[thirdparty/openssl.git] / test / sslapitest.c

/*
 * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <openssl/opensslconf.h>
#include <openssl/bio.h>
#include <openssl/crypto.h>
#include <openssl/ssl.h>

#include "ssltestlib.h"
#include "testutil.h"

static char *cert = NULL;
static char *privkey = NULL;

static int test_tlsext_status_type(void)
{
    SSL_CTX *ctx = NULL;
    SSL *con = NULL;
    int testresult = 0;

    /* Test tlsext_status_type */
    ctx = SSL_CTX_new(TLS_method());

    if (SSL_CTX_get_tlsext_status_type(ctx) != -1) {
        printf("Unexpected initial value for "
               "SSL_CTX_get_tlsext_status_type()\n");
        goto end;
    }

    con = SSL_new(ctx);

    if (SSL_get_tlsext_status_type(con) != -1) {
        printf("Unexpected initial value for SSL_get_tlsext_status_type()\n");
        goto end;
    }

    if (!SSL_set_tlsext_status_type(con, TLSEXT_STATUSTYPE_ocsp)) {
        printf("Unexpected fail for SSL_set_tlsext_status_type()\n");
        goto end;
    }

    if (SSL_get_tlsext_status_type(con) != TLSEXT_STATUSTYPE_ocsp) {
        printf("Unexpected result for SSL_get_tlsext_status_type()\n");
        goto end;
    }

    SSL_free(con);
    con = NULL;

    if (!SSL_CTX_set_tlsext_status_type(ctx, TLSEXT_STATUSTYPE_ocsp)) {
        printf("Unexpected fail for SSL_CTX_set_tlsext_status_type()\n");
        goto end;
    }

    if (SSL_CTX_get_tlsext_status_type(ctx) != TLSEXT_STATUSTYPE_ocsp) {
        printf("Unexpected result for SSL_CTX_get_tlsext_status_type()\n");
        goto end;
    }

    con = SSL_new(ctx);

    if (SSL_get_tlsext_status_type(con) != TLSEXT_STATUSTYPE_ocsp) {
        printf("Unexpected result for SSL_get_tlsext_status_type() (test 2)\n");
        goto end;
    }

    testresult = 1;

 end:
    SSL_free(con);
    SSL_CTX_free(ctx);

    return testresult;
}

typedef struct ssl_session_test_fixture {
    const char *test_case_name;
    int use_ext_cache;
    int use_int_cache;
} SSL_SESSION_TEST_FIXTURE;

static int new_called = 0, remove_called = 0;

static SSL_SESSION_TEST_FIXTURE
ssl_session_set_up(const char *const test_case_name)
{
    SSL_SESSION_TEST_FIXTURE fixture;

    fixture.test_case_name = test_case_name;
    fixture.use_ext_cache = 1;
    fixture.use_int_cache = 1;

    new_called = remove_called = 0;

    return fixture;
}

static void ssl_session_tear_down(SSL_SESSION_TEST_FIXTURE fixture)
{
}

static int new_session_cb(SSL *ssl, SSL_SESSION *sess)
{
    new_called++;

    return 1;
}

static void remove_session_cb(SSL_CTX *ctx, SSL_SESSION *sess)
{
    remove_called++;
}

static int execute_test_session(SSL_SESSION_TEST_FIXTURE fix)
{
    SSL_CTX *sctx = NULL, *cctx = NULL;
    SSL *serverssl1 = NULL, *clientssl1 = NULL;
    SSL *serverssl2 = NULL, *clientssl2 = NULL;
#ifndef OPENSSL_NO_TLS1_1
    SSL *serverssl3 = NULL, *clientssl3 = NULL;
#endif
    SSL_SESSION *sess1 = NULL, *sess2 = NULL;
    int testresult = 0;

    if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), &sctx,
                             &cctx, cert, privkey)) {
        printf("Unable to create SSL_CTX pair\n");
        return 0;
    }

#ifndef OPENSSL_NO_TLS1_2
    /* Only allow TLS1.2 so we can force a connection failure later */
    SSL_CTX_set_min_proto_version(cctx, TLS1_2_VERSION);
#endif

    /* Set up session cache */
    if (fix.use_ext_cache) {
        SSL_CTX_sess_set_new_cb(cctx, new_session_cb);
        SSL_CTX_sess_set_remove_cb(cctx, remove_session_cb);
    }
    if (fix.use_int_cache) {
        /* Also covers instance where both are set */
        SSL_CTX_set_session_cache_mode(cctx, SSL_SESS_CACHE_CLIENT);
    } else {
        SSL_CTX_set_session_cache_mode(cctx,
                                       SSL_SESS_CACHE_CLIENT
                                       | SSL_SESS_CACHE_NO_INTERNAL_STORE);
    }

    if (!create_ssl_objects(sctx, cctx, &serverssl1, &clientssl1, NULL,
                               NULL)) {
        printf("Unable to create SSL objects\n");
        goto end;
    }

    if (!create_ssl_connection(serverssl1, clientssl1)) {
        printf("Unable to create SSL connection\n");
        goto end;
    }
    sess1 = SSL_get1_session(clientssl1);
    if (sess1 == NULL) {
        printf("Unexpected NULL session\n");
        goto end;
    }

    if (fix.use_int_cache && SSL_CTX_add_session(cctx, sess1)) {
        /* Should have failed because it should already be in the cache */
        printf("Unexpected success adding session to cache\n");
        goto end;
    }

    if (fix.use_ext_cache && (new_called != 1 || remove_called != 0)) {
        printf("Session not added to cache\n");
        goto end;
    }

    if (!create_ssl_objects(sctx, cctx, &serverssl2, &clientssl2, NULL, NULL)) {
        printf("Unable to create second SSL objects\n");
        goto end;
    }

    if (!create_ssl_connection(serverssl2, clientssl2)) {
        printf("Unable to create second SSL connection\n");
        goto end;
    }

    sess2 = SSL_get1_session(clientssl2);
    if (sess2 == NULL) {
        printf("Unexpected NULL session from clientssl2\n");
        goto end;
    }

    if (fix.use_ext_cache && (new_called != 2 || remove_called != 0)) {
        printf("Remove session callback unexpectedly called\n");
        goto end;
    }

