2 * Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
12 #include <openssl/opensslconf.h>
13 #include <openssl/bio.h>
14 #include <openssl/crypto.h>
15 #include <openssl/ssl.h>
16 #include <openssl/ocsp.h>
18 #include "ssltestlib.h"
20 #include "internal/nelem.h"
21 #include "../ssl/ssl_locl.h"
23 static char *cert = NULL;
24 static char *privkey = NULL;
26 #define LOG_BUFFER_SIZE 1024
27 static char server_log_buffer[LOG_BUFFER_SIZE + 1] = {0};
28 static size_t server_log_buffer_index = 0;
29 static char client_log_buffer[LOG_BUFFER_SIZE + 1] = {0};
30 static size_t client_log_buffer_index = 0;
31 static int error_writing_log = 0;
33 #ifndef OPENSSL_NO_OCSP
34 static const unsigned char orespder[] = "Dummy OCSP Response";
35 static int ocsp_server_called = 0;
36 static int ocsp_client_called = 0;
38 static int cdummyarg = 1;
39 static X509 *ocspcert = NULL;
42 #define NUM_EXTRA_CERTS 40
43 #define CLIENT_VERSION_LEN 2
46 * This structure is used to validate that the correct number of log messages
47 * of various types are emitted when emitting secret logs.
49 struct sslapitest_log_counts {
50 unsigned int rsa_key_exchange_count;
51 unsigned int master_secret_count;
52 unsigned int client_handshake_secret_count;
53 unsigned int server_handshake_secret_count;
54 unsigned int client_application_secret_count;
55 unsigned int server_application_secret_count;
59 static unsigned char serverinfov1[] = {
60 0xff, 0xff, /* Dummy extension type */
61 0x00, 0x01, /* Extension length is 1 byte */
62 0xff /* Dummy extension data */
65 static unsigned char serverinfov2[] = {
67 (unsigned char)(SSL_EXT_CLIENT_HELLO & 0xff), /* Dummy context - 4 bytes */
68 0xff, 0xff, /* Dummy extension type */
69 0x00, 0x01, /* Extension length is 1 byte */
70 0xff /* Dummy extension data */
73 static void client_keylog_callback(const SSL *ssl, const char *line)
75 int line_length = strlen(line);
77 /* If the log doesn't fit, error out. */
78 if (client_log_buffer_index + line_length > sizeof(client_log_buffer) - 1) {
79 TEST_info("Client log too full");
80 error_writing_log = 1;
84 strcat(client_log_buffer, line);
85 client_log_buffer_index += line_length;
86 client_log_buffer[client_log_buffer_index++] = '\n';
89 static void server_keylog_callback(const SSL *ssl, const char *line)
91 int line_length = strlen(line);
93 /* If the log doesn't fit, error out. */
94 if (server_log_buffer_index + line_length > sizeof(server_log_buffer) - 1) {
95 TEST_info("Server log too full");
96 error_writing_log = 1;
100 strcat(server_log_buffer, line);
101 server_log_buffer_index += line_length;
102 server_log_buffer[server_log_buffer_index++] = '\n';
105 static int compare_hex_encoded_buffer(const char *hex_encoded,
113 if (!TEST_size_t_eq(raw_length * 2, hex_length))
116 for (i = j = 0; i < raw_length && j + 1 < hex_length; i++, j += 2) {
117 sprintf(hexed, "%02x", raw[i]);
118 if (!TEST_int_eq(hexed[0], hex_encoded[j])
119 || !TEST_int_eq(hexed[1], hex_encoded[j + 1]))
126 static int test_keylog_output(char *buffer, const SSL *ssl,
127 const SSL_SESSION *session,
128 struct sslapitest_log_counts *expected)
131 unsigned char actual_client_random[SSL3_RANDOM_SIZE] = {0};
132 size_t client_random_size = SSL3_RANDOM_SIZE;
133 unsigned char actual_master_key[SSL_MAX_MASTER_KEY_LENGTH] = {0};
134 size_t master_key_size = SSL_MAX_MASTER_KEY_LENGTH;
135 unsigned int rsa_key_exchange_count = 0;
136 unsigned int master_secret_count = 0;
137 unsigned int client_handshake_secret_count = 0;
138 unsigned int server_handshake_secret_count = 0;
139 unsigned int client_application_secret_count = 0;
140 unsigned int server_application_secret_count = 0;
142 for (token = strtok(buffer, " \n"); token != NULL;
143 token = strtok(NULL, " \n")) {
144 if (strcmp(token, "RSA") == 0) {
146 * Premaster secret. Tokens should be: 16 ASCII bytes of
147 * hex-encoded encrypted secret, then the hex-encoded pre-master
150 if (!TEST_ptr(token = strtok(NULL, " \n")))
152 if (!TEST_size_t_eq(strlen(token), 16))
154 if (!TEST_ptr(token = strtok(NULL, " \n")))
157 * We can't sensibly check the log because the premaster secret is
158 * transient, and OpenSSL doesn't keep hold of it once the master
159 * secret is generated.
161 rsa_key_exchange_count++;
162 } else if (strcmp(token, "CLIENT_RANDOM") == 0) {
164 * Master secret. Tokens should be: 64 ASCII bytes of hex-encoded
165 * client random, then the hex-encoded master secret.
167 client_random_size = SSL_get_client_random(ssl,
168 actual_client_random,
170 if (!TEST_size_t_eq(client_random_size, SSL3_RANDOM_SIZE))
173 if (!TEST_ptr(token = strtok(NULL, " \n")))
175 if (!TEST_size_t_eq(strlen(token), 64))
177 if (!TEST_false(compare_hex_encoded_buffer(token, 64,
178 actual_client_random,
179 client_random_size)))
182 if (!TEST_ptr(token = strtok(NULL, " \n")))
184 master_key_size = SSL_SESSION_get_master_key(session,
187 if (!TEST_size_t_ne(master_key_size, 0))
189 if (!TEST_false(compare_hex_encoded_buffer(token, strlen(token),
193 master_secret_count++;
194 } else if (strcmp(token, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0
195 || strcmp(token, "SERVER_HANDSHAKE_TRAFFIC_SECRET") == 0
196 || strcmp(token, "CLIENT_TRAFFIC_SECRET_0") == 0
197 || strcmp(token, "SERVER_TRAFFIC_SECRET_0") == 0) {
199 * TLSv1.3 secret. Tokens should be: 64 ASCII bytes of hex-encoded
200 * client random, and then the hex-encoded secret. In this case,
201 * we treat all of these secrets identically and then just
202 * distinguish between them when counting what we saw.
204 if (strcmp(token, "CLIENT_HANDSHAKE_TRAFFIC_SECRET") == 0)
205 client_handshake_secret_count++;
206 else if (strcmp(token, "SERVER_HANDSHAKE_TRAFFIC_SECRET") == 0)
207 server_handshake_secret_count++;
208 else if (strcmp(token, "CLIENT_TRAFFIC_SECRET_0") == 0)
209 client_application_secret_count++;
210 else if (strcmp(token, "SERVER_TRAFFIC_SECRET_0") == 0)
211 server_application_secret_count++;
213 client_random_size = SSL_get_client_random(ssl,
214 actual_client_random,
216 if (!TEST_size_t_eq(client_random_size, SSL3_RANDOM_SIZE))
219 if (!TEST_ptr(token = strtok(NULL, " \n")))
221 if (!TEST_size_t_eq(strlen(token), 64))
223 if (!TEST_false(compare_hex_encoded_buffer(token, 64,
224 actual_client_random,
225 client_random_size)))
228 if (!TEST_ptr(token = strtok(NULL, " \n")))
232 * TODO(TLS1.3): test that application traffic secrets are what
235 TEST_info("Unexpected token %s\n", token);
240 /* Got what we expected? */
241 if (!TEST_size_t_eq(rsa_key_exchange_count,
242 expected->rsa_key_exchange_count)
243 || !TEST_size_t_eq(master_secret_count,
244 expected->master_secret_count)
245 || !TEST_size_t_eq(client_handshake_secret_count,
246 expected->client_handshake_secret_count)
247 || !TEST_size_t_eq(server_handshake_secret_count,
248 expected->server_handshake_secret_count)
249 || !TEST_size_t_eq(client_application_secret_count,
250 expected->client_application_secret_count)
251 || !TEST_size_t_eq(server_application_secret_count,
252 expected->server_application_secret_count))
257 #if !defined(OPENSSL_NO_TLS1_2) || defined(OPENSSL_NO_TLS1_3)
258 static int test_keylog(void)
260 SSL_CTX *cctx = NULL, *sctx = NULL;
261 SSL *clientssl = NULL, *serverssl = NULL;
263 struct sslapitest_log_counts expected = {0};
265 /* Clean up logging space */
266 memset(client_log_buffer, 0, sizeof(client_log_buffer));
267 memset(server_log_buffer, 0, sizeof(server_log_buffer));
268 client_log_buffer_index = 0;
269 server_log_buffer_index = 0;
270 error_writing_log = 0;
272 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
274 &sctx, &cctx, cert, privkey)))
277 /* We cannot log the master secret for TLSv1.3, so we should forbid it. */
278 SSL_CTX_set_options(cctx, SSL_OP_NO_TLSv1_3);
279 SSL_CTX_set_options(sctx, SSL_OP_NO_TLSv1_3);
281 /* We also want to ensure that we use RSA-based key exchange. */
282 if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "RSA")))
285 if (!TEST_true(SSL_CTX_get_keylog_callback(cctx) == NULL)
286 || !TEST_true(SSL_CTX_get_keylog_callback(sctx) == NULL))
288 SSL_CTX_set_keylog_callback(cctx, client_keylog_callback);
289 if (!TEST_true(SSL_CTX_get_keylog_callback(cctx)
290 == client_keylog_callback))
292 SSL_CTX_set_keylog_callback(sctx, server_keylog_callback);
293 if (!TEST_true(SSL_CTX_get_keylog_callback(sctx)
294 == server_keylog_callback))
297 /* Now do a handshake and check that the logs have been written to. */
298 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
299 &clientssl, NULL, NULL))
300 || !TEST_true(create_ssl_connection(serverssl, clientssl,
302 || !TEST_false(error_writing_log)
303 || !TEST_int_gt(client_log_buffer_index, 0)
304 || !TEST_int_gt(server_log_buffer_index, 0))
308 * Now we want to test that our output data was vaguely sensible. We
309 * do that by using strtok and confirming that we have more or less the
310 * data we expect. For both client and server, we expect to see one master
311 * secret. The client should also see a RSA key exchange.
313 expected.rsa_key_exchange_count = 1;
314 expected.master_secret_count = 1;
315 if (!TEST_true(test_keylog_output(client_log_buffer, clientssl,
316 SSL_get_session(clientssl), &expected)))
319 expected.rsa_key_exchange_count = 0;
320 if (!TEST_true(test_keylog_output(server_log_buffer, serverssl,
321 SSL_get_session(serverssl), &expected)))
336 #ifndef OPENSSL_NO_TLS1_3
337 static int test_keylog_no_master_key(void)
339 SSL_CTX *cctx = NULL, *sctx = NULL;
340 SSL *clientssl = NULL, *serverssl = NULL;
342 struct sslapitest_log_counts expected = {0};
344 /* Clean up logging space */
345 memset(client_log_buffer, 0, sizeof(client_log_buffer));
346 memset(server_log_buffer, 0, sizeof(server_log_buffer));
347 client_log_buffer_index = 0;
348 server_log_buffer_index = 0;
349 error_writing_log = 0;
351 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
352 TLS_client_method(), &sctx,
353 &cctx, cert, privkey)))
356 if (!TEST_true(SSL_CTX_get_keylog_callback(cctx) == NULL)
357 || !TEST_true(SSL_CTX_get_keylog_callback(sctx) == NULL))
360 SSL_CTX_set_keylog_callback(cctx, client_keylog_callback);
361 if (!TEST_true(SSL_CTX_get_keylog_callback(cctx)
362 == client_keylog_callback))
365 SSL_CTX_set_keylog_callback(sctx, server_keylog_callback);
366 if (!TEST_true(SSL_CTX_get_keylog_callback(sctx)
367 == server_keylog_callback))
370 /* Now do a handshake and check that the logs have been written to. */
371 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
372 &clientssl, NULL, NULL))
373 || !TEST_true(create_ssl_connection(serverssl, clientssl,
375 || !TEST_false(error_writing_log))
379 * Now we want to test that our output data was vaguely sensible. For this
380 * test, we expect no CLIENT_RANDOM entry because it doesn't make sense for
381 * TLSv1.3, but we do expect both client and server to emit keys.
