2 * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #if !defined(__STDC_FORMAT_MACROS)
11 #define __STDC_FORMAT_MACROS
14 #include "packeted_bio.h"
15 #include <openssl/e_os2.h>
17 #if !defined(OPENSSL_SYS_WINDOWS)
18 #include <arpa/inet.h>
19 #include <netinet/in.h>
20 #include <netinet/tcp.h>
22 #include <sys/socket.h>
27 OPENSSL_MSVC_PRAGMA(warning(push
, 3))
30 OPENSSL_MSVC_PRAGMA(warning(pop
))
32 OPENSSL_MSVC_PRAGMA(comment(lib
, "Ws2_32.lib"))
39 #include <openssl/bio.h>
40 #include <openssl/buffer.h>
41 #include <openssl/bn.h>
42 #include <openssl/core_names.h>
43 #include <openssl/crypto.h>
44 #include <openssl/dh.h>
45 #include <openssl/err.h>
46 #include <openssl/evp.h>
47 #include <openssl/hmac.h>
48 #include <openssl/objects.h>
49 #include <openssl/rand.h>
50 #include <openssl/ssl.h>
51 #include <openssl/x509.h>
57 #include "async_bio.h"
58 #include "test_config.h"
62 #if !defined(OPENSSL_SYS_WINDOWS)
63 static int closesocket(int sock
) {
67 static void PrintSocketError(const char *func
) {
71 static void PrintSocketError(const char *func
) {
72 fprintf(stderr
, "%s: %d\n", func
, WSAGetLastError());
76 static int Usage(const char *program
) {
77 fprintf(stderr
, "Usage: %s [flags...]\n", program
);
82 // async_bio is async BIO which pauses reads and writes.
83 BIO
*async_bio
= nullptr;
84 // packeted_bio is the packeted BIO which simulates read timeouts.
85 BIO
*packeted_bio
= nullptr;
86 bool cert_ready
= false;
87 bool handshake_done
= false;
88 // private_key is the underlying private key used when testing custom keys.
89 bssl::UniquePtr
<EVP_PKEY
> private_key
;
90 bool got_new_session
= false;
91 bssl::UniquePtr
<SSL_SESSION
> new_session
;
92 bool ticket_decrypt_done
= false;
93 bool alpn_select_done
= false;
96 static void TestStateExFree(void *parent
, void *ptr
, CRYPTO_EX_DATA
*ad
,
97 int index
, long argl
, void *argp
) {
98 delete ((TestState
*)ptr
);
101 static int g_config_index
= 0;
102 static int g_state_index
= 0;
104 static bool SetTestConfig(SSL
*ssl
, const TestConfig
*config
) {
105 return SSL_set_ex_data(ssl
, g_config_index
, (void *)config
) == 1;
108 static const TestConfig
*GetTestConfig(const SSL
*ssl
) {
109 return (const TestConfig
*)SSL_get_ex_data(ssl
, g_config_index
);
112 static bool SetTestState(SSL
*ssl
, std::unique_ptr
<TestState
> state
) {
113 // |SSL_set_ex_data| takes ownership of |state| only on success.
114 if (SSL_set_ex_data(ssl
, g_state_index
, state
.get()) == 1) {
121 static TestState
*GetTestState(const SSL
*ssl
) {
122 return (TestState
*)SSL_get_ex_data(ssl
, g_state_index
);
125 static bssl::UniquePtr
<X509
> LoadCertificate(const std::string
&file
) {
126 bssl::UniquePtr
<BIO
> bio(BIO_new(BIO_s_file()));
127 if (!bio
|| !BIO_read_filename(bio
.get(), file
.c_str())) {
130 return bssl::UniquePtr
<X509
>(PEM_read_bio_X509(bio
.get(), NULL
, NULL
, NULL
));
133 static bssl::UniquePtr
<EVP_PKEY
> LoadPrivateKey(const std::string
&file
) {
134 bssl::UniquePtr
<BIO
> bio(BIO_new(BIO_s_file()));
135 if (!bio
|| !BIO_read_filename(bio
.get(), file
.c_str())) {
138 return bssl::UniquePtr
<EVP_PKEY
>(
139 PEM_read_bio_PrivateKey(bio
.get(), NULL
, NULL
, NULL
));
144 void operator()(T
*buf
) {
149 static bool GetCertificate(SSL
*ssl
, bssl::UniquePtr
<X509
> *out_x509
,
150 bssl::UniquePtr
<EVP_PKEY
> *out_pkey
) {
151 const TestConfig
*config
= GetTestConfig(ssl
);
153 if (!config
->key_file
.empty()) {
154 *out_pkey
= LoadPrivateKey(config
->key_file
.c_str());
159 if (!config
->cert_file
.empty()) {
160 *out_x509
= LoadCertificate(config
->cert_file
.c_str());
168 static bool InstallCertificate(SSL
*ssl
) {
169 bssl::UniquePtr
<X509
> x509
;
170 bssl::UniquePtr
<EVP_PKEY
> pkey
;
171 if (!GetCertificate(ssl
, &x509
, &pkey
)) {
175 if (pkey
&& !SSL_use_PrivateKey(ssl
, pkey
.get())) {
179 if (x509
&& !SSL_use_certificate(ssl
, x509
.get())) {
186 static int ClientCertCallback(SSL
*ssl
, X509
**out_x509
, EVP_PKEY
**out_pkey
) {
187 if (GetTestConfig(ssl
)->async
&& !GetTestState(ssl
)->cert_ready
) {
191 bssl::UniquePtr
<X509
> x509
;
192 bssl::UniquePtr
<EVP_PKEY
> pkey
;
193 if (!GetCertificate(ssl
, &x509
, &pkey
)) {
197 // Return zero for no certificate.
