quic.c 60 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660
  1. /* quic.c QUIC unit tests
  2. *
  3. * Copyright (C) 2006-2024 wolfSSL Inc.
  4. *
  5. * This file is part of wolfSSL.
  6. *
  7. * wolfSSL is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License as published by
  9. * the Free Software Foundation; either version 2 of the License, or
  10. * (at your option) any later version.
  11. *
  12. * wolfSSL is distributed in the hope that it will be useful,
  13. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. * GNU General Public License for more details.
  16. *
  17. * You should have received a copy of the GNU General Public License
  18. * along with this program; if not, write to the Free Software
  19. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20. */
  21. #ifdef HAVE_CONFIG_H
  22. #include <config.h>
  23. #else
  24. #ifndef WOLFSSL_USER_SETTINGS
  25. #include <wolfssl/options.h>
  26. #endif
  27. #endif
  28. #include <wolfssl/wolfcrypt/settings.h>
  29. #include <tests/unit.h>
  30. #ifdef WOLFSSL_QUIC
  31. #include <wolfssl/ssl.h>
  32. #include <wolfssl/quic.h>
  33. #ifdef NO_INLINE
  34. #include <wolfssl/wolfcrypt/misc.h>
  35. #else
  36. #define WOLFSSL_MISC_INCLUDED
  37. #include <wolfcrypt/src/misc.c>
  38. #endif
  39. #include <wolfssl/error-ssl.h>
  40. #include <wolfssl/internal.h>
  41. #define testingFmt " %s:"
  42. #define resultFmt " %s\n"
  43. static const char* passed = "passed";
  44. static const char* failed = "failed";
  45. typedef struct {
  46. const char *name;
  47. WOLFSSL_METHOD *method;
  48. int is_server;
  49. } ctx_setups;
  50. static int dummy_set_encryption_secrets(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level,
  51. const uint8_t *read_secret,
  52. const uint8_t *write_secret, size_t secret_len)
  53. {
  54. (void)ssl;
  55. printf("QUIC_set_encryption_secrets(level=%d, length=%d, rx=%s, tx=%s)\n",
  56. level, (int)secret_len, read_secret? "yes" : "no", write_secret? "yes" : "no");
  57. return 1;
  58. }
  59. static int dummy_add_handshake_data(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level,
  60. const uint8_t *data, size_t len)
  61. {
  62. (void)ssl;
  63. (void)data;
  64. printf("QUIC_add_handshake_data(level=%d, length=%d)\n", level, (int)len);
  65. return 1;
  66. }
  67. static int dummy_flush_flight(WOLFSSL *ssl)
  68. {
  69. (void)ssl;
  70. printf("QUIC_flush_flight()\n");
  71. return 1;
  72. }
  73. static int dummy_send_alert(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level, uint8_t err)
  74. {
  75. (void)ssl;
  76. printf("QUIC_send_alert(level=%d, err=%d)\n", level, err);
  77. return 1;
  78. }
  79. static WOLFSSL_QUIC_METHOD dummy_method = {
  80. dummy_set_encryption_secrets,
  81. dummy_add_handshake_data,
  82. dummy_flush_flight,
  83. dummy_send_alert,
  84. };
  85. static WOLFSSL_QUIC_METHOD null_method = {
  86. NULL, NULL, NULL, NULL
  87. };
  88. static int test_set_quic_method(void) {
  89. WOLFSSL_CTX *ctx;
  90. WOLFSSL *ssl;
  91. int ret = 0, i;
  92. const uint8_t *data;
  93. size_t data_len;
  94. ctx_setups valids[] = {
  95. #ifdef WOLFSSL_TLS13
  96. { "TLSv1.3 server", wolfTLSv1_3_server_method(), 1},
  97. { "TLSv1.3 client", wolfTLSv1_3_client_method(), 0},
  98. #endif
  99. { NULL, NULL, 0}
  100. };
  101. ctx_setups invalids[] = {
  102. #ifndef WOLFSSL_NO_TLS12
  103. { "TLSv1.2 server", wolfTLSv1_2_server_method(), 1},
  104. { "TLSv1.2 client", wolfTLSv1_2_client_method(), 0},
  105. #endif
  106. #ifndef NO_OLD_TLS
  107. { "TLSv1.1 server", wolfTLSv1_1_server_method(), 1},
  108. { "TLSv1.1 client", wolfTLSv1_1_client_method(), 0},
  109. #endif
  110. { NULL, NULL, 0}
  111. };
  112. for (i = 0; valids[i].name != NULL; ++i) {
  113. AssertNotNull(ctx = wolfSSL_CTX_new(valids[i].method));
  114. if (valids[i].is_server) {
  115. AssertTrue(wolfSSL_CTX_use_certificate_file(ctx, svrCertFile,
  116. WOLFSSL_FILETYPE_PEM));
  117. AssertTrue(wolfSSL_CTX_use_PrivateKey_file(ctx, svrKeyFile,
  118. WOLFSSL_FILETYPE_PEM));
  119. }
  120. /* ctx does not have quic enabled, so will SSL* derived from it */
  121. AssertNotNull(ssl = wolfSSL_new(ctx));
  122. AssertFalse(wolfSSL_is_quic(ssl));
  123. /* Enable quic on the SSL* */
  124. AssertFalse(wolfSSL_set_quic_method(ssl, &null_method) == WOLFSSL_SUCCESS);
  125. AssertTrue(wolfSSL_set_quic_method(ssl, &dummy_method) == WOLFSSL_SUCCESS);
  126. AssertTrue(wolfSSL_is_quic(ssl));
  127. /* Check some default, initial behaviour */
  128. AssertTrue(wolfSSL_set_quic_transport_params(ssl, NULL, 0) == WOLFSSL_SUCCESS);
  129. wolfSSL_get_peer_quic_transport_params(ssl, &data, &data_len);
  130. AssertNull(data);
  131. AssertTrue(data_len == 0);
  132. AssertTrue(wolfSSL_quic_read_level(ssl) == wolfssl_encryption_initial);
  133. AssertTrue(wolfSSL_quic_write_level(ssl) == wolfssl_encryption_initial);
  134. AssertTrue(wolfSSL_get_quic_transport_version(ssl) == 0);
  135. wolfSSL_set_quic_transport_version(ssl, TLSX_KEY_QUIC_TP_PARAMS);
  136. AssertTrue(wolfSSL_get_quic_transport_version(ssl) == TLSX_KEY_QUIC_TP_PARAMS);
  137. wolfSSL_set_quic_use_legacy_codepoint(ssl, 1);
  138. AssertTrue(wolfSSL_get_quic_transport_version(ssl) == TLSX_KEY_QUIC_TP_PARAMS_DRAFT);
  139. wolfSSL_set_quic_use_legacy_codepoint(ssl, 0);
  140. AssertTrue(wolfSSL_get_quic_transport_version(ssl) == TLSX_KEY_QUIC_TP_PARAMS);
  141. /* max flight len during stages of handhshake, we us 16k initial and on
  142. * app data, and during handshake allow larger for cert exchange. This is
  143. * more advisory for the network code. ngtcp2 has its own ideas, for example.
