2 * Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
12 #include <openssl/opensslconf.h>
13 #include <openssl/bio.h>
14 #include <openssl/crypto.h>
15 #include <openssl/ssl.h>
16 #include <openssl/ocsp.h>
18 #include "ssltestlib.h"
20 #include <internal/nelem.h>
21 #include "../ssl/ssl_locl.h"
23 static char *cert
= NULL
;
24 static char *privkey
= NULL
;
26 #define LOG_BUFFER_SIZE 1024
27 static char server_log_buffer
[LOG_BUFFER_SIZE
+ 1] = {0};
28 static size_t server_log_buffer_index
= 0;
29 static char client_log_buffer
[LOG_BUFFER_SIZE
+ 1] = {0};
30 static size_t client_log_buffer_index
= 0;
31 static int error_writing_log
= 0;
33 #ifndef OPENSSL_NO_OCSP
34 static const unsigned char orespder
[] = "Dummy OCSP Response";
35 static int ocsp_server_called
= 0;
36 static int ocsp_client_called
= 0;
38 static int cdummyarg
= 1;
39 static X509
*ocspcert
= NULL
;
42 #define NUM_EXTRA_CERTS 40
45 * This structure is used to validate that the correct number of log messages
46 * of various types are emitted when emitting secret logs.
48 struct sslapitest_log_counts
{
49 unsigned int rsa_key_exchange_count
;
50 unsigned int master_secret_count
;
51 unsigned int client_handshake_secret_count
;
52 unsigned int server_handshake_secret_count
;
53 unsigned int client_application_secret_count
;
54 unsigned int server_application_secret_count
;
58 static unsigned char serverinfov1
[] = {
59 0xff, 0xff, /* Dummy extension type */
60 0x00, 0x01, /* Extension length is 1 byte */
61 0xff /* Dummy extension data */
64 static unsigned char serverinfov2
[] = {
66 (unsigned char)(SSL_EXT_CLIENT_HELLO
& 0xff), /* Dummy context - 4 bytes */
67 0xff, 0xff, /* Dummy extension type */
68 0x00, 0x01, /* Extension length is 1 byte */
69 0xff /* Dummy extension data */
72 static void client_keylog_callback(const SSL
*ssl
, const char *line
)
74 int line_length
= strlen(line
);
76 /* If the log doesn't fit, error out. */
77 if (client_log_buffer_index
+ line_length
> sizeof(client_log_buffer
) - 1) {
78 TEST_info("Client log too full");
79 error_writing_log
= 1;
83 strcat(client_log_buffer
, line
);
84 client_log_buffer_index
+= line_length
;
85 client_log_buffer
[client_log_buffer_index
++] = '\n';
88 static void server_keylog_callback(const SSL
*ssl
, const char *line
)
90 int line_length
= strlen(line
);
92 /* If the log doesn't fit, error out. */
93 if (server_log_buffer_index
+ line_length
> sizeof(server_log_buffer
) - 1) {
94 TEST_info("Server log too full");
95 error_writing_log
= 1;
99 strcat(server_log_buffer
, line
);
100 server_log_buffer_index
+= line_length
;
101 server_log_buffer
[server_log_buffer_index
++] = '\n';
104 static int compare_hex_encoded_buffer(const char *hex_encoded
,
112 if (!TEST_size_t_eq(raw_length
* 2, hex_length
))
115 for (i
= j
= 0; i
< raw_length
&& j
+ 1 < hex_length
; i
++, j
+= 2) {
116 sprintf(hexed
, "%02x", raw
[i
]);
117 if (!TEST_int_eq(hexed
[0], hex_encoded
[j
])
118 || !TEST_int_eq(hexed
[1], hex_encoded
[j
+ 1]))
125 static int test_keylog_output(char *buffer
, const SSL
*ssl
,
126 const SSL_SESSION
*session
,
127 struct sslapitest_log_counts
*expected
)
130 unsigned char actual_client_random
[SSL3_RANDOM_SIZE
] = {0};
131 size_t client_random_size
= SSL3_RANDOM_SIZE
;
132 unsigned char actual_master_key
[SSL_MAX_MASTER_KEY_LENGTH
] = {0};
133 size_t master_key_size
= SSL_MAX_MASTER_KEY_LENGTH
;
134 unsigned int rsa_key_exchange_count
= 0;
135 unsigned int master_secret_count
= 0;
136 unsigned int client_handshake_secret_count
= 0;
137 unsigned int server_handshake_secret_count
= 0;
138 unsigned int client_application_secret_count
= 0;
139 unsigned int server_application_secret_count
= 0;
141 for (token
= strtok(buffer
, " \n"); token
!= NULL
;
142 token
= strtok(NULL
, " \n")) {
143 if (strcmp(token
, "RSA") == 0) {
145 * Premaster secret. Tokens should be: 16 ASCII bytes of
146 * hex-encoded encrypted secret, then the hex-encoded pre-master
149 if (!TEST_ptr(token
= strtok(NULL
, " \n")))
151 if (!TEST_size_t_eq(strlen(token
), 16))
153 if (!TEST_ptr(token
= strtok(NULL
, " \n")))
156 * We can't sensibly check the log because the premaster secret is
157 * transient, and OpenSSL doesn't keep hold of it once the master
158 * secret is generated.
160 rsa_key_exchange_count
++;
161 } else if (strcmp(token
, "CLIENT_RANDOM") == 0) {
163 * Master secret. Tokens should be: 64 ASCII bytes of hex-encoded
164 * client random, then the hex-encoded master secret.
166 client_random_size
= SSL_get_client_random(ssl
,
167 actual_client_random
,
169 if (!TEST_size_t_eq(client_random_size
, SSL3_RANDOM_SIZE
))
172 if (!TEST_ptr(token
= strtok(NULL
, " \n")))
174 if (!TEST_size_t_eq(strlen(token
), 64))
176 if (!TEST_false(compare_hex_encoded_buffer(token
, 64,
177 actual_client_random
,
178 client_random_size
)))
181 if (!TEST_ptr(token
= strtok(NULL
, " \n")))
183 master_key_size
= SSL_SESSION_get_master_key(session
,
186 if (!TEST_size_t_ne(master_key_size
, 0))
188 if (!TEST_false(compare_hex_encoded_buffer(token
, strlen(token
),
192 master_secret_count
++;
193 } else if (strcmp(token
, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0
194 || strcmp(token
, "SERVER_HANDSHAKE_TRAFFIC_SECRET") == 0
195 || strcmp(token
, "CLIENT_TRAFFIC_SECRET_0") == 0
196 || strcmp(token
, "SERVER_TRAFFIC_SECRET_0") == 0) {
198 * TLSv1.3 secret. Tokens should be: 64 ASCII bytes of hex-encoded
199 * client random, and then the hex-encoded secret. In this case,
200 * we treat all of these secrets identically and then just
201 * distinguish between them when counting what we saw.
203 if (strcmp(token
, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0)
204 client_handshake_secret_count
++;
205 else if (strcmp(token
, "SERVER_HANDSHAKE_TRAFFIC_SECRET") == 0)
206 server_handshake_secret_count
++;
207 else if (strcmp(token
, "CLIENT_TRAFFIC_SECRET_0") == 0)
208 client_application_secret_count
++;
209 else if (strcmp(token
, "SERVER_TRAFFIC_SECRET_0") == 0)
210 server_application_secret_count
++;
212 client_random_size
= SSL_get_client_random(ssl
,
213 actual_client_random
,
215 if (!TEST_size_t_eq(client_random_size
, SSL3_RANDOM_SIZE
))
218 if (!TEST_ptr(token
= strtok(NULL
, " \n")))
220 if (!TEST_size_t_eq(strlen(token
), 64))
222 if (!TEST_false(compare_hex_encoded_buffer(token
, 64,
223 actual_client_random
,
224 client_random_size
)))
227 if (!TEST_ptr(token
= strtok(NULL
, " \n")))
231 * TODO(TLS1.3): test that application traffic secrets are what
234 TEST_info("Unexpected token %s\n", token
);
239 /* Got what we expected? */
240 if (!TEST_size_t_eq(rsa_key_exchange_count
,
241 expected
->rsa_key_exchange_count
)
242 || !TEST_size_t_eq(master_secret_count
,
243 expected
->master_secret_count
)
244 || !TEST_size_t_eq(client_handshake_secret_count
,
245 expected
->client_handshake_secret_count
)
246 || !TEST_size_t_eq(server_handshake_secret_count
,
247 expected
->server_handshake_secret_count
)
248 || !TEST_size_t_eq(client_application_secret_count
,
249 expected
->client_application_secret_count
)
250 || !TEST_size_t_eq(server_application_secret_count
,
251 expected
->server_application_secret_count
))
256 static int test_keylog(void)
258 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
;
259 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
261 struct sslapitest_log_counts expected
= {0};
263 /* Clean up logging space */
264 memset(client_log_buffer
, 0, sizeof(client_log_buffer
));
265 memset(server_log_buffer
, 0, sizeof(server_log_buffer
));
266 client_log_buffer_index
= 0;
267 server_log_buffer_index
= 0;
268 error_writing_log
= 0;
270 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
272 &sctx
, &cctx
, cert
, privkey
)))
275 /* We cannot log the master secret for TLSv1.3, so we should forbid it. */
276 SSL_CTX_set_options(cctx
, SSL_OP_NO_TLSv1_3
);
277 SSL_CTX_set_options(sctx
, SSL_OP_NO_TLSv1_3
);
279 /* We also want to ensure that we use RSA-based key exchange. */
280 if (!TEST_true(SSL_CTX_set_cipher_list(cctx
, "RSA")))
283 if (!TEST_true(SSL_CTX_get_keylog_callback(cctx
) == NULL
)
284 || !TEST_true(SSL_CTX_get_keylog_callback(sctx
) == NULL
))
286 SSL_CTX_set_keylog_callback(cctx
, client_keylog_callback
);
287 if (!TEST_true(SSL_CTX_get_keylog_callback(cctx
)
288 == client_keylog_callback
))
290 SSL_CTX_set_keylog_callback(sctx
, server_keylog_callback
);
291 if (!TEST_true(SSL_CTX_get_keylog_callback(sctx
)
292 == server_keylog_callback
))
295 /* Now do a handshake and check that the logs have been written to. */
296 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
,
297 &clientssl
, NULL
, NULL
))
298 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
300 || !TEST_false(error_writing_log
)
301 || !TEST_int_gt(client_log_buffer_index
, 0)
302 || !TEST_int_gt(server_log_buffer_index
, 0))
306 * Now we want to test that our output data was vaguely sensible. We
307 * do that by using strtok and confirming that we have more or less the
308 * data we expect. For both client and server, we expect to see one master
309 * secret. The client should also see a RSA key exchange.
