2 * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 * Unit test for Cisco DTLS1_BAD_VER session resume, as used by
12 * AnyConnect VPN protocol.
14 * This is designed to exercise the code paths in
15 * http://git.infradead.org/users/dwmw2/openconnect.git/blob/HEAD:/dtls.c
16 * which have frequently been affected by regressions in DTLS1_BAD_VER
19 * Note that unlike other SSL tests, we don't test against our own SSL
20 * server method. Firstly because we don't have one; we *only* support
21 * DTLS1_BAD_VER as a client. And secondly because even if that were
22 * fixed up it's the wrong thing to test against — because if changes
23 * are made in generic DTLS code which don't take DTLS1_BAD_VER into
24 * account, there's plenty of scope for making those changes such that
25 * they break *both* the client and the server in the same way.
27 * So we handle the server side manually. In a session resume there isn't
28 * much to be done anyway.
32 /* On Windows this will include <winsock2.h> and thus it needs to be
33 * included *before* anything that includes <windows.h>. Ick. */
34 #include "e_os.h" /* for 'inline' */
36 #include <openssl/bio.h>
37 #include <openssl/crypto.h>
38 #include <openssl/evp.h>
39 #include <openssl/ssl.h>
40 #include <openssl/err.h>
41 #include <openssl/rand.h>
43 /* PACKET functions lifted from OpenSSL 1.1's ssl/packet_locl.h */
45 /* Pointer to where we are currently reading from */
46 const unsigned char *curr;
47 /* Number of bytes remaining */
51 /* Internal unchecked shorthand; don't use outside this file. */
52 static inline void packet_forward(PACKET *pkt, size_t len)
55 pkt->remaining -= len;
59 * Returns the number of bytes remaining to be read in the PACKET
61 static inline size_t PACKET_remaining(const PACKET *pkt)
63 return pkt->remaining;
67 * Initialise a PACKET with |len| bytes held in |buf|. This does not make a
68 * copy of the data so |buf| must be present for the whole time that the PACKET
71 static inline int PACKET_buf_init(PACKET *pkt,
72 const unsigned char *buf,
75 /* Sanity check for negative values. */
76 if (len > (size_t)65536)
85 * Returns 1 if the packet has length |num| and its contents equal the |num|
86 * bytes read from |ptr|. Returns 0 otherwise (lengths or contents not equal).
87 * If lengths are equal, performs the comparison in constant time.
89 static inline int PACKET_equal(const PACKET *pkt, const void *ptr,
92 if (PACKET_remaining(pkt) != num)
94 return CRYPTO_memcmp(pkt->curr, ptr, num) == 0;
98 * Peek ahead at 2 bytes in network order from |pkt| and store the value in
101 static inline int PACKET_peek_net_2(const PACKET *pkt,
104 if (PACKET_remaining(pkt) < 2)
107 *data = ((unsigned int)(*pkt->curr)) << 8;
108 *data |= *(pkt->curr + 1);
113 /* Equivalent of n2s */
114 /* Get 2 bytes in network order from |pkt| and store the value in |*data| */
115 static inline int PACKET_get_net_2(PACKET *pkt,
118 if (!PACKET_peek_net_2(pkt, data))
121 packet_forward(pkt, 2);
126 /* Peek ahead at 1 byte from |pkt| and store the value in |*data| */
127 static inline int PACKET_peek_1(const PACKET *pkt,
130 if (!PACKET_remaining(pkt))
138 /* Get 1 byte from |pkt| and store the value in |*data| */
139 static inline int PACKET_get_1(PACKET *pkt, unsigned int *data)
141 if (!PACKET_peek_1(pkt, data))
144 packet_forward(pkt, 1);
150 * Peek ahead at |len| bytes from the |pkt| and store a pointer to them in
151 * |*data|. This just points at the underlying buffer that |pkt| is using. The
152 * caller should not free this data directly (it will be freed when the
153 * underlying buffer gets freed
155 static inline int PACKET_peek_bytes(const PACKET *pkt,
156 const unsigned char **data,
159 if (PACKET_remaining(pkt) < len)
168 * Read |len| bytes from the |pkt| and store a pointer to them in |*data|. This
169 * just points at the underlying buffer that |pkt| is using. The caller should
170 * not free this data directly (it will be freed when the underlying buffer gets
173 static inline int PACKET_get_bytes(PACKET *pkt,
174 const unsigned char **data,
177 if (!PACKET_peek_bytes(pkt, data, len))
180 packet_forward(pkt, len);
185 /* Peek ahead at |len| bytes from |pkt| and copy them to |data| */
186 static inline int PACKET_peek_copy_bytes(const PACKET *pkt,
190 if (PACKET_remaining(pkt) < len)
193 memcpy(data, pkt->curr, len);
199 * Read |len| bytes from |pkt| and copy them to |data|.
