tls13ccstest.c 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508
  1. /*
  2. * Copyright 2017-2024 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <openssl/ssl.h>
  10. #include <string.h>
  11. #include "helpers/ssltestlib.h"
  12. #include "testutil.h"
  13. #include "internal/packet.h"
  14. static char *cert = NULL;
  15. static char *privkey = NULL;
  16. static BIO *s_to_c_fbio = NULL, *c_to_s_fbio = NULL;
  17. static int chseen = 0, shseen = 0, sccsseen = 0, ccsaftersh = 0;
  18. static int ccsbeforesh = 0, sappdataseen = 0, cappdataseen = 0, badccs = 0;
  19. static int badvers = 0, badsessid = 0;
  20. static unsigned char chsessid[SSL_MAX_SSL_SESSION_ID_LENGTH];
  21. static size_t chsessidlen = 0;
  22. static int watchccs_new(BIO *bi);
  23. static int watchccs_free(BIO *a);
  24. static int watchccs_read(BIO *b, char *out, int outl);
  25. static int watchccs_write(BIO *b, const char *in, int inl);
  26. static long watchccs_ctrl(BIO *b, int cmd, long num, void *ptr);
  27. static int watchccs_gets(BIO *bp, char *buf, int size);
  28. static int watchccs_puts(BIO *bp, const char *str);
  29. /* Choose a sufficiently large type likely to be unused for this custom BIO */
  30. # define BIO_TYPE_WATCHCCS_FILTER (0x80 | BIO_TYPE_FILTER)
  31. static BIO_METHOD *method_watchccs = NULL;
  32. static const BIO_METHOD *bio_f_watchccs_filter(void)
  33. {
  34. if (method_watchccs == NULL) {
  35. method_watchccs = BIO_meth_new(BIO_TYPE_WATCHCCS_FILTER,
  36. "Watch CCS filter");
  37. if (method_watchccs == NULL
  38. || !BIO_meth_set_write(method_watchccs, watchccs_write)
  39. || !BIO_meth_set_read(method_watchccs, watchccs_read)
  40. || !BIO_meth_set_puts(method_watchccs, watchccs_puts)
  41. || !BIO_meth_set_gets(method_watchccs, watchccs_gets)
  42. || !BIO_meth_set_ctrl(method_watchccs, watchccs_ctrl)
  43. || !BIO_meth_set_create(method_watchccs, watchccs_new)
  44. || !BIO_meth_set_destroy(method_watchccs, watchccs_free))
  45. return NULL;
  46. }
  47. return method_watchccs;
  48. }
  49. static int watchccs_new(BIO *bio)
  50. {
  51. BIO_set_init(bio, 1);
  52. return 1;
  53. }
  54. static int watchccs_free(BIO *bio)
  55. {
  56. BIO_set_init(bio, 0);
  57. return 1;
  58. }
  59. static int watchccs_read(BIO *bio, char *out, int outl)
  60. {
  61. int ret = 0;
  62. BIO *next = BIO_next(bio);
  63. if (outl <= 0)
  64. return 0;
  65. if (next == NULL)
  66. return 0;
  67. BIO_clear_retry_flags(bio);
  68. ret = BIO_read(next, out, outl);
  69. if (ret <= 0 && BIO_should_read(next))
  70. BIO_set_retry_read(bio);
  71. return ret;
  72. }
  73. static int watchccs_write(BIO *bio, const char *in, int inl)
  74. {
  75. int ret = 0;
  76. BIO *next = BIO_next(bio);
  77. PACKET pkt, msg, msgbody, sessionid;
  78. unsigned int rectype, recvers, msgtype, expectedrecvers;
  79. if (inl <= 0)
  80. return 0;
  81. if (next == NULL)
  82. return 0;
  83. BIO_clear_retry_flags(bio);
  84. if (!PACKET_buf_init(&pkt, (const unsigned char *)in, inl))
  85. return 0;
  86. /* We assume that we always write complete records each time */
  87. while (PACKET_remaining(&pkt)) {
  88. if (!PACKET_get_1(&pkt, &rectype)
  89. || !PACKET_get_net_2(&pkt, &recvers)
  90. || !PACKET_get_length_prefixed_2(&pkt, &msg))
  91. return 0;
  92. expectedrecvers = TLS1_2_VERSION;
  93. if (rectype == SSL3_RT_HANDSHAKE) {
  94. if (!PACKET_get_1(&msg, &msgtype)
  95. || !PACKET_get_length_prefixed_3(&msg, &msgbody))
  96. return 0;
  97. if (msgtype == SSL3_MT_CLIENT_HELLO) {
  98. chseen++;
  99. /*
  100. * Skip legacy_version (2 bytes) and Random (32 bytes) to read
  101. * session_id.