202 // Asynchronous private keys are not supported with client_cert_cb.
203 *out_x509
= x509
.release();
204 *out_pkey
= pkey
.release();
208 static int VerifySucceed(X509_STORE_CTX
*store_ctx
, void *arg
) {
212 static int VerifyFail(X509_STORE_CTX
*store_ctx
, void *arg
) {
213 X509_STORE_CTX_set_error(store_ctx
, X509_V_ERR_APPLICATION_VERIFICATION
);
217 static int NextProtosAdvertisedCallback(SSL
*ssl
, const uint8_t **out
,
218 unsigned int *out_len
, void *arg
) {
219 const TestConfig
*config
= GetTestConfig(ssl
);
220 if (config
->advertise_npn
.empty()) {
221 return SSL_TLSEXT_ERR_NOACK
;
224 *out
= (const uint8_t*)config
->advertise_npn
.data();
225 *out_len
= config
->advertise_npn
.size();
226 return SSL_TLSEXT_ERR_OK
;
229 static int NextProtoSelectCallback(SSL
* ssl
, uint8_t** out
, uint8_t* outlen
,
230 const uint8_t* in
, unsigned inlen
, void* arg
) {
231 const TestConfig
*config
= GetTestConfig(ssl
);
232 if (config
->select_next_proto
.empty()) {
233 return SSL_TLSEXT_ERR_NOACK
;
236 *out
= (uint8_t*)config
->select_next_proto
.data();
237 *outlen
= config
->select_next_proto
.size();
238 return SSL_TLSEXT_ERR_OK
;
241 static int AlpnSelectCallback(SSL
* ssl
, const uint8_t** out
, uint8_t* outlen
,
242 const uint8_t* in
, unsigned inlen
, void* arg
) {
243 if (GetTestState(ssl
)->alpn_select_done
) {
244 fprintf(stderr
, "AlpnSelectCallback called after completion.\n");
248 GetTestState(ssl
)->alpn_select_done
= true;
250 const TestConfig
*config
= GetTestConfig(ssl
);
251 if (config
->decline_alpn
) {
252 return SSL_TLSEXT_ERR_NOACK
;
255 if (!config
->expected_advertised_alpn
.empty() &&
256 (config
->expected_advertised_alpn
.size() != inlen
||
257 memcmp(config
->expected_advertised_alpn
.data(),
259 fprintf(stderr
, "bad ALPN select callback inputs\n");
263 *out
= (const uint8_t*)config
->select_alpn
.data();
264 *outlen
= config
->select_alpn
.size();
265 return SSL_TLSEXT_ERR_OK
;
268 static unsigned PskClientCallback(SSL
*ssl
, const char *hint
,
270 unsigned max_identity_len
,
271 uint8_t *out_psk
, unsigned max_psk_len
) {
272 const TestConfig
*config
= GetTestConfig(ssl
);
274 if (config
->psk_identity
.empty()) {
275 if (hint
!= nullptr) {
276 fprintf(stderr
, "Server PSK hint was non-null.\n");
279 } else if (hint
== nullptr ||
280 strcmp(hint
, config
->psk_identity
.c_str()) != 0) {
281 fprintf(stderr
, "Server PSK hint did not match.\n");
285 // Account for the trailing '\0' for the identity.
286 if (config
->psk_identity
.size() >= max_identity_len
||
287 config
->psk
.size() > max_psk_len
) {
288 fprintf(stderr
, "PSK buffers too small\n");
292 OPENSSL_strlcpy(out_identity
, config
->psk_identity
.c_str(),
294 memcpy(out_psk
, config
->psk
.data(), config
->psk
.size());
295 return config
->psk
.size();
298 static unsigned PskServerCallback(SSL
*ssl
, const char *identity
,
299 uint8_t *out_psk
, unsigned max_psk_len
) {
300 const TestConfig
*config
= GetTestConfig(ssl
);
302 if (strcmp(identity
, config
->psk_identity
.c_str()) != 0) {
303 fprintf(stderr
, "Client PSK identity did not match.\n");
307 if (config
->psk
.size() > max_psk_len
) {
308 fprintf(stderr
, "PSK buffers too small\n");
312 memcpy(out_psk
, config
->psk
.data(), config
->psk
.size());
313 return config
->psk
.size();
316 static int CertCallback(SSL
*ssl
, void *arg
) {
317 const TestConfig
*config
= GetTestConfig(ssl
);
319 // Check the CertificateRequest metadata is as expected.
321 // TODO(davidben): Test |SSL_get_client_CA_list|.
322 if (!SSL_is_server(ssl
) &&
323 !config
->expected_certificate_types
.empty()) {
324 const uint8_t *certificate_types
;
325 size_t certificate_types_len
=
326 SSL_get0_certificate_types(ssl
, &certificate_types
);
327 if (certificate_types_len
!= config
->expected_certificate_types
.size() ||
328 memcmp(certificate_types
,
329 config
->expected_certificate_types
.data(),
330 certificate_types_len
) != 0) {
331 fprintf(stderr
, "certificate types mismatch\n");
336 // The certificate will be installed via other means.
337 if (!config
->async
||
338 config
->use_old_client_cert_callback
) {
342 if (!GetTestState(ssl
)->cert_ready
) {
345 if (!InstallCertificate(ssl
)) {
351 static void InfoCallback(const SSL
*ssl
, int type
, int val
) {
352 if (type
== SSL_CB_HANDSHAKE_DONE
) {
353 if (GetTestConfig(ssl
)->handshake_never_done
) {
354 fprintf(stderr
, "Handshake unexpectedly completed.\n");
355 // Abort before any expected error code is printed, to ensure the overall
359 GetTestState(ssl
)->handshake_done
= true;
361 // Callbacks may be called again on a new handshake.
