2
0

ssl_test_ctx.c 29 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895
  1. /*
  2. * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <string.h>
  10. #include <openssl/e_os2.h>
  11. #include <openssl/crypto.h>
  12. #include "internal/nelem.h"
  13. #include "ssl_test_ctx.h"
  14. #include "testutil.h"
  15. #ifdef OPENSSL_SYS_WINDOWS
  16. # define strcasecmp _stricmp
  17. #endif
  18. static const int default_app_data_size = 256;
  19. /* Default set to be as small as possible to exercise fragmentation. */
  20. static const int default_max_fragment_size = 512;
  21. static int parse_boolean(const char *value, int *result)
  22. {
  23. if (strcasecmp(value, "Yes") == 0) {
  24. *result = 1;
  25. return 1;
  26. }
  27. else if (strcasecmp(value, "No") == 0) {
  28. *result = 0;
  29. return 1;
  30. }
  31. TEST_error("parse_boolean given: '%s'", value);
  32. return 0;
  33. }
  34. #define IMPLEMENT_SSL_TEST_BOOL_OPTION(struct_type, name, field) \
  35. static int parse_##name##_##field(struct_type *ctx, const char *value) \
  36. { \
  37. return parse_boolean(value, &ctx->field); \
  38. }
  39. #define IMPLEMENT_SSL_TEST_STRING_OPTION(struct_type, name, field) \
  40. static int parse_##name##_##field(struct_type *ctx, const char *value) \
  41. { \
  42. OPENSSL_free(ctx->field); \
  43. ctx->field = OPENSSL_strdup(value); \
  44. return TEST_ptr(ctx->field); \
  45. }
  46. #define IMPLEMENT_SSL_TEST_INT_OPTION(struct_type, name, field) \
  47. static int parse_##name##_##field(struct_type *ctx, const char *value) \
  48. { \
  49. ctx->field = atoi(value); \
  50. return 1; \
  51. }
  52. /* True enums and other test configuration values that map to an int. */
  53. typedef struct {
  54. const char *name;
  55. int value;
  56. } test_enum;
  57. __owur static int parse_enum(const test_enum *enums, size_t num_enums,
  58. int *value, const char *name)
  59. {
  60. size_t i;
  61. for (i = 0; i < num_enums; i++) {
  62. if (strcmp(enums[i].name, name) == 0) {
  63. *value = enums[i].value;
  64. return 1;
  65. }
  66. }
  67. return 0;
  68. }
  69. static const char *enum_name(const test_enum *enums, size_t num_enums,
  70. int value)
  71. {
  72. size_t i;
  73. for (i = 0; i < num_enums; i++) {
  74. if (enums[i].value == value) {
  75. return enums[i].name;
  76. }
  77. }
  78. return "InvalidValue";
  79. }
  80. /* ExpectedResult */
  81. static const test_enum ssl_test_results[] = {
  82. {"Success", SSL_TEST_SUCCESS},
  83. {"ServerFail", SSL_TEST_SERVER_FAIL},
  84. {"ClientFail", SSL_TEST_CLIENT_FAIL},
  85. {"InternalError", SSL_TEST_INTERNAL_ERROR},
  86. {"FirstHandshakeFailed", SSL_TEST_FIRST_HANDSHAKE_FAILED},
  87. };
  88. __owur static int parse_expected_result(SSL_TEST_CTX *test_ctx, const char *value)
  89. {
  90. int ret_value;
  91. if (!parse_enum(ssl_test_results, OSSL_NELEM(ssl_test_results),
  92. &ret_value, value)) {
  93. return 0;
  94. }
  95. test_ctx->expected_result = ret_value;
  96. return 1;
  97. }
  98. const char *ssl_test_result_name(ssl_test_result_t result)
  99. {
  100. return enum_name(ssl_test_results, OSSL_NELEM(ssl_test_results), result);
  101. }
  102. /* ExpectedClientAlert / ExpectedServerAlert */
  103. static const test_enum ssl_alerts[] = {
  104. {"UnknownCA", SSL_AD_UNKNOWN_CA},
  105. {"HandshakeFailure", SSL_AD_HANDSHAKE_FAILURE},
  106. {"UnrecognizedName", SSL_AD_UNRECOGNIZED_NAME},
  107. {"BadCertificate", SSL_AD_BAD_CERTIFICATE},
  108. {"NoApplicationProtocol", SSL_AD_NO_APPLICATION_PROTOCOL},
  109. {"CertificateRequired", SSL_AD_CERTIFICATE_REQUIRED},
  110. };
  111. __owur static int parse_alert(int *alert, const char *value)
