cctx) || !TEST_ptr(sctx))
  8125. goto end;
  8126. if (idx != 5) {
  8127. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  8128. TLS_client_method(),
  8129. TLS1_VERSION,
  8130. 0,
  8131. &sctx, &cctx, cert, privkey)))
  8132. goto end;
  8133. } else {
  8134. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  8135. TLS_client_method(),
  8136. TLS1_VERSION,
  8137. 0,
  8138. &sctx, &cctx, cert2, privkey2)))
  8139. goto end;
  8140. }
  8141. /* Ensure we only use TLSv1.2 ciphersuites based on SHA256 */
  8142. if (idx < 4) {
  8143. if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
  8144. "ECDHE-RSA-AES128-GCM-SHA256")))
  8145. goto end;
  8146. } else {
  8147. if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
  8148. "ECDHE-ECDSA-AES128-GCM-SHA256")))
  8149. goto end;
  8150. }
  8151. if (idx < 3) {
  8152. if (!SSL_CTX_set1_sigalgs_list(cctx,
  8153. "rsa_pss_rsae_sha384"
  8154. ":rsa_pss_rsae_sha256")
  8155. || !SSL_CTX_set1_sigalgs_list(sctx,
  8156. "rsa_pss_rsae_sha384"
  8157. ":rsa_pss_rsae_sha256"))
  8158. goto end;
  8159. } else {
  8160. if (!SSL_CTX_set1_sigalgs_list(cctx, "rsa_pss_rsae_sha256:ECDSA+SHA256")
  8161. || !SSL_CTX_set1_sigalgs_list(sctx,
  8162. "rsa_pss_rsae_sha256:ECDSA+SHA256"))
  8163. goto end;
  8164. }
  8165. if (idx != 5
  8166. && (!TEST_int_eq(SSL_CTX_use_certificate_file(sctx, cert2,
  8167. SSL_FILETYPE_PEM), 1)
  8168. || !TEST_int_eq(SSL_CTX_use_PrivateKey_file(sctx,
  8169. privkey2,
  8170. SSL_FILETYPE_PEM), 1)
  8171. || !TEST_int_eq(SSL_CTX_check_private_key(sctx), 1)))
  8172. goto end;
  8173. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  8174. NULL, NULL)))
  8175. goto end;
  8176. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  8177. goto end;
  8178. /* For tests 0 and 3 we expect 2 shared sigalgs, otherwise exactly 1 */
  8179. if (!TEST_int_eq(SSL_get_shared_sigalgs(serverssl, 0, &sig, &hash, NULL,
  8180. NULL, NULL),
  8181. (idx == 0 || idx == 3) ? 2 : 1))
  8182. goto end;
  8183. if (!TEST_int_eq(hash, idx == 0 ? NID_sha384 : NID_sha256))
  8184. goto end;
  8185. if (!TEST_int_eq(sig, (idx == 4 || idx == 5) ? EVP_PKEY_EC
  8186. : NID_rsassaPss))
  8187. goto end;
  8188. testresult = filter_provider_check_clean_finish();
  8189. end:
  8190. SSL_free(serverssl);
  8191. SSL_free(clientssl);
  8192. SSL_CTX_free(sctx);
  8193. SSL_CTX_free(cctx);
  8194. OSSL_PROVIDER_unload(filterprov);
  8195. OSSL_LIB_CTX_free(tmpctx);
  8196. return testresult;
  8197. }
  8198. #endif /*
  8199. * !defined(OPENSSL_NO_EC) \
  8200. * && (!defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2))
  8201. */
  8202. #ifndef OPENSSL_NO_TLS1_3
  8203. /* This test can run in TLSv1.3 even if ec and dh are disabled */
  8204. static int test_pluggable_group(int idx)
  8205. {
  8206. SSL_CTX *cctx = NULL, *sctx = NULL;
  8207. SSL *clientssl = NULL, *serverssl = NULL;
  8208. int testresult = 0;
  8209. OSSL_PROVIDER *tlsprov = OSSL_PROVIDER_load(libctx, "tls-provider");
  8210. /* Check that we are not impacted by a provider without any groups */
  8211. OSSL_PROVIDER *legacyprov = OSSL_PROVIDER_load(libctx, "legacy");
  8212. const char *group_name = idx == 0 ? "xorgroup" : "xorkemgroup";
  8213. if (!TEST_ptr(tlsprov))
  8214. goto end;
  8215. if (legacyprov == NULL) {
  8216. /*
  8217. * In this case we assume we've been built with "no-legacy" and skip
  8218. * this test (there is no OPENSSL_NO_LEGACY)
  8219. */
  8220. testresult = 1;
  8221. goto end;
  8222. }
  8223. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  8224. TLS_client_method(),
  8225. TLS1_3_VERSION,
  8226. TLS1_3_VERSION,
  8227. &sctx, &cctx, cert, privkey))
  8228. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  8229. NULL, NULL)))
  8230. goto end;
  8231. if (!TEST_true(SSL_set1_groups_list(serverssl, group_name))
  8232. || !TEST_true(SSL_set1_groups_list(clientssl, group_name)))
  8233. goto end;
  8234. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  8235. goto end;
  8236. if (!TEST_str_eq(group_name,
  8237. SSL_group_to_name(serverssl, SSL_get_shared_group(serverssl, 0))))
  8238. goto end;
  8239. if (!TEST_str_eq(group_name, SSL_get0_group_name(serverssl))
  8240. || !TEST_str_eq(group_name, SSL_get0_group_name(clientssl)))
  8241. goto end;
  8242. testresult = 1;
  8243. end:
  8244. SSL_free(serverssl);
  8245. SSL_free(clientssl);
  8246. SSL_CTX_free(sctx);
  8247. SSL_CTX_free(cctx);
  8248. OSSL_PROVIDER_unload(tlsprov);
  8249. OSSL_PROVIDER_unload(legacyprov);
  8250. return testresult;
  8251. }
  8252. /*
  8253. * This function triggers encode, decode and sign functions
  8254. * of the artificial "xorhmacsig" algorithm implemented in tls-provider
  8255. * creating private key and certificate files for use in TLS testing.
  8256. */
  8257. static int create_cert_key(int idx, char *certfilename, char *privkeyfilename)
  8258. {
  8259. EVP_PKEY_CTX *evpctx = EVP_PKEY_CTX_new_from_name(libctx,
  8260. (idx == 0) ? "xorhmacsig" : "xorhmacsha2sig", NULL);
  8261. EVP_PKEY *pkey = NULL;
  8262. X509 *x509 = X509_new();
  8263. X509_NAME *name = NULL;
  8264. BIO *keybio = NULL, *certbio = NULL;
  8265. int ret = 1;
  8266. if (!TEST_ptr(evpctx)
  8267. || !TEST_true(EVP_PKEY_keygen_init(evpctx))
  8268. || !TEST_true(EVP_PKEY_generate(evpctx, &pkey))
  8269. || !TEST_ptr(pkey)
  8270. || !TEST_ptr(x509)
  8271. || !TEST_true(ASN1_INTEGER_set(X509_get_serialNumber(x509), 1))
  8272. || !TEST_true(X509_gmtime_adj(X509_getm_notBefore(x509), 0))
  8273. || !TEST_true(X509_gmtime_adj(X509_getm_notAfter(x509), 31536000L))
  8274. || !TEST_true(X509_set_pubkey(x509, pkey))
  8275. || !TEST_ptr(name = X509_get_subject_name(x509))
  8276. || !TEST_true(X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC,
  8277. (unsigned char *)"CH", -1, -1, 0))
  8278. || !TEST_true(X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC,
  8279. (unsigned char *)"test.org", -1, -1, 0))
  8280. || !TEST_true(X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC,
  8281. (unsigned char *)"localhost", -1, -1, 0))
  8282. || !TEST_true(X509_set_issuer_name(x509, name))
  8283. || !TEST_true(X509_sign(x509, pkey, EVP_sha1()))
  8284. || !TEST_ptr(keybio = BIO_new_file(privkeyfilename, "wb"))
  8285. || !TEST_true(PEM_write_bio_PrivateKey(keybio, pkey, NULL, NULL, 0, NULL, NULL))
  8286. || !TEST_ptr(certbio = BIO_new_file(certfilename, "wb"))
  8287. || !TEST_true(PEM_write_bio_X509(certbio, x509)))
  8288. ret = 0;
  8289. EVP_PKEY_free(pkey);
  8290. X509_free(x509);
  8291. EVP_PKEY_CTX_free(evpctx);
  8292. BIO_free(keybio);
  8293. BIO_free(certbio);
  8294. return ret;
  8295. }
  8296. /*
  8297. * Test that signature algorithms loaded via the provider interface can
  8298. * correctly establish a TLS (1.3) connection.
  8299. * Test 0: Signature algorithm with built-in hashing functionality: "xorhmacsig"
  8300. * Test 1: Signature algorithm using external SHA2 hashing: "xorhmacsha2sig"
  8301. * Test 2: Test 0 using RPK
  8302. * Test 3: Test 1 using RPK
  8303. */
  8304. static int test_pluggable_signature(int idx)
  8305. {
  8306. static const unsigned char cert_type_rpk[] = { TLSEXT_cert_type_rpk, TLSEXT_cert_type_x509 };
  8307. SSL_CTX *cctx = NULL, *sctx = NULL;
  8308. SSL *clientssl = NULL, *serverssl = NULL;
  8309. int testresult = 0;
  8310. OSSL_PROVIDER *tlsprov = OSSL_PROVIDER_load(libctx, "tls-provider");
  8311. OSSL_PROVIDER *defaultprov = OSSL_PROVIDER_load(libctx, "default");
  8312. char *certfilename = "tls-prov-cert.pem";
  8313. char *privkeyfilename = "tls-prov-key.pem";
  8314. int sigidx = idx % 2;
  8315. int rpkidx = idx / 2;
  8316. /* create key and certificate for the different algorithm types */
  8317. if (!TEST_ptr(tlsprov)
  8318. || !TEST_true(create_cert_key(sigidx, certfilename, privkeyfilename)))
  8319. goto end;
  8320. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  8321. TLS_client_method(),
  8322. TLS1_3_VERSION,
  8323. TLS1_3_VERSION,
  8324. &sctx, &cctx, certfilename, privkeyfilename))
  8325. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  8326. NULL, NULL)))
  8327. goto end;
  8328. /* Enable RPK for server cert */
  8329. if (rpkidx) {
  8330. if (!TEST_true(SSL_set1_server_cert_type(serverssl, cert_type_rpk, sizeof(cert_type_rpk)))
  8331. || !TEST_true(SSL_set1_server_cert_type(clientssl, cert_type_rpk, sizeof(cert_type_rpk))))
  8332. goto end;
  8333. }
  8334. /* This is necessary to pass minimal setup w/o other groups configured */
  8335. if (!TEST_true(SSL_set1_groups_list(serverssl, "xorgroup"))
  8336. || !TEST_true(SSL_set1_groups_list(clientssl, "xorgroup")))
  8337. goto end;
  8338. /*
  8339. * If this connection gets established, it must have been completed
  8340. * via the tls-provider-implemented "hmacsig" algorithm, testing
  8341. * both sign and verify functions during handshake.
