]>
Commit | Line | Data |
---|---|---|
440e5d80 | 1 | /* |
a28d06f3 | 2 | * Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved. |
170b7358 | 3 | * |
909f1a2e | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
440e5d80 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
170b7358 VD |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
11 | #include <string.h> | |
12 | #include <ctype.h> | |
13 | #include <limits.h> | |
14 | #include <errno.h> | |
15 | ||
16 | #include <openssl/crypto.h> | |
17 | #include <openssl/evp.h> | |
18 | #include <openssl/x509.h> | |
19 | #include <openssl/ssl.h> | |
20 | #include <openssl/err.h> | |
21 | #include <openssl/conf.h> | |
22 | #ifndef OPENSSL_NO_ENGINE | |
23 | #include <openssl/engine.h> | |
24 | #endif | |
1f9d203d | 25 | #include "testutil.h" |
170b7358 | 26 | |
176db6dc | 27 | #include "internal/nelem.h" |
170b7358 | 28 | |
18295f0c RL |
29 | #define _UC(c) ((unsigned char)(c)) |
30 | ||
1f9d203d RS |
31 | static const char *basedomain; |
32 | static const char *CAfile; | |
33 | static const char *tlsafile; | |
170b7358 VD |
34 | |
35 | /* | |
36 | * Forward declaration, of function that uses internal interfaces, from headers | |
37 | * included at the end of this module. | |
38 | */ | |
39 | static void store_ctx_dane_init(X509_STORE_CTX *, SSL *); | |
40 | ||
41 | static int saved_errno; | |
42 | ||
43 | static void save_errno(void) | |
44 | { | |
45 | saved_errno = errno; | |
46 | } | |
47 | ||
48 | static int restore_errno(void) | |
49 | { | |
50 | int ret = errno; | |
51 | errno = saved_errno; | |
52 | return ret; | |
53 | } | |
54 | ||
170b7358 VD |
55 | static int verify_chain(SSL *ssl, STACK_OF(X509) *chain) |
56 | { | |
1f9d203d RS |
57 | X509_STORE_CTX *store_ctx = NULL; |
58 | SSL_CTX *ssl_ctx = NULL; | |
59 | X509_STORE *store = NULL; | |
1f9d203d | 60 | int ret = 0; |
170b7358 | 61 | int store_ctx_idx = SSL_get_ex_data_X509_STORE_CTX_idx(); |
170b7358 | 62 | |
1f9d203d RS |
63 | if (!TEST_ptr(store_ctx = X509_STORE_CTX_new()) |
64 | || !TEST_ptr(ssl_ctx = SSL_get_SSL_CTX(ssl)) | |
65 | || !TEST_ptr(store = SSL_CTX_get_cert_store(ssl_ctx)) | |
11ddbf84 | 66 | || !TEST_true(X509_STORE_CTX_init(store_ctx, store, NULL, chain)) |
1f9d203d RS |
67 | || !TEST_true(X509_STORE_CTX_set_ex_data(store_ctx, store_ctx_idx, |
68 | ssl))) | |
e5a5e3f3 | 69 | goto end; |
170b7358 VD |
70 | |
71 | X509_STORE_CTX_set_default(store_ctx, | |
72 | SSL_is_server(ssl) ? "ssl_client" : "ssl_server"); | |
73 | X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(store_ctx), | |
74 | SSL_get0_param(ssl)); | |
75 | store_ctx_dane_init(store_ctx, ssl); | |
76 | ||
1f9d203d | 77 | if (SSL_get_verify_callback(ssl) != NULL) |
dccd20d1 | 78 | X509_STORE_CTX_set_verify_cb(store_ctx, SSL_get_verify_callback(ssl)); |
170b7358 | 79 | |
1f9d203d | 80 | /* Mask "internal failures" (-1) from our return value. */ |