200 * The caller is responsible for ensuring that |data| can hold |len| bytes.
202 static inline int PACKET_copy_bytes(PACKET *pkt,
206 if (!PACKET_peek_copy_bytes(pkt, data, len))
209 packet_forward(pkt, len);
215 /* Move the current reading position forward |len| bytes */
216 static inline int PACKET_forward(PACKET *pkt, size_t len)
218 if (PACKET_remaining(pkt) < len)
221 packet_forward(pkt, len);
227 * Reads a variable-length vector prefixed with a one-byte length, and stores
228 * the contents in |subpkt|. |pkt| can equal |subpkt|.
229 * Data is not copied: the |subpkt| packet will share its underlying buffer with
230 * the original |pkt|, so data wrapped by |pkt| must outlive the |subpkt|.
231 * Upon failure, the original |pkt| and |subpkt| are not modified.
233 static inline int PACKET_get_length_prefixed_1(PACKET *pkt,
237 const unsigned char *data;
239 if (!PACKET_get_1(&tmp, &length) ||
240 !PACKET_get_bytes(&tmp, &data, (size_t)length)) {
246 subpkt->remaining = length;
251 #define OSSL_NELEM(x) (sizeof(x)/sizeof(x[0]))
253 /* For DTLS1_BAD_VER packets the MAC doesn't include the handshake header */
254 #define MAC_OFFSET (DTLS1_RT_HEADER_LENGTH + DTLS1_HM_HEADER_LENGTH)
256 static unsigned char client_random[SSL3_RANDOM_SIZE];
257 static unsigned char server_random[SSL3_RANDOM_SIZE];
259 /* These are all generated locally, sized purely according to our own whim */
260 static unsigned char session_id[32];
261 static unsigned char master_secret[48];
262 static unsigned char cookie[20];
264 /* We've hard-coded the cipher suite; we know it's 104 bytes */
265 static unsigned char key_block[104];
266 #define mac_key (key_block + 20)
267 #define dec_key (key_block + 40)
268 #define enc_key (key_block + 56)
270 static EVP_MD_CTX handshake_md5;
271 static EVP_MD_CTX handshake_sha1;
273 /* PRF lifted from ssl/t1_enc.c since we can't easily use it directly */
274 static int tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
276 const void *seed1, int seed1_len,
277 const void *seed2, int seed2_len,
278 const void *seed3, int seed3_len,
279 unsigned char *out, int olen)
283 EVP_MD_CTX ctx, ctx_tmp, ctx_init;
284 EVP_PKEY *prf_mac_key;
285 unsigned char A1[EVP_MAX_MD_SIZE];
289 chunk = EVP_MD_size(md);
290 OPENSSL_assert(chunk >= 0);
292 EVP_MD_CTX_init(&ctx);
293 EVP_MD_CTX_init(&ctx_tmp);
294 EVP_MD_CTX_init(&ctx_init);
295 EVP_MD_CTX_set_flags(&ctx_init, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
296 prf_mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, sec, sec_len);
299 if (!EVP_DigestSignInit(&ctx_init, NULL, md, NULL, prf_mac_key))
301 if (!EVP_MD_CTX_copy_ex(&ctx, &ctx_init))
303 if (seed1 && !EVP_DigestSignUpdate(&ctx, seed1, seed1_len))
305 if (seed2 && !EVP_DigestSignUpdate(&ctx, seed2, seed2_len))
307 if (seed3 && !EVP_DigestSignUpdate(&ctx, seed3, seed3_len))
309 if (!EVP_DigestSignFinal(&ctx, A1, &A1_len))
313 /* Reinit mac contexts */
314 if (!EVP_MD_CTX_copy_ex(&ctx, &ctx_init))
316 if (!EVP_DigestSignUpdate(&ctx, A1, A1_len))
318 if (olen > chunk && !EVP_MD_CTX_copy_ex(&ctx_tmp, &ctx))
320 if (seed1 && !EVP_DigestSignUpdate(&ctx, seed1, seed1_len))
322 if (seed2 && !EVP_DigestSignUpdate(&ctx, seed2, seed2_len))
324 if (seed3 && !EVP_DigestSignUpdate(&ctx, seed3, seed3_len))
