2 * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #if !defined(__STDC_FORMAT_MACROS)
11 #define __STDC_FORMAT_MACROS
14 #include "packeted_bio.h"
15 #include <openssl/e_os2.h>
17 #if !defined(OPENSSL_SYS_WINDOWS)
18 #include <arpa/inet.h>
19 #include <netinet/in.h>
20 #include <netinet/tcp.h>
22 #include <sys/socket.h>
27 OPENSSL_MSVC_PRAGMA(warning(push
, 3))
30 OPENSSL_MSVC_PRAGMA(warning(pop
))
32 OPENSSL_MSVC_PRAGMA(comment(lib
, "Ws2_32.lib"))
39 #include <openssl/bio.h>
40 #include <openssl/buffer.h>
41 #include <openssl/bn.h>
42 #include <openssl/core_names.h>
43 #include <openssl/crypto.h>
44 #include <openssl/dh.h>
45 #include <openssl/err.h>
46 #include <openssl/evp.h>
47 #include <openssl/hmac.h>
48 #include <openssl/objects.h>
49 #include <openssl/rand.h>
50 #include <openssl/ssl.h>
51 #include <openssl/x509.h>
57 #include "async_bio.h"
58 #include "test_config.h"
62 #if !defined(OPENSSL_SYS_WINDOWS)
63 static int closesocket(int sock
) {
67 static void PrintSocketError(const char *func
) {
71 static void PrintSocketError(const char *func
) {
72 fprintf(stderr
, "%s: %d\n", func
, WSAGetLastError());
76 static int Usage(const char *program
) {
77 fprintf(stderr
, "Usage: %s [flags...]\n", program
);
82 // async_bio is async BIO which pauses reads and writes.
83 BIO
*async_bio
= nullptr;
84 // packeted_bio is the packeted BIO which simulates read timeouts.
85 BIO
*packeted_bio
= nullptr;
86 bool cert_ready
= false;
87 bool handshake_done
= false;
88 // private_key is the underlying private key used when testing custom keys.
89 bssl::UniquePtr
<EVP_PKEY
> private_key
;
90 bool got_new_session
= false;
91 bssl::UniquePtr
<SSL_SESSION
> new_session
;
92 bool ticket_decrypt_done
= false;
93 bool alpn_select_done
= false;
96 static void TestStateExFree(void *parent
, void *ptr
, CRYPTO_EX_DATA
*ad
,
97 int index
, long argl
, void *argp
) {
98 delete ((TestState
*)ptr
);
101 static int g_config_index
= 0;
102 static int g_state_index
= 0;
104 static bool SetTestConfig(SSL
*ssl
, const TestConfig
*config
) {
105 return SSL_set_ex_data(ssl
, g_config_index
, (void *)config
) == 1;
108 static const TestConfig
*GetTestConfig(const SSL
*ssl
) {
109 return (const TestConfig
*)SSL_get_ex_data(ssl
, g_config_index
);
112 static bool SetTestState(SSL
*ssl
, std::unique_ptr
<TestState
> state
) {
113 // |SSL_set_ex_data| takes ownership of |state| only on success.
114 if (SSL_set_ex_data(ssl
, g_state_index
, state
.get()) == 1) {
121 static TestState
*GetTestState(const SSL
*ssl
) {
122 return (TestState
*)SSL_get_ex_data(ssl
, g_state_index
);
125 static bssl::UniquePtr
<X509
> LoadCertificate(const std::string
&file
) {
126 bssl::UniquePtr
<BIO
> bio(BIO_new(BIO_s_file()));
127 if (!bio
|| !BIO_read_filename(bio
.get(), file
.c_str())) {
130 return bssl::UniquePtr
<X509
>(PEM_read_bio_X509(bio
.get(), NULL
, NULL
, NULL
));
133 static bssl::UniquePtr
<EVP_PKEY
> LoadPrivateKey(const std::string
&file
) {
134 bssl::UniquePtr
<BIO
> bio(BIO_new(BIO_s_file()));
135 if (!bio
|| !BIO_read_filename(bio
.get(), file
.c_str())) {
138 return bssl::UniquePtr
<EVP_PKEY
>(
139 PEM_read_bio_PrivateKey(bio
.get(), NULL
, NULL
, NULL
));
144 void operator()(T
*buf
) {
149 static bool GetCertificate(SSL
*ssl
, bssl::UniquePtr
<X509
> *out_x509
,
150 bssl::UniquePtr
<EVP_PKEY
> *out_pkey
) {
151 const TestConfig
*config
= GetTestConfig(ssl
);
153 if (!config
->key_file
.empty()) {
154 *out_pkey
= LoadPrivateKey(config
->key_file
.c_str());
159 if (!config
->cert_file
.empty()) {
160 *out_x509
= LoadCertificate(config
->cert_file
.c_str());
168 static bool InstallCertificate(SSL
*ssl
) {
169 bssl::UniquePtr
<X509
> x509
;
170 bssl::UniquePtr
<EVP_PKEY
> pkey
;
171 if (!GetCertificate(ssl
, &x509
, &pkey
)) {
175 if (pkey
&& !SSL_use_PrivateKey(ssl
, pkey
.get())) {
179 if (x509
&& !SSL_use_certificate(ssl
, x509
.get())) {
186 static int ClientCertCallback(SSL
*ssl
, X509
**out_x509
, EVP_PKEY
**out_pkey
) {
187 if (GetTestConfig(ssl
)->async
&& !GetTestState(ssl
)->cert_ready
) {
191 bssl::UniquePtr
<X509
> x509
;
192 bssl::UniquePtr
<EVP_PKEY
> pkey
;
193 if (!GetCertificate(ssl
, &x509
, &pkey
)) {
197 // Return zero for no certificate.