  102. */
  103. if (!PACKET_forward(&msgbody, 34)
  104. || !PACKET_get_length_prefixed_1(&msgbody, &sessionid))
  105. return 0;
  106. if (chseen == 1) {
  107. expectedrecvers = TLS1_VERSION;
  108. /* Save the session id for later */
  109. chsessidlen = PACKET_remaining(&sessionid);
  110. if (!PACKET_copy_bytes(&sessionid, chsessid, chsessidlen))
  111. return 0;
  112. } else {
  113. /*
  114. * Check the session id for the second ClientHello is the
  115. * same as the first one.
  116. */
  117. if (PACKET_remaining(&sessionid) != chsessidlen
  118. || (chsessidlen > 0
  119. && memcmp(chsessid, PACKET_data(&sessionid),
  120. chsessidlen) != 0))
  121. badsessid = 1;
  122. }
  123. } else if (msgtype == SSL3_MT_SERVER_HELLO) {
  124. shseen++;
  125. /*
  126. * Skip legacy_version (2 bytes) and Random (32 bytes) to read
  127. * session_id.
  128. */
  129. if (!PACKET_forward(&msgbody, 34)
  130. || !PACKET_get_length_prefixed_1(&msgbody, &sessionid))
  131. return 0;
  132. /*
  133. * Check the session id is the same as the one in the
  134. * ClientHello
  135. */
  136. if (PACKET_remaining(&sessionid) != chsessidlen
  137. || (chsessidlen > 0
  138. && memcmp(chsessid, PACKET_data(&sessionid),
  139. chsessidlen) != 0))
  140. badsessid = 1;
  141. }
  142. } else if (rectype == SSL3_RT_CHANGE_CIPHER_SPEC) {
  143. if (bio == s_to_c_fbio) {
  144. /*
  145. * Server writing. We shouldn't have written any app data
  146. * yet, and we should have seen both the ClientHello and the
  147. * ServerHello
  148. */
  149. if (!sappdataseen
  150. && chseen == 1
  151. && shseen == 1
  152. && !sccsseen)
  153. sccsseen = 1;
  154. else
  155. badccs = 1;
  156. } else if (!cappdataseen) {
  157. /*
  158. * Client writing. We shouldn't have written any app data
  159. * yet, and we should have seen the ClientHello
  160. */
  161. if (shseen == 1 && !ccsaftersh)
  162. ccsaftersh = 1;
  163. else if (shseen == 0 && !ccsbeforesh)
  164. ccsbeforesh = 1;
  165. else
  166. badccs = 1;
  167. } else {
  168. badccs = 1;
  169. }
  170. } else if (rectype == SSL3_RT_APPLICATION_DATA) {
  171. if (bio == s_to_c_fbio)
  172. sappdataseen = 1;
  173. else
  174. cappdataseen = 1;
  175. }
  176. if (recvers != expectedrecvers)
  177. badvers = 1;
  178. }
  179. ret = BIO_write(next, in, inl);
  180. if (ret <= 0 && BIO_should_write(next))
  181. BIO_set_retry_write(bio);
  182. return ret;
  183. }
  184. static long watchccs_ctrl(BIO *bio, int cmd, long num, void *ptr)
  185. {
  186. long ret;
  187. BIO *next = BIO_next(bio);
  188. if (next == NULL)
  189. return 0;
  190. switch (cmd) {
  191. case BIO_CTRL_DUP:
  192. ret = 0;
  193. break;
  194. default:
  195. ret = BIO_ctrl(next, cmd, num, ptr);
  196. break;
  197. }
  198. return ret;
  199. }
  200. static int watchccs_gets(BIO *bio, char *buf, int size)
  201. {
  202. /* We don't support this - not needed anyway */
  203. return -1;
  204. }
  205. static int watchccs_puts(BIO *bio, const char *str)
  206. {
  207. return watchccs_write(bio, str, strlen(str));
  208. }
  209. static int test_tls13ccs(int tst)
  210. {
  211. SSL_CTX *sctx = NULL, *cctx = NULL;
  212. SSL *sssl = NULL, *cssl = NULL;
  213. int ret = 0;
  214. const char msg[] = "Dummy data";
  215. char buf[80];
  216. size_t written, readbytes;
  217. SSL_SESSION *sess = NULL;
  218. chseen = shseen = sccsseen = ccsaftersh = ccsbeforesh = 0;
  219. sappdataseen = cappdataseen = badccs = badvers = badsessid = 0;
  220. chsessidlen = 0;
  221. if (!TEST_true(create_ssl_ctx_pair(NULL, TLS_server_method(),
  222. TLS_client_method(), TLS1_VERSION, 0,