362 GetTestState(ssl
)->ticket_decrypt_done
= false;
363 GetTestState(ssl
)->alpn_select_done
= false;
367 static int NewSessionCallback(SSL
*ssl
, SSL_SESSION
*session
) {
368 GetTestState(ssl
)->got_new_session
= true;
369 GetTestState(ssl
)->new_session
.reset(session
);
373 static int TicketKeyCallback(SSL
*ssl
, uint8_t *key_name
, uint8_t *iv
,
374 EVP_CIPHER_CTX
*ctx
, EVP_MAC_CTX
*hmac_ctx
,
376 OSSL_PARAM params
[3], *p
= params
;
379 if (GetTestState(ssl
)->ticket_decrypt_done
) {
380 fprintf(stderr
, "TicketKeyCallback called after completion.\n");
384 GetTestState(ssl
)->ticket_decrypt_done
= true;
387 // This is just test code, so use the all-zeros key.
388 static const uint8_t kZeros
[16] = {0};
391 memcpy(key_name
, kZeros
, sizeof(kZeros
));
393 } else if (memcmp(key_name
, kZeros
, 16) != 0) {
397 *p
++ = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST
,
398 const_cast<char *>("SHA256"), 0);
399 *p
++ = OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY
,
402 *p
= OSSL_PARAM_construct_end();
404 if (!EVP_CipherInit_ex(ctx
, EVP_aes_128_cbc(), NULL
, kZeros
, iv
, encrypt
)
405 || !EVP_MAC_init(hmac_ctx
)
406 || !EVP_MAC_CTX_set_params(hmac_ctx
, params
)) {
411 return GetTestConfig(ssl
)->renew_ticket
? 2 : 1;
416 // kCustomExtensionValue is the extension value that the custom extension
417 // callbacks will add.
418 static const uint16_t kCustomExtensionValue
= 1234;
419 static void *const kCustomExtensionAddArg
=
420 reinterpret_cast<void *>(kCustomExtensionValue
);
421 static void *const kCustomExtensionParseArg
=
422 reinterpret_cast<void *>(kCustomExtensionValue
+ 1);
423 static const char kCustomExtensionContents
[] = "custom extension";
425 static int CustomExtensionAddCallback(SSL
*ssl
, unsigned extension_value
,
426 const uint8_t **out
, size_t *out_len
,
427 int *out_alert_value
, void *add_arg
) {
428 if (extension_value
!= kCustomExtensionValue
||
429 add_arg
!= kCustomExtensionAddArg
) {
433 if (GetTestConfig(ssl
)->custom_extension_skip
) {
436 if (GetTestConfig(ssl
)->custom_extension_fail_add
) {
440 *out
= reinterpret_cast<const uint8_t*>(kCustomExtensionContents
);
441 *out_len
= sizeof(kCustomExtensionContents
) - 1;
446 static void CustomExtensionFreeCallback(SSL
*ssl
, unsigned extension_value
,
447 const uint8_t *out
, void *add_arg
) {
448 if (extension_value
!= kCustomExtensionValue
||
449 add_arg
!= kCustomExtensionAddArg
||
450 out
!= reinterpret_cast<const uint8_t *>(kCustomExtensionContents
)) {
455 static int CustomExtensionParseCallback(SSL
*ssl
, unsigned extension_value
,
456 const uint8_t *contents
,
458 int *out_alert_value
, void *parse_arg
) {
459 if (extension_value
!= kCustomExtensionValue
||
460 parse_arg
!= kCustomExtensionParseArg
) {
464 if (contents_len
!= sizeof(kCustomExtensionContents
) - 1 ||
465 memcmp(contents
, kCustomExtensionContents
, contents_len
) != 0) {
466 *out_alert_value
= SSL_AD_DECODE_ERROR
;
473 static int ServerNameCallback(SSL
*ssl
, int *out_alert
, void *arg
) {
474 // SNI must be accessible from the SNI callback.
475 const TestConfig
*config
= GetTestConfig(ssl
);
476 const char *server_name
= SSL_get_servername(ssl
, TLSEXT_NAMETYPE_host_name
);
477 if (server_name
== nullptr ||
478 std::string(server_name
) != config
->expected_server_name
) {
479 fprintf(stderr
, "servername mismatch (got %s; want %s)\n", server_name
,
480 config
->expected_server_name
.c_str());
481 return SSL_TLSEXT_ERR_ALERT_FATAL
;
484 return SSL_TLSEXT_ERR_OK
;
487 // Connect returns a new socket connected to localhost on |port| or -1 on
489 static int Connect(uint16_t port
) {
490 int sock
= socket(AF_INET
, SOCK_STREAM
, 0);
492 PrintSocketError("socket");
496 if (setsockopt(sock
, IPPROTO_TCP
, TCP_NODELAY
,
497 reinterpret_cast<const char*>(&nodelay
), sizeof(nodelay
)) != 0) {
498 PrintSocketError("setsockopt");
503 memset(&sin
, 0, sizeof(sin
));
504 sin
.sin_family
= AF_INET
;
505 sin
.sin_port
= htons(port
);
506 if (!inet_pton(AF_INET
, "127.0.0.1", &sin
.sin_addr
)) {
507 PrintSocketError("inet_pton");
511 if (connect(sock
, reinterpret_cast<const sockaddr
*>(&sin
),
513 PrintSocketError("connect");
522 explicit SocketCloser(int sock
) : sock_(sock
) {}
524 // Half-close and drain the socket before releasing it. This seems to be
525 // necessary for graceful shutdown on Windows. It will also avoid write
526 // failures in the test runner.