  144. */
  145. data_len = wolfSSL_quic_max_handshake_flight_len(ssl, wolfssl_encryption_initial);
  146. AssertTrue(data_len == 16*1024);
  147. data_len = wolfSSL_quic_max_handshake_flight_len(ssl, wolfssl_encryption_early_data);
  148. AssertTrue(data_len == 0);
  149. data_len = wolfSSL_quic_max_handshake_flight_len(ssl, wolfssl_encryption_handshake);
  150. AssertTrue(data_len >= 16*1024);
  151. data_len = wolfSSL_quic_max_handshake_flight_len(ssl, wolfssl_encryption_application);
  152. AssertTrue(data_len == 16*1024);
  153. wolfSSL_free(ssl);
  154. /* Enabled quic on the ctx */
  155. AssertTrue(wolfSSL_CTX_set_quic_method(ctx, &dummy_method) == WOLFSSL_SUCCESS);
  156. /* It will be enabled on the SSL* */
  157. AssertNotNull(ssl = wolfSSL_new(ctx));
  158. AssertTrue(wolfSSL_is_quic(ssl));
  159. wolfSSL_free(ssl);
  160. wolfSSL_CTX_free(ctx);
  161. }
  162. for (i = 0; invalids[i].name != NULL; ++i) {
  163. AssertNotNull(ctx = wolfSSL_CTX_new(invalids[i].method));
  164. AssertTrue(wolfSSL_CTX_use_certificate_file(ctx, svrCertFile,
  165. WOLFSSL_FILETYPE_PEM));
  166. AssertTrue(wolfSSL_CTX_use_PrivateKey_file(ctx, svrKeyFile,
  167. WOLFSSL_FILETYPE_PEM));
  168. AssertFalse(wolfSSL_CTX_set_quic_method(ctx, &dummy_method) == WOLFSSL_SUCCESS);
  169. AssertNotNull(ssl = wolfSSL_new(ctx));
  170. AssertFalse(wolfSSL_set_quic_method(ssl, &dummy_method) == WOLFSSL_SUCCESS);
  171. AssertFalse(wolfSSL_is_quic(ssl));
  172. /* even though not quic, this is the only level we can return */
  173. AssertTrue(wolfSSL_quic_read_level(ssl) == wolfssl_encryption_initial);
  174. AssertTrue(wolfSSL_quic_write_level(ssl) == wolfssl_encryption_initial);
  175. wolfSSL_free(ssl);
  176. wolfSSL_CTX_free(ctx);
  177. }
  178. printf(" test_set_quic_method: %s\n", (ret == 0)? passed : failed);
  179. return ret;
  180. }
  181. static size_t fake_record(byte rtype, word32 rlen, uint8_t *rec)
  182. {
  183. rec[0] = (uint8_t)rtype;
  184. c32to24(rlen, rec+1);
  185. return rlen + 4;
  186. }
  187. static size_t shift_record(uint8_t *rec, size_t len, size_t written)
  188. {
  189. len -= written;
  190. XMEMMOVE(rec, rec+written, len);
  191. return len;
  192. }
  193. static void dump_buffer(const char *name, const byte *p, size_t len, int indent)
  194. {
  195. size_t i = 0;
  196. printf("%s[%d] = {", name, (int)len);
  197. while((p != NULL) && (i < len)) {
  198. if((i % 0x10) == 0) {
  199. printf("\n");
  200. printf("%*s %04X - ", indent, " ", (int)i);
  201. }
  202. else if((i % 0x08) == 0) {
  203. printf(" ");
  204. }
  205. printf("%02X ", p[i]);
  206. i++;
  207. }
  208. printf("\n%*s};\n", indent, " ");
  209. }
  210. static void dump_ssl_buffers(WOLFSSL *ssl, FILE *fp)
  211. {
  212. QuicRecord *qr = ssl->quic.input_head;
  213. fprintf(fp, "SSL quic data buffered: \n");
  214. while (qr) {
  215. fprintf(fp, " - %d-%d/%d (cap %d, level=%d)\n",
  216. qr->start, qr->end, qr->len, qr->capacity, qr->level);
  217. qr = qr->next;
  218. }
  219. if ((qr = ssl->quic.scratch)) {
  220. fprintf(fp, " scratch: %d-%d/%d (cap %d, level=%d)\n",
  221. qr->start, qr->end, qr->len, qr->capacity, qr->level);
  222. }
  223. else {
  224. fprintf(fp, " scratch: -\n");
  225. }
  226. }
  227. static int provide_data(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level,
  228. const uint8_t *data, size_t len, int excpect_fail)
  229. {
  230. int ret;
  231. ret = (wolfSSL_provide_quic_data(ssl, level, data, len) == WOLFSSL_SUCCESS);
  232. if (!!ret != !excpect_fail) {
  233. dump_ssl_buffers(ssl, stdout);
  234. return 0;
  235. }
  236. return 1;
  237. }
  238. static int test_provide_quic_data(void) {
  239. WOLFSSL_CTX *ctx;
  240. WOLFSSL *ssl;
  241. uint8_t lbuffer[16*1024];
  242. size_t len;
  243. int ret = 0;
  244. AssertNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
  245. AssertTrue(wolfSSL_CTX_set_quic_method(ctx, &dummy_method) == WOLFSSL_SUCCESS);
  246. /* provide_quic_data() feeds CRYPTO packets inside a QUIC Frame into
  247. * the TLSv1.3 state machine.
  248. * The data fed is not the QUIC frame, but the TLS record inside it.
  249. * This may be called several times before SSL_do_handshake() is invoked
  250. * to process them.
  251. * During buffering this data, the code checks that:
  252. * - encryption level only ever increases for subsequent TLS records
  253. * - a TLS record is received complete before the encryption level increases
  254. */
  255. AssertNotNull(ssl = wolfSSL_new(ctx));
  256. len = fake_record(1, 100, lbuffer);
  257. AssertTrue(provide_data(ssl, wolfssl_encryption_initial, lbuffer, len, 0));
  258. len = fake_record(2, 1523, lbuffer);
  259. AssertTrue(provide_data(ssl, wolfssl_encryption_handshake, lbuffer, len, 0));
  260. len = fake_record(2, 1, lbuffer);
  261. len += fake_record(3, 190, lbuffer+len);
  262. AssertTrue(provide_data(ssl, wolfssl_encryption_handshake, lbuffer, len, 0));
  263. len = fake_record(5, 2049, lbuffer);
  264. AssertTrue(provide_data(ssl, wolfssl_encryption_application, lbuffer, len, 0));
  265. /* adding another record with decreased level must fail */
  266. len = fake_record(1, 100, lbuffer);
  267. AssertTrue(provide_data(ssl, wolfssl_encryption_initial, lbuffer, len, 1));
  268. wolfSSL_free(ssl);
  269. AssertNotNull(ssl = wolfSSL_new(ctx));
  270. len = fake_record(1, 100, lbuffer);
  271. AssertTrue(provide_data(ssl, wolfssl_encryption_initial, lbuffer, 24, 0));
  272. len = shift_record(lbuffer, len, 24);
  273. len += fake_record(2, 4000, lbuffer+len);
  274. AssertTrue(provide_data(ssl, wolfssl_encryption_initial, lbuffer, len - 99, 0));
  275. len = shift_record(lbuffer, len, len - 99);
  276. len += fake_record(5, 2049, lbuffer+len);
  277. AssertTrue(provide_data(ssl, wolfssl_encryption_initial, lbuffer, len, 0));
  278. /* should be recognized as complete and level increase needs to be accepted */
  279. len = fake_record(2, 1, lbuffer);
  280. len += fake_record(3, 190, lbuffer+len);
  281. AssertTrue(provide_data(ssl, wolfssl_encryption_handshake, lbuffer, len - 10, 0));
  282. len = shift_record(lbuffer, len, len - 10);
  283. /* Change level with incomplete record in lbuffer, needs to fail */
  284. len += fake_record(5, 8102, lbuffer+len);
  285. AssertTrue(provide_data(ssl, wolfssl_encryption_application, lbuffer, len - 10, 1));
  286. wolfSSL_free(ssl);
  287. wolfSSL_CTX_free(ctx);
  288. printf(" test_provide_quic_data: %s\n", (ret == 0)? passed : failed);
  289. return 0;
  290. }
  291. static int test_quic_crypt(void) {
  292. WOLFSSL_CTX *ctx;
  293. WOLFSSL *ssl;
  294. const WOLFSSL_EVP_CIPHER *aead_cipher;
  295. int ret = 0;
  296. AssertNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
  297. AssertTrue(wolfSSL_CTX_set_quic_method(ctx, &dummy_method) == WOLFSSL_SUCCESS);
  298. AssertNotNull(ssl = wolfSSL_new(ctx));
  299. /* don't have an AEAD cipher selected before start */
  300. AssertTrue(wolfSSL_CIPHER_get_id(wolfSSL_get_current_cipher(ssl)) == 0);
  301. AssertNotNull(aead_cipher = wolfSSL_EVP_aes_128_gcm());
  302. AssertTrue(wolfSSL_quic_aead_is_gcm(aead_cipher) != 0);
  303. AssertTrue(wolfSSL_quic_aead_is_ccm(aead_cipher) == 0);
  304. AssertTrue(wolfSSL_quic_aead_is_chacha20(aead_cipher) == 0);
  305. if (1) {
  306. /* check that our enc-/decrypt support in quic rount-trips */
  307. static const uint8_t key[16] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
  308. 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff};
  309. static const uint8_t aad[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19};
  310. static const uint8_t iv[] = {20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31};
  311. static const uint8_t plaintext[] = "hello world\nhello world\nhello world\nhello world\nhello world\nhello world\nhello world\n";
  312. static const uint8_t expected[] = {0xd3, 0xa8, 0x1d, 0x96, 0x4c, 0x9b, 0x02, 0xd7, 0x9a, 0xb0, 0x41, 0x07, 0x4c, 0x8c, 0xe2,
  313. 0xe0, 0x2e, 0x83, 0x54, 0x52, 0x45, 0xcb, 0xd4, 0x68, 0xc8, 0x43, 0x45, 0xca, 0x91, 0xfb,
  314. 0xa3, 0x7a, 0x67, 0xed, 0xe8, 0xd7, 0x5e, 0xe2, 0x33, 0xd1, 0x3e, 0xbf, 0x50, 0xc2, 0x4b,
  315. 0x86, 0x83, 0x55, 0x11, 0xbb, 0x17, 0x4f, 0xf5, 0x78, 0xb8, 0x65, 0xeb, 0x9a, 0x2b, 0x8f,
  316. 0x77, 0x08, 0xa9, 0x60, 0x17, 0x73, 0xc5, 0x07, 0xf3, 0x04, 0xc9, 0x3f, 0x67, 0x4d, 0x12,
  317. 0xa1, 0x02, 0x93, 0xc2, 0x3c, 0xd3, 0xf8, 0x59, 0x33, 0xd5, 0x01, 0xc3, 0xbb, 0xaa, 0xe6,
  318. 0x3f, 0xbb, 0x23, 0x66, 0x94, 0x26, 0x28, 0x43, 0xa5, 0xfd, 0x2f};