11ddbf84 | 81 | if (!TEST_int_ge(ret = X509_STORE_CTX_verify(store_ctx), 0)) |
1f9d203d | 82 | ret = 0; |
170b7358 VD |
83 | |
84 | SSL_set_verify_result(ssl, X509_STORE_CTX_get_error(store_ctx)); | |
1f9d203d | 85 | |
e5a5e3f3 | 86 | end: |
170b7358 | 87 | X509_STORE_CTX_free(store_ctx); |
1f9d203d | 88 | return ret; |
170b7358 VD |
89 | } |
90 | ||
02b91dcf | 91 | static STACK_OF(X509) *load_chain(BIO *fp, int nelem) |
170b7358 VD |
92 | { |
93 | int count; | |
94 | char *name = 0; | |
95 | char *header = 0; | |
96 | unsigned char *data = 0; | |
97 | long len; | |
dccd20d1 | 98 | char *errtype = 0; /* if error: cert or pkey? */ |
170b7358 VD |
99 | STACK_OF(X509) *chain; |
100 | typedef X509 *(*d2i_X509_t)(X509 **, const unsigned char **, long); | |
101 | ||
1f9d203d RS |
102 | if (!TEST_ptr(chain = sk_X509_new_null())) |
103 | goto err; | |
170b7358 VD |
104 | |
105 | for (count = 0; | |
dccd20d1 | 106 | count < nelem && errtype == 0 |
1f9d203d | 107 | && PEM_read_bio(fp, &name, &header, &data, &len) == 1; |
dccd20d1 | 108 | ++count) { |
dccd20d1 | 109 | if (strcmp(name, PEM_STRING_X509) == 0 |
1f9d203d RS |
110 | || strcmp(name, PEM_STRING_X509_TRUSTED) == 0 |
111 | || strcmp(name, PEM_STRING_X509_OLD) == 0) { | |
112 | d2i_X509_t d = strcmp(name, PEM_STRING_X509_TRUSTED) != 0 | |
113 | ? d2i_X509_AUX : d2i_X509; | |
114 | X509 *cert; | |
115 | const unsigned char *p = data; | |
116 | ||
117 | if (!TEST_ptr(cert = d(0, &p, len)) | |
118 | || !TEST_long_eq(p - data, len)) { | |
119 | TEST_info("Certificate parsing error"); | |
dccd20d1 F |
120 | goto err; |
121 | } | |
1f9d203d RS |
122 | |
123 | if (!TEST_true(sk_X509_push(chain, cert))) | |
124 | goto err; | |
dccd20d1 | 125 | } else { |
1f9d203d | 126 | TEST_info("Unknown chain file object %s", name); |
dccd20d1 F |
127 | goto err; |
128 | } | |
129 | ||
dccd20d1 F |
130 | OPENSSL_free(name); |
131 | OPENSSL_free(header); | |
132 | OPENSSL_free(data); | |
9e206ce5 P |
133 | name = header = NULL; |
134 | data = NULL; | |
170b7358 VD |
135 | } |
136 | ||
170b7358 VD |
137 | if (count == nelem) { |
138 | ERR_clear_error(); | |
139 | return chain; | |
140 | } | |
141 | ||
142 | err: | |
1f9d203d RS |
143 | OPENSSL_free(name); |
144 | OPENSSL_free(header); | |
145 | OPENSSL_free(data); | |
170b7358 | 146 | sk_X509_pop_free(chain, X509_free); |
170b7358 VD |
147 | return NULL; |
148 | } | |
149 | ||
02b91dcf | 150 | static char *read_to_eol(BIO *f) |
170b7358 VD |
151 | { |
152 | static char buf[1024]; | |
153 | int n; | |
154 | ||
02b91dcf | 155 | if (!BIO_gets(f, buf, sizeof(buf))) |
170b7358 VD |
156 | return NULL; |
157 | ||
158 | n = strlen(buf); | |
1f9d203d RS |
159 | if (buf[n - 1] != '\n') { |
160 | if (n + 1 == sizeof(buf)) | |
161 | TEST_error("input too long"); | |
162 | else | |
163 | TEST_error("EOF before newline"); | |
170b7358 VD |
164 | return NULL; |
165 | } | |
166 | ||
167 | /* Trim trailing whitespace */ | |
1f9d203d | 168 | while (n > 0 && isspace(_UC(buf[n - 1]))) |