527 #if defined(OPENSSL_SYS_WINDOWS)
528 shutdown(sock_
, SD_SEND
);
530 shutdown(sock_
, SHUT_WR
);
534 if (recv(sock_
, buf
, sizeof(buf
), 0) <= 0) {
545 static bssl::UniquePtr
<SSL_CTX
> SetupCtx(const TestConfig
*config
) {
546 const char sess_id_ctx
[] = "ossl_shim";
547 bssl::UniquePtr
<SSL_CTX
> ssl_ctx(SSL_CTX_new(
548 config
->is_dtls
? DTLS_method() : TLS_method()));
553 SSL_CTX_set_security_level(ssl_ctx
.get(), 0);
555 /* Disabled for now until we have some TLS1.3 support */
556 // Enable TLS 1.3 for tests.
557 if (!config
->is_dtls
&&
558 !SSL_CTX_set_max_proto_version(ssl_ctx
.get(), TLS1_3_VERSION
)) {
562 /* Ensure we don't negotiate TLSv1.3 until we can handle it */
563 if (!config
->is_dtls
&&
564 !SSL_CTX_set_max_proto_version(ssl_ctx
.get(), TLS1_2_VERSION
)) {
569 std::string cipher_list
= "ALL";
570 if (!config
->cipher
.empty()) {
571 cipher_list
= config
->cipher
;
572 SSL_CTX_set_options(ssl_ctx
.get(), SSL_OP_CIPHER_SERVER_PREFERENCE
);
574 if (!SSL_CTX_set_cipher_list(ssl_ctx
.get(), cipher_list
.c_str())) {
580 if (config
->use_sparse_dh_prime
) {
585 if (p
== NULL
|| g
== NULL
|| tmpdh
== NULL
) {
591 // This prime number is 2^1024 + 643 – a value just above a power of two.
592 // Because of its form, values modulo it are essentially certain to be one
593 // byte shorter. This is used to test padding of these values.
596 "1000000000000000000000000000000000000000000000000000000000000000"
597 "0000000000000000000000000000000000000000000000000000000000000000"
598 "0000000000000000000000000000000000000000000000000000000000000000"
599 "0000000000000000000000000000000000000000000000000000000000000028"
601 !BN_set_word(g
, 2)) {
607 DH_set0_pqg(tmpdh
, p
, NULL
, g
);
609 tmpdh
= DH_get_2048_256();
612 bssl::UniquePtr
<DH
> dh(tmpdh
);
614 if (!dh
|| !SSL_CTX_set_tmp_dh(ssl_ctx
.get(), dh
.get())) {
618 SSL_CTX_set_session_cache_mode(ssl_ctx
.get(), SSL_SESS_CACHE_BOTH
);
620 if (config
->use_old_client_cert_callback
) {
621 SSL_CTX_set_client_cert_cb(ssl_ctx
.get(), ClientCertCallback
);
624 SSL_CTX_set_npn_advertised_cb(
625 ssl_ctx
.get(), NextProtosAdvertisedCallback
, NULL
);
626 if (!config
->select_next_proto
.empty()) {
627 SSL_CTX_set_next_proto_select_cb(ssl_ctx
.get(), NextProtoSelectCallback
,
631 if (!config
->select_alpn
.empty() || config
->decline_alpn
) {
632 SSL_CTX_set_alpn_select_cb(ssl_ctx
.get(), AlpnSelectCallback
, NULL
);
635 SSL_CTX_set_info_callback(ssl_ctx
.get(), InfoCallback
);
636 SSL_CTX_sess_set_new_cb(ssl_ctx
.get(), NewSessionCallback
);
638 if (config
->use_ticket_callback
) {
639 SSL_CTX_set_tlsext_ticket_key_evp_cb(ssl_ctx
.get(), TicketKeyCallback
);
642 if (config
->enable_client_custom_extension
&&
643 !SSL_CTX_add_client_custom_ext(
644 ssl_ctx
.get(), kCustomExtensionValue
, CustomExtensionAddCallback
,
645 CustomExtensionFreeCallback
, kCustomExtensionAddArg
,
646 CustomExtensionParseCallback
, kCustomExtensionParseArg
)) {
650 if (config
->enable_server_custom_extension
&&
651 !SSL_CTX_add_server_custom_ext(
652 ssl_ctx
.get(), kCustomExtensionValue
, CustomExtensionAddCallback
,
653 CustomExtensionFreeCallback
, kCustomExtensionAddArg
,
654 CustomExtensionParseCallback
, kCustomExtensionParseArg
)) {
658 if (config
->verify_fail
) {
659 SSL_CTX_set_cert_verify_callback(ssl_ctx
.get(), VerifyFail
, NULL
);
661 SSL_CTX_set_cert_verify_callback(ssl_ctx
.get(), VerifySucceed
, NULL
);
664 if (config
->use_null_client_ca_list
) {
665 SSL_CTX_set_client_CA_list(ssl_ctx
.get(), nullptr);
668 if (!SSL_CTX_set_session_id_context(ssl_ctx
.get(),
669 (const unsigned char *)sess_id_ctx
,
670 sizeof(sess_id_ctx
) - 1))
673 if (!config
->expected_server_name
.empty()) {
674 SSL_CTX_set_tlsext_servername_callback(ssl_ctx
.get(), ServerNameCallback
);
680 // RetryAsync is called after a failed operation on |ssl| with return code
681 // |ret|. If the operation should be retried, it simulates one asynchronous
682 // event and returns true. Otherwise it returns false.