202 // Asynchronous private keys are not supported with client_cert_cb.
203 *out_x509
= x509
.release();
204 *out_pkey
= pkey
.release();
208 static int VerifySucceed(X509_STORE_CTX
*store_ctx
, void *arg
) {
212 static int VerifyFail(X509_STORE_CTX
*store_ctx
, void *arg
) {
213 X509_STORE_CTX_set_error(store_ctx
, X509_V_ERR_APPLICATION_VERIFICATION
);
217 static int NextProtosAdvertisedCallback(SSL
*ssl
, const uint8_t **out
,
218 unsigned int *out_len
, void *arg
) {
219 const TestConfig
*config
= GetTestConfig(ssl
);
220 if (config
->advertise_npn
.empty()) {
221 return SSL_TLSEXT_ERR_NOACK
;
224 *out
= (const uint8_t*)config
->advertise_npn
.data();
225 *out_len
= config
->advertise_npn
.size();
226 return SSL_TLSEXT_ERR_OK
;
229 static int NextProtoSelectCallback(SSL
* ssl
, uint8_t** out
, uint8_t* outlen
,
230 const uint8_t* in
, unsigned inlen
, void* arg
) {
231 const TestConfig
*config
= GetTestConfig(ssl
);
232 if (config
->select_next_proto
.empty()) {
233 return SSL_TLSEXT_ERR_NOACK
;
236 *out
= (uint8_t*)config
->select_next_proto
.data();
237 *outlen
= config
->select_next_proto
.size();
238 return SSL_TLSEXT_ERR_OK
;
241 static int AlpnSelectCallback(SSL
* ssl
, const uint8_t** out
, uint8_t* outlen
,
242 const uint8_t* in
, unsigned inlen
, void* arg
) {
243 if (GetTestState(ssl
)->alpn_select_done
) {
244 fprintf(stderr
, "AlpnSelectCallback called after completion.\n");
248 GetTestState(ssl
)->alpn_select_done
= true;
250 const TestConfig
*config
= GetTestConfig(ssl
);
251 if (config
->decline_alpn
) {
252 return SSL_TLSEXT_ERR_NOACK
;
255 if (!config
->expected_advertised_alpn
.empty() &&
256 (config
->expected_advertised_alpn
.size() != inlen
||
257 memcmp(config
->expected_advertised_alpn
.data(),
259 fprintf(stderr
, "bad ALPN select callback inputs\n");
263 *out
= (const uint8_t*)config
->select_alpn
.data();
264 *outlen
= config
->select_alpn
.size();
265 return SSL_TLSEXT_ERR_OK
;
268 static unsigned PskClientCallback(SSL
*ssl
, const char *hint
,
270 unsigned max_identity_len
,
271 uint8_t *out_psk
, unsigned max_psk_len
) {
272 const TestConfig
*config
= GetTestConfig(ssl
);
274 if (config
->psk_identity
.empty()) {
275 if (hint
!= nullptr) {
276 fprintf(stderr
, "Server PSK hint was non-null.\n");
279 } else if (hint
== nullptr ||
280 strcmp(hint
, config
->psk_identity
.c_str()) != 0) {
281 fprintf(stderr
, "Server PSK hint did not match.\n");
285 // Account for the trailing '\0' for the identity.
286 if (config
->psk_identity
.size() >= max_identity_len
||
287 config
->psk
.size() > max_psk_len
) {
288 fprintf(stderr
, "PSK buffers too small\n");
292 OPENSSL_strlcpy(out_identity
, config
->psk_identity
.c_str(),
294 memcpy(out_psk
, config
->psk
.data(), config
->psk
.size());
295 return config
->psk
.size();
298 static unsigned PskServerCallback(SSL
*ssl
, const char *identity
,
299 uint8_t *out_psk
, unsigned max_psk_len
) {
300 const TestConfig
*config
= GetTestConfig(ssl
);
302 if (strcmp(identity
, config
->psk_identity
.c_str()) != 0) {
303 fprintf(stderr
, "Client PSK identity did not match.\n");
307 if (config
->psk
.size() > max_psk_len
) {
308 fprintf(stderr
, "PSK buffers too small\n");
312 memcpy(out_psk
, config
->psk
.data(), config
->psk
.size());
313 return config
->psk
.size();
316 static int CertCallback(SSL
*ssl
, void *arg
) {
317 const TestConfig
*config
= GetTestConfig(ssl
);
319 // Check the CertificateRequest metadata is as expected.
321 // TODO(davidben): Test |SSL_get_client_CA_list|.
322 if (!SSL_is_server(ssl
) &&
323 !config
->expected_certificate_types
.empty()) {
324 const uint8_t *certificate_types
;
325 size_t certificate_types_len
=
326 SSL_get0_certificate_types(ssl
, &certificate_types
);
327 if (certificate_types_len
!= config
->expected_certificate_types
.size() ||
328 memcmp(certificate_types
,
329 config
->expected_certificate_types
.data(),
330 certificate_types_len
) != 0) {
331 fprintf(stderr
, "certificate types mismatch\n");
336 // The certificate will be installed via other means.
337 if (!config
->async
||
338 config
->use_old_client_cert_callback
) {
342 if (!GetTestState(ssl
)->cert_ready
) {
345 if (!InstallCertificate(ssl
)) {
351 static void InfoCallback(const SSL
*ssl
, int type
, int val
) {
352 if (type
== SSL_CB_HANDSHAKE_DONE
) {
353 if (GetTestConfig(ssl
)->handshake_never_done
) {
354 fprintf(stderr
, "Handshake unexpectedly completed.\n");
355 // Abort before any expected error code is printed, to ensure the overall
359 GetTestState(ssl
)->handshake_done
= true;
361 // Callbacks may be called again on a new handshake.
