2
0

sslapitest.c 311 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401440244034404440544064407440844094410441144124413441444154416441744184419442044214422442344244425442644274428442944304431443244334434443544364437443844394440444144424443444444454446444744484449445044514452445344544455445644574458445944604461446244634464446544664467446844694470447144724473447444754476447744784479448044814482448344844485448644874488448944904491449244934494449544964497449844994500450145024503450445054506450745084509451045114512451345144515451645174518451945204521452245234524452545264527452845294530453145324533453445354536453745384539454045414542454345444545454645474548454945504551455245534554455545564557455845594560456145624563456445654566456745684569457045714572457345744575457645774578457945804581458245834584458545864587458845894590459145924593459445954596459745984599460046014602460346044605460646074608460946104611461246134614461546164617461846194620462146224623462446254626462746284629463046314632463346344635463646374638463946404641464246434644464546464647464846494650465146524653465446554656465746584659466046614662466346644665466646674668466946704671467246734674467546764677467846794680468146824683468446854686468746884689469046914692469346944695469646974698469947004701470247034704470547064707470847094710471147124713471447154716471747184719472047214722472347244725472647274728472947304731473247334734473547364737473847394740474147424743474447454746474747484749475047514752475347544755475647574758475947604761476247634764476547664767476847694770477147724773477447754776477747784779478047814782478347844785478647874788478947904791479247934794479547964797479847994800480148024803480448054806480748084809481048114812481348144815481648174818481948204821482248234824482548264827482848294830483148324833483448354836483748384839484048414842484348444845484648474848484948504851485248534854485548564857485848594860486148624863486448654866486748684869487048714872487348744875487648774878487948804881488248834884488548864887488848894890489148924893489448954896489748984899490049014902490349044905490649074908490949104911491249134914491549164917491849194920492149224923492449254926492749284929493049314932493349344935493649374938493949404941494249434944494549464947494849494950495149524953495449554956495749584959496049614962496349644965496649674968496949704971497249734974497549764977497849794980498149824983498449854986498749884989499049914992499349944995499649974998499950005001500250035004500550065007500850095010501150125013501450155016501750185019502050215022502350245025502650275028502950305031503250335034503550365037503850395040504150425043504450455046504750485049505050515052505350545055505650575058505950605061506250635064506550665067506850695070507150725073507450755076507750785079508050815082508350845085508650875088508950905091509250935094509550965097509850995100510151025103510451055106510751085109511051115112511351145115511651175118511951205121512251235124512551265127512851295130513151325133513451355136513751385139514051415142514351445145514651475148514951505151515251535154515551565157515851595160516151625163516451655166516751685169517051715172517351745175517651775178517951805181518251835184518551865187518851895190519151925193519451955196519751985199520052015202520352045205520652075208520952105211521252135214521552165217521852195220522152225223522452255226522752285229523052315232523352345235523652375238523952405241524252435244524552465247524852495250525152525253525452555256525752585259526052615262526352645265526652675268526952705271527252735274527552765277527852795280528152825283528452855286528752885289529052915292529352945295529652975298529953005301530253035304530553065307530853095310531153125313531453155316531753185319532053215322532353245325532653275328532953305331533253335334533553365337533853395340534153425343534453455346534753485349535053515352535353545355535653575358535953605361536253635364536553665367536853695370537153725373537453755376537753785379538053815382538353845385538653875388538953905391539253935394539553965397539853995400540154025403540454055406540754085409541054115412541354145415541654175418541954205421542254235424542554265427542854295430543154325433543454355436543754385439544054415442544354445445544654475448544954505451545254535454545554565457545854595460546154625463546454655466546754685469547054715472547354745475547654775478547954805481548254835484548554865487548854895490549154925493549454955496549754985499550055015502550355045505550655075508550955105511551255135514551555165517551855195520552155225523552455255526552755285529553055315532553355345535553655375538553955405541554255435544554555465547554855495550555155525553555455555556555755585559556055615562556355645565556655675568556955705571557255735574557555765577557855795580558155825583558455855586558755885589559055915592559355945595559655975598559956005601560256035604560556065607560856095610561156125613561456155616561756185619562056215622562356245625562656275628562956305631563256335634563556365637563856395640564156425643564456455646564756485649565056515652565356545655565656575658565956605661566256635664566556665667566856695670567156725673567456755676567756785679568056815682568356845685568656875688568956905691569256935694569556965697569856995700570157025703570457055706570757085709571057115712571357145715571657175718571957205721572257235724572557265727572857295730573157325733573457355736573757385739574057415742574357445745574657475748574957505751575257535754575557565757575857595760576157625763576457655766576757685769577057715772577357745775577657775778577957805781578257835784578557865787578857895790579157925793579457955796579757985799580058015802580358045805580658075808580958105811581258135814581558165817581858195820582158225823582458255826582758285829583058315832583358345835583658375838583958405841584258435844584558465847584858495850585158525853585458555856585758585859586058615862586358645865586658675868586958705871587258735874587558765877587858795880588158825883588458855886588758885889589058915892589358945895589658975898589959005901590259035904590559065907590859095910591159125913591459155916591759185919592059215922592359245925592659275928592959305931593259335934593559365937593859395940594159425943594459455946594759485949595059515952595359545955595659575958595959605961596259635964596559665967596859695970597159725973597459755976597759785979598059815982598359845985598659875988598959905991599259935994599559965997599859996000600160026003600460056006600760086009601060116012601360146015601660176018601960206021602260236024602560266027602860296030603160326033603460356036603760386039604060416042604360446045604660476048604960506051605260536054605560566057605860596060606160626063606460656066606760686069607060716072607360746075607660776078607960806081608260836084608560866087608860896090609160926093609460956096609760986099610061016102610361046105610661076108610961106111611261136114611561166117611861196120612161226123612461256126612761286129613061316132613361346135613661376138613961406141614261436144614561466147614861496150615161526153615461556156615761586159616061616162616361646165616661676168616961706171617261736174617561766177617861796180618161826183618461856186618761886189619061916192619361946195619661976198619962006201620262036204620562066207620862096210621162126213621462156216621762186219622062216222622362246225622662276228622962306231623262336234623562366237623862396240624162426243624462456246624762486249625062516252625362546255625662576258625962606261626262636264626562666267626862696270627162726273627462756276627762786279628062816282628362846285628662876288628962906291629262936294629562966297629862996300630163026303630463056306630763086309631063116312631363146315631663176318631963206321632263236324632563266327632863296330633163326333633463356336633763386339634063416342634363446345634663476348634963506351635263536354635563566357635863596360636163626363636463656366636763686369637063716372637363746375637663776378637963806381638263836384638563866387638863896390639163926393639463956396639763986399640064016402640364046405640664076408640964106411641264136414641564166417641864196420642164226423642464256426642764286429643064316432643364346435643664376438643964406441644264436444644564466447644864496450645164526453645464556456645764586459646064616462646364646465646664676468646964706471647264736474647564766477647864796480648164826483648464856486648764886489649064916492649364946495649664976498649965006501650265036504650565066507650865096510651165126513651465156516651765186519652065216522652365246525652665276528652965306531653265336534653565366537653865396540654165426543654465456546654765486549655065516552655365546555655665576558655965606561656265636564656565666567656865696570657165726573657465756576657765786579658065816582658365846585658665876588658965906591659265936594659565966597659865996600660166026603660466056606660766086609661066116612661366146615661666176618661966206621662266236624662566266627662866296630663166326633663466356636663766386639664066416642664366446645664666476648664966506651665266536654665566566657665866596660666166626663666466656666666766686669667066716672667366746675667666776678667966806681668266836684668566866687668866896690669166926693669466956696669766986699670067016702670367046705670667076708670967106711671267136714671567166717671867196720672167226723672467256726672767286729673067316732673367346735673667376738673967406741674267436744674567466747674867496750675167526753675467556756675767586759676067616762676367646765676667676768676967706771677267736774677567766777677867796780678167826783678467856786678767886789679067916792679367946795679667976798679968006801680268036804680568066807680868096810681168126813681468156816681768186819682068216822682368246825682668276828682968306831683268336834683568366837683868396840684168426843684468456846684768486849685068516852685368546855685668576858685968606861686268636864686568666867686868696870687168726873687468756876687768786879688068816882688368846885688668876888688968906891689268936894689568966897689868996900690169026903690469056906690769086909691069116912691369146915691669176918691969206921692269236924692569266927692869296930693169326933693469356936693769386939694069416942694369446945694669476948694969506951695269536954695569566957695869596960696169626963696469656966696769686969697069716972697369746975697669776978697969806981698269836984698569866987698869896990699169926993699469956996699769986999700070017002700370047005700670077008700970107011701270137014701570167017701870197020702170227023702470257026702770287029703070317032703370347035703670377038703970407041704270437044704570467047704870497050705170527053705470557056705770587059706070617062706370647065706670677068706970707071707270737074707570767077707870797080708170827083708470857086708770887089709070917092709370947095709670977098709971007101710271037104710571067107710871097110711171127113711471157116711771187119712071217122712371247125712671277128712971307131713271337134713571367137713871397140714171427143714471457146714771487149715071517152715371547155715671577158715971607161716271637164716571667167716871697170717171727173717471757176717771787179718071817182718371847185718671877188718971907191719271937194719571967197719871997200720172027203720472057206720772087209721072117212721372147215721672177218721972207221722272237224722572267227722872297230723172327233723472357236723772387239724072417242724372447245724672477248724972507251725272537254725572567257725872597260726172627263726472657266726772687269727072717272727372747275727672777278727972807281728272837284728572867287728872897290729172927293729472957296729772987299730073017302730373047305730673077308730973107311731273137314731573167317731873197320732173227323732473257326732773287329733073317332733373347335733673377338733973407341734273437344734573467347734873497350735173527353735473557356735773587359736073617362736373647365736673677368736973707371737273737374737573767377737873797380738173827383738473857386738773887389739073917392739373947395739673977398739974007401740274037404740574067407740874097410741174127413741474157416741774187419742074217422742374247425742674277428742974307431743274337434743574367437743874397440744174427443744474457446744774487449745074517452745374547455745674577458745974607461746274637464746574667467746874697470747174727473747474757476747774787479748074817482748374847485748674877488748974907491749274937494749574967497749874997500750175027503750475057506750775087509751075117512751375147515751675177518751975207521752275237524752575267527752875297530753175327533753475357536753775387539754075417542754375447545754675477548754975507551755275537554755575567557755875597560756175627563756475657566756775687569757075717572757375747575757675777578757975807581758275837584758575867587758875897590759175927593759475957596759775987599760076017602760376047605760676077608760976107611761276137614761576167617761876197620762176227623762476257626762776287629763076317632763376347635763676377638763976407641764276437644764576467647764876497650765176527653765476557656765776587659766076617662766376647665766676677668766976707671767276737674767576767677767876797680768176827683768476857686768776887689769076917692769376947695769676977698769977007701770277037704770577067707770877097710771177127713771477157716771777187719772077217722772377247725772677277728772977307731773277337734773577367737773877397740774177427743774477457746774777487749775077517752775377547755775677577758775977607761776277637764776577667767776877697770777177727773777477757776777777787779778077817782778377847785778677877788778977907791779277937794779577967797779877997800780178027803780478057806780778087809781078117812781378147815781678177818781978207821782278237824782578267827782878297830783178327833783478357836783778387839784078417842784378447845784678477848784978507851785278537854785578567857785878597860786178627863786478657866786778687869787078717872787378747875787678777878787978807881788278837884788578867887788878897890789178927893789478957896789778987899790079017902790379047905790679077908790979107911791279137914791579167917791879197920792179227923792479257926792779287929793079317932793379347935793679377938793979407941794279437944794579467947794879497950795179527953795479557956795779587959796079617962796379647965796679677968796979707971797279737974797579767977797879797980798179827983798479857986798779887989799079917992799379947995799679977998799980008001800280038004800580068007800880098010801180128013801480158016801780188019802080218022802380248025802680278028802980308031803280338034803580368037803880398040804180428043804480458046804780488049805080518052805380548055805680578058805980608061806280638064806580668067806880698070807180728073807480758076807780788079808080818082808380848085808680878088808980908091809280938094809580968097809880998100810181028103810481058106810781088109811081118112811381148115811681178118811981208121812281238124812581268127812881298130813181328133813481358136813781388139814081418142814381448145814681478148814981508151815281538154815581568157815881598160816181628163816481658166816781688169817081718172817381748175817681778178817981808181818281838184818581868187818881898190819181928193819481958196819781988199820082018202820382048205820682078208820982108211821282138214821582168217821882198220822182228223822482258226822782288229823082318232823382348235823682378238823982408241824282438244824582468247824882498250825182528253825482558256825782588259826082618262826382648265826682678268826982708271827282738274827582768277827882798280828182828283828482858286828782888289829082918292829382948295829682978298829983008301830283038304830583068307830883098310831183128313831483158316831783188319832083218322832383248325832683278328832983308331833283338334833583368337833883398340834183428343834483458346834783488349835083518352835383548355835683578358835983608361836283638364836583668367836883698370837183728373837483758376837783788379838083818382838383848385838683878388838983908391839283938394839583968397839883998400840184028403840484058406840784088409841084118412841384148415841684178418841984208421842284238424842584268427842884298430843184328433843484358436843784388439844084418442844384448445844684478448844984508451845284538454845584568457845884598460846184628463846484658466846784688469847084718472847384748475847684778478847984808481848284838484848584868487848884898490849184928493849484958496849784988499850085018502850385048505850685078508850985108511851285138514851585168517851885198520852185228523852485258526852785288529853085318532853385348535853685378538853985408541854285438544854585468547854885498550855185528553855485558556855785588559856085618562856385648565856685678568856985708571857285738574857585768577857885798580858185828583858485858586858785888589859085918592859385948595859685978598859986008601860286038604860586068607860886098610861186128613861486158616861786188619862086218622862386248625862686278628862986308631863286338634863586368637863886398640864186428643864486458646864786488649865086518652865386548655865686578658865986608661866286638664866586668667866886698670867186728673867486758676867786788679868086818682868386848685868686878688868986908691869286938694869586968697869886998700870187028703870487058706870787088709871087118712871387148715871687178718871987208721872287238724872587268727872887298730873187328733873487358736873787388739874087418742874387448745874687478748874987508751875287538754875587568757875887598760876187628763876487658766876787688769877087718772877387748775877687778778877987808781878287838784878587868787878887898790879187928793879487958796879787988799880088018802880388048805880688078808880988108811881288138814881588168817881888198820882188228823882488258826882788288829883088318832883388348835883688378838883988408841884288438844884588468847884888498850885188528853885488558856885788588859886088618862886388648865886688678868886988708871887288738874887588768877887888798880888188828883888488858886888788888889889088918892889388948895889688978898889989008901890289038904890589068907890889098910891189128913891489158916891789188919892089218922892389248925892689278928892989308931893289338934893589368937893889398940894189428943894489458946894789488949895089518952895389548955895689578958895989608961896289638964896589668967896889698970897189728973897489758976897789788979898089818982898389848985898689878988898989908991899289938994899589968997899889999000900190029003900490059006900790089009901090119012901390149015901690179018901990209021902290239024902590269027902890299030903190329033903490359036903790389039904090419042904390449045904690479048904990509051905290539054905590569057905890599060906190629063906490659066906790689069907090719072907390749075907690779078907990809081908290839084908590869087908890899090909190929093909490959096909790989099910091019102910391049105910691079108910991109111911291139114911591169117911891199120912191229123912491259126912791289129913091319132913391349135913691379138913991409141914291439144914591469147914891499150915191529153915491559156915791589159916091619162916391649165916691679168916991709171917291739174917591769177917891799180918191829183918491859186918791889189919091919192919391949195919691979198919992009201920292039204920592069207920892099210921192129213921492159216921792189219922092219222922392249225922692279228922992309231923292339234923592369237923892399240924192429243924492459246924792489249925092519252925392549255925692579258925992609261926292639264926592669267926892699270927192729273927492759276927792789279928092819282928392849285928692879288928992909291929292939294929592969297929892999300930193029303930493059306930793089309931093119312931393149315931693179318931993209321
  1. /*
  2. * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * We need access to the deprecated low level HMAC APIs for legacy purposes
  11. * when the deprecated calls are not hidden
  12. */
  13. #ifndef OPENSSL_NO_DEPRECATED_3_0
  14. # define OPENSSL_SUPPRESS_DEPRECATED
  15. #endif
  16. #include <stdio.h>
  17. #include <string.h>
  18. #include <openssl/opensslconf.h>
  19. #include <openssl/bio.h>
  20. #include <openssl/crypto.h>
  21. #include <openssl/ssl.h>
  22. #include <openssl/ocsp.h>
  23. #include <openssl/srp.h>
  24. #include <openssl/txt_db.h>
  25. #include <openssl/aes.h>
  26. #include <openssl/rand.h>
  27. #include <openssl/core_names.h>
  28. #include <openssl/core_dispatch.h>
  29. #include <openssl/provider.h>
  30. #include <openssl/param_build.h>
  31. #include <openssl/x509v3.h>
  32. #include "helpers/ssltestlib.h"
  33. #include "testutil.h"
  34. #include "testutil/output.h"
  35. #include "internal/nelem.h"
  36. #include "internal/ktls.h"
  37. #include "../ssl/ssl_local.h"
  38. #include "filterprov.h"
  39. #undef OSSL_NO_USABLE_TLS1_3
  40. #if defined(OPENSSL_NO_TLS1_3) \
  41. || (defined(OPENSSL_NO_EC) && defined(OPENSSL_NO_DH))
  42. /*
  43. * If we don't have ec or dh then there are no built-in groups that are usable
  44. * with TLSv1.3
  45. */
  46. # define OSSL_NO_USABLE_TLS1_3
  47. #endif
  48. /* Defined in tls-provider.c */
  49. int tls_provider_init(const OSSL_CORE_HANDLE *handle,
  50. const OSSL_DISPATCH *in,
  51. const OSSL_DISPATCH **out,
  52. void **provctx);
  53. static OSSL_LIB_CTX *libctx = NULL;
  54. static OSSL_PROVIDER *defctxnull = NULL;
  55. #ifndef OSSL_NO_USABLE_TLS1_3
  56. static SSL_SESSION *clientpsk = NULL;
  57. static SSL_SESSION *serverpsk = NULL;
  58. static const char *pskid = "Identity";
  59. static const char *srvid;
  60. static int use_session_cb(SSL *ssl, const EVP_MD *md, const unsigned char **id,
  61. size_t *idlen, SSL_SESSION **sess);
  62. static int find_session_cb(SSL *ssl, const unsigned char *identity,
  63. size_t identity_len, SSL_SESSION **sess);
  64. static int use_session_cb_cnt = 0;
  65. static int find_session_cb_cnt = 0;
  66. static SSL_SESSION *create_a_psk(SSL *ssl);
  67. #endif
  68. static char *certsdir = NULL;
  69. static char *cert = NULL;
  70. static char *privkey = NULL;
  71. static char *cert2 = NULL;
  72. static char *privkey2 = NULL;
  73. static char *cert1024 = NULL;
  74. static char *privkey1024 = NULL;
  75. static char *cert3072 = NULL;
  76. static char *privkey3072 = NULL;
  77. static char *cert4096 = NULL;
  78. static char *privkey4096 = NULL;
  79. static char *cert8192 = NULL;
  80. static char *privkey8192 = NULL;
  81. static char *srpvfile = NULL;
  82. static char *tmpfilename = NULL;
  83. static int is_fips = 0;
  84. #define LOG_BUFFER_SIZE 2048
  85. static char server_log_buffer[LOG_BUFFER_SIZE + 1] = {0};
  86. static size_t server_log_buffer_index = 0;
  87. static char client_log_buffer[LOG_BUFFER_SIZE + 1] = {0};
  88. static size_t client_log_buffer_index = 0;
  89. static int error_writing_log = 0;
  90. #ifndef OPENSSL_NO_OCSP
  91. static const unsigned char orespder[] = "Dummy OCSP Response";
  92. static int ocsp_server_called = 0;
  93. static int ocsp_client_called = 0;
  94. static int cdummyarg = 1;
  95. static X509 *ocspcert = NULL;
  96. #endif
  97. #define NUM_EXTRA_CERTS 40
  98. #define CLIENT_VERSION_LEN 2
  99. /*
  100. * This structure is used to validate that the correct number of log messages
  101. * of various types are emitted when emitting secret logs.
  102. */
  103. struct sslapitest_log_counts {
  104. unsigned int rsa_key_exchange_count;
  105. unsigned int master_secret_count;
  106. unsigned int client_early_secret_count;
  107. unsigned int client_handshake_secret_count;
  108. unsigned int server_handshake_secret_count;
  109. unsigned int client_application_secret_count;
  110. unsigned int server_application_secret_count;
  111. unsigned int early_exporter_secret_count;
  112. unsigned int exporter_secret_count;
  113. };
  114. static unsigned char serverinfov1[] = {
  115. 0xff, 0xff, /* Dummy extension type */
  116. 0x00, 0x01, /* Extension length is 1 byte */
  117. 0xff /* Dummy extension data */
  118. };
  119. static unsigned char serverinfov2[] = {
  120. 0x00, 0x00, 0x00,
  121. (unsigned char)(SSL_EXT_CLIENT_HELLO & 0xff), /* Dummy context - 4 bytes */
  122. 0xff, 0xff, /* Dummy extension type */
  123. 0x00, 0x01, /* Extension length is 1 byte */
  124. 0xff /* Dummy extension data */
  125. };
  126. static int hostname_cb(SSL *s, int *al, void *arg)
  127. {
  128. const char *hostname = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
  129. if (hostname != NULL && (strcmp(hostname, "goodhost") == 0
  130. || strcmp(hostname, "altgoodhost") == 0))
  131. return SSL_TLSEXT_ERR_OK;
  132. return SSL_TLSEXT_ERR_NOACK;
  133. }
  134. static void client_keylog_callback(const SSL *ssl, const char *line)
  135. {
  136. int line_length = strlen(line);
  137. /* If the log doesn't fit, error out. */
  138. if (client_log_buffer_index + line_length > sizeof(client_log_buffer) - 1) {
  139. TEST_info("Client log too full");
  140. error_writing_log = 1;
  141. return;
  142. }
  143. strcat(client_log_buffer, line);
  144. client_log_buffer_index += line_length;
  145. client_log_buffer[client_log_buffer_index++] = '\n';
  146. }
  147. static void server_keylog_callback(const SSL *ssl, const char *line)
  148. {
  149. int line_length = strlen(line);
  150. /* If the log doesn't fit, error out. */
  151. if (server_log_buffer_index + line_length > sizeof(server_log_buffer) - 1) {
  152. TEST_info("Server log too full");
  153. error_writing_log = 1;
  154. return;
  155. }
  156. strcat(server_log_buffer, line);
  157. server_log_buffer_index += line_length;
  158. server_log_buffer[server_log_buffer_index++] = '\n';
  159. }
  160. static int compare_hex_encoded_buffer(const char *hex_encoded,
  161. size_t hex_length,
  162. const uint8_t *raw,
  163. size_t raw_length)
  164. {
  165. size_t i, j;
  166. char hexed[3];
  167. if (!TEST_size_t_eq(raw_length * 2, hex_length))
  168. return 1;
  169. for (i = j = 0; i < raw_length && j + 1 < hex_length; i++, j += 2) {
  170. sprintf(hexed, "%02x", raw[i]);
  171. if (!TEST_int_eq(hexed[0], hex_encoded[j])
  172. || !TEST_int_eq(hexed[1], hex_encoded[j + 1]))
  173. return 1;
  174. }
  175. return 0;
  176. }
  177. static int test_keylog_output(char *buffer, const SSL *ssl,
  178. const SSL_SESSION *session,
  179. struct sslapitest_log_counts *expected)
  180. {
  181. char *token = NULL;
  182. unsigned char actual_client_random[SSL3_RANDOM_SIZE] = {0};
  183. size_t client_random_size = SSL3_RANDOM_SIZE;
  184. unsigned char actual_master_key[SSL_MAX_MASTER_KEY_LENGTH] = {0};
  185. size_t master_key_size = SSL_MAX_MASTER_KEY_LENGTH;
  186. unsigned int rsa_key_exchange_count = 0;
  187. unsigned int master_secret_count = 0;
  188. unsigned int client_early_secret_count = 0;
  189. unsigned int client_handshake_secret_count = 0;
  190. unsigned int server_handshake_secret_count = 0;
  191. unsigned int client_application_secret_count = 0;
  192. unsigned int server_application_secret_count = 0;
  193. unsigned int early_exporter_secret_count = 0;
  194. unsigned int exporter_secret_count = 0;
  195. for (token = strtok(buffer, " \n"); token != NULL;
  196. token = strtok(NULL, " \n")) {
  197. if (strcmp(token, "RSA") == 0) {
  198. /*
  199. * Premaster secret. Tokens should be: 16 ASCII bytes of
  200. * hex-encoded encrypted secret, then the hex-encoded pre-master
  201. * secret.
  202. */
  203. if (!TEST_ptr(token = strtok(NULL, " \n")))
  204. return 0;
  205. if (!TEST_size_t_eq(strlen(token), 16))
  206. return 0;
  207. if (!TEST_ptr(token = strtok(NULL, " \n")))
  208. return 0;
  209. /*
  210. * We can't sensibly check the log because the premaster secret is
  211. * transient, and OpenSSL doesn't keep hold of it once the master
  212. * secret is generated.
  213. */
  214. rsa_key_exchange_count++;
  215. } else if (strcmp(token, "CLIENT_RANDOM") == 0) {
  216. /*
  217. * Master secret. Tokens should be: 64 ASCII bytes of hex-encoded
  218. * client random, then the hex-encoded master secret.
  219. */
  220. client_random_size = SSL_get_client_random(ssl,
  221. actual_client_random,
  222. SSL3_RANDOM_SIZE);
  223. if (!TEST_size_t_eq(client_random_size, SSL3_RANDOM_SIZE))
  224. return 0;
  225. if (!TEST_ptr(token = strtok(NULL, " \n")))
  226. return 0;
  227. if (!TEST_size_t_eq(strlen(token), 64))
  228. return 0;
  229. if (!TEST_false(compare_hex_encoded_buffer(token, 64,
  230. actual_client_random,
  231. client_random_size)))
  232. return 0;
  233. if (!TEST_ptr(token = strtok(NULL, " \n")))
  234. return 0;
  235. master_key_size = SSL_SESSION_get_master_key(session,
  236. actual_master_key,
  237. master_key_size);
  238. if (!TEST_size_t_ne(master_key_size, 0))
  239. return 0;
  240. if (!TEST_false(compare_hex_encoded_buffer(token, strlen(token),
  241. actual_master_key,
  242. master_key_size)))
  243. return 0;
  244. master_secret_count++;
  245. } else if (strcmp(token, "CLIENT_EARLY_TRAFFIC_SECRET") == 0
  246. || strcmp(token, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0
  247. || strcmp(token, "SERVER_HANDSHAKE_TRAFFIC_SECRET") == 0
  248. || strcmp(token, "CLIENT_TRAFFIC_SECRET_0") == 0
  249. || strcmp(token, "SERVER_TRAFFIC_SECRET_0") == 0
  250. || strcmp(token, "EARLY_EXPORTER_SECRET") == 0
  251. || strcmp(token, "EXPORTER_SECRET") == 0) {
  252. /*
  253. * TLSv1.3 secret. Tokens should be: 64 ASCII bytes of hex-encoded
  254. * client random, and then the hex-encoded secret. In this case,
  255. * we treat all of these secrets identically and then just
  256. * distinguish between them when counting what we saw.
  257. */
  258. if (strcmp(token, "CLIENT_EARLY_TRAFFIC_SECRET") == 0)
  259. client_early_secret_count++;
  260. else if (strcmp(token, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0)
  261. client_handshake_secret_count++;
  262. else if (strcmp(token, "SERVER_HANDSHAKE_TRAFFIC_SECRET") == 0)
  263. server_handshake_secret_count++;
  264. else if (strcmp(token, "CLIENT_TRAFFIC_SECRET_0") == 0)
  265. client_application_secret_count++;
  266. else if (strcmp(token, "SERVER_TRAFFIC_SECRET_0") == 0)
  267. server_application_secret_count++;
  268. else if (strcmp(token, "EARLY_EXPORTER_SECRET") == 0)
  269. early_exporter_secret_count++;
  270. else if (strcmp(token, "EXPORTER_SECRET") == 0)
  271. exporter_secret_count++;
  272. client_random_size = SSL_get_client_random(ssl,
  273. actual_client_random,
  274. SSL3_RANDOM_SIZE);
  275. if (!TEST_size_t_eq(client_random_size, SSL3_RANDOM_SIZE))
  276. return 0;
  277. if (!TEST_ptr(token = strtok(NULL, " \n")))
  278. return 0;
  279. if (!TEST_size_t_eq(strlen(token), 64))
  280. return 0;
  281. if (!TEST_false(compare_hex_encoded_buffer(token, 64,
  282. actual_client_random,
  283. client_random_size)))
  284. return 0;
  285. if (!TEST_ptr(token = strtok(NULL, " \n")))
  286. return 0;
  287. } else {
  288. TEST_info("Unexpected token %s\n", token);
  289. return 0;
  290. }
  291. }
  292. /* Got what we expected? */
  293. if (!TEST_size_t_eq(rsa_key_exchange_count,
  294. expected->rsa_key_exchange_count)
  295. || !TEST_size_t_eq(master_secret_count,
  296. expected->master_secret_count)
  297. || !TEST_size_t_eq(client_early_secret_count,
  298. expected->client_early_secret_count)
  299. || !TEST_size_t_eq(client_handshake_secret_count,
  300. expected->client_handshake_secret_count)
  301. || !TEST_size_t_eq(server_handshake_secret_count,
  302. expected->server_handshake_secret_count)
  303. || !TEST_size_t_eq(client_application_secret_count,
  304. expected->client_application_secret_count)
  305. || !TEST_size_t_eq(server_application_secret_count,
  306. expected->server_application_secret_count)
  307. || !TEST_size_t_eq(early_exporter_secret_count,
  308. expected->early_exporter_secret_count)
  309. || !TEST_size_t_eq(exporter_secret_count,
  310. expected->exporter_secret_count))
  311. return 0;
  312. return 1;
  313. }
  314. #if !defined(OPENSSL_NO_TLS1_2) || defined(OSSL_NO_USABLE_TLS1_3)
  315. static int test_keylog(void)
  316. {
  317. SSL_CTX *cctx = NULL, *sctx = NULL;
  318. SSL *clientssl = NULL, *serverssl = NULL;
  319. int testresult = 0;
  320. struct sslapitest_log_counts expected;
  321. /* Clean up logging space */
  322. memset(&expected, 0, sizeof(expected));
  323. memset(client_log_buffer, 0, sizeof(client_log_buffer));
  324. memset(server_log_buffer, 0, sizeof(server_log_buffer));
  325. client_log_buffer_index = 0;
  326. server_log_buffer_index = 0;
  327. error_writing_log = 0;
  328. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  329. TLS_client_method(),
  330. TLS1_VERSION, 0,
  331. &sctx, &cctx, cert, privkey)))
  332. return 0;
  333. /* We cannot log the master secret for TLSv1.3, so we should forbid it. */
  334. SSL_CTX_set_options(cctx, SSL_OP_NO_TLSv1_3);
  335. SSL_CTX_set_options(sctx, SSL_OP_NO_TLSv1_3);
  336. /* We also want to ensure that we use RSA-based key exchange. */
  337. if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "RSA")))
  338. goto end;
  339. if (!TEST_true(SSL_CTX_get_keylog_callback(cctx) == NULL)
  340. || !TEST_true(SSL_CTX_get_keylog_callback(sctx) == NULL))
  341. goto end;
  342. SSL_CTX_set_keylog_callback(cctx, client_keylog_callback);
  343. if (!TEST_true(SSL_CTX_get_keylog_callback(cctx)
  344. == client_keylog_callback))
  345. goto end;
  346. SSL_CTX_set_keylog_callback(sctx, server_keylog_callback);
  347. if (!TEST_true(SSL_CTX_get_keylog_callback(sctx)
  348. == server_keylog_callback))
  349. goto end;
  350. /* Now do a handshake and check that the logs have been written to. */
  351. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  352. &clientssl, NULL, NULL))
  353. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  354. SSL_ERROR_NONE))
  355. || !TEST_false(error_writing_log)
  356. || !TEST_int_gt(client_log_buffer_index, 0)
  357. || !TEST_int_gt(server_log_buffer_index, 0))
  358. goto end;
  359. /*
  360. * Now we want to test that our output data was vaguely sensible. We
  361. * do that by using strtok and confirming that we have more or less the
  362. * data we expect. For both client and server, we expect to see one master
  363. * secret. The client should also see a RSA key exchange.
  364. */
  365. expected.rsa_key_exchange_count = 1;
  366. expected.master_secret_count = 1;
  367. if (!TEST_true(test_keylog_output(client_log_buffer, clientssl,
  368. SSL_get_session(clientssl), &expected)))
  369. goto end;
  370. expected.rsa_key_exchange_count = 0;
  371. if (!TEST_true(test_keylog_output(server_log_buffer, serverssl,
  372. SSL_get_session(serverssl), &expected)))
  373. goto end;
  374. testresult = 1;
  375. end:
  376. SSL_free(serverssl);
  377. SSL_free(clientssl);
  378. SSL_CTX_free(sctx);
  379. SSL_CTX_free(cctx);
  380. return testresult;
  381. }
  382. #endif
  383. #ifndef OSSL_NO_USABLE_TLS1_3
  384. static int test_keylog_no_master_key(void)
  385. {
  386. SSL_CTX *cctx = NULL, *sctx = NULL;
  387. SSL *clientssl = NULL, *serverssl = NULL;
  388. SSL_SESSION *sess = NULL;
  389. int testresult = 0;
  390. struct sslapitest_log_counts expected;
  391. unsigned char buf[1];
  392. size_t readbytes, written;
  393. /* Clean up logging space */
  394. memset(&expected, 0, sizeof(expected));
  395. memset(client_log_buffer, 0, sizeof(client_log_buffer));
  396. memset(server_log_buffer, 0, sizeof(server_log_buffer));
  397. client_log_buffer_index = 0;
  398. server_log_buffer_index = 0;
  399. error_writing_log = 0;
  400. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  401. TLS_client_method(), TLS1_VERSION, 0,
  402. &sctx, &cctx, cert, privkey))
  403. || !TEST_true(SSL_CTX_set_max_early_data(sctx,
  404. SSL3_RT_MAX_PLAIN_LENGTH)))
  405. return 0;
  406. if (!TEST_true(SSL_CTX_get_keylog_callback(cctx) == NULL)
  407. || !TEST_true(SSL_CTX_get_keylog_callback(sctx) == NULL))
  408. goto end;
  409. SSL_CTX_set_keylog_callback(cctx, client_keylog_callback);
  410. if (!TEST_true(SSL_CTX_get_keylog_callback(cctx)
  411. == client_keylog_callback))
  412. goto end;
  413. SSL_CTX_set_keylog_callback(sctx, server_keylog_callback);
  414. if (!TEST_true(SSL_CTX_get_keylog_callback(sctx)
  415. == server_keylog_callback))
  416. goto end;
  417. /* Now do a handshake and check that the logs have been written to. */
  418. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  419. &clientssl, NULL, NULL))
  420. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  421. SSL_ERROR_NONE))
  422. || !TEST_false(error_writing_log))
  423. goto end;
  424. /*
  425. * Now we want to test that our output data was vaguely sensible. For this
  426. * test, we expect no CLIENT_RANDOM entry because it doesn't make sense for
  427. * TLSv1.3, but we do expect both client and server to emit keys.
  428. */
  429. expected.client_handshake_secret_count = 1;
  430. expected.server_handshake_secret_count = 1;
  431. expected.client_application_secret_count = 1;
  432. expected.server_application_secret_count = 1;
  433. expected.exporter_secret_count = 1;
  434. if (!TEST_true(test_keylog_output(client_log_buffer, clientssl,
  435. SSL_get_session(clientssl), &expected))
  436. || !TEST_true(test_keylog_output(server_log_buffer, serverssl,
  437. SSL_get_session(serverssl),
  438. &expected)))
  439. goto end;
  440. /* Terminate old session and resume with early data. */
  441. sess = SSL_get1_session(clientssl);
  442. SSL_shutdown(clientssl);
  443. SSL_shutdown(serverssl);
  444. SSL_free(serverssl);
  445. SSL_free(clientssl);
  446. serverssl = clientssl = NULL;
  447. /* Reset key log */
  448. memset(client_log_buffer, 0, sizeof(client_log_buffer));
  449. memset(server_log_buffer, 0, sizeof(server_log_buffer));
  450. client_log_buffer_index = 0;
  451. server_log_buffer_index = 0;
  452. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  453. &clientssl, NULL, NULL))
  454. || !TEST_true(SSL_set_session(clientssl, sess))
  455. /* Here writing 0 length early data is enough. */
  456. || !TEST_true(SSL_write_early_data(clientssl, NULL, 0, &written))
  457. || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  458. &readbytes),
  459. SSL_READ_EARLY_DATA_ERROR)
  460. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  461. SSL_EARLY_DATA_ACCEPTED)
  462. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  463. SSL_ERROR_NONE))
  464. || !TEST_true(SSL_session_reused(clientssl)))
  465. goto end;
  466. /* In addition to the previous entries, expect early secrets. */
  467. expected.client_early_secret_count = 1;
  468. expected.early_exporter_secret_count = 1;
  469. if (!TEST_true(test_keylog_output(client_log_buffer, clientssl,
  470. SSL_get_session(clientssl), &expected))
  471. || !TEST_true(test_keylog_output(server_log_buffer, serverssl,
  472. SSL_get_session(serverssl),
  473. &expected)))
  474. goto end;
  475. testresult = 1;
  476. end:
  477. SSL_SESSION_free(sess);
  478. SSL_free(serverssl);
  479. SSL_free(clientssl);
  480. SSL_CTX_free(sctx);
  481. SSL_CTX_free(cctx);
  482. return testresult;
  483. }
  484. #endif
  485. static int verify_retry_cb(X509_STORE_CTX *ctx, void *arg)
  486. {
  487. int res = X509_verify_cert(ctx);
  488. if (res == 0 && X509_STORE_CTX_get_error(ctx) ==
  489. X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY)
  490. return -1; /* indicate SSL_ERROR_WANT_RETRY_VERIFY */
  491. return res;
  492. }
  493. static int test_client_cert_verify_cb(void)
  494. {
  495. /* server key, cert, chain, and root */
  496. char *skey = test_mk_file_path(certsdir, "leaf.key");
  497. char *leaf = test_mk_file_path(certsdir, "leaf.pem");
  498. char *int2 = test_mk_file_path(certsdir, "subinterCA.pem");
  499. char *int1 = test_mk_file_path(certsdir, "interCA.pem");
  500. char *root = test_mk_file_path(certsdir, "rootCA.pem");
  501. X509 *crt1 = NULL, *crt2 = NULL;
  502. STACK_OF(X509) *server_chain;
  503. SSL_CTX *cctx = NULL, *sctx = NULL;
  504. SSL *clientssl = NULL, *serverssl = NULL;
  505. int testresult = 0;
  506. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  507. TLS_client_method(), TLS1_VERSION, 0,
  508. &sctx, &cctx, NULL, NULL)))
  509. goto end;
  510. if (!TEST_int_eq(SSL_CTX_use_certificate_chain_file(sctx, leaf), 1)
  511. || !TEST_int_eq(SSL_CTX_use_PrivateKey_file(sctx, skey,
  512. SSL_FILETYPE_PEM), 1)
  513. || !TEST_int_eq(SSL_CTX_check_private_key(sctx), 1))
  514. goto end;
  515. if (!TEST_true(SSL_CTX_load_verify_locations(cctx, root, NULL)))
  516. goto end;
  517. SSL_CTX_set_verify(cctx, SSL_VERIFY_PEER, NULL);
  518. SSL_CTX_set_cert_verify_callback(cctx, verify_retry_cb, NULL);
  519. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  520. &clientssl, NULL, NULL)))
  521. goto end;
  522. /* attempt SSL_connect() with incomplete server chain */
  523. if (!TEST_false(create_ssl_connection(serverssl, clientssl,
  524. SSL_ERROR_WANT_RETRY_VERIFY)))
  525. goto end;
  526. /* application provides intermediate certs needed to verify server cert */
  527. if (!TEST_ptr((crt1 = load_cert_pem(int1, libctx)))
  528. || !TEST_ptr((crt2 = load_cert_pem(int2, libctx)))
  529. || !TEST_ptr((server_chain = SSL_get_peer_cert_chain(clientssl))))
  530. goto end;
  531. /* add certs in reverse order to demonstrate real chain building */
  532. if (!TEST_true(sk_X509_push(server_chain, crt1)))
  533. goto end;
  534. crt1 = NULL;
  535. if (!TEST_true(sk_X509_push(server_chain, crt2)))
  536. goto end;
  537. crt2 = NULL;
  538. /* continue SSL_connect(), must now succeed with completed server chain */
  539. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  540. SSL_ERROR_NONE)))
  541. goto end;
  542. testresult = 1;
  543. end:
  544. X509_free(crt1);
  545. X509_free(crt2);
  546. if (clientssl != NULL) {
  547. SSL_shutdown(clientssl);
  548. SSL_free(clientssl);
  549. }
  550. if (serverssl != NULL) {
  551. SSL_shutdown(serverssl);
  552. SSL_free(serverssl);
  553. }
  554. SSL_CTX_free(sctx);
  555. SSL_CTX_free(cctx);
  556. OPENSSL_free(skey);
  557. OPENSSL_free(leaf);
  558. OPENSSL_free(int2);
  559. OPENSSL_free(int1);
  560. OPENSSL_free(root);
  561. return testresult;
  562. }
  563. static int test_ssl_build_cert_chain(void)
  564. {
  565. int ret = 0;
  566. SSL_CTX *ssl_ctx = NULL;
  567. SSL *ssl = NULL;
  568. char *skey = test_mk_file_path(certsdir, "leaf.key");
  569. char *leaf_chain = test_mk_file_path(certsdir, "leaf-chain.pem");
  570. if (!TEST_ptr(ssl_ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method())))
  571. goto end;
  572. if (!TEST_ptr(ssl = SSL_new(ssl_ctx)))
  573. goto end;
  574. /* leaf_chain contains leaf + subinterCA + interCA + rootCA */
  575. if (!TEST_int_eq(SSL_use_certificate_chain_file(ssl, leaf_chain), 1)
  576. || !TEST_int_eq(SSL_use_PrivateKey_file(ssl, skey, SSL_FILETYPE_PEM), 1)
  577. || !TEST_int_eq(SSL_check_private_key(ssl), 1))
  578. goto end;
  579. if (!TEST_true(SSL_build_cert_chain(ssl, SSL_BUILD_CHAIN_FLAG_NO_ROOT
  580. | SSL_BUILD_CHAIN_FLAG_CHECK)))
  581. goto end;
  582. ret = 1;
  583. end:
  584. SSL_free(ssl);
  585. SSL_CTX_free(ssl_ctx);
  586. OPENSSL_free(leaf_chain);
  587. OPENSSL_free(skey);
  588. return ret;
  589. }
  590. static int test_ssl_ctx_build_cert_chain(void)
  591. {
  592. int ret = 0;
  593. SSL_CTX *ctx = NULL;
  594. char *skey = test_mk_file_path(certsdir, "leaf.key");
  595. char *leaf_chain = test_mk_file_path(certsdir, "leaf-chain.pem");
  596. if (!TEST_ptr(ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method())))
  597. goto end;
  598. /* leaf_chain contains leaf + subinterCA + interCA + rootCA */
  599. if (!TEST_int_eq(SSL_CTX_use_certificate_chain_file(ctx, leaf_chain), 1)
  600. || !TEST_int_eq(SSL_CTX_use_PrivateKey_file(ctx, skey,
  601. SSL_FILETYPE_PEM), 1)
  602. || !TEST_int_eq(SSL_CTX_check_private_key(ctx), 1))
  603. goto end;
  604. if (!TEST_true(SSL_CTX_build_cert_chain(ctx, SSL_BUILD_CHAIN_FLAG_NO_ROOT
  605. | SSL_BUILD_CHAIN_FLAG_CHECK)))
  606. goto end;
  607. ret = 1;
  608. end:
  609. SSL_CTX_free(ctx);
  610. OPENSSL_free(leaf_chain);
  611. OPENSSL_free(skey);
  612. return ret;
  613. }
  614. #ifndef OPENSSL_NO_TLS1_2
  615. static int full_client_hello_callback(SSL *s, int *al, void *arg)
  616. {
  617. int *ctr = arg;
  618. const unsigned char *p;
  619. int *exts;
  620. /* We only configure two ciphers, but the SCSV is added automatically. */
  621. #ifdef OPENSSL_NO_EC
  622. const unsigned char expected_ciphers[] = {0x00, 0x9d, 0x00, 0xff};
  623. #else
  624. const unsigned char expected_ciphers[] = {0x00, 0x9d, 0xc0,
  625. 0x2c, 0x00, 0xff};
  626. #endif
  627. const int expected_extensions[] = {
  628. #ifndef OPENSSL_NO_EC
  629. 11, 10,
  630. #endif
  631. 35, 22, 23, 13};
  632. size_t len;
  633. /* Make sure we can defer processing and get called back. */
  634. if ((*ctr)++ == 0)
  635. return SSL_CLIENT_HELLO_RETRY;
  636. len = SSL_client_hello_get0_ciphers(s, &p);
  637. if (!TEST_mem_eq(p, len, expected_ciphers, sizeof(expected_ciphers))
  638. || !TEST_size_t_eq(
  639. SSL_client_hello_get0_compression_methods(s, &p), 1)
  640. || !TEST_int_eq(*p, 0))
  641. return SSL_CLIENT_HELLO_ERROR;
  642. if (!SSL_client_hello_get1_extensions_present(s, &exts, &len))
  643. return SSL_CLIENT_HELLO_ERROR;
  644. if (len != OSSL_NELEM(expected_extensions) ||
  645. memcmp(exts, expected_extensions, len * sizeof(*exts)) != 0) {
  646. printf("ClientHello callback expected extensions mismatch\n");
  647. OPENSSL_free(exts);
  648. return SSL_CLIENT_HELLO_ERROR;
  649. }
  650. OPENSSL_free(exts);
  651. return SSL_CLIENT_HELLO_SUCCESS;
  652. }
  653. static int test_client_hello_cb(void)
  654. {
  655. SSL_CTX *cctx = NULL, *sctx = NULL;
  656. SSL *clientssl = NULL, *serverssl = NULL;
  657. int testctr = 0, testresult = 0;
  658. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  659. TLS_client_method(), TLS1_VERSION, 0,
  660. &sctx, &cctx, cert, privkey)))
  661. goto end;
  662. SSL_CTX_set_client_hello_cb(sctx, full_client_hello_callback, &testctr);
  663. /* The gimpy cipher list we configure can't do TLS 1.3. */
  664. SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION);
  665. if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
  666. "AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384"))
  667. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  668. &clientssl, NULL, NULL))
  669. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  670. SSL_ERROR_WANT_CLIENT_HELLO_CB))
  671. /*
  672. * Passing a -1 literal is a hack since
  673. * the real value was lost.
  674. * */
  675. || !TEST_int_eq(SSL_get_error(serverssl, -1),
  676. SSL_ERROR_WANT_CLIENT_HELLO_CB)
  677. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  678. SSL_ERROR_NONE)))
  679. goto end;
  680. testresult = 1;
  681. end:
  682. SSL_free(serverssl);
  683. SSL_free(clientssl);
  684. SSL_CTX_free(sctx);
  685. SSL_CTX_free(cctx);
  686. return testresult;
  687. }
  688. static int test_no_ems(void)
  689. {
  690. SSL_CTX *cctx = NULL, *sctx = NULL;
  691. SSL *clientssl = NULL, *serverssl = NULL;
  692. int testresult = 0;
  693. if (!create_ssl_ctx_pair(libctx, TLS_server_method(), TLS_client_method(),
  694. TLS1_VERSION, TLS1_2_VERSION,
  695. &sctx, &cctx, cert, privkey)) {
  696. printf("Unable to create SSL_CTX pair\n");
  697. goto end;
  698. }
  699. SSL_CTX_set_options(sctx, SSL_OP_NO_EXTENDED_MASTER_SECRET);
  700. if (!create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL, NULL)) {
  701. printf("Unable to create SSL objects\n");
  702. goto end;
  703. }
  704. if (!create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)) {
  705. printf("Creating SSL connection failed\n");
  706. goto end;
  707. }
  708. if (SSL_get_extms_support(serverssl)) {
  709. printf("Server reports Extended Master Secret support\n");
  710. goto end;
  711. }
  712. if (SSL_get_extms_support(clientssl)) {
  713. printf("Client reports Extended Master Secret support\n");
  714. goto end;
  715. }
  716. testresult = 1;
  717. end:
  718. SSL_free(serverssl);
  719. SSL_free(clientssl);
  720. SSL_CTX_free(sctx);
  721. SSL_CTX_free(cctx);
  722. return testresult;
  723. }
  724. /*
  725. * Very focused test to exercise a single case in the server-side state
  726. * machine, when the ChangeCipherState message needs to actually change
  727. * from one cipher to a different cipher (i.e., not changing from null
  728. * encryption to real encryption).