311 expected
.rsa_key_exchange_count
= 1;
312 expected
.master_secret_count
= 1;
313 if (!TEST_true(test_keylog_output(client_log_buffer
, clientssl
,
314 SSL_get_session(clientssl
), &expected
)))
317 expected
.rsa_key_exchange_count
= 0;
318 if (!TEST_true(test_keylog_output(server_log_buffer
, serverssl
,
319 SSL_get_session(serverssl
), &expected
)))
333 #ifndef OPENSSL_NO_TLS1_3
334 static int test_keylog_no_master_key(void)
336 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
;
337 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
339 struct sslapitest_log_counts expected
= {0};
341 /* Clean up logging space */
342 memset(client_log_buffer
, 0, sizeof(client_log_buffer
));
343 memset(server_log_buffer
, 0, sizeof(server_log_buffer
));
344 client_log_buffer_index
= 0;
345 server_log_buffer_index
= 0;
346 error_writing_log
= 0;
348 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
349 TLS_client_method(), &sctx
,
350 &cctx
, cert
, privkey
)))
353 if (!TEST_true(SSL_CTX_get_keylog_callback(cctx
) == NULL
)
354 || !TEST_true(SSL_CTX_get_keylog_callback(sctx
) == NULL
))
357 SSL_CTX_set_keylog_callback(cctx
, client_keylog_callback
);
358 if (!TEST_true(SSL_CTX_get_keylog_callback(cctx
)
359 == client_keylog_callback
))
362 SSL_CTX_set_keylog_callback(sctx
, server_keylog_callback
);
363 if (!TEST_true(SSL_CTX_get_keylog_callback(sctx
)
364 == server_keylog_callback
))
367 /* Now do a handshake and check that the logs have been written to. */
368 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
,
369 &clientssl
, NULL
, NULL
))
370 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
372 || !TEST_false(error_writing_log
))
376 * Now we want to test that our output data was vaguely sensible. For this
377 * test, we expect no CLIENT_RANDOM entry because it doesn't make sense for
378 * TLSv1.3, but we do expect both client and server to emit keys.
380 expected
.client_handshake_secret_count
= 1;
381 expected
.server_handshake_secret_count
= 1;
382 expected
.client_application_secret_count
= 1;
383 expected
.server_application_secret_count
= 1;
384 if (!TEST_true(test_keylog_output(client_log_buffer
, clientssl
,
385 SSL_get_session(clientssl
), &expected
))
386 || !TEST_true(test_keylog_output(server_log_buffer
, serverssl
,
387 SSL_get_session(serverssl
),
403 #ifndef OPENSSL_NO_TLS1_2
404 static int full_early_callback(SSL
*s
, int *al
, void *arg
)
407 const unsigned char *p
;
409 /* We only configure two ciphers, but the SCSV is added automatically. */
411 const unsigned char expected_ciphers
[] = {0x00, 0x9d, 0x00, 0xff};
413 const unsigned char expected_ciphers
[] = {0x00, 0x9d, 0xc0,
416 const int expected_extensions
[] = {
417 #ifndef OPENSSL_NO_EC
423 /* Make sure we can defer processing and get called back. */
427 len
= SSL_early_get0_ciphers(s
, &p
);
428 if (!TEST_mem_eq(p
, len
, expected_ciphers
, sizeof(expected_ciphers
))
429 || !TEST_size_t_eq(SSL_early_get0_compression_methods(s
, &p
), 1)
430 || !TEST_int_eq(*p
, 0))
432 if (!SSL_early_get1_extensions_present(s
, &exts
, &len
))
434 if (len
!= OSSL_NELEM(expected_extensions
) ||
435 memcmp(exts
, expected_extensions
, len
* sizeof(*exts
)) != 0) {
436 printf("Early callback expected ClientHello extensions mismatch\n");
444 static int test_early_cb(void)
446 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
;
447 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
448 int testctr
= 0, testresult
= 0;
450 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
451 TLS_client_method(), &sctx
,
452 &cctx
, cert
, privkey
)))
454 SSL_CTX_set_early_cb(sctx
, full_early_callback
, &testctr
);
456 /* The gimpy cipher list we configure can't do TLS 1.3. */
457 SSL_CTX_set_max_proto_version(cctx
, TLS1_2_VERSION
);
459 if (!TEST_true(SSL_CTX_set_cipher_list(cctx
,
460 "AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384"))
461 || !TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
,
462 &clientssl
, NULL
, NULL
))
463 || !TEST_false(create_ssl_connection(serverssl
, clientssl
,
464 SSL_ERROR_WANT_EARLY
))
466 * Passing a -1 literal is a hack since
467 * the real value was lost.
469 || !TEST_int_eq(SSL_get_error(serverssl
, -1), SSL_ERROR_WANT_EARLY
)
470 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
486 static int execute_test_large_message(const SSL_METHOD
*smeth
,
487 const SSL_METHOD
*cmeth
, int read_ahead
)
489 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
;
490 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
494 X509
*chaincert
= NULL
;
497 if (!TEST_ptr(certbio
= BIO_new_file(cert
, "r")))
499 chaincert
= PEM_read_bio_X509(certbio
, NULL
, NULL
, NULL
);
502 if (!TEST_ptr(chaincert
))
505 if (!TEST_true(create_ssl_ctx_pair(smeth
, cmeth
, &sctx
,
506 &cctx
, cert
, privkey
)))
511 * Test that read_ahead works correctly when dealing with large
514 SSL_CTX_set_read_ahead(cctx
, 1);
518 * We assume the supplied certificate is big enough so that if we add
519 * NUM_EXTRA_CERTS it will make the overall message large enough. The
520 * default buffer size is requested to be 16k, but due to the way BUF_MEM
521 * works, it ends up allocating a little over 21k (16 * 4/3). So, in this
522 * test we need to have a message larger than that.
524 certlen
= i2d_X509(chaincert
, NULL
);
525 OPENSSL_assert(certlen
* NUM_EXTRA_CERTS
>
526 (SSL3_RT_MAX_PLAIN_LENGTH
* 4) / 3);
527 for (i
= 0; i
< NUM_EXTRA_CERTS
; i
++) {
528 if (!X509_up_ref(chaincert
))
530 if (!SSL_CTX_add_extra_chain_cert(sctx
, chaincert
)) {
531 X509_free(chaincert
);
536 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
, &clientssl
,
538 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
543 * Calling SSL_clear() first is not required but this tests that SSL_clear()
544 * doesn't leak (when using enable-crypto-mdebug).
546 if (!TEST_true(SSL_clear(serverssl
)))
551 X509_free(chaincert
);
560 static int test_large_message_tls(void)
562 return execute_test_large_message(TLS_server_method(), TLS_client_method(),
566 static int test_large_message_tls_read_ahead(void)
568 return execute_test_large_message(TLS_server_method(), TLS_client_method(),
572 #ifndef OPENSSL_NO_DTLS
573 static int test_large_message_dtls(void)
576 * read_ahead is not relevant to DTLS because DTLS always acts as if
579 return execute_test_large_message(DTLS_server_method(),
580 DTLS_client_method(), 0);
584 #ifndef OPENSSL_NO_OCSP
585 static int ocsp_server_cb(SSL
*s
, void *arg
)
587 int *argi
= (int *)arg
;
588 unsigned char *copy
= NULL
;
589 STACK_OF(OCSP_RESPID
) *ids
= NULL
;
590 OCSP_RESPID
*id
= NULL
;
593 /* In this test we are expecting exactly 1 OCSP_RESPID */
594 SSL_get_tlsext_status_ids(s
, &ids
);
595 if (ids
== NULL
|| sk_OCSP_RESPID_num(ids
) != 1)
596 return SSL_TLSEXT_ERR_ALERT_FATAL
;
598 id
= sk_OCSP_RESPID_value(ids
, 0);
599 if (id
== NULL
|| !OCSP_RESPID_match(id
, ocspcert
))
600 return SSL_TLSEXT_ERR_ALERT_FATAL
;
601 } else if (*argi
!= 1) {
602 return SSL_TLSEXT_ERR_ALERT_FATAL
;
605 if (!TEST_ptr(copy
= OPENSSL_memdup(orespder
, sizeof(orespder
))))
606 return SSL_TLSEXT_ERR_ALERT_FATAL
;
608 SSL_set_tlsext_status_ocsp_resp(s
, copy
, sizeof(orespder
));
609 ocsp_server_called
= 1;
610 return SSL_TLSEXT_ERR_OK
;
613 static int ocsp_client_cb(SSL
*s
, void *arg
)
615 int *argi
= (int *)arg
;
616 const unsigned char *respderin
;
619 if (*argi
!= 1 && *argi
!= 2)
622 len
= SSL_get_tlsext_status_ocsp_resp(s
, &respderin
);
623 if (!TEST_mem_eq(orespder
, len
, respderin
, len
))
626 ocsp_client_called
= 1;
630 static int test_tlsext_status_type(void)
632 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
;
633 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
635 STACK_OF(OCSP_RESPID
) *ids
= NULL
;
636 OCSP_RESPID
*id
= NULL
;
639 if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), &sctx
,
640 &cctx
, cert
, privkey
))
643 if (SSL_CTX_get_tlsext_status_type(cctx
) != -1)
646 /* First just do various checks getting and setting tlsext_status_type */
648 clientssl
= SSL_new(cctx
);
649 if (!TEST_int_eq(SSL_get_tlsext_status_type(clientssl
), -1)
650 || !TEST_true(SSL_set_tlsext_status_type(clientssl
,
651 TLSEXT_STATUSTYPE_ocsp
))
652 || !TEST_int_eq(SSL_get_tlsext_status_type(clientssl
),
653 TLSEXT_STATUSTYPE_ocsp
))
659 if (!SSL_CTX_set_tlsext_status_type(cctx
, TLSEXT_STATUSTYPE_ocsp
)
660 || SSL_CTX_get_tlsext_status_type(cctx
) != TLSEXT_STATUSTYPE_ocsp
)
663 clientssl
= SSL_new(cctx
);
664 if (SSL_get_tlsext_status_type(clientssl
) != TLSEXT_STATUSTYPE_ocsp
)
670 * Now actually do a handshake and check OCSP information is exchanged and
671 * the callbacks get called
673 SSL_CTX_set_tlsext_status_cb(cctx
, ocsp_client_cb
);
674 SSL_CTX_set_tlsext_status_arg(cctx
, &cdummyarg
);
675 SSL_CTX_set_tlsext_status_cb(sctx
, ocsp_server_cb
);
676 SSL_CTX_set_tlsext_status_arg(sctx
, &cdummyarg
);
677 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
,
678 &clientssl
, NULL
, NULL
))
679 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
681 || !TEST_true(ocsp_client_called
)
682 || !TEST_true(ocsp_server_called
))
689 /* Try again but this time force the server side callback to fail */
690 ocsp_client_called
= 0;
691 ocsp_server_called
= 0;
693 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
,
694 &clientssl
, NULL
, NULL
))
695 /* This should fail because the callback will fail */
696 || !TEST_false(create_ssl_connection(serverssl
, clientssl
,
698 || !TEST_false(ocsp_client_called
)
699 || !TEST_false(ocsp_server_called
))
707 * This time we'll get the client to send an OCSP_RESPID that it will
710 ocsp_client_called
= 0;
711 ocsp_server_called
= 0;
713 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
,
714 &clientssl
, NULL
, NULL
)))
718 * We'll just use any old cert for this test - it doesn't have to be an OCSP
719 * specific one. We'll use the server cert.