328 if (!EVP_DigestSignFinal(&ctx, out, &j))
332 /* calc the next A1 value */
333 if (!EVP_DigestSignFinal(&ctx_tmp, A1, &A1_len))
335 } else { /* last one */
337 if (!EVP_DigestSignFinal(&ctx, A1, &A1_len))
339 memcpy(out, A1, olen);
345 EVP_PKEY_free(prf_mac_key);
346 EVP_MD_CTX_cleanup(&ctx);
347 EVP_MD_CTX_cleanup(&ctx_tmp);
348 EVP_MD_CTX_cleanup(&ctx_init);
349 OPENSSL_cleanse(A1, sizeof(A1));
353 /* seed1 through seed5 are virtually concatenated */
354 static int do_PRF(const void *seed1, int seed1_len,
355 const void *seed2, int seed2_len,
356 const void *seed3, int seed3_len,
357 unsigned char *out, int olen)
359 unsigned char out2[104];
362 if (olen > (int)sizeof(out2))
365 len = sizeof(master_secret) / 2;
367 if (!tls1_P_hash(EVP_md5(), master_secret, len,
368 seed1, seed1_len, seed2, seed2_len, seed3,
369 seed3_len, out, olen))
372 if (!tls1_P_hash(EVP_sha1(), master_secret + len, len,
373 seed1, seed1_len, seed2, seed2_len, seed3,
374 seed3_len, out2, olen))
377 for (i = 0; i < olen; i++) {
384 static SSL_SESSION *client_session(void)
386 static unsigned char session_asn1[] = {
387 0x30, 0x5F, /* SEQUENCE, length 0x5F */
388 0x02, 0x01, 0x01, /* INTEGER, SSL_SESSION_ASN1_VERSION */
389 0x02, 0x02, 0x01, 0x00, /* INTEGER, DTLS1_BAD_VER */
390 0x04, 0x02, 0x00, 0x2F, /* OCTET_STRING, AES128-SHA */
391 0x04, 0x20, /* OCTET_STRING, session id */
392 #define SS_SESSID_OFS 15 /* Session ID goes here */
393 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
394 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
395 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
396 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
397 0x04, 0x30, /* OCTET_STRING, master secret */
398 #define SS_SECRET_OFS 49 /* Master secret goes here */
399 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
400 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
401 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
402 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
403 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
404 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
406 const unsigned char *p = session_asn1;
408 /* Copy the randomly-generated fields into the above ASN1 */
409 memcpy(session_asn1 + SS_SESSID_OFS, session_id, sizeof(session_id));
410 memcpy(session_asn1 + SS_SECRET_OFS, master_secret, sizeof(master_secret));
412 return d2i_SSL_SESSION(NULL, &p, sizeof(session_asn1));
415 /* Returns 1 for initial ClientHello, 2 for ClientHello with cookie */
416 static int validate_client_hello(BIO *wbio)
421 int cookie_found = 0;
424 len = BIO_get_mem_data(wbio, (char **)&data);
425 if (!PACKET_buf_init(&pkt, data, len))
428 /* Check record header type */
429 if (!PACKET_get_1(&pkt, &u) || u != SSL3_RT_HANDSHAKE)
432 if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)
434 /* Skip the rest of the record header */
435 if (!PACKET_forward(&pkt, DTLS1_RT_HEADER_LENGTH - 3))
438 /* Check it's a ClientHello */
439 if (!PACKET_get_1(&pkt, &u) || u != SSL3_MT_CLIENT_HELLO)
441 /* Skip the rest of the handshake message header */
442 if (!PACKET_forward(&pkt, DTLS1_HM_HEADER_LENGTH - 1))
445 /* Check client version */
446 if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)