  223. &sctx, &cctx, cert, privkey))
  224. || !TEST_true(SSL_CTX_set_max_early_data(sctx,
  225. SSL3_RT_MAX_PLAIN_LENGTH)))
  226. goto err;
  227. /*
  228. * Test 0: Simple Handshake
  229. * Test 1: Simple Handshake, client middlebox compat mode disabled
  230. * Test 2: Simple Handshake, server middlebox compat mode disabled
  231. * Test 3: HRR Handshake
  232. * Test 4: HRR Handshake, client middlebox compat mode disabled
  233. * Test 5: HRR Handshake, server middlebox compat mode disabled
  234. * Test 6: Early data handshake
  235. * Test 7: Early data handshake, client middlebox compat mode disabled
  236. * Test 8: Early data handshake, server middlebox compat mode disabled
  237. * Test 9: Early data then HRR
  238. * Test 10: Early data then HRR, client middlebox compat mode disabled
  239. * Test 11: Early data then HRR, server middlebox compat mode disabled
  240. */
  241. switch (tst) {
  242. case 0:
  243. case 3:
  244. case 6:
  245. case 9:
  246. break;
  247. case 1:
  248. case 4:
  249. case 7:
  250. case 10:
  251. SSL_CTX_clear_options(cctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
  252. break;
  253. case 2:
  254. case 5:
  255. case 8:
  256. case 11:
  257. SSL_CTX_clear_options(sctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
  258. break;
  259. default:
  260. TEST_error("Invalid test value");
  261. goto err;
  262. }
  263. if (tst >= 6) {
  264. /* Get a session suitable for early_data */
  265. if (!TEST_true(create_ssl_objects(sctx, cctx, &sssl, &cssl, NULL, NULL))
  266. || !TEST_true(create_ssl_connection(sssl, cssl, SSL_ERROR_NONE)))
  267. goto err;
  268. sess = SSL_get1_session(cssl);
  269. if (!TEST_ptr(sess))
  270. goto err;
  271. SSL_shutdown(cssl);
  272. SSL_shutdown(sssl);
  273. SSL_free(sssl);
  274. SSL_free(cssl);
  275. sssl = cssl = NULL;
  276. }
  277. if ((tst >= 3 && tst <= 5) || tst >= 9) {
  278. /* HRR handshake */
  279. #if defined(OPENSSL_NO_EC)
  280. # if !defined(OPENSSL_NO_DH)
  281. if (!TEST_true(SSL_CTX_set1_groups_list(sctx, "ffdhe3072")))
  282. goto err;
  283. # endif
  284. #else
  285. if (!TEST_true(SSL_CTX_set1_groups_list(sctx, "P-384")))
  286. goto err;
  287. #endif
  288. }
  289. s_to_c_fbio = BIO_new(bio_f_watchccs_filter());
  290. c_to_s_fbio = BIO_new(bio_f_watchccs_filter());
  291. if (!TEST_ptr(s_to_c_fbio)
  292. || !TEST_ptr(c_to_s_fbio)) {
  293. BIO_free(s_to_c_fbio);
  294. BIO_free(c_to_s_fbio);
  295. goto err;
  296. }
  297. /* BIOs get freed on error */
  298. if (!TEST_true(create_ssl_objects(sctx, cctx, &sssl, &cssl, s_to_c_fbio,
  299. c_to_s_fbio)))
  300. goto err;
  301. if (tst >= 6) {
  302. /* Early data */
  303. if (!TEST_true(SSL_set_session(cssl, sess))
  304. || !TEST_true(SSL_write_early_data(cssl, msg, strlen(msg),
  305. &written))
  306. || (tst <= 8
  307. && !TEST_int_eq(SSL_read_early_data(sssl, buf, sizeof(buf),
  308. &readbytes),
  309. SSL_READ_EARLY_DATA_SUCCESS)))
  310. goto err;
  311. if (tst <= 8) {
  312. if (!TEST_int_gt(SSL_connect(cssl), 0))
  313. goto err;
  314. } else {
  315. if (!TEST_int_le(SSL_connect(cssl), 0))
  316. goto err;
  317. }
  318. if (!TEST_int_eq(SSL_read_early_data(sssl, buf, sizeof(buf),
  319. &readbytes),
  320. SSL_READ_EARLY_DATA_FINISH))
  321. goto err;
  322. }
  323. /* Perform handshake (or complete it if doing early data ) */
  324. if (!TEST_true(create_ssl_connection(sssl, cssl, SSL_ERROR_NONE)))
  325. goto err;
  326. /*
  327. * Check there were no unexpected CCS messages, all record versions
  328. * were as expected, and that the session ids were reflected by the server
  329. * correctly.