  319. WOLFSSL_EVP_CIPHER_CTX *enc_ctx, *dec_ctx;
  320. uint8_t *encrypted, *decrypted;
  321. size_t tag_len, enc_len, dec_len;
  322. AssertTrue((tag_len = wolfSSL_quic_get_aead_tag_len(aead_cipher)) == 16);
  323. dec_len = sizeof(plaintext);
  324. enc_len = dec_len + tag_len;
  325. encrypted = (uint8_t*)XMALLOC(enc_len, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  326. AssertNotNull(encrypted);
  327. decrypted = (uint8_t*)XMALLOC(dec_len, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  328. AssertNotNull(decrypted);
  329. AssertNotNull(enc_ctx = wolfSSL_quic_crypt_new(aead_cipher, key, iv, 1));
  330. AssertTrue(wolfSSL_quic_aead_encrypt(encrypted, enc_ctx,
  331. plaintext, sizeof(plaintext),
  332. NULL, aad, sizeof(aad)) == WOLFSSL_SUCCESS);
  333. AssertTrue(memcmp(expected, encrypted, dec_len) == 0);
  334. AssertTrue(memcmp(expected+dec_len, encrypted+dec_len, tag_len) == 0);
  335. AssertNotNull(dec_ctx = wolfSSL_quic_crypt_new(aead_cipher, key, iv, 0));
  336. AssertTrue(wolfSSL_quic_aead_decrypt(decrypted, dec_ctx,
  337. encrypted, enc_len,
  338. NULL, aad, sizeof(aad)) == WOLFSSL_SUCCESS);
  339. AssertTrue(memcmp(plaintext, decrypted, dec_len) == 0);
  340. XFREE(encrypted, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  341. XFREE(decrypted, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  342. wolfSSL_EVP_CIPHER_CTX_free(enc_ctx);
  343. wolfSSL_EVP_CIPHER_CTX_free(dec_ctx);
  344. }
  345. wolfSSL_free(ssl);
  346. wolfSSL_CTX_free(ctx);
  347. printf(" test_quic_crypt: %s\n", (ret == 0)? passed : failed);
  348. return ret;
  349. }
  350. typedef struct OutputBuffer {
  351. byte data[64*1024];
  352. size_t len;
  353. WOLFSSL_ENCRYPTION_LEVEL level;
  354. struct OutputBuffer *next;
  355. } OutputBuffer;
  356. typedef struct {
  357. const char *name;
  358. WOLFSSL *ssl;
  359. OutputBuffer output;
  360. byte rx_secret[4][1024];
  361. size_t rx_secret_len[4];
  362. byte tx_secret[4][1024];
  363. size_t tx_secret_len[4];
  364. int handshake_done;
  365. int alert_level;
  366. int alert;
  367. int flushed;
  368. int verbose;
  369. byte ticket[16*1024];
  370. word32 ticket_len;
  371. byte session[16*1024];
  372. word32 session_len;
  373. } QuicTestContext;
  374. static int ctx_set_encryption_secrets(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level,
  375. const uint8_t *read_secret,
  376. const uint8_t *write_secret, size_t secret_len);
  377. static int ctx_add_handshake_data(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level,
  378. const uint8_t *data, size_t len);
  379. static int ctx_flush_flight(WOLFSSL *ssl);
  380. static int ctx_send_alert(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level, uint8_t err);
  381. #ifdef HAVE_SESSION_TICKET
  382. static int ctx_session_ticket_cb(WOLFSSL* ssl,
  383. const unsigned char* ticket, int ticketSz,
  384. void* cb_ctx);
  385. #endif
  386. static WOLFSSL_QUIC_METHOD ctx_method = {
  387. ctx_set_encryption_secrets,
  388. ctx_add_handshake_data,
  389. ctx_flush_flight,
  390. ctx_send_alert,
  391. };
  392. static void QuicTestContext_init(QuicTestContext *tctx, WOLFSSL_CTX *ctx,
  393. const char *name, int verbose)
  394. {
  395. static const byte tp_params_c[] = {0, 1, 2, 3, 4, 5, 6, 7};
  396. static const byte tp_params_s[] = {7, 6, 5, 4, 3, 2, 1, 0, 1};
  397. AssertNotNull(tctx);
  398. memset(tctx, 0, sizeof(*tctx));
  399. tctx->name = name;
  400. AssertNotNull((tctx->ssl = wolfSSL_new(ctx)));
  401. tctx->verbose = verbose;
  402. wolfSSL_set_app_data(tctx->ssl, tctx);
  403. AssertTrue(wolfSSL_set_quic_method(tctx->ssl, &ctx_method) == WOLFSSL_SUCCESS);
  404. wolfSSL_set_verify(tctx->ssl, SSL_VERIFY_NONE, 0);
  405. #ifdef HAVE_SESSION_TICKET
  406. wolfSSL_UseSessionTicket(tctx->ssl);
  407. wolfSSL_set_SessionTicket_cb(tctx->ssl, ctx_session_ticket_cb, NULL);
  408. #endif
  409. if (wolfSSL_is_server(tctx->ssl)) {
  410. wolfSSL_set_quic_transport_version(tctx->ssl, 0);
  411. wolfSSL_set_quic_transport_params(tctx->ssl, tp_params_s, sizeof(tp_params_s));
  412. }
  413. else {
  414. wolfSSL_set_quic_transport_version(tctx->ssl, 0);
  415. wolfSSL_set_quic_transport_params(tctx->ssl, tp_params_c, sizeof(tp_params_c));
  416. }
  417. }
  418. static void QuicTestContext_free(QuicTestContext *tctx)
  419. {
  420. OutputBuffer *out, *n;
  421. if (tctx->ssl) {
  422. wolfSSL_free(tctx->ssl);
  423. tctx->ssl = NULL;
  424. }
  425. out = tctx->output.next;
  426. while (out) {
  427. n = out->next;
  428. free(out);
  429. out = n;
  430. }
  431. }
  432. static int ctx_set_encryption_secrets(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level,
  433. const uint8_t *read_secret,
  434. const uint8_t *write_secret, size_t secret_len)
  435. {
  436. QuicTestContext *ctx = (QuicTestContext*)wolfSSL_get_app_data(ssl);
  437. AssertNotNull(ctx);
  438. AssertTrue(secret_len <= sizeof(ctx->rx_secret[0]));
  439. if (read_secret) {
  440. memcpy(ctx->rx_secret[level], read_secret, secret_len);
  441. ctx->rx_secret_len[level] = secret_len;
  442. }
  443. if (write_secret) {
  444. memcpy(ctx->tx_secret[level], write_secret, secret_len);
  445. ctx->tx_secret_len[level] = secret_len;
  446. }
  447. AssertNotNull(ctx);
  448. return 1;
  449. }
  450. static int ctx_add_handshake_data(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level,
  451. const uint8_t *data, size_t len)
  452. {
  453. QuicTestContext *ctx = (QuicTestContext*)wolfSSL_get_app_data(ssl);
  454. OutputBuffer *out;
  455. AssertNotNull(ctx);
  456. out = &ctx->output;
  457. while (out->next) {
  458. out = out->next;
  459. }
  460. if (out->level != level) {
  461. if (out->len > 0) {
  462. out->next = (OutputBuffer*)calloc(1, sizeof(OutputBuffer));
  463. out = out->next;
  464. AssertNotNull(out);
  465. }
  466. out->level = level;
  467. }
  468. if (ctx->verbose) {
  469. printf("[%s] add_handshake[enc_level=%d]: %d bytes\n", ctx->name, level, (int)len);
  470. /* dump_buffer("add", data, len, 0); */
  471. }
  472. if (len > 0) {
  473. AssertTrue(out->len + len < sizeof(out->data));
  474. memcpy(out->data + out->len, data, len);
  475. out->len += len;
  476. }
  477. return 1;
  478. }
  479. static int ctx_flush_flight(WOLFSSL *ssl)
  480. {
  481. QuicTestContext *ctx = (QuicTestContext*)wolfSSL_get_app_data(ssl);
  482. AssertNotNull(ctx);
  483. ctx->flushed = 1;
  484. return 1;
  485. }
  486. static int ctx_send_alert(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level, uint8_t err)
  487. {
  488. QuicTestContext *ctx = (QuicTestContext*)wolfSSL_get_app_data(ssl);
  489. AssertNotNull(ctx);
  490. if (ctx->verbose) {
  491. printf("[%s] send_alert: level=%d, err=%d\n", ctx->name, level, err);
  492. }
  493. ctx->alert_level = level;
  494. ctx->alert = alert;
  495. return 1;
  496. }
  497. #ifdef HAVE_SESSION_TICKET
  498. static int ctx_session_ticket_cb(WOLFSSL* ssl,
  499. const unsigned char* ticket, int ticketSz,
  500. void* cb_ctx)
  501. {
  502. QuicTestContext *ctx = (QuicTestContext*)wolfSSL_get_app_data(ssl);
  503. AssertNotNull(ctx);
  504. (void)cb_ctx;
  505. if (ticketSz < 0 || (size_t)ticketSz > sizeof(ctx->ticket)) {
  506. printf("SESSION TICKET callback: ticket given is too large: %d bytes\n", ticketSz);
  507. return 1;
  508. }
  509. memset(ctx->ticket, 0, sizeof(ctx->ticket));
  510. ctx->ticket_len = (word32)ticketSz;
  511. memcpy(ctx->ticket, ticket, (size_t)ticketSz);
  512. if (ctx->verbose) {
  513. printf("Session Ticket[%s]: ", ctx->name);
  514. dump_buffer("", ticket, (size_t)ticketSz, 4);
  515. }
  516. return 0;
  517. }
  518. #endif
  519. static void ctx_dump_output(QuicTestContext *ctx)
  520. {
  521. dump_buffer("Output", ctx->output.data, ctx->output.len, 0);
  522. }
  523. static void check_handshake_record(const byte *data, size_t data_len, int *ptype, size_t *prlen)
  524. {
  525. word32 rlen;
  526. AssertTrue(data_len >= HANDSHAKE_HEADER_SZ);
  527. *ptype = data[0];
  528. c24to32(&data[1], &rlen);
  529. *prlen = rlen + HANDSHAKE_HEADER_SZ;
  530. }
  531. static void ext_dump(const byte *data, size_t data_len, int indent)
  532. {
  533. size_t idx = 0;
  534. word16 len16, etype, i;
  535. printf("%*sextensions:\n", indent, " ");
  536. while (idx < data_len) {
  537. ato16(&data[idx], &etype); /* extension type */
  538. ato16(&data[idx+2], &len16); /* extension length */
  539. printf(" extension: %04x [", etype);