683 static bool RetryAsync(SSL
*ssl
, int ret
) {
684 // No error; don't retry.
689 TestState
*test_state
= GetTestState(ssl
);
690 assert(GetTestConfig(ssl
)->async
);
692 if (test_state
->packeted_bio
!= nullptr &&
693 PacketedBioAdvanceClock(test_state
->packeted_bio
)) {
694 // The DTLS retransmit logic silently ignores write failures. So the test
695 // may progress, allow writes through synchronously.
696 AsyncBioEnforceWriteQuota(test_state
->async_bio
, false);
697 int timeout_ret
= DTLSv1_handle_timeout(ssl
);
698 AsyncBioEnforceWriteQuota(test_state
->async_bio
, true);
700 if (timeout_ret
< 0) {
701 fprintf(stderr
, "Error retransmitting.\n");
707 // See if we needed to read or write more. If so, allow one byte through on
708 // the appropriate end to maximally stress the state machine.
709 switch (SSL_get_error(ssl
, ret
)) {
710 case SSL_ERROR_WANT_READ
:
711 AsyncBioAllowRead(test_state
->async_bio
, 1);
713 case SSL_ERROR_WANT_WRITE
:
714 AsyncBioAllowWrite(test_state
->async_bio
, 1);
716 case SSL_ERROR_WANT_X509_LOOKUP
:
717 test_state
->cert_ready
= true;
724 // DoRead reads from |ssl|, resolving any asynchronous operations. It returns
725 // the result value of the final |SSL_read| call.
726 static int DoRead(SSL
*ssl
, uint8_t *out
, size_t max_out
) {
727 const TestConfig
*config
= GetTestConfig(ssl
);
728 TestState
*test_state
= GetTestState(ssl
);
732 // The DTLS retransmit logic silently ignores write failures. So the test
733 // may progress, allow writes through synchronously. |SSL_read| may
734 // trigger a retransmit, so disconnect the write quota.
735 AsyncBioEnforceWriteQuota(test_state
->async_bio
, false);
737 ret
= config
->peek_then_read
? SSL_peek(ssl
, out
, max_out
)
738 : SSL_read(ssl
, out
, max_out
);
740 AsyncBioEnforceWriteQuota(test_state
->async_bio
, true);
742 } while (config
->async
&& RetryAsync(ssl
, ret
));
744 if (config
->peek_then_read
&& ret
> 0) {
745 std::unique_ptr
<uint8_t[]> buf(new uint8_t[static_cast<size_t>(ret
)]);
747 // SSL_peek should synchronously return the same data.
748 int ret2
= SSL_peek(ssl
, buf
.get(), ret
);
750 memcmp(buf
.get(), out
, ret
) != 0) {
751 fprintf(stderr
, "First and second SSL_peek did not match.\n");
755 // SSL_read should synchronously return the same data and consume it.
756 ret2
= SSL_read(ssl
, buf
.get(), ret
);
758 memcmp(buf
.get(), out
, ret
) != 0) {
759 fprintf(stderr
, "SSL_peek and SSL_read did not match.\n");
767 // WriteAll writes |in_len| bytes from |in| to |ssl|, resolving any asynchronous
768 // operations. It returns the result of the final |SSL_write| call.
769 static int WriteAll(SSL
*ssl
, const uint8_t *in
, size_t in_len
) {
770 const TestConfig
*config
= GetTestConfig(ssl
);
773 ret
= SSL_write(ssl
, in
, in_len
);
778 } while ((config
->async
&& RetryAsync(ssl
, ret
)) || (ret
> 0 && in_len
> 0));
782 // DoShutdown calls |SSL_shutdown|, resolving any asynchronous operations. It
783 // returns the result of the final |SSL_shutdown| call.
784 static int DoShutdown(SSL
*ssl
) {
785 const TestConfig
*config
= GetTestConfig(ssl
);
788 ret
= SSL_shutdown(ssl
);
789 } while (config
->async
&& RetryAsync(ssl
, ret
));
793 static uint16_t GetProtocolVersion(const SSL
*ssl
) {
794 uint16_t version
= SSL_version(ssl
);
795 if (!SSL_is_dtls(ssl
)) {
798 return 0x0201 + ~version
;
801 // CheckHandshakeProperties checks, immediately after |ssl| completes its
802 // initial handshake (or False Starts), whether all the properties are
803 // consistent with the test configuration and invariants.
804 static bool CheckHandshakeProperties(SSL
*ssl
, bool is_resume
) {
805 const TestConfig
*config
= GetTestConfig(ssl
);
807 if (SSL_get_current_cipher(ssl
) == nullptr) {
808 fprintf(stderr
, "null cipher after handshake\n");
813 (!!SSL_session_reused(ssl
) == config
->expect_session_miss
)) {
814 fprintf(stderr
, "session was%s reused\n",
815 SSL_session_reused(ssl
) ? "" : " not");
819 if (!GetTestState(ssl
)->handshake_done
) {
820 fprintf(stderr
, "handshake was not completed\n");
824 if (!config
->is_server
) {
825 bool expect_new_session
=
826 !config
->expect_no_session
&&
827 (!SSL_session_reused(ssl
) || config
->expect_ticket_renewal
) &&
828 // Session tickets are sent post-handshake in TLS 1.3.
