]>
Commit | Line | Data |
---|---|---|
02e22dd4 DW |
1 | /* |
2 | * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. | |
3 | * | |
4 | * Licensed under the OpenSSL license (the "License"). You may not use | |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
10 | #include <stdio.h> | |
11 | #include <string.h> | |
12 | ||
13 | #include <openssl/dtls1.h> | |
14 | #include <openssl/ssl.h> | |
15 | #include <openssl/err.h> | |
16 | ||
17 | #include "ssltestlib.h" | |
18 | ||
19 | /* for SSL_USE_ETM() */ | |
20 | #include "../ssl/ssl_locl.h" | |
21 | ||
22 | static int debug = 0; | |
23 | ||
24 | static unsigned int clnt_psk_callback(SSL *ssl, const char *hint, | |
25 | char *ident, unsigned int max_ident_len, | |
26 | unsigned char *psk, | |
27 | unsigned int max_psk_len) | |
28 | { | |
7380737d | 29 | BIO_snprintf(ident, max_ident_len, "psk"); |
02e22dd4 DW |
30 | |
31 | if (max_psk_len > 20) | |
32 | max_psk_len = 20; | |
33 | memset(psk, 0x5a, max_psk_len); | |
34 | ||
35 | return max_psk_len; | |
36 | } | |
37 | ||
38 | static unsigned int srvr_psk_callback(SSL *ssl, const char *identity, | |
39 | unsigned char *psk, | |
40 | unsigned int max_psk_len) | |
41 | { | |
42 | if (max_psk_len > 20) | |
43 | max_psk_len = 20; | |
44 | memset(psk, 0x5a, max_psk_len); | |
45 | return max_psk_len; | |
46 | } | |
47 | ||
48 | static int mtu_test(SSL_CTX *ctx, const char *cs, int no_etm) | |
49 | { | |
50 | SSL *srvr_ssl = NULL, *clnt_ssl = NULL; | |
51 | BIO *sc_bio = NULL; | |
52 | int i; | |
53 | size_t s; | |
54 | size_t mtus[30]; | |
55 | unsigned char buf[600]; | |
56 | int rv = 0; | |
57 | ||
58 | memset(buf, 0x5a, sizeof(buf)); | |
59 | ||
60 | if (create_ssl_objects(ctx, ctx, &srvr_ssl, &clnt_ssl, NULL, NULL) != 1) | |
61 | goto out; | |
62 | ||
63 | if (no_etm) | |
64 | SSL_set_options(srvr_ssl, SSL_OP_NO_ENCRYPT_THEN_MAC); | |
65 | ||
66 | if (SSL_set_cipher_list(srvr_ssl, cs) != 1 || | |
67 | SSL_set_cipher_list(clnt_ssl, cs) != 1) { | |
68 | ERR_print_errors_fp(stdout); | |
69 | goto out; | |
70 | } | |
71 | sc_bio = SSL_get_rbio(srvr_ssl); | |
72 | ||
73 | if (create_ssl_connection(clnt_ssl, srvr_ssl) != 1) | |
74 | goto out; | |
75 | ||
76 | if (debug) | |
77 | printf("Channel established\n"); | |
78 | ||
79 | /* For record MTU values between 500 and 539, call DTLS_get_data_mtu() | |
80 | * to query the payload MTU which will fit. */ | |
81 | for (i = 0; i < 30; i++) { | |
82 | SSL_set_mtu(clnt_ssl, 500 + i); | |
83 | mtus[i] = DTLS_get_data_mtu(clnt_ssl); | |
84 | if (debug) | |
85 | printf("%s%s payload MTU for record mtu %d = %"OSSLzu"\n", | |
86 | cs, no_etm ? "-noEtM":"", 500 + i, mtus[i]); | |
87 | if (mtus[i] == 0) { | |
88 | fprintf(stderr, | |
89 | "payload MTU failed with record MTU %d for %s\n", | |
90 | 500 + i, cs); | |
91 | goto out; | |
92 | } | |
93 | } | |
94 | ||
95 | /* Now get out of the way */ | |
96 | SSL_set_mtu(clnt_ssl, 1000); | |
97 | ||
98 | /* Now for all values in the range of payload MTUs, send | |
99 | * a payload of that size and see what actual record size | |
100 | * we end up with. */ | |
101 | for (s = mtus[0]; s <= mtus[29]; s++) { | |
102 | size_t reclen; | |
103 | if (SSL_write(clnt_ssl, buf, s) != (int)s) { | |