  8342. */
  8343. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  8344. goto end;
  8345. /* If using RPK, make sure we got one */
  8346. if (rpkidx && !TEST_long_eq(SSL_get_verify_result(clientssl), X509_V_ERR_RPK_UNTRUSTED))
  8347. goto end;
  8348. testresult = 1;
  8349. end:
  8350. SSL_free(serverssl);
  8351. SSL_free(clientssl);
  8352. SSL_CTX_free(sctx);
  8353. SSL_CTX_free(cctx);
  8354. OSSL_PROVIDER_unload(tlsprov);
  8355. OSSL_PROVIDER_unload(defaultprov);
  8356. return testresult;
  8357. }
  8358. #endif
  8359. #ifndef OPENSSL_NO_TLS1_2
  8360. static int test_ssl_dup(void)
  8361. {
  8362. SSL_CTX *cctx = NULL, *sctx = NULL;
  8363. SSL *clientssl = NULL, *serverssl = NULL, *client2ssl = NULL;
  8364. int testresult = 0;
  8365. BIO *rbio = NULL, *wbio = NULL;
  8366. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  8367. TLS_client_method(),
  8368. 0,
  8369. 0,
  8370. &sctx, &cctx, cert, privkey)))
  8371. goto end;
  8372. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  8373. NULL, NULL)))
  8374. goto end;
  8375. if (!TEST_true(SSL_set_min_proto_version(clientssl, TLS1_2_VERSION))
  8376. || !TEST_true(SSL_set_max_proto_version(clientssl, TLS1_2_VERSION)))
  8377. goto end;
  8378. client2ssl = SSL_dup(clientssl);
  8379. rbio = SSL_get_rbio(clientssl);
  8380. if (!TEST_ptr(rbio)
  8381. || !TEST_true(BIO_up_ref(rbio)))
  8382. goto end;
  8383. SSL_set0_rbio(client2ssl, rbio);
  8384. rbio = NULL;
  8385. wbio = SSL_get_wbio(clientssl);
  8386. if (!TEST_ptr(wbio) || !TEST_true(BIO_up_ref(wbio)))
  8387. goto end;
  8388. SSL_set0_wbio(client2ssl, wbio);
  8389. rbio = NULL;
  8390. if (!TEST_ptr(client2ssl)
  8391. /* Handshake not started so pointers should be different */
  8392. || !TEST_ptr_ne(clientssl, client2ssl))
  8393. goto end;
  8394. if (!TEST_int_eq(SSL_get_min_proto_version(client2ssl), TLS1_2_VERSION)
  8395. || !TEST_int_eq(SSL_get_max_proto_version(client2ssl), TLS1_2_VERSION))
  8396. goto end;
  8397. if (!TEST_true(create_ssl_connection(serverssl, client2ssl, SSL_ERROR_NONE)))
  8398. goto end;
  8399. SSL_free(clientssl);
  8400. clientssl = SSL_dup(client2ssl);
  8401. if (!TEST_ptr(clientssl)
  8402. /* Handshake has finished so pointers should be the same */
  8403. || !TEST_ptr_eq(clientssl, client2ssl))
  8404. goto end;
  8405. testresult = 1;
  8406. end:
  8407. SSL_free(serverssl);
  8408. SSL_free(clientssl);
  8409. SSL_free(client2ssl);
  8410. SSL_CTX_free(sctx);
  8411. SSL_CTX_free(cctx);
  8412. return testresult;
  8413. }
  8414. # ifndef OPENSSL_NO_DH
  8415. static EVP_PKEY *tmp_dh_params = NULL;
  8416. /* Helper function for the test_set_tmp_dh() tests */
  8417. static EVP_PKEY *get_tmp_dh_params(void)
  8418. {
  8419. if (tmp_dh_params == NULL) {
  8420. BIGNUM *p = NULL;
  8421. OSSL_PARAM_BLD *tmpl = NULL;
  8422. EVP_PKEY_CTX *pctx = NULL;
  8423. OSSL_PARAM *params = NULL;
  8424. EVP_PKEY *dhpkey = NULL;
  8425. p = BN_get_rfc3526_prime_2048(NULL);
  8426. if (!TEST_ptr(p))
  8427. goto end;
  8428. pctx = EVP_PKEY_CTX_new_from_name(libctx, "DH", NULL);
  8429. if (!TEST_ptr(pctx)
  8430. || !TEST_int_eq(EVP_PKEY_fromdata_init(pctx), 1))
  8431. goto end;
  8432. tmpl = OSSL_PARAM_BLD_new();
  8433. if (!TEST_ptr(tmpl)
  8434. || !TEST_true(OSSL_PARAM_BLD_push_BN(tmpl,
  8435. OSSL_PKEY_PARAM_FFC_P,
  8436. p))
  8437. || !TEST_true(OSSL_PARAM_BLD_push_uint(tmpl,
  8438. OSSL_PKEY_PARAM_FFC_G,
  8439. 2)))
  8440. goto end;
  8441. params = OSSL_PARAM_BLD_to_param(tmpl);
  8442. if (!TEST_ptr(params)
  8443. || !TEST_int_eq(EVP_PKEY_fromdata(pctx, &dhpkey,
  8444. EVP_PKEY_KEY_PARAMETERS,
  8445. params), 1))
  8446. goto end;
  8447. tmp_dh_params = dhpkey;
  8448. end:
  8449. BN_free(p);
  8450. EVP_PKEY_CTX_free(pctx);
  8451. OSSL_PARAM_BLD_free(tmpl);
  8452. OSSL_PARAM_free(params);
  8453. }
  8454. if (tmp_dh_params != NULL && !EVP_PKEY_up_ref(tmp_dh_params))
  8455. return NULL;
  8456. return tmp_dh_params;
  8457. }
  8458. # ifndef OPENSSL_NO_DEPRECATED_3_0
  8459. /* Callback used by test_set_tmp_dh() */
  8460. static DH *tmp_dh_callback(SSL *s, int is_export, int keylen)
  8461. {
  8462. EVP_PKEY *dhpkey = get_tmp_dh_params();
  8463. DH *ret = NULL;
  8464. if (!TEST_ptr(dhpkey))
  8465. return NULL;
  8466. /*
  8467. * libssl does not free the returned DH, so we free it now knowing that even
  8468. * after we free dhpkey, there will still be a reference to the owning
  8469. * EVP_PKEY in tmp_dh_params, and so the DH object will live for the length
  8470. * of time we need it for.
  8471. */
  8472. ret = EVP_PKEY_get1_DH(dhpkey);
  8473. DH_free(ret);
  8474. EVP_PKEY_free(dhpkey);
  8475. return ret;
  8476. }
  8477. # endif
  8478. /*
  8479. * Test the various methods for setting temporary DH parameters
  8480. *
  8481. * Test 0: Default (no auto) setting
  8482. * Test 1: Explicit SSL_CTX auto off
  8483. * Test 2: Explicit SSL auto off
  8484. * Test 3: Explicit SSL_CTX auto on
  8485. * Test 4: Explicit SSL auto on
  8486. * Test 5: Explicit SSL_CTX auto off, custom DH params via EVP_PKEY
  8487. * Test 6: Explicit SSL auto off, custom DH params via EVP_PKEY
  8488. *
  8489. * The following are testing deprecated APIs, so we only run them if available
  8490. * Test 7: Explicit SSL_CTX auto off, custom DH params via DH
  8491. * Test 8: Explicit SSL auto off, custom DH params via DH
  8492. * Test 9: Explicit SSL_CTX auto off, custom DH params via callback
  8493. * Test 10: Explicit SSL auto off, custom DH params via callback
  8494. */
  8495. static int test_set_tmp_dh(int idx)
  8496. {
  8497. SSL_CTX *cctx = NULL, *sctx = NULL;
  8498. SSL *clientssl = NULL, *serverssl = NULL;
  8499. int testresult = 0;
  8500. int dhauto = (idx == 3 || idx == 4) ? 1 : 0;
  8501. int expected = (idx <= 2) ? 0 : 1;
  8502. EVP_PKEY *dhpkey = NULL;
  8503. # ifndef OPENSSL_NO_DEPRECATED_3_0
  8504. DH *dh = NULL;
  8505. # else
  8506. if (idx >= 7)
  8507. return 1;
  8508. # endif
  8509. if (idx >= 5 && idx <= 8) {
  8510. dhpkey = get_tmp_dh_params();
  8511. if (!TEST_ptr(dhpkey))
  8512. goto end;
  8513. }
  8514. # ifndef OPENSSL_NO_DEPRECATED_3_0
  8515. if (idx == 7 || idx == 8) {
  8516. dh = EVP_PKEY_get1_DH(dhpkey);
  8517. if (!TEST_ptr(dh))
  8518. goto end;
  8519. }
  8520. # endif
  8521. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  8522. TLS_client_method(),
  8523. 0,
  8524. 0,
  8525. &sctx, &cctx, cert, privkey)))
  8526. goto end;
  8527. if ((idx & 1) == 1) {
  8528. if (!TEST_true(SSL_CTX_set_dh_auto(sctx, dhauto)))
  8529. goto end;
  8530. }
  8531. if (idx == 5) {
  8532. if (!TEST_true(SSL_CTX_set0_tmp_dh_pkey(sctx, dhpkey)))
  8533. goto end;
  8534. dhpkey = NULL;
  8535. }
  8536. # ifndef OPENSSL_NO_DEPRECATED_3_0
  8537. else if (idx == 7) {
  8538. if (!TEST_true(SSL_CTX_set_tmp_dh(sctx, dh)))
  8539. goto end;
  8540. } else if (idx == 9) {
  8541. SSL_CTX_set_tmp_dh_callback(sctx, tmp_dh_callback);
  8542. }
  8543. # endif
  8544. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  8545. NULL, NULL)))
  8546. goto end;
  8547. if ((idx & 1) == 0 && idx != 0) {
  8548. if (!TEST_true(SSL_set_dh_auto(serverssl, dhauto)))
  8549. goto end;
  8550. }
  8551. if (idx == 6) {
  8552. if (!TEST_true(SSL_set0_tmp_dh_pkey(serverssl, dhpkey)))
  8553. goto end;
  8554. dhpkey = NULL;
  8555. }
  8556. # ifndef OPENSSL_NO_DEPRECATED_3_0
  8557. else if (idx == 8) {
  8558. if (!TEST_true(SSL_set_tmp_dh(serverssl, dh)))
  8559. goto end;
  8560. } else if (idx == 10) {
  8561. SSL_set_tmp_dh_callback(serverssl, tmp_dh_callback);
  8562. }
  8563. # endif
  8564. if (!TEST_true(SSL_set_min_proto_version(serverssl, TLS1_2_VERSION))
  8565. || !TEST_true(SSL_set_max_proto_version(serverssl, TLS1_2_VERSION))
  8566. || !TEST_true(SSL_set_cipher_list(serverssl, "DHE-RSA-AES128-SHA")))
  8567. goto end;
  8568. /*
  8569. * If autoon then we should succeed. Otherwise we expect failure because
  8570. * there are no parameters
  8571. */
  8572. if (!TEST_int_eq(create_ssl_connection(serverssl, clientssl,
  8573. SSL_ERROR_NONE), expected))
  8574. goto end;
  8575. testresult = 1;
  8576. end:
  8577. # ifndef OPENSSL_NO_DEPRECATED_3_0
  8578. DH_free(dh);
  8579. # endif
  8580. SSL_free(serverssl);
  8581. SSL_free(clientssl);
  8582. SSL_CTX_free(sctx);
  8583. SSL_CTX_free(cctx);
  8584. EVP_PKEY_free(dhpkey);
  8585. return testresult;
  8586. }
  8587. /*
  8588. * Test the auto DH keys are appropriately sized
  8589. */
  8590. static int test_dh_auto(int idx)
  8591. {
  8592. SSL_CTX *cctx = SSL_CTX_new_ex(libctx, NULL, TLS_client_method());
  8593. SSL_CTX *sctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
  8594. SSL *clientssl = NULL, *serverssl = NULL;
  8595. int testresult = 0;
  8596. EVP_PKEY *tmpkey = NULL;
  8597. char *thiscert = NULL, *thiskey = NULL;
  8598. size_t expdhsize = 0;
  8599. const char *ciphersuite = "DHE-RSA-AES128-SHA";
  8600. if (!TEST_ptr(sctx) || !TEST_ptr(cctx))
  8601. goto end;
  8602. switch (idx) {
  8603. case 0:
  8604. /* The FIPS provider doesn't support this DH size - so we ignore it */
  8605. if (is_fips) {
  8606. testresult = 1;
  8607. goto end;
  8608. }
  8609. thiscert = cert1024;
  8610. thiskey = privkey1024;
  8611. expdhsize = 1024;
  8612. SSL_CTX_set_security_level(sctx, 1);
  8613. SSL_CTX_set_security_level(cctx, 1);
  8614. break;
  8615. case 1:
  8616. /* 2048 bit prime */
  8617. thiscert = cert;
  8618. thiskey = privkey;
  8619. expdhsize = 2048;
  8620. break;
  8621. case 2:
  8622. thiscert = cert3072;
  8623. thiskey = privkey3072;
  8624. expdhsize = 3072;
  8625. break;
  8626. case 3:
  8627. thiscert = cert4096;
  8628. thiskey = privkey4096;
  8629. expdhsize = 4096;
  8630. break;
  8631. case 4:
  8632. thiscert = cert8192;
  8633. thiskey = privkey8192;
  8634. expdhsize = 8192;
  8635. break;
  8636. /* No certificate cases */
  8637. case 5:
  8638. /* The FIPS provider doesn't support this DH size - so we ignore it */
  8639. if (is_fips) {
  8640. testresult = 1;
  8641. goto end;
  8642. }
  8643. ciphersuite = "ADH-AES128-SHA256:@SECLEVEL=0";
  8644. expdhsize = 1024;
  8645. break;
  8646. case 6:
  8647. ciphersuite = "ADH-AES256-SHA256:@SECLEVEL=0";
  8648. expdhsize = 3072;
  8649. break;
  8650. default:
  8651. TEST_error("Invalid text index");
  8652. goto end;
  8653. }
  8654. if (!TEST_true(create_ssl_ctx_pair(libctx, NULL,
  8655. NULL,
  8656. 0,
  8657. 0,
  8658. &sctx, &cctx, thiscert, thiskey)))
  8659. goto end;
  8660. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  8661. NULL, NULL)))
  8662. goto end;
  8663. if (!TEST_true(SSL_set_dh_auto(serverssl, 1))
  8664. || !TEST_true(SSL_set_min_proto_version(serverssl, TLS1_2_VERSION))
  8665. || !TEST_true(SSL_set_max_proto_version(serverssl, TLS1_2_VERSION))
  8666. || !TEST_true(SSL_set_cipher_list(serverssl, ciphersuite))
  8667. || !TEST_true(SSL_set_cipher_list(clientssl, ciphersuite)))
  8668. goto end;
  8669. /*
  8670. * Send the server's first flight. At this point the server has created the
  8671. * temporary DH key but hasn't finished using it yet. Once used it is
  8672. * removed, so we cannot test it.