829 GetProtocolVersion(ssl
) < TLS1_3_VERSION
;
830 if (expect_new_session
!= GetTestState(ssl
)->got_new_session
) {
832 "new session was%s cached, but we expected the opposite\n",
833 GetTestState(ssl
)->got_new_session
? "" : " not");
838 if (!config
->expected_server_name
.empty()) {
839 const char *server_name
=
840 SSL_get_servername(ssl
, TLSEXT_NAMETYPE_host_name
);
841 if (server_name
== nullptr ||
842 std::string(server_name
) != config
->expected_server_name
) {
843 fprintf(stderr
, "servername mismatch (got %s; want %s)\n",
844 server_name
, config
->expected_server_name
.c_str());
849 if (!config
->expected_next_proto
.empty()) {
850 const uint8_t *next_proto
;
851 unsigned next_proto_len
;
852 SSL_get0_next_proto_negotiated(ssl
, &next_proto
, &next_proto_len
);
853 if (next_proto_len
!= config
->expected_next_proto
.size() ||
854 memcmp(next_proto
, config
->expected_next_proto
.data(),
855 next_proto_len
) != 0) {
856 fprintf(stderr
, "negotiated next proto mismatch\n");
861 if (!config
->expected_alpn
.empty()) {
862 const uint8_t *alpn_proto
;
863 unsigned alpn_proto_len
;
864 SSL_get0_alpn_selected(ssl
, &alpn_proto
, &alpn_proto_len
);
865 if (alpn_proto_len
!= config
->expected_alpn
.size() ||
866 memcmp(alpn_proto
, config
->expected_alpn
.data(),
867 alpn_proto_len
) != 0) {
868 fprintf(stderr
, "negotiated alpn proto mismatch\n");
873 if (config
->expect_extended_master_secret
) {
874 if (!SSL_get_extms_support(ssl
)) {
875 fprintf(stderr
, "No EMS for connection when expected");
880 if (config
->expect_verify_result
) {
881 int expected_verify_result
= config
->verify_fail
?
882 X509_V_ERR_APPLICATION_VERIFICATION
:
885 if (SSL_get_verify_result(ssl
) != expected_verify_result
) {
886 fprintf(stderr
, "Wrong certificate verification result\n");
891 if (!config
->psk
.empty()) {
892 if (SSL_get_peer_cert_chain(ssl
) != nullptr) {
893 fprintf(stderr
, "Received peer certificate on a PSK cipher.\n");
896 } else if (!config
->is_server
|| config
->require_any_client_certificate
) {
897 if (SSL_get_peer_certificate(ssl
) == nullptr) {
898 fprintf(stderr
, "Received no peer certificate but expected one.\n");
906 // DoExchange runs a test SSL exchange against the peer. On success, it returns
907 // true and sets |*out_session| to the negotiated SSL session. If the test is a
908 // resumption attempt, |is_resume| is true and |session| is the session from the
909 // previous exchange.
910 static bool DoExchange(bssl::UniquePtr
<SSL_SESSION
> *out_session
,
911 SSL_CTX
*ssl_ctx
, const TestConfig
*config
,
912 bool is_resume
, SSL_SESSION
*session
) {
913 bssl::UniquePtr
<SSL
> ssl(SSL_new(ssl_ctx
));
918 if (!SetTestConfig(ssl
.get(), config
) ||
919 !SetTestState(ssl
.get(), std::unique_ptr
<TestState
>(new TestState
))) {
923 if (config
->fallback_scsv
&&
924 !SSL_set_mode(ssl
.get(), SSL_MODE_SEND_FALLBACK_SCSV
)) {
927 // Install the certificate synchronously if nothing else will handle it.
928 if (!config
->use_old_client_cert_callback
&&
930 !InstallCertificate(ssl
.get())) {
933 SSL_set_cert_cb(ssl
.get(), CertCallback
, nullptr);
934 if (config
->require_any_client_certificate
) {
935 SSL_set_verify(ssl
.get(), SSL_VERIFY_PEER
|SSL_VERIFY_FAIL_IF_NO_PEER_CERT
,
938 if (config
->verify_peer
) {
939 SSL_set_verify(ssl
.get(), SSL_VERIFY_PEER
, NULL
);
941 if (config
->partial_write
) {
942 SSL_set_mode(ssl
.get(), SSL_MODE_ENABLE_PARTIAL_WRITE
);
944 if (config
->no_tls13
) {
945 SSL_set_options(ssl
.get(), SSL_OP_NO_TLSv1_3
);
947 if (config
->no_tls12
) {
948 SSL_set_options(ssl
.get(), SSL_OP_NO_TLSv1_2
);
950 if (config
->no_tls11
) {
951 SSL_set_options(ssl
.get(), SSL_OP_NO_TLSv1_1
);
953 if (config
->no_tls1
) {
954 SSL_set_options(ssl
.get(), SSL_OP_NO_TLSv1
);
956 if (config
->no_ssl3
) {
957 SSL_set_options(ssl
.get(), SSL_OP_NO_SSLv3
);
959 if (!config
->host_name
.empty() &&
960 !SSL_set_tlsext_host_name(ssl
.get(), config
->host_name
.c_str())) {
963 if (!config
->advertise_alpn
.empty() &&
964 SSL_set_alpn_protos(ssl
.get(),
965 (const uint8_t *)config
->advertise_alpn
.data(),
966 config
->advertise_alpn
.size()) != 0) {
969 if (!config
->psk
.empty()) {
970 SSL_set_psk_client_callback(ssl
.get(), PskClientCallback
);
971 SSL_set_psk_server_callback(ssl
.get(), PskServerCallback
);
973 if (!config
->psk_identity
.empty() &&
974 !SSL_use_psk_identity_hint(ssl
.get(), config
->psk_identity
.c_str())) {
977 if (!config
->srtp_profiles
.empty() &&
978 SSL_set_tlsext_use_srtp(ssl
.get(), config
->srtp_profiles
.c_str())) {
981 if (config
->min_version
!= 0 &&
982 !SSL_set_min_proto_version(ssl
.get(), (uint16_t)config
->min_version
)) {
985 if (config
->max_version
!= 0 &&
986 !SSL_set_max_proto_version(ssl
.get(), (uint16_t)config
->max_version
)) {
989 if (config
->mtu
!= 0) {
990 SSL_set_options(ssl
.get(), SSL_OP_NO_QUERY_MTU
);
991 SSL_set_mtu(ssl
.get(), config
->mtu
);
993 if (config
->renegotiate_freely
) {
994 // This is always on for OpenSSL.