721 if (!TEST_ptr(certbio
= BIO_new_file(cert
, "r"))
722 || !TEST_ptr(id
= OCSP_RESPID_new())
723 || !TEST_ptr(ids
= sk_OCSP_RESPID_new_null())
724 || !TEST_ptr(ocspcert
= PEM_read_bio_X509(certbio
,
726 || !TEST_true(OCSP_RESPID_set_by_key(id
, ocspcert
))
727 || !TEST_true(sk_OCSP_RESPID_push(ids
, id
)))
730 SSL_set_tlsext_status_ids(clientssl
, ids
);
731 /* Control has been transferred */
737 if (!TEST_true(create_ssl_connection(serverssl
, clientssl
,
739 || !TEST_true(ocsp_client_called
)
740 || !TEST_true(ocsp_server_called
))
750 sk_OCSP_RESPID_pop_free(ids
, OCSP_RESPID_free
);
751 OCSP_RESPID_free(id
);
760 static int new_called
= 0, remove_called
= 0;
762 static int new_session_cb(SSL
*ssl
, SSL_SESSION
*sess
)
766 * sess has been up-refed for us, but we don't actually need it so free it
769 SSL_SESSION_free(sess
);
773 static void remove_session_cb(SSL_CTX
*ctx
, SSL_SESSION
*sess
)
778 static SSL_SESSION
*get_sess_val
= NULL
;
780 static SSL_SESSION
*get_session_cb(SSL
*ssl
, const unsigned char *id
, int len
,
788 static int execute_test_session(int maxprot
, int use_int_cache
,
791 SSL_CTX
*sctx
= NULL
, *cctx
= NULL
;
792 SSL
*serverssl1
= NULL
, *clientssl1
= NULL
;
793 SSL
*serverssl2
= NULL
, *clientssl2
= NULL
;
794 #ifndef OPENSSL_NO_TLS1_1
795 SSL
*serverssl3
= NULL
, *clientssl3
= NULL
;
797 SSL_SESSION
*sess1
= NULL
, *sess2
= NULL
;
800 new_called
= remove_called
= 0;
802 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
803 TLS_client_method(), &sctx
,
804 &cctx
, cert
, privkey
)))
808 * Only allow the max protocol version so we can force a connection failure
811 SSL_CTX_set_min_proto_version(cctx
, maxprot
);
812 SSL_CTX_set_max_proto_version(cctx
, maxprot
);
814 /* Set up session cache */
816 SSL_CTX_sess_set_new_cb(cctx
, new_session_cb
);
817 SSL_CTX_sess_set_remove_cb(cctx
, remove_session_cb
);
820 /* Also covers instance where both are set */
821 SSL_CTX_set_session_cache_mode(cctx
, SSL_SESS_CACHE_CLIENT
);
823 SSL_CTX_set_session_cache_mode(cctx
,
824 SSL_SESS_CACHE_CLIENT
825 | SSL_SESS_CACHE_NO_INTERNAL_STORE
);
828 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl1
, &clientssl1
,
830 || !TEST_true(create_ssl_connection(serverssl1
, clientssl1
,
832 || !TEST_ptr(sess1
= SSL_get1_session(clientssl1
)))
835 /* Should fail because it should already be in the cache */
836 if (use_int_cache
&& !TEST_false(SSL_CTX_add_session(cctx
, sess1
)))
839 && (!TEST_int_eq(new_called
, 1) || !TEST_int_eq(remove_called
, 0)))
842 new_called
= remove_called
= 0;
843 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl2
,
844 &clientssl2
, NULL
, NULL
))
845 || !TEST_true(SSL_set_session(clientssl2
, sess1
))
846 || !TEST_true(create_ssl_connection(serverssl2
, clientssl2
,
848 || !TEST_true(SSL_session_reused(clientssl2
)))
851 if (maxprot
== TLS1_3_VERSION
) {
853 * In TLSv1.3 we should have created a new session even though we have
854 * resumed. The original session should also have been removed.
857 && (!TEST_int_eq(new_called
, 1)
858 || !TEST_int_eq(remove_called
, 1)))
862 * In TLSv1.2 we expect to have resumed so no sessions added or
866 && (!TEST_int_eq(new_called
, 0)
867 || !TEST_int_eq(remove_called
, 0)))
871 SSL_SESSION_free(sess1
);
872 if (!TEST_ptr(sess1
= SSL_get1_session(clientssl2
)))
874 shutdown_ssl_connection(serverssl2
, clientssl2
);
875 serverssl2
= clientssl2
= NULL
;
877 new_called
= remove_called
= 0;
878 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl2
,
879 &clientssl2
, NULL
, NULL
))
880 || !TEST_true(create_ssl_connection(serverssl2
, clientssl2
,
884 if (!TEST_ptr(sess2
= SSL_get1_session(clientssl2
)))
888 && (!TEST_int_eq(new_called
, 1) || !TEST_int_eq(remove_called
, 0)))
891 new_called
= remove_called
= 0;
893 * This should clear sess2 from the cache because it is a "bad" session.
894 * See SSL_set_session() documentation.
896 if (!TEST_true(SSL_set_session(clientssl2
, sess1
)))
899 && (!TEST_int_eq(new_called
, 0) || !TEST_int_eq(remove_called
, 1)))
901 if (!TEST_ptr_eq(SSL_get_session(clientssl2
), sess1
))
905 /* Should succeeded because it should not already be in the cache */
906 if (!TEST_true(SSL_CTX_add_session(cctx
, sess2
))
907 || !TEST_true(SSL_CTX_remove_session(cctx
, sess2
)))
911 new_called
= remove_called
= 0;
912 /* This shouldn't be in the cache so should fail */
913 if (!TEST_false(SSL_CTX_remove_session(cctx
, sess2
)))
917 && (!TEST_int_eq(new_called
, 0) || !TEST_int_eq(remove_called
, 1)))
920 #if !defined(OPENSSL_NO_TLS1_1)
921 new_called
= remove_called
= 0;
922 /* Force a connection failure */
923 SSL_CTX_set_max_proto_version(sctx
, TLS1_1_VERSION
);
924 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl3
,
925 &clientssl3
, NULL
, NULL
))
926 || !TEST_true(SSL_set_session(clientssl3
, sess1
))
927 /* This should fail because of the mismatched protocol versions */
928 || !TEST_false(create_ssl_connection(serverssl3
, clientssl3
,
932 /* We should have automatically removed the session from the cache */
934 && (!TEST_int_eq(new_called
, 0) || !TEST_int_eq(remove_called
, 1)))
937 /* Should succeed because it should not already be in the cache */
938 if (use_int_cache
&& !TEST_true(SSL_CTX_add_session(cctx
, sess2
)))
942 /* Now do some tests for server side caching */
944 SSL_CTX_sess_set_new_cb(cctx
, NULL
);
945 SSL_CTX_sess_set_remove_cb(cctx
, NULL
);
946 SSL_CTX_sess_set_new_cb(sctx
, new_session_cb
);
947 SSL_CTX_sess_set_remove_cb(sctx
, remove_session_cb
);
948 SSL_CTX_sess_set_get_cb(sctx
, get_session_cb
);
952 SSL_CTX_set_session_cache_mode(cctx
, 0);
953 /* Internal caching is the default on the server side */
955 SSL_CTX_set_session_cache_mode(sctx
,
956 SSL_SESS_CACHE_SERVER
957 | SSL_SESS_CACHE_NO_INTERNAL_STORE
);
959 SSL_free(serverssl1
);
960 SSL_free(clientssl1
);
961 serverssl1
= clientssl1
= NULL
;
962 SSL_free(serverssl2
);
963 SSL_free(clientssl2
);
964 serverssl2
= clientssl2
= NULL
;
965 SSL_SESSION_free(sess1
);
967 SSL_SESSION_free(sess2
);
970 SSL_CTX_set_max_proto_version(sctx
, maxprot
);
971 SSL_CTX_set_options(sctx
, SSL_OP_NO_TICKET
);
972 new_called
= remove_called
= 0;
973 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl1
, &clientssl1
,
975 || !TEST_true(create_ssl_connection(serverssl1
, clientssl1
,
977 || !TEST_ptr(sess1
= SSL_get1_session(clientssl1
))
978 || !TEST_ptr(sess2
= SSL_get1_session(serverssl1
)))
981 /* Should fail because it should already be in the cache */
982 if (use_int_cache
&& !TEST_false(SSL_CTX_add_session(sctx
, sess2
)))
986 SSL_SESSION
*tmp
= sess2
;
988 if (!TEST_int_eq(new_called
, 1) || !TEST_int_eq(remove_called
, 0))
991 * Delete the session from the internal cache to force a lookup from
992 * the external cache. We take a copy first because
993 * SSL_CTX_remove_session() also marks the session as non-resumable.
996 if (!TEST_ptr(tmp
= SSL_SESSION_dup(sess2
))
997 || !TEST_true(SSL_CTX_remove_session(sctx
, sess2
)))
999 SSL_SESSION_free(sess2
);
1004 new_called
= remove_called
= 0;
1005 get_sess_val
= sess2
;
1006 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl2
,
1007 &clientssl2
, NULL
, NULL
))
1008 || !TEST_true(SSL_set_session(clientssl2
, sess1
))
1009 || !TEST_true(create_ssl_connection(serverssl2
, clientssl2
,
1011 || !TEST_true(SSL_session_reused(clientssl2
)))
1015 && (!TEST_int_eq(new_called
, 0)
1016 || !TEST_int_eq(remove_called
, 0)))
1022 SSL_free(serverssl1
);
1023 SSL_free(clientssl1
);
1024 SSL_free(serverssl2
);
1025 SSL_free(clientssl2
);
1026 #ifndef OPENSSL_NO_TLS1_1
1027 SSL_free(serverssl3
);
1028 SSL_free(clientssl3
);
1030 SSL_SESSION_free(sess1
);
1031 SSL_SESSION_free(sess2
);
1038 static int test_session_with_only_int_cache(void)
1040 #ifndef OPENSSL_NO_TLS1_3
1041 if (!execute_test_session(TLS1_3_VERSION
, 1, 0))
1045 #ifndef OPENSSL_NO_TLS1_2
1046 return execute_test_session(TLS1_2_VERSION
, 1, 0);
1052 static int test_session_with_only_ext_cache(void)
1054 #ifndef OPENSSL_NO_TLS1_3
1055 if (!execute_test_session(TLS1_3_VERSION
, 0, 1))
1059 #ifndef OPENSSL_NO_TLS1_2
1060 return execute_test_session(TLS1_2_VERSION
, 0, 1);
1066 static int test_session_with_both_cache(void)
1068 #ifndef OPENSSL_NO_TLS1_3
1069 if (!execute_test_session(TLS1_3_VERSION
, 1, 1))
1073 #ifndef OPENSSL_NO_TLS1_2
1074 return execute_test_session(TLS1_2_VERSION
, 1, 1);
1084 #define TOTAL_SSL_SET_BIO_TESTS (3 * 3 * 3 * 3)
1086 static void setupbio(BIO
**res
, BIO
*bio1
, BIO
*bio2
, int type
)
1101 static int test_ssl_set_bio(int idx
)
1106 BIO
*irbio
= NULL
, *iwbio
= NULL
, *nrbio
= NULL
, *nwbio
= NULL
;
1108 int initrbio
, initwbio
, newrbio
, newwbio
;
1118 if (!TEST_int_le(newwbio
, 2))
1121 if (!TEST_ptr(ctx
= SSL_CTX_new(TLS_method()))
1122 || !TEST_ptr(ssl
= SSL_new(ctx
)))
1125 if (initrbio
== USE_BIO_1
1126 || initwbio
== USE_BIO_1
1127 || newrbio
== USE_BIO_1
1128 || newwbio
== USE_BIO_1
) {
1129 if (!TEST_ptr(bio1
= BIO_new(BIO_s_mem())))
1133 if (initrbio
== USE_BIO_2
1134 || initwbio
== USE_BIO_2
1135 || newrbio
== USE_BIO_2
1136 || newwbio
== USE_BIO_2
) {
1137 if (!TEST_ptr(bio2
= BIO_new(BIO_s_mem())))
1141 setupbio(&irbio
, bio1
, bio2
, initrbio
);
1142 setupbio(&iwbio
, bio1
, bio2
, initwbio
);
1145 * We want to maintain our own refs to these BIO, so do an up ref for each
1146 * BIO that will have ownership transferred in the SSL_set_bio() call
1150 if (iwbio
!= NULL
&& iwbio
!= irbio
)
1153 SSL_set_bio(ssl
, irbio
, iwbio
);
1155 setupbio(&nrbio
, bio1
, bio2
, newrbio
);
1156 setupbio(&nwbio
, bio1
, bio2
, newwbio
);
1159 * We will (maybe) transfer ownership again so do more up refs.