  729. */
  730. static int test_ccs_change_cipher(void)
  731. {
  732. SSL_CTX *cctx = NULL, *sctx = NULL;
  733. SSL *clientssl = NULL, *serverssl = NULL;
  734. SSL_SESSION *sess = NULL, *sesspre, *sesspost;
  735. int testresult = 0;
  736. int i;
  737. unsigned char buf;
  738. size_t readbytes;
  739. /*
  740. * Create a conection so we can resume and potentially (but not) use
  741. * a different cipher in the second connection.
  742. */
  743. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  744. TLS_client_method(),
  745. TLS1_VERSION, TLS1_2_VERSION,
  746. &sctx, &cctx, cert, privkey))
  747. || !TEST_true(SSL_CTX_set_options(sctx, SSL_OP_NO_TICKET))
  748. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  749. NULL, NULL))
  750. || !TEST_true(SSL_set_cipher_list(clientssl, "AES128-GCM-SHA256"))
  751. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  752. SSL_ERROR_NONE))
  753. || !TEST_ptr(sesspre = SSL_get0_session(serverssl))
  754. || !TEST_ptr(sess = SSL_get1_session(clientssl)))
  755. goto end;
  756. shutdown_ssl_connection(serverssl, clientssl);
  757. serverssl = clientssl = NULL;
  758. /* Resume, preferring a different cipher. Our server will force the
  759. * same cipher to be used as the initial handshake. */
  760. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  761. NULL, NULL))
  762. || !TEST_true(SSL_set_session(clientssl, sess))
  763. || !TEST_true(SSL_set_cipher_list(clientssl, "AES256-GCM-SHA384:AES128-GCM-SHA256"))
  764. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  765. SSL_ERROR_NONE))
  766. || !TEST_true(SSL_session_reused(clientssl))
  767. || !TEST_true(SSL_session_reused(serverssl))
  768. || !TEST_ptr(sesspost = SSL_get0_session(serverssl))
  769. || !TEST_ptr_eq(sesspre, sesspost)
  770. || !TEST_int_eq(TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
  771. SSL_CIPHER_get_id(SSL_get_current_cipher(clientssl))))
  772. goto end;
  773. shutdown_ssl_connection(serverssl, clientssl);
  774. serverssl = clientssl = NULL;
  775. /*
  776. * Now create a fresh connection and try to renegotiate a different
  777. * cipher on it.
  778. */
  779. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  780. NULL, NULL))
  781. || !TEST_true(SSL_set_cipher_list(clientssl, "AES128-GCM-SHA256"))
  782. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  783. SSL_ERROR_NONE))
  784. || !TEST_ptr(sesspre = SSL_get0_session(serverssl))
  785. || !TEST_true(SSL_set_cipher_list(clientssl, "AES256-GCM-SHA384"))
  786. || !TEST_true(SSL_renegotiate(clientssl))
  787. || !TEST_true(SSL_renegotiate_pending(clientssl)))
  788. goto end;
  789. /* Actually drive the renegotiation. */
  790. for (i = 0; i < 3; i++) {
  791. if (SSL_read_ex(clientssl, &buf, sizeof(buf), &readbytes) > 0) {
  792. if (!TEST_ulong_eq(readbytes, 0))
  793. goto end;
  794. } else if (!TEST_int_eq(SSL_get_error(clientssl, 0),
  795. SSL_ERROR_WANT_READ)) {
  796. goto end;
  797. }
  798. if (SSL_read_ex(serverssl, &buf, sizeof(buf), &readbytes) > 0) {
  799. if (!TEST_ulong_eq(readbytes, 0))
  800. goto end;
  801. } else if (!TEST_int_eq(SSL_get_error(serverssl, 0),
  802. SSL_ERROR_WANT_READ)) {
  803. goto end;
  804. }
  805. }
  806. /* sesspre and sesspost should be different since the cipher changed. */
  807. if (!TEST_false(SSL_renegotiate_pending(clientssl))
  808. || !TEST_false(SSL_session_reused(clientssl))
  809. || !TEST_false(SSL_session_reused(serverssl))
  810. || !TEST_ptr(sesspost = SSL_get0_session(serverssl))
  811. || !TEST_ptr_ne(sesspre, sesspost)
  812. || !TEST_int_eq(TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
  813. SSL_CIPHER_get_id(SSL_get_current_cipher(clientssl))))
  814. goto end;
  815. shutdown_ssl_connection(serverssl, clientssl);
  816. serverssl = clientssl = NULL;
  817. testresult = 1;
  818. end:
  819. SSL_free(serverssl);
  820. SSL_free(clientssl);
  821. SSL_CTX_free(sctx);
  822. SSL_CTX_free(cctx);
  823. SSL_SESSION_free(sess);
  824. return testresult;
  825. }
  826. #endif
  827. static int execute_test_large_message(const SSL_METHOD *smeth,
  828. const SSL_METHOD *cmeth,
  829. int min_version, int max_version,
  830. int read_ahead)
  831. {
  832. SSL_CTX *cctx = NULL, *sctx = NULL;
  833. SSL *clientssl = NULL, *serverssl = NULL;
  834. int testresult = 0;
  835. int i;
  836. BIO *certbio = NULL;
  837. X509 *chaincert = NULL;
  838. int certlen;
  839. if (!TEST_ptr(certbio = BIO_new_file(cert, "r")))
  840. goto end;
  841. if (!TEST_ptr(chaincert = X509_new_ex(libctx, NULL)))
  842. goto end;
  843. if (PEM_read_bio_X509(certbio, &chaincert, NULL, NULL) == NULL)
  844. goto end;
  845. BIO_free(certbio);
  846. certbio = NULL;
  847. if (!TEST_true(create_ssl_ctx_pair(libctx, smeth, cmeth, min_version,
  848. max_version, &sctx, &cctx, cert,
  849. privkey)))
  850. goto end;
  851. #ifdef OPENSSL_NO_DTLS1_2
  852. if (smeth == DTLS_server_method()) {
  853. /*
  854. * Default sigalgs are SHA1 based in <DTLS1.2 which is in security
  855. * level 0
  856. */
  857. if (!TEST_true(SSL_CTX_set_cipher_list(sctx, "DEFAULT:@SECLEVEL=0"))
  858. || !TEST_true(SSL_CTX_set_cipher_list(cctx,
  859. "DEFAULT:@SECLEVEL=0")))
  860. goto end;
  861. }
  862. #endif
  863. if (read_ahead) {
  864. /*
  865. * Test that read_ahead works correctly when dealing with large
  866. * records
  867. */
  868. SSL_CTX_set_read_ahead(cctx, 1);
  869. }
  870. /*
  871. * We assume the supplied certificate is big enough so that if we add
  872. * NUM_EXTRA_CERTS it will make the overall message large enough. The
  873. * default buffer size is requested to be 16k, but due to the way BUF_MEM
  874. * works, it ends up allocating a little over 21k (16 * 4/3). So, in this
  875. * test we need to have a message larger than that.
  876. */
  877. certlen = i2d_X509(chaincert, NULL);
  878. OPENSSL_assert(certlen * NUM_EXTRA_CERTS >
  879. (SSL3_RT_MAX_PLAIN_LENGTH * 4) / 3);
  880. for (i = 0; i < NUM_EXTRA_CERTS; i++) {
  881. if (!X509_up_ref(chaincert))
  882. goto end;
  883. if (!SSL_CTX_add_extra_chain_cert(sctx, chaincert)) {
  884. X509_free(chaincert);
  885. goto end;
  886. }
  887. }
  888. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  889. NULL, NULL))
  890. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  891. SSL_ERROR_NONE)))
  892. goto end;
  893. /*
  894. * Calling SSL_clear() first is not required but this tests that SSL_clear()
  895. * doesn't leak.
  896. */
  897. if (!TEST_true(SSL_clear(serverssl)))
  898. goto end;
  899. testresult = 1;
  900. end:
  901. BIO_free(certbio);
  902. X509_free(chaincert);
  903. SSL_free(serverssl);
  904. SSL_free(clientssl);
  905. SSL_CTX_free(sctx);
  906. SSL_CTX_free(cctx);
  907. return testresult;
  908. }
  909. #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_KTLS) && \
  910. !(defined(OSSL_NO_USABLE_TLS1_3) && defined(OPENSSL_NO_TLS1_2))
  911. #define TLS_CIPHER_MAX_REC_SEQ_SIZE 8
  912. /* sock must be connected */
  913. static int ktls_chk_platform(int sock)
  914. {
  915. if (!ktls_enable(sock))
  916. return 0;
  917. return 1;
  918. }
  919. static int ping_pong_query(SSL *clientssl, SSL *serverssl, int cfd, int sfd, int rec_seq_size)
  920. {
  921. static char count = 1;
  922. unsigned char cbuf[16000] = {0};
  923. unsigned char sbuf[16000];
  924. size_t err = 0;
  925. char crec_wseq_before[TLS_CIPHER_MAX_REC_SEQ_SIZE];
  926. char crec_wseq_after[TLS_CIPHER_MAX_REC_SEQ_SIZE];
  927. char crec_rseq_before[TLS_CIPHER_MAX_REC_SEQ_SIZE];
  928. char crec_rseq_after[TLS_CIPHER_MAX_REC_SEQ_SIZE];
  929. char srec_wseq_before[TLS_CIPHER_MAX_REC_SEQ_SIZE];
  930. char srec_wseq_after[TLS_CIPHER_MAX_REC_SEQ_SIZE];
  931. char srec_rseq_before[TLS_CIPHER_MAX_REC_SEQ_SIZE];
  932. char srec_rseq_after[TLS_CIPHER_MAX_REC_SEQ_SIZE];
  933. cbuf[0] = count++;
  934. memcpy(crec_wseq_before, &clientssl->rlayer.write_sequence, rec_seq_size);
  935. memcpy(crec_rseq_before, &clientssl->rlayer.read_sequence, rec_seq_size);
  936. memcpy(srec_wseq_before, &serverssl->rlayer.write_sequence, rec_seq_size);
  937. memcpy(srec_rseq_before, &serverssl->rlayer.read_sequence, rec_seq_size);
  938. if (!TEST_true(SSL_write(clientssl, cbuf, sizeof(cbuf)) == sizeof(cbuf)))
  939. goto end;
  940. while ((err = SSL_read(serverssl, &sbuf, sizeof(sbuf))) != sizeof(sbuf)) {
  941. if (SSL_get_error(serverssl, err) != SSL_ERROR_WANT_READ) {
  942. goto end;
  943. }
  944. }
  945. if (!TEST_true(SSL_write(serverssl, sbuf, sizeof(sbuf)) == sizeof(sbuf)))
  946. goto end;
  947. while ((err = SSL_read(clientssl, &cbuf, sizeof(cbuf))) != sizeof(cbuf)) {
  948. if (SSL_get_error(clientssl, err) != SSL_ERROR_WANT_READ) {
  949. goto end;
  950. }
  951. }
  952. memcpy(crec_wseq_after, &clientssl->rlayer.write_sequence, rec_seq_size);
  953. memcpy(crec_rseq_after, &clientssl->rlayer.read_sequence, rec_seq_size);
  954. memcpy(srec_wseq_after, &serverssl->rlayer.write_sequence, rec_seq_size);
  955. memcpy(srec_rseq_after, &serverssl->rlayer.read_sequence, rec_seq_size);
  956. /* verify the payload */
  957. if (!TEST_mem_eq(cbuf, sizeof(cbuf), sbuf, sizeof(sbuf)))
  958. goto end;
  959. /* ktls is used then kernel sequences are used instead of OpenSSL sequences */
  960. if ((SSL_get_options(clientssl) & SSL_OP_ENABLE_KTLS) == 0) {
  961. if (!TEST_mem_ne(crec_wseq_before, rec_seq_size,
  962. crec_wseq_after, rec_seq_size))
  963. goto end;
  964. } else {
  965. if (!TEST_mem_eq(crec_wseq_before, rec_seq_size,
  966. crec_wseq_after, rec_seq_size))
  967. goto end;
  968. }
  969. if ((SSL_get_options(serverssl) & SSL_OP_ENABLE_KTLS) == 0) {
  970. if (!TEST_mem_ne(srec_wseq_before, rec_seq_size,
  971. srec_wseq_after, rec_seq_size))
  972. goto end;
  973. } else {
  974. if (!TEST_mem_eq(srec_wseq_before, rec_seq_size,
  975. srec_wseq_after, rec_seq_size))
  976. goto end;
  977. }
  978. if ((SSL_get_options(clientssl) & SSL_OP_ENABLE_KTLS) == 0
  979. #if defined(OPENSSL_NO_KTLS_RX)
  980. || 1
  981. #endif
  982. ) {
  983. if (!TEST_mem_ne(crec_rseq_before, rec_seq_size,
  984. crec_rseq_after, rec_seq_size))
  985. goto end;
  986. } else {
  987. if (!TEST_mem_eq(crec_rseq_before, rec_seq_size,
  988. crec_rseq_after, rec_seq_size))
  989. goto end;
  990. }
  991. if ((SSL_get_options(serverssl) & SSL_OP_ENABLE_KTLS) == 0
  992. #if defined(OPENSSL_NO_KTLS_RX)
  993. || 1
  994. #endif
  995. ) {
  996. if (!TEST_mem_ne(srec_rseq_before, rec_seq_size,
  997. srec_rseq_after, rec_seq_size))
  998. goto end;
  999. } else {
  1000. if (!TEST_mem_eq(srec_rseq_before, rec_seq_size,
  1001. srec_rseq_after, rec_seq_size))
  1002. goto end;
  1003. }
  1004. return 1;
  1005. end:
  1006. return 0;
  1007. }
  1008. static int execute_test_ktls(int cis_ktls, int sis_ktls,
  1009. int tls_version, const char *cipher,
  1010. int rec_seq_size)
  1011. {
  1012. SSL_CTX *cctx = NULL, *sctx = NULL;
  1013. SSL *clientssl = NULL, *serverssl = NULL;
  1014. int testresult = 0;
  1015. int cfd, sfd;
  1016. if (!TEST_true(create_test_sockets(&cfd, &sfd)))
  1017. goto end;
  1018. /* Skip this test if the platform does not support ktls */
  1019. if (!ktls_chk_platform(cfd))
  1020. return 1;
  1021. /* Create a session based on SHA-256 */
  1022. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  1023. TLS_client_method(),
  1024. tls_version, tls_version,
  1025. &sctx, &cctx, cert, privkey))
  1026. || !TEST_true(SSL_CTX_set_cipher_list(cctx, cipher))
  1027. || !TEST_true(SSL_CTX_set_cipher_list(sctx, cipher))
  1028. || !TEST_true(create_ssl_objects2(sctx, cctx, &serverssl,
  1029. &clientssl, sfd, cfd)))
  1030. goto end;
  1031. if (cis_ktls) {
  1032. if (!TEST_true(SSL_set_options(clientssl, SSL_OP_ENABLE_KTLS)))
  1033. goto end;
  1034. }
  1035. if (sis_ktls) {
  1036. if (!TEST_true(SSL_set_mode(serverssl, SSL_OP_ENABLE_KTLS)))
  1037. goto end;
  1038. }
  1039. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  1040. SSL_ERROR_NONE)))
  1041. goto end;
  1042. if (!cis_ktls) {
  1043. if (!TEST_false(BIO_get_ktls_send(clientssl->wbio)))
  1044. goto end;
  1045. } else {
  1046. if (!TEST_true(BIO_get_ktls_send(clientssl->wbio)))
  1047. goto end;
  1048. }
  1049. if (!sis_ktls) {
  1050. if (!TEST_false(BIO_get_ktls_send(serverssl->wbio)))
  1051. goto end;
  1052. } else {
  1053. if (!TEST_true(BIO_get_ktls_send(serverssl->wbio)))
  1054. goto end;
  1055. }
  1056. if (!cis_ktls
  1057. #if defined(OPENSSL_NO_KTLS_RX)
  1058. || 1
  1059. #endif
  1060. ) {
  1061. if (!TEST_false(BIO_get_ktls_recv(clientssl->rbio)))
  1062. goto end;
  1063. } else {
  1064. if (!TEST_true(BIO_get_ktls_recv(clientssl->rbio)))
  1065. goto end;
  1066. }
  1067. if (!sis_ktls
  1068. #if defined(OPENSSL_NO_KTLS_RX)
  1069. || 1
  1070. #endif
  1071. ) {
  1072. if (!TEST_false(BIO_get_ktls_recv(serverssl->rbio)))
  1073. goto end;
  1074. } else {
  1075. if (!TEST_true(BIO_get_ktls_recv(serverssl->rbio)))
  1076. goto end;
  1077. }
  1078. if (!TEST_true(ping_pong_query(clientssl, serverssl, cfd, sfd,
  1079. rec_seq_size)))
  1080. goto end;
  1081. testresult = 1;
  1082. end:
  1083. if (clientssl) {
  1084. SSL_shutdown(clientssl);
  1085. SSL_free(clientssl);
  1086. }
  1087. if (serverssl) {
  1088. SSL_shutdown(serverssl);
  1089. SSL_free(serverssl);
  1090. }
  1091. SSL_CTX_free(sctx);
  1092. SSL_CTX_free(cctx);
  1093. serverssl = clientssl = NULL;
  1094. return testresult;
  1095. }
  1096. #define SENDFILE_SZ (16 * 4096)
  1097. #define SENDFILE_CHUNK (4 * 4096)
  1098. #define min(a,b) ((a) > (b) ? (b) : (a))
  1099. static int test_ktls_sendfile(int tls_version, const char *cipher)
  1100. {
  1101. SSL_CTX *cctx = NULL, *sctx = NULL;
  1102. SSL *clientssl = NULL, *serverssl = NULL;
  1103. unsigned char *buf, *buf_dst;
  1104. BIO *out = NULL, *in = NULL;
  1105. int cfd, sfd, ffd, err;
  1106. ssize_t chunk_size = 0;
  1107. off_t chunk_off = 0;
  1108. int testresult = 0;
  1109. FILE *ffdp;
  1110. buf = OPENSSL_zalloc(SENDFILE_SZ);
  1111. buf_dst = OPENSSL_zalloc(SENDFILE_SZ);
  1112. if (!TEST_ptr(buf) || !TEST_ptr(buf_dst)
  1113. || !TEST_true(create_test_sockets(&cfd, &sfd)))
  1114. goto end;
  1115. /* Skip this test if the platform does not support ktls */
  1116. if (!ktls_chk_platform(sfd)) {
  1117. testresult = 1;
  1118. goto end;
  1119. }
  1120. /* Create a session based on SHA-256 */
  1121. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  1122. TLS_client_method(),
  1123. tls_version, tls_version,
  1124. &sctx, &cctx, cert, privkey))
  1125. || !TEST_true(SSL_CTX_set_cipher_list(cctx, cipher))
  1126. || !TEST_true(SSL_CTX_set_cipher_list(sctx, cipher))
  1127. || !TEST_true(create_ssl_objects2(sctx, cctx, &serverssl,
  1128. &clientssl, sfd, cfd)))
  1129. goto end;
  1130. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  1131. SSL_ERROR_NONE))
  1132. || !TEST_true(BIO_get_ktls_send(serverssl->wbio)))
  1133. goto end;
  1134. if (!TEST_true(RAND_bytes_ex(libctx, buf, SENDFILE_SZ, 0)))
  1135. goto end;
  1136. out = BIO_new_file(tmpfilename, "wb");
  1137. if (!TEST_ptr(out))
  1138. goto end;
  1139. if (BIO_write(out, buf, SENDFILE_SZ) != SENDFILE_SZ)
  1140. goto end;
  1141. BIO_free(out);
  1142. out = NULL;
  1143. in = BIO_new_file(tmpfilename, "rb");
  1144. BIO_get_fp(in, &ffdp);
  1145. ffd = fileno(ffdp);
  1146. while (chunk_off < SENDFILE_SZ) {
  1147. chunk_size = min(SENDFILE_CHUNK, SENDFILE_SZ - chunk_off);
  1148. while ((err = SSL_sendfile(serverssl,
  1149. ffd,
  1150. chunk_off,
  1151. chunk_size,
  1152. 0)) != chunk_size) {
  1153. if (SSL_get_error(serverssl, err) != SSL_ERROR_WANT_WRITE)
  1154. goto end;
  1155. }
  1156. while ((err = SSL_read(clientssl,
  1157. buf_dst + chunk_off,
  1158. chunk_size)) != chunk_size) {
  1159. if (SSL_get_error(clientssl, err) != SSL_ERROR_WANT_READ)
  1160. goto end;
  1161. }
  1162. /* verify the payload */
  1163. if (!TEST_mem_eq(buf_dst + chunk_off,
  1164. chunk_size,
  1165. buf + chunk_off,
  1166. chunk_size))
  1167. goto end;
  1168. chunk_off += chunk_size;
  1169. }
  1170. testresult = 1;
  1171. end:
  1172. if (clientssl) {
  1173. SSL_shutdown(clientssl);
  1174. SSL_free(clientssl);
  1175. }
  1176. if (serverssl) {
  1177. SSL_shutdown(serverssl);
  1178. SSL_free(serverssl);
  1179. }
  1180. SSL_CTX_free(sctx);
  1181. SSL_CTX_free(cctx);
  1182. serverssl = clientssl = NULL;
  1183. BIO_free(out);
  1184. BIO_free(in);
  1185. OPENSSL_free(buf);
  1186. OPENSSL_free(buf_dst);
  1187. return testresult;
  1188. }
  1189. #if !defined(OPENSSL_NO_TLS1_2) || !defined(OSSL_NO_USABLE_TLS1_3)
  1190. static int test_ktls(int test)
  1191. {
  1192. int cis_ktls, sis_ktls;
  1193. int tlsver, testresult;
  1194. if (test > 3) {
  1195. #if defined(OSSL_NO_USABLE_TLS1_3)
  1196. return 1;
  1197. #else
  1198. test -= 4;
  1199. tlsver = TLS1_3_VERSION;
  1200. #endif
  1201. } else {
  1202. #if defined(OPENSSL_NO_TLS1_2)
  1203. return 1;
  1204. #else
  1205. tlsver = TLS1_2_VERSION;
  1206. #endif
  1207. }
  1208. cis_ktls = (test & 1) != 0;
  1209. sis_ktls = (test & 2) != 0;
  1210. testresult = 1;
  1211. #ifdef OPENSSL_KTLS_AES_GCM_128
  1212. testresult &= execute_test_ktls(cis_ktls, sis_ktls, tlsver,
  1213. "AES128-GCM-SHA256",
  1214. TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
  1215. #endif
  1216. #ifdef OPENSSL_KTLS_AES_CCM_128
  1217. testresult &= execute_test_ktls(cis_ktls, sis_ktls, tlsver, "AES128-CCM",
  1218. TLS_CIPHER_AES_CCM_128_REC_SEQ_SIZE);
  1219. #endif
  1220. #ifdef OPENSSL_KTLS_AES_GCM_256
  1221. testresult &= execute_test_ktls(cis_ktls, sis_ktls, tlsver,
  1222. "AES256-GCM-SHA384",
  1223. TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
  1224. #endif
  1225. return testresult;
  1226. }
  1227. static int test_ktls_sendfile_anytls(int tst)
  1228. {
  1229. char *cipher[] = {"AES128-GCM-SHA256","AES128-CCM","AES256-GCM-SHA384"};
  1230. int tlsver;
  1231. if (tst > 2) {
  1232. #if defined(OSSL_NO_USABLE_TLS1_3)
  1233. return 1;
  1234. #else
  1235. tst -= 3;
  1236. tlsver = TLS1_3_VERSION;
  1237. #endif
  1238. } else {
  1239. #if defined(OPENSSL_NO_TLS1_2)
  1240. return 1;
  1241. #else
  1242. tlsver = TLS1_2_VERSION;
  1243. #endif
  1244. }
  1245. #ifndef OPENSSL_KTLS_AES_GCM_128
  1246. if(tst == 0) return 1;
  1247. #endif
  1248. #ifndef OPENSSL_KTLS_AES_CCM_128
  1249. if(tst == 1) return 1;
  1250. #endif
  1251. #ifndef OPENSSL_KTLS_AES_GCM_256
  1252. if(tst == 2) return 1;
  1253. #endif
  1254. return test_ktls_sendfile(tlsver, cipher[tst]);
  1255. }
  1256. #endif
  1257. #endif
  1258. static int test_large_message_tls(void)
  1259. {
  1260. return execute_test_large_message(TLS_server_method(), TLS_client_method(),
  1261. TLS1_VERSION, 0, 0);
  1262. }
  1263. static int test_large_message_tls_read_ahead(void)
  1264. {
  1265. return execute_test_large_message(TLS_server_method(), TLS_client_method(),
  1266. TLS1_VERSION, 0, 1);
  1267. }
  1268. #ifndef OPENSSL_NO_DTLS
  1269. static int test_large_message_dtls(void)
  1270. {
  1271. # ifdef OPENSSL_NO_DTLS1_2
  1272. /* Not supported in the FIPS provider */
  1273. if (is_fips)
  1274. return 1;
  1275. # endif
  1276. /*
  1277. * read_ahead is not relevant to DTLS because DTLS always acts as if
  1278. * read_ahead is set.
  1279. */
  1280. return execute_test_large_message(DTLS_server_method(),
  1281. DTLS_client_method(),
  1282. DTLS1_VERSION, 0, 0);
  1283. }
  1284. #endif
  1285. static int execute_cleanse_plaintext(const SSL_METHOD *smeth,
  1286. const SSL_METHOD *cmeth,
  1287. int min_version, int max_version)
  1288. {
  1289. size_t i;
  1290. SSL_CTX *cctx = NULL, *sctx = NULL;
  1291. SSL *clientssl = NULL, *serverssl = NULL;
  1292. int testresult = 0;
  1293. SSL3_RECORD *rr;
  1294. void *zbuf;
  1295. static unsigned char cbuf[16000];
  1296. static unsigned char sbuf[16000];
  1297. if (!TEST_true(create_ssl_ctx_pair(libctx,
  1298. smeth, cmeth,
  1299. min_version, max_version,
  1300. &sctx, &cctx, cert,
  1301. privkey)))
  1302. goto end;
  1303. #ifdef OPENSSL_NO_DTLS1_2
  1304. if (smeth == DTLS_server_method()) {
  1305. # ifdef OPENSSL_NO_DTLS1_2
  1306. /* Not supported in the FIPS provider */
  1307. if (is_fips) {
  1308. testresult = 1;
  1309. goto end;
  1310. };
  1311. # endif
  1312. /*
  1313. * Default sigalgs are SHA1 based in <DTLS1.2 which is in security
  1314. * level 0
  1315. */
  1316. if (!TEST_true(SSL_CTX_set_cipher_list(sctx, "DEFAULT:@SECLEVEL=0"))
  1317. || !TEST_true(SSL_CTX_set_cipher_list(cctx,
  1318. "DEFAULT:@SECLEVEL=0")))
  1319. goto end;
  1320. }
  1321. #endif
  1322. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  1323. NULL, NULL)))
  1324. goto end;
  1325. if (!TEST_true(SSL_set_options(serverssl, SSL_OP_CLEANSE_PLAINTEXT)))
  1326. goto end;
  1327. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  1328. SSL_ERROR_NONE)))
  1329. goto end;
  1330. for (i = 0; i < sizeof(cbuf); i++) {
  1331. cbuf[i] = i & 0xff;
  1332. }
  1333. if (!TEST_int_eq(SSL_write(clientssl, cbuf, sizeof(cbuf)), sizeof(cbuf)))
  1334. goto end;
  1335. if (!TEST_int_eq(SSL_peek(serverssl, &sbuf, sizeof(sbuf)), sizeof(sbuf)))
  1336. goto end;
  1337. if (!TEST_mem_eq(cbuf, sizeof(cbuf), sbuf, sizeof(sbuf)))
  1338. goto end;
  1339. /*
  1340. * Since we called SSL_peek(), we know the data in the record
  1341. * layer is a plaintext record. We can gather the pointer to check
  1342. * for zeroization after SSL_read().
  1343. */
  1344. rr = serverssl->rlayer.rrec;
  1345. zbuf = &rr->data[rr->off];
  1346. if (!TEST_int_eq(rr->length, sizeof(cbuf)))
  1347. goto end;
  1348. /*
  1349. * After SSL_peek() the plaintext must still be stored in the
  1350. * record.
  1351. */
  1352. if (!TEST_mem_eq(cbuf, sizeof(cbuf), zbuf, sizeof(cbuf)))
  1353. goto end;
  1354. memset(sbuf, 0, sizeof(sbuf));
  1355. if (!TEST_int_eq(SSL_read(serverssl, &sbuf, sizeof(sbuf)), sizeof(sbuf)))
  1356. goto end;
  1357. if (!TEST_mem_eq(cbuf, sizeof(cbuf), sbuf, sizeof(cbuf)))
  1358. goto end;
  1359. /* Check if rbuf is cleansed */
  1360. memset(cbuf, 0, sizeof(cbuf));
  1361. if (!TEST_mem_eq(cbuf, sizeof(cbuf), zbuf, sizeof(cbuf)))
  1362. goto end;
  1363. testresult = 1;
  1364. end:
  1365. SSL_free(serverssl);
  1366. SSL_free(clientssl);
  1367. SSL_CTX_free(sctx);
  1368. SSL_CTX_free(cctx);
  1369. return testresult;
  1370. }
  1371. static int test_cleanse_plaintext(void)
  1372. {
  1373. #if !defined(OPENSSL_NO_TLS1_2)
  1374. if (!TEST_true(execute_cleanse_plaintext(TLS_server_method(),
  1375. TLS_client_method(),
  1376. TLS1_2_VERSION,
  1377. TLS1_2_VERSION)))
  1378. return 0;
  1379. #endif
  1380. #if !defined(OSSL_NO_USABLE_TLS1_3)
  1381. if (!TEST_true(execute_cleanse_plaintext(TLS_server_method(),
  1382. TLS_client_method(),
  1383. TLS1_3_VERSION,
  1384. TLS1_3_VERSION)))
  1385. return 0;
  1386. #endif
  1387. #if !defined(OPENSSL_NO_DTLS)
  1388. if (!TEST_true(execute_cleanse_plaintext(DTLS_server_method(),
  1389. DTLS_client_method(),
  1390. DTLS1_VERSION,
  1391. 0)))
  1392. return 0;
  1393. #endif
  1394. return 1;
  1395. }
  1396. #ifndef OPENSSL_NO_OCSP
  1397. static int ocsp_server_cb(SSL *s, void *arg)
  1398. {
  1399. int *argi = (int *)arg;
  1400. unsigned char *copy = NULL;
  1401. STACK_OF(OCSP_RESPID) *ids = NULL;
  1402. OCSP_RESPID *id = NULL;
  1403. if (*argi == 2) {
  1404. /* In this test we are expecting exactly 1 OCSP_RESPID */
  1405. SSL_get_tlsext_status_ids(s, &ids);
  1406. if (ids == NULL || sk_OCSP_RESPID_num(ids) != 1)
  1407. return SSL_TLSEXT_ERR_ALERT_FATAL;
  1408. id = sk_OCSP_RESPID_value(ids, 0);
  1409. if (id == NULL || !OCSP_RESPID_match_ex(id, ocspcert, libctx, NULL))
  1410. return SSL_TLSEXT_ERR_ALERT_FATAL;
  1411. } else if (*argi != 1) {
  1412. return SSL_TLSEXT_ERR_ALERT_FATAL;
  1413. }
  1414. if (!TEST_ptr(copy = OPENSSL_memdup(orespder, sizeof(orespder))))
  1415. return SSL_TLSEXT_ERR_ALERT_FATAL;
  1416. SSL_set_tlsext_status_ocsp_resp(s, copy, sizeof(orespder));
  1417. ocsp_server_called = 1;
  1418. return SSL_TLSEXT_ERR_OK;
  1419. }
  1420. static int ocsp_client_cb(SSL *s, void *arg)
  1421. {
  1422. int *argi = (int *)arg;
  1423. const unsigned char *respderin;
  1424. size_t len;
  1425. if (*argi != 1 && *argi != 2)
  1426. return 0;
  1427. len = SSL_get_tlsext_status_ocsp_resp(s, &respderin);
  1428. if (!TEST_mem_eq(orespder, len, respderin, len))
  1429. return 0;
  1430. ocsp_client_called = 1;
  1431. return 1;
  1432. }
  1433. static int test_tlsext_status_type(void)
  1434. {
  1435. SSL_CTX *cctx = NULL, *sctx = NULL;
  1436. SSL *clientssl = NULL, *serverssl = NULL;
  1437. int testresult = 0;
  1438. STACK_OF(OCSP_RESPID) *ids = NULL;
  1439. OCSP_RESPID *id = NULL;
  1440. BIO *certbio = NULL;
  1441. if (!create_ssl_ctx_pair(libctx, TLS_server_method(), TLS_client_method(),
  1442. TLS1_VERSION, 0,
  1443. &sctx, &cctx, cert, privkey))
  1444. return 0;
  1445. if (SSL_CTX_get_tlsext_status_type(cctx) != -1)
  1446. goto end;
  1447. /* First just do various checks getting and setting tlsext_status_type */
  1448. clientssl = SSL_new(cctx);
  1449. if (!TEST_int_eq(SSL_get_tlsext_status_type(clientssl), -1)
  1450. || !TEST_true(SSL_set_tlsext_status_type(clientssl,
  1451. TLSEXT_STATUSTYPE_ocsp))
  1452. || !TEST_int_eq(SSL_get_tlsext_status_type(clientssl),
  1453. TLSEXT_STATUSTYPE_ocsp))
  1454. goto end;
  1455. SSL_free(clientssl);
  1456. clientssl = NULL;
  1457. if (!SSL_CTX_set_tlsext_status_type(cctx, TLSEXT_STATUSTYPE_ocsp)
  1458. || SSL_CTX_get_tlsext_status_type(cctx) != TLSEXT_STATUSTYPE_ocsp)
  1459. goto end;
  1460. clientssl = SSL_new(cctx);
  1461. if (SSL_get_tlsext_status_type(clientssl) != TLSEXT_STATUSTYPE_ocsp)
  1462. goto end;
  1463. SSL_free(clientssl);
  1464. clientssl = NULL;
  1465. /*
  1466. * Now actually do a handshake and check OCSP information is exchanged and
  1467. * the callbacks get called
  1468. */
  1469. SSL_CTX_set_tlsext_status_cb(cctx, ocsp_client_cb);
  1470. SSL_CTX_set_tlsext_status_arg(cctx, &cdummyarg);
  1471. SSL_CTX_set_tlsext_status_cb(sctx, ocsp_server_cb);
  1472. SSL_CTX_set_tlsext_status_arg(sctx, &cdummyarg);
  1473. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  1474. &clientssl, NULL, NULL))
  1475. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  1476. SSL_ERROR_NONE))
  1477. || !TEST_true(ocsp_client_called)
  1478. || !TEST_true(ocsp_server_called))
  1479. goto end;
  1480. SSL_free(serverssl);
  1481. SSL_free(clientssl);
  1482. serverssl = NULL;
  1483. clientssl = NULL;
  1484. /* Try again but this time force the server side callback to fail */
  1485. ocsp_client_called = 0;
  1486. ocsp_server_called = 0;
  1487. cdummyarg = 0;
  1488. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  1489. &clientssl, NULL, NULL))
  1490. /* This should fail because the callback will fail */
  1491. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  1492. SSL_ERROR_NONE))
  1493. || !TEST_false(ocsp_client_called)
  1494. || !TEST_false(ocsp_server_called))
  1495. goto end;
  1496. SSL_free(serverssl);
  1497. SSL_free(clientssl);
  1498. serverssl = NULL;
  1499. clientssl = NULL;
  1500. /*
  1501. * This time we'll get the client to send an OCSP_RESPID that it will
  1502. * accept.
  1503. */
  1504. ocsp_client_called = 0;
  1505. ocsp_server_called = 0;
  1506. cdummyarg = 2;
  1507. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  1508. &clientssl, NULL, NULL)))
  1509. goto end;
  1510. /*
  1511. * We'll just use any old cert for this test - it doesn't have to be an OCSP
  1512. * specific one. We'll use the server cert.
  1513. */
  1514. if (!TEST_ptr(certbio = BIO_new_file(cert, "r"))
  1515. || !TEST_ptr(id = OCSP_RESPID_new())
  1516. || !TEST_ptr(ids = sk_OCSP_RESPID_new_null())
  1517. || !TEST_ptr(ocspcert = X509_new_ex(libctx, NULL))
  1518. || !TEST_ptr(PEM_read_bio_X509(certbio, &ocspcert, NULL, NULL))
  1519. || !TEST_true(OCSP_RESPID_set_by_key_ex(id, ocspcert, libctx, NULL))
  1520. || !TEST_true(sk_OCSP_RESPID_push(ids, id)))
  1521. goto end;
  1522. id = NULL;
  1523. SSL_set_tlsext_status_ids(clientssl, ids);
  1524. /* Control has been transferred */
  1525. ids = NULL;
  1526. BIO_free(certbio);
  1527. certbio = NULL;
  1528. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  1529. SSL_ERROR_NONE))
  1530. || !TEST_true(ocsp_client_called)
  1531. || !TEST_true(ocsp_server_called))
  1532. goto end;
  1533. testresult = 1;
  1534. end:
  1535. SSL_free(serverssl);
  1536. SSL_free(clientssl);
  1537. SSL_CTX_free(sctx);
  1538. SSL_CTX_free(cctx);
  1539. sk_OCSP_RESPID_pop_free(ids, OCSP_RESPID_free);
  1540. OCSP_RESPID_free(id);
  1541. BIO_free(certbio);
  1542. X509_free(ocspcert);
  1543. ocspcert = NULL;
  1544. return testresult;
  1545. }
  1546. #endif
  1547. #if !defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
  1548. static int new_called, remove_called, get_called;
  1549. static int new_session_cb(SSL *ssl, SSL_SESSION *sess)
  1550. {
  1551. new_called++;
  1552. /*
  1553. * sess has been up-refed for us, but we don't actually need it so free it
  1554. * immediately.
  1555. */
  1556. SSL_SESSION_free(sess);
  1557. return 1;
  1558. }
  1559. static void remove_session_cb(SSL_CTX *ctx, SSL_SESSION *sess)
  1560. {
  1561. remove_called++;
  1562. }
  1563. static SSL_SESSION *get_sess_val = NULL;
  1564. static SSL_SESSION *get_session_cb(SSL *ssl, const unsigned char *id, int len,
  1565. int *copy)
  1566. {
  1567. get_called++;
  1568. *copy = 1;
  1569. return get_sess_val;
  1570. }
  1571. static int execute_test_session(int maxprot, int use_int_cache,
  1572. int use_ext_cache, long s_options)
  1573. {
  1574. SSL_CTX *sctx = NULL, *cctx = NULL;
  1575. SSL *serverssl1 = NULL, *clientssl1 = NULL;
  1576. SSL *serverssl2 = NULL, *clientssl2 = NULL;
  1577. # ifndef OPENSSL_NO_TLS1_1
  1578. SSL *serverssl3 = NULL, *clientssl3 = NULL;
  1579. # endif
  1580. SSL_SESSION *sess1 = NULL, *sess2 = NULL;
  1581. int testresult = 0, numnewsesstick = 1;
  1582. new_called = remove_called = 0;
  1583. /* TLSv1.3 sends 2 NewSessionTickets */
  1584. if (maxprot == TLS1_3_VERSION)
  1585. numnewsesstick = 2;
  1586. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  1587. TLS_client_method(), TLS1_VERSION, 0,
  1588. &sctx, &cctx, cert, privkey)))
  1589. return 0;
  1590. /*
  1591. * Only allow the max protocol version so we can force a connection failure
  1592. * later
  1593. */
  1594. SSL_CTX_set_min_proto_version(cctx, maxprot);
  1595. SSL_CTX_set_max_proto_version(cctx, maxprot);
  1596. /* Set up session cache */
  1597. if (use_ext_cache) {
  1598. SSL_CTX_sess_set_new_cb(cctx, new_session_cb);
  1599. SSL_CTX_sess_set_remove_cb(cctx, remove_session_cb);
  1600. }
  1601. if (use_int_cache) {
  1602. /* Also covers instance where both are set */
  1603. SSL_CTX_set_session_cache_mode(cctx, SSL_SESS_CACHE_CLIENT);
  1604. } else {
  1605. SSL_CTX_set_session_cache_mode(cctx,
  1606. SSL_SESS_CACHE_CLIENT
  1607. | SSL_SESS_CACHE_NO_INTERNAL_STORE);
  1608. }
  1609. if (s_options) {
  1610. SSL_CTX_set_options(sctx, s_options);
  1611. }
  1612. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl1, &clientssl1,
  1613. NULL, NULL))
  1614. || !TEST_true(create_ssl_connection(serverssl1, clientssl1,
  1615. SSL_ERROR_NONE))
  1616. || !TEST_ptr(sess1 = SSL_get1_session(clientssl1)))
  1617. goto end;
  1618. /* Should fail because it should already be in the cache */
  1619. if (use_int_cache && !TEST_false(SSL_CTX_add_session(cctx, sess1)))
  1620. goto end;
  1621. if (use_ext_cache
  1622. && (!TEST_int_eq(new_called, numnewsesstick)
  1623. || !TEST_int_eq(remove_called, 0)))
  1624. goto end;
  1625. new_called = remove_called = 0;
  1626. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl2,
  1627. &clientssl2, NULL, NULL))
  1628. || !TEST_true(SSL_set_session(clientssl2, sess1))
  1629. || !TEST_true(create_ssl_connection(serverssl2, clientssl2,
  1630. SSL_ERROR_NONE))
  1631. || !TEST_true(SSL_session_reused(clientssl2)))
  1632. goto end;
  1633. if (maxprot == TLS1_3_VERSION) {
  1634. /*
  1635. * In TLSv1.3 we should have created a new session even though we have
  1636. * resumed. Since we attempted a resume we should also have removed the
  1637. * old ticket from the cache so that we try to only use tickets once.
  1638. */
  1639. if (use_ext_cache
  1640. && (!TEST_int_eq(new_called, 1)
  1641. || !TEST_int_eq(remove_called, 1)))
  1642. goto end;
  1643. } else {
  1644. /*
  1645. * In TLSv1.2 we expect to have resumed so no sessions added or
  1646. * removed.
  1647. */
  1648. if (use_ext_cache
  1649. && (!TEST_int_eq(new_called, 0)
  1650. || !TEST_int_eq(remove_called, 0)))
  1651. goto end;
  1652. }
  1653. SSL_SESSION_free(sess1);
  1654. if (!TEST_ptr(sess1 = SSL_get1_session(clientssl2)))
  1655. goto end;
  1656. shutdown_ssl_connection(serverssl2, clientssl2);
  1657. serverssl2 = clientssl2 = NULL;
  1658. new_called = remove_called = 0;
  1659. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl2,
  1660. &clientssl2, NULL, NULL))
  1661. || !TEST_true(create_ssl_connection(serverssl2, clientssl2,
  1662. SSL_ERROR_NONE)))
  1663. goto end;
  1664. if (!TEST_ptr(sess2 = SSL_get1_session(clientssl2)))
  1665. goto end;
  1666. if (use_ext_cache
  1667. && (!TEST_int_eq(new_called, numnewsesstick)
  1668. || !TEST_int_eq(remove_called, 0)))
  1669. goto end;
  1670. new_called = remove_called = 0;
  1671. /*
  1672. * This should clear sess2 from the cache because it is a "bad" session.
  1673. * See SSL_set_session() documentation.
  1674. */
  1675. if (!TEST_true(SSL_set_session(clientssl2, sess1)))
  1676. goto end;
  1677. if (use_ext_cache
  1678. && (!TEST_int_eq(new_called, 0) || !TEST_int_eq(remove_called, 1)))
  1679. goto end;
  1680. if (!TEST_ptr_eq(SSL_get_session(clientssl2), sess1))
  1681. goto end;
  1682. if (use_int_cache) {
  1683. /* Should succeeded because it should not already be in the cache */
  1684. if (!TEST_true(SSL_CTX_add_session(cctx, sess2))
  1685. || !TEST_true(SSL_CTX_remove_session(cctx, sess2)))
  1686. goto end;
  1687. }
  1688. new_called = remove_called = 0;
  1689. /* This shouldn't be in the cache so should fail */
  1690. if (!TEST_false(SSL_CTX_remove_session(cctx, sess2)))
  1691. goto end;
  1692. if (use_ext_cache
  1693. && (!TEST_int_eq(new_called, 0) || !TEST_int_eq(remove_called, 1)))
  1694. goto end;
  1695. # if !defined(OPENSSL_NO_TLS1_1)
  1696. new_called = remove_called = 0;
  1697. /* Force a connection failure */
  1698. SSL_CTX_set_max_proto_version(sctx, TLS1_1_VERSION);
  1699. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl3,
  1700. &clientssl3, NULL, NULL))
  1701. || !TEST_true(SSL_set_session(clientssl3, sess1))
  1702. /* This should fail because of the mismatched protocol versions */
  1703. || !TEST_false(create_ssl_connection(serverssl3, clientssl3,
  1704. SSL_ERROR_NONE)))
  1705. goto end;
  1706. /* We should have automatically removed the session from the cache */
  1707. if (use_ext_cache
  1708. && (!TEST_int_eq(new_called, 0) || !TEST_int_eq(remove_called, 1)))
  1709. goto end;
  1710. /* Should succeed because it should not already be in the cache */
  1711. if (use_int_cache && !TEST_true(SSL_CTX_add_session(cctx, sess2)))
  1712. goto end;
  1713. # endif
  1714. /* Now do some tests for server side caching */
  1715. if (use_ext_cache) {
  1716. SSL_CTX_sess_set_new_cb(cctx, NULL);
  1717. SSL_CTX_sess_set_remove_cb(cctx, NULL);
  1718. SSL_CTX_sess_set_new_cb(sctx, new_session_cb);
  1719. SSL_CTX_sess_set_remove_cb(sctx, remove_session_cb);
  1720. SSL_CTX_sess_set_get_cb(sctx, get_session_cb);
  1721. get_sess_val = NULL;
  1722. }
  1723. SSL_CTX_set_session_cache_mode(cctx, 0);
  1724. /* Internal caching is the default on the server side */
  1725. if (!use_int_cache)
  1726. SSL_CTX_set_session_cache_mode(sctx,
  1727. SSL_SESS_CACHE_SERVER
  1728. | SSL_SESS_CACHE_NO_INTERNAL_STORE);
  1729. SSL_free(serverssl1);
  1730. SSL_free(clientssl1);
  1731. serverssl1 = clientssl1 = NULL;
  1732. SSL_free(serverssl2);
  1733. SSL_free(clientssl2);
  1734. serverssl2 = clientssl2 = NULL;
  1735. SSL_SESSION_free(sess1);
  1736. sess1 = NULL;
  1737. SSL_SESSION_free(sess2);
  1738. sess2 = NULL;
  1739. SSL_CTX_set_max_proto_version(sctx, maxprot);
  1740. if (maxprot == TLS1_2_VERSION)
  1741. SSL_CTX_set_options(sctx, SSL_OP_NO_TICKET);
  1742. new_called = remove_called = get_called = 0;
  1743. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl1, &clientssl1,
  1744. NULL, NULL))
  1745. || !TEST_true(create_ssl_connection(serverssl1, clientssl1,
  1746. SSL_ERROR_NONE))
  1747. || !TEST_ptr(sess1 = SSL_get1_session(clientssl1))
  1748. || !TEST_ptr(sess2 = SSL_get1_session(serverssl1)))
  1749. goto end;
  1750. if (use_int_cache) {
  1751. if (maxprot == TLS1_3_VERSION && !use_ext_cache) {
  1752. /*
  1753. * In TLSv1.3 it should not have been added to the internal cache,
  1754. * except in the case where we also have an external cache (in that
  1755. * case it gets added to the cache in order to generate remove
  1756. * events after timeout).