  540. for (i = 0; i < len16; ++i) {
  541. printf("%s0x%02x", (i? ", ": ""), data[idx+4+i]);
  542. }
  543. printf("]\n");
  544. idx += 2 + 2 + len16;
  545. }
  546. }
  547. static const byte *ext_find(const byte *data, size_t data_len, int ext_type)
  548. {
  549. size_t idx = 0;
  550. word16 len16, etype;
  551. while (idx < data_len) {
  552. ato16(&data[idx], &etype); /* extension type */
  553. if (etype == ext_type) {
  554. return data + idx;
  555. }
  556. ato16(&data[idx+2], &len16); /* extension length */
  557. idx += 2 + 2 + len16;
  558. }
  559. return NULL;
  560. }
  561. static int ext_has(const byte *data, size_t data_len, int ext_type)
  562. {
  563. return ext_find(data, data_len,ext_type) != NULL;
  564. }
  565. static void ext_equals(const byte *data, size_t data_len, int ext_type,
  566. const byte *exp_data, size_t exp_len)
  567. {
  568. const byte *ext;
  569. word16 len16;
  570. AssertNotNull(ext = ext_find(data, data_len, ext_type));
  571. ato16(&ext[2], &len16);
  572. AssertTrue(len16 == exp_len);
  573. AssertTrue(memcmp(ext + 4, exp_data, exp_len) == 0);
  574. }
  575. static void check_quic_client_hello(const byte *data, size_t data_len, int verbose, int indent)
  576. {
  577. size_t idx;
  578. word16 len16;
  579. const byte *exts;
  580. size_t exts_len, rec_len;
  581. int rec_type;
  582. static byte ext_sup_version[3] = {0x02, 0x03, 0x04};
  583. check_handshake_record(data, data_len, &rec_type, &rec_len);
  584. AssertIntEQ(rec_type, client_hello);
  585. idx = HANDSHAKE_HEADER_SZ;
  586. /* the client hello arrives alone */
  587. AssertIntEQ(rec_len, data_len);
  588. AssertTrue(data[idx++] == SSLv3_MAJOR);
  589. AssertTrue(data[idx++] == TLSv1_2_MINOR);
  590. idx += 32; /* 32 bytes RANDOM */
  591. AssertIntEQ(data[idx], 0); /* session id length MUST be 0, RFC9001 ch. 8.4 */
  592. idx += 1 + data[idx];
  593. ato16(&data[idx], &len16); /* ciphers length */
  594. AssertTrue(len16 > 0);
  595. idx += 2 + len16;
  596. AssertTrue(data[idx] == 1); /* compressions */
  597. AssertTrue(data[idx+1] == 0); /* no compression */
  598. idx += 2;
  599. ato16(&data[idx], &len16); /* extensions length */
  600. AssertTrue(len16 > 0);
  601. exts_len = len16;
  602. idx += 2;
  603. exts = &data[idx];
  604. idx += exts_len;
  605. AssertTrue(idx <= rec_len); /* should fit */
  606. for (; idx < rec_len; ++idx) {
  607. AssertTrue(data[idx] == 0); /* padding */
  608. }
  609. ext_equals(exts, exts_len, TLSX_SUPPORTED_VERSIONS,
  610. ext_sup_version, sizeof(ext_sup_version));
  611. if (verbose) {
  612. ext_dump(exts, exts_len, indent);
  613. dump_buffer("", data, data_len, indent);
  614. }
  615. }
  616. static void check_quic_client_hello_tp(OutputBuffer *out, int tp_v1, int tp_draft)
  617. {
  618. size_t idx;
  619. word16 len16;
  620. const byte *exts;
  621. size_t exts_len, rec_len;
  622. int rec_type;
  623. check_handshake_record(out->data, out->len, &rec_type, &rec_len);
  624. AssertIntEQ(rec_type, client_hello);
  625. idx = HANDSHAKE_HEADER_SZ;
  626. idx += 2; /* old version */
  627. idx += 32; /* 32 bytes RANDOM */
  628. idx += 1 + out->data[idx]; /* session id */
  629. ato16(&out->data[idx], &len16); /* ciphers length */
  630. idx += 2 + len16;
  631. idx += 2; /* compression */
  632. ato16(&out->data[idx], &len16); /* extensions length */
  633. AssertTrue(len16 > 0);
  634. exts_len = len16;
  635. idx += 2;
  636. exts = &out->data[idx];
  637. AssertTrue(!ext_has(exts, exts_len, TLSX_KEY_QUIC_TP_PARAMS) == !tp_v1);
  638. AssertTrue(!ext_has(exts, exts_len, TLSX_KEY_QUIC_TP_PARAMS_DRAFT) == !tp_draft);
  639. }
  640. static void check_secrets(QuicTestContext *ctx, WOLFSSL_ENCRYPTION_LEVEL level, size_t rx_len, size_t tx_len)
  641. {
  642. int idx = (int)level;
  643. AssertTrue(idx < 4);
  644. AssertIntEQ(ctx->rx_secret_len[idx], rx_len);
  645. AssertIntEQ(ctx->tx_secret_len[idx], tx_len);
  646. }
  647. static void assert_secrets_EQ(QuicTestContext *ctx1, QuicTestContext *ctx2,
  648. WOLFSSL_ENCRYPTION_LEVEL level)
  649. {
  650. int idx = (int)level;
  651. /* rx secrets are the other ones tx secrets */
  652. AssertIntEQ(ctx1->rx_secret_len[idx], ctx2->tx_secret_len[idx]);
  653. AssertIntEQ(ctx1->tx_secret_len[idx], ctx2->rx_secret_len[idx]);
  654. AssertIntEQ(memcmp(ctx1->rx_secret[idx], ctx2->tx_secret[idx], ctx1->rx_secret_len[idx]), 0);
  655. AssertIntEQ(memcmp(ctx1->tx_secret[idx], ctx2->rx_secret[idx], ctx1->tx_secret_len[idx]), 0);
  656. }
  657. static void check_ee(const byte *data, size_t data_len, int verbose, int indent)
  658. {
  659. size_t rec_len, exts_len, idx;
  660. word16 len16;
  661. const byte *exts;
  662. int rec_type;
  663. check_handshake_record(data, data_len, &rec_type, &rec_len);
  664. AssertIntEQ(rec_type, encrypted_extensions);
  665. idx = HANDSHAKE_HEADER_SZ;
  666. ato16(&data[idx], &len16); /* extensions length */
  667. AssertTrue(len16 > 0);
  668. exts_len = len16;
  669. idx += 2;
  670. exts = &data[idx];
  671. if (verbose) {
  672. ext_dump(exts, exts_len, indent);
  673. dump_buffer("", data, data_len, indent);
  674. }
  675. }
  676. static void check_quic_server_hello(const byte *data, size_t data_len, int verbose, int indent)
  677. {
  678. size_t idx;
  679. word16 len16, cipher;
  680. const byte *exts;
  681. size_t exts_len, rec_len;
  682. static byte ext_sup_version[2] = {0x03, 0x04};
  683. int rec_type;
  684. check_handshake_record(data, data_len, &rec_type, &rec_len);
  685. AssertIntEQ(rec_type, server_hello);
  686. idx = HANDSHAKE_HEADER_SZ;
  687. AssertTrue(data[idx++] == SSLv3_MAJOR);
  688. AssertTrue(data[idx++] == TLSv1_2_MINOR);
  689. idx += 32; /* 32 bytes RANDOM */
  690. /* AssertIntEQ(data[idx], 0); session id of len 0 */
  691. idx += 1 + data[idx];
  692. ato16(&data[idx], &cipher); /* cipher selected */
  693. AssertTrue(cipher != 0);
  694. idx += 2;
  695. AssertTrue(data[idx] == 0); /* null compression */
  696. idx += 1;
  697. ato16(&data[idx], &len16); /* extensions length */
  698. AssertTrue(len16 > 0);
  699. exts_len = len16;
  700. idx += 2;
  701. exts = &data[idx];
  702. idx += exts_len;
  703. AssertTrue(idx <= rec_len); /* should fit */
  704. for (; idx < rec_len; ++idx) {
  705. AssertTrue(data[idx] == 0); /* padding */
  706. }
  707. if (verbose) {
  708. ext_dump(exts, exts_len, indent);
  709. dump_buffer("", data, rec_len, indent);
  710. }
  711. ext_equals(exts, exts_len, TLSX_SUPPORTED_VERSIONS,
  712. ext_sup_version, sizeof(ext_sup_version));
  713. }
  714. static void check_crypto_rec(const byte *data, size_t data_len, int verbose, int indent)
  715. {
  716. size_t rec_len;
  717. int rec_type;
  718. check_handshake_record(data, data_len, &rec_type, &rec_len);
  719. if (verbose) {
  720. dump_buffer("", data, rec_len, indent);
  721. }
  722. }
  723. static void check_crypto_records(QuicTestContext *from, OutputBuffer *out, int indent, char *rec_log, size_t rec_log_size)
  724. {
  725. const byte *data = out->data;
  726. size_t data_len = out->len;
  727. size_t rec_len;
  728. int rec_type;
  729. const char *rec_name;
  730. char lbuffer[128];
  731. void (*check_rec) (const byte *d, size_t l, int v, int indent);
  732. while (data_len > 0) {
  733. check_handshake_record(data, data_len, &rec_type, &rec_len);
  734. if (rec_len > data_len) {
  735. printf("%*sINCOMPLETE CRYPTO?: ", indent, " ");
  736. dump_buffer("", data, data_len, indent);
  737. }
  738. AssertTrue(rec_len <= data_len);
  739. check_rec = check_crypto_rec;
  740. switch (rec_type) {
  741. case client_hello:
  742. rec_name = "ClientHello";
  743. check_rec = check_quic_client_hello;
  744. break;
  745. case server_hello:
  746. rec_name = "ServerHello";
  747. check_rec = check_quic_server_hello;
  748. break;
  749. case session_ticket:
  750. rec_name = "SessionTicket";
  751. break;
  752. case encrypted_extensions:
  753. rec_name = "EncryptedExtension";
  754. check_rec = check_ee;
  755. break;
  756. case certificate:
  757. rec_name = "Certificate";
  758. break;
  759. case certificate_verify:
  760. rec_name = "CertificateVerify";
  761. break;
  762. case finished:
  763. rec_name = "Finished";
  764. break;
  765. default:
  766. (void)XSNPRINTF(lbuffer, sizeof(lbuffer), "%d", rec_type);
  767. rec_name = lbuffer;
  768. break;
  769. }
  770. if (rec_log) {
  771. if (*rec_log) XSTRLCAT(rec_log, ":", rec_log_size);
  772. XSTRLCAT(rec_log, rec_name, rec_log_size);
  773. }