1160 * SSL_set_bio() has some really complicated ownership rules where BIOs have
1165 && (nwbio
!= iwbio
|| nrbio
!= nwbio
))
1169 && (nwbio
!= iwbio
|| (nwbio
== iwbio
&& irbio
== iwbio
)))
1172 SSL_set_bio(ssl
, nrbio
, nwbio
);
1182 * This test is checking that the ref counting for SSL_set_bio is correct.
1183 * If we get here and we did too many frees then we will fail in the above
1184 * functions. If we haven't done enough then this will only be detected in
1185 * a crypto-mdebug build
1191 typedef enum { NO_BIO_CHANGE
, CHANGE_RBIO
, CHANGE_WBIO
} bio_change_t
;
1193 static int execute_test_ssl_bio(int pop_ssl
, bio_change_t change_bio
)
1195 BIO
*sslbio
= NULL
, *membio1
= NULL
, *membio2
= NULL
;
1200 if (!TEST_ptr(ctx
= SSL_CTX_new(TLS_method()))
1201 || !TEST_ptr(ssl
= SSL_new(ctx
))
1202 || !TEST_ptr(sslbio
= BIO_new(BIO_f_ssl()))
1203 || !TEST_ptr(membio1
= BIO_new(BIO_s_mem())))
1206 BIO_set_ssl(sslbio
, ssl
, BIO_CLOSE
);
1209 * If anything goes wrong here then we could leak memory, so this will
1210 * be caught in a crypto-mdebug build
1212 BIO_push(sslbio
, membio1
);
1214 /* Verify changing the rbio/wbio directly does not cause leaks */
1215 if (change_bio
!= NO_BIO_CHANGE
) {
1216 if (!TEST_ptr(membio2
= BIO_new(BIO_s_mem())))
1218 if (change_bio
== CHANGE_RBIO
)
1219 SSL_set0_rbio(ssl
, membio2
);
1221 SSL_set0_wbio(ssl
, membio2
);
1240 static int test_ssl_bio_pop_next_bio(void)
1242 return execute_test_ssl_bio(0, NO_BIO_CHANGE
);
1245 static int test_ssl_bio_pop_ssl_bio(void)
1247 return execute_test_ssl_bio(1, NO_BIO_CHANGE
);
1250 static int test_ssl_bio_change_rbio(void)
1252 return execute_test_ssl_bio(0, CHANGE_RBIO
);
1255 static int test_ssl_bio_change_wbio(void)
1257 return execute_test_ssl_bio(0, CHANGE_WBIO
);
1261 /* The list of sig algs */
1263 /* The length of the list */
1265 /* A sigalgs list in string format */
1266 const char *liststr
;
1267 /* Whether setting the list should succeed */
1269 /* Whether creating a connection with the list should succeed */
1273 static const int validlist1
[] = {NID_sha256
, EVP_PKEY_RSA
};
1274 #ifndef OPENSSL_NO_EC
1275 static const int validlist2
[] = {NID_sha256
, EVP_PKEY_RSA
, NID_sha512
, EVP_PKEY_EC
};
1276 static const int validlist3
[] = {NID_sha512
, EVP_PKEY_EC
};
1278 static const int invalidlist1
[] = {NID_undef
, EVP_PKEY_RSA
};
1279 static const int invalidlist2
[] = {NID_sha256
, NID_undef
};
1280 static const int invalidlist3
[] = {NID_sha256
, EVP_PKEY_RSA
, NID_sha256
};
1281 static const int invalidlist4
[] = {NID_sha256
};
1282 static const sigalgs_list testsigalgs
[] = {
1283 {validlist1
, OSSL_NELEM(validlist1
), NULL
, 1, 1},
1284 #ifndef OPENSSL_NO_EC
1285 {validlist2
, OSSL_NELEM(validlist2
), NULL
, 1, 1},
1286 {validlist3
, OSSL_NELEM(validlist3
), NULL
, 1, 0},
1288 {NULL
, 0, "RSA+SHA256", 1, 1},
1289 #ifndef OPENSSL_NO_EC
1290 {NULL
, 0, "RSA+SHA256:ECDSA+SHA512", 1, 1},
1291 {NULL
, 0, "ECDSA+SHA512", 1, 0},
1293 {invalidlist1
, OSSL_NELEM(invalidlist1
), NULL
, 0, 0},
1294 {invalidlist2
, OSSL_NELEM(invalidlist2
), NULL
, 0, 0},
1295 {invalidlist3
, OSSL_NELEM(invalidlist3
), NULL
, 0, 0},
1296 {invalidlist4
, OSSL_NELEM(invalidlist4
), NULL
, 0, 0},
1297 {NULL
, 0, "RSA", 0, 0},
1298 {NULL
, 0, "SHA256", 0, 0},
1299 {NULL
, 0, "RSA+SHA256:SHA256", 0, 0},
1300 {NULL
, 0, "Invalid", 0, 0}
1303 static int test_set_sigalgs(int idx
)
1305 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
;
1306 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
1308 const sigalgs_list
*curr
;
1311 /* Should never happen */
1312 if (!TEST_size_t_le((size_t)idx
, OSSL_NELEM(testsigalgs
) * 2))
1315 testctx
= ((size_t)idx
< OSSL_NELEM(testsigalgs
));
1316 curr
= testctx
? &testsigalgs
[idx
]
1317 : &testsigalgs
[idx
- OSSL_NELEM(testsigalgs
)];
1319 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
1320 TLS_client_method(), &sctx
,
1321 &cctx
, cert
, privkey
)))
1325 * TODO(TLS1.3): These APIs cannot set TLSv1.3 sig algs so we just test it
1326 * for TLSv1.2 for now until we add a new API.
1328 SSL_CTX_set_max_proto_version(cctx
, TLS1_2_VERSION
);
1333 if (curr
->list
!= NULL
)
1334 ret
= SSL_CTX_set1_sigalgs(cctx
, curr
->list
, curr
->listlen
);
1336 ret
= SSL_CTX_set1_sigalgs_list(cctx
, curr
->liststr
);
1340 TEST_info("Failure setting sigalgs in SSL_CTX (%d)\n", idx
);
1346 TEST_info("Not-failed setting sigalgs in SSL_CTX (%d)\n", idx
);
1351 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
,
1352 &clientssl
, NULL
, NULL
)))
1358 if (curr
->list
!= NULL
)
1359 ret
= SSL_set1_sigalgs(clientssl
, curr
->list
, curr
->listlen
);
1361 ret
= SSL_set1_sigalgs_list(clientssl
, curr
->liststr
);
1364 TEST_info("Failure setting sigalgs in SSL (%d)\n", idx
);
1373 if (!TEST_int_eq(create_ssl_connection(serverssl
, clientssl
,
1381 SSL_free(serverssl
);
1382 SSL_free(clientssl
);
1389 #ifndef OPENSSL_NO_TLS1_3
1391 #define MSG1 "Hello"
1392 #define MSG2 "World."
1397 #define MSG7 "message."
1400 * Helper method to setup objects for early data test. Caller frees objects on
1403 static int setupearly_data_test(SSL_CTX
**cctx
, SSL_CTX
**sctx
, SSL
**clientssl
,
1404 SSL
**serverssl
, SSL_SESSION
**sess
, int idx
)
1406 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
1407 TLS_client_method(), sctx
,
1408 cctx
, cert
, privkey
)))
1411 /* When idx == 1 we repeat the tests with read_ahead set */
1413 SSL_CTX_set_read_ahead(*cctx
, 1);
1414 SSL_CTX_set_read_ahead(*sctx
, 1);
1417 if (!TEST_true(create_ssl_objects(*sctx
, *cctx
, serverssl
, clientssl
,
1419 || !TEST_true(create_ssl_connection(*serverssl
, *clientssl
,
1423 *sess
= SSL_get1_session(*clientssl
);
1424 SSL_shutdown(*clientssl
);
1425 SSL_shutdown(*serverssl
);
1426 SSL_free(*serverssl
);
1427 SSL_free(*clientssl
);
1428 *serverssl
= *clientssl
= NULL
;
1430 if (!TEST_true(create_ssl_objects(*sctx
, *cctx
, serverssl
,
1431 clientssl
, NULL
, NULL
))
1432 || !TEST_true(SSL_set_session(*clientssl
, *sess
)))
1438 static int test_early_data_read_write(int idx
)
1440 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
;
1441 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
1443 SSL_SESSION
*sess
= NULL
;
1444 unsigned char buf
[20], data
[1024];
1445 size_t readbytes
, written
, eoedlen
, rawread
, rawwritten
;
1448 if (!TEST_true(setupearly_data_test(&cctx
, &sctx
, &clientssl
,
1449 &serverssl
, &sess
, idx
)))
1452 /* Write and read some early data */
1453 if (!TEST_true(SSL_write_early_data(clientssl
, MSG1
, strlen(MSG1
),
1455 || !TEST_size_t_eq(written
, strlen(MSG1
))
1456 || !TEST_int_eq(SSL_read_early_data(serverssl
, buf
,
1457 sizeof(buf
), &readbytes
),
1458 SSL_READ_EARLY_DATA_SUCCESS
)
1459 || !TEST_mem_eq(MSG1
, readbytes
, buf
, strlen(MSG1
))
1460 || !TEST_int_eq(SSL_get_early_data_status(serverssl
),
1461 SSL_EARLY_DATA_ACCEPTED
))
1465 * Server should be able to write data, and client should be able to
1468 if (!TEST_true(SSL_write_early_data(serverssl
, MSG2
, strlen(MSG2
),
1470 || !TEST_size_t_eq(written
, strlen(MSG2
))
1471 || !TEST_true(SSL_read_ex(clientssl
, buf
, sizeof(buf
), &readbytes
))
1472 || !TEST_mem_eq(buf
, readbytes
, MSG2
, strlen(MSG2
)))
1475 /* Even after reading normal data, client should be able write early data */
1476 if (!TEST_true(SSL_write_early_data(clientssl
, MSG3
, strlen(MSG3
),
1478 || !TEST_size_t_eq(written
, strlen(MSG3
)))
1481 /* Server should still be able read early data after writing data */
1482 if (!TEST_int_eq(SSL_read_early_data(serverssl
, buf
, sizeof(buf
),
1484 SSL_READ_EARLY_DATA_SUCCESS
)
1485 || !TEST_mem_eq(buf
, readbytes
, MSG3
, strlen(MSG3
)))
1488 /* Write more data from server and read it from client */
1489 if (!TEST_true(SSL_write_early_data(serverssl
, MSG4
, strlen(MSG4
),
1491 || !TEST_size_t_eq(written
, strlen(MSG4
))
1492 || !TEST_true(SSL_read_ex(clientssl
, buf
, sizeof(buf
), &readbytes
))
1493 || !TEST_mem_eq(buf
, readbytes
, MSG4
, strlen(MSG4
)))
1497 * If client writes normal data it should mean writing early data is no
1500 if (!TEST_true(SSL_write_ex(clientssl
, MSG5
, strlen(MSG5
), &written
))
1501 || !TEST_size_t_eq(written
, strlen(MSG5
))
1502 || !TEST_int_eq(SSL_get_early_data_status(clientssl
),
1503 SSL_EARLY_DATA_ACCEPTED
))
1507 * At this point the client has written EndOfEarlyData, ClientFinished and
1508 * normal (fully protected) data. We are going to cause a delay between the
1509 * arrival of EndOfEarlyData and ClientFinished. We read out all the data
1510 * in the read BIO, and then just put back the EndOfEarlyData message.