362 GetTestState(ssl
)->ticket_decrypt_done
= false;
363 GetTestState(ssl
)->alpn_select_done
= false;
367 static int NewSessionCallback(SSL
*ssl
, SSL_SESSION
*session
) {
368 GetTestState(ssl
)->got_new_session
= true;
369 GetTestState(ssl
)->new_session
.reset(session
);
373 static int TicketKeyCallback(SSL
*ssl
, uint8_t *key_name
, uint8_t *iv
,
374 EVP_CIPHER_CTX
*ctx
, EVP_MAC_CTX
*hmac_ctx
,
376 OSSL_PARAM params
[2], *p
= params
;
379 if (GetTestState(ssl
)->ticket_decrypt_done
) {
380 fprintf(stderr
, "TicketKeyCallback called after completion.\n");
384 GetTestState(ssl
)->ticket_decrypt_done
= true;
387 // This is just test code, so use the all-zeros key.
388 static const uint8_t kZeros
[16] = {0};
391 memcpy(key_name
, kZeros
, sizeof(kZeros
));
393 } else if (memcmp(key_name
, kZeros
, 16) != 0) {
397 *p
++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST
,
398 const_cast<char *>("SHA256"), 0);
399 *p
= OSSL_PARAM_construct_end();
401 if (!EVP_CipherInit_ex(ctx
, EVP_aes_128_cbc(), NULL
, kZeros
, iv
, encrypt
)
402 || !EVP_MAC_init(hmac_ctx
, kZeros
, sizeof(kZeros
), params
)) {
407 return GetTestConfig(ssl
)->renew_ticket
? 2 : 1;
412 // kCustomExtensionValue is the extension value that the custom extension
413 // callbacks will add.
414 static const uint16_t kCustomExtensionValue
= 1234;
415 static void *const kCustomExtensionAddArg
=
416 reinterpret_cast<void *>(kCustomExtensionValue
);
417 static void *const kCustomExtensionParseArg
=
418 reinterpret_cast<void *>(kCustomExtensionValue
+ 1);
419 static const char kCustomExtensionContents
[] = "custom extension";
421 static int CustomExtensionAddCallback(SSL
*ssl
, unsigned extension_value
,
422 const uint8_t **out
, size_t *out_len
,
423 int *out_alert_value
, void *add_arg
) {
424 if (extension_value
!= kCustomExtensionValue
||
425 add_arg
!= kCustomExtensionAddArg
) {
429 if (GetTestConfig(ssl
)->custom_extension_skip
) {
432 if (GetTestConfig(ssl
)->custom_extension_fail_add
) {
436 *out
= reinterpret_cast<const uint8_t*>(kCustomExtensionContents
);
437 *out_len
= sizeof(kCustomExtensionContents
) - 1;
442 static void CustomExtensionFreeCallback(SSL
*ssl
, unsigned extension_value
,
443 const uint8_t *out
, void *add_arg
) {
444 if (extension_value
!= kCustomExtensionValue
||
445 add_arg
!= kCustomExtensionAddArg
||
446 out
!= reinterpret_cast<const uint8_t *>(kCustomExtensionContents
)) {
451 static int CustomExtensionParseCallback(SSL
*ssl
, unsigned extension_value
,
452 const uint8_t *contents
,
454 int *out_alert_value
, void *parse_arg
) {
455 if (extension_value
!= kCustomExtensionValue
||
456 parse_arg
!= kCustomExtensionParseArg
) {
460 if (contents_len
!= sizeof(kCustomExtensionContents
) - 1 ||
461 memcmp(contents
, kCustomExtensionContents
, contents_len
) != 0) {
462 *out_alert_value
= SSL_AD_DECODE_ERROR
;
469 static int ServerNameCallback(SSL
*ssl
, int *out_alert
, void *arg
) {
470 // SNI must be accessible from the SNI callback.
471 const TestConfig
*config
= GetTestConfig(ssl
);
472 const char *server_name
= SSL_get_servername(ssl
, TLSEXT_NAMETYPE_host_name
);
473 if (server_name
== nullptr ||
474 std::string(server_name
) != config
->expected_server_name
) {
475 fprintf(stderr
, "servername mismatch (got %s; want %s)\n", server_name
,
476 config
->expected_server_name
.c_str());
477 return SSL_TLSEXT_ERR_ALERT_FATAL
;
480 return SSL_TLSEXT_ERR_OK
;
483 // Connect returns a new socket connected to localhost on |port| or -1 on
485 static int Connect(uint16_t port
) {
486 int sock
= socket(AF_INET
, SOCK_STREAM
, 0);
488 PrintSocketError("socket");
492 if (setsockopt(sock
, IPPROTO_TCP
, TCP_NODELAY
,
493 reinterpret_cast<const char*>(&nodelay
), sizeof(nodelay
)) != 0) {
494 PrintSocketError("setsockopt");
499 memset(&sin
, 0, sizeof(sin
));
500 sin
.sin_family
= AF_INET
;
501 sin
.sin_port
= htons(port
);
502 if (!inet_pton(AF_INET
, "127.0.0.1", &sin
.sin_addr
)) {
503 PrintSocketError("inet_pton");
507 if (connect(sock
, reinterpret_cast<const sockaddr
*>(&sin
),
509 PrintSocketError("connect");
518 explicit SocketCloser(int sock
) : sock_(sock
) {}
520 // Half-close and drain the socket before releasing it. This seems to be
521 // necessary for graceful shutdown on Windows. It will also avoid write
522 // failures in the test runner.
