test/dtls_mtu_test.c

   1 /*
   2  * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include <string.h>
  12
  13 #include <openssl/dtls1.h>
  14 #include <openssl/ssl.h>
  15 #include <openssl/err.h>
  16
  17 #include "helpers/ssltestlib.h"
  18 #include "testutil.h"
  19
  20 /* for SSL_READ_ETM() */
  21 #include "../ssl/ssl_local.h"
  22
  23 static int debug = 0;
  24
  25 static unsigned int clnt_psk_callback(SSL *ssl, const char *hint,
  26                                       char *ident, unsigned int max_ident_len,
  27                                       unsigned char *psk,
  28                                       unsigned int max_psk_len)
  29 {
  30     BIO_snprintf(ident, max_ident_len, "psk");
  31
  32     if (max_psk_len > 20)
  33         max_psk_len = 20;
  34     memset(psk, 0x5a, max_psk_len);
  35
  36     return max_psk_len;
  37 }
  38
  39 static unsigned int srvr_psk_callback(SSL *ssl, const char *identity,
  40                                       unsigned char *psk,
  41                                       unsigned int max_psk_len)
  42 {
  43     if (max_psk_len > 20)
  44         max_psk_len = 20;
  45     memset(psk, 0x5a, max_psk_len);
  46     return max_psk_len;
  47 }
  48
  49 static int mtu_test(SSL_CTX *ctx, const char *cs, int no_etm)
  50 {
  51     SSL *srvr_ssl = NULL, *clnt_ssl = NULL;
  52     BIO *sc_bio = NULL;
  53     int i;
  54     size_t s;
  55     size_t mtus[30];
  56     unsigned char buf[600];
  57     int rv = 0;
  58     SSL_CONNECTION *clnt_sc;
  59
  60     memset(buf, 0x5a, sizeof(buf));
  61
  62     if (!TEST_true(create_ssl_objects(ctx, ctx, &srvr_ssl, &clnt_ssl,
  63                                       NULL, NULL)))
  64         goto end;
  65
  66     if (no_etm)
  67         SSL_set_options(srvr_ssl, SSL_OP_NO_ENCRYPT_THEN_MAC);
  68
  69     if (!TEST_true(SSL_set_cipher_list(srvr_ssl, cs))
  70             || !TEST_true(SSL_set_cipher_list(clnt_ssl, cs))
  71             || !TEST_ptr(sc_bio = SSL_get_rbio(srvr_ssl))
  72             || !TEST_true(create_ssl_connection(clnt_ssl, srvr_ssl,
  73                                                 SSL_ERROR_NONE)))
  74         goto end;
  75
  76     if (debug)
  77         TEST_info("Channel established");
  78
  79     /* For record MTU values between 500 and 539, call DTLS_get_data_mtu()
  80      * to query the payload MTU which will fit. */
  81     for (i = 0; i < 30; i++) {
  82         SSL_set_mtu(clnt_ssl, 500 + i);
  83         mtus[i] = DTLS_get_data_mtu(clnt_ssl);
  84         if (debug)
  85             TEST_info("%s%s MTU for record mtu %d = %lu",
  86                       cs, no_etm ? "-noEtM" : "",
  87                       500 + i, (unsigned long)mtus[i]);
  88         if (!TEST_size_t_ne(mtus[i], 0)) {
  89             TEST_info("Cipher %s MTU %d", cs, 500 + i);
  90             goto end;
  91         }
  92     }
  93
  94     /* Now get out of the way */
  95     SSL_set_mtu(clnt_ssl, 1000);
  96
  97     /*
  98      * Now for all values in the range of payload MTUs, send a payload of
  99      * that size and see what actual record size we end up with.
 100      */
 101     for (s = mtus[0]; s <= mtus[29]; s++) {
 102         size_t reclen;
 103
 104         if (!TEST_int_eq(SSL_write(clnt_ssl, buf, s), (int)s))
 105             goto end;
 106         reclen = BIO_read(sc_bio, buf, sizeof(buf));
 107         if (debug)
 108             TEST_info("record %zu for payload %zu", reclen, s);
 109
 110         for (i = 0; i < 30; i++) {
 111             /* DTLS_get_data_mtu() with record MTU 500+i returned mtus[i] ... */
 112
 113             if (!TEST_false(s <= mtus[i] && reclen > (size_t)(500 + i))) {
 114                 /*
 115                  * We sent a packet smaller than or equal to mtus[j] and
 116                  * that made a record *larger* than the record MTU 500+j!
 117                  */
 118                 TEST_error("%s: s=%lu, mtus[i]=%lu, reclen=%lu, i=%d",
 119                            cs, (unsigned long)s, (unsigned long)mtus[i],
 120                            (unsigned long)reclen, 500 + i);
 121                 goto end;
 122             }
 123             if (!TEST_false(s > mtus[i] && reclen <= (size_t)(500 + i))) {
 124                 /*
 125                  * We sent a *larger* packet than mtus[i] and that *still*
 126                  * fits within the record MTU 500+i, so DTLS_get_data_mtu()
 127                  * was overly pessimistic.