450 if (!PACKET_copy_bytes(&pkt, client_random, SSL3_RANDOM_SIZE))
453 /* Check session id length and content */
454 if (!PACKET_get_length_prefixed_1(&pkt, &pkt2) ||
455 !PACKET_equal(&pkt2, session_id, sizeof(session_id)))
459 if (!PACKET_get_length_prefixed_1(&pkt, &pkt2))
461 if (PACKET_remaining(&pkt2)) {
462 if (!PACKET_equal(&pkt2, cookie, sizeof(cookie)))
468 if (!PACKET_get_net_2(&pkt, &u) || !PACKET_forward(&pkt, u))
471 /* Skip compression */
472 if (!PACKET_get_1(&pkt, &u) || !PACKET_forward(&pkt, u))
475 /* Skip extensions */
476 if (!PACKET_get_net_2(&pkt, &u) || !PACKET_forward(&pkt, u))
479 /* Now we are at the end */
480 if (PACKET_remaining(&pkt))
483 /* Update handshake MAC for second ClientHello (with cookie) */
484 if (cookie_found && (!EVP_DigestUpdate(&handshake_md5, data + MAC_OFFSET,
486 !EVP_DigestUpdate(&handshake_sha1, data + MAC_OFFSET,
488 printf("EVP_DigestUpdate() failed\n");
490 (void)BIO_reset(wbio);
492 return 1 + cookie_found;
495 static int send_hello_verify(BIO *rbio)
497 static unsigned char hello_verify[] = {
498 0x16, /* Handshake */
499 0x01, 0x00, /* DTLS1_BAD_VER */
500 0x00, 0x00, /* Epoch 0 */
501 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* Seq# 0 */
502 0x00, 0x23, /* Length */
503 0x03, /* Hello Verify */
504 0x00, 0x00, 0x17, /* Length */
505 0x00, 0x00, /* Seq# 0 */
506 0x00, 0x00, 0x00, /* Fragment offset */
507 0x00, 0x00, 0x17, /* Fragment length */
508 0x01, 0x00, /* DTLS1_BAD_VER */
509 0x14, /* Cookie length */
510 #define HV_COOKIE_OFS 28 /* Cookie goes here */
511 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
512 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
513 0x00, 0x00, 0x00, 0x00,
516 memcpy(hello_verify + HV_COOKIE_OFS, cookie, sizeof(cookie));
518 BIO_write(rbio, hello_verify, sizeof(hello_verify));
523 static int send_server_hello(BIO *rbio)
525 static unsigned char server_hello[] = {
526 0x16, /* Handshake */
527 0x01, 0x00, /* DTLS1_BAD_VER */
528 0x00, 0x00, /* Epoch 0 */
529 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, /* Seq# 1 */
530 0x00, 0x52, /* Length */
531 0x02, /* Server Hello */
532 0x00, 0x00, 0x46, /* Length */
533 0x00, 0x01, /* Seq# */
534 0x00, 0x00, 0x00, /* Fragment offset */
535 0x00, 0x00, 0x46, /* Fragment length */
536 0x01, 0x00, /* DTLS1_BAD_VER */
537 #define SH_RANDOM_OFS 27 /* Server random goes here */
538 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
539 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
540 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
541 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
542 0x20, /* Session ID length */
543 #define SH_SESSID_OFS 60 /* Session ID goes here */
544 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
545 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
546 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
547 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
548 0x00, 0x2f, /* Cipher suite AES128-SHA */
549 0x00, /* Compression null */
551 static unsigned char change_cipher_spec[] = {
552 0x14, /* Change Cipher Spec */
553 0x01, 0x00, /* DTLS1_BAD_VER */
554 0x00, 0x00, /* Epoch 0 */
555 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, /* Seq# 2 */