    /*
     * This should clear sess2 from the cache because it is a "bad" session. See
     * SSL_set_session() documentation.
     */
    if (!SSL_set_session(clientssl2, sess1)) {
        printf("Unexpected failure setting session\n");
        goto end;
    }

    if (fix.use_ext_cache && (new_called != 2 || remove_called != 1)) {
        printf("Failed to call callback to remove session\n");
        goto end;
    }


    if (SSL_get_session(clientssl2) != sess1) {
        printf("Unexpected session found\n");
        goto end;
    }

    if (fix.use_int_cache) {
        if (!SSL_CTX_add_session(cctx, sess2)) {
            /*
             * Should have succeeded because it should not already be in the cache
             */
            printf("Unexpected failure adding session to cache\n");
            goto end;
        }

        if (!SSL_CTX_remove_session(cctx, sess2)) {
            printf("Unexpected failure removing session from cache\n");
            goto end;
        }

        /* This is for the purposes of internal cache testing...ignore the
         * counter for external cache
         */
        if (fix.use_ext_cache)
            remove_called--;
    }

    /* This shouldn't be in the cache so should fail */
    if (SSL_CTX_remove_session(cctx, sess2)) {
        printf("Unexpected success removing session from cache\n");
        goto end;
    }

    if (fix.use_ext_cache && (new_called != 2 || remove_called != 2)) {
        printf("Failed to call callback to remove session #2\n");
        goto end;
    }

#if !defined(OPENSSL_NO_TLS1_1) && !defined(OPENSSL_NO_TLS1_2)
    /* Force a connection failure */
    SSL_CTX_set_max_proto_version(sctx, TLS1_1_VERSION);

    if (!create_ssl_objects(sctx, cctx, &serverssl3, &clientssl3, NULL, NULL)) {
        printf("Unable to create third SSL objects\n");
        goto end;
    }

    if (!SSL_set_session(clientssl3, sess1)) {
        printf("Unable to set session for third connection\n");
        goto end;
    }

    /* This should fail because of the mismatched protocol versions */
    if (create_ssl_connection(serverssl3, clientssl3)) {
        printf("Unable to create third SSL connection\n");
        goto end;
    }


    /* We should have automatically removed the session from the cache */
    if (fix.use_ext_cache && (new_called != 2 || remove_called != 3)) {
        printf("Failed to call callback to remove session #2\n");
        goto end;
    }

    if (fix.use_int_cache && !SSL_CTX_add_session(cctx, sess2)) {
        /*
         * Should have succeeded because it should not already be in the cache
         */
        printf("Unexpected failure adding session to cache #2\n");
        goto end;
    }
#endif

    testresult = 1;

 end:
    SSL_free(serverssl1);
    SSL_free(clientssl1);
    SSL_free(serverssl2);
    SSL_free(clientssl2);
#ifndef OPENSSL_NO_TLS1_1
    SSL_free(serverssl3);
    SSL_free(clientssl3);
#endif
    SSL_SESSION_free(sess1);
    SSL_SESSION_free(sess2);
    /*
     * Check if we need to remove any sessions up-refed for the external cache
     */
    if (new_called >= 1)
        SSL_SESSION_free(sess1);
    if (new_called >= 2)
        SSL_SESSION_free(sess2);
    SSL_CTX_free(sctx);
    SSL_CTX_free(cctx);

    return testresult;
}

static int test_session_with_only_int_cache(void)
{
    SETUP_TEST_FIXTURE(SSL_SESSION_TEST_FIXTURE, ssl_session_set_up);

    fixture.use_ext_cache = 0;

    EXECUTE_TEST(execute_test_session, ssl_session_tear_down);
}

static int test_session_with_only_ext_cache(void)
{
    SETUP_TEST_FIXTURE(SSL_SESSION_TEST_FIXTURE, ssl_session_set_up);

    fixture.use_int_cache = 0;

    EXECUTE_TEST(execute_test_session, ssl_session_tear_down);
}

static int test_session_with_both_cache(void)
{
    SETUP_TEST_FIXTURE(SSL_SESSION_TEST_FIXTURE, ssl_session_set_up);