  1757. */
  1758. if (!TEST_false(SSL_CTX_remove_session(sctx, sess2)))
  1759. goto end;
  1760. } else {
  1761. /* Should fail because it should already be in the cache */
  1762. if (!TEST_false(SSL_CTX_add_session(sctx, sess2)))
  1763. goto end;
  1764. }
  1765. }
  1766. if (use_ext_cache) {
  1767. SSL_SESSION *tmp = sess2;
  1768. if (!TEST_int_eq(new_called, numnewsesstick)
  1769. || !TEST_int_eq(remove_called, 0)
  1770. || !TEST_int_eq(get_called, 0))
  1771. goto end;
  1772. /*
  1773. * Delete the session from the internal cache to force a lookup from
  1774. * the external cache. We take a copy first because
  1775. * SSL_CTX_remove_session() also marks the session as non-resumable.
  1776. */
  1777. if (use_int_cache && maxprot != TLS1_3_VERSION) {
  1778. if (!TEST_ptr(tmp = SSL_SESSION_dup(sess2))
  1779. || !TEST_true(SSL_CTX_remove_session(sctx, sess2)))
  1780. goto end;
  1781. SSL_SESSION_free(sess2);
  1782. }
  1783. sess2 = tmp;
  1784. }
  1785. new_called = remove_called = get_called = 0;
  1786. get_sess_val = sess2;
  1787. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl2,
  1788. &clientssl2, NULL, NULL))
  1789. || !TEST_true(SSL_set_session(clientssl2, sess1))
  1790. || !TEST_true(create_ssl_connection(serverssl2, clientssl2,
  1791. SSL_ERROR_NONE))
  1792. || !TEST_true(SSL_session_reused(clientssl2)))
  1793. goto end;
  1794. if (use_ext_cache) {
  1795. if (!TEST_int_eq(remove_called, 0))
  1796. goto end;
  1797. if (maxprot == TLS1_3_VERSION) {
  1798. if (!TEST_int_eq(new_called, 1)
  1799. || !TEST_int_eq(get_called, 0))
  1800. goto end;
  1801. } else {
  1802. if (!TEST_int_eq(new_called, 0)
  1803. || !TEST_int_eq(get_called, 1))
  1804. goto end;
  1805. }
  1806. }
  1807. testresult = 1;
  1808. end:
  1809. SSL_free(serverssl1);
  1810. SSL_free(clientssl1);
  1811. SSL_free(serverssl2);
  1812. SSL_free(clientssl2);
  1813. # ifndef OPENSSL_NO_TLS1_1
  1814. SSL_free(serverssl3);
  1815. SSL_free(clientssl3);
  1816. # endif
  1817. SSL_SESSION_free(sess1);
  1818. SSL_SESSION_free(sess2);
  1819. SSL_CTX_free(sctx);
  1820. SSL_CTX_free(cctx);
  1821. return testresult;
  1822. }
  1823. #endif /* !defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2) */
  1824. static int test_session_with_only_int_cache(void)
  1825. {
  1826. #ifndef OSSL_NO_USABLE_TLS1_3
  1827. if (!execute_test_session(TLS1_3_VERSION, 1, 0, 0))
  1828. return 0;
  1829. #endif
  1830. #ifndef OPENSSL_NO_TLS1_2
  1831. return execute_test_session(TLS1_2_VERSION, 1, 0, 0);
  1832. #else
  1833. return 1;
  1834. #endif
  1835. }
  1836. static int test_session_with_only_ext_cache(void)
  1837. {
  1838. #ifndef OSSL_NO_USABLE_TLS1_3
  1839. if (!execute_test_session(TLS1_3_VERSION, 0, 1, 0))
  1840. return 0;
  1841. #endif
  1842. #ifndef OPENSSL_NO_TLS1_2
  1843. return execute_test_session(TLS1_2_VERSION, 0, 1, 0);
  1844. #else
  1845. return 1;
  1846. #endif
  1847. }
  1848. static int test_session_with_both_cache(void)
  1849. {
  1850. #ifndef OSSL_NO_USABLE_TLS1_3
  1851. if (!execute_test_session(TLS1_3_VERSION, 1, 1, 0))
  1852. return 0;
  1853. #endif
  1854. #ifndef OPENSSL_NO_TLS1_2
  1855. return execute_test_session(TLS1_2_VERSION, 1, 1, 0);
  1856. #else
  1857. return 1;
  1858. #endif
  1859. }
  1860. static int test_session_wo_ca_names(void)
  1861. {
  1862. #ifndef OSSL_NO_USABLE_TLS1_3
  1863. if (!execute_test_session(TLS1_3_VERSION, 1, 0, SSL_OP_DISABLE_TLSEXT_CA_NAMES))
  1864. return 0;
  1865. #endif
  1866. #ifndef OPENSSL_NO_TLS1_2
  1867. return execute_test_session(TLS1_2_VERSION, 1, 0, SSL_OP_DISABLE_TLSEXT_CA_NAMES);
  1868. #else
  1869. return 1;
  1870. #endif
  1871. }
  1872. #ifndef OSSL_NO_USABLE_TLS1_3
  1873. static SSL_SESSION *sesscache[6];
  1874. static int do_cache;
  1875. static int new_cachesession_cb(SSL *ssl, SSL_SESSION *sess)
  1876. {
  1877. if (do_cache) {
  1878. sesscache[new_called] = sess;
  1879. } else {
  1880. /* We don't need the reference to the session, so free it */
  1881. SSL_SESSION_free(sess);
  1882. }
  1883. new_called++;
  1884. return 1;
  1885. }
  1886. static int post_handshake_verify(SSL *sssl, SSL *cssl)
  1887. {
  1888. SSL_set_verify(sssl, SSL_VERIFY_PEER, NULL);
  1889. if (!TEST_true(SSL_verify_client_post_handshake(sssl)))
  1890. return 0;
  1891. /* Start handshake on the server and client */
  1892. if (!TEST_int_eq(SSL_do_handshake(sssl), 1)
  1893. || !TEST_int_le(SSL_read(cssl, NULL, 0), 0)
  1894. || !TEST_int_le(SSL_read(sssl, NULL, 0), 0)
  1895. || !TEST_true(create_ssl_connection(sssl, cssl,
  1896. SSL_ERROR_NONE)))
  1897. return 0;
  1898. return 1;
  1899. }
  1900. static int setup_ticket_test(int stateful, int idx, SSL_CTX **sctx,
  1901. SSL_CTX **cctx)
  1902. {
  1903. int sess_id_ctx = 1;
  1904. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  1905. TLS_client_method(), TLS1_VERSION, 0,
  1906. sctx, cctx, cert, privkey))
  1907. || !TEST_true(SSL_CTX_set_num_tickets(*sctx, idx))
  1908. || !TEST_true(SSL_CTX_set_session_id_context(*sctx,
  1909. (void *)&sess_id_ctx,
  1910. sizeof(sess_id_ctx))))
  1911. return 0;
  1912. if (stateful)
  1913. SSL_CTX_set_options(*sctx, SSL_OP_NO_TICKET);
  1914. SSL_CTX_set_session_cache_mode(*cctx, SSL_SESS_CACHE_CLIENT
  1915. | SSL_SESS_CACHE_NO_INTERNAL_STORE);
  1916. SSL_CTX_sess_set_new_cb(*cctx, new_cachesession_cb);
  1917. return 1;
  1918. }
  1919. static int check_resumption(int idx, SSL_CTX *sctx, SSL_CTX *cctx, int succ)
  1920. {
  1921. SSL *serverssl = NULL, *clientssl = NULL;
  1922. int i;
  1923. /* Test that we can resume with all the tickets we got given */
  1924. for (i = 0; i < idx * 2; i++) {
  1925. new_called = 0;
  1926. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  1927. &clientssl, NULL, NULL))
  1928. || !TEST_true(SSL_set_session(clientssl, sesscache[i])))
  1929. goto end;
  1930. SSL_set_post_handshake_auth(clientssl, 1);
  1931. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  1932. SSL_ERROR_NONE)))
  1933. goto end;
  1934. /*
  1935. * Following a successful resumption we only get 1 ticket. After a
  1936. * failed one we should get idx tickets.
  1937. */
  1938. if (succ) {
  1939. if (!TEST_true(SSL_session_reused(clientssl))
  1940. || !TEST_int_eq(new_called, 1))
  1941. goto end;
  1942. } else {
  1943. if (!TEST_false(SSL_session_reused(clientssl))
  1944. || !TEST_int_eq(new_called, idx))
  1945. goto end;
  1946. }
  1947. new_called = 0;
  1948. /* After a post-handshake authentication we should get 1 new ticket */
  1949. if (succ
  1950. && (!post_handshake_verify(serverssl, clientssl)
  1951. || !TEST_int_eq(new_called, 1)))
  1952. goto end;
  1953. SSL_shutdown(clientssl);
  1954. SSL_shutdown(serverssl);
  1955. SSL_free(serverssl);
  1956. SSL_free(clientssl);
  1957. serverssl = clientssl = NULL;
  1958. SSL_SESSION_free(sesscache[i]);
  1959. sesscache[i] = NULL;
  1960. }
  1961. return 1;
  1962. end:
  1963. SSL_free(clientssl);
  1964. SSL_free(serverssl);
  1965. return 0;
  1966. }
  1967. static int test_tickets(int stateful, int idx)
  1968. {
  1969. SSL_CTX *sctx = NULL, *cctx = NULL;
  1970. SSL *serverssl = NULL, *clientssl = NULL;
  1971. int testresult = 0;
  1972. size_t j;
  1973. /* idx is the test number, but also the number of tickets we want */
  1974. new_called = 0;
  1975. do_cache = 1;
  1976. if (!setup_ticket_test(stateful, idx, &sctx, &cctx))
  1977. goto end;
  1978. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  1979. &clientssl, NULL, NULL)))
  1980. goto end;
  1981. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  1982. SSL_ERROR_NONE))
  1983. /* Check we got the number of tickets we were expecting */
  1984. || !TEST_int_eq(idx, new_called))
  1985. goto end;
  1986. SSL_shutdown(clientssl);
  1987. SSL_shutdown(serverssl);
  1988. SSL_free(serverssl);
  1989. SSL_free(clientssl);
  1990. SSL_CTX_free(sctx);
  1991. SSL_CTX_free(cctx);
  1992. clientssl = serverssl = NULL;
  1993. sctx = cctx = NULL;
  1994. /*
  1995. * Now we try to resume with the tickets we previously created. The
  1996. * resumption attempt is expected to fail (because we're now using a new
  1997. * SSL_CTX). We should see idx number of tickets issued again.
  1998. */
  1999. /* Stop caching sessions - just count them */
  2000. do_cache = 0;
  2001. if (!setup_ticket_test(stateful, idx, &sctx, &cctx))
  2002. goto end;
  2003. if (!check_resumption(idx, sctx, cctx, 0))
  2004. goto end;
  2005. /* Start again with caching sessions */
  2006. new_called = 0;
  2007. do_cache = 1;
  2008. SSL_CTX_free(sctx);
  2009. SSL_CTX_free(cctx);
  2010. sctx = cctx = NULL;
  2011. if (!setup_ticket_test(stateful, idx, &sctx, &cctx))
  2012. goto end;
  2013. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  2014. &clientssl, NULL, NULL)))
  2015. goto end;
  2016. SSL_set_post_handshake_auth(clientssl, 1);
  2017. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  2018. SSL_ERROR_NONE))
  2019. /* Check we got the number of tickets we were expecting */
  2020. || !TEST_int_eq(idx, new_called))
  2021. goto end;
  2022. /* After a post-handshake authentication we should get new tickets issued */
  2023. if (!post_handshake_verify(serverssl, clientssl)
  2024. || !TEST_int_eq(idx * 2, new_called))
  2025. goto end;
  2026. SSL_shutdown(clientssl);
  2027. SSL_shutdown(serverssl);
  2028. SSL_free(serverssl);
  2029. SSL_free(clientssl);
  2030. serverssl = clientssl = NULL;
  2031. /* Stop caching sessions - just count them */
  2032. do_cache = 0;
  2033. /*
  2034. * Check we can resume with all the tickets we created. This time around the
  2035. * resumptions should all be successful.
  2036. */
  2037. if (!check_resumption(idx, sctx, cctx, 1))
  2038. goto end;
  2039. testresult = 1;
  2040. end:
  2041. SSL_free(serverssl);
  2042. SSL_free(clientssl);
  2043. for (j = 0; j < OSSL_NELEM(sesscache); j++) {
  2044. SSL_SESSION_free(sesscache[j]);
  2045. sesscache[j] = NULL;
  2046. }
  2047. SSL_CTX_free(sctx);
  2048. SSL_CTX_free(cctx);
  2049. return testresult;
  2050. }
  2051. static int test_stateless_tickets(int idx)
  2052. {
  2053. return test_tickets(0, idx);
  2054. }
  2055. static int test_stateful_tickets(int idx)
  2056. {
  2057. return test_tickets(1, idx);
  2058. }
  2059. static int test_psk_tickets(void)
  2060. {
  2061. SSL_CTX *sctx = NULL, *cctx = NULL;
  2062. SSL *serverssl = NULL, *clientssl = NULL;
  2063. int testresult = 0;
  2064. int sess_id_ctx = 1;
  2065. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  2066. TLS_client_method(), TLS1_VERSION, 0,
  2067. &sctx, &cctx, NULL, NULL))
  2068. || !TEST_true(SSL_CTX_set_session_id_context(sctx,
  2069. (void *)&sess_id_ctx,
  2070. sizeof(sess_id_ctx))))
  2071. goto end;
  2072. SSL_CTX_set_session_cache_mode(cctx, SSL_SESS_CACHE_CLIENT
  2073. | SSL_SESS_CACHE_NO_INTERNAL_STORE);
  2074. SSL_CTX_set_psk_use_session_callback(cctx, use_session_cb);
  2075. SSL_CTX_set_psk_find_session_callback(sctx, find_session_cb);
  2076. SSL_CTX_sess_set_new_cb(cctx, new_session_cb);
  2077. use_session_cb_cnt = 0;
  2078. find_session_cb_cnt = 0;
  2079. srvid = pskid;
  2080. new_called = 0;
  2081. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  2082. NULL, NULL)))
  2083. goto end;
  2084. clientpsk = serverpsk = create_a_psk(clientssl);
  2085. if (!TEST_ptr(clientpsk))
  2086. goto end;
  2087. SSL_SESSION_up_ref(clientpsk);
  2088. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  2089. SSL_ERROR_NONE))
  2090. || !TEST_int_eq(1, find_session_cb_cnt)
  2091. || !TEST_int_eq(1, use_session_cb_cnt)
  2092. /* We should always get 1 ticket when using external PSK */
  2093. || !TEST_int_eq(1, new_called))
  2094. goto end;
  2095. testresult = 1;
  2096. end:
  2097. SSL_free(serverssl);
  2098. SSL_free(clientssl);
  2099. SSL_CTX_free(sctx);
  2100. SSL_CTX_free(cctx);
  2101. SSL_SESSION_free(clientpsk);
  2102. SSL_SESSION_free(serverpsk);
  2103. clientpsk = serverpsk = NULL;
  2104. return testresult;
  2105. }
  2106. static int test_extra_tickets(int idx)
  2107. {
  2108. SSL_CTX *sctx = NULL, *cctx = NULL;
  2109. SSL *serverssl = NULL, *clientssl = NULL;
  2110. BIO *bretry = BIO_new(bio_s_always_retry());
  2111. BIO *tmp = NULL;
  2112. int testresult = 0;
  2113. int stateful = 0;
  2114. size_t nbytes;
  2115. unsigned char c, buf[1];
  2116. new_called = 0;
  2117. do_cache = 1;
  2118. if (idx >= 3) {
  2119. idx -= 3;
  2120. stateful = 1;
  2121. }
  2122. if (!TEST_ptr(bretry) || !setup_ticket_test(stateful, idx, &sctx, &cctx))
  2123. goto end;
  2124. SSL_CTX_sess_set_new_cb(sctx, new_session_cb);
  2125. /* setup_ticket_test() uses new_cachesession_cb which we don't need. */
  2126. SSL_CTX_sess_set_new_cb(cctx, new_session_cb);
  2127. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  2128. &clientssl, NULL, NULL)))
  2129. goto end;
  2130. /*
  2131. * Note that we have new_session_cb on both sctx and cctx, so new_called is
  2132. * incremented by both client and server.
  2133. */
  2134. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  2135. SSL_ERROR_NONE))
  2136. /* Check we got the number of tickets we were expecting */
  2137. || !TEST_int_eq(idx * 2, new_called)
  2138. || !TEST_true(SSL_new_session_ticket(serverssl))
  2139. || !TEST_true(SSL_new_session_ticket(serverssl))
  2140. || !TEST_int_eq(idx * 2, new_called))
  2141. goto end;
  2142. /* Now try a (real) write to actually send the tickets */
  2143. c = '1';
  2144. if (!TEST_true(SSL_write_ex(serverssl, &c, 1, &nbytes))
  2145. || !TEST_size_t_eq(1, nbytes)
  2146. || !TEST_int_eq(idx * 2 + 2, new_called)
  2147. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes))
  2148. || !TEST_int_eq(idx * 2 + 4, new_called)
  2149. || !TEST_int_eq(sizeof(buf), nbytes)
  2150. || !TEST_int_eq(c, buf[0])
  2151. || !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes)))
  2152. goto end;
  2153. /* Try with only requesting one new ticket, too */
  2154. c = '2';
  2155. new_called = 0;
  2156. if (!TEST_true(SSL_new_session_ticket(serverssl))
  2157. || !TEST_true(SSL_write_ex(serverssl, &c, sizeof(c), &nbytes))
  2158. || !TEST_size_t_eq(sizeof(c), nbytes)
  2159. || !TEST_int_eq(1, new_called)
  2160. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes))
  2161. || !TEST_int_eq(2, new_called)
  2162. || !TEST_size_t_eq(sizeof(buf), nbytes)
  2163. || !TEST_int_eq(c, buf[0]))
  2164. goto end;
  2165. /* Do it again but use dummy writes to drive the ticket generation */
  2166. c = '3';
  2167. new_called = 0;
  2168. if (!TEST_true(SSL_new_session_ticket(serverssl))
  2169. || !TEST_true(SSL_new_session_ticket(serverssl))
  2170. || !TEST_true(SSL_write_ex(serverssl, &c, 0, &nbytes))
  2171. || !TEST_size_t_eq(0, nbytes)
  2172. || !TEST_int_eq(2, new_called)
  2173. || !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes))
  2174. || !TEST_int_eq(4, new_called))
  2175. goto end;
  2176. /* Once more, but with SSL_do_handshake() to drive the ticket generation */
  2177. c = '4';
  2178. new_called = 0;
  2179. if (!TEST_true(SSL_new_session_ticket(serverssl))
  2180. || !TEST_true(SSL_new_session_ticket(serverssl))
  2181. || !TEST_true(SSL_do_handshake(serverssl))
  2182. || !TEST_int_eq(2, new_called)
  2183. || !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes))
  2184. || !TEST_int_eq(4, new_called))
  2185. goto end;
  2186. /*
  2187. * Use the always-retry BIO to exercise the logic that forces ticket
  2188. * generation to wait until a record boundary.
  2189. */
  2190. c = '5';
  2191. new_called = 0;
  2192. tmp = SSL_get_wbio(serverssl);
  2193. if (!TEST_ptr(tmp) || !TEST_true(BIO_up_ref(tmp))) {
  2194. tmp = NULL;
  2195. goto end;
  2196. }
  2197. SSL_set0_wbio(serverssl, bretry);
  2198. bretry = NULL;
  2199. if (!TEST_false(SSL_write_ex(serverssl, &c, 1, &nbytes))
  2200. || !TEST_int_eq(SSL_get_error(serverssl, 0), SSL_ERROR_WANT_WRITE)
  2201. || !TEST_size_t_eq(nbytes, 0))
  2202. goto end;
  2203. /* Restore a BIO that will let the write succeed */
  2204. SSL_set0_wbio(serverssl, tmp);
  2205. tmp = NULL;
  2206. /*
  2207. * These calls should just queue the request and not send anything
  2208. * even if we explicitly try to hit the state machine.
  2209. */
  2210. if (!TEST_true(SSL_new_session_ticket(serverssl))
  2211. || !TEST_true(SSL_new_session_ticket(serverssl))
  2212. || !TEST_int_eq(0, new_called)
  2213. || !TEST_true(SSL_do_handshake(serverssl))
  2214. || !TEST_int_eq(0, new_called))
  2215. goto end;
  2216. /* Re-do the write; still no tickets sent */
  2217. if (!TEST_true(SSL_write_ex(serverssl, &c, 1, &nbytes))
  2218. || !TEST_size_t_eq(1, nbytes)
  2219. || !TEST_int_eq(0, new_called)
  2220. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes))
  2221. || !TEST_int_eq(0, new_called)
  2222. || !TEST_int_eq(sizeof(buf), nbytes)
  2223. || !TEST_int_eq(c, buf[0])
  2224. || !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes)))
  2225. goto end;
  2226. /* Even trying to hit the state machine now will still not send tickets */
  2227. if (!TEST_true(SSL_do_handshake(serverssl))
  2228. || !TEST_int_eq(0, new_called))
  2229. goto end;
  2230. /* Now the *next* write should send the tickets */
  2231. c = '6';
  2232. if (!TEST_true(SSL_write_ex(serverssl, &c, 1, &nbytes))
  2233. || !TEST_size_t_eq(1, nbytes)
  2234. || !TEST_int_eq(2, new_called)
  2235. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes))
  2236. || !TEST_int_eq(4, new_called)
  2237. || !TEST_int_eq(sizeof(buf), nbytes)
  2238. || !TEST_int_eq(c, buf[0])
  2239. || !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &nbytes)))
  2240. goto end;
  2241. SSL_shutdown(clientssl);
  2242. SSL_shutdown(serverssl);
  2243. testresult = 1;
  2244. end:
  2245. BIO_free(bretry);
  2246. BIO_free(tmp);
  2247. SSL_free(serverssl);
  2248. SSL_free(clientssl);
  2249. SSL_CTX_free(sctx);
  2250. SSL_CTX_free(cctx);
  2251. clientssl = serverssl = NULL;
  2252. sctx = cctx = NULL;
  2253. return testresult;
  2254. }
  2255. #endif
  2256. #define USE_NULL 0
  2257. #define USE_BIO_1 1
  2258. #define USE_BIO_2 2
  2259. #define USE_DEFAULT 3
  2260. #define CONNTYPE_CONNECTION_SUCCESS 0
  2261. #define CONNTYPE_CONNECTION_FAIL 1
  2262. #define CONNTYPE_NO_CONNECTION 2
  2263. #define TOTAL_NO_CONN_SSL_SET_BIO_TESTS (3 * 3 * 3 * 3)
  2264. #define TOTAL_CONN_SUCCESS_SSL_SET_BIO_TESTS (2 * 2)
  2265. #if !defined(OSSL_NO_USABLE_TLS1_3) && !defined(OPENSSL_NO_TLS1_2)
  2266. # define TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS (2 * 2)
  2267. #else
  2268. # define TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS 0
  2269. #endif
  2270. #define TOTAL_SSL_SET_BIO_TESTS TOTAL_NO_CONN_SSL_SET_BIO_TESTS \
  2271. + TOTAL_CONN_SUCCESS_SSL_SET_BIO_TESTS \
  2272. + TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS
  2273. static void setupbio(BIO **res, BIO *bio1, BIO *bio2, int type)
  2274. {
  2275. switch (type) {
  2276. case USE_NULL:
  2277. *res = NULL;
  2278. break;
  2279. case USE_BIO_1:
  2280. *res = bio1;
  2281. break;
  2282. case USE_BIO_2:
  2283. *res = bio2;
  2284. break;
  2285. }
  2286. }
  2287. /*
  2288. * Tests calls to SSL_set_bio() under various conditions.
  2289. *
  2290. * For the first 3 * 3 * 3 * 3 = 81 tests we do 2 calls to SSL_set_bio() with
  2291. * various combinations of valid BIOs or NULL being set for the rbio/wbio. We
  2292. * then do more tests where we create a successful connection first using our
  2293. * standard connection setup functions, and then call SSL_set_bio() with
  2294. * various combinations of valid BIOs or NULL. We then repeat these tests
  2295. * following a failed connection. In this last case we are looking to check that
  2296. * SSL_set_bio() functions correctly in the case where s->bbio is not NULL.
  2297. */
  2298. static int test_ssl_set_bio(int idx)
  2299. {
  2300. SSL_CTX *sctx = NULL, *cctx = NULL;
  2301. BIO *bio1 = NULL;
  2302. BIO *bio2 = NULL;
  2303. BIO *irbio = NULL, *iwbio = NULL, *nrbio = NULL, *nwbio = NULL;
  2304. SSL *serverssl = NULL, *clientssl = NULL;
  2305. int initrbio, initwbio, newrbio, newwbio, conntype;
  2306. int testresult = 0;
  2307. if (idx < TOTAL_NO_CONN_SSL_SET_BIO_TESTS) {
  2308. initrbio = idx % 3;
  2309. idx /= 3;
  2310. initwbio = idx % 3;
  2311. idx /= 3;
  2312. newrbio = idx % 3;
  2313. idx /= 3;
  2314. newwbio = idx % 3;
  2315. conntype = CONNTYPE_NO_CONNECTION;
  2316. } else {
  2317. idx -= TOTAL_NO_CONN_SSL_SET_BIO_TESTS;
  2318. initrbio = initwbio = USE_DEFAULT;
  2319. newrbio = idx % 2;
  2320. idx /= 2;
  2321. newwbio = idx % 2;
  2322. idx /= 2;
  2323. conntype = idx % 2;
  2324. }
  2325. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  2326. TLS_client_method(), TLS1_VERSION, 0,
  2327. &sctx, &cctx, cert, privkey)))
  2328. goto end;
  2329. if (conntype == CONNTYPE_CONNECTION_FAIL) {
  2330. /*
  2331. * We won't ever get here if either TLSv1.3 or TLSv1.2 is disabled
  2332. * because we reduced the number of tests in the definition of
  2333. * TOTAL_CONN_FAIL_SSL_SET_BIO_TESTS to avoid this scenario. By setting
  2334. * mismatched protocol versions we will force a connection failure.
  2335. */
  2336. SSL_CTX_set_min_proto_version(sctx, TLS1_3_VERSION);
  2337. SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION);
  2338. }
  2339. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  2340. NULL, NULL)))
  2341. goto end;
  2342. if (initrbio == USE_BIO_1
  2343. || initwbio == USE_BIO_1
  2344. || newrbio == USE_BIO_1
  2345. || newwbio == USE_BIO_1) {
  2346. if (!TEST_ptr(bio1 = BIO_new(BIO_s_mem())))
  2347. goto end;
  2348. }
  2349. if (initrbio == USE_BIO_2
  2350. || initwbio == USE_BIO_2
  2351. || newrbio == USE_BIO_2
  2352. || newwbio == USE_BIO_2) {
  2353. if (!TEST_ptr(bio2 = BIO_new(BIO_s_mem())))
  2354. goto end;
  2355. }
  2356. if (initrbio != USE_DEFAULT) {
  2357. setupbio(&irbio, bio1, bio2, initrbio);
  2358. setupbio(&iwbio, bio1, bio2, initwbio);
  2359. SSL_set_bio(clientssl, irbio, iwbio);
  2360. /*
  2361. * We want to maintain our own refs to these BIO, so do an up ref for
  2362. * each BIO that will have ownership transferred in the SSL_set_bio()
  2363. * call
  2364. */
  2365. if (irbio != NULL)
  2366. BIO_up_ref(irbio);
  2367. if (iwbio != NULL && iwbio != irbio)
  2368. BIO_up_ref(iwbio);
  2369. }
  2370. if (conntype != CONNTYPE_NO_CONNECTION
  2371. && !TEST_true(create_ssl_connection(serverssl, clientssl,
  2372. SSL_ERROR_NONE)
  2373. == (conntype == CONNTYPE_CONNECTION_SUCCESS)))
  2374. goto end;
  2375. setupbio(&nrbio, bio1, bio2, newrbio);
  2376. setupbio(&nwbio, bio1, bio2, newwbio);
  2377. /*
  2378. * We will (maybe) transfer ownership again so do more up refs.
  2379. * SSL_set_bio() has some really complicated ownership rules where BIOs have
  2380. * already been set!
  2381. */
  2382. if (nrbio != NULL
  2383. && nrbio != irbio
  2384. && (nwbio != iwbio || nrbio != nwbio))
  2385. BIO_up_ref(nrbio);
  2386. if (nwbio != NULL
  2387. && nwbio != nrbio
  2388. && (nwbio != iwbio || (nwbio == iwbio && irbio == iwbio)))
  2389. BIO_up_ref(nwbio);
  2390. SSL_set_bio(clientssl, nrbio, nwbio);
  2391. testresult = 1;
  2392. end:
  2393. BIO_free(bio1);
  2394. BIO_free(bio2);
  2395. /*
  2396. * This test is checking that the ref counting for SSL_set_bio is correct.
  2397. * If we get here and we did too many frees then we will fail in the above
  2398. * functions.
  2399. */
  2400. SSL_free(serverssl);
  2401. SSL_free(clientssl);
  2402. SSL_CTX_free(sctx);
  2403. SSL_CTX_free(cctx);
  2404. return testresult;
  2405. }
  2406. typedef enum { NO_BIO_CHANGE, CHANGE_RBIO, CHANGE_WBIO } bio_change_t;
  2407. static int execute_test_ssl_bio(int pop_ssl, bio_change_t change_bio)
  2408. {
  2409. BIO *sslbio = NULL, *membio1 = NULL, *membio2 = NULL;
  2410. SSL_CTX *ctx;
  2411. SSL *ssl = NULL;
  2412. int testresult = 0;
  2413. if (!TEST_ptr(ctx = SSL_CTX_new_ex(libctx, NULL, TLS_method()))
  2414. || !TEST_ptr(ssl = SSL_new(ctx))
  2415. || !TEST_ptr(sslbio = BIO_new(BIO_f_ssl()))
  2416. || !TEST_ptr(membio1 = BIO_new(BIO_s_mem())))
  2417. goto end;
  2418. BIO_set_ssl(sslbio, ssl, BIO_CLOSE);
  2419. /*
  2420. * If anything goes wrong here then we could leak memory.
  2421. */
  2422. BIO_push(sslbio, membio1);
  2423. /* Verify changing the rbio/wbio directly does not cause leaks */
  2424. if (change_bio != NO_BIO_CHANGE) {
  2425. if (!TEST_ptr(membio2 = BIO_new(BIO_s_mem()))) {
  2426. ssl = NULL;
  2427. goto end;
  2428. }
  2429. if (change_bio == CHANGE_RBIO)
  2430. SSL_set0_rbio(ssl, membio2);
  2431. else
  2432. SSL_set0_wbio(ssl, membio2);
  2433. }
  2434. ssl = NULL;
  2435. if (pop_ssl)
  2436. BIO_pop(sslbio);
  2437. else
  2438. BIO_pop(membio1);
  2439. testresult = 1;
  2440. end:
  2441. BIO_free(membio1);
  2442. BIO_free(sslbio);
  2443. SSL_free(ssl);
  2444. SSL_CTX_free(ctx);
  2445. return testresult;
  2446. }
  2447. static int test_ssl_bio_pop_next_bio(void)
  2448. {
  2449. return execute_test_ssl_bio(0, NO_BIO_CHANGE);
  2450. }
  2451. static int test_ssl_bio_pop_ssl_bio(void)
  2452. {
  2453. return execute_test_ssl_bio(1, NO_BIO_CHANGE);
  2454. }
  2455. static int test_ssl_bio_change_rbio(void)
  2456. {
  2457. return execute_test_ssl_bio(0, CHANGE_RBIO);
  2458. }
  2459. static int test_ssl_bio_change_wbio(void)
  2460. {
  2461. return execute_test_ssl_bio(0, CHANGE_WBIO);
  2462. }
  2463. #if !defined(OPENSSL_NO_TLS1_2) || defined(OSSL_NO_USABLE_TLS1_3)
  2464. typedef struct {
  2465. /* The list of sig algs */
  2466. const int *list;
  2467. /* The length of the list */
  2468. size_t listlen;
  2469. /* A sigalgs list in string format */
  2470. const char *liststr;
  2471. /* Whether setting the list should succeed */
  2472. int valid;
  2473. /* Whether creating a connection with the list should succeed */
  2474. int connsuccess;
  2475. } sigalgs_list;
  2476. static const int validlist1[] = {NID_sha256, EVP_PKEY_RSA};
  2477. # ifndef OPENSSL_NO_EC
  2478. static const int validlist2[] = {NID_sha256, EVP_PKEY_RSA, NID_sha512, EVP_PKEY_EC};
  2479. static const int validlist3[] = {NID_sha512, EVP_PKEY_EC};
  2480. # endif
  2481. static const int invalidlist1[] = {NID_undef, EVP_PKEY_RSA};
  2482. static const int invalidlist2[] = {NID_sha256, NID_undef};
  2483. static const int invalidlist3[] = {NID_sha256, EVP_PKEY_RSA, NID_sha256};
  2484. static const int invalidlist4[] = {NID_sha256};
  2485. static const sigalgs_list testsigalgs[] = {
  2486. {validlist1, OSSL_NELEM(validlist1), NULL, 1, 1},
  2487. # ifndef OPENSSL_NO_EC
  2488. {validlist2, OSSL_NELEM(validlist2), NULL, 1, 1},
  2489. {validlist3, OSSL_NELEM(validlist3), NULL, 1, 0},
  2490. # endif
  2491. {NULL, 0, "RSA+SHA256", 1, 1},
  2492. # ifndef OPENSSL_NO_EC
  2493. {NULL, 0, "RSA+SHA256:ECDSA+SHA512", 1, 1},
  2494. {NULL, 0, "ECDSA+SHA512", 1, 0},
  2495. # endif
  2496. {invalidlist1, OSSL_NELEM(invalidlist1), NULL, 0, 0},
  2497. {invalidlist2, OSSL_NELEM(invalidlist2), NULL, 0, 0},
  2498. {invalidlist3, OSSL_NELEM(invalidlist3), NULL, 0, 0},
  2499. {invalidlist4, OSSL_NELEM(invalidlist4), NULL, 0, 0},
  2500. {NULL, 0, "RSA", 0, 0},
  2501. {NULL, 0, "SHA256", 0, 0},
  2502. {NULL, 0, "RSA+SHA256:SHA256", 0, 0},
  2503. {NULL, 0, "Invalid", 0, 0}
  2504. };
  2505. static int test_set_sigalgs(int idx)
  2506. {
  2507. SSL_CTX *cctx = NULL, *sctx = NULL;
  2508. SSL *clientssl = NULL, *serverssl = NULL;
  2509. int testresult = 0;
  2510. const sigalgs_list *curr;
  2511. int testctx;
  2512. /* Should never happen */
  2513. if (!TEST_size_t_le((size_t)idx, OSSL_NELEM(testsigalgs) * 2))
  2514. return 0;
  2515. testctx = ((size_t)idx < OSSL_NELEM(testsigalgs));
  2516. curr = testctx ? &testsigalgs[idx]
  2517. : &testsigalgs[idx - OSSL_NELEM(testsigalgs)];
  2518. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  2519. TLS_client_method(), TLS1_VERSION, 0,
  2520. &sctx, &cctx, cert, privkey)))
  2521. return 0;
  2522. SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION);
  2523. if (testctx) {
  2524. int ret;
  2525. if (curr->list != NULL)
  2526. ret = SSL_CTX_set1_sigalgs(cctx, curr->list, curr->listlen);
  2527. else
  2528. ret = SSL_CTX_set1_sigalgs_list(cctx, curr->liststr);
  2529. if (!ret) {
  2530. if (curr->valid)
  2531. TEST_info("Failure setting sigalgs in SSL_CTX (%d)\n", idx);
  2532. else
  2533. testresult = 1;
  2534. goto end;
  2535. }
  2536. if (!curr->valid) {
  2537. TEST_info("Not-failed setting sigalgs in SSL_CTX (%d)\n", idx);
  2538. goto end;
  2539. }
  2540. }
  2541. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  2542. &clientssl, NULL, NULL)))
  2543. goto end;
  2544. if (!testctx) {
  2545. int ret;
  2546. if (curr->list != NULL)
  2547. ret = SSL_set1_sigalgs(clientssl, curr->list, curr->listlen);
  2548. else
  2549. ret = SSL_set1_sigalgs_list(clientssl, curr->liststr);
  2550. if (!ret) {
  2551. if (curr->valid)
  2552. TEST_info("Failure setting sigalgs in SSL (%d)\n", idx);
  2553. else
  2554. testresult = 1;
  2555. goto end;
  2556. }
  2557. if (!curr->valid)
  2558. goto end;
  2559. }
  2560. if (!TEST_int_eq(create_ssl_connection(serverssl, clientssl,
  2561. SSL_ERROR_NONE),
  2562. curr->connsuccess))
  2563. goto end;
  2564. testresult = 1;
  2565. end:
  2566. SSL_free(serverssl);
  2567. SSL_free(clientssl);
  2568. SSL_CTX_free(sctx);
  2569. SSL_CTX_free(cctx);
  2570. return testresult;
  2571. }
  2572. #endif
  2573. #ifndef OSSL_NO_USABLE_TLS1_3
  2574. static int psk_client_cb_cnt = 0;
  2575. static int psk_server_cb_cnt = 0;
  2576. static int use_session_cb(SSL *ssl, const EVP_MD *md, const unsigned char **id,
  2577. size_t *idlen, SSL_SESSION **sess)
  2578. {
  2579. switch (++use_session_cb_cnt) {
  2580. case 1:
  2581. /* The first call should always have a NULL md */
  2582. if (md != NULL)
  2583. return 0;
  2584. break;
  2585. case 2:
  2586. /* The second call should always have an md */
  2587. if (md == NULL)
  2588. return 0;
  2589. break;
  2590. default:
  2591. /* We should only be called a maximum of twice */
  2592. return 0;
  2593. }
  2594. if (clientpsk != NULL)
  2595. SSL_SESSION_up_ref(clientpsk);
  2596. *sess = clientpsk;
  2597. *id = (const unsigned char *)pskid;
  2598. *idlen = strlen(pskid);
  2599. return 1;
  2600. }
  2601. #ifndef OPENSSL_NO_PSK
  2602. static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *id,
  2603. unsigned int max_id_len,
  2604. unsigned char *psk,
  2605. unsigned int max_psk_len)
  2606. {
  2607. unsigned int psklen = 0;
  2608. psk_client_cb_cnt++;
  2609. if (strlen(pskid) + 1 > max_id_len)
  2610. return 0;
  2611. /* We should only ever be called a maximum of twice per connection */
  2612. if (psk_client_cb_cnt > 2)
  2613. return 0;
  2614. if (clientpsk == NULL)
  2615. return 0;
  2616. /* We'll reuse the PSK we set up for TLSv1.3 */
  2617. if (SSL_SESSION_get_master_key(clientpsk, NULL, 0) > max_psk_len)
  2618. return 0;
  2619. psklen = SSL_SESSION_get_master_key(clientpsk, psk, max_psk_len);
  2620. strncpy(id, pskid, max_id_len);
  2621. return psklen;
  2622. }
  2623. #endif /* OPENSSL_NO_PSK */
  2624. static int find_session_cb(SSL *ssl, const unsigned char *identity,
  2625. size_t identity_len, SSL_SESSION **sess)
  2626. {
  2627. find_session_cb_cnt++;
  2628. /* We should only ever be called a maximum of twice per connection */
  2629. if (find_session_cb_cnt > 2)
  2630. return 0;
  2631. if (serverpsk == NULL)
  2632. return 0;
  2633. /* Identity should match that set by the client */
  2634. if (strlen(srvid) != identity_len
  2635. || strncmp(srvid, (const char *)identity, identity_len) != 0) {
  2636. /* No PSK found, continue but without a PSK */
  2637. *sess = NULL;
  2638. return 1;
  2639. }
  2640. SSL_SESSION_up_ref(serverpsk);
  2641. *sess = serverpsk;
  2642. return 1;
  2643. }
  2644. #ifndef OPENSSL_NO_PSK
  2645. static unsigned int psk_server_cb(SSL *ssl, const char *identity,
  2646. unsigned char *psk, unsigned int max_psk_len)
  2647. {
  2648. unsigned int psklen = 0;
  2649. psk_server_cb_cnt++;
  2650. /* We should only ever be called a maximum of twice per connection */
  2651. if (find_session_cb_cnt > 2)
  2652. return 0;
  2653. if (serverpsk == NULL)
  2654. return 0;
  2655. /* Identity should match that set by the client */
  2656. if (strcmp(srvid, identity) != 0) {
  2657. return 0;
  2658. }
  2659. /* We'll reuse the PSK we set up for TLSv1.3 */
  2660. if (SSL_SESSION_get_master_key(serverpsk, NULL, 0) > max_psk_len)
  2661. return 0;
  2662. psklen = SSL_SESSION_get_master_key(serverpsk, psk, max_psk_len);
  2663. return psklen;
  2664. }
  2665. #endif /* OPENSSL_NO_PSK */
  2666. #define MSG1 "Hello"
  2667. #define MSG2 "World."
  2668. #define MSG3 "This"
  2669. #define MSG4 "is"
  2670. #define MSG5 "a"
  2671. #define MSG6 "test"
  2672. #define MSG7 "message."
  2673. #define TLS13_AES_128_GCM_SHA256_BYTES ((const unsigned char *)"\x13\x01")
  2674. #define TLS13_AES_256_GCM_SHA384_BYTES ((const unsigned char *)"\x13\x02")
  2675. #define TLS13_CHACHA20_POLY1305_SHA256_BYTES ((const unsigned char *)"\x13\x03")
  2676. #define TLS13_AES_128_CCM_SHA256_BYTES ((const unsigned char *)"\x13\x04")
  2677. #define TLS13_AES_128_CCM_8_SHA256_BYTES ((const unsigned char *)"\x13\05")
  2678. static SSL_SESSION *create_a_psk(SSL *ssl)
  2679. {
  2680. const SSL_CIPHER *cipher = NULL;
  2681. const unsigned char key[] = {
  2682. 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a,
  2683. 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15,
  2684. 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20,
  2685. 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b,
  2686. 0x2c, 0x2d, 0x2e, 0x2f
  2687. };
  2688. SSL_SESSION *sess = NULL;
  2689. cipher = SSL_CIPHER_find(ssl, TLS13_AES_256_GCM_SHA384_BYTES);
  2690. sess = SSL_SESSION_new();
  2691. if (!TEST_ptr(sess)
  2692. || !TEST_ptr(cipher)
  2693. || !TEST_true(SSL_SESSION_set1_master_key(sess, key,
  2694. sizeof(key)))
  2695. || !TEST_true(SSL_SESSION_set_cipher(sess, cipher))
  2696. || !TEST_true(
  2697. SSL_SESSION_set_protocol_version(sess,
  2698. TLS1_3_VERSION))) {
  2699. SSL_SESSION_free(sess);
  2700. return NULL;
  2701. }
  2702. return sess;
  2703. }
  2704. /*
  2705. * Helper method to setup objects for early data test. Caller frees objects on
  2706. * error.
  2707. */
  2708. static int setupearly_data_test(SSL_CTX **cctx, SSL_CTX **sctx, SSL **clientssl,
  2709. SSL **serverssl, SSL_SESSION **sess, int idx)
  2710. {
  2711. if (*sctx == NULL
  2712. && !TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  2713. TLS_client_method(),
  2714. TLS1_VERSION, 0,
  2715. sctx, cctx, cert, privkey)))
  2716. return 0;
  2717. if (!TEST_true(SSL_CTX_set_max_early_data(*sctx, SSL3_RT_MAX_PLAIN_LENGTH)))
  2718. return 0;
  2719. if (idx == 1) {
  2720. /* When idx == 1 we repeat the tests with read_ahead set */
  2721. SSL_CTX_set_read_ahead(*cctx, 1);
  2722. SSL_CTX_set_read_ahead(*sctx, 1);
  2723. } else if (idx == 2) {
  2724. /* When idx == 2 we are doing early_data with a PSK. Set up callbacks */
  2725. SSL_CTX_set_psk_use_session_callback(*cctx, use_session_cb);
  2726. SSL_CTX_set_psk_find_session_callback(*sctx, find_session_cb);
  2727. use_session_cb_cnt = 0;
  2728. find_session_cb_cnt = 0;
  2729. srvid = pskid;
  2730. }
  2731. if (!TEST_true(create_ssl_objects(*sctx, *cctx, serverssl, clientssl,
  2732. NULL, NULL)))
  2733. return 0;
  2734. /*
  2735. * For one of the run throughs (doesn't matter which one), we'll try sending
  2736. * some SNI data in the initial ClientHello. This will be ignored (because
  2737. * there is no SNI cb set up by the server), so it should not impact
  2738. * early_data.
  2739. */
  2740. if (idx == 1
  2741. && !TEST_true(SSL_set_tlsext_host_name(*clientssl, "localhost")))
  2742. return 0;
  2743. if (idx == 2) {
  2744. clientpsk = create_a_psk(*clientssl);
  2745. if (!TEST_ptr(clientpsk)
  2746. /*
  2747. * We just choose an arbitrary value for max_early_data which
  2748. * should be big enough for testing purposes.
  2749. */
  2750. || !TEST_true(SSL_SESSION_set_max_early_data(clientpsk,
  2751. 0x100))
  2752. || !TEST_true(SSL_SESSION_up_ref(clientpsk))) {
  2753. SSL_SESSION_free(clientpsk);
  2754. clientpsk = NULL;
  2755. return 0;
  2756. }
  2757. serverpsk = clientpsk;
  2758. if (sess != NULL) {
  2759. if (!TEST_true(SSL_SESSION_up_ref(clientpsk))) {
  2760. SSL_SESSION_free(clientpsk);
  2761. SSL_SESSION_free(serverpsk);
  2762. clientpsk = serverpsk = NULL;
  2763. return 0;
  2764. }
  2765. *sess = clientpsk;
  2766. }
  2767. return 1;
  2768. }
  2769. if (sess == NULL)
  2770. return 1;
  2771. if (!TEST_true(create_ssl_connection(*serverssl, *clientssl,
  2772. SSL_ERROR_NONE)))
  2773. return 0;
  2774. *sess = SSL_get1_session(*clientssl);
  2775. SSL_shutdown(*clientssl);
  2776. SSL_shutdown(*serverssl);
  2777. SSL_free(*serverssl);
  2778. SSL_free(*clientssl);
  2779. *serverssl = *clientssl = NULL;
  2780. if (!TEST_true(create_ssl_objects(*sctx, *cctx, serverssl,
  2781. clientssl, NULL, NULL))
  2782. || !TEST_true(SSL_set_session(*clientssl, *sess)))
  2783. return 0;
  2784. return 1;
  2785. }
  2786. static int test_early_data_read_write(int idx)
  2787. {
  2788. SSL_CTX *cctx = NULL, *sctx = NULL;
  2789. SSL *clientssl = NULL, *serverssl = NULL;
  2790. int testresult = 0;
  2791. SSL_SESSION *sess = NULL;
  2792. unsigned char buf[20], data[1024];
  2793. size_t readbytes, written, eoedlen, rawread, rawwritten;
  2794. BIO *rbio;
  2795. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  2796. &serverssl, &sess, idx)))
  2797. goto end;
  2798. /* Write and read some early data */
  2799. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  2800. &written))
  2801. || !TEST_size_t_eq(written, strlen(MSG1))
  2802. || !TEST_int_eq(SSL_read_early_data(serverssl, buf,
  2803. sizeof(buf), &readbytes),
  2804. SSL_READ_EARLY_DATA_SUCCESS)
  2805. || !TEST_mem_eq(MSG1, readbytes, buf, strlen(MSG1))
  2806. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  2807. SSL_EARLY_DATA_ACCEPTED))
  2808. goto end;
  2809. /*
  2810. * Server should be able to write data, and client should be able to
  2811. * read it.