  774. if (from->verbose) printf("%*sCRYPTO[%s]: ", indent, " ", rec_name);
  775. check_rec(data, rec_len, from->verbose, indent);
  776. if (from->verbose) printf("\n");
  777. data += rec_len;
  778. data_len -= rec_len;
  779. }
  780. }
  781. static void QuicTestContext_forward(QuicTestContext *from, QuicTestContext *to, char *rec_log, size_t rec_log_size)
  782. {
  783. int ret;
  784. OutputBuffer *out, *old;
  785. out = &from->output;
  786. while (out->len > 0) {
  787. if (from->verbose) {
  788. printf("[%s -> %s] forward %d bytes at level %d\n",
  789. from->name, to->name, (int)out->len, out->level);
  790. }
  791. if (out->level == wolfssl_encryption_early_data) {
  792. if (from->verbose) dump_buffer("EarlyData", out->data, out->len, 4);
  793. }
  794. else {
  795. check_crypto_records(from, out, 4, rec_log, rec_log_size);
  796. }
  797. ret = wolfSSL_provide_quic_data(to->ssl, out->level, out->data, out->len);
  798. out->len = 0;
  799. AssertIntEQ(ret, WOLFSSL_SUCCESS);
  800. if (out->next) {
  801. old = out->next;
  802. memcpy(out, out->next, sizeof(*out));
  803. free(old);
  804. }
  805. }
  806. }
  807. typedef struct {
  808. QuicTestContext *client;
  809. QuicTestContext *server;
  810. int started;
  811. int verbose;
  812. char rec_log[16*1024];
  813. int sent_early_data;
  814. int accept_early_data;
  815. char early_data[16*1024];
  816. size_t early_data_len;
  817. } QuicConversation;
  818. static void QuicConversation_init(QuicConversation *conv,
  819. QuicTestContext *tclient, QuicTestContext *tserver)
  820. {
  821. memset(conv, 0, sizeof(*conv));
  822. conv->client = tclient;
  823. conv->server = tserver;
  824. conv->verbose = tclient->verbose && tserver->verbose;
  825. }
  826. static int QuicConversation_start(QuicConversation *conv, const byte *data,
  827. size_t data_len, size_t *pwritten)
  828. {
  829. int ret;
  830. AssertFalse(conv->started);
  831. if (conv->verbose) {
  832. printf("[%s <-> %s] starting\n", conv->client->name, conv->server->name);
  833. }
  834. if (data && data_len > 0) {
  835. #ifdef WOLFSSL_EARLY_DATA
  836. int written;
  837. ret = wolfSSL_write_early_data(conv->client->ssl, data, (int)data_len, &written);
  838. if (ret < 0) {
  839. int err = wolfSSL_get_error(conv->client->ssl, ret);
  840. char lbuffer[1024];
  841. printf("EARLY DATA ret = %d, error = %d, %s\n", ret, err, wolfSSL_ERR_error_string((unsigned long)err, lbuffer));
  842. AssertTrue(0);
  843. }
  844. *pwritten = (size_t)written;
  845. conv->sent_early_data = 1;
  846. #else
  847. fprintf(stderr, "Cannot send EARLY DATA without feature enabled!\n");
  848. AssertTrue(0);
  849. #endif
  850. }
  851. else {
  852. ret = wolfSSL_connect(conv->client->ssl);
  853. if (ret != WOLFSSL_SUCCESS) {
  854. AssertIntEQ(wolfSSL_get_error(conv->client->ssl, 0), WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ));
  855. }
  856. if (pwritten) *pwritten = 0;
  857. }
  858. conv->started = 1;
  859. return ret;
  860. }
  861. static int QuicConversation_step(QuicConversation *conv, int may_fail)
  862. {
  863. int n;
  864. if (!conv->started) {
  865. n = wolfSSL_connect(conv->client->ssl);
  866. if (n != WOLFSSL_SUCCESS
  867. && wolfSSL_get_error(conv->client->ssl, 0) != WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ)) {
  868. if (may_fail) return 0;
  869. AssertIntEQ(WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ), wolfSSL_get_error(conv->client->ssl, 0));
  870. }
  871. conv->started = 1;
  872. }
  873. if (conv->server->output.len > 0) {
  874. QuicTestContext_forward(conv->server, conv->client, conv->rec_log, sizeof(conv->rec_log));
  875. n = wolfSSL_quic_read_write(conv->client->ssl);
  876. if (n != WOLFSSL_SUCCESS
  877. && wolfSSL_get_error(conv->client->ssl, 0) != WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ)) {
  878. if (may_fail) return 0;
  879. AssertIntEQ(WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ), wolfSSL_get_error(conv->client->ssl, 0));
  880. }
  881. return 1;
  882. }
  883. else if (conv->client->output.len > 0) {
  884. QuicTestContext_forward(conv->client, conv->server, conv->rec_log, sizeof(conv->rec_log));
  885. #ifdef WOLFSSL_EARLY_DATA
  886. if (conv->accept_early_data) {
  887. int written;
  888. n = wolfSSL_read_early_data(conv->server->ssl,
  889. conv->early_data + conv->early_data_len,
  890. (int)(sizeof(conv->early_data) - conv->early_data_len),
  891. &written);
  892. if (n < 0) {
  893. if (wolfSSL_get_error(conv->server->ssl, 0) != WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ)) {
  894. if (may_fail) return 0;
  895. AssertIntEQ(wolfSSL_get_error(conv->server->ssl, 0), WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ));
  896. }
  897. }
  898. else if (n > 0) {
  899. conv->early_data_len += (size_t)n;
  900. if (conv->verbose)
  901. printf("RECVed early data, len now=%d\n", (int)conv->early_data_len);
  902. }
  903. }
  904. else
  905. #endif /* WOLFSSL_EARLY_DATA */
  906. {
  907. n = wolfSSL_quic_read_write(conv->server->ssl);
  908. if (n != WOLFSSL_SUCCESS
  909. && wolfSSL_get_error(conv->server->ssl, 0) != WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ)) {
  910. if (may_fail) return 0;
  911. AssertIntEQ(wolfSSL_get_error(conv->server->ssl, 0), WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ));
  912. }
  913. }
  914. return 1;
  915. }
  916. return 0;
  917. }
  918. static void QuicConversation_do(QuicConversation *conv)
  919. {
  920. if (!conv->started) {
  921. QuicConversation_start(conv, NULL, 0, NULL);
  922. }
  923. while (1) {
  924. if (!QuicConversation_step(conv, 0)) {
  925. int c_err = wolfSSL_get_error(conv->client->ssl, 0);
  926. int s_err = wolfSSL_get_error(conv->server->ssl, 0);
  927. if (c_err == 0 && s_err == 0) {
  928. break; /* handshake done */
  929. }
  930. printf("Neither tclient nor server have anything to send, "
  931. "but client_error=%d, server_error=%d\n",
  932. c_err, s_err);
  933. AssertFalse(1);
  934. }
  935. }
  936. }
  937. #ifdef HAVE_SESSION_TICKET
  938. static void QuicConversation_fail(QuicConversation *conv)
  939. {
  940. if (!conv->started) {
  941. QuicConversation_start(conv, NULL, 0, NULL);
  942. }
  943. while (1) {
  944. if (!QuicConversation_step(conv, 1)) {
  945. int c_err = wolfSSL_get_error(conv->client->ssl, 0);
  946. int s_err = wolfSSL_get_error(conv->server->ssl, 0);
  947. AssertTrue(c_err != 0 || s_err != 0);
  948. break;
  949. }
  950. }
  951. }
  952. #endif /* HAVE_SESSION_TICKET */
  953. static int test_quic_client_hello(int verbose) {
  954. WOLFSSL_CTX *ctx;
  955. int ret = 0;
  956. QuicTestContext tctx;
  957. (void)ctx_dump_output;
  958. AssertNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
  959. QuicTestContext_init(&tctx, ctx, "client", verbose);
  960. /* Without any QUIC transport params, this needs to fail */
  961. AssertTrue(wolfSSL_set_quic_transport_params(tctx.ssl, NULL, 0) == WOLFSSL_SUCCESS);
  962. AssertTrue(wolfSSL_quic_read_write(tctx.ssl) != 0);
  963. AssertIntEQ(wolfSSL_get_error(tctx.ssl, 0), WC_NO_ERR_TRACE(QUIC_TP_MISSING_E));
  964. QuicTestContext_free(&tctx);
  965. /* Set transport params, expect both extensions */
  966. QuicTestContext_init(&tctx, ctx, "client", verbose);
  967. #ifdef HAVE_SNI
  968. wolfSSL_UseSNI(tctx.ssl, WOLFSSL_SNI_HOST_NAME,
  969. "wolfssl.com", sizeof("wolfssl.com")-1);
  970. #endif
  971. AssertTrue(wolfSSL_connect(tctx.ssl) != 0);
  972. AssertIntEQ(wolfSSL_get_error(tctx.ssl, 0), WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ));
  973. check_quic_client_hello_tp(&tctx.output, 1, 1);
  974. QuicTestContext_free(&tctx);
  975. /* Set transport params v1, expect v1 extension */
  976. QuicTestContext_init(&tctx, ctx, "client", verbose);
  977. wolfSSL_set_quic_transport_version(tctx.ssl, TLSX_KEY_QUIC_TP_PARAMS);
  978. AssertTrue(wolfSSL_connect(tctx.ssl) != 0);
  979. check_quic_client_hello_tp(&tctx.output, 1, 0);
  980. QuicTestContext_free(&tctx);
  981. /* Set transport params draft, expect draft extension */
  982. QuicTestContext_init(&tctx, ctx, "client", verbose);
  983. wolfSSL_set_quic_transport_version(tctx.ssl, TLSX_KEY_QUIC_TP_PARAMS_DRAFT);
  984. AssertTrue(wolfSSL_connect(tctx.ssl) != 0);
  985. check_quic_client_hello_tp(&tctx.output, 0, 1);
  986. QuicTestContext_free(&tctx);
  987. /* Set transport params 0, expect both extension */
  988. QuicTestContext_init(&tctx, ctx, "client", verbose);