383 expected.client_handshake_secret_count = 1;
384 expected.server_handshake_secret_count = 1;
385 expected.client_application_secret_count = 1;
386 expected.server_application_secret_count = 1;
387 if (!TEST_true(test_keylog_output(client_log_buffer, clientssl,
388 SSL_get_session(clientssl), &expected))
389 || !TEST_true(test_keylog_output(server_log_buffer, serverssl,
390 SSL_get_session(serverssl),
406 #ifndef OPENSSL_NO_TLS1_2
407 static int full_client_hello_callback(SSL *s, int *al, void *arg)
410 const unsigned char *p;
412 /* We only configure two ciphers, but the SCSV is added automatically. */
414 const unsigned char expected_ciphers[] = {0x00, 0x9d, 0x00, 0xff};
416 const unsigned char expected_ciphers[] = {0x00, 0x9d, 0xc0,
419 const int expected_extensions[] = {
420 #ifndef OPENSSL_NO_EC
426 /* Make sure we can defer processing and get called back. */
428 return SSL_CLIENT_HELLO_RETRY;
430 len = SSL_client_hello_get0_ciphers(s, &p);
431 if (!TEST_mem_eq(p, len, expected_ciphers, sizeof(expected_ciphers))
433 SSL_client_hello_get0_compression_methods(s, &p), 1)
434 || !TEST_int_eq(*p, 0))
435 return SSL_CLIENT_HELLO_ERROR;
436 if (!SSL_client_hello_get1_extensions_present(s, &exts, &len))
437 return SSL_CLIENT_HELLO_ERROR;
438 if (len != OSSL_NELEM(expected_extensions) ||
439 memcmp(exts, expected_extensions, len * sizeof(*exts)) != 0) {
440 printf("ClientHello callback expected extensions mismatch\n");
442 return SSL_CLIENT_HELLO_ERROR;
445 return SSL_CLIENT_HELLO_SUCCESS;
448 static int test_client_hello_cb(void)
450 SSL_CTX *cctx = NULL, *sctx = NULL;
451 SSL *clientssl = NULL, *serverssl = NULL;
452 int testctr = 0, testresult = 0;
454 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
455 TLS_client_method(), &sctx,
456 &cctx, cert, privkey)))
458 SSL_CTX_set_client_hello_cb(sctx, full_client_hello_callback, &testctr);
460 /* The gimpy cipher list we configure can't do TLS 1.3. */
461 SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION);
463 if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
464 "AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384"))
465 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
466 &clientssl, NULL, NULL))
467 || !TEST_false(create_ssl_connection(serverssl, clientssl,
468 SSL_ERROR_WANT_CLIENT_HELLO_CB))
470 * Passing a -1 literal is a hack since
471 * the real value was lost.
473 || !TEST_int_eq(SSL_get_error(serverssl, -1),
474 SSL_ERROR_WANT_CLIENT_HELLO_CB)
475 || !TEST_true(create_ssl_connection(serverssl, clientssl,
491 static int execute_test_large_message(const SSL_METHOD *smeth,
492 const SSL_METHOD *cmeth, int read_ahead)
494 SSL_CTX *cctx = NULL, *sctx = NULL;
495 SSL *clientssl = NULL, *serverssl = NULL;
499 X509 *chaincert = NULL;
502 if (!TEST_ptr(certbio = BIO_new_file(cert, "r")))
504 chaincert = PEM_read_bio_X509(certbio, NULL, NULL, NULL);
507 if (!TEST_ptr(chaincert))
510 if (!TEST_true(create_ssl_ctx_pair(smeth, cmeth, &sctx,
511 &cctx, cert, privkey)))
516 * Test that read_ahead works correctly when dealing with large
519 SSL_CTX_set_read_ahead(cctx, 1);
523 * We assume the supplied certificate is big enough so that if we add
524 * NUM_EXTRA_CERTS it will make the overall message large enough. The
525 * default buffer size is requested to be 16k, but due to the way BUF_MEM
526 * works, it ends up allocating a little over 21k (16 * 4/3). So, in this
527 * test we need to have a message larger than that.
529 certlen = i2d_X509(chaincert, NULL);
530 OPENSSL_assert(certlen * NUM_EXTRA_CERTS >
531 (SSL3_RT_MAX_PLAIN_LENGTH * 4) / 3);
532 for (i = 0; i < NUM_EXTRA_CERTS; i++) {
533 if (!X509_up_ref(chaincert))
535 if (!SSL_CTX_add_extra_chain_cert(sctx, chaincert)) {
536 X509_free(chaincert);
541 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
543 || !TEST_true(create_ssl_connection(serverssl, clientssl,
548 * Calling SSL_clear() first is not required but this tests that SSL_clear()
549 * doesn't leak (when using enable-crypto-mdebug).
551 if (!TEST_true(SSL_clear(serverssl)))
556 X509_free(chaincert);
565 static int test_large_message_tls(void)
567 return execute_test_large_message(TLS_server_method(), TLS_client_method(),
571 static int test_large_message_tls_read_ahead(void)
573 return execute_test_large_message(TLS_server_method(), TLS_client_method(),
577 #ifndef OPENSSL_NO_DTLS
578 static int test_large_message_dtls(void)
581 * read_ahead is not relevant to DTLS because DTLS always acts as if
584 return execute_test_large_message(DTLS_server_method(),
585 DTLS_client_method(), 0);
589 #ifndef OPENSSL_NO_OCSP
590 static int ocsp_server_cb(SSL *s, void *arg)
592 int *argi = (int *)arg;
593 unsigned char *copy = NULL;
594 STACK_OF(OCSP_RESPID) *ids = NULL;
595 OCSP_RESPID *id = NULL;
598 /* In this test we are expecting exactly 1 OCSP_RESPID */
599 SSL_get_tlsext_status_ids(s, &ids);
600 if (ids == NULL || sk_OCSP_RESPID_num(ids) != 1)
601 return SSL_TLSEXT_ERR_ALERT_FATAL;
603 id = sk_OCSP_RESPID_value(ids, 0);
604 if (id == NULL || !OCSP_RESPID_match(id, ocspcert))
605 return SSL_TLSEXT_ERR_ALERT_FATAL;
606 } else if (*argi != 1) {
607 return SSL_TLSEXT_ERR_ALERT_FATAL;
610 if (!TEST_ptr(copy = OPENSSL_memdup(orespder, sizeof(orespder))))
611 return SSL_TLSEXT_ERR_ALERT_FATAL;
613 SSL_set_tlsext_status_ocsp_resp(s, copy, sizeof(orespder));
614 ocsp_server_called = 1;
615 return SSL_TLSEXT_ERR_OK;
618 static int ocsp_client_cb(SSL *s, void *arg)
620 int *argi = (int *)arg;
621 const unsigned char *respderin;
624 if (*argi != 1 && *argi != 2)
627 len = SSL_get_tlsext_status_ocsp_resp(s, &respderin);
628 if (!TEST_mem_eq(orespder, len, respderin, len))
631 ocsp_client_called = 1;
635 static int test_tlsext_status_type(void)
637 SSL_CTX *cctx = NULL, *sctx = NULL;
638 SSL *clientssl = NULL, *serverssl = NULL;
640 STACK_OF(OCSP_RESPID) *ids = NULL;
641 OCSP_RESPID *id = NULL;
644 if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), &sctx,
645 &cctx, cert, privkey))
648 if (SSL_CTX_get_tlsext_status_type(cctx) != -1)
651 /* First just do various checks getting and setting tlsext_status_type */
653 clientssl = SSL_new(cctx);
654 if (!TEST_int_eq(SSL_get_tlsext_status_type(clientssl), -1)
655 || !TEST_true(SSL_set_tlsext_status_type(clientssl,
656 TLSEXT_STATUSTYPE_ocsp))
657 || !TEST_int_eq(SSL_get_tlsext_status_type(clientssl),
658 TLSEXT_STATUSTYPE_ocsp))
664 if (!SSL_CTX_set_tlsext_status_type(cctx, TLSEXT_STATUSTYPE_ocsp)
665 || SSL_CTX_get_tlsext_status_type(cctx) != TLSEXT_STATUSTYPE_ocsp)
668 clientssl = SSL_new(cctx);
669 if (SSL_get_tlsext_status_type(clientssl) != TLSEXT_STATUSTYPE_ocsp)
675 * Now actually do a handshake and check OCSP information is exchanged and
676 * the callbacks get called
678 SSL_CTX_set_tlsext_status_cb(cctx, ocsp_client_cb);
679 SSL_CTX_set_tlsext_status_arg(cctx, &cdummyarg);
680 SSL_CTX_set_tlsext_status_cb(sctx, ocsp_server_cb);
681 SSL_CTX_set_tlsext_status_arg(sctx, &cdummyarg);
682 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
683 &clientssl, NULL, NULL))
684 || !TEST_true(create_ssl_connection(serverssl, clientssl,
686 || !TEST_true(ocsp_client_called)
687 || !TEST_true(ocsp_server_called))
694 /* Try again but this time force the server side callback to fail */
695 ocsp_client_called = 0;
696 ocsp_server_called = 0;
698 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
699 &clientssl, NULL, NULL))
700 /* This should fail because the callback will fail */
701 || !TEST_false(create_ssl_connection(serverssl, clientssl,
703 || !TEST_false(ocsp_client_called)
704 || !TEST_false(ocsp_server_called))
712 * This time we'll get the client to send an OCSP_RESPID that it will
715 ocsp_client_called = 0;
716 ocsp_server_called = 0;
718 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
719 &clientssl, NULL, NULL)))
723 * We'll just use any old cert for this test - it doesn't have to be an OCSP
724 * specific one. We'll use the server cert.
726 if (!TEST_ptr(certbio = BIO_new_file(cert, "r"))
727 || !TEST_ptr(id = OCSP_RESPID_new())
728 || !TEST_ptr(ids = sk_OCSP_RESPID_new_null())
729 || !TEST_ptr(ocspcert = PEM_read_bio_X509(certbio,
731 || !TEST_true(OCSP_RESPID_set_by_key(id, ocspcert))
732 || !TEST_true(sk_OCSP_RESPID_push(ids, id)))
735 SSL_set_tlsext_status_ids(clientssl, ids);
736 /* Control has been transferred */
742 if (!TEST_true(create_ssl_connection(serverssl, clientssl,
744 || !TEST_true(ocsp_client_called)
745 || !TEST_true(ocsp_server_called))
755 sk_OCSP_RESPID_pop_free(ids, OCSP_RESPID_free);
756 OCSP_RESPID_free(id);
765 #if !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)
766 static int new_called, remove_called, get_called;
768 static int new_session_cb(SSL *ssl, SSL_SESSION *sess)
772 * sess has been up-refed for us, but we don't actually need it so free it
775 SSL_SESSION_free(sess);
779 static void remove_session_cb(SSL_CTX *ctx, SSL_SESSION *sess)
784 static SSL_SESSION *get_sess_val = NULL;
786 static SSL_SESSION *get_session_cb(SSL *ssl, const unsigned char *id, int len,
794 static int execute_test_session(int maxprot, int use_int_cache,
797 SSL_CTX *sctx = NULL, *cctx = NULL;
798 SSL *serverssl1 = NULL, *clientssl1 = NULL;
799 SSL *serverssl2 = NULL, *clientssl2 = NULL;
800 # ifndef OPENSSL_NO_TLS1_1
801 SSL *serverssl3 = NULL, *clientssl3 = NULL;
803 SSL_SESSION *sess1 = NULL, *sess2 = NULL;
806 new_called = remove_called = 0;
808 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
809 TLS_client_method(), &sctx,
810 &cctx, cert, privkey)))
814 * Only allow the max protocol version so we can force a connection failure
817 SSL_CTX_set_min_proto_version(cctx, maxprot);
818 SSL_CTX_set_max_proto_version(cctx, maxprot);
820 /* Set up session cache */
822 SSL_CTX_sess_set_new_cb(cctx, new_session_cb);
823 SSL_CTX_sess_set_remove_cb(cctx, remove_session_cb);
826 /* Also covers instance where both are set */
827 SSL_CTX_set_session_cache_mode(cctx, SSL_SESS_CACHE_CLIENT);
829 SSL_CTX_set_session_cache_mode(cctx,
830 SSL_SESS_CACHE_CLIENT
831 | SSL_SESS_CACHE_NO_INTERNAL_STORE);
834 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl1, &clientssl1,
836 || !TEST_true(create_ssl_connection(serverssl1, clientssl1,
838 || !TEST_ptr(sess1 = SSL_get1_session(clientssl1)))
841 /* Should fail because it should already be in the cache */
842 if (use_int_cache && !TEST_false(SSL_CTX_add_session(cctx, sess1)))
845 && (!TEST_int_eq(new_called, 1) || !TEST_int_eq(remove_called, 0)))
848 new_called = remove_called = 0;
849 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl2,
850 &clientssl2, NULL, NULL))
851 || !TEST_true(SSL_set_session(clientssl2, sess1))
852 || !TEST_true(create_ssl_connection(serverssl2, clientssl2,
854 || !TEST_true(SSL_session_reused(clientssl2)))
857 if (maxprot == TLS1_3_VERSION) {
859 * In TLSv1.3 we should have created a new session even though we have
860 * resumed. The original session should also have been removed.