  112. {
  113. return parse_enum(ssl_alerts, OSSL_NELEM(ssl_alerts), alert, value);
  114. }
  115. __owur static int parse_client_alert(SSL_TEST_CTX *test_ctx, const char *value)
  116. {
  117. return parse_alert(&test_ctx->expected_client_alert, value);
  118. }
  119. __owur static int parse_server_alert(SSL_TEST_CTX *test_ctx, const char *value)
  120. {
  121. return parse_alert(&test_ctx->expected_server_alert, value);
  122. }
  123. const char *ssl_alert_name(int alert)
  124. {
  125. return enum_name(ssl_alerts, OSSL_NELEM(ssl_alerts), alert);
  126. }
  127. /* ExpectedProtocol */
  128. static const test_enum ssl_protocols[] = {
  129. {"TLSv1.3", TLS1_3_VERSION},
  130. {"TLSv1.2", TLS1_2_VERSION},
  131. {"TLSv1.1", TLS1_1_VERSION},
  132. {"TLSv1", TLS1_VERSION},
  133. {"SSLv3", SSL3_VERSION},
  134. {"DTLSv1", DTLS1_VERSION},
  135. {"DTLSv1.2", DTLS1_2_VERSION},
  136. };
  137. __owur static int parse_protocol(SSL_TEST_CTX *test_ctx, const char *value)
  138. {
  139. return parse_enum(ssl_protocols, OSSL_NELEM(ssl_protocols),
  140. &test_ctx->expected_protocol, value);
  141. }
  142. const char *ssl_protocol_name(int protocol)
  143. {
  144. return enum_name(ssl_protocols, OSSL_NELEM(ssl_protocols), protocol);
  145. }
  146. /* VerifyCallback */
  147. static const test_enum ssl_verify_callbacks[] = {
  148. {"None", SSL_TEST_VERIFY_NONE},
  149. {"AcceptAll", SSL_TEST_VERIFY_ACCEPT_ALL},
  150. {"RejectAll", SSL_TEST_VERIFY_REJECT_ALL},
  151. };
  152. __owur static int parse_client_verify_callback(SSL_TEST_CLIENT_CONF *client_conf,
  153. const char *value)
  154. {
  155. int ret_value;
  156. if (!parse_enum(ssl_verify_callbacks, OSSL_NELEM(ssl_verify_callbacks),
  157. &ret_value, value)) {
  158. return 0;
  159. }
  160. client_conf->verify_callback = ret_value;
  161. return 1;
  162. }
  163. const char *ssl_verify_callback_name(ssl_verify_callback_t callback)
  164. {
  165. return enum_name(ssl_verify_callbacks, OSSL_NELEM(ssl_verify_callbacks),
  166. callback);
  167. }
  168. /* ServerName */
  169. static const test_enum ssl_servername[] = {
  170. {"None", SSL_TEST_SERVERNAME_NONE},
  171. {"server1", SSL_TEST_SERVERNAME_SERVER1},
  172. {"server2", SSL_TEST_SERVERNAME_SERVER2},
  173. {"invalid", SSL_TEST_SERVERNAME_INVALID},
  174. };
  175. __owur static int parse_servername(SSL_TEST_CLIENT_CONF *client_conf,
  176. const char *value)
  177. {
  178. int ret_value;
  179. if (!parse_enum(ssl_servername, OSSL_NELEM(ssl_servername),
  180. &ret_value, value)) {
  181. return 0;
  182. }
  183. client_conf->servername = ret_value;
  184. return 1;
  185. }
  186. __owur static int parse_expected_servername(SSL_TEST_CTX *test_ctx,
  187. const char *value)
  188. {
  189. int ret_value;
  190. if (!parse_enum(ssl_servername, OSSL_NELEM(ssl_servername),
  191. &ret_value, value)) {
  192. return 0;
  193. }
  194. test_ctx->expected_servername = ret_value;
  195. return 1;
  196. }
  197. const char *ssl_servername_name(ssl_servername_t server)
  198. {
  199. return enum_name(ssl_servername, OSSL_NELEM(ssl_servername),
  200. server);
  201. }
  202. /* ServerNameCallback */
  203. static const test_enum ssl_servername_callbacks[] = {
  204. {"None", SSL_TEST_SERVERNAME_CB_NONE},
  205. {"IgnoreMismatch", SSL_TEST_SERVERNAME_IGNORE_MISMATCH},
  206. {"RejectMismatch", SSL_TEST_SERVERNAME_REJECT_MISMATCH},
  207. {"ClientHelloIgnoreMismatch",
  208. SSL_TEST_SERVERNAME_CLIENT_HELLO_IGNORE_MISMATCH},
  209. {"ClientHelloRejectMismatch",
  210. SSL_TEST_SERVERNAME_CLIENT_HELLO_REJECT_MISMATCH},
  211. {"ClientHelloNoV12", SSL_TEST_SERVERNAME_CLIENT_HELLO_NO_V12},