    EXECUTE_TEST(execute_test_session, ssl_session_tear_down);
}

#define USE_NULL    0
#define USE_BIO_1   1
#define USE_BIO_2   2

#define TOTAL_SSL_SET_BIO_TESTS (3 * 3 * 3 * 3)

static void setupbio(BIO **res, BIO *bio1, BIO *bio2, int type)
{
    switch (type) {
    case USE_NULL:
        *res = NULL;
        break;
    case USE_BIO_1:
        *res = bio1;
        break;
    case USE_BIO_2:
        *res = bio2;
        break;
    }
}

static int test_ssl_set_bio(int idx)
{
    SSL_CTX *ctx = SSL_CTX_new(TLS_method());
    BIO *bio1 = NULL;
    BIO *bio2 = NULL;
    BIO *irbio = NULL, *iwbio = NULL, *nrbio = NULL, *nwbio = NULL;
    SSL *ssl = NULL;
    int initrbio, initwbio, newrbio, newwbio;
    int testresult = 0;

    if (ctx == NULL) {
        printf("Failed to allocate SSL_CTX\n");
        goto end;
    }

    ssl = SSL_new(ctx);
    if (ssl == NULL) {
        printf("Failed to allocate SSL object\n");
        goto end;
    }

    initrbio = idx % 3;
    idx /= 3;
    initwbio = idx % 3;
    idx /= 3;
    newrbio = idx % 3;
    idx /= 3;
    newwbio = idx;
    OPENSSL_assert(newwbio <= 2);

    if (initrbio == USE_BIO_1 || initwbio == USE_BIO_1 || newrbio == USE_BIO_1
            || newwbio == USE_BIO_1) {
        bio1 = BIO_new(BIO_s_mem());
        if (bio1 == NULL) {
            printf("Failed to allocate bio1\n");
            goto end;
        }
    }

    if (initrbio == USE_BIO_2 || initwbio == USE_BIO_2 || newrbio == USE_BIO_2
            || newwbio == USE_BIO_2) {
        bio2 = BIO_new(BIO_s_mem());
        if (bio2 == NULL) {
            printf("Failed to allocate bio2\n");
            goto end;
        }
    }

    setupbio(&irbio, bio1, bio2, initrbio);
    setupbio(&iwbio, bio1, bio2, initwbio);

    /*
     * We want to maintain our own refs to these BIO, so do an up ref for each
     * BIO that will have ownersip transferred in the SSL_set_bio() call
     */
    if (irbio != NULL)
        BIO_up_ref(irbio);
    if (iwbio != NULL && iwbio != irbio)
        BIO_up_ref(iwbio);

    SSL_set_bio(ssl, irbio, iwbio);

    setupbio(&nrbio, bio1, bio2, newrbio);
    setupbio(&nwbio, bio1, bio2, newwbio);

    /*
     * We will (maybe) transfer ownership again so do more up refs.
     * SSL_set_bio() has some really complicated ownership rules where BIOs have
     * already been set!
     */
    if (nrbio != NULL && nrbio != irbio && (nwbio != iwbio || nrbio != nwbio))
        BIO_up_ref(nrbio);
    if (nwbio != NULL && nwbio != nrbio && (nwbio != iwbio || (nwbio == iwbio && irbio == iwbio)))
        BIO_up_ref(nwbio);

    SSL_set_bio(ssl, nrbio, nwbio);

    testresult = 1;

 end:
    SSL_free(ssl);
    BIO_free(bio1);
    BIO_free(bio2);
    /*
     * This test is checking that the ref counting for SSL_set_bio is correct.
     * If we get here and we did too many frees then we will fail in the above
     * functions. If we haven't done enough then this will only be detected in
     * a crypto-mdebug build
     */
    SSL_CTX_free(ctx);

    return testresult;
}

typedef struct ssl_bio_test_fixture {
    const char *test_case_name;
    int pop_ssl;
    enum { NO_BIO_CHANGE, CHANGE_RBIO, CHANGE_WBIO } change_bio;
} SSL_BIO_TEST_FIXTURE;

static SSL_BIO_TEST_FIXTURE ssl_bio_set_up(const char *const test_case_name)
{
    SSL_BIO_TEST_FIXTURE fixture;

    fixture.test_case_name = test_case_name;
    fixture.pop_ssl = 0;

    return fixture;
}

static void ssl_bio_tear_down(SSL_BIO_TEST_FIXTURE fixture)
{
}

static int execute_test_ssl_bio(SSL_BIO_TEST_FIXTURE fix)
{
    BIO *sslbio = NULL, *membio1 = NULL, *membio2 = NULL;
    SSL_CTX *ctx = SSL_CTX_new(TLS_method());
    SSL *ssl = NULL;
    int testresult = 0;

    if (ctx == NULL) {
        printf("Failed to allocate SSL_CTX\n");
        return 0;
    }

    ssl = SSL_new(ctx);
    if (ssl == NULL) {
        printf("Failed to allocate SSL object\n");
        goto end;
    }

    sslbio = BIO_new(BIO_f_ssl());
    membio1 = BIO_new(BIO_s_mem());

    if (sslbio == NULL || membio1 == NULL) {
        printf("Malloc failure creating BIOs\n");
        goto end;
    }

    BIO_set_ssl(sslbio, ssl, BIO_CLOSE);

    /*
     * If anything goes wrong here then we could leak memory, so this will
     * be caught in a crypto-mdebug build
     */
    BIO_push(sslbio, membio1);

    /* Verify chaning the rbio/wbio directly does not cause leaks */
    if (fix.change_bio != NO_BIO_CHANGE) {
        membio2 = BIO_new(BIO_s_mem());
        if (membio2 == NULL) {
            printf("Malloc failure creating membio2\n");
            goto end;
        }
        if (fix.change_bio == CHANGE_RBIO)
            SSL_set0_rbio(ssl, membio2);
        else
            SSL_set0_wbio(ssl, membio2);
    }
    ssl = NULL;

    if (fix.pop_ssl)
        BIO_pop(sslbio);
    else
        BIO_pop(membio1);

    testresult = 1;
 end:
    BIO_free(membio1);
    BIO_free(sslbio);
    SSL_free(ssl);
    SSL_CTX_free(ctx);

    return testresult;
}

static int test_ssl_bio_pop_next_bio(void)
{
    SETUP_TEST_FIXTURE(SSL_BIO_TEST_FIXTURE, ssl_bio_set_up);