  330. */
  331. if (!TEST_false(badccs) || !TEST_false(badvers) || !TEST_false(badsessid))
  332. goto err;
  333. switch (tst) {
  334. case 0:
  335. if (!TEST_true(sccsseen)
  336. || !TEST_true(ccsaftersh)
  337. || !TEST_false(ccsbeforesh)
  338. || !TEST_size_t_gt(chsessidlen, 0))
  339. goto err;
  340. break;
  341. case 1:
  342. if (!TEST_true(sccsseen)
  343. || !TEST_false(ccsaftersh)
  344. || !TEST_false(ccsbeforesh)
  345. || !TEST_size_t_eq(chsessidlen, 0))
  346. goto err;
  347. break;
  348. case 2:
  349. if (!TEST_false(sccsseen)
  350. || !TEST_true(ccsaftersh)
  351. || !TEST_false(ccsbeforesh)
  352. || !TEST_size_t_gt(chsessidlen, 0))
  353. goto err;
  354. break;
  355. case 3:
  356. if (!TEST_true(sccsseen)
  357. || !TEST_true(ccsaftersh)
  358. || !TEST_false(ccsbeforesh)
  359. || !TEST_size_t_gt(chsessidlen, 0))
  360. goto err;
  361. break;
  362. case 4:
  363. if (!TEST_true(sccsseen)
  364. || !TEST_false(ccsaftersh)
  365. || !TEST_false(ccsbeforesh)
  366. || !TEST_size_t_eq(chsessidlen, 0))
  367. goto err;
  368. break;
  369. case 5:
  370. if (!TEST_false(sccsseen)
  371. || !TEST_true(ccsaftersh)
  372. || !TEST_false(ccsbeforesh)
  373. || !TEST_size_t_gt(chsessidlen, 0))
  374. goto err;
  375. break;
  376. case 6:
  377. if (!TEST_true(sccsseen)
  378. || !TEST_false(ccsaftersh)
  379. || !TEST_true(ccsbeforesh)
  380. || !TEST_size_t_gt(chsessidlen, 0))
  381. goto err;
  382. break;
  383. case 7:
  384. if (!TEST_true(sccsseen)
  385. || !TEST_false(ccsaftersh)
  386. || !TEST_false(ccsbeforesh)
  387. || !TEST_size_t_eq(chsessidlen, 0))
  388. goto err;
  389. break;
  390. case 8:
  391. if (!TEST_false(sccsseen)
  392. || !TEST_false(ccsaftersh)
  393. || !TEST_true(ccsbeforesh)
  394. || !TEST_size_t_gt(chsessidlen, 0))
  395. goto err;
  396. break;
  397. case 9:
  398. if (!TEST_true(sccsseen)
  399. || !TEST_false(ccsaftersh)
  400. || !TEST_true(ccsbeforesh)
  401. || !TEST_size_t_gt(chsessidlen, 0))
  402. goto err;
  403. break;
  404. case 10:
  405. if (!TEST_true(sccsseen)
  406. || !TEST_false(ccsaftersh)
  407. || !TEST_false(ccsbeforesh)
  408. || !TEST_size_t_eq(chsessidlen, 0))
  409. goto err;
  410. break;
  411. case 11:
  412. if (!TEST_false(sccsseen)
  413. || !TEST_false(ccsaftersh)
  414. || !TEST_true(ccsbeforesh)
  415. || !TEST_size_t_gt(chsessidlen, 0))
  416. goto err;
  417. break;
  418. }
  419. ret = 1;
  420. err:
  421. SSL_SESSION_free(sess);
  422. SSL_free(sssl);
  423. SSL_free(cssl);
  424. SSL_CTX_free(sctx);
  425. SSL_CTX_free(cctx);
  426. return ret;
  427. }
  428. OPT_TEST_DECLARE_USAGE("certfile privkeyfile\n")
  429. int setup_tests(void)
  430. {
  431. if (!test_skip_common_options()) {
  432. TEST_error("Error parsing test options\n");
  433. return 0;
  434. }
  435. if (!TEST_ptr(cert = test_get_argument(0))
  436. || !TEST_ptr(privkey = test_get_argument(1)))
  437. return 0;
  438. ADD_ALL_TESTS(test_tls13ccs, 12);
  439. return 1;
  440. }
  441. void cleanup_tests(void)
  442. {
  443. BIO_meth_free(method_watchccs);
  444. }