863 && (!TEST_int_eq(new_called, 1)
864 || !TEST_int_eq(remove_called, 1)))
868 * In TLSv1.2 we expect to have resumed so no sessions added or
872 && (!TEST_int_eq(new_called, 0)
873 || !TEST_int_eq(remove_called, 0)))
877 SSL_SESSION_free(sess1);
878 if (!TEST_ptr(sess1 = SSL_get1_session(clientssl2)))
880 shutdown_ssl_connection(serverssl2, clientssl2);
881 serverssl2 = clientssl2 = NULL;
883 new_called = remove_called = 0;
884 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl2,
885 &clientssl2, NULL, NULL))
886 || !TEST_true(create_ssl_connection(serverssl2, clientssl2,
890 if (!TEST_ptr(sess2 = SSL_get1_session(clientssl2)))
894 && (!TEST_int_eq(new_called, 1) || !TEST_int_eq(remove_called, 0)))
897 new_called = remove_called = 0;
899 * This should clear sess2 from the cache because it is a "bad" session.
900 * See SSL_set_session() documentation.
902 if (!TEST_true(SSL_set_session(clientssl2, sess1)))
905 && (!TEST_int_eq(new_called, 0) || !TEST_int_eq(remove_called, 1)))
907 if (!TEST_ptr_eq(SSL_get_session(clientssl2), sess1))
911 /* Should succeeded because it should not already be in the cache */
912 if (!TEST_true(SSL_CTX_add_session(cctx, sess2))
913 || !TEST_true(SSL_CTX_remove_session(cctx, sess2)))
917 new_called = remove_called = 0;
918 /* This shouldn't be in the cache so should fail */
919 if (!TEST_false(SSL_CTX_remove_session(cctx, sess2)))
923 && (!TEST_int_eq(new_called, 0) || !TEST_int_eq(remove_called, 1)))
926 # if !defined(OPENSSL_NO_TLS1_1)
927 new_called = remove_called = 0;
928 /* Force a connection failure */
929 SSL_CTX_set_max_proto_version(sctx, TLS1_1_VERSION);
930 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl3,
931 &clientssl3, NULL, NULL))
932 || !TEST_true(SSL_set_session(clientssl3, sess1))
933 /* This should fail because of the mismatched protocol versions */
934 || !TEST_false(create_ssl_connection(serverssl3, clientssl3,
938 /* We should have automatically removed the session from the cache */
940 && (!TEST_int_eq(new_called, 0) || !TEST_int_eq(remove_called, 1)))
943 /* Should succeed because it should not already be in the cache */
944 if (use_int_cache && !TEST_true(SSL_CTX_add_session(cctx, sess2)))
948 /* Now do some tests for server side caching */
950 SSL_CTX_sess_set_new_cb(cctx, NULL);
951 SSL_CTX_sess_set_remove_cb(cctx, NULL);
952 SSL_CTX_sess_set_new_cb(sctx, new_session_cb);
953 SSL_CTX_sess_set_remove_cb(sctx, remove_session_cb);
954 SSL_CTX_sess_set_get_cb(sctx, get_session_cb);
958 SSL_CTX_set_session_cache_mode(cctx, 0);
959 /* Internal caching is the default on the server side */
961 SSL_CTX_set_session_cache_mode(sctx,
962 SSL_SESS_CACHE_SERVER
963 | SSL_SESS_CACHE_NO_INTERNAL_STORE);
965 SSL_free(serverssl1);
966 SSL_free(clientssl1);
967 serverssl1 = clientssl1 = NULL;
968 SSL_free(serverssl2);
969 SSL_free(clientssl2);
970 serverssl2 = clientssl2 = NULL;
971 SSL_SESSION_free(sess1);
973 SSL_SESSION_free(sess2);
976 SSL_CTX_set_max_proto_version(sctx, maxprot);
977 SSL_CTX_set_options(sctx, SSL_OP_NO_TICKET);
978 new_called = remove_called = get_called = 0;
979 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl1, &clientssl1,
981 || !TEST_true(create_ssl_connection(serverssl1, clientssl1,
983 || !TEST_ptr(sess1 = SSL_get1_session(clientssl1))
984 || !TEST_ptr(sess2 = SSL_get1_session(serverssl1)))
987 /* Should fail because it should already be in the cache */
988 if (use_int_cache && !TEST_false(SSL_CTX_add_session(sctx, sess2)))
992 SSL_SESSION *tmp = sess2;
994 if (!TEST_int_eq(new_called, 1)
995 || !TEST_int_eq(remove_called, 0)
996 || !TEST_int_eq(get_called, 0))
999 * Delete the session from the internal cache to force a lookup from
1000 * the external cache. We take a copy first because
1001 * SSL_CTX_remove_session() also marks the session as non-resumable.
1003 if (use_int_cache) {
1004 if (!TEST_ptr(tmp = SSL_SESSION_dup(sess2))
1005 || !TEST_true(SSL_CTX_remove_session(sctx, sess2)))
1007 SSL_SESSION_free(sess2);
1012 new_called = remove_called = get_called = 0;
1013 get_sess_val = sess2;
1014 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl2,
1015 &clientssl2, NULL, NULL))
1016 || !TEST_true(SSL_set_session(clientssl2, sess1))
1017 || !TEST_true(create_ssl_connection(serverssl2, clientssl2,
1019 || !TEST_true(SSL_session_reused(clientssl2)))
1022 if (use_ext_cache) {
1023 if (!TEST_int_eq(new_called, 0)
1024 || !TEST_int_eq(remove_called, 0))
1027 if (maxprot == TLS1_3_VERSION) {
1028 if (!TEST_int_eq(get_called, 0))
1031 if (!TEST_int_eq(get_called, 1))
1039 SSL_free(serverssl1);
1040 SSL_free(clientssl1);
1041 SSL_free(serverssl2);
1042 SSL_free(clientssl2);
1043 # ifndef OPENSSL_NO_TLS1_1
1044 SSL_free(serverssl3);
1045 SSL_free(clientssl3);
1047 SSL_SESSION_free(sess1);
1048 SSL_SESSION_free(sess2);
1054 #endif /* !defined(OPENSSL_NO_TLS1_3) || !defined(OPENSSL_NO_TLS1_2) */
1056 static int test_session_with_only_int_cache(void)
1058 #ifndef OPENSSL_NO_TLS1_3
1059 if (!execute_test_session(TLS1_3_VERSION, 1, 0))
1063 #ifndef OPENSSL_NO_TLS1_2
1064 return execute_test_session(TLS1_2_VERSION, 1, 0);
1070 static int test_session_with_only_ext_cache(void)
1072 #ifndef OPENSSL_NO_TLS1_3
1073 if (!execute_test_session(TLS1_3_VERSION, 0, 1))
1077 #ifndef OPENSSL_NO_TLS1_2
1078 return execute_test_session(TLS1_2_VERSION, 0, 1);
1084 static int test_session_with_both_cache(void)
1086 #ifndef OPENSSL_NO_TLS1_3
1087 if (!execute_test_session(TLS1_3_VERSION, 1, 1))
1091 #ifndef OPENSSL_NO_TLS1_2
1092 return execute_test_session(TLS1_2_VERSION, 1, 1);
1102 #define TOTAL_SSL_SET_BIO_TESTS (3 * 3 * 3 * 3)
1104 static void setupbio(BIO **res, BIO *bio1, BIO *bio2, int type)
1119 static int test_ssl_set_bio(int idx)
1124 BIO *irbio = NULL, *iwbio = NULL, *nrbio = NULL, *nwbio = NULL;
1126 int initrbio, initwbio, newrbio, newwbio;
1136 if (!TEST_int_le(newwbio, 2))
1139 if (!TEST_ptr(ctx = SSL_CTX_new(TLS_method()))
1140 || !TEST_ptr(ssl = SSL_new(ctx)))
1143 if (initrbio == USE_BIO_1
1144 || initwbio == USE_BIO_1
1145 || newrbio == USE_BIO_1
1146 || newwbio == USE_BIO_1) {
1147 if (!TEST_ptr(bio1 = BIO_new(BIO_s_mem())))
1151 if (initrbio == USE_BIO_2
1152 || initwbio == USE_BIO_2
1153 || newrbio == USE_BIO_2
1154 || newwbio == USE_BIO_2) {
1155 if (!TEST_ptr(bio2 = BIO_new(BIO_s_mem())))
1159 setupbio(&irbio, bio1, bio2, initrbio);
1160 setupbio(&iwbio, bio1, bio2, initwbio);
1163 * We want to maintain our own refs to these BIO, so do an up ref for each
1164 * BIO that will have ownership transferred in the SSL_set_bio() call
1168 if (iwbio != NULL && iwbio != irbio)
1171 SSL_set_bio(ssl, irbio, iwbio);
1173 setupbio(&nrbio, bio1, bio2, newrbio);
1174 setupbio(&nwbio, bio1, bio2, newwbio);
1177 * We will (maybe) transfer ownership again so do more up refs.
1178 * SSL_set_bio() has some really complicated ownership rules where BIOs have
1183 && (nwbio != iwbio || nrbio != nwbio))
1187 && (nwbio != iwbio || (nwbio == iwbio && irbio == iwbio)))
1190 SSL_set_bio(ssl, nrbio, nwbio);
1200 * This test is checking that the ref counting for SSL_set_bio is correct.
1201 * If we get here and we did too many frees then we will fail in the above
1202 * functions. If we haven't done enough then this will only be detected in
1203 * a crypto-mdebug build
1209 typedef enum { NO_BIO_CHANGE, CHANGE_RBIO, CHANGE_WBIO } bio_change_t;
1211 static int execute_test_ssl_bio(int pop_ssl, bio_change_t change_bio)
1213 BIO *sslbio = NULL, *membio1 = NULL, *membio2 = NULL;
1218 if (!TEST_ptr(ctx = SSL_CTX_new(TLS_method()))
1219 || !TEST_ptr(ssl = SSL_new(ctx))
1220 || !TEST_ptr(sslbio = BIO_new(BIO_f_ssl()))
1221 || !TEST_ptr(membio1 = BIO_new(BIO_s_mem())))
1224 BIO_set_ssl(sslbio, ssl, BIO_CLOSE);
1227 * If anything goes wrong here then we could leak memory, so this will
1228 * be caught in a crypto-mdebug build
1230 BIO_push(sslbio, membio1);
1232 /* Verify changing the rbio/wbio directly does not cause leaks */
1233 if (change_bio != NO_BIO_CHANGE) {
1234 if (!TEST_ptr(membio2 = BIO_new(BIO_s_mem())))
1236 if (change_bio == CHANGE_RBIO)
1237 SSL_set0_rbio(ssl, membio2);
1239 SSL_set0_wbio(ssl, membio2);
1258 static int test_ssl_bio_pop_next_bio(void)
1260 return execute_test_ssl_bio(0, NO_BIO_CHANGE);
1263 static int test_ssl_bio_pop_ssl_bio(void)
1265 return execute_test_ssl_bio(1, NO_BIO_CHANGE);
1268 static int test_ssl_bio_change_rbio(void)
1270 return execute_test_ssl_bio(0, CHANGE_RBIO);
1273 static int test_ssl_bio_change_wbio(void)
1275 return execute_test_ssl_bio(0, CHANGE_WBIO);
1278 #if !defined(OPENSSL_NO_TLS1_2) || defined(OPENSSL_NO_TLS1_3)
1280 /* The list of sig algs */
1282 /* The length of the list */
1284 /* A sigalgs list in string format */
1285 const char *liststr;
1286 /* Whether setting the list should succeed */
1288 /* Whether creating a connection with the list should succeed */
1292 static const int validlist1[] = {NID_sha256, EVP_PKEY_RSA};
1293 # ifndef OPENSSL_NO_EC
1294 static const int validlist2[] = {NID_sha256, EVP_PKEY_RSA, NID_sha512, EVP_PKEY_EC};
1295 static const int validlist3[] = {NID_sha512, EVP_PKEY_EC};
1297 static const int invalidlist1[] = {NID_undef, EVP_PKEY_RSA};
1298 static const int invalidlist2[] = {NID_sha256, NID_undef};
1299 static const int invalidlist3[] = {NID_sha256, EVP_PKEY_RSA, NID_sha256};
1300 static const int invalidlist4[] = {NID_sha256};
1301 static const sigalgs_list testsigalgs[] = {
1302 {validlist1, OSSL_NELEM(validlist1), NULL, 1, 1},
1303 # ifndef OPENSSL_NO_EC
1304 {validlist2, OSSL_NELEM(validlist2), NULL, 1, 1},
1305 {validlist3, OSSL_NELEM(validlist3), NULL, 1, 0},
1307 {NULL, 0, "RSA+SHA256", 1, 1},
1308 # ifndef OPENSSL_NO_EC
1309 {NULL, 0, "RSA+SHA256:ECDSA+SHA512", 1, 1},
1310 {NULL, 0, "ECDSA+SHA512", 1, 0},
1312 {invalidlist1, OSSL_NELEM(invalidlist1), NULL, 0, 0},
1313 {invalidlist2, OSSL_NELEM(invalidlist2), NULL, 0, 0},
1314 {invalidlist3, OSSL_NELEM(invalidlist3), NULL, 0, 0},
1315 {invalidlist4, OSSL_NELEM(invalidlist4), NULL, 0, 0},
1316 {NULL, 0, "RSA", 0, 0},
1317 {NULL, 0, "SHA256", 0, 0},
1318 {NULL, 0, "RSA+SHA256:SHA256", 0, 0},
1319 {NULL, 0, "Invalid", 0, 0}
1322 static int test_set_sigalgs(int idx)
1324 SSL_CTX *cctx = NULL, *sctx = NULL;
1325 SSL *clientssl = NULL, *serverssl = NULL;
1327 const sigalgs_list *curr;
1330 /* Should never happen */
1331 if (!TEST_size_t_le((size_t)idx, OSSL_NELEM(testsigalgs) * 2))
1334 testctx = ((size_t)idx < OSSL_NELEM(testsigalgs));
1335 curr = testctx ? &testsigalgs[idx]
1336 : &testsigalgs[idx - OSSL_NELEM(testsigalgs)];
1338 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
1339 TLS_client_method(), &sctx,
1340 &cctx, cert, privkey)))
1344 * TODO(TLS1.3): These APIs cannot set TLSv1.3 sig algs so we just test it
1345 * for TLSv1.2 for now until we add a new API.