  8673. */
  8674. if (!TEST_int_le(SSL_connect(clientssl), 0)
  8675. || !TEST_int_le(SSL_accept(serverssl), 0))
  8676. goto end;
  8677. if (!TEST_int_gt(SSL_get_tmp_key(serverssl, &tmpkey), 0))
  8678. goto end;
  8679. if (!TEST_size_t_eq(EVP_PKEY_get_bits(tmpkey), expdhsize))
  8680. goto end;
  8681. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  8682. goto end;
  8683. testresult = 1;
  8684. end:
  8685. SSL_free(serverssl);
  8686. SSL_free(clientssl);
  8687. SSL_CTX_free(sctx);
  8688. SSL_CTX_free(cctx);
  8689. EVP_PKEY_free(tmpkey);
  8690. return testresult;
  8691. }
  8692. # endif /* OPENSSL_NO_DH */
  8693. #endif /* OPENSSL_NO_TLS1_2 */
  8694. #ifndef OSSL_NO_USABLE_TLS1_3
  8695. /*
  8696. * Test that setting an SNI callback works with TLSv1.3. Specifically we check
  8697. * that it works even without a certificate configured for the original
  8698. * SSL_CTX
  8699. */
  8700. static int test_sni_tls13(void)
  8701. {
  8702. SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
  8703. SSL *clientssl = NULL, *serverssl = NULL;
  8704. int testresult = 0;
  8705. /* Reset callback counter */
  8706. snicb = 0;
  8707. /* Create an initial SSL_CTX with no certificate configured */
  8708. sctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
  8709. if (!TEST_ptr(sctx))
  8710. goto end;
  8711. /* Require TLSv1.3 as a minimum */
  8712. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  8713. TLS_client_method(), TLS1_3_VERSION, 0,
  8714. &sctx2, &cctx, cert, privkey)))
  8715. goto end;
  8716. /* Set up SNI */
  8717. if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx, sni_cb))
  8718. || !TEST_true(SSL_CTX_set_tlsext_servername_arg(sctx, sctx2)))
  8719. goto end;
  8720. /*
  8721. * Connection should still succeed because the final SSL_CTX has the right
  8722. * certificates configured.
  8723. */
  8724. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  8725. &clientssl, NULL, NULL))
  8726. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  8727. SSL_ERROR_NONE)))
  8728. goto end;
  8729. /* We should have had the SNI callback called exactly once */
  8730. if (!TEST_int_eq(snicb, 1))
  8731. goto end;
  8732. testresult = 1;
  8733. end:
  8734. SSL_free(serverssl);
  8735. SSL_free(clientssl);
  8736. SSL_CTX_free(sctx2);
  8737. SSL_CTX_free(sctx);
  8738. SSL_CTX_free(cctx);
  8739. return testresult;
  8740. }
  8741. /*
  8742. * Test that the lifetime hint of a TLSv1.3 ticket is no more than 1 week
  8743. * 0 = TLSv1.2
  8744. * 1 = TLSv1.3
  8745. */
  8746. static int test_ticket_lifetime(int idx)
  8747. {
  8748. SSL_CTX *cctx = NULL, *sctx = NULL;
  8749. SSL *clientssl = NULL, *serverssl = NULL;
  8750. int testresult = 0;
  8751. int version = TLS1_3_VERSION;
  8752. #define ONE_WEEK_SEC (7 * 24 * 60 * 60)
  8753. #define TWO_WEEK_SEC (2 * ONE_WEEK_SEC)
  8754. if (idx == 0) {
  8755. #ifdef OPENSSL_NO_TLS1_2
  8756. return TEST_skip("TLS 1.2 is disabled.");
  8757. #else
  8758. version = TLS1_2_VERSION;
  8759. #endif
  8760. }
  8761. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  8762. TLS_client_method(), version, version,
  8763. &sctx, &cctx, cert, privkey)))
  8764. goto end;
  8765. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  8766. &clientssl, NULL, NULL)))
  8767. goto end;
  8768. /*
  8769. * Set the timeout to be more than 1 week
  8770. * make sure the returned value is the default
  8771. */
  8772. if (!TEST_long_eq(SSL_CTX_set_timeout(sctx, TWO_WEEK_SEC),
  8773. SSL_get_default_timeout(serverssl)))
  8774. goto end;
  8775. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  8776. goto end;
  8777. if (idx == 0) {
  8778. /* TLSv1.2 uses the set value */
  8779. if (!TEST_ulong_eq(SSL_SESSION_get_ticket_lifetime_hint(SSL_get_session(clientssl)), TWO_WEEK_SEC))
  8780. goto end;
  8781. } else {
  8782. /* TLSv1.3 uses the limited value */
  8783. if (!TEST_ulong_le(SSL_SESSION_get_ticket_lifetime_hint(SSL_get_session(clientssl)), ONE_WEEK_SEC))
  8784. goto end;
  8785. }
  8786. testresult = 1;
  8787. end:
  8788. SSL_free(serverssl);
  8789. SSL_free(clientssl);
  8790. SSL_CTX_free(sctx);
  8791. SSL_CTX_free(cctx);
  8792. return testresult;
  8793. }
  8794. #endif
  8795. /*
  8796. * Test that setting an ALPN does not violate RFC
  8797. */
  8798. static int test_set_alpn(void)
  8799. {
  8800. SSL_CTX *ctx = NULL;
  8801. SSL *ssl = NULL;
  8802. int testresult = 0;
  8803. unsigned char bad0[] = { 0x00, 'b', 'a', 'd' };
  8804. unsigned char good[] = { 0x04, 'g', 'o', 'o', 'd' };
  8805. unsigned char bad1[] = { 0x01, 'b', 'a', 'd' };
  8806. unsigned char bad2[] = { 0x03, 'b', 'a', 'd', 0x00};
  8807. unsigned char bad3[] = { 0x03, 'b', 'a', 'd', 0x01, 'b', 'a', 'd'};
  8808. unsigned char bad4[] = { 0x03, 'b', 'a', 'd', 0x06, 'b', 'a', 'd'};
  8809. /* Create an initial SSL_CTX with no certificate configured */
  8810. ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
  8811. if (!TEST_ptr(ctx))
  8812. goto end;
  8813. /* the set_alpn functions return 0 (false) on success, non-zero (true) on failure */
  8814. if (!TEST_false(SSL_CTX_set_alpn_protos(ctx, NULL, 2)))
  8815. goto end;
  8816. if (!TEST_false(SSL_CTX_set_alpn_protos(ctx, good, 0)))
  8817. goto end;
  8818. if (!TEST_false(SSL_CTX_set_alpn_protos(ctx, good, sizeof(good))))
  8819. goto end;
  8820. if (!TEST_true(SSL_CTX_set_alpn_protos(ctx, good, 1)))
  8821. goto end;
  8822. if (!TEST_true(SSL_CTX_set_alpn_protos(ctx, bad0, sizeof(bad0))))
  8823. goto end;
  8824. if (!TEST_true(SSL_CTX_set_alpn_protos(ctx, bad1, sizeof(bad1))))
  8825. goto end;
  8826. if (!TEST_true(SSL_CTX_set_alpn_protos(ctx, bad2, sizeof(bad2))))
  8827. goto end;
  8828. if (!TEST_true(SSL_CTX_set_alpn_protos(ctx, bad3, sizeof(bad3))))
  8829. goto end;
  8830. if (!TEST_true(SSL_CTX_set_alpn_protos(ctx, bad4, sizeof(bad4))))
  8831. goto end;
  8832. ssl = SSL_new(ctx);
  8833. if (!TEST_ptr(ssl))
  8834. goto end;
  8835. if (!TEST_false(SSL_set_alpn_protos(ssl, NULL, 2)))
  8836. goto end;
  8837. if (!TEST_false(SSL_set_alpn_protos(ssl, good, 0)))
  8838. goto end;
  8839. if (!TEST_false(SSL_set_alpn_protos(ssl, good, sizeof(good))))
  8840. goto end;
  8841. if (!TEST_true(SSL_set_alpn_protos(ssl, good, 1)))
  8842. goto end;
  8843. if (!TEST_true(SSL_set_alpn_protos(ssl, bad0, sizeof(bad0))))
  8844. goto end;
  8845. if (!TEST_true(SSL_set_alpn_protos(ssl, bad1, sizeof(bad1))))
  8846. goto end;
  8847. if (!TEST_true(SSL_set_alpn_protos(ssl, bad2, sizeof(bad2))))
  8848. goto end;
  8849. if (!TEST_true(SSL_set_alpn_protos(ssl, bad3, sizeof(bad3))))
  8850. goto end;
  8851. if (!TEST_true(SSL_set_alpn_protos(ssl, bad4, sizeof(bad4))))
  8852. goto end;
  8853. testresult = 1;
  8854. end:
  8855. SSL_free(ssl);
  8856. SSL_CTX_free(ctx);
  8857. return testresult;
  8858. }
  8859. /*
  8860. * Test SSL_CTX_set1_verify/chain_cert_store and SSL_CTX_get_verify/chain_cert_store.