    EXECUTE_TEST(execute_test_ssl_bio, ssl_bio_tear_down);
}

static int test_ssl_bio_pop_ssl_bio(void)
{
    SETUP_TEST_FIXTURE(SSL_BIO_TEST_FIXTURE, ssl_bio_set_up);

    fixture.pop_ssl = 1;

    EXECUTE_TEST(execute_test_ssl_bio, ssl_bio_tear_down);
}

static int test_ssl_bio_change_rbio(void)
{
    SETUP_TEST_FIXTURE(SSL_BIO_TEST_FIXTURE, ssl_bio_set_up);

    fixture.change_bio = CHANGE_RBIO;

    EXECUTE_TEST(execute_test_ssl_bio, ssl_bio_tear_down);
}

static int test_ssl_bio_change_wbio(void)
{
    SETUP_TEST_FIXTURE(SSL_BIO_TEST_FIXTURE, ssl_bio_set_up);

    fixture.change_bio = CHANGE_WBIO;

    EXECUTE_TEST(execute_test_ssl_bio, ssl_bio_tear_down);
}

int main(int argc, char *argv[])
{
    BIO *err = NULL;
    int testresult = 1;

    if (argc != 3) {
        printf("Invalid argument count\n");
        return 1;
    }

    cert = argv[1];
    privkey = argv[2];

    err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);

    CRYPTO_set_mem_debug(1);
    CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);

    ADD_TEST(test_tlsext_status_type);
    ADD_TEST(test_session_with_only_int_cache);
    ADD_TEST(test_session_with_only_ext_cache);
    ADD_TEST(test_session_with_both_cache);
    ADD_ALL_TESTS(test_ssl_set_bio, TOTAL_SSL_SET_BIO_TESTS);
    ADD_TEST(test_ssl_bio_pop_next_bio);
    ADD_TEST(test_ssl_bio_pop_ssl_bio);
    ADD_TEST(test_ssl_bio_change_rbio);
    ADD_TEST(test_ssl_bio_change_wbio);

    testresult = run_tests(argv[0]);

#ifndef OPENSSL_NO_CRYPTO_MDEBUG
    if (CRYPTO_mem_leaks(err) <= 0)
        testresult = 1;
#endif
    BIO_free(err);

    if (!testresult)
        printf("PASS\n");