1347 SSL_CTX_set_max_proto_version(cctx, TLS1_2_VERSION);
1352 if (curr->list != NULL)
1353 ret = SSL_CTX_set1_sigalgs(cctx, curr->list, curr->listlen);
1355 ret = SSL_CTX_set1_sigalgs_list(cctx, curr->liststr);
1359 TEST_info("Failure setting sigalgs in SSL_CTX (%d)\n", idx);
1365 TEST_info("Not-failed setting sigalgs in SSL_CTX (%d)\n", idx);
1370 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
1371 &clientssl, NULL, NULL)))
1377 if (curr->list != NULL)
1378 ret = SSL_set1_sigalgs(clientssl, curr->list, curr->listlen);
1380 ret = SSL_set1_sigalgs_list(clientssl, curr->liststr);
1383 TEST_info("Failure setting sigalgs in SSL (%d)\n", idx);
1392 if (!TEST_int_eq(create_ssl_connection(serverssl, clientssl,
1400 SSL_free(serverssl);
1401 SSL_free(clientssl);
1409 #ifndef OPENSSL_NO_TLS1_3
1411 static SSL_SESSION *clientpsk = NULL;
1412 static SSL_SESSION *serverpsk = NULL;
1413 static const char *pskid = "Identity";
1414 static const char *srvid;
1416 static int use_session_cb_cnt = 0;
1417 static int find_session_cb_cnt = 0;
1419 static int use_session_cb(SSL *ssl, const EVP_MD *md, const unsigned char **id,
1420 size_t *idlen, SSL_SESSION **sess)
1422 switch (++use_session_cb_cnt) {
1424 /* The first call should always have a NULL md */
1430 /* The second call should always have an md */
1436 /* We should only be called a maximum of twice */
1440 if (clientpsk != NULL)
1441 SSL_SESSION_up_ref(clientpsk);
1444 *id = (const unsigned char *)pskid;
1445 *idlen = strlen(pskid);
1450 static int find_session_cb(SSL *ssl, const unsigned char *identity,
1451 size_t identity_len, SSL_SESSION **sess)
1453 find_session_cb_cnt++;
1455 /* We should only ever be called a maximum of twice per connection */
1456 if (find_session_cb_cnt > 2)
1459 if (serverpsk == NULL)
1462 /* Identity should match that set by the client */
1463 if (strlen(srvid) != identity_len
1464 || strncmp(srvid, (const char *)identity, identity_len) != 0) {
1465 /* No PSK found, continue but without a PSK */
1470 SSL_SESSION_up_ref(serverpsk);
1476 #define MSG1 "Hello"
1477 #define MSG2 "World."
1482 #define MSG7 "message."
1484 #define TLS13_AES_256_GCM_SHA384_BYTES ((const unsigned char *)"\x13\x02")
1487 * Helper method to setup objects for early data test. Caller frees objects on
1490 static int setupearly_data_test(SSL_CTX **cctx, SSL_CTX **sctx, SSL **clientssl,
1491 SSL **serverssl, SSL_SESSION **sess, int idx)
1493 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
1494 TLS_client_method(), sctx,
1495 cctx, cert, privkey)))
1499 /* When idx == 1 we repeat the tests with read_ahead set */
1500 SSL_CTX_set_read_ahead(*cctx, 1);
1501 SSL_CTX_set_read_ahead(*sctx, 1);
1502 } else if (idx == 2) {
1503 /* When idx == 2 we are doing early_data with a PSK. Set up callbacks */
1504 SSL_CTX_set_psk_use_session_callback(*cctx, use_session_cb);
1505 SSL_CTX_set_psk_find_session_callback(*sctx, find_session_cb);
1506 use_session_cb_cnt = 0;
1507 find_session_cb_cnt = 0;
1511 if (!TEST_true(create_ssl_objects(*sctx, *cctx, serverssl, clientssl,
1516 * For one of the run throughs (doesn't matter which one), we'll try sending
1517 * some SNI data in the initial ClientHello. This will be ignored (because
1518 * there is no SNI cb set up by the server), so it should not impact
1522 && !TEST_true(SSL_set_tlsext_host_name(*clientssl, "localhost")))
1526 /* Create the PSK */
1527 const SSL_CIPHER *cipher = NULL;
1528 const unsigned char key[] = {
1529 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a,
1530 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15,
1531 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20,
1532 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b,
1533 0x2c, 0x2d, 0x2e, 0x2f
1536 cipher = SSL_CIPHER_find(*clientssl, TLS13_AES_256_GCM_SHA384_BYTES);
1537 clientpsk = SSL_SESSION_new();
1538 if (!TEST_ptr(clientpsk)
1539 || !TEST_ptr(cipher)
1540 || !TEST_true(SSL_SESSION_set1_master_key(clientpsk, key,
1542 || !TEST_true(SSL_SESSION_set_cipher(clientpsk, cipher))
1544 SSL_SESSION_set_protocol_version(clientpsk,
1547 * We just choose an arbitrary value for max_early_data which
1548 * should be big enough for testing purposes.
1550 || !TEST_true(SSL_SESSION_set_max_early_data(clientpsk,
1552 || !TEST_true(SSL_SESSION_up_ref(clientpsk))) {
1553 SSL_SESSION_free(clientpsk);
1557 serverpsk = clientpsk;
1567 if (!TEST_true(create_ssl_connection(*serverssl, *clientssl,
1571 *sess = SSL_get1_session(*clientssl);
1572 SSL_shutdown(*clientssl);
1573 SSL_shutdown(*serverssl);
1574 SSL_free(*serverssl);
1575 SSL_free(*clientssl);
1576 *serverssl = *clientssl = NULL;
1578 if (!TEST_true(create_ssl_objects(*sctx, *cctx, serverssl,
1579 clientssl, NULL, NULL))
1580 || !TEST_true(SSL_set_session(*clientssl, *sess)))
1586 static int test_early_data_read_write(int idx)
1588 SSL_CTX *cctx = NULL, *sctx = NULL;
1589 SSL *clientssl = NULL, *serverssl = NULL;
1591 SSL_SESSION *sess = NULL;
1592 unsigned char buf[20], data[1024];
1593 size_t readbytes, written, eoedlen, rawread, rawwritten;
1596 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
1597 &serverssl, &sess, idx)))
1600 /* Write and read some early data */
1601 if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
1603 || !TEST_size_t_eq(written, strlen(MSG1))
1604 || !TEST_int_eq(SSL_read_early_data(serverssl, buf,
1605 sizeof(buf), &readbytes),
1606 SSL_READ_EARLY_DATA_SUCCESS)
1607 || !TEST_mem_eq(MSG1, readbytes, buf, strlen(MSG1))
1608 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
1609 SSL_EARLY_DATA_ACCEPTED))
1613 * Server should be able to write data, and client should be able to
1616 if (!TEST_true(SSL_write_early_data(serverssl, MSG2, strlen(MSG2),
1618 || !TEST_size_t_eq(written, strlen(MSG2))
1619 || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
1620 || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
1623 /* Even after reading normal data, client should be able write early data */
1624 if (!TEST_true(SSL_write_early_data(clientssl, MSG3, strlen(MSG3),
1626 || !TEST_size_t_eq(written, strlen(MSG3)))
1629 /* Server should still be able read early data after writing data */
1630 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
1632 SSL_READ_EARLY_DATA_SUCCESS)
1633 || !TEST_mem_eq(buf, readbytes, MSG3, strlen(MSG3)))
1636 /* Write more data from server and read it from client */
1637 if (!TEST_true(SSL_write_early_data(serverssl, MSG4, strlen(MSG4),
1639 || !TEST_size_t_eq(written, strlen(MSG4))
1640 || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
1641 || !TEST_mem_eq(buf, readbytes, MSG4, strlen(MSG4)))
1645 * If client writes normal data it should mean writing early data is no
1648 if (!TEST_true(SSL_write_ex(clientssl, MSG5, strlen(MSG5), &written))
1649 || !TEST_size_t_eq(written, strlen(MSG5))
1650 || !TEST_int_eq(SSL_get_early_data_status(clientssl),
1651 SSL_EARLY_DATA_ACCEPTED))
1655 * At this point the client has written EndOfEarlyData, ClientFinished and
1656 * normal (fully protected) data. We are going to cause a delay between the
1657 * arrival of EndOfEarlyData and ClientFinished. We read out all the data
1658 * in the read BIO, and then just put back the EndOfEarlyData message.
1660 rbio = SSL_get_rbio(serverssl);
1661 if (!TEST_true(BIO_read_ex(rbio, data, sizeof(data), &rawread))
1662 || !TEST_size_t_lt(rawread, sizeof(data))
1663 || !TEST_size_t_gt(rawread, SSL3_RT_HEADER_LENGTH))
1666 /* Record length is in the 4th and 5th bytes of the record header */
1667 eoedlen = SSL3_RT_HEADER_LENGTH + (data[3] << 8 | data[4]);
1668 if (!TEST_true(BIO_write_ex(rbio, data, eoedlen, &rawwritten))
1669 || !TEST_size_t_eq(rawwritten, eoedlen))
1672 /* Server should be told that there is no more early data */
1673 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
1675 SSL_READ_EARLY_DATA_FINISH)
1676 || !TEST_size_t_eq(readbytes, 0))
1680 * Server has not finished init yet, so should still be able to write early
1683 if (!TEST_true(SSL_write_early_data(serverssl, MSG6, strlen(MSG6),
1685 || !TEST_size_t_eq(written, strlen(MSG6)))
1688 /* Push the ClientFinished and the normal data back into the server rbio */
1689 if (!TEST_true(BIO_write_ex(rbio, data + eoedlen, rawread - eoedlen,
1691 || !TEST_size_t_eq(rawwritten, rawread - eoedlen))
1694 /* Server should be able to read normal data */
1695 if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
1696 || !TEST_size_t_eq(readbytes, strlen(MSG5)))
1699 /* Client and server should not be able to write/read early data now */
1700 if (!TEST_false(SSL_write_early_data(clientssl, MSG6, strlen(MSG6),
1704 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
1706 SSL_READ_EARLY_DATA_ERROR))
1710 /* Client should be able to read the data sent by the server */
1711 if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
1712 || !TEST_mem_eq(buf, readbytes, MSG6, strlen(MSG6)))
1716 * Make sure we process the NewSessionTicket. This arrives post-handshake.
1717 * We attempt a read which we do not expect to return any data.