556 0x00, 0x03, /* Length */
557 0x01, 0x00, 0x02, /* Message */
560 memcpy(server_hello + SH_RANDOM_OFS, server_random, sizeof(server_random));
561 memcpy(server_hello + SH_SESSID_OFS, session_id, sizeof(session_id));
563 if (!EVP_DigestUpdate(&handshake_md5, server_hello + MAC_OFFSET,
564 sizeof(server_hello) - MAC_OFFSET) ||
565 !EVP_DigestUpdate(&handshake_sha1, server_hello + MAC_OFFSET,
566 sizeof(server_hello) - MAC_OFFSET))
567 printf("EVP_DigestUpdate() failed\n");
569 BIO_write(rbio, server_hello, sizeof(server_hello));
570 BIO_write(rbio, change_cipher_spec, sizeof(change_cipher_spec));
575 /* Create header, HMAC, pad, encrypt and send a record */
576 static int send_record(BIO *rbio, unsigned char type, unsigned long seqnr,
577 const void *msg, size_t len)
579 /* Note that the order of the record header fields on the wire,
580 * and in the HMAC, is different. So we just keep them in separate
581 * variables and handle them individually. */
582 static unsigned char epoch[2] = { 0x00, 0x01 };
583 static unsigned char seq[6] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
584 static unsigned char ver[2] = { 0x01, 0x00 }; /* DTLS1_BAD_VER */
585 unsigned char lenbytes[2];
587 EVP_CIPHER_CTX enc_ctx;
588 unsigned char iv[16];
592 #ifdef SIXTY_FOUR_BIT_LONG
593 seq[0] = (seqnr >> 40) & 0xff;
594 seq[1] = (seqnr >> 32) & 0xff;
596 seq[2] = (seqnr >> 24) & 0xff;
597 seq[3] = (seqnr >> 16) & 0xff;
598 seq[4] = (seqnr >> 8) & 0xff;
599 seq[5] = seqnr & 0xff;
601 pad = 15 - ((len + SHA_DIGEST_LENGTH) % 16);
602 enc = OPENSSL_malloc(len + SHA_DIGEST_LENGTH + 1 + pad);
606 /* Copy record to encryption buffer */
607 memcpy(enc, msg, len);
609 /* Append HMAC to data */
610 HMAC_Init(&ctx, mac_key, 20, EVP_sha1());
611 HMAC_Update(&ctx, epoch, 2);
612 HMAC_Update(&ctx, seq, 6);
613 HMAC_Update(&ctx, &type, 1);
614 HMAC_Update(&ctx, ver, 2); /* Version */
615 lenbytes[0] = len >> 8;
616 lenbytes[1] = len & 0xff;
617 HMAC_Update(&ctx, lenbytes, 2); /* Length */
618 HMAC_Update(&ctx, enc, len); /* Finally the data itself */
619 HMAC_Final(&ctx, enc + len, NULL);
620 HMAC_CTX_cleanup(&ctx);
622 /* Append padding bytes */
623 len += SHA_DIGEST_LENGTH;
628 /* Generate IV, and encrypt */
629 RAND_bytes(iv, sizeof(iv));
630 EVP_CIPHER_CTX_init(&enc_ctx);
631 EVP_CipherInit_ex(&enc_ctx, EVP_aes_128_cbc(), NULL, enc_key, iv, 1);
632 EVP_Cipher(&enc_ctx, enc, enc, len);
633 EVP_CIPHER_CTX_cleanup(&enc_ctx);
635 /* Finally write header (from fragmented variables), IV and encrypted record */
636 BIO_write(rbio, &type, 1);
637 BIO_write(rbio, ver, 2);
638 BIO_write(rbio, epoch, 2);
639 BIO_write(rbio, seq, 6);
640 lenbytes[0] = (len + sizeof(iv)) >> 8;
641 lenbytes[1] = (len + sizeof(iv)) & 0xff;
642 BIO_write(rbio, lenbytes, 2);
644 BIO_write(rbio, iv, sizeof(iv));
645 BIO_write(rbio, enc, len);
651 static int send_finished(SSL *s, BIO *rbio)
653 static unsigned char finished_msg[DTLS1_HM_HEADER_LENGTH +
654 TLS1_FINISH_MAC_LENGTH] = {
656 0x00, 0x00, 0x0c, /* Length */
657 0x00, 0x03, /* Seq# 3 */
658 0x00, 0x00, 0x00, /* Fragment offset */
659 0x00, 0x00, 0x0c, /* Fragment length */
660 /* Finished MAC (12 bytes) */
662 unsigned char handshake_hash[EVP_MAX_MD_SIZE * 2];