  2812. */
  2813. if (!TEST_true(SSL_write_early_data(serverssl, MSG2, strlen(MSG2),
  2814. &written))
  2815. || !TEST_size_t_eq(written, strlen(MSG2))
  2816. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  2817. || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
  2818. goto end;
  2819. /* Even after reading normal data, client should be able write early data */
  2820. if (!TEST_true(SSL_write_early_data(clientssl, MSG3, strlen(MSG3),
  2821. &written))
  2822. || !TEST_size_t_eq(written, strlen(MSG3)))
  2823. goto end;
  2824. /* Server should still be able read early data after writing data */
  2825. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  2826. &readbytes),
  2827. SSL_READ_EARLY_DATA_SUCCESS)
  2828. || !TEST_mem_eq(buf, readbytes, MSG3, strlen(MSG3)))
  2829. goto end;
  2830. /* Write more data from server and read it from client */
  2831. if (!TEST_true(SSL_write_early_data(serverssl, MSG4, strlen(MSG4),
  2832. &written))
  2833. || !TEST_size_t_eq(written, strlen(MSG4))
  2834. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  2835. || !TEST_mem_eq(buf, readbytes, MSG4, strlen(MSG4)))
  2836. goto end;
  2837. /*
  2838. * If client writes normal data it should mean writing early data is no
  2839. * longer possible.
  2840. */
  2841. if (!TEST_true(SSL_write_ex(clientssl, MSG5, strlen(MSG5), &written))
  2842. || !TEST_size_t_eq(written, strlen(MSG5))
  2843. || !TEST_int_eq(SSL_get_early_data_status(clientssl),
  2844. SSL_EARLY_DATA_ACCEPTED))
  2845. goto end;
  2846. /*
  2847. * At this point the client has written EndOfEarlyData, ClientFinished and
  2848. * normal (fully protected) data. We are going to cause a delay between the
  2849. * arrival of EndOfEarlyData and ClientFinished. We read out all the data
  2850. * in the read BIO, and then just put back the EndOfEarlyData message.
  2851. */
  2852. rbio = SSL_get_rbio(serverssl);
  2853. if (!TEST_true(BIO_read_ex(rbio, data, sizeof(data), &rawread))
  2854. || !TEST_size_t_lt(rawread, sizeof(data))
  2855. || !TEST_size_t_gt(rawread, SSL3_RT_HEADER_LENGTH))
  2856. goto end;
  2857. /* Record length is in the 4th and 5th bytes of the record header */
  2858. eoedlen = SSL3_RT_HEADER_LENGTH + (data[3] << 8 | data[4]);
  2859. if (!TEST_true(BIO_write_ex(rbio, data, eoedlen, &rawwritten))
  2860. || !TEST_size_t_eq(rawwritten, eoedlen))
  2861. goto end;
  2862. /* Server should be told that there is no more early data */
  2863. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  2864. &readbytes),
  2865. SSL_READ_EARLY_DATA_FINISH)
  2866. || !TEST_size_t_eq(readbytes, 0))
  2867. goto end;
  2868. /*
  2869. * Server has not finished init yet, so should still be able to write early
  2870. * data.
  2871. */
  2872. if (!TEST_true(SSL_write_early_data(serverssl, MSG6, strlen(MSG6),
  2873. &written))
  2874. || !TEST_size_t_eq(written, strlen(MSG6)))
  2875. goto end;
  2876. /* Push the ClientFinished and the normal data back into the server rbio */
  2877. if (!TEST_true(BIO_write_ex(rbio, data + eoedlen, rawread - eoedlen,
  2878. &rawwritten))
  2879. || !TEST_size_t_eq(rawwritten, rawread - eoedlen))
  2880. goto end;
  2881. /* Server should be able to read normal data */
  2882. if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  2883. || !TEST_size_t_eq(readbytes, strlen(MSG5)))
  2884. goto end;
  2885. /* Client and server should not be able to write/read early data now */
  2886. if (!TEST_false(SSL_write_early_data(clientssl, MSG6, strlen(MSG6),
  2887. &written)))
  2888. goto end;
  2889. ERR_clear_error();
  2890. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  2891. &readbytes),
  2892. SSL_READ_EARLY_DATA_ERROR))
  2893. goto end;
  2894. ERR_clear_error();
  2895. /* Client should be able to read the data sent by the server */
  2896. if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  2897. || !TEST_mem_eq(buf, readbytes, MSG6, strlen(MSG6)))
  2898. goto end;
  2899. /*
  2900. * Make sure we process the two NewSessionTickets. These arrive
  2901. * post-handshake. We attempt reads which we do not expect to return any
  2902. * data.
  2903. */
  2904. if (!TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  2905. || !TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf),
  2906. &readbytes)))
  2907. goto end;
  2908. /* Server should be able to write normal data */
  2909. if (!TEST_true(SSL_write_ex(serverssl, MSG7, strlen(MSG7), &written))
  2910. || !TEST_size_t_eq(written, strlen(MSG7))
  2911. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  2912. || !TEST_mem_eq(buf, readbytes, MSG7, strlen(MSG7)))
  2913. goto end;
  2914. SSL_SESSION_free(sess);
  2915. sess = SSL_get1_session(clientssl);
  2916. use_session_cb_cnt = 0;
  2917. find_session_cb_cnt = 0;
  2918. SSL_shutdown(clientssl);
  2919. SSL_shutdown(serverssl);
  2920. SSL_free(serverssl);
  2921. SSL_free(clientssl);
  2922. serverssl = clientssl = NULL;
  2923. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  2924. &clientssl, NULL, NULL))
  2925. || !TEST_true(SSL_set_session(clientssl, sess)))
  2926. goto end;
  2927. /* Write and read some early data */
  2928. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  2929. &written))
  2930. || !TEST_size_t_eq(written, strlen(MSG1))
  2931. || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  2932. &readbytes),
  2933. SSL_READ_EARLY_DATA_SUCCESS)
  2934. || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1)))
  2935. goto end;
  2936. if (!TEST_int_gt(SSL_connect(clientssl), 0)
  2937. || !TEST_int_gt(SSL_accept(serverssl), 0))
  2938. goto end;
  2939. /* Client and server should not be able to write/read early data now */
  2940. if (!TEST_false(SSL_write_early_data(clientssl, MSG6, strlen(MSG6),
  2941. &written)))
  2942. goto end;
  2943. ERR_clear_error();
  2944. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  2945. &readbytes),
  2946. SSL_READ_EARLY_DATA_ERROR))
  2947. goto end;
  2948. ERR_clear_error();
  2949. /* Client and server should be able to write/read normal data */
  2950. if (!TEST_true(SSL_write_ex(clientssl, MSG5, strlen(MSG5), &written))
  2951. || !TEST_size_t_eq(written, strlen(MSG5))
  2952. || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  2953. || !TEST_size_t_eq(readbytes, strlen(MSG5)))
  2954. goto end;
  2955. testresult = 1;
  2956. end:
  2957. SSL_SESSION_free(sess);
  2958. SSL_SESSION_free(clientpsk);
  2959. SSL_SESSION_free(serverpsk);
  2960. clientpsk = serverpsk = NULL;
  2961. SSL_free(serverssl);
  2962. SSL_free(clientssl);
  2963. SSL_CTX_free(sctx);
  2964. SSL_CTX_free(cctx);
  2965. return testresult;
  2966. }
  2967. static int allow_ed_cb_called = 0;
  2968. static int allow_early_data_cb(SSL *s, void *arg)
  2969. {
  2970. int *usecb = (int *)arg;
  2971. allow_ed_cb_called++;
  2972. if (*usecb == 1)
  2973. return 0;
  2974. return 1;
  2975. }
  2976. /*
  2977. * idx == 0: Standard early_data setup
  2978. * idx == 1: early_data setup using read_ahead
  2979. * usecb == 0: Don't use a custom early data callback
  2980. * usecb == 1: Use a custom early data callback and reject the early data
  2981. * usecb == 2: Use a custom early data callback and accept the early data
  2982. * confopt == 0: Configure anti-replay directly
  2983. * confopt == 1: Configure anti-replay using SSL_CONF
  2984. */
  2985. static int test_early_data_replay_int(int idx, int usecb, int confopt)
  2986. {
  2987. SSL_CTX *cctx = NULL, *sctx = NULL;
  2988. SSL *clientssl = NULL, *serverssl = NULL;
  2989. int testresult = 0;
  2990. SSL_SESSION *sess = NULL;
  2991. size_t readbytes, written;
  2992. unsigned char buf[20];
  2993. allow_ed_cb_called = 0;
  2994. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  2995. TLS_client_method(), TLS1_VERSION, 0,
  2996. &sctx, &cctx, cert, privkey)))
  2997. return 0;
  2998. if (usecb > 0) {
  2999. if (confopt == 0) {
  3000. SSL_CTX_set_options(sctx, SSL_OP_NO_ANTI_REPLAY);
  3001. } else {
  3002. SSL_CONF_CTX *confctx = SSL_CONF_CTX_new();
  3003. if (!TEST_ptr(confctx))
  3004. goto end;
  3005. SSL_CONF_CTX_set_flags(confctx, SSL_CONF_FLAG_FILE
  3006. | SSL_CONF_FLAG_SERVER);
  3007. SSL_CONF_CTX_set_ssl_ctx(confctx, sctx);
  3008. if (!TEST_int_eq(SSL_CONF_cmd(confctx, "Options", "-AntiReplay"),
  3009. 2)) {
  3010. SSL_CONF_CTX_free(confctx);
  3011. goto end;
  3012. }
  3013. SSL_CONF_CTX_free(confctx);
  3014. }
  3015. SSL_CTX_set_allow_early_data_cb(sctx, allow_early_data_cb, &usecb);
  3016. }
  3017. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3018. &serverssl, &sess, idx)))
  3019. goto end;
  3020. /*
  3021. * The server is configured to accept early data. Create a connection to
  3022. * "use up" the ticket
  3023. */
  3024. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
  3025. || !TEST_true(SSL_session_reused(clientssl)))
  3026. goto end;
  3027. SSL_shutdown(clientssl);
  3028. SSL_shutdown(serverssl);
  3029. SSL_free(serverssl);
  3030. SSL_free(clientssl);
  3031. serverssl = clientssl = NULL;
  3032. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  3033. &clientssl, NULL, NULL))
  3034. || !TEST_true(SSL_set_session(clientssl, sess)))
  3035. goto end;
  3036. /* Write and read some early data */
  3037. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3038. &written))
  3039. || !TEST_size_t_eq(written, strlen(MSG1)))
  3040. goto end;
  3041. if (usecb <= 1) {
  3042. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3043. &readbytes),
  3044. SSL_READ_EARLY_DATA_FINISH)
  3045. /*
  3046. * The ticket was reused, so the we should have rejected the
  3047. * early data
  3048. */
  3049. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3050. SSL_EARLY_DATA_REJECTED))
  3051. goto end;
  3052. } else {
  3053. /* In this case the callback decides to accept the early data */
  3054. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3055. &readbytes),
  3056. SSL_READ_EARLY_DATA_SUCCESS)
  3057. || !TEST_mem_eq(MSG1, strlen(MSG1), buf, readbytes)
  3058. /*
  3059. * Server will have sent its flight so client can now send
  3060. * end of early data and complete its half of the handshake
  3061. */
  3062. || !TEST_int_gt(SSL_connect(clientssl), 0)
  3063. || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3064. &readbytes),
  3065. SSL_READ_EARLY_DATA_FINISH)
  3066. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3067. SSL_EARLY_DATA_ACCEPTED))
  3068. goto end;
  3069. }
  3070. /* Complete the connection */
  3071. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
  3072. || !TEST_int_eq(SSL_session_reused(clientssl), (usecb > 0) ? 1 : 0)
  3073. || !TEST_int_eq(allow_ed_cb_called, usecb > 0 ? 1 : 0))
  3074. goto end;
  3075. testresult = 1;
  3076. end:
  3077. SSL_SESSION_free(sess);
  3078. SSL_SESSION_free(clientpsk);
  3079. SSL_SESSION_free(serverpsk);
  3080. clientpsk = serverpsk = NULL;
  3081. SSL_free(serverssl);
  3082. SSL_free(clientssl);
  3083. SSL_CTX_free(sctx);
  3084. SSL_CTX_free(cctx);
  3085. return testresult;
  3086. }
  3087. static int test_early_data_replay(int idx)
  3088. {
  3089. int ret = 1, usecb, confopt;
  3090. for (usecb = 0; usecb < 3; usecb++) {
  3091. for (confopt = 0; confopt < 2; confopt++)
  3092. ret &= test_early_data_replay_int(idx, usecb, confopt);
  3093. }
  3094. return ret;
  3095. }
  3096. /*
  3097. * Helper function to test that a server attempting to read early data can
  3098. * handle a connection from a client where the early data should be skipped.
  3099. * testtype: 0 == No HRR
  3100. * testtype: 1 == HRR
  3101. * testtype: 2 == HRR, invalid early_data sent after HRR
  3102. * testtype: 3 == recv_max_early_data set to 0
  3103. */
  3104. static int early_data_skip_helper(int testtype, int idx)
  3105. {
  3106. SSL_CTX *cctx = NULL, *sctx = NULL;
  3107. SSL *clientssl = NULL, *serverssl = NULL;
  3108. int testresult = 0;
  3109. SSL_SESSION *sess = NULL;
  3110. unsigned char buf[20];
  3111. size_t readbytes, written;
  3112. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3113. &serverssl, &sess, idx)))
  3114. goto end;
  3115. if (testtype == 1 || testtype == 2) {
  3116. /* Force an HRR to occur */
  3117. #if defined(OPENSSL_NO_EC)
  3118. if (!TEST_true(SSL_set1_groups_list(serverssl, "ffdhe3072")))
  3119. goto end;
  3120. #else
  3121. if (!TEST_true(SSL_set1_groups_list(serverssl, "P-256")))
  3122. goto end;
  3123. #endif
  3124. } else if (idx == 2) {
  3125. /*
  3126. * We force early_data rejection by ensuring the PSK identity is
  3127. * unrecognised
  3128. */
  3129. srvid = "Dummy Identity";
  3130. } else {
  3131. /*
  3132. * Deliberately corrupt the creation time. We take 20 seconds off the
  3133. * time. It could be any value as long as it is not within tolerance.
  3134. * This should mean the ticket is rejected.
  3135. */
  3136. if (!TEST_true(SSL_SESSION_set_time(sess, (long)(time(NULL) - 20))))
  3137. goto end;
  3138. }
  3139. if (testtype == 3
  3140. && !TEST_true(SSL_set_recv_max_early_data(serverssl, 0)))
  3141. goto end;
  3142. /* Write some early data */
  3143. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3144. &written))
  3145. || !TEST_size_t_eq(written, strlen(MSG1)))
  3146. goto end;
  3147. /* Server should reject the early data */
  3148. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3149. &readbytes),
  3150. SSL_READ_EARLY_DATA_FINISH)
  3151. || !TEST_size_t_eq(readbytes, 0)
  3152. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3153. SSL_EARLY_DATA_REJECTED))
  3154. goto end;
  3155. switch (testtype) {
  3156. case 0:
  3157. /* Nothing to do */
  3158. break;
  3159. case 1:
  3160. /*
  3161. * Finish off the handshake. We perform the same writes and reads as
  3162. * further down but we expect them to fail due to the incomplete
  3163. * handshake.
  3164. */
  3165. if (!TEST_false(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
  3166. || !TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf),
  3167. &readbytes)))
  3168. goto end;
  3169. break;
  3170. case 2:
  3171. {
  3172. BIO *wbio = SSL_get_wbio(clientssl);
  3173. /* A record that will appear as bad early_data */
  3174. const unsigned char bad_early_data[] = {
  3175. 0x17, 0x03, 0x03, 0x00, 0x01, 0x00
  3176. };
  3177. /*
  3178. * We force the client to attempt a write. This will fail because
  3179. * we're still in the handshake. It will cause the second
  3180. * ClientHello to be sent.
  3181. */
  3182. if (!TEST_false(SSL_write_ex(clientssl, MSG2, strlen(MSG2),
  3183. &written)))
  3184. goto end;
  3185. /*
  3186. * Inject some early_data after the second ClientHello. This should
  3187. * cause the server to fail
  3188. */
  3189. if (!TEST_true(BIO_write_ex(wbio, bad_early_data,
  3190. sizeof(bad_early_data), &written)))
  3191. goto end;
  3192. }
  3193. /* fallthrough */
  3194. case 3:
  3195. /*
  3196. * This client has sent more early_data than we are willing to skip
  3197. * (case 3) or sent invalid early_data (case 2) so the connection should
  3198. * abort.
  3199. */
  3200. if (!TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3201. || !TEST_int_eq(SSL_get_error(serverssl, 0), SSL_ERROR_SSL))
  3202. goto end;
  3203. /* Connection has failed - nothing more to do */
  3204. testresult = 1;
  3205. goto end;
  3206. default:
  3207. TEST_error("Invalid test type");
  3208. goto end;
  3209. }
  3210. /*
  3211. * Should be able to send normal data despite rejection of early data. The
  3212. * early_data should be skipped.
  3213. */
  3214. if (!TEST_true(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
  3215. || !TEST_size_t_eq(written, strlen(MSG2))
  3216. || !TEST_int_eq(SSL_get_early_data_status(clientssl),
  3217. SSL_EARLY_DATA_REJECTED)
  3218. || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3219. || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
  3220. goto end;
  3221. testresult = 1;
  3222. end:
  3223. SSL_SESSION_free(clientpsk);
  3224. SSL_SESSION_free(serverpsk);
  3225. clientpsk = serverpsk = NULL;
  3226. SSL_SESSION_free(sess);
  3227. SSL_free(serverssl);
  3228. SSL_free(clientssl);
  3229. SSL_CTX_free(sctx);
  3230. SSL_CTX_free(cctx);
  3231. return testresult;
  3232. }
  3233. /*
  3234. * Test that a server attempting to read early data can handle a connection
  3235. * from a client where the early data is not acceptable.
  3236. */
  3237. static int test_early_data_skip(int idx)
  3238. {
  3239. return early_data_skip_helper(0, idx);
  3240. }
  3241. /*
  3242. * Test that a server attempting to read early data can handle a connection
  3243. * from a client where an HRR occurs.
  3244. */
  3245. static int test_early_data_skip_hrr(int idx)
  3246. {
  3247. return early_data_skip_helper(1, idx);
  3248. }
  3249. /*
  3250. * Test that a server attempting to read early data can handle a connection
  3251. * from a client where an HRR occurs and correctly fails if early_data is sent
  3252. * after the HRR
  3253. */
  3254. static int test_early_data_skip_hrr_fail(int idx)
  3255. {
  3256. return early_data_skip_helper(2, idx);
  3257. }
  3258. /*
  3259. * Test that a server attempting to read early data will abort if it tries to
  3260. * skip over too much.
  3261. */
  3262. static int test_early_data_skip_abort(int idx)
  3263. {
  3264. return early_data_skip_helper(3, idx);
  3265. }
  3266. /*
  3267. * Test that a server attempting to read early data can handle a connection
  3268. * from a client that doesn't send any.
  3269. */
  3270. static int test_early_data_not_sent(int idx)
  3271. {
  3272. SSL_CTX *cctx = NULL, *sctx = NULL;
  3273. SSL *clientssl = NULL, *serverssl = NULL;
  3274. int testresult = 0;
  3275. SSL_SESSION *sess = NULL;
  3276. unsigned char buf[20];
  3277. size_t readbytes, written;
  3278. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3279. &serverssl, &sess, idx)))
  3280. goto end;
  3281. /* Write some data - should block due to handshake with server */
  3282. SSL_set_connect_state(clientssl);
  3283. if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written)))
  3284. goto end;
  3285. /* Server should detect that early data has not been sent */
  3286. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3287. &readbytes),
  3288. SSL_READ_EARLY_DATA_FINISH)
  3289. || !TEST_size_t_eq(readbytes, 0)
  3290. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3291. SSL_EARLY_DATA_NOT_SENT)
  3292. || !TEST_int_eq(SSL_get_early_data_status(clientssl),
  3293. SSL_EARLY_DATA_NOT_SENT))
  3294. goto end;
  3295. /* Continue writing the message we started earlier */
  3296. if (!TEST_true(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
  3297. || !TEST_size_t_eq(written, strlen(MSG1))
  3298. || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3299. || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
  3300. || !SSL_write_ex(serverssl, MSG2, strlen(MSG2), &written)
  3301. || !TEST_size_t_eq(written, strlen(MSG2)))
  3302. goto end;
  3303. if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  3304. || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
  3305. goto end;
  3306. testresult = 1;
  3307. end:
  3308. SSL_SESSION_free(sess);
  3309. SSL_SESSION_free(clientpsk);
  3310. SSL_SESSION_free(serverpsk);
  3311. clientpsk = serverpsk = NULL;
  3312. SSL_free(serverssl);
  3313. SSL_free(clientssl);
  3314. SSL_CTX_free(sctx);
  3315. SSL_CTX_free(cctx);
  3316. return testresult;
  3317. }
  3318. static const char *servalpn;
  3319. static int alpn_select_cb(SSL *ssl, const unsigned char **out,
  3320. unsigned char *outlen, const unsigned char *in,
  3321. unsigned int inlen, void *arg)
  3322. {
  3323. unsigned int protlen = 0;
  3324. const unsigned char *prot;
  3325. for (prot = in; prot < in + inlen; prot += protlen) {
  3326. protlen = *prot++;
  3327. if (in + inlen < prot + protlen)
  3328. return SSL_TLSEXT_ERR_NOACK;
  3329. if (protlen == strlen(servalpn)
  3330. && memcmp(prot, servalpn, protlen) == 0) {
  3331. *out = prot;
  3332. *outlen = protlen;
  3333. return SSL_TLSEXT_ERR_OK;
  3334. }
  3335. }
  3336. return SSL_TLSEXT_ERR_NOACK;
  3337. }
  3338. /* Test that a PSK can be used to send early_data */
  3339. static int test_early_data_psk(int idx)
  3340. {
  3341. SSL_CTX *cctx = NULL, *sctx = NULL;
  3342. SSL *clientssl = NULL, *serverssl = NULL;
  3343. int testresult = 0;
  3344. SSL_SESSION *sess = NULL;
  3345. unsigned char alpnlist[] = {
  3346. 0x08, 'g', 'o', 'o', 'd', 'a', 'l', 'p', 'n', 0x07, 'b', 'a', 'd', 'a',
  3347. 'l', 'p', 'n'
  3348. };
  3349. #define GOODALPNLEN 9
  3350. #define BADALPNLEN 8
  3351. #define GOODALPN (alpnlist)
  3352. #define BADALPN (alpnlist + GOODALPNLEN)
  3353. int err = 0;
  3354. unsigned char buf[20];
  3355. size_t readbytes, written;
  3356. int readearlyres = SSL_READ_EARLY_DATA_SUCCESS, connectres = 1;
  3357. int edstatus = SSL_EARLY_DATA_ACCEPTED;
  3358. /* We always set this up with a final parameter of "2" for PSK */
  3359. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3360. &serverssl, &sess, 2)))
  3361. goto end;
  3362. servalpn = "goodalpn";
  3363. /*
  3364. * Note: There is no test for inconsistent SNI with late client detection.
  3365. * This is because servers do not acknowledge SNI even if they are using
  3366. * it in a resumption handshake - so it is not actually possible for a
  3367. * client to detect a problem.
  3368. */
  3369. switch (idx) {
  3370. case 0:
  3371. /* Set inconsistent SNI (early client detection) */
  3372. err = SSL_R_INCONSISTENT_EARLY_DATA_SNI;
  3373. if (!TEST_true(SSL_SESSION_set1_hostname(sess, "goodhost"))
  3374. || !TEST_true(SSL_set_tlsext_host_name(clientssl, "badhost")))
  3375. goto end;
  3376. break;
  3377. case 1:
  3378. /* Set inconsistent ALPN (early client detection) */
  3379. err = SSL_R_INCONSISTENT_EARLY_DATA_ALPN;
  3380. /* SSL_set_alpn_protos returns 0 for success and 1 for failure */
  3381. if (!TEST_true(SSL_SESSION_set1_alpn_selected(sess, GOODALPN,
  3382. GOODALPNLEN))
  3383. || !TEST_false(SSL_set_alpn_protos(clientssl, BADALPN,
  3384. BADALPNLEN)))
  3385. goto end;
  3386. break;
  3387. case 2:
  3388. /*
  3389. * Set invalid protocol version. Technically this affects PSKs without
  3390. * early_data too, but we test it here because it is similar to the
  3391. * SNI/ALPN consistency tests.
  3392. */
  3393. err = SSL_R_BAD_PSK;
  3394. if (!TEST_true(SSL_SESSION_set_protocol_version(sess, TLS1_2_VERSION)))
  3395. goto end;
  3396. break;
  3397. case 3:
  3398. /*
  3399. * Set inconsistent SNI (server side). In this case the connection
  3400. * will succeed and accept early_data. In TLSv1.3 on the server side SNI
  3401. * is associated with each handshake - not the session. Therefore it
  3402. * should not matter that we used a different server name last time.
  3403. */
  3404. SSL_SESSION_free(serverpsk);
  3405. serverpsk = SSL_SESSION_dup(clientpsk);
  3406. if (!TEST_ptr(serverpsk)
  3407. || !TEST_true(SSL_SESSION_set1_hostname(serverpsk, "badhost")))
  3408. goto end;
  3409. /* Fall through */
  3410. case 4:
  3411. /* Set consistent SNI */
  3412. if (!TEST_true(SSL_SESSION_set1_hostname(sess, "goodhost"))
  3413. || !TEST_true(SSL_set_tlsext_host_name(clientssl, "goodhost"))
  3414. || !TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx,
  3415. hostname_cb)))
  3416. goto end;
  3417. break;
  3418. case 5:
  3419. /*
  3420. * Set inconsistent ALPN (server detected). In this case the connection
  3421. * will succeed but reject early_data.
  3422. */
  3423. servalpn = "badalpn";
  3424. edstatus = SSL_EARLY_DATA_REJECTED;
  3425. readearlyres = SSL_READ_EARLY_DATA_FINISH;
  3426. /* Fall through */
  3427. case 6:
  3428. /*
  3429. * Set consistent ALPN.
  3430. * SSL_set_alpn_protos returns 0 for success and 1 for failure. It
  3431. * accepts a list of protos (each one length prefixed).
  3432. * SSL_set1_alpn_selected accepts a single protocol (not length
  3433. * prefixed)
  3434. */
  3435. if (!TEST_true(SSL_SESSION_set1_alpn_selected(sess, GOODALPN + 1,
  3436. GOODALPNLEN - 1))
  3437. || !TEST_false(SSL_set_alpn_protos(clientssl, GOODALPN,
  3438. GOODALPNLEN)))
  3439. goto end;
  3440. SSL_CTX_set_alpn_select_cb(sctx, alpn_select_cb, NULL);
  3441. break;
  3442. case 7:
  3443. /* Set inconsistent ALPN (late client detection) */
  3444. SSL_SESSION_free(serverpsk);
  3445. serverpsk = SSL_SESSION_dup(clientpsk);
  3446. if (!TEST_ptr(serverpsk)
  3447. || !TEST_true(SSL_SESSION_set1_alpn_selected(clientpsk,
  3448. BADALPN + 1,
  3449. BADALPNLEN - 1))
  3450. || !TEST_true(SSL_SESSION_set1_alpn_selected(serverpsk,
  3451. GOODALPN + 1,
  3452. GOODALPNLEN - 1))
  3453. || !TEST_false(SSL_set_alpn_protos(clientssl, alpnlist,
  3454. sizeof(alpnlist))))
  3455. goto end;
  3456. SSL_CTX_set_alpn_select_cb(sctx, alpn_select_cb, NULL);
  3457. edstatus = SSL_EARLY_DATA_ACCEPTED;
  3458. readearlyres = SSL_READ_EARLY_DATA_SUCCESS;
  3459. /* SSL_connect() call should fail */
  3460. connectres = -1;
  3461. break;
  3462. default:
  3463. TEST_error("Bad test index");
  3464. goto end;
  3465. }
  3466. SSL_set_connect_state(clientssl);
  3467. if (err != 0) {
  3468. if (!TEST_false(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3469. &written))
  3470. || !TEST_int_eq(SSL_get_error(clientssl, 0), SSL_ERROR_SSL)
  3471. || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), err))
  3472. goto end;
  3473. } else {
  3474. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3475. &written)))
  3476. goto end;
  3477. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3478. &readbytes), readearlyres)
  3479. || (readearlyres == SSL_READ_EARLY_DATA_SUCCESS
  3480. && !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1)))
  3481. || !TEST_int_eq(SSL_get_early_data_status(serverssl), edstatus)
  3482. || !TEST_int_eq(SSL_connect(clientssl), connectres))
  3483. goto end;
  3484. }
  3485. testresult = 1;
  3486. end:
  3487. SSL_SESSION_free(sess);
  3488. SSL_SESSION_free(clientpsk);
  3489. SSL_SESSION_free(serverpsk);
  3490. clientpsk = serverpsk = NULL;
  3491. SSL_free(serverssl);
  3492. SSL_free(clientssl);
  3493. SSL_CTX_free(sctx);
  3494. SSL_CTX_free(cctx);
  3495. return testresult;
  3496. }
  3497. /*
  3498. * Test TLSv1.3 PSK can be used to send early_data with all 5 ciphersuites
  3499. * idx == 0: Test with TLS1_3_RFC_AES_128_GCM_SHA256
  3500. * idx == 1: Test with TLS1_3_RFC_AES_256_GCM_SHA384
  3501. * idx == 2: Test with TLS1_3_RFC_CHACHA20_POLY1305_SHA256,
  3502. * idx == 3: Test with TLS1_3_RFC_AES_128_CCM_SHA256
  3503. * idx == 4: Test with TLS1_3_RFC_AES_128_CCM_8_SHA256
  3504. */
  3505. static int test_early_data_psk_with_all_ciphers(int idx)
  3506. {
  3507. SSL_CTX *cctx = NULL, *sctx = NULL;
  3508. SSL *clientssl = NULL, *serverssl = NULL;
  3509. int testresult = 0;
  3510. SSL_SESSION *sess = NULL;
  3511. unsigned char buf[20];
  3512. size_t readbytes, written;
  3513. const SSL_CIPHER *cipher;
  3514. const char *cipher_str[] = {
  3515. TLS1_3_RFC_AES_128_GCM_SHA256,
  3516. TLS1_3_RFC_AES_256_GCM_SHA384,
  3517. # if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
  3518. TLS1_3_RFC_CHACHA20_POLY1305_SHA256,
  3519. # else
  3520. NULL,
  3521. # endif
  3522. TLS1_3_RFC_AES_128_CCM_SHA256,
  3523. TLS1_3_RFC_AES_128_CCM_8_SHA256
  3524. };
  3525. const unsigned char *cipher_bytes[] = {
  3526. TLS13_AES_128_GCM_SHA256_BYTES,
  3527. TLS13_AES_256_GCM_SHA384_BYTES,
  3528. # if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
  3529. TLS13_CHACHA20_POLY1305_SHA256_BYTES,
  3530. # else
  3531. NULL,
  3532. # endif
  3533. TLS13_AES_128_CCM_SHA256_BYTES,
  3534. TLS13_AES_128_CCM_8_SHA256_BYTES
  3535. };
  3536. if (cipher_str[idx] == NULL)
  3537. return 1;
  3538. /* Skip ChaCha20Poly1305 as currently FIPS module does not support it */
  3539. if (idx == 2 && is_fips == 1)
  3540. return 1;
  3541. /* We always set this up with a final parameter of "2" for PSK */
  3542. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3543. &serverssl, &sess, 2)))
  3544. goto end;
  3545. if (!TEST_true(SSL_set_ciphersuites(clientssl, cipher_str[idx]))
  3546. || !TEST_true(SSL_set_ciphersuites(serverssl, cipher_str[idx])))
  3547. goto end;
  3548. /*
  3549. * 'setupearly_data_test' creates only one instance of SSL_SESSION
  3550. * and assigns to both client and server with incremented reference
  3551. * and the same instance is updated in 'sess'.
  3552. * So updating ciphersuite in 'sess' which will get reflected in
  3553. * PSK handshake using psk use sess and find sess cb.
  3554. */
  3555. cipher = SSL_CIPHER_find(clientssl, cipher_bytes[idx]);
  3556. if (!TEST_ptr(cipher) || !TEST_true(SSL_SESSION_set_cipher(sess, cipher)))
  3557. goto end;
  3558. SSL_set_connect_state(clientssl);
  3559. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3560. &written)))
  3561. goto end;
  3562. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3563. &readbytes),
  3564. SSL_READ_EARLY_DATA_SUCCESS)
  3565. || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
  3566. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3567. SSL_EARLY_DATA_ACCEPTED)
  3568. || !TEST_int_eq(SSL_connect(clientssl), 1)
  3569. || !TEST_int_eq(SSL_accept(serverssl), 1))
  3570. goto end;
  3571. /* Send some normal data from client to server */
  3572. if (!TEST_true(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
  3573. || !TEST_size_t_eq(written, strlen(MSG2)))
  3574. goto end;
  3575. if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3576. || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
  3577. goto end;
  3578. testresult = 1;
  3579. end:
  3580. SSL_SESSION_free(sess);
  3581. SSL_SESSION_free(clientpsk);
  3582. SSL_SESSION_free(serverpsk);
  3583. clientpsk = serverpsk = NULL;
  3584. if (clientssl != NULL)
  3585. SSL_shutdown(clientssl);
  3586. if (serverssl != NULL)
  3587. SSL_shutdown(serverssl);
  3588. SSL_free(serverssl);
  3589. SSL_free(clientssl);
  3590. SSL_CTX_free(sctx);
  3591. SSL_CTX_free(cctx);
  3592. return testresult;
  3593. }
  3594. /*
  3595. * Test that a server that doesn't try to read early data can handle a
  3596. * client sending some.
  3597. */
  3598. static int test_early_data_not_expected(int idx)
  3599. {
  3600. SSL_CTX *cctx = NULL, *sctx = NULL;
  3601. SSL *clientssl = NULL, *serverssl = NULL;
  3602. int testresult = 0;
  3603. SSL_SESSION *sess = NULL;
  3604. unsigned char buf[20];
  3605. size_t readbytes, written;
  3606. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3607. &serverssl, &sess, idx)))
  3608. goto end;
  3609. /* Write some early data */
  3610. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  3611. &written)))
  3612. goto end;
  3613. /*
  3614. * Server should skip over early data and then block waiting for client to
  3615. * continue handshake
  3616. */
  3617. if (!TEST_int_le(SSL_accept(serverssl), 0)
  3618. || !TEST_int_gt(SSL_connect(clientssl), 0)
  3619. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3620. SSL_EARLY_DATA_REJECTED)
  3621. || !TEST_int_gt(SSL_accept(serverssl), 0)
  3622. || !TEST_int_eq(SSL_get_early_data_status(clientssl),
  3623. SSL_EARLY_DATA_REJECTED))
  3624. goto end;
  3625. /* Send some normal data from client to server */
  3626. if (!TEST_true(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
  3627. || !TEST_size_t_eq(written, strlen(MSG2)))
  3628. goto end;
  3629. if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3630. || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
  3631. goto end;
  3632. testresult = 1;
  3633. end:
  3634. SSL_SESSION_free(sess);
  3635. SSL_SESSION_free(clientpsk);
  3636. SSL_SESSION_free(serverpsk);
  3637. clientpsk = serverpsk = NULL;
  3638. SSL_free(serverssl);
  3639. SSL_free(clientssl);
  3640. SSL_CTX_free(sctx);
  3641. SSL_CTX_free(cctx);
  3642. return testresult;
  3643. }
  3644. # ifndef OPENSSL_NO_TLS1_2
  3645. /*
  3646. * Test that a server attempting to read early data can handle a connection
  3647. * from a TLSv1.2 client.
  3648. */
  3649. static int test_early_data_tls1_2(int idx)
  3650. {
  3651. SSL_CTX *cctx = NULL, *sctx = NULL;
  3652. SSL *clientssl = NULL, *serverssl = NULL;
  3653. int testresult = 0;
  3654. unsigned char buf[20];
  3655. size_t readbytes, written;
  3656. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  3657. &serverssl, NULL, idx)))
  3658. goto end;
  3659. /* Write some data - should block due to handshake with server */
  3660. SSL_set_max_proto_version(clientssl, TLS1_2_VERSION);
  3661. SSL_set_connect_state(clientssl);
  3662. if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written)))
  3663. goto end;
  3664. /*
  3665. * Server should do TLSv1.2 handshake. First it will block waiting for more
  3666. * messages from client after ServerDone. Then SSL_read_early_data should
  3667. * finish and detect that early data has not been sent
  3668. */
  3669. if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3670. &readbytes),
  3671. SSL_READ_EARLY_DATA_ERROR))
  3672. goto end;
  3673. /*
  3674. * Continue writing the message we started earlier. Will still block waiting
  3675. * for the CCS/Finished from server
  3676. */
  3677. if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
  3678. || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  3679. &readbytes),
  3680. SSL_READ_EARLY_DATA_FINISH)
  3681. || !TEST_size_t_eq(readbytes, 0)
  3682. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  3683. SSL_EARLY_DATA_NOT_SENT))
  3684. goto end;
  3685. /* Continue writing the message we started earlier */
  3686. if (!TEST_true(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
  3687. || !TEST_size_t_eq(written, strlen(MSG1))
  3688. || !TEST_int_eq(SSL_get_early_data_status(clientssl),
  3689. SSL_EARLY_DATA_NOT_SENT)
  3690. || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  3691. || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
  3692. || !TEST_true(SSL_write_ex(serverssl, MSG2, strlen(MSG2), &written))
  3693. || !TEST_size_t_eq(written, strlen(MSG2))
  3694. || !SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes)
  3695. || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
  3696. goto end;
  3697. testresult = 1;
  3698. end:
  3699. SSL_SESSION_free(clientpsk);
  3700. SSL_SESSION_free(serverpsk);
  3701. clientpsk = serverpsk = NULL;
  3702. SSL_free(serverssl);
  3703. SSL_free(clientssl);
  3704. SSL_CTX_free(sctx);
  3705. SSL_CTX_free(cctx);
  3706. return testresult;
  3707. }
  3708. # endif /* OPENSSL_NO_TLS1_2 */
  3709. /*
  3710. * Test configuring the TLSv1.3 ciphersuites
  3711. *
  3712. * Test 0: Set a default ciphersuite in the SSL_CTX (no explicit cipher_list)
  3713. * Test 1: Set a non-default ciphersuite in the SSL_CTX (no explicit cipher_list)
  3714. * Test 2: Set a default ciphersuite in the SSL (no explicit cipher_list)
  3715. * Test 3: Set a non-default ciphersuite in the SSL (no explicit cipher_list)
  3716. * Test 4: Set a default ciphersuite in the SSL_CTX (SSL_CTX cipher_list)
  3717. * Test 5: Set a non-default ciphersuite in the SSL_CTX (SSL_CTX cipher_list)
  3718. * Test 6: Set a default ciphersuite in the SSL (SSL_CTX cipher_list)
  3719. * Test 7: Set a non-default ciphersuite in the SSL (SSL_CTX cipher_list)
  3720. * Test 8: Set a default ciphersuite in the SSL (SSL cipher_list)
  3721. * Test 9: Set a non-default ciphersuite in the SSL (SSL cipher_list)
  3722. */
  3723. static int test_set_ciphersuite(int idx)
  3724. {
  3725. SSL_CTX *cctx = NULL, *sctx = NULL;
  3726. SSL *clientssl = NULL, *serverssl = NULL;
  3727. int testresult = 0;
  3728. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  3729. TLS_client_method(), TLS1_VERSION, 0,
  3730. &sctx, &cctx, cert, privkey))
  3731. || !TEST_true(SSL_CTX_set_ciphersuites(sctx,
  3732. "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256")))
  3733. goto end;
  3734. if (idx >=4 && idx <= 7) {
  3735. /* SSL_CTX explicit cipher list */
  3736. if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "AES256-GCM-SHA384")))
  3737. goto end;
  3738. }
  3739. if (idx == 0 || idx == 4) {
  3740. /* Default ciphersuite */
  3741. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  3742. "TLS_AES_128_GCM_SHA256")))
  3743. goto end;
  3744. } else if (idx == 1 || idx == 5) {
  3745. /* Non default ciphersuite */
  3746. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  3747. "TLS_AES_128_CCM_SHA256")))
  3748. goto end;
  3749. }
  3750. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  3751. &clientssl, NULL, NULL)))
  3752. goto end;
  3753. if (idx == 8 || idx == 9) {
  3754. /* SSL explicit cipher list */
  3755. if (!TEST_true(SSL_set_cipher_list(clientssl, "AES256-GCM-SHA384")))
  3756. goto end;
  3757. }
  3758. if (idx == 2 || idx == 6 || idx == 8) {
  3759. /* Default ciphersuite */
  3760. if (!TEST_true(SSL_set_ciphersuites(clientssl,
  3761. "TLS_AES_128_GCM_SHA256")))
  3762. goto end;
  3763. } else if (idx == 3 || idx == 7 || idx == 9) {
  3764. /* Non default ciphersuite */
  3765. if (!TEST_true(SSL_set_ciphersuites(clientssl,
  3766. "TLS_AES_128_CCM_SHA256")))
  3767. goto end;
  3768. }
  3769. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  3770. goto end;
  3771. testresult = 1;
  3772. end:
  3773. SSL_free(serverssl);
  3774. SSL_free(clientssl);
  3775. SSL_CTX_free(sctx);
  3776. SSL_CTX_free(cctx);
  3777. return testresult;
  3778. }
  3779. static int test_ciphersuite_change(void)
  3780. {
  3781. SSL_CTX *cctx = NULL, *sctx = NULL;
  3782. SSL *clientssl = NULL, *serverssl = NULL;
  3783. SSL_SESSION *clntsess = NULL;
  3784. int testresult = 0;
  3785. const SSL_CIPHER *aes_128_gcm_sha256 = NULL;
  3786. /* Create a session based on SHA-256 */
  3787. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  3788. TLS_client_method(), TLS1_VERSION, 0,
  3789. &sctx, &cctx, cert, privkey))
  3790. || !TEST_true(SSL_CTX_set_ciphersuites(sctx,
  3791. "TLS_AES_128_GCM_SHA256:"
  3792. "TLS_AES_256_GCM_SHA384:"
  3793. "TLS_AES_128_CCM_SHA256"))
  3794. || !TEST_true(SSL_CTX_set_ciphersuites(cctx,
  3795. "TLS_AES_128_GCM_SHA256"))
  3796. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  3797. &clientssl, NULL, NULL))
  3798. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  3799. SSL_ERROR_NONE)))
  3800. goto end;
  3801. clntsess = SSL_get1_session(clientssl);
  3802. /* Save for later */
  3803. aes_128_gcm_sha256 = SSL_SESSION_get0_cipher(clntsess);
  3804. SSL_shutdown(clientssl);
  3805. SSL_shutdown(serverssl);
  3806. SSL_free(serverssl);
  3807. SSL_free(clientssl);
  3808. serverssl = clientssl = NULL;
  3809. /* Check we can resume a session with a different SHA-256 ciphersuite */
  3810. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  3811. "TLS_AES_128_CCM_SHA256"))
  3812. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  3813. &clientssl, NULL, NULL))
  3814. || !TEST_true(SSL_set_session(clientssl, clntsess))
  3815. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  3816. SSL_ERROR_NONE))
  3817. || !TEST_true(SSL_session_reused(clientssl)))
  3818. goto end;
  3819. SSL_SESSION_free(clntsess);
  3820. clntsess = SSL_get1_session(clientssl);
  3821. SSL_shutdown(clientssl);
  3822. SSL_shutdown(serverssl);
  3823. SSL_free(serverssl);
  3824. SSL_free(clientssl);
  3825. serverssl = clientssl = NULL;
  3826. /*
  3827. * Check attempting to resume a SHA-256 session with no SHA-256 ciphersuites
  3828. * succeeds but does not resume.
  3829. */
  3830. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, "TLS_AES_256_GCM_SHA384"))
  3831. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  3832. NULL, NULL))
  3833. || !TEST_true(SSL_set_session(clientssl, clntsess))
  3834. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  3835. SSL_ERROR_SSL))
  3836. || !TEST_false(SSL_session_reused(clientssl)))
  3837. goto end;
  3838. SSL_SESSION_free(clntsess);
  3839. clntsess = NULL;
  3840. SSL_shutdown(clientssl);
  3841. SSL_shutdown(serverssl);
  3842. SSL_free(serverssl);
  3843. SSL_free(clientssl);
  3844. serverssl = clientssl = NULL;
  3845. /* Create a session based on SHA384 */
  3846. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, "TLS_AES_256_GCM_SHA384"))
  3847. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  3848. &clientssl, NULL, NULL))
  3849. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  3850. SSL_ERROR_NONE)))
  3851. goto end;
  3852. clntsess = SSL_get1_session(clientssl);
  3853. SSL_shutdown(clientssl);
  3854. SSL_shutdown(serverssl);
  3855. SSL_free(serverssl);
  3856. SSL_free(clientssl);
  3857. serverssl = clientssl = NULL;
  3858. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  3859. "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384"))
  3860. || !TEST_true(SSL_CTX_set_ciphersuites(sctx,
  3861. "TLS_AES_256_GCM_SHA384"))
  3862. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  3863. NULL, NULL))
  3864. || !TEST_true(SSL_set_session(clientssl, clntsess))
  3865. /*
  3866. * We use SSL_ERROR_WANT_READ below so that we can pause the
  3867. * connection after the initial ClientHello has been sent to
  3868. * enable us to make some session changes.
  3869. */
  3870. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  3871. SSL_ERROR_WANT_READ)))
  3872. goto end;
  3873. /* Trick the client into thinking this session is for a different digest */
  3874. clntsess->cipher = aes_128_gcm_sha256;
  3875. clntsess->cipher_id = clntsess->cipher->id;
  3876. /*
  3877. * Continue the previously started connection. Server has selected a SHA-384
  3878. * ciphersuite, but client thinks the session is for SHA-256, so it should
  3879. * bail out.