  989. wolfSSL_set_quic_transport_version(tctx.ssl, 0);
  990. AssertTrue(wolfSSL_connect(tctx.ssl) != 0);
  991. check_quic_client_hello_tp(&tctx.output, 1, 1);
  992. QuicTestContext_free(&tctx);
  993. wolfSSL_CTX_free(ctx);
  994. printf(" test_quic_client_hello: %s\n", (ret == 0)? passed : failed);
  995. return ret;
  996. }
  997. static int test_quic_server_hello(int verbose) {
  998. WOLFSSL_CTX *ctx_c, *ctx_s;
  999. int ret = 0;
  1000. QuicTestContext tclient, tserver;
  1001. QuicConversation conv;
  1002. AssertNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
  1003. AssertNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
  1004. AssertTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile, WOLFSSL_FILETYPE_PEM));
  1005. AssertTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile, WOLFSSL_FILETYPE_PEM));
  1006. /* setup ssls */
  1007. QuicTestContext_init(&tclient, ctx_c, "client", verbose);
  1008. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1009. /* connect */
  1010. QuicConversation_init(&conv, &tclient, &tserver);
  1011. QuicConversation_step(&conv, 0);
  1012. /* check established/missing secrets */
  1013. check_secrets(&tserver, wolfssl_encryption_initial, 0, 0);
  1014. check_secrets(&tserver, wolfssl_encryption_handshake, 32, 32);
  1015. check_secrets(&tserver, wolfssl_encryption_application, 32, 32);
  1016. check_secrets(&tclient, wolfssl_encryption_handshake, 0, 0);
  1017. /* feed the server data to the client */
  1018. QuicConversation_step(&conv, 0);
  1019. /* client has generated handshake secret */
  1020. check_secrets(&tclient, wolfssl_encryption_handshake, 32, 32);
  1021. /* continue the handshake till done */
  1022. conv.started = 1;
  1023. /* run till end */
  1024. QuicConversation_do(&conv);
  1025. AssertIntEQ(tclient.output.len, 0);
  1026. AssertIntEQ(tserver.output.len, 0);
  1027. /* what have we seen? */
  1028. #ifdef HAVE_SESSION_TICKET
  1029. AssertStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
  1030. "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
  1031. #else
  1032. AssertStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
  1033. "Certificate:CertificateVerify:Finished:Finished");
  1034. #endif
  1035. /* we are at application encryption level */
  1036. AssertTrue(wolfSSL_quic_read_level(tclient.ssl) == wolfssl_encryption_application);
  1037. AssertTrue(wolfSSL_quic_write_level(tclient.ssl) == wolfssl_encryption_application);
  1038. AssertTrue(wolfSSL_quic_read_level(tserver.ssl) == wolfssl_encryption_application);
  1039. AssertTrue(wolfSSL_quic_write_level(tserver.ssl) == wolfssl_encryption_application);
  1040. /* the last client write (FINISHED) was at handshake level */
  1041. AssertTrue(tclient.output.level == wolfssl_encryption_handshake);
  1042. /* we have the app secrets */
  1043. check_secrets(&tclient, wolfssl_encryption_application, 32, 32);
  1044. check_secrets(&tserver, wolfssl_encryption_application, 32, 32);
  1045. /* verify client and server have the same secrets established */
  1046. assert_secrets_EQ(&tclient, &tserver, wolfssl_encryption_handshake);
  1047. assert_secrets_EQ(&tclient, &tserver, wolfssl_encryption_application);
  1048. /* AEAD cipher should be known */
  1049. AssertNotNull(wolfSSL_quic_get_aead(tclient.ssl));
  1050. AssertNotNull(wolfSSL_quic_get_aead(tserver.ssl));
  1051. /* What was negiotiated and is it the same? */
  1052. AssertIntEQ(wolfSSL_get_peer_quic_transport_version(tclient.ssl),
  1053. wolfSSL_get_peer_quic_transport_version(tserver.ssl));
  1054. QuicTestContext_free(&tclient);
  1055. QuicTestContext_free(&tserver);
  1056. wolfSSL_CTX_free(ctx_c);
  1057. wolfSSL_CTX_free(ctx_s);
  1058. printf(" test_quic_server_hello: %s\n", (ret == 0)? passed : failed);
  1059. return ret;
  1060. }
  1061. /* This has gotten a bit out of hand. */
  1062. #if (defined(OPENSSL_ALL) || (defined(OPENSSL_EXTRA) && \
  1063. (defined(HAVE_STUNNEL) || defined(WOLFSSL_NGINX) || \
  1064. defined(HAVE_LIGHTY) || defined(WOLFSSL_HAPROXY) || \
  1065. defined(WOLFSSL_OPENSSH) || defined(HAVE_SBLIM_SFCB)))) \
  1066. && defined(HAVE_ALPN) && defined(HAVE_SNI)
  1067. #define REALLY_HAVE_ALPN_AND_SNI
  1068. #else
  1069. #undef REALLY_HAVE_ALPN_AND_SNI
  1070. #endif
  1071. #ifdef REALLY_HAVE_ALPN_AND_SNI
  1072. struct stripe_buffer {
  1073. char stripe[256];
  1074. };
  1075. static int inspect_SNI(WOLFSSL *ssl, int *ad, void *baton)
  1076. {
  1077. struct stripe_buffer *stripe = (struct stripe_buffer *)baton;
  1078. (void)ssl;
  1079. *ad = 0;
  1080. XSTRLCAT(stripe->stripe, "S", sizeof(stripe->stripe));
  1081. return 0;
  1082. }
  1083. static int select_ALPN(WOLFSSL *ssl,
  1084. const unsigned char **out,
  1085. unsigned char *outlen,
  1086. const unsigned char *in,
  1087. unsigned int inlen,
  1088. void *baton)
  1089. {
  1090. struct stripe_buffer *stripe = (struct stripe_buffer *)baton;
  1091. (void)ssl;
  1092. (void)inlen;
  1093. /* just select the first */
  1094. *out = in + 1;
  1095. *outlen = in[0];
  1096. XSTRLCAT(stripe->stripe, "A", sizeof(stripe->stripe));
  1097. return 0;
  1098. }
  1099. static int test_quic_alpn(int verbose) {
  1100. WOLFSSL_CTX *ctx_c, *ctx_s;
  1101. int ret = 0;
  1102. QuicTestContext tclient, tserver;
  1103. QuicConversation conv;
  1104. struct stripe_buffer stripe;
  1105. unsigned char alpn_protos[256];
  1106. AssertNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
  1107. AssertNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
  1108. AssertTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile, WOLFSSL_FILETYPE_PEM));
  1109. AssertTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile, WOLFSSL_FILETYPE_PEM));
  1110. stripe.stripe[0] = '\0';
  1111. wolfSSL_CTX_set_servername_callback(ctx_s, inspect_SNI);
  1112. wolfSSL_CTX_set_servername_arg(ctx_s, &stripe);
  1113. wolfSSL_CTX_set_alpn_select_cb(ctx_s, select_ALPN, &stripe);
  1114. /* setup ssls */
  1115. QuicTestContext_init(&tclient, ctx_c, "client", verbose);
  1116. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1117. /* set SNI and ALPN callbacks on server side,
  1118. * provide values on client side */
  1119. wolfSSL_UseSNI(tclient.ssl, WOLFSSL_SNI_HOST_NAME,
  1120. "wolfssl.com", sizeof("wolfssl.com")-1);
  1121. /* connect */
  1122. QuicConversation_init(&conv, &tclient, &tserver);
  1123. XSTRLCPY((char*)(alpn_protos + 1), "test", sizeof(alpn_protos));
  1124. alpn_protos[0] = strlen("test");
  1125. wolfSSL_set_alpn_protos(tclient.ssl, alpn_protos, 1 + strlen("test"));
  1126. QuicConversation_do(&conv);
  1127. AssertIntEQ(tclient.output.len, 0);
  1128. AssertIntEQ(tserver.output.len, 0);
  1129. /* SNI callback needs to be called before ALPN callback */
  1130. AssertStrEQ(stripe.stripe, "SA");
  1131. QuicTestContext_free(&tclient);
  1132. QuicTestContext_free(&tserver);
  1133. wolfSSL_CTX_free(ctx_c);
  1134. wolfSSL_CTX_free(ctx_s);
  1135. printf(" test_quic_alpn: %s\n", (ret == 0)? passed : failed);
  1136. return ret;
  1137. }
  1138. #endif /* REALLY_HAVE_ALPN_AND_SNI */
  1139. #ifdef HAVE_SESSION_TICKET
  1140. static int test_quic_key_share(int verbose) {
  1141. WOLFSSL_CTX *ctx_c, *ctx_s;
  1142. int ret = 0;
  1143. QuicTestContext tclient, tserver;
  1144. QuicConversation conv;
  1145. AssertNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
  1146. AssertNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
  1147. AssertTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile, WOLFSSL_FILETYPE_PEM));
  1148. AssertTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile, WOLFSSL_FILETYPE_PEM));
  1149. /* setup & handshake defaults */
  1150. QuicTestContext_init(&tclient, ctx_c, "client", verbose);
  1151. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1152. QuicConversation_init(&conv, &tclient, &tserver);
  1153. QuicConversation_do(&conv);
  1154. AssertStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
  1155. "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
  1156. QuicTestContext_free(&tclient);
  1157. QuicTestContext_free(&tserver);
  1158. /* setup & handshake, restricted groups. KEY_SHARE should use
  1159. * the first configured group. */
  1160. /*If that is supported by the server, expect a smooth handshake.*/
  1161. QuicTestContext_init(&tclient, ctx_c, "client", verbose);
  1162. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1163. AssertTrue(wolfSSL_set1_curves_list(tclient.ssl, "X25519:P-256")