523 #if defined(OPENSSL_SYS_WINDOWS)
524 shutdown(sock_
, SD_SEND
);
526 shutdown(sock_
, SHUT_WR
);
530 if (recv(sock_
, buf
, sizeof(buf
), 0) <= 0) {
541 static bssl::UniquePtr
<SSL_CTX
> SetupCtx(const TestConfig
*config
) {
542 const char sess_id_ctx
[] = "ossl_shim";
543 bssl::UniquePtr
<SSL_CTX
> ssl_ctx(SSL_CTX_new(
544 config
->is_dtls
? DTLS_method() : TLS_method()));
549 SSL_CTX_set_security_level(ssl_ctx
.get(), 0);
551 /* Disabled for now until we have some TLS1.3 support */
552 // Enable TLS 1.3 for tests.
553 if (!config
->is_dtls
&&
554 !SSL_CTX_set_max_proto_version(ssl_ctx
.get(), TLS1_3_VERSION
)) {
558 /* Ensure we don't negotiate TLSv1.3 until we can handle it */
559 if (!config
->is_dtls
&&
560 !SSL_CTX_set_max_proto_version(ssl_ctx
.get(), TLS1_2_VERSION
)) {
565 std::string cipher_list
= "ALL";
566 if (!config
->cipher
.empty()) {
567 cipher_list
= config
->cipher
;
568 SSL_CTX_set_options(ssl_ctx
.get(), SSL_OP_CIPHER_SERVER_PREFERENCE
);
570 if (!SSL_CTX_set_cipher_list(ssl_ctx
.get(), cipher_list
.c_str())) {
576 if (config
->use_sparse_dh_prime
) {
581 if (p
== NULL
|| g
== NULL
|| tmpdh
== NULL
) {
587 // This prime number is 2^1024 + 643 – a value just above a power of two.
588 // Because of its form, values modulo it are essentially certain to be one
589 // byte shorter. This is used to test padding of these values.
592 "1000000000000000000000000000000000000000000000000000000000000000"
593 "0000000000000000000000000000000000000000000000000000000000000000"
594 "0000000000000000000000000000000000000000000000000000000000000000"
595 "0000000000000000000000000000000000000000000000000000000000000028"
597 !BN_set_word(g
, 2)) {
603 DH_set0_pqg(tmpdh
, p
, NULL
, g
);
605 tmpdh
= DH_get_2048_256();
608 bssl::UniquePtr
<DH
> dh(tmpdh
);
610 if (!dh
|| !SSL_CTX_set_tmp_dh(ssl_ctx
.get(), dh
.get())) {
614 SSL_CTX_set_session_cache_mode(ssl_ctx
.get(), SSL_SESS_CACHE_BOTH
);
616 if (config
->use_old_client_cert_callback
) {
617 SSL_CTX_set_client_cert_cb(ssl_ctx
.get(), ClientCertCallback
);
620 SSL_CTX_set_npn_advertised_cb(
621 ssl_ctx
.get(), NextProtosAdvertisedCallback
, NULL
);
622 if (!config
->select_next_proto
.empty()) {
623 SSL_CTX_set_next_proto_select_cb(ssl_ctx
.get(), NextProtoSelectCallback
,
627 if (!config
->select_alpn
.empty() || config
->decline_alpn
) {
628 SSL_CTX_set_alpn_select_cb(ssl_ctx
.get(), AlpnSelectCallback
, NULL
);
631 SSL_CTX_set_info_callback(ssl_ctx
.get(), InfoCallback
);
632 SSL_CTX_sess_set_new_cb(ssl_ctx
.get(), NewSessionCallback
);
634 if (config
->use_ticket_callback
) {
635 SSL_CTX_set_tlsext_ticket_key_evp_cb(ssl_ctx
.get(), TicketKeyCallback
);
638 if (config
->enable_client_custom_extension
&&
639 !SSL_CTX_add_client_custom_ext(
640 ssl_ctx
.get(), kCustomExtensionValue
, CustomExtensionAddCallback
,
641 CustomExtensionFreeCallback
, kCustomExtensionAddArg
,
642 CustomExtensionParseCallback
, kCustomExtensionParseArg
)) {
646 if (config
->enable_server_custom_extension
&&
647 !SSL_CTX_add_server_custom_ext(
648 ssl_ctx
.get(), kCustomExtensionValue
, CustomExtensionAddCallback
,
649 CustomExtensionFreeCallback
, kCustomExtensionAddArg
,
650 CustomExtensionParseCallback
, kCustomExtensionParseArg
)) {
654 if (config
->verify_fail
) {
655 SSL_CTX_set_cert_verify_callback(ssl_ctx
.get(), VerifyFail
, NULL
);
657 SSL_CTX_set_cert_verify_callback(ssl_ctx
.get(), VerifySucceed
, NULL
);
660 if (config
->use_null_client_ca_list
) {
661 SSL_CTX_set_client_CA_list(ssl_ctx
.get(), nullptr);
664 if (!SSL_CTX_set_session_id_context(ssl_ctx
.get(),
665 (const unsigned char *)sess_id_ctx
,
666 sizeof(sess_id_ctx
) - 1))
669 if (!config
->expected_server_name
.empty()) {
670 SSL_CTX_set_tlsext_servername_callback(ssl_ctx
.get(), ServerNameCallback
);
676 // RetryAsync is called after a failed operation on |ssl| with return code
677 // |ret|. If the operation should be retried, it simulates one asynchronous
678 // event and returns true. Otherwise it returns false.
679 static bool RetryAsync(SSL
*ssl
, int ret
) {
680 // No error; don't retry.