  3880. */
  3881. if (!TEST_false(create_ssl_connection(serverssl, clientssl,
  3882. SSL_ERROR_SSL))
  3883. || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()),
  3884. SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED))
  3885. goto end;
  3886. testresult = 1;
  3887. end:
  3888. SSL_SESSION_free(clntsess);
  3889. SSL_free(serverssl);
  3890. SSL_free(clientssl);
  3891. SSL_CTX_free(sctx);
  3892. SSL_CTX_free(cctx);
  3893. return testresult;
  3894. }
  3895. /*
  3896. * Test TLSv1.3 Key exchange
  3897. * Test 0 = Test all ECDHE Key exchange with TLSv1.3 client and server
  3898. * Test 1 = Test NID_X9_62_prime256v1 with TLSv1.3 client and server
  3899. * Test 2 = Test NID_secp384r1 with TLSv1.3 client and server
  3900. * Test 3 = Test NID_secp521r1 with TLSv1.3 client and server
  3901. * Test 4 = Test NID_X25519 with TLSv1.3 client and server
  3902. * Test 5 = Test NID_X448 with TLSv1.3 client and server
  3903. * Test 6 = Test all FFDHE Key exchange with TLSv1.3 client and server
  3904. * Test 7 = Test NID_ffdhe2048 with TLSv1.3 client and server
  3905. * Test 8 = Test NID_ffdhe3072 with TLSv1.3 client and server
  3906. * Test 9 = Test NID_ffdhe4096 with TLSv1.3 client and server
  3907. * Test 10 = Test NID_ffdhe6144 with TLSv1.3 client and server
  3908. * Test 11 = Test NID_ffdhe8192 with TLSv1.3 client and server
  3909. * Test 12 = Test all ECDHE with TLSv1.2 client and server
  3910. * Test 13 = Test all FFDHE with TLSv1.2 client and server
  3911. */
  3912. # ifndef OPENSSL_NO_EC
  3913. static int ecdhe_kexch_groups[] = {NID_X9_62_prime256v1, NID_secp384r1,
  3914. NID_secp521r1, NID_X25519, NID_X448};
  3915. # endif
  3916. # ifndef OPENSSL_NO_DH
  3917. static int ffdhe_kexch_groups[] = {NID_ffdhe2048, NID_ffdhe3072, NID_ffdhe4096,
  3918. NID_ffdhe6144, NID_ffdhe8192};
  3919. # endif
  3920. static int test_key_exchange(int idx)
  3921. {
  3922. SSL_CTX *sctx = NULL, *cctx = NULL;
  3923. SSL *serverssl = NULL, *clientssl = NULL;
  3924. int testresult = 0;
  3925. int kexch_alg;
  3926. int *kexch_groups = &kexch_alg;
  3927. int kexch_groups_size = 1;
  3928. int max_version = TLS1_3_VERSION;
  3929. char *kexch_name0 = NULL;
  3930. switch (idx) {
  3931. # ifndef OPENSSL_NO_EC
  3932. # ifndef OPENSSL_NO_TLS1_2
  3933. case 12:
  3934. max_version = TLS1_2_VERSION;
  3935. # endif
  3936. /* Fall through */
  3937. case 0:
  3938. kexch_groups = ecdhe_kexch_groups;
  3939. kexch_groups_size = OSSL_NELEM(ecdhe_kexch_groups);
  3940. kexch_name0 = "secp256r1";
  3941. break;
  3942. case 1:
  3943. kexch_alg = NID_X9_62_prime256v1;
  3944. kexch_name0 = "secp256r1";
  3945. break;
  3946. case 2:
  3947. kexch_alg = NID_secp384r1;
  3948. kexch_name0 = "secp384r1";
  3949. break;
  3950. case 3:
  3951. kexch_alg = NID_secp521r1;
  3952. kexch_name0 = "secp521r1";
  3953. break;
  3954. case 4:
  3955. kexch_alg = NID_X25519;
  3956. kexch_name0 = "x25519";
  3957. break;
  3958. case 5:
  3959. kexch_alg = NID_X448;
  3960. kexch_name0 = "x448";
  3961. break;
  3962. # endif
  3963. # ifndef OPENSSL_NO_DH
  3964. # ifndef OPENSSL_NO_TLS1_2
  3965. case 13:
  3966. max_version = TLS1_2_VERSION;
  3967. kexch_name0 = "ffdhe2048";
  3968. # endif
  3969. /* Fall through */
  3970. case 6:
  3971. kexch_groups = ffdhe_kexch_groups;
  3972. kexch_groups_size = OSSL_NELEM(ffdhe_kexch_groups);
  3973. kexch_name0 = "ffdhe2048";
  3974. break;
  3975. case 7:
  3976. kexch_alg = NID_ffdhe2048;
  3977. kexch_name0 = "ffdhe2048";
  3978. break;
  3979. case 8:
  3980. kexch_alg = NID_ffdhe3072;
  3981. kexch_name0 = "ffdhe3072";
  3982. break;
  3983. case 9:
  3984. kexch_alg = NID_ffdhe4096;
  3985. kexch_name0 = "ffdhe4096";
  3986. break;
  3987. case 10:
  3988. kexch_alg = NID_ffdhe6144;
  3989. kexch_name0 = "ffdhe6144";
  3990. break;
  3991. case 11:
  3992. kexch_alg = NID_ffdhe8192;
  3993. kexch_name0 = "ffdhe8192";
  3994. break;
  3995. # endif
  3996. default:
  3997. /* We're skipping this test */
  3998. return 1;
  3999. }
  4000. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  4001. TLS_client_method(), TLS1_VERSION,
  4002. max_version, &sctx, &cctx, cert,
  4003. privkey)))
  4004. goto end;
  4005. if (!TEST_true(SSL_CTX_set_ciphersuites(sctx,
  4006. TLS1_3_RFC_AES_128_GCM_SHA256)))
  4007. goto end;
  4008. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  4009. TLS1_3_RFC_AES_128_GCM_SHA256)))
  4010. goto end;
  4011. if (!TEST_true(SSL_CTX_set_cipher_list(sctx,
  4012. TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ":"
  4013. TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256))
  4014. || !TEST_true(SSL_CTX_set_dh_auto(sctx, 1)))
  4015. goto end;
  4016. /*
  4017. * Must include an EC ciphersuite so that we send supported groups in
  4018. * TLSv1.2
  4019. */
  4020. # ifndef OPENSSL_NO_TLS1_2
  4021. if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
  4022. TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ":"
  4023. TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256)))
  4024. goto end;
  4025. # endif
  4026. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4027. NULL, NULL)))
  4028. goto end;
  4029. if (!TEST_true(SSL_set1_groups(serverssl, kexch_groups, kexch_groups_size))
  4030. || !TEST_true(SSL_set1_groups(clientssl, kexch_groups, kexch_groups_size)))
  4031. goto end;
  4032. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  4033. goto end;
  4034. /*
  4035. * If Handshake succeeds the negotiated kexch alg should be the first one in
  4036. * configured, except in the case of FFDHE groups (idx 13), which are
  4037. * TLSv1.3 only so we expect no shared group to exist.
  4038. */
  4039. if (!TEST_int_eq(SSL_get_shared_group(serverssl, 0),
  4040. idx == 13 ? 0 : kexch_groups[0]))
  4041. goto end;
  4042. if (!TEST_str_eq(SSL_group_to_name(serverssl, kexch_groups[0]),
  4043. kexch_name0))
  4044. goto end;
  4045. /* We don't implement RFC 7919 named groups for TLS 1.2. */
  4046. if (idx != 13) {
  4047. if (!TEST_int_eq(SSL_get_negotiated_group(serverssl), kexch_groups[0]))
  4048. goto end;
  4049. if (!TEST_int_eq(SSL_get_negotiated_group(clientssl), kexch_groups[0]))
  4050. goto end;
  4051. }
  4052. testresult = 1;
  4053. end:
  4054. SSL_free(serverssl);
  4055. SSL_free(clientssl);
  4056. SSL_CTX_free(sctx);
  4057. SSL_CTX_free(cctx);
  4058. return testresult;
  4059. }
  4060. # if !defined(OPENSSL_NO_TLS1_2) \
  4061. && !defined(OPENSSL_NO_EC) \
  4062. && !defined(OPENSSL_NO_DH)
  4063. static int set_ssl_groups(SSL *serverssl, SSL *clientssl, int clientmulti,
  4064. int isecdhe, int idx)
  4065. {
  4066. int kexch_alg;
  4067. int *kexch_groups = &kexch_alg;
  4068. int numec, numff;
  4069. numec = OSSL_NELEM(ecdhe_kexch_groups);
  4070. numff = OSSL_NELEM(ffdhe_kexch_groups);
  4071. if (isecdhe)
  4072. kexch_alg = ecdhe_kexch_groups[idx];
  4073. else
  4074. kexch_alg = ffdhe_kexch_groups[idx];
  4075. if (clientmulti) {
  4076. if (!TEST_true(SSL_set1_groups(serverssl, kexch_groups, 1)))
  4077. return 0;
  4078. if (isecdhe) {
  4079. if (!TEST_true(SSL_set1_groups(clientssl, ecdhe_kexch_groups,
  4080. numec)))
  4081. return 0;
  4082. } else {
  4083. if (!TEST_true(SSL_set1_groups(clientssl, ffdhe_kexch_groups,
  4084. numff)))
  4085. return 0;
  4086. }
  4087. } else {
  4088. if (!TEST_true(SSL_set1_groups(clientssl, kexch_groups, 1)))
  4089. return 0;
  4090. if (isecdhe) {
  4091. if (!TEST_true(SSL_set1_groups(serverssl, ecdhe_kexch_groups,
  4092. numec)))
  4093. return 0;
  4094. } else {
  4095. if (!TEST_true(SSL_set1_groups(serverssl, ffdhe_kexch_groups,
  4096. numff)))
  4097. return 0;
  4098. }
  4099. }
  4100. return 1;
  4101. }
  4102. /*-
  4103. * Test the SSL_get_negotiated_group() API across a battery of scenarios.
  4104. * Run through both the ECDHE and FFDHE group lists used in the previous
  4105. * test, for both TLS 1.2 and TLS 1.3, negotiating each group in turn,
  4106. * confirming the expected result; then perform a resumption handshake
  4107. * while offering the same group list, and another resumption handshake
  4108. * offering a different group list. The returned value should be the
  4109. * negotiated group for the initial handshake; for TLS 1.3 resumption
  4110. * handshakes the returned value will be negotiated on the resumption
  4111. * handshake itself, but for TLS 1.2 resumption handshakes the value will
  4112. * be cached in the session from the original handshake, regardless of what
  4113. * was offered in the resumption ClientHello.
  4114. *
  4115. * Using E for the number of EC groups and F for the number of FF groups:
  4116. * E tests of ECDHE with TLS 1.3, client sends only one group
  4117. * F tests of FFDHE with TLS 1.3, client sends only one group
  4118. * E tests of ECDHE with TLS 1.2, client sends only one group
  4119. * F tests of FFDHE with TLS 1.2, client sends only one group
  4120. * E tests of ECDHE with TLS 1.3, server only has one group
  4121. * F tests of FFDHE with TLS 1.3, server only has one group
  4122. * E tests of ECDHE with TLS 1.2, server only has one group
  4123. * F tests of FFDHE with TLS 1.2, server only has one group
  4124. */
  4125. static int test_negotiated_group(int idx)
  4126. {
  4127. int clientmulti, istls13, isecdhe, numec, numff, numgroups;
  4128. int expectednid;
  4129. SSL_CTX *sctx = NULL, *cctx = NULL;
  4130. SSL *serverssl = NULL, *clientssl = NULL;
  4131. SSL_SESSION *origsess = NULL;
  4132. int testresult = 0;
  4133. int kexch_alg;
  4134. int max_version = TLS1_3_VERSION;
  4135. numec = OSSL_NELEM(ecdhe_kexch_groups);
  4136. numff = OSSL_NELEM(ffdhe_kexch_groups);
  4137. numgroups = numec + numff;
  4138. clientmulti = (idx < 2 * numgroups);
  4139. idx = idx % (2 * numgroups);
  4140. istls13 = (idx < numgroups);
  4141. idx = idx % numgroups;
  4142. isecdhe = (idx < numec);
  4143. if (!isecdhe)
  4144. idx -= numec;
  4145. /* Now 'idx' is an index into ecdhe_kexch_groups or ffdhe_kexch_groups */
  4146. if (isecdhe)
  4147. kexch_alg = ecdhe_kexch_groups[idx];
  4148. else
  4149. kexch_alg = ffdhe_kexch_groups[idx];
  4150. /* We expect nothing for the unimplemented TLS 1.2 FFDHE named groups */
  4151. if (!istls13 && !isecdhe)
  4152. expectednid = NID_undef;
  4153. else
  4154. expectednid = kexch_alg;
  4155. if (!istls13)
  4156. max_version = TLS1_2_VERSION;
  4157. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  4158. TLS_client_method(), TLS1_VERSION,
  4159. max_version, &sctx, &cctx, cert,
  4160. privkey)))
  4161. goto end;
  4162. /*
  4163. * Force (EC)DHE ciphers for TLS 1.2.
  4164. * Be sure to enable auto tmp DH so that FFDHE can succeed.
  4165. */
  4166. if (!TEST_true(SSL_CTX_set_cipher_list(sctx,
  4167. TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ":"
  4168. TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256))
  4169. || !TEST_true(SSL_CTX_set_dh_auto(sctx, 1)))
  4170. goto end;
  4171. if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
  4172. TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ":"
  4173. TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256)))
  4174. goto end;
  4175. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4176. NULL, NULL)))
  4177. goto end;
  4178. if (!TEST_true(set_ssl_groups(serverssl, clientssl, clientmulti, isecdhe,
  4179. idx)))
  4180. goto end;
  4181. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  4182. goto end;
  4183. /* Initial handshake; always the configured one */
  4184. if (!TEST_uint_eq(SSL_get_negotiated_group(clientssl), expectednid)
  4185. || !TEST_uint_eq(SSL_get_negotiated_group(serverssl), expectednid))
  4186. goto end;
  4187. if (!TEST_ptr((origsess = SSL_get1_session(clientssl))))
  4188. goto end;
  4189. SSL_shutdown(clientssl);
  4190. SSL_shutdown(serverssl);
  4191. SSL_free(serverssl);
  4192. SSL_free(clientssl);
  4193. serverssl = clientssl = NULL;
  4194. /* First resumption attempt; use the same config as initial handshake */
  4195. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4196. NULL, NULL))
  4197. || !TEST_true(SSL_set_session(clientssl, origsess))
  4198. || !TEST_true(set_ssl_groups(serverssl, clientssl, clientmulti,
  4199. isecdhe, idx)))
  4200. goto end;
  4201. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
  4202. || !TEST_true(SSL_session_reused(clientssl)))
  4203. goto end;
  4204. /* Still had better agree, since nothing changed... */
  4205. if (!TEST_uint_eq(SSL_get_negotiated_group(clientssl), expectednid)
  4206. || !TEST_uint_eq(SSL_get_negotiated_group(serverssl), expectednid))
  4207. goto end;
  4208. SSL_shutdown(clientssl);
  4209. SSL_shutdown(serverssl);
  4210. SSL_free(serverssl);
  4211. SSL_free(clientssl);
  4212. serverssl = clientssl = NULL;
  4213. /*-
  4214. * Second resumption attempt
  4215. * The party that picks one group changes it, which we effectuate by
  4216. * changing 'idx' and updating what we expect.
  4217. */
  4218. if (idx == 0)
  4219. idx = 1;
  4220. else
  4221. idx--;
  4222. if (istls13) {
  4223. if (isecdhe)
  4224. expectednid = ecdhe_kexch_groups[idx];
  4225. else
  4226. expectednid = ffdhe_kexch_groups[idx];
  4227. /* Verify that we are changing what we expect. */
  4228. if (!TEST_int_ne(expectednid, kexch_alg))
  4229. goto end;
  4230. } else {
  4231. /* TLS 1.2 only supports named groups for ECDHE. */
  4232. if (isecdhe)
  4233. expectednid = kexch_alg;
  4234. else
  4235. expectednid = 0;
  4236. }
  4237. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4238. NULL, NULL))
  4239. || !TEST_true(SSL_set_session(clientssl, origsess))
  4240. || !TEST_true(set_ssl_groups(serverssl, clientssl, clientmulti,
  4241. isecdhe, idx)))
  4242. goto end;
  4243. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
  4244. || !TEST_true(SSL_session_reused(clientssl)))
  4245. goto end;
  4246. /* Check that we get what we expected */
  4247. if (!TEST_uint_eq(SSL_get_negotiated_group(clientssl), expectednid)
  4248. || !TEST_uint_eq(SSL_get_negotiated_group(serverssl), expectednid))
  4249. goto end;
  4250. testresult = 1;
  4251. end:
  4252. SSL_free(serverssl);
  4253. SSL_free(clientssl);
  4254. SSL_CTX_free(sctx);
  4255. SSL_CTX_free(cctx);
  4256. SSL_SESSION_free(origsess);
  4257. return testresult;
  4258. }
  4259. # endif /* !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_DH) */
  4260. /*
  4261. * Test TLSv1.3 Cipher Suite
  4262. * Test 0 = Set TLS1.3 cipher on context
  4263. * Test 1 = Set TLS1.3 cipher on SSL
  4264. * Test 2 = Set TLS1.3 and TLS1.2 cipher on context
  4265. * Test 3 = Set TLS1.3 and TLS1.2 cipher on SSL
  4266. */
  4267. static int test_tls13_ciphersuite(int idx)
  4268. {
  4269. SSL_CTX *sctx = NULL, *cctx = NULL;
  4270. SSL *serverssl = NULL, *clientssl = NULL;
  4271. static const struct {
  4272. const char *ciphername;
  4273. int fipscapable;
  4274. } t13_ciphers[] = {
  4275. { TLS1_3_RFC_AES_128_GCM_SHA256, 1 },
  4276. { TLS1_3_RFC_AES_256_GCM_SHA384, 1 },
  4277. { TLS1_3_RFC_AES_128_CCM_SHA256, 1 },
  4278. # if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
  4279. { TLS1_3_RFC_CHACHA20_POLY1305_SHA256, 0 },
  4280. { TLS1_3_RFC_AES_256_GCM_SHA384
  4281. ":" TLS1_3_RFC_CHACHA20_POLY1305_SHA256, 0 },
  4282. # endif
  4283. { TLS1_3_RFC_AES_128_CCM_8_SHA256 ":" TLS1_3_RFC_AES_128_CCM_SHA256, 1 }
  4284. };
  4285. const char *t13_cipher = NULL;
  4286. const char *t12_cipher = NULL;
  4287. const char *negotiated_scipher;
  4288. const char *negotiated_ccipher;
  4289. int set_at_ctx = 0;
  4290. int set_at_ssl = 0;
  4291. int testresult = 0;
  4292. int max_ver;
  4293. size_t i;
  4294. switch (idx) {
  4295. case 0:
  4296. set_at_ctx = 1;
  4297. break;
  4298. case 1:
  4299. set_at_ssl = 1;
  4300. break;
  4301. case 2:
  4302. set_at_ctx = 1;
  4303. t12_cipher = TLS1_TXT_RSA_WITH_AES_128_SHA256;
  4304. break;
  4305. case 3:
  4306. set_at_ssl = 1;
  4307. t12_cipher = TLS1_TXT_RSA_WITH_AES_128_SHA256;
  4308. break;
  4309. }
  4310. for (max_ver = TLS1_2_VERSION; max_ver <= TLS1_3_VERSION; max_ver++) {
  4311. # ifdef OPENSSL_NO_TLS1_2
  4312. if (max_ver == TLS1_2_VERSION)
  4313. continue;
  4314. # endif
  4315. for (i = 0; i < OSSL_NELEM(t13_ciphers); i++) {
  4316. if (is_fips && !t13_ciphers[i].fipscapable)
  4317. continue;
  4318. t13_cipher = t13_ciphers[i].ciphername;
  4319. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  4320. TLS_client_method(),
  4321. TLS1_VERSION, max_ver,
  4322. &sctx, &cctx, cert, privkey)))
  4323. goto end;
  4324. if (set_at_ctx) {
  4325. if (!TEST_true(SSL_CTX_set_ciphersuites(sctx, t13_cipher))
  4326. || !TEST_true(SSL_CTX_set_ciphersuites(cctx, t13_cipher)))
  4327. goto end;
  4328. if (t12_cipher != NULL) {
  4329. if (!TEST_true(SSL_CTX_set_cipher_list(sctx, t12_cipher))
  4330. || !TEST_true(SSL_CTX_set_cipher_list(cctx,
  4331. t12_cipher)))
  4332. goto end;
  4333. }
  4334. }
  4335. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  4336. &clientssl, NULL, NULL)))
  4337. goto end;
  4338. if (set_at_ssl) {
  4339. if (!TEST_true(SSL_set_ciphersuites(serverssl, t13_cipher))
  4340. || !TEST_true(SSL_set_ciphersuites(clientssl, t13_cipher)))
  4341. goto end;
  4342. if (t12_cipher != NULL) {
  4343. if (!TEST_true(SSL_set_cipher_list(serverssl, t12_cipher))
  4344. || !TEST_true(SSL_set_cipher_list(clientssl,
  4345. t12_cipher)))
  4346. goto end;
  4347. }
  4348. }
  4349. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  4350. SSL_ERROR_NONE)))
  4351. goto end;
  4352. negotiated_scipher = SSL_CIPHER_get_name(SSL_get_current_cipher(
  4353. serverssl));
  4354. negotiated_ccipher = SSL_CIPHER_get_name(SSL_get_current_cipher(
  4355. clientssl));
  4356. if (!TEST_str_eq(negotiated_scipher, negotiated_ccipher))
  4357. goto end;
  4358. /*
  4359. * TEST_strn_eq is used below because t13_cipher can contain
  4360. * multiple ciphersuites
  4361. */
  4362. if (max_ver == TLS1_3_VERSION
  4363. && !TEST_strn_eq(t13_cipher, negotiated_scipher,
  4364. strlen(negotiated_scipher)))
  4365. goto end;
  4366. # ifndef OPENSSL_NO_TLS1_2
  4367. /* Below validation is not done when t12_cipher is NULL */
  4368. if (max_ver == TLS1_2_VERSION && t12_cipher != NULL
  4369. && !TEST_str_eq(t12_cipher, negotiated_scipher))
  4370. goto end;
  4371. # endif
  4372. SSL_free(serverssl);
  4373. serverssl = NULL;
  4374. SSL_free(clientssl);
  4375. clientssl = NULL;
  4376. SSL_CTX_free(sctx);
  4377. sctx = NULL;
  4378. SSL_CTX_free(cctx);
  4379. cctx = NULL;
  4380. }
  4381. }
  4382. testresult = 1;
  4383. end:
  4384. SSL_free(serverssl);
  4385. SSL_free(clientssl);
  4386. SSL_CTX_free(sctx);
  4387. SSL_CTX_free(cctx);
  4388. return testresult;
  4389. }
  4390. /*
  4391. * Test TLSv1.3 PSKs
  4392. * Test 0 = Test new style callbacks
  4393. * Test 1 = Test both new and old style callbacks
  4394. * Test 2 = Test old style callbacks
  4395. * Test 3 = Test old style callbacks with no certificate
  4396. */
  4397. static int test_tls13_psk(int idx)
  4398. {
  4399. SSL_CTX *sctx = NULL, *cctx = NULL;
  4400. SSL *serverssl = NULL, *clientssl = NULL;
  4401. const SSL_CIPHER *cipher = NULL;
  4402. const unsigned char key[] = {
  4403. 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
  4404. 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
  4405. 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
  4406. 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f
  4407. };
  4408. int testresult = 0;
  4409. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  4410. TLS_client_method(), TLS1_VERSION, 0,
  4411. &sctx, &cctx, idx == 3 ? NULL : cert,
  4412. idx == 3 ? NULL : privkey)))
  4413. goto end;
  4414. if (idx != 3) {
  4415. /*
  4416. * We use a ciphersuite with SHA256 to ease testing old style PSK
  4417. * callbacks which will always default to SHA256. This should not be
  4418. * necessary if we have no cert/priv key. In that case the server should
  4419. * prefer SHA256 automatically.
  4420. */
  4421. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  4422. "TLS_AES_128_GCM_SHA256")))
  4423. goto end;
  4424. } else {
  4425. /*
  4426. * As noted above the server should prefer SHA256 automatically. However
  4427. * we are careful not to offer TLS_CHACHA20_POLY1305_SHA256 so this same
  4428. * code works even if we are testing with only the FIPS provider loaded.
  4429. */
  4430. if (!TEST_true(SSL_CTX_set_ciphersuites(cctx,
  4431. "TLS_AES_256_GCM_SHA384:"
  4432. "TLS_AES_128_GCM_SHA256")))
  4433. goto end;
  4434. }
  4435. /*
  4436. * Test 0: New style callbacks only
  4437. * Test 1: New and old style callbacks (only the new ones should be used)
  4438. * Test 2: Old style callbacks only
  4439. */
  4440. if (idx == 0 || idx == 1) {
  4441. SSL_CTX_set_psk_use_session_callback(cctx, use_session_cb);
  4442. SSL_CTX_set_psk_find_session_callback(sctx, find_session_cb);
  4443. }
  4444. #ifndef OPENSSL_NO_PSK
  4445. if (idx >= 1) {
  4446. SSL_CTX_set_psk_client_callback(cctx, psk_client_cb);
  4447. SSL_CTX_set_psk_server_callback(sctx, psk_server_cb);
  4448. }
  4449. #endif
  4450. srvid = pskid;
  4451. use_session_cb_cnt = 0;
  4452. find_session_cb_cnt = 0;
  4453. psk_client_cb_cnt = 0;
  4454. psk_server_cb_cnt = 0;
  4455. if (idx != 3) {
  4456. /*
  4457. * Check we can create a connection if callback decides not to send a
  4458. * PSK
  4459. */
  4460. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4461. NULL, NULL))
  4462. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  4463. SSL_ERROR_NONE))
  4464. || !TEST_false(SSL_session_reused(clientssl))
  4465. || !TEST_false(SSL_session_reused(serverssl)))
  4466. goto end;
  4467. if (idx == 0 || idx == 1) {
  4468. if (!TEST_true(use_session_cb_cnt == 1)
  4469. || !TEST_true(find_session_cb_cnt == 0)
  4470. /*
  4471. * If no old style callback then below should be 0
  4472. * otherwise 1
  4473. */
  4474. || !TEST_true(psk_client_cb_cnt == idx)
  4475. || !TEST_true(psk_server_cb_cnt == 0))
  4476. goto end;
  4477. } else {
  4478. if (!TEST_true(use_session_cb_cnt == 0)
  4479. || !TEST_true(find_session_cb_cnt == 0)
  4480. || !TEST_true(psk_client_cb_cnt == 1)
  4481. || !TEST_true(psk_server_cb_cnt == 0))
  4482. goto end;
  4483. }
  4484. shutdown_ssl_connection(serverssl, clientssl);
  4485. serverssl = clientssl = NULL;
  4486. use_session_cb_cnt = psk_client_cb_cnt = 0;
  4487. }
  4488. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4489. NULL, NULL)))
  4490. goto end;
  4491. /* Create the PSK */
  4492. cipher = SSL_CIPHER_find(clientssl, TLS13_AES_128_GCM_SHA256_BYTES);
  4493. clientpsk = SSL_SESSION_new();
  4494. if (!TEST_ptr(clientpsk)
  4495. || !TEST_ptr(cipher)
  4496. || !TEST_true(SSL_SESSION_set1_master_key(clientpsk, key,
  4497. sizeof(key)))
  4498. || !TEST_true(SSL_SESSION_set_cipher(clientpsk, cipher))
  4499. || !TEST_true(SSL_SESSION_set_protocol_version(clientpsk,
  4500. TLS1_3_VERSION))
  4501. || !TEST_true(SSL_SESSION_up_ref(clientpsk)))
  4502. goto end;
  4503. serverpsk = clientpsk;
  4504. /* Check we can create a connection and the PSK is used */
  4505. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
  4506. || !TEST_true(SSL_session_reused(clientssl))
  4507. || !TEST_true(SSL_session_reused(serverssl)))
  4508. goto end;
  4509. if (idx == 0 || idx == 1) {
  4510. if (!TEST_true(use_session_cb_cnt == 1)
  4511. || !TEST_true(find_session_cb_cnt == 1)
  4512. || !TEST_true(psk_client_cb_cnt == 0)
  4513. || !TEST_true(psk_server_cb_cnt == 0))
  4514. goto end;
  4515. } else {
  4516. if (!TEST_true(use_session_cb_cnt == 0)
  4517. || !TEST_true(find_session_cb_cnt == 0)
  4518. || !TEST_true(psk_client_cb_cnt == 1)
  4519. || !TEST_true(psk_server_cb_cnt == 1))
  4520. goto end;
  4521. }
  4522. shutdown_ssl_connection(serverssl, clientssl);
  4523. serverssl = clientssl = NULL;
  4524. use_session_cb_cnt = find_session_cb_cnt = 0;
  4525. psk_client_cb_cnt = psk_server_cb_cnt = 0;
  4526. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4527. NULL, NULL)))
  4528. goto end;
  4529. /* Force an HRR */
  4530. #if defined(OPENSSL_NO_EC)
  4531. if (!TEST_true(SSL_set1_groups_list(serverssl, "ffdhe3072")))
  4532. goto end;
  4533. #else
  4534. if (!TEST_true(SSL_set1_groups_list(serverssl, "P-256")))
  4535. goto end;
  4536. #endif
  4537. /*
  4538. * Check we can create a connection, the PSK is used and the callbacks are
  4539. * called twice.
  4540. */
  4541. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
  4542. || !TEST_true(SSL_session_reused(clientssl))
  4543. || !TEST_true(SSL_session_reused(serverssl)))
  4544. goto end;
  4545. if (idx == 0 || idx == 1) {
  4546. if (!TEST_true(use_session_cb_cnt == 2)
  4547. || !TEST_true(find_session_cb_cnt == 2)
  4548. || !TEST_true(psk_client_cb_cnt == 0)
  4549. || !TEST_true(psk_server_cb_cnt == 0))
  4550. goto end;
  4551. } else {
  4552. if (!TEST_true(use_session_cb_cnt == 0)
  4553. || !TEST_true(find_session_cb_cnt == 0)
  4554. || !TEST_true(psk_client_cb_cnt == 2)
  4555. || !TEST_true(psk_server_cb_cnt == 2))
  4556. goto end;
  4557. }
  4558. shutdown_ssl_connection(serverssl, clientssl);
  4559. serverssl = clientssl = NULL;
  4560. use_session_cb_cnt = find_session_cb_cnt = 0;
  4561. psk_client_cb_cnt = psk_server_cb_cnt = 0;
  4562. if (idx != 3) {
  4563. /*
  4564. * Check that if the server rejects the PSK we can still connect, but with
  4565. * a full handshake
  4566. */
  4567. srvid = "Dummy Identity";
  4568. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4569. NULL, NULL))
  4570. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  4571. SSL_ERROR_NONE))
  4572. || !TEST_false(SSL_session_reused(clientssl))
  4573. || !TEST_false(SSL_session_reused(serverssl)))
  4574. goto end;
  4575. if (idx == 0 || idx == 1) {
  4576. if (!TEST_true(use_session_cb_cnt == 1)
  4577. || !TEST_true(find_session_cb_cnt == 1)
  4578. || !TEST_true(psk_client_cb_cnt == 0)
  4579. /*
  4580. * If no old style callback then below should be 0
  4581. * otherwise 1
  4582. */
  4583. || !TEST_true(psk_server_cb_cnt == idx))
  4584. goto end;
  4585. } else {
  4586. if (!TEST_true(use_session_cb_cnt == 0)
  4587. || !TEST_true(find_session_cb_cnt == 0)
  4588. || !TEST_true(psk_client_cb_cnt == 1)
  4589. || !TEST_true(psk_server_cb_cnt == 1))
  4590. goto end;
  4591. }
  4592. shutdown_ssl_connection(serverssl, clientssl);
  4593. serverssl = clientssl = NULL;
  4594. }
  4595. testresult = 1;
  4596. end:
  4597. SSL_SESSION_free(clientpsk);
  4598. SSL_SESSION_free(serverpsk);
  4599. clientpsk = serverpsk = NULL;
  4600. SSL_free(serverssl);
  4601. SSL_free(clientssl);
  4602. SSL_CTX_free(sctx);
  4603. SSL_CTX_free(cctx);
  4604. return testresult;
  4605. }
  4606. static unsigned char cookie_magic_value[] = "cookie magic";
  4607. static int generate_cookie_callback(SSL *ssl, unsigned char *cookie,
  4608. unsigned int *cookie_len)
  4609. {
  4610. /*
  4611. * Not suitable as a real cookie generation function but good enough for
  4612. * testing!
  4613. */
  4614. memcpy(cookie, cookie_magic_value, sizeof(cookie_magic_value) - 1);
  4615. *cookie_len = sizeof(cookie_magic_value) - 1;
  4616. return 1;
  4617. }
  4618. static int verify_cookie_callback(SSL *ssl, const unsigned char *cookie,
  4619. unsigned int cookie_len)
  4620. {
  4621. if (cookie_len == sizeof(cookie_magic_value) - 1
  4622. && memcmp(cookie, cookie_magic_value, cookie_len) == 0)
  4623. return 1;
  4624. return 0;
  4625. }
  4626. static int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie,
  4627. size_t *cookie_len)
  4628. {
  4629. unsigned int temp;
  4630. int res = generate_cookie_callback(ssl, cookie, &temp);
  4631. *cookie_len = temp;
  4632. return res;
  4633. }
  4634. static int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie,
  4635. size_t cookie_len)
  4636. {
  4637. return verify_cookie_callback(ssl, cookie, cookie_len);
  4638. }
  4639. static int test_stateless(void)
  4640. {
  4641. SSL_CTX *sctx = NULL, *cctx = NULL;
  4642. SSL *serverssl = NULL, *clientssl = NULL;
  4643. int testresult = 0;
  4644. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  4645. TLS_client_method(), TLS1_VERSION, 0,
  4646. &sctx, &cctx, cert, privkey)))
  4647. goto end;
  4648. /* The arrival of CCS messages can confuse the test */
  4649. SSL_CTX_clear_options(cctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
  4650. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4651. NULL, NULL))
  4652. /* Send the first ClientHello */
  4653. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  4654. SSL_ERROR_WANT_READ))
  4655. /*
  4656. * This should fail with a -1 return because we have no callbacks
  4657. * set up
  4658. */
  4659. || !TEST_int_eq(SSL_stateless(serverssl), -1))
  4660. goto end;
  4661. /* Fatal error so abandon the connection from this client */
  4662. SSL_free(clientssl);
  4663. clientssl = NULL;
  4664. /* Set up the cookie generation and verification callbacks */
  4665. SSL_CTX_set_stateless_cookie_generate_cb(sctx, generate_stateless_cookie_callback);
  4666. SSL_CTX_set_stateless_cookie_verify_cb(sctx, verify_stateless_cookie_callback);
  4667. /*
  4668. * Create a new connection from the client (we can reuse the server SSL
  4669. * object).
  4670. */
  4671. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4672. NULL, NULL))
  4673. /* Send the first ClientHello */
  4674. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  4675. SSL_ERROR_WANT_READ))
  4676. /* This should fail because there is no cookie */
  4677. || !TEST_int_eq(SSL_stateless(serverssl), 0))
  4678. goto end;
  4679. /* Abandon the connection from this client */
  4680. SSL_free(clientssl);
  4681. clientssl = NULL;
  4682. /*
  4683. * Now create a connection from a new client but with the same server SSL
  4684. * object
  4685. */
  4686. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4687. NULL, NULL))
  4688. /* Send the first ClientHello */
  4689. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  4690. SSL_ERROR_WANT_READ))
  4691. /* This should fail because there is no cookie */
  4692. || !TEST_int_eq(SSL_stateless(serverssl), 0)
  4693. /* Send the second ClientHello */
  4694. || !TEST_false(create_ssl_connection(serverssl, clientssl,
  4695. SSL_ERROR_WANT_READ))
  4696. /* This should succeed because a cookie is now present */
  4697. || !TEST_int_eq(SSL_stateless(serverssl), 1)
  4698. /* Complete the connection */
  4699. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  4700. SSL_ERROR_NONE)))
  4701. goto end;
  4702. shutdown_ssl_connection(serverssl, clientssl);
  4703. serverssl = clientssl = NULL;
  4704. testresult = 1;
  4705. end:
  4706. SSL_free(serverssl);
  4707. SSL_free(clientssl);
  4708. SSL_CTX_free(sctx);
  4709. SSL_CTX_free(cctx);
  4710. return testresult;
  4711. }
  4712. #endif /* OSSL_NO_USABLE_TLS1_3 */
  4713. static int clntaddoldcb = 0;
  4714. static int clntparseoldcb = 0;
  4715. static int srvaddoldcb = 0;
  4716. static int srvparseoldcb = 0;
  4717. static int clntaddnewcb = 0;
  4718. static int clntparsenewcb = 0;
  4719. static int srvaddnewcb = 0;
  4720. static int srvparsenewcb = 0;
  4721. static int snicb = 0;
  4722. #define TEST_EXT_TYPE1 0xff00
  4723. static int old_add_cb(SSL *s, unsigned int ext_type, const unsigned char **out,
  4724. size_t *outlen, int *al, void *add_arg)
  4725. {
  4726. int *server = (int *)add_arg;
  4727. unsigned char *data;
  4728. if (SSL_is_server(s))
  4729. srvaddoldcb++;
  4730. else
  4731. clntaddoldcb++;
  4732. if (*server != SSL_is_server(s)
  4733. || (data = OPENSSL_malloc(sizeof(*data))) == NULL)
  4734. return -1;
  4735. *data = 1;
  4736. *out = data;
  4737. *outlen = sizeof(char);
  4738. return 1;
  4739. }
  4740. static void old_free_cb(SSL *s, unsigned int ext_type, const unsigned char *out,
  4741. void *add_arg)
  4742. {
  4743. OPENSSL_free((unsigned char *)out);
  4744. }
  4745. static int old_parse_cb(SSL *s, unsigned int ext_type, const unsigned char *in,
  4746. size_t inlen, int *al, void *parse_arg)
  4747. {
  4748. int *server = (int *)parse_arg;
  4749. if (SSL_is_server(s))
  4750. srvparseoldcb++;
  4751. else
  4752. clntparseoldcb++;
  4753. if (*server != SSL_is_server(s)
  4754. || inlen != sizeof(char)
  4755. || *in != 1)
  4756. return -1;
  4757. return 1;
  4758. }
  4759. static int new_add_cb(SSL *s, unsigned int ext_type, unsigned int context,
  4760. const unsigned char **out, size_t *outlen, X509 *x,
  4761. size_t chainidx, int *al, void *add_arg)
  4762. {
  4763. int *server = (int *)add_arg;
  4764. unsigned char *data;
  4765. if (SSL_is_server(s))
  4766. srvaddnewcb++;
  4767. else
  4768. clntaddnewcb++;
  4769. if (*server != SSL_is_server(s)
  4770. || (data = OPENSSL_malloc(sizeof(*data))) == NULL)
  4771. return -1;
  4772. *data = 1;
  4773. *out = data;
  4774. *outlen = sizeof(*data);
  4775. return 1;
  4776. }
  4777. static void new_free_cb(SSL *s, unsigned int ext_type, unsigned int context,
  4778. const unsigned char *out, void *add_arg)
  4779. {
  4780. OPENSSL_free((unsigned char *)out);
  4781. }
  4782. static int new_parse_cb(SSL *s, unsigned int ext_type, unsigned int context,
  4783. const unsigned char *in, size_t inlen, X509 *x,
  4784. size_t chainidx, int *al, void *parse_arg)
  4785. {
  4786. int *server = (int *)parse_arg;
  4787. if (SSL_is_server(s))
  4788. srvparsenewcb++;
  4789. else
  4790. clntparsenewcb++;
  4791. if (*server != SSL_is_server(s)
  4792. || inlen != sizeof(char) || *in != 1)
  4793. return -1;
  4794. return 1;
  4795. }
  4796. static int sni_cb(SSL *s, int *al, void *arg)
  4797. {
  4798. SSL_CTX *ctx = (SSL_CTX *)arg;
  4799. if (SSL_set_SSL_CTX(s, ctx) == NULL) {
  4800. *al = SSL_AD_INTERNAL_ERROR;
  4801. return SSL_TLSEXT_ERR_ALERT_FATAL;
  4802. }
  4803. snicb++;
  4804. return SSL_TLSEXT_ERR_OK;
  4805. }
  4806. /*
  4807. * Custom call back tests.
  4808. * Test 0: Old style callbacks in TLSv1.2
  4809. * Test 1: New style callbacks in TLSv1.2
  4810. * Test 2: New style callbacks in TLSv1.2 with SNI
  4811. * Test 3: New style callbacks in TLSv1.3. Extensions in CH and EE
  4812. * Test 4: New style callbacks in TLSv1.3. Extensions in CH, SH, EE, Cert + NST
  4813. */
  4814. static int test_custom_exts(int tst)
  4815. {
  4816. SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
  4817. SSL *clientssl = NULL, *serverssl = NULL;
  4818. int testresult = 0;
  4819. static int server = 1;
  4820. static int client = 0;
  4821. SSL_SESSION *sess = NULL;
  4822. unsigned int context;
  4823. #if defined(OPENSSL_NO_TLS1_2) && !defined(OSSL_NO_USABLE_TLS1_3)
  4824. /* Skip tests for TLSv1.2 and below in this case */
  4825. if (tst < 3)
  4826. return 1;
  4827. #endif
  4828. /* Reset callback counters */
  4829. clntaddoldcb = clntparseoldcb = srvaddoldcb = srvparseoldcb = 0;
  4830. clntaddnewcb = clntparsenewcb = srvaddnewcb = srvparsenewcb = 0;
  4831. snicb = 0;
  4832. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  4833. TLS_client_method(), TLS1_VERSION, 0,
  4834. &sctx, &cctx, cert, privkey)))
  4835. goto end;
  4836. if (tst == 2
  4837. && !TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(), NULL,
  4838. TLS1_VERSION, 0,
  4839. &sctx2, NULL, cert, privkey)))
  4840. goto end;
  4841. if (tst < 3) {
  4842. SSL_CTX_set_options(cctx, SSL_OP_NO_TLSv1_3);
  4843. SSL_CTX_set_options(sctx, SSL_OP_NO_TLSv1_3);
  4844. if (sctx2 != NULL)
  4845. SSL_CTX_set_options(sctx2, SSL_OP_NO_TLSv1_3);
  4846. }
  4847. if (tst == 4) {
  4848. context = SSL_EXT_CLIENT_HELLO
  4849. | SSL_EXT_TLS1_2_SERVER_HELLO
  4850. | SSL_EXT_TLS1_3_SERVER_HELLO
  4851. | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
  4852. | SSL_EXT_TLS1_3_CERTIFICATE
  4853. | SSL_EXT_TLS1_3_NEW_SESSION_TICKET;
  4854. } else {
  4855. context = SSL_EXT_CLIENT_HELLO
  4856. | SSL_EXT_TLS1_2_SERVER_HELLO
  4857. | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS;
  4858. }
  4859. /* Create a client side custom extension */
  4860. if (tst == 0) {
  4861. if (!TEST_true(SSL_CTX_add_client_custom_ext(cctx, TEST_EXT_TYPE1,
  4862. old_add_cb, old_free_cb,
  4863. &client, old_parse_cb,
  4864. &client)))
  4865. goto end;
  4866. } else {
  4867. if (!TEST_true(SSL_CTX_add_custom_ext(cctx, TEST_EXT_TYPE1, context,
  4868. new_add_cb, new_free_cb,
  4869. &client, new_parse_cb, &client)))
  4870. goto end;
  4871. }
  4872. /* Should not be able to add duplicates */
  4873. if (!TEST_false(SSL_CTX_add_client_custom_ext(cctx, TEST_EXT_TYPE1,
  4874. old_add_cb, old_free_cb,
  4875. &client, old_parse_cb,
  4876. &client))
  4877. || !TEST_false(SSL_CTX_add_custom_ext(cctx, TEST_EXT_TYPE1,
  4878. context, new_add_cb,
  4879. new_free_cb, &client,
  4880. new_parse_cb, &client)))
  4881. goto end;
  4882. /* Create a server side custom extension */
  4883. if (tst == 0) {
  4884. if (!TEST_true(SSL_CTX_add_server_custom_ext(sctx, TEST_EXT_TYPE1,
  4885. old_add_cb, old_free_cb,
  4886. &server, old_parse_cb,
  4887. &server)))
  4888. goto end;
  4889. } else {
  4890. if (!TEST_true(SSL_CTX_add_custom_ext(sctx, TEST_EXT_TYPE1, context,
  4891. new_add_cb, new_free_cb,
  4892. &server, new_parse_cb, &server)))
  4893. goto end;
  4894. if (sctx2 != NULL
  4895. && !TEST_true(SSL_CTX_add_custom_ext(sctx2, TEST_EXT_TYPE1,
  4896. context, new_add_cb,
  4897. new_free_cb, &server,
  4898. new_parse_cb, &server)))
  4899. goto end;
  4900. }
  4901. /* Should not be able to add duplicates */
  4902. if (!TEST_false(SSL_CTX_add_server_custom_ext(sctx, TEST_EXT_TYPE1,
  4903. old_add_cb, old_free_cb,
  4904. &server, old_parse_cb,
  4905. &server))
  4906. || !TEST_false(SSL_CTX_add_custom_ext(sctx, TEST_EXT_TYPE1,
  4907. context, new_add_cb,
  4908. new_free_cb, &server,
  4909. new_parse_cb, &server)))
  4910. goto end;
  4911. if (tst == 2) {
  4912. /* Set up SNI */
  4913. if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx, sni_cb))
  4914. || !TEST_true(SSL_CTX_set_tlsext_servername_arg(sctx, sctx2)))
  4915. goto end;
  4916. }
  4917. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  4918. &clientssl, NULL, NULL))
  4919. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  4920. SSL_ERROR_NONE)))
  4921. goto end;
  4922. if (tst == 0) {
  4923. if (clntaddoldcb != 1
  4924. || clntparseoldcb != 1
  4925. || srvaddoldcb != 1
  4926. || srvparseoldcb != 1)
  4927. goto end;
  4928. } else if (tst == 1 || tst == 2 || tst == 3) {
  4929. if (clntaddnewcb != 1
  4930. || clntparsenewcb != 1
  4931. || srvaddnewcb != 1
  4932. || srvparsenewcb != 1
  4933. || (tst != 2 && snicb != 0)
  4934. || (tst == 2 && snicb != 1))
  4935. goto end;
  4936. } else {
  4937. /* In this case there 2 NewSessionTicket messages created */
  4938. if (clntaddnewcb != 1
  4939. || clntparsenewcb != 5
  4940. || srvaddnewcb != 5
  4941. || srvparsenewcb != 1)
  4942. goto end;
  4943. }
  4944. sess = SSL_get1_session(clientssl);
  4945. SSL_shutdown(clientssl);
  4946. SSL_shutdown(serverssl);
  4947. SSL_free(serverssl);
  4948. SSL_free(clientssl);
  4949. serverssl = clientssl = NULL;
  4950. if (tst == 3) {
  4951. /* We don't bother with the resumption aspects for this test */
  4952. testresult = 1;
  4953. goto end;
  4954. }
  4955. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  4956. NULL, NULL))
  4957. || !TEST_true(SSL_set_session(clientssl, sess))
  4958. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  4959. SSL_ERROR_NONE)))
  4960. goto end;
  4961. /*
  4962. * For a resumed session we expect to add the ClientHello extension. For the
  4963. * old style callbacks we ignore it on the server side because they set
  4964. * SSL_EXT_IGNORE_ON_RESUMPTION. The new style callbacks do not ignore
  4965. * them.
  4966. */
  4967. if (tst == 0) {
  4968. if (clntaddoldcb != 2
  4969. || clntparseoldcb != 1
  4970. || srvaddoldcb != 1
  4971. || srvparseoldcb != 1)
  4972. goto end;
  4973. } else if (tst == 1 || tst == 2 || tst == 3) {
  4974. if (clntaddnewcb != 2
  4975. || clntparsenewcb != 2
  4976. || srvaddnewcb != 2
  4977. || srvparsenewcb != 2)
  4978. goto end;
  4979. } else {
  4980. /*
  4981. * No Certificate message extensions in the resumption handshake,
  4982. * 2 NewSessionTickets in the initial handshake, 1 in the resumption
  4983. */
  4984. if (clntaddnewcb != 2
  4985. || clntparsenewcb != 8
  4986. || srvaddnewcb != 8
  4987. || srvparsenewcb != 2)
  4988. goto end;
  4989. }
  4990. testresult = 1;
  4991. end:
  4992. SSL_SESSION_free(sess);
  4993. SSL_free(serverssl);
  4994. SSL_free(clientssl);
  4995. SSL_CTX_free(sctx2);
  4996. SSL_CTX_free(sctx);
  4997. SSL_CTX_free(cctx);
  4998. return testresult;
  4999. }
  5000. /*
  5001. * Test loading of serverinfo data in various formats. test_sslmessages actually
  5002. * tests to make sure the extensions appear in the handshake
  5003. */
  5004. static int test_serverinfo(int tst)
  5005. {
  5006. unsigned int version;
  5007. unsigned char *sibuf;
  5008. size_t sibuflen;
  5009. int ret, expected, testresult = 0;
  5010. SSL_CTX *ctx;
  5011. ctx = SSL_CTX_new_ex(libctx, NULL, TLS_method());
  5012. if (!TEST_ptr(ctx))
  5013. goto end;
  5014. if ((tst & 0x01) == 0x01)
  5015. version = SSL_SERVERINFOV2;
  5016. else
  5017. version = SSL_SERVERINFOV1;
  5018. if ((tst & 0x02) == 0x02) {
  5019. sibuf = serverinfov2;
  5020. sibuflen = sizeof(serverinfov2);
  5021. expected = (version == SSL_SERVERINFOV2);
  5022. } else {
  5023. sibuf = serverinfov1;
  5024. sibuflen = sizeof(serverinfov1);
  5025. expected = (version == SSL_SERVERINFOV1);
  5026. }
  5027. if ((tst & 0x04) == 0x04) {
  5028. ret = SSL_CTX_use_serverinfo_ex(ctx, version, sibuf, sibuflen);
  5029. } else {
  5030. ret = SSL_CTX_use_serverinfo(ctx, sibuf, sibuflen);
  5031. /*
  5032. * The version variable is irrelevant in this case - it's what is in the
  5033. * buffer that matters
  5034. */
  5035. if ((tst & 0x02) == 0x02)
  5036. expected = 0;
  5037. else
  5038. expected = 1;
  5039. }
  5040. if (!TEST_true(ret == expected))
  5041. goto end;
  5042. testresult = 1;
  5043. end:
  5044. SSL_CTX_free(ctx);
  5045. return testresult;
  5046. }
  5047. /*
  5048. * Test that SSL_export_keying_material() produces expected results. There are
  5049. * no test vectors so all we do is test that both sides of the communication
  5050. * produce the same results for different protocol versions.