1719 if (!TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes)))
1722 /* Server should be able to write normal data */
1723 if (!TEST_true(SSL_write_ex(serverssl, MSG7, strlen(MSG7), &written))
1724 || !TEST_size_t_eq(written, strlen(MSG7))
1725 || !TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
1726 || !TEST_mem_eq(buf, readbytes, MSG7, strlen(MSG7)))
1729 /* We keep the PSK session around if using PSK */
1731 SSL_SESSION_free(sess);
1732 sess = SSL_get1_session(clientssl);
1733 use_session_cb_cnt = 0;
1734 find_session_cb_cnt = 0;
1736 SSL_shutdown(clientssl);
1737 SSL_shutdown(serverssl);
1738 SSL_free(serverssl);
1739 SSL_free(clientssl);
1740 serverssl = clientssl = NULL;
1741 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
1742 &clientssl, NULL, NULL))
1743 || !TEST_true(SSL_set_session(clientssl, sess)))
1746 /* Write and read some early data */
1747 if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
1749 || !TEST_size_t_eq(written, strlen(MSG1))
1750 || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
1752 SSL_READ_EARLY_DATA_SUCCESS)
1753 || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1)))
1756 if (!TEST_int_gt(SSL_connect(clientssl), 0)
1757 || !TEST_int_gt(SSL_accept(serverssl), 0))
1760 /* Client and server should not be able to write/read early data now */
1761 if (!TEST_false(SSL_write_early_data(clientssl, MSG6, strlen(MSG6),
1765 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
1767 SSL_READ_EARLY_DATA_ERROR))
1771 /* Client and server should be able to write/read normal data */
1772 if (!TEST_true(SSL_write_ex(clientssl, MSG5, strlen(MSG5), &written))
1773 || !TEST_size_t_eq(written, strlen(MSG5))
1774 || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
1775 || !TEST_size_t_eq(readbytes, strlen(MSG5)))
1781 if (sess != clientpsk)
1782 SSL_SESSION_free(sess);
1783 SSL_SESSION_free(clientpsk);
1784 SSL_SESSION_free(serverpsk);
1785 clientpsk = serverpsk = NULL;
1786 SSL_free(serverssl);
1787 SSL_free(clientssl);
1794 * Helper function to test that a server attempting to read early data can
1795 * handle a connection from a client where the early data should be skipped.
1797 static int early_data_skip_helper(int hrr, int idx)
1799 SSL_CTX *cctx = NULL, *sctx = NULL;
1800 SSL *clientssl = NULL, *serverssl = NULL;
1802 SSL_SESSION *sess = NULL;
1803 unsigned char buf[20];
1804 size_t readbytes, written;
1806 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
1807 &serverssl, &sess, idx)))
1811 /* Force an HRR to occur */
1812 if (!TEST_true(SSL_set1_groups_list(serverssl, "P-256")))
1814 } else if (idx == 2) {
1816 * We force early_data rejection by ensuring the PSK identity is
1819 srvid = "Dummy Identity";
1822 * Deliberately corrupt the creation time. We take 20 seconds off the
1823 * time. It could be any value as long as it is not within tolerance.
1824 * This should mean the ticket is rejected.
1826 if (!TEST_true(SSL_SESSION_set_time(sess, (long)(time(NULL) - 20))))
1830 /* Write some early data */
1831 if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
1833 || !TEST_size_t_eq(written, strlen(MSG1)))
1836 /* Server should reject the early data and skip over it */
1837 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
1839 SSL_READ_EARLY_DATA_FINISH)
1840 || !TEST_size_t_eq(readbytes, 0)
1841 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
1842 SSL_EARLY_DATA_REJECTED))
1847 * Finish off the handshake. We perform the same writes and reads as
1848 * further down but we expect them to fail due to the incomplete
1851 if (!TEST_false(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
1852 || !TEST_false(SSL_read_ex(serverssl, buf, sizeof(buf),
1857 /* Should be able to send normal data despite rejection of early data */
1858 if (!TEST_true(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
1859 || !TEST_size_t_eq(written, strlen(MSG2))
1860 || !TEST_int_eq(SSL_get_early_data_status(clientssl),
1861 SSL_EARLY_DATA_REJECTED)
1862 || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
1863 || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
1869 if (sess != clientpsk)
1870 SSL_SESSION_free(clientpsk);
1871 SSL_SESSION_free(serverpsk);
1872 clientpsk = serverpsk = NULL;
1873 SSL_SESSION_free(sess);
1874 SSL_free(serverssl);
1875 SSL_free(clientssl);
1882 * Test that a server attempting to read early data can handle a connection
1883 * from a client where the early data is not acceptable.
1885 static int test_early_data_skip(int idx)
1887 return early_data_skip_helper(0, idx);
1891 * Test that a server attempting to read early data can handle a connection
1892 * from a client where an HRR occurs.
1894 static int test_early_data_skip_hrr(int idx)
1896 return early_data_skip_helper(1, idx);
1900 * Test that a server attempting to read early data can handle a connection
1901 * from a client that doesn't send any.
1903 static int test_early_data_not_sent(int idx)
1905 SSL_CTX *cctx = NULL, *sctx = NULL;
1906 SSL *clientssl = NULL, *serverssl = NULL;
1908 SSL_SESSION *sess = NULL;
1909 unsigned char buf[20];
1910 size_t readbytes, written;
1912 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
1913 &serverssl, &sess, idx)))
1916 /* Write some data - should block due to handshake with server */
1917 SSL_set_connect_state(clientssl);
1918 if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written)))
1921 /* Server should detect that early data has not been sent */
1922 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
1924 SSL_READ_EARLY_DATA_FINISH)
1925 || !TEST_size_t_eq(readbytes, 0)
1926 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
1927 SSL_EARLY_DATA_NOT_SENT)
1928 || !TEST_int_eq(SSL_get_early_data_status(clientssl),
1929 SSL_EARLY_DATA_NOT_SENT))
1932 /* Continue writing the message we started earlier */
1933 if (!TEST_true(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
1934 || !TEST_size_t_eq(written, strlen(MSG1))
1935 || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
1936 || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
1937 || !SSL_write_ex(serverssl, MSG2, strlen(MSG2), &written)
1938 || !TEST_size_t_eq(written, strlen(MSG2)))
1942 * Should block due to the NewSessionTicket arrival unless we're using
1946 if (!TEST_false(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes)))
1950 if (!TEST_true(SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes))
1951 || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
1957 /* If using PSK then clientpsk and sess are the same */
1958 SSL_SESSION_free(sess);
1959 SSL_SESSION_free(serverpsk);
1960 clientpsk = serverpsk = NULL;
1961 SSL_free(serverssl);
1962 SSL_free(clientssl);
1968 static int hostname_cb(SSL *s, int *al, void *arg)
1970 const char *hostname = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
1972 if (hostname != NULL && strcmp(hostname, "goodhost") == 0)
1973 return SSL_TLSEXT_ERR_OK;
1975 return SSL_TLSEXT_ERR_NOACK;
1978 static const char *servalpn;
1980 static int alpn_select_cb(SSL *ssl, const unsigned char **out,
1981 unsigned char *outlen, const unsigned char *in,
1982 unsigned int inlen, void *arg)
1984 unsigned int protlen = 0;
1985 const unsigned char *prot;
1987 for (prot = in; prot < in + inlen; prot += protlen) {
1989 if (in + inlen < prot + protlen)
1990 return SSL_TLSEXT_ERR_NOACK;
1992 if (protlen == strlen(servalpn)
1993 && memcmp(prot, servalpn, protlen) == 0) {
1996 return SSL_TLSEXT_ERR_OK;
2000 return SSL_TLSEXT_ERR_NOACK;
2003 /* Test that a PSK can be used to send early_data */
2004 static int test_early_data_psk(int idx)
2006 SSL_CTX *cctx = NULL, *sctx = NULL;
2007 SSL *clientssl = NULL, *serverssl = NULL;
2009 SSL_SESSION *sess = NULL;
2010 unsigned char alpnlist[] = {
2011 0x08, 'g', 'o', 'o', 'd', 'a', 'l', 'p', 'n', 0x07, 'b', 'a', 'd', 'a',
2014 #define GOODALPNLEN 9
2015 #define BADALPNLEN 8
2016 #define GOODALPN (alpnlist)
2017 #define BADALPN (alpnlist + GOODALPNLEN)
2019 unsigned char buf[20];
2020 size_t readbytes, written;
2021 int readearlyres = SSL_READ_EARLY_DATA_SUCCESS, connectres = 1;
2022 int edstatus = SSL_EARLY_DATA_ACCEPTED;
2024 /* We always set this up with a final parameter of "2" for PSK */
2025 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
2026 &serverssl, &sess, 2)))
2029 servalpn = "goodalpn";
2032 * Note: There is no test for inconsistent SNI with late client detection.
2033 * This is because servers do not acknowledge SNI even if they are using
2034 * it in a resumption handshake - so it is not actually possible for a
2035 * client to detect a problem.
2039 /* Set inconsistent SNI (early client detection) */
2040 err = SSL_R_INCONSISTENT_EARLY_DATA_SNI;
2041 if (!TEST_true(SSL_SESSION_set1_hostname(sess, "goodhost"))
2042 || !TEST_true(SSL_set_tlsext_host_name(clientssl, "badhost")))
2047 /* Set inconsistent ALPN (early client detection) */
2048 err = SSL_R_INCONSISTENT_EARLY_DATA_ALPN;
2049 /* SSL_set_alpn_protos returns 0 for success and 1 for failure */
2050 if (!TEST_true(SSL_SESSION_set1_alpn_selected(sess, GOODALPN,
2052 || !TEST_false(SSL_set_alpn_protos(clientssl, BADALPN,
2059 * Set invalid protocol version. Technically this affects PSKs without
2060 * early_data too, but we test it here because it is similar to the
2061 * SNI/ALPN consistency tests.
2063 err = SSL_R_BAD_PSK;
2064 if (!TEST_true(SSL_SESSION_set_protocol_version(sess, TLS1_2_VERSION)))
2070 * Set inconsistent SNI (server detected). In this case the connection
2071 * will succeed but reject early_data.
2073 SSL_SESSION_free(serverpsk);
2074 serverpsk = SSL_SESSION_dup(clientpsk);
2075 if (!TEST_ptr(serverpsk)
2076 || !TEST_true(SSL_SESSION_set1_hostname(serverpsk, "badhost")))
2078 edstatus = SSL_EARLY_DATA_REJECTED;
2079 readearlyres = SSL_READ_EARLY_DATA_FINISH;
2082 /* Set consistent SNI */
2083 if (!TEST_true(SSL_SESSION_set1_hostname(sess, "goodhost"))
2084 || !TEST_true(SSL_set_tlsext_host_name(clientssl, "goodhost"))
2085 || !TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx,
2092 * Set inconsistent ALPN (server detected). In this case the connection
2093 * will succeed but reject early_data.
2095 servalpn = "badalpn";
2096 edstatus = SSL_EARLY_DATA_REJECTED;
2097 readearlyres = SSL_READ_EARLY_DATA_FINISH;
2101 * Set consistent ALPN.
2102 * SSL_set_alpn_protos returns 0 for success and 1 for failure. It
2103 * accepts a list of protos (each one length prefixed).
2104 * SSL_set1_alpn_selected accepts a single protocol (not length
2107 if (!TEST_true(SSL_SESSION_set1_alpn_selected(sess, GOODALPN + 1,
2109 || !TEST_false(SSL_set_alpn_protos(clientssl, GOODALPN,
2113 SSL_CTX_set_alpn_select_cb(sctx, alpn_select_cb, NULL);
2117 /* Set inconsistent ALPN (late client detection) */
2118 SSL_SESSION_free(serverpsk);
2119 serverpsk = SSL_SESSION_dup(clientpsk);
2120 if (!TEST_ptr(serverpsk)
2121 || !TEST_true(SSL_SESSION_set1_alpn_selected(clientpsk,
2124 || !TEST_true(SSL_SESSION_set1_alpn_selected(serverpsk,
2127 || !TEST_false(SSL_set_alpn_protos(clientssl, alpnlist,
2130 SSL_CTX_set_alpn_select_cb(sctx, alpn_select_cb, NULL);
2131 edstatus = SSL_EARLY_DATA_ACCEPTED;
2132 readearlyres = SSL_READ_EARLY_DATA_SUCCESS;
2133 /* SSL_connect() call should fail */
2138 TEST_error("Bad test index");
2142 SSL_set_connect_state(clientssl);
2144 if (!TEST_false(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
2146 || !TEST_int_eq(SSL_get_error(clientssl, 0), SSL_ERROR_SSL)
2147 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()), err))
2150 if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
2154 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
2155 &readbytes), readearlyres)
2156 || (readearlyres == SSL_READ_EARLY_DATA_SUCCESS
2157 && !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1)))
2158 || !TEST_int_eq(SSL_get_early_data_status(serverssl), edstatus)
2159 || !TEST_int_eq(SSL_connect(clientssl), connectres))
2166 SSL_SESSION_free(clientpsk);
2167 SSL_SESSION_free(serverpsk);
2168 clientpsk = serverpsk = NULL;
2169 SSL_free(serverssl);
2170 SSL_free(clientssl);
2177 * Test that a server that doesn't try to read early data can handle a
2178 * client sending some.