  8861. */
  8862. static int test_set_verify_cert_store_ssl_ctx(void)
  8863. {
  8864. SSL_CTX *ctx = NULL;
  8865. int testresult = 0;
  8866. X509_STORE *store = NULL, *new_store = NULL,
  8867. *cstore = NULL, *new_cstore = NULL;
  8868. /* Create an initial SSL_CTX. */
  8869. ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
  8870. if (!TEST_ptr(ctx))
  8871. goto end;
  8872. /* Retrieve verify store pointer. */
  8873. if (!TEST_true(SSL_CTX_get0_verify_cert_store(ctx, &store)))
  8874. goto end;
  8875. /* Retrieve chain store pointer. */
  8876. if (!TEST_true(SSL_CTX_get0_chain_cert_store(ctx, &cstore)))
  8877. goto end;
  8878. /* We haven't set any yet, so this should be NULL. */
  8879. if (!TEST_ptr_null(store) || !TEST_ptr_null(cstore))
  8880. goto end;
  8881. /* Create stores. We use separate stores so pointers are different. */
  8882. new_store = X509_STORE_new();
  8883. if (!TEST_ptr(new_store))
  8884. goto end;
  8885. new_cstore = X509_STORE_new();
  8886. if (!TEST_ptr(new_cstore))
  8887. goto end;
  8888. /* Set stores. */
  8889. if (!TEST_true(SSL_CTX_set1_verify_cert_store(ctx, new_store)))
  8890. goto end;
  8891. if (!TEST_true(SSL_CTX_set1_chain_cert_store(ctx, new_cstore)))
  8892. goto end;
  8893. /* Should be able to retrieve the same pointer. */
  8894. if (!TEST_true(SSL_CTX_get0_verify_cert_store(ctx, &store)))
  8895. goto end;
  8896. if (!TEST_true(SSL_CTX_get0_chain_cert_store(ctx, &cstore)))
  8897. goto end;
  8898. if (!TEST_ptr_eq(store, new_store) || !TEST_ptr_eq(cstore, new_cstore))
  8899. goto end;
  8900. /* Should be able to unset again. */
  8901. if (!TEST_true(SSL_CTX_set1_verify_cert_store(ctx, NULL)))
  8902. goto end;
  8903. if (!TEST_true(SSL_CTX_set1_chain_cert_store(ctx, NULL)))
  8904. goto end;
  8905. /* Should now be NULL. */
  8906. if (!TEST_true(SSL_CTX_get0_verify_cert_store(ctx, &store)))
  8907. goto end;
  8908. if (!TEST_true(SSL_CTX_get0_chain_cert_store(ctx, &cstore)))
  8909. goto end;
  8910. if (!TEST_ptr_null(store) || !TEST_ptr_null(cstore))
  8911. goto end;
  8912. testresult = 1;
  8913. end:
  8914. X509_STORE_free(new_store);
  8915. X509_STORE_free(new_cstore);
  8916. SSL_CTX_free(ctx);
  8917. return testresult;
  8918. }
  8919. /*
  8920. * Test SSL_set1_verify/chain_cert_store and SSL_get_verify/chain_cert_store.
  8921. */
  8922. static int test_set_verify_cert_store_ssl(void)
  8923. {
  8924. SSL_CTX *ctx = NULL;
  8925. SSL *ssl = NULL;
  8926. int testresult = 0;
  8927. X509_STORE *store = NULL, *new_store = NULL,
  8928. *cstore = NULL, *new_cstore = NULL;
  8929. /* Create an initial SSL_CTX. */
  8930. ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
  8931. if (!TEST_ptr(ctx))
  8932. goto end;
  8933. /* Create an SSL object. */
  8934. ssl = SSL_new(ctx);
  8935. if (!TEST_ptr(ssl))
  8936. goto end;
  8937. /* Retrieve verify store pointer. */
  8938. if (!TEST_true(SSL_get0_verify_cert_store(ssl, &store)))
  8939. goto end;
  8940. /* Retrieve chain store pointer. */
  8941. if (!TEST_true(SSL_get0_chain_cert_store(ssl, &cstore)))
  8942. goto end;
  8943. /* We haven't set any yet, so this should be NULL. */
  8944. if (!TEST_ptr_null(store) || !TEST_ptr_null(cstore))
  8945. goto end;
  8946. /* Create stores. We use separate stores so pointers are different. */
  8947. new_store = X509_STORE_new();
  8948. if (!TEST_ptr(new_store))
  8949. goto end;
  8950. new_cstore = X509_STORE_new();
  8951. if (!TEST_ptr(new_cstore))
  8952. goto end;
  8953. /* Set stores. */
  8954. if (!TEST_true(SSL_set1_verify_cert_store(ssl, new_store)))
  8955. goto end;
  8956. if (!TEST_true(SSL_set1_chain_cert_store(ssl, new_cstore)))
  8957. goto end;
  8958. /* Should be able to retrieve the same pointer. */
  8959. if (!TEST_true(SSL_get0_verify_cert_store(ssl, &store)))
  8960. goto end;
  8961. if (!TEST_true(SSL_get0_chain_cert_store(ssl, &cstore)))
  8962. goto end;
  8963. if (!TEST_ptr_eq(store, new_store) || !TEST_ptr_eq(cstore, new_cstore))
  8964. goto end;
  8965. /* Should be able to unset again. */
  8966. if (!TEST_true(SSL_set1_verify_cert_store(ssl, NULL)))
  8967. goto end;
  8968. if (!TEST_true(SSL_set1_chain_cert_store(ssl, NULL)))
  8969. goto end;
  8970. /* Should now be NULL. */
  8971. if (!TEST_true(SSL_get0_verify_cert_store(ssl, &store)))
  8972. goto end;
  8973. if (!TEST_true(SSL_get0_chain_cert_store(ssl, &cstore)))
  8974. goto end;
  8975. if (!TEST_ptr_null(store) || !TEST_ptr_null(cstore))
  8976. goto end;
  8977. testresult = 1;
  8978. end:
  8979. X509_STORE_free(new_store);
  8980. X509_STORE_free(new_cstore);
  8981. SSL_free(ssl);
  8982. SSL_CTX_free(ctx);
  8983. return testresult;
  8984. }
  8985. static int test_inherit_verify_param(void)
  8986. {
  8987. int testresult = 0;
  8988. SSL_CTX *ctx = NULL;
  8989. X509_VERIFY_PARAM *cp = NULL;
  8990. SSL *ssl = NULL;
  8991. X509_VERIFY_PARAM *sp = NULL;
  8992. int hostflags = X509_CHECK_FLAG_NEVER_CHECK_SUBJECT;
  8993. ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
  8994. if (!TEST_ptr(ctx))
  8995. goto end;
  8996. cp = SSL_CTX_get0_param(ctx);
  8997. if (!TEST_ptr(cp))
  8998. goto end;
  8999. if (!TEST_int_eq(X509_VERIFY_PARAM_get_hostflags(cp), 0))
  9000. goto end;
  9001. X509_VERIFY_PARAM_set_hostflags(cp, hostflags);
  9002. ssl = SSL_new(ctx);
  9003. if (!TEST_ptr(ssl))
  9004. goto end;
  9005. sp = SSL_get0_param(ssl);
  9006. if (!TEST_ptr(sp))
  9007. goto end;
  9008. if (!TEST_int_eq(X509_VERIFY_PARAM_get_hostflags(sp), hostflags))
  9009. goto end;
  9010. testresult = 1;
  9011. end:
  9012. SSL_free(ssl);
  9013. SSL_CTX_free(ctx);
  9014. return testresult;
  9015. }
  9016. static int test_load_dhfile(void)
  9017. {
  9018. #ifndef OPENSSL_NO_DH
  9019. int testresult = 0;
  9020. SSL_CTX *ctx = NULL;
  9021. SSL_CONF_CTX *cctx = NULL;
  9022. if (dhfile == NULL)
  9023. return 1;
  9024. if (!TEST_ptr(ctx = SSL_CTX_new_ex(libctx, NULL, TLS_client_method()))
  9025. || !TEST_ptr(cctx = SSL_CONF_CTX_new()))
  9026. goto end;
  9027. SSL_CONF_CTX_set_ssl_ctx(cctx, ctx);
  9028. SSL_CONF_CTX_set_flags(cctx,
  9029. SSL_CONF_FLAG_CERTIFICATE
  9030. | SSL_CONF_FLAG_SERVER
  9031. | SSL_CONF_FLAG_FILE);
  9032. if (!TEST_int_eq(SSL_CONF_cmd(cctx, "DHParameters", dhfile), 2))
  9033. goto end;
  9034. testresult = 1;
  9035. end:
  9036. SSL_CONF_CTX_free(cctx);
  9037. SSL_CTX_free(ctx);
  9038. return testresult;
  9039. #else
  9040. return TEST_skip("DH not supported by this build");
  9041. #endif
  9042. }
  9043. #ifndef OSSL_NO_USABLE_TLS1_3
  9044. /* Test that read_ahead works across a key change */
  9045. static int test_read_ahead_key_change(void)
  9046. {
  9047. SSL_CTX *cctx = NULL, *sctx = NULL;
  9048. SSL *clientssl = NULL, *serverssl = NULL;
  9049. int testresult = 0;
  9050. char *msg = "Hello World";
  9051. size_t written, readbytes;
  9052. char buf[80];
  9053. int i;
  9054. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  9055. TLS_client_method(), TLS1_3_VERSION, 0,
  9056. &sctx, &cctx, cert, privkey)))
  9057. goto end;
  9058. SSL_CTX_set_read_ahead(sctx, 1);
  9059. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  9060. &clientssl, NULL, NULL)))
  9061. goto end;
  9062. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  9063. goto end;
  9064. /* Write some data, send a key update, write more data */
  9065. if (!TEST_true(SSL_write_ex(clientssl, msg, strlen(msg), &written))
  9066. || !TEST_size_t_eq(written, strlen(msg)))
  9067. goto end;
  9068. if (!TEST_true(SSL_key_update(clientssl, SSL_KEY_UPDATE_NOT_REQUESTED)))
  9069. goto end;
  9070. if (!TEST_true(SSL_write_ex(clientssl, msg, strlen(msg), &written))
  9071. || !TEST_size_t_eq(written, strlen(msg)))
  9072. goto end;
  9073. /*
  9074. * Since read_ahead is on the first read below should read the record with
  9075. * the first app data, the second record with the key update message, and
  9076. * the third record with the app data all in one go. We should be able to
  9077. * still process the read_ahead data correctly even though it crosses
  9078. * epochs
  9079. */
  9080. for (i = 0; i < 2; i++) {
  9081. if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf) - 1,
  9082. &readbytes)))
  9083. goto end;
  9084. buf[readbytes] = '\0';
  9085. if (!TEST_str_eq(buf, msg))
  9086. goto end;
  9087. }
  9088. testresult = 1;
  9089. end:
  9090. SSL_free(serverssl);
  9091. SSL_free(clientssl);
  9092. SSL_CTX_free(sctx);
  9093. SSL_CTX_free(cctx);
  9094. return testresult;
  9095. }
  9096. static size_t record_pad_cb(SSL *s, int type, size_t len, void *arg)
  9097. {
  9098. int *called = arg;
  9099. switch ((*called)++) {
  9100. case 0:
  9101. /* Add some padding to first record */
  9102. return 512;
  9103. case 1:
  9104. /* Maximally pad the second record */
  9105. return SSL3_RT_MAX_PLAIN_LENGTH - len;
  9106. case 2:
  9107. /*
  9108. * Exceeding the maximum padding should be fine. It should just pad to
  9109. * the maximum anyway
  9110. */
  9111. return SSL3_RT_MAX_PLAIN_LENGTH + 1 - len;
  9112. case 3:
  9113. /*
  9114. * Very large padding should also be ok. Should just pad to the maximum
  9115. * allowed
  9116. */
  9117. return SIZE_MAX;
  9118. default:
  9119. return 0;
  9120. }
  9121. }
  9122. /*
  9123. * Test that setting record padding in TLSv1.3 works as expected
  9124. * Test 0: Record padding callback on the SSL_CTX
  9125. * Test 1: Record padding callback on the SSL
  9126. * Test 2: Record block padding on the SSL_CTX
  9127. * Test 3: Record block padding on the SSL
  9128. */
  9129. static int test_tls13_record_padding(int idx)
  9130. {
  9131. SSL_CTX *cctx = NULL, *sctx = NULL;
  9132. SSL *clientssl = NULL, *serverssl = NULL;
  9133. int testresult = 0;
  9134. char *msg = "Hello World";
  9135. size_t written, readbytes;
  9136. char buf[80];
  9137. int i;
  9138. int called = 0;
  9139. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  9140. TLS_client_method(), TLS1_3_VERSION, 0,
  9141. &sctx, &cctx, cert, privkey)))
  9142. goto end;
  9143. if (idx == 0) {
  9144. SSL_CTX_set_record_padding_callback(cctx, record_pad_cb);
  9145. SSL_CTX_set_record_padding_callback_arg(cctx, &called);
  9146. if (!TEST_ptr_eq(SSL_CTX_get_record_padding_callback_arg(cctx), &called))
  9147. goto end;
  9148. } else if (idx == 2) {
  9149. /* Exceeding the max plain length should fail */
  9150. if (!TEST_false(SSL_CTX_set_block_padding(cctx,
  9151. SSL3_RT_MAX_PLAIN_LENGTH + 1)))
  9152. goto end;
  9153. if (!TEST_true(SSL_CTX_set_block_padding(cctx, 512)))
  9154. goto end;
  9155. }
  9156. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  9157. &clientssl, NULL, NULL)))
  9158. goto end;
  9159. if (idx == 1) {
  9160. SSL_set_record_padding_callback(clientssl, record_pad_cb);
  9161. SSL_set_record_padding_callback_arg(clientssl, &called);
  9162. if (!TEST_ptr_eq(SSL_get_record_padding_callback_arg(clientssl), &called))
  9163. goto end;
  9164. } else if (idx == 3) {
  9165. /* Exceeding the max plain length should fail */
  9166. if (!TEST_false(SSL_set_block_padding(clientssl,
  9167. SSL3_RT_MAX_PLAIN_LENGTH + 1)))
  9168. goto end;
  9169. if (!TEST_true(SSL_set_block_padding(clientssl, 512)))
  9170. goto end;
  9171. }
  9172. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  9173. goto end;
  9174. called = 0;
  9175. /*
  9176. * Write some data, then check we can read it. Do this four times to check
  9177. * we can continue to write and read padded data after the initial record
  9178. * padding has been added. We don't actually check that the padding has
  9179. * been applied to the record - just that we can continue to communicate
  9180. * normally and that the callback has been called (if appropriate).
  9181. */
  9182. for (i = 0; i < 4; i++) {
  9183. if (!TEST_true(SSL_write_ex(clientssl, msg, strlen(msg), &written))
  9184. || !TEST_size_t_eq(written, strlen(msg)))
  9185. goto end;
  9186. if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf) - 1,
  9187. &readbytes))
  9188. || !TEST_size_t_eq(written, readbytes))
  9189. goto end;
  9190. buf[readbytes] = '\0';
  9191. if (!TEST_str_eq(buf, msg))
  9192. goto end;
  9193. }
  9194. if ((idx == 0 || idx == 1) && !TEST_int_eq(called, 4))
  9195. goto end;
  9196. testresult = 1;
  9197. end:
  9198. SSL_free(serverssl);
  9199. SSL_free(clientssl);
  9200. SSL_CTX_free(sctx);
  9201. SSL_CTX_free(cctx);
  9202. return testresult;
  9203. }
  9204. #endif /* OSSL_NO_USABLE_TLS1_3 */
  9205. #if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_DYNAMIC_ENGINE)
  9206. /*
  9207. * Test TLSv1.2 with a pipeline capable cipher. TLSv1.3 and DTLS do not
  9208. * support this yet. The only pipeline capable cipher that we have is in the
  9209. * dasync engine (providers don't support this yet), so we have to use
  9210. * deprecated APIs for this test.
  9211. *
  9212. * Test 0: Client has pipelining enabled, server does not
  9213. * Test 1: Server has pipelining enabled, client does not
  9214. * Test 2: Client has pipelining enabled, server does not: not enough data to
  9215. * fill all the pipelines
  9216. * Test 3: Client has pipelining enabled, server does not: not enough data to
  9217. * fill all the pipelines by more than a full pipeline's worth
  9218. * Test 4: Client has pipelining enabled, server does not: more data than all
  9219. * the available pipelines can take
  9220. * Test 5: Client has pipelining enabled, server does not: Maximum size pipeline
  9221. */
  9222. static int test_pipelining(int idx)
  9223. {
  9224. SSL_CTX *cctx = NULL, *sctx = NULL;
  9225. SSL *clientssl = NULL, *serverssl = NULL, *peera, *peerb;
  9226. int testresult = 0, numreads;
  9227. /* A 55 byte message */
  9228. unsigned char *msg = (unsigned char *)
  9229. "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz123";
  9230. size_t written, readbytes, offset, msglen, fragsize = 10, numpipes = 5;
  9231. size_t expectedreads;
  9232. unsigned char *buf = NULL;
  9233. ENGINE *e;
  9234. if (!TEST_ptr(e = ENGINE_by_id("dasync")))
  9235. return 0;
  9236. if (!TEST_true(ENGINE_init(e))) {
  9237. ENGINE_free(e);
  9238. return 0;
  9239. }
  9240. if (!TEST_true(ENGINE_register_ciphers(e)))
  9241. goto end;
  9242. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  9243. TLS_client_method(), 0,
  9244. TLS1_2_VERSION, &sctx, &cctx, cert,
  9245. privkey)))
  9246. goto end;
  9247. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  9248. &clientssl, NULL, NULL)))
  9249. goto end;
  9250. if (!TEST_true(SSL_set_cipher_list(clientssl, "AES128-SHA")))
  9251. goto end;
  9252. /* peera is always configured for pipelining, while peerb is not. */
  9253. if (idx == 1) {
  9254. peera = serverssl;
  9255. peerb = clientssl;
  9256. } else {
  9257. peera = clientssl;
  9258. peerb = serverssl;
  9259. }
  9260. if (idx == 5) {
  9261. numpipes = 2;
  9262. /* Maximum allowed fragment size */
  9263. fragsize = SSL3_RT_MAX_PLAIN_LENGTH;
  9264. msglen = fragsize * numpipes;
  9265. msg = OPENSSL_malloc(msglen);
  9266. if (!TEST_ptr(msg))
  9267. goto end;
  9268. if (!TEST_int_gt(RAND_bytes_ex(libctx, msg, msglen, 0), 0))
  9269. goto end;
  9270. } else if (idx == 4) {
  9271. msglen = 55;
  9272. } else {
  9273. msglen = 50;
  9274. }
  9275. if (idx == 2)
  9276. msglen -= 2; /* Send 2 less bytes */
  9277. else if (idx == 3)
  9278. msglen -= 12; /* Send 12 less bytes */
  9279. buf = OPENSSL_malloc(msglen);
  9280. if (!TEST_ptr(buf))
  9281. goto end;
  9282. if (idx == 5) {
  9283. /*
  9284. * Test that setting a split send fragment longer than the maximum
  9285. * allowed fails
  9286. */
  9287. if (!TEST_false(SSL_set_split_send_fragment(peera, fragsize + 1)))
  9288. goto end;
  9289. }
  9290. /*
  9291. * In the normal case. We have 5 pipelines with 10 bytes per pipeline
  9292. * (50 bytes in total). This is a ridiculously small number of bytes -
  9293. * but sufficient for our purposes
  9294. */
  9295. if (!TEST_true(SSL_set_max_pipelines(peera, numpipes))
  9296. || !TEST_true(SSL_set_split_send_fragment(peera, fragsize)))
  9297. goto end;
  9298. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  9299. goto end;
  9300. /* Write some data from peera to peerb */
  9301. if (!TEST_true(SSL_write_ex(peera, msg, msglen, &written))
  9302. || !TEST_size_t_eq(written, msglen))
  9303. goto end;
  9304. /*
  9305. * If the pipelining code worked, then we expect all |numpipes| pipelines to
  9306. * have been used - except in test 3 where only |numpipes - 1| pipelines
  9307. * will be used. This will result in |numpipes| records (|numpipes - 1| for
  9308. * test 3) having been sent to peerb. Since peerb is not using read_ahead we
  9309. * expect this to be read in |numpipes| or |numpipes - 1| separate
  9310. * SSL_read_ex calls. In the case of test 4, there is then one additional
  9311. * read for left over data that couldn't fit in the previous pipelines
  9312. */
  9313. for (offset = 0, numreads = 0;
  9314. offset < msglen;
  9315. offset += readbytes, numreads++) {
  9316. if (!TEST_true(SSL_read_ex(peerb, buf + offset,
  9317. msglen - offset, &readbytes)))
  9318. goto end;
  9319. }
  9320. expectedreads = idx == 4 ? numpipes + 1
  9321. : (idx == 3 ? numpipes - 1 : numpipes);
  9322. if (!TEST_mem_eq(msg, msglen, buf, offset)
  9323. || !TEST_int_eq(numreads, expectedreads))
  9324. goto end;
  9325. /*
  9326. * Write some data from peerb to peera. We do this in up to |numpipes + 1|
  9327. * chunks to exercise the read pipelining code on peera.