  5051. */
  5052. #define SMALL_LABEL_LEN 10
  5053. #define LONG_LABEL_LEN 249
  5054. static int test_export_key_mat(int tst)
  5055. {
  5056. int testresult = 0;
  5057. SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
  5058. SSL *clientssl = NULL, *serverssl = NULL;
  5059. const char label[LONG_LABEL_LEN + 1] = "test label";
  5060. const unsigned char context[] = "context";
  5061. const unsigned char *emptycontext = NULL;
  5062. unsigned char ckeymat1[80], ckeymat2[80], ckeymat3[80];
  5063. unsigned char skeymat1[80], skeymat2[80], skeymat3[80];
  5064. size_t labellen;
  5065. const int protocols[] = {
  5066. TLS1_VERSION,
  5067. TLS1_1_VERSION,
  5068. TLS1_2_VERSION,
  5069. TLS1_3_VERSION,
  5070. TLS1_3_VERSION,
  5071. TLS1_3_VERSION
  5072. };
  5073. #ifdef OPENSSL_NO_TLS1
  5074. if (tst == 0)
  5075. return 1;
  5076. #endif
  5077. #ifdef OPENSSL_NO_TLS1_1
  5078. if (tst == 1)
  5079. return 1;
  5080. #endif
  5081. if (is_fips && (tst == 0 || tst == 1))
  5082. return 1;
  5083. #ifdef OPENSSL_NO_TLS1_2
  5084. if (tst == 2)
  5085. return 1;
  5086. #endif
  5087. #ifdef OSSL_NO_USABLE_TLS1_3
  5088. if (tst >= 3)
  5089. return 1;
  5090. #endif
  5091. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5092. TLS_client_method(), TLS1_VERSION, 0,
  5093. &sctx, &cctx, cert, privkey)))
  5094. goto end;
  5095. OPENSSL_assert(tst >= 0 && (size_t)tst < OSSL_NELEM(protocols));
  5096. SSL_CTX_set_max_proto_version(cctx, protocols[tst]);
  5097. SSL_CTX_set_min_proto_version(cctx, protocols[tst]);
  5098. if ((protocols[tst] < TLS1_2_VERSION) &&
  5099. (!SSL_CTX_set_cipher_list(cctx, "DEFAULT:@SECLEVEL=0")
  5100. || !SSL_CTX_set_cipher_list(sctx, "DEFAULT:@SECLEVEL=0")))
  5101. goto end;
  5102. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
  5103. NULL)))
  5104. goto end;
  5105. /*
  5106. * Premature call of SSL_export_keying_material should just fail.
  5107. */
  5108. if (!TEST_int_le(SSL_export_keying_material(clientssl, ckeymat1,
  5109. sizeof(ckeymat1), label,
  5110. SMALL_LABEL_LEN + 1, context,
  5111. sizeof(context) - 1, 1), 0))
  5112. goto end;
  5113. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  5114. SSL_ERROR_NONE)))
  5115. goto end;
  5116. if (tst == 5) {
  5117. /*
  5118. * TLSv1.3 imposes a maximum label len of 249 bytes. Check we fail if we
  5119. * go over that.
  5120. */
  5121. if (!TEST_int_le(SSL_export_keying_material(clientssl, ckeymat1,
  5122. sizeof(ckeymat1), label,
  5123. LONG_LABEL_LEN + 1, context,
  5124. sizeof(context) - 1, 1), 0))
  5125. goto end;
  5126. testresult = 1;
  5127. goto end;
  5128. } else if (tst == 4) {
  5129. labellen = LONG_LABEL_LEN;
  5130. } else {
  5131. labellen = SMALL_LABEL_LEN;
  5132. }
  5133. if (!TEST_int_eq(SSL_export_keying_material(clientssl, ckeymat1,
  5134. sizeof(ckeymat1), label,
  5135. labellen, context,
  5136. sizeof(context) - 1, 1), 1)
  5137. || !TEST_int_eq(SSL_export_keying_material(clientssl, ckeymat2,
  5138. sizeof(ckeymat2), label,
  5139. labellen,
  5140. emptycontext,
  5141. 0, 1), 1)
  5142. || !TEST_int_eq(SSL_export_keying_material(clientssl, ckeymat3,
  5143. sizeof(ckeymat3), label,
  5144. labellen,
  5145. NULL, 0, 0), 1)
  5146. || !TEST_int_eq(SSL_export_keying_material(serverssl, skeymat1,
  5147. sizeof(skeymat1), label,
  5148. labellen,
  5149. context,
  5150. sizeof(context) -1, 1),
  5151. 1)
  5152. || !TEST_int_eq(SSL_export_keying_material(serverssl, skeymat2,
  5153. sizeof(skeymat2), label,
  5154. labellen,
  5155. emptycontext,
  5156. 0, 1), 1)
  5157. || !TEST_int_eq(SSL_export_keying_material(serverssl, skeymat3,
  5158. sizeof(skeymat3), label,
  5159. labellen,
  5160. NULL, 0, 0), 1)
  5161. /*
  5162. * Check that both sides created the same key material with the
  5163. * same context.
  5164. */
  5165. || !TEST_mem_eq(ckeymat1, sizeof(ckeymat1), skeymat1,
  5166. sizeof(skeymat1))
  5167. /*
  5168. * Check that both sides created the same key material with an
  5169. * empty context.
  5170. */
  5171. || !TEST_mem_eq(ckeymat2, sizeof(ckeymat2), skeymat2,
  5172. sizeof(skeymat2))
  5173. /*
  5174. * Check that both sides created the same key material without a
  5175. * context.
  5176. */
  5177. || !TEST_mem_eq(ckeymat3, sizeof(ckeymat3), skeymat3,
  5178. sizeof(skeymat3))
  5179. /* Different contexts should produce different results */
  5180. || !TEST_mem_ne(ckeymat1, sizeof(ckeymat1), ckeymat2,
  5181. sizeof(ckeymat2)))
  5182. goto end;
  5183. /*
  5184. * Check that an empty context and no context produce different results in
  5185. * protocols less than TLSv1.3. In TLSv1.3 they should be the same.
  5186. */
  5187. if ((tst < 3 && !TEST_mem_ne(ckeymat2, sizeof(ckeymat2), ckeymat3,
  5188. sizeof(ckeymat3)))
  5189. || (tst >= 3 && !TEST_mem_eq(ckeymat2, sizeof(ckeymat2), ckeymat3,
  5190. sizeof(ckeymat3))))
  5191. goto end;
  5192. testresult = 1;
  5193. end:
  5194. SSL_free(serverssl);
  5195. SSL_free(clientssl);
  5196. SSL_CTX_free(sctx2);
  5197. SSL_CTX_free(sctx);
  5198. SSL_CTX_free(cctx);
  5199. return testresult;
  5200. }
  5201. #ifndef OSSL_NO_USABLE_TLS1_3
  5202. /*
  5203. * Test that SSL_export_keying_material_early() produces expected
  5204. * results. There are no test vectors so all we do is test that both
  5205. * sides of the communication produce the same results for different
  5206. * protocol versions.
  5207. */
  5208. static int test_export_key_mat_early(int idx)
  5209. {
  5210. static const char label[] = "test label";
  5211. static const unsigned char context[] = "context";
  5212. int testresult = 0;
  5213. SSL_CTX *cctx = NULL, *sctx = NULL;
  5214. SSL *clientssl = NULL, *serverssl = NULL;
  5215. SSL_SESSION *sess = NULL;
  5216. const unsigned char *emptycontext = NULL;
  5217. unsigned char ckeymat1[80], ckeymat2[80];
  5218. unsigned char skeymat1[80], skeymat2[80];
  5219. unsigned char buf[1];
  5220. size_t readbytes, written;
  5221. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl, &serverssl,
  5222. &sess, idx)))
  5223. goto end;
  5224. /* Here writing 0 length early data is enough. */
  5225. if (!TEST_true(SSL_write_early_data(clientssl, NULL, 0, &written))
  5226. || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
  5227. &readbytes),
  5228. SSL_READ_EARLY_DATA_ERROR)
  5229. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  5230. SSL_EARLY_DATA_ACCEPTED))
  5231. goto end;
  5232. if (!TEST_int_eq(SSL_export_keying_material_early(
  5233. clientssl, ckeymat1, sizeof(ckeymat1), label,
  5234. sizeof(label) - 1, context, sizeof(context) - 1), 1)
  5235. || !TEST_int_eq(SSL_export_keying_material_early(
  5236. clientssl, ckeymat2, sizeof(ckeymat2), label,
  5237. sizeof(label) - 1, emptycontext, 0), 1)
  5238. || !TEST_int_eq(SSL_export_keying_material_early(
  5239. serverssl, skeymat1, sizeof(skeymat1), label,
  5240. sizeof(label) - 1, context, sizeof(context) - 1), 1)
  5241. || !TEST_int_eq(SSL_export_keying_material_early(
  5242. serverssl, skeymat2, sizeof(skeymat2), label,
  5243. sizeof(label) - 1, emptycontext, 0), 1)
  5244. /*
  5245. * Check that both sides created the same key material with the
  5246. * same context.
  5247. */
  5248. || !TEST_mem_eq(ckeymat1, sizeof(ckeymat1), skeymat1,
  5249. sizeof(skeymat1))
  5250. /*
  5251. * Check that both sides created the same key material with an
  5252. * empty context.
  5253. */
  5254. || !TEST_mem_eq(ckeymat2, sizeof(ckeymat2), skeymat2,
  5255. sizeof(skeymat2))
  5256. /* Different contexts should produce different results */
  5257. || !TEST_mem_ne(ckeymat1, sizeof(ckeymat1), ckeymat2,
  5258. sizeof(ckeymat2)))
  5259. goto end;
  5260. testresult = 1;
  5261. end:
  5262. SSL_SESSION_free(sess);
  5263. SSL_SESSION_free(clientpsk);
  5264. SSL_SESSION_free(serverpsk);
  5265. clientpsk = serverpsk = NULL;
  5266. SSL_free(serverssl);
  5267. SSL_free(clientssl);
  5268. SSL_CTX_free(sctx);
  5269. SSL_CTX_free(cctx);
  5270. return testresult;
  5271. }
  5272. #define NUM_KEY_UPDATE_MESSAGES 40
  5273. /*
  5274. * Test KeyUpdate.
  5275. */
  5276. static int test_key_update(void)
  5277. {
  5278. SSL_CTX *cctx = NULL, *sctx = NULL;
  5279. SSL *clientssl = NULL, *serverssl = NULL;
  5280. int testresult = 0, i, j;
  5281. char buf[20];
  5282. static char *mess = "A test message";
  5283. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5284. TLS_client_method(),
  5285. TLS1_3_VERSION,
  5286. 0,
  5287. &sctx, &cctx, cert, privkey))
  5288. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  5289. NULL, NULL))
  5290. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5291. SSL_ERROR_NONE)))
  5292. goto end;
  5293. for (j = 0; j < 2; j++) {
  5294. /* Send lots of KeyUpdate messages */
  5295. for (i = 0; i < NUM_KEY_UPDATE_MESSAGES; i++) {
  5296. if (!TEST_true(SSL_key_update(clientssl,
  5297. (j == 0)
  5298. ? SSL_KEY_UPDATE_NOT_REQUESTED
  5299. : SSL_KEY_UPDATE_REQUESTED))
  5300. || !TEST_true(SSL_do_handshake(clientssl)))
  5301. goto end;
  5302. }
  5303. /* Check that sending and receiving app data is ok */
  5304. if (!TEST_int_eq(SSL_write(clientssl, mess, strlen(mess)), strlen(mess))
  5305. || !TEST_int_eq(SSL_read(serverssl, buf, sizeof(buf)),
  5306. strlen(mess)))
  5307. goto end;
  5308. if (!TEST_int_eq(SSL_write(serverssl, mess, strlen(mess)), strlen(mess))
  5309. || !TEST_int_eq(SSL_read(clientssl, buf, sizeof(buf)),
  5310. strlen(mess)))
  5311. goto end;
  5312. }
  5313. testresult = 1;
  5314. end:
  5315. SSL_free(serverssl);
  5316. SSL_free(clientssl);
  5317. SSL_CTX_free(sctx);
  5318. SSL_CTX_free(cctx);
  5319. return testresult;
  5320. }
  5321. /*
  5322. * Test we can handle a KeyUpdate (update requested) message while write data
  5323. * is pending.
  5324. * Test 0: Client sends KeyUpdate while Server is writing
  5325. * Test 1: Server sends KeyUpdate while Client is writing
  5326. */
  5327. static int test_key_update_in_write(int tst)
  5328. {
  5329. SSL_CTX *cctx = NULL, *sctx = NULL;
  5330. SSL *clientssl = NULL, *serverssl = NULL;
  5331. int testresult = 0;
  5332. char buf[20];
  5333. static char *mess = "A test message";
  5334. BIO *bretry = BIO_new(bio_s_always_retry());
  5335. BIO *tmp = NULL;
  5336. SSL *peerupdate = NULL, *peerwrite = NULL;
  5337. if (!TEST_ptr(bretry)
  5338. || !TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5339. TLS_client_method(),
  5340. TLS1_3_VERSION,
  5341. 0,
  5342. &sctx, &cctx, cert, privkey))
  5343. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  5344. NULL, NULL))
  5345. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5346. SSL_ERROR_NONE)))
  5347. goto end;
  5348. peerupdate = tst == 0 ? clientssl : serverssl;
  5349. peerwrite = tst == 0 ? serverssl : clientssl;
  5350. if (!TEST_true(SSL_key_update(peerupdate, SSL_KEY_UPDATE_REQUESTED))
  5351. || !TEST_true(SSL_do_handshake(peerupdate)))
  5352. goto end;
  5353. /* Swap the writing endpoint's write BIO to force a retry */
  5354. tmp = SSL_get_wbio(peerwrite);
  5355. if (!TEST_ptr(tmp) || !TEST_true(BIO_up_ref(tmp))) {
  5356. tmp = NULL;
  5357. goto end;
  5358. }
  5359. SSL_set0_wbio(peerwrite, bretry);
  5360. bretry = NULL;
  5361. /* Write data that we know will fail with SSL_ERROR_WANT_WRITE */
  5362. if (!TEST_int_eq(SSL_write(peerwrite, mess, strlen(mess)), -1)
  5363. || !TEST_int_eq(SSL_get_error(peerwrite, 0), SSL_ERROR_WANT_WRITE))
  5364. goto end;
  5365. /* Reinstate the original writing endpoint's write BIO */
  5366. SSL_set0_wbio(peerwrite, tmp);
  5367. tmp = NULL;
  5368. /* Now read some data - we will read the key update */
  5369. if (!TEST_int_eq(SSL_read(peerwrite, buf, sizeof(buf)), -1)
  5370. || !TEST_int_eq(SSL_get_error(peerwrite, 0), SSL_ERROR_WANT_READ))
  5371. goto end;
  5372. /*
  5373. * Complete the write we started previously and read it from the other
  5374. * endpoint
  5375. */
  5376. if (!TEST_int_eq(SSL_write(peerwrite, mess, strlen(mess)), strlen(mess))
  5377. || !TEST_int_eq(SSL_read(peerupdate, buf, sizeof(buf)), strlen(mess)))
  5378. goto end;
  5379. /* Write more data to ensure we send the KeyUpdate message back */
  5380. if (!TEST_int_eq(SSL_write(peerwrite, mess, strlen(mess)), strlen(mess))
  5381. || !TEST_int_eq(SSL_read(peerupdate, buf, sizeof(buf)), strlen(mess)))
  5382. goto end;
  5383. testresult = 1;
  5384. end:
  5385. SSL_free(serverssl);
  5386. SSL_free(clientssl);
  5387. SSL_CTX_free(sctx);
  5388. SSL_CTX_free(cctx);
  5389. BIO_free(bretry);
  5390. BIO_free(tmp);
  5391. return testresult;
  5392. }
  5393. #endif /* OSSL_NO_USABLE_TLS1_3 */
  5394. static int test_ssl_clear(int idx)
  5395. {
  5396. SSL_CTX *cctx = NULL, *sctx = NULL;
  5397. SSL *clientssl = NULL, *serverssl = NULL;
  5398. int testresult = 0;
  5399. #ifdef OPENSSL_NO_TLS1_2
  5400. if (idx == 1)
  5401. return 1;
  5402. #endif
  5403. /* Create an initial connection */
  5404. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5405. TLS_client_method(), TLS1_VERSION, 0,
  5406. &sctx, &cctx, cert, privkey))
  5407. || (idx == 1
  5408. && !TEST_true(SSL_CTX_set_max_proto_version(cctx,
  5409. TLS1_2_VERSION)))
  5410. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  5411. &clientssl, NULL, NULL))
  5412. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5413. SSL_ERROR_NONE)))
  5414. goto end;
  5415. SSL_shutdown(clientssl);
  5416. SSL_shutdown(serverssl);
  5417. SSL_free(serverssl);
  5418. serverssl = NULL;
  5419. /* Clear clientssl - we're going to reuse the object */
  5420. if (!TEST_true(SSL_clear(clientssl)))
  5421. goto end;
  5422. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  5423. NULL, NULL))
  5424. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5425. SSL_ERROR_NONE))
  5426. || !TEST_true(SSL_session_reused(clientssl)))
  5427. goto end;
  5428. SSL_shutdown(clientssl);
  5429. SSL_shutdown(serverssl);
  5430. testresult = 1;
  5431. end:
  5432. SSL_free(serverssl);
  5433. SSL_free(clientssl);
  5434. SSL_CTX_free(sctx);
  5435. SSL_CTX_free(cctx);
  5436. return testresult;
  5437. }
  5438. /* Parse CH and retrieve any MFL extension value if present */
  5439. static int get_MFL_from_client_hello(BIO *bio, int *mfl_codemfl_code)
  5440. {
  5441. long len;
  5442. unsigned char *data;
  5443. PACKET pkt, pkt2, pkt3;
  5444. unsigned int MFL_code = 0, type = 0;
  5445. if (!TEST_uint_gt( len = BIO_get_mem_data( bio, (char **) &data ), 0 ) )
  5446. goto end;
  5447. memset(&pkt, 0, sizeof(pkt));
  5448. memset(&pkt2, 0, sizeof(pkt2));
  5449. memset(&pkt3, 0, sizeof(pkt3));
  5450. if (!TEST_long_gt(len, 0)
  5451. || !TEST_true( PACKET_buf_init( &pkt, data, len ) )
  5452. /* Skip the record header */
  5453. || !PACKET_forward(&pkt, SSL3_RT_HEADER_LENGTH)
  5454. /* Skip the handshake message header */
  5455. || !TEST_true(PACKET_forward(&pkt, SSL3_HM_HEADER_LENGTH))
  5456. /* Skip client version and random */
  5457. || !TEST_true(PACKET_forward(&pkt, CLIENT_VERSION_LEN
  5458. + SSL3_RANDOM_SIZE))
  5459. /* Skip session id */
  5460. || !TEST_true(PACKET_get_length_prefixed_1(&pkt, &pkt2))
  5461. /* Skip ciphers */
  5462. || !TEST_true(PACKET_get_length_prefixed_2(&pkt, &pkt2))
  5463. /* Skip compression */
  5464. || !TEST_true(PACKET_get_length_prefixed_1(&pkt, &pkt2))
  5465. /* Extensions len */
  5466. || !TEST_true(PACKET_as_length_prefixed_2(&pkt, &pkt2)))
  5467. goto end;
  5468. /* Loop through all extensions */
  5469. while (PACKET_remaining(&pkt2)) {
  5470. if (!TEST_true(PACKET_get_net_2(&pkt2, &type))
  5471. || !TEST_true(PACKET_get_length_prefixed_2(&pkt2, &pkt3)))
  5472. goto end;
  5473. if (type == TLSEXT_TYPE_max_fragment_length) {
  5474. if (!TEST_uint_ne(PACKET_remaining(&pkt3), 0)
  5475. || !TEST_true(PACKET_get_1(&pkt3, &MFL_code)))
  5476. goto end;
  5477. *mfl_codemfl_code = MFL_code;
  5478. return 1;
  5479. }
  5480. }
  5481. end:
  5482. return 0;
  5483. }
  5484. /* Maximum-Fragment-Length TLS extension mode to test */
  5485. static const unsigned char max_fragment_len_test[] = {
  5486. TLSEXT_max_fragment_length_512,
  5487. TLSEXT_max_fragment_length_1024,
  5488. TLSEXT_max_fragment_length_2048,
  5489. TLSEXT_max_fragment_length_4096
  5490. };
  5491. static int test_max_fragment_len_ext(int idx_tst)
  5492. {
  5493. SSL_CTX *ctx = NULL;
  5494. SSL *con = NULL;
  5495. int testresult = 0, MFL_mode = 0;
  5496. BIO *rbio, *wbio;
  5497. if (!TEST_true(create_ssl_ctx_pair(libctx, NULL, TLS_client_method(),
  5498. TLS1_VERSION, 0, NULL, &ctx, NULL,
  5499. NULL)))
  5500. return 0;
  5501. if (!TEST_true(SSL_CTX_set_tlsext_max_fragment_length(
  5502. ctx, max_fragment_len_test[idx_tst])))
  5503. goto end;
  5504. con = SSL_new(ctx);
  5505. if (!TEST_ptr(con))
  5506. goto end;
  5507. rbio = BIO_new(BIO_s_mem());
  5508. wbio = BIO_new(BIO_s_mem());
  5509. if (!TEST_ptr(rbio)|| !TEST_ptr(wbio)) {
  5510. BIO_free(rbio);
  5511. BIO_free(wbio);
  5512. goto end;
  5513. }
  5514. SSL_set_bio(con, rbio, wbio);
  5515. if (!TEST_int_le(SSL_connect(con), 0)) {
  5516. /* This shouldn't succeed because we don't have a server! */
  5517. goto end;
  5518. }
  5519. if (!TEST_true(get_MFL_from_client_hello(wbio, &MFL_mode)))
  5520. /* no MFL in client hello */
  5521. goto end;
  5522. if (!TEST_true(max_fragment_len_test[idx_tst] == MFL_mode))
  5523. goto end;
  5524. testresult = 1;
  5525. end:
  5526. SSL_free(con);
  5527. SSL_CTX_free(ctx);
  5528. return testresult;
  5529. }
  5530. #ifndef OSSL_NO_USABLE_TLS1_3
  5531. static int test_pha_key_update(void)
  5532. {
  5533. SSL_CTX *cctx = NULL, *sctx = NULL;
  5534. SSL *clientssl = NULL, *serverssl = NULL;
  5535. int testresult = 0;
  5536. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5537. TLS_client_method(), TLS1_VERSION, 0,
  5538. &sctx, &cctx, cert, privkey)))
  5539. return 0;
  5540. if (!TEST_true(SSL_CTX_set_min_proto_version(sctx, TLS1_3_VERSION))
  5541. || !TEST_true(SSL_CTX_set_max_proto_version(sctx, TLS1_3_VERSION))
  5542. || !TEST_true(SSL_CTX_set_min_proto_version(cctx, TLS1_3_VERSION))
  5543. || !TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_3_VERSION)))
  5544. goto end;
  5545. SSL_CTX_set_post_handshake_auth(cctx, 1);
  5546. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  5547. NULL, NULL)))
  5548. goto end;
  5549. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  5550. SSL_ERROR_NONE)))
  5551. goto end;
  5552. SSL_set_verify(serverssl, SSL_VERIFY_PEER, NULL);
  5553. if (!TEST_true(SSL_verify_client_post_handshake(serverssl)))
  5554. goto end;
  5555. if (!TEST_true(SSL_key_update(clientssl, SSL_KEY_UPDATE_NOT_REQUESTED)))
  5556. goto end;
  5557. /* Start handshake on the server */
  5558. if (!TEST_int_eq(SSL_do_handshake(serverssl), 1))
  5559. goto end;
  5560. /* Starts with SSL_connect(), but it's really just SSL_do_handshake() */
  5561. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  5562. SSL_ERROR_NONE)))
  5563. goto end;
  5564. SSL_shutdown(clientssl);
  5565. SSL_shutdown(serverssl);
  5566. testresult = 1;
  5567. end:
  5568. SSL_free(serverssl);
  5569. SSL_free(clientssl);
  5570. SSL_CTX_free(sctx);
  5571. SSL_CTX_free(cctx);
  5572. return testresult;
  5573. }
  5574. #endif
  5575. #if !defined(OPENSSL_NO_SRP) && !defined(OPENSSL_NO_TLS1_2)
  5576. static SRP_VBASE *vbase = NULL;
  5577. static int ssl_srp_cb(SSL *s, int *ad, void *arg)
  5578. {
  5579. int ret = SSL3_AL_FATAL;
  5580. char *username;
  5581. SRP_user_pwd *user = NULL;
  5582. username = SSL_get_srp_username(s);
  5583. if (username == NULL) {
  5584. *ad = SSL_AD_INTERNAL_ERROR;
  5585. goto err;
  5586. }
  5587. user = SRP_VBASE_get1_by_user(vbase, username);
  5588. if (user == NULL) {
  5589. *ad = SSL_AD_INTERNAL_ERROR;
  5590. goto err;
  5591. }
  5592. if (SSL_set_srp_server_param(s, user->N, user->g, user->s, user->v,
  5593. user->info) <= 0) {
  5594. *ad = SSL_AD_INTERNAL_ERROR;
  5595. goto err;
  5596. }
  5597. ret = 0;
  5598. err:
  5599. SRP_user_pwd_free(user);
  5600. return ret;
  5601. }
  5602. static int create_new_vfile(char *userid, char *password, const char *filename)
  5603. {
  5604. char *gNid = NULL;
  5605. OPENSSL_STRING *row = OPENSSL_zalloc(sizeof(row) * (DB_NUMBER + 1));
  5606. TXT_DB *db = NULL;
  5607. int ret = 0;
  5608. BIO *out = NULL, *dummy = BIO_new_mem_buf("", 0);
  5609. size_t i;
  5610. if (!TEST_ptr(dummy) || !TEST_ptr(row))
  5611. goto end;
  5612. gNid = SRP_create_verifier_ex(userid, password, &row[DB_srpsalt],
  5613. &row[DB_srpverifier], NULL, NULL, libctx, NULL);
  5614. if (!TEST_ptr(gNid))
  5615. goto end;
  5616. /*
  5617. * The only way to create an empty TXT_DB is to provide a BIO with no data
  5618. * in it!
  5619. */
  5620. db = TXT_DB_read(dummy, DB_NUMBER);
  5621. if (!TEST_ptr(db))
  5622. goto end;
  5623. out = BIO_new_file(filename, "w");
  5624. if (!TEST_ptr(out))
  5625. goto end;
  5626. row[DB_srpid] = OPENSSL_strdup(userid);
  5627. row[DB_srptype] = OPENSSL_strdup("V");
  5628. row[DB_srpgN] = OPENSSL_strdup(gNid);
  5629. if (!TEST_ptr(row[DB_srpid])
  5630. || !TEST_ptr(row[DB_srptype])
  5631. || !TEST_ptr(row[DB_srpgN])
  5632. || !TEST_true(TXT_DB_insert(db, row)))
  5633. goto end;
  5634. row = NULL;
  5635. if (!TXT_DB_write(out, db))
  5636. goto end;
  5637. ret = 1;
  5638. end:
  5639. if (row != NULL) {
  5640. for (i = 0; i < DB_NUMBER; i++)
  5641. OPENSSL_free(row[i]);
  5642. }
  5643. OPENSSL_free(row);
  5644. BIO_free(dummy);
  5645. BIO_free(out);
  5646. TXT_DB_free(db);
  5647. return ret;
  5648. }
  5649. static int create_new_vbase(char *userid, char *password)
  5650. {
  5651. BIGNUM *verifier = NULL, *salt = NULL;
  5652. const SRP_gN *lgN = NULL;
  5653. SRP_user_pwd *user_pwd = NULL;
  5654. int ret = 0;
  5655. lgN = SRP_get_default_gN(NULL);
  5656. if (!TEST_ptr(lgN))
  5657. goto end;
  5658. if (!TEST_true(SRP_create_verifier_BN_ex(userid, password, &salt, &verifier,
  5659. lgN->N, lgN->g, libctx, NULL)))
  5660. goto end;
  5661. user_pwd = OPENSSL_zalloc(sizeof(*user_pwd));
  5662. if (!TEST_ptr(user_pwd))
  5663. goto end;
  5664. user_pwd->N = lgN->N;
  5665. user_pwd->g = lgN->g;
  5666. user_pwd->id = OPENSSL_strdup(userid);
  5667. if (!TEST_ptr(user_pwd->id))
  5668. goto end;
  5669. user_pwd->v = verifier;
  5670. user_pwd->s = salt;
  5671. verifier = salt = NULL;
  5672. if (sk_SRP_user_pwd_insert(vbase->users_pwd, user_pwd, 0) == 0)
  5673. goto end;
  5674. user_pwd = NULL;
  5675. ret = 1;
  5676. end:
  5677. SRP_user_pwd_free(user_pwd);
  5678. BN_free(salt);
  5679. BN_free(verifier);
  5680. return ret;
  5681. }
  5682. /*
  5683. * SRP tests
  5684. *
  5685. * Test 0: Simple successful SRP connection, new vbase
  5686. * Test 1: Connection failure due to bad password, new vbase
  5687. * Test 2: Simple successful SRP connection, vbase loaded from existing file
  5688. * Test 3: Connection failure due to bad password, vbase loaded from existing
  5689. * file
  5690. * Test 4: Simple successful SRP connection, vbase loaded from new file
  5691. * Test 5: Connection failure due to bad password, vbase loaded from new file
  5692. */
  5693. static int test_srp(int tst)
  5694. {
  5695. char *userid = "test", *password = "password", *tstsrpfile;
  5696. SSL_CTX *cctx = NULL, *sctx = NULL;
  5697. SSL *clientssl = NULL, *serverssl = NULL;
  5698. int ret, testresult = 0;
  5699. vbase = SRP_VBASE_new(NULL);
  5700. if (!TEST_ptr(vbase))
  5701. goto end;
  5702. if (tst == 0 || tst == 1) {
  5703. if (!TEST_true(create_new_vbase(userid, password)))
  5704. goto end;
  5705. } else {
  5706. if (tst == 4 || tst == 5) {
  5707. if (!TEST_true(create_new_vfile(userid, password, tmpfilename)))
  5708. goto end;
  5709. tstsrpfile = tmpfilename;
  5710. } else {
  5711. tstsrpfile = srpvfile;
  5712. }
  5713. if (!TEST_int_eq(SRP_VBASE_init(vbase, tstsrpfile), SRP_NO_ERROR))
  5714. goto end;
  5715. }
  5716. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5717. TLS_client_method(), TLS1_VERSION, 0,
  5718. &sctx, &cctx, cert, privkey)))
  5719. goto end;
  5720. if (!TEST_int_gt(SSL_CTX_set_srp_username_callback(sctx, ssl_srp_cb), 0)
  5721. || !TEST_true(SSL_CTX_set_cipher_list(cctx, "SRP-AES-128-CBC-SHA"))
  5722. || !TEST_true(SSL_CTX_set_max_proto_version(sctx, TLS1_2_VERSION))
  5723. || !TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION))
  5724. || !TEST_int_gt(SSL_CTX_set_srp_username(cctx, userid), 0))
  5725. goto end;
  5726. if (tst % 2 == 1) {
  5727. if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, "badpass"), 0))
  5728. goto end;
  5729. } else {
  5730. if (!TEST_int_gt(SSL_CTX_set_srp_password(cctx, password), 0))
  5731. goto end;
  5732. }
  5733. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  5734. NULL, NULL)))
  5735. goto end;
  5736. ret = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE);
  5737. if (ret) {
  5738. if (!TEST_true(tst % 2 == 0))
  5739. goto end;
  5740. } else {
  5741. if (!TEST_true(tst % 2 == 1))
  5742. goto end;
  5743. }
  5744. testresult = 1;
  5745. end:
  5746. SRP_VBASE_free(vbase);
  5747. vbase = NULL;
  5748. SSL_free(serverssl);
  5749. SSL_free(clientssl);
  5750. SSL_CTX_free(sctx);
  5751. SSL_CTX_free(cctx);
  5752. return testresult;
  5753. }
  5754. #endif
  5755. static int info_cb_failed = 0;
  5756. static int info_cb_offset = 0;
  5757. static int info_cb_this_state = -1;
  5758. static struct info_cb_states_st {
  5759. int where;
  5760. const char *statestr;
  5761. } info_cb_states[][60] = {
  5762. {
  5763. /* TLSv1.2 server followed by resumption */
  5764. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
  5765. {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
  5766. {SSL_CB_LOOP, "TWSC"}, {SSL_CB_LOOP, "TWSKE"}, {SSL_CB_LOOP, "TWSD"},
  5767. {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWSD"}, {SSL_CB_LOOP, "TRCKE"},
  5768. {SSL_CB_LOOP, "TRCCS"}, {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWST"},
  5769. {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
  5770. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
  5771. {SSL_CB_ALERT, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
  5772. {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"},
  5773. {SSL_CB_LOOP, "TWSH"}, {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
  5774. {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_LOOP, "TRCCS"},
  5775. {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
  5776. {SSL_CB_EXIT, NULL}, {0, NULL},
  5777. }, {
  5778. /* TLSv1.2 client followed by resumption */
  5779. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
  5780. {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWCH"},
  5781. {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TRSC"}, {SSL_CB_LOOP, "TRSKE"},
  5782. {SSL_CB_LOOP, "TRSD"}, {SSL_CB_LOOP, "TWCKE"}, {SSL_CB_LOOP, "TWCCS"},
  5783. {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWFIN"},
  5784. {SSL_CB_LOOP, "TRST"}, {SSL_CB_LOOP, "TRCCS"}, {SSL_CB_LOOP, "TRFIN"},
  5785. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL}, {SSL_CB_ALERT, NULL},
  5786. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
  5787. {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWCH"},
  5788. {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TRCCS"}, {SSL_CB_LOOP, "TRFIN"},
  5789. {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
  5790. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL}, {0, NULL},
  5791. }, {
  5792. /* TLSv1.3 server followed by resumption */
  5793. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
  5794. {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
  5795. {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"}, {SSL_CB_LOOP, "TWSC"},
  5796. {SSL_CB_LOOP, "TRSCV"}, {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_LOOP, "TED"},
  5797. {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TRFIN"},
  5798. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_LOOP, "TWST"},
  5799. {SSL_CB_LOOP, "TWST"}, {SSL_CB_EXIT, NULL}, {SSL_CB_ALERT, NULL},
  5800. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
  5801. {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
  5802. {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"}, {SSL_CB_LOOP, "TWFIN"},
  5803. {SSL_CB_LOOP, "TED"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TED"},
  5804. {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
  5805. {SSL_CB_LOOP, "TWST"}, {SSL_CB_EXIT, NULL}, {0, NULL},
  5806. }, {
  5807. /* TLSv1.3 client followed by resumption */
  5808. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
  5809. {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "TWCH"},
  5810. {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"}, {SSL_CB_LOOP, "TRSC"},
  5811. {SSL_CB_LOOP, "TRSCV"}, {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWCCS"},
  5812. {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
  5813. {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "SSLOK "},
  5814. {SSL_CB_LOOP, "TRST"}, {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "SSLOK "},
  5815. {SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "TRST"}, {SSL_CB_EXIT, NULL},
  5816. {SSL_CB_ALERT, NULL}, {SSL_CB_HANDSHAKE_START, NULL},
  5817. {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TWCH"}, {SSL_CB_EXIT, NULL},
  5818. {SSL_CB_LOOP, "TWCH"}, {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"},
  5819. {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWFIN"},
  5820. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
  5821. {SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "TRST"},
  5822. {SSL_CB_EXIT, NULL}, {0, NULL},
  5823. }, {
  5824. /* TLSv1.3 server, early_data */
  5825. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
  5826. {SSL_CB_LOOP, "PINIT "}, {SSL_CB_LOOP, "TRCH"}, {SSL_CB_LOOP, "TWSH"},
  5827. {SSL_CB_LOOP, "TWCCS"}, {SSL_CB_LOOP, "TWEE"}, {SSL_CB_LOOP, "TWFIN"},
  5828. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
  5829. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "TED"},
  5830. {SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TWEOED"}, {SSL_CB_LOOP, "TRFIN"},
  5831. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_LOOP, "TWST"},
  5832. {SSL_CB_EXIT, NULL}, {0, NULL},
  5833. }, {
  5834. /* TLSv1.3 client, early_data */
  5835. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "PINIT "},
  5836. {SSL_CB_LOOP, "TWCH"}, {SSL_CB_LOOP, "TWCCS"},
  5837. {SSL_CB_HANDSHAKE_DONE, NULL}, {SSL_CB_EXIT, NULL},
  5838. {SSL_CB_HANDSHAKE_START, NULL}, {SSL_CB_LOOP, "TED"},
  5839. {SSL_CB_LOOP, "TED"}, {SSL_CB_LOOP, "TRSH"}, {SSL_CB_LOOP, "TREE"},
  5840. {SSL_CB_LOOP, "TRFIN"}, {SSL_CB_LOOP, "TPEDE"}, {SSL_CB_LOOP, "TWEOED"},
  5841. {SSL_CB_LOOP, "TWFIN"}, {SSL_CB_HANDSHAKE_DONE, NULL},
  5842. {SSL_CB_EXIT, NULL}, {SSL_CB_LOOP, "SSLOK "}, {SSL_CB_LOOP, "SSLOK "},
  5843. {SSL_CB_LOOP, "TRST"}, {SSL_CB_EXIT, NULL}, {0, NULL},
  5844. }, {
  5845. {0, NULL},
  5846. }
  5847. };
  5848. static void sslapi_info_callback(const SSL *s, int where, int ret)
  5849. {
  5850. struct info_cb_states_st *state = info_cb_states[info_cb_offset];
  5851. /* We do not ever expect a connection to fail in this test */
  5852. if (!TEST_false(ret == 0)) {
  5853. info_cb_failed = 1;
  5854. return;
  5855. }
  5856. /*
  5857. * Do some sanity checks. We never expect these things to happen in this
  5858. * test
  5859. */
  5860. if (!TEST_false((SSL_is_server(s) && (where & SSL_ST_CONNECT) != 0))
  5861. || !TEST_false(!SSL_is_server(s) && (where & SSL_ST_ACCEPT) != 0)
  5862. || !TEST_int_ne(state[++info_cb_this_state].where, 0)) {
  5863. info_cb_failed = 1;
  5864. return;
  5865. }
  5866. /* Now check we're in the right state */
  5867. if (!TEST_true((where & state[info_cb_this_state].where) != 0)) {
  5868. info_cb_failed = 1;
  5869. return;
  5870. }
  5871. if ((where & SSL_CB_LOOP) != 0
  5872. && !TEST_int_eq(strcmp(SSL_state_string(s),
  5873. state[info_cb_this_state].statestr), 0)) {
  5874. info_cb_failed = 1;
  5875. return;
  5876. }
  5877. /*
  5878. * Check that, if we've got SSL_CB_HANDSHAKE_DONE we are not in init
  5879. */
  5880. if ((where & SSL_CB_HANDSHAKE_DONE)
  5881. && SSL_in_init((SSL *)s) != 0) {
  5882. info_cb_failed = 1;
  5883. return;
  5884. }
  5885. }
  5886. /*
  5887. * Test the info callback gets called when we expect it to.
  5888. *
  5889. * Test 0: TLSv1.2, server
  5890. * Test 1: TLSv1.2, client
  5891. * Test 2: TLSv1.3, server
  5892. * Test 3: TLSv1.3, client
  5893. * Test 4: TLSv1.3, server, early_data
  5894. * Test 5: TLSv1.3, client, early_data
  5895. */
  5896. static int test_info_callback(int tst)
  5897. {
  5898. SSL_CTX *cctx = NULL, *sctx = NULL;
  5899. SSL *clientssl = NULL, *serverssl = NULL;
  5900. SSL_SESSION *clntsess = NULL;
  5901. int testresult = 0;
  5902. int tlsvers;
  5903. if (tst < 2) {
  5904. /* We need either ECDHE or DHE for the TLSv1.2 test to work */
  5905. #if !defined(OPENSSL_NO_TLS1_2) && (!defined(OPENSSL_NO_EC) \
  5906. || !defined(OPENSSL_NO_DH))
  5907. tlsvers = TLS1_2_VERSION;
  5908. #else
  5909. return 1;
  5910. #endif
  5911. } else {
  5912. #ifndef OSSL_NO_USABLE_TLS1_3
  5913. tlsvers = TLS1_3_VERSION;
  5914. #else
  5915. return 1;
  5916. #endif
  5917. }
  5918. /* Reset globals */
  5919. info_cb_failed = 0;
  5920. info_cb_this_state = -1;
  5921. info_cb_offset = tst;
  5922. #ifndef OSSL_NO_USABLE_TLS1_3
  5923. if (tst >= 4) {
  5924. SSL_SESSION *sess = NULL;
  5925. size_t written, readbytes;
  5926. unsigned char buf[80];
  5927. /* early_data tests */
  5928. if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
  5929. &serverssl, &sess, 0)))
  5930. goto end;
  5931. /* We don't actually need this reference */
  5932. SSL_SESSION_free(sess);
  5933. SSL_set_info_callback((tst % 2) == 0 ? serverssl : clientssl,
  5934. sslapi_info_callback);
  5935. /* Write and read some early data and then complete the connection */
  5936. if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
  5937. &written))
  5938. || !TEST_size_t_eq(written, strlen(MSG1))
  5939. || !TEST_int_eq(SSL_read_early_data(serverssl, buf,
  5940. sizeof(buf), &readbytes),
  5941. SSL_READ_EARLY_DATA_SUCCESS)
  5942. || !TEST_mem_eq(MSG1, readbytes, buf, strlen(MSG1))
  5943. || !TEST_int_eq(SSL_get_early_data_status(serverssl),
  5944. SSL_EARLY_DATA_ACCEPTED)
  5945. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5946. SSL_ERROR_NONE))
  5947. || !TEST_false(info_cb_failed))
  5948. goto end;
  5949. testresult = 1;
  5950. goto end;
  5951. }
  5952. #endif
  5953. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  5954. TLS_client_method(),
  5955. tlsvers, tlsvers, &sctx, &cctx, cert,
  5956. privkey)))
  5957. goto end;
  5958. if (!TEST_true(SSL_CTX_set_dh_auto(sctx, 1)))
  5959. goto end;
  5960. /*
  5961. * For even numbered tests we check the server callbacks. For odd numbers we
  5962. * check the client.
  5963. */
  5964. SSL_CTX_set_info_callback((tst % 2) == 0 ? sctx : cctx,
  5965. sslapi_info_callback);
  5966. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  5967. &clientssl, NULL, NULL))
  5968. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5969. SSL_ERROR_NONE))
  5970. || !TEST_false(info_cb_failed))
  5971. goto end;
  5972. clntsess = SSL_get1_session(clientssl);
  5973. SSL_shutdown(clientssl);
  5974. SSL_shutdown(serverssl);
  5975. SSL_free(serverssl);
  5976. SSL_free(clientssl);
  5977. serverssl = clientssl = NULL;
  5978. /* Now do a resumption */
  5979. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
  5980. NULL))
  5981. || !TEST_true(SSL_set_session(clientssl, clntsess))
  5982. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  5983. SSL_ERROR_NONE))
  5984. || !TEST_true(SSL_session_reused(clientssl))
  5985. || !TEST_false(info_cb_failed))
  5986. goto end;
  5987. testresult = 1;
  5988. end:
  5989. SSL_free(serverssl);
  5990. SSL_free(clientssl);
  5991. SSL_SESSION_free(clntsess);
  5992. SSL_CTX_free(sctx);
  5993. SSL_CTX_free(cctx);
  5994. return testresult;
  5995. }
  5996. static int test_ssl_pending(int tst)
  5997. {
  5998. SSL_CTX *cctx = NULL, *sctx = NULL;
  5999. SSL *clientssl = NULL, *serverssl = NULL;
  6000. int testresult = 0;
  6001. char msg[] = "A test message";
  6002. char buf[5];
  6003. size_t written, readbytes;
  6004. if (tst == 0) {
  6005. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6006. TLS_client_method(),
  6007. TLS1_VERSION, 0,
  6008. &sctx, &cctx, cert, privkey)))
  6009. goto end;
  6010. } else {
  6011. #ifndef OPENSSL_NO_DTLS
  6012. if (!TEST_true(create_ssl_ctx_pair(libctx, DTLS_server_method(),
  6013. DTLS_client_method(),
  6014. DTLS1_VERSION, 0,
  6015. &sctx, &cctx, cert, privkey)))
  6016. goto end;
  6017. # ifdef OPENSSL_NO_DTLS1_2
  6018. /* Not supported in the FIPS provider */
  6019. if (is_fips) {
  6020. testresult = 1;
  6021. goto end;
  6022. };
  6023. /*
  6024. * Default sigalgs are SHA1 based in <DTLS1.2 which is in security
  6025. * level 0
  6026. */
  6027. if (!TEST_true(SSL_CTX_set_cipher_list(sctx, "DEFAULT:@SECLEVEL=0"))
  6028. || !TEST_true(SSL_CTX_set_cipher_list(cctx,
  6029. "DEFAULT:@SECLEVEL=0")))
  6030. goto end;
  6031. # endif
  6032. #else
  6033. return 1;
  6034. #endif
  6035. }
  6036. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  6037. NULL, NULL))
  6038. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  6039. SSL_ERROR_NONE)))
  6040. goto end;
  6041. if (!TEST_int_eq(SSL_pending(clientssl), 0)
  6042. || !TEST_false(SSL_has_pending(clientssl))
  6043. || !TEST_int_eq(SSL_pending(serverssl), 0)
  6044. || !TEST_false(SSL_has_pending(serverssl))
  6045. || !TEST_true(SSL_write_ex(serverssl, msg, sizeof(msg), &written))
  6046. || !TEST_size_t_eq(written, sizeof(msg))
  6047. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
  6048. || !TEST_size_t_eq(readbytes, sizeof(buf))
  6049. || !TEST_int_eq(SSL_pending(clientssl), (int)(written - readbytes))
  6050. || !TEST_true(SSL_has_pending(clientssl)))
  6051. goto end;
  6052. testresult = 1;
  6053. end:
  6054. SSL_free(serverssl);
  6055. SSL_free(clientssl);
  6056. SSL_CTX_free(sctx);
  6057. SSL_CTX_free(cctx);
  6058. return testresult;
  6059. }
  6060. static struct {
  6061. unsigned int maxprot;
  6062. const char *clntciphers;
  6063. const char *clnttls13ciphers;
  6064. const char *srvrciphers;
  6065. const char *srvrtls13ciphers;
  6066. const char *shared;
  6067. const char *fipsshared;
  6068. } shared_ciphers_data[] = {
  6069. /*
  6070. * We can't establish a connection (even in TLSv1.1) with these ciphersuites if
  6071. * TLSv1.3 is enabled but TLSv1.2 is disabled.
  6072. */
  6073. #if defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
  6074. {
  6075. TLS1_2_VERSION,
  6076. "AES128-SHA:AES256-SHA",
  6077. NULL,
  6078. "AES256-SHA:DHE-RSA-AES128-SHA",
  6079. NULL,
  6080. "AES256-SHA",
  6081. "AES256-SHA"
  6082. },
  6083. # if !defined(OPENSSL_NO_CHACHA) \
  6084. && !defined(OPENSSL_NO_POLY1305) \
  6085. && !defined(OPENSSL_NO_EC)
  6086. {
  6087. TLS1_2_VERSION,
  6088. "AES128-SHA:ECDHE-RSA-CHACHA20-POLY1305",
  6089. NULL,
  6090. "AES128-SHA:ECDHE-RSA-CHACHA20-POLY1305",
  6091. NULL,
  6092. "AES128-SHA:ECDHE-RSA-CHACHA20-POLY1305",
  6093. "AES128-SHA"
  6094. },
  6095. # endif
  6096. {
  6097. TLS1_2_VERSION,
  6098. "AES128-SHA:DHE-RSA-AES128-SHA:AES256-SHA",
  6099. NULL,
  6100. "AES128-SHA:DHE-RSA-AES256-SHA:AES256-SHA",
  6101. NULL,
  6102. "AES128-SHA:AES256-SHA",
  6103. "AES128-SHA:AES256-SHA"
  6104. },
  6105. {
  6106. TLS1_2_VERSION,
  6107. "AES128-SHA:AES256-SHA",
  6108. NULL,
  6109. "AES128-SHA:DHE-RSA-AES128-SHA",
  6110. NULL,
  6111. "AES128-SHA",
  6112. "AES128-SHA"
  6113. },
  6114. #endif
  6115. /*
  6116. * This test combines TLSv1.3 and TLSv1.2 ciphersuites so they must both be
  6117. * enabled.