664 /* Derive key material */
665 do_PRF(TLS_MD_KEY_EXPANSION_CONST, TLS_MD_KEY_EXPANSION_CONST_SIZE,
666 server_random, SSL3_RANDOM_SIZE,
667 client_random, SSL3_RANDOM_SIZE,
668 key_block, sizeof(key_block));
670 /* Generate Finished MAC */
671 if (!EVP_DigestFinal_ex(&handshake_md5, handshake_hash, NULL) ||
672 !EVP_DigestFinal_ex(&handshake_sha1, handshake_hash + EVP_MD_CTX_size(&handshake_md5), NULL))
673 printf("EVP_DigestFinal_ex() failed\n");
675 do_PRF(TLS_MD_SERVER_FINISH_CONST, TLS_MD_SERVER_FINISH_CONST_SIZE,
676 handshake_hash, EVP_MD_CTX_size(&handshake_md5) + EVP_MD_CTX_size(&handshake_sha1),
678 finished_msg + DTLS1_HM_HEADER_LENGTH, TLS1_FINISH_MAC_LENGTH);
680 return send_record(rbio, SSL3_RT_HANDSHAKE, 0,
681 finished_msg, sizeof(finished_msg));
684 static int validate_ccs(BIO *wbio)
691 len = BIO_get_mem_data(wbio, (char **)&data);
692 if (!PACKET_buf_init(&pkt, data, len))
695 /* Check record header type */
696 if (!PACKET_get_1(&pkt, &u) || u != SSL3_RT_CHANGE_CIPHER_SPEC)
699 if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)
701 /* Skip the rest of the record header */
702 if (!PACKET_forward(&pkt, DTLS1_RT_HEADER_LENGTH - 3))
705 /* Check ChangeCipherSpec message */
706 if (!PACKET_get_1(&pkt, &u) || u != SSL3_MT_CCS)
708 /* A DTLS1_BAD_VER ChangeCipherSpec also contains the
709 * handshake sequence number (which is 2 here) */
710 if (!PACKET_get_net_2(&pkt, &u) || u != 0x0002)
713 /* Now check the Finished packet */
714 if (!PACKET_get_1(&pkt, &u) || u != SSL3_RT_HANDSHAKE)
716 if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)
719 /* Check epoch is now 1 */
720 if (!PACKET_get_net_2(&pkt, &u) || u != 0x0001)
723 /* That'll do for now. If OpenSSL accepted *our* Finished packet
724 * then it's evidently remembered that DTLS1_BAD_VER doesn't
725 * include the handshake header in the MAC. There's not a lot of
726 * point in implementing decryption here, just to check that it
727 * continues to get it right for one more packet. */
732 #define NODROP(x) { x##UL, 0 }
733 #define DROP(x) { x##UL, 1 }
739 NODROP(1), NODROP(3), NODROP(2),
740 NODROP(0x1234), NODROP(0x1230), NODROP(0x1235),
741 NODROP(0xffff), NODROP(0x10001), NODROP(0xfffe), NODROP(0x10000),
742 DROP(0x10001), DROP(0xff), NODROP(0x100000), NODROP(0x800000), NODROP(0x7fffe1),
743 NODROP(0xffffff), NODROP(0x1000000), NODROP(0xfffffe), DROP(0xffffff), NODROP(0x1000010),
744 NODROP(0xfffffd), NODROP(0x1000011), DROP(0x12), NODROP(0x1000012),
745 NODROP(0x1ffffff), NODROP(0x2000000), DROP(0x1ff00fe), NODROP(0x2000001),
746 NODROP(0x20fffff), NODROP(0x2105500), DROP(0x20ffffe), NODROP(0x21054ff),
747 NODROP(0x211ffff), DROP(0x2110000), NODROP(0x2120000)
748 /* The last test should be NODROP, because a DROP wouldn't get tested. */
751 int main(int argc, char *argv[])
764 SSL_load_error_strings();
766 err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);
768 CRYPTO_malloc_debug_init();
769 CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
770 CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
772 RAND_bytes(session_id, sizeof(session_id));
773 RAND_bytes(master_secret, sizeof(master_secret));
774 RAND_bytes(cookie, sizeof(cookie));
775 RAND_bytes(server_random + 4, sizeof(server_random) - 4);