685 TestState
*test_state
= GetTestState(ssl
);
686 assert(GetTestConfig(ssl
)->async
);
688 if (test_state
->packeted_bio
!= nullptr &&
689 PacketedBioAdvanceClock(test_state
->packeted_bio
)) {
690 // The DTLS retransmit logic silently ignores write failures. So the test
691 // may progress, allow writes through synchronously.
692 AsyncBioEnforceWriteQuota(test_state
->async_bio
, false);
693 int timeout_ret
= DTLSv1_handle_timeout(ssl
);
694 AsyncBioEnforceWriteQuota(test_state
->async_bio
, true);
696 if (timeout_ret
< 0) {
697 fprintf(stderr
, "Error retransmitting.\n");
703 // See if we needed to read or write more. If so, allow one byte through on
704 // the appropriate end to maximally stress the state machine.
705 switch (SSL_get_error(ssl
, ret
)) {
706 case SSL_ERROR_WANT_READ
:
707 AsyncBioAllowRead(test_state
->async_bio
, 1);
709 case SSL_ERROR_WANT_WRITE
:
710 AsyncBioAllowWrite(test_state
->async_bio
, 1);
712 case SSL_ERROR_WANT_X509_LOOKUP
:
713 test_state
->cert_ready
= true;
720 // DoRead reads from |ssl|, resolving any asynchronous operations. It returns
721 // the result value of the final |SSL_read| call.
722 static int DoRead(SSL
*ssl
, uint8_t *out
, size_t max_out
) {
723 const TestConfig
*config
= GetTestConfig(ssl
);
724 TestState
*test_state
= GetTestState(ssl
);
728 // The DTLS retransmit logic silently ignores write failures. So the test
729 // may progress, allow writes through synchronously. |SSL_read| may
730 // trigger a retransmit, so disconnect the write quota.
731 AsyncBioEnforceWriteQuota(test_state
->async_bio
, false);
733 ret
= config
->peek_then_read
? SSL_peek(ssl
, out
, max_out
)
734 : SSL_read(ssl
, out
, max_out
);
736 AsyncBioEnforceWriteQuota(test_state
->async_bio
, true);
738 } while (config
->async
&& RetryAsync(ssl
, ret
));
740 if (config
->peek_then_read
&& ret
> 0) {
741 std::unique_ptr
<uint8_t[]> buf(new uint8_t[static_cast<size_t>(ret
)]);
743 // SSL_peek should synchronously return the same data.
744 int ret2
= SSL_peek(ssl
, buf
.get(), ret
);
746 memcmp(buf
.get(), out
, ret
) != 0) {
747 fprintf(stderr
, "First and second SSL_peek did not match.\n");
751 // SSL_read should synchronously return the same data and consume it.
752 ret2
= SSL_read(ssl
, buf
.get(), ret
);
754 memcmp(buf
.get(), out
, ret
) != 0) {
755 fprintf(stderr
, "SSL_peek and SSL_read did not match.\n");
763 // WriteAll writes |in_len| bytes from |in| to |ssl|, resolving any asynchronous
764 // operations. It returns the result of the final |SSL_write| call.
765 static int WriteAll(SSL
*ssl
, const uint8_t *in
, size_t in_len
) {
766 const TestConfig
*config
= GetTestConfig(ssl
);
769 ret
= SSL_write(ssl
, in
, in_len
);
774 } while ((config
->async
&& RetryAsync(ssl
, ret
)) || (ret
> 0 && in_len
> 0));
778 // DoShutdown calls |SSL_shutdown|, resolving any asynchronous operations. It
779 // returns the result of the final |SSL_shutdown| call.
780 static int DoShutdown(SSL
*ssl
) {
781 const TestConfig
*config
= GetTestConfig(ssl
);
784 ret
= SSL_shutdown(ssl
);
785 } while (config
->async
&& RetryAsync(ssl
, ret
));
789 static uint16_t GetProtocolVersion(const SSL
*ssl
) {
790 uint16_t version
= SSL_version(ssl
);
791 if (!SSL_is_dtls(ssl
)) {
794 return 0x0201 + ~version
;
797 // CheckHandshakeProperties checks, immediately after |ssl| completes its
798 // initial handshake (or False Starts), whether all the properties are
799 // consistent with the test configuration and invariants.
800 static bool CheckHandshakeProperties(SSL
*ssl
, bool is_resume
) {
801 const TestConfig
*config
= GetTestConfig(ssl
);
803 if (SSL_get_current_cipher(ssl
) == nullptr) {
804 fprintf(stderr
, "null cipher after handshake\n");
809 (!!SSL_session_reused(ssl
) == config
->expect_session_miss
)) {
810 fprintf(stderr
, "session was%s reused\n",
811 SSL_session_reused(ssl
) ? "" : " not");
815 if (!GetTestState(ssl
)->handshake_done
) {
816 fprintf(stderr
, "handshake was not completed\n");
820 if (!config
->is_server
) {
821 bool expect_new_session
=
822 !config
->expect_no_session
&&
823 (!SSL_session_reused(ssl
) || config
->expect_ticket_renewal
) &&
824 // Session tickets are sent post-handshake in TLS 1.3.
