From: Matt Caswell Date: Mon, 4 Jul 2016 13:59:06 +0000 (+0100) Subject: Add a DTLS unprocesed records test X-Git-Tag: OpenSSL_1_1_0~128 X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=6fc1748ec65c94c195d02b59556434e36a5f7651;p=oweals%2Fopenssl.git Add a DTLS unprocesed records test Add a test to inject a record from the next epoch during the handshake and make sure it doesn't get processed immediately. Reviewed-by: Richard Levitte --- diff --git a/test/build.info b/test/build.info index 0c51d1e5c8..ec450c2a9b 100644 --- a/test/build.info +++ b/test/build.info @@ -16,7 +16,7 @@ IF[{- !$disabled{tests} -}] packettest asynctest secmemtest srptest memleaktest \ dtlsv1listentest ct_test threadstest afalgtest d2i_test \ ssl_test_ctx_test ssl_test x509aux cipherlist_test asynciotest \ - bioprinttest sslapitest + bioprinttest sslapitest dtlstest SOURCE[aborttest]=aborttest.c INCLUDE[aborttest]=../include @@ -266,6 +266,10 @@ IF[{- !$disabled{tests} -}] SOURCE[sslapitest]=sslapitest.c ssltestlib.c testutil.c INCLUDE[sslapitest]=../include DEPEND[sslapitest]=../libcrypto ../libssl + + SOURCE[dtlstest]=dtlstest.c ssltestlib.c testutil.c + INCLUDE[dtlstest]=../include . + DEPEND[dtlstest]=../libcrypto ../libssl ENDIF {- diff --git a/test/dtlstest.c b/test/dtlstest.c new file mode 100644 index 0000000000..c2aa7ee71a --- /dev/null +++ b/test/dtlstest.c @@ -0,0 +1,130 @@ +/* + * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the OpenSSL license (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html + */ + +#include +#include +#include +#include + +#include "ssltestlib.h" +#include "testutil.h" + +static char *cert = NULL; +static char *privkey = NULL; + + +#define DUMMY_CERT_STATUS_LEN 12 + +unsigned char certstatus[] = { + SSL3_RT_HANDSHAKE, /* Content type */ + 0xfe, 0xfd, /* Record version */ + 0, 1, /* Epoch */ + 0, 0, 0, 0, 0, 0x0f, /* Record sequence number */ + 0, DTLS1_HM_HEADER_LENGTH + DUMMY_CERT_STATUS_LEN - 2, + SSL3_MT_CERTIFICATE_STATUS, /* Cert Status handshake message type */ + 0, 0, DUMMY_CERT_STATUS_LEN, /* Message len */ + 0, 5, /* Message sequence */ + 0, 0, 0, /* Fragment offset */ + 0, 0, DUMMY_CERT_STATUS_LEN - 2, /* Fragment len */ + 0x80, 0x80, 0x80, 0x80, 0x80, + 0x80, 0x80, 0x80, 0x80, 0x80 /* Dummy data */ +}; + +static int test_dtls_unprocessed(void) +{ + SSL_CTX *sctx = NULL, *cctx = NULL; + SSL *serverssl1 = NULL, *clientssl1 = NULL; + BIO *c_to_s_fbio, *c_to_s_mempacket; + int testresult = 0; + + if (!create_ssl_ctx_pair(DTLS_server_method(), DTLS_client_method(), &sctx, + &cctx, cert, privkey)) { + printf("Unable to create SSL_CTX pair\n"); + return 0; + } + + if (!SSL_CTX_set_cipher_list(cctx, "ECDHE-RSA-AES256-SHA384")) { + printf("Failed setting cipher list\n"); + } + + c_to_s_fbio = BIO_new(bio_f_tls_dump_filter()); + if (c_to_s_fbio == NULL) { + printf("Failed to create filter BIO\n"); + goto end; + } + + /* BIO is freed by create_ssl_connection on error */ + if (!create_ssl_objects(sctx, cctx, &serverssl1, &clientssl1, NULL, + c_to_s_fbio)) { + printf("Unable to create SSL objects\n"); + ERR_print_errors_fp(stdout); + goto end; + } + + /* + * Inject a dummy record from the next epoch. This should never get used + * because the message sequence number is too big + */ + c_to_s_mempacket = SSL_get_wbio(clientssl1); + c_to_s_mempacket = BIO_next(c_to_s_mempacket); + mempacket_test_inject(c_to_s_mempacket, (char *)certstatus, + sizeof(certstatus), 1, INJECT_PACKET_IGNORE_REC_SEQ); + + if (!create_ssl_connection(serverssl1, clientssl1)) { + printf("Unable to create SSL connection\n"); + ERR_print_errors_fp(stdout); + goto end; + } + + testresult = 1; + end: + SSL_free(serverssl1); + SSL_free(clientssl1); + SSL_CTX_free(sctx); + SSL_CTX_free(cctx); + + return testresult; +} + +int main(int argc, char *argv[]) +{ + BIO *err = NULL; + int testresult = 1; + + if (argc != 3) { + printf("Invalid argument count\n"); + return 1; + } + + cert = argv[1]; + privkey = argv[2]; + + err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT); + + CRYPTO_set_mem_debug(1); + CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON); + + ADD_TEST(test_dtls_unprocessed); + + testresult = run_tests(argv[0]); + + bio_f_tls_dump_filter_free(); + bio_s_mempacket_test_free(); + +#ifndef OPENSSL_NO_CRYPTO_MDEBUG + if (CRYPTO_mem_leaks(err) <= 0) + testresult = 1; +#endif + BIO_free(err); + + if (!testresult) + printf("PASS\n"); + + return testresult; +} diff --git a/test/recipes/80-test_dtls.t b/test/recipes/80-test_dtls.t new file mode 100644 index 0000000000..008c81774e --- /dev/null +++ b/test/recipes/80-test_dtls.t @@ -0,0 +1,21 @@ +#! /usr/bin/env perl +# Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. +# +# Licensed under the OpenSSL license (the "License"). You may not use +# this file except in compliance with the License. You can obtain a copy +# in the file LICENSE in the source distribution or at +# https://www.openssl.org/source/license.html + +use OpenSSL::Test; +use OpenSSL::Test::Utils; +use OpenSSL::Test qw/:DEFAULT srctop_file/; + +setup("test_dtls"); + +plan skip_all => "No DTLS protocols are supported by this OpenSSL build" + if alldisabled(available_protocols("dtls")); + +plan tests => 1; + +ok(run(test(["dtlstest", srctop_file("apps", "server.pem"), + srctop_file("apps", "server.pem")])), "running dtlstest");