  1164. == WOLFSSL_SUCCESS);
  1165. AssertTrue(wolfSSL_set1_curves_list(tserver.ssl, "X25519")
  1166. == WOLFSSL_SUCCESS);
  1167. QuicConversation_init(&conv, &tclient, &tserver);
  1168. QuicConversation_do(&conv);
  1169. AssertStrEQ(conv.rec_log,
  1170. "ClientHello:ServerHello:EncryptedExtension:"
  1171. "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
  1172. QuicTestContext_free(&tclient);
  1173. QuicTestContext_free(&tserver);
  1174. printf(" test_quic_key_share: priority ok\n");
  1175. /* If group is not supported by server, expect HelloRetry */
  1176. QuicTestContext_init(&tclient, ctx_c, "client", verbose);
  1177. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1178. AssertTrue(wolfSSL_set1_curves_list(tclient.ssl, "X25519:P-256")
  1179. == WOLFSSL_SUCCESS);
  1180. AssertTrue(wolfSSL_set1_curves_list(tserver.ssl, "P-256")
  1181. == WOLFSSL_SUCCESS);
  1182. QuicConversation_init(&conv, &tclient, &tserver);
  1183. QuicConversation_do(&conv);
  1184. AssertStrEQ(conv.rec_log,
  1185. "ClientHello:ServerHello:ClientHello:ServerHello:EncryptedExtension:"
  1186. "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
  1187. QuicTestContext_free(&tclient);
  1188. QuicTestContext_free(&tserver);
  1189. printf(" test_quic_key_share: retry ok\n");
  1190. /* If no group overlap, expect failure */
  1191. QuicTestContext_init(&tclient, ctx_c, "client", verbose);
  1192. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1193. AssertTrue(wolfSSL_set1_curves_list(tclient.ssl, "P-256")
  1194. == WOLFSSL_SUCCESS);
  1195. AssertTrue(wolfSSL_set1_curves_list(tserver.ssl, "X25519")
  1196. == WOLFSSL_SUCCESS);
  1197. QuicConversation_init(&conv, &tclient, &tserver);
  1198. QuicConversation_fail(&conv);
  1199. AssertIntEQ(wolfSSL_get_error(tserver.ssl, 0), WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ));
  1200. AssertIntEQ(wolfSSL_get_error(tclient.ssl, 0), WC_NO_ERR_TRACE(BAD_KEY_SHARE_DATA));
  1201. QuicTestContext_free(&tclient);
  1202. QuicTestContext_free(&tserver);
  1203. printf(" test_quic_key_share: no match ok\n");
  1204. wolfSSL_CTX_free(ctx_c);
  1205. wolfSSL_CTX_free(ctx_s);
  1206. printf(" test_quic_key_share: %s\n", (ret == 0)? passed : failed);
  1207. return ret;
  1208. }
  1209. static int test_quic_resumption(int verbose) {
  1210. WOLFSSL_CTX *ctx_c, *ctx_s;
  1211. WOLFSSL_SESSION *session, *session_restored;
  1212. int ret = 0;
  1213. QuicTestContext tclient, tserver;
  1214. QuicConversation conv;
  1215. unsigned char session_buffer[16 * 1024], *session_data;
  1216. const unsigned char *session_data2;
  1217. unsigned int session_size;
  1218. AssertNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
  1219. AssertNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
  1220. AssertTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile, WOLFSSL_FILETYPE_PEM));
  1221. AssertTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile, WOLFSSL_FILETYPE_PEM));
  1222. /* setup ssls */
  1223. QuicTestContext_init(&tclient, ctx_c, "client", verbose);
  1224. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1225. QuicConversation_init(&conv, &tclient, &tserver);
  1226. /* run till end */
  1227. QuicConversation_do(&conv);
  1228. /* what have we seen? */
  1229. AssertStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
  1230. "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
  1231. /* Should have received a session ticket, save the session
  1232. * and also make a serialized/deserialized copy to check that persisting
  1233. * a session works. */
  1234. AssertTrue(tclient.ticket_len > 0);
  1235. AssertNotNull(session = wolfSSL_get1_session(tclient.ssl));
  1236. AssertTrue((session_size = (unsigned int)wolfSSL_i2d_SSL_SESSION(session, NULL)) > 0);
  1237. AssertTrue((size_t)session_size < sizeof(session_buffer));
  1238. session_data2 = session_data = session_buffer;
  1239. session_size = (unsigned int)wolfSSL_i2d_SSL_SESSION(session, &session_data);
  1240. session_restored = wolfSSL_d2i_SSL_SESSION(NULL, &session_data2, session_size);
  1241. AssertNotNull(session_restored);
  1242. QuicTestContext_free(&tserver);
  1243. QuicTestContext_free(&tclient);
  1244. /* Do a Session resumption with the session object */
  1245. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1246. QuicTestContext_init(&tclient, ctx_c, "client_resume", verbose);
  1247. AssertIntEQ(wolfSSL_set_session(tclient.ssl, session), WOLFSSL_SUCCESS);
  1248. /* let them talk */
  1249. QuicConversation_init(&conv, &tclient, &tserver);
  1250. QuicConversation_do(&conv);
  1251. /* this is what should happen. Look Ma, no certificate! */
  1252. AssertStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
  1253. "Finished:Finished:SessionTicket");
  1254. QuicTestContext_free(&tclient);
  1255. QuicTestContext_free(&tserver);
  1256. /* Do a Session resumption with the restored session object */
  1257. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1258. QuicTestContext_init(&tclient, ctx_c, "client_resume_restored", verbose);
  1259. AssertIntEQ(wolfSSL_set_session(tclient.ssl, session_restored), WOLFSSL_SUCCESS);
  1260. /* let them talk */
  1261. QuicConversation_init(&conv, &tclient, &tserver);
  1262. QuicConversation_do(&conv);
  1263. /* this is what should happen. Look Ma, no certificate! */
  1264. AssertStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
  1265. "Finished:Finished:SessionTicket");
  1266. QuicTestContext_free(&tclient);
  1267. QuicTestContext_free(&tserver);
  1268. {
  1269. /* Do a Session resumption with a new server ctx */
  1270. WOLFSSL_CTX *ctx_s2;
  1271. AssertNotNull(ctx_s2 = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
  1272. AssertTrue(wolfSSL_CTX_use_certificate_file(ctx_s2, eccCertFile, WOLFSSL_FILETYPE_PEM));
  1273. AssertTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s2, eccKeyFile, WOLFSSL_FILETYPE_PEM));
  1274. QuicTestContext_init(&tserver, ctx_s2, "server2", verbose);
  1275. QuicTestContext_init(&tclient, ctx_c, "client_resume2", verbose);
  1276. AssertIntEQ(wolfSSL_set_session(tclient.ssl, session_restored), WOLFSSL_SUCCESS);
  1277. /* let them talk */
  1278. QuicConversation_init(&conv, &tclient, &tserver);
  1279. QuicConversation_do(&conv);
  1280. AssertStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
  1281. "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
  1282. QuicTestContext_free(&tclient);
  1283. QuicTestContext_free(&tserver);
  1284. wolfSSL_CTX_free(ctx_s2);
  1285. }
  1286. wolfSSL_SESSION_free(session);
  1287. wolfSSL_SESSION_free(session_restored);
  1288. wolfSSL_CTX_free(ctx_c);
  1289. wolfSSL_CTX_free(ctx_s);
  1290. printf(" test_quic_resumption: %s\n", (ret == 0)? passed : failed);
  1291. return ret;
  1292. }
  1293. #ifdef WOLFSSL_EARLY_DATA
  1294. static int test_quic_early_data(int verbose) {
  1295. WOLFSSL_CTX *ctx_c, *ctx_s;
  1296. int ret = 0;
  1297. QuicTestContext tclient, tserver;
  1298. QuicConversation conv;
  1299. const byte early_data[] = "Nulla dies sine linea!";
  1300. size_t ed_written;
  1301. WOLFSSL_SESSION *session;
  1302. unsigned int max_early_sz;
  1303. AssertNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
  1304. wolfSSL_CTX_UseSessionTicket(ctx_c);
  1305. AssertNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
  1306. AssertTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile, WOLFSSL_FILETYPE_PEM));
  1307. AssertTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile, WOLFSSL_FILETYPE_PEM));
  1308. /* setup ssls */
  1309. QuicTestContext_init(&tclient, ctx_c, "client", verbose);
  1310. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1311. wolfSSL_set_quic_early_data_enabled(tserver.ssl, 1);
  1312. /* QUIC only allows 0xffffffff or 0x0 as values */
  1313. AssertIntEQ(wolfSSL_get_max_early_data(tserver.ssl), UINT32_MAX);
  1314. QuicConversation_init(&conv, &tclient, &tserver);
  1315. /* run till end */
  1316. QuicConversation_do(&conv);
  1317. /* what have we seen? */
  1318. AssertStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
  1319. "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
  1320. /* Should have received a session ticket, save the session */
  1321. AssertTrue(tclient.ticket_len > 0);
  1322. AssertNotNull(session = wolfSSL_get1_session(tclient.ssl));
  1323. QuicTestContext_free(&tclient);
  1324. QuicTestContext_free(&tserver);
  1325. /* QUIC requires 0 or 0xffffffff as only allowed values.