  6118. */
  6119. #if !defined(OSSL_NO_USABLE_TLS1_3) && !defined(OPENSSL_NO_TLS1_2) \
  6120. && !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
  6121. {
  6122. TLS1_3_VERSION,
  6123. "AES128-SHA:AES256-SHA",
  6124. NULL,
  6125. "AES256-SHA:AES128-SHA256",
  6126. NULL,
  6127. "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:"
  6128. "TLS_AES_128_GCM_SHA256:AES256-SHA",
  6129. "TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:AES256-SHA"
  6130. },
  6131. #endif
  6132. #ifndef OSSL_NO_USABLE_TLS1_3
  6133. {
  6134. TLS1_3_VERSION,
  6135. "AES128-SHA",
  6136. "TLS_AES_256_GCM_SHA384",
  6137. "AES256-SHA",
  6138. "TLS_AES_256_GCM_SHA384",
  6139. "TLS_AES_256_GCM_SHA384",
  6140. "TLS_AES_256_GCM_SHA384"
  6141. },
  6142. #endif
  6143. };
  6144. static int int_test_ssl_get_shared_ciphers(int tst, int clnt)
  6145. {
  6146. SSL_CTX *cctx = NULL, *sctx = NULL;
  6147. SSL *clientssl = NULL, *serverssl = NULL;
  6148. int testresult = 0;
  6149. char buf[1024];
  6150. OSSL_LIB_CTX *tmplibctx = OSSL_LIB_CTX_new();
  6151. if (!TEST_ptr(tmplibctx))
  6152. goto end;
  6153. /*
  6154. * Regardless of whether we're testing with the FIPS provider loaded into
  6155. * libctx, we want one peer to always use the full set of ciphersuites
  6156. * available. Therefore we use a separate libctx with the default provider
  6157. * loaded into it. We run the same tests twice - once with the client side
  6158. * having the full set of ciphersuites and once with the server side.
  6159. */
  6160. if (clnt) {
  6161. cctx = SSL_CTX_new_ex(tmplibctx, NULL, TLS_client_method());
  6162. if (!TEST_ptr(cctx))
  6163. goto end;
  6164. } else {
  6165. sctx = SSL_CTX_new_ex(tmplibctx, NULL, TLS_server_method());
  6166. if (!TEST_ptr(sctx))
  6167. goto end;
  6168. }
  6169. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6170. TLS_client_method(),
  6171. TLS1_VERSION,
  6172. shared_ciphers_data[tst].maxprot,
  6173. &sctx, &cctx, cert, privkey)))
  6174. goto end;
  6175. if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
  6176. shared_ciphers_data[tst].clntciphers))
  6177. || (shared_ciphers_data[tst].clnttls13ciphers != NULL
  6178. && !TEST_true(SSL_CTX_set_ciphersuites(cctx,
  6179. shared_ciphers_data[tst].clnttls13ciphers)))
  6180. || !TEST_true(SSL_CTX_set_cipher_list(sctx,
  6181. shared_ciphers_data[tst].srvrciphers))
  6182. || (shared_ciphers_data[tst].srvrtls13ciphers != NULL
  6183. && !TEST_true(SSL_CTX_set_ciphersuites(sctx,
  6184. shared_ciphers_data[tst].srvrtls13ciphers))))
  6185. goto end;
  6186. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  6187. NULL, NULL))
  6188. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  6189. SSL_ERROR_NONE)))
  6190. goto end;
  6191. if (!TEST_ptr(SSL_get_shared_ciphers(serverssl, buf, sizeof(buf)))
  6192. || !TEST_int_eq(strcmp(buf,
  6193. is_fips
  6194. ? shared_ciphers_data[tst].fipsshared
  6195. : shared_ciphers_data[tst].shared),
  6196. 0)) {
  6197. TEST_info("Shared ciphers are: %s\n", buf);
  6198. goto end;
  6199. }
  6200. testresult = 1;
  6201. end:
  6202. SSL_free(serverssl);
  6203. SSL_free(clientssl);
  6204. SSL_CTX_free(sctx);
  6205. SSL_CTX_free(cctx);
  6206. OSSL_LIB_CTX_free(tmplibctx);
  6207. return testresult;
  6208. }
  6209. static int test_ssl_get_shared_ciphers(int tst)
  6210. {
  6211. return int_test_ssl_get_shared_ciphers(tst, 0)
  6212. && int_test_ssl_get_shared_ciphers(tst, 1);
  6213. }
  6214. static const char *appdata = "Hello World";
  6215. static int gen_tick_called, dec_tick_called, tick_key_cb_called;
  6216. static int tick_key_renew = 0;
  6217. static SSL_TICKET_RETURN tick_dec_ret = SSL_TICKET_RETURN_ABORT;
  6218. static int gen_tick_cb(SSL *s, void *arg)
  6219. {
  6220. gen_tick_called = 1;
  6221. return SSL_SESSION_set1_ticket_appdata(SSL_get_session(s), appdata,
  6222. strlen(appdata));
  6223. }
  6224. static SSL_TICKET_RETURN dec_tick_cb(SSL *s, SSL_SESSION *ss,
  6225. const unsigned char *keyname,
  6226. size_t keyname_length,
  6227. SSL_TICKET_STATUS status,
  6228. void *arg)
  6229. {
  6230. void *tickdata;
  6231. size_t tickdlen;
  6232. dec_tick_called = 1;
  6233. if (status == SSL_TICKET_EMPTY)
  6234. return SSL_TICKET_RETURN_IGNORE_RENEW;
  6235. if (!TEST_true(status == SSL_TICKET_SUCCESS
  6236. || status == SSL_TICKET_SUCCESS_RENEW))
  6237. return SSL_TICKET_RETURN_ABORT;
  6238. if (!TEST_true(SSL_SESSION_get0_ticket_appdata(ss, &tickdata,
  6239. &tickdlen))
  6240. || !TEST_size_t_eq(tickdlen, strlen(appdata))
  6241. || !TEST_int_eq(memcmp(tickdata, appdata, tickdlen), 0))
  6242. return SSL_TICKET_RETURN_ABORT;
  6243. if (tick_key_cb_called) {
  6244. /* Don't change what the ticket key callback wanted to do */
  6245. switch (status) {
  6246. case SSL_TICKET_NO_DECRYPT:
  6247. return SSL_TICKET_RETURN_IGNORE_RENEW;
  6248. case SSL_TICKET_SUCCESS:
  6249. return SSL_TICKET_RETURN_USE;
  6250. case SSL_TICKET_SUCCESS_RENEW:
  6251. return SSL_TICKET_RETURN_USE_RENEW;
  6252. default:
  6253. return SSL_TICKET_RETURN_ABORT;
  6254. }
  6255. }
  6256. return tick_dec_ret;
  6257. }
  6258. #ifndef OPENSSL_NO_DEPRECATED_3_0
  6259. static int tick_key_cb(SSL *s, unsigned char key_name[16],
  6260. unsigned char iv[EVP_MAX_IV_LENGTH], EVP_CIPHER_CTX *ctx,
  6261. HMAC_CTX *hctx, int enc)
  6262. {
  6263. const unsigned char tick_aes_key[16] = "0123456789abcdef";
  6264. const unsigned char tick_hmac_key[16] = "0123456789abcdef";
  6265. EVP_CIPHER *aes128cbc = EVP_CIPHER_fetch(libctx, "AES-128-CBC", NULL);
  6266. EVP_MD *sha256 = EVP_MD_fetch(libctx, "SHA-256", NULL);
  6267. int ret;
  6268. tick_key_cb_called = 1;
  6269. memset(iv, 0, AES_BLOCK_SIZE);
  6270. memset(key_name, 0, 16);
  6271. if (aes128cbc == NULL
  6272. || sha256 == NULL
  6273. || !EVP_CipherInit_ex(ctx, aes128cbc, NULL, tick_aes_key, iv, enc)
  6274. || !HMAC_Init_ex(hctx, tick_hmac_key, sizeof(tick_hmac_key), sha256,
  6275. NULL))
  6276. ret = -1;
  6277. else
  6278. ret = tick_key_renew ? 2 : 1;
  6279. EVP_CIPHER_free(aes128cbc);
  6280. EVP_MD_free(sha256);
  6281. return ret;
  6282. }
  6283. #endif
  6284. static int tick_key_evp_cb(SSL *s, unsigned char key_name[16],
  6285. unsigned char iv[EVP_MAX_IV_LENGTH],
  6286. EVP_CIPHER_CTX *ctx, EVP_MAC_CTX *hctx, int enc)
  6287. {
  6288. const unsigned char tick_aes_key[16] = "0123456789abcdef";
  6289. unsigned char tick_hmac_key[16] = "0123456789abcdef";
  6290. OSSL_PARAM params[2];
  6291. EVP_CIPHER *aes128cbc = EVP_CIPHER_fetch(libctx, "AES-128-CBC", NULL);
  6292. int ret;
  6293. tick_key_cb_called = 1;
  6294. memset(iv, 0, AES_BLOCK_SIZE);
  6295. memset(key_name, 0, 16);
  6296. params[0] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
  6297. "SHA256", 0);
  6298. params[1] = OSSL_PARAM_construct_end();
  6299. if (aes128cbc == NULL
  6300. || !EVP_CipherInit_ex(ctx, aes128cbc, NULL, tick_aes_key, iv, enc)
  6301. || !EVP_MAC_init(hctx, tick_hmac_key, sizeof(tick_hmac_key),
  6302. params))
  6303. ret = -1;
  6304. else
  6305. ret = tick_key_renew ? 2 : 1;
  6306. EVP_CIPHER_free(aes128cbc);
  6307. return ret;
  6308. }
  6309. /*
  6310. * Test the various ticket callbacks
  6311. * Test 0: TLSv1.2, no ticket key callback, no ticket, no renewal
  6312. * Test 1: TLSv1.3, no ticket key callback, no ticket, no renewal
  6313. * Test 2: TLSv1.2, no ticket key callback, no ticket, renewal
  6314. * Test 3: TLSv1.3, no ticket key callback, no ticket, renewal
  6315. * Test 4: TLSv1.2, no ticket key callback, ticket, no renewal
  6316. * Test 5: TLSv1.3, no ticket key callback, ticket, no renewal
  6317. * Test 6: TLSv1.2, no ticket key callback, ticket, renewal
  6318. * Test 7: TLSv1.3, no ticket key callback, ticket, renewal
  6319. * Test 8: TLSv1.2, old ticket key callback, ticket, no renewal
  6320. * Test 9: TLSv1.3, old ticket key callback, ticket, no renewal
  6321. * Test 10: TLSv1.2, old ticket key callback, ticket, renewal
  6322. * Test 11: TLSv1.3, old ticket key callback, ticket, renewal
  6323. * Test 12: TLSv1.2, ticket key callback, ticket, no renewal
  6324. * Test 13: TLSv1.3, ticket key callback, ticket, no renewal
  6325. * Test 14: TLSv1.2, ticket key callback, ticket, renewal
  6326. * Test 15: TLSv1.3, ticket key callback, ticket, renewal
  6327. */
  6328. static int test_ticket_callbacks(int tst)
  6329. {
  6330. SSL_CTX *cctx = NULL, *sctx = NULL;
  6331. SSL *clientssl = NULL, *serverssl = NULL;
  6332. SSL_SESSION *clntsess = NULL;
  6333. int testresult = 0;
  6334. #ifdef OPENSSL_NO_TLS1_2
  6335. if (tst % 2 == 0)
  6336. return 1;
  6337. #endif
  6338. #ifdef OSSL_NO_USABLE_TLS1_3
  6339. if (tst % 2 == 1)
  6340. return 1;
  6341. #endif
  6342. #ifdef OPENSSL_NO_DEPRECATED_3_0
  6343. if (tst >= 8 && tst <= 11)
  6344. return 1;
  6345. #endif
  6346. gen_tick_called = dec_tick_called = tick_key_cb_called = 0;
  6347. /* Which tests the ticket key callback should request renewal for */
  6348. if (tst == 10 || tst == 11 || tst == 14 || tst == 15)
  6349. tick_key_renew = 1;
  6350. else
  6351. tick_key_renew = 0;
  6352. /* Which tests the decrypt ticket callback should request renewal for */
  6353. switch (tst) {
  6354. case 0:
  6355. case 1:
  6356. tick_dec_ret = SSL_TICKET_RETURN_IGNORE;
  6357. break;
  6358. case 2:
  6359. case 3:
  6360. tick_dec_ret = SSL_TICKET_RETURN_IGNORE_RENEW;
  6361. break;
  6362. case 4:
  6363. case 5:
  6364. tick_dec_ret = SSL_TICKET_RETURN_USE;
  6365. break;
  6366. case 6:
  6367. case 7:
  6368. tick_dec_ret = SSL_TICKET_RETURN_USE_RENEW;
  6369. break;
  6370. default:
  6371. tick_dec_ret = SSL_TICKET_RETURN_ABORT;
  6372. }
  6373. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6374. TLS_client_method(),
  6375. TLS1_VERSION,
  6376. ((tst % 2) == 0) ? TLS1_2_VERSION
  6377. : TLS1_3_VERSION,
  6378. &sctx, &cctx, cert, privkey)))
  6379. goto end;
  6380. /*
  6381. * We only want sessions to resume from tickets - not the session cache. So
  6382. * switch the cache off.
  6383. */
  6384. if (!TEST_true(SSL_CTX_set_session_cache_mode(sctx, SSL_SESS_CACHE_OFF)))
  6385. goto end;
  6386. if (!TEST_true(SSL_CTX_set_session_ticket_cb(sctx, gen_tick_cb, dec_tick_cb,
  6387. NULL)))
  6388. goto end;
  6389. if (tst >= 12) {
  6390. if (!TEST_true(SSL_CTX_set_tlsext_ticket_key_evp_cb(sctx, tick_key_evp_cb)))
  6391. goto end;
  6392. #ifndef OPENSSL_NO_DEPRECATED_3_0
  6393. } else if (tst >= 8) {
  6394. if (!TEST_true(SSL_CTX_set_tlsext_ticket_key_cb(sctx, tick_key_cb)))
  6395. goto end;
  6396. #endif
  6397. }
  6398. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  6399. NULL, NULL))
  6400. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  6401. SSL_ERROR_NONE)))
  6402. goto end;
  6403. /*
  6404. * The decrypt ticket key callback in TLSv1.2 should be called even though
  6405. * we have no ticket yet, because it gets called with a status of
  6406. * SSL_TICKET_EMPTY (the client indicates support for tickets but does not
  6407. * actually send any ticket data). This does not happen in TLSv1.3 because
  6408. * it is not valid to send empty ticket data in TLSv1.3.
  6409. */
  6410. if (!TEST_int_eq(gen_tick_called, 1)
  6411. || !TEST_int_eq(dec_tick_called, ((tst % 2) == 0) ? 1 : 0))
  6412. goto end;
  6413. gen_tick_called = dec_tick_called = 0;
  6414. clntsess = SSL_get1_session(clientssl);
  6415. SSL_shutdown(clientssl);
  6416. SSL_shutdown(serverssl);
  6417. SSL_free(serverssl);
  6418. SSL_free(clientssl);
  6419. serverssl = clientssl = NULL;
  6420. /* Now do a resumption */
  6421. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
  6422. NULL))
  6423. || !TEST_true(SSL_set_session(clientssl, clntsess))
  6424. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  6425. SSL_ERROR_NONE)))
  6426. goto end;
  6427. if (tick_dec_ret == SSL_TICKET_RETURN_IGNORE
  6428. || tick_dec_ret == SSL_TICKET_RETURN_IGNORE_RENEW) {
  6429. if (!TEST_false(SSL_session_reused(clientssl)))
  6430. goto end;
  6431. } else {
  6432. if (!TEST_true(SSL_session_reused(clientssl)))
  6433. goto end;
  6434. }
  6435. if (!TEST_int_eq(gen_tick_called,
  6436. (tick_key_renew
  6437. || tick_dec_ret == SSL_TICKET_RETURN_IGNORE_RENEW
  6438. || tick_dec_ret == SSL_TICKET_RETURN_USE_RENEW)
  6439. ? 1 : 0)
  6440. || !TEST_int_eq(dec_tick_called, 1))
  6441. goto end;
  6442. testresult = 1;
  6443. end:
  6444. SSL_SESSION_free(clntsess);
  6445. SSL_free(serverssl);
  6446. SSL_free(clientssl);
  6447. SSL_CTX_free(sctx);
  6448. SSL_CTX_free(cctx);
  6449. return testresult;
  6450. }
  6451. /*
  6452. * Test incorrect shutdown.
  6453. * Test 0: client does not shutdown properly,
  6454. * server does not set SSL_OP_IGNORE_UNEXPECTED_EOF,
  6455. * server should get SSL_ERROR_SSL
  6456. * Test 1: client does not shutdown properly,
  6457. * server sets SSL_OP_IGNORE_UNEXPECTED_EOF,
  6458. * server should get SSL_ERROR_ZERO_RETURN
  6459. */
  6460. static int test_incorrect_shutdown(int tst)
  6461. {
  6462. SSL_CTX *cctx = NULL, *sctx = NULL;
  6463. SSL *clientssl = NULL, *serverssl = NULL;
  6464. int testresult = 0;
  6465. char buf[80];
  6466. BIO *c2s;
  6467. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6468. TLS_client_method(), 0, 0,
  6469. &sctx, &cctx, cert, privkey)))
  6470. goto end;
  6471. if (tst == 1)
  6472. SSL_CTX_set_options(sctx, SSL_OP_IGNORE_UNEXPECTED_EOF);
  6473. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  6474. NULL, NULL)))
  6475. goto end;
  6476. if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  6477. SSL_ERROR_NONE)))
  6478. goto end;
  6479. c2s = SSL_get_rbio(serverssl);
  6480. BIO_set_mem_eof_return(c2s, 0);
  6481. if (!TEST_false(SSL_read(serverssl, buf, sizeof(buf))))
  6482. goto end;
  6483. if (tst == 0 && !TEST_int_eq(SSL_get_error(serverssl, 0), SSL_ERROR_SSL) )
  6484. goto end;
  6485. if (tst == 1 && !TEST_int_eq(SSL_get_error(serverssl, 0), SSL_ERROR_ZERO_RETURN) )
  6486. goto end;
  6487. testresult = 1;
  6488. end:
  6489. SSL_free(serverssl);
  6490. SSL_free(clientssl);
  6491. SSL_CTX_free(sctx);
  6492. SSL_CTX_free(cctx);
  6493. return testresult;
  6494. }
  6495. /*
  6496. * Test bi-directional shutdown.
  6497. * Test 0: TLSv1.2
  6498. * Test 1: TLSv1.2, server continues to read/write after client shutdown
  6499. * Test 2: TLSv1.3, no pending NewSessionTicket messages
  6500. * Test 3: TLSv1.3, pending NewSessionTicket messages
  6501. * Test 4: TLSv1.3, server continues to read/write after client shutdown, server
  6502. * sends key update, client reads it
  6503. * Test 5: TLSv1.3, server continues to read/write after client shutdown, server
  6504. * sends CertificateRequest, client reads and ignores it
  6505. * Test 6: TLSv1.3, server continues to read/write after client shutdown, client
  6506. * doesn't read it
  6507. */
  6508. static int test_shutdown(int tst)
  6509. {
  6510. SSL_CTX *cctx = NULL, *sctx = NULL;
  6511. SSL *clientssl = NULL, *serverssl = NULL;
  6512. int testresult = 0;
  6513. char msg[] = "A test message";
  6514. char buf[80];
  6515. size_t written, readbytes;
  6516. SSL_SESSION *sess;
  6517. #ifdef OPENSSL_NO_TLS1_2
  6518. if (tst <= 1)
  6519. return 1;
  6520. #endif
  6521. #ifdef OSSL_NO_USABLE_TLS1_3
  6522. if (tst >= 2)
  6523. return 1;
  6524. #endif
  6525. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6526. TLS_client_method(),
  6527. TLS1_VERSION,
  6528. (tst <= 1) ? TLS1_2_VERSION
  6529. : TLS1_3_VERSION,
  6530. &sctx, &cctx, cert, privkey)))
  6531. goto end;
  6532. if (tst == 5)
  6533. SSL_CTX_set_post_handshake_auth(cctx, 1);
  6534. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  6535. NULL, NULL)))
  6536. goto end;
  6537. if (tst == 3) {
  6538. if (!TEST_true(create_bare_ssl_connection(serverssl, clientssl,
  6539. SSL_ERROR_NONE, 1))
  6540. || !TEST_ptr_ne(sess = SSL_get_session(clientssl), NULL)
  6541. || !TEST_false(SSL_SESSION_is_resumable(sess)))
  6542. goto end;
  6543. } else if (!TEST_true(create_ssl_connection(serverssl, clientssl,
  6544. SSL_ERROR_NONE))
  6545. || !TEST_ptr_ne(sess = SSL_get_session(clientssl), NULL)
  6546. || !TEST_true(SSL_SESSION_is_resumable(sess))) {
  6547. goto end;
  6548. }
  6549. if (!TEST_int_eq(SSL_shutdown(clientssl), 0))
  6550. goto end;
  6551. if (tst >= 4) {
  6552. /*
  6553. * Reading on the server after the client has sent close_notify should
  6554. * fail and provide SSL_ERROR_ZERO_RETURN
  6555. */
  6556. if (!TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
  6557. || !TEST_int_eq(SSL_get_error(serverssl, 0),
  6558. SSL_ERROR_ZERO_RETURN)
  6559. || !TEST_int_eq(SSL_get_shutdown(serverssl),
  6560. SSL_RECEIVED_SHUTDOWN)
  6561. /*
  6562. * Even though we're shutdown on receive we should still be
  6563. * able to write.
  6564. */
  6565. || !TEST_true(SSL_write(serverssl, msg, sizeof(msg))))
  6566. goto end;
  6567. if (tst == 4
  6568. && !TEST_true(SSL_key_update(serverssl,
  6569. SSL_KEY_UPDATE_REQUESTED)))
  6570. goto end;
  6571. if (tst == 5) {
  6572. SSL_set_verify(serverssl, SSL_VERIFY_PEER, NULL);
  6573. if (!TEST_true(SSL_verify_client_post_handshake(serverssl)))
  6574. goto end;
  6575. }
  6576. if ((tst == 4 || tst == 5)
  6577. && !TEST_true(SSL_write(serverssl, msg, sizeof(msg))))
  6578. goto end;
  6579. if (!TEST_int_eq(SSL_shutdown(serverssl), 1))
  6580. goto end;
  6581. if (tst == 4 || tst == 5) {
  6582. /* Should still be able to read data from server */
  6583. if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf),
  6584. &readbytes))
  6585. || !TEST_size_t_eq(readbytes, sizeof(msg))
  6586. || !TEST_int_eq(memcmp(msg, buf, readbytes), 0)
  6587. || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf),
  6588. &readbytes))
  6589. || !TEST_size_t_eq(readbytes, sizeof(msg))
  6590. || !TEST_int_eq(memcmp(msg, buf, readbytes), 0))
  6591. goto end;
  6592. }
  6593. }
  6594. /* Writing on the client after sending close_notify shouldn't be possible */
  6595. if (!TEST_false(SSL_write_ex(clientssl, msg, sizeof(msg), &written)))
  6596. goto end;
  6597. if (tst < 4) {
  6598. /*
  6599. * For these tests the client has sent close_notify but it has not yet
  6600. * been received by the server. The server has not sent close_notify
  6601. * yet.
  6602. */
  6603. if (!TEST_int_eq(SSL_shutdown(serverssl), 0)
  6604. /*
  6605. * Writing on the server after sending close_notify shouldn't
  6606. * be possible.
  6607. */
  6608. || !TEST_false(SSL_write_ex(serverssl, msg, sizeof(msg), &written))
  6609. || !TEST_int_eq(SSL_shutdown(clientssl), 1)
  6610. || !TEST_ptr_ne(sess = SSL_get_session(clientssl), NULL)
  6611. || !TEST_true(SSL_SESSION_is_resumable(sess))
  6612. || !TEST_int_eq(SSL_shutdown(serverssl), 1))
  6613. goto end;
  6614. } else if (tst == 4 || tst == 5) {
  6615. /*
  6616. * In this test the client has sent close_notify and it has been
  6617. * received by the server which has responded with a close_notify. The
  6618. * client needs to read the close_notify sent by the server.
  6619. */
  6620. if (!TEST_int_eq(SSL_shutdown(clientssl), 1)
  6621. || !TEST_ptr_ne(sess = SSL_get_session(clientssl), NULL)
  6622. || !TEST_true(SSL_SESSION_is_resumable(sess)))
  6623. goto end;
  6624. } else {
  6625. /*
  6626. * tst == 6
  6627. *
  6628. * The client has sent close_notify and is expecting a close_notify
  6629. * back, but instead there is application data first. The shutdown
  6630. * should fail with a fatal error.
  6631. */
  6632. if (!TEST_int_eq(SSL_shutdown(clientssl), -1)
  6633. || !TEST_int_eq(SSL_get_error(clientssl, -1), SSL_ERROR_SSL))
  6634. goto end;
  6635. }
  6636. testresult = 1;
  6637. end:
  6638. SSL_free(serverssl);
  6639. SSL_free(clientssl);
  6640. SSL_CTX_free(sctx);
  6641. SSL_CTX_free(cctx);
  6642. return testresult;
  6643. }
  6644. #if !defined(OPENSSL_NO_TLS1_2) || !defined(OSSL_NO_USABLE_TLS1_3)
  6645. static int cert_cb_cnt;
  6646. static int cert_cb(SSL *s, void *arg)
  6647. {
  6648. SSL_CTX *ctx = (SSL_CTX *)arg;
  6649. BIO *in = NULL;
  6650. EVP_PKEY *pkey = NULL;
  6651. X509 *x509 = NULL, *rootx = NULL;
  6652. STACK_OF(X509) *chain = NULL;
  6653. char *rootfile = NULL, *ecdsacert = NULL, *ecdsakey = NULL;
  6654. int ret = 0;
  6655. if (cert_cb_cnt == 0) {
  6656. /* Suspend the handshake */
  6657. cert_cb_cnt++;
  6658. return -1;
  6659. } else if (cert_cb_cnt == 1) {
  6660. /*
  6661. * Update the SSL_CTX, set the certificate and private key and then
  6662. * continue the handshake normally.
  6663. */
  6664. if (ctx != NULL && !TEST_ptr(SSL_set_SSL_CTX(s, ctx)))
  6665. return 0;
  6666. if (!TEST_true(SSL_use_certificate_file(s, cert, SSL_FILETYPE_PEM))
  6667. || !TEST_true(SSL_use_PrivateKey_file(s, privkey,
  6668. SSL_FILETYPE_PEM))
  6669. || !TEST_true(SSL_check_private_key(s)))
  6670. return 0;
  6671. cert_cb_cnt++;
  6672. return 1;
  6673. } else if (cert_cb_cnt == 3) {
  6674. int rv;
  6675. rootfile = test_mk_file_path(certsdir, "rootcert.pem");
  6676. ecdsacert = test_mk_file_path(certsdir, "server-ecdsa-cert.pem");
  6677. ecdsakey = test_mk_file_path(certsdir, "server-ecdsa-key.pem");
  6678. if (!TEST_ptr(rootfile) || !TEST_ptr(ecdsacert) || !TEST_ptr(ecdsakey))
  6679. goto out;
  6680. chain = sk_X509_new_null();
  6681. if (!TEST_ptr(chain))
  6682. goto out;
  6683. if (!TEST_ptr(in = BIO_new(BIO_s_file()))
  6684. || !TEST_int_ge(BIO_read_filename(in, rootfile), 0)
  6685. || !TEST_ptr(rootx = X509_new_ex(libctx, NULL))
  6686. || !TEST_ptr(PEM_read_bio_X509(in, &rootx, NULL, NULL))
  6687. || !TEST_true(sk_X509_push(chain, rootx)))
  6688. goto out;
  6689. rootx = NULL;
  6690. BIO_free(in);
  6691. if (!TEST_ptr(in = BIO_new(BIO_s_file()))
  6692. || !TEST_int_ge(BIO_read_filename(in, ecdsacert), 0)
  6693. || !TEST_ptr(x509 = X509_new_ex(libctx, NULL))
  6694. || !TEST_ptr(PEM_read_bio_X509(in, &x509, NULL, NULL)))
  6695. goto out;
  6696. BIO_free(in);
  6697. if (!TEST_ptr(in = BIO_new(BIO_s_file()))
  6698. || !TEST_int_ge(BIO_read_filename(in, ecdsakey), 0)
  6699. || !TEST_ptr(pkey = PEM_read_bio_PrivateKey_ex(in, NULL,
  6700. NULL, NULL,
  6701. libctx, NULL)))
  6702. goto out;
  6703. rv = SSL_check_chain(s, x509, pkey, chain);
  6704. /*
  6705. * If the cert doesn't show as valid here (e.g., because we don't
  6706. * have any shared sigalgs), then we will not set it, and there will
  6707. * be no certificate at all on the SSL or SSL_CTX. This, in turn,
  6708. * will cause tls_choose_sigalgs() to fail the connection.
  6709. */
  6710. if ((rv & (CERT_PKEY_VALID | CERT_PKEY_CA_SIGNATURE))
  6711. == (CERT_PKEY_VALID | CERT_PKEY_CA_SIGNATURE)) {
  6712. if (!SSL_use_cert_and_key(s, x509, pkey, NULL, 1))
  6713. goto out;
  6714. }
  6715. ret = 1;
  6716. }
  6717. /* Abort the handshake */
  6718. out:
  6719. OPENSSL_free(ecdsacert);
  6720. OPENSSL_free(ecdsakey);
  6721. OPENSSL_free(rootfile);
  6722. BIO_free(in);
  6723. EVP_PKEY_free(pkey);
  6724. X509_free(x509);
  6725. X509_free(rootx);
  6726. sk_X509_pop_free(chain, X509_free);
  6727. return ret;
  6728. }
  6729. /*
  6730. * Test the certificate callback.
  6731. * Test 0: Callback fails
  6732. * Test 1: Success - no SSL_set_SSL_CTX() in the callback
  6733. * Test 2: Success - SSL_set_SSL_CTX() in the callback
  6734. * Test 3: Success - Call SSL_check_chain from the callback
  6735. * Test 4: Failure - SSL_check_chain fails from callback due to bad cert in the
  6736. * chain
  6737. * Test 5: Failure - SSL_check_chain fails from callback due to bad ee cert
  6738. */
  6739. static int test_cert_cb_int(int prot, int tst)
  6740. {
  6741. SSL_CTX *cctx = NULL, *sctx = NULL, *snictx = NULL;
  6742. SSL *clientssl = NULL, *serverssl = NULL;
  6743. int testresult = 0, ret;
  6744. #ifdef OPENSSL_NO_EC
  6745. /* We use an EC cert in these tests, so we skip in a no-ec build */
  6746. if (tst >= 3)
  6747. return 1;
  6748. #endif
  6749. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6750. TLS_client_method(),
  6751. TLS1_VERSION,
  6752. prot,
  6753. &sctx, &cctx, NULL, NULL)))
  6754. goto end;
  6755. if (tst == 0)
  6756. cert_cb_cnt = -1;
  6757. else if (tst >= 3)
  6758. cert_cb_cnt = 3;
  6759. else
  6760. cert_cb_cnt = 0;
  6761. if (tst == 2)
  6762. snictx = SSL_CTX_new(TLS_server_method());
  6763. SSL_CTX_set_cert_cb(sctx, cert_cb, snictx);
  6764. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  6765. NULL, NULL)))
  6766. goto end;
  6767. if (tst == 4) {
  6768. /*
  6769. * We cause SSL_check_chain() to fail by specifying sig_algs that
  6770. * the chain doesn't meet (the root uses an RSA cert)
  6771. */
  6772. if (!TEST_true(SSL_set1_sigalgs_list(clientssl,
  6773. "ecdsa_secp256r1_sha256")))
  6774. goto end;
  6775. } else if (tst == 5) {
  6776. /*
  6777. * We cause SSL_check_chain() to fail by specifying sig_algs that
  6778. * the ee cert doesn't meet (the ee uses an ECDSA cert)
  6779. */
  6780. if (!TEST_true(SSL_set1_sigalgs_list(clientssl,
  6781. "rsa_pss_rsae_sha256:rsa_pkcs1_sha256")))
  6782. goto end;
  6783. }
  6784. ret = create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE);
  6785. if (!TEST_true(tst == 0 || tst == 4 || tst == 5 ? !ret : ret)
  6786. || (tst > 0
  6787. && !TEST_int_eq((cert_cb_cnt - 2) * (cert_cb_cnt - 3), 0))) {
  6788. goto end;
  6789. }
  6790. testresult = 1;
  6791. end:
  6792. SSL_free(serverssl);
  6793. SSL_free(clientssl);
  6794. SSL_CTX_free(sctx);
  6795. SSL_CTX_free(cctx);
  6796. SSL_CTX_free(snictx);
  6797. return testresult;
  6798. }
  6799. #endif
  6800. static int test_cert_cb(int tst)
  6801. {
  6802. int testresult = 1;
  6803. #ifndef OPENSSL_NO_TLS1_2
  6804. testresult &= test_cert_cb_int(TLS1_2_VERSION, tst);
  6805. #endif
  6806. #ifndef OSSL_NO_USABLE_TLS1_3
  6807. testresult &= test_cert_cb_int(TLS1_3_VERSION, tst);
  6808. #endif
  6809. return testresult;
  6810. }
  6811. static int client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
  6812. {
  6813. X509 *xcert;
  6814. EVP_PKEY *privpkey;
  6815. BIO *in = NULL;
  6816. BIO *priv_in = NULL;
  6817. /* Check that SSL_get0_peer_certificate() returns something sensible */
  6818. if (!TEST_ptr(SSL_get0_peer_certificate(ssl)))
  6819. return 0;
  6820. in = BIO_new_file(cert, "r");
  6821. if (!TEST_ptr(in))
  6822. return 0;
  6823. if (!TEST_ptr(xcert = X509_new_ex(libctx, NULL))
  6824. || !TEST_ptr(PEM_read_bio_X509(in, &xcert, NULL, NULL))
  6825. || !TEST_ptr(priv_in = BIO_new_file(privkey, "r"))
  6826. || !TEST_ptr(privpkey = PEM_read_bio_PrivateKey_ex(priv_in, NULL,
  6827. NULL, NULL,
  6828. libctx, NULL)))
  6829. goto err;
  6830. *x509 = xcert;
  6831. *pkey = privpkey;
  6832. BIO_free(in);
  6833. BIO_free(priv_in);
  6834. return 1;
  6835. err:
  6836. X509_free(xcert);
  6837. BIO_free(in);
  6838. BIO_free(priv_in);
  6839. return 0;
  6840. }
  6841. static int verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
  6842. {
  6843. return 1;
  6844. }
  6845. static int test_client_cert_cb(int tst)
  6846. {
  6847. SSL_CTX *cctx = NULL, *sctx = NULL;
  6848. SSL *clientssl = NULL, *serverssl = NULL;
  6849. int testresult = 0;
  6850. #ifdef OPENSSL_NO_TLS1_2
  6851. if (tst == 0)
  6852. return 1;
  6853. #endif
  6854. #ifdef OSSL_NO_USABLE_TLS1_3
  6855. if (tst == 1)
  6856. return 1;
  6857. #endif
  6858. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6859. TLS_client_method(),
  6860. TLS1_VERSION,
  6861. tst == 0 ? TLS1_2_VERSION
  6862. : TLS1_3_VERSION,
  6863. &sctx, &cctx, cert, privkey)))
  6864. goto end;
  6865. /*
  6866. * Test that setting a client_cert_cb results in a client certificate being
  6867. * sent.
  6868. */
  6869. SSL_CTX_set_client_cert_cb(cctx, client_cert_cb);
  6870. SSL_CTX_set_verify(sctx,
  6871. SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
  6872. verify_cb);
  6873. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  6874. NULL, NULL))
  6875. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  6876. SSL_ERROR_NONE)))
  6877. goto end;
  6878. testresult = 1;
  6879. end:
  6880. SSL_free(serverssl);
  6881. SSL_free(clientssl);
  6882. SSL_CTX_free(sctx);
  6883. SSL_CTX_free(cctx);
  6884. return testresult;
  6885. }
  6886. #if !defined(OPENSSL_NO_TLS1_2) || !defined(OSSL_NO_USABLE_TLS1_3)
  6887. /*
  6888. * Test setting certificate authorities on both client and server.
  6889. *
  6890. * Test 0: SSL_CTX_set0_CA_list() only
  6891. * Test 1: Both SSL_CTX_set0_CA_list() and SSL_CTX_set_client_CA_list()
  6892. * Test 2: Only SSL_CTX_set_client_CA_list()
  6893. */
  6894. static int test_ca_names_int(int prot, int tst)
  6895. {
  6896. SSL_CTX *cctx = NULL, *sctx = NULL;
  6897. SSL *clientssl = NULL, *serverssl = NULL;
  6898. int testresult = 0;
  6899. size_t i;
  6900. X509_NAME *name[] = { NULL, NULL, NULL, NULL };
  6901. char *strnames[] = { "Jack", "Jill", "John", "Joanne" };
  6902. STACK_OF(X509_NAME) *sk1 = NULL, *sk2 = NULL;
  6903. const STACK_OF(X509_NAME) *sktmp = NULL;
  6904. for (i = 0; i < OSSL_NELEM(name); i++) {
  6905. name[i] = X509_NAME_new();
  6906. if (!TEST_ptr(name[i])
  6907. || !TEST_true(X509_NAME_add_entry_by_txt(name[i], "CN",
  6908. MBSTRING_ASC,
  6909. (unsigned char *)
  6910. strnames[i],
  6911. -1, -1, 0)))
  6912. goto end;
  6913. }
  6914. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  6915. TLS_client_method(),
  6916. TLS1_VERSION,
  6917. prot,
  6918. &sctx, &cctx, cert, privkey)))
  6919. goto end;
  6920. SSL_CTX_set_verify(sctx, SSL_VERIFY_PEER, NULL);
  6921. if (tst == 0 || tst == 1) {
  6922. if (!TEST_ptr(sk1 = sk_X509_NAME_new_null())
  6923. || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[0])))
  6924. || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[1])))
  6925. || !TEST_ptr(sk2 = sk_X509_NAME_new_null())
  6926. || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[0])))
  6927. || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[1]))))
  6928. goto end;
  6929. SSL_CTX_set0_CA_list(sctx, sk1);
  6930. SSL_CTX_set0_CA_list(cctx, sk2);
  6931. sk1 = sk2 = NULL;
  6932. }
  6933. if (tst == 1 || tst == 2) {
  6934. if (!TEST_ptr(sk1 = sk_X509_NAME_new_null())
  6935. || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[2])))
  6936. || !TEST_true(sk_X509_NAME_push(sk1, X509_NAME_dup(name[3])))
  6937. || !TEST_ptr(sk2 = sk_X509_NAME_new_null())
  6938. || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[2])))
  6939. || !TEST_true(sk_X509_NAME_push(sk2, X509_NAME_dup(name[3]))))
  6940. goto end;
  6941. SSL_CTX_set_client_CA_list(sctx, sk1);
  6942. SSL_CTX_set_client_CA_list(cctx, sk2);
  6943. sk1 = sk2 = NULL;
  6944. }
  6945. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  6946. NULL, NULL))
  6947. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  6948. SSL_ERROR_NONE)))
  6949. goto end;
  6950. /*
  6951. * We only expect certificate authorities to have been sent to the server
  6952. * if we are using TLSv1.3 and SSL_set0_CA_list() was used
  6953. */
  6954. sktmp = SSL_get0_peer_CA_list(serverssl);
  6955. if (prot == TLS1_3_VERSION
  6956. && (tst == 0 || tst == 1)) {
  6957. if (!TEST_ptr(sktmp)
  6958. || !TEST_int_eq(sk_X509_NAME_num(sktmp), 2)
  6959. || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 0),
  6960. name[0]), 0)
  6961. || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 1),
  6962. name[1]), 0))
  6963. goto end;
  6964. } else if (!TEST_ptr_null(sktmp)) {
  6965. goto end;
  6966. }
  6967. /*
  6968. * In all tests we expect certificate authorities to have been sent to the
  6969. * client. However, SSL_set_client_CA_list() should override
  6970. * SSL_set0_CA_list()
  6971. */
  6972. sktmp = SSL_get0_peer_CA_list(clientssl);
  6973. if (!TEST_ptr(sktmp)
  6974. || !TEST_int_eq(sk_X509_NAME_num(sktmp), 2)
  6975. || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 0),
  6976. name[tst == 0 ? 0 : 2]), 0)
  6977. || !TEST_int_eq(X509_NAME_cmp(sk_X509_NAME_value(sktmp, 1),
  6978. name[tst == 0 ? 1 : 3]), 0))
  6979. goto end;
  6980. testresult = 1;
  6981. end:
  6982. SSL_free(serverssl);
  6983. SSL_free(clientssl);
  6984. SSL_CTX_free(sctx);
  6985. SSL_CTX_free(cctx);
  6986. for (i = 0; i < OSSL_NELEM(name); i++)
  6987. X509_NAME_free(name[i]);
  6988. sk_X509_NAME_pop_free(sk1, X509_NAME_free);
  6989. sk_X509_NAME_pop_free(sk2, X509_NAME_free);
  6990. return testresult;
  6991. }
  6992. #endif
  6993. static int test_ca_names(int tst)
  6994. {
  6995. int testresult = 1;
  6996. #ifndef OPENSSL_NO_TLS1_2
  6997. testresult &= test_ca_names_int(TLS1_2_VERSION, tst);
  6998. #endif
  6999. #ifndef OSSL_NO_USABLE_TLS1_3
  7000. testresult &= test_ca_names_int(TLS1_3_VERSION, tst);
  7001. #endif
  7002. return testresult;
  7003. }
  7004. #ifndef OPENSSL_NO_TLS1_2
  7005. static const char *multiblock_cipherlist_data[]=
  7006. {
  7007. "AES128-SHA",
  7008. "AES128-SHA256",
  7009. "AES256-SHA",
  7010. "AES256-SHA256",
  7011. };
  7012. /* Reduce the fragment size - so the multiblock test buffer can be small */
  7013. # define MULTIBLOCK_FRAGSIZE 512
  7014. static int test_multiblock_write(int test_index)
  7015. {
  7016. static const char *fetchable_ciphers[]=
  7017. {
  7018. "AES-128-CBC-HMAC-SHA1",
  7019. "AES-128-CBC-HMAC-SHA256",
  7020. "AES-256-CBC-HMAC-SHA1",
  7021. "AES-256-CBC-HMAC-SHA256"
  7022. };
  7023. const char *cipherlist = multiblock_cipherlist_data[test_index];
  7024. const SSL_METHOD *smeth = TLS_server_method();
  7025. const SSL_METHOD *cmeth = TLS_client_method();
  7026. int min_version = TLS1_VERSION;
  7027. int max_version = TLS1_2_VERSION; /* Don't select TLS1_3 */
  7028. SSL_CTX *cctx = NULL, *sctx = NULL;
  7029. SSL *clientssl = NULL, *serverssl = NULL;
  7030. int testresult = 0;
  7031. /*
  7032. * Choose a buffer large enough to perform a multi-block operation
  7033. * i.e: write_len >= 4 * frag_size
  7034. * 9 * is chosen so that multiple multiblocks are used + some leftover.
  7035. */
  7036. unsigned char msg[MULTIBLOCK_FRAGSIZE * 9];
  7037. unsigned char buf[sizeof(msg)], *p = buf;
  7038. size_t readbytes, written, len;
  7039. EVP_CIPHER *ciph = NULL;
  7040. /*
  7041. * Check if the cipher exists before attempting to use it since it only has
  7042. * a hardware specific implementation.
  7043. */
  7044. ciph = EVP_CIPHER_fetch(NULL, fetchable_ciphers[test_index], "");
  7045. if (ciph == NULL) {
  7046. TEST_skip("Multiblock cipher is not available for %s", cipherlist);
  7047. return 1;
  7048. }
  7049. EVP_CIPHER_free(ciph);
  7050. /* Set up a buffer with some data that will be sent to the client */
  7051. RAND_bytes(msg, sizeof(msg));
  7052. if (!TEST_true(create_ssl_ctx_pair(libctx, smeth, cmeth, min_version,
  7053. max_version, &sctx, &cctx, cert,
  7054. privkey)))
  7055. goto end;
  7056. if (!TEST_true(SSL_CTX_set_max_send_fragment(sctx, MULTIBLOCK_FRAGSIZE)))
  7057. goto end;
  7058. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7059. NULL, NULL)))
  7060. goto end;
  7061. /* settings to force it to use AES-CBC-HMAC_SHA */
  7062. SSL_set_options(serverssl, SSL_OP_NO_ENCRYPT_THEN_MAC);
  7063. if (!TEST_true(SSL_CTX_set_cipher_list(cctx, cipherlist)))
  7064. goto end;
  7065. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  7066. goto end;
  7067. if (!TEST_true(SSL_write_ex(serverssl, msg, sizeof(msg), &written))
  7068. || !TEST_size_t_eq(written, sizeof(msg)))
  7069. goto end;
  7070. len = written;
  7071. while (len > 0) {
  7072. if (!TEST_true(SSL_read_ex(clientssl, p, MULTIBLOCK_FRAGSIZE, &readbytes)))
  7073. goto end;
  7074. p += readbytes;
  7075. len -= readbytes;
  7076. }
  7077. if (!TEST_mem_eq(msg, sizeof(msg), buf, sizeof(buf)))
  7078. goto end;
  7079. testresult = 1;
  7080. end:
  7081. SSL_free(serverssl);
  7082. SSL_free(clientssl);
  7083. SSL_CTX_free(sctx);
  7084. SSL_CTX_free(cctx);
  7085. return testresult;
  7086. }
  7087. #endif /* OPENSSL_NO_TLS1_2 */
  7088. /*
  7089. * Test 0: Client sets servername and server acknowledges it (TLSv1.2)
  7090. * Test 1: Client sets servername and server does not acknowledge it (TLSv1.2)
  7091. * Test 2: Client sets inconsistent servername on resumption (TLSv1.2)
  7092. * Test 3: Client does not set servername on initial handshake (TLSv1.2)
  7093. * Test 4: Client does not set servername on resumption handshake (TLSv1.2)
  7094. * Test 5: Client sets servername and server acknowledges it (TLSv1.3)
  7095. * Test 6: Client sets servername and server does not acknowledge it (TLSv1.3)
  7096. * Test 7: Client sets inconsistent servername on resumption (TLSv1.3)
  7097. * Test 8: Client does not set servername on initial handshake(TLSv1.3)
  7098. * Test 9: Client does not set servername on resumption handshake (TLSv1.3)
  7099. */
  7100. static int test_servername(int tst)
  7101. {
  7102. SSL_CTX *cctx = NULL, *sctx = NULL;
  7103. SSL *clientssl = NULL, *serverssl = NULL;
  7104. int testresult = 0;
  7105. SSL_SESSION *sess = NULL;
  7106. const char *sexpectedhost = NULL, *cexpectedhost = NULL;
  7107. #ifdef OPENSSL_NO_TLS1_2
  7108. if (tst <= 4)
  7109. return 1;
  7110. #endif
  7111. #ifdef OSSL_NO_USABLE_TLS1_3
  7112. if (tst >= 5)
  7113. return 1;
  7114. #endif
  7115. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7116. TLS_client_method(),
  7117. TLS1_VERSION,
  7118. (tst <= 4) ? TLS1_2_VERSION
  7119. : TLS1_3_VERSION,
  7120. &sctx, &cctx, cert, privkey))
  7121. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7122. NULL, NULL)))
  7123. goto end;
  7124. if (tst != 1 && tst != 6) {
  7125. if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx,
  7126. hostname_cb)))
  7127. goto end;
  7128. }
  7129. if (tst != 3 && tst != 8) {
  7130. if (!TEST_true(SSL_set_tlsext_host_name(clientssl, "goodhost")))
  7131. goto end;
  7132. sexpectedhost = cexpectedhost = "goodhost";
  7133. }
  7134. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  7135. goto end;
  7136. if (!TEST_str_eq(SSL_get_servername(clientssl, TLSEXT_NAMETYPE_host_name),
  7137. cexpectedhost)
  7138. || !TEST_str_eq(SSL_get_servername(serverssl,
  7139. TLSEXT_NAMETYPE_host_name),
  7140. sexpectedhost))
  7141. goto end;
  7142. /* Now repeat with a resumption handshake */
  7143. if (!TEST_int_eq(SSL_shutdown(clientssl), 0)
  7144. || !TEST_ptr_ne(sess = SSL_get1_session(clientssl), NULL)
  7145. || !TEST_true(SSL_SESSION_is_resumable(sess))
  7146. || !TEST_int_eq(SSL_shutdown(serverssl), 0))
  7147. goto end;
  7148. SSL_free(clientssl);
  7149. SSL_free(serverssl);
  7150. clientssl = serverssl = NULL;
  7151. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
  7152. NULL)))
  7153. goto end;
  7154. if (!TEST_true(SSL_set_session(clientssl, sess)))
  7155. goto end;
  7156. sexpectedhost = cexpectedhost = "goodhost";
  7157. if (tst == 2 || tst == 7) {
  7158. /* Set an inconsistent hostname */
  7159. if (!TEST_true(SSL_set_tlsext_host_name(clientssl, "altgoodhost")))
  7160. goto end;
  7161. /*
  7162. * In TLSv1.2 we expect the hostname from the original handshake, in
  7163. * TLSv1.3 we expect the hostname from this handshake
  7164. */
  7165. if (tst == 7)
  7166. sexpectedhost = cexpectedhost = "altgoodhost";
  7167. if (!TEST_str_eq(SSL_get_servername(clientssl,
  7168. TLSEXT_NAMETYPE_host_name),
  7169. "altgoodhost"))
  7170. goto end;
  7171. } else if (tst == 4 || tst == 9) {
  7172. /*
  7173. * A TLSv1.3 session does not associate a session with a servername,
  7174. * but a TLSv1.2 session does.