  212. };
  213. __owur static int parse_servername_callback(SSL_TEST_SERVER_CONF *server_conf,
  214. const char *value)
  215. {
  216. int ret_value;
  217. if (!parse_enum(ssl_servername_callbacks,
  218. OSSL_NELEM(ssl_servername_callbacks), &ret_value, value)) {
  219. return 0;
  220. }
  221. server_conf->servername_callback = ret_value;
  222. return 1;
  223. }
  224. const char *ssl_servername_callback_name(ssl_servername_callback_t callback)
  225. {
  226. return enum_name(ssl_servername_callbacks,
  227. OSSL_NELEM(ssl_servername_callbacks), callback);
  228. }
  229. /* SessionTicketExpected */
  230. static const test_enum ssl_session_ticket[] = {
  231. {"Ignore", SSL_TEST_SESSION_TICKET_IGNORE},
  232. {"Yes", SSL_TEST_SESSION_TICKET_YES},
  233. {"No", SSL_TEST_SESSION_TICKET_NO},
  234. };
  235. __owur static int parse_session_ticket(SSL_TEST_CTX *test_ctx, const char *value)
  236. {
  237. int ret_value;
  238. if (!parse_enum(ssl_session_ticket, OSSL_NELEM(ssl_session_ticket),
  239. &ret_value, value)) {
  240. return 0;
  241. }
  242. test_ctx->session_ticket_expected = ret_value;
  243. return 1;
  244. }
  245. const char *ssl_session_ticket_name(ssl_session_ticket_t server)
  246. {
  247. return enum_name(ssl_session_ticket,
  248. OSSL_NELEM(ssl_session_ticket),
  249. server);
  250. }
  251. /* CompressionExpected */
  252. IMPLEMENT_SSL_TEST_BOOL_OPTION(SSL_TEST_CTX, test, compression_expected)
  253. /* SessionIdExpected */
  254. static const test_enum ssl_session_id[] = {
  255. {"Ignore", SSL_TEST_SESSION_ID_IGNORE},
  256. {"Yes", SSL_TEST_SESSION_ID_YES},
  257. {"No", SSL_TEST_SESSION_ID_NO},
  258. };
  259. __owur static int parse_session_id(SSL_TEST_CTX *test_ctx, const char *value)
  260. {
  261. int ret_value;
  262. if (!parse_enum(ssl_session_id, OSSL_NELEM(ssl_session_id),
  263. &ret_value, value)) {
  264. return 0;
  265. }
  266. test_ctx->session_id_expected = ret_value;
  267. return 1;
  268. }
  269. const char *ssl_session_id_name(ssl_session_id_t server)
  270. {
  271. return enum_name(ssl_session_id,
  272. OSSL_NELEM(ssl_session_id),
  273. server);
  274. }
  275. /* Method */
  276. static const test_enum ssl_test_methods[] = {
  277. {"TLS", SSL_TEST_METHOD_TLS},
  278. {"DTLS", SSL_TEST_METHOD_DTLS},
  279. };
  280. __owur static int parse_test_method(SSL_TEST_CTX *test_ctx, const char *value)
  281. {
  282. int ret_value;
  283. if (!parse_enum(ssl_test_methods, OSSL_NELEM(ssl_test_methods),
  284. &ret_value, value)) {
  285. return 0;
  286. }
  287. test_ctx->method = ret_value;
  288. return 1;
  289. }
  290. const char *ssl_test_method_name(ssl_test_method_t method)
  291. {
  292. return enum_name(ssl_test_methods, OSSL_NELEM(ssl_test_methods), method);
  293. }
  294. /* NPN and ALPN options */
  295. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_CLIENT_CONF, client, npn_protocols)
  296. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_SERVER_CONF, server, npn_protocols)
  297. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_CTX, test, expected_npn_protocol)
  298. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_CLIENT_CONF, client, alpn_protocols)
  299. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_SERVER_CONF, server, alpn_protocols)
  300. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_CTX, test, expected_alpn_protocol)
  301. /* SRP options */
  302. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_CLIENT_CONF, client, srp_user)
  303. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_SERVER_CONF, server, srp_user)
  304. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_CLIENT_CONF, client, srp_password)