170b7358 VD |
169 | buf[--n] = '\0'; |
170 | ||
171 | return buf; | |
172 | } | |
173 | ||
174 | /* | |
175 | * Hex decoder that tolerates optional whitespace | |
176 | */ | |
177 | static ossl_ssize_t hexdecode(const char *in, void *result) | |
178 | { | |
179 | unsigned char **out = (unsigned char **)result; | |
1f9d203d RS |
180 | unsigned char *ret; |
181 | unsigned char *cp; | |
170b7358 VD |
182 | uint8_t byte; |
183 | int nibble = 0; | |
184 | ||
1f9d203d | 185 | if (!TEST_ptr(ret = OPENSSL_malloc(strlen(in) / 2))) |
170b7358 | 186 | return -1; |
1f9d203d | 187 | cp = ret; |
170b7358 VD |
188 | |
189 | for (byte = 0; *in; ++in) { | |
49445f21 | 190 | int x; |
170b7358 | 191 | |
18295f0c | 192 | if (isspace(_UC(*in))) |
170b7358 | 193 | continue; |
49445f21 RS |
194 | x = OPENSSL_hexchar2int(*in); |
195 | if (x < 0) { | |
170b7358 VD |
196 | OPENSSL_free(ret); |
197 | return 0; | |
198 | } | |
49445f21 | 199 | byte |= (char)x; |
170b7358 VD |
200 | if ((nibble ^= 1) == 0) { |
201 | *cp++ = byte; | |
202 | byte = 0; | |
203 | } else { | |
204 | byte <<= 4; | |
205 | } | |
206 | } | |
207 | if (nibble != 0) { | |
208 | OPENSSL_free(ret); | |
209 | return 0; | |
210 | } | |
211 | ||
212 | return cp - (*out = ret); | |
213 | } | |
214 | ||
215 | static ossl_ssize_t checked_uint8(const char *in, void *out) | |
216 | { | |
217 | uint8_t *result = (uint8_t *)out; | |
218 | const char *cp = in; | |
219 | char *endp; | |
220 | long v; | |
221 | int e; | |
222 | ||
223 | save_errno(); | |
224 | v = strtol(cp, &endp, 10); | |
225 | e = restore_errno(); | |
226 | ||
227 | if (((v == LONG_MIN || v == LONG_MAX) && e == ERANGE) || | |
18295f0c | 228 | endp == cp || !isspace(_UC(*endp)) || |
170b7358 VD |
229 | v != (*(uint8_t *)result = (uint8_t) v)) { |
230 | return -1; | |
231 | } | |
18295f0c | 232 | for (cp = endp; isspace(_UC(*cp)); ++cp) |
170b7358 VD |
233 | continue; |
234 | return cp - in; | |
235 | } | |
236 | ||
bbd86bf5 RS |
237 | struct tlsa_field { |
238 | void *var; | |
239 | const char *name; | |
240 | ossl_ssize_t (*parser)(const char *, void *); | |
241 | }; | |
242 | ||
170b7358 VD |
243 | static int tlsa_import_rr(SSL *ssl, const char *rrdata) |
244 | { | |
bbd86bf5 RS |
245 | static uint8_t usage; |
246 | static uint8_t selector; | |
247 | static uint8_t mtype; | |
248 | static unsigned char *data = NULL; | |
249 | static struct tlsa_field tlsa_fields[] = { | |
170b7358 VD |
250 | { &usage, "usage", checked_uint8 }, |
251 | { &selector, "selector", checked_uint8 }, | |
252 | { &mtype, "mtype", checked_uint8 }, | |
253 | { &data, "data", hexdecode }, | |
254 | { NULL, } | |
255 | }; | |
bbd86bf5 | 256 | int ret; |
170b7358 | 257 | struct tlsa_field *f; |
bbd86bf5 RS |
258 | const char *cp = rrdata; |
259 | ossl_ssize_t len = 0; | |
170b7358 VD |
260 | |
261 | for (f = tlsa_fields; f->var; ++f) { | |
262 | if ((len = f->parser(cp += len, f->var)) <= 0) { | |