825 GetProtocolVersion(ssl
) < TLS1_3_VERSION
;
826 if (expect_new_session
!= GetTestState(ssl
)->got_new_session
) {
828 "new session was%s cached, but we expected the opposite\n",
829 GetTestState(ssl
)->got_new_session
? "" : " not");
834 if (!config
->expected_server_name
.empty()) {
835 const char *server_name
=
836 SSL_get_servername(ssl
, TLSEXT_NAMETYPE_host_name
);
837 if (server_name
== nullptr ||
838 std::string(server_name
) != config
->expected_server_name
) {
839 fprintf(stderr
, "servername mismatch (got %s; want %s)\n",
840 server_name
, config
->expected_server_name
.c_str());
845 if (!config
->expected_next_proto
.empty()) {
846 const uint8_t *next_proto
;
847 unsigned next_proto_len
;
848 SSL_get0_next_proto_negotiated(ssl
, &next_proto
, &next_proto_len
);
849 if (next_proto_len
!= config
->expected_next_proto
.size() ||
850 memcmp(next_proto
, config
->expected_next_proto
.data(),
851 next_proto_len
) != 0) {
852 fprintf(stderr
, "negotiated next proto mismatch\n");
857 if (!config
->expected_alpn
.empty()) {
858 const uint8_t *alpn_proto
;
859 unsigned alpn_proto_len
;
860 SSL_get0_alpn_selected(ssl
, &alpn_proto
, &alpn_proto_len
);
861 if (alpn_proto_len
!= config
->expected_alpn
.size() ||
862 memcmp(alpn_proto
, config
->expected_alpn
.data(),
863 alpn_proto_len
) != 0) {
864 fprintf(stderr
, "negotiated alpn proto mismatch\n");
869 if (config
->expect_extended_master_secret
) {
870 if (!SSL_get_extms_support(ssl
)) {
871 fprintf(stderr
, "No EMS for connection when expected");
876 if (config
->expect_verify_result
) {
877 int expected_verify_result
= config
->verify_fail
?
878 X509_V_ERR_APPLICATION_VERIFICATION
:
881 if (SSL_get_verify_result(ssl
) != expected_verify_result
) {
882 fprintf(stderr
, "Wrong certificate verification result\n");
887 if (!config
->psk
.empty()) {
888 if (SSL_get_peer_cert_chain(ssl
) != nullptr) {
889 fprintf(stderr
, "Received peer certificate on a PSK cipher.\n");
892 } else if (!config
->is_server
|| config
->require_any_client_certificate
) {
893 if (SSL_get0_peer_certificate(ssl
) == nullptr) {
894 fprintf(stderr
, "Received no peer certificate but expected one.\n");
902 // DoExchange runs a test SSL exchange against the peer. On success, it returns
903 // true and sets |*out_session| to the negotiated SSL session. If the test is a
904 // resumption attempt, |is_resume| is true and |session| is the session from the
905 // previous exchange.
906 static bool DoExchange(bssl::UniquePtr
<SSL_SESSION
> *out_session
,
907 SSL_CTX
*ssl_ctx
, const TestConfig
*config
,
908 bool is_resume
, SSL_SESSION
*session
) {
909 bssl::UniquePtr
<SSL
> ssl(SSL_new(ssl_ctx
));
914 if (!SetTestConfig(ssl
.get(), config
) ||
915 !SetTestState(ssl
.get(), std::unique_ptr
<TestState
>(new TestState
))) {
919 if (config
->fallback_scsv
&&
920 !SSL_set_mode(ssl
.get(), SSL_MODE_SEND_FALLBACK_SCSV
)) {
923 // Install the certificate synchronously if nothing else will handle it.
924 if (!config
->use_old_client_cert_callback
&&
926 !InstallCertificate(ssl
.get())) {
929 SSL_set_cert_cb(ssl
.get(), CertCallback
, nullptr);
930 if (config
->require_any_client_certificate
) {
931 SSL_set_verify(ssl
.get(), SSL_VERIFY_PEER
|SSL_VERIFY_FAIL_IF_NO_PEER_CERT
,
934 if (config
->verify_peer
) {
935 SSL_set_verify(ssl
.get(), SSL_VERIFY_PEER
, NULL
);
937 if (config
->partial_write
) {
938 SSL_set_mode(ssl
.get(), SSL_MODE_ENABLE_PARTIAL_WRITE
);
940 if (config
->no_tls13
) {
941 SSL_set_options(ssl
.get(), SSL_OP_NO_TLSv1_3
);
943 if (config
->no_tls12
) {
944 SSL_set_options(ssl
.get(), SSL_OP_NO_TLSv1_2
);
946 if (config
->no_tls11
) {
947 SSL_set_options(ssl
.get(), SSL_OP_NO_TLSv1_1
);
949 if (config
->no_tls1
) {
950 SSL_set_options(ssl
.get(), SSL_OP_NO_TLSv1
);
952 if (config
->no_ssl3
) {
953 SSL_set_options(ssl
.get(), SSL_OP_NO_SSLv3
);
955 if (!config
->host_name
.empty() &&
956 !SSL_set_tlsext_host_name(ssl
.get(), config
->host_name
.c_str())) {
959 if (!config
->advertise_alpn
.empty() &&
960 SSL_set_alpn_protos(ssl
.get(),
961 (const uint8_t *)config
->advertise_alpn
.data(),
962 config
->advertise_alpn
.size()) != 0) {
965 if (!config
->psk
.empty()) {
966 SSL_set_psk_client_callback(ssl
.get(), PskClientCallback
);
967 SSL_set_psk_server_callback(ssl
.get(), PskServerCallback
);
969 if (!config
->psk_identity
.empty() &&
970 !SSL_use_psk_identity_hint(ssl
.get(), config
->psk_identity
.c_str())) {
973 if (!config
->srtp_profiles
.empty() &&
974 SSL_set_tlsext_use_srtp(ssl
.get(), config
->srtp_profiles
.c_str())) {
977 if (config
->min_version
!= 0 &&
978 !SSL_set_min_proto_version(ssl
.get(), (uint16_t)config
->min_version
)) {
981 if (config
->max_version
!= 0 &&
982 !SSL_set_max_proto_version(ssl
.get(), (uint16_t)config
->max_version
)) {
985 if (config
->mtu
!= 0) {
986 SSL_set_options(ssl
.get(), SSL_OP_NO_QUERY_MTU
);
987 SSL_set_mtu(ssl
.get(), config
->mtu
);
989 if (config
->renegotiate_freely
) {
990 // This is always on for OpenSSL.
