#define RECORD_SEQUENCE 10
+static const char dummy_cookie[] = "0123456";
+
+static int generate_cookie_cb(SSL *ssl, unsigned char *cookie,
+ unsigned int *cookie_len)
+{
+ memcpy(cookie, dummy_cookie, sizeof(dummy_cookie));
+ *cookie_len = sizeof(dummy_cookie);
+ return 1;
+}
+
+static int verify_cookie_cb(SSL *ssl, const unsigned char *cookie,
+ unsigned int cookie_len)
+{
+ return TEST_mem_eq(cookie, cookie_len, dummy_cookie, sizeof(dummy_cookie));
+}
+
static unsigned int timer_cb(SSL *s, unsigned int timer_us)
{
++timer_cb_count;
* they will fail to decrypt.
*/
if (!TEST_true(create_bare_ssl_connection(serverssl1, clientssl1,
- SSL_ERROR_NONE, 0)))
+ SSL_ERROR_NONE, 0, 0)))
goto end;
if (timer_cb_count == 0) {
return testresult;
}
+/* One record for the cookieless initial ClientHello */
+#define CLI_TO_SRV_COOKIE_EXCH 1
+
+/*
+ * In a resumption handshake we use 2 records for the initial ClientHello in
+ * this test because we are using a very small MTU and the ClientHello is
+ * bigger than in the non resumption case.
+ */
+#define CLI_TO_SRV_RESUME_COOKIE_EXCH 2
+#define SRV_TO_CLI_COOKIE_EXCH 1
+
#define CLI_TO_SRV_EPOCH_0_RECS 3
#define CLI_TO_SRV_EPOCH_1_RECS 1
#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
#endif
#define SRV_TO_CLI_EPOCH_1_RECS 1
#define TOTAL_FULL_HAND_RECORDS \
- (CLI_TO_SRV_EPOCH_0_RECS + CLI_TO_SRV_EPOCH_1_RECS + \
+ (CLI_TO_SRV_COOKIE_EXCH + SRV_TO_CLI_COOKIE_EXCH + \
+ CLI_TO_SRV_EPOCH_0_RECS + CLI_TO_SRV_EPOCH_1_RECS + \
SRV_TO_CLI_EPOCH_0_RECS + SRV_TO_CLI_EPOCH_1_RECS)
#define CLI_TO_SRV_RESUME_EPOCH_0_RECS 3
#define SRV_TO_CLI_RESUME_EPOCH_0_RECS 2
#define SRV_TO_CLI_RESUME_EPOCH_1_RECS 1
#define TOTAL_RESUME_HAND_RECORDS \
- (CLI_TO_SRV_RESUME_EPOCH_0_RECS + CLI_TO_SRV_RESUME_EPOCH_1_RECS + \
+ (CLI_TO_SRV_RESUME_COOKIE_EXCH + SRV_TO_CLI_COOKIE_EXCH + \
+ CLI_TO_SRV_RESUME_EPOCH_0_RECS + CLI_TO_SRV_RESUME_EPOCH_1_RECS + \
SRV_TO_CLI_RESUME_EPOCH_0_RECS + SRV_TO_CLI_RESUME_EPOCH_1_RECS)
#define TOTAL_RECORDS (TOTAL_FULL_HAND_RECORDS + TOTAL_RESUME_HAND_RECORDS)
int testresult = 0;
int epoch = 0;
SSL_SESSION *sess = NULL;
- int cli_to_srv_epoch0, cli_to_srv_epoch1, srv_to_cli_epoch0;
+ int cli_to_srv_cookie, cli_to_srv_epoch0, cli_to_srv_epoch1;
+ int srv_to_cli_epoch0;
if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
DTLS_client_method(),
if (!TEST_true(SSL_CTX_set_dh_auto(sctx, 1)))