  1326. * Since we enabled early data in the server that created the session,
  1327. * we need to see it here. */
  1328. max_early_sz = wolfSSL_SESSION_get_max_early_data(session);
  1329. AssertIntEQ(max_early_sz, UINT32_MAX);
  1330. /* Do a Session resumption with the ticket */
  1331. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1332. QuicTestContext_init(&tclient, ctx_c, "client", verbose);
  1333. AssertIntEQ(wolfSSL_set_session(tclient.ssl, session), WOLFSSL_SUCCESS);
  1334. /* enable early data -*/
  1335. wolfSSL_set_quic_early_data_enabled(tserver.ssl, 1);
  1336. /* client will send, and server will receive implicitly */
  1337. QuicConversation_init(&conv, &tclient, &tserver);
  1338. QuicConversation_start(&conv, early_data, sizeof(early_data), &ed_written);
  1339. QuicConversation_do(&conv);
  1340. AssertIntEQ(wolfSSL_get_early_data_status(tclient.ssl), WOLFSSL_EARLY_DATA_ACCEPTED);
  1341. QuicTestContext_free(&tclient);
  1342. QuicTestContext_free(&tserver);
  1343. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1344. QuicTestContext_init(&tclient, ctx_c, "client", verbose);
  1345. AssertIntEQ(wolfSSL_set_session(tclient.ssl, session), WOLFSSL_SUCCESS);
  1346. /* client will send, and server will receive */
  1347. QuicConversation_init(&conv, &tclient, &tserver);
  1348. /* make QuicConversation_do() use wolfSSL_read_early_data() */
  1349. conv.accept_early_data = 1;
  1350. QuicConversation_start(&conv, early_data, sizeof(early_data), &ed_written);
  1351. QuicConversation_do(&conv);
  1352. AssertIntEQ(wolfSSL_get_early_data_status(tclient.ssl), WOLFSSL_EARLY_DATA_ACCEPTED);
  1353. AssertIntEQ(conv.early_data_len, sizeof(early_data));
  1354. AssertStrEQ(conv.early_data, (const char*)early_data);
  1355. QuicTestContext_free(&tclient);
  1356. QuicTestContext_free(&tserver);
  1357. wolfSSL_SESSION_free(session);
  1358. wolfSSL_CTX_free(ctx_c);
  1359. wolfSSL_CTX_free(ctx_s);
  1360. printf(" test_quic_early_data: %s\n", (ret == 0)? passed : failed);
  1361. return ret;
  1362. }
  1363. #endif /* WOLFSSL_EARLY_DATA */
  1364. static int new_session_cb(WOLFSSL *ssl, WOLFSSL_SESSION *session)
  1365. {
  1366. QuicTestContext *ctx = (QuicTestContext*)wolfSSL_get_app_data(ssl);
  1367. byte *data;
  1368. int ret = 0;
  1369. int sz;
  1370. AssertNotNull(ctx);
  1371. sz = wolfSSL_i2d_SSL_SESSION(session, NULL);
  1372. if (sz <= 0) {
  1373. printf("[%s] session serialization error: %d <- ", ctx->name, sz);
  1374. return sz;
  1375. }
  1376. if ((size_t)sz > sizeof(ctx->session)) {
  1377. printf("[%s] session serialization too large: %d <- ", ctx->name, sz);
  1378. return -1;
  1379. }
  1380. data = ctx->session;
  1381. ctx->session_len = (word32)wolfSSL_i2d_SSL_SESSION(session, &data);
  1382. if (ctx->verbose) {
  1383. printf("[%s]", ctx->name);
  1384. dump_buffer(" new SESSION", ctx->session, ctx->session_len, 4);
  1385. }
  1386. return ret;
  1387. }
  1388. static int test_quic_session_export(int verbose)
  1389. {
  1390. WOLFSSL_CTX *ctx_c, *ctx_s;
  1391. WOLFSSL_SESSION *session = NULL;
  1392. int ret = 0;
  1393. QuicTestContext tclient, tserver;
  1394. QuicConversation conv;
  1395. byte session_data[16*1024];
  1396. const byte *bp;
  1397. word32 session_len;
  1398. AssertNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
  1399. AssertNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
  1400. AssertTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile, WOLFSSL_FILETYPE_PEM));
  1401. AssertTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile, WOLFSSL_FILETYPE_PEM));
  1402. /* Uses CTX session callback for new sessions */
  1403. wolfSSL_CTX_sess_set_new_cb(ctx_c, new_session_cb);
  1404. /* setup ssls */
  1405. QuicTestContext_init(&tclient, ctx_c, "client", verbose);
  1406. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1407. QuicConversation_init(&conv, &tclient, &tserver);
  1408. /* run till end */
  1409. QuicConversation_do(&conv);
  1410. /* what have we seen? */
  1411. AssertStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:Certificate:CertificateVerify:Finished:Finished:SessionTicket");
  1412. /* Should have received a session, save it */
  1413. AssertTrue(tclient.session_len > 0);
  1414. memcpy(session_data, tclient.session, tclient.session_len);
  1415. session_len = tclient.session_len;
  1416. if (verbose)
  1417. dump_buffer("copied SESSION", session_data, session_len, 0);
  1418. QuicTestContext_free(&tserver);
  1419. QuicTestContext_free(&tclient);
  1420. /* Do a Session resumption with the ticket */
  1421. QuicTestContext_init(&tserver, ctx_s, "server", verbose);
  1422. QuicTestContext_init(&tclient, ctx_c, "client_resume", verbose);
  1423. bp = session_data;
  1424. AssertNotNull(session = wolfSSL_d2i_SSL_SESSION(NULL, &bp, session_len));
  1425. AssertIntEQ(wolfSSL_set_session(tclient.ssl, session), WOLFSSL_SUCCESS);
  1426. wolfSSL_SESSION_free(session);
  1427. /* let them talk */
  1428. QuicConversation_init(&conv, &tclient, &tserver);
  1429. QuicConversation_do(&conv);
  1430. /* this is what should happen. Look Ma, no certificate! */
  1431. AssertStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:Finished:Finished:SessionTicket");
  1432. QuicTestContext_free(&tclient);
  1433. QuicTestContext_free(&tserver);
  1434. wolfSSL_CTX_free(ctx_c);
  1435. wolfSSL_CTX_free(ctx_s);
  1436. printf(" test_quic_session_export: %s\n", (ret == 0)? passed : failed);
  1437. return ret;
  1438. }
  1439. #endif /* WOLFSSL_SESSION_EXPORT */
  1440. #endif /* WOLFSSL_QUIC */
  1441. int QuicTest(void)
  1442. {
  1443. int ret = 0;
  1444. #ifdef WOLFSSL_QUIC
  1445. int verbose = 0;
  1446. printf(" Begin QUIC Tests\n");
  1447. if ((ret = test_set_quic_method()) != 0) goto leave;
  1448. if ((ret = test_provide_quic_data()) != 0) goto leave;
  1449. if ((ret = test_quic_crypt()) != 0) goto leave;
  1450. if ((ret = test_quic_client_hello(verbose)) != 0) goto leave;
  1451. if ((ret = test_quic_server_hello(verbose)) != 0) goto leave;
  1452. #ifdef REALLY_HAVE_ALPN_AND_SNI
  1453. if ((ret = test_quic_alpn(verbose)) != 0) goto leave;
  1454. #endif /* REALLY_HAVE_ALPN_AND_SNI */
  1455. #ifdef HAVE_SESSION_TICKET
  1456. if ((ret = test_quic_key_share(verbose)) != 0) goto leave;
  1457. if ((ret = test_quic_resumption(verbose)) != 0) goto leave;
  1458. #ifdef WOLFSSL_EARLY_DATA
  1459. if ((ret = test_quic_early_data(verbose)) != 0) goto leave;
  1460. #endif /* WOLFSSL_EARLY_DATA */
  1461. if ((ret = test_quic_session_export(verbose)) != 0) goto leave;
  1462. #endif /* HAVE_SESSION_TICKET */
  1463. leave:
  1464. if (ret != 0)
  1465. printf(" FAILED: some tests did not pass.\n");
  1466. printf(" End QUIC Tests\n");
  1467. #endif
  1468. return ret;
  1469. }