  305. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_SERVER_CONF, server, srp_password)
  306. /* Session Ticket App Data options */
  307. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_CTX, test, expected_session_ticket_app_data)
  308. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_SERVER_CONF, server, session_ticket_app_data)
  309. /* Handshake mode */
  310. static const test_enum ssl_handshake_modes[] = {
  311. {"Simple", SSL_TEST_HANDSHAKE_SIMPLE},
  312. {"Resume", SSL_TEST_HANDSHAKE_RESUME},
  313. {"RenegotiateServer", SSL_TEST_HANDSHAKE_RENEG_SERVER},
  314. {"RenegotiateClient", SSL_TEST_HANDSHAKE_RENEG_CLIENT},
  315. {"KeyUpdateServer", SSL_TEST_HANDSHAKE_KEY_UPDATE_SERVER},
  316. {"KeyUpdateClient", SSL_TEST_HANDSHAKE_KEY_UPDATE_CLIENT},
  317. {"PostHandshakeAuth", SSL_TEST_HANDSHAKE_POST_HANDSHAKE_AUTH},
  318. };
  319. __owur static int parse_handshake_mode(SSL_TEST_CTX *test_ctx, const char *value)
  320. {
  321. int ret_value;
  322. if (!parse_enum(ssl_handshake_modes, OSSL_NELEM(ssl_handshake_modes),
  323. &ret_value, value)) {
  324. return 0;
  325. }
  326. test_ctx->handshake_mode = ret_value;
  327. return 1;
  328. }
  329. const char *ssl_handshake_mode_name(ssl_handshake_mode_t mode)
  330. {
  331. return enum_name(ssl_handshake_modes, OSSL_NELEM(ssl_handshake_modes),
  332. mode);
  333. }
  334. /* Renegotiation Ciphersuites */
  335. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_CLIENT_CONF, client, reneg_ciphers)
  336. /* KeyUpdateType */
  337. static const test_enum ssl_key_update_types[] = {
  338. {"KeyUpdateRequested", SSL_KEY_UPDATE_REQUESTED},
  339. {"KeyUpdateNotRequested", SSL_KEY_UPDATE_NOT_REQUESTED},
  340. };
  341. __owur static int parse_key_update_type(SSL_TEST_CTX *test_ctx, const char *value)
  342. {
  343. int ret_value;
  344. if (!parse_enum(ssl_key_update_types, OSSL_NELEM(ssl_key_update_types),
  345. &ret_value, value)) {
  346. return 0;
  347. }
  348. test_ctx->key_update_type = ret_value;
  349. return 1;
  350. }
  351. /* CT Validation */
  352. static const test_enum ssl_ct_validation_modes[] = {
  353. {"None", SSL_TEST_CT_VALIDATION_NONE},
  354. {"Permissive", SSL_TEST_CT_VALIDATION_PERMISSIVE},
  355. {"Strict", SSL_TEST_CT_VALIDATION_STRICT},
  356. };
  357. __owur static int parse_ct_validation(SSL_TEST_CLIENT_CONF *client_conf,
  358. const char *value)
  359. {
  360. int ret_value;
  361. if (!parse_enum(ssl_ct_validation_modes, OSSL_NELEM(ssl_ct_validation_modes),
  362. &ret_value, value)) {
  363. return 0;
  364. }
  365. client_conf->ct_validation = ret_value;
  366. return 1;
  367. }
  368. const char *ssl_ct_validation_name(ssl_ct_validation_t mode)
  369. {
  370. return enum_name(ssl_ct_validation_modes, OSSL_NELEM(ssl_ct_validation_modes),
  371. mode);
  372. }
  373. IMPLEMENT_SSL_TEST_BOOL_OPTION(SSL_TEST_CTX, test, resumption_expected)
  374. IMPLEMENT_SSL_TEST_BOOL_OPTION(SSL_TEST_SERVER_CONF, server, broken_session_ticket)
  375. IMPLEMENT_SSL_TEST_BOOL_OPTION(SSL_TEST_CTX, test, use_sctp)
  376. IMPLEMENT_SSL_TEST_BOOL_OPTION(SSL_TEST_CTX, test, enable_client_sctp_label_bug)
  377. IMPLEMENT_SSL_TEST_BOOL_OPTION(SSL_TEST_CTX, test, enable_server_sctp_label_bug)
  378. /* CertStatus */
  379. static const test_enum ssl_certstatus[] = {
  380. {"None", SSL_TEST_CERT_STATUS_NONE},
  381. {"GoodResponse", SSL_TEST_CERT_STATUS_GOOD_RESPONSE},
  382. {"BadResponse", SSL_TEST_CERT_STATUS_BAD_RESPONSE}
  383. };
  384. __owur static int parse_certstatus(SSL_TEST_SERVER_CONF *server_conf,
  385. const char *value)
  386. {
  387. int ret_value;
  388. if (!parse_enum(ssl_certstatus, OSSL_NELEM(ssl_certstatus), &ret_value,