    return testresult;
}
Commit	Line	Data
2cb4b5f6 MC	1	/*
	2	* Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
	3	*
	4	* Licensed under the OpenSSL license (the "License"). You may not use
	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
	8	*/
	9
	10	#include <openssl/opensslconf.h>
	11	#include <openssl/bio.h>
	12	#include <openssl/crypto.h>
	13	#include <openssl/ssl.h>
	14
	15	#include "ssltestlib.h"
c887104f	16	#include "testutil.h"
2cb4b5f6 MC	17
	18	static char *cert = NULL;
	19	static char *privkey = NULL;
	20
	21	static int test_tlsext_status_type(void)
	22	{
	23	SSL_CTX *ctx = NULL;
	24	SSL *con = NULL;
	25	int testresult = 0;
	26
	27	/* Test tlsext_status_type */
	28	ctx = SSL_CTX_new(TLS_method());
	29
	30	if (SSL_CTX_get_tlsext_status_type(ctx) != -1) {
	31	printf("Unexpected initial value for "
	32	"SSL_CTX_get_tlsext_status_type()\n");
	33	goto end;
	34	}
	35
	36	con = SSL_new(ctx);
	37
	38	if (SSL_get_tlsext_status_type(con) != -1) {
	39	printf("Unexpected initial value for SSL_get_tlsext_status_type()\n");
	40	goto end;
	41	}
	42
	43	if (!SSL_set_tlsext_status_type(con, TLSEXT_STATUSTYPE_ocsp)) {
	44	printf("Unexpected fail for SSL_set_tlsext_status_type()\n");
	45	goto end;
	46	}
	47
	48	if (SSL_get_tlsext_status_type(con) != TLSEXT_STATUSTYPE_ocsp) {
	49	printf("Unexpected result for SSL_get_tlsext_status_type()\n");
	50	goto end;
	51	}
	52
	53	SSL_free(con);
	54	con = NULL;
	55
	56	if (!SSL_CTX_set_tlsext_status_type(ctx, TLSEXT_STATUSTYPE_ocsp)) {
	57	printf("Unexpected fail for SSL_CTX_set_tlsext_status_type()\n");
	58	goto end;
	59	}
	60
	61	if (SSL_CTX_get_tlsext_status_type(ctx) != TLSEXT_STATUSTYPE_ocsp) {
	62	printf("Unexpected result for SSL_CTX_get_tlsext_status_type()\n");
	63	goto end;
	64	}
	65
	66	con = SSL_new(ctx);
	67
	68	if (SSL_get_tlsext_status_type(con) != TLSEXT_STATUSTYPE_ocsp) {
	69	printf("Unexpected result for SSL_get_tlsext_status_type() (test 2)\n");
	70	goto end;
	71	}
	72
	73	testresult = 1;
	74
	75	end:
	76	SSL_free(con);
	77	SSL_CTX_free(ctx);
	78
	79	return testresult;
	80	}
81
eaa776da MC	82	typedef struct ssl_session_test_fixture {
	83	const char *test_case_name;
	84	int use_ext_cache;
	85	int use_int_cache;
	86	} SSL_SESSION_TEST_FIXTURE;
	87
	88	static int new_called = 0, remove_called = 0;
	89
	90	static SSL_SESSION_TEST_FIXTURE
	91	ssl_session_set_up(const char *const test_case_name)
	92	{
	93	SSL_SESSION_TEST_FIXTURE fixture;
	94
	95	fixture.test_case_name = test_case_name;
	96	fixture.use_ext_cache = 1;
	97	fixture.use_int_cache = 1;
	98
	99	new_called = remove_called = 0;
	100
	101	return fixture;
	102	}
	103
	104	static void ssl_session_tear_down(SSL_SESSION_TEST_FIXTURE fixture)
	105	{
	106	}
	107
	108	static int new_session_cb(SSL ssl, SSL_SESSION sess)
	109	{
	110	new_called++;
	111
	112	return 1;
	113	}
	114
	115	static void remove_session_cb(SSL_CTX ctx, SSL_SESSION sess)
	116	{
	117	remove_called++;
	118	}
	119
	120	static int execute_test_session(SSL_SESSION_TEST_FIXTURE fix)
2cb4b5f6 MC	121	{
	122	SSL_CTX sctx = NULL, cctx = NULL;
	123	SSL serverssl1 = NULL, clientssl1 = NULL;
	124	SSL serverssl2 = NULL, clientssl2 = NULL;
b4982125	125	#ifndef OPENSSL_NO_TLS1_1
eaa776da	126	SSL serverssl3 = NULL, clientssl3 = NULL;
b4982125	127	#endif
2cb4b5f6 MC	128	SSL_SESSION sess1 = NULL, sess2 = NULL;
	129	int testresult = 0;
	130
	131	if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), &sctx,
	132	&cctx, cert, privkey)) {
	133	printf("Unable to create SSL_CTX pair\n");
	134	return 0;
	135	}
	136
eaa776da MC	137	#ifndef OPENSSL_NO_TLS1_2
	138	/* Only allow TLS1.2 so we can force a connection failure later */
	139	SSL_CTX_set_min_proto_version(cctx, TLS1_2_VERSION);
	140	#endif
	141
	142	/* Set up session cache */
	143	if (fix.use_ext_cache) {
	144	SSL_CTX_sess_set_new_cb(cctx, new_session_cb);
	145	SSL_CTX_sess_set_remove_cb(cctx, remove_session_cb);
	146	}
	147	if (fix.use_int_cache) {
	148	/* Also covers instance where both are set */
	149	SSL_CTX_set_session_cache_mode(cctx, SSL_SESS_CACHE_CLIENT);
	150	} else {
	151	SSL_CTX_set_session_cache_mode(cctx,
	152	SSL_SESS_CACHE_CLIENT
	153	\| SSL_SESS_CACHE_NO_INTERNAL_STORE);
	154	}
2cb4b5f6	155
b4982125	156	if (!create_ssl_objects(sctx, cctx, &serverssl1, &clientssl1, NULL,
2cb4b5f6	157	NULL)) {
b4982125 MC	158	printf("Unable to create SSL objects\n");
	159	goto end;