 128                  */
 129                 TEST_error("%s: s=%lu, mtus[i]=%lu, reclen=%lu, i=%d",
 130                            cs, (unsigned long)s, (unsigned long)mtus[i],
 131                            (unsigned long)reclen, 500 + i);
 132                 goto end;
 133             }
 134         }
 135     }
 136     if (!TEST_ptr(clnt_sc = SSL_CONNECTION_FROM_SSL_ONLY(clnt_ssl)))
 137         goto end;
 138     rv = 1;
 139     if (SSL_READ_ETM(clnt_sc))
 140         rv = 2;
 141  end:
 142     SSL_free(clnt_ssl);
 143     SSL_free(srvr_ssl);
 144     return rv;
 145 }
 146
 147 static int run_mtu_tests(void)
 148 {
 149     SSL_CTX *ctx = NULL;
 150     STACK_OF(SSL_CIPHER) *ciphers;
 151     int i, ret = 0;
 152
 153     if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_method())))
 154         goto end;
 155
 156     SSL_CTX_set_psk_server_callback(ctx, srvr_psk_callback);
 157     SSL_CTX_set_psk_client_callback(ctx, clnt_psk_callback);
 158     SSL_CTX_set_security_level(ctx, 0);
 159
 160     /*
 161      * We only care about iterating over each enc/mac; we don't want to
 162      * repeat the test for each auth/kx variant. So keep life simple and
 163      * only do (non-DH) PSK.
 164      */
 165     if (!TEST_true(SSL_CTX_set_cipher_list(ctx, "PSK")))
 166         goto end;
 167
 168     ciphers = SSL_CTX_get_ciphers(ctx);
 169     for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
 170         const SSL_CIPHER *cipher = sk_SSL_CIPHER_value(ciphers, i);
 171         const char *cipher_name = SSL_CIPHER_get_name(cipher);
 172
 173         /* As noted above, only one test for each enc/mac variant. */
 174         if (!HAS_PREFIX(cipher_name, "PSK-"))
 175             continue;
 176
 177         if (!TEST_int_gt(ret = mtu_test(ctx, cipher_name, 0), 0))
 178             break;
 179         TEST_info("%s OK", cipher_name);
 180         if (ret == 1)
 181             continue;
 182
 183         /* mtu_test() returns 2 if it used Encrypt-then-MAC */
 184         if (!TEST_int_gt(ret = mtu_test(ctx, cipher_name, 1), 0))
 185             break;
 186         TEST_info("%s without EtM OK", cipher_name);
 187     }
 188
 189  end:
 190     SSL_CTX_free(ctx);
 191     return ret;
 192 }
 193
 194 static int test_server_mtu_larger_than_max_fragment_length(void)
 195 {
 196     SSL_CTX *ctx = NULL;
 197     SSL *srvr_ssl = NULL, *clnt_ssl = NULL;
 198     int rv = 0;
 199
 200     if (!TEST_ptr(ctx = SSL_CTX_new(DTLS_method())))
 201         goto end;
 202
 203     SSL_CTX_set_psk_server_callback(ctx, srvr_psk_callback);
 204     SSL_CTX_set_psk_client_callback(ctx, clnt_psk_callback);
 205
 206 #ifndef OPENSSL_NO_DH
 207     if (!TEST_true(SSL_CTX_set_dh_auto(ctx, 1)))
 208         goto end;
 209 #endif
 210
 211     if (!TEST_true(create_ssl_objects(ctx, ctx, &srvr_ssl, &clnt_ssl,
 212                                       NULL, NULL)))
 213         goto end;
 214
 215     SSL_set_options(srvr_ssl, SSL_OP_NO_QUERY_MTU);
 216     if (!TEST_true(DTLS_set_link_mtu(srvr_ssl, 1500)))
 217         goto end;
 218
 219     SSL_set_tlsext_max_fragment_length(clnt_ssl,
 220                                        TLSEXT_max_fragment_length_512);
 221
 222     if (!TEST_true(create_ssl_connection(srvr_ssl, clnt_ssl,
 223                                          SSL_ERROR_NONE)))
 224         goto end;
 225
 226     rv = 1;
 227
 228  end:
 229     SSL_free(clnt_ssl);
 230     SSL_free(srvr_ssl);
 231     SSL_CTX_free(ctx);
 232     return rv;
 233 }
 234
 235 int setup_tests(void)
 236 {
 237     ADD_TEST(run_mtu_tests);
 238     ADD_TEST(test_server_mtu_larger_than_max_fragment_length);
 239     return 1;
 240 }
 241
 242 void cleanup_tests(void)
 243 {
 244     bio_s_mempacket_test_free();
 245 }