  389. value)) {
  390. return 0;
  391. }
  392. server_conf->cert_status = ret_value;
  393. return 1;
  394. }
  395. const char *ssl_certstatus_name(ssl_cert_status_t cert_status)
  396. {
  397. return enum_name(ssl_certstatus,
  398. OSSL_NELEM(ssl_certstatus), cert_status);
  399. }
  400. /* ApplicationData */
  401. IMPLEMENT_SSL_TEST_INT_OPTION(SSL_TEST_CTX, test, app_data_size)
  402. /* MaxFragmentSize */
  403. IMPLEMENT_SSL_TEST_INT_OPTION(SSL_TEST_CTX, test, max_fragment_size)
  404. /* Maximum-Fragment-Length TLS extension mode */
  405. static const test_enum ssl_max_fragment_len_mode[] = {
  406. {"None", TLSEXT_max_fragment_length_DISABLED},
  407. { "512", TLSEXT_max_fragment_length_512},
  408. {"1024", TLSEXT_max_fragment_length_1024},
  409. {"2048", TLSEXT_max_fragment_length_2048},
  410. {"4096", TLSEXT_max_fragment_length_4096}
  411. };
  412. __owur static int parse_max_fragment_len_mode(SSL_TEST_CLIENT_CONF *client_conf,
  413. const char *value)
  414. {
  415. int ret_value;
  416. if (!parse_enum(ssl_max_fragment_len_mode,
  417. OSSL_NELEM(ssl_max_fragment_len_mode), &ret_value, value)) {
  418. return 0;
  419. }
  420. client_conf->max_fragment_len_mode = ret_value;
  421. return 1;
  422. }
  423. const char *ssl_max_fragment_len_name(int MFL_mode)
  424. {
  425. return enum_name(ssl_max_fragment_len_mode,
  426. OSSL_NELEM(ssl_max_fragment_len_mode), MFL_mode);
  427. }
  428. /* Expected key and signature types */
  429. __owur static int parse_expected_key_type(int *ptype, const char *value)
  430. {
  431. int nid;
  432. const EVP_PKEY_ASN1_METHOD *ameth;
  433. if (value == NULL)
  434. return 0;
  435. ameth = EVP_PKEY_asn1_find_str(NULL, value, -1);
  436. if (ameth != NULL)
  437. EVP_PKEY_asn1_get0_info(&nid, NULL, NULL, NULL, NULL, ameth);
  438. else
  439. nid = OBJ_sn2nid(value);
  440. if (nid == NID_undef)
  441. nid = OBJ_ln2nid(value);
  442. #ifndef OPENSSL_NO_EC
  443. if (nid == NID_undef)
  444. nid = EC_curve_nist2nid(value);
  445. #endif
  446. if (nid == NID_undef)
  447. return 0;
  448. *ptype = nid;
  449. return 1;
  450. }
  451. __owur static int parse_expected_tmp_key_type(SSL_TEST_CTX *test_ctx,
  452. const char *value)
  453. {
  454. return parse_expected_key_type(&test_ctx->expected_tmp_key_type, value);
  455. }
  456. __owur static int parse_expected_server_cert_type(SSL_TEST_CTX *test_ctx,
  457. const char *value)
  458. {
  459. return parse_expected_key_type(&test_ctx->expected_server_cert_type,
  460. value);
  461. }
  462. __owur static int parse_expected_server_sign_type(SSL_TEST_CTX *test_ctx,
  463. const char *value)
  464. {
  465. return parse_expected_key_type(&test_ctx->expected_server_sign_type,
  466. value);
  467. }
  468. __owur static int parse_expected_client_cert_type(SSL_TEST_CTX *test_ctx,
  469. const char *value)
  470. {
  471. return parse_expected_key_type(&test_ctx->expected_client_cert_type,
  472. value);
  473. }
  474. __owur static int parse_expected_client_sign_type(SSL_TEST_CTX *test_ctx,
  475. const char *value)
  476. {
  477. return parse_expected_key_type(&test_ctx->expected_client_sign_type,
  478. value);
  479. }
  480. /* Expected signing hash */
  481. __owur static int parse_expected_sign_hash(int *ptype, const char *value)
  482. {
  483. int nid;
  484. if (value == NULL)
  485. return 0;
  486. nid = OBJ_sn2nid(value);
  487. if (nid == NID_undef)
  488. nid = OBJ_ln2nid(value);
  489. if (nid == NID_undef)
  490. return 0;
  491. *ptype = nid;
  492. return 1;
  493. }
  494. __owur static int parse_expected_server_sign_hash(SSL_TEST_CTX *test_ctx,