1f9d203d | 263 | TEST_info("bad TLSA %s field in: %s", f->name, rrdata); |
170b7358 VD |
264 | return 0; |
265 | } | |
266 | } | |
1f9d203d | 267 | |
170b7358 VD |
268 | ret = SSL_dane_tlsa_add(ssl, usage, selector, mtype, data, len); |
269 | OPENSSL_free(data); | |
170b7358 | 270 | if (ret == 0) { |
1f9d203d | 271 | TEST_info("unusable TLSA rrdata: %s", rrdata); |
170b7358 VD |
272 | return 0; |
273 | } | |
274 | if (ret < 0) { | |
1f9d203d | 275 | TEST_info("error loading TLSA rrdata: %s", rrdata); |
170b7358 VD |
276 | return 0; |
277 | } | |
1f9d203d | 278 | |
170b7358 VD |
279 | return ret; |
280 | } | |
281 | ||
282 | static int allws(const char *cp) | |
283 | { | |
284 | while (*cp) | |
18295f0c | 285 | if (!isspace(_UC(*cp++))) |
170b7358 VD |
286 | return 0; |
287 | return 1; | |
288 | } | |
289 | ||
aebe9e39 | 290 | static int test_tlsafile(SSL_CTX *ctx, const char *base_name, |
02b91dcf | 291 | BIO *f, const char *path) |
170b7358 VD |
292 | { |
293 | char *line; | |
294 | int testno = 0; | |
295 | int ret = 1; | |
296 | SSL *ssl; | |
297 | ||
298 | while (ret > 0 && (line = read_to_eol(f)) != NULL) { | |
299 | STACK_OF(X509) *chain; | |
300 | int ntlsa; | |
301 | int ncert; | |
5ae4ceb9 | 302 | int noncheck; |
170b7358 VD |
303 | int want; |
304 | int want_depth; | |
305 | int off; | |
306 | int i; | |
307 | int ok; | |
308 | int err; | |
309 | int mdpth; | |
310 | ||
311 | if (*line == '\0' || *line == '#') | |
312 | continue; | |
313 | ||
314 | ++testno; | |
5ae4ceb9 VD |
315 | if (sscanf(line, "%d %d %d %d %d%n", |
316 | &ntlsa, &ncert, &noncheck, &want, &want_depth, &off) != 5 | |
170b7358 | 317 | || !allws(line + off)) { |
1f9d203d | 318 | TEST_error("Malformed line for test %d", testno); |
170b7358 VD |
319 | return 0; |
320 | } | |
321 | ||
1f9d203d RS |
322 | if (!TEST_ptr(ssl = SSL_new(ctx))) |
323 | return 0; | |
170b7358 | 324 | SSL_set_connect_state(ssl); |
aebe9e39 | 325 | if (SSL_dane_enable(ssl, base_name) <= 0) { |
170b7358 | 326 | SSL_free(ssl); |
1f9d203d | 327 | return 0; |
170b7358 | 328 | } |
5ae4ceb9 VD |
329 | if (noncheck) |
330 | SSL_dane_set_flags(ssl, DANE_FLAG_NO_DANE_EE_NAMECHECKS); | |
170b7358 VD |
331 | |
332 | for (i = 0; i < ntlsa; ++i) { | |
333 | if ((line = read_to_eol(f)) == NULL || !tlsa_import_rr(ssl, line)) { | |
334 | SSL_free(ssl); | |
335 | return 0; | |
336 | } | |
337 | } | |
338 | ||
339 | /* Don't report old news */ | |
340 | ERR_clear_error(); | |
1f9d203d | 341 | if (!TEST_ptr(chain = load_chain(f, ncert))) { |
170b7358 | 342 | SSL_free(ssl); |
1f9d203d | 343 | return 0; |
170b7358 VD |
344 | } |
345 | ||
346 | ok = verify_chain(ssl, chain); | |
347 | sk_X509_pop_free(chain, X509_free); | |
348 | err = SSL_get_verify_result(ssl); | |
c0a445a9 VD |
349 | /* |
350 | * Peek under the hood, normally TLSA match data is hidden when | |
351 | * verification fails, we can obtain any suppressed data by setting the | |