	160	}
	161
	162	if (!create_ssl_connection(serverssl1, clientssl1)) {
2cb4b5f6 MC	163	printf("Unable to create SSL connection\n");
	164	goto end;
	165	}
2cb4b5f6 MC	166	sess1 = SSL_get1_session(clientssl1);
	167	if (sess1 == NULL) {
	168	printf("Unexpected NULL session\n");
	169	goto end;
	170	}
	171
eaa776da	172	if (fix.use_int_cache && SSL_CTX_add_session(cctx, sess1)) {
2cb4b5f6 MC	173	/* Should have failed because it should already be in the cache */
	174	printf("Unexpected success adding session to cache\n");
	175	goto end;
	176	}
	177
eaa776da MC	178	if (fix.use_ext_cache && (new_called != 1 \|\| remove_called != 0)) {
	179	printf("Session not added to cache\n");
	180	goto end;
	181	}
	182
b4982125 MC	183	if (!create_ssl_objects(sctx, cctx, &serverssl2, &clientssl2, NULL, NULL)) {
	184	printf("Unable to create second SSL objects\n");
	185	goto end;
	186	}
	187
	188	if (!create_ssl_connection(serverssl2, clientssl2)) {
2cb4b5f6 MC	189	printf("Unable to create second SSL connection\n");
	190	goto end;
	191	}
	192
	193	sess2 = SSL_get1_session(clientssl2);
	194	if (sess2 == NULL) {
	195	printf("Unexpected NULL session from clientssl2\n");
	196	goto end;
	197	}
	198
eaa776da MC	199	if (fix.use_ext_cache && (new_called != 2 \|\| remove_called != 0)) {
	200	printf("Remove session callback unexpectedly called\n");
	201	goto end;
	202	}
	203
2cb4b5f6 MC	204	/*
	205	* This should clear sess2 from the cache because it is a "bad" session. See
	206	* SSL_set_session() documentation.
	207	*/
	208	if (!SSL_set_session(clientssl2, sess1)) {
	209	printf("Unexpected failure setting session\n");
	210	goto end;
	211	}
	212
eaa776da MC	213	if (fix.use_ext_cache && (new_called != 2 \|\| remove_called != 1)) {
	214	printf("Failed to call callback to remove session\n");
	215	goto end;
	216	}
	217
	218
2cb4b5f6 MC	219	if (SSL_get_session(clientssl2) != sess1) {
	220	printf("Unexpected session found\n");
	221	goto end;
	222	}
	223
eaa776da MC	224	if (fix.use_int_cache) {
	225	if (!SSL_CTX_add_session(cctx, sess2)) {
	226	/*
	227	* Should have succeeded because it should not already be in the cache
	228	*/
	229	printf("Unexpected failure adding session to cache\n");
	230	goto end;
	231	}
	232
	233	if (!SSL_CTX_remove_session(cctx, sess2)) {
	234	printf("Unexpected failure removing session from cache\n");
	235	goto end;
	236	}
	237
	238	/* This is for the purposes of internal cache testing...ignore the
	239	* counter for external cache
2cb4b5f6	240	*/
eaa776da MC	241	if (fix.use_ext_cache)
	242	remove_called--;
	243	}
	244
	245	/* This shouldn't be in the cache so should fail */
	246	if (SSL_CTX_remove_session(cctx, sess2)) {
	247	printf("Unexpected success removing session from cache\n");
2cb4b5f6 MC	248	goto end;
	249	}
	250
eaa776da MC	251	if (fix.use_ext_cache && (new_called != 2 \|\| remove_called != 2)) {
eaa776da MC	252	printf("Failed to call callback to remove session #2\n");
2cb4b5f6 MC	253	goto end;
	254	}
	255
80f397e2	256	#if !defined(OPENSSL_NO_TLS1_1) && !defined(OPENSSL_NO_TLS1_2)
eaa776da MC	257	/* Force a connection failure */
eaa776da MC	258	SSL_CTX_set_max_proto_version(sctx, TLS1_1_VERSION);
b4982125 MC	259
	260	if (!create_ssl_objects(sctx, cctx, &serverssl3, &clientssl3, NULL, NULL)) {
	261	printf("Unable to create third SSL objects\n");
eaa776da MC	262	goto end;
eaa776da MC	263	}
b4982125	264
eaa776da MC	265	if (!SSL_set_session(clientssl3, sess1)) {
	266	printf("Unable to set session for third connection\n");
	267	goto end;
	268	}
	269
	270	/* This should fail because of the mismatched protocol versions */
b4982125 MC	271	if (create_ssl_connection(serverssl3, clientssl3)) {
b4982125 MC	272	printf("Unable to create third SSL connection\n");
eaa776da MC	273	goto end;
	274	}
	275
b4982125	276
eaa776da MC	277	/* We should have automatically removed the session from the cache */
	278	if (fix.use_ext_cache && (new_called != 2 \|\| remove_called != 3)) {
	279	printf("Failed to call callback to remove session #2\n");
2cb4b5f6 MC	280	goto end;
	281	}
	282
eaa776da MC	283	if (fix.use_int_cache && !SSL_CTX_add_session(cctx, sess2)) {
	284	/*
	285	* Should have succeeded because it should not already be in the cache
	286	*/
	287	printf("Unexpected failure adding session to cache #2\n");
	288	goto end;
	289	}
	290	#endif
	291
2cb4b5f6	292	testresult = 1;
eaa776da	293
2cb4b5f6 MC	294	end:
