ssl_test_ctx.h 8.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249
  1. /*
  2. * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #ifndef HEADER_SSL_TEST_CTX_H
  10. #define HEADER_SSL_TEST_CTX_H
  11. #include <openssl/conf.h>
  12. #include <openssl/ssl.h>
  13. typedef enum {
  14. SSL_TEST_SUCCESS = 0, /* Default */
  15. SSL_TEST_SERVER_FAIL,
  16. SSL_TEST_CLIENT_FAIL,
  17. SSL_TEST_INTERNAL_ERROR,
  18. /* Couldn't test resumption/renegotiation: original handshake failed. */
  19. SSL_TEST_FIRST_HANDSHAKE_FAILED
  20. } ssl_test_result_t;
  21. typedef enum {
  22. SSL_TEST_VERIFY_NONE = 0, /* Default */
  23. SSL_TEST_VERIFY_ACCEPT_ALL,
  24. SSL_TEST_VERIFY_REJECT_ALL
  25. } ssl_verify_callback_t;
  26. typedef enum {
  27. SSL_TEST_SERVERNAME_NONE = 0, /* Default */
  28. SSL_TEST_SERVERNAME_SERVER1,
  29. SSL_TEST_SERVERNAME_SERVER2,
  30. SSL_TEST_SERVERNAME_INVALID
  31. } ssl_servername_t;
  32. typedef enum {
  33. SSL_TEST_SERVERNAME_CB_NONE = 0, /* Default */
  34. SSL_TEST_SERVERNAME_IGNORE_MISMATCH,
  35. SSL_TEST_SERVERNAME_REJECT_MISMATCH,
  36. SSL_TEST_SERVERNAME_CLIENT_HELLO_IGNORE_MISMATCH,
  37. SSL_TEST_SERVERNAME_CLIENT_HELLO_REJECT_MISMATCH,
  38. SSL_TEST_SERVERNAME_CLIENT_HELLO_NO_V12
  39. } ssl_servername_callback_t;
  40. typedef enum {
  41. SSL_TEST_SESSION_TICKET_IGNORE = 0, /* Default */
  42. SSL_TEST_SESSION_TICKET_YES,
  43. SSL_TEST_SESSION_TICKET_NO,
  44. SSL_TEST_SESSION_TICKET_BROKEN /* Special test */
  45. } ssl_session_ticket_t;
  46. typedef enum {
  47. SSL_TEST_COMPRESSION_NO = 0, /* Default */
  48. SSL_TEST_COMPRESSION_YES
  49. } ssl_compression_t;
  50. typedef enum {
  51. SSL_TEST_SESSION_ID_IGNORE = 0, /* Default */
  52. SSL_TEST_SESSION_ID_YES,
  53. SSL_TEST_SESSION_ID_NO
  54. } ssl_session_id_t;
  55. typedef enum {
  56. SSL_TEST_METHOD_TLS = 0, /* Default */
  57. SSL_TEST_METHOD_DTLS
  58. } ssl_test_method_t;
  59. typedef enum {
  60. SSL_TEST_HANDSHAKE_SIMPLE = 0, /* Default */
  61. SSL_TEST_HANDSHAKE_RESUME,
  62. SSL_TEST_HANDSHAKE_RENEG_SERVER,
  63. SSL_TEST_HANDSHAKE_RENEG_CLIENT,
  64. SSL_TEST_HANDSHAKE_KEY_UPDATE_SERVER,
  65. SSL_TEST_HANDSHAKE_KEY_UPDATE_CLIENT,
  66. SSL_TEST_HANDSHAKE_POST_HANDSHAKE_AUTH
  67. } ssl_handshake_mode_t;
  68. typedef enum {
  69. SSL_TEST_CT_VALIDATION_NONE = 0, /* Default */
  70. SSL_TEST_CT_VALIDATION_PERMISSIVE,
  71. SSL_TEST_CT_VALIDATION_STRICT
  72. } ssl_ct_validation_t;
  73. typedef enum {
  74. SSL_TEST_CERT_STATUS_NONE = 0, /* Default */
  75. SSL_TEST_CERT_STATUS_GOOD_RESPONSE,
  76. SSL_TEST_CERT_STATUS_BAD_RESPONSE
  77. } ssl_cert_status_t;
  78. /*
  79. * Server/client settings that aren't supported by the SSL CONF library,
  80. * such as callbacks.
  81. */
  82. typedef struct {
  83. /* One of a number of predefined custom callbacks. */
  84. ssl_verify_callback_t verify_callback;
  85. /* One of a number of predefined server names use by the client */
  86. ssl_servername_t servername;
  87. /* Maximum Fragment Length extension mode */
  88. int max_fragment_len_mode;
  89. /* Supported NPN and ALPN protocols. A comma-separated list. */
  90. char *npn_protocols;
  91. char *alpn_protocols;
  92. ssl_ct_validation_t ct_validation;
  93. /* Ciphersuites to set on a renegotiation */
  94. char *reneg_ciphers;
  95. char *srp_user;
  96. char *srp_password;
  97. /* Forced PHA */
  98. int force_pha;
  99. } SSL_TEST_CLIENT_CONF;
  100. typedef struct {
  101. /* SNI callback (server-side). */
  102. ssl_servername_callback_t servername_callback;
  103. /* Supported NPN and ALPN protocols. A comma-separated list. */
  104. char *npn_protocols;
  105. char *alpn_protocols;
  106. /* Whether to set a broken session ticket callback. */
  107. int broken_session_ticket;
  108. /* Should we send a CertStatus message? */
  109. ssl_cert_status_t cert_status;
  110. /* An SRP user known to the server. */
  111. char *srp_user;
  112. char *srp_password;
  113. /* Forced PHA */
  114. int force_pha;
  115. char *session_ticket_app_data;
  116. } SSL_TEST_SERVER_CONF;
  117. typedef struct {
  118. SSL_TEST_CLIENT_CONF client;
  119. SSL_TEST_SERVER_CONF server;
  120. SSL_TEST_SERVER_CONF server2;
  121. } SSL_TEST_EXTRA_CONF;
  122. typedef struct {
  123. /*
  124. * Global test configuration. Does not change between handshakes.