  495. const char *value)
  496. {
  497. return parse_expected_sign_hash(&test_ctx->expected_server_sign_hash,
  498. value);
  499. }
  500. __owur static int parse_expected_client_sign_hash(SSL_TEST_CTX *test_ctx,
  501. const char *value)
  502. {
  503. return parse_expected_sign_hash(&test_ctx->expected_client_sign_hash,
  504. value);
  505. }
  506. __owur static int parse_expected_ca_names(STACK_OF(X509_NAME) **pnames,
  507. const char *value)
  508. {
  509. if (value == NULL)
  510. return 0;
  511. if (!strcmp(value, "empty"))
  512. *pnames = sk_X509_NAME_new_null();
  513. else
  514. *pnames = SSL_load_client_CA_file(value);
  515. return *pnames != NULL;
  516. }
  517. __owur static int parse_expected_server_ca_names(SSL_TEST_CTX *test_ctx,
  518. const char *value)
  519. {
  520. return parse_expected_ca_names(&test_ctx->expected_server_ca_names, value);
  521. }
  522. __owur static int parse_expected_client_ca_names(SSL_TEST_CTX *test_ctx,
  523. const char *value)
  524. {
  525. return parse_expected_ca_names(&test_ctx->expected_client_ca_names, value);
  526. }
  527. /* ExpectedCipher */
  528. IMPLEMENT_SSL_TEST_STRING_OPTION(SSL_TEST_CTX, test, expected_cipher)
  529. /* Client and Server PHA */
  530. IMPLEMENT_SSL_TEST_BOOL_OPTION(SSL_TEST_CLIENT_CONF, client, enable_pha)
  531. IMPLEMENT_SSL_TEST_BOOL_OPTION(SSL_TEST_SERVER_CONF, server, force_pha)
  532. /* Known test options and their corresponding parse methods. */
  533. /* Top-level options. */
  534. typedef struct {
  535. const char *name;
  536. int (*parse)(SSL_TEST_CTX *test_ctx, const char *value);
  537. } ssl_test_ctx_option;
  538. static const ssl_test_ctx_option ssl_test_ctx_options[] = {
  539. { "ExpectedResult", &parse_expected_result },
  540. { "ExpectedClientAlert", &parse_client_alert },
  541. { "ExpectedServerAlert", &parse_server_alert },
  542. { "ExpectedProtocol", &parse_protocol },
  543. { "ExpectedServerName", &parse_expected_servername },
  544. { "SessionTicketExpected", &parse_session_ticket },
  545. { "CompressionExpected", &parse_test_compression_expected },
  546. { "SessionIdExpected", &parse_session_id },
  547. { "Method", &parse_test_method },
  548. { "ExpectedNPNProtocol", &parse_test_expected_npn_protocol },
  549. { "ExpectedALPNProtocol", &parse_test_expected_alpn_protocol },
  550. { "HandshakeMode", &parse_handshake_mode },
  551. { "KeyUpdateType", &parse_key_update_type },
  552. { "ResumptionExpected", &parse_test_resumption_expected },
  553. { "ApplicationData", &parse_test_app_data_size },
  554. { "MaxFragmentSize", &parse_test_max_fragment_size },
  555. { "ExpectedTmpKeyType", &parse_expected_tmp_key_type },
  556. { "ExpectedServerCertType", &parse_expected_server_cert_type },
  557. { "ExpectedServerSignHash", &parse_expected_server_sign_hash },
  558. { "ExpectedServerSignType", &parse_expected_server_sign_type },
  559. { "ExpectedServerCANames", &parse_expected_server_ca_names },
  560. { "ExpectedClientCertType", &parse_expected_client_cert_type },
  561. { "ExpectedClientSignHash", &parse_expected_client_sign_hash },
  562. { "ExpectedClientSignType", &parse_expected_client_sign_type },
  563. { "ExpectedClientCANames", &parse_expected_client_ca_names },
  564. { "UseSCTP", &parse_test_use_sctp },
  565. { "EnableClientSCTPLabelBug", &parse_test_enable_client_sctp_label_bug },
  566. { "EnableServerSCTPLabelBug", &parse_test_enable_server_sctp_label_bug },
  567. { "ExpectedCipher", &parse_test_expected_cipher },
  568. { "ExpectedSessionTicketAppData", &parse_test_expected_session_ticket_app_data },
  569. };
  570. /* Nested client options. */
  571. typedef struct {