  9328. */
  9329. for (offset = 0; offset < msglen; offset += fragsize) {
  9330. size_t sendlen = msglen - offset;
  9331. if (sendlen > fragsize)
  9332. sendlen = fragsize;
  9333. if (!TEST_true(SSL_write_ex(peerb, msg + offset, sendlen, &written))
  9334. || !TEST_size_t_eq(written, sendlen))
  9335. goto end;
  9336. }
  9337. /*
  9338. * The data was written in |numpipes|, |numpipes - 1| or |numpipes + 1|
  9339. * separate chunks (depending on which test we are running). If the
  9340. * pipelining is working then we expect peera to read up to numpipes chunks
  9341. * and process them in parallel, giving back the complete result in a single
  9342. * call to SSL_read_ex
  9343. */
  9344. if (!TEST_true(SSL_read_ex(peera, buf, msglen, &readbytes))
  9345. || !TEST_size_t_le(readbytes, msglen))
  9346. goto end;
  9347. if (idx == 4) {
  9348. size_t readbytes2;
  9349. if (!TEST_true(SSL_read_ex(peera, buf + readbytes,
  9350. msglen - readbytes, &readbytes2)))
  9351. goto end;
  9352. readbytes += readbytes2;
  9353. if (!TEST_size_t_le(readbytes, msglen))
  9354. goto end;
  9355. }
  9356. if (!TEST_mem_eq(msg, msglen, buf, readbytes))
  9357. goto end;
  9358. testresult = 1;
  9359. end:
  9360. SSL_free(serverssl);
  9361. SSL_free(clientssl);
  9362. SSL_CTX_free(sctx);
  9363. SSL_CTX_free(cctx);
  9364. ENGINE_unregister_ciphers(e);
  9365. ENGINE_finish(e);
  9366. ENGINE_free(e);
  9367. OPENSSL_free(buf);
  9368. if (fragsize == SSL3_RT_MAX_PLAIN_LENGTH)
  9369. OPENSSL_free(msg);
  9370. return testresult;
  9371. }
  9372. #endif /* !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_DYNAMIC_ENGINE) */
  9373. static int check_version_string(SSL *s, int version)
  9374. {
  9375. const char *verstr = NULL;
  9376. switch (version) {
  9377. case SSL3_VERSION:
  9378. verstr = "SSLv3";
  9379. break;
  9380. case TLS1_VERSION:
  9381. verstr = "TLSv1";
  9382. break;
  9383. case TLS1_1_VERSION:
  9384. verstr = "TLSv1.1";
  9385. break;
  9386. case TLS1_2_VERSION:
  9387. verstr = "TLSv1.2";
  9388. break;
  9389. case TLS1_3_VERSION:
  9390. verstr = "TLSv1.3";
  9391. break;
  9392. case DTLS1_VERSION:
  9393. verstr = "DTLSv1";
  9394. break;
  9395. case DTLS1_2_VERSION:
  9396. verstr = "DTLSv1.2";
  9397. }
  9398. return TEST_str_eq(verstr, SSL_get_version(s));
  9399. }
  9400. /*
  9401. * Test that SSL_version, SSL_get_version, SSL_is_quic, SSL_is_tls and
  9402. * SSL_is_dtls return the expected results for a (D)TLS connection. Compare with
  9403. * test_version() in quicapitest.c which does the same thing for QUIC
  9404. * connections.
  9405. */
  9406. static int test_version(int idx)
  9407. {
  9408. SSL_CTX *cctx = NULL, *sctx = NULL;
  9409. SSL *clientssl = NULL, *serverssl = NULL;
  9410. int testresult = 0, version;
  9411. const SSL_METHOD *servmeth = TLS_server_method();
  9412. const SSL_METHOD *clientmeth = TLS_client_method();
  9413. switch (idx) {
  9414. #if !defined(OPENSSL_NO_SSL3)
  9415. case 0:
  9416. version = SSL3_VERSION;
  9417. break;
  9418. #endif
  9419. #if !defined(OPENSSL_NO_TLS1)
  9420. case 1:
  9421. version = TLS1_VERSION;
  9422. break;
  9423. #endif
  9424. #if !defined(OPENSSL_NO_TLS1_2)
  9425. case 2:
  9426. version = TLS1_2_VERSION;
  9427. break;
  9428. #endif
  9429. #if !defined(OSSL_NO_USABLE_TLS1_3)
  9430. case 3:
  9431. version = TLS1_3_VERSION;
  9432. break;
  9433. #endif
  9434. #if !defined(OPENSSL_NO_DTLS1)
  9435. case 4:
  9436. version = DTLS1_VERSION;
  9437. break;
  9438. #endif
  9439. #if !defined(OPENSSL_NO_DTLS1_2)
  9440. case 5:
  9441. version = DTLS1_2_VERSION;
  9442. break;
  9443. #endif
  9444. /*
  9445. * NB we do not support QUIC in this test. That is covered by quicapitest.c
  9446. * We also don't support DTLS1_BAD_VER since we have no server support for
  9447. * that.
  9448. */
  9449. default:
  9450. TEST_skip("Unsupported protocol version");
  9451. return 1;
  9452. }
  9453. if (is_fips
  9454. && (version == SSL3_VERSION
  9455. || version == TLS1_VERSION
  9456. || version == DTLS1_VERSION)) {
  9457. TEST_skip("Protocol version not supported with FIPS");
  9458. return 1;
  9459. }
  9460. #if !defined(OPENSSL_NO_DTLS)
  9461. if (version == DTLS1_VERSION || version == DTLS1_2_VERSION) {
  9462. servmeth = DTLS_server_method();
  9463. clientmeth = DTLS_client_method();
  9464. }
  9465. #endif
  9466. if (!TEST_true(create_ssl_ctx_pair(libctx, servmeth, clientmeth, version,
  9467. version, &sctx, &cctx, cert, privkey)))
  9468. goto end;
  9469. if (!TEST_true(SSL_CTX_set_cipher_list(sctx, "DEFAULT:@SECLEVEL=0"))
  9470. || !TEST_true(SSL_CTX_set_cipher_list(cctx,
  9471. "DEFAULT:@SECLEVEL=0")))
  9472. goto end;
  9473. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  9474. &clientssl, NULL, NULL)))
  9475. goto end;
  9476. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  9477. goto end;
  9478. if (!TEST_int_eq(SSL_version(serverssl), version)
  9479. || !TEST_int_eq(SSL_version(clientssl), version)
  9480. || !TEST_true(check_version_string(serverssl, version))
  9481. || !TEST_true(check_version_string(clientssl, version)))
  9482. goto end;
  9483. if (version == DTLS1_VERSION || version == DTLS1_2_VERSION) {
  9484. if (!TEST_true(SSL_is_dtls(serverssl))
  9485. || !TEST_true(SSL_is_dtls(clientssl))
  9486. || !TEST_false(SSL_is_tls(serverssl))
  9487. || !TEST_false(SSL_is_tls(clientssl))
  9488. || !TEST_false(SSL_is_quic(serverssl))
  9489. || !TEST_false(SSL_is_quic(clientssl)))
  9490. goto end;
  9491. } else {
  9492. if (!TEST_true(SSL_is_tls(serverssl))
  9493. || !TEST_true(SSL_is_tls(clientssl))
  9494. || !TEST_false(SSL_is_dtls(serverssl))
  9495. || !TEST_false(SSL_is_dtls(clientssl))
  9496. || !TEST_false(SSL_is_quic(serverssl))
  9497. || !TEST_false(SSL_is_quic(clientssl)))
  9498. goto end;
  9499. }
  9500. testresult = 1;
  9501. end:
  9502. SSL_free(serverssl);
  9503. SSL_free(clientssl);
  9504. SSL_CTX_free(sctx);
  9505. SSL_CTX_free(cctx);
  9506. return testresult;
  9507. }
  9508. /*
  9509. * Test that the SSL_rstate_string*() APIs return sane results
  9510. */
  9511. static int test_rstate_string(void)
  9512. {
  9513. SSL_CTX *cctx = NULL, *sctx = NULL;
  9514. SSL *clientssl = NULL, *serverssl = NULL;
  9515. int testresult = 0, version;
  9516. const SSL_METHOD *servmeth = TLS_server_method();
  9517. const SSL_METHOD *clientmeth = TLS_client_method();
  9518. size_t written, readbytes;
  9519. unsigned char buf[2];
  9520. unsigned char dummyheader[SSL3_RT_HEADER_LENGTH] = {
  9521. SSL3_RT_APPLICATION_DATA,
  9522. TLS1_2_VERSION_MAJOR,
  9523. 0, /* To be filled in later */
  9524. 0,
  9525. 1
  9526. };
  9527. if (!TEST_true(create_ssl_ctx_pair(libctx, servmeth, clientmeth, 0,
  9528. 0, &sctx, &cctx, cert, privkey)))
  9529. goto end;
  9530. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  9531. &clientssl, NULL, NULL)))
  9532. goto end;
  9533. if (!TEST_str_eq(SSL_rstate_string(serverssl), "RH")
  9534. || !TEST_str_eq(SSL_rstate_string_long(serverssl), "read header"))
  9535. goto end;
  9536. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  9537. goto end;
  9538. if (!TEST_str_eq(SSL_rstate_string(serverssl), "RH")
  9539. || !TEST_str_eq(SSL_rstate_string_long(serverssl), "read header"))
  9540. goto end;
  9541. /* Fill in the correct version for the record header */
  9542. version = SSL_version(serverssl);
  9543. if (version == TLS1_3_VERSION)
  9544. version = TLS1_2_VERSION;
  9545. dummyheader[2] = version & 0xff;
  9546. /*
  9547. * Send a dummy header. If we continued to read the body as well this
  9548. * would fail with a bad record mac, but we're not going to go that far.
  9549. */
  9550. if (!TEST_true(BIO_write_ex(SSL_get_rbio(serverssl), dummyheader,
  9551. sizeof(dummyheader), &written))
  9552. || !TEST_size_t_eq(written, SSL3_RT_HEADER_LENGTH))
  9553. goto end;
  9554. if (!TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes)))
  9555. goto end;
  9556. if (!TEST_str_eq(SSL_rstate_string(serverssl), "RB")
  9557. || !TEST_str_eq(SSL_rstate_string_long(serverssl), "read body"))
  9558. goto end;
  9559. testresult = 1;
  9560. end:
  9561. SSL_free(serverssl);
  9562. SSL_free(clientssl);
  9563. SSL_CTX_free(sctx);
  9564. SSL_CTX_free(cctx);
  9565. return testresult;
  9566. }
  9567. /*
  9568. * Force a write retry during handshaking. We test various combinations of
  9569. * scenarios. We test a large certificate message which will fill the buffering
  9570. * BIO used in the handshake. We try with client auth on and off. Finally we
  9571. * also try a BIO that indicates retry via a 0 return. BIO_write() is documented
  9572. * to indicate retry via -1 - but sometimes BIOs don't do that.
  9573. *
  9574. * Test 0: Standard certificate message
  9575. * Test 1: Large certificate message
  9576. * Test 2: Standard cert, verify peer
  9577. * Test 3: Large cert, verify peer
  9578. * Test 4: Standard cert, BIO returns 0 on retry
  9579. * Test 5: Large cert, BIO returns 0 on retry
  9580. * Test 6: Standard cert, verify peer, BIO returns 0 on retry
  9581. * Test 7: Large cert, verify peer, BIO returns 0 on retry
  9582. * Test 8-15: Repeat of above with TLSv1.2
  9583. */
  9584. static int test_handshake_retry(int idx)
  9585. {
  9586. SSL_CTX *cctx = NULL, *sctx = NULL;
  9587. SSL *clientssl = NULL, *serverssl = NULL;
  9588. int testresult = 0;
  9589. BIO *tmp = NULL, *bretry = BIO_new(bio_s_always_retry());
  9590. int maxversion = 0;
  9591. if (!TEST_ptr(bretry))
  9592. goto end;
  9593. #ifndef OPENSSL_NO_TLS1_2
  9594. if ((idx & 8) == 8)
  9595. maxversion = TLS1_2_VERSION;
  9596. #else
  9597. if ((idx & 8) == 8)
  9598. return TEST_skip("No TLSv1.2");
  9599. #endif
  9600. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  9601. TLS_client_method(), 0, maxversion,
  9602. &sctx, &cctx, cert, privkey)))
  9603. goto end;
  9604. /*
  9605. * Add a large amount of data to fill the buffering BIO used by the SSL
  9606. * object
  9607. */
  9608. if ((idx & 1) == 1 && !ssl_ctx_add_large_cert_chain(libctx, sctx, cert))
  9609. goto end;
  9610. /*
  9611. * We don't actually configure a client cert, but neither do we fail if one
  9612. * isn't present.