2180 static int test_early_data_not_expected(int idx)
2182 SSL_CTX *cctx = NULL, *sctx = NULL;
2183 SSL *clientssl = NULL, *serverssl = NULL;
2185 SSL_SESSION *sess = NULL;
2186 unsigned char buf[20];
2187 size_t readbytes, written;
2189 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
2190 &serverssl, &sess, idx)))
2193 /* Write some early data */
2194 if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1),
2199 * Server should skip over early data and then block waiting for client to
2200 * continue handshake
2202 if (!TEST_int_le(SSL_accept(serverssl), 0)
2203 || !TEST_int_gt(SSL_connect(clientssl), 0)
2204 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
2205 SSL_EARLY_DATA_REJECTED)
2206 || !TEST_int_gt(SSL_accept(serverssl), 0)
2207 || !TEST_int_eq(SSL_get_early_data_status(clientssl),
2208 SSL_EARLY_DATA_REJECTED))
2211 /* Send some normal data from client to server */
2212 if (!TEST_true(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
2213 || !TEST_size_t_eq(written, strlen(MSG2)))
2216 if (!TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
2217 || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
2223 /* If using PSK then clientpsk and sess are the same */
2224 SSL_SESSION_free(sess);
2225 SSL_SESSION_free(serverpsk);
2226 clientpsk = serverpsk = NULL;
2227 SSL_free(serverssl);
2228 SSL_free(clientssl);
2235 # ifndef OPENSSL_NO_TLS1_2
2237 * Test that a server attempting to read early data can handle a connection
2238 * from a TLSv1.2 client.
2240 static int test_early_data_tls1_2(int idx)
2242 SSL_CTX *cctx = NULL, *sctx = NULL;
2243 SSL *clientssl = NULL, *serverssl = NULL;
2245 unsigned char buf[20];
2246 size_t readbytes, written;
2248 if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
2249 &serverssl, NULL, idx)))
2252 /* Write some data - should block due to handshake with server */
2253 SSL_set_max_proto_version(clientssl, TLS1_2_VERSION);
2254 SSL_set_connect_state(clientssl);
2255 if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written)))
2259 * Server should do TLSv1.2 handshake. First it will block waiting for more
2260 * messages from client after ServerDone. Then SSL_read_early_data should
2261 * finish and detect that early data has not been sent
2263 if (!TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
2265 SSL_READ_EARLY_DATA_ERROR))
2269 * Continue writing the message we started earlier. Will still block waiting
2270 * for the CCS/Finished from server
2272 if (!TEST_false(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
2273 || !TEST_int_eq(SSL_read_early_data(serverssl, buf, sizeof(buf),
2275 SSL_READ_EARLY_DATA_FINISH)
2276 || !TEST_size_t_eq(readbytes, 0)
2277 || !TEST_int_eq(SSL_get_early_data_status(serverssl),
2278 SSL_EARLY_DATA_NOT_SENT))
2281 /* Continue writing the message we started earlier */
2282 if (!TEST_true(SSL_write_ex(clientssl, MSG1, strlen(MSG1), &written))
2283 || !TEST_size_t_eq(written, strlen(MSG1))
2284 || !TEST_int_eq(SSL_get_early_data_status(clientssl),
2285 SSL_EARLY_DATA_NOT_SENT)
2286 || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
2287 || !TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1))
2288 || !TEST_true(SSL_write_ex(serverssl, MSG2, strlen(MSG2), &written))
2289 || !TEST_size_t_eq(written, strlen(MSG2))
2290 || !SSL_read_ex(clientssl, buf, sizeof(buf), &readbytes)
2291 || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
2297 /* If using PSK then clientpsk and sess are the same */
2298 SSL_SESSION_free(clientpsk);
2299 SSL_SESSION_free(serverpsk);
2300 clientpsk = serverpsk = NULL;
2301 SSL_free(serverssl);
2302 SSL_free(clientssl);
2308 # endif /* OPENSSL_NO_TLS1_2 */
2310 static int test_ciphersuite_change(void)
2312 SSL_CTX *cctx = NULL, *sctx = NULL;
2313 SSL *clientssl = NULL, *serverssl = NULL;
2314 SSL_SESSION *clntsess = NULL;
2316 const SSL_CIPHER *aes_128_gcm_sha256 = NULL;
2318 /* Create a session based on SHA-256 */
2319 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
2320 TLS_client_method(), &sctx,
2321 &cctx, cert, privkey))
2322 || !TEST_true(SSL_CTX_set_cipher_list(cctx,
2323 "TLS13-AES-128-GCM-SHA256"))
2324 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
2325 &clientssl, NULL, NULL))
2326 || !TEST_true(create_ssl_connection(serverssl, clientssl,
2330 clntsess = SSL_get1_session(clientssl);
2331 /* Save for later */
2332 aes_128_gcm_sha256 = SSL_SESSION_get0_cipher(clntsess);
2333 SSL_shutdown(clientssl);
2334 SSL_shutdown(serverssl);
2335 SSL_free(serverssl);
2336 SSL_free(clientssl);
2337 serverssl = clientssl = NULL;
2339 # if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
2340 /* Check we can resume a session with a different SHA-256 ciphersuite */
2341 if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
2342 "TLS13-CHACHA20-POLY1305-SHA256"))
2343 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
2345 || !TEST_true(SSL_set_session(clientssl, clntsess))
2346 || !TEST_true(create_ssl_connection(serverssl, clientssl,
2348 || !TEST_true(SSL_session_reused(clientssl)))
2351 SSL_SESSION_free(clntsess);
2352 clntsess = SSL_get1_session(clientssl);
2353 SSL_shutdown(clientssl);
2354 SSL_shutdown(serverssl);
2355 SSL_free(serverssl);
2356 SSL_free(clientssl);
2357 serverssl = clientssl = NULL;
2361 * Check attempting to resume a SHA-256 session with no SHA-256 ciphersuites
2362 * succeeds but does not resume.
2364 if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "TLS13-AES-256-GCM-SHA384"))
2365 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
2367 || !TEST_true(SSL_set_session(clientssl, clntsess))
2368 || !TEST_true(create_ssl_connection(serverssl, clientssl,
2370 || !TEST_false(SSL_session_reused(clientssl)))
2373 SSL_SESSION_free(clntsess);
2375 SSL_shutdown(clientssl);
2376 SSL_shutdown(serverssl);
2377 SSL_free(serverssl);
2378 SSL_free(clientssl);
2379 serverssl = clientssl = NULL;
2381 /* Create a session based on SHA384 */
2382 if (!TEST_true(SSL_CTX_set_cipher_list(cctx, "TLS13-AES-256-GCM-SHA384"))
2383 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
2384 &clientssl, NULL, NULL))
2385 || !TEST_true(create_ssl_connection(serverssl, clientssl,
2389 clntsess = SSL_get1_session(clientssl);
2390 SSL_shutdown(clientssl);
2391 SSL_shutdown(serverssl);
2392 SSL_free(serverssl);
2393 SSL_free(clientssl);
2394 serverssl = clientssl = NULL;
2396 if (!TEST_true(SSL_CTX_set_cipher_list(cctx,
2397 "TLS13-AES-128-GCM-SHA256:TLS13-AES-256-GCM-SHA384"))
2398 || !TEST_true(SSL_CTX_set_cipher_list(sctx,
2399 "TLS13-AES-256-GCM-SHA384"))
2400 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
2402 || !TEST_true(SSL_set_session(clientssl, clntsess))
2404 * We use SSL_ERROR_WANT_READ below so that we can pause the
2405 * connection after the initial ClientHello has been sent to
2406 * enable us to make some session changes.
2408 || !TEST_false(create_ssl_connection(serverssl, clientssl,
2409 SSL_ERROR_WANT_READ)))
2412 /* Trick the client into thinking this session is for a different digest */
2413 clntsess->cipher = aes_128_gcm_sha256;
2414 clntsess->cipher_id = clntsess->cipher->id;
2417 * Continue the previously started connection. Server has selected a SHA-384
2418 * ciphersuite, but client thinks the session is for SHA-256, so it should
2421 if (!TEST_false(create_ssl_connection(serverssl, clientssl,
2423 || !TEST_int_eq(ERR_GET_REASON(ERR_get_error()),
2424 SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED))
2430 SSL_SESSION_free(clntsess);
2431 SSL_free(serverssl);
2432 SSL_free(clientssl);
2439 static int test_tls13_psk(void)
2441 SSL_CTX *sctx = NULL, *cctx = NULL;
2442 SSL *serverssl = NULL, *clientssl = NULL;
2443 const SSL_CIPHER *cipher = NULL;
2444 const unsigned char key[] = {
2445 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
2446 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
2447 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
2448 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f
2452 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
2453 TLS_client_method(), &sctx,
2454 &cctx, cert, privkey)))
2457 SSL_CTX_set_psk_use_session_callback(cctx, use_session_cb);
2458 SSL_CTX_set_psk_find_session_callback(sctx, find_session_cb);
2460 use_session_cb_cnt = 0;
2461 find_session_cb_cnt = 0;
2463 /* Check we can create a connection if callback decides not to send a PSK */
2464 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
2466 || !TEST_true(create_ssl_connection(serverssl, clientssl,
2468 || !TEST_false(SSL_session_reused(clientssl))
2469 || !TEST_false(SSL_session_reused(serverssl))
2470 || !TEST_true(use_session_cb_cnt == 1)
2471 || !TEST_true(find_session_cb_cnt == 0))
2474 shutdown_ssl_connection(serverssl, clientssl);
2475 serverssl = clientssl = NULL;
2476 use_session_cb_cnt = 0;
2478 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
2482 /* Create the PSK */
2483 cipher = SSL_CIPHER_find(clientssl, TLS13_AES_256_GCM_SHA384_BYTES);
2484 clientpsk = SSL_SESSION_new();
2485 if (!TEST_ptr(clientpsk)
2486 || !TEST_ptr(cipher)
2487 || !TEST_true(SSL_SESSION_set1_master_key(clientpsk, key,
2489 || !TEST_true(SSL_SESSION_set_cipher(clientpsk, cipher))
2490 || !TEST_true(SSL_SESSION_set_protocol_version(clientpsk,
2492 || !TEST_true(SSL_SESSION_up_ref(clientpsk)))
2494 serverpsk = clientpsk;
2496 /* Check we can create a connection and the PSK is used */
2497 if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
2498 || !TEST_true(SSL_session_reused(clientssl))
2499 || !TEST_true(SSL_session_reused(serverssl))
2500 || !TEST_true(use_session_cb_cnt == 1)
2501 || !TEST_true(find_session_cb_cnt == 1))
2504 shutdown_ssl_connection(serverssl, clientssl);
2505 serverssl = clientssl = NULL;
2506 use_session_cb_cnt = find_session_cb_cnt = 0;
2508 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
2513 if (!TEST_true(SSL_set1_groups_list(serverssl, "P-256")))
2517 * Check we can create a connection, the PSK is used and the callbacks are
2520 if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))
2521 || !TEST_true(SSL_session_reused(clientssl))
2522 || !TEST_true(SSL_session_reused(serverssl))
2523 || !TEST_true(use_session_cb_cnt == 2)
2524 || !TEST_true(find_session_cb_cnt == 2))
2527 shutdown_ssl_connection(serverssl, clientssl);
2528 serverssl = clientssl = NULL;
2529 use_session_cb_cnt = find_session_cb_cnt = 0;
2532 * Check that if the server rejects the PSK we can still connect, but with
2535 srvid = "Dummy Identity";
2536 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
2538 || !TEST_true(create_ssl_connection(serverssl, clientssl,
2540 || !TEST_false(SSL_session_reused(clientssl))
2541 || !TEST_false(SSL_session_reused(serverssl))
2542 || !TEST_true(use_session_cb_cnt == 1)
2543 || !TEST_true(find_session_cb_cnt == 1))
2546 shutdown_ssl_connection(serverssl, clientssl);
2547 serverssl = clientssl = NULL;
2551 SSL_SESSION_free(clientpsk);
