2 * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
13 #include <openssl/dtls1.h>
14 #include <openssl/ssl.h>
15 #include <openssl/err.h>
17 #include "ssltestlib.h"
20 /* for SSL_READ_ETM() */
21 #include "../ssl/ssl_local.h"
25 static unsigned int clnt_psk_callback(SSL
*ssl
, const char *hint
,
26 char *ident
, unsigned int max_ident_len
,
28 unsigned int max_psk_len
)
30 BIO_snprintf(ident
, max_ident_len
, "psk");
34 memset(psk
, 0x5a, max_psk_len
);
39 static unsigned int srvr_psk_callback(SSL
*ssl
, const char *identity
,
41 unsigned int max_psk_len
)
45 memset(psk
, 0x5a, max_psk_len
);
49 static int mtu_test(SSL_CTX
*ctx
, const char *cs
, int no_etm
)
51 SSL
*srvr_ssl
= NULL
, *clnt_ssl
= NULL
;
56 unsigned char buf
[600];
59 memset(buf
, 0x5a, sizeof(buf
));
61 if (!TEST_true(create_ssl_objects(ctx
, ctx
, &srvr_ssl
, &clnt_ssl
,
66 SSL_set_options(srvr_ssl
, SSL_OP_NO_ENCRYPT_THEN_MAC
);
68 if (!TEST_true(SSL_set_cipher_list(srvr_ssl
, cs
))
69 || !TEST_true(SSL_set_cipher_list(clnt_ssl
, cs
))
70 || !TEST_ptr(sc_bio
= SSL_get_rbio(srvr_ssl
))
71 || !TEST_true(create_ssl_connection(clnt_ssl
, srvr_ssl
,
76 TEST_info("Channel established");
78 /* For record MTU values between 500 and 539, call DTLS_get_data_mtu()
79 * to query the payload MTU which will fit. */
80 for (i
= 0; i
< 30; i
++) {
81 SSL_set_mtu(clnt_ssl
, 500 + i
);
82 mtus
[i
] = DTLS_get_data_mtu(clnt_ssl
);
84 TEST_info("%s%s MTU for record mtu %d = %lu",
85 cs
, no_etm
? "-noEtM" : "",
86 500 + i
, (unsigned long)mtus
[i
]);
87 if (!TEST_size_t_ne(mtus
[i
], 0)) {
88 TEST_info("Cipher %s MTU %d", cs
, 500 + i
);
93 /* Now get out of the way */
94 SSL_set_mtu(clnt_ssl
, 1000);
97 * Now for all values in the range of payload MTUs, send a payload of
98 * that size and see what actual record size we end up with.
100 for (s
= mtus
[0]; s
<= mtus
[29]; s
++) {
103 if (!TEST_int_eq(SSL_write(clnt_ssl
, buf
, s
), (int)s
))
105 reclen
= BIO_read(sc_bio
, buf
, sizeof(buf
));
107 TEST_info("record %zu for payload %zu", reclen
, s
);
109 for (i
= 0; i
< 30; i
++) {
110 /* DTLS_get_data_mtu() with record MTU 500+i returned mtus[i] ... */
112 if (!TEST_false(s
<= mtus
[i
] && reclen
> (size_t)(500 + i
))) {
114 * We sent a packet smaller than or equal to mtus[j] and
115 * that made a record *larger* than the record MTU 500+j!
117 TEST_error("%s: s=%lu, mtus[i]=%lu, reclen=%lu, i=%d",
118 cs
, (unsigned long)s
, (unsigned long)mtus
[i
],
119 (unsigned long)reclen
, 500 + i
);
122 if (!TEST_false(s
> mtus
[i
] && reclen
<= (size_t)(500 + i
))) {
124 * We sent a *larger* packet than mtus[i] and that *still*
125 * fits within the record MTU 500+i, so DTLS_get_data_mtu()
126 * was overly pessimistic.
128 TEST_error("%s: s=%lu, mtus[i]=%lu, reclen=%lu, i=%d",
129 cs
, (unsigned long)s
, (unsigned long)mtus
[i
],
130 (unsigned long)reclen
, 500 + i
);
136 if (SSL_READ_ETM(clnt_ssl
))
144 static int run_mtu_tests(void)
147 STACK_OF(SSL_CIPHER
) *ciphers
;
150 if (!TEST_ptr(ctx
= SSL_CTX_new(DTLS_method())))
153 SSL_CTX_set_psk_server_callback(ctx
, srvr_psk_callback
);
154 SSL_CTX_set_psk_client_callback(ctx
, clnt_psk_callback
);
155 SSL_CTX_set_security_level(ctx
, 0);
158 * We only care about iterating over each enc/mac; we don't want to
159 * repeat the test for each auth/kx variant. So keep life simple and
160 * only do (non-DH) PSK.
162 if (!TEST_true(SSL_CTX_set_cipher_list(ctx
, "PSK")))
165 ciphers
= SSL_CTX_get_ciphers(ctx
);
166 for (i
= 0; i
< sk_SSL_CIPHER_num(ciphers
); i
++) {
167 const SSL_CIPHER
*cipher
= sk_SSL_CIPHER_value(ciphers
, i
);
168 const char *cipher_name
= SSL_CIPHER_get_name(cipher
);
170 /* As noted above, only one test for each enc/mac variant. */
171 if (strncmp(cipher_name
, "PSK-", 4) != 0)
174 if (!TEST_int_gt(ret
= mtu_test(ctx
, cipher_name
, 0), 0))
176 TEST_info("%s OK", cipher_name
);
180 /* mtu_test() returns 2 if it used Encrypt-then-MAC */
181 if (!TEST_int_gt(ret
= mtu_test(ctx
, cipher_name
, 1), 0))
183 TEST_info("%s without EtM OK", cipher_name
);
188 bio_s_mempacket_test_free();
192 int setup_tests(void)
194 ADD_TEST(run_mtu_tests
);