2 * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
13 #include <openssl/dtls1.h>
14 #include <openssl/ssl.h>
15 #include <openssl/err.h>
17 #include "ssltestlib.h"
19 /* for SSL_READ_ETM() */
20 #include "../ssl/ssl_locl.h"
24 static unsigned int clnt_psk_callback(SSL
*ssl
, const char *hint
,
25 char *ident
, unsigned int max_ident_len
,
27 unsigned int max_psk_len
)
29 BIO_snprintf(ident
, max_ident_len
, "psk");
33 memset(psk
, 0x5a, max_psk_len
);
38 static unsigned int srvr_psk_callback(SSL
*ssl
, const char *identity
,
40 unsigned int max_psk_len
)
44 memset(psk
, 0x5a, max_psk_len
);
48 static int mtu_test(SSL_CTX
*ctx
, const char *cs
, int no_etm
)
50 SSL
*srvr_ssl
= NULL
, *clnt_ssl
= NULL
;
55 unsigned char buf
[600];
58 memset(buf
, 0x5a, sizeof(buf
));
60 if (create_ssl_objects(ctx
, ctx
, &srvr_ssl
, &clnt_ssl
, NULL
, NULL
) != 1)
64 SSL_set_options(srvr_ssl
, SSL_OP_NO_ENCRYPT_THEN_MAC
);
66 if (SSL_set_cipher_list(srvr_ssl
, cs
) != 1 ||
67 SSL_set_cipher_list(clnt_ssl
, cs
) != 1) {
68 ERR_print_errors_fp(stdout
);
71 sc_bio
= SSL_get_rbio(srvr_ssl
);
73 if (create_ssl_connection(clnt_ssl
, srvr_ssl
) != 1)
77 printf("Channel established\n");
79 /* For record MTU values between 500 and 539, call DTLS_get_data_mtu()
80 * to query the payload MTU which will fit. */
81 for (i
= 0; i
< 30; i
++) {
82 SSL_set_mtu(clnt_ssl
, 500 + i
);
83 mtus
[i
] = DTLS_get_data_mtu(clnt_ssl
);
85 printf("%s%s payload MTU for record mtu %d = %"OSSLzu
"\n",
86 cs
, no_etm
? "-noEtM":"", 500 + i
, mtus
[i
]);
89 "payload MTU failed with record MTU %d for %s\n",
95 /* Now get out of the way */
96 SSL_set_mtu(clnt_ssl
, 1000);
98 /* Now for all values in the range of payload MTUs, send
99 * a payload of that size and see what actual record size
101 for (s
= mtus
[0]; s
<= mtus
[29]; s
++) {
103 if (SSL_write(clnt_ssl
, buf
, s
) != (int)s
) {
104 ERR_print_errors_fp(stdout
);
107 reclen
= BIO_read(sc_bio
, buf
, sizeof(buf
));
109 printf("record %"OSSLzu
" for payload %"OSSLzu
"\n", reclen
, s
);
111 for (i
= 0; i
< 30; i
++) {
112 /* DTLS_get_data_mtu() with record MTU 500+i returned mtus[i] ... */
114 if (s
<= mtus
[i
] && reclen
> (size_t)(500 + i
)) {
115 /* We sent a packet smaller than or equal to mtus[j] and
116 * that made a record *larger* than the record MTU 500+j! */
118 "%s: Payload MTU %"OSSLzu
" reported for record MTU %d\n"
119 "but sending a payload of %"OSSLzu
" made a record of %"OSSLzu
"(too large)\n",
120 cs
, mtus
[i
], 500 + i
, s
, reclen
);
123 if (s
> mtus
[i
] && reclen
<= (size_t)(500 + i
)) {
124 /* We sent a *larger* packet than mtus[i] and that *still*
125 * fits within the record MTU 500+i, so DTLS_get_data_mtu()
126 * was overly pessimistic. */
128 "%s: Payload MTU %"OSSLzu
" reported for record MTU %d\n"
129 "but sending a payload of %"OSSLzu
" made a record of %"OSSLzu
" (too small)\n",
130 cs
, mtus
[i
], 500 + i
, s
, reclen
);
136 if (SSL_READ_ETM(clnt_ssl
))
146 SSL_CTX
*ctx
= SSL_CTX_new(DTLS_method());
147 STACK_OF(SSL_CIPHER
) *ciphers
;
150 SSL_CTX_set_psk_server_callback(ctx
, srvr_psk_callback
);
151 SSL_CTX_set_psk_client_callback(ctx
, clnt_psk_callback
);
152 SSL_CTX_set_security_level(ctx
, 0);
154 /* We only care about iterating over each enc/mac; we don't
155 * want to repeat the test for each auth/kx variant.
156 * So keep life simple and only do (non-DH) PSK. */
157 if (!SSL_CTX_set_cipher_list(ctx
, "PSK")) {
158 fprintf(stderr
, "Failed to set PSK cipher list\n");
162 ciphers
= SSL_CTX_get_ciphers(ctx
);
163 for (i
= 0; i
< sk_SSL_CIPHER_num(ciphers
); i
++) {
164 const SSL_CIPHER
*cipher
= sk_SSL_CIPHER_value(ciphers
, i
);
165 const char *cipher_name
= SSL_CIPHER_get_name(cipher
);
167 /* As noted above, only one test for each enc/mac variant. */
168 if (strncmp(cipher_name
, "PSK-", 4))
171 rv
= mtu_test(ctx
, cipher_name
, 0);
175 printf("DTLS MTU test OK for %s\n", cipher_name
);
179 /* mtu_test() returns 2 if it used Encrypt-then-MAC */
180 rv
= mtu_test(ctx
, cipher_name
, 1);
184 printf("DTLS MTU test OK for %s without Encrypt-then-MAC\n", cipher_name
);