  125. */
  126. /* Whether the server/client CTX should use DTLS or TLS. */
  127. ssl_test_method_t method;
  128. /* Whether to test a resumed/renegotiated handshake. */
  129. ssl_handshake_mode_t handshake_mode;
  130. /*
  131. * How much application data to exchange (default is 256 bytes).
  132. * Both peers will send |app_data_size| bytes interleaved.
  133. */
  134. int app_data_size;
  135. /* Maximum send fragment size. */
  136. int max_fragment_size;
  137. /* KeyUpdate type */
  138. int key_update_type;
  139. /*
  140. * Extra server/client configurations. Per-handshake.
  141. */
  142. /* First handshake. */
  143. SSL_TEST_EXTRA_CONF extra;
  144. /* Resumed handshake. */
  145. SSL_TEST_EXTRA_CONF resume_extra;
  146. /*
  147. * Test expectations. These apply to the LAST handshake.
  148. */
  149. /* Defaults to SUCCESS. */
  150. ssl_test_result_t expected_result;
  151. /* Alerts. 0 if no expectation. */
  152. /* See ssl.h for alert codes. */
  153. /* Alert sent by the client / received by the server. */
  154. int expected_client_alert;
  155. /* Alert sent by the server / received by the client. */
  156. int expected_server_alert;
  157. /* Negotiated protocol version. 0 if no expectation. */
  158. /* See ssl.h for protocol versions. */
  159. int expected_protocol;
  160. /*
  161. * The expected SNI context to use.
  162. * We test server-side that the server switched to the expected context.
  163. * Set by the callback upon success, so if the callback wasn't called or
  164. * terminated with an alert, the servername will match with
  165. * SSL_TEST_SERVERNAME_NONE.
  166. * Note: in the event that the servername was accepted, the client should
  167. * also receive an empty SNI extension back but we have no way of probing
  168. * client-side via the API that this was the case.
  169. */
  170. ssl_servername_t expected_servername;
  171. ssl_session_ticket_t session_ticket_expected;
  172. int compression_expected;
  173. /* The expected NPN/ALPN protocol to negotiate. */
  174. char *expected_npn_protocol;
  175. char *expected_alpn_protocol;
  176. /* Whether the second handshake is resumed or a full handshake (boolean). */
  177. int resumption_expected;
  178. /* Expected temporary key type */
  179. int expected_tmp_key_type;
  180. /* Expected server certificate key type */
  181. int expected_server_cert_type;
  182. /* Expected server signing hash */
  183. int expected_server_sign_hash;
  184. /* Expected server signature type */
  185. int expected_server_sign_type;
  186. /* Expected server CA names */
  187. STACK_OF(X509_NAME) *expected_server_ca_names;
  188. /* Expected client certificate key type */
  189. int expected_client_cert_type;
  190. /* Expected client signing hash */
  191. int expected_client_sign_hash;
  192. /* Expected client signature type */
  193. int expected_client_sign_type;
  194. /* Expected CA names for client auth */
  195. STACK_OF(X509_NAME) *expected_client_ca_names;
  196. /* Whether to use SCTP for the transport */
  197. int use_sctp;
  198. /* Whether to expect a session id from the server */
  199. ssl_session_id_t session_id_expected;
  200. char *expected_cipher;
  201. /* Expected Session Ticket Application Data */
  202. char *expected_session_ticket_app_data;
  203. } SSL_TEST_CTX;
  204. const char *ssl_test_result_name(ssl_test_result_t result);
  205. const char *ssl_alert_name(int alert);
  206. const char *ssl_protocol_name(int protocol);
  207. const char *ssl_verify_callback_name(ssl_verify_callback_t verify_callback);
  208. const char *ssl_servername_name(ssl_servername_t server);
  209. const char *ssl_servername_callback_name(ssl_servername_callback_t
  210. servername_callback);
  211. const char *ssl_session_ticket_name(ssl_session_ticket_t server);
  212. const char *ssl_session_id_name(ssl_session_id_t server);
  213. const char *ssl_test_method_name(ssl_test_method_t method);
  214. const char *ssl_handshake_mode_name(ssl_handshake_mode_t mode);
  215. const char *ssl_ct_validation_name(ssl_ct_validation_t mode);
  216. const char *ssl_certstatus_name(ssl_cert_status_t cert_status);
  217. const char *ssl_max_fragment_len_name(int MFL_mode);
  218. /*
  219. * Load the test case context from |conf|.
  220. * See test/README.ssltest.md for details on the conf file format.
  221. */
  222. SSL_TEST_CTX *SSL_TEST_CTX_create(const CONF *conf, const char *test_section);
  223. SSL_TEST_CTX *SSL_TEST_CTX_new(void);
  224. void SSL_TEST_CTX_free(SSL_TEST_CTX *ctx);
  225. #endif /* HEADER_SSL_TEST_CTX_H */