992 if (!config
->check_close_notify
) {
993 SSL_set_quiet_shutdown(ssl
.get(), 1);
995 if (config
->p384_only
) {
996 int nid
= NID_secp384r1
;
997 if (!SSL_set1_curves(ssl
.get(), &nid
, 1)) {
1001 if (config
->enable_all_curves
) {
1002 static const int kAllCurves
[] = {
1003 NID_X25519
, NID_X9_62_prime256v1
, NID_X448
, NID_secp521r1
, NID_secp384r1
1005 if (!SSL_set1_curves(ssl
.get(), kAllCurves
,
1006 OPENSSL_ARRAY_SIZE(kAllCurves
))) {
1010 if (config
->max_cert_list
> 0) {
1011 SSL_set_max_cert_list(ssl
.get(), config
->max_cert_list
);
1014 if (!config
->async
) {
1015 SSL_set_mode(ssl
.get(), SSL_MODE_AUTO_RETRY
);
1018 int sock
= Connect(config
->port
);
1022 SocketCloser
closer(sock
);
1024 bssl::UniquePtr
<BIO
> bio(BIO_new_socket(sock
, BIO_NOCLOSE
));
1028 if (config
->is_dtls
) {
1029 bssl::UniquePtr
<BIO
> packeted
= PacketedBioCreate(!config
->async
);
1033 GetTestState(ssl
.get())->packeted_bio
= packeted
.get();
1034 BIO_push(packeted
.get(), bio
.release());
1035 bio
= std::move(packeted
);
1037 if (config
->async
) {
1038 bssl::UniquePtr
<BIO
> async_scoped
=
1039 config
->is_dtls
? AsyncBioCreateDatagram() : AsyncBioCreate();
1040 if (!async_scoped
) {
1043 BIO_push(async_scoped
.get(), bio
.release());
1044 GetTestState(ssl
.get())->async_bio
= async_scoped
.get();
1045 bio
= std::move(async_scoped
);
1047 SSL_set_bio(ssl
.get(), bio
.get(), bio
.get());
1048 bio
.release(); // SSL_set_bio takes ownership.
1050 if (session
!= NULL
) {
1051 if (!config
->is_server
) {
1052 if (SSL_set_session(ssl
.get(), session
) != 1) {
1059 // KNOWN BUG: OpenSSL's SSL_get_current_cipher behaves incorrectly when
1060 // offering resumption.
1061 if (SSL_get_current_cipher(ssl
.get()) != nullptr) {
1062 fprintf(stderr
, "non-null cipher before handshake\n");
1068 if (config
->implicit_handshake
) {
1069 if (config
->is_server
) {
1070 SSL_set_accept_state(ssl
.get());
1072 SSL_set_connect_state(ssl
.get());
1076 if (config
->is_server
) {
1077 ret
= SSL_accept(ssl
.get());
1079 ret
= SSL_connect(ssl
.get());
1081 } while (config
->async
&& RetryAsync(ssl
.get(), ret
));
1083 !CheckHandshakeProperties(ssl
.get(), is_resume
)) {
1084 fprintf(stderr
, "resumption check failed\n");
1088 // Reset the state to assert later that the callback isn't called in
1090 GetTestState(ssl
.get())->got_new_session
= false;
1093 if (config
->export_keying_material
> 0) {
1094 std::vector
<uint8_t> result(
1095 static_cast<size_t>(config
->export_keying_material
));
1096 if (SSL_export_keying_material(
1097 ssl
.get(), result
.data(), result
.size(),
1098 config
->export_label
.data(), config
->export_label
.size(),
1099 reinterpret_cast<const uint8_t*>(config
->export_context
.data()),
1100 config
->export_context
.size(), config
->use_export_context
) != 1) {
1101 fprintf(stderr
, "failed to export keying material\n");
1104 if (WriteAll(ssl
.get(), result
.data(), result
.size()) < 0) {
1105 fprintf(stderr
, "writing exported key material failed\n");
1110 if (config
->write_different_record_sizes
) {
1111 if (config
->is_dtls
) {
1112 fprintf(stderr
, "write_different_record_sizes not supported for DTLS\n");
1115 // This mode writes a number of different record sizes in an attempt to
1116 // trip up the CBC record splitting code.
1117 static const size_t kBufLen
= 32769;
1118 std::unique_ptr
<uint8_t[]> buf(new uint8_t[kBufLen
]);
1119 memset(buf
.get(), 0x42, kBufLen
);
1120 static const size_t kRecordSizes
[] = {
1121 0, 1, 255, 256, 257, 16383, 16384, 16385, 32767, 32768, 32769};
1122 for (size_t i
= 0; i
< OPENSSL_ARRAY_SIZE(kRecordSizes
); i
++) {
1123 const size_t len
= kRecordSizes
[i
];
1124 if (len
> kBufLen
) {
1125 fprintf(stderr
, "Bad kRecordSizes value.\n");
1128 if (WriteAll(ssl
.get(), buf
.get(), len
) < 0) {
1133 if (config
->shim_writes_first
) {
1134 if (WriteAll(ssl
.get(), reinterpret_cast<const uint8_t *>("hello"),
1136 fprintf(stderr
, "shim_writes_first write failed\n");
1140 if (!config
->shim_shuts_down
) {
1142 static const size_t kBufLen
= 16384;
1143 std::unique_ptr
<uint8_t[]> buf(new uint8_t[kBufLen
]);
1145 // Read only 512 bytes at a time in TLS to ensure records may be
1146 // returned in multiple reads.