goto end;
+ SSL_CTX_set_options(sctx, SSL_OP_COOKIE_EXCHANGE);
+ SSL_CTX_set_cookie_generate_cb(sctx, generate_cookie_cb);
+ SSL_CTX_set_cookie_verify_cb(sctx, verify_cookie_cb);
+
if (idx >= TOTAL_FULL_HAND_RECORDS) {
/* We're going to do a resumption handshake. Get a session first. */
if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
cli_to_srv_epoch0 = CLI_TO_SRV_RESUME_EPOCH_0_RECS;
cli_to_srv_epoch1 = CLI_TO_SRV_RESUME_EPOCH_1_RECS;
srv_to_cli_epoch0 = SRV_TO_CLI_RESUME_EPOCH_0_RECS;
+ cli_to_srv_cookie = CLI_TO_SRV_RESUME_COOKIE_EXCH;
idx -= TOTAL_FULL_HAND_RECORDS;
} else {
cli_to_srv_epoch0 = CLI_TO_SRV_EPOCH_0_RECS;
cli_to_srv_epoch1 = CLI_TO_SRV_EPOCH_1_RECS;
srv_to_cli_epoch0 = SRV_TO_CLI_EPOCH_0_RECS;
+ cli_to_srv_cookie = CLI_TO_SRV_COOKIE_EXCH;
}
c_to_s_fbio = BIO_new(bio_f_tls_dump_filter());
DTLS_set_timer_cb(serverssl, timer_cb);
/* Work out which record to drop based on the test number */
- if (idx >= cli_to_srv_epoch0 + cli_to_srv_epoch1) {
+ if (idx >= cli_to_srv_cookie + cli_to_srv_epoch0 + cli_to_srv_epoch1) {
mempackbio = SSL_get_wbio(serverssl);
- idx -= cli_to_srv_epoch0 + cli_to_srv_epoch1;
- if (idx >= srv_to_cli_epoch0) {
+ idx -= cli_to_srv_cookie + cli_to_srv_epoch0 + cli_to_srv_epoch1;
+ if (idx >= SRV_TO_CLI_COOKIE_EXCH + srv_to_cli_epoch0) {
epoch = 1;
- idx -= srv_to_cli_epoch0;
+ idx -= SRV_TO_CLI_COOKIE_EXCH + srv_to_cli_epoch0;
}
} else {
mempackbio = SSL_get_wbio(clientssl);
- if (idx >= cli_to_srv_epoch0) {
+ if (idx >= cli_to_srv_cookie + cli_to_srv_epoch0) {
epoch = 1;
- idx -= cli_to_srv_epoch0;
+ idx -= cli_to_srv_cookie + cli_to_srv_epoch0;
}
mempackbio = BIO_next(mempackbio);
}
}
#endif /* !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC) */
-static const char dummy_cookie[] = "0123456";
-
-static int generate_cookie_cb(SSL *ssl, unsigned char *cookie,
- unsigned int *cookie_len)
-{
- memcpy(cookie, dummy_cookie, sizeof(dummy_cookie));
- *cookie_len = sizeof(dummy_cookie);
- return 1;
-}
-
-static int verify_cookie_cb(SSL *ssl, const unsigned char *cookie,
- unsigned int cookie_len)
-{
- return TEST_mem_eq(cookie, cookie_len, dummy_cookie, sizeof(dummy_cookie));
-}
-
static int test_cookie(void)
{
SSL_CTX *sctx = NULL, *cctx = NULL;
return testresult;
}
+/*
+ * Test that swapping an app data record so that it is received before the
+ * Finished message still works.