	295	SSL_free(serverssl1);
	296	SSL_free(clientssl1);
	297	SSL_free(serverssl2);
	298	SSL_free(clientssl2);
b4982125	299	#ifndef OPENSSL_NO_TLS1_1
eaa776da MC	300	SSL_free(serverssl3);
eaa776da MC	301	SSL_free(clientssl3);
b4982125	302	#endif
2cb4b5f6 MC	303	SSL_SESSION_free(sess1);
2cb4b5f6 MC	304	SSL_SESSION_free(sess2);
eaa776da MC	305	/*
	306	* Check if we need to remove any sessions up-refed for the external cache
	307	*/
	308	if (new_called >= 1)
	309	SSL_SESSION_free(sess1);
	310	if (new_called >= 2)
	311	SSL_SESSION_free(sess2);
2cb4b5f6 MC	312	SSL_CTX_free(sctx);
	313	SSL_CTX_free(cctx);
	314
	315	return testresult;
	316	}
	317
7fb4c820 MC	318	static int test_session_with_only_int_cache(void)
7fb4c820 MC	319	{
eaa776da MC	320	SETUP_TEST_FIXTURE(SSL_SESSION_TEST_FIXTURE, ssl_session_set_up);
	321
	322	fixture.use_ext_cache = 0;
	323
	324	EXECUTE_TEST(execute_test_session, ssl_session_tear_down);
	325	}
	326
7fb4c820 MC	327	static int test_session_with_only_ext_cache(void)
7fb4c820 MC	328	{
eaa776da MC	329	SETUP_TEST_FIXTURE(SSL_SESSION_TEST_FIXTURE, ssl_session_set_up);
	330
	331	fixture.use_int_cache = 0;
	332
	333	EXECUTE_TEST(execute_test_session, ssl_session_tear_down);
	334	}
	335
7fb4c820 MC	336	static int test_session_with_both_cache(void)
7fb4c820 MC	337	{
eaa776da MC	338	SETUP_TEST_FIXTURE(SSL_SESSION_TEST_FIXTURE, ssl_session_set_up);
	339
	340	EXECUTE_TEST(execute_test_session, ssl_session_tear_down);
	341	}
	342
7fb4c820 MC	343	#define USE_NULL 0
	344	#define USE_BIO_1 1
	345	#define USE_BIO_2 2
	346
	347	#define TOTAL_SSL_SET_BIO_TESTS (3 * 3 * 3 * 3)
	348
	349	static void setupbio(BIO *res, BIO bio1, BIO *bio2, int type)
	350	{
	351	switch (type) {
	352	case USE_NULL:
	353	*res = NULL;
	354	break;
	355	case USE_BIO_1:
	356	*res = bio1;
	357	break;
	358	case USE_BIO_2:
	359	*res = bio2;
	360	break;
	361	}
	362	}
	363
	364	static int test_ssl_set_bio(int idx)
	365	{
	366	SSL_CTX *ctx = SSL_CTX_new(TLS_method());
	367	BIO *bio1 = NULL;
	368	BIO *bio2 = NULL;
0fae8150	369	BIO irbio = NULL, iwbio = NULL, nrbio = NULL, nwbio = NULL;
7fb4c820 MC	370	SSL *ssl = NULL;
	371	int initrbio, initwbio, newrbio, newwbio;
	372	int testresult = 0;
	373
	374	if (ctx == NULL) {
	375	printf("Failed to allocate SSL_CTX\n");
	376	goto end;
	377	}
	378
	379	ssl = SSL_new(ctx);
	380	if (ssl == NULL) {
	381	printf("Failed to allocate SSL object\n");
	382	goto end;
	383	}
	384
	385	initrbio = idx % 3;
	386	idx /= 3;
	387	initwbio = idx % 3;
	388	idx /= 3;
	389	newrbio = idx % 3;
	390	idx /= 3;
	391	newwbio = idx;
	392	OPENSSL_assert(newwbio <= 2);
	393
	394	if (initrbio == USE_BIO_1 \|\| initwbio == USE_BIO_1 \|\| newrbio == USE_BIO_1
	395	\|\| newwbio == USE_BIO_1) {
	396	bio1 = BIO_new(BIO_s_mem());
	397	if (bio1 == NULL) {
	398	printf("Failed to allocate bio1\n");
	399	goto end;
	400	}
	401	}
	402
	403	if (initrbio == USE_BIO_2 \|\| initwbio == USE_BIO_2 \|\| newrbio == USE_BIO_2
	404	\|\| newwbio == USE_BIO_2) {
	405	bio2 = BIO_new(BIO_s_mem());
	406	if (bio2 == NULL) {
	407	printf("Failed to allocate bio2\n");
	408	goto end;
	409	}
	410	}
	411
	412	setupbio(&irbio, bio1, bio2, initrbio);
	413	setupbio(&iwbio, bio1, bio2, initwbio);
	414
	415	/*
	416	* We want to maintain our own refs to these BIO, so do an up ref for each
	417	* BIO that will have ownersip transferred in the SSL_set_bio() call
	418	*/
	419	if (irbio != NULL)
	420	BIO_up_ref(irbio);
	421	if (iwbio != NULL && iwbio != irbio)
	422	BIO_up_ref(iwbio);
	423
	424	SSL_set_bio(ssl, irbio, iwbio);
	425
	426	setupbio(&nrbio, bio1, bio2, newrbio);
	427	setupbio(&nwbio, bio1, bio2, newwbio);
	428
	429	/*
	430	* We will (maybe) transfer ownership again so do more up refs.
	431	* SSL_set_bio() has some really complicated ownership rules where BIOs have
	432	* already been set!
	433	*/
434	if (nrbio != NULL && nrbio != irbio && (nwbio != iwbio \|\| nrbio != nwbio))
435	BIO_up_ref(nrbio);
436	if (nwbio != NULL && nwbio != nrbio && (nwbio != iwbio \|\| (nwbio == iwbio && irbio == iwbio)))
437	BIO_up_ref(nwbio);
438
439	SSL_set_bio(ssl, nrbio, nwbio);
440
441	testresult = 1;
442
443	end:
444	SSL_free(ssl);
445	BIO_free(bio1);
446	BIO_free(bio2);
447	/*
448	* This test is checking that the ref counting for SSL_set_bio is correct.
449	* If we get here and we did too many frees then we will fail in the above
450	* functions. If we haven't done enough then this will only be detected in