1512 rbio
= SSL_get_rbio(serverssl
);
1513 if (!TEST_true(BIO_read_ex(rbio
, data
, sizeof(data
), &rawread
))
1514 || !TEST_size_t_lt(rawread
, sizeof(data
))
1515 || !TEST_size_t_gt(rawread
, SSL3_RT_HEADER_LENGTH
))
1518 /* Record length is in the 4th and 5th bytes of the record header */
1519 eoedlen
= SSL3_RT_HEADER_LENGTH
+ (data
[3] << 8 | data
[4]);
1520 if (!TEST_true(BIO_write_ex(rbio
, data
, eoedlen
, &rawwritten
))
1521 || !TEST_size_t_eq(rawwritten
, eoedlen
))
1524 /* Server should be told that there is no more early data */
1525 if (!TEST_int_eq(SSL_read_early_data(serverssl
, buf
, sizeof(buf
),
1527 SSL_READ_EARLY_DATA_FINISH
)
1528 || !TEST_size_t_eq(readbytes
, 0))
1532 * Server has not finished init yet, so should still be able to write early
1535 if (!TEST_true(SSL_write_early_data(serverssl
, MSG6
, strlen(MSG6
),
1537 || !TEST_size_t_eq(written
, strlen(MSG6
)))
1540 /* Push the ClientFinished and the normal data back into the server rbio */
1541 if (!TEST_true(BIO_write_ex(rbio
, data
+ eoedlen
, rawread
- eoedlen
,
1543 || !TEST_size_t_eq(rawwritten
, rawread
- eoedlen
))
1546 /* Server should be able to read normal data */
1547 if (!TEST_true(SSL_read_ex(serverssl
, buf
, sizeof(buf
), &readbytes
))
1548 || !TEST_size_t_eq(readbytes
, strlen(MSG5
)))
1551 /* Client and server should not be able to write/read early data now */
1552 if (!TEST_false(SSL_write_early_data(clientssl
, MSG6
, strlen(MSG6
),
1556 if (!TEST_int_eq(SSL_read_early_data(serverssl
, buf
, sizeof(buf
),
1558 SSL_READ_EARLY_DATA_ERROR
))
1562 /* Client should be able to read the data sent by the server */
1563 if (!TEST_true(SSL_read_ex(clientssl
, buf
, sizeof(buf
), &readbytes
))
1564 || !TEST_mem_eq(buf
, readbytes
, MSG6
, strlen(MSG6
)))
1568 * Make sure we process the NewSessionTicket. This arrives post-handshake.
1569 * We attempt a read which we do not expect to return any data.
1571 if (!TEST_false(SSL_read_ex(clientssl
, buf
, sizeof(buf
), &readbytes
)))
1574 /* Server should be able to write normal data */
1575 if (!TEST_true(SSL_write_ex(serverssl
, MSG7
, strlen(MSG7
), &written
))
1576 || !TEST_size_t_eq(written
, strlen(MSG7
))
1577 || !TEST_true(SSL_read_ex(clientssl
, buf
, sizeof(buf
), &readbytes
))
1578 || !TEST_mem_eq(buf
, readbytes
, MSG7
, strlen(MSG7
)))
1581 SSL_SESSION_free(sess
);
1582 sess
= SSL_get1_session(clientssl
);
1584 SSL_shutdown(clientssl
);
1585 SSL_shutdown(serverssl
);
1586 SSL_free(serverssl
);
1587 SSL_free(clientssl
);
1588 serverssl
= clientssl
= NULL
;
1589 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
,
1590 &clientssl
, NULL
, NULL
))
1591 || !TEST_true(SSL_set_session(clientssl
, sess
)))
1594 /* Write and read some early data */
1595 if (!TEST_true(SSL_write_early_data(clientssl
, MSG1
, strlen(MSG1
),
1597 || !TEST_size_t_eq(written
, strlen(MSG1
))
1598 || !TEST_int_eq(SSL_read_early_data(serverssl
, buf
, sizeof(buf
),
1600 SSL_READ_EARLY_DATA_SUCCESS
)
1601 || !TEST_mem_eq(buf
, readbytes
, MSG1
, strlen(MSG1
)))
1604 if (!TEST_int_gt(SSL_connect(clientssl
), 0)
1605 || !TEST_int_gt(SSL_accept(serverssl
), 0))
1608 /* Client and server should not be able to write/read early data now */
1609 if (!TEST_false(SSL_write_early_data(clientssl
, MSG6
, strlen(MSG6
),
1613 if (!TEST_int_eq(SSL_read_early_data(serverssl
, buf
, sizeof(buf
),
1615 SSL_READ_EARLY_DATA_ERROR
))
1619 /* Client and server should be able to write/read normal data */
1620 if (!TEST_true(SSL_write_ex(clientssl
, MSG5
, strlen(MSG5
), &written
))
1621 || !TEST_size_t_eq(written
, strlen(MSG5
))
1622 || !TEST_true(SSL_read_ex(serverssl
, buf
, sizeof(buf
), &readbytes
))
1623 || !TEST_size_t_eq(readbytes
, strlen(MSG5
)))
1629 SSL_SESSION_free(sess
);
1630 SSL_free(serverssl
);
1631 SSL_free(clientssl
);
1638 * Helper function to test that a server attempting to read early data can
1639 * handle a connection from a client where the early data should be skipped.
1641 static int early_data_skip_helper(int hrr
, int idx
)
1643 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
;
1644 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
1646 SSL_SESSION
*sess
= NULL
;
1647 unsigned char buf
[20];
1648 size_t readbytes
, written
;
1650 if (!TEST_true(setupearly_data_test(&cctx
, &sctx
, &clientssl
,
1651 &serverssl
, &sess
, idx
)))
1655 /* Force an HRR to occur */
1656 if (!TEST_true(SSL_set1_groups_list(serverssl
, "P-256")))
1660 * Deliberately corrupt the creation time. We take 20 seconds off the
1661 * time. It could be any value as long as it is not within tolerance.
1662 * This should mean the ticket is rejected.
1664 if (!TEST_true(SSL_SESSION_set_time(sess
, time(NULL
) - 20)))
1668 /* Write some early data */
1669 if (!TEST_true(SSL_write_early_data(clientssl
, MSG1
, strlen(MSG1
),
1671 || !TEST_size_t_eq(written
, strlen(MSG1
)))
1674 /* Server should reject the early data and skip over it */
1675 if (!TEST_int_eq(SSL_read_early_data(serverssl
, buf
, sizeof(buf
),
1677 SSL_READ_EARLY_DATA_FINISH
)
1678 || !TEST_size_t_eq(readbytes
, 0)
1679 || !TEST_int_eq(SSL_get_early_data_status(serverssl
),
1680 SSL_EARLY_DATA_REJECTED
))
1685 * Finish off the handshake. We perform the same writes and reads as
1686 * further down but we expect them to fail due to the incomplete
1689 if (!TEST_false(SSL_write_ex(clientssl
, MSG2
, strlen(MSG2
), &written
))
1690 || !TEST_false(SSL_read_ex(serverssl
, buf
, sizeof(buf
),
1695 /* Should be able to send normal data despite rejection of early data */
1696 if (!TEST_true(SSL_write_ex(clientssl
, MSG2
, strlen(MSG2
), &written
))
1697 || !TEST_size_t_eq(written
, strlen(MSG2
))
1698 || !TEST_int_eq(SSL_get_early_data_status(clientssl
),
1699 SSL_EARLY_DATA_REJECTED
)
1700 || !TEST_true(SSL_read_ex(serverssl
, buf
, sizeof(buf
), &readbytes
))
1701 || !TEST_mem_eq(buf
, readbytes
, MSG2
, strlen(MSG2
)))
1707 SSL_SESSION_free(sess
);
1708 SSL_free(serverssl
);
1709 SSL_free(clientssl
);
1716 * Test that a server attempting to read early data can handle a connection
1717 * from a client where the early data is not acceptable.
1719 static int test_early_data_skip(int idx
)
1721 return early_data_skip_helper(0, idx
);
1725 * Test that a server attempting to read early data can handle a connection
1726 * from a client where an HRR occurs.
1728 static int test_early_data_skip_hrr(int idx
)
1730 return early_data_skip_helper(1, idx
);
1734 * Test that a server attempting to read early data can handle a connection
1735 * from a client that doesn't send any.
1737 static int test_early_data_not_sent(int idx
)
1739 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
;
1740 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
1742 SSL_SESSION
*sess
= NULL
;
1743 unsigned char buf
[20];
1744 size_t readbytes
, written
;
1746 if (!TEST_true(setupearly_data_test(&cctx
, &sctx
, &clientssl
,
1747 &serverssl
, &sess
, idx
)))
1750 /* Write some data - should block due to handshake with server */
1751 SSL_set_connect_state(clientssl
);
1752 if (!TEST_false(SSL_write_ex(clientssl
, MSG1
, strlen(MSG1
), &written
)))
1755 /* Server should detect that early data has not been sent */
1756 if (!TEST_int_eq(SSL_read_early_data(serverssl
, buf
, sizeof(buf
),
1758 SSL_READ_EARLY_DATA_FINISH
)
1759 || !TEST_size_t_eq(readbytes
, 0)
1760 || !TEST_int_eq(SSL_get_early_data_status(serverssl
),
1761 SSL_EARLY_DATA_NOT_SENT
)
1762 || !TEST_int_eq(SSL_get_early_data_status(clientssl
),
1763 SSL_EARLY_DATA_NOT_SENT
))
1766 /* Continue writing the message we started earlier */
1767 if (!TEST_true(SSL_write_ex(clientssl
, MSG1
, strlen(MSG1
), &written
))
1768 || !TEST_size_t_eq(written
, strlen(MSG1
))
1769 || !TEST_true(SSL_read_ex(serverssl
, buf
, sizeof(buf
), &readbytes
))
1770 || !TEST_mem_eq(buf
, readbytes
, MSG1
, strlen(MSG1
))
1771 || !SSL_write_ex(serverssl
, MSG2
, strlen(MSG2
), &written
)
1772 || !TEST_size_t_eq(written
, strlen(MSG2
)))
1776 * Should block due to the NewSessionTicket arrival unless we're using
1780 if (!TEST_false(SSL_read_ex(clientssl
, buf
, sizeof(buf
), &readbytes
)))
1784 if (!TEST_true(SSL_read_ex(clientssl
, buf
, sizeof(buf
), &readbytes
))
1785 || !TEST_mem_eq(buf
, readbytes
, MSG2
, strlen(MSG2
)))
1791 SSL_SESSION_free(sess
);
1792 SSL_free(serverssl
);
1793 SSL_free(clientssl
);
1800 * Test that a server that doesn't try to read early data can handle a
1801 * client sending some.