  7175. */
  7176. if (tst == 9)
  7177. sexpectedhost = cexpectedhost = NULL;
  7178. if (!TEST_str_eq(SSL_get_servername(clientssl,
  7179. TLSEXT_NAMETYPE_host_name),
  7180. cexpectedhost))
  7181. goto end;
  7182. } else {
  7183. if (!TEST_true(SSL_set_tlsext_host_name(clientssl, "goodhost")))
  7184. goto end;
  7185. /*
  7186. * In a TLSv1.2 resumption where the hostname was not acknowledged
  7187. * we expect the hostname on the server to be empty. On the client we
  7188. * return what was requested in this case.
  7189. *
  7190. * Similarly if the client didn't set a hostname on an original TLSv1.2
  7191. * session but is now, the server hostname will be empty, but the client
  7192. * is as we set it.
  7193. */
  7194. if (tst == 1 || tst == 3)
  7195. sexpectedhost = NULL;
  7196. if (!TEST_str_eq(SSL_get_servername(clientssl,
  7197. TLSEXT_NAMETYPE_host_name),
  7198. "goodhost"))
  7199. goto end;
  7200. }
  7201. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  7202. goto end;
  7203. if (!TEST_true(SSL_session_reused(clientssl))
  7204. || !TEST_true(SSL_session_reused(serverssl))
  7205. || !TEST_str_eq(SSL_get_servername(clientssl,
  7206. TLSEXT_NAMETYPE_host_name),
  7207. cexpectedhost)
  7208. || !TEST_str_eq(SSL_get_servername(serverssl,
  7209. TLSEXT_NAMETYPE_host_name),
  7210. sexpectedhost))
  7211. goto end;
  7212. testresult = 1;
  7213. end:
  7214. SSL_SESSION_free(sess);
  7215. SSL_free(serverssl);
  7216. SSL_free(clientssl);
  7217. SSL_CTX_free(sctx);
  7218. SSL_CTX_free(cctx);
  7219. return testresult;
  7220. }
  7221. #if !defined(OPENSSL_NO_EC) \
  7222. && (!defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2))
  7223. /*
  7224. * Test that if signature algorithms are not available, then we do not offer or
  7225. * accept them.
  7226. * Test 0: Two RSA sig algs available: both RSA sig algs shared
  7227. * Test 1: The client only has SHA2-256: only SHA2-256 algorithms shared
  7228. * Test 2: The server only has SHA2-256: only SHA2-256 algorithms shared
  7229. * Test 3: An RSA and an ECDSA sig alg available: both sig algs shared
  7230. * Test 4: The client only has an ECDSA sig alg: only ECDSA algorithms shared
  7231. * Test 5: The server only has an ECDSA sig alg: only ECDSA algorithms shared
  7232. */
  7233. static int test_sigalgs_available(int idx)
  7234. {
  7235. SSL_CTX *cctx = NULL, *sctx = NULL;
  7236. SSL *clientssl = NULL, *serverssl = NULL;
  7237. int testresult = 0;
  7238. OSSL_LIB_CTX *tmpctx = OSSL_LIB_CTX_new();
  7239. OSSL_LIB_CTX *clientctx = libctx, *serverctx = libctx;
  7240. OSSL_PROVIDER *filterprov = NULL;
  7241. int sig, hash;
  7242. if (!TEST_ptr(tmpctx))
  7243. goto end;
  7244. if (idx != 0 && idx != 3) {
  7245. if (!TEST_true(OSSL_PROVIDER_add_builtin(tmpctx, "filter",
  7246. filter_provider_init)))
  7247. goto end;
  7248. filterprov = OSSL_PROVIDER_load(tmpctx, "filter");
  7249. if (!TEST_ptr(filterprov))
  7250. goto end;
  7251. if (idx < 3) {
  7252. /*
  7253. * Only enable SHA2-256 so rsa_pss_rsae_sha384 should not be offered
  7254. * or accepted for the peer that uses this libctx. Note that libssl
  7255. * *requires* SHA2-256 to be available so we cannot disable that. We
  7256. * also need SHA1 for our certificate.
  7257. */
  7258. if (!TEST_true(filter_provider_set_filter(OSSL_OP_DIGEST,
  7259. "SHA2-256:SHA1")))
  7260. goto end;
  7261. } else {
  7262. if (!TEST_true(filter_provider_set_filter(OSSL_OP_SIGNATURE,
  7263. "ECDSA"))
  7264. || !TEST_true(filter_provider_set_filter(OSSL_OP_KEYMGMT,
  7265. "EC:X25519:X448")))
  7266. goto end;
  7267. }
  7268. if (idx == 1 || idx == 4)
  7269. clientctx = tmpctx;
  7270. else
  7271. serverctx = tmpctx;
  7272. }
  7273. cctx = SSL_CTX_new_ex(clientctx, NULL, TLS_client_method());
  7274. sctx = SSL_CTX_new_ex(serverctx, NULL, TLS_server_method());
  7275. if (!TEST_ptr(cctx) || !TEST_ptr(sctx))
  7276. goto end;
  7277. if (idx != 5) {
  7278. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7279. TLS_client_method(),
  7280. TLS1_VERSION,
  7281. 0,
  7282. &sctx, &cctx, cert, privkey)))
  7283. goto end;
  7284. } else {
  7285. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7286. TLS_client_method(),
  7287. TLS1_VERSION,
  7288. 0,
  7289. &sctx, &cctx, cert2, privkey2)))
  7290. goto end;
  7291. }
  7292. /* Ensure we only use TLSv1.2 ciphersuites based on SHA256 */
  7293. if (idx < 4) {
  7294. if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
  7295. "ECDHE-RSA-AES128-GCM-SHA256")))
  7296. goto end;
  7297. } else {
  7298. if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
  7299. "ECDHE-ECDSA-AES128-GCM-SHA256")))
  7300. goto end;
  7301. }
  7302. if (idx < 3) {
  7303. if (!SSL_CTX_set1_sigalgs_list(cctx,
  7304. "rsa_pss_rsae_sha384"
  7305. ":rsa_pss_rsae_sha256")
  7306. || !SSL_CTX_set1_sigalgs_list(sctx,
  7307. "rsa_pss_rsae_sha384"
  7308. ":rsa_pss_rsae_sha256"))
  7309. goto end;
  7310. } else {
  7311. if (!SSL_CTX_set1_sigalgs_list(cctx, "rsa_pss_rsae_sha256:ECDSA+SHA256")
  7312. || !SSL_CTX_set1_sigalgs_list(sctx,
  7313. "rsa_pss_rsae_sha256:ECDSA+SHA256"))
  7314. goto end;
  7315. }
  7316. if (idx != 5
  7317. && (!TEST_int_eq(SSL_CTX_use_certificate_file(sctx, cert2,
  7318. SSL_FILETYPE_PEM), 1)
  7319. || !TEST_int_eq(SSL_CTX_use_PrivateKey_file(sctx,
  7320. privkey2,
  7321. SSL_FILETYPE_PEM), 1)
  7322. || !TEST_int_eq(SSL_CTX_check_private_key(sctx), 1)))
  7323. goto end;
  7324. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7325. NULL, NULL)))
  7326. goto end;
  7327. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  7328. goto end;
  7329. /* For tests 0 and 3 we expect 2 shared sigalgs, otherwise exactly 1 */
  7330. if (!TEST_int_eq(SSL_get_shared_sigalgs(serverssl, 0, &sig, &hash, NULL,
  7331. NULL, NULL),
  7332. (idx == 0 || idx == 3) ? 2 : 1))
  7333. goto end;
  7334. if (!TEST_int_eq(hash, idx == 0 ? NID_sha384 : NID_sha256))
  7335. goto end;
  7336. if (!TEST_int_eq(sig, (idx == 4 || idx == 5) ? EVP_PKEY_EC
  7337. : NID_rsassaPss))
  7338. goto end;
  7339. testresult = filter_provider_check_clean_finish();
  7340. end:
  7341. SSL_free(serverssl);
  7342. SSL_free(clientssl);
  7343. SSL_CTX_free(sctx);
  7344. SSL_CTX_free(cctx);
  7345. OSSL_PROVIDER_unload(filterprov);
  7346. OSSL_LIB_CTX_free(tmpctx);
  7347. return testresult;
  7348. }
  7349. #endif /*
  7350. * !defined(OPENSSL_NO_EC) \
  7351. * && (!defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2))
  7352. */
  7353. #ifndef OPENSSL_NO_TLS1_3
  7354. /* This test can run in TLSv1.3 even if ec and dh are disabled */
  7355. static int test_pluggable_group(int idx)
  7356. {
  7357. SSL_CTX *cctx = NULL, *sctx = NULL;
  7358. SSL *clientssl = NULL, *serverssl = NULL;
  7359. int testresult = 0;
  7360. OSSL_PROVIDER *tlsprov = OSSL_PROVIDER_load(libctx, "tls-provider");
  7361. /* Check that we are not impacted by a provider without any groups */
  7362. OSSL_PROVIDER *legacyprov = OSSL_PROVIDER_load(libctx, "legacy");
  7363. const char *group_name = idx == 0 ? "xorgroup" : "xorkemgroup";
  7364. if (!TEST_ptr(tlsprov))
  7365. goto end;
  7366. if (legacyprov == NULL) {
  7367. /*
  7368. * In this case we assume we've been built with "no-legacy" and skip
  7369. * this test (there is no OPENSSL_NO_LEGACY)
  7370. */
  7371. testresult = 1;
  7372. goto end;
  7373. }
  7374. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7375. TLS_client_method(),
  7376. TLS1_3_VERSION,
  7377. TLS1_3_VERSION,
  7378. &sctx, &cctx, cert, privkey))
  7379. || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7380. NULL, NULL)))
  7381. goto end;
  7382. if (!TEST_true(SSL_set1_groups_list(serverssl, group_name))
  7383. || !TEST_true(SSL_set1_groups_list(clientssl, group_name)))
  7384. goto end;
  7385. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  7386. goto end;
  7387. if (!TEST_str_eq(group_name,
  7388. SSL_group_to_name(serverssl, SSL_get_shared_group(serverssl, 0))))
  7389. goto end;
  7390. testresult = 1;
  7391. end:
  7392. SSL_free(serverssl);
  7393. SSL_free(clientssl);
  7394. SSL_CTX_free(sctx);
  7395. SSL_CTX_free(cctx);
  7396. OSSL_PROVIDER_unload(tlsprov);
  7397. OSSL_PROVIDER_unload(legacyprov);
  7398. return testresult;
  7399. }
  7400. #endif
  7401. #ifndef OPENSSL_NO_TLS1_2
  7402. static int test_ssl_dup(void)
  7403. {
  7404. SSL_CTX *cctx = NULL, *sctx = NULL;
  7405. SSL *clientssl = NULL, *serverssl = NULL, *client2ssl = NULL;
  7406. int testresult = 0;
  7407. BIO *rbio = NULL, *wbio = NULL;
  7408. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7409. TLS_client_method(),
  7410. 0,
  7411. 0,
  7412. &sctx, &cctx, cert, privkey)))
  7413. goto end;
  7414. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7415. NULL, NULL)))
  7416. goto end;
  7417. if (!TEST_true(SSL_set_min_proto_version(clientssl, TLS1_2_VERSION))
  7418. || !TEST_true(SSL_set_max_proto_version(clientssl, TLS1_2_VERSION)))
  7419. goto end;
  7420. client2ssl = SSL_dup(clientssl);
  7421. rbio = SSL_get_rbio(clientssl);
  7422. if (!TEST_ptr(rbio)
  7423. || !TEST_true(BIO_up_ref(rbio)))
  7424. goto end;
  7425. SSL_set0_rbio(client2ssl, rbio);
  7426. rbio = NULL;
  7427. wbio = SSL_get_wbio(clientssl);
  7428. if (!TEST_ptr(wbio) || !TEST_true(BIO_up_ref(wbio)))
  7429. goto end;
  7430. SSL_set0_wbio(client2ssl, wbio);
  7431. rbio = NULL;
  7432. if (!TEST_ptr(client2ssl)
  7433. /* Handshake not started so pointers should be different */
  7434. || !TEST_ptr_ne(clientssl, client2ssl))
  7435. goto end;
  7436. if (!TEST_int_eq(SSL_get_min_proto_version(client2ssl), TLS1_2_VERSION)
  7437. || !TEST_int_eq(SSL_get_max_proto_version(client2ssl), TLS1_2_VERSION))
  7438. goto end;
  7439. if (!TEST_true(create_ssl_connection(serverssl, client2ssl, SSL_ERROR_NONE)))
  7440. goto end;
  7441. SSL_free(clientssl);
  7442. clientssl = SSL_dup(client2ssl);
  7443. if (!TEST_ptr(clientssl)
  7444. /* Handshake has finished so pointers should be the same */
  7445. || !TEST_ptr_eq(clientssl, client2ssl))
  7446. goto end;
  7447. testresult = 1;
  7448. end:
  7449. SSL_free(serverssl);
  7450. SSL_free(clientssl);
  7451. SSL_free(client2ssl);
  7452. SSL_CTX_free(sctx);
  7453. SSL_CTX_free(cctx);
  7454. return testresult;
  7455. }
  7456. # ifndef OPENSSL_NO_DH
  7457. static EVP_PKEY *tmp_dh_params = NULL;
  7458. /* Helper function for the test_set_tmp_dh() tests */
  7459. static EVP_PKEY *get_tmp_dh_params(void)
  7460. {
  7461. if (tmp_dh_params == NULL) {
  7462. BIGNUM *p = NULL;
  7463. OSSL_PARAM_BLD *tmpl = NULL;
  7464. EVP_PKEY_CTX *pctx = NULL;
  7465. OSSL_PARAM *params = NULL;
  7466. EVP_PKEY *dhpkey = NULL;
  7467. p = BN_get_rfc3526_prime_2048(NULL);
  7468. if (!TEST_ptr(p))
  7469. goto end;
  7470. pctx = EVP_PKEY_CTX_new_from_name(libctx, "DH", NULL);
  7471. if (!TEST_ptr(pctx)
  7472. || !TEST_true(EVP_PKEY_fromdata_init(pctx)))
  7473. goto end;
  7474. tmpl = OSSL_PARAM_BLD_new();
  7475. if (!TEST_ptr(tmpl)
  7476. || !TEST_true(OSSL_PARAM_BLD_push_BN(tmpl,
  7477. OSSL_PKEY_PARAM_FFC_P,
  7478. p))
  7479. || !TEST_true(OSSL_PARAM_BLD_push_uint(tmpl,
  7480. OSSL_PKEY_PARAM_FFC_G,
  7481. 2)))
  7482. goto end;
  7483. params = OSSL_PARAM_BLD_to_param(tmpl);
  7484. if (!TEST_ptr(params)
  7485. || !TEST_true(EVP_PKEY_fromdata(pctx, &dhpkey,
  7486. EVP_PKEY_KEY_PARAMETERS, params)))
  7487. goto end;
  7488. tmp_dh_params = dhpkey;
  7489. end:
  7490. BN_free(p);
  7491. EVP_PKEY_CTX_free(pctx);
  7492. OSSL_PARAM_BLD_free(tmpl);
  7493. OSSL_PARAM_free(params);
  7494. }
  7495. if (tmp_dh_params != NULL && !EVP_PKEY_up_ref(tmp_dh_params))
  7496. return NULL;
  7497. return tmp_dh_params;
  7498. }
  7499. # ifndef OPENSSL_NO_DEPRECATED_3_0
  7500. /* Callback used by test_set_tmp_dh() */
  7501. static DH *tmp_dh_callback(SSL *s, int is_export, int keylen)
  7502. {
  7503. EVP_PKEY *dhpkey = get_tmp_dh_params();
  7504. DH *ret = NULL;
  7505. if (!TEST_ptr(dhpkey))
  7506. return NULL;
  7507. /*
  7508. * libssl does not free the returned DH, so we free it now knowing that even
  7509. * after we free dhpkey, there will still be a reference to the owning
  7510. * EVP_PKEY in tmp_dh_params, and so the DH object will live for the length
  7511. * of time we need it for.
  7512. */
  7513. ret = EVP_PKEY_get1_DH(dhpkey);
  7514. DH_free(ret);
  7515. EVP_PKEY_free(dhpkey);
  7516. return ret;
  7517. }
  7518. # endif
  7519. /*
  7520. * Test the various methods for setting temporary DH parameters
  7521. *
  7522. * Test 0: Default (no auto) setting
  7523. * Test 1: Explicit SSL_CTX auto off
  7524. * Test 2: Explicit SSL auto off
  7525. * Test 3: Explicit SSL_CTX auto on
  7526. * Test 4: Explicit SSL auto on
  7527. * Test 5: Explicit SSL_CTX auto off, custom DH params via EVP_PKEY
  7528. * Test 6: Explicit SSL auto off, custom DH params via EVP_PKEY
  7529. *
  7530. * The following are testing deprecated APIs, so we only run them if available
  7531. * Test 7: Explicit SSL_CTX auto off, custom DH params via DH
  7532. * Test 8: Explicit SSL auto off, custom DH params via DH
  7533. * Test 9: Explicit SSL_CTX auto off, custom DH params via callback
  7534. * Test 10: Explicit SSL auto off, custom DH params via callback
  7535. */
  7536. static int test_set_tmp_dh(int idx)
  7537. {
  7538. SSL_CTX *cctx = NULL, *sctx = NULL;
  7539. SSL *clientssl = NULL, *serverssl = NULL;
  7540. int testresult = 0;
  7541. int dhauto = (idx == 3 || idx == 4) ? 1 : 0;
  7542. int expected = (idx <= 2) ? 0 : 1;
  7543. EVP_PKEY *dhpkey = NULL;
  7544. # ifndef OPENSSL_NO_DEPRECATED_3_0
  7545. DH *dh = NULL;
  7546. # else
  7547. if (idx >= 7)
  7548. return 1;
  7549. # endif
  7550. if (idx >= 5 && idx <= 8) {
  7551. dhpkey = get_tmp_dh_params();
  7552. if (!TEST_ptr(dhpkey))
  7553. goto end;
  7554. }
  7555. # ifndef OPENSSL_NO_DEPRECATED_3_0
  7556. if (idx == 7 || idx == 8) {
  7557. dh = EVP_PKEY_get1_DH(dhpkey);
  7558. if (!TEST_ptr(dh))
  7559. goto end;
  7560. }
  7561. # endif
  7562. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7563. TLS_client_method(),
  7564. 0,
  7565. 0,
  7566. &sctx, &cctx, cert, privkey)))
  7567. goto end;
  7568. if ((idx & 1) == 1) {
  7569. if (!TEST_true(SSL_CTX_set_dh_auto(sctx, dhauto)))
  7570. goto end;
  7571. }
  7572. if (idx == 5) {
  7573. if (!TEST_true(SSL_CTX_set0_tmp_dh_pkey(sctx, dhpkey)))
  7574. goto end;
  7575. dhpkey = NULL;
  7576. }
  7577. # ifndef OPENSSL_NO_DEPRECATED_3_0
  7578. else if (idx == 7) {
  7579. if (!TEST_true(SSL_CTX_set_tmp_dh(sctx, dh)))
  7580. goto end;
  7581. } else if (idx == 9) {
  7582. SSL_CTX_set_tmp_dh_callback(sctx, tmp_dh_callback);
  7583. }
  7584. # endif
  7585. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7586. NULL, NULL)))
  7587. goto end;
  7588. if ((idx & 1) == 0 && idx != 0) {
  7589. if (!TEST_true(SSL_set_dh_auto(serverssl, dhauto)))
  7590. goto end;
  7591. }
  7592. if (idx == 6) {
  7593. if (!TEST_true(SSL_set0_tmp_dh_pkey(serverssl, dhpkey)))
  7594. goto end;
  7595. dhpkey = NULL;
  7596. }
  7597. # ifndef OPENSSL_NO_DEPRECATED_3_0
  7598. else if (idx == 8) {
  7599. if (!TEST_true(SSL_set_tmp_dh(serverssl, dh)))
  7600. goto end;
  7601. } else if (idx == 10) {
  7602. SSL_set_tmp_dh_callback(serverssl, tmp_dh_callback);
  7603. }
  7604. # endif
  7605. if (!TEST_true(SSL_set_min_proto_version(serverssl, TLS1_2_VERSION))
  7606. || !TEST_true(SSL_set_max_proto_version(serverssl, TLS1_2_VERSION))
  7607. || !TEST_true(SSL_set_cipher_list(serverssl, "DHE-RSA-AES128-SHA")))
  7608. goto end;
  7609. /*
  7610. * If autoon then we should succeed. Otherwise we expect failure because
  7611. * there are no parameters
  7612. */
  7613. if (!TEST_int_eq(create_ssl_connection(serverssl, clientssl,
  7614. SSL_ERROR_NONE), expected))
  7615. goto end;
  7616. testresult = 1;
  7617. end:
  7618. # ifndef OPENSSL_NO_DEPRECATED_3_0
  7619. DH_free(dh);
  7620. # endif
  7621. SSL_free(serverssl);
  7622. SSL_free(clientssl);
  7623. SSL_CTX_free(sctx);
  7624. SSL_CTX_free(cctx);
  7625. EVP_PKEY_free(dhpkey);
  7626. return testresult;
  7627. }
  7628. /*
  7629. * Test the auto DH keys are appropriately sized
  7630. */
  7631. static int test_dh_auto(int idx)
  7632. {
  7633. SSL_CTX *cctx = NULL, *sctx = NULL;
  7634. SSL *clientssl = NULL, *serverssl = NULL;
  7635. int testresult = 0;
  7636. EVP_PKEY *tmpkey = NULL;
  7637. char *thiscert = NULL, *thiskey = NULL;
  7638. size_t expdhsize = 0;
  7639. const char *ciphersuite = "DHE-RSA-AES128-SHA";
  7640. switch (idx) {
  7641. case 0:
  7642. /* The FIPS provider doesn't support this DH size - so we ignore it */
  7643. if (is_fips)
  7644. return 1;
  7645. thiscert = cert1024;
  7646. thiskey = privkey1024;
  7647. expdhsize = 1024;
  7648. break;
  7649. case 1:
  7650. /* 2048 bit prime */
  7651. thiscert = cert;
  7652. thiskey = privkey;
  7653. expdhsize = 2048;
  7654. break;
  7655. case 2:
  7656. thiscert = cert3072;
  7657. thiskey = privkey3072;
  7658. expdhsize = 3072;
  7659. break;
  7660. case 3:
  7661. thiscert = cert4096;
  7662. thiskey = privkey4096;
  7663. expdhsize = 4096;
  7664. break;
  7665. case 4:
  7666. thiscert = cert8192;
  7667. thiskey = privkey8192;
  7668. expdhsize = 8192;
  7669. break;
  7670. /* No certificate cases */
  7671. case 5:
  7672. /* The FIPS provider doesn't support this DH size - so we ignore it */
  7673. if (is_fips)
  7674. return 1;
  7675. ciphersuite = "ADH-AES128-SHA256:@SECLEVEL=0";
  7676. expdhsize = 1024;
  7677. break;
  7678. case 6:
  7679. ciphersuite = "ADH-AES256-SHA256:@SECLEVEL=0";
  7680. expdhsize = 3072;
  7681. break;
  7682. default:
  7683. TEST_error("Invalid text index");
  7684. goto end;
  7685. }
  7686. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7687. TLS_client_method(),
  7688. 0,
  7689. 0,
  7690. &sctx, &cctx, thiscert, thiskey)))
  7691. goto end;
  7692. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
  7693. NULL, NULL)))
  7694. goto end;
  7695. if (!TEST_true(SSL_set_dh_auto(serverssl, 1))
  7696. || !TEST_true(SSL_set_min_proto_version(serverssl, TLS1_2_VERSION))
  7697. || !TEST_true(SSL_set_max_proto_version(serverssl, TLS1_2_VERSION))
  7698. || !TEST_true(SSL_set_cipher_list(serverssl, ciphersuite))
  7699. || !TEST_true(SSL_set_cipher_list(clientssl, ciphersuite)))
  7700. goto end;
  7701. /*
  7702. * Send the server's first flight. At this point the server has created the
  7703. * temporary DH key but hasn't finished using it yet. Once used it is
  7704. * removed, so we cannot test it.
  7705. */
  7706. if (!TEST_int_le(SSL_connect(clientssl), 0)
  7707. || !TEST_int_le(SSL_accept(serverssl), 0))
  7708. goto end;
  7709. if (!TEST_int_gt(SSL_get_tmp_key(serverssl, &tmpkey), 0))
  7710. goto end;
  7711. if (!TEST_size_t_eq(EVP_PKEY_get_bits(tmpkey), expdhsize))
  7712. goto end;
  7713. if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
  7714. goto end;
  7715. testresult = 1;
  7716. end:
  7717. SSL_free(serverssl);
  7718. SSL_free(clientssl);
  7719. SSL_CTX_free(sctx);
  7720. SSL_CTX_free(cctx);
  7721. EVP_PKEY_free(tmpkey);
  7722. return testresult;
  7723. }
  7724. # endif /* OPENSSL_NO_DH */
  7725. #endif /* OPENSSL_NO_TLS1_2 */
  7726. #ifndef OSSL_NO_USABLE_TLS1_3
  7727. /*
  7728. * Test that setting an SNI callback works with TLSv1.3. Specifically we check
  7729. * that it works even without a certificate configured for the original
  7730. * SSL_CTX
  7731. */
  7732. static int test_sni_tls13(void)
  7733. {
  7734. SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
  7735. SSL *clientssl = NULL, *serverssl = NULL;
  7736. int testresult = 0;
  7737. /* Reset callback counter */
  7738. snicb = 0;
  7739. /* Create an initial SSL_CTX with no certificate configured */
  7740. sctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
  7741. if (!TEST_ptr(sctx))
  7742. goto end;
  7743. /* Require TLSv1.3 as a minimum */
  7744. if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
  7745. TLS_client_method(), TLS1_3_VERSION, 0,
  7746. &sctx2, &cctx, cert, privkey)))
  7747. goto end;
  7748. /* Set up SNI */
  7749. if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx, sni_cb))
  7750. || !TEST_true(SSL_CTX_set_tlsext_servername_arg(sctx, sctx2)))
  7751. goto end;
  7752. /*
  7753. * Connection should still succeed because the final SSL_CTX has the right
  7754. * certificates configured.
  7755. */
  7756. if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
  7757. &clientssl, NULL, NULL))
  7758. || !TEST_true(create_ssl_connection(serverssl, clientssl,
  7759. SSL_ERROR_NONE)))
  7760. goto end;
  7761. /* We should have had the SNI callback called exactly once */
  7762. if (!TEST_int_eq(snicb, 1))
  7763. goto end;
  7764. testresult = 1;
  7765. end:
  7766. SSL_free(serverssl);
  7767. SSL_free(clientssl);
  7768. SSL_CTX_free(sctx2);
  7769. SSL_CTX_free(sctx);
  7770. SSL_CTX_free(cctx);
  7771. return testresult;
  7772. }
  7773. #endif
  7774. /*
  7775. * Test that setting an ALPN does not violate RFC
  7776. */
  7777. static int test_set_alpn(void)
  7778. {
  7779. SSL_CTX *ctx = NULL;
  7780. SSL *ssl = NULL;
  7781. int testresult = 0;
  7782. unsigned char bad0[] = { 0x00, 'b', 'a', 'd' };
  7783. unsigned char good[] = { 0x04, 'g', 'o', 'o', 'd' };
  7784. unsigned char bad1[] = { 0x01, 'b', 'a', 'd' };
  7785. unsigned char bad2[] = { 0x03, 'b', 'a', 'd', 0x00};
  7786. unsigned char bad3[] = { 0x03, 'b', 'a', 'd', 0x01, 'b', 'a', 'd'};
  7787. unsigned char bad4[] = { 0x03, 'b', 'a', 'd', 0x06, 'b', 'a', 'd'};
  7788. /* Create an initial SSL_CTX with no certificate configured */
  7789. ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
  7790. if (!TEST_ptr(ctx))
  7791. goto end;
  7792. /* the set_alpn functions return 0 (false) on success, non-zero (true) on failure */
  7793. if (!TEST_false(SSL_CTX_set_alpn_protos(ctx, NULL, 2)))
  7794. goto end;
  7795. if (!TEST_false(SSL_CTX_set_alpn_protos(ctx, good, 0)))
  7796. goto end;
  7797. if (!TEST_false(SSL_CTX_set_alpn_protos(ctx, good, sizeof(good))))
  7798. goto end;
  7799. if (!TEST_true(SSL_CTX_set_alpn_protos(ctx, good, 1)))
  7800. goto end;
  7801. if (!TEST_true(SSL_CTX_set_alpn_protos(ctx, bad0, sizeof(bad0))))
  7802. goto end;
  7803. if (!TEST_true(SSL_CTX_set_alpn_protos(ctx, bad1, sizeof(bad1))))
  7804. goto end;
  7805. if (!TEST_true(SSL_CTX_set_alpn_protos(ctx, bad2, sizeof(bad2))))
  7806. goto end;
  7807. if (!TEST_true(SSL_CTX_set_alpn_protos(ctx, bad3, sizeof(bad3))))
  7808. goto end;
  7809. if (!TEST_true(SSL_CTX_set_alpn_protos(ctx, bad4, sizeof(bad4))))
  7810. goto end;
  7811. ssl = SSL_new(ctx);
  7812. if (!TEST_ptr(ssl))
  7813. goto end;
  7814. if (!TEST_false(SSL_set_alpn_protos(ssl, NULL, 2)))
  7815. goto end;
  7816. if (!TEST_false(SSL_set_alpn_protos(ssl, good, 0)))
  7817. goto end;
  7818. if (!TEST_false(SSL_set_alpn_protos(ssl, good, sizeof(good))))
  7819. goto end;
  7820. if (!TEST_true(SSL_set_alpn_protos(ssl, good, 1)))
  7821. goto end;
  7822. if (!TEST_true(SSL_set_alpn_protos(ssl, bad0, sizeof(bad0))))
  7823. goto end;
  7824. if (!TEST_true(SSL_set_alpn_protos(ssl, bad1, sizeof(bad1))))
  7825. goto end;
  7826. if (!TEST_true(SSL_set_alpn_protos(ssl, bad2, sizeof(bad2))))
  7827. goto end;
  7828. if (!TEST_true(SSL_set_alpn_protos(ssl, bad3, sizeof(bad3))))
  7829. goto end;
  7830. if (!TEST_true(SSL_set_alpn_protos(ssl, bad4, sizeof(bad4))))
  7831. goto end;
  7832. testresult = 1;
  7833. end:
  7834. SSL_free(ssl);
  7835. SSL_CTX_free(ctx);
  7836. return testresult;
  7837. }
  7838. static int test_inherit_verify_param(void)
  7839. {
  7840. int testresult = 0;
  7841. SSL_CTX *ctx = NULL;
  7842. X509_VERIFY_PARAM *cp = NULL;
  7843. SSL *ssl = NULL;
  7844. X509_VERIFY_PARAM *sp = NULL;
  7845. int hostflags = X509_CHECK_FLAG_NEVER_CHECK_SUBJECT;
  7846. ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
  7847. if (!TEST_ptr(ctx))
  7848. goto end;
  7849. cp = SSL_CTX_get0_param(ctx);
  7850. if (!TEST_ptr(cp))
  7851. goto end;
  7852. if (!TEST_int_eq(X509_VERIFY_PARAM_get_hostflags(cp), 0))
  7853. goto end;
  7854. X509_VERIFY_PARAM_set_hostflags(cp, hostflags);
  7855. ssl = SSL_new(ctx);
  7856. if (!TEST_ptr(ssl))
  7857. goto end;
  7858. sp = SSL_get0_param(ssl);
  7859. if (!TEST_ptr(sp))
  7860. goto end;
  7861. if (!TEST_int_eq(X509_VERIFY_PARAM_get_hostflags(sp), hostflags))
  7862. goto end;
  7863. testresult = 1;
  7864. end:
  7865. SSL_free(ssl);
  7866. SSL_CTX_free(ctx);
  7867. return testresult;
  7868. }
  7869. OPT_TEST_DECLARE_USAGE("certfile privkeyfile srpvfile tmpfile provider config\n")
  7870. int setup_tests(void)
  7871. {
  7872. char *modulename;
  7873. char *configfile;
  7874. libctx = OSSL_LIB_CTX_new();
  7875. if (!TEST_ptr(libctx))
  7876. return 0;
  7877. defctxnull = OSSL_PROVIDER_load(NULL, "null");
  7878. /*
  7879. * Verify that the default and fips providers in the default libctx are not
  7880. * available
  7881. */
  7882. if (!TEST_false(OSSL_PROVIDER_available(NULL, "default"))
  7883. || !TEST_false(OSSL_PROVIDER_available(NULL, "fips")))
  7884. return 0;
  7885. if (!test_skip_common_options()) {
  7886. TEST_error("Error parsing test options\n");
  7887. return 0;
  7888. }
  7889. if (!TEST_ptr(certsdir = test_get_argument(0))
  7890. || !TEST_ptr(srpvfile = test_get_argument(1))
  7891. || !TEST_ptr(tmpfilename = test_get_argument(2))
  7892. || !TEST_ptr(modulename = test_get_argument(3))
  7893. || !TEST_ptr(configfile = test_get_argument(4)))
  7894. return 0;
  7895. if (!TEST_true(OSSL_LIB_CTX_load_config(libctx, configfile)))
  7896. return 0;
  7897. /* Check we have the expected provider available */
  7898. if (!TEST_true(OSSL_PROVIDER_available(libctx, modulename)))
  7899. return 0;
  7900. /* Check the default provider is not available */
  7901. if (strcmp(modulename, "default") != 0
  7902. && !TEST_false(OSSL_PROVIDER_available(libctx, "default")))
  7903. return 0;
  7904. if (strcmp(modulename, "fips") == 0)
  7905. is_fips = 1;
  7906. /*
  7907. * We add, but don't load the test "tls-provider". We'll load it when we
  7908. * need it.
  7909. */
  7910. if (!TEST_true(OSSL_PROVIDER_add_builtin(libctx, "tls-provider",
  7911. tls_provider_init)))
  7912. return 0;
  7913. if (getenv("OPENSSL_TEST_GETCOUNTS") != NULL) {
  7914. #ifdef OPENSSL_NO_CRYPTO_MDEBUG
  7915. TEST_error("not supported in this build");
  7916. return 0;
  7917. #else
  7918. int i, mcount, rcount, fcount;
  7919. for (i = 0; i < 4; i++)
  7920. test_export_key_mat(i);
  7921. CRYPTO_get_alloc_counts(&mcount, &rcount, &fcount);
  7922. test_printf_stdout("malloc %d realloc %d free %d\n",
  7923. mcount, rcount, fcount);
  7924. return 1;
  7925. #endif
  7926. }
  7927. cert = test_mk_file_path(certsdir, "servercert.pem");
  7928. if (cert == NULL)
  7929. goto err;
  7930. privkey = test_mk_file_path(certsdir, "serverkey.pem");
  7931. if (privkey == NULL)
  7932. goto err;
  7933. cert2 = test_mk_file_path(certsdir, "server-ecdsa-cert.pem");
  7934. if (cert2 == NULL)
  7935. goto err;
  7936. privkey2 = test_mk_file_path(certsdir, "server-ecdsa-key.pem");
  7937. if (privkey2 == NULL)
  7938. goto err;
  7939. cert1024 = test_mk_file_path(certsdir, "ee-cert-1024.pem");
  7940. if (cert1024 == NULL)
  7941. goto err;
  7942. privkey1024 = test_mk_file_path(certsdir, "ee-key-1024.pem");
  7943. if (privkey1024 == NULL)
  7944. goto err;
  7945. cert3072 = test_mk_file_path(certsdir, "ee-cert-3072.pem");
  7946. if (cert3072 == NULL)
  7947. goto err;
  7948. privkey3072 = test_mk_file_path(certsdir, "ee-key-3072.pem");
  7949. if (privkey3072 == NULL)
  7950. goto err;
  7951. cert4096 = test_mk_file_path(certsdir, "ee-cert-4096.pem");
  7952. if (cert4096 == NULL)
  7953. goto err;
  7954. privkey4096 = test_mk_file_path(certsdir, "ee-key-4096.pem");
  7955. if (privkey4096 == NULL)
  7956. goto err;
  7957. cert8192 = test_mk_file_path(certsdir, "ee-cert-8192.pem");
  7958. if (cert8192 == NULL)
  7959. goto err;
  7960. privkey8192 = test_mk_file_path(certsdir, "ee-key-8192.pem");
  7961. if (privkey8192 == NULL)
  7962. goto err;
  7963. #if !defined(OPENSSL_NO_KTLS) && !defined(OPENSSL_NO_SOCK)
  7964. # if !defined(OPENSSL_NO_TLS1_2) || !defined(OSSL_NO_USABLE_TLS1_3)
  7965. ADD_ALL_TESTS(test_ktls, 8);
  7966. ADD_ALL_TESTS(test_ktls_sendfile_anytls, 6);
  7967. # endif
  7968. #endif
  7969. ADD_TEST(test_large_message_tls);
  7970. ADD_TEST(test_large_message_tls_read_ahead);
  7971. #ifndef OPENSSL_NO_DTLS
  7972. ADD_TEST(test_large_message_dtls);
  7973. #endif
  7974. ADD_TEST(test_cleanse_plaintext);
  7975. #ifndef OPENSSL_NO_OCSP
  7976. ADD_TEST(test_tlsext_status_type);
  7977. #endif
  7978. ADD_TEST(test_session_with_only_int_cache);
  7979. ADD_TEST(test_session_with_only_ext_cache);
  7980. ADD_TEST(test_session_with_both_cache);
  7981. ADD_TEST(test_session_wo_ca_names);
  7982. #ifndef OSSL_NO_USABLE_TLS1_3
  7983. ADD_ALL_TESTS(test_stateful_tickets, 3);
  7984. ADD_ALL_TESTS(test_stateless_tickets, 3);
  7985. ADD_TEST(test_psk_tickets);
  7986. ADD_ALL_TESTS(test_extra_tickets, 6);
  7987. #endif
  7988. ADD_ALL_TESTS(test_ssl_set_bio, TOTAL_SSL_SET_BIO_TESTS);
  7989. ADD_TEST(test_ssl_bio_pop_next_bio);
  7990. ADD_TEST(test_ssl_bio_pop_ssl_bio);
  7991. ADD_TEST(test_ssl_bio_change_rbio);
  7992. ADD_TEST(test_ssl_bio_change_wbio);
  7993. #if !defined(OPENSSL_NO_TLS1_2) || defined(OSSL_NO_USABLE_TLS1_3)
  7994. ADD_ALL_TESTS(test_set_sigalgs, OSSL_NELEM(testsigalgs) * 2);
  7995. ADD_TEST(test_keylog);
  7996. #endif
  7997. #ifndef OSSL_NO_USABLE_TLS1_3
  7998. ADD_TEST(test_keylog_no_master_key);
  7999. #endif
  8000. ADD_TEST(test_client_cert_verify_cb);
  8001. ADD_TEST(test_ssl_build_cert_chain);
  8002. ADD_TEST(test_ssl_ctx_build_cert_chain);
  8003. #ifndef OPENSSL_NO_TLS1_2
  8004. ADD_TEST(test_client_hello_cb);
  8005. ADD_TEST(test_no_ems);
  8006. ADD_TEST(test_ccs_change_cipher);
  8007. #endif
  8008. #ifndef OSSL_NO_USABLE_TLS1_3
  8009. ADD_ALL_TESTS(test_early_data_read_write, 3);
  8010. /*
  8011. * We don't do replay tests for external PSK. Replay protection isn't used
  8012. * in that scenario.
  8013. */
  8014. ADD_ALL_TESTS(test_early_data_replay, 2);
  8015. ADD_ALL_TESTS(test_early_data_skip, 3);
  8016. ADD_ALL_TESTS(test_early_data_skip_hrr, 3);
  8017. ADD_ALL_TESTS(test_early_data_skip_hrr_fail, 3);
  8018. ADD_ALL_TESTS(test_early_data_skip_abort, 3);
  8019. ADD_ALL_TESTS(test_early_data_not_sent, 3);
  8020. ADD_ALL_TESTS(test_early_data_psk, 8);
  8021. ADD_ALL_TESTS(test_early_data_psk_with_all_ciphers, 5);
  8022. ADD_ALL_TESTS(test_early_data_not_expected, 3);
  8023. # ifndef OPENSSL_NO_TLS1_2
  8024. ADD_ALL_TESTS(test_early_data_tls1_2, 3);
  8025. # endif
  8026. #endif
  8027. #ifndef OSSL_NO_USABLE_TLS1_3
  8028. ADD_ALL_TESTS(test_set_ciphersuite, 10);
  8029. ADD_TEST(test_ciphersuite_change);
  8030. ADD_ALL_TESTS(test_tls13_ciphersuite, 4);
  8031. # ifdef OPENSSL_NO_PSK
  8032. ADD_ALL_TESTS(test_tls13_psk, 1);
  8033. # else
  8034. ADD_ALL_TESTS(test_tls13_psk, 4);
  8035. # endif /* OPENSSL_NO_PSK */
  8036. # ifndef OPENSSL_NO_TLS1_2
  8037. /* Test with both TLSv1.3 and 1.2 versions */
  8038. ADD_ALL_TESTS(test_key_exchange, 14);
  8039. # if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_DH)
  8040. ADD_ALL_TESTS(test_negotiated_group,
  8041. 4 * (OSSL_NELEM(ecdhe_kexch_groups)
  8042. + OSSL_NELEM(ffdhe_kexch_groups)));
  8043. # endif
  8044. # else
  8045. /* Test with only TLSv1.3 versions */
  8046. ADD_ALL_TESTS(test_key_exchange, 12);
  8047. # endif
  8048. ADD_ALL_TESTS(test_custom_exts, 5);
  8049. ADD_TEST(test_stateless);
  8050. ADD_TEST(test_pha_key_update);
  8051. #else
  8052. ADD_ALL_TESTS(test_custom_exts, 3);
  8053. #endif
  8054. ADD_ALL_TESTS(test_serverinfo, 8);
  8055. ADD_ALL_TESTS(test_export_key_mat, 6);
  8056. #ifndef OSSL_NO_USABLE_TLS1_3
  8057. ADD_ALL_TESTS(test_export_key_mat_early, 3);
  8058. ADD_TEST(test_key_update);
  8059. ADD_ALL_TESTS(test_key_update_in_write, 2);
  8060. #endif
  8061. ADD_ALL_TESTS(test_ssl_clear, 2);
  8062. ADD_ALL_TESTS(test_max_fragment_len_ext, OSSL_NELEM(max_fragment_len_test));
  8063. #if !defined(OPENSSL_NO_SRP) && !defined(OPENSSL_NO_TLS1_2)
  8064. ADD_ALL_TESTS(test_srp, 6);
  8065. #endif
  8066. ADD_ALL_TESTS(test_info_callback, 6);
  8067. ADD_ALL_TESTS(test_ssl_pending, 2);
  8068. ADD_ALL_TESTS(test_ssl_get_shared_ciphers, OSSL_NELEM(shared_ciphers_data));
  8069. ADD_ALL_TESTS(test_ticket_callbacks, 16);
  8070. ADD_ALL_TESTS(test_shutdown, 7);
  8071. ADD_ALL_TESTS(test_incorrect_shutdown, 2);
  8072. ADD_ALL_TESTS(test_cert_cb, 6);
  8073. ADD_ALL_TESTS(test_client_cert_cb, 2);
  8074. ADD_ALL_TESTS(test_ca_names, 3);
  8075. #ifndef OPENSSL_NO_TLS1_2
  8076. ADD_ALL_TESTS(test_multiblock_write, OSSL_NELEM(multiblock_cipherlist_data));
  8077. #endif
  8078. ADD_ALL_TESTS(test_servername, 10);
  8079. #if !defined(OPENSSL_NO_EC) \
  8080. && (!defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2))
  8081. ADD_ALL_TESTS(test_sigalgs_available, 6);
  8082. #endif
  8083. #ifndef OPENSSL_NO_TLS1_3
  8084. ADD_ALL_TESTS(test_pluggable_group, 2);
  8085. #endif
  8086. #ifndef OPENSSL_NO_TLS1_2
  8087. ADD_TEST(test_ssl_dup);
  8088. # ifndef OPENSSL_NO_DH
  8089. ADD_ALL_TESTS(test_set_tmp_dh, 11);
  8090. ADD_ALL_TESTS(test_dh_auto, 7);
  8091. # endif
  8092. #endif
  8093. #ifndef OSSL_NO_USABLE_TLS1_3
  8094. ADD_TEST(test_sni_tls13);
  8095. #endif
  8096. ADD_TEST(test_inherit_verify_param);
  8097. ADD_TEST(test_set_alpn);
  8098. return 1;
  8099. err:
  8100. OPENSSL_free(cert);
  8101. OPENSSL_free(privkey);
  8102. OPENSSL_free(cert2);
  8103. OPENSSL_free(privkey2);
  8104. return 0;
  8105. }
  8106. void cleanup_tests(void)
  8107. {
  8108. # if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_DH)
  8109. EVP_PKEY_free(tmp_dh_params);
  8110. #endif
  8111. OPENSSL_free(cert);
  8112. OPENSSL_free(privkey);
  8113. OPENSSL_free(cert2);
  8114. OPENSSL_free(privkey2);
  8115. OPENSSL_free(cert1024);
  8116. OPENSSL_free(privkey1024);
  8117. OPENSSL_free(cert3072);
  8118. OPENSSL_free(privkey3072);
  8119. OPENSSL_free(cert4096);
  8120. OPENSSL_free(privkey4096);
  8121. OPENSSL_free(cert8192);
  8122. OPENSSL_free(privkey8192);
  8123. bio_s_mempacket_test_free();
  8124. bio_s_always_retry_free();
  8125. OSSL_PROVIDER_unload(defctxnull);
  8126. OSSL_LIB_CTX_free(libctx);
  8127. }