996 if (!config
->check_close_notify
) {
997 SSL_set_quiet_shutdown(ssl
.get(), 1);
999 if (config
->p384_only
) {
1000 int nid
= NID_secp384r1
;
1001 if (!SSL_set1_curves(ssl
.get(), &nid
, 1)) {
1005 if (config
->enable_all_curves
) {
1006 static const int kAllCurves
[] = {
1007 NID_X25519
, NID_X9_62_prime256v1
, NID_X448
, NID_secp521r1
, NID_secp384r1
1009 if (!SSL_set1_curves(ssl
.get(), kAllCurves
,
1010 OPENSSL_ARRAY_SIZE(kAllCurves
))) {
1014 if (config
->max_cert_list
> 0) {
1015 SSL_set_max_cert_list(ssl
.get(), config
->max_cert_list
);
1018 if (!config
->async
) {
1019 SSL_set_mode(ssl
.get(), SSL_MODE_AUTO_RETRY
);
1022 int sock
= Connect(config
->port
);
1026 SocketCloser
closer(sock
);
1028 bssl::UniquePtr
<BIO
> bio(BIO_new_socket(sock
, BIO_NOCLOSE
));
1032 if (config
->is_dtls
) {
1033 bssl::UniquePtr
<BIO
> packeted
= PacketedBioCreate(!config
->async
);
1037 GetTestState(ssl
.get())->packeted_bio
= packeted
.get();
1038 BIO_push(packeted
.get(), bio
.release());
1039 bio
= std::move(packeted
);
1041 if (config
->async
) {
1042 bssl::UniquePtr
<BIO
> async_scoped
=
1043 config
->is_dtls
? AsyncBioCreateDatagram() : AsyncBioCreate();
1044 if (!async_scoped
) {
1047 BIO_push(async_scoped
.get(), bio
.release());
1048 GetTestState(ssl
.get())->async_bio
= async_scoped
.get();
1049 bio
= std::move(async_scoped
);
1051 SSL_set_bio(ssl
.get(), bio
.get(), bio
.get());
1052 bio
.release(); // SSL_set_bio takes ownership.
1054 if (session
!= NULL
) {
1055 if (!config
->is_server
) {
1056 if (SSL_set_session(ssl
.get(), session
) != 1) {
1063 // KNOWN BUG: OpenSSL's SSL_get_current_cipher behaves incorrectly when
1064 // offering resumption.
1065 if (SSL_get_current_cipher(ssl
.get()) != nullptr) {
1066 fprintf(stderr
, "non-null cipher before handshake\n");
1072 if (config
->implicit_handshake
) {
1073 if (config
->is_server
) {
1074 SSL_set_accept_state(ssl
.get());
1076 SSL_set_connect_state(ssl
.get());
1080 if (config
->is_server
) {
1081 ret
= SSL_accept(ssl
.get());
1083 ret
= SSL_connect(ssl
.get());
1085 } while (config
->async
&& RetryAsync(ssl
.get(), ret
));
1087 !CheckHandshakeProperties(ssl
.get(), is_resume
)) {
1091 // Reset the state to assert later that the callback isn't called in
1093 GetTestState(ssl
.get())->got_new_session
= false;
1096 if (config
->export_keying_material
> 0) {
1097 std::vector
<uint8_t> result(
1098 static_cast<size_t>(config
->export_keying_material
));
1099 if (SSL_export_keying_material(
1100 ssl
.get(), result
.data(), result
.size(),
1101 config
->export_label
.data(), config
->export_label
.size(),
1102 reinterpret_cast<const uint8_t*>(config
->export_context
.data()),
1103 config
->export_context
.size(), config
->use_export_context
) != 1) {
1104 fprintf(stderr
, "failed to export keying material\n");
1107 if (WriteAll(ssl
.get(), result
.data(), result
.size()) < 0) {
1112 if (config
->write_different_record_sizes
) {
1113 if (config
->is_dtls
) {
1114 fprintf(stderr
, "write_different_record_sizes not supported for DTLS\n");
1117 // This mode writes a number of different record sizes in an attempt to
1118 // trip up the CBC record splitting code.
1119 static const size_t kBufLen
= 32769;
1120 std::unique_ptr
<uint8_t[]> buf(new uint8_t[kBufLen
]);
1121 memset(buf
.get(), 0x42, kBufLen
);
1122 static const size_t kRecordSizes
[] = {
1123 0, 1, 255, 256, 257, 16383, 16384, 16385, 32767, 32768, 32769};
1124 for (size_t i
= 0; i
< OPENSSL_ARRAY_SIZE(kRecordSizes
); i
++) {
1125 const size_t len
= kRecordSizes
[i
];
1126 if (len
> kBufLen
) {
1127 fprintf(stderr
, "Bad kRecordSizes value.\n");
1130 if (WriteAll(ssl
.get(), buf
.get(), len
) < 0) {
1135 if (config
->shim_writes_first
) {
1136 if (WriteAll(ssl
.get(), reinterpret_cast<const uint8_t *>("hello"),
1141 if (!config
->shim_shuts_down
) {
1143 static const size_t kBufLen
= 16384;
1144 std::unique_ptr
<uint8_t[]> buf(new uint8_t[kBufLen
]);
1146 // Read only 512 bytes at a time in TLS to ensure records may be
1147 // returned in multiple reads.