451	* a crypto-mdebug build
452	*/
453	SSL_CTX_free(ctx);
454
455	return testresult;
456	}
457
9a716987 MC	458	typedef struct ssl_bio_test_fixture {
	459	const char *test_case_name;
	460	int pop_ssl;
	461	enum { NO_BIO_CHANGE, CHANGE_RBIO, CHANGE_WBIO } change_bio;
	462	} SSL_BIO_TEST_FIXTURE;
	463
	464	static SSL_BIO_TEST_FIXTURE ssl_bio_set_up(const char *const test_case_name)
	465	{
	466	SSL_BIO_TEST_FIXTURE fixture;
	467
	468	fixture.test_case_name = test_case_name;
	469	fixture.pop_ssl = 0;
	470
	471	return fixture;
	472	}
	473
	474	static void ssl_bio_tear_down(SSL_BIO_TEST_FIXTURE fixture)
	475	{
	476	}
	477
	478	static int execute_test_ssl_bio(SSL_BIO_TEST_FIXTURE fix)
	479	{
	480	BIO sslbio = NULL, membio1 = NULL, *membio2 = NULL;
	481	SSL_CTX *ctx = SSL_CTX_new(TLS_method());
	482	SSL *ssl = NULL;
	483	int testresult = 0;
	484
	485	if (ctx == NULL) {
	486	printf("Failed to allocate SSL_CTX\n");
	487	return 0;
	488	}
	489
	490	ssl = SSL_new(ctx);
	491	if (ssl == NULL) {
	492	printf("Failed to allocate SSL object\n");
	493	goto end;
	494	}
	495
	496	sslbio = BIO_new(BIO_f_ssl());
	497	membio1 = BIO_new(BIO_s_mem());
	498
	499	if (sslbio == NULL \|\| membio1 == NULL) {
	500	printf("Malloc failure creating BIOs\n");
	501	goto end;
	502	}
	503
	504	BIO_set_ssl(sslbio, ssl, BIO_CLOSE);
	505
	506	/*
	507	* If anything goes wrong here then we could leak memory, so this will
	508	* be caught in a crypto-mdebug build
	509	*/
	510	BIO_push(sslbio, membio1);
	511
	512	/* Verify chaning the rbio/wbio directly does not cause leaks */
	513	if (fix.change_bio != NO_BIO_CHANGE) {
	514	membio2 = BIO_new(BIO_s_mem());
	515	if (membio2 == NULL) {
	516	printf("Malloc failure creating membio2\n");
	517	goto end;
	518	}
	519	if (fix.change_bio == CHANGE_RBIO)
65e2d672	520	SSL_set0_rbio(ssl, membio2);
9a716987	521	else
65e2d672	522	SSL_set0_wbio(ssl, membio2);
9a716987 MC	523	}
	524	ssl = NULL;
	525
	526	if (fix.pop_ssl)
	527	BIO_pop(sslbio);
	528	else
	529	BIO_pop(membio1);
	530
	531	testresult = 1;
	532	end:
	533	BIO_free(membio1);
	534	BIO_free(sslbio);
	535	SSL_free(ssl);
	536	SSL_CTX_free(ctx);
	537
	538	return testresult;
	539	}
	540
	541	static int test_ssl_bio_pop_next_bio(void)
	542	{
	543	SETUP_TEST_FIXTURE(SSL_BIO_TEST_FIXTURE, ssl_bio_set_up);
	544
	545	EXECUTE_TEST(execute_test_ssl_bio, ssl_bio_tear_down);
	546	}
	547
	548	static int test_ssl_bio_pop_ssl_bio(void)
	549	{
	550	SETUP_TEST_FIXTURE(SSL_BIO_TEST_FIXTURE, ssl_bio_set_up);
	551
	552	fixture.pop_ssl = 1;
	553
	554	EXECUTE_TEST(execute_test_ssl_bio, ssl_bio_tear_down);
	555	}
	556
	557	static int test_ssl_bio_change_rbio(void)
	558	{
	559	SETUP_TEST_FIXTURE(SSL_BIO_TEST_FIXTURE, ssl_bio_set_up);
	560
	561	fixture.change_bio = CHANGE_RBIO;
	562
	563	EXECUTE_TEST(execute_test_ssl_bio, ssl_bio_tear_down);
	564	}
	565
	566	static int test_ssl_bio_change_wbio(void)
	567	{
	568	SETUP_TEST_FIXTURE(SSL_BIO_TEST_FIXTURE, ssl_bio_set_up);
	569
	570	fixture.change_bio = CHANGE_WBIO;
	571
	572	EXECUTE_TEST(execute_test_ssl_bio, ssl_bio_tear_down);
	573	}
	574
2cb4b5f6 MC	575	int main(int argc, char *argv[])
2cb4b5f6 MC	576	{
c887104f MC	577	BIO *err = NULL;
c887104f MC	578	int testresult = 1;
2cb4b5f6 MC	579
	580	if (argc != 3) {
	581	printf("Invalid argument count\n");
c887104f	582	return 1;
2cb4b5f6 MC	583	}
	584
	585	cert = argv[1];
	586	privkey = argv[2];
	587
	588	err = BIO_new_fp(stderr, BIO_NOCLOSE \| BIO_FP_TEXT);
	589
	590	CRYPTO_set_mem_debug(1);
	591	CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
	592
c887104f	593	ADD_TEST(test_tlsext_status_type);
eaa776da MC	594	ADD_TEST(test_session_with_only_int_cache);
	595	ADD_TEST(test_session_with_only_ext_cache);
	596	ADD_TEST(test_session_with_both_cache);
7fb4c820	597	ADD_ALL_TESTS(test_ssl_set_bio, TOTAL_SSL_SET_BIO_TESTS);
9a716987 MC	598	ADD_TEST(test_ssl_bio_pop_next_bio);
	599	ADD_TEST(test_ssl_bio_pop_ssl_bio);
	600	ADD_TEST(test_ssl_bio_change_rbio);
	601	ADD_TEST(test_ssl_bio_change_wbio);
2cb4b5f6	602
c887104f	603	testresult = run_tests(argv[0]);
2cb4b5f6 MC	604
	605	#ifndef OPENSSL_NO_CRYPTO_MDEBUG
	606	if (CRYPTO_mem_leaks(err) <= 0)
c887104f	607	testresult = 1;
2cb4b5f6 MC	608	#endif
	609	BIO_free(err);
	610
c887104f	611	if (!testresult)
2cb4b5f6 MC	612	printf("PASS\n");
2cb4b5f6 MC	613
c887104f	614	return testresult;
2cb4b5f6	615	}