  9613. */
  9614. if ((idx & 2) == 2)
  9615. SSL_CTX_set_verify(sctx, SSL_VERIFY_PEER, NULL);
  9616. if ((idx & 4) == 4)
  9617. set_always_retry_err_val(0);
  9618. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  9619. &clientssl, NULL, NULL)))
  9620. goto end;
  9621. tmp = SSL_get_wbio(serverssl);
  9622. if (!TEST_ptr(tmp) || !TEST_true(BIO_up_ref(tmp))) {
  9623. tmp = NULL;
  9624. goto end;
  9625. }
  9626. SSL_set0_wbio(serverssl, bretry);
  9627. bretry = NULL;
  9628. if (!TEST_int_eq(SSL_connect(clientssl), -1))
  9629. goto end;
  9630. if (!TEST_int_eq(SSL_accept(serverssl), -1)
  9631. || !TEST_int_eq(SSL_get_error(serverssl, -1), SSL_ERROR_WANT_WRITE))
  9632. goto end;
  9633. /* Restore a BIO that will let the write succeed */
  9634. SSL_set0_wbio(serverssl, tmp);
  9635. tmp = NULL;
  9636. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  9637. goto end;
  9638. testresult = 1;
  9639. end:
  9640. SSL_free(serverssl);
  9641. SSL_free(clientssl);
  9642. SSL_CTX_free(sctx);
  9643. SSL_CTX_free(cctx);
  9644. BIO_free(bretry);
  9645. BIO_free(tmp);
  9646. set_always_retry_err_val(-1);
  9647. return testresult;
  9648. }
  9649. /*
  9650. * Test that receiving retries when writing application data works as expected
  9651. */
  9652. static int test_data_retry(void)
  9653. {
  9654. SSL_CTX *cctx = NULL, *sctx = NULL;
  9655. SSL *clientssl = NULL, *serverssl = NULL;
  9656. int testresult = 0;
  9657. unsigned char inbuf[1200], outbuf[1200];
  9658. size_t i;
  9659. BIO *tmp = NULL;
  9660. BIO *bretry = BIO_new(bio_s_maybe_retry());
  9661. size_t written, readbytes, totread = 0;
  9662. if (!TEST_ptr(bretry))
  9663. goto end;
  9664. for (i = 0; i < sizeof(inbuf); i++)
  9665. inbuf[i] = (unsigned char)(0xff & i);
  9666. memset(outbuf, 0, sizeof(outbuf));
  9667. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  9668. TLS_client_method(), 0, 0, &sctx, &cctx,
  9669. cert, privkey)))
  9670. goto end;
  9671. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
  9672. NULL)))
  9673. goto end;
  9674. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  9675. goto end;
  9676. /* Smallest possible max send fragment is 512 */
  9677. if (!TEST_true(SSL_set_max_send_fragment(clientssl, 512)))
  9678. goto end;
  9679. tmp = SSL_get_wbio(clientssl);
  9680. if (!TEST_ptr(tmp))
  9681. goto end;
  9682. if (!TEST_true(BIO_up_ref(tmp)))
  9683. goto end;
  9684. BIO_push(bretry, tmp);
  9685. tmp = NULL;
  9686. SSL_set0_wbio(clientssl, bretry);
  9687. if (!BIO_up_ref(bretry)) {
  9688. bretry = NULL;
  9689. goto end;
  9690. }
  9691. for (i = 0; i < 3; i++) {
  9692. /* We expect this call to make no progress and indicate retry */
  9693. if (!TEST_false(SSL_write_ex(clientssl, inbuf, sizeof(inbuf), &written)))
  9694. goto end;
  9695. if (!TEST_int_eq(SSL_get_error(clientssl, 0), SSL_ERROR_WANT_WRITE))
  9696. goto end;
  9697. /* Allow one write to progess, but the next one to signal retry */
  9698. if (!TEST_true(BIO_ctrl(bretry, MAYBE_RETRY_CTRL_SET_RETRY_AFTER_CNT, 1,
  9699. NULL)))
  9700. goto end;
  9701. if (i == 2)
  9702. break;
  9703. /*
  9704. * This call will hopefully make progress but will still indicate retry
  9705. * because there is more data than will fit into a single record.
  9706. */
  9707. if (!TEST_false(SSL_write_ex(clientssl, inbuf, sizeof(inbuf), &written)))
  9708. goto end;
  9709. if (!TEST_int_eq(SSL_get_error(clientssl, 0), SSL_ERROR_WANT_WRITE))
  9710. goto end;
  9711. }
  9712. /* The final call should write the last chunk of data and succeed */
  9713. if (!TEST_true(SSL_write_ex(clientssl, inbuf, sizeof(inbuf), &written)))
  9714. goto end;
  9715. /* Read all the data available */
  9716. while (SSL_read_ex(serverssl, outbuf + totread, sizeof(outbuf) - totread,
  9717. &readbytes))
  9718. totread += readbytes;
  9719. if (!TEST_mem_eq(inbuf, sizeof(inbuf), outbuf, totread))
  9720. goto end;
  9721. testresult = 1;
  9722. end:
  9723. SSL_free(serverssl);
  9724. SSL_free(clientssl);
  9725. SSL_CTX_free(sctx);
  9726. SSL_CTX_free(cctx);
  9727. BIO_free_all(bretry);
  9728. BIO_free(tmp);
  9729. return testresult;
  9730. }
  9731. OPT_TEST_DECLARE_USAGE("certfile privkeyfile srpvfile tmpfile provider config dhfile\n")
  9732. int setup_tests(void)
  9733. {
  9734. char *modulename;
  9735. char *configfile;
  9736. libctx = OSSL_LIB_CTX_new();
  9737. if (!TEST_ptr(libctx))
  9738. return 0;
  9739. defctxnull = OSSL_PROVIDER_load(NULL, "null");
  9740. /*
  9741. * Verify that the default and fips providers in the default libctx are not
  9742. * available
  9743. */
  9744. if (!TEST_false(OSSL_PROVIDER_available(NULL, "default"))
  9745. || !TEST_false(OSSL_PROVIDER_available(NULL, "fips")))
  9746. return 0;
  9747. if (!test_skip_common_options()) {
  9748. TEST_error("Error parsing test options\n");
  9749. return 0;
  9750. }
  9751. if (!TEST_ptr(certsdir = test_get_argument(0))
  9752. || !TEST_ptr(srpvfile = test_get_argument(1))
  9753. || !TEST_ptr(tmpfilename = test_get_argument(2))
  9754. || !TEST_ptr(modulename = test_get_argument(3))
  9755. || !TEST_ptr(configfile = test_get_argument(4))
  9756. || !TEST_ptr(dhfile = test_get_argument(5)))
  9757. return 0;
  9758. if (!TEST_true(OSSL_LIB_CTX_load_config(libctx, configfile)))
  9759. return 0;
  9760. /* Check we have the expected provider available */
  9761. if (!TEST_true(OSSL_PROVIDER_available(libctx, modulename)))
  9762. return 0;
  9763. /* Check the default provider is not available */
  9764. if (strcmp(modulename, "default") != 0
  9765. && !TEST_false(OSSL_PROVIDER_available(libctx, "default")))
  9766. return 0;
  9767. if (strcmp(modulename, "fips") == 0) {
  9768. OSSL_PROVIDER *prov = NULL;
  9769. OSSL_PARAM params[2];
  9770. is_fips = 1;
  9771. prov = OSSL_PROVIDER_load(libctx, "fips");
  9772. if (prov != NULL) {
  9773. /* Query the fips provider to check if the check ems option is enabled */
  9774. params[0] =
  9775. OSSL_PARAM_construct_int(OSSL_PROV_PARAM_TLS1_PRF_EMS_CHECK,
  9776. &fips_ems_check);
  9777. params[1] = OSSL_PARAM_construct_end();
  9778. OSSL_PROVIDER_get_params(prov, params);
  9779. OSSL_PROVIDER_unload(prov);
  9780. }
  9781. }
  9782. /*
  9783. * We add, but don't load the test "tls-provider". We'll load it when we
  9784. * need it.