+ */
+static int test_swap_app_data(void)
+{
+ SSL_CTX *sctx = NULL, *cctx = NULL;
+ SSL *sssl = NULL, *cssl = NULL;
+ int testresult = 0;
+ BIO *bio;
+ char msg[] = { 0x00, 0x01, 0x02, 0x03 };
+ char buf[10];
+
+ if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
+ DTLS_client_method(),
+ DTLS1_VERSION, 0,
+ &sctx, &cctx, cert, privkey)))
+ return 0;
+
+#ifndef OPENSSL_NO_DTLS1_2
+ if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "AES128-SHA")))
+ goto end;
+#else
+ /* Default sigalgs are SHA1 based in <DTLS1.2 which is in security level 0 */
+ if (!TEST_true(SSL_CTX_set_cipher_list(sctx, "AES128-SHA:@SECLEVEL=0"))
+ || !TEST_true(SSL_CTX_set_cipher_list(cctx,
+ "AES128-SHA:@SECLEVEL=0")))
+ goto end;
+#endif
+
+ if (!TEST_true(create_ssl_objects(sctx, cctx, &sssl, &cssl,
+ NULL, NULL)))
+ goto end;
+
+ /* Send flight 1: ClientHello */
+ if (!TEST_int_le(SSL_connect(cssl), 0))
+ goto end;
+
+ /* Recv flight 1, send flight 2: ServerHello, Certificate, ServerHelloDone */
+ if (!TEST_int_le(SSL_accept(sssl), 0))
+ goto end;
+
+ /* Recv flight 2, send flight 3: ClientKeyExchange, CCS, Finished */
+ if (!TEST_int_le(SSL_connect(cssl), 0))
+ goto end;
+
+ /* Recv flight 3, send flight 4: datagram 1(NST, CCS) datagram 2(Finished) */
+ if (!TEST_int_gt(SSL_accept(sssl), 0))
+ goto end;
+
+ /* Send flight 5: app data */
+ if (!TEST_int_eq(SSL_write(sssl, msg, sizeof(msg)), (int)sizeof(msg)))
+ goto end;
+
+ bio = SSL_get_wbio(sssl);
+ if (!TEST_ptr(bio)
+ || !TEST_true(mempacket_swap_recent(bio)))
+ goto end;
+
+ /*
+ * Recv flight 4 (datagram 1): NST, CCS, + flight 5: app data
+ * + flight 4 (datagram 2): Finished
+ */
+ if (!TEST_int_gt(SSL_connect(cssl), 0))
+ goto end;
+
+ /* The app data should be buffered already */
+ if (!TEST_int_eq(SSL_pending(cssl), (int)sizeof(msg))
+ || !TEST_true(SSL_has_pending(cssl)))
+ goto end;
+
+ /*
+ * Recv flight 5 (app data)
+ * We already buffered this so it should be available.
+ */
+ if (!TEST_int_eq(SSL_read(cssl, buf, sizeof(buf)), (int)sizeof(msg)))
+ goto end;
+
+ testresult = 1;
+ end:
+ SSL_free(cssl);
+ SSL_free(sssl);
+ SSL_CTX_free(cctx);
+ SSL_CTX_free(sctx);
+
+ return testresult;
+}
+
+/* Confirm that we can create a connections using DTLSv1_listen() */
+static int test_listen(void)
+{
+ SSL_CTX *sctx = NULL, *cctx = NULL;
+ SSL *serverssl = NULL, *clientssl = NULL;
+ int testresult = 0;
+
+ if (!TEST_true(create_ssl_ctx_pair(NULL, DTLS_server_method(),
+ DTLS_client_method(),
+ DTLS1_VERSION, 0,
+ &sctx, &cctx, cert, privkey)))
+ return 0;
+
+#ifdef OPENSSL_NO_DTLS1_2
+ /* Default sigalgs are SHA1 based in <DTLS1.2 which is in security level 0 */
+ if (!TEST_true(SSL_CTX_set_cipher_list(sctx, "DEFAULT:@SECLEVEL=0"))
+ || !TEST_true(SSL_CTX_set_cipher_list(cctx,
+ "DEFAULT:@SECLEVEL=0")))
+ goto end;
+#endif
+
+ SSL_CTX_set_cookie_generate_cb(sctx, generate_cookie_cb);
+ SSL_CTX_set_cookie_verify_cb(sctx, verify_cookie_cb);
+
+ if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
+ NULL, NULL)))
+ goto end;
+
+ DTLS_set_timer_cb(clientssl, timer_cb);
+ DTLS_set_timer_cb(serverssl, timer_cb);
+
+ /*
+ * The last parameter to create_bare_ssl_connection() requests that
+ * DLTSv1_listen() is used.
+ */
+ if (!TEST_true(create_bare_ssl_connection(serverssl, clientssl,
+ SSL_ERROR_NONE, 1, 1)))
+ goto end;
+
+ testresult = 1;
+ end:
+ SSL_free(serverssl);
+ SSL_free(clientssl);
+ SSL_CTX_free(sctx);
+ SSL_CTX_free(cctx);
+
+ return testresult;
+}
+
OPT_TEST_DECLARE_USAGE("certfile privkeyfile\n")
int setup_tests(void)
ADD_TEST(test_dtls_duplicate_records);
ADD_TEST(test_just_finished);
ADD_TEST(test_swap_epoch);
+ ADD_TEST(test_swap_app_data);
+ ADD_TEST(test_listen);
return 1;
}
projects / thirdparty / openssl.git / blobdiff