352 | * verification result to X509_V_OK before looking. | |
353 | */ | |
354 | SSL_set_verify_result(ssl, X509_V_OK); | |
170b7358 | 355 | mdpth = SSL_get0_dane_authority(ssl, NULL, NULL); |
c0a445a9 VD |
356 | /* Not needed any more, but lead by example and put the error back. */ |
357 | SSL_set_verify_result(ssl, err); | |
170b7358 VD |
358 | SSL_free(ssl); |
359 | ||
1f9d203d RS |
360 | if (!TEST_int_eq(err, want)) { |
361 | if (want == X509_V_OK) | |
362 | TEST_info("Verification failure in test %d: %d=%s", | |
363 | testno, err, X509_verify_cert_error_string(err)); | |
364 | else | |
365 | TEST_info("Unexpected error in test %d", testno); | |
170b7358 | 366 | ret = 0; |
170b7358 VD |
367 | continue; |
368 | } | |
1f9d203d RS |
369 | if (!TEST_false(want == 0 && ok == 0)) { |
370 | TEST_info("Verification failure in test %d: ok=0", testno); | |
170b7358 | 371 | ret = 0; |
170b7358 VD |
372 | continue; |
373 | } | |
1f9d203d RS |
374 | if (!TEST_int_eq(mdpth, want_depth)) { |
375 | TEST_info("In test test %d", testno); | |
170b7358 | 376 | ret = 0; |
170b7358 | 377 | } |
170b7358 VD |
378 | } |
379 | ERR_clear_error(); | |
380 | ||
381 | return ret; | |
382 | } | |
383 | ||
31a80694 | 384 | static int run_tlsatest(void) |
170b7358 | 385 | { |
170b7358 | 386 | SSL_CTX *ctx = NULL; |
1f9d203d RS |
387 | BIO *f = NULL; |
388 | int ret = 0; | |
389 | ||
390 | if (!TEST_ptr(f = BIO_new_file(tlsafile, "r")) | |
391 | || !TEST_ptr(ctx = SSL_CTX_new(TLS_client_method())) | |
392 | || !TEST_int_gt(SSL_CTX_dane_enable(ctx), 0) | |
573e4bf0 | 393 | || !TEST_true(SSL_CTX_load_verify_file(ctx, CAfile)) |
1f9d203d RS |
394 | || !TEST_int_gt(SSL_CTX_dane_mtype_set(ctx, EVP_sha512(), 2, 1), |
395 | 0) | |
396 | || !TEST_int_gt(SSL_CTX_dane_mtype_set(ctx, EVP_sha256(), 1, 2), | |
397 | 0) | |
398 | || !TEST_int_gt(test_tlsafile(ctx, basedomain, f, tlsafile), 0)) | |
399 | goto end; | |
400 | ret = 1; | |
401 | ||
402 | end: | |
403 | BIO_free(f); | |
404 | SSL_CTX_free(ctx); | |
405 | ||
406 | return ret; | |
407 | } | |
408 | ||
a43ce58f SL |
409 | OPT_TEST_DECLARE_USAGE("basedomain CAfile tlsafile\n") |
410 | ||
ad887416 | 411 | int setup_tests(void) |
1f9d203d | 412 | { |
8d242823 MC |
413 | if (!test_skip_common_options()) { |
414 | TEST_error("Error parsing test options\n"); | |
415 | return 0; | |
416 | } | |
417 | ||
ad887416 P |
418 | if (!TEST_ptr(basedomain = test_get_argument(0)) |
419 | || !TEST_ptr(CAfile = test_get_argument(1)) | |
a43ce58f | 420 | || !TEST_ptr(tlsafile = test_get_argument(2))) |
1f9d203d | 421 | return 0; |
170b7358 | 422 | |
1f9d203d | 423 | ADD_TEST(run_tlsatest); |
ad887416 | 424 | return 1; |
170b7358 VD |
425 | } |
426 | ||
176db6dc | 427 | #include "internal/dane.h" |
170b7358 VD |
428 | |
429 | static void store_ctx_dane_init(X509_STORE_CTX *store_ctx, SSL *ssl) | |
430 | { | |
431 | X509_STORE_CTX_set0_dane(store_ctx, SSL_get0_dane(ssl)); | |
432 | } |