dtls_mtu_test.c 6.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196
  1. /*
  2. * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include <string.h>
  11. #include <openssl/dtls1.h>
  12. #include <openssl/ssl.h>
  13. #include <openssl/err.h>
  14. #include "helpers/ssltestlib.h"
  15. #include "testutil.h"
  16. /* for SSL_READ_ETM() */
  17. #include "../ssl/ssl_local.h"
  18. static int debug = 0;
  19. static unsigned int clnt_psk_callback(SSL *ssl, const char *hint,
  20. char *ident, unsigned int max_ident_len,
  21. unsigned char *psk,
  22. unsigned int max_psk_len)
  23. {
  24. BIO_snprintf(ident, max_ident_len, "psk");
  25. if (max_psk_len > 20)
  26. max_psk_len = 20;
  27. memset(psk, 0x5a, max_psk_len);
  28. return max_psk_len;
  29. }
  30. static unsigned int srvr_psk_callback(SSL *ssl, const char *identity,
  31. unsigned char *psk,
  32. unsigned int max_psk_len)
  33. {
  34. if (max_psk_len > 20)
  35. max_psk_len = 20;
  36. memset(psk, 0x5a, max_psk_len);
  37. return max_psk_len;
  38. }
  39. static int mtu_test(SSL_CTX *ctx, const char *cs, int no_etm)
  40. {
  41. SSL *srvr_ssl = NULL, *clnt_ssl = NULL;
  42. BIO *sc_bio = NULL;
  43. int i;
  44. size_t s;
  45. size_t mtus[30];
  46. unsigned char buf[600];
  47. int rv = 0;
  48. memset(buf, 0x5a, sizeof(buf));
  49. if (!TEST_true(create_ssl_objects(ctx, ctx, &srvr_ssl, &clnt_ssl,
  50. NULL, NULL)))
  51. goto end;
  52. if (no_etm)
  53. SSL_set_options(srvr_ssl, SSL_OP_NO_ENCRYPT_THEN_MAC);
  54. if (!TEST_true(SSL_set_cipher_list(srvr_ssl, cs))
  55. || !TEST_true(SSL_set_cipher_list(clnt_ssl, cs))
  56. || !TEST_ptr(sc_bio = SSL_get_rbio(srvr_ssl))
  57. || !TEST_true(create_ssl_connection(clnt_ssl, srvr_ssl,
  58. SSL_ERROR_NONE)))
  59. goto end;
  60. if (debug)
  61. TEST_info("Channel established");
  62. /* For record MTU values between 500 and 539, call DTLS_get_data_mtu()
  63. * to query the payload MTU which will fit. */
  64. for (i = 0; i < 30; i++) {
  65. SSL_set_mtu(clnt_ssl, 500 + i);
  66. mtus[i] = DTLS_get_data_mtu(clnt_ssl);
  67. if (debug)
  68. TEST_info("%s%s MTU for record mtu %d = %lu",
  69. cs, no_etm ? "-noEtM" : "",
  70. 500 + i, (unsigned long)mtus[i]);
  71. if (!TEST_size_t_ne(mtus[i], 0)) {
  72. TEST_info("Cipher %s MTU %d", cs, 500 + i);
  73. goto end;
  74. }
  75. }
  76. /* Now get out of the way */
  77. SSL_set_mtu(clnt_ssl, 1000);
  78. /*
  79. * Now for all values in the range of payload MTUs, send a payload of
  80. * that size and see what actual record size we end up with.
  81. */
  82. for (s = mtus[0]; s <= mtus[29]; s++) {
  83. size_t reclen;
  84. if (!TEST_int_eq(SSL_write(clnt_ssl, buf, s), (int)s))
  85. goto end;
  86. reclen = BIO_read(sc_bio, buf, sizeof(buf));
  87. if (debug)
  88. TEST_info("record %zu for payload %zu", reclen, s);
  89. for (i = 0; i < 30; i++) {
  90. /* DTLS_get_data_mtu() with record MTU 500+i returned mtus[i] ... */
  91. if (!TEST_false(s <= mtus[i] && reclen > (size_t)(500 + i))) {
  92. /*
  93. * We sent a packet smaller than or equal to mtus[j] and
  94. * that made a record *larger* than the record MTU 500+j!
  95. */
  96. TEST_error("%s: s=%lu, mtus[i]=%lu, reclen=%lu, i=%d",
  97. cs, (unsigned long)s, (unsigned long)mtus[i],
  98. (unsigned long)reclen, 500 + i);
  99. goto end;
  100. }
  101. if (!TEST_false(s > mtus[i] && reclen <= (size_t)(500 + i))) {
  102. /*
  103. * We sent a *larger* packet than mtus[i] and that *still*
  104. * fits within the record MTU 500+i, so DTLS_get_data_mtu()
  105. * was overly pessimistic.
  106. */
  107. TEST_error("%s: s=%lu, mtus[i]=%lu, reclen=%lu, i=%d",
  108. cs, (unsigned long)s, (unsigned long)mtus[i],
  109. (unsigned long)reclen, 500 + i);
  110. goto end;
  111. }
  112. }
  113. }
  114. rv = 1;
  115. if (SSL_READ_ETM(clnt_ssl))
  116. rv = 2;
  117. end:
  118. SSL_free(clnt_ssl);
  119. SSL_free(srvr_ssl);
  120. return rv;
  121. }
  122. static int run_mtu_tests(void)
  123. {
  124. SSL_CTX *ctx = NULL;
  125. STACK_OF(SSL_CIPHER) *ciphers;
  126. int i, ret = 0;
  127. if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_method())))
  128. goto end;
  129. SSL_CTX_set_psk_server_callback(ctx, srvr_psk_callback);
  130. SSL_CTX_set_psk_client_callback(ctx, clnt_psk_callback);
  131. SSL_CTX_set_security_level(ctx, 0);
  132. /*
  133. * We only care about iterating over each enc/mac; we don't want to
  134. * repeat the test for each auth/kx variant. So keep life simple and
  135. * only do (non-DH) PSK.
  136. */
  137. if (!TEST_true(SSL_CTX_set_cipher_list(ctx, "PSK")))
  138. goto end;
  139. ciphers = SSL_CTX_get_ciphers(ctx);
  140. for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
  141. const SSL_CIPHER *cipher = sk_SSL_CIPHER_value(ciphers, i);
  142. const char *cipher_name = SSL_CIPHER_get_name(cipher);
  143. /* As noted above, only one test for each enc/mac variant. */
  144. if (strncmp(cipher_name, "PSK-", 4) != 0)
  145. continue;
  146. if (!TEST_int_gt(ret = mtu_test(ctx, cipher_name, 0), 0))
  147. break;
  148. TEST_info("%s OK", cipher_name);
  149. if (ret == 1)
  150. continue;
  151. /* mtu_test() returns 2 if it used Encrypt-then-MAC */
  152. if (!TEST_int_gt(ret = mtu_test(ctx, cipher_name, 1), 0))
  153. break;
  154. TEST_info("%s without EtM OK", cipher_name);
  155. }
  156. end:
  157. SSL_CTX_free(ctx);
  158. bio_s_mempacket_test_free();
  159. return ret;
  160. }
  161. int setup_tests(void)
  162. {
  163. ADD_TEST(run_mtu_tests);
  164. return 1;
  165. }