  572. const char *name;
  573. int (*parse)(SSL_TEST_CLIENT_CONF *conf, const char *value);
  574. } ssl_test_client_option;
  575. static const ssl_test_client_option ssl_test_client_options[] = {
  576. { "VerifyCallback", &parse_client_verify_callback },
  577. { "ServerName", &parse_servername },
  578. { "NPNProtocols", &parse_client_npn_protocols },
  579. { "ALPNProtocols", &parse_client_alpn_protocols },
  580. { "CTValidation", &parse_ct_validation },
  581. { "RenegotiateCiphers", &parse_client_reneg_ciphers},
  582. { "SRPUser", &parse_client_srp_user },
  583. { "SRPPassword", &parse_client_srp_password },
  584. { "MaxFragmentLenExt", &parse_max_fragment_len_mode },
  585. { "EnablePHA", &parse_client_enable_pha },
  586. };
  587. /* Nested server options. */
  588. typedef struct {
  589. const char *name;
  590. int (*parse)(SSL_TEST_SERVER_CONF *conf, const char *value);
  591. } ssl_test_server_option;
  592. static const ssl_test_server_option ssl_test_server_options[] = {
  593. { "ServerNameCallback", &parse_servername_callback },
  594. { "NPNProtocols", &parse_server_npn_protocols },
  595. { "ALPNProtocols", &parse_server_alpn_protocols },
  596. { "BrokenSessionTicket", &parse_server_broken_session_ticket },
  597. { "CertStatus", &parse_certstatus },
  598. { "SRPUser", &parse_server_srp_user },
  599. { "SRPPassword", &parse_server_srp_password },
  600. { "ForcePHA", &parse_server_force_pha },
  601. { "SessionTicketAppData", &parse_server_session_ticket_app_data },
  602. };
  603. SSL_TEST_CTX *SSL_TEST_CTX_new(void)
  604. {
  605. SSL_TEST_CTX *ret;
  606. /* The return code is checked by caller */
  607. if ((ret = OPENSSL_zalloc(sizeof(*ret))) != NULL) {
  608. ret->app_data_size = default_app_data_size;
  609. ret->max_fragment_size = default_max_fragment_size;
  610. }
  611. return ret;
  612. }
  613. static void ssl_test_extra_conf_free_data(SSL_TEST_EXTRA_CONF *conf)
  614. {
  615. OPENSSL_free(conf->client.npn_protocols);
  616. OPENSSL_free(conf->server.npn_protocols);
  617. OPENSSL_free(conf->server2.npn_protocols);
  618. OPENSSL_free(conf->client.alpn_protocols);
  619. OPENSSL_free(conf->server.alpn_protocols);
  620. OPENSSL_free(conf->server2.alpn_protocols);
  621. OPENSSL_free(conf->client.reneg_ciphers);
  622. OPENSSL_free(conf->server.srp_user);
  623. OPENSSL_free(conf->server.srp_password);
  624. OPENSSL_free(conf->server2.srp_user);
  625. OPENSSL_free(conf->server2.srp_password);
  626. OPENSSL_free(conf->client.srp_user);
  627. OPENSSL_free(conf->client.srp_password);
  628. OPENSSL_free(conf->server.session_ticket_app_data);
  629. OPENSSL_free(conf->server2.session_ticket_app_data);
  630. }
  631. static void ssl_test_ctx_free_extra_data(SSL_TEST_CTX *ctx)
  632. {
  633. ssl_test_extra_conf_free_data(&ctx->extra);
  634. ssl_test_extra_conf_free_data(&ctx->resume_extra);
  635. }
  636. void SSL_TEST_CTX_free(SSL_TEST_CTX *ctx)
  637. {
  638. ssl_test_ctx_free_extra_data(ctx);
  639. OPENSSL_free(ctx->expected_npn_protocol);
  640. OPENSSL_free(ctx->expected_alpn_protocol);
  641. OPENSSL_free(ctx->expected_session_ticket_app_data);
  642. sk_X509_NAME_pop_free(ctx->expected_server_ca_names, X509_NAME_free);
  643. sk_X509_NAME_pop_free(ctx->expected_client_ca_names, X509_NAME_free);
  644. OPENSSL_free(ctx->expected_cipher);
  645. OPENSSL_free(ctx);
  646. }
  647. static int parse_client_options(SSL_TEST_CLIENT_CONF *client, const CONF *conf,
  648. const char *client_section)
  649. {
  650. STACK_OF(CONF_VALUE) *sk_conf;
  651. int i;
  652. size_t j;
  653. if (!TEST_ptr(sk_conf = NCONF_get_section(conf, client_section)))
  654. return 0;