  9785. */
  9786. if (!TEST_true(OSSL_PROVIDER_add_builtin(libctx, "tls-provider",
  9787. tls_provider_init)))
  9788. return 0;
  9789. if (getenv("OPENSSL_TEST_GETCOUNTS") != NULL) {
  9790. #ifdef OPENSSL_NO_CRYPTO_MDEBUG
  9791. TEST_error("not supported in this build");
  9792. return 0;
  9793. #else
  9794. int i, mcount, rcount, fcount;
  9795. for (i = 0; i < 4; i++)
  9796. test_export_key_mat(i);
  9797. CRYPTO_get_alloc_counts(&mcount, &rcount, &fcount);
  9798. test_printf_stdout("malloc %d realloc %d free %d\n",
  9799. mcount, rcount, fcount);
  9800. return 1;
  9801. #endif
  9802. }
  9803. cert = test_mk_file_path(certsdir, "servercert.pem");
  9804. if (cert == NULL)
  9805. goto err;
  9806. privkey = test_mk_file_path(certsdir, "serverkey.pem");
  9807. if (privkey == NULL)
  9808. goto err;
  9809. cert2 = test_mk_file_path(certsdir, "server-ecdsa-cert.pem");
  9810. if (cert2 == NULL)
  9811. goto err;
  9812. privkey2 = test_mk_file_path(certsdir, "server-ecdsa-key.pem");
  9813. if (privkey2 == NULL)
  9814. goto err;
  9815. cert1024 = test_mk_file_path(certsdir, "ee-cert-1024.pem");
  9816. if (cert1024 == NULL)
  9817. goto err;
  9818. privkey1024 = test_mk_file_path(certsdir, "ee-key-1024.pem");
  9819. if (privkey1024 == NULL)
  9820. goto err;
  9821. cert3072 = test_mk_file_path(certsdir, "ee-cert-3072.pem");
  9822. if (cert3072 == NULL)
  9823. goto err;
  9824. privkey3072 = test_mk_file_path(certsdir, "ee-key-3072.pem");
  9825. if (privkey3072 == NULL)
  9826. goto err;
  9827. cert4096 = test_mk_file_path(certsdir, "ee-cert-4096.pem");
  9828. if (cert4096 == NULL)
  9829. goto err;
  9830. privkey4096 = test_mk_file_path(certsdir, "ee-key-4096.pem");
  9831. if (privkey4096 == NULL)
  9832. goto err;
  9833. cert8192 = test_mk_file_path(certsdir, "ee-cert-8192.pem");
  9834. if (cert8192 == NULL)
  9835. goto err;
  9836. privkey8192 = test_mk_file_path(certsdir, "ee-key-8192.pem");
  9837. if (privkey8192 == NULL)
  9838. goto err;
  9839. if (fips_ems_check) {
  9840. #ifndef OPENSSL_NO_TLS1_2
  9841. ADD_TEST(test_no_ems);
  9842. #endif
  9843. return 1;
  9844. }
  9845. #if !defined(OPENSSL_NO_KTLS) && !defined(OPENSSL_NO_SOCK)
  9846. # if !defined(OPENSSL_NO_TLS1_2) || !defined(OSSL_NO_USABLE_TLS1_3)
  9847. ADD_ALL_TESTS(test_ktls, NUM_KTLS_TEST_CIPHERS * 4);
  9848. ADD_ALL_TESTS(test_ktls_sendfile, NUM_KTLS_TEST_CIPHERS * 2);
  9849. # endif
  9850. #endif
  9851. ADD_TEST(test_large_message_tls);
  9852. ADD_TEST(test_large_message_tls_read_ahead);
  9853. #ifndef OPENSSL_NO_DTLS
  9854. ADD_TEST(test_large_message_dtls);
  9855. #endif
  9856. ADD_ALL_TESTS(test_large_app_data, 28);
  9857. ADD_TEST(test_cleanse_plaintext);
  9858. #ifndef OPENSSL_NO_OCSP
  9859. ADD_TEST(test_tlsext_status_type);
  9860. #endif
  9861. ADD_TEST(test_session_with_only_int_cache);
  9862. ADD_TEST(test_session_with_only_ext_cache);
  9863. ADD_TEST(test_session_with_both_cache);
  9864. ADD_TEST(test_session_wo_ca_names);
  9865. #ifndef OSSL_NO_USABLE_TLS1_3
  9866. ADD_ALL_TESTS(test_stateful_tickets, 3);
  9867. ADD_ALL_TESTS(test_stateless_tickets, 3);
  9868. ADD_TEST(test_psk_tickets);
  9869. ADD_ALL_TESTS(test_extra_tickets, 6);
  9870. #endif
  9871. ADD_ALL_TESTS(test_ssl_set_bio, TOTAL_SSL_SET_BIO_TESTS);
  9872. ADD_TEST(test_ssl_bio_pop_next_bio);
  9873. ADD_TEST(test_ssl_bio_pop_ssl_bio);
  9874. ADD_TEST(test_ssl_bio_change_rbio);
  9875. ADD_TEST(test_ssl_bio_change_wbio);
  9876. #if !defined(OPENSSL_NO_TLS1_2) || defined(OSSL_NO_USABLE_TLS1_3)
  9877. ADD_ALL_TESTS(test_set_sigalgs, OSSL_NELEM(testsigalgs) * 2);
  9878. ADD_TEST(test_keylog);
  9879. #endif
  9880. #ifndef OSSL_NO_USABLE_TLS1_3
  9881. ADD_TEST(test_keylog_no_master_key);
  9882. #endif
  9883. ADD_TEST(test_client_cert_verify_cb);
  9884. ADD_TEST(test_ssl_build_cert_chain);
  9885. ADD_TEST(test_ssl_ctx_build_cert_chain);
  9886. #ifndef OPENSSL_NO_TLS1_2
  9887. ADD_TEST(test_client_hello_cb);
  9888. ADD_TEST(test_no_ems);
  9889. ADD_TEST(test_ccs_change_cipher);
  9890. #endif
  9891. #ifndef OSSL_NO_USABLE_TLS1_3
  9892. ADD_ALL_TESTS(test_early_data_read_write, 6);
  9893. /*
  9894. * We don't do replay tests for external PSK. Replay protection isn't used
  9895. * in that scenario.
  9896. */
  9897. ADD_ALL_TESTS(test_early_data_replay, 2);
  9898. ADD_ALL_TESTS(test_early_data_skip, OSSL_NELEM(ciphersuites) * 3);
  9899. ADD_ALL_TESTS(test_early_data_skip_hrr, OSSL_NELEM(ciphersuites) * 3);
  9900. ADD_ALL_TESTS(test_early_data_skip_hrr_fail, OSSL_NELEM(ciphersuites) * 3);
  9901. ADD_ALL_TESTS(test_early_data_skip_abort, OSSL_NELEM(ciphersuites) * 3);
  9902. ADD_ALL_TESTS(test_early_data_not_sent, 3);
  9903. ADD_ALL_TESTS(test_early_data_psk, 8);
  9904. ADD_ALL_TESTS(test_early_data_psk_with_all_ciphers, 5);
  9905. ADD_ALL_TESTS(test_early_data_not_expected, 3);
  9906. # ifndef OPENSSL_NO_TLS1_2
  9907. ADD_ALL_TESTS(test_early_data_tls1_2, 3);
  9908. # endif
  9909. #endif
  9910. #ifndef OSSL_NO_USABLE_TLS1_3
  9911. ADD_ALL_TESTS(test_set_ciphersuite, 10);
  9912. ADD_TEST(test_ciphersuite_change);
  9913. ADD_ALL_TESTS(test_tls13_ciphersuite, 4);
  9914. # ifdef OPENSSL_NO_PSK
  9915. ADD_ALL_TESTS(test_tls13_psk, 1);
  9916. # else
  9917. ADD_ALL_TESTS(test_tls13_psk, 4);
  9918. # endif /* OPENSSL_NO_PSK */
  9919. # ifndef OPENSSL_NO_TLS1_2
  9920. /* Test with both TLSv1.3 and 1.2 versions */
  9921. ADD_ALL_TESTS(test_key_exchange, 14);
  9922. # if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_DH)
  9923. ADD_ALL_TESTS(test_negotiated_group,
  9924. 4 * (OSSL_NELEM(ecdhe_kexch_groups)
  9925. + OSSL_NELEM(ffdhe_kexch_groups)));
  9926. # endif
  9927. # else
  9928. /* Test with only TLSv1.3 versions */
  9929. ADD_ALL_TESTS(test_key_exchange, 12);
  9930. # endif
  9931. ADD_ALL_TESTS(test_custom_exts, 6);
  9932. ADD_TEST(test_stateless);
  9933. ADD_TEST(test_pha_key_update);
  9934. #else
  9935. ADD_ALL_TESTS(test_custom_exts, 3);
  9936. #endif
  9937. ADD_ALL_TESTS(test_export_key_mat, 6);
  9938. #ifndef OSSL_NO_USABLE_TLS1_3
  9939. ADD_ALL_TESTS(test_export_key_mat_early, 3);
  9940. ADD_TEST(test_key_update);
  9941. ADD_ALL_TESTS(test_key_update_peer_in_write, 2);
  9942. ADD_ALL_TESTS(test_key_update_peer_in_read, 2);
  9943. ADD_ALL_TESTS(test_key_update_local_in_write, 2);
  9944. ADD_ALL_TESTS(test_key_update_local_in_read, 2);
  9945. #endif
  9946. ADD_ALL_TESTS(test_ssl_clear, 2);
  9947. ADD_ALL_TESTS(test_max_fragment_len_ext, OSSL_NELEM(max_fragment_len_test));
  9948. #if !defined(OPENSSL_NO_SRP) && !defined(OPENSSL_NO_TLS1_2)
  9949. ADD_ALL_TESTS(test_srp, 6);
  9950. #endif
  9951. #if !defined(OPENSSL_NO_COMP_ALG)
  9952. /* Add compression case */
  9953. ADD_ALL_TESTS(test_info_callback, 8);
  9954. #else
  9955. ADD_ALL_TESTS(test_info_callback, 6);
  9956. #endif
  9957. ADD_ALL_TESTS(test_ssl_pending, 2);
  9958. ADD_ALL_TESTS(test_ssl_get_shared_ciphers, OSSL_NELEM(shared_ciphers_data));
  9959. ADD_ALL_TESTS(test_ticket_callbacks, 20);
  9960. ADD_ALL_TESTS(test_shutdown, 7);
  9961. ADD_TEST(test_async_shutdown);
  9962. ADD_ALL_TESTS(test_incorrect_shutdown, 2);
  9963. ADD_ALL_TESTS(test_cert_cb, 6);
  9964. ADD_ALL_TESTS(test_client_cert_cb, 2);
  9965. ADD_ALL_TESTS(test_ca_names, 3);
  9966. #ifndef OPENSSL_NO_TLS1_2
  9967. ADD_ALL_TESTS(test_multiblock_write, OSSL_NELEM(multiblock_cipherlist_data));
  9968. #endif
  9969. ADD_ALL_TESTS(test_servername, 10);
  9970. #if !defined(OPENSSL_NO_EC) \
  9971. && (!defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2))
  9972. ADD_ALL_TESTS(test_sigalgs_available, 6);
  9973. #endif
  9974. #ifndef OPENSSL_NO_TLS1_3
  9975. ADD_ALL_TESTS(test_pluggable_group, 2);
  9976. ADD_ALL_TESTS(test_pluggable_signature, 4);
  9977. #endif
  9978. #ifndef OPENSSL_NO_TLS1_2
  9979. ADD_TEST(test_ssl_dup);
  9980. # ifndef OPENSSL_NO_DH
  9981. ADD_ALL_TESTS(test_set_tmp_dh, 11);
  9982. ADD_ALL_TESTS(test_dh_auto, 7);
  9983. # endif
  9984. #endif
  9985. #ifndef OSSL_NO_USABLE_TLS1_3
  9986. ADD_TEST(test_sni_tls13);
  9987. ADD_ALL_TESTS(test_ticket_lifetime, 2);
  9988. #endif
  9989. ADD_TEST(test_inherit_verify_param);
  9990. ADD_TEST(test_set_alpn);
  9991. ADD_TEST(test_set_verify_cert_store_ssl_ctx);
  9992. ADD_TEST(test_set_verify_cert_store_ssl);
  9993. ADD_ALL_TESTS(test_session_timeout, 1);
  9994. ADD_TEST(test_load_dhfile);
  9995. #ifndef OSSL_NO_USABLE_TLS1_3
  9996. ADD_TEST(test_read_ahead_key_change);
  9997. ADD_ALL_TESTS(test_tls13_record_padding, 4);
  9998. #endif
  9999. #if !defined(OPENSSL_NO_TLS1_2) && !defined(OSSL_NO_USABLE_TLS1_3)
  10000. ADD_ALL_TESTS(test_serverinfo_custom, 4);
  10001. #endif
  10002. #if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_DYNAMIC_ENGINE)
  10003. ADD_ALL_TESTS(test_pipelining, 6);
  10004. #endif
  10005. ADD_ALL_TESTS(test_version, 6);
  10006. ADD_TEST(test_rstate_string);
  10007. ADD_ALL_TESTS(test_handshake_retry, 16);
  10008. ADD_TEST(test_data_retry);
  10009. return 1;
  10010. err:
  10011. OPENSSL_free(cert);
  10012. OPENSSL_free(privkey);
  10013. OPENSSL_free(cert2);
  10014. OPENSSL_free(privkey2);
  10015. return 0;
  10016. }
  10017. void cleanup_tests(void)
  10018. {
  10019. # if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_DH)
  10020. EVP_PKEY_free(tmp_dh_params);
  10021. #endif
  10022. OPENSSL_free(cert);
  10023. OPENSSL_free(privkey);
  10024. OPENSSL_free(cert2);
  10025. OPENSSL_free(privkey2);
  10026. OPENSSL_free(cert1024);
  10027. OPENSSL_free(privkey1024);
  10028. OPENSSL_free(cert3072);
  10029. OPENSSL_free(privkey3072);
  10030. OPENSSL_free(cert4096);
  10031. OPENSSL_free(privkey4096);
  10032. OPENSSL_free(cert8192);
  10033. OPENSSL_free(privkey8192);
  10034. bio_s_mempacket_test_free();
  10035. bio_s_always_retry_free();
  10036. bio_s_maybe_retry_free();
  10037. OSSL_PROVIDER_unload(defctxnull);
  10038. OSSL_LIB_CTX_free(libctx);
  10039. }