104 | ERR_print_errors_fp(stdout); | |
105 | goto out; | |
106 | } | |
107 | reclen = BIO_read(sc_bio, buf, sizeof(buf)); | |
108 | if (debug) | |
109 | printf("record %"OSSLzu" for payload %"OSSLzu"\n", reclen, s); | |
110 | ||
111 | for (i = 0; i < 30; i++) { | |
112 | /* DTLS_get_data_mtu() with record MTU 500+i returned mtus[i] ... */ | |
113 | ||
114 | if (s <= mtus[i] && reclen > (size_t)(500 + i)) { | |
115 | /* We sent a packet smaller than or equal to mtus[j] and | |
116 | * that made a record *larger* than the record MTU 500+j! */ | |
117 | fprintf(stderr, | |
118 | "%s: Payload MTU %"OSSLzu" reported for record MTU %d\n" | |
119 | "but sending a payload of %"OSSLzu" made a record of %"OSSLzu"(too large)\n", | |
120 | cs, mtus[i], 500 + i, s, reclen); | |
121 | goto out; | |
122 | } | |
123 | if (s > mtus[i] && reclen <= (size_t)(500 + i)) { | |
124 | /* We sent a *larger* packet than mtus[i] and that *still* | |
125 | * fits within the record MTU 500+i, so DTLS_get_data_mtu() | |
126 | * was overly pessimistic. */ | |
127 | fprintf(stderr, | |
128 | "%s: Payload MTU %"OSSLzu" reported for record MTU %d\n" | |
129 | "but sending a payload of %"OSSLzu" made a record of %"OSSLzu" (too small)\n", | |
130 | cs, mtus[i], 500 + i, s, reclen); | |
131 | goto out; | |
132 | } | |
133 | } | |
134 | } | |
135 | rv = 1; | |
136 | if (SSL_USE_ETM(clnt_ssl)) | |
137 | rv = 2; | |
138 | out: | |
139 | SSL_free(clnt_ssl); | |
140 | SSL_free(srvr_ssl); | |
141 | return rv; | |
142 | } | |
143 | ||
144 | int main(void) | |
145 | { | |
146 | SSL_CTX *ctx = SSL_CTX_new(DTLS_method()); | |
147 | STACK_OF(SSL_CIPHER) *ciphers; | |
148 | int i, rv = 0; | |
149 | ||
150 | SSL_CTX_set_psk_server_callback(ctx, srvr_psk_callback); | |
151 | SSL_CTX_set_psk_client_callback(ctx, clnt_psk_callback); | |
152 | SSL_CTX_set_security_level(ctx, 0); | |
153 | ||
154 | /* We only care about iterating over each enc/mac; we don't | |
155 | * want to repeat the test for each auth/kx variant. | |
156 | * So keep life simple and only do (non-DH) PSK. */ | |
157 | if (!SSL_CTX_set_cipher_list(ctx, "PSK")) { | |
158 | fprintf(stderr, "Failed to set PSK cipher list\n"); | |
159 | goto out; | |
160 | } | |
161 | ||
162 | ciphers = SSL_CTX_get_ciphers(ctx); | |
163 | for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) { | |
164 | const SSL_CIPHER *cipher = sk_SSL_CIPHER_value(ciphers, i); | |
165 | const char *cipher_name = SSL_CIPHER_get_name(cipher); | |
166 | ||
167 | /* As noted above, only one test for each enc/mac variant. */ | |
168 | if (strncmp(cipher_name, "PSK-", 4)) | |
169 | continue; | |
170 | ||
171 | rv = mtu_test(ctx, cipher_name, 0); | |
172 | if (!rv) | |
173 | break; | |
174 | ||
175 | printf("DTLS MTU test OK for %s\n", cipher_name); | |
176 | if (rv == 1) | |
177 | continue; | |
178 | ||
179 | /* mtu_test() returns 2 if it used Encrypt-then-MAC */ | |
180 | rv = mtu_test(ctx, cipher_name, 1); | |
181 | if (!rv) | |
182 | break; | |
183 | ||
184 | printf("DTLS MTU test OK for %s without Encrypt-then-MAC\n", cipher_name); | |
185 | } | |
186 | out: | |
187 | SSL_CTX_free(ctx); | |
188 | ||
189 | return !rv; | |
190 | } |