  655. for (i = 0; i < sk_CONF_VALUE_num(sk_conf); i++) {
  656. int found = 0;
  657. const CONF_VALUE *option = sk_CONF_VALUE_value(sk_conf, i);
  658. for (j = 0; j < OSSL_NELEM(ssl_test_client_options); j++) {
  659. if (strcmp(option->name, ssl_test_client_options[j].name) == 0) {
  660. if (!ssl_test_client_options[j].parse(client, option->value)) {
  661. TEST_info("Bad value %s for option %s",
  662. option->value, option->name);
  663. return 0;
  664. }
  665. found = 1;
  666. break;
  667. }
  668. }
  669. if (!found) {
  670. TEST_info("Unknown test option: %s", option->name);
  671. return 0;
  672. }
  673. }
  674. return 1;
  675. }
  676. static int parse_server_options(SSL_TEST_SERVER_CONF *server, const CONF *conf,
  677. const char *server_section)
  678. {
  679. STACK_OF(CONF_VALUE) *sk_conf;
  680. int i;
  681. size_t j;
  682. if (!TEST_ptr(sk_conf = NCONF_get_section(conf, server_section)))
  683. return 0;
  684. for (i = 0; i < sk_CONF_VALUE_num(sk_conf); i++) {
  685. int found = 0;
  686. const CONF_VALUE *option = sk_CONF_VALUE_value(sk_conf, i);
  687. for (j = 0; j < OSSL_NELEM(ssl_test_server_options); j++) {
  688. if (strcmp(option->name, ssl_test_server_options[j].name) == 0) {
  689. if (!ssl_test_server_options[j].parse(server, option->value)) {
  690. TEST_info("Bad value %s for option %s",
  691. option->value, option->name);
  692. return 0;
  693. }
  694. found = 1;
  695. break;
  696. }
  697. }
  698. if (!found) {
  699. TEST_info("Unknown test option: %s", option->name);
  700. return 0;
  701. }
  702. }
  703. return 1;
  704. }
  705. SSL_TEST_CTX *SSL_TEST_CTX_create(const CONF *conf, const char *test_section)
  706. {
  707. STACK_OF(CONF_VALUE) *sk_conf = NULL;
  708. SSL_TEST_CTX *ctx = NULL;
  709. int i;
  710. size_t j;
  711. if (!TEST_ptr(sk_conf = NCONF_get_section(conf, test_section))
  712. || !TEST_ptr(ctx = SSL_TEST_CTX_new()))
  713. goto err;
  714. for (i = 0; i < sk_CONF_VALUE_num(sk_conf); i++) {
  715. int found = 0;
  716. const CONF_VALUE *option = sk_CONF_VALUE_value(sk_conf, i);
  717. /* Subsections */
  718. if (strcmp(option->name, "client") == 0) {
  719. if (!parse_client_options(&ctx->extra.client, conf, option->value))
  720. goto err;
  721. } else if (strcmp(option->name, "server") == 0) {
  722. if (!parse_server_options(&ctx->extra.server, conf, option->value))
  723. goto err;
  724. } else if (strcmp(option->name, "server2") == 0) {
  725. if (!parse_server_options(&ctx->extra.server2, conf, option->value))
  726. goto err;
  727. } else if (strcmp(option->name, "resume-client") == 0) {
  728. if (!parse_client_options(&ctx->resume_extra.client, conf,
  729. option->value))
  730. goto err;
  731. } else if (strcmp(option->name, "resume-server") == 0) {
  732. if (!parse_server_options(&ctx->resume_extra.server, conf,
  733. option->value))
  734. goto err;
  735. } else if (strcmp(option->name, "resume-server2") == 0) {
  736. if (!parse_server_options(&ctx->resume_extra.server2, conf,
  737. option->value))
  738. goto err;
  739. } else {
  740. for (j = 0; j < OSSL_NELEM(ssl_test_ctx_options); j++) {
  741. if (strcmp(option->name, ssl_test_ctx_options[j].name) == 0) {
  742. if (!ssl_test_ctx_options[j].parse(ctx, option->value)) {
  743. TEST_info("Bad value %s for option %s",
  744. option->value, option->name);
  745. goto err;
  746. }
  747. found = 1;
  748. break;
  749. }
  750. }
  751. if (!found) {
  752. TEST_info("Unknown test option: %s", option->name);
  753. goto err;
  754. }
  755. }
  756. }
  757. goto done;
  758. err:
  759. SSL_TEST_CTX_free(ctx);
  760. ctx = NULL;
  761. done:
  762. return ctx;
  763. }