From 6582661f7b369c3ce7edab5fea2529de5f2fb408 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 3 Nov 2020 15:51:23 +0000 Subject: [PATCH] Test that we can negotiate TLSv1.3 if we have an SNI callback If an SNI callback has been set then we may have no certificuates suitable for TLSv1.3 use configured for the current SSL_CTX. This should not prevent us from negotiating TLSv1.3, since we may change the SSL_CTX by the time we need a suitable certificate. Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/13304) --- test/sslapitest.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) diff --git a/test/sslapitest.c b/test/sslapitest.c index 6592b6bda6d..6683fccbedb 100644 --- a/test/sslapitest.c +++ b/test/sslapitest.c @@ -8372,6 +8372,62 @@ static int test_dh_auto(int idx) # endif /* OPENSSL_NO_DH */ #endif /* OPENSSL_NO_TLS1_2 */ +#ifndef OPENSSL_NO_TLS1_3 +/* + * Test that setting an SNI callback works with TLSv1.3. Specifically we check + * that it works even without a certificate configured for the original + * SSL_CTX + */ +static int test_sni_tls13(void) +{ + SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL; + SSL *clientssl = NULL, *serverssl = NULL; + int testresult = 0; + + /* Reset callback counter */ + snicb = 0; + + /* Create an initial SSL_CTX with no certificate configured */ + sctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method()); + if (!TEST_ptr(sctx)) + goto end; + /* Require TLSv1.3 as a minimum */ + if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(), + TLS_client_method(), TLS1_3_VERSION, 0, + &sctx2, &cctx, cert, privkey))) + goto end; + + /* Set up SNI */ + if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx, sni_cb)) + || !TEST_true(SSL_CTX_set_tlsext_servername_arg(sctx, sctx2))) + goto end; + + /* + * Connection should still succeed because the final SSL_CTX has the right + * certificates configured. + */ + if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, + &clientssl, NULL, NULL)) + || !TEST_true(create_ssl_connection(serverssl, clientssl, + SSL_ERROR_NONE))) + goto end; + + /* We should have had the SNI callback called exactly once */ + if (!TEST_int_eq(snicb, 1)) + goto end; + + testresult = 1; + +end: + SSL_free(serverssl); + SSL_free(clientssl); + SSL_CTX_free(sctx2); + SSL_CTX_free(sctx); + SSL_CTX_free(cctx); + return testresult; +} +#endif + OPT_TEST_DECLARE_USAGE("certfile privkeyfile srpvfile tmpfile provider config\n") int setup_tests(void) @@ -8614,6 +8670,9 @@ int setup_tests(void) ADD_ALL_TESTS(test_set_tmp_dh, 11); ADD_ALL_TESTS(test_dh_auto, 7); # endif +#endif +#ifndef OPENSSL_NO_TLS1_3 + ADD_TEST(test_sni_tls13); #endif return 1; -- 2.47.2