1148 int n
= DoRead(ssl
.get(), buf
.get(), config
->is_dtls
? kBufLen
: 512);
1149 int err
= SSL_get_error(ssl
.get(), n
);
1150 if (err
== SSL_ERROR_ZERO_RETURN
||
1151 (n
== 0 && err
== SSL_ERROR_SYSCALL
)) {
1153 fprintf(stderr
, "Invalid SSL_get_error output\n");
1156 // Stop on either clean or unclean shutdown.
1158 } else if (err
!= SSL_ERROR_NONE
) {
1160 fprintf(stderr
, "Invalid SSL_get_error output\n");
1165 // Successfully read data.
1167 fprintf(stderr
, "Invalid SSL_get_error output\n");
1171 // After a successful read, with or without False Start, the handshake
1172 // must be complete.
1173 if (!GetTestState(ssl
.get())->handshake_done
) {
1174 fprintf(stderr
, "handshake was not completed after SSL_read\n");
1178 for (int i
= 0; i
< n
; i
++) {
1181 if (WriteAll(ssl
.get(), buf
.get(), n
) < 0) {
1188 if (!config
->is_server
&&
1189 !config
->implicit_handshake
&&
1190 // Session tickets are sent post-handshake in TLS 1.3.
1191 GetProtocolVersion(ssl
.get()) < TLS1_3_VERSION
&&
1192 GetTestState(ssl
.get())->got_new_session
) {
1193 fprintf(stderr
, "new session was established after the handshake\n");
1197 if (GetProtocolVersion(ssl
.get()) >= TLS1_3_VERSION
&& !config
->is_server
) {
1198 bool expect_new_session
=
1199 !config
->expect_no_session
&& !config
->shim_shuts_down
;
1200 if (expect_new_session
!= GetTestState(ssl
.get())->got_new_session
) {
1202 "new session was%s cached, but we expected the opposite\n",
1203 GetTestState(ssl
.get())->got_new_session
? "" : " not");
1209 *out_session
= std::move(GetTestState(ssl
.get())->new_session
);
1212 ret
= DoShutdown(ssl
.get());
1214 if (config
->shim_shuts_down
&& config
->check_close_notify
) {
1215 // We initiate shutdown, so |SSL_shutdown| will return in two stages. First
1216 // it returns zero when our close_notify is sent, then one when the peer's
1219 fprintf(stderr
, "Unexpected SSL_shutdown result: %d != 0\n", ret
);
1222 ret
= DoShutdown(ssl
.get());
1226 fprintf(stderr
, "Unexpected SSL_shutdown result: %d != 1\n", ret
);
1230 if (SSL_total_renegotiations(ssl
.get()) !=
1231 config
->expect_total_renegotiations
) {
1232 fprintf(stderr
, "Expected %d renegotiations, got %ld\n",
1233 config
->expect_total_renegotiations
,
1234 SSL_total_renegotiations(ssl
.get()));
1241 class StderrDelimiter
{
1243 ~StderrDelimiter() { fprintf(stderr
, "--- DONE ---\n"); }
1246 static int Main(int argc
, char **argv
) {
1247 // To distinguish ASan's output from ours, add a trailing message to stderr.
1248 // Anything following this line will be considered an error.
1249 StderrDelimiter delimiter
;
1251 #if defined(OPENSSL_SYS_WINDOWS)
1252 /* Initialize Winsock. */
1253 WORD wsa_version
= MAKEWORD(2, 2);
1255 int wsa_err
= WSAStartup(wsa_version
, &wsa_data
);
1257 fprintf(stderr
, "WSAStartup failed: %d\n", wsa_err
);
1260 if (wsa_data
.wVersion
!= wsa_version
) {
1261 fprintf(stderr
, "Didn't get expected version: %x\n", wsa_data
.wVersion
);
1265 signal(SIGPIPE
, SIG_IGN
);
1268 OPENSSL_init_crypto(0, NULL
);
1269 OPENSSL_init_ssl(0, NULL
);
1270 g_config_index
= SSL_get_ex_new_index(0, NULL
, NULL
, NULL
, NULL
);
1271 g_state_index
= SSL_get_ex_new_index(0, NULL
, NULL
, NULL
, TestStateExFree
);
1272 if (g_config_index
< 0 || g_state_index
< 0) {
1277 if (!ParseConfig(argc
- 1, argv
+ 1, &config
)) {
1278 return Usage(argv
[0]);
1281 bssl::UniquePtr
<SSL_CTX
> ssl_ctx
= SetupCtx(&config
);
1283 ERR_print_errors_fp(stderr
);
1287 bssl::UniquePtr
<SSL_SESSION
> session
;
1288 for (int i
= 0; i
< config
.resume_count
+ 1; i
++) {
1289 bool is_resume
= i
> 0;
1290 if (is_resume
&& !config
.is_server
&& !session
) {
1291 fprintf(stderr
, "No session to offer.\n");
1295 bssl::UniquePtr
<SSL_SESSION
> offer_session
= std::move(session
);
1296 if (!DoExchange(&session
, ssl_ctx
.get(), &config
, is_resume
,
1297 offer_session
.get())) {
1298 fprintf(stderr
, "Connection %d failed.\n", i
+ 1);
1299 ERR_print_errors_fp(stderr
);
1309 int main(int argc
, char **argv
) {
1310 return bssl::Main(argc
, argv
);