776 time((void *)server_random);
778 sess = client_session();
780 printf("Failed to generate SSL_SESSION\n");
784 if (!EVP_DigestInit_ex(&handshake_md5, EVP_md5(), NULL) ||
785 !EVP_DigestInit_ex(&handshake_sha1, EVP_sha1(), NULL)) {
786 printf("Failed to initialise handshake_md\n");
790 ctx = SSL_CTX_new(DTLSv1_client_method());
792 printf("Failed to allocate SSL_CTX\n");
795 SSL_CTX_set_options(ctx, SSL_OP_CISCO_ANYCONNECT);
797 if (!SSL_CTX_set_cipher_list(ctx, "AES128-SHA")) {
798 printf("SSL_CTX_set_cipher_list() failed\n");
803 if (!SSL_set_session(con, sess)) {
804 printf("SSL_set_session() failed\n");
807 SSL_SESSION_free(sess);
809 rbio = BIO_new(BIO_s_mem());
810 wbio = BIO_new(BIO_s_mem());
812 BIO_set_nbio(rbio, 1);
813 BIO_set_nbio(wbio, 1);
815 SSL_set_bio(con, rbio, wbio);
816 SSL_set_connect_state(con);
818 /* Send initial ClientHello */
819 ret = SSL_do_handshake(con);
820 if (ret > 0 || SSL_get_error(con, ret) != SSL_ERROR_WANT_READ) {
821 printf("Unexpected handshake result at initial call!\n");
825 if (validate_client_hello(wbio) != 1) {
826 printf("Initial ClientHello failed validation\n");
829 if (send_hello_verify(rbio) != 1) {
830 printf("Failed to send HelloVerify\n");
833 ret = SSL_do_handshake(con);
834 if (ret > 0 || SSL_get_error(con, ret) != SSL_ERROR_WANT_READ) {
835 printf("Unexpected handshake result after HelloVerify!\n");
838 if (validate_client_hello(wbio) != 2) {
839 printf("Second ClientHello failed validation\n");
842 if (send_server_hello(rbio) != 1) {
843 printf("Failed to send ServerHello\n");
846 ret = SSL_do_handshake(con);
847 if (ret > 0 || SSL_get_error(con, ret) != SSL_ERROR_WANT_READ) {
848 printf("Unexpected handshake result after ServerHello!\n");
851 if (send_finished(con, rbio) != 1) {
852 printf("Failed to send Finished\n");
855 ret = SSL_do_handshake(con);
857 printf("Handshake not successful after Finished!\n");
860 if (validate_ccs(wbio) != 1) {
861 printf("Failed to validate client CCS/Finished\n");
865 /* While we're here and crafting packets by hand, we might as well do a
866 bit of a stress test on the DTLS record replay handling. Not Cisco-DTLS
867 specific but useful anyway for the general case. It's been broken
868 before, and in fact was broken even for a basic 0, 2, 1 test case
869 when this test was first added.... */
870 for (i = 0; i < (int)OSSL_NELEM(tests); i++) {
871 unsigned long recv_buf[2];
873 if (send_record(rbio, SSL3_RT_APPLICATION_DATA, tests[i].seq,
874 &tests[i].seq, sizeof(unsigned long)) != 1) {
875 printf("Failed to send data seq #0x%lx (%d)\n",
883 ret = SSL_read(con, recv_buf, 2 * sizeof(unsigned long));
884 if (ret != sizeof(unsigned long)) {
885 printf("SSL_read failed or wrong size on seq#0x%lx (%d)\n",
889 if (recv_buf[0] != tests[i].seq) {
890 printf("Wrong data packet received (0x%lx not 0x%lx) at packet %d\n",
891 recv_buf[0], tests[i].seq, i);
895 if (tests[i-1].drop) {
896 printf("Error: last test cannot be DROP()\n");
906 EVP_MD_CTX_cleanup(&handshake_md5);
907 EVP_MD_CTX_cleanup(&handshake_sha1);
909 ERR_print_errors_fp(stderr);
912 printf("Cisco BadDTLS test: FAILED\n");
916 ERR_remove_thread_state(NULL);
918 CRYPTO_cleanup_all_ex_data();
919 CRYPTO_mem_leaks(err);
922 return testresult?0:1;