1803 static int test_early_data_not_expected(int idx
)
1805 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
;
1806 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
1808 SSL_SESSION
*sess
= NULL
;
1809 unsigned char buf
[20];
1810 size_t readbytes
, written
;
1813 if (!TEST_true(setupearly_data_test(&cctx
, &sctx
, &clientssl
,
1814 &serverssl
, &sess
, idx
)))
1817 /* Write some early data */
1818 if (!TEST_true(SSL_write_early_data(clientssl
, MSG1
, strlen(MSG1
),
1823 * Server should skip over early data and then block waiting for client to
1824 * continue handshake
1826 if (!TEST_int_le(SSL_accept(serverssl
), 0)
1827 || !TEST_int_gt(SSL_connect(clientssl
), 0)
1828 || !TEST_int_eq(SSL_get_early_data_status(serverssl
),
1829 SSL_EARLY_DATA_REJECTED
)
1830 || !TEST_int_gt(SSL_accept(serverssl
), 0)
1831 || !TEST_int_eq(SSL_get_early_data_status(clientssl
),
1832 SSL_EARLY_DATA_REJECTED
))
1835 /* Send some normal data from client to server */
1836 if (!TEST_true(SSL_write_ex(clientssl
, MSG2
, strlen(MSG2
), &written
))
1837 || !TEST_size_t_eq(written
, strlen(MSG2
)))
1840 if (!TEST_true(SSL_read_ex(serverssl
, buf
, sizeof(buf
), &readbytes
))
1841 || !TEST_mem_eq(buf
, readbytes
, MSG2
, strlen(MSG2
)))
1847 SSL_SESSION_free(sess
);
1848 SSL_free(serverssl
);
1849 SSL_free(clientssl
);
1856 # ifndef OPENSSL_NO_TLS1_2
1858 * Test that a server attempting to read early data can handle a connection
1859 * from a TLSv1.2 client.
1861 static int test_early_data_tls1_2(int idx
)
1863 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
;
1864 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
1866 unsigned char buf
[20];
1867 size_t readbytes
, written
;
1869 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
1870 TLS_client_method(), &sctx
,
1871 &cctx
, cert
, privkey
)))
1874 /* When idx == 1 we repeat the tests with read_ahead set */
1876 SSL_CTX_set_read_ahead(cctx
, 1);
1877 SSL_CTX_set_read_ahead(sctx
, 1);
1880 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
,
1881 &clientssl
, NULL
, NULL
)))
1884 /* Write some data - should block due to handshake with server */
1885 SSL_set_max_proto_version(clientssl
, TLS1_2_VERSION
);
1886 SSL_set_connect_state(clientssl
);
1887 if (!TEST_false(SSL_write_ex(clientssl
, MSG1
, strlen(MSG1
), &written
)))
1891 * Server should do TLSv1.2 handshake. First it will block waiting for more
1892 * messages from client after ServerDone. Then SSL_read_early_data should
1893 * finish and detect that early data has not been sent
1895 if (!TEST_int_eq(SSL_read_early_data(serverssl
, buf
, sizeof(buf
),
1897 SSL_READ_EARLY_DATA_ERROR
))
1901 * Continue writing the message we started earlier. Will still block waiting
1902 * for the CCS/Finished from server
1904 if (!TEST_false(SSL_write_ex(clientssl
, MSG1
, strlen(MSG1
), &written
))
1905 || !TEST_int_eq(SSL_read_early_data(serverssl
, buf
, sizeof(buf
),
1907 SSL_READ_EARLY_DATA_FINISH
)
1908 || !TEST_size_t_eq(readbytes
, 0)
1909 || !TEST_int_eq(SSL_get_early_data_status(serverssl
),
1910 SSL_EARLY_DATA_NOT_SENT
))
1913 /* Continue writing the message we started earlier */
1914 if (!TEST_true(SSL_write_ex(clientssl
, MSG1
, strlen(MSG1
), &written
))
1915 || !TEST_size_t_eq(written
, strlen(MSG1
))
1916 || !TEST_int_eq(SSL_get_early_data_status(clientssl
),
1917 SSL_EARLY_DATA_NOT_SENT
)
1918 || !TEST_true(SSL_read_ex(serverssl
, buf
, sizeof(buf
), &readbytes
))
1919 || !TEST_mem_eq(buf
, readbytes
, MSG1
, strlen(MSG1
))
1920 || !TEST_true(SSL_write_ex(serverssl
, MSG2
, strlen(MSG2
), &written
))
1921 || !TEST_size_t_eq(written
, strlen(MSG2
))
1922 || !SSL_read_ex(clientssl
, buf
, sizeof(buf
), &readbytes
)
1923 || !TEST_mem_eq(buf
, readbytes
, MSG2
, strlen(MSG2
)))
1929 SSL_free(serverssl
);
1930 SSL_free(clientssl
);
1936 # endif /* OPENSSL_NO_TLS1_2 */
1938 static int test_ciphersuite_change(void)
1940 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
;
1941 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
1942 SSL_SESSION
*clntsess
= NULL
;
1944 const SSL_CIPHER
*aes_128_gcm_sha256
= NULL
;
1946 /* Create a session based on SHA-256 */
1947 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
1948 TLS_client_method(), &sctx
,
1949 &cctx
, cert
, privkey
))
1950 || !TEST_true(SSL_CTX_set_cipher_list(cctx
,
1951 "TLS13-AES-128-GCM-SHA256"))
1952 || !TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
,
1953 &clientssl
, NULL
, NULL
))
1954 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
1958 clntsess
= SSL_get1_session(clientssl
);
1959 /* Save for later */
1960 aes_128_gcm_sha256
= SSL_SESSION_get0_cipher(clntsess
);
1961 SSL_shutdown(clientssl
);
1962 SSL_shutdown(serverssl
);
1963 SSL_free(serverssl
);
1964 SSL_free(clientssl
);
1965 serverssl
= clientssl
= NULL
;
1967 /* Check we can resume a session with a different SHA-256 ciphersuite */
1968 if (!TEST_true(SSL_CTX_set_cipher_list(cctx
,
1969 "TLS13-CHACHA20-POLY1305-SHA256"))
1970 || !TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
, &clientssl
,
1972 || !TEST_true(SSL_set_session(clientssl
, clntsess
))
1973 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
1975 || !TEST_true(SSL_session_reused(clientssl
)))
1978 SSL_SESSION_free(clntsess
);
1979 clntsess
= SSL_get1_session(clientssl
);
1980 SSL_shutdown(clientssl
);
1981 SSL_shutdown(serverssl
);
1982 SSL_free(serverssl
);
1983 SSL_free(clientssl
);
1984 serverssl
= clientssl
= NULL
;
1987 * Check attempting to resume a SHA-256 session with no SHA-256 ciphersuites
1988 * succeeds but does not resume.
1990 if (!TEST_true(SSL_CTX_set_cipher_list(cctx
, "TLS13-AES-256-GCM-SHA384"))
1991 || !TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
, &clientssl
,
1993 || !TEST_true(SSL_set_session(clientssl
, clntsess
))
1994 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
1996 || !TEST_false(SSL_session_reused(clientssl
)))
1999 SSL_SESSION_free(clntsess
);
2001 SSL_shutdown(clientssl
);
2002 SSL_shutdown(serverssl
);
2003 SSL_free(serverssl
);
2004 SSL_free(clientssl
);
2005 serverssl
= clientssl
= NULL
;
2007 /* Create a session based on SHA384 */
2008 if (!TEST_true(SSL_CTX_set_cipher_list(cctx
, "TLS13-AES-256-GCM-SHA384"))
2009 || !TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
,
2010 &clientssl
, NULL
, NULL
))
2011 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
2015 clntsess
= SSL_get1_session(clientssl
);
2016 SSL_shutdown(clientssl
);
2017 SSL_shutdown(serverssl
);
2018 SSL_free(serverssl
);
2019 SSL_free(clientssl
);
2020 serverssl
= clientssl
= NULL
;
2022 if (!TEST_true(SSL_CTX_set_cipher_list(cctx
,
2023 "TLS13-AES-128-GCM-SHA256:TLS13-AES-256-GCM-SHA384"))
2024 || !TEST_true(SSL_CTX_set_cipher_list(sctx
,
2025 "TLS13-AES-256-GCM-SHA384"))
2026 || !TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
, &clientssl
,
2028 || !TEST_true(SSL_set_session(clientssl
, clntsess
))
2030 * We use SSL_ERROR_WANT_READ below so that we can pause the
2031 * connection after the initial ClientHello has been sent to
2032 * enable us to make some session changes.