2552 SSL_SESSION_free(serverpsk);
2553 clientpsk = serverpsk = NULL;
2554 SSL_free(serverssl);
2555 SSL_free(clientssl);
2561 static unsigned char cookie_magic_value[] = "cookie magic";
2563 static int generate_cookie_callback(SSL *ssl, unsigned char *cookie,
2564 unsigned int *cookie_len)
2567 * Not suitable as a real cookie generation function but good enough for
2570 memcpy(cookie, cookie_magic_value, sizeof(cookie_magic_value) - 1);
2571 *cookie_len = sizeof(cookie_magic_value) - 1;
2576 static int verify_cookie_callback(SSL *ssl, const unsigned char *cookie,
2577 unsigned int cookie_len)
2579 if (cookie_len == sizeof(cookie_magic_value) - 1
2580 && memcmp(cookie, cookie_magic_value, cookie_len) == 0)
2586 static int test_stateless(void)
2588 SSL_CTX *sctx = NULL, *cctx = NULL;
2589 SSL *serverssl = NULL, *clientssl = NULL;
2592 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
2593 TLS_client_method(), &sctx,
2594 &cctx, cert, privkey)))
2597 /* Set up the cookie generation and verification callbacks */
2598 SSL_CTX_set_cookie_generate_cb(sctx, generate_cookie_callback);
2599 SSL_CTX_set_cookie_verify_cb(sctx, verify_cookie_callback);
2601 /* The arrival of CCS messages can confuse the test */
2602 SSL_CTX_clear_options(cctx, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
2604 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
2606 /* Send the first ClientHello */
2607 || !TEST_false(create_ssl_connection(serverssl, clientssl,
2608 SSL_ERROR_WANT_READ))
2609 /* This should fail because there is no cookie */
2610 || !TEST_false(SSL_stateless(serverssl)))
2613 /* Abandon the connection from this client */
2614 SSL_free(clientssl);
2618 * Now create a connection from a new client but with the same server SSL
2621 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
2623 /* Send the first ClientHello */
2624 || !TEST_false(create_ssl_connection(serverssl, clientssl,
2625 SSL_ERROR_WANT_READ))
2626 /* This should fail because there is no cookie */
2627 || !TEST_false(SSL_stateless(serverssl))
2628 /* Send the second ClientHello */
2629 || !TEST_false(create_ssl_connection(serverssl, clientssl,
2630 SSL_ERROR_WANT_READ))
2631 /* This should succeed because a cookie is now present */
2632 || !TEST_true(SSL_stateless(serverssl))
2633 /* Complete the connection */
2634 || !TEST_true(create_ssl_connection(serverssl, clientssl,
2638 shutdown_ssl_connection(serverssl, clientssl);
2639 serverssl = clientssl = NULL;
2643 SSL_free(serverssl);
2644 SSL_free(clientssl);
2650 #endif /* OPENSSL_NO_TLS1_3 */
2652 static int clntaddoldcb = 0;
2653 static int clntparseoldcb = 0;
2654 static int srvaddoldcb = 0;
2655 static int srvparseoldcb = 0;
2656 static int clntaddnewcb = 0;
2657 static int clntparsenewcb = 0;
2658 static int srvaddnewcb = 0;
2659 static int srvparsenewcb = 0;
2660 static int snicb = 0;
2662 #define TEST_EXT_TYPE1 0xff00
2664 static int old_add_cb(SSL *s, unsigned int ext_type, const unsigned char **out,
2665 size_t *outlen, int *al, void *add_arg)
2667 int *server = (int *)add_arg;
2668 unsigned char *data;
2670 if (SSL_is_server(s))
2675 if (*server != SSL_is_server(s)
2676 || (data = OPENSSL_malloc(sizeof(*data))) == NULL)
2681 *outlen = sizeof(char);
2685 static void old_free_cb(SSL *s, unsigned int ext_type, const unsigned char *out,
2688 OPENSSL_free((unsigned char *)out);
2691 static int old_parse_cb(SSL *s, unsigned int ext_type, const unsigned char *in,
2692 size_t inlen, int *al, void *parse_arg)
2694 int *server = (int *)parse_arg;
2696 if (SSL_is_server(s))
2701 if (*server != SSL_is_server(s)
2702 || inlen != sizeof(char)
2709 static int new_add_cb(SSL *s, unsigned int ext_type, unsigned int context,
2710 const unsigned char **out, size_t *outlen, X509 *x,
2711 size_t chainidx, int *al, void *add_arg)
2713 int *server = (int *)add_arg;
2714 unsigned char *data;
2716 if (SSL_is_server(s))
2721 if (*server != SSL_is_server(s)
2722 || (data = OPENSSL_malloc(sizeof(*data))) == NULL)
2727 *outlen = sizeof(*data);
2731 static void new_free_cb(SSL *s, unsigned int ext_type, unsigned int context,
2732 const unsigned char *out, void *add_arg)
2734 OPENSSL_free((unsigned char *)out);
2737 static int new_parse_cb(SSL *s, unsigned int ext_type, unsigned int context,
2738 const unsigned char *in, size_t inlen, X509 *x,
2739 size_t chainidx, int *al, void *parse_arg)
2741 int *server = (int *)parse_arg;
2743 if (SSL_is_server(s))
2748 if (*server != SSL_is_server(s)
2749 || inlen != sizeof(char) || *in != 1)
2755 static int sni_cb(SSL *s, int *al, void *arg)
2757 SSL_CTX *ctx = (SSL_CTX *)arg;
2759 if (SSL_set_SSL_CTX(s, ctx) == NULL) {
2760 *al = SSL_AD_INTERNAL_ERROR;
2761 return SSL_TLSEXT_ERR_ALERT_FATAL;
2764 return SSL_TLSEXT_ERR_OK;
2768 * Custom call back tests.
2769 * Test 0: Old style callbacks in TLSv1.2
2770 * Test 1: New style callbacks in TLSv1.2
2771 * Test 2: New style callbacks in TLSv1.2 with SNI
2772 * Test 3: New style callbacks in TLSv1.3. Extensions in CH and EE
2773 * Test 4: New style callbacks in TLSv1.3. Extensions in CH, SH, EE, Cert + NST
2775 static int test_custom_exts(int tst)
2777 SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
2778 SSL *clientssl = NULL, *serverssl = NULL;
2780 static int server = 1;
2781 static int client = 0;
2782 SSL_SESSION *sess = NULL;
2783 unsigned int context;
2785 #if defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_TLS1_3)
2786 /* Skip tests for TLSv1.2 and below in this case */
2791 /* Reset callback counters */
2792 clntaddoldcb = clntparseoldcb = srvaddoldcb = srvparseoldcb = 0;
2793 clntaddnewcb = clntparsenewcb = srvaddnewcb = srvparsenewcb = 0;
2796 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
2797 TLS_client_method(), &sctx,
2798 &cctx, cert, privkey)))
2802 && !TEST_true(create_ssl_ctx_pair(TLS_server_method(), NULL, &sctx2,
2803 NULL, cert, privkey)))
2808 SSL_CTX_set_options(cctx, SSL_OP_NO_TLSv1_3);
2809 SSL_CTX_set_options(sctx, SSL_OP_NO_TLSv1_3);
2811 SSL_CTX_set_options(sctx2, SSL_OP_NO_TLSv1_3);
2815 context = SSL_EXT_CLIENT_HELLO
2816 | SSL_EXT_TLS1_2_SERVER_HELLO
2817 | SSL_EXT_TLS1_3_SERVER_HELLO
2818 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
2819 | SSL_EXT_TLS1_3_CERTIFICATE
2820 | SSL_EXT_TLS1_3_NEW_SESSION_TICKET;
2822 context = SSL_EXT_CLIENT_HELLO
2823 | SSL_EXT_TLS1_2_SERVER_HELLO
2824 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS;
2827 /* Create a client side custom extension */
2829 if (!TEST_true(SSL_CTX_add_client_custom_ext(cctx, TEST_EXT_TYPE1,
2830 old_add_cb, old_free_cb,
2831 &client, old_parse_cb,
2835 if (!TEST_true(SSL_CTX_add_custom_ext(cctx, TEST_EXT_TYPE1, context,
2836 new_add_cb, new_free_cb,
2837 &client, new_parse_cb, &client)))
2841 /* Should not be able to add duplicates */
2842 if (!TEST_false(SSL_CTX_add_client_custom_ext(cctx, TEST_EXT_TYPE1,
2843 old_add_cb, old_free_cb,
2844 &client, old_parse_cb,
2846 || !TEST_false(SSL_CTX_add_custom_ext(cctx, TEST_EXT_TYPE1,
2847 context, new_add_cb,
2848 new_free_cb, &client,
2849 new_parse_cb, &client)))
2852 /* Create a server side custom extension */
2854 if (!TEST_true(SSL_CTX_add_server_custom_ext(sctx, TEST_EXT_TYPE1,
2855 old_add_cb, old_free_cb,
2856 &server, old_parse_cb,
2860 if (!TEST_true(SSL_CTX_add_custom_ext(sctx, TEST_EXT_TYPE1, context,
2861 new_add_cb, new_free_cb,
2862 &server, new_parse_cb, &server)))
2865 && !TEST_true(SSL_CTX_add_custom_ext(sctx2, TEST_EXT_TYPE1,
2866 context, new_add_cb,
2867 new_free_cb, &server,
2868 new_parse_cb, &server)))
2872 /* Should not be able to add duplicates */
2873 if (!TEST_false(SSL_CTX_add_server_custom_ext(sctx, TEST_EXT_TYPE1,
2874 old_add_cb, old_free_cb,
2875 &server, old_parse_cb,
2877 || !TEST_false(SSL_CTX_add_custom_ext(sctx, TEST_EXT_TYPE1,
2878 context, new_add_cb,
2879 new_free_cb, &server,
2880 new_parse_cb, &server)))
2885 if (!TEST_true(SSL_CTX_set_tlsext_servername_callback(sctx, sni_cb))
2886 || !TEST_true(SSL_CTX_set_tlsext_servername_arg(sctx, sctx2)))
2890 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
2891 &clientssl, NULL, NULL))
2892 || !TEST_true(create_ssl_connection(serverssl, clientssl,
2897 if (clntaddoldcb != 1
2898 || clntparseoldcb != 1
2900 || srvparseoldcb != 1)
2902 } else if (tst == 1 || tst == 2 || tst == 3) {
2903 if (clntaddnewcb != 1
2904 || clntparsenewcb != 1
2906 || srvparsenewcb != 1
2907 || (tst != 2 && snicb != 0)
2908 || (tst == 2 && snicb != 1))
2911 if (clntaddnewcb != 1
2912 || clntparsenewcb != 4
2914 || srvparsenewcb != 1)
2918 sess = SSL_get1_session(clientssl);
2919 SSL_shutdown(clientssl);
2920 SSL_shutdown(serverssl);
2921 SSL_free(serverssl);
2922 SSL_free(clientssl);
2923 serverssl = clientssl = NULL;
2926 /* We don't bother with the resumption aspects for this test */
2931 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
2933 || !TEST_true(SSL_set_session(clientssl, sess))
2934 || !TEST_true(create_ssl_connection(serverssl, clientssl,
2939 * For a resumed session we expect to add the ClientHello extension. For the
2940 * old style callbacks we ignore it on the server side because they set
2941 * SSL_EXT_IGNORE_ON_RESUMPTION. The new style callbacks do not ignore
2945 if (clntaddoldcb != 2
2946 || clntparseoldcb != 1
2948 || srvparseoldcb != 1)
2950 } else if (tst == 1 || tst == 2 || tst == 3) {
2951 if (clntaddnewcb != 2
2952 || clntparsenewcb != 2
2954 || srvparsenewcb != 2)
2957 /* No Certificate message extensions in the resumption handshake */
2958 if (clntaddnewcb != 2
2959 || clntparsenewcb != 7
2961 || srvparsenewcb != 2)
2968 SSL_SESSION_free(sess);
2969 SSL_free(serverssl);
2970 SSL_free(clientssl);
2971 SSL_CTX_free(sctx2);
2978 * Test loading of serverinfo data in various formats. test_sslmessages actually
2979 * tests to make sure the extensions appear in the handshake
2981 static int test_serverinfo(int tst)
2983 unsigned int version;
2984 unsigned char *sibuf;
2986 int ret, expected, testresult = 0;
2989 ctx = SSL_CTX_new(TLS_method());
2993 if ((tst & 0x01) == 0x01)
2994 version = SSL_SERVERINFOV2;
2996 version = SSL_SERVERINFOV1;
2998 if ((tst & 0x02) == 0x02) {
2999 sibuf = serverinfov2;
3000 sibuflen = sizeof(serverinfov2);
3001 expected = (version == SSL_SERVERINFOV2);
3003 sibuf = serverinfov1;
3004 sibuflen = sizeof(serverinfov1);
3005 expected = (version == SSL_SERVERINFOV1);
3008 if ((tst & 0x04) == 0x04) {
3009 ret = SSL_CTX_use_serverinfo_ex(ctx, version, sibuf, sibuflen);
3011 ret = SSL_CTX_use_serverinfo(ctx, sibuf, sibuflen);
3014 * The version variable is irrelevant in this case - it's what is in the
3015 * buffer that matters
3017 if ((tst & 0x02) == 0x02)
3023 if (!TEST_true(ret == expected))
3035 * Test that SSL_export_keying_material() produces expected results. There are
3036 * no test vectors so all we do is test that both sides of the communication
3037 * produce the same results for different protocol versions.