1147 int n
= DoRead(ssl
.get(), buf
.get(), config
->is_dtls
? kBufLen
: 512);
1148 int err
= SSL_get_error(ssl
.get(), n
);
1149 if (err
== SSL_ERROR_ZERO_RETURN
||
1150 (n
== 0 && err
== SSL_ERROR_SYSCALL
)) {
1152 fprintf(stderr
, "Invalid SSL_get_error output\n");
1155 // Stop on either clean or unclean shutdown.
1157 } else if (err
!= SSL_ERROR_NONE
) {
1159 fprintf(stderr
, "Invalid SSL_get_error output\n");
1162 fprintf(stderr
, "Unexpected entry in error queue\n");
1165 // Successfully read data.
1167 fprintf(stderr
, "Invalid SSL_get_error output\n");
1171 // After a successful read, with or without False Start, the handshake
1172 // must be complete.
1173 if (!GetTestState(ssl
.get())->handshake_done
) {
1174 fprintf(stderr
, "handshake was not completed after SSL_read\n");
1178 for (int i
= 0; i
< n
; i
++) {
1181 if (WriteAll(ssl
.get(), buf
.get(), n
) < 0) {
1182 fprintf(stderr
, "write of inverted bitstream failed\n");
1189 if (!config
->is_server
&&
1190 !config
->implicit_handshake
&&
1191 // Session tickets are sent post-handshake in TLS 1.3.
1192 GetProtocolVersion(ssl
.get()) < TLS1_3_VERSION
&&
1193 GetTestState(ssl
.get())->got_new_session
) {
1194 fprintf(stderr
, "new session was established after the handshake\n");
1198 if (GetProtocolVersion(ssl
.get()) >= TLS1_3_VERSION
&& !config
->is_server
) {
1199 bool expect_new_session
=
1200 !config
->expect_no_session
&& !config
->shim_shuts_down
;
1201 if (expect_new_session
!= GetTestState(ssl
.get())->got_new_session
) {
1203 "new session was%s cached, but we expected the opposite\n",
1204 GetTestState(ssl
.get())->got_new_session
? "" : " not");
1210 *out_session
= std::move(GetTestState(ssl
.get())->new_session
);
1213 ret
= DoShutdown(ssl
.get());
1215 if (config
->shim_shuts_down
&& config
->check_close_notify
) {
1216 // We initiate shutdown, so |SSL_shutdown| will return in two stages. First
1217 // it returns zero when our close_notify is sent, then one when the peer's
1220 fprintf(stderr
, "Unexpected SSL_shutdown result: %d != 0\n", ret
);
1223 ret
= DoShutdown(ssl
.get());
1227 fprintf(stderr
, "Unexpected SSL_shutdown result: %d != 1\n", ret
);
1231 if (SSL_total_renegotiations(ssl
.get()) !=
1232 config
->expect_total_renegotiations
) {
1233 fprintf(stderr
, "Expected %d renegotiations, got %ld\n",
1234 config
->expect_total_renegotiations
,
1235 SSL_total_renegotiations(ssl
.get()));
1242 class StderrDelimiter
{
1244 ~StderrDelimiter() { fprintf(stderr
, "--- DONE ---\n"); }
1247 static int Main(int argc
, char **argv
) {
1248 // To distinguish ASan's output from ours, add a trailing message to stderr.
1249 // Anything following this line will be considered an error.
1250 StderrDelimiter delimiter
;
1252 #if defined(OPENSSL_SYS_WINDOWS)
1253 /* Initialize Winsock. */
1254 WORD wsa_version
= MAKEWORD(2, 2);
1256 int wsa_err
= WSAStartup(wsa_version
, &wsa_data
);
1258 fprintf(stderr
, "WSAStartup failed: %d\n", wsa_err
);
1261 if (wsa_data
.wVersion
!= wsa_version
) {
1262 fprintf(stderr
, "Didn't get expected version: %x\n", wsa_data
.wVersion
);
1266 signal(SIGPIPE
, SIG_IGN
);
1269 OPENSSL_init_crypto(0, NULL
);
1270 OPENSSL_init_ssl(0, NULL
);
1271 g_config_index
= SSL_get_ex_new_index(0, NULL
, NULL
, NULL
, NULL
);
1272 g_state_index
= SSL_get_ex_new_index(0, NULL
, NULL
, NULL
, TestStateExFree
);
1273 if (g_config_index
< 0 || g_state_index
< 0) {
1278 if (!ParseConfig(argc
- 1, argv
+ 1, &config
)) {
1279 return Usage(argv
[0]);
1282 bssl::UniquePtr
<SSL_CTX
> ssl_ctx
= SetupCtx(&config
);
1284 ERR_print_errors_fp(stderr
);
1288 bssl::UniquePtr
<SSL_SESSION
> session
;
1289 for (int i
= 0; i
< config
.resume_count
+ 1; i
++) {
1290 bool is_resume
= i
> 0;
1291 if (is_resume
&& !config
.is_server
&& !session
) {
1292 fprintf(stderr
, "No session to offer.\n");
1296 bssl::UniquePtr
<SSL_SESSION
> offer_session
= std::move(session
);
1297 if (!DoExchange(&session
, ssl_ctx
.get(), &config
, is_resume
,
1298 offer_session
.get())) {
1299 fprintf(stderr
, "Connection %d failed.\n", i
+ 1);
1300 ERR_print_errors_fp(stderr
);
1310 int main(int argc
, char **argv
) {
1311 return bssl::Main(argc
, argv
);