2034 || !TEST_false(create_ssl_connection(serverssl
, clientssl
,
2035 SSL_ERROR_WANT_READ
)))
2038 /* Trick the client into thinking this session is for a different digest */
2039 clntsess
->cipher
= aes_128_gcm_sha256
;
2040 clntsess
->cipher_id
= clntsess
->cipher
->id
;
2043 * Continue the previously started connection. Server has selected a SHA-384
2044 * ciphersuite, but client thinks the session is for SHA-256, so it should
2047 if (!TEST_false(create_ssl_connection(serverssl
, clientssl
,
2049 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()),
2050 SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED
))
2056 SSL_SESSION_free(clntsess
);
2057 SSL_free(serverssl
);
2058 SSL_free(clientssl
);
2066 static SSL_SESSION
*psk
= NULL
;
2067 static const char *pskid
= "Identity";
2068 static const char *srvid
;
2070 static int use_session_cb_cnt
= 0;
2071 static int find_session_cb_cnt
= 0;
2073 static int use_session_cb(SSL
*ssl
, const EVP_MD
*md
, const unsigned char **id
,
2074 size_t *idlen
, SSL_SESSION
**sess
)
2076 switch (++use_session_cb_cnt
) {
2078 /* The first call should always have a NULL md */
2084 /* The second call should always have an md */
2090 /* We should only be called a maximum of twice */
2095 SSL_SESSION_up_ref(psk
);
2098 *id
= (const unsigned char *)pskid
;
2099 *idlen
= strlen(pskid
);
2104 static int find_session_cb(SSL
*ssl
, const unsigned char *identity
,
2105 size_t identity_len
, SSL_SESSION
**sess
)
2107 find_session_cb_cnt
++;
2109 /* We should only ever be called a maximum of twice per connection */
2110 if (find_session_cb_cnt
> 2)
2116 /* Identity should match that set by the client */
2117 if (strlen(srvid
) != identity_len
2118 || strncmp(srvid
, (const char *)identity
, identity_len
) != 0) {
2119 /* No PSK found, continue but without a PSK */
2124 SSL_SESSION_up_ref(psk
);
2130 #define TLS13_AES_256_GCM_SHA384_BYTES ((const unsigned char *)"\x13\x02")
2132 static int test_tls13_psk(void)
2134 SSL_CTX
*sctx
= NULL
, *cctx
= NULL
;
2135 SSL
*serverssl
= NULL
, *clientssl
= NULL
;
2136 const SSL_CIPHER
*cipher
= NULL
;
2137 const unsigned char key
[] = {
2138 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
2139 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
2140 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
2141 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f
2145 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
2146 TLS_client_method(), &sctx
,
2147 &cctx
, cert
, privkey
)))
2150 SSL_CTX_set_psk_use_session_callback(cctx
, use_session_cb
);
2151 SSL_CTX_set_psk_find_session_callback(sctx
, find_session_cb
);
2154 /* Check we can create a connection if callback decides not to send a PSK */
2155 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
, &clientssl
,
2157 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
2159 || !TEST_false(SSL_session_reused(clientssl
))
2160 || !TEST_false(SSL_session_reused(serverssl
))
2161 || !TEST_true(use_session_cb_cnt
== 1)
2162 || !TEST_true(find_session_cb_cnt
== 0))
2165 shutdown_ssl_connection(serverssl
, clientssl
);
2166 serverssl
= clientssl
= NULL
;
2167 use_session_cb_cnt
= 0;
2169 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
, &clientssl
,
2173 /* Create the PSK */
2174 cipher
= SSL_CIPHER_find(clientssl
, TLS13_AES_256_GCM_SHA384_BYTES
);
2175 psk
= SSL_SESSION_new();
2177 || !TEST_ptr(cipher
)
2178 || !TEST_true(SSL_SESSION_set1_master_key(psk
, key
, sizeof(key
)))
2179 || !TEST_true(SSL_SESSION_set_cipher(psk
, cipher
))
2180 || !TEST_true(SSL_SESSION_set_protocol_version(psk
,
2184 /* Check we can create a connection and the PSK is used */
2185 if (!TEST_true(create_ssl_connection(serverssl
, clientssl
, SSL_ERROR_NONE
))
2186 || !TEST_true(SSL_session_reused(clientssl
))
2187 || !TEST_true(SSL_session_reused(serverssl
))
2188 || !TEST_true(use_session_cb_cnt
== 1)
2189 || !TEST_true(find_session_cb_cnt
== 1))
2192 shutdown_ssl_connection(serverssl
, clientssl
);
2193 serverssl
= clientssl
= NULL
;
2194 use_session_cb_cnt
= find_session_cb_cnt
= 0;
2196 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
, &clientssl
,
2201 if (!TEST_true(SSL_set1_groups_list(serverssl
, "P-256")))
2205 * Check we can create a connection, the PSK is used and the callbacks are
2208 if (!TEST_true(create_ssl_connection(serverssl
, clientssl
, SSL_ERROR_NONE
))
2209 || !TEST_true(SSL_session_reused(clientssl
))
2210 || !TEST_true(SSL_session_reused(serverssl
))
2211 || !TEST_true(use_session_cb_cnt
== 2)
2212 || !TEST_true(find_session_cb_cnt
== 2))
2215 shutdown_ssl_connection(serverssl
, clientssl
);
2216 serverssl
= clientssl
= NULL
;
2217 use_session_cb_cnt
= find_session_cb_cnt
= 0;
2220 * Check that if the server rejects the PSK we can still connect, but with
2223 srvid
= "Dummy Identity";
2224 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
, &clientssl
,
2226 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
2228 || !TEST_false(SSL_session_reused(clientssl
))
2229 || !TEST_false(SSL_session_reused(serverssl
))
2230 || !TEST_true(use_session_cb_cnt
== 1)
2231 || !TEST_true(find_session_cb_cnt
== 1))
2234 shutdown_ssl_connection(serverssl
, clientssl
);
2235 serverssl
= clientssl
= NULL
;
2239 SSL_SESSION_free(psk
);
2240 SSL_free(serverssl
);
2241 SSL_free(clientssl
);
2247 #endif /* OPENSSL_NO_TLS1_3 */
2249 static int clntaddoldcb
= 0;
2250 static int clntparseoldcb
= 0;
2251 static int srvaddoldcb
= 0;
2252 static int srvparseoldcb
= 0;
2253 static int clntaddnewcb
= 0;
2254 static int clntparsenewcb
= 0;
2255 static int srvaddnewcb
= 0;
2256 static int srvparsenewcb
= 0;
2257 static int snicb
= 0;
2259 #define TEST_EXT_TYPE1 0xff00
2261 static int old_add_cb(SSL
*s
, unsigned int ext_type
, const unsigned char **out
,
2262 size_t *outlen
, int *al
, void *add_arg
)
2264 int *server
= (int *)add_arg
;
2265 unsigned char *data
;
2267 if (SSL_is_server(s
))
2272 if (*server
!= SSL_is_server(s
)
2273 || (data
= OPENSSL_malloc(sizeof(*data
))) == NULL
)
2278 *outlen
= sizeof(char);
2282 static void old_free_cb(SSL
*s
, unsigned int ext_type
, const unsigned char *out
,
2285 OPENSSL_free((unsigned char *)out
);
2288 static int old_parse_cb(SSL
*s
, unsigned int ext_type
, const unsigned char *in
,
2289 size_t inlen
, int *al
, void *parse_arg
)
2291 int *server
= (int *)parse_arg
;
2293 if (SSL_is_server(s
))
2298 if (*server
!= SSL_is_server(s
)
2299 || inlen
!= sizeof(char)
2306 static int new_add_cb(SSL
*s
, unsigned int ext_type
, unsigned int context
,
2307 const unsigned char **out
, size_t *outlen
, X509
*x
,
2308 size_t chainidx
, int *al
, void *add_arg
)
2310 int *server
= (int *)add_arg
;
2311 unsigned char *data
;
2313 if (SSL_is_server(s
))
2318 if (*server
!= SSL_is_server(s
)
2319 || (data
= OPENSSL_malloc(sizeof(*data
))) == NULL
)
2324 *outlen
= sizeof(*data
);
2328 static void new_free_cb(SSL
*s
, unsigned int ext_type
, unsigned int context
,
2329 const unsigned char *out
, void *add_arg
)
2331 OPENSSL_free((unsigned char *)out
);
2334 static int new_parse_cb(SSL
*s
, unsigned int ext_type
, unsigned int context
,
2335 const unsigned char *in
, size_t inlen
, X509
*x
,
2336 size_t chainidx
, int *al
, void *parse_arg
)
2338 int *server
= (int *)parse_arg
;
2340 if (SSL_is_server(s
))
2345 if (*server
!= SSL_is_server(s
)
2346 || inlen
!= sizeof(char) || *in
!= 1)
2352 static int sni_cb(SSL
*s
, int *al
, void *arg
)
2354 SSL_CTX
*ctx
= (SSL_CTX
*)arg
;
2356 if (SSL_set_SSL_CTX(s
, ctx
) == NULL
) {
2357 *al
= SSL_AD_INTERNAL_ERROR
;
2358 return SSL_TLSEXT_ERR_ALERT_FATAL
;
2361 return SSL_TLSEXT_ERR_OK
;
2365 * Custom call back tests.
2366 * Test 0: Old style callbacks in TLSv1.2
2367 * Test 1: New style callbacks in TLSv1.2
2368 * Test 2: New style callbacks in TLSv1.2 with SNI
2369 * Test 3: New style callbacks in TLSv1.3. Extensions in CH and EE
2370 * Test 4: New style callbacks in TLSv1.3. Extensions in CH, SH, EE, Cert + NST
2372 static int test_custom_exts(int tst
)
2374 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
, *sctx2
= NULL
;
2375 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
2377 static int server
= 1;
2378 static int client
= 0;
2379 SSL_SESSION
*sess
= NULL
;
2380 unsigned int context
;
2382 /* Reset callback counters */
2383 clntaddoldcb
= clntparseoldcb
= srvaddoldcb
= srvparseoldcb
= 0;
2384 clntaddnewcb
= clntparsenewcb
= srvaddnewcb
= srvparsenewcb
= 0;
2387 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
2388 TLS_client_method(), &sctx
,
2389 &cctx
, cert
, privkey
)))
2393 && !TEST_true(create_ssl_ctx_pair(TLS_server_method(), NULL
, &sctx2
,
2394 NULL
, cert
, privkey
)))
2399 SSL_CTX_set_options(cctx
, SSL_OP_NO_TLSv1_3
);
2400 SSL_CTX_set_options(sctx
, SSL_OP_NO_TLSv1_3
);
2402 SSL_CTX_set_options(sctx2
, SSL_OP_NO_TLSv1_3
);
2406 context
= SSL_EXT_CLIENT_HELLO
2407 | SSL_EXT_TLS1_2_SERVER_HELLO
2408 | SSL_EXT_TLS1_3_SERVER_HELLO
2409 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
2410 | SSL_EXT_TLS1_3_CERTIFICATE
2411 | SSL_EXT_TLS1_3_NEW_SESSION_TICKET
;
2413 context
= SSL_EXT_CLIENT_HELLO
2414 | SSL_EXT_TLS1_2_SERVER_HELLO
2415 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
;
2418 /* Create a client side custom extension */
2420 if (!TEST_true(SSL_CTX_add_client_custom_ext(cctx
, TEST_EXT_TYPE1
,
2421 old_add_cb
, old_free_cb
,
2422 &client
, old_parse_cb
,
2426 if (!TEST_true(SSL_CTX_add_custom_ext(cctx
, TEST_EXT_TYPE1
, context
,
2427 new_add_cb
, new_free_cb
,
2428 &client
, new_parse_cb
, &client
)))
2432 /* Should not be able to add duplicates */
2433 if (!TEST_false(SSL_CTX_add_client_custom_ext(cctx