3039 static int test_export_key_mat(int tst)
3042 SSL_CTX *cctx = NULL, *sctx = NULL, *sctx2 = NULL;
3043 SSL *clientssl = NULL, *serverssl = NULL;
3044 const char label[] = "test label";
3045 const unsigned char context[] = "context";
3046 const unsigned char *emptycontext = NULL;
3047 unsigned char ckeymat1[80], ckeymat2[80], ckeymat3[80];
3048 unsigned char skeymat1[80], skeymat2[80], skeymat3[80];
3049 const int protocols[] = {
3056 #ifdef OPENSSL_NO_TLS1
3060 #ifdef OPENSSL_NO_TLS1_1
3064 #ifdef OPENSSL_NO_TLS1_2
3068 #ifdef OPENSSL_NO_TLS1_3
3072 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
3073 TLS_client_method(), &sctx,
3074 &cctx, cert, privkey)))
3077 OPENSSL_assert(tst >= 0 && (size_t)tst < OSSL_NELEM(protocols));
3078 SSL_CTX_set_max_proto_version(cctx, protocols[tst]);
3079 SSL_CTX_set_min_proto_version(cctx, protocols[tst]);
3081 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL,
3083 || !TEST_true(create_ssl_connection(serverssl, clientssl,
3087 if (!TEST_int_eq(SSL_export_keying_material(clientssl, ckeymat1,
3088 sizeof(ckeymat1), label,
3089 sizeof(label) - 1, context,
3090 sizeof(context) - 1, 1), 1)
3091 || !TEST_int_eq(SSL_export_keying_material(clientssl, ckeymat2,
3092 sizeof(ckeymat2), label,
3096 || !TEST_int_eq(SSL_export_keying_material(clientssl, ckeymat3,
3097 sizeof(ckeymat3), label,
3100 || !TEST_int_eq(SSL_export_keying_material(serverssl, skeymat1,
3101 sizeof(skeymat1), label,
3104 sizeof(context) -1, 1),
3106 || !TEST_int_eq(SSL_export_keying_material(serverssl, skeymat2,
3107 sizeof(skeymat2), label,
3111 || !TEST_int_eq(SSL_export_keying_material(serverssl, skeymat3,
3112 sizeof(skeymat3), label,
3116 * Check that both sides created the same key material with the
3119 || !TEST_mem_eq(ckeymat1, sizeof(ckeymat1), skeymat1,
3122 * Check that both sides created the same key material with an
3125 || !TEST_mem_eq(ckeymat2, sizeof(ckeymat2), skeymat2,
3128 * Check that both sides created the same key material without a
3131 || !TEST_mem_eq(ckeymat3, sizeof(ckeymat3), skeymat3,
3133 /* Different contexts should produce different results */
3134 || !TEST_mem_ne(ckeymat1, sizeof(ckeymat1), ckeymat2,
3139 * Check that an empty context and no context produce different results in
3140 * protocols less than TLSv1.3. In TLSv1.3 they should be the same.
3142 if ((tst != 3 && !TEST_mem_ne(ckeymat2, sizeof(ckeymat2), ckeymat3,
3144 || (tst ==3 && !TEST_mem_eq(ckeymat2, sizeof(ckeymat2), ckeymat3,
3151 SSL_free(serverssl);
3152 SSL_free(clientssl);
3153 SSL_CTX_free(sctx2);
3160 static int test_ssl_clear(int idx)
3162 SSL_CTX *cctx = NULL, *sctx = NULL;
3163 SSL *clientssl = NULL, *serverssl = NULL;
3166 #ifdef OPENSSL_NO_TLS1_2
3171 /* Create an initial connection */
3172 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
3173 TLS_client_method(), &sctx,
3174 &cctx, cert, privkey))
3176 && !TEST_true(SSL_CTX_set_max_proto_version(cctx,
3178 || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
3179 &clientssl, NULL, NULL))
3180 || !TEST_true(create_ssl_connection(serverssl, clientssl,
3184 SSL_shutdown(clientssl);
3185 SSL_shutdown(serverssl);
3186 SSL_free(serverssl);
3189 /* Clear clientssl - we're going to reuse the object */
3190 if (!TEST_true(SSL_clear(clientssl)))
3193 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
3195 || !TEST_true(create_ssl_connection(serverssl, clientssl,
3197 || !TEST_true(SSL_session_reused(clientssl)))
3200 SSL_shutdown(clientssl);
3201 SSL_shutdown(serverssl);
3206 SSL_free(serverssl);
3207 SSL_free(clientssl);
3214 /* Parse CH and retrieve any MFL extension value if present */
3215 static int get_MFL_from_client_hello(BIO *bio, int *mfl_codemfl_code)
3218 unsigned char *data;
3219 PACKET pkt = {0}, pkt2 = {0}, pkt3 = {0};
3220 unsigned int MFL_code = 0, type = 0;
3222 if (!TEST_uint_gt( len = BIO_get_mem_data( bio, (char **) &data ), 0 ) )
3225 if (!TEST_true( PACKET_buf_init( &pkt, data, len ) )
3226 /* Skip the record header */
3227 || !PACKET_forward(&pkt, SSL3_RT_HEADER_LENGTH)
3228 /* Skip the handshake message header */
3229 || !TEST_true(PACKET_forward(&pkt, SSL3_HM_HEADER_LENGTH))
3230 /* Skip client version and random */
3231 || !TEST_true(PACKET_forward(&pkt, CLIENT_VERSION_LEN
3232 + SSL3_RANDOM_SIZE))
3233 /* Skip session id */
3234 || !TEST_true(PACKET_get_length_prefixed_1(&pkt, &pkt2))
3236 || !TEST_true(PACKET_get_length_prefixed_2(&pkt, &pkt2))
3237 /* Skip compression */
3238 || !TEST_true(PACKET_get_length_prefixed_1(&pkt, &pkt2))
3239 /* Extensions len */
3240 || !TEST_true(PACKET_as_length_prefixed_2(&pkt, &pkt2)))
3243 /* Loop through all extensions */
3244 while (PACKET_remaining(&pkt2)) {
3245 if (!TEST_true(PACKET_get_net_2(&pkt2, &type))
3246 || !TEST_true(PACKET_get_length_prefixed_2(&pkt2, &pkt3)))
3249 if (type == TLSEXT_TYPE_max_fragment_length) {
3250 if (!TEST_uint_ne(PACKET_remaining(&pkt3), 0)
3251 || !TEST_true(PACKET_get_1(&pkt3, &MFL_code)))
3254 *mfl_codemfl_code = MFL_code;
3263 /* Maximum-Fragment-Length TLS extension mode to test */
3264 static const unsigned char max_fragment_len_test[] = {
3265 TLSEXT_max_fragment_length_512,
3266 TLSEXT_max_fragment_length_1024,
3267 TLSEXT_max_fragment_length_2048,
3268 TLSEXT_max_fragment_length_4096
3271 static int test_max_fragment_len_ext(int idx_tst)
3275 int testresult = 0, MFL_mode = 0;
3278 ctx = SSL_CTX_new(TLS_method());
3282 if (!TEST_true(SSL_CTX_set_tlsext_max_fragment_length(
3283 ctx, max_fragment_len_test[idx_tst])))
3290 rbio = BIO_new(BIO_s_mem());
3291 wbio = BIO_new(BIO_s_mem());
3292 if (!TEST_ptr(rbio)|| !TEST_ptr(wbio)) {
3298 SSL_set_bio(con, rbio, wbio);
3299 SSL_set_connect_state(con);
3301 if (!TEST_int_le(SSL_connect(con), 0)) {
3302 /* This shouldn't succeed because we don't have a server! */
3306 if (!TEST_true(get_MFL_from_client_hello(wbio, &MFL_mode)))
3307 /* no MFL in client hello */
3309 if (!TEST_true(max_fragment_len_test[idx_tst] == MFL_mode))
3321 #ifndef OPENSSL_NO_TLS1_3
3322 static int test_pha_key_update(void)
3324 SSL_CTX *cctx = NULL, *sctx = NULL;
3325 SSL *clientssl = NULL, *serverssl = NULL;
3328 if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
3329 TLS_client_method(),
3330 &sctx, &cctx, cert, privkey)))
3333 if (!TEST_true(SSL_CTX_set_min_proto_version(sctx, TLS1_3_VERSION))
3334 || !TEST_true(SSL_CTX_set_max_proto_version(sctx, TLS1_3_VERSION))
3335 || !TEST_true(SSL_CTX_set_min_proto_version(cctx, TLS1_3_VERSION))
3336 || !TEST_true(SSL_CTX_set_max_proto_version(cctx, TLS1_3_VERSION)))
3340 if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
3344 SSL_force_post_handshake_auth(clientssl);
3346 if (!TEST_true(create_ssl_connection(serverssl, clientssl,
3350 SSL_set_verify(serverssl, SSL_VERIFY_PEER, NULL);
3351 if (!TEST_true(SSL_verify_client_post_handshake(serverssl)))
3354 if (!TEST_true(SSL_key_update(clientssl, SSL_KEY_UPDATE_NOT_REQUESTED)))
3357 /* Start handshake on the server */
3358 if (!TEST_int_eq(SSL_do_handshake(serverssl), 1))
3361 /* Starts with SSL_connect(), but it's really just SSL_do_handshake() */
3362 if (!TEST_true(create_ssl_connection(serverssl, clientssl,
3366 SSL_shutdown(clientssl);
3367 SSL_shutdown(serverssl);
3372 SSL_free(serverssl);
3373 SSL_free(clientssl);
3380 int setup_tests(void)
3382 if (!TEST_ptr(cert = test_get_argument(0))
3383 || !TEST_ptr(privkey = test_get_argument(1)))
3386 ADD_TEST(test_large_message_tls);
3387 ADD_TEST(test_large_message_tls_read_ahead);
3388 #ifndef OPENSSL_NO_DTLS
3389 ADD_TEST(test_large_message_dtls);
3391 #ifndef OPENSSL_NO_OCSP
3392 ADD_TEST(test_tlsext_status_type);
3394 ADD_TEST(test_session_with_only_int_cache);
3395 ADD_TEST(test_session_with_only_ext_cache);
3396 ADD_TEST(test_session_with_both_cache);
3397 ADD_ALL_TESTS(test_ssl_set_bio, TOTAL_SSL_SET_BIO_TESTS);
3398 ADD_TEST(test_ssl_bio_pop_next_bio);
3399 ADD_TEST(test_ssl_bio_pop_ssl_bio);
3400 ADD_TEST(test_ssl_bio_change_rbio);
3401 ADD_TEST(test_ssl_bio_change_wbio);
3402 #if !defined(OPENSSL_NO_TLS1_2) || defined(OPENSSL_NO_TLS1_3)
3403 ADD_ALL_TESTS(test_set_sigalgs, OSSL_NELEM(testsigalgs) * 2);
3404 ADD_TEST(test_keylog);
3406 #ifndef OPENSSL_NO_TLS1_3
3407 ADD_TEST(test_keylog_no_master_key);
3409 #ifndef OPENSSL_NO_TLS1_2
3410 ADD_TEST(test_client_hello_cb);
3412 #ifndef OPENSSL_NO_TLS1_3
3413 ADD_ALL_TESTS(test_early_data_read_write, 3);
3414 ADD_ALL_TESTS(test_early_data_skip, 3);
3415 ADD_ALL_TESTS(test_early_data_skip_hrr, 3);
3416 ADD_ALL_TESTS(test_early_data_not_sent, 3);
3417 ADD_ALL_TESTS(test_early_data_psk, 8);
3418 ADD_ALL_TESTS(test_early_data_not_expected, 3);
3419 # ifndef OPENSSL_NO_TLS1_2
3420 ADD_ALL_TESTS(test_early_data_tls1_2, 3);
3423 #ifndef OPENSSL_NO_TLS1_3
3424 ADD_TEST(test_ciphersuite_change);
3425 ADD_TEST(test_tls13_psk);
3426 ADD_ALL_TESTS(test_custom_exts, 5);
3427 ADD_TEST(test_stateless);
3428 ADD_TEST(test_pha_key_update);
3430 ADD_ALL_TESTS(test_custom_exts, 3);
3432 ADD_ALL_TESTS(test_serverinfo, 8);
3433 ADD_ALL_TESTS(test_export_key_mat, 4);
3434 ADD_ALL_TESTS(test_ssl_clear, 2);
3435 ADD_ALL_TESTS(test_max_fragment_len_ext, OSSL_NELEM(max_fragment_len_test));
3439 void cleanup_tests(void)
3441 bio_s_mempacket_test_free();