, TEST_EXT_TYPE1
,
2434 old_add_cb
, old_free_cb
,
2435 &client
, old_parse_cb
,
2437 || !TEST_false(SSL_CTX_add_custom_ext(cctx
, TEST_EXT_TYPE1
,
2438 context
, new_add_cb
,
2439 new_free_cb
, &client
,
2440 new_parse_cb
, &client
)))
2443 /* Create a server side custom extension */
2445 if (!TEST_true(SSL_CTX_add_server_custom_ext(sctx
, TEST_EXT_TYPE1
,
2446 old_add_cb
, old_free_cb
,
2447 &server
, old_parse_cb
,
2451 if (!TEST_true(SSL_CTX_add_custom_ext(sctx
, TEST_EXT_TYPE1
, context
,
2452 new_add_cb
, new_free_cb
,
2453 &server
, new_parse_cb
, &server
)))
2456 && !TEST_true(SSL_CTX_add_custom_ext(sctx2
, TEST_EXT_TYPE1
,
2457 context
, new_add_cb
,
2458 new_free_cb
, &server
,
2459 new_parse_cb
, &server
)))
2463 /* Should not be able to add duplicates */
2464 if (!TEST_false(SSL_CTX_add_server_custom_ext(sctx
, TEST_EXT_TYPE1
,
2465 old_add_cb
, old_free_cb
,
2466 &server
, old_parse_cb
,
2468 || !TEST_false(SSL_CTX_add_custom_ext(sctx
, TEST_EXT_TYPE1
,
2469 context
, new_add_cb
,
2470 new_free_cb
, &server
,
2471 new_parse_cb
, &server
)))
2476 if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx
, sni_cb
))
2477 || !TEST_true(SSL_CTX_set_tlsext_servername_arg(sctx
, sctx2
)))
2481 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
,
2482 &clientssl
, NULL
, NULL
))
2483 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
2488 if (clntaddoldcb
!= 1
2489 || clntparseoldcb
!= 1
2491 || srvparseoldcb
!= 1)
2493 } else if (tst
== 1 || tst
== 2 || tst
== 3) {
2494 if (clntaddnewcb
!= 1
2495 || clntparsenewcb
!= 1
2497 || srvparsenewcb
!= 1
2498 || (tst
!= 2 && snicb
!= 0)
2499 || (tst
== 2 && snicb
!= 1))
2502 if (clntaddnewcb
!= 1
2503 || clntparsenewcb
!= 4
2505 || srvparsenewcb
!= 1)
2509 sess
= SSL_get1_session(clientssl
);
2510 SSL_shutdown(clientssl
);
2511 SSL_shutdown(serverssl
);
2512 SSL_free(serverssl
);
2513 SSL_free(clientssl
);
2514 serverssl
= clientssl
= NULL
;
2517 /* We don't bother with the resumption aspects for this test */
2522 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
, &clientssl
,
2524 || !TEST_true(SSL_set_session(clientssl
, sess
))
2525 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
2530 * For a resumed session we expect to add the ClientHello extension. For the
2531 * old style callbacks we ignore it on the server side because they set
2532 * SSL_EXT_IGNORE_ON_RESUMPTION. The new style callbacks do not ignore
2536 if (clntaddoldcb
!= 2
2537 || clntparseoldcb
!= 1
2539 || srvparseoldcb
!= 1)
2541 } else if (tst
== 1 || tst
== 2 || tst
== 3) {
2542 if (clntaddnewcb
!= 2
2543 || clntparsenewcb
!= 2
2545 || srvparsenewcb
!= 2)
2548 /* No Certificate message extensions in the resumption handshake */
2549 if (clntaddnewcb
!= 2
2550 || clntparsenewcb
!= 7
2552 || srvparsenewcb
!= 2)
2559 SSL_SESSION_free(sess
);
2560 SSL_free(serverssl
);
2561 SSL_free(clientssl
);
2562 SSL_CTX_free(sctx2
);
2569 * Test loading of serverinfo data in various formats. test_sslmessages actually
2570 * tests to make sure the extensions appear in the handshake
2572 static int test_serverinfo(int tst
)
2574 unsigned int version
;
2575 unsigned char *sibuf
;
2577 int ret
, expected
, testresult
= 0;
2580 ctx
= SSL_CTX_new(TLS_method());
2584 if ((tst
& 0x01) == 0x01)
2585 version
= SSL_SERVERINFOV2
;
2587 version
= SSL_SERVERINFOV1
;
2589 if ((tst
& 0x02) == 0x02) {
2590 sibuf
= serverinfov2
;
2591 sibuflen
= sizeof(serverinfov2
);
2592 expected
= (version
== SSL_SERVERINFOV2
);
2594 sibuf
= serverinfov1
;
2595 sibuflen
= sizeof(serverinfov1
);
2596 expected
= (version
== SSL_SERVERINFOV1
);
2599 if ((tst
& 0x04) == 0x04) {
2600 ret
= SSL_CTX_use_serverinfo_ex(ctx
, version
, sibuf
, sibuflen
);
2602 ret
= SSL_CTX_use_serverinfo(ctx
, sibuf
, sibuflen
);
2605 * The version variable is irrelevant in this case - it's what is in the
2606 * buffer that matters
2608 if ((tst
& 0x02) == 0x02)
2614 if (!TEST_true(ret
== expected
))
2626 * Test that SSL_export_keying_material() produces expected results. There are
2627 * no test vectors so all we do is test that both sides of the communication
2628 * produce the same results for different protocol versions.
2630 static int test_export_key_mat(int tst
)
2633 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
, *sctx2
= NULL
;
2634 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
2635 const char label
[] = "test label";
2636 const unsigned char context
[] = "context";
2637 const unsigned char *emptycontext
= NULL
;
2638 unsigned char ckeymat1
[80], ckeymat2
[80], ckeymat3
[80];
2639 unsigned char skeymat1
[80], skeymat2
[80], skeymat3
[80];
2640 const int protocols
[] = {
2647 #ifdef OPENSSL_NO_TLS1
2651 #ifdef OPENSSL_NO_TLS1_1
2655 #ifdef OPENSSL_NO_TLS1_2
2659 #ifdef OPENSSL_NO_TLS1_3
2663 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
2664 TLS_client_method(), &sctx
,
2665 &cctx
, cert
, privkey
)))
2668 OPENSSL_assert(tst
>= 0 && (size_t)tst
< OSSL_NELEM(protocols
));
2669 SSL_CTX_set_max_proto_version(cctx
, protocols
[tst
]);
2670 SSL_CTX_set_min_proto_version(cctx
, protocols
[tst
]);
2672 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
, &clientssl
, NULL
,
2674 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
2678 if (!TEST_int_eq(SSL_export_keying_material(clientssl
, ckeymat1
,
2679 sizeof(ckeymat1
), label
,
2680 sizeof(label
) - 1, context
,
2681 sizeof(context
) - 1, 1), 1)
2682 || !TEST_int_eq(SSL_export_keying_material(clientssl
, ckeymat2
,
2683 sizeof(ckeymat2
), label
,
2687 || !TEST_int_eq(SSL_export_keying_material(clientssl
, ckeymat3
,
2688 sizeof(ckeymat3
), label
,
2691 || !TEST_int_eq(SSL_export_keying_material(serverssl
, skeymat1
,
2692 sizeof(skeymat1
), label
,
2695 sizeof(context
) -1, 1),
2697 || !TEST_int_eq(SSL_export_keying_material(serverssl
, skeymat2
,
2698 sizeof(skeymat2
), label
,
2702 || !TEST_int_eq(SSL_export_keying_material(serverssl
, skeymat3
,
2703 sizeof(skeymat3
), label
,
2707 * Check that both sides created the same key material with the
2710 || !TEST_mem_eq(ckeymat1
, sizeof(ckeymat1
), skeymat1
,
2713 * Check that both sides created the same key material with an
2716 || !TEST_mem_eq(ckeymat2
, sizeof(ckeymat2
), skeymat2
,
2719 * Check that both sides created the same key material without a
2722 || !TEST_mem_eq(ckeymat3
, sizeof(ckeymat3
), skeymat3
,
2724 /* Different contexts should produce different results */
2725 || !TEST_mem_ne(ckeymat1
, sizeof(ckeymat1
), ckeymat2
,
2730 * Check that an empty context and no context produce different results in
2731 * protocols less than TLSv1.3. In TLSv1.3 they should be the same.
2733 if ((tst
!= 3 && !TEST_mem_ne(ckeymat2
, sizeof(ckeymat2
), ckeymat3
,
2735 || (tst
==3 && !TEST_mem_eq(ckeymat2
, sizeof(ckeymat2
), ckeymat3
,
2742 SSL_free(serverssl
);
2743 SSL_free(clientssl
);
2744 SSL_CTX_free(sctx2
);
2751 static int test_ssl_clear(int idx
)
2753 SSL_CTX
*cctx
= NULL
, *sctx
= NULL
;
2754 SSL
*clientssl
= NULL
, *serverssl
= NULL
;
2757 #ifdef OPENSSL_NO_TLS1_2
2762 /* Create an initial connection */
2763 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
2764 TLS_client_method(), &sctx
,
2765 &cctx
, cert
, privkey
))
2767 && !TEST_true(SSL_CTX_set_max_proto_version(cctx
,
2769 || !TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
,
2770 &clientssl
, NULL
, NULL
))
2771 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
2775 SSL_shutdown(clientssl
);
2776 SSL_shutdown(serverssl
);
2777 SSL_free(serverssl
);
2780 /* Clear clientssl - we're going to reuse the object */
2781 if (!TEST_true(SSL_clear(clientssl
)))
2784 if (!TEST_true(create_ssl_objects(sctx
, cctx
, &serverssl
, &clientssl
,
2786 || !TEST_true(create_ssl_connection(serverssl
, clientssl
,
2788 || !TEST_true(SSL_session_reused(clientssl
)))
2791 SSL_shutdown(clientssl
);
2792 SSL_shutdown(serverssl
);
2797 SSL_free(serverssl
);
2798 SSL_free(clientssl
);
2805 int setup_tests(void)
2807 if (!TEST_ptr(cert
= test_get_argument(0))
2808 || !TEST_ptr(privkey
= test_get_argument(1)))
2811 ADD_TEST(test_large_message_tls
);
2812 ADD_TEST(test_large_message_tls_read_ahead
);
2813 #ifndef OPENSSL_NO_DTLS
2814 ADD_TEST(test_large_message_dtls
);
2816 #ifndef OPENSSL_NO_OCSP
2817 ADD_TEST(test_tlsext_status_type
);
2819 ADD_TEST(test_session_with_only_int_cache
);
2820 ADD_TEST(test_session_with_only_ext_cache
);
2821 ADD_TEST(test_session_with_both_cache
);
2822 ADD_ALL_TESTS(test_ssl_set_bio
, TOTAL_SSL_SET_BIO_TESTS
);
2823 ADD_TEST(test_ssl_bio_pop_next_bio
);
2824 ADD_TEST(test_ssl_bio_pop_ssl_bio
);
2825 ADD_TEST(test_ssl_bio_change_rbio
);
2826 ADD_TEST(test_ssl_bio_change_wbio
);
2827 ADD_ALL_TESTS(test_set_sigalgs
, OSSL_NELEM(testsigalgs
) * 2);
2828 ADD_TEST(test_keylog
);
2829 #ifndef OPENSSL_NO_TLS1_3
2830 ADD_TEST(test_keylog_no_master_key
);
2832 #ifndef OPENSSL_NO_TLS1_2
2833 ADD_TEST(test_early_cb
);
2835 #ifndef OPENSSL_NO_TLS1_3
2836 ADD_ALL_TESTS(test_early_data_read_write
, 2);
2837 ADD_ALL_TESTS(test_early_data_skip
, 2);
2838 ADD_ALL_TESTS(test_early_data_skip_hrr
, 2);
2839 ADD_ALL_TESTS(test_early_data_not_sent
, 2);
2840 ADD_ALL_TESTS(test_early_data_not_expected
, 2);
2841 # ifndef OPENSSL_NO_TLS1_2
2842 ADD_ALL_TESTS(test_early_data_tls1_2
, 2);
2845 #ifndef OPENSSL_NO_TLS1_3
2846 ADD_TEST(test_ciphersuite_change
);
2847 ADD_TEST(test_tls13_psk
);
2848 ADD_ALL_TESTS(test_custom_exts
, 5);
2850 ADD_ALL_TESTS(test_custom_exts
, 3);
2852 ADD_ALL_TESTS(test_serverinfo
, 8);
2853 ADD_ALL_TESTS(test_export_key_mat
, 4);
2854 ADD_ALL_TESTS(test_ssl_clear
, 2);
2858 void cleanup_tests(void)
